@yiaany/ghostapi 0.1.8 → 0.2.0

package/dist/cli/index.js

@@ -10,26 +10,26 @@ import { createServer } from "../server/createServer.js";
 import { clearCache } from "../cache/index.js";
 import { clearState } from "../state/stateStore.js";
 import { clearEvents } from "../server/eventsStore.js";
-import { DEFAULT_MODEL, loadServerConfig } from "../config/serverConfig.js";
-import { initializeLocalConfig, readLocalConfig, writeLocalConfig } from "../config/localConfig.js";
+import { DEFAULT_MODEL, loadServerConfig, } from "../config/serverConfig.js";
+import { initializeLocalConfig, readLocalConfig, writeLocalConfig, } from "../config/localConfig.js";
 import { getDataPaths } from "../config/dataPaths.js";
-import { detectEgressCapabilities, formatEgressCapabilityReport } from "../egress/capabilities.js";
+import { detectEgressCapabilities, formatEgressCapabilityReport, } from "../egress/capabilities.js";
 import { EgressRunError, runEgressCommand } from "../egress/run.js";
-import { PolicyValidationError, evaluatePolicy, formatPolicyDecision, loadPolicyFile } from "../policy/index.js";
+import { PolicyValidationError, evaluatePolicy, formatPolicyDecision, loadPolicyFile, } from "../policy/index.js";
 import { isLoopbackHost } from "../server/accessControl.js";
-import { getProviderManifests, isRegisteredProvider, providerRegistry } from "../providers/registry.js";
+import { getProviderManifests, isRegisteredProvider, providerRegistry, } from "../providers/registry.js";
 import { parseCliArgs } from "./parser.js";
 import { CliError } from "./errors.js";
 import { startMcpServer } from "../mcp/server.js";
 import { generateRepoSetup, writeRepoSetup } from "../setup/setupGenerator.js";
 import { generateSafetyReport } from "../report/safetyReport.js";
-import { compareEvidenceReports, formatEvidenceCompare, formatEvidenceReport, generateEvidenceReport, loadEvidenceReport, EvidenceReportError } from "../evidence/index.js";
-import { createScenarioReplayer, formatScenarioSanitizationSummary, loadScenarioBundle, prepareScenarioRecordingFromFile, ScenarioBundleError, writeScenarioBundle } from "../scenarios/scenarioBundle.js";
-import { ContractError, diffContracts, formatContractDiff, importHarContractFromFile, importOpenApiContractFromFile, loadContract, writeContract } from "../contracts/index.js";
+import { compareEvidenceReports, formatEvidenceCompare, formatEvidenceReport, generateEvidenceReport, loadEvidenceReport, EvidenceReportError, } from "../evidence/index.js";
+import { createScenarioReplayer, formatScenarioSanitizationSummary, loadScenarioBundle, prepareScenarioRecordingFromFile, ScenarioBundleError, writeScenarioBundle, } from "../scenarios/scenarioBundle.js";
+import { ContractError, diffContracts, formatContractDiff, importHarContractFromFile, importOpenApiContractFromFile, loadContract, writeContract, } from "../contracts/index.js";
 import { EvalError, formatEvalReport, runEval } from "../evals/index.js";
-import { SyntheticWorldError, createWorld, forkWorld, formatWorld, inspectWorld, resetWorld } from "../worlds/index.js";
-import { formatProductTelemetry, readProductTelemetry, recordProductTelemetry, setProductTelemetryEnabled } from "../productTelemetry/index.js";
-import { ActionGatewayError, createLocalActionGateway } from "../actions/index.js";
+import { SyntheticWorldError, createWorld, forkWorld, formatWorld, inspectWorld, resetWorld, } from "../worlds/index.js";
+import { formatProductTelemetry, readProductTelemetry, recordProductTelemetry, setProductTelemetryEnabled, } from "../productTelemetry/index.js";
+import { ActionGatewayError, createLocalActionGateway, } from "../actions/index.js";
 import { openUrl } from "./openUrl.js";
 async function main() {
     const command = parseCliArgs(process.argv.slice(2));
@@ -161,7 +161,9 @@ async function startServer(config, open = false) {
             console.warn("Warning: GhostAPI is bound beyond loopback. Use HTTPS or a secure tunnel because the dashboard token does not encrypt traffic.");
         }
         if (open)
