@xylabs/aries 0.1.1

package/dist/actions/index.mjs

@@ -0,0 +1,4615 @@
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/utils.js
+var require_utils = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/utils.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.loadNativeModule = exports.assign = void 0;
+    function assign(target) {
+      var sources = [];
+      for (var _i = 1; _i < arguments.length; _i++) {
+        sources[_i - 1] = arguments[_i];
+      }
+      sources.forEach(function(source) {
+        return Object.keys(source).forEach(function(key) {
+          return target[key] = source[key];
+        });
+      });
+      return target;
+    }
+    exports.assign = assign;
+    function loadNativeModule(name) {
+      var dirs = ["build/Release", "build/Debug", "prebuilds/" + process.platform + "-" + process.arch];
+      var relative = ["..", "."];
+      var lastError;
+      for (var _i = 0, dirs_1 = dirs; _i < dirs_1.length; _i++) {
+        var d = dirs_1[_i];
+        for (var _a = 0, relative_1 = relative; _a < relative_1.length; _a++) {
+          var r = relative_1[_a];
+          var dir = r + "/" + d + "/";
+          try {
+            return { dir, module: __require(dir + "/" + name + ".node") };
+          } catch (e) {
+            lastError = e;
+          }
+        }
+      }
+      throw new Error("Failed to load native module: " + name + ".node, checked: " + dirs.join(", ") + ": " + lastError);
+    }
+    exports.loadNativeModule = loadNativeModule;
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/eventEmitter2.js
+var require_eventEmitter2 = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/eventEmitter2.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.EventEmitter2 = void 0;
+    var EventEmitter2 = (
+      /** @class */
+      (function() {
+        function EventEmitter22() {
+          this._listeners = [];
+        }
+        Object.defineProperty(EventEmitter22.prototype, "event", {
+          get: function() {
+            var _this = this;
+            if (!this._event) {
+              this._event = function(listener) {
+                _this._listeners.push(listener);
+                var disposable = {
+                  dispose: function() {
+                    for (var i = 0; i < _this._listeners.length; i++) {
+                      if (_this._listeners[i] === listener) {
+                        _this._listeners.splice(i, 1);
+                        return;
+                      }
+                    }
+                  }
+                };
+                return disposable;
+              };
+            }
+            return this._event;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        EventEmitter22.prototype.fire = function(data) {
+          var queue = [];
+          for (var i = 0; i < this._listeners.length; i++) {
+            queue.push(this._listeners[i]);
+          }
+          for (var i = 0; i < queue.length; i++) {
+            queue[i].call(void 0, data);
+          }
+        };
+        return EventEmitter22;
+      })()
+    );
+    exports.EventEmitter2 = EventEmitter2;
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/terminal.js
+var require_terminal = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/terminal.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.Terminal = exports.DEFAULT_ROWS = exports.DEFAULT_COLS = void 0;
+    var events_1 = __require("events");
+    var eventEmitter2_1 = require_eventEmitter2();
+    exports.DEFAULT_COLS = 80;
+    exports.DEFAULT_ROWS = 24;
+    var FLOW_CONTROL_PAUSE = "";
+    var FLOW_CONTROL_RESUME = "";
+    var Terminal2 = (
+      /** @class */
+      (function() {
+        function Terminal3(opt) {
+          this._pid = 0;
+          this._fd = 0;
+          this._cols = 0;
+          this._rows = 0;
+          this._readable = false;
+          this._writable = false;
+          this._onData = new eventEmitter2_1.EventEmitter2();
+          this._onExit = new eventEmitter2_1.EventEmitter2();
+          this._internalee = new events_1.EventEmitter();
+          this.handleFlowControl = !!(opt === null || opt === void 0 ? void 0 : opt.handleFlowControl);
+          this._flowControlPause = (opt === null || opt === void 0 ? void 0 : opt.flowControlPause) || FLOW_CONTROL_PAUSE;
+          this._flowControlResume = (opt === null || opt === void 0 ? void 0 : opt.flowControlResume) || FLOW_CONTROL_RESUME;
+          if (!opt) {
+            return;
+          }
+          this._checkType("name", opt.name ? opt.name : void 0, "string");
+          this._checkType("cols", opt.cols ? opt.cols : void 0, "number");
+          this._checkType("rows", opt.rows ? opt.rows : void 0, "number");
+          this._checkType("cwd", opt.cwd ? opt.cwd : void 0, "string");
+          this._checkType("env", opt.env ? opt.env : void 0, "object");
+          this._checkType("uid", opt.uid ? opt.uid : void 0, "number");
+          this._checkType("gid", opt.gid ? opt.gid : void 0, "number");
+          this._checkType("encoding", opt.encoding ? opt.encoding : void 0, "string");
+        }
+        Object.defineProperty(Terminal3.prototype, "onData", {
+          get: function() {
+            return this._onData.event;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(Terminal3.prototype, "onExit", {
+          get: function() {
+            return this._onExit.event;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(Terminal3.prototype, "pid", {
+          get: function() {
+            return this._pid;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(Terminal3.prototype, "cols", {
+          get: function() {
+            return this._cols;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(Terminal3.prototype, "rows", {
+          get: function() {
+            return this._rows;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Terminal3.prototype.write = function(data) {
+          if (this.handleFlowControl) {
+            if (data === this._flowControlPause) {
+              this.pause();
+              return;
+            }
+            if (data === this._flowControlResume) {
+              this.resume();
+              return;
+            }
+          }
+          this._write(data);
+        };
+        Terminal3.prototype._forwardEvents = function() {
+          var _this = this;
+          this.on("data", function(e) {
+            return _this._onData.fire(e);
+          });
+          this.on("exit", function(exitCode, signal) {
+            return _this._onExit.fire({ exitCode, signal });
+          });
+        };
+        Terminal3.prototype._checkType = function(name, value, type, allowArray) {
+          if (allowArray === void 0) {
+            allowArray = false;
+          }
+          if (value === void 0) {
+            return;
+          }
+          if (allowArray) {
+            if (Array.isArray(value)) {
+              value.forEach(function(v, i) {
+                if (typeof v !== type) {
+                  throw new Error(name + "[" + i + "] must be a " + type + " (not a " + typeof v[i] + ")");
+                }
+              });
+              return;
+            }
+          }
+          if (typeof value !== type) {
+            throw new Error(name + " must be a " + type + " (not a " + typeof value + ")");
+          }
+        };
+        Terminal3.prototype.end = function(data) {
+          this._socket.end(data);
+        };
+        Terminal3.prototype.pipe = function(dest, options) {
+          return this._socket.pipe(dest, options);
+        };
+        Terminal3.prototype.pause = function() {
+          return this._socket.pause();
+        };
+        Terminal3.prototype.resume = function() {
+          return this._socket.resume();
+        };
+        Terminal3.prototype.setEncoding = function(encoding) {
+          if (this._socket._decoder) {
+            delete this._socket._decoder;
+          }
+          if (encoding) {
+            this._socket.setEncoding(encoding);
+          }
+        };
+        Terminal3.prototype.addListener = function(eventName, listener) {
+          this.on(eventName, listener);
+        };
+        Terminal3.prototype.on = function(eventName, listener) {
+          if (eventName === "close") {
+            this._internalee.on("close", listener);
+            return;
+          }
+          this._socket.on(eventName, listener);
+        };
+        Terminal3.prototype.emit = function(eventName) {
+          var args = [];
+          for (var _i = 1; _i < arguments.length; _i++) {
+            args[_i - 1] = arguments[_i];
+          }
+          if (eventName === "close") {
+            return this._internalee.emit.apply(this._internalee, arguments);
+          }
+          return this._socket.emit.apply(this._socket, arguments);
+        };
+        Terminal3.prototype.listeners = function(eventName) {
+          return this._socket.listeners(eventName);
+        };
+        Terminal3.prototype.removeListener = function(eventName, listener) {
+          this._socket.removeListener(eventName, listener);
+        };
+        Terminal3.prototype.removeAllListeners = function(eventName) {
+          this._socket.removeAllListeners(eventName);
+        };
+        Terminal3.prototype.once = function(eventName, listener) {
+          this._socket.once(eventName, listener);
+        };
+        Terminal3.prototype._close = function() {
+          this._socket.readable = false;
+          this.write = function() {
+          };
+          this.end = function() {
+          };
+          this._writable = false;
+          this._readable = false;
+        };
+        Terminal3.prototype._parseEnv = function(env) {
+          var keys = Object.keys(env || {});
+          var pairs = [];
+          for (var i = 0; i < keys.length; i++) {
+            if (keys[i] === void 0) {
+              continue;
+            }
+            pairs.push(keys[i] + "=" + env[keys[i]]);
+          }
+          return pairs;
+        };
+        return Terminal3;
+      })()
+    );
+    exports.Terminal = Terminal2;
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/shared/conout.js
+var require_conout = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/shared/conout.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.getWorkerPipeName = void 0;
+    function getWorkerPipeName(conoutPipeName) {
+      return conoutPipeName + "-worker";
+    }
+    exports.getWorkerPipeName = getWorkerPipeName;
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/windowsConoutConnection.js
+var require_windowsConoutConnection = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/windowsConoutConnection.js"(exports) {
+    "use strict";
+    var __awaiter = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
+      function adopt(value) {
+        return value instanceof P ? value : new P(function(resolve) {
+          resolve(value);
+        });
+      }
+      return new (P || (P = Promise))(function(resolve, reject) {
+        function fulfilled(value) {
+          try {
+            step(generator.next(value));
+          } catch (e) {
+            reject(e);
+          }
+        }
+        function rejected(value) {
+          try {
+            step(generator["throw"](value));
+          } catch (e) {
+            reject(e);
+          }
+        }
+        function step(result) {
+          result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+        }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+      });
+    };
+    var __generator = exports && exports.__generator || function(thisArg, body) {
+      var _ = { label: 0, sent: function() {
+        if (t[0] & 1) throw t[1];
+        return t[1];
+      }, trys: [], ops: [] }, f, y, t, g;
+      return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+      }), g;
+      function verb(n) {
+        return function(v) {
+          return step([n, v]);
+        };
+      }
+      function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+          if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+          if (y = 0, t) op = [op[0] & 2, t.value];
+          switch (op[0]) {
+            case 0:
+            case 1:
+              t = op;
+              break;
+            case 4:
+              _.label++;
+              return { value: op[1], done: false };
+            case 5:
+              _.label++;
+              y = op[1];
+              op = [0];
+              continue;
+            case 7:
+              op = _.ops.pop();
+              _.trys.pop();
+              continue;
+            default:
+              if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                _ = 0;
+                continue;
+              }
+              if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                _.label = op[1];
+                break;
+              }
+              if (op[0] === 6 && _.label < t[1]) {
+                _.label = t[1];
+                t = op;
+                break;
+              }
+              if (t && _.label < t[2]) {
+                _.label = t[2];
+                _.ops.push(op);
+                break;
+              }
+              if (t[2]) _.ops.pop();
+              _.trys.pop();
+              continue;
+          }
+          op = body.call(thisArg, _);
+        } catch (e) {
+          op = [6, e];
+          y = 0;
+        } finally {
+          f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return { value: op[0] ? op[1] : void 0, done: true };
+      }
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ConoutConnection = void 0;
+    var worker_threads_1 = __require("worker_threads");
+    var conout_1 = require_conout();
+    var path_1 = __require("path");
+    var eventEmitter2_1 = require_eventEmitter2();
+    var FLUSH_DATA_INTERVAL = 1e3;
+    var ConoutConnection = (
+      /** @class */
+      (function() {
+        function ConoutConnection2(_conoutPipeName, _useConptyDll) {
+          var _this = this;
+          this._conoutPipeName = _conoutPipeName;
+          this._useConptyDll = _useConptyDll;
+          this._isDisposed = false;
+          this._onReady = new eventEmitter2_1.EventEmitter2();
+          var workerData = {
+            conoutPipeName: _conoutPipeName
+          };
+          var scriptPath = __dirname.replace("node_modules.asar", "node_modules.asar.unpacked");
+          this._worker = new worker_threads_1.Worker(path_1.join(scriptPath, "worker/conoutSocketWorker.js"), { workerData });
+          this._worker.on("message", function(message) {
+            switch (message) {
+              case 1:
+                _this._onReady.fire();
+                return;
+              default:
+                console.warn("Unexpected ConoutWorkerMessage", message);
+            }
+          });
+        }
+        Object.defineProperty(ConoutConnection2.prototype, "onReady", {
+          get: function() {
+            return this._onReady.event;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        ConoutConnection2.prototype.dispose = function() {
+          if (!this._useConptyDll && this._isDisposed) {
+            return;
+          }
+          this._isDisposed = true;
+          this._drainDataAndClose();
+        };
+        ConoutConnection2.prototype.connectSocket = function(socket) {
+          socket.connect(conout_1.getWorkerPipeName(this._conoutPipeName));
+        };
+        ConoutConnection2.prototype._drainDataAndClose = function() {
+          var _this = this;
+          if (this._drainTimeout) {
+            clearTimeout(this._drainTimeout);
+          }
+          this._drainTimeout = setTimeout(function() {
+            return _this._destroySocket();
+          }, FLUSH_DATA_INTERVAL);
+        };
+        ConoutConnection2.prototype._destroySocket = function() {
+          return __awaiter(this, void 0, void 0, function() {
+            return __generator(this, function(_a) {
+              switch (_a.label) {
+                case 0:
+                  return [4, this._worker.terminate()];
+                case 1:
+                  _a.sent();
+                  return [
+                    2
+                    /*return*/
+                  ];
+              }
+            });
+          });
+        };
+        return ConoutConnection2;
+      })()
+    );
+    exports.ConoutConnection = ConoutConnection;
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/windowsPtyAgent.js
+var require_windowsPtyAgent = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/windowsPtyAgent.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.argsToCommandLine = exports.WindowsPtyAgent = void 0;
+    var fs = __require("fs");
+    var os = __require("os");
+    var path13 = __require("path");
+    var child_process_1 = __require("child_process");
+    var net_1 = __require("net");
+    var windowsConoutConnection_1 = require_windowsConoutConnection();
+    var utils_1 = require_utils();
+    var conptyNative;
+    var winptyNative;
+    var FLUSH_DATA_INTERVAL = 1e3;
+    var WindowsPtyAgent = (
+      /** @class */
+      (function() {
+        function WindowsPtyAgent2(file, args, env, cwd, cols, rows, debug, _useConpty, _useConptyDll, conptyInheritCursor) {
+          var _this = this;
+          if (_useConptyDll === void 0) {
+            _useConptyDll = false;
+          }
+          if (conptyInheritCursor === void 0) {
+            conptyInheritCursor = false;
+          }
+          this._useConpty = _useConpty;
+          this._useConptyDll = _useConptyDll;
+          this._pid = 0;
+          this._innerPid = 0;
+          if (this._useConpty === void 0 || this._useConpty === true) {
+            this._useConpty = this._getWindowsBuildNumber() >= 18309;
+          }
+          if (this._useConpty) {
+            if (!conptyNative) {
+              conptyNative = utils_1.loadNativeModule("conpty").module;
+            }
+          } else {
+            if (!winptyNative) {
+              winptyNative = utils_1.loadNativeModule("pty").module;
+            }
+          }
+          this._ptyNative = this._useConpty ? conptyNative : winptyNative;
+          cwd = path13.resolve(cwd);
+          var commandLine = argsToCommandLine(file, args);
+          var term;
+          if (this._useConpty) {
+            term = this._ptyNative.startProcess(file, cols, rows, debug, this._generatePipeName(), conptyInheritCursor, this._useConptyDll);
+          } else {
+            term = this._ptyNative.startProcess(file, commandLine, env, cwd, cols, rows, debug);
+            this._pid = term.pid;
+            this._innerPid = term.innerPid;
+          }
+          this._fd = term.fd;
+          this._pty = term.pty;
+          this._outSocket = new net_1.Socket();
+          this._outSocket.setEncoding("utf8");
+          this._conoutSocketWorker = new windowsConoutConnection_1.ConoutConnection(term.conout, this._useConptyDll);
+          this._conoutSocketWorker.onReady(function() {
+            _this._conoutSocketWorker.connectSocket(_this._outSocket);
+          });
+          this._outSocket.on("connect", function() {
+            _this._outSocket.emit("ready_datapipe");
+          });
+          var inSocketFD = fs.openSync(term.conin, "w");
+          this._inSocket = new net_1.Socket({
+            fd: inSocketFD,
+            readable: false,
+            writable: true
+          });
+          this._inSocket.setEncoding("utf8");
+          if (this._useConpty) {
+            var connect = this._ptyNative.connect(this._pty, commandLine, cwd, env, this._useConptyDll, function(c) {
+              return _this._$onProcessExit(c);
+            });
+            this._innerPid = connect.pid;
+          }
+        }
+        Object.defineProperty(WindowsPtyAgent2.prototype, "inSocket", {
+          get: function() {
+            return this._inSocket;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(WindowsPtyAgent2.prototype, "outSocket", {
+          get: function() {
+            return this._outSocket;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(WindowsPtyAgent2.prototype, "fd", {
+          get: function() {
+            return this._fd;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(WindowsPtyAgent2.prototype, "innerPid", {
+          get: function() {
+            return this._innerPid;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(WindowsPtyAgent2.prototype, "pty", {
+          get: function() {
+            return this._pty;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        WindowsPtyAgent2.prototype.resize = function(cols, rows) {
+          if (this._useConpty) {
+            if (this._exitCode !== void 0) {
