agentinel 0.0.1

package/dist/asen.js

@@ -0,0 +1,1838 @@
+#!/usr/bin/env node
+
+// src/cli/args.ts
+var VALUE_TAKING_FLAGS = /* @__PURE__ */ new Set(["--reason"]);
+function positionals(args) {
+  const found = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg.startsWith("-")) {
+      if (VALUE_TAKING_FLAGS.has(arg)) {
+        index += 1;
+      }
+      continue;
+    }
+    found.push(arg);
+  }
+  return found;
+}
+function readFlag(args, flag) {
+  const index = args.indexOf(flag);
+  if (index !== -1) {
+    return args[index + 1];
+  }
+  const inline = args.find((arg) => arg.startsWith(`${flag}=`));
+  return inline ? inline.slice(flag.length + 1) : void 0;
+}
+
+// src/checks/package-guard/staged-deps.ts
+import { execFileSync } from "child_process";
+var DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies"];
+function newStagedDependencies(repoRoot) {
+  const names = [];
+  for (const path of stagedManifestPaths(repoRoot)) {
+    const staged = gitJson(repoRoot, `:${path}`);
+    if (!staged) {
+      continue;
+    }
+    const before = collectNames(gitJson(repoRoot, `HEAD:${path}`) ?? {});
+    for (const name of collectNames(staged)) {
+      if (!before.has(name) && !names.includes(name)) {
+        names.push(name);
+      }
+    }
+  }
+  return names;
+}
+function stagedManifestPaths(repoRoot) {
+  const output = git(repoRoot, ["diff", "--cached", "--name-only", "-z", "--diff-filter=ACMR"]);
+  if (output === null) {
+    return [];
+  }
+  return output.split("\0").filter((path) => path === "package.json" || path.endsWith("/package.json")).filter((path) => !isInsideDependencies(path));
+}
+function isInsideDependencies(path) {
+  return path.split("/").includes("node_modules");
+}
+function repoRootOrCwd() {
+  const root = git(process.cwd(), ["rev-parse", "--show-toplevel"]);
+  return root === null ? process.cwd() : root.trim();
+}
+function collectNames(manifest) {
+  const names = /* @__PURE__ */ new Set();
+  for (const field of DEP_FIELDS) {
+    const section = manifest[field];
+    if (typeof section === "object" && section !== null) {
+      for (const name of Object.keys(section)) {
+        names.add(name);
+      }
+    }
+  }
+  return names;
+}
+function gitJson(repoRoot, revision) {
+  const text = git(repoRoot, ["show", revision]);
+  if (text === null) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function git(cwd, args) {
+  try {
+    return execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      maxBuffer: 10 * 1024 * 1024
+    });
+  } catch {
+    return null;
+  }
+}
+
+// src/config/load.ts
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { join } from "path";
+
+// src/config/schema.ts
+var CONFIG_FILENAME = ".agentinel.json";
+function defaultConfig() {
+  return { mode: "warn", allow: [] };
+}
+function parseConfig(raw, warn2 = () => {
+}) {
+  const config = defaultConfig();
+  if (typeof raw !== "object" || raw === null) {
+    return config;
+  }
+  const source = raw;
+  if (source.mode === "strict" || source.mode === "warn") {
+    config.mode = source.mode;
+  } else if (source.mode !== void 0) {
+    warn2(
+      `unknown mode ${JSON.stringify(source.mode)} in ${CONFIG_FILENAME}, falling back to "warn". Valid modes are "warn" and "strict".`
+    );
+  }
+  if (Array.isArray(source.allow)) {
+    for (const entry of source.allow) {
+      if (typeof entry !== "object" || entry === null) continue;
+      const { name, reason, date } = entry;
+      if (typeof name !== "string" || name.length === 0) continue;
+      config.allow.push({
+        name,
+        reason: typeof reason === "string" ? reason : "",
+        date: typeof date === "string" ? date : ""
+      });
+    }
+  }
+  return config;
+}
+function isAllowlisted(config, name) {
+  const entry = config.allow.find((candidate) => candidate.name === name);
+  return entry ? { allowed: true, reason: entry.reason } : { allowed: false };
+}
+
+// src/config/load.ts
+var ConfigError = class extends Error {
+};
+function configPath(repoRoot) {
+  return join(repoRoot, CONFIG_FILENAME);
+}
+function loadConfig(repoRoot) {
+  const path = configPath(repoRoot);
+  if (!existsSync(path)) {
+    return defaultConfig();
+  }
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error) {
+    throw new ConfigError(`could not read ${CONFIG_FILENAME}: ${describe(error)}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new ConfigError(`${CONFIG_FILENAME} is not valid JSON, fix it or delete it`);
+  }
+  return parseConfig(raw, (message) => process.stderr.write(`agentinel: ${message}
+`));
+}
+function saveConfig(repoRoot, config) {
+  writeFileSync(configPath(repoRoot), JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/commands/allow.ts
+function runAllow(name, reason) {