-            openUrl(remote && config.authToken ? `${dashboardUrl}?token=${encodeURIComponent(config.authToken)}` : dashboardUrl);
+            openUrl(remote && config.authToken
+                ? `${dashboardUrl}?token=${encodeURIComponent(config.authToken)}`
+                : dashboardUrl);
     });
 }
 async function createDevTlsOptions(host) {
@@ -172,8 +174,14 @@ async function createDevTlsOptions(host) {
             { name: "basicConstraints", cA: false },
             { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
             { name: "extKeyUsage", serverAuth: true },
-            { name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] }
-        ]
+            {
+                name: "subjectAltName",
+                altNames: [
+                    { type: 2, value: "localhost" },
+                    { type: 7, ip: "127.0.0.1" },
+                ],
+            },
+        ],
     });
     return { key: pems.private, cert: pems.cert };
 }
@@ -201,7 +209,7 @@ async function initProject() {
 }
 async function printRepoSetup(write) {
     const written = write ? await writeRepoSetup() : null;
-    const setup = written?.setup ?? await generateRepoSetup();
+    const setup = written?.setup ?? (await generateRepoSetup());
     console.log(setup.summary);
     console.log("");
     console.log("Commands:");
@@ -232,11 +240,13 @@ function openDashboard(options) {
 }
 async function printSafetyReport() {
     const report = await generateSafetyReport();
-    console.log(`GhostAPI safety report for ${report.projectRoot}`);
+    console.log(`GhostAPI provider-risk heuristic scan for ${report.projectRoot}`);
     console.log(`Detected SDKs: ${report.detected.length > 0 ? report.detected.join(", ") : "none"}`);
+    console.log(`Scanned files: ${report.limits.scannedFiles}/${report.limits.maxFiles} (files over ${report.limits.maxFileBytes} bytes are skipped)`);
     console.log("");
     if (report.findings.length === 0) {
-        console.log("No high-risk provider usage found.");
+        console.log("No matches found in the bounded heuristic scan.");
+        console.log("This is not proof that the repository contains no production endpoints, credentials, or egress paths.");
     }
     else {
         console.log("Findings:");
@@ -260,7 +270,9 @@ async function setModel(model) {
 }
 function listProviders() {
     for (const manifest of getProviderManifests()) {
-        const version = manifest.packVersion === null ? manifest.implementation : `pack ${manifest.packVersion}`;
+        const version = manifest.packVersion === null
+            ? manifest.implementation
+            : `pack ${manifest.packVersion}`;
         console.log(`${manifest.name.padEnd(8)} ${manifest.displayName} (${version})`);
     }
 }
@@ -277,60 +289,123 @@ function inspectProvider(provider) {
     console.log(`Mode: ${manifest.implementation}`);
     console.log(`Pack version: ${manifest.packVersion ?? "n/a"}`);
     console.log(`API versions: ${manifest.apiVersions?.supported.join(", ") ?? "legacy"}`);
-    console.log(`Capabilities: ${Object.entries(manifest.capabilities).filter(([, enabled]) => enabled).map(([name]) => name).join(", ")}`);
+    console.log(`Capabilities: ${Object.entries(manifest.capabilities)
+        .filter(([, enabled]) => enabled)
+        .map(([name]) => name)
+        .join(", ")}`);
     console.log("Error formatting: supported");
 }
 async function runDoctor(options) {
     if (options.egress) {
         const report = detectEgressCapabilities();
-        console.log(options.json ? JSON.stringify(report, null, 2) : formatEgressCapabilityReport(report));
+        console.log(options.json
+            ? JSON.stringify(report, null, 2)
+            : formatEgressCapabilityReport(report));
         return;
     }
     const checks = [];
     let config = null;
     try {
         config = loadServerConfig(process.env, [], options.port ? { port: options.port } : {});
-        checks.push({ label: "Config", status: "ok", detail: "loaded", docs: "docs/usage.md#configuration" });
+        checks.push({
+            label: "Config",