+              throw new Error("Cannot resize a pty that has already exited");
+            }
+            this._ptyNative.resize(this._pty, cols, rows, this._useConptyDll);
+            return;
+          }
+          this._ptyNative.resize(this._pid, cols, rows);
+        };
+        WindowsPtyAgent2.prototype.clear = function() {
+          if (this._useConpty) {
+            this._ptyNative.clear(this._pty, this._useConptyDll);
+          }
+        };
+        WindowsPtyAgent2.prototype.kill = function() {
+          var _this = this;
+          if (this._useConpty) {
+            if (!this._useConptyDll) {
+              this._inSocket.readable = false;
+              this._outSocket.readable = false;
+              this._getConsoleProcessList().then(function(consoleProcessList) {
+                consoleProcessList.forEach(function(pid) {
+                  try {
+                    process.kill(pid);
+                  } catch (e) {
+                  }
+                });
+              });
+              this._ptyNative.kill(this._pty, this._useConptyDll);
+              this._conoutSocketWorker.dispose();
+            } else {
+              this._inSocket.destroy();
+              this._ptyNative.kill(this._pty, this._useConptyDll);
+              this._outSocket.on("data", function() {
+                _this._conoutSocketWorker.dispose();
+              });
+            }
+          } else {
+            var processList = this._ptyNative.getProcessList(this._pid);
+            this._ptyNative.kill(this._pid, this._innerPid);
+            processList.forEach(function(pid) {
+              try {
+                process.kill(pid);
+              } catch (e) {
+              }
+            });
+          }
+        };
+        WindowsPtyAgent2.prototype._getConsoleProcessList = function() {
+          var _this = this;
+          return new Promise(function(resolve) {
+            var agent = child_process_1.fork(path13.join(__dirname, "conpty_console_list_agent"), [_this._innerPid.toString()]);
+            agent.on("message", function(message) {
+              clearTimeout(timeout);
+              resolve(message.consoleProcessList);
+            });
+            var timeout = setTimeout(function() {
+              agent.kill();
+              resolve([_this._innerPid]);
+            }, 5e3);
+          });
+        };
+        Object.defineProperty(WindowsPtyAgent2.prototype, "exitCode", {
+          get: function() {
+            if (this._useConpty) {
+              return this._exitCode;
+            }
+            var winptyExitCode = this._ptyNative.getExitCode(this._innerPid);
+            return winptyExitCode === -1 ? void 0 : winptyExitCode;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        WindowsPtyAgent2.prototype._getWindowsBuildNumber = function() {
+          var osVersion = /(\d+)\.(\d+)\.(\d+)/g.exec(os.release());
+          var buildNumber = 0;
+          if (osVersion && osVersion.length === 4) {
+            buildNumber = parseInt(osVersion[3]);
+          }
+          return buildNumber;
+        };
+        WindowsPtyAgent2.prototype._generatePipeName = function() {
+          return "conpty-" + Math.random() * 1e7;
+        };
+        WindowsPtyAgent2.prototype._$onProcessExit = function(exitCode) {
+          var _this = this;
+          this._exitCode = exitCode;
+          if (!this._useConptyDll) {
+            this._flushDataAndCleanUp();
+            this._outSocket.on("data", function() {
+              return _this._flushDataAndCleanUp();
+            });
+          }
+        };
+        WindowsPtyAgent2.prototype._flushDataAndCleanUp = function() {
+          var _this = this;
+          if (this._useConptyDll) {
+            return;
+          }
+          if (this._closeTimeout) {
+            clearTimeout(this._closeTimeout);
+          }
+          this._closeTimeout = setTimeout(function() {
+            return _this._cleanUpProcess();
+          }, FLUSH_DATA_INTERVAL);
+        };
+        WindowsPtyAgent2.prototype._cleanUpProcess = function() {
+          if (this._useConptyDll) {
+            return;
+          }
+          this._inSocket.readable = false;
+          this._outSocket.readable = false;
+          this._outSocket.destroy();
+        };
+        return WindowsPtyAgent2;
+      })()
+    );
+    exports.WindowsPtyAgent = WindowsPtyAgent;
+    function argsToCommandLine(file, args) {
+      if (isCommandLine(args)) {
+        if (args.length === 0) {
+          return file;
+        }
+        return argsToCommandLine(file, []) + " " + args;
+      }
+      var argv = [file];
+      Array.prototype.push.apply(argv, args);
+      var result = "";
+      for (var argIndex = 0; argIndex < argv.length; argIndex++) {
+        if (argIndex > 0) {
+          result += " ";
+        }
+        var arg = argv[argIndex];
+        var hasLopsidedEnclosingQuote = xOr(arg[0] !== '"', arg[arg.length - 1] !== '"');
+        var hasNoEnclosingQuotes = arg[0] !== '"' && arg[arg.length - 1] !== '"';
+        var quote = arg === "" || (arg.indexOf(" ") !== -1 || arg.indexOf("	") !== -1) && (arg.length > 1 && (hasLopsidedEnclosingQuote || hasNoEnclosingQuotes));
+        if (quote) {
+          result += '"';
+        }
+        var bsCount = 0;
+        for (var i = 0; i < arg.length; i++) {
+          var p = arg[i];
+          if (p === "\\") {
+            bsCount++;
+          } else if (p === '"') {
+            result += repeatText("\\", bsCount * 2 + 1);
+            result += '"';
+            bsCount = 0;
+          } else {
+            result += repeatText("\\", bsCount);
+            bsCount = 0;
+            result += p;
+          }
+        }
+        if (quote) {
+          result += repeatText("\\", bsCount * 2);
+          result += '"';
+        } else {
+          result += repeatText("\\", bsCount);
+        }
+      }
+      return result;
+    }
+    exports.argsToCommandLine = argsToCommandLine;
+    function isCommandLine(args) {
+      return typeof args === "string";
+    }
+    function repeatText(text, count) {
+      var result = "";
+      for (var i = 0; i < count; i++) {
+        result += text;
+      }
+      return result;
+    }
+    function xOr(arg1, arg2) {
+      return arg1 && !arg2 || !arg1 && arg2;
+    }
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/windowsTerminal.js
+var require_windowsTerminal = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/windowsTerminal.js"(exports) {
+    "use strict";
+    var __extends = exports && exports.__extends || /* @__PURE__ */ (function() {
+      var extendStatics = function(d, b) {
+        extendStatics = Object.setPrototypeOf || { __proto__: [] } instanceof Array && function(d2, b2) {
+          d2.__proto__ = b2;
+        } || function(d2, b2) {
+          for (var p in b2) if (b2.hasOwnProperty(p)) d2[p] = b2[p];
+        };
+        return extendStatics(d, b);
+      };
+      return function(d, b) {
+        extendStatics(d, b);
+        function __() {
+          this.constructor = d;
+        }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.WindowsTerminal = void 0;
+    var terminal_1 = require_terminal();
+    var windowsPtyAgent_1 = require_windowsPtyAgent();
+    var utils_1 = require_utils();
+    var DEFAULT_FILE = "cmd.exe";
+    var DEFAULT_NAME = "Windows Shell";
+    var WindowsTerminal = (
+      /** @class */
+      (function(_super) {
+        __extends(WindowsTerminal2, _super);
+        function WindowsTerminal2(file, args, opt) {
+          var _this = _super.call(this, opt) || this;
+          _this._checkType("args", args, "string", true);
+          args = args || [];
+          file = file || DEFAULT_FILE;
+          opt = opt || {};
+          opt.env = opt.env || process.env;
+          if (opt.encoding) {
+            console.warn("Setting encoding on Windows is not supported");
+          }
+          var env = utils_1.assign({}, opt.env);
+          _this._cols = opt.cols || terminal_1.DEFAULT_COLS;
+          _this._rows = opt.rows || terminal_1.DEFAULT_ROWS;
+          var cwd = opt.cwd || process.cwd();
+          var name = opt.name || env.TERM || DEFAULT_NAME;
+          var parsedEnv = _this._parseEnv(env);
+          _this._isReady = false;
+          _this._deferreds = [];
+          _this._agent = new windowsPtyAgent_1.WindowsPtyAgent(file, args, parsedEnv, cwd, _this._cols, _this._rows, false, opt.useConpty, opt.useConptyDll, opt.conptyInheritCursor);
+          _this._socket = _this._agent.outSocket;
+          _this._pid = _this._agent.innerPid;
+          _this._fd = _this._agent.fd;
+          _this._pty = _this._agent.pty;
+          _this._socket.on("ready_datapipe", function() {
+            _this._socket.once("data", function() {
+              if (!_this._isReady) {
+                _this._isReady = true;
+                _this._deferreds.forEach(function(fn) {
+                  fn.run();
+                });
+                _this._deferreds = [];
+              }
+            });
+            _this._socket.on("error", function(err) {
+              _this._close();
+              if (err.code) {
+                if (~err.code.indexOf("errno 5") || ~err.code.indexOf("EIO"))
+                  return;
+              }
+              if (_this.listeners("error").length < 2) {
+                throw err;
+              }
+            });
+            _this._socket.on("close", function() {
+              _this.emit("exit", _this._agent.exitCode);
+              _this._close();
+            });
+          });
+          _this._file = file;
+          _this._name = name;
+          _this._readable = true;
+          _this._writable = true;
+          _this._forwardEvents();
+          return _this;
+        }
+        WindowsTerminal2.prototype._write = function(data) {
+          this._defer(this._doWrite, data);
+        };
+        WindowsTerminal2.prototype._doWrite = function(data) {
+          this._agent.inSocket.write(data);
+        };
+        WindowsTerminal2.open = function(options) {
+          throw new Error("open() not supported on windows, use Fork() instead.");
+        };
+        WindowsTerminal2.prototype.resize = function(cols, rows) {
+          var _this = this;
+          if (cols <= 0 || rows <= 0 || isNaN(cols) || isNaN(rows) || cols === Infinity || rows === Infinity) {
+            throw new Error("resizing must be done using positive cols and rows");
+          }
+          this._deferNoArgs(function() {
+            _this._agent.resize(cols, rows);
+            _this._cols = cols;
+            _this._rows = rows;
+          });
+        };
+        WindowsTerminal2.prototype.clear = function() {
+          var _this = this;
+          this._deferNoArgs(function() {
+            _this._agent.clear();
+          });
+        };
+        WindowsTerminal2.prototype.destroy = function() {
+          var _this = this;
+          this._deferNoArgs(function() {
+            _this.kill();
+          });
+        };
+        WindowsTerminal2.prototype.kill = function(signal) {
+          var _this = this;
+          this._deferNoArgs(function() {
+            if (signal) {
+              throw new Error("Signals not supported on windows.");
+            }
+            _this._close();
+            _this._agent.kill();
+          });
+        };
+        WindowsTerminal2.prototype._deferNoArgs = function(deferredFn) {
+          var _this = this;
+          if (this._isReady) {
+            deferredFn.call(this);
+            return;
+          }
+          this._deferreds.push({
+            run: function() {
+              return deferredFn.call(_this);
+            }
+          });
+        };
+        WindowsTerminal2.prototype._defer = function(deferredFn, arg) {
+          var _this = this;
+          if (this._isReady) {
+            deferredFn.call(this, arg);
+            return;
+          }
+          this._deferreds.push({
+            run: function() {
+              return deferredFn.call(_this, arg);
+            }
+          });
+        };
+        Object.defineProperty(WindowsTerminal2.prototype, "process", {
+          get: function() {
+            return this._name;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(WindowsTerminal2.prototype, "master", {
+          get: function() {
+            throw new Error("master is not supported on Windows");
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(WindowsTerminal2.prototype, "slave", {
+          get: function() {
+            throw new Error("slave is not supported on Windows");
+          },
+          enumerable: false,
+          configurable: true
+        });
+        return WindowsTerminal2;
+      })(terminal_1.Terminal)
+    );
+    exports.WindowsTerminal = WindowsTerminal;
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/unixTerminal.js
+var require_unixTerminal = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/unixTerminal.js"(exports) {
+    "use strict";
+    var __extends = exports && exports.__extends || /* @__PURE__ */ (function() {
+      var extendStatics = function(d, b) {
+        extendStatics = Object.setPrototypeOf || { __proto__: [] } instanceof Array && function(d2, b2) {
+          d2.__proto__ = b2;
+        } || function(d2, b2) {
+          for (var p in b2) if (b2.hasOwnProperty(p)) d2[p] = b2[p];
+        };
+        return extendStatics(d, b);
+      };
+      return function(d, b) {
+        extendStatics(d, b);
+        function __() {
+          this.constructor = d;
+        }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.UnixTerminal = void 0;
+    var fs = __require("fs");
+    var path13 = __require("path");
+    var tty = __require("tty");
+    var terminal_1 = require_terminal();
+    var utils_1 = require_utils();
+    var native = utils_1.loadNativeModule("pty");
+    var pty = native.module;
+    var helperPath = native.dir + "/spawn-helper";
+    helperPath = path13.resolve(__dirname, helperPath);
+    helperPath = helperPath.replace("app.asar", "app.asar.unpacked");
+    helperPath = helperPath.replace("node_modules.asar", "node_modules.asar.unpacked");
+    var DEFAULT_FILE = "sh";
+    var DEFAULT_NAME = "xterm";
+    var DESTROY_SOCKET_TIMEOUT_MS = 200;
+    var UnixTerminal = (
+      /** @class */
+      (function(_super) {
+        __extends(UnixTerminal2, _super);
+        function UnixTerminal2(file, args, opt) {
+          var _a, _b;
+          var _this = _super.call(this, opt) || this;
+          _this._boundClose = false;
+          _this._emittedClose = false;
+          if (typeof args === "string") {
+            throw new Error("args as a string is not supported on unix.");
+          }
+          args = args || [];
+          file = file || DEFAULT_FILE;
+          opt = opt || {};
+          opt.env = opt.env || process.env;
+          _this._cols = opt.cols || terminal_1.DEFAULT_COLS;
+          _this._rows = opt.rows || terminal_1.DEFAULT_ROWS;
+          var uid = (_a = opt.uid) !== null && _a !== void 0 ? _a : -1;
+          var gid = (_b = opt.gid) !== null && _b !== void 0 ? _b : -1;
+          var env = utils_1.assign({}, opt.env);
+          if (opt.env === process.env) {
+            _this._sanitizeEnv(env);
+          }
+          var cwd = opt.cwd || process.cwd();
+          env.PWD = cwd;
+          var name = opt.name || env.TERM || DEFAULT_NAME;
+          env.TERM = name;
+          var parsedEnv = _this._parseEnv(env);
+          var encoding = opt.encoding === void 0 ? "utf8" : opt.encoding;
+          var onexit = function(code, signal) {
+            if (!_this._emittedClose) {
+              if (_this._boundClose) {
+                return;
+              }
+              _this._boundClose = true;
+              var timeout_1 = setTimeout(function() {
+                timeout_1 = null;
+                _this._socket.destroy();
+              }, DESTROY_SOCKET_TIMEOUT_MS);
+              _this.once("close", function() {
+                if (timeout_1 !== null) {
+                  clearTimeout(timeout_1);
+                }
+                _this.emit("exit", code, signal);
+              });
+              return;
+            }
+            _this.emit("exit", code, signal);
+          };
+          var term = pty.fork(file, args, parsedEnv, cwd, _this._cols, _this._rows, uid, gid, encoding === "utf8", helperPath, onexit);
+          _this._socket = new tty.ReadStream(term.fd);
+          if (encoding !== null) {
+            _this._socket.setEncoding(encoding);
+          }
+          _this._writeStream = new CustomWriteStream(term.fd, encoding || void 0);
+          _this._socket.on("error", function(err) {
+            if (err.code) {
+              if (~err.code.indexOf("EAGAIN")) {
+                return;
+              }
+            }
+            _this._close();
+            if (!_this._emittedClose) {
+              _this._emittedClose = true;
+              _this.emit("close");
+            }
+            if (err.code) {
+              if (~err.code.indexOf("errno 5") || ~err.code.indexOf("EIO")) {
+                return;
+              }
+            }
+            if (_this.listeners("error").length < 2) {
+              throw err;
+            }
+          });
+          _this._pid = term.pid;
+          _this._fd = term.fd;
+          _this._pty = term.pty;
+          _this._file = file;
+          _this._name = name;
+          _this._readable = true;
+          _this._writable = true;
+          _this._socket.on("close", function() {
+            if (_this._emittedClose) {
+              return;
+            }
+            _this._emittedClose = true;
+            _this._close();
+            _this.emit("close");
+          });
+          _this._forwardEvents();
+          return _this;
+        }
+        Object.defineProperty(UnixTerminal2.prototype, "master", {
+          get: function() {
+            return this._master;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(UnixTerminal2.prototype, "slave", {
+          get: function() {
+            return this._slave;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        UnixTerminal2.prototype._write = function(data) {
+          this._writeStream.write(data);
+        };
+        Object.defineProperty(UnixTerminal2.prototype, "fd", {
+          /* Accessors */
+          get: function() {
+            return this._fd;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        Object.defineProperty(UnixTerminal2.prototype, "ptsName", {
+          get: function() {
+            return this._pty;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        UnixTerminal2.open = function(opt) {
+          var self = Object.create(UnixTerminal2.prototype);
+          opt = opt || {};
+          if (arguments.length > 1) {
+            opt = {
+              cols: arguments[1],
+              rows: arguments[2]
+            };
+          }
+          var cols = opt.cols || terminal_1.DEFAULT_COLS;
+          var rows = opt.rows || terminal_1.DEFAULT_ROWS;
+          var encoding = opt.encoding === void 0 ? "utf8" : opt.encoding;
+          var term = pty.open(cols, rows);
+          self._master = new tty.ReadStream(term.master);
+          if (encoding !== null) {
+            self._master.setEncoding(encoding);
+          }
+          self._master.resume();
+          self._slave = new tty.ReadStream(term.slave);
+          if (encoding !== null) {
+            self._slave.setEncoding(encoding);
+          }
+          self._slave.resume();
+          self._socket = self._master;
+          self._pid = -1;
+          self._fd = term.master;
+          self._pty = term.pty;
+          self._file = process.argv[0] || "node";
+          self._name = process.env.TERM || "";
+          self._readable = true;
+          self._writable = true;
+          self._socket.on("error", function(err) {
+            self._close();
+            if (self.listeners("error").length < 2) {
+              throw err;
+            }
+          });
+          self._socket.on("close", function() {
+            self._close();
+          });
+          return self;
+        };
+        UnixTerminal2.prototype.destroy = function() {
+          var _this = this;
+          this._close();
+          this._socket.once("close", function() {
+            _this.kill("SIGHUP");
+          });
+          this._socket.destroy();
+          this._writeStream.dispose();
+        };
+        UnixTerminal2.prototype.kill = function(signal) {
+          try {
+            process.kill(this.pid, signal || "SIGHUP");
+          } catch (e) {
+          }
+        };
+        Object.defineProperty(UnixTerminal2.prototype, "process", {
+          /**
+           * Gets the name of the process.