+  if (!name) {
+    console.error('usage: asen allow <pkg> --reason "why this package is trusted"');
+    return 1;
+  }
+  if (!reason || reason.trim().length === 0) {
+    console.error(
+      `a reason is required, so anyone reading the config later knows why ${name} was trusted`
+    );
+    console.error(`  asen allow ${name} --reason "published by me, expected to be new"`);
+    return 1;
+  }
+  const repoRoot = repoRootOrCwd();
+  const config = loadConfig(repoRoot);
+  if (config.allow.some((entry) => entry.name === name)) {
+    console.log(`${name} is already allowlisted`);
+    return 0;
+  }
+  config.allow.push({
+    name,
+    reason: reason.trim(),
+    date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)
+  });
+  saveConfig(repoRoot, config);
+  console.log(`allowlisted ${name} in .agentinel.json`);
+  return 0;
+}
+
+// src/types.ts
+var MAX_AGE_DAYS = 30;
+var MIN_MONTHLY_DOWNLOADS = 1e3;
+var SIZE_JUMP_RATIO = 3;
+function isRisky(verdict) {
+  return verdict.kind === "flagged" || verdict.kind === "not-found";
+}
+function isConfirmed(reason) {
+  return reason.kind === "known-malware" || reason.kind === "security-hold";
+}
+
+// src/checks/package-guard/http.ts
+var TIMEOUT_MS = 1e4;
+var ATTEMPTS = 2;
+var RequestFailed = class extends Error {
+  constructor(message, timedOut) {
+    super(message);
+    this.timedOut = timedOut;
+  }
+  timedOut;
+};
+async function get(url) {
+  let last = null;
+  for (let attempt = 0; attempt < ATTEMPTS; attempt += 1) {
+    try {
+      return await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+    } catch (error) {
+      last = new RequestFailed(describe2(error), isTimeout(error));
+    }
+  }
+  throw last ?? new RequestFailed("request failed", false);
+}
+function isTimeout(error) {
+  if (!(error instanceof RequestFailed)) {
+    if (!(error instanceof Error)) {
+      return false;
+    }
+    if (error.name === "TimeoutError" || error.name === "AbortError") {
+      return true;
+    }
+    return isTimeout(error.cause);
+  }
+  return error.timedOut;
+}
+function describe2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/checks/package-guard/downloads.ts
+var DOWNLOADS_URL = "https://api.npmjs.org/downloads/point/last-month";
+async function fetchDownloads(name) {
+  const url = `${DOWNLOADS_URL}/${name.replace("/", "%2F")}`;
+  let response;
+  try {
+    response = await get(url);
+  } catch (error) {
+    return { kind: "unavailable", reason: describeFailure(error) };
+  }
+  if (response.status === 404) {
+    return { kind: "no-data" };
+  }
+  if (!response.ok) {
+    return { kind: "unavailable", reason: `downloads API returned ${response.status}` };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    return { kind: "unavailable", reason: describeFailure(error) };
+  }
+  const lastMonth = readDownloadCount(body);
+  if (lastMonth === null) {
+    return { kind: "unavailable", reason: "downloads response had no usable count" };
+  }
+  return { kind: "found", lastMonth };
+}
+function readDownloadCount(body) {
+  if (typeof body !== "object" || body === null) {
+    return null;
+  }
+  const downloads2 = body.downloads;
+  if (typeof downloads2 !== "number" || !Number.isFinite(downloads2)) {
+    return null;
+  }
+  return downloads2;
+}
+function describeFailure(error) {
+  return isTimeout(error) ? "downloads request timed out" : "could not reach the npm downloads API";
+}
+
+// src/checks/package-guard/malware.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join2 } from "path";
+import { fileURLToPath } from "url";
+import { gunzipSync } from "zlib";
+var cache = null;
+function list() {
+  if (cache === null) {
+    cache = load();
+  }
+  return cache;
+}
+function isKnownMalware(name, version) {
+  const versions = list()[name];
+  if (versions === void 0) {
+    return false;
+  }
+  if (versions.length === 0) {
+    return true;
+  }
+  return version ? versions.includes(version) : false;
+}
+function load() {
+  const path = listPath();
+  if (path === null) {
+    return {};
+  }
+  try {
+    const raw = gunzipSync(readFileSync2(path)).toString("utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function listPath() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join2(here, "..", "data", "malware-names.json.gz"),
+    join2(here, "..", "..", "data", "malware-names.json.gz"),
+    join2(here, "..", "..", "..", "data", "malware-names.json.gz")
+  ];
+  return candidates.find((path) => existsSync2(path)) ?? null;
+}
+
+// src/checks/package-guard/parse-install.ts
+var PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun"]);
+var INSTALL_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "install",
+  "i",
+  "add",
+  "in",
+  "ins",
+  "inst",
+  "insta",
+  "instal"
+]);