+            status: "ok",
+            detail: "loaded",
+            docs: "docs/usage.md#configuration",
+        });
     }
     catch (error) {
-        checks.push({ label: "Config", status: "fail", detail: error instanceof Error ? error.message : "invalid configuration", remediation: "Fix GHOSTAPI_* environment values or .ghostapi/config.json, then re-run ghostapi doctor.", docs: "docs/usage.md#configuration" });
+        checks.push({
+            label: "Config",
+            status: "fail",
+            detail: error instanceof Error ? error.message : "invalid configuration",
+            remediation: "Fix GHOSTAPI_* environment values or .ghostapi/config.json, then re-run ghostapi doctor.",
+            docs: "docs/usage.md#configuration",
+        });
     }
     const major = Number(process.versions.node.split(".")[0]);
-    checks.push({ label: "Node version", status: major >= 20 ? "ok" : "fail", detail: process.versions.node, remediation: "Install Node.js 20 or newer.", docs: "README.md#quickstart" });
+    checks.push({
+        label: "Node version",
+        status: major >= 20 ? "ok" : "fail",
+        detail: process.versions.node,
+        remediation: "Install Node.js 20 or newer.",
+        docs: "README.md#quickstart",
+    });
     const writeAccess = await canWriteGhostApiDir();
-    checks.push({ label: "GhostAPI data write access", status: writeAccess ? "ok" : "fail", detail: getDataPaths().root, remediation: "Check GHOSTAPI_DATA_DIR and directory permissions.", docs: "README.md#local-files" });
+    checks.push({
+        label: "GhostAPI data write access",
+        status: writeAccess ? "ok" : "fail",
+        detail: getDataPaths().root,
+        remediation: "Check GHOSTAPI_DATA_DIR and directory permissions.",
+        docs: "docs/usage.md#local-data-and-retention",
+    });
     if (config !== null) {
         const portAvailable = await isPortAvailable(config.host, config.port);
-        checks.push({ label: "Port availability", status: portAvailable ? "ok" : "fail", detail: `${config.host}:${config.port}`, remediation: `Run ghostapi start --port <free-port> or stop the process using ${config.port}.`, docs: "README.md#quickstart" });
-        checks.push({ label: "Model config", status: config.model.trim() !== "" ? "ok" : "fail", detail: config.model, remediation: "Run ghostapi model set <model>.", docs: "docs/usage.md#configuration" });
+        checks.push({
+            label: "Port availability",
+            status: portAvailable ? "ok" : "fail",
+            detail: `${config.host}:${config.port}`,
+            remediation: `Run ghostapi start --port <free-port> or stop the process using ${config.port}.`,
+            docs: "README.md#quickstart",
+        });
+        checks.push({
+            label: "Model config",
+            status: config.model.trim() !== "" ? "ok" : "fail",
+            detail: config.model,
+            remediation: "Run ghostapi model set <model>.",
+            docs: "docs/usage.md#configuration",
+        });
         const hasApiKey = Boolean(config.apiKey);
         checks.push({
             label: "LLM API key",
             status: config.allowExternalLlm && !hasApiKey ? "fail" : "ok",
-            detail: config.offline ? "offline mode" : config.allowExternalLlm ? hasApiKey ? "explicitly enabled" : "enabled without GHOSTAPI_LLM_API_KEY" : "disabled; deterministic provider mocks enabled",
-            remediation: config.allowExternalLlm && !hasApiKey ? "Set GHOSTAPI_LLM_API_KEY or remove the external LLM opt-in." : undefined,
-            docs: "README.md#safety-model"
+            detail: config.offline
+                ? "offline mode"
+                : config.allowExternalLlm
+                    ? hasApiKey
+                        ? "explicitly enabled"
+                        : "enabled without GHOSTAPI_LLM_API_KEY"
+                    : "disabled; deterministic provider mocks enabled",
+            remediation: config.allowExternalLlm && !hasApiKey
+                ? "Set GHOSTAPI_LLM_API_KEY or remove the external LLM opt-in."