+           */
+          get: function() {
+            if (process.platform === "darwin") {
+              var title = pty.process(this._fd);
+              return title !== "kernel_task" ? title : this._file;
+            }
+            return pty.process(this._fd, this._pty) || this._file;
+          },
+          enumerable: false,
+          configurable: true
+        });
+        UnixTerminal2.prototype.resize = function(cols, rows) {
+          if (cols <= 0 || rows <= 0 || isNaN(cols) || isNaN(rows) || cols === Infinity || rows === Infinity) {
+            throw new Error("resizing must be done using positive cols and rows");
+          }
+          pty.resize(this._fd, cols, rows);
+          this._cols = cols;
+          this._rows = rows;
+        };
+        UnixTerminal2.prototype.clear = function() {
+        };
+        UnixTerminal2.prototype._sanitizeEnv = function(env) {
+          delete env["TMUX"];
+          delete env["TMUX_PANE"];
+          delete env["STY"];
+          delete env["WINDOW"];
+          delete env["WINDOWID"];
+          delete env["TERMCAP"];
+          delete env["COLUMNS"];
+          delete env["LINES"];
+        };
+        return UnixTerminal2;
+      })(terminal_1.Terminal)
+    );
+    exports.UnixTerminal = UnixTerminal;
+    var CustomWriteStream = (
+      /** @class */
+      (function() {
+        function CustomWriteStream2(_fd, _encoding) {
+          this._fd = _fd;
+          this._encoding = _encoding;
+          this._writeQueue = [];
+        }
+        CustomWriteStream2.prototype.dispose = function() {
+          clearImmediate(this._writeImmediate);
+          this._writeImmediate = void 0;
+        };
+        CustomWriteStream2.prototype.write = function(data) {
+          var buffer = typeof data === "string" ? Buffer.from(data, this._encoding) : Buffer.from(data);
+          if (buffer.byteLength !== 0) {
+            this._writeQueue.push({ buffer, offset: 0 });
+            if (this._writeQueue.length === 1) {
+              this._processWriteQueue();
+            }
+          }
+        };
+        CustomWriteStream2.prototype._processWriteQueue = function() {
+          var _this = this;
+          this._writeImmediate = void 0;
+          if (this._writeQueue.length === 0) {
+            return;
+          }
+          var task = this._writeQueue[0];
+          fs.write(this._fd, task.buffer, task.offset, function(err, written) {
+            if (err) {
+              if ("code" in err && err.code === "EAGAIN") {
+                _this._writeImmediate = setImmediate(function() {
+                  return _this._processWriteQueue();
+                });
+              } else {
+                _this._writeQueue.length = 0;
+                console.error("Unhandled pty write error", err);
+              }
+              return;
+            }
+            task.offset += written;
+            if (task.offset >= task.buffer.byteLength) {
+              _this._writeQueue.shift();
+            }
+            _this._processWriteQueue();
+          });
+        };
+        return CustomWriteStream2;
+      })()
+    );
+  }
+});
+
+// ../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/index.js
+var require_lib = __commonJS({
+  "../../node_modules/.pnpm/node-pty@1.1.0/node_modules/node-pty/lib/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.native = exports.open = exports.createTerminal = exports.fork = exports.spawn = void 0;
+    var utils_1 = require_utils();
+    var terminalCtor;
+    if (process.platform === "win32") {
+      terminalCtor = require_windowsTerminal().WindowsTerminal;
+    } else {
+      terminalCtor = require_unixTerminal().UnixTerminal;
+    }
+    function spawn2(file, args, opt) {
+      return new terminalCtor(file, args, opt);
+    }
+    exports.spawn = spawn2;
+    function fork(file, args, opt) {
+      return new terminalCtor(file, args, opt);
+    }
+    exports.fork = fork;
+    function createTerminal(file, args, opt) {
+      return new terminalCtor(file, args, opt);
+    }
+    exports.createTerminal = createTerminal;
+    function open(options) {
+      return terminalCtor.open(options);
+    }
+    exports.open = open;
+    exports.native = process.platform !== "win32" ? utils_1.loadNativeModule("pty").module : null;
+  }
+});
+
+// src/actions/audit/installPlugin.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import path from "path";
+import chalk from "chalk";
+function findMonorepoRoot(startDir) {
+  let dir = startDir;
+  while (dir !== path.dirname(dir)) {
+    if (existsSync(path.join(dir, "pnpm-workspace.yaml"))) return dir;
+    dir = path.dirname(dir);
+  }
+  return void 0;
+}
+function getRepoRoot() {
+  const root = findMonorepoRoot(process.cwd());
+  if (!root) throw new Error("Could not find monorepo root (pnpm-workspace.yaml)");
+  return root;
+}
+function resolveClaudeHooksDist() {
+  return path.join(getRepoRoot(), "packages", "audit-plugin", "dist", "hooks");
+}
+function getClaudeSettingsPath() {
+  return path.join(homedir(), ".claude", "settings.json");
+}
+function readClaudeSettings() {
+  const settingsPath = getClaudeSettingsPath();
+  if (!existsSync(settingsPath)) return {};
+  const raw = readFileSync(settingsPath, "utf8");
+  return JSON.parse(raw);
+}
+function writeClaudeSettings(settings) {
+  const settingsPath = getClaudeSettingsPath();
+  mkdirSync(path.dirname(settingsPath), { recursive: true });
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+}
+function buildClaudeHooks(hooksDir) {
+  return {
+    SessionStart: [
+      {
+        matcher: "",
+        hooks: [{
+          type: "command",
+          command: `node ${hooksDir}/session-start.mjs`,
+          timeout: 5
+        }]
+      }
+    ],
+    UserPromptSubmit: [
+      {
+        matcher: "",
+        hooks: [{
+          type: "command",
+          command: `node ${hooksDir}/user-prompt-submit.mjs`,
+          timeout: 5
+        }]
+      }
+    ],
+    PostToolUse: [
+      {
+        matcher: "",
+        hooks: [{
+          type: "command",
+          command: `node ${hooksDir}/post-tool-use.mjs`,
+          timeout: 5
+        }]
+      }
+    ],
+    Stop: [
+      {
+        matcher: "",
+        hooks: [{
+          type: "command",
+          command: `node ${hooksDir}/stop.mjs`,
+          timeout: 5
+        }]
+      }
+    ]
+  };
+}
+function getCodexConfigPath() {
+  return path.join(homedir(), ".codex", "config.toml");
+}
+function getCodexHooksPath() {
+  return path.join(getRepoRoot(), ".codex", "hooks.json");
+}
+function readCodexConfig() {
+  const configPath = getCodexConfigPath();
+  if (!existsSync(configPath)) return "";
+  return readFileSync(configPath, "utf8");
+}
+function writeCodexConfig(config) {
+  const configPath = getCodexConfigPath();
+  mkdirSync(path.dirname(configPath), { recursive: true });
+  writeFileSync(configPath, config, "utf8");
+}
+function enableCodexHooksFeature() {
+  const config = readCodexConfig();
+  const lines = config === "" ? [] : config.split("\n");
+  const featuresIndex = lines.findIndex((line) => line.trim() === "[features]");
+  if (featuresIndex === -1) {
+    const separator = config === "" || config.endsWith("\n\n") || config.endsWith("\n") ? "" : "\n";
+    writeCodexConfig(config + separator + "[features]\ncodex_hooks = true\n");
+    return;
+  }
+  const sectionEnd = lines.findIndex(
+    (line, index) => index > featuresIndex && /^\s*\[.*\]\s*$/.test(line)
+  );
+  const endIndex = sectionEnd === -1 ? lines.length : sectionEnd;
+  const codexHooksIndex = lines.findIndex(
+    (line, index) => index > featuresIndex && index < endIndex && /^\s*codex_hooks\s*=/.test(line)
+  );
+  if (codexHooksIndex === -1) {
+    lines.splice(endIndex, 0, "codex_hooks = true");
+  } else {
+    lines[codexHooksIndex] = "codex_hooks = true";
+  }
+  writeCodexConfig(lines.join("\n"));
+}
+function readCodexHooks() {
+  const hooksPath = getCodexHooksPath();
+  if (!existsSync(hooksPath)) return {};
+  return JSON.parse(readFileSync(hooksPath, "utf8"));
+}
+function writeCodexHooks(config) {
+  const hooksPath = getCodexHooksPath();
+  mkdirSync(path.dirname(hooksPath), { recursive: true });
+  writeFileSync(hooksPath, JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+function buildCodexHookCommand(eventName) {
+  const recorderPath = path.join(getRepoRoot(), "packages", "audit-plugin", "dist", "codex", "record-event.mjs");
+  return `node "${recorderPath}" ${eventName}`;
+}
+function buildCodexHooks() {
+  return {
+    PostToolUse: [
+      {
+        hooks: [
+          {
+            command: buildCodexHookCommand("PostToolUse"),
+            statusMessage: "Recording Codex audit entry",
+            type: "command"
+          }
+        ],
+        matcher: "Bash"
+      }
+    ],
+    SessionStart: [
+      {
+        hooks: [
+          {
+            command: buildCodexHookCommand("SessionStart"),
+            statusMessage: "Recording Codex audit entry",
+            type: "command"
+          }
+        ],
+        matcher: "startup|resume"
+      }
+    ],
+    Stop: [
+      {
+        hooks: [
+          {
+            command: buildCodexHookCommand("Stop"),
+            statusMessage: "Recording Codex audit entry",
+            type: "command"
+          }
+        ]
+      }
+    ],
+    UserPromptSubmit: [
+      {
+        hooks: [
+          {
+            command: buildCodexHookCommand("UserPromptSubmit"),
+            statusMessage: "Recording Codex audit entry",
+            type: "command"
+          }
+        ]
+      }
+    ]
+  };
+}
+function isManagedCodexHook(hook) {
+  return hook.command.includes(path.join("packages", "audit-plugin", "dist", "codex", "record-event.mjs"));
+}
+function mergeCodexHooks(existing) {
+  const mergedHooks = existing.hooks ? { ...existing.hooks } : {};
+  const managedHooks = buildCodexHooks();
+  for (const [eventName, groups] of Object.entries(managedHooks)) {
+    const remaining = (mergedHooks[eventName] ?? []).map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((hook) => !isManagedCodexHook(hook))
+    })).filter((group) => group.hooks.length > 0);
+    mergedHooks[eventName] = [...remaining, ...groups];
+  }
+  return { hooks: mergedHooks };
+}
+function removeManagedCodexHooks(existing) {
+  const nextHooks = {};
+  for (const [eventName, groups] of Object.entries(existing.hooks ?? {})) {
+    const remaining = groups.map((group) => ({
+      ...group,
+      hooks: group.hooks.filter((hook) => !isManagedCodexHook(hook))
+    })).filter((group) => group.hooks.length > 0);
+    if (remaining.length > 0) {
+      nextHooks[eventName] = remaining;
+    }
+  }
+  return Object.keys(nextHooks).length > 0 ? { hooks: nextHooks } : {};
+}
+function installClaudePlugin() {
+  const hooksDir = resolveClaudeHooksDist();
+  if (!existsSync(hooksDir)) {
+    console.log(chalk.red(`Hook scripts not found: ${hooksDir}`));
+    console.log(chalk.gray("Make sure @xylabs/aries-audit-plugin is built (pnpm xy build)."));
+    return;
+  }
+  const settings = readClaudeSettings();
+  settings.hooks = buildClaudeHooks(hooksDir);
+  writeClaudeSettings(settings);
+  console.log(chalk.green("Claude audit hooks installed into ~/.claude/settings.json"));
+  console.log(`  ${chalk.gray("Hook scripts:")} ${hooksDir}`);
+  console.log(chalk.yellow("\nRestart Claude Code for the hooks to take effect."));
+}
+function uninstallClaudePlugin() {
+  const settings = readClaudeSettings();
+  if (!settings.hooks) {
+    console.log(chalk.yellow("No Claude hooks configured in ~/.claude/settings.json"));
+    return;
+  }
+  delete settings.hooks;
+  writeClaudeSettings(settings);
+  console.log(chalk.green("Claude audit hooks removed from ~/.claude/settings.json"));
+  console.log(chalk.yellow("Restart Claude Code for the change to take effect."));
+}
+function installCodexPlugin() {
+  const recorderPath = path.join(getRepoRoot(), "packages", "audit-plugin", "dist", "codex", "record-event.mjs");
+  if (!existsSync(recorderPath)) {
+    console.log(chalk.red(`Codex recorder not found: ${recorderPath}`));
+    console.log(chalk.gray("Make sure @xylabs/aries-audit-plugin is built (pnpm xy build)."));
+    return;
+  }
+  enableCodexHooksFeature();
+  const hooks = mergeCodexHooks(readCodexHooks());
+  writeCodexHooks(hooks);
+  console.log(chalk.green("Codex audit hooks installed"));
+  console.log(`  ${chalk.gray("Hooks file:")} ${getCodexHooksPath()}`);
+  console.log(`  ${chalk.gray("Config file:")} ${getCodexConfigPath()}`);
+  console.log(chalk.yellow("\nRestart Codex CLI in this repo for the hooks to take effect."));
+}
+function uninstallCodexPlugin() {
+  const hooksPath = getCodexHooksPath();
+  if (!existsSync(hooksPath)) {
+    console.log(chalk.yellow("No repo-local Codex hooks file found to update."));
+    return;
+  }
+  const hooks = removeManagedCodexHooks(readCodexHooks());
+  writeCodexHooks(hooks);
+  console.log(chalk.green("Codex audit hooks removed from repo-local hooks.json"));
+  console.log(`  ${chalk.gray("Hooks file:")} ${hooksPath}`);
+  console.log(chalk.gray("Leaving features.codex_hooks enabled in ~/.codex/config.toml to avoid disabling unrelated hooks."));
+}
+function installPlugin(provider) {
+  if (!provider) {
+    installClaudePlugin();
+    console.log();
+    installCodexPlugin();
+    return;
+  }
+  if (provider === "claude") {
+    installClaudePlugin();
+    return;
+  }
+  installCodexPlugin();
+}
+function uninstallPlugin(provider) {
+  if (!provider) {
+    uninstallClaudePlugin();
+    console.log();
+    uninstallCodexPlugin();
+    return;
+  }
+  if (provider === "claude") {
+    uninstallClaudePlugin();
+    return;
+  }
+  uninstallCodexPlugin();
+}
+
+// src/actions/audit/listSessions.ts
+import {
+  existsSync as existsSync2,
+  readdirSync,
+  readFileSync as readFileSync2
+} from "fs";
+import path3 from "path";
+import chalk2 from "chalk";
+
+// src/actions/audit/auditPaths.ts
+import { homedir as homedir2 } from "os";
+import path2 from "path";
+function getAuditRootDir() {
+  return path2.join(homedir2(), ".aries", "audit-logs");
+}
+function getAuditDir(provider) {
+  return provider ? path2.join(getAuditRootDir(), provider) : getAuditRootDir();
+}
+function getAuditSearchDirs() {
+  return [
+    getAuditDir("claude"),
+    getAuditDir("codex"),
+    getAuditRootDir()
+  ];
+}
+
+// src/actions/audit/listSessions.ts
+function summarizeSession(filePath, date) {
+  const content = readFileSync2(filePath, "utf8").trim();
+  if (!content) return void 0;
+  const lines = content.split("\n");
+  const events = {};
+  let firstTimestamp = "";
+  let lastTimestamp = "";
+  let sessionId = "unknown";
+  for (const line of lines) {
+    try {
+      const entry = JSON.parse(line);
+      if (!firstTimestamp) firstTimestamp = entry.timestamp ?? "";
+      lastTimestamp = entry.timestamp ?? "";
+      sessionId = entry.sessionId ?? sessionId;
+      const eventName = entry.event ?? "unknown";
+      events[eventName] = (events[eventName] ?? 0) + 1;
+    } catch {
+    }
+  }
+  return {
+    date,
+    entryCount: lines.length,
+    events,
+    firstTimestamp,
+    lastTimestamp,
+    sessionId
+  };
+}
+function listSessions(date) {
+  const auditDirs = getAuditSearchDirs().filter((dir) => existsSync2(dir));
+  if (auditDirs.length === 0) {
+    console.log(chalk2.yellow("No audit logs found."));
+    return;
+  }
+  const dates = date ? [date] : [...new Set(
+    auditDirs.flatMap((auditDir) => readdirSync(auditDir).filter((d) => /^\d{4}-\d{2}-\d{2}$/.test(d)))
+  )].toSorted((a, b) => a.localeCompare(b)).toReversed();
+  let found = false;
+  for (const d of dates) {
+    const files = auditDirs.flatMap((auditDir) => {
+      const dayDir = path3.join(auditDir, d);
+      if (!existsSync2(dayDir)) return [];
+      return readdirSync(dayDir).filter((f) => f.endsWith(".jsonl")).map((file) => path3.join(dayDir, file));
+    });
+    if (files.length === 0) continue;
+    found = true;
+    console.log(chalk2.cyan(`
+${d}`));
+    for (const file of files) {
+      const summary = summarizeSession(file, d);
+      if (!summary) continue;
+      const timeRange = `${summary.firstTimestamp.slice(11, 19)} - ${summary.lastTimestamp.slice(11, 19)}`;
+      const eventSummary = Object.entries(summary.events).map(([k, v]) => `${k}:${v}`).join(" ");
+      console.log(
+        `  ${chalk2.white(summary.sessionId.slice(0, 12).padEnd(12))} ${chalk2.gray(timeRange)} ${chalk2.green(String(summary.entryCount).padStart(4))} entries  ${chalk2.gray(eventSummary)}`
+      );
+    }
+  }
+  if (!found) {
+    console.log(chalk2.yellow("No audit logs found."));
+  }
+}
+
+// src/actions/audit/searchAudit.ts
+import {
+  existsSync as existsSync3,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync3
+} from "fs";
+import path4 from "path";
+import chalk3 from "chalk";
+function searchAudit(query, date, limit = 50) {
+  const auditDirs = getAuditSearchDirs().filter((dir) => existsSync3(dir));
+  if (auditDirs.length === 0) {
+    console.log(chalk3.yellow("No audit logs found."));
+    return;
+  }
+  const dates = date ? [date] : [...new Set(
+    auditDirs.flatMap((auditDir) => readdirSync2(auditDir).filter((d) => /^\d{4}-\d{2}-\d{2}$/.test(d)))
+  )].toSorted((a, b) => a.localeCompare(b)).toReversed();
+  const lowerQuery = query.toLowerCase();
+  let matchCount = 0;
+  for (const d of dates) {
+    const files = auditDirs.flatMap((auditDir) => {
+      const dayDir = path4.join(auditDir, d);
+      if (!existsSync3(dayDir)) return [];
+      return readdirSync2(dayDir).filter((f) => f.endsWith(".jsonl")).map((file) => path4.join(dayDir, file));
+    });
+    for (const file of files) {
+      const content = readFileSync3(file, "utf8").trim();
+      if (!content) continue;
+      for (const line of content.split("\n")) {
+        if (!line.toLowerCase().includes(lowerQuery)) continue;
+        try {
+          const entry = JSON.parse(line);
+          const time = (entry.timestamp ?? "").slice(0, 19);
+          const event = entry.event ?? "unknown";
+          const snippet = JSON.stringify(entry.data).slice(0, 150);
+          console.log(`${chalk3.gray(time)} ${chalk3.cyan((entry.sessionId ?? "").slice(0, 8))} ${chalk3.yellow(event)} ${snippet}`);
+          matchCount++;
+          if (matchCount >= limit) {
+            console.log(chalk3.gray(`
+... showing first ${limit} matches`));
+            return;
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  if (matchCount === 0) {