+var EXECUTE_SUBCOMMANDS = /* @__PURE__ */ new Set(["dlx", "exec"]);
+var EXECUTE_COMMANDS = /* @__PURE__ */ new Set(["npx", "bunx", "pnpx"]);
+var LOCKFILE_SUBCOMMANDS = /* @__PURE__ */ new Set(["ci", "install", "i"]);
+var VALUE_TAKING_FLAGS2 = /* @__PURE__ */ new Set([
+  "--registry",
+  "--prefix",
+  "--workspace",
+  "-w",
+  "--package",
+  "-p",
+  "--call",
+  "-c"
+]);
+var PACKAGE_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
+function isValidPackageName(token) {
+  if (token.length === 0 || token.length > 214) {
+    return false;
+  }
+  return PACKAGE_NAME.test(token);
+}
+var NOTHING = { installs: [], executes: [], lockfile: false };
+function parseCommand(command) {
+  const intent = { installs: [], executes: [], lockfile: false };
+  for (const segment of splitSegments(command)) {
+    const found = parseSegment(segment);
+    for (const name of found.installs) {
+      if (!intent.installs.includes(name)) intent.installs.push(name);
+    }
+    for (const name of found.executes) {
+      if (!intent.executes.includes(name)) intent.executes.push(name);
+    }
+    if (found.lockfile) intent.lockfile = true;
+  }
+  return intent;
+}
+function splitSegments(command) {
+  return command.split(/&&|\|\||[;|&\n]/).map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+}
+function parseSegment(segment) {
+  const tokens = tokenize(segment);
+  const head = tokens[0];
+  if (head === void 0) {
+    return NOTHING;
+  }
+  if (EXECUTE_COMMANDS.has(head)) {
+    return { installs: [], executes: namesAfter(tokens, 1, 1), lockfile: false };
+  }
+  if (!PACKAGE_MANAGERS.has(head)) {
+    return NOTHING;
+  }
+  let index = 1;
+  while (index < tokens.length && isFlag(tokens[index])) {
+    index += consumedBy(tokens[index]);
+  }
+  const subcommand = tokens[index];
+  if (subcommand === void 0) {
+    return head === "yarn" ? { ...NOTHING, lockfile: true } : NOTHING;
+  }
+  index += 1;
+  if (EXECUTE_SUBCOMMANDS.has(subcommand)) {
+    return { installs: [], executes: namesAfter(tokens, index, 1), lockfile: false };
+  }
+  if (!INSTALL_SUBCOMMANDS.has(subcommand) && !LOCKFILE_SUBCOMMANDS.has(subcommand)) {
+    return NOTHING;
+  }
+  const named = namesAfter(tokens, index, Infinity);
+  if (named.length === 0 && positionalCount(tokens, index) === 0) {
+    return LOCKFILE_SUBCOMMANDS.has(subcommand) ? { ...NOTHING, lockfile: true } : NOTHING;
+  }
+  return { installs: named, executes: [], lockfile: false };
+}
+function namesAfter(tokens, start, limit) {
+  const names = [];
+  for (let index = start; index < tokens.length && names.length < limit; index += 1) {
+    const token = tokens[index];
+    if (token === "--") {
+      continue;
+    }
+    if (isFlag(token)) {
+      index += consumedBy(token) - 1;
+      continue;
+    }
+    const name = packageNameFrom(token);
+    if (name !== null) {
+      names.push(name);
+    } else if (limit === 1) {
+      return names;
+    }
+  }
+  return names;
+}
+function positionalCount(tokens, start) {
+  let count = 0;
+  for (let index = start; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (isFlag(token)) {
+      index += consumedBy(token) - 1;
+      continue;
+    }
+    if (token !== "--") count += 1;
+  }
+  return count;
+}
+function tokenize(segment) {
+  const tokens = [];
+  const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
+  let match = pattern.exec(segment);
+  while (match !== null) {
+    tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
+    match = pattern.exec(segment);
+  }
+  return tokens;
+}
+function isFlag(token) {
+  return token.startsWith("-") && token.length > 1;
+}
+function consumedBy(flag) {
+  if (flag.includes("=")) {
+    return 1;
+  }
+  return VALUE_TAKING_FLAGS2.has(flag) ? 2 : 1;
+}
+function packageNameFrom(token) {
+  const separator = token.startsWith("@") ? token.indexOf("@", 1) : token.indexOf("@");
+  if (separator === -1) {
+    return isValidPackageName(token) ? token : null;
+  }
+  const specifier = token.slice(separator + 1);
+  if (specifier.startsWith("npm:")) {
+    return packageNameFrom(specifier.slice("npm:".length));
+  }
+  const name = token.slice(0, separator);
+  return isValidPackageName(name) ? name : null;
+}
+
+// src/checks/package-guard/registry.ts
+var REGISTRY_URL = "https://registry.npmjs.org";
+async function fetchRegistry(name) {
+  const url = `${REGISTRY_URL}/${name.replace("/", "%2F")}`;
+  let response;
+  try {
+    response = await get(url);
+  } catch (error) {
+    return { kind: "unavailable", reason: describeFailure2(error) };
+  }
+  if (response.status === 404) {
+    return { kind: "not-found" };
+  }
+  if (!response.ok) {
+    return { kind: "unavailable", reason: `registry returned ${response.status}` };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    return { kind: "unavailable", reason: describeFailure2(error) };