+                : undefined,
+            docs: "README.md#security-boundaries",
         });
         const remote = !isLoopbackHost(config.host);
         checks.push({
             label: "Remote bind auth",
-            status: !remote || (config.authToken !== undefined && config.authToken.length >= 24) ? "ok" : "fail",
+            status: !remote ||
+                (config.authToken !== undefined && config.authToken.length >= 24)
+                ? "ok"
+                : "fail",
             detail: remote ? "non-loopback host configured" : "loopback only",
-            remediation: remote ? "Set a strong GHOSTAPI_AUTH_TOKEN and use HTTPS or a secure tunnel." : undefined,
-            docs: "README.md#safety-model"
+            remediation: remote
+                ? "Set a strong GHOSTAPI_AUTH_TOKEN and use HTTPS or a secure tunnel."
+                : undefined,
+            docs: "README.md#security-boundaries",
         });
     }
     const tlsBypass = process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0";
-    checks.push({ label: "TLS safety", status: !tlsBypass ? "ok" : "fail", detail: tlsBypass ? "NODE_TLS_REJECT_UNAUTHORIZED=0" : "safe", remediation: "Unset NODE_TLS_REJECT_UNAUTHORIZED.", docs: "SECURITY.md" });
+    checks.push({
+        label: "TLS safety",
+        status: !tlsBypass ? "ok" : "fail",
+        detail: tlsBypass ? "NODE_TLS_REJECT_UNAUTHORIZED=0" : "safe",
+        remediation: "Unset NODE_TLS_REJECT_UNAUTHORIZED.",
+        docs: "SECURITY.md",
+    });
     const egress = detectEgressCapabilities();
     const linuxNamespace = egress.capabilities.find((capability) => capability.id === "linux-network-namespace");
     const enforcementAvailable = process.platform === "linux" && linuxNamespace !== undefined;
     checks.push({
         label: "Enforcement capability",
         status: enforcementAvailable ? "warn" : "warn",
-        detail: enforcementAvailable ? linuxNamespace.detail : `ghostapi run process isolation is unsupported/experimental on ${process.platform}`,
-        remediation: enforcementAvailable ? "Run ghostapi run to execute the real preflight; doctor does not launch the target." : "Use ghostapi start --open for local provider simulation, or run enforced tests on Linux.",
-        docs: "docs/security/egress-threat-model.md"
+        detail: enforcementAvailable
+            ? linuxNamespace.detail
+            : `ghostapi run process isolation is unsupported/experimental on ${process.platform}`,
+        remediation: enforcementAvailable
+            ? "Run ghostapi run to execute the real preflight; doctor does not launch the target."