+    console.log(chalk3.yellow(`No matches found for: ${query}`));
+  } else {
+    console.log(chalk3.gray(`
+${matchCount} match${matchCount === 1 ? "" : "es"} found`));
+  }
+}
+
+// src/actions/audit/showSession.ts
+import {
+  existsSync as existsSync4,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync4
+} from "fs";
+import path5 from "path";
+import chalk4 from "chalk";
+function findSessionFile(sessionId) {
+  const auditDirs = getAuditSearchDirs().filter((dir) => existsSync4(dir));
+  if (auditDirs.length === 0) return void 0;
+  const dates = [...new Set(
+    auditDirs.flatMap((auditDir) => readdirSync3(auditDir).filter((d) => /^\d{4}-\d{2}-\d{2}$/.test(d)))
+  )].toSorted((a, b) => a.localeCompare(b)).toReversed();
+  for (const date of dates) {
+    for (const auditDir of auditDirs) {
+      const dayDir = path5.join(auditDir, date);
+      if (!existsSync4(dayDir)) continue;
+      const files = readdirSync3(dayDir).filter((f) => f.includes(sessionId) && f.endsWith(".jsonl"));
+      if (files.length > 0) return path5.join(dayDir, files[0]);
+    }
+  }
+  return void 0;
+}
+function formatSessionStart(time, entry) {
+  const version = entry.ai?.version ? ` v${entry.ai.version}` : "";
+  const mode = entry.data?.permissionMode ? ` mode=${entry.data.permissionMode}` : "";
+  return `${chalk4.gray(time)} ${chalk4.blue("SESSION START")}${version}${mode}`;
+}
+function formatEntry(entry) {
+  const time = (entry.timestamp ?? "").slice(11, 23);
+  const event = entry.event ?? "unknown";
+  const data = entry.data;
+  switch (event) {
+    case "SessionStart": {
+      return formatSessionStart(time, entry);
+    }
+    case "UserPromptSubmit": {
+      return `${chalk4.gray(time)} ${chalk4.green("PROMPT")} ${String(data?.prompt ?? "").slice(0, 200)}`;
+    }
+    case "PostToolUse": {
+      return `${chalk4.gray(time)} ${chalk4.yellow("TOOL")} ${chalk4.white(String(data?.toolName ?? ""))} ${chalk4.gray(String(data?.toolInput ?? "").slice(0, 120))}`;
+    }
+    case "Stop": {
+      return `${chalk4.gray(time)} ${chalk4.magenta("RESPONSE")} ${String(data?.response ?? "").slice(0, 200)}`;
+    }
+    default: {
+      return `${chalk4.gray(time)} ${event} ${JSON.stringify(data)}`;
+    }
+  }
+}
+function showSession(sessionId, format) {
+  const filePath = findSessionFile(sessionId);
+  if (!filePath) {
+    console.log(chalk4.red(`No audit log found for session: ${sessionId}`));
+    return;
+  }
+  const content = readFileSync4(filePath, "utf8").trim();
+  if (!content) {
+    console.log(chalk4.yellow("Session log is empty."));
+    return;
+  }
+  const lines = content.split("\n");
+  if (format === "json") {
+    for (const line of lines) {
+      console.log(line);
+    }
+    return;
+  }
+  console.log(chalk4.cyan(`Session: ${sessionId}`));
+  console.log(chalk4.cyan(`File: ${filePath}`));
+  console.log(chalk4.cyan(`Entries: ${lines.length}`));
+  console.log();
+  for (const line of lines) {
+    try {
+      const entry = JSON.parse(line);
+      console.log(formatEntry(entry));
+    } catch {
+      console.log(chalk4.red(`  [malformed] ${line.slice(0, 80)}`));
+    }
+  }
+}
+
+// src/actions/audit/statusAudit.ts
+import {
+  existsSync as existsSync5,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync5,
+  statSync
+} from "fs";
+import { homedir as homedir3 } from "os";
+import path6 from "path";
+import chalk5 from "chalk";
+function getDirectorySize(dir) {
+  let size = 0;
+  if (!existsSync5(dir)) return size;
+  for (const entry of readdirSync4(dir)) {
+    const fullPath = path6.join(dir, entry);
+    const stat = statSync(fullPath);
+    size += stat.isDirectory() ? getDirectorySize(fullPath) : stat.size;
+  }
+  return size;
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function countSessions(dir) {
+  if (!existsSync5(dir)) return 0;
+  let count = 0;
+  for (const date of readdirSync4(dir)) {
+    const dayDir = path6.join(dir, date);
+    const stat = statSync(dayDir);
+    if (stat.isDirectory()) {
+      count += readdirSync4(dayDir).filter((f) => f.endsWith(".jsonl")).length;
+    }
+  }
+  return count;
+}
+function checkHooksInstalled() {
+  const settingsPath = path6.join(homedir3(), ".claude", "settings.json");
+  if (!existsSync5(settingsPath)) return false;
+  try {
+    const settings = JSON.parse(readFileSync5(settingsPath, "utf8"));
+    return settings.hooks != null;
+  } catch {
+    return false;
+  }
+}
+function statusAudit() {
+  const auditRootDir = getAuditRootDir();
+  const auditDirs = getAuditSearchDirs().filter((dir) => existsSync5(dir));
+  console.log(chalk5.cyan("Audit Plugin Status"));
+  console.log();
+  if (checkHooksInstalled()) {
+    console.log(`  ${chalk5.green("Hooks:")} configured in ~/.claude/settings.json`);
+  } else {
+    console.log(`  ${chalk5.red("Hooks:")} not installed (run: aries audit install)`);
+  }
+  console.log();
+  console.log(`  ${chalk5.gray("Log root:")}      ${auditRootDir}`);
+  console.log(`  ${chalk5.gray("Claude logs:")}   ${getAuditDir("claude")}`);
+  console.log(`  ${chalk5.gray("Codex logs:")}    ${getAuditDir("codex")}`);
+  if (auditDirs.length > 0) {
+    const sessions = auditDirs.reduce((sum, dir) => sum + countSessions(dir), 0);
+    const size = auditDirs.reduce((sum, dir) => sum + getDirectorySize(dir), 0);
+    const dates = [...new Set(
+      auditDirs.flatMap((dir) => readdirSync4(dir).filter((d) => /^\d{4}-\d{2}-\d{2}$/.test(d)))
+    )];
+    const sorted = dates.toSorted((a, b) => a.localeCompare(b));
+    console.log(`  ${chalk5.gray("Sessions:")}      ${sessions}`);
+    console.log(`  ${chalk5.gray("Date range:")}    ${sorted[0] ?? "none"} - ${sorted.at(-1) ?? "none"}`);
+    console.log(`  ${chalk5.gray("Disk usage:")}    ${formatBytes(size)}`);
+  } else {
+    console.log(`  ${chalk5.gray("No logs yet")}`);
+  }
+}
+
+// src/actions/clamp/clampAudit.ts
+import { writeAuditEntry } from "@xylabs/aries-audit-core";
+import { CLAMP_AUDIT_SCHEMA } from "@xylabs/aries-clamp-core";
+function logClampPermission(options) {
+  writeAuditEntry({
+    ai: { product: "clamp", provider: "aries" },
+    client: { name: "@xylabs/aries", version: "0.1.0" },
+    cwd: process.cwd(),
+    data: {
+      args: options.args,
+      command: options.command,
+      decision: options.decision,
+      policy: options.policy.name
+    },
+    event: "ClampPermission",
+    schema: CLAMP_AUDIT_SCHEMA,
+    sessionId: options.sessionId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function logClampStart(options) {
+  writeAuditEntry({
+    ai: { product: "clamp", provider: "aries" },
+    client: { name: "@xylabs/aries", version: "0.1.0" },
+    cwd: process.cwd(),
+    data: {
+      command: options.command,
+      policy: options.policy.name
+    },
+    event: "ClampStart",
+    schema: CLAMP_AUDIT_SCHEMA,
+    sessionId: options.sessionId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function logClampStop(options) {
+  writeAuditEntry({
+    ai: { product: "clamp", provider: "aries" },
+    client: { name: "@xylabs/aries", version: "0.1.0" },
+    cwd: process.cwd(),
+    data: { exitCode: options.exitCode },
+    event: "ClampStop",
+    schema: CLAMP_AUDIT_SCHEMA,
+    sessionId: options.sessionId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/actions/clamp/ipcServer.ts
+import {
+  createServer
+} from "net";
+function createIpcServer(options) {
+  const { socketPath, onPermissionRequest } = options;
+  const server = createServer((socket) => {
+    let data = "";
+    socket.on("data", (chunk) => {
+      data += chunk.toString();
+      const newlineIdx = data.indexOf("\n");
+      if (newlineIdx === -1) return;
+      const line = data.slice(0, newlineIdx);
+      data = data.slice(newlineIdx + 1);
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        socket.end(JSON.stringify({
+          allowed: false,
+          reason: "Invalid request",
+          requestId: "unknown",
+          type: "permission-response"
+        }) + "\n");
+        return;
+      }
+      onPermissionRequest(request).then((response) => {
+        socket.end(JSON.stringify(response) + "\n");
+      }).catch(() => {
+        const errorResponse = {
+          allowed: false,
+          reason: "Internal error",
+          requestId: request.requestId,
+          type: "permission-response"
+        };
+        socket.end(JSON.stringify(errorResponse) + "\n");
+      });
+    });
+    socket.on("error", () => {
+    });
+  });
+  const listening = new Promise((resolve, reject) => {
+    server.listen(socketPath, () => resolve());
+    server.on("error", reject);
+  });
+  return {
+    close: () => server.close(),
+    listening,
+    server
+  };
+}
+
+// src/actions/clamp/promptUser.ts
+import {
+  closeSync,
+  openSync,
+  writeSync
+} from "fs";
+import { createInterface } from "readline";
+import { ReadStream } from "tty";
+function parseAnswer(answer) {
+  const trimmed = answer.trim().toLowerCase();
+  if (trimmed === "y" || trimmed === "yes") return "allow-once";
+  if (trimmed === "a" || trimmed === "always") return "allow-always";
+  return "deny";
+}
+function promptViaTty(fullCommand) {
+  let readFd;
+  let writeFd;
+  try {
+    readFd = openSync("/dev/tty", "r");
+    writeFd = openSync("/dev/tty", "w");
+  } catch {
+    return Promise.resolve("deny");
+  }
+  const ttyIn = new ReadStream(readFd);
+  writeSync(writeFd, `
+[clamp] "${fullCommand}" \u2014 Allow? [y/N/a(lways)] `);
+  const rl = createInterface({ input: ttyIn, terminal: false });
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      rl.close();
+      ttyIn.destroy();
+      try {
+        closeSync(writeFd);
+      } catch {
+      }
+    };
+    rl.once("line", (answer) => {
+      cleanup();
+      resolve(parseAnswer(answer));
+    });
+    rl.once("close", () => resolve("deny"));
+    ttyIn.on("error", () => {
+      cleanup();
+      resolve("deny");
+    });
+  });
+}
+function promptViaRenderer(fullCommand, renderer) {
+  const promptText2 = `[clamp] "${fullCommand}" \u2014 Allow? [y/N/a(lways)] `;
+  renderer.setStatusLine(promptText2);
+  let readFd;
+  try {
+    readFd = openSync("/dev/tty", "r");
+  } catch {
+    renderer.setStatusLine("[clamp] No TTY \u2014 denied");
+    return Promise.resolve("deny");
+  }
+  const ttyIn = new ReadStream(readFd);
+  const rl = createInterface({ input: ttyIn, terminal: false });
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      rl.close();
+      ttyIn.destroy();
+      renderer.setStatusLine("[clamp] Ready");
+    };
+    rl.once("line", (answer) => {
+      const decision = parseAnswer(answer);
+      cleanup();
+      resolve(decision);
+    });
+    rl.once("close", () => {
+      cleanup();
+      resolve("deny");
+    });
+    ttyIn.on("error", () => {
+      cleanup();
+      resolve("deny");
+    });
+  });
+}
+async function promptUser(command, args, renderer) {
+  const fullCommand = [command, ...args].join(" ");
+  if (renderer) {
+    return promptViaRenderer(fullCommand, renderer);
+  }
+  return promptViaTty(fullCommand);
+}
+
+// src/actions/clamp/runClamped.ts
+import { randomUUID } from "crypto";
+import { rmSync as rmSync3, unlinkSync } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import path10 from "path";
+import {
+  CLAMP_IPC_ENV,
+  CLAMP_ORIGINAL_PATH_ENV,
+  CLAMP_SESSION_ENV,
+  loadPolicy,
+  matchProcess
+} from "@xylabs/aries-clamp-core";
+import chalk7 from "chalk";
+
+// src/actions/clamp/sandboxExec.ts
+import { spawn } from "child_process";
+import {
+  mkdtempSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { tmpdir } from "os";
+import path7 from "path";
+import { detectPlatform, generateMacOSProfile } from "@xylabs/aries-clamp-core";
+import chalk6 from "chalk";
+
+// src/actions/clamp/terminalRenderer.ts
+import pkg from "@xterm/headless";
+var { Terminal } = pkg;
+var STATUS_BAR_HEIGHT = 2;
+var ESC = "\x1B[";
+var moveTo = (row, col) => `${ESC}${row};${col}H`;
+var resetStyle = `${ESC}0m`;
+var hideCursor = `${ESC}?25l`;
+var showCursor = `${ESC}?25h`;
+var clearScreen = `${ESC}2J`;
+var setBg = (r, g, b) => `${ESC}48;2;${r};${g};${b}m`;
+var setFg = (r, g, b) => `${ESC}38;2;${r};${g};${b}m`;
+var fgPalette = (n) => `${ESC}38;5;${n}m`;
+var bgPalette = (n) => `${ESC}48;5;${n}m`;
+var bold = `${ESC}1m`;
+var dim = `${ESC}2m`;
+var italic = `${ESC}3m`;
+var underline = `${ESC}4m`;
+var inverse = `${ESC}7m`;
+var strikethrough = `${ESC}9m`;
+function getCellStyle(cell) {
+  if (!cell) return {
+    attrs: "",
+    bg: "",
+    fg: ""
+  };
+  let fg = "";
+  let bg = "";
+  let attrs = "";
+  if (cell.isFgRGB()) {
+    const color = cell.getFgColor();
+    fg = setFg(color >> 16 & 255, color >> 8 & 255, color & 255);
+  } else if (cell.getFgColorMode() !== 0) {
+    fg = fgPalette(cell.getFgColor());
+  }
+  if (cell.isBgRGB()) {
+    const color = cell.getBgColor();
+    bg = setBg(color >> 16 & 255, color >> 8 & 255, color & 255);
+  } else if (cell.getBgColorMode() !== 0) {
+    bg = bgPalette(cell.getBgColor());
+  }
+  if (cell.isBold()) attrs += bold;
+  if (cell.isDim()) attrs += dim;
+  if (cell.isItalic()) attrs += italic;
+  if (cell.isUnderline()) attrs += underline;
+  if (cell.isInverse()) attrs += inverse;
+  if (cell.isStrikethrough()) attrs += strikethrough;
+  return {
+    attrs,
+    bg,
+    fg
+  };
+}
+function createTerminalRenderer() {
+  const realCols = process.stdout.columns ?? 80;
+  const realRows = process.stdout.rows ?? 24;
+  const innerRows = realRows - STATUS_BAR_HEIGHT;
+  const terminal = new Terminal({
+    cols: realCols,
+    rows: innerRows
+  });
+  let statusLine = "";
+  let renderScheduled = false;
+  function renderBuffer() {
+    const buf = terminal.buffer.active;
+    const cols = terminal.cols;
+    const rows = terminal.rows;
+    const output = [hideCursor];
+    for (let y = 0; y < rows; y++) {
+      const line = buf.getLine(y);
+      output.push(moveTo(y + 1, 1));
+      if (!line) {
+        output.push(resetStyle + " ".repeat(cols));
+        continue;
+      }
+      let lineStr = "";
+      let lastStyle = "";
+      for (let x = 0; x < cols; x++) {
+        const cell = line.getCell(x);
+        if (!cell || cell.getWidth() === 0) continue;
+        const style = getCellStyle(cell);
+        const styleStr = resetStyle + style.fg + style.bg + style.attrs;
+        if (styleStr !== lastStyle) {
+          lineStr += styleStr;
+          lastStyle = styleStr;
+        }
+        const ch = cell.getChars();
+        lineStr += ch || " ";
+      }
+      output.push(lineStr + resetStyle);
+    }
+    const statusRow = realRows - 1;
+    output.push(
+      moveTo(statusRow, 1),
+      resetStyle + dim + "\u2500".repeat(realCols) + resetStyle,
+      moveTo(statusRow + 1, 1),
+      resetStyle,
+      statusLine.padEnd(realCols).slice(0, realCols),
+      resetStyle
+    );
+    const cursorY = buf.cursorY + 1;
+    const cursorX = buf.cursorX + 1;
+    output.push(moveTo(cursorY, cursorX), showCursor);
+    process.stdout.write(output.join(""));
+  }
+  function scheduleRender() {
+    if (renderScheduled) return;
+    renderScheduled = true;
+    setImmediate(() => {
+      renderScheduled = false;
+      renderBuffer();
+    });
+  }
+  function handleResize() {
+    const newCols = process.stdout.columns ?? 80;
+    const newRows = process.stdout.rows ?? 24;
+    const newInnerRows = newRows - STATUS_BAR_HEIGHT;
+    terminal.resize(newCols, newInnerRows);
+    process.stdout.write(clearScreen);
+    scheduleRender();
+  }
+  process.stdout.on("resize", handleResize);
+  process.stdout.write(clearScreen + moveTo(1, 1));
+  return {
+    destroy: () => {
+      process.stdout.removeListener("resize", handleResize);
+      process.stdout.write(clearScreen + moveTo(1, 1) + showCursor + resetStyle);
+      terminal.dispose();
+    },
+    render: scheduleRender,
+    setStatusLine: (line) => {
+      statusLine = line;
+      scheduleRender();
+    },
+    terminal,
+    write: (data) => {
+      terminal.write(data);
+      scheduleRender();
+    }
+  };
+}
+
+// src/actions/clamp/sandboxExec.ts
+function createMacOSSandbox(policy) {
+  const profileContent = generateMacOSProfile(policy, process.cwd());
+  const profileDir = mkdtempSync(path7.join(tmpdir(), "aries-clamp-sb-"));
+  const profilePath = path7.join(profileDir, "sandbox.sb");
+  writeFileSync2(profilePath, profileContent, "utf8");
+  console.error(chalk6.gray("[clamp] macOS sandbox enabled"));
+  return {
+    args: ["-f", profilePath],
+    cleanup: () => {
+      try {
+        rmSync(profileDir, { force: true, recursive: true });
+      } catch {
+      }
+    }
+  };
+}
+function resolveSpawnCommand(command, args, policy) {
+  const platform2 = detectPlatform();
+  const cleanupFns = [];
+  if (platform2 === "darwin" && policy.filesystem) {
+    const sandbox = createMacOSSandbox(policy);
+    cleanupFns.push(sandbox.cleanup);
+    return {
+      cleanupFns,
+      spawnArgs: [...sandbox.args, command, ...args],
+      spawnCommand: "sandbox-exec"
+    };
+  }
+  if (platform2 === "linux" && policy.filesystem) {
+    console.error(chalk6.yellow("[clamp] Linux filesystem sandbox: Landlock integration pending"));
+  } else if (policy.filesystem) {
+    console.error(chalk6.yellow(`[clamp] OS filesystem sandbox not available on ${platform2}`));
+  }
+  return {
+    cleanupFns,
+    spawnArgs: args,
+    spawnCommand: command
+  };
+}
+function cleanEnvRecord(env) {
+  const clean = {};
+  for (const [k, v] of Object.entries(env)) {
+    if (v !== void 0) clean[k] = v;
+  }
+  return clean;
+}
+function spawnWithRenderedPty(spawnCommand, spawnArgs, env) {
+  try {
+    const pty = require_lib();
+    const renderer = createTerminalRenderer();
+    const innerRows = (process.stdout.rows ?? 24) - 2;
+    const ptyProcess = pty.spawn(spawnCommand, spawnArgs, {
+      cols: process.stdout.columns ?? 80,
+      cwd: process.cwd(),
+      env,
+      name: process.env.TERM ?? "xterm-256color",
+      rows: innerRows
+    });
+    let paused = false;
+    ptyProcess.onData((data) => {
+      if (!paused) {
+        renderer.write(data);
+      }
+    });
+    if (process.stdin.isTTY) process.stdin.setRawMode(true);
+    process.stdin.resume();
+    const onStdin = (data) => {
+      ptyProcess.write(data.toString());
+    };
+    process.stdin.on("data", onStdin);
+    const onResize = () => {
+      const newInnerRows = (process.stdout.rows ?? 24) - 2;
+      ptyProcess.resize(process.stdout.columns ?? 80, newInnerRows);
+    };