+  }
+  const facts = readFacts(body);
+  if (facts === null) {
+    return { kind: "unavailable", reason: "registry response had no usable creation date" };
+  }
+  return { kind: "found", facts };
+}
+function readFacts(body) {
+  if (typeof body !== "object" || body === null) {
+    return null;
+  }
+  const doc = body;
+  const created = readCreatedDate(doc);
+  if (created === null) {
+    return null;
+  }
+  const versions = asRecord(doc.versions) ?? {};
+  const order = versionsInPublishOrder(doc, versions);
+  const latestName = latestVersionName(doc, order);
+  const latest = latestName ? asRecord(versions[latestName]) : null;
+  const previousName = order[order.indexOf(latestName ?? "") - 1];
+  const previous = previousName ? asRecord(versions[previousName]) : null;
+  const latestPublisher = publisherOf(latest);
+  const priorPublishers = order.filter((v) => v !== latestName).map((v) => publisherOf(asRecord(versions[v]))).filter((p) => p !== null);
+  return {
+    created,
+    latestVersion: latestName,
+    securityHold: isSecurityHold(doc, latestName),
+    versionCount: Object.keys(versions).length,
+    hasRepository: Boolean(latest?.repository ?? doc.repository),
+    latestPublisher,
+    priorPublishers,
+    unpackedSize: sizeOf(latest),
+    previousUnpackedSize: sizeOf(previous),
+    latestIsSmallBump: isSmallBump(previousName, latestName)
+  };
+}
+function isSecurityHold(doc, latestName) {
+  if (typeof latestName === "string" && latestName.endsWith("-security")) {
+    return true;
+  }
+  const description = doc.description;
+  return typeof description === "string" && description.toLowerCase().includes("security holding");
+}
+function publisherOf(version) {
+  const user = asRecord(version?._npmUser);
+  const name = user?.name;
+  return typeof name === "string" ? name : null;
+}
+function sizeOf(version) {
+  const dist = asRecord(version?.dist);
+  const size2 = dist?.unpackedSize;
+  return typeof size2 === "number" && Number.isFinite(size2) ? size2 : null;
+}
+function versionsInPublishOrder(doc, versions) {
+  const time = asRecord(doc.time) ?? {};
+  return Object.keys(time).filter((key) => key !== "created" && key !== "modified" && key in versions).sort((a, b) => Date.parse(String(time[a])) - Date.parse(String(time[b])));
+}
+function latestVersionName(doc, order) {
+  const tags = asRecord(doc["dist-tags"]);
+  const latest = tags?.latest;
+  if (typeof latest === "string") {
+    return latest;
+  }
+  return order.length > 0 ? order[order.length - 1] ?? null : null;
+}
+function isSmallBump(previous, latest) {
+  if (!previous || !latest) {
+    return false;
+  }
+  const major = (v) => v.split(".")[0];
+  return major(previous) === major(latest);
+}
+function readCreatedDate(doc) {
+  const time = asRecord(doc.time);
+  const created = time?.created;
+  if (typeof created !== "string") {
+    return null;
+  }
+  const parsed = new Date(created);
+  return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+function describeFailure2(error) {
+  return isTimeout(error) ? "registry request timed out" : "could not reach the npm registry";
+}
+
+// src/checks/package-guard/evaluate.ts
+var MS_PER_DAY = 864e5;
+function evaluate(name, registry, downloads2, config, now = /* @__PURE__ */ new Date()) {
+  const allowed = isAllowlisted(config, name);
+  if (allowed.allowed) {
+    return { kind: "allowlisted", name, reason: allowed.reason };
+  }
+  const version = registry.kind === "found" ? registry.facts.latestVersion : null;
+  const confirmed = isKnownMalware(name, version) ? [{ kind: "known-malware" }] : [];
+  if (registry.kind === "not-found") {
+    return confirmed.length > 0 ? { kind: "flagged", name, reasons: confirmed } : { kind: "not-found", name };
+  }
+  if (registry.kind === "unavailable") {
+    return confirmed.length > 0 ? { kind: "flagged", name, reasons: confirmed } : { kind: "skipped", name, reason: registry.reason };
+  }
+  if (downloads2.kind === "unavailable") {
+    return confirmed.length > 0 ? { kind: "flagged", name, reasons: confirmed } : { kind: "skipped", name, reason: downloads2.reason };
+  }
+  const facts = registry.facts;
+  const lastMonth = downloads2.kind === "no-data" ? 0 : downloads2.lastMonth;
+  const ageDays = Math.floor((now.getTime() - facts.created.getTime()) / MS_PER_DAY);
+  const reasons = [...confirmed];
+  if (facts.securityHold) {
+    reasons.push({ kind: "security-hold" });
+  }
+  if (ageDays < MAX_AGE_DAYS && lastMonth < MIN_MONTHLY_DOWNLOADS) {
+    reasons.push({ kind: "new-and-unpopular", ageDays, downloads: lastMonth });
+  }
+  if (!facts.hasRepository && facts.versionCount === 1 && lastMonth < MIN_MONTHLY_DOWNLOADS) {