+            : "Use ghostapi start --open for local provider simulation, or run enforced tests on Linux.",
+        docs: "docs/security/egress-threat-model.md",
     });
     if (options.json) {
         console.log(JSON.stringify({ schemaVersion: 1, checks, egress }, null, 2));
@@ -363,7 +438,13 @@ async function explainPolicy(file, event) {
     console.log(formatPolicyDecision(evaluatePolicy(loaded.policy, event)));
 }
 async function generateEvidence(options) {
-    const { report, path } = await generateEvidenceReport({ policyPath: options.policyPath, runPath: options.runPath, outPath: options.outPath, contractBaselinePath: options.contractBaselinePath, contractCandidatePath: options.contractCandidatePath });
+    const { report, path } = await generateEvidenceReport({
+        policyPath: options.policyPath,
+        runPath: options.runPath,
+        outPath: options.outPath,
+        contractBaselinePath: options.contractBaselinePath,
+        contractCandidatePath: options.contractCandidatePath,
+    });
     if (options.json)
         console.log(JSON.stringify({ path, report }, null, 2));
     else {
@@ -376,13 +457,17 @@ async function generateEvidence(options) {
 }
 async function viewEvidence(options) {
     const report = await loadEvidenceReport(options.path);
-    console.log(options.json ? JSON.stringify(report, null, 2) : formatEvidenceReport(report));
+    console.log(options.json
+        ? JSON.stringify(report, null, 2)
+        : formatEvidenceReport(report));
 }
 async function compareEvidence(options) {
     const left = await loadEvidenceReport(options.leftPath);
     const right = await loadEvidenceReport(options.rightPath);
     const result = compareEvidenceReports(left, right);
-    console.log(options.json ? JSON.stringify(result, null, 2) : formatEvidenceCompare(result));
+    console.log(options.json
+        ? JSON.stringify(result, null, 2)
+        : formatEvidenceCompare(result));
     if (!result.equal)
         process.exitCode = 1;
 }
@@ -390,7 +475,7 @@ async function recordScenario(options) {
     const bundle = await prepareScenarioRecordingFromFile(options.inputPath, {
         title: options.title,
         allowedSandboxHosts: options.allowedSandboxHosts,
-        pii: parsePiiRules(options.pii)
+        pii: parsePiiRules(options.pii),
     });
     console.log(formatScenarioSanitizationSummary(bundle.sanitization));
     if (bundle.sanitization.requiresApproval && !options.approve) {
@@ -415,7 +500,9 @@ async function replayBundle(options) {
     }
 }
 async function importOpenApi(options) {
-    const contract = await importOpenApiContractFromFile(options.inputPath, { title: options.title });
+    const contract = await importOpenApiContractFromFile(options.inputPath, {
+        title: options.title,
+    });
     const path = await writeContract(contract, options.outPath);
     console.log(`Contract: ${path}`);
     console.log(`Operations: ${contract.operations.length}`);
@@ -424,7 +511,7 @@ async function importHar(options) {
     const { bundle, contract } = await importHarContractFromFile(options.inputPath, {
         title: options.title,
         allowedSandboxHosts: options.allowedSandboxHosts,
-        pii: parsePiiRules(options.pii)
+        pii: parsePiiRules(options.pii),
     });
     console.log(formatScenarioSanitizationSummary(bundle.sanitization));
     if (bundle.sanitization.requiresApproval && !options.approve) {
@@ -439,10 +526,19 @@ async function diffContractFiles(options) {
     const [baseline, candidate, loadedPolicy] = await Promise.all([
         loadContract(options.baselinePath),
         loadContract(options.candidatePath),
-        options.policyPath === undefined ? Promise.resolve(null) : loadPolicyFile(options.policyPath, process.cwd(), true)
+        options.policyPath === undefined
+            ? Promise.resolve(null)
+            : loadPolicyFile(options.policyPath, process.cwd(), true),
     ]);
     const diff = diffContracts(baseline, candidate);