+    process.stdout.on("resize", onResize);
+    const exitCode = new Promise((resolve) => {
+      ptyProcess.onExit(({ exitCode: code }) => {
+        process.stdin.removeListener("data", onStdin);
+        process.stdout.removeListener("resize", onResize);
+        if (process.stdin.isTTY) process.stdin.setRawMode(false);
+        process.stdin.pause();
+        renderer.destroy();
+        resolve(code);
+      });
+    });
+    return {
+      cleanup: () => {
+      },
+      exitCode,
+      ok: true,
+      pause: () => {
+        paused = true;
+      },
+      renderer,
+      resume: () => {
+        paused = false;
+        renderer.render();
+      }
+    };
+  } catch {
+    return { ok: false };
+  }
+}
+function spawnFallback(spawnCommand, spawnArgs, env) {
+  console.error(chalk6.yellow("[clamp] PTY unavailable, falling back to basic stdio passthrough"));
+  const child = spawn(spawnCommand, spawnArgs, { env, stdio: "inherit" });
+  const exitCode = new Promise((resolve) => {
+    child.on("close", (code) => resolve(code));
+    child.on("error", () => resolve(1));
+  });
+  const noop = () => {
+  };
+  return {
+    cleanup: noop,
+    exitCode,
+    pause: noop,
+    renderer: void 0,
+    resume: noop
+  };
+}
+function spawnSandboxed(options) {
+  const { env, policy } = options;
+  const {
+    spawnCommand,
+    spawnArgs,
+    cleanupFns
+  } = resolveSpawnCommand(options.command, options.args, policy);
+  const cleanEnv = cleanEnvRecord(env);
+  const ptyResult = spawnWithRenderedPty(spawnCommand, spawnArgs, cleanEnv);
+  const result = ptyResult.ok ? ptyResult : spawnFallback(spawnCommand, spawnArgs, env);
+  const originalCleanup = result.cleanup;
+  return {
+    ...result,
+    cleanup: () => {
+      originalCleanup();
+      for (const fn of cleanupFns) fn();
+    }
+  };
+}
+
+// src/actions/clamp/shellEnvSetup.ts
+import {
+  mkdtempSync as mkdtempSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { homedir as homedir4, tmpdir as tmpdir2 } from "os";
+import path8 from "path";
+function createShellEnvOverrides(shimDir) {
+  const tmpDir = mkdtempSync2(path8.join(tmpdir2(), "aries-clamp-env-"));
+  const home = homedir4();
+  const zshenv = [
+    "# Aries Clamp: source real .zshenv then re-prepend shim dir",
+    `[ -f "${home}/.zshenv" ] && ZDOTDIR="${home}" source "${home}/.zshenv"`,
+    `export PATH="${shimDir}:\${PATH}"`
+  ].join("\n") + "\n";
+  writeFileSync3(path8.join(tmpDir, ".zshenv"), zshenv, "utf8");
+  const zshrc = [
+    "# Aries Clamp: source real .zshrc then re-prepend shim dir",
+    `[ -f "${home}/.zshrc" ] && ZDOTDIR="${home}" source "${home}/.zshrc"`,
+    `export PATH="${shimDir}:\${PATH}"`
+  ].join("\n") + "\n";
+  writeFileSync3(path8.join(tmpDir, ".zshrc"), zshrc, "utf8");
+  const zprofile = [
+    "# Aries Clamp: source real .zprofile then re-prepend shim dir",
+    `[ -f "${home}/.zprofile" ] && ZDOTDIR="${home}" source "${home}/.zprofile"`,
+    `export PATH="${shimDir}:\${PATH}"`
+  ].join("\n") + "\n";
+  writeFileSync3(path8.join(tmpDir, ".zprofile"), zprofile, "utf8");
+  const bashEnv = [
+    "# Aries Clamp: prepend shim dir to PATH",
+    `export PATH="${shimDir}:\${PATH}"`
+  ].join("\n") + "\n";
+  const bashEnvPath = path8.join(tmpDir, "bash_env.sh");
+  writeFileSync3(bashEnvPath, bashEnv, "utf8");
+  const bashrc = [
+    "# Aries Clamp: source real .bashrc then re-prepend shim dir",
+    `[ -f "${home}/.bashrc" ] && source "${home}/.bashrc"`,
+    `export PATH="${shimDir}:\${PATH}"`
+  ].join("\n") + "\n";
+  writeFileSync3(path8.join(tmpDir, ".bashrc"), bashrc, "utf8");
+  return {
+    cleanup: () => {
+      try {
+        rmSync2(tmpDir, { force: true, recursive: true });
+      } catch {
+      }
+    },
+    env: {
+      BASH_ENV: bashEnvPath,
+      ENV: bashEnvPath,
+      ZDOTDIR: tmpDir
+    }
+  };
+}
+
+// src/actions/clamp/shimGenerator.ts
+import {
+  chmodSync,
+  existsSync as existsSync6,
+  mkdtempSync as mkdtempSync3,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { createRequire } from "module";
+import { tmpdir as tmpdir3 } from "os";
+import path9 from "path";
+var DANGEROUS_COMMANDS = [
+  "chmod",
+  "chown",
+  "curl",
+  "docker",
+  "kill",
+  "killall",
+  "mv",
+  "pkill",
+  "rm",
+  "rmdir",
+  "sudo",
+  "wget"
+];
+function getGatekeeperPath() {
+  const require2 = createRequire(import.meta.url);
+  try {
+    const pluginPkg = require2.resolve("@xylabs/aries-clamp-plugin/package.json");
+    return path9.join(path9.dirname(pluginPkg), "dist", "shim", "gatekeeper.mjs");
+  } catch {
+    const candidates = [
+      path9.resolve("packages", "clamp-plugin", "dist", "shim", "gatekeeper.mjs"),
+      path9.resolve("node_modules", "@xylabs", "aries-clamp-plugin", "dist", "shim", "gatekeeper.mjs")
+    ];
+    for (const candidate of candidates) {
+      if (existsSync6(candidate)) return candidate;
+    }
+    throw new Error("Could not find gatekeeper.mjs \u2014 is @xylabs/aries-clamp-plugin built?");
+  }
+}
+async function generateShimDirectory(policy) {
+  const shimDir = mkdtempSync3(path9.join(tmpdir3(), "aries-clamp-"));
+  const gatekeeperPath = getGatekeeperPath();
+  const nodePath = process.execPath;
+  const commands = /* @__PURE__ */ new Set();
+  const processRules = policy.process;
+  if (processRules) {
+    for (const cmd of processRules.allow ?? []) commands.add(cmd);
+    for (const cmd of processRules.prompt ?? []) commands.add(cmd);
+    for (const cmd of processRules.deny ?? []) commands.add(cmd);
+  }
+  for (const cmd of DANGEROUS_COMMANDS) {
+    commands.add(cmd);
+  }
+  for (const cmd of commands) {
+    const shimPath = path9.join(shimDir, cmd);
+    const script = `#!/bin/sh
+exec "${nodePath}" "${gatekeeperPath}" "${cmd}" "$@"
+`;
+    writeFileSync4(shimPath, script, "utf8");
+    chmodSync(shimPath, 493);
+  }
+  return shimDir;
+}
+
+// src/actions/clamp/runClamped.ts
+function printDryRun(command, args, policy, auditEnabled) {
+  console.log(chalk7.cyan("\n[clamp] Dry run \u2014 would sandbox with:\n"));
+  console.log(chalk7.white(`  Command: ${command} ${args.join(" ")}`));
+  console.log(chalk7.white(`  Policy: ${policy.name}`));
+  console.log(chalk7.white(`  Default action: ${policy.defaultAction ?? "prompt"}`));
+  console.log(chalk7.white(`  Audit: ${auditEnabled ? "enabled" : "disabled"}`));
+  if (policy.process) {
+    console.log(chalk7.green(`  Allowed: ${policy.process.allow?.join(", ") ?? "(none)"}`));
+    console.log(chalk7.yellow(`  Prompted: ${policy.process.prompt?.join(", ") ?? "(none)"}`));
+    console.log(chalk7.red(`  Denied: ${policy.process.deny?.join(", ") ?? "(none)"}`));
+  }
+  if (policy.filesystem) {
+    console.log(chalk7.white("  Filesystem sandbox: enabled"));
+  }
+  console.log("");
+}
+async function resolveDecision(command, args, alwaysAllow, renderer) {
+  const answer = await promptUser(command, args, renderer);
+  if (answer === "allow-always") {
+    alwaysAllow.add(command);
+    return "prompted-allow";
+  }
+  return answer === "allow-once" ? "prompted-allow" : "prompted-deny";
+}
+function createPermissionHandler(policy, sessionId, auditEnabled, alwaysAllow, sandboxRef) {
+  const defaultAction = policy.defaultAction ?? "prompt";
+  return async (request) => {
+    const {
+      command: reqCommand,
+      args: reqArgs,
+      requestId
+    } = request;
+    if (alwaysAllow.has(reqCommand)) {
+      if (auditEnabled) {
+        logClampPermission({
+          args: reqArgs,
+          command: reqCommand,
+          decision: "allowed",
+          policy,
+          sessionId
+        });
+      }
+      return {
+        allowed: true,
+        requestId,
+        type: "permission-response"
+      };
+    }
+    const level = matchProcess(reqCommand, policy.process, defaultAction);
+    if (level === "allow" || level === "deny") {
+      const decision2 = level === "allow" ? "allowed" : "denied";
+      if (auditEnabled) {
+        logClampPermission({
+          args: reqArgs,
+          command: reqCommand,
+          decision: decision2,
+          policy,
+          sessionId
+        });
+      }
+      return {
+        allowed: level === "allow",
+        reason: level === "deny" ? `Policy "${policy.name}": deny` : void 0,
+        requestId,
+        type: "permission-response"
+      };
+    }
+    sandboxRef.sandbox?.pause();
+    const decision = await resolveDecision(reqCommand, reqArgs, alwaysAllow, sandboxRef.sandbox?.renderer);
+    sandboxRef.sandbox?.resume();
+    if (auditEnabled) {
+      logClampPermission({
+        args: reqArgs,
+        command: reqCommand,
+        decision,
+        policy,
+        sessionId
+      });
+    }
+    const allowed = decision === "prompted-allow";
+    return {
+      allowed,
+      reason: allowed ? void 0 : `Policy "${policy.name}": denied by user`,
+      requestId,
+      type: "permission-response"
+    };
+  };
+}
+function buildChildEnv(shimDir, socketPath, sessionId, shellEnv) {
+  const originalPath = process.env.PATH ?? "";
+  return {
+    ...process.env,
+    ...shellEnv,
+    PATH: `${shimDir}${path10.delimiter}${originalPath}`,
+    [CLAMP_IPC_ENV]: socketPath,
+    [CLAMP_ORIGINAL_PATH_ENV]: originalPath,
+    [CLAMP_SESSION_ENV]: sessionId
+  };
+}
+function cleanupResources(socketPath, shimDir) {
+  try {
+    unlinkSync(socketPath);
+  } catch {
+  }
+  try {
+    rmSync3(shimDir, { force: true, recursive: true });
+  } catch {
+  }
+}
+function parseArgs(argv) {
+  return {
+    args: argv.args ?? [],
+    auditEnabled: argv.audit !== false,
+    command: argv.command,
+    dryRun: argv["dry-run"] ?? false,
+    policyOption: argv.policy
+  };
+}
+async function runClamped(argv) {
+  const {
+    command,
+    args,
+    policyOption,
+    auditEnabled,
+    dryRun
+  } = parseArgs(argv);
+  let policy;
+  try {
+    policy = loadPolicy({ path: policyOption });
+  } catch (err) {
+    console.error(chalk7.red(`Failed to load policy: ${String(err)}`));
+    process.exit(1);
+  }
+  if (dryRun) {
+    printDryRun(command, args, policy, auditEnabled);
+    return;
+  }
+  const sessionId = randomUUID();
+  const shimDir = await generateShimDirectory(policy);
+  const shellOverrides = createShellEnvOverrides(shimDir);
+  const socketPath = path10.join(tmpdir4(), `aries-clamp-${process.pid}-${randomUUID().slice(0, 8)}.sock`);
+  const sandboxRef = {};
+  const handler = createPermissionHandler(policy, sessionId, auditEnabled, /* @__PURE__ */ new Set(), sandboxRef);
+  const ipcHandle = createIpcServer({ onPermissionRequest: handler, socketPath });
+  await ipcHandle.listening;
+  if (auditEnabled) logClampStart({
+    command,
+    policy,
+    sessionId
+  });
+  console.error(chalk7.cyan(`[clamp] Session ${sessionId.slice(0, 8)} \u2014 policy: ${policy.name}`));
+  const childEnv = buildChildEnv(shimDir, socketPath, sessionId, shellOverrides.env);
+  const sandbox = spawnSandboxed({
+    args,
+    command,
+    env: childEnv,
+    policy
+  });
+  sandboxRef.sandbox = sandbox;
+  sandbox.renderer?.setStatusLine(`[clamp] policy: ${policy.name} | allowed: 0 | denied: 0`);
+  const exitCode = await sandbox.exitCode;
+  sandbox.cleanup();
+  shellOverrides.cleanup();
+  ipcHandle.close();
+  cleanupResources(socketPath, shimDir);
+  if (auditEnabled) logClampStop({ exitCode, sessionId });
+  console.error(chalk7.gray(`
+[clamp] Session ended (exit code: ${exitCode})`));
+  process.exit(exitCode ?? 1);
+}
+
+// src/actions/detect/detectAiClients.ts
+import { execFileSync, execSync } from "child_process";
+import { existsSync as existsSync7, realpathSync } from "fs";
+import { homedir as homedir5, platform } from "os";
+import path11 from "path";
+import chalk8 from "chalk";
+function getAppPaths() {
+  const os = platform();
+  const home = homedir5();
+  if (os === "darwin") {
+    return ["/Applications", path11.join(home, "Applications")];
+  }
+  if (os === "win32") {
+    return [
+      String.raw`C:\Program Files`,
+      String.raw`C:\Program Files (x86)`,
+      path11.join(home, "AppData", "Local", "Programs")
+    ];
+  }
+  return ["/usr/share/applications"];
+}
+function detectApp(candidate) {
+  const appDirs = getAppPaths();
+  for (const dir of appDirs) {
+    for (const appPath of candidate.paths) {
+      const full = path11.join(dir, appPath);
+      if (existsSync7(full)) {
+        return {
+          detected: true,
+          name: candidate.name,
+          path: full,
+          provider: candidate.provider,
+          type: "app"
+        };
+      }
+    }
+  }
+  return {
+    detected: false,
+    name: candidate.name,
+    provider: candidate.provider,
+    type: "app"
+  };
+}
+function resolveCliPath(location) {
+  try {
+    return realpathSync(location);
+  } catch {
+    return location;
+  }
+}
+function findCliLocation(candidate) {
+  try {
+    return execSync(`which ${candidate.command}`, {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+    for (const cliPath of candidate.paths ?? []) {
+      if (existsSync7(cliPath)) {
+        return cliPath;
+      }
+    }
+  }
+}
+function detectCli(candidate) {
+  const location = findCliLocation(candidate);
+  if (!location) {
+    return {
+      detected: false,
+      name: candidate.name,
+      provider: candidate.provider,
+      type: "cli"
+    };
+  }
+  const resolvedLocation = resolveCliPath(location);
+  let version;
+  if (candidate.versionFlag) {
+    try {
+      const output = execFileSync(resolvedLocation, [candidate.versionFlag], {
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 5e3
+      }).trim();
+      const match = /[\d.]+/.exec(output);
+      version = match?.[0];
+    } catch {
+    }
+  }
+  return {
+    detected: true,
+    name: candidate.name,
+    path: resolvedLocation,
+    provider: candidate.provider,
+    type: "cli",
+    version
+  };
+}
+function getVscodeExtensions() {
+  try {
+    const output = execSync("code --list-extensions", {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4
+    }).trim();
+    return new Set(output.toLowerCase().split("\n").map((e) => e.trim()));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function detectVscode(candidate, extensions) {
+  const extensionId = candidate.extensionIds.find((id) => extensions.has(id.toLowerCase()));
+  const detected = Boolean(extensionId);
+  return {
+    detected,
+    name: candidate.name,
+    ...extensionId ? { path: extensionId } : {},
+    provider: candidate.provider,
+    type: "vscode"
+  };
+}
+var APP_CANDIDATES = [
+  {
+    name: "Claude Desktop",
+    paths: ["Claude.app"],
+    provider: "Anthropic"
+  },
+  {
+    name: "ChatGPT Desktop",
+    paths: ["ChatGPT.app"],
+    provider: "OpenAI"
+  },
+  {
+    name: "Codex Desktop",
+    paths: ["Codex.app", "OpenAI Codex.app"],
+    provider: "OpenAI"
+  },
+  {
+    name: "Cursor",
+    paths: ["Cursor.app", "Cursor/Cursor.exe", "cursor.desktop"],
+    provider: "Cursor"
+  },
+  {
+    name: "Grok Desktop",
+    paths: ["Grok.app"],
+    provider: "xAI"
+  },
+  {
+    name: "Windsurf",
+    paths: ["Windsurf.app", "Windsurf/Windsurf.exe", "windsurf.desktop"],
+    provider: "Windsurf"
+  },
+  {
+    name: "Gemini Desktop",
+    paths: ["Gemini.app", "Google Gemini.app"],
+    provider: "Google"
+  },
+  {
+    name: "Gemini in Android Studio",
+    paths: ["Android Studio.app"],
+    provider: "Google"
+  },
+  {
+    name: "Kiro",
+    paths: ["Kiro.app", "Kiro/Kiro.exe", "kiro.desktop"],
+    provider: "Kiro"
+  },
+  {
+    name: "Copilot Desktop",
+    paths: ["Microsoft Copilot.app", "Copilot.app"],
+    provider: "Microsoft"
+  },
+  {
+    name: "Ollama",
+    paths: ["Ollama.app", "Ollama/Ollama.exe", "ollama.desktop"],
+    provider: "Ollama"
+  },
+  {
+    name: "LM Studio",
+    paths: ["LM Studio.app"],
+    provider: "LM Studio"
+  },
+  {
+    name: "OpenCode",
+    paths: ["OpenCode.app"],
+    provider: "OpenCode"
+  }
+];
+var CLI_CANDIDATES = [
+  {
+    command: "claude",
+    name: "Claude Code",
+    provider: "Anthropic",
+    versionFlag: "--version"
+  },
+  {
+    command: "chatgpt",
+    name: "ChatGPT CLI",
+    provider: "OpenAI",
+    versionFlag: "--version"
+  },
+  {
+    command: "codex",
+    name: "Codex CLI",
+    provider: "OpenAI",
+    versionFlag: "--version"
+  },
+  {
+    command: "cursor-agent",
+    name: "Cursor Agent CLI",
+    provider: "Cursor",
+    versionFlag: "--version"
+  },
+  {
+    command: "cursor",
+    name: "Cursor Editor CLI",
+    paths: ["/Applications/Cursor.app/Contents/Resources/app/bin/cursor"],
+    provider: "Cursor",
+    versionFlag: "--version"
+  },
+  {
+    command: "grok",
+    name: "Grok CLI",
+    provider: "xAI",
+    versionFlag: "--version"
+  },
+  {
+    command: "windsurf",
+    name: "Windsurf CLI",
+    paths: ["/Applications/Windsurf.app/Contents/Resources/app/bin/windsurf"],
+    provider: "Windsurf",
+    versionFlag: "--version"
+  },
+  {
+    command: "gemini",
+    name: "Gemini CLI",
+    provider: "Google",
+    versionFlag: "--version"
+  },
+  {
+    command: "kiro-cli",
+    name: "Kiro CLI",
+    provider: "Kiro",
+    versionFlag: "version"
+  },
+  {
+    command: "kiro",
+    name: "Kiro Editor CLI",
+    provider: "Kiro",
+    versionFlag: "--version"
+  },
+  {
+    command: "copilot",
+    name: "GitHub Copilot CLI",
+    provider: "Microsoft",
+    versionFlag: "--version"
+  },
+  {
+    command: "ollama",
+    name: "Ollama CLI",
+    paths: ["/Applications/Ollama.app/Contents/Resources/ollama"],
+    provider: "Ollama",
+    versionFlag: "--version"
+  },
+  {
+    command: "aider",
+    name: "Aider CLI",
+    provider: "Aider",
+    versionFlag: "--version"
+  },
+  {
+    command: "cn",
+    name: "Continue CLI",
+    provider: "Continue",
+    versionFlag: "--version"
+  },
+  {
+    command: "cline",
+    name: "Cline CLI",
+    provider: "Cline",
+    versionFlag: "--version"
+  },
+  {
+    command: "droid",
+    name: "Factory Droid CLI",
+    provider: "Factory",
+    versionFlag: "--version"
+  },
+  {
+    command: "lms",
+    name: "LM Studio CLI",
+    provider: "LM Studio",
+    versionFlag: "version"
+  },
+  {
+    command: "opencode",
+    name: "OpenCode CLI",
+    provider: "OpenCode",
+    versionFlag: "--version"
+  }
+];
+var VSCODE_CANDIDATES = [
+  {
+    extensionIds: ["anthropic.claude-code"],
+    name: "Claude Code Extension",
+    provider: "Anthropic"
+  },
+  {
+    extensionIds: ["openai.chatgpt"],
+    name: "Codex IDE Extension",
+    provider: "OpenAI"
+  },
+  {