+    reasons.push({ kind: "no-track-record", downloads: lastMonth });
+  }
+  const jump = sizeJump(facts.unpackedSize, facts.previousUnpackedSize, facts.latestIsSmallBump);
+  if (jump) {
+    reasons.push(jump);
+  }
+  const drift = publisherDrift(facts.latestPublisher, facts.priorPublishers);
+  if (drift && reasons.length > 0) {
+    reasons.push(drift);
+  }
+  return reasons.length > 0 ? { kind: "flagged", name, reasons } : { kind: "clean", name };
+}
+function publisherDrift(latest, prior) {
+  if (!latest || prior.length < 3) {
+    return null;
+  }
+  const recent = prior.slice(-5);
+  const machine = (name) => /github|actions|bot|ci|npm-cli|semantic-release/i.test(name);
+  const allPriorWereMachines = recent.every(machine);
+  const allPriorWereSamePerson = recent.every((p) => p === recent[0]) && !machine(recent[0]);
+  if (allPriorWereMachines && !machine(latest)) {
+    return { kind: "publisher-drift", before: recent[recent.length - 1], now: latest };
+  }
+  if (allPriorWereSamePerson && latest !== recent[0]) {
+    return { kind: "publisher-drift", before: recent[0], now: latest };
+  }
+  return null;
+}
+function sizeJump(now, before, smallBump) {
+  if (!smallBump || now === null || before === null || before === 0) {
+    return null;
+  }
+  return now / before >= SIZE_JUMP_RATIO ? { kind: "size-jump", before, now } : null;
+}
+function needsRegistryLookup(downloads2) {
+  if (downloads2.kind === "found") {
+    return downloads2.lastMonth < MIN_MONTHLY_DOWNLOADS;
+  }
+  return true;
+}
+var CONCURRENCY = 5;
+async function checkPackages(names, config, depth = "thorough") {
+  const unique = [...new Set(names)];
+  const now = /* @__PURE__ */ new Date();
+  const verdicts = new Array(unique.length);
+  let next = 0;
+  async function worker() {
+    while (next < unique.length) {
+      const index = next;
+      next += 1;
+      const name = unique[index];
+      try {
+        verdicts[index] = await checkOne(name, config, now, depth);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        verdicts[index] = { kind: "skipped", name, reason };
+      }
+    }
+  }
+  const workers = Math.min(CONCURRENCY, unique.length);
+  await Promise.all(Array.from({ length: workers }, () => worker()));
+  return verdicts;
+}
+async function checkOne(name, config, now, depth) {
+  const allowed = isAllowlisted(config, name);
+  if (allowed.allowed) {
+    return { kind: "allowlisted", name, reason: allowed.reason };
+  }
+  if (!isValidPackageName(name)) {
+    return { kind: "skipped", name, reason: "not a valid npm package name" };
+  }
+  if (isKnownMalware(name, null)) {
+    return { kind: "flagged", name, reasons: [{ kind: "known-malware" }] };
+  }
+  const downloads2 = await fetchDownloads(name);
+  if (depth === "quick" && !needsRegistryLookup(downloads2)) {
+    return { kind: "clean", name };
+  }
+  const registry = await fetchRegistry(name);
+  return evaluate(name, registry, downloads2, config, now);
+}
+async function scan(named, tree, config) {
+  const namedVerdicts = await checkPackages(named, config, "thorough");
+  const treeVerdicts = scanForKnownMalware(tree, config);
+  return [...namedVerdicts, ...treeVerdicts];
+}
+function scanForKnownMalware(tree, config) {
+  const verdicts = [];
+  for (const { name, version } of tree) {
+    if (isAllowlisted(config, name).allowed) {
+      continue;
+    }
+    if (isKnownMalware(name, version)) {
+      verdicts.push({ kind: "flagged", name, reasons: [{ kind: "known-malware" }] });
+    }
+  }
+  return verdicts;
+}
+
+// src/checks/package-guard/lockfile.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+function packagesInLockfile(repoRoot) {
+  const path = join3(repoRoot, "package-lock.json");
+  if (!existsSync3(path)) {
+    return [];
+  }
+  return packagesInLockText(readFileOrNull(path));
+}
+function stagedLockfilePackages(repoRoot) {
+  let text = null;
+  try {
+    text = execFileSync2("git", ["show", ":package-lock.json"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch {
+    return [];
+  }
+  return packagesInLockText(text);
+}
+function packagesInLockText(text) {
+  if (text === null) {
+    return [];
+  }
+  let lock;
+  try {
+    lock = JSON.parse(text);
+  } catch {
+    return [];
+  }
+  if (typeof lock !== "object" || lock === null) {
+    return [];
+  }
+  const found = /* @__PURE__ */ new Map();
+  collectFromPackages(lock, found);
+  collectFromDependencies(lock, found);
+  return [...found.values()];
+}
+function readFileOrNull(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function collectFromPackages(lock, found) {
+  const packages = lock.packages;
+  if (typeof packages !== "object" || packages === null) {
+    return;
+  }
+  const entries = packages;