-    const decision = loadedPolicy === null ? null : evaluatePolicy(loadedPolicy.policy, { type: "report", productionEgressAttempts: 0, forbiddenCredentialMatches: 0, breakingContractChanges: diff.summary.breaking });
+    const decision = loadedPolicy === null
+        ? null
+        : evaluatePolicy(loadedPolicy.policy, {
+            type: "report",
+            productionEgressAttempts: 0,
+            forbiddenCredentialMatches: 0,
+            breakingContractChanges: diff.summary.breaking,
+        });
     if (options.json)
         console.log(JSON.stringify({ diff, policy: decision }, null, 2));
     else {
@@ -450,11 +546,17 @@ async function diffContractFiles(options) {
         if (decision !== null)
             console.log(`Policy: ${decision.allowed ? "PASS" : "FAIL"} - ${decision.reason}`);
     }
-    if (options.ci && (decision === null ? diff.summary.breaking > 0 : !decision.allowed))
+    if (options.ci &&
+        (decision === null ? diff.summary.breaking > 0 : !decision.allowed))
         process.exitCode = 2;
 }
 async function runEvalCommand(options) {
-    const { report, path } = await runEval({ specPath: options.specPath, template: options.template, evidencePath: options.evidencePath, outPath: options.outPath });
+    const { report, path } = await runEval({
+        specPath: options.specPath,
+        template: options.template,
+        evidencePath: options.evidencePath,
+        outPath: options.outPath,
+    });
     if (options.json)
         console.log(JSON.stringify({ path, report }, null, 2));
     else {
@@ -467,7 +569,9 @@ async function runEvalCommand(options) {
 }
 async function createWorldCommand(options) {
     const world = await createWorld(options);
-    console.log(options.json ? JSON.stringify(world, null, 2) : `${formatWorld(world)}\nPath: ${getDataPaths().worlds}`);
+    console.log(options.json
+        ? JSON.stringify(world, null, 2)
+        : `${formatWorld(world)}\nPath: ${getDataPaths().worlds}`);
 }
 async function inspectWorldCommand(id, json) {
     const world = await inspectWorld(id);
@@ -475,15 +579,21 @@ async function inspectWorldCommand(id, json) {
 }
 async function resetWorldCommand(id, json) {
     const world = await resetWorld(id);
-    console.log(json ? JSON.stringify(world, null, 2) : `${formatWorld(world)}\nReset: restored baseline state.`);
+    console.log(json
+        ? JSON.stringify(world, null, 2)
+        : `${formatWorld(world)}\nReset: restored baseline state.`);
 }
 async function forkWorldCommand(sourceId, options) {
     const world = await forkWorld(sourceId, options);
-    console.log(options.json ? JSON.stringify(world, null, 2) : `${formatWorld(world)}\nForked from: ${sourceId}`);
+    console.log(options.json
+        ? JSON.stringify(world, null, 2)
+        : `${formatWorld(world)}\nForked from: ${sourceId}`);
 }
 async function inspectActionCommand(actionId, json) {
     const record = await createLocalActionGateway().inspect(actionId);
-    console.log(json ? JSON.stringify(record, null, 2) : `Action: ${record.envelope.actionId}\nHash: ${record.actionHash}\nReceipts: ${record.receipts.map((receipt) => receipt.status).join(", ")}`);
+    console.log(json
+        ? JSON.stringify(record, null, 2)
+        : `Action: ${record.envelope.actionId}\nHash: ${record.actionHash}\nReceipts: ${record.receipts.map((receipt) => receipt.status).join(", ")}`);
 }
 async function runTelemetryCommand(action, json) {
     const snapshot = action === "enable"
@@ -513,16 +623,22 @@ function parsePiiRules(value) {
     if (value === undefined)
         return undefined;
     const selected = new Set(value === "none" ? [] : value.split(","));
-    return { emails: selected.has("emails"), phones: selected.has("phones"), addresses: selected.has("addresses") };
+    return {
+        emails: selected.has("emails"),
+        phones: selected.has("phones"),
+        addresses: selected.has("addresses"),
+    };
 }
 async function loadReplayRequests(path) {
-    const target = isAbsolute(path) ? resolve(path) : resolve(process.cwd(), path);
+    const target = isAbsolute(path)
+        ? resolve(path)
+        : resolve(process.cwd(), path);
     if (!isInsideAllowedRoots(target))