+    extensionIds: ["codeium.codeium"],
+    name: "Windsurf / Codeium Extension",
+    provider: "Windsurf"
+  },
+  {
+    extensionIds: ["github.copilot"],
+    name: "GitHub Copilot",
+    provider: "Microsoft"
+  },
+  {
+    extensionIds: ["github.copilot-chat"],
+    name: "GitHub Copilot Chat",
+    provider: "Microsoft"
+  },
+  {
+    extensionIds: ["google.geminicodeassist", "google.gemini-code-assist"],
+    name: "Gemini Code Assist",
+    provider: "Google"
+  },
+  {
+    extensionIds: ["continue.continue"],
+    name: "Continue",
+    provider: "Continue"
+  },
+  {
+    extensionIds: ["saoudrizwan.claude-dev"],
+    name: "Cline",
+    provider: "Cline"
+  }
+];
+function detectAll() {
+  const results = [];
+  for (const candidate of APP_CANDIDATES) {
+    results.push(detectApp(candidate));
+  }
+  for (const candidate of CLI_CANDIDATES) {
+    results.push(detectCli(candidate));
+  }
+  const extensions = getVscodeExtensions();
+  for (const candidate of VSCODE_CANDIDATES) {
+    results.push(detectVscode(candidate, extensions));
+  }
+  return results;
+}
+function printResults(results) {
+  const providers = [
+    "Anthropic",
+    "OpenAI",
+    "Cursor",
+    "xAI",
+    "Windsurf",
+    "Google",
+    "Kiro",
+    "Microsoft",
+    "Ollama",
+    "Aider",
+    "Continue",
+    "Cline",
+    "Factory",
+    "LM Studio",
+    "OpenCode"
+  ];
+  for (const provider of providers) {
+    const clients = results.filter((c) => c.provider === provider);
+    const found = clients.filter((c) => c.detected);
+    console.log(chalk8.cyan(provider));
+    if (found.length === 0) {
+      console.log(chalk8.gray("  (none detected)"));
+    } else {
+      for (const client of found) {
+        const info = [client.path, client.version].filter(Boolean).join(" ");
+        console.log(`  ${chalk8.green("+")} ${chalk8.white(client.name.padEnd(28))} ${chalk8.gray(info)}`);
+      }
+    }
+    console.log();
+  }
+  const total = results.filter((c) => c.detected).length;
+  console.log(chalk8.white(`${total} AI client${total === 1 ? "" : "s"} detected`));
+}
+function detectAiClients(json) {
+  const results = detectAll();
+  if (json) {
+    console.log(JSON.stringify(results, null, 2));
+    return;
+  }
+  printResults(results);
+}
+
+// src/actions/printVersion.ts
+import chalk9 from "chalk";
+function printVersion() {
+  console.log(chalk9.cyan("ariestools"));
+  console.log(`  Node:    ${process.version}`);
+  console.log(`  Platform: ${process.platform}`);
+  console.log(`  Arch:     ${process.arch}`);
+}
+
+// src/actions/sync/syncAiConfig.ts
+import {
+  copyFileSync,
+  cpSync,
+  existsSync as existsSync8,
+  rmSync as rmSync4
+} from "fs";
+import path12 from "path";
+import chalk10 from "chalk";
+function resolveMapping(from, cwd) {
+  if (from === "claude") {
+    return {
+      destDir: path12.join(cwd, ".agents"),
+      destFile: path12.join(cwd, "AGENTS.md"),
+      sourceDir: path12.join(cwd, ".claude"),
+      sourceFile: path12.join(cwd, "CLAUDE.md")
+    };
+  }
+  return {
+    destDir: path12.join(cwd, ".claude"),
+    destFile: path12.join(cwd, "CLAUDE.md"),
+    sourceDir: path12.join(cwd, ".agents"),
+    sourceFile: path12.join(cwd, "AGENTS.md")
+  };
+}
+function syncAiConfig(from) {
+  const cwd = process.cwd();
+  const mapping = resolveMapping(from, cwd);
+  if (!existsSync8(mapping.sourceDir)) {
+    throw new Error(chalk10.red(`Source directory not found: ${mapping.sourceDir}`));
+  }
+  if (!existsSync8(mapping.sourceFile)) {
+    throw new Error(chalk10.red(`Source file not found: ${mapping.sourceFile}`));
+  }
+  if (existsSync8(mapping.destDir)) {
+    rmSync4(mapping.destDir, { recursive: true });
+  }
+  if (existsSync8(mapping.destFile)) {
+    rmSync4(mapping.destFile);
+  }
+  cpSync(mapping.sourceDir, mapping.destDir, { recursive: true });
+  copyFileSync(mapping.sourceFile, mapping.destFile);
+  const label = from === "claude" ? "Claude \u2192 Codex" : "Codex \u2192 Claude";
+  console.log(chalk10.green(`Synced ${label}:`));
+  console.log(`  ${path12.basename(mapping.sourceDir)}/ \u2192 ${path12.basename(mapping.destDir)}/`);
+  console.log(`  ${path12.basename(mapping.sourceFile)} \u2192 ${path12.basename(mapping.destFile)}`);
+}
+
+// src/actions/wallet/account/deriveAndAdd.ts
+import chalk11 from "chalk";
+
+// src/actions/wallet/paths.ts
+import OS from "os";
+import PATH from "path";
+function walletRoot() {
+  const override = process.env.ARIES_WALLET_HOME;
+  if (override) return override;
+  return PATH.join(OS.homedir(), ".aries", "wallet");
+}
+function walletPaths(root = walletRoot()) {
+  return {
+    root,
+    password: PATH.join(root, "password.json"),
+    phrases: PATH.join(root, "phrases.json"),
+    active: PATH.join(root, "active.json"),
+    addressBooks: PATH.join(root, "address-books.json"),
+    contacts: PATH.join(root, "contacts.json"),
+    networks: PATH.join(root, "networks.json"),
+    session: PATH.join(root, "session.json"),
+    machineId: PATH.join(root, ".machine-id")
+  };
+}
+
+// src/actions/wallet/storage.ts
+import FS from "fs";
+import PATH2 from "path";
+function ensureWalletDir(root = walletRoot()) {
+  if (!FS.existsSync(root)) {
+    FS.mkdirSync(root, { recursive: true, mode: 448 });
+    return;
+  }
+  try {
+    FS.chmodSync(root, 448);
+  } catch {
+  }
+}
+function readJsonFile(file) {
+  if (!FS.existsSync(file)) return void 0;
+  const raw = FS.readFileSync(file, "utf8");
+  if (raw.trim().length === 0) return void 0;
+  return JSON.parse(raw);
+}
+function writeJsonFile(file, value) {
+  ensureWalletDir(PATH2.dirname(file));
+  const tmp = `${file}.tmp`;
+  FS.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  FS.renameSync(tmp, file);
+  try {
+    FS.chmodSync(file, 384);
+  } catch {
+  }
+}
+function deleteFile(file) {
+  if (FS.existsSync(file)) FS.unlinkSync(file);
+}
+
+// src/actions/wallet/addressBook/storage.ts
+var ADDRESS_BOOK_VERSION = 1;
+function readAllAddressBooks() {
+  return readJsonFile(walletPaths().addressBooks) ?? {};
+}
+function writeAllAddressBooks(data) {
+  writeJsonFile(walletPaths().addressBooks, data);
+}
+function readAddressBook(rootAddress) {
+  const all = readAllAddressBooks();
+  const key = rootAddress.toLowerCase();
+  return all[key] ?? {
+    rootAddress: key,
+    entries: [{ offset: "0" }, { offset: "1" }, { offset: "2" }],
+    version: ADDRESS_BOOK_VERSION
+  };
+}
+function writeAddressBook(book) {
+  const all = readAllAddressBooks();
+  all[book.rootAddress.toLowerCase()] = book;
+  writeAllAddressBooks(all);
+}
+function removeAddressBook(rootAddress) {
+  const all = readAllAddressBooks();
+  const key = rootAddress.toLowerCase();
+  if (key in all) {
+    delete all[key];
+    writeAllAddressBooks(all);
+  }
+}
+function upsertAddressBookEntry(rootAddress, entry) {
+  const book = readAddressBook(rootAddress);
+  const existing = book.entries.find((e) => e.offset === entry.offset);
+  if (existing) {
+    if (entry.label !== void 0) existing.label = entry.label;
+  } else {
+    book.entries.push(entry);
+  }
+  writeAddressBook(book);
+  return book;
+}
+function removeAddressBookEntry(rootAddress, offset) {
+  const book = readAddressBook(rootAddress);
+  book.entries = book.entries.filter((e) => e.offset !== offset);
+  writeAddressBook(book);
+  return book;
+}
+
+// src/actions/wallet/account/getActiveWallet.ts
+import { HDWallet } from "@xyo-network/sdk-js";
+import { DEFAULT_WALLET_PATH } from "@xyo-network/xl1-protocol-sdk";
+
+// src/actions/wallet/prompt.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import {
+  closeSync as closeSync2,
+  openSync as openSync2,
+  readSync,
+  writeSync as writeSync2
+} from "fs";
+var CTRL_C = 3;
+var ENTER = 13;
+var NEWLINE = 10;
+var BACKSPACE_DELETE = 127;
+var BACKSPACE = 8;
+function readChars(readFd, writeFd, mask) {
+  const chars = [];
+  const buf = Buffer.alloc(1);
+  for (; ; ) {
+    const bytes = readSync(readFd, buf, 0, 1, null);
+    if (bytes === 0) break;
+    const ch = buf[0];
+    if (ch === ENTER || ch === NEWLINE) break;
+    if (ch === CTRL_C) {
+      writeSync2(writeFd, "\n");
+      throw new Error("Aborted");
+    }
+    if (ch === BACKSPACE_DELETE || ch === BACKSPACE) {
+      if (chars.length > 0) {
+        chars.pop();
+        writeSync2(writeFd, "\b \b");
+      }
+      continue;
+    }
+    chars.push(ch);
+    writeSync2(writeFd, mask ? "*" : String.fromCodePoint(ch));
+  }
+  writeSync2(writeFd, "\n");
+  return Buffer.from(chars).toString("utf8");
+}
+function saveStty(readFd) {
+  try {
+    return execFileSync2("stty", ["-g"], {
+      stdio: [readFd, "pipe", "ignore"],
+      encoding: "utf8"
+    }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function applyStty(readFd, args) {
+  try {
+    execFileSync2("stty", args, { stdio: [readFd, "ignore", "ignore"] });
+  } catch {
+  }
+}
+function promptTty(options) {
+  const readFd = openSync2("/dev/tty", "r");
+  const writeFd = openSync2("/dev/tty", "w");
+  const saved = saveStty(readFd);
+  try {
+    if (saved) applyStty(readFd, ["-echo", "-icanon", "min", "1", "time", "0"]);
+    writeSync2(writeFd, options.prompt);
+    return readChars(readFd, writeFd, options.mask === true);
+  } finally {
+    if (saved) applyStty(readFd, [saved]);
+    try {
+      closeSync2(readFd);
+    } catch {
+    }
+    try {
+      closeSync2(writeFd);
+    } catch {
+    }
+  }
+}
+function promptPassword(prompt = "Password: ") {
+  const env = process.env.ARIES_WALLET_PASSWORD;
+  if (env !== void 0 && env.length > 0) return env;
+  return promptTty({ prompt, mask: true });
+}
+function promptText(prompt) {
+  return promptTty({ prompt, mask: false });
+}
+
+// src/actions/wallet/session/sessionCache.ts
+import { webcrypto as webcrypto3 } from "crypto";
+
+// src/actions/wallet/passwordKey.ts
+import { webcrypto } from "crypto";
+var subtle = webcrypto.subtle;
+var INITIALIZATION_VECTOR_LENGTH = 12;
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_BYTES = 16;
+var PasswordKey = class _PasswordKey {
+  password;
+  salt;
+  constructor(password, salt = _PasswordKey.generateSalt()) {
+    this.password = password;
+    this.salt = salt;
+  }
+  static async decryptString(key, data) {
+    const encryptedData = new Uint8Array(Buffer.from(data, "base64"));
+    const iv = encryptedData.slice(0, INITIALIZATION_VECTOR_LENGTH);
+    const ciphertext = encryptedData.slice(INITIALIZATION_VECTOR_LENGTH);
+    const decrypted = await subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+    return new TextDecoder("utf-8").decode(decrypted);
+  }
+  static async encryptString(key, data) {
+    const iv = webcrypto.getRandomValues(new Uint8Array(INITIALIZATION_VECTOR_LENGTH));
+    const ciphertext = await subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(data));
+    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+    combined.set(iv, 0);
+    combined.set(new Uint8Array(ciphertext), iv.length);
+    return Buffer.from(combined).toString("base64");
+  }
+  static generateSalt() {
+    const array = new Uint8Array(SALT_BYTES);
+    webcrypto.getRandomValues(array);
+    return [...array].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  static async getHashFromKey(key) {
+    const exported = await subtle.exportKey("raw", key);
+    const digest = await subtle.digest("SHA-256", exported);
+    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  static async importEncryptionKey(rawKey) {
+    return await subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  }
+  static async importExtractableKey(rawKey) {
+    return await subtle.importKey("raw", rawKey, { name: "AES-GCM" }, true, ["encrypt", "decrypt"]);
+  }
+  static async serializeKey(key, salt = _PasswordKey.generateSalt()) {
+    const hash = await _PasswordKey.getHashFromKey(key);
+    return { hash, salt };
+  }
+  async deriveKey() {
+    const encoder = new TextEncoder();
+    const passphraseKey = await subtle.importKey(
+      "raw",
+      encoder.encode(this.password),
+      { name: "PBKDF2" },
+      false,
+      ["deriveKey"]
+    );
+    return await subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode(this.salt),
+        iterations: PBKDF2_ITERATIONS,
+        hash: "SHA-256"
+      },
+      passphraseKey,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  }
+};
+async function encryptWithKey(key, data) {
+  const exported = await subtle.exportKey("raw", key);
+  const encKey = await PasswordKey.importEncryptionKey(exported);
+  return await PasswordKey.encryptString(encKey, data);
+}
+async function decryptWithKey(key, data) {
+  const exported = await subtle.exportKey("raw", key);
+  const encKey = await PasswordKey.importEncryptionKey(exported);
+  return await PasswordKey.decryptString(encKey, data);
+}
+
+// src/actions/wallet/session/machineId.ts
+import { webcrypto as webcrypto2 } from "crypto";
+import FS2 from "fs";
+import OS2 from "os";
+function generateMachineSecret() {
+  const bytes = new Uint8Array(32);
+  webcrypto2.getRandomValues(bytes);
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function loadMachineSecret() {
+  ensureWalletDir();
+  const path13 = walletPaths().machineId;
+  if (FS2.existsSync(path13)) {
+    return FS2.readFileSync(path13, "utf8").trim();
+  }
+  const secret = generateMachineSecret();
+  FS2.writeFileSync(path13, `${secret}
+`, { mode: 384 });
+  try {
+    FS2.chmodSync(path13, 384);
+  } catch {
+  }
+  return secret;
+}
+async function deriveMachineKey() {
+  const secret = loadMachineSecret();
+  const stable = `${OS2.hostname()}:${OS2.userInfo().username}:${secret}`;
+  const passwordKey = new PasswordKey(stable, "aries-wallet-machine-kek-v1");
+  return await passwordKey.deriveKey();
+}
+
+// src/actions/wallet/session/sessionCache.ts
+var subtle2 = webcrypto3.subtle;
+var DEFAULT_SESSION_TTL_SECONDS = 15 * 60;
+async function unlockSession(passwordKey, ttlSeconds = DEFAULT_SESSION_TTL_SECONDS) {
+  const machineKey = await deriveMachineKey();
+  const exported = await subtle2.exportKey("raw", passwordKey);
+  const exportedBase64 = Buffer.from(new Uint8Array(exported)).toString("base64");
+  const encryptedKey = await encryptWithKey(machineKey, exportedBase64);
+  const expiresAt = Date.now() + ttlSeconds * 1e3;
+  const data = { encryptedKey, expiresAt };
+  writeJsonFile(walletPaths().session, data);
+  return expiresAt;
+}
+function lockSession() {
+  deleteFile(walletPaths().session);
+}
+async function readSession() {
+  const data = readJsonFile(walletPaths().session);
+  if (!data) return void 0;
+  if (data.expiresAt <= Date.now()) {
+    lockSession();
+    return void 0;
+  }
+  try {
+    const machineKey = await deriveMachineKey();
+    const exportedBase64 = await decryptWithKey(machineKey, data.encryptedKey);
+    const raw = Buffer.from(exportedBase64, "base64");
+    return await PasswordKey.importExtractableKey(
+      raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength)
+    );
+  } catch {
+    lockSession();
+    return void 0;
+  }
+}
+
+// src/actions/wallet/password/passwordStorage.ts
+function readPassword() {
+  return readJsonFile(walletPaths().password);
+}
+function writePassword(values) {
+  writeJsonFile(walletPaths().password, values);
+}
+function hasPassword() {
+  return readPassword() !== void 0;
+}
+
+// src/actions/wallet/password/validatePassword.ts
+async function validatePassword(password) {
+  const stored = readPassword();
+  if (!stored) return void 0;
+  const passwordKey = new PasswordKey(password, stored.salt);
+  const key = await passwordKey.deriveKey();
+  const hash = await PasswordKey.getHashFromKey(key);
+  if (hash !== stored.hash) return void 0;
+  return key;
+}
+
+// src/actions/wallet/password/getActiveKey.ts
+async function getActiveKey() {
+  if (!hasPassword()) {
+    throw new Error("Wallet not initialized. Run `aries wallet create` or `aries wallet import` first.");
+  }
+  const cached = await readSession();
+  if (cached) return cached;
+  const password = promptPassword("Wallet password: ");
+  const key = await validatePassword(password);
+  if (!key) throw new Error("Incorrect password.");
+  return key;
+}
+
+// src/actions/wallet/seedPhrase/phraseStorage.ts
+function readPhrases() {
+  const data = readJsonFile(walletPaths().phrases);
+  return data?.phrases ?? [];
+}
+function writePhrases(phrases) {
+  writeJsonFile(walletPaths().phrases, { phrases });
+}
+function readActive() {
+  return readJsonFile(walletPaths().active) ?? {};
+}
+function writeActive(active) {
+  writeJsonFile(walletPaths().active, active);
+}
+function findPhrase(id) {
+  return readPhrases().find((p) => p.id === id || p.label === id);
+}
+function getActivePhrase() {
+  const phrases = readPhrases();
+  if (phrases.length === 0) return void 0;
+  const active = readActive();
+  if (active.phraseId) {
+    const found = phrases.find((p) => p.id === active.phraseId);
+    if (found) return found;
+  }
+  return phrases[0];
+}
+
+// src/actions/wallet/account/getActiveWallet.ts
+async function getActiveWallet() {
+  const record = getActivePhrase();
+  if (!record) throw new Error("No active wallet. Run `aries wallet create` or `aries wallet import` first.");
+  const key = await getActiveKey();
+  const mnemonic = await decryptWithKey(key, record.encryptedPhrase);
+  const rootWallet = await HDWallet.fromPhrase(mnemonic, DEFAULT_WALLET_PATH);
+  return {
+    record,
+    mnemonic,
+    rootWallet
+  };
+}
+async function deriveAccount(rootWallet, offset) {
+  return await rootWallet.derivePath(offset);
+}
+
+// src/actions/wallet/account/deriveAndAdd.ts
+async function deriveAndAdd(options) {
+  const { rootWallet } = await getActiveWallet();
+  const account = await deriveAccount(rootWallet, options.offset);
+  upsertAddressBookEntry(rootWallet.address, { offset: options.offset, label: options.label });
+  console.log(chalk11.green(`Derived account at offset ${chalk11.cyan(options.offset)}: 0x${account.address}`));
+  if (options.label) console.log(chalk11.gray(`  label: ${options.label}`));
+}
+
+// src/actions/wallet/account/labelAccount.ts
+import chalk12 from "chalk";
+async function labelAccount(offset, label) {
+  const { rootWallet } = await getActiveWallet();
+  upsertAddressBookEntry(rootWallet.address, { offset, label });
+  console.log(chalk12.green(`Labeled account ${chalk12.cyan(offset)} as ${chalk12.white(label)}`));
+}
+
+// src/actions/wallet/account/listAccounts.ts
+import chalk13 from "chalk";
+async function listAccounts() {