+  for (const key of Object.keys(entries)) {
+    if (key === "") continue;
+    const marker = key.lastIndexOf("node_modules/");
+    if (marker === -1) continue;
+    const name = key.slice(marker + "node_modules/".length);
+    if (!name) continue;
+    const entry = entries[key];
+    const version = typeof entry === "object" && entry !== null ? String(entry.version ?? "") : "";
+    found.set(name, { name, version });
+  }
+}
+function collectFromDependencies(lock, found) {
+  const walk = (node) => {
+    if (typeof node !== "object" || node === null) return;
+    const deps = node.dependencies;
+    if (typeof deps !== "object" || deps === null) return;
+    for (const [name, child] of Object.entries(deps)) {
+      const version = typeof child === "object" && child !== null ? String(child.version ?? "") : "";
+      found.set(name, { name, version });
+      walk(child);
+    }
+  };
+  walk(lock);
+}
+
+// src/output/format.ts
+var RESET = "\x1B[0m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var DIM = "\x1B[2m";
+var WIDTH = 46;
+var TITLE = "agentinel";
+function supportsColor(stream = process.stdout) {
+  return stream.isTTY === true && !process.env.NO_COLOR;
+}
+function describeReason(reason) {
+  switch (reason.kind) {
+    case "known-malware":
+      return "listed as malware on the public advisory database";
+    case "security-hold":
+      return "npm has taken this package down for security";
+    case "new-and-unpopular":
+      return `registered ${days(reason.ageDays)} ago, ${downloads(reason.downloads)} last month`;
+    case "publisher-drift":
+      return `published by ${reason.now}, but previous versions came from ${reason.before}`;
+    case "no-track-record":
+      return `no repository, only one version ever, ${downloads(reason.downloads)} last month`;
+    case "size-jump":
+      return `a small version bump, but the code grew from ${size(reason.before)} to ${size(reason.now)}`;
+  }
+}
+function banner(verdict) {
+  switch (verdict.kind) {
+    case "clean":
+    case "allowlisted":
+      return null;
+    case "flagged": {
+      const confirmed = verdict.reasons.some(isConfirmed);
+      const body = [verdict.name, ""];
+      for (const reason of verdict.reasons) {
+        body.push(`- ${describeReason(reason)}`);
+      }
+      if (!confirmed) {
+        body.push("", "This is the pattern slopsquatting attacks use.");
+      }
+      return {
+        heading: confirmed ? "MALICIOUS PACKAGE" : "SUSPICIOUS PACKAGE",
+        body,
+        action: confirmed ? "Do not install this. It is known malware." : `Trust it:  asen allow ${verdict.name} --reason "..."`,
+        tone: confirmed ? "bad" : "warn"
+      };
+    }
+    case "not-found":
+      return {
+        heading: "PACKAGE DOES NOT EXIST",
+        body: [
+          verdict.name,
+          "",
+          "No package by that name is published on npm, so this install will fail.",
+          "A name an agent invented is exactly what a slopsquatter waits to register."
+        ],
+        action: "Check the spelling before installing anything under this name.",
+        tone: "bad"
+      };
+    case "skipped":
+      return {
+        heading: "CHECK SKIPPED",
+        body: [verdict.name, "", verdict.reason, "Nothing was blocked."],
+        tone: "quiet"
+      };
+  }
+}
+function draw(b, paint) {
+  const inner = WIDTH - 4;
+  const text = inner - 1;
+  const color = b.tone === "bad" ? RED : b.tone === "warn" ? YELLOW : DIM;
+  const top = paint(color, `\u256D\u2500 ${TITLE} ${"\u2500".repeat(WIDTH - TITLE.length - 5)}\u256E`);
+  const bottom = paint(color, `\u2570${"\u2500".repeat(WIDTH - 2)}\u256F`);
+  const rows = [];
+  const push = (line, styled) => {
+    const edge = paint(color, "\u2502");
+    const pad = " ".repeat(Math.max(0, inner - line.length));
+    rows.push(`${edge}  ${styled ?? line}${pad}${edge}`);
+  };
+  push(b.heading, paint(color, b.heading));
+  push("");
+  for (const line of b.body) {
+    if (line === "") {
+      push("");
+      continue;
+    }
+    for (const wrapped of wrap(line, text)) {
+      push(wrapped);
+    }
+  }
+  const box = [top, ...rows, bottom].join("\n");
+  return b.action ? `${box}
+  ${paint(DIM, b.action)}` : box;
+}
+function wrap(line, width) {
+  const lines = [];
+  let current = "";
+  for (const word of line.split(" ")) {
+    if (current === "") {
+      current = word;
+    } else if (`${current} ${word}`.length <= width) {
+      current += ` ${word}`;
+    } else {
+      lines.push(current);
+      current = word;
+    }
+  }
+  if (current !== "") {
+    lines.push(current);
+  }
+  return lines.flatMap(
+    (l) => l.length <= width ? [l] : l.match(new RegExp(`.{1,${width}}`, "g")) ?? [l]
+  );
+}
+function formatVerdict(verdict, stream = process.stdout) {