         throw new CliError("Replay requests path traversal outside the project root or GHOSTAPI_DATA_DIR is not allowed.");
     const info = await lstat(target);
     if (!info.isFile() || info.isSymbolicLink())
         throw new CliError("Replay requests input must be a regular non-symlink file.");
-    if (!await isRealPathInsideAllowedRoots(target))
+    if (!(await isRealPathInsideAllowedRoots(target)))
         throw new CliError("Replay requests input resolves outside the project root or GHOSTAPI_DATA_DIR through a symlink.");
     const source = await readFile(target, "utf8");
     if (Buffer.byteLength(source, "utf8") > 1024 * 1024)
@@ -534,30 +650,47 @@ async function loadReplayRequests(path) {
     catch {
         throw new CliError("Replay requests input is not valid JSON.");
     }
-    const requests = Array.isArray(parsed) ? parsed : parsed !== null && typeof parsed === "object" && Array.isArray(parsed.requests) ? parsed.requests : null;
+    const requests = Array.isArray(parsed)
+        ? parsed
+        : parsed !== null &&
+            typeof parsed === "object" &&
+            Array.isArray(parsed.requests)
+            ? parsed.requests
+            : null;
     if (requests === null || requests.length === 0 || requests.length > 100)
         throw new CliError("Replay requests input must contain 1-100 requests.");
     return requests.map((request) => {
-        if (request === null || typeof request !== "object" || Array.isArray(request))
+        if (request === null ||
+            typeof request !== "object" ||
+            Array.isArray(request))
             throw new CliError("Replay request must be an object.");
         const candidate = request;
-        if (typeof candidate.method !== "string" || typeof candidate.path !== "string")
+        if (typeof candidate.method !== "string" ||
+            typeof candidate.path !== "string")
             throw new CliError("Replay request requires string method and path.");
-        return { method: candidate.method, path: candidate.path, headers: candidate.headers, body: candidate.body };
+        return {
+            method: candidate.method,
+            path: candidate.path,
+            headers: candidate.headers,
+            body: candidate.body,
+        };
     });
 }
 function isInsideAllowedRoots(target) {
-    return isInside(process.cwd(), target) || isInside(getDataPaths().root, target);
+    return (isInside(process.cwd(), target) || isInside(getDataPaths().root, target));
 }
 function isInside(root, target) {
     const relativePath = relative(resolve(root), target);
-    return relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+    return (relativePath !== ".." &&
+        !relativePath.startsWith(`..${sep}`) &&
+        !isAbsolute(relativePath));
 }
 async function isRealPathInsideAllowedRoots(target) {
     const realTarget = await realpath(target);
     const realProjectRoot = await realpath(process.cwd());
     const dataRoot = await realpath(getDataPaths().root).catch(() => null);
-    return isInside(realProjectRoot, realTarget) || (dataRoot !== null && isInside(dataRoot, realTarget));
+    return (isInside(realProjectRoot, realTarget) ||
+        (dataRoot !== null && isInside(dataRoot, realTarget)));
 }
 async function canWriteGhostApiDir() {
     const dataDir = getDataPaths().root;
@@ -579,39 +712,39 @@ function isPortAvailable(host, port) {
     });
 }
 function printHelp() {
-    console.log(`GhostAPI CLI
-
-Usage:
-  ghostapi start [--host 127.0.0.1] [--port 8080] [--model gpt-4o-mini] [--offline] [--https] [--allow-external-llm] [--open]
-  ghostapi open [--host 127.0.0.1] [--port 8080] [--https]
-  ghostapi clear cache|state|events|all
-  ghostapi model get
-  ghostapi model set <model>
-  ghostapi providers list
-  ghostapi providers inspect <provider>
-  ghostapi setup [--write]
-  ghostapi report
-  ghostapi mcp
-  ghostapi doctor [--port 8080] [--json]
-  ghostapi doctor --egress [--json]
-  ghostapi run [--port 8080] [--allow-host localhost] [--policy ghostapi.policy.yaml] -- <command> [args...]