+  const { record, rootWallet } = await getActiveWallet();
+  const book = readAddressBook(rootWallet.address);
+  console.log(chalk13.cyan(`Wallet ${record.label} (${record.id})`));
+  console.log(chalk13.gray(`  root: ${rootWallet.address}`));
+  console.log();
+  if (book.entries.length === 0) {
+    console.log(chalk13.gray("  No derived accounts. Run `aries wallet account derive <offset>`."));
+    return;
+  }
+  for (const entry of book.entries) {
+    const account = await deriveAccount(rootWallet, entry.offset);
+    const offset = chalk13.cyan(entry.offset.padEnd(6));
+    const label = chalk13.white((entry.label ?? "").padEnd(20));
+    console.log(`  ${offset} ${label} 0x${account.address}`);
+  }
+}
+
+// src/actions/wallet/account/removeAccount.ts
+import chalk14 from "chalk";
+async function removeAccount(offset) {
+  const { rootWallet } = await getActiveWallet();
+  removeAddressBookEntry(rootWallet.address, offset);
+  console.log(chalk14.green(`Removed account at offset ${chalk14.cyan(offset)} from address book`));
+}
+
+// src/actions/wallet/account/showAccount.ts
+import chalk15 from "chalk";
+async function showAccount(offset) {
+  const { rootWallet } = await getActiveWallet();
+  const book = readAddressBook(rootWallet.address);
+  const entry = book.entries.find((e) => e.offset === offset);
+  const account = await deriveAccount(rootWallet, offset);
+  console.log(chalk15.cyan(`Account ${offset}`));
+  console.log(`  ${chalk15.gray("label:")}    ${entry?.label ?? "\u2014"}`);
+  console.log(`  ${chalk15.gray("address:")}  0x${account.address}`);
+  if (account.public) console.log(`  ${chalk15.gray("public:")}   ${account.public.hex}`);
+  console.log(`  ${chalk15.gray("path:")}     ${offset}`);
+}
+
+// src/actions/wallet/backup/exportBackup.ts
+import FS3 from "fs";
+import chalk16 from "chalk";
+
+// src/actions/wallet/contact/storage.ts
+var CONTACTS_VERSION = 1;
+function readContacts() {
+  return readJsonFile(walletPaths().contacts) ?? {
+    entries: [],
+    version: CONTACTS_VERSION
+  };
+}
+function writeContacts(file) {
+  writeJsonFile(walletPaths().contacts, file);
+}
+
+// src/actions/wallet/backup/exportBackup.ts
+var SCHEMA = "network.xyo.wallet.backup";
+var VERSION = 1;
+var ADDRESS_BOOK_SCHEMA = "network.xyo.wallet.addressBook";
+var CONTACTS_SCHEMA = "network.xyo.wallet.contacts";
+function exportBackup(options) {
+  const exportedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const entries = [];
+  const sources = [];
+  const addressBooks = readAllAddressBooks();
+  for (const book of Object.values(addressBooks)) {
+    entries.push({
+      ...book,
+      schema: ADDRESS_BOOK_SCHEMA,
+      exportedAt
+    });
+    if (!sources.includes(ADDRESS_BOOK_SCHEMA)) sources.push(ADDRESS_BOOK_SCHEMA);
+  }
+  const contacts = readContacts();
+  if (contacts.entries.length > 0) {
+    entries.push({
+      ...contacts,
+      schema: CONTACTS_SCHEMA,
+      exportedAt
+    });
+    sources.push(CONTACTS_SCHEMA);
+  }
+  const backup = {
+    schema: SCHEMA,
+    version: VERSION,
+    entries,
+    exportedAt,
+    sources
+  };
+  FS3.writeFileSync(options.file, `${JSON.stringify(backup, null, 2)}
+`, { mode: 384 });
+  console.log(chalk16.green(`Backup written to ${options.file}`));
+  console.log(chalk16.gray(`  ${entries.length} entries, sources: ${sources.join(", ")}`));
+}
+
+// src/actions/wallet/backup/importBackup.ts
+import FS4 from "fs";
+import chalk17 from "chalk";
+function importBackup(options) {
+  const raw = FS4.readFileSync(options.file, "utf8");
+  const parsed = JSON.parse(raw);
+  if (parsed.schema !== "network.xyo.wallet.backup") {
+    throw new Error(`Not a wallet backup (schema=${parsed.schema}).`);
+  }
+  const allBooks = readAllAddressBooks();
+  let booksImported = 0;
+  let contactsImported = 0;
+  const existingContacts = readContacts();
+  for (const entry of parsed.entries) {
+    if (entry.schema === "network.xyo.wallet.addressBook") {
+      const book = entry;
+      const key = book.rootAddress.toLowerCase();
+      const merged = allBooks[key] ? mergeAddressBooks(allBooks[key], book) : {
+        rootAddress: key,
+        entries: book.entries,
+        version: book.version
+      };
+      allBooks[key] = merged;
+      booksImported++;
+    } else if (entry.schema === "network.xyo.wallet.contacts") {
+      const contacts = entry;
+      for (const contact of contacts.entries) {
+        upsertContact(existingContacts, contact);
+        contactsImported++;
+      }
+    }
+  }
+  if (booksImported > 0) writeAllAddressBooks(allBooks);
+  if (contactsImported > 0) writeContacts(existingContacts);
+  console.log(chalk17.green(`Imported backup from ${options.file}`));
+  console.log(chalk17.gray(`  address books: ${booksImported}, contacts: ${contactsImported}`));
+}
+function mergeAddressBooks(existing, incoming) {
+  const merged = {
+    rootAddress: existing.rootAddress,
+    version: Math.max(existing.version, incoming.version),
+    entries: [...existing.entries]
+  };
+  for (const entry of incoming.entries) {
+    const found = merged.entries.find((e) => e.offset === entry.offset);
+    if (found) {
+      if (entry.label !== void 0) found.label = entry.label;
+    } else {
+      merged.entries.push(entry);
+    }
+  }
+  return merged;
+}
+function upsertContact(file, contact) {
+  const normalized = contact.address.toLowerCase();
+  const found = file.entries.find((e) => e.address.toLowerCase() === normalized);
+  if (found) {
+    found.label = contact.label;
+    found.updatedAt = contact.updatedAt;
+  } else {
+    file.entries.push({ ...contact, address: normalized });
+  }
+}
+
+// src/actions/wallet/balance/getBalance.ts
+import { XL1Amount } from "@xyo-network/xl1-protocol-sdk";
+import chalk18 from "chalk";
+
+// src/actions/wallet/client/walletClient.ts
+import {
+  basicRemoteViewerLocator,
+  ProviderFactoryLocator,
+  SimpleXyoConnectionRunner,
+  SimpleXyoGatewayRunner,
+  SimpleXyoRunner,
+  SimpleXyoSigner,
+  XyoGatewayRunnerMoniker,
+  XyoRunnerMoniker,
+  XyoViewerMoniker
+} from "@xyo-network/xl1-sdk";
+async function loadValidators() {
+  try {
+    const mod = await import("@xyo-network/chain-validation");
+    return {
+      validateHydratedBlock: mod.validateHydratedBlock,
+      validateHydratedBlockState: mod.validateHydratedBlockState
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function createReadOnlyClient(rpcUrl) {
+  const validators = await loadValidators();
+  const viewerLocator = await basicRemoteViewerLocator(
+    "aries-wallet-readonly",
+    { rpc: { protocol: "http", url: rpcUrl } },
+    void 0,
+    validators ? { validators } : void 0
+  );
+  const viewer = await viewerLocator.getInstance(XyoViewerMoniker);
+  return { viewer, locator: viewerLocator };
+}
+async function createWalletClient(rpcUrl, account) {
+  const validators = await loadValidators();
+  const viewerLocator = await basicRemoteViewerLocator(
+    "aries-wallet",
+    { rpc: { protocol: "http", url: rpcUrl } },
+    void 0,
+    validators ? { validators } : void 0
+  );
+  const locator = new ProviderFactoryLocator(viewerLocator.context, {});
+  locator.register(SimpleXyoSigner.factory(SimpleXyoSigner.dependencies, { account }));
+  locator.register(SimpleXyoGatewayRunner.factory(SimpleXyoGatewayRunner.dependencies, {}));
+  locator.register(SimpleXyoRunner.factory(SimpleXyoRunner.dependencies, {}));
+  locator.register(SimpleXyoConnectionRunner.factory(SimpleXyoConnectionRunner.dependencies, {}));
+  locator.validateDependencies();
+  const gateway = await locator.getInstance(XyoGatewayRunnerMoniker);
+  const runner = await locator.getInstance(XyoRunnerMoniker);
+  const viewer = await locator.getInstance(XyoViewerMoniker);
+  return {
+    gateway,
+    runner,
+    viewer,
+    connection: gateway.connection,
+    locator
+  };
+}
+
+// src/actions/wallet/network/storage.ts
+var DEFAULT_NETWORKS = [
+  {
+    id: "xl1-mainnet",
+    label: "XL1 Mainnet",
+    rpcUrl: "https://node.xyo.network",
+    isCustom: false
+  },
+  {
+    id: "xl1-testnet",
+    label: "XL1 Testnet",
+    rpcUrl: "https://testnet.node.xyo.network",
+    isCustom: false
+  }
+];
+function readNetworks() {
+  const data = readJsonFile(walletPaths().networks);
+  if (data) return data;
+  const seeded = {
+    networks: DEFAULT_NETWORKS,
+    activeId: DEFAULT_NETWORKS[0].id
+  };
+  writeJsonFile(walletPaths().networks, seeded);
+  return seeded;
+}
+function writeNetworks(file) {
+  writeJsonFile(walletPaths().networks, file);
+}
+function getActiveNetwork() {
+  const file = readNetworks();
+  const found = file.networks.find((n) => n.id === file.activeId);
+  if (!found) throw new Error(`Active network ${file.activeId} not found.`);
+  return found;
+}
+
+// src/actions/wallet/balance/getBalance.ts
+async function getBalance(options = {}) {
+  const offset = options.offset ?? "0";
+  const { rootWallet } = await getActiveWallet();
+  const account = await deriveAccount(rootWallet, offset);
+  const network = getActiveNetwork();
+  const { viewer } = await createReadOnlyClient(network.rpcUrl);
+  const atto = await viewer.account.balance.accountBalance(account.address);
+  const display = new XL1Amount(atto).toString();
+  console.log(`${chalk18.cyan("balance:")} ${display} XL1`);
+  console.log(`${chalk18.gray("atto:")}    ${atto}`);
+  console.log(`${chalk18.gray("address:")} 0x${account.address}`);
+  console.log(`${chalk18.gray("network:")} ${network.id} (${network.rpcUrl})`);
+}
+
+// src/actions/wallet/contact/contactActions.ts
+import chalk19 from "chalk";
+function normalize(address) {
+  return address.toLowerCase();
+}
+function listContacts() {
+  const file = readContacts();
+  if (file.entries.length === 0) {
+    console.log(chalk19.gray("No contacts. Run `aries wallet contact add <address> <label>` to add one."));
+    return;
+  }
+  for (const entry of file.entries) {
+    console.log(`  ${chalk19.white(entry.label.padEnd(20))} ${entry.address}`);
+  }
+}
+function addContact(address, label) {
+  const file = readContacts();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const normalized = normalize(address);
+  const existing = file.entries.find((e) => normalize(e.address) === normalized);
+  if (existing) {
+    existing.label = label;
+    existing.updatedAt = now;
+  } else {
+    file.entries.push({
+      address: normalized,
+      label,
+      createdAt: now,
+      updatedAt: now
+    });
+  }
+  writeContacts(file);
+  console.log(chalk19.green(`Saved contact ${chalk19.cyan(label)} (${normalized})`));
+}
+function renameContact(address, label) {
+  addContact(address, label);
+}
+function removeContact(address) {
+  const file = readContacts();
+  const normalized = normalize(address);
+  const before = file.entries.length;
+  file.entries = file.entries.filter((e) => normalize(e.address) !== normalized);
+  if (file.entries.length === before) throw new Error(`Contact not found: ${address}`);
+  writeContacts(file);
+  console.log(chalk19.green(`Removed contact ${normalized}`));
+}
+
+// src/actions/wallet/network/networkActions.ts
+import chalk20 from "chalk";
+function listNetworks() {
+  const file = readNetworks();
+  for (const network of file.networks) {
+    const marker = network.id === file.activeId ? chalk20.green("* ") : "  ";
+    const id = chalk20.cyan(network.id.padEnd(20));
+    const label = chalk20.white(network.label.padEnd(20));
+    const custom = network.isCustom ? chalk20.gray("(custom)") : "";
+    console.log(`${marker}${id} ${label} ${network.rpcUrl} ${custom}`);
+  }
+}
+function useNetwork(id) {
+  const file = readNetworks();
+  const found = file.networks.find((n) => n.id === id);
+  if (!found) throw new Error(`Network not found: ${id}`);
+  file.activeId = id;
+  writeNetworks(file);
+  console.log(chalk20.green(`Active network set to ${chalk20.cyan(id)}`));
+}
+function addNetwork(options) {
+  const file = readNetworks();
+  if (file.networks.some((n) => n.id === options.id)) {
+    throw new Error(`Network already exists: ${options.id}`);
+  }
+  const record = {
+    id: options.id,
+    label: options.label ?? options.id,
+    rpcUrl: options.rpcUrl,
+    chainId: options.chainId,
+    isCustom: true
+  };
+  file.networks.push(record);
+  writeNetworks(file);
+  console.log(chalk20.green(`Added network ${chalk20.cyan(options.id)} (${options.rpcUrl})`));
+}
+function removeNetwork(id) {
+  const file = readNetworks();
+  const target = file.networks.find((n) => n.id === id);
+  if (!target) throw new Error(`Network not found: ${id}`);
+  if (!target.isCustom) throw new Error(`Cannot remove built-in network: ${id}`);
+  file.networks = file.networks.filter((n) => n.id !== id);
+  if (file.activeId === id) file.activeId = file.networks[0]?.id ?? "";
+  writeNetworks(file);
+  console.log(chalk20.green(`Removed network ${chalk20.cyan(id)}`));
+}
+
+// src/actions/wallet/password/changePassword.ts
+import chalk21 from "chalk";
+async function changePassword() {
+  const current = promptPassword("Current password: ");
+  const oldKey = await validatePassword(current);
+  if (!oldKey) throw new Error("Incorrect password.");
+  const next = promptPassword("New password: ");
+  const confirmed = promptPassword("Confirm new password: ");
+  if (next !== confirmed) throw new Error("Passwords do not match.");
+  if (next.length === 0) throw new Error("Password cannot be empty.");
+  const salt = PasswordKey.generateSalt();
+  const newKey = await new PasswordKey(next, salt).deriveKey();
+  const phrases = readPhrases();
+  for (const phrase of phrases) {
+    const mnemonic = await decryptWithKey(oldKey, phrase.encryptedPhrase);
+    phrase.encryptedPhrase = await encryptWithKey(newKey, mnemonic);
+  }
+  writePhrases(phrases);
+  writePassword(await PasswordKey.serializeKey(newKey, salt));
+  lockSession();
+  console.log(chalk21.green("Password changed. Re-unlock to start a new session."));
+}
+
+// src/actions/wallet/seedPhrase/createPhrase.ts
+import { HDWallet as HDWallet2 } from "@xyo-network/sdk-js";
+import chalk22 from "chalk";
+
+// src/actions/wallet/password/setPassword.ts
+async function setPassword(password) {
+  if (password.length === 0) throw new Error("Password cannot be empty");
+  const salt = PasswordKey.generateSalt();
+  const passwordKey = new PasswordKey(password, salt);
+  const key = await passwordKey.deriveKey();
+  const values = await PasswordKey.serializeKey(key, salt);
+  writePassword(values);
+  return { key, salt };
+}
+
+// src/actions/wallet/password/initOrUnlock.ts
+async function initOrUnlock() {
+  if (hasPassword()) return await getActiveKey();
+  const fromEnv = process.env.ARIES_WALLET_PASSWORD;
+  if (fromEnv !== void 0 && fromEnv.length > 0) {
+    const { key: key2 } = await setPassword(fromEnv);
+    return key2;
+  }
+  const password = promptPassword("Set wallet password: ");
+  const confirmed = promptPassword("Confirm password: ");
+  if (password !== confirmed) throw new Error("Passwords do not match.");
+  const { key } = await setPassword(password);
+  return key;
+}
+
+// src/actions/wallet/seedPhrase/idGen.ts
+import { webcrypto as webcrypto4 } from "crypto";
+function generatePhraseId() {
+  const bytes = new Uint8Array(8);
+  webcrypto4.getRandomValues(bytes);
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/actions/wallet/seedPhrase/createPhrase.ts
+async function createPhrase(options) {
+  const key = await initOrUnlock();
+  const mnemonic = HDWallet2.generateMnemonic();
+  const encryptedPhrase = await encryptWithKey(key, mnemonic);
+  const record = {
+    id: generatePhraseId(),
+    label: options.label,
+    walletKind: "user",
+    encryptedPhrase,
+    createdAt: Date.now()
+  };
+  const phrases = readPhrases();
+  phrases.push(record);
+  writePhrases(phrases);
+  if (phrases.length === 1) writeActive({ phraseId: record.id });
+  console.log(chalk22.green(`Created wallet ${chalk22.cyan(record.label)} (id ${record.id})`));
+  console.log();
+  console.log(chalk22.yellow("Recovery phrase \u2014 write this down and store it safely:"));
+  console.log();
+  console.log(`  ${chalk22.white(mnemonic)}`);
+  console.log();
+  console.log(chalk22.gray("You will not be shown this phrase again unless you run `aries wallet export`."));
+  return record;
+}
+
+// src/actions/wallet/seedPhrase/exportPhrase.ts
+import chalk23 from "chalk";
+async function exportPhrase(options = {}) {
+  const record = options.id ? findPhrase(options.id) : getActivePhrase();
+  if (!record) throw new Error("Wallet not found.");
+  const key = await getActiveKey();
+  const mnemonic = await decryptWithKey(key, record.encryptedPhrase);
+  console.log(chalk23.yellow(`Recovery phrase for ${chalk23.cyan(record.label)} (id ${record.id}):`));
+  console.log();
+  console.log(`  ${chalk23.white(mnemonic)}`);
+  return mnemonic;
+}
+
+// src/actions/wallet/seedPhrase/importPhrase.ts
+import { HDWallet as HDWallet3 } from "@xyo-network/sdk-js";
+import chalk24 from "chalk";
+async function importPhrase(options) {
+  const key = await initOrUnlock();
+  const mnemonic = (options.phrase ?? promptText("Recovery phrase: ")).trim();
+  if (mnemonic.split(/\s+/).length < 12) {
+    throw new Error("Recovery phrase must be at least 12 words.");
+  }
+  await HDWallet3.fromPhrase(mnemonic);
+  const encryptedPhrase = await encryptWithKey(key, mnemonic);
+  const record = {
+    id: generatePhraseId(),
+    label: options.label,
+    walletKind: "user",
+    encryptedPhrase,
+    createdAt: Date.now()
+  };
+  const phrases = readPhrases();
+  phrases.push(record);
+  writePhrases(phrases);
+  if (phrases.length === 1) writeActive({ phraseId: record.id });
+  console.log(chalk24.green(`Imported wallet ${chalk24.cyan(record.label)} (id ${record.id})`));
+  return record;
+}
+
+// src/actions/wallet/seedPhrase/listPhrases.ts
+import chalk25 from "chalk";
+function listPhrases() {
+  const phrases = readPhrases();
+  if (phrases.length === 0) {
+    console.log(chalk25.gray("No wallets. Run `aries wallet create` or `aries wallet import` to add one."));
+    return;
+  }
+  const active = readActive();
+  for (const phrase of phrases) {
+    const marker = phrase.id === active.phraseId ? chalk25.green("* ") : "  ";
+    const created = new Date(phrase.createdAt).toISOString();
+    console.log(`${marker}${chalk25.cyan(phrase.label.padEnd(20))} ${chalk25.gray(phrase.id)}  ${chalk25.gray(created)}`);
+  }
+}
+
+// src/actions/wallet/seedPhrase/removePhrase.ts