+  const b = banner(verdict);
+  if (b === null) {
+    return null;
+  }
+  const color = supportsColor(stream);
+  const paint = (code, text) => color ? `${code}${text}${RESET}` : text;
+  return draw(b, paint);
+}
+function plainVerdict(verdict) {
+  const b = banner(verdict);
+  return b === null ? null : draw(b, (_code, text) => text);
+}
+function plainSummary(verdicts) {
+  const blocks = verdicts.map(plainVerdict).filter((block) => block !== null);
+  return blocks.length === 0 ? null : blocks.join("\n\n");
+}
+function denyReason(verdicts) {
+  const problems = [];
+  for (const verdict of verdicts) {
+    if (verdict.kind === "flagged") {
+      const why = verdict.reasons.map(describeReason).join("; ");
+      problems.push(`${verdict.name} (${why})`);
+    } else if (verdict.kind === "not-found") {
+      problems.push(`${verdict.name} (does not exist on the npm registry)`);
+    }
+  }
+  if (problems.length === 0) {
+    return "Blocked by agentinel.";
+  }
+  return `Blocked by agentinel: ${problems.join(", ")}. Verify the package, pick an established alternative, or allowlist it with \`asen allow <pkg> --reason "..."\`.`;
+}
+function days(count) {
+  return count === 1 ? "1 day" : `${count} days`;
+}
+function downloads(count) {
+  return count === 1 ? "1 download" : `${count.toLocaleString("en-US")} downloads`;
+}
+function size(bytes) {
+  const kb = bytes / 1024;
+  return kb >= 1024 ? `${(kb / 1024).toFixed(1)}MB` : `${Math.round(kb)}KB`;
+}
+
+// src/commands/check.ts
+async function runCheck(names) {
+  const repoRoot = repoRootOrCwd();
+  const config = loadConfig(repoRoot);
+  let named;
+  let tree;
+  if (names.length > 0) {
+    named = names;
+    tree = [];
+  } else {
+    named = newStagedDependencies(repoRoot);
+    tree = stagedLockfilePackages(repoRoot).filter((entry) => !named.includes(entry.name));
+  }
+  if (named.length === 0 && tree.length === 0) {
+    console.log("no new packages to check");
+    return 0;
+  }
+  const verdicts = await scan(named, tree, config);
+  let risky = 0;
+  let skipped = 0;
+  for (const verdict of verdicts) {
+    if (isRisky(verdict)) {
+      risky += 1;
+    }
+    if (verdict.kind === "skipped") {
+      skipped += 1;
+    }
+    const message = formatVerdict(verdict);
+    if (message) {
+      console.log("");
+      console.log(message);
+    }
+  }
+  if (risky === 0) {
+    const checked = verdicts.length - skipped;
+    if (skipped > 0) {
+      console.log(
+        `checked ${checked} package(s), nothing suspicious. ${skipped} could not be checked`
+      );
+    } else {
+      console.log(`checked ${checked} package(s), nothing suspicious`);
+    }
+    return 0;
+  }
+  return 1;
+}
+
+// src/commands/init.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { isAbsolute, join as join5 } from "path";
+
+// src/platform.ts
+function isWindows() {
+  return process.platform === "win32";
+}
+function npmCommand() {
+  return isWindows() ? { file: "npm.cmd", shell: true } : { file: "npm", shell: false };
+}
+
+// src/commands/shim.ts
+import { chmodSync, existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir } from "os";
+import { join as join4 } from "path";
+var CLIENTS = ["npm", "npx", "pnpm", "yarn", "bun"];
+var BLOCK_EXIT_CODE = 2;
+var RC_MARKER = "# agentinel";
+function currentTarget() {
+  return { home: homedir(), shell: process.env.SHELL ?? "", platform: process.platform };
+}
+function shimDirectory(home) {
+  return join4(home, ".agentinel", "bin");
+}
+function onWindows(target) {
+  return target.platform === "win32";
+}
+function shimFileName(client, target) {
+  return onWindows(target) ? `${client}.cmd` : client;
+}
+function startupFilePath(target) {
+  if (onWindows(target)) {
+    return join4(target.home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1");
+  }
+  if (target.shell.includes("zsh")) {
+    return join4(target.home, ".zshrc");
+  }
+  if (target.shell.includes("bash")) {
+    return join4(target.home, ".bashrc");
+  }
+  return join4(target.home, ".profile");
+}
+function installShim(repoRoot, target = currentTarget()) {
+  const dir = shimDirectory(target.home);
+  mkdirSync(dir, { recursive: true });
+  for (const client of CLIENTS) {
+    const path = join4(dir, shimFileName(client, target));
+    writeFileSync2(path, shimScript(client, target), "utf8");
+    if (!onWindows(target)) {
+      chmodSync(path, 493);
+    }
+  }
+  console.log(`wrote shims for ${CLIENTS.join(", ")} in ${dir}`);
+  addPathLine(target);
+  const mode = loadConfig(repoRoot).mode;
+  console.log(
+    mode === "strict" ? "Mode is strict, so a risky package typed at the terminal will be blocked." : "Mode is warn, so a risky package typed at the terminal will be reported, not blocked."