-  ghostapi policy validate [--file ghostapi.policy.yaml]
-  ghostapi policy explain <scenario-id>|network <host>|credential <value>|enforcement <mode>|report <production-attempts> <credential-matches> [--file ghostapi.policy.yaml]
-  ghostapi evidence generate [--policy ghostapi.policy.yaml] [--run .ghostapi/runs/<id>/run.json] [--out .ghostapi/reports/report.json] [--contract-baseline base.contract.json --contract-candidate head.contract.json] [--ci] [--json]
-  ghostapi evidence view <report.json> [--json]
-  ghostapi evidence compare <left.json> <right.json> [--json]
-  ghostapi record --input <capture.json|har.json> --allow-sandbox-host <host> [--out bundle.json] [--title title] [--pii emails,phones,addresses] [--approve]
-  ghostapi replay <bundle.json> --requests <requests.json> [--json]
-  ghostapi contract import-openapi --input <openapi.json> [--out contract.json] [--title title]
-  ghostapi contract import-har --input <capture.har> --allow-sandbox-host <host> [--out bundle.json] [--contract-out contract.json] [--title title] [--pii emails,phones,addresses] [--approve]
-  ghostapi contract diff --baseline <contract.json> --candidate <contract.json> [--policy ghostapi.policy.yaml] [--ci] [--json]
-  ghostapi eval --spec <eval.json>|--template <name> [--evidence report.json] [--out report.eval.json] [--ci] [--json]
-  ghostapi world create --id <world-id> --seed <seed> [--title title] [--json]
-  ghostapi world inspect <world-id> [--json]
-  ghostapi world reset <world-id> [--json]
-  ghostapi world fork <source-world-id> --id <fork-world-id> [--title title] [--json]
-  ghostapi action inspect <action-id> [--json]
-  ghostapi telemetry status|enable|disable|export [--json]
+    console.log(`GhostAPI CLI
+
+Usage:
+  ghostapi start [--host 127.0.0.1] [--port 8080] [--model gpt-4o-mini] [--offline] [--https] [--allow-external-llm] [--open]
+  ghostapi open [--host 127.0.0.1] [--port 8080] [--https]
+  ghostapi clear cache|state|events|all
+  ghostapi model get
+  ghostapi model set <model>
+  ghostapi providers list
+  ghostapi providers inspect <provider>
+  ghostapi setup [--write]
+  ghostapi report
+  ghostapi mcp
+  ghostapi doctor [--port 8080] [--json]
+  ghostapi doctor --egress [--json]
+  ghostapi run [--port 8080] [--allow-host localhost] [--policy ghostapi.policy.yaml] -- <command> [args...]
+  ghostapi policy validate [--file ghostapi.policy.yaml]
+  ghostapi policy explain <scenario-id>|network <host>|credential <value>|enforcement <mode>|report <production-attempts> <credential-matches> [--file ghostapi.policy.yaml]
+  ghostapi evidence generate [--policy ghostapi.policy.yaml] [--run .ghostapi/runs/<id>/run.json] [--out .ghostapi/reports/report.json] [--contract-baseline base.contract.json --contract-candidate head.contract.json] [--ci] [--json]
+  ghostapi evidence view <report.json> [--json]
+  ghostapi evidence compare <left.json> <right.json> [--json]
+  ghostapi record --input <capture.json|har.json> --allow-sandbox-host <host> [--out bundle.json] [--title title] [--pii emails,phones,addresses] [--approve]
+  ghostapi replay <bundle.json> --requests <requests.json> [--json]
+  ghostapi contract import-openapi --input <openapi.json> [--out contract.json] [--title title]
+  ghostapi contract import-har --input <capture.har> --allow-sandbox-host <host> [--out bundle.json] [--contract-out contract.json] [--title title] [--pii emails,phones,addresses] [--approve]
+  ghostapi contract diff --baseline <contract.json> --candidate <contract.json> [--policy ghostapi.policy.yaml] [--ci] [--json]
+  ghostapi eval --spec <eval.json>|--template <name> [--evidence report.json] [--out report.eval.json] [--ci] [--json]
+  ghostapi world create --id <world-id> --seed <seed> [--title title] [--json]
+  ghostapi world inspect <world-id> [--json]
+  ghostapi world reset <world-id> [--json]
+  ghostapi world fork <source-world-id> --id <fork-world-id> [--title title] [--json]
+  ghostapi action inspect <action-id> [--json]
+  ghostapi telemetry status|enable|disable|export [--json]
   ghostapi init`);
 }
 main().catch((error) => {