+import { HDWallet as HDWallet4 } from "@xyo-network/sdk-js";
+import { DEFAULT_WALLET_PATH as DEFAULT_WALLET_PATH2 } from "@xyo-network/xl1-protocol-sdk";
+import chalk26 from "chalk";
+async function removePhrase(options) {
+  const phrases = readPhrases();
+  const target = phrases.find((p) => p.id === options.id || p.label === options.id);
+  if (!target) throw new Error(`Wallet not found: ${options.id}`);
+  try {
+    const key = await getActiveKey();
+    const mnemonic = await decryptWithKey(key, target.encryptedPhrase);
+    const root = await HDWallet4.fromPhrase(mnemonic, DEFAULT_WALLET_PATH2);
+    removeAddressBook(root.address);
+  } catch (e) {
+    console.warn(chalk26.yellow(`Warning: failed to clean up address book: ${e.message}`));
+  }
+  const remaining = phrases.filter((p) => p.id !== target.id);
+  writePhrases(remaining);
+  const active = readActive();
+  if (active.phraseId === target.id) {
+    writeActive({ ...active, phraseId: remaining[0]?.id });
+  }
+  console.log(chalk26.green(`Removed wallet ${chalk26.cyan(target.label)} (id ${target.id})`));
+}
+
+// src/actions/wallet/seedPhrase/renamePhrase.ts
+import chalk27 from "chalk";
+function renamePhrase(id, label) {
+  const phrases = readPhrases();
+  const target = phrases.find((p) => p.id === id || p.label === id);
+  if (!target) throw new Error(`Wallet not found: ${id}`);
+  target.label = label;
+  writePhrases(phrases);
+  console.log(chalk27.green(`Renamed wallet ${target.id} to ${chalk27.cyan(label)}`));
+}
+
+// src/actions/wallet/seedPhrase/usePhrase.ts
+import chalk28 from "chalk";
+function usePhrase(id) {
+  const record = findPhrase(id);
+  if (!record) throw new Error(`Wallet not found: ${id}`);
+  const active = readActive();
+  writeActive({ ...active, phraseId: record.id });
+  console.log(chalk28.green(`Active wallet set to ${chalk28.cyan(record.label)} (id ${record.id})`));
+}
+
+// src/actions/wallet/session/unlock.ts
+import chalk29 from "chalk";
+async function unlock(options = {}) {
+  if (!hasPassword()) {
+    throw new Error("Wallet not initialized. Run `aries wallet create` or `aries wallet import` first.");
+  }
+  const password = promptPassword("Wallet password: ");
+  const key = await validatePassword(password);
+  if (!key) throw new Error("Incorrect password.");
+  const ttl = options.ttl ?? DEFAULT_SESSION_TTL_SECONDS;
+  const expiresAt = await unlockSession(key, ttl);
+  console.log(chalk29.green(`Wallet unlocked. Session expires ${new Date(expiresAt).toISOString()}.`));
+}
+function lock() {
+  lockSession();
+  console.log(chalk29.green("Wallet locked."));
+}
+
+// src/actions/wallet/sign/signPayload.ts
+import FS5 from "fs";
+
+// ../../node_modules/.pnpm/@xyo-network+boundwitness-builder@5.5.2_@bitauth+libauth@3.0.0_@scure+base@2.2.0_@xylab_4c4b2704d625c906bfa16bd14f65b27b/node_modules/@xyo-network/boundwitness-builder/dist/neutral/index.mjs
+import {
+  asAddress,
+  asHash,
+  assertEx,
+  hexFromArrayBuffer,
+  toArrayBuffer
+} from "@xylabs/sdk-js";
+
+// ../../node_modules/.pnpm/@xyo-network+boundwitness-model@5.5.2_@xylabs+sdk-js@5.0.101_@opentelemetry+api@1.9.1_@_815cc9f8526e164e787cddfcee3cd298/node_modules/@xyo-network/boundwitness-model/dist/neutral/index.mjs
+import {
+  AddressZod,
+  HashZod,
+  zodAsFactory,
+  zodIsFactory,
+  zodToFactory
+} from "@xylabs/sdk-js";
+import { PayloadZod, SchemaZod } from "@xyo-network/payload-model";
+import z2 from "zod";
+import { asSchema } from "@xyo-network/payload-model";
+import { HexZod } from "@xylabs/sdk-js";
+import z from "zod";
+import { PayloadZod as PayloadZod2 } from "@xyo-network/payload-model";
+import z3 from "zod";
+import { isStorageMeta } from "@xyo-network/payload-model";
+var BoundWitnessSchema = asSchema("network.xyo.boundwitness", true);
+var SignaturesMetaZod = z.object({ $signatures: z.array(z.union([HexZod, z.null()])) });
+var UnsignedSignaturesMetaZod = z.object({ $signatures: z.array(z.null()) });
+var SignedSignaturesMetaZod = z.object({ $signatures: z.array(HexZod).min(1) });
+var BoundWitnessRequiredFieldsZod = z2.object({
+  addresses: z2.array(AddressZod),
+  payload_hashes: z2.array(HashZod),
+  payload_schemas: z2.array(SchemaZod),
+  previous_hashes: z2.array(HashZod.nullable())
+});
+var BoundWitnessMetaZod = z2.object({
+  $destination: AddressZod.optional(),
+  $sourceQuery: HashZod.optional()
+}).extend(SignaturesMetaZod.shape);
+var BoundWitnessZod = PayloadZod.safeExtend({ schema: z2.literal(BoundWitnessSchema) }).safeExtend(BoundWitnessRequiredFieldsZod.shape).safeExtend(BoundWitnessMetaZod.shape);
+var isBoundWitness = zodIsFactory(BoundWitnessZod);
+var asBoundWitness = zodAsFactory(BoundWitnessZod, "asBoundWitness");
+var toBoundWitness = zodToFactory(BoundWitnessZod, "toBoundWitness");
+var AnyBoundWitnessZod = BoundWitnessZod.loose();
+var SignedBoundWitnessZod = BoundWitnessZod.extend(SignedSignaturesMetaZod.shape);
+var AnySignedBoundWitnessZod = SignedBoundWitnessZod.loose();
+var UnsignedBoundWitnessZod = BoundWitnessZod.extend(UnsignedSignaturesMetaZod.shape);
+var AnyUnsignedBoundWitnessZod = UnsignedBoundWitnessZod.loose();
+function HydratedBoundWitnessZodBuilder(bwZod) {
+  return z3.tuple([bwZod, z3.array(PayloadZod2.loose())]);
+}
+var HydratedBoundWitnessZod = HydratedBoundWitnessZodBuilder(BoundWitnessZod);
+var SignedHydratedBoundWitnessZod = HydratedBoundWitnessZodBuilder(SignedBoundWitnessZod);
+var UnsignedHydratedBoundWitnessZod = HydratedBoundWitnessZodBuilder(UnsignedBoundWitnessZod);
+
+// ../../node_modules/.pnpm/@xyo-network+boundwitness-builder@5.5.2_@bitauth+libauth@3.0.0_@scure+base@2.2.0_@xylab_4c4b2704d625c906bfa16bd14f65b27b/node_modules/@xyo-network/boundwitness-builder/dist/neutral/index.mjs
+import {
+  ObjectHasher,
+  removeEmptyFields,
+  sortFields
+} from "@xyo-network/hash";
+import { omitSchema, PayloadBuilder } from "@xyo-network/payload-builder";
+import { Mutex } from "async-mutex";
+import {
+  asHash as asHash2,
+  difference,
+  exists
+} from "@xylabs/sdk-js";
+import { PayloadBuilder as PayloadBuilder2 } from "@xyo-network/payload-builder";
+import { asHash as asHash3 } from "@xylabs/sdk-js";
+import { assertEx as assertEx2 } from "@xylabs/sdk-js";
+var GeneratedBoundWitnessFields = ["addresses", "payload_hashes", "payload_schemas", "previous_hashes"];
+var uniqueAddresses = (addresses, throwOnFalse = false) => {
+  const addressesSet = /* @__PURE__ */ new Set();
+  for (const address of addresses) {
+    if (addressesSet.has(address)) {
+      if (throwOnFalse) {
+        throw new Error("Duplicate address");
+      }
+      return false;
+    }
+    addressesSet.add(address);
+  }
+  return true;
+};
+var uniqueAccounts = (accounts, throwOnFalse = false) => {
+  return uniqueAddresses(accounts.map((account) => account.address), throwOnFalse);
+};
+var BoundWitnessBuilder = class _BoundWitnessBuilder extends PayloadBuilder {
+  static _buildMutex = new Mutex();
+  _accounts = [];
+  _errorHashes;
+  _errors = [];
+  _payloadHashes;
+  _payloadSchemas;
+  _payloads = [];
+  constructor(options) {
+    super({ ...options, schema: BoundWitnessSchema });
+  }
+  get addresses() {
+    uniqueAccounts(this._accounts, true);
+    return this._accounts.map((account) => account.address.toLowerCase());
+  }
+  get payloadSchemas() {
+    return this._payloadSchemas ?? this._payloads.map((payload) => {
+      return assertEx(payload.schema, () => this.missingSchemaMessage(payload));
+    });
+  }
+  get previousHashBytes() {
+    return this._accounts.map((account) => account.previousHashBytes ?? null);
+  }
+  get previousHashes() {
+    return this._accounts.map((account) => account.previousHash ?? null);
+  }
+  static addressIndex(payload, address) {
+    const index = payload.addresses.indexOf(address);
+    if (index === -1) {
+      throw new Error("Invalid address");
+    }
+    return index;
+  }
+  static previousHash(boundWitness, address) {
+    return asHash(boundWitness.previous_hashes[this.addressIndex(boundWitness, address)])?.toLowerCase();
+  }
+  static async linkingFields(accounts, payloads) {
+    const addresses = accounts.map((account) => asAddress(hexFromArrayBuffer(account.addressBytes, { prefix: false }), true));
+    const previous_hashes = accounts.map((account) => account.previousHash ?? null);
+    const payload_hashes = payloads ? await _BoundWitnessBuilder.hashes(payloads) : [];
+    const payload_schemas = payloads?.map(({ schema }) => schema) ?? [];
+    return {
+      addresses,
+      payload_hashes,
+      payload_schemas,
+      previous_hashes
+    };
+  }
+  static signature(payload, address) {
+    return payload.$signatures[this.addressIndex(payload, address)];
+  }
+  static async signatures(accounts, dataHash) {
+    const hashBytes = toArrayBuffer(dataHash);
+    const previousHashesBytes = accounts?.map((account) => account.previousHashBytes);
+    return await Promise.all(accounts.map(async (account, index) => hexFromArrayBuffer((await account.sign(hashBytes, previousHashesBytes[index]))[0])));
+  }
+  static validateGeneratedFields(fields) {
+    assertEx(fields.payload_hashes?.length === fields.payload_schemas?.length, () => "Payload hash/schema mismatch");
+    assertEx(!fields.payload_hashes.includes(null), () => "nulls found in hashes");
+    assertEx(!fields.payload_schemas.includes(null), () => "nulls found in schemas");
+  }
+  async build(sign = true) {
+    return await _BoundWitnessBuilder._buildMutex.runExclusive(async () => {
+      const dataHashableFields = await this.dataHashableFields();
+      const $signatures = sign ? await this.sign() : this.addresses.map(() => null);
+      const ret = {
+        ...this._meta,
+        ...dataHashableFields,
+        ...this._fields,
+        $signatures
+      };
+      return [
+        ret,
+        this._payloads,
+        this._errors
+      ];
+    });
+  }
+  async dataHash() {
+    const dataHashableFields = await this.dataHashableFields();
+    const hash = await ObjectHasher.hash(dataHashableFields);
+    return hash;
+  }
+  async dataHashableFields() {
+    const generatedFields = await this.generatedFields();
+    _BoundWitnessBuilder.validateGeneratedFields(generatedFields);
+    const fields = {
+      ...PayloadBuilder.omitMeta(this._fields ?? {}),
+      ...generatedFields
+    };
+    return await _BoundWitnessBuilder.dataHashableFields(this._schema, fields);
+  }
+  error(payload) {
+    assertEx(this._errorHashes === void 0, () => "Can not set errors when hashes already set");
+    if (payload) {
+      this._errors.push(assertEx(sortFields(payload)));
+    }
+    return this;
+  }
+  errors(errors) {
+    if (errors) {
+      for (const error of errors) {
+        if (error !== null) {
+          this.error(error);
+        }
+      }
+    }
+    return this;
+  }
+  fields(fields) {
+    const clone = structuredClone(fields);
+    for (const field of GeneratedBoundWitnessFields) {
+      delete clone[field];
+    }
+    this._fields = _BoundWitnessBuilder.omitStorageMeta(
+      _BoundWitnessBuilder.omitClientMeta(
+        omitSchema(removeEmptyFields(clone))
+      )
+    );
+    return this;
+  }
+  hashes(hashes, schema) {
+    assertEx(this.payloads.length === 0, () => "Can not set hashes when payloads already set");
+    this._payloadHashes = hashes;
+    this._payloadSchemas = schema;
+    return this;
+  }
+  payload(payload) {
+    assertEx(this._payloadHashes === void 0, () => "Can not set payloads when hashes already set");
+    if (payload) {
+      this._payloads.push(assertEx(sortFields(payload)));
+    }
+    return this;
+  }
+  payloads(payloads) {
+    if (payloads)
+      for (const payload of payloads) {
+        if (payload !== null) {
+          this.payload(payload);
+        }
+      }
+    return this;
+  }
+  signer(account) {
+    uniqueAccounts([...this._accounts, account], true);
+    this._accounts?.push(account);
+    return this;
+  }
+  signers(accounts) {
+    uniqueAccounts([...this._accounts, ...accounts], true);
+    this._accounts?.push(...accounts);
+    return this;
+  }
+  sourceQuery(sourceQuery) {
+    this._meta = {
+      ...this._meta,
+      $sourceQuery: sourceQuery
+    };
+    return this;
+  }
+  /** @deprecated use signer instead */
+  witness(account) {
+    this._accounts?.push(account);
+    return this;
+  }
+  /** @deprecated use signers instead */
+  witnesses(accounts) {
+    this._accounts?.push(...accounts);
+    return this;
+  }
+  async sign() {
+    uniqueAccounts(this._accounts, true);
+    const hashBytes = toArrayBuffer(await this.dataHash());
+    return await Promise.all(this._accounts.map(async (account) => hexFromArrayBuffer((await account.sign(hashBytes))[0])));
+  }
+  async generatedFields() {
+    return await _BoundWitnessBuilder.linkingFields(this._accounts, this._payloads);
+  }
+  missingSchemaMessage(payload) {
+    return `Builder: Missing Schema
+${JSON.stringify(payload, null, 2)}`;
+  }
+};
+
+// src/actions/wallet/sign/signPayload.ts
+import chalk30 from "chalk";
+async function signPayload(options) {
+  const offset = options.offset ?? "0";
+  const raw = FS5.readFileSync(options.file, "utf8");
+  const payload = JSON.parse(raw);
+  if (typeof payload.schema !== "string" || payload.schema.length === 0) {
+    throw new Error("Payload must have a non-empty `schema` string field.");
+  }
+  const { rootWallet } = await getActiveWallet();
+  const account = await deriveAccount(rootWallet, offset);
+  const [boundwitness, payloads] = await new BoundWitnessBuilder().payload(payload).signer(account).build();
+  const result = { boundwitness, payloads };
+  const json = JSON.stringify(result, null, 2);
+  if (options.output) {
+    FS5.writeFileSync(options.output, `${json}
+`);
+    console.log(chalk30.green(`Signed payload written to ${options.output}`));
+  } else {
+    console.log(json);
+  }
+}
+
+// src/actions/wallet/transaction/broadcastTransaction.ts
+import FS6 from "fs";
+import chalk31 from "chalk";
+function reviveBigints(_key, value) {
+  if (typeof value === "string" && /^-?\d+n$/.test(value)) {
+    return BigInt(value.slice(0, -1));
+  }
+  return value;
+}
+async function broadcastTransaction(options) {
+  const offset = options.offset ?? "0";
+  const raw = FS6.readFileSync(options.file, "utf8");
+  const signedTx = JSON.parse(raw, reviveBigints);
+  const network = getActiveNetwork();
+  const { rootWallet } = await getActiveWallet();
+  const account = await deriveAccount(rootWallet, offset);
+  console.log(chalk31.gray(`Connecting to ${network.rpcUrl}...`));
+  const { runner } = await createWalletClient(network.rpcUrl, account);
+  const hash = await runner.broadcastTransaction(signedTx);
+  console.log(chalk31.green(`Broadcast accepted: ${hash}`));
+}
+
+// src/actions/wallet/transaction/sendTransaction.ts
+import { asAddress as asAddress2, assertEx as assertEx3 } from "@xylabs/sdk-js";
+import { XL1Amount as XL1Amount2 } from "@xyo-network/xl1-protocol-sdk";
+import chalk32 from "chalk";
+async function sendTransaction(options) {
+  const offset = options.offset ?? "0";
+  const { rootWallet } = await getActiveWallet();
+  const account = await deriveAccount(rootWallet, offset);
+  const network = getActiveNetwork();
+  const recipient = assertEx3(asAddress2(options.recipient.toLowerCase().replace(/^0x/, "")), () => `Invalid recipient address: ${options.recipient}`);
+  const amountXL1 = XL1Amount2.fromXL1(BigInt(options.amount));
+  console.log(chalk32.gray(`Connecting to ${network.rpcUrl}...`));
+  const { gateway } = await createWalletClient(network.rpcUrl, account);
+  console.log(chalk32.gray(`Submitting transfer of ${options.amount} XL1 to 0x${recipient}...`));
+  const hash = await gateway.send(recipient, amountXL1.atto);
+  console.log(chalk32.gray(`Tx submitted: ${hash}`));
+  const attempts = options.attempts ?? 30;
+  const delay = options.delay ?? 2e3;
+  console.log(chalk32.gray(`Confirming (up to ${attempts} attempts, ${delay}ms apart)...`));
+  await gateway.confirmSubmittedTransaction(hash, { attempts, delay });
+  console.log(chalk32.green(`Sent ${options.amount} XL1 \u2192 0x${recipient}`));
+  console.log(`${chalk32.gray("hash:")}    ${hash}`);
+  console.log(`${chalk32.gray("from:")}    0x${account.address}`);
+  console.log(`${chalk32.gray("network:")} ${network.id}`);
+}
+
+// src/actions/wallet/transaction/signTransactionFile.ts
+import FS7 from "fs";
+import { buildTransaction } from "@xyo-network/xl1-protocol-sdk";
+import chalk33 from "chalk";
+function asBigint(value) {
+  return typeof value === "bigint" ? value : BigInt(value);
+}
+async function signTransactionFile(options) {
+  const offset = options.offset ?? "0";
+  const raw = FS7.readFileSync(options.file, "utf8");
+  const tx = JSON.parse(raw);
+  const { rootWallet } = await getActiveWallet();
+  const account = await deriveAccount(rootWallet, offset);
+  const fees = tx.fees ? {
+    base: asBigint(tx.fees.base),
+    gasLimit: asBigint(tx.fees.gasLimit),
+    gasPrice: asBigint(tx.fees.gasPrice),
+    priority: asBigint(tx.fees.priority)
+  } : void 0;
+  const signed = await buildTransaction(
+    tx.chain,
+    tx.onChainPayloads ?? [],
+    tx.offChainPayloads ?? [],
+    account,
+    asBigint(tx.nbf),
+    asBigint(tx.exp),
+    void 0,
+    fees
+  );
+  const serialized = JSON.stringify(signed, (_key, value) => typeof value === "bigint" ? value.toString() : value, 2);
+  if (options.output) {
+    FS7.writeFileSync(options.output, `${serialized}
+`);
+    console.log(chalk33.green(`Signed transaction written to ${options.output}`));
+  } else {
+    console.log(serialized);
+  }
+}
+
+// src/actions/index.ts
+import { executeWitness, registerWitnessCommand } from "@xylabs/aries-witness-cli";
+export {
+  addContact,
+  addNetwork,
+  broadcastTransaction,
+  changePassword,
+  createPhrase,
+  deriveAccount,
+  deriveAndAdd,
+  detectAiClients,
+  executeWitness,
+  exportBackup,
+  exportPhrase,
+  getActiveWallet,
+  getBalance,
+  hasPassword,
+  importBackup,
+  importPhrase,
+  installPlugin,
+  labelAccount,
+  listAccounts,
+  listContacts,
+  listNetworks,
+  listPhrases,
+  listSessions,
+  lock,
+  printVersion,
+  registerWitnessCommand,
+  removeAccount,
+  removeContact,
+  removeNetwork,
+  removePhrase,
+  renameContact,
+  renamePhrase,
+  runClamped,
+  searchAudit,
+  sendTransaction,
+  showAccount,
+  showSession,
+  signPayload,
+  signTransactionFile,
+  statusAudit,
+  syncAiConfig,
+  uninstallPlugin,
+  unlock,
+  useNetwork,
+  usePhrase
+};
+//# sourceMappingURL=index.mjs.map