+  );
+  console.log("Open a new terminal, or run `asen unshim` to undo this.");
+  return 0;
+}
+function removeShim(target = currentTarget()) {
+  const dir = shimDirectory(target.home);
+  rmSync(dir, { recursive: true, force: true });
+  console.log(`removed ${dir}`);
+  removePathLine(target);
+  return 0;
+}
+function pathLine(target) {
+  if (onWindows(target)) {
+    return `$env:Path = "$HOME\\.agentinel\\bin;" + $env:Path  ${RC_MARKER}
+`;
+  }
+  return `export PATH="$HOME/.agentinel/bin:$PATH" ${RC_MARKER}
+`;
+}
+function addPathLine(target) {
+  const path = startupFilePath(target);
+  const existing = existsSync4(path) ? readFileSync4(path, "utf8") : "";
+  if (existing.includes(RC_MARKER)) {
+    console.log(`${path} already puts the shims on PATH, left alone`);
+    return;
+  }
+  mkdirSync(join4(path, ".."), { recursive: true });
+  const separator = existing === "" || existing.endsWith("\n") ? "" : "\n";
+  writeFileSync2(path, `${existing}${separator}${pathLine(target)}`, "utf8");
+  console.log(`added the shims to PATH in ${path}`);
+}
+function removePathLine(target) {
+  const path = startupFilePath(target);
+  if (!existsSync4(path)) {
+    return;
+  }
+  const lines = readFileSync4(path, "utf8").split("\n");
+  const kept = lines.filter((line) => !line.includes(RC_MARKER));
+  if (kept.length === lines.length) {
+    return;
+  }
+  writeFileSync2(path, kept.join("\n"), "utf8");
+  console.log(`removed the PATH line from ${path}`);
+}
+function shimScript(client, target) {
+  return onWindows(target) ? windowsShim(client) : posixShim(client);
+}
+function posixShim(client) {
+  return `#!/bin/sh
+# agentinel shim for ${client}. Checks what the command would pull from the npm registry, then runs
+# the real ${client}. Undo with: asen unshim
+#
+# This script fails open on purpose. If agentinel is missing or broken, ${client} still runs.
+
+client="${client}"
+
+# Our own directory, taken from the script's path rather than from $HOME, which may not be set.
+shim_dir=$(CDPATH= cd -- "$(dirname -- "$0")" 2>/dev/null && pwd)
+
+# PATH with our directory removed. The real client is whatever that resolves to. Skipping this is
+# how a shim finds itself and recurses until the shell runs out of processes.
+real_path=""
+saved_ifs=$IFS
+IFS=:
+for entry in $PATH; do
+  if [ -z "$entry" ] || [ "$entry" = "$shim_dir" ]; then
+    continue
+  fi
+  if [ -z "$real_path" ]; then
+    real_path="$entry"
+  else
+    real_path="$real_path:$entry"
+  fi
+done
+IFS=$saved_ifs
+
+real=$(PATH="$real_path" command -v "$client" 2>/dev/null)
+if [ -z "$real" ]; then
+  echo "agentinel: $client is not installed" >&2
+  exit 127
+fi
+
+if [ -n "$AGENTINEL_SKIP" ]; then
+  exec "$real" "$@"
+fi
+
+# Prefer the copy installed in the project, since it starts faster than a global resolve.
+if [ -x "./node_modules/.bin/asen" ]; then
+  asen="./node_modules/.bin/asen"
+else
+  asen=$(PATH="$real_path" command -v asen 2>/dev/null)
+fi
+
+if [ -n "$asen" ]; then
+  # stdin is closed for the check so it can never swallow input meant for the real client.
+  "$asen" check-command "$client $*" < /dev/null
+  status=$?
+  # ${BLOCK_EXIT_CODE} means agentinel decided to stop this. Any other non-zero means agentinel
+  # itself failed, and that must not stop the user's command.
+  if [ "$status" -eq ${BLOCK_EXIT_CODE} ]; then
+    exit 1
+  fi
+fi
+
+exec "$real" "$@"
+`;
+}
+function windowsShim(client) {
+  return [
+    `@echo off`,
+    `rem agentinel shim for ${client}. Fails open: if agentinel is missing or broken, ${client} still runs.`,
+    `rem Undo with: asen unshim`,
+    `setlocal enabledelayedexpansion`,
+    ``,
+    `set "real="`,
+    `for /f "delims=" %%i in ('where ${client} 2^>nul') do (`,
+    `  echo %%i | findstr /i /c:".agentinel\\bin" >nul`,
+    `  if errorlevel 1 if not defined real set "real=%%i"`,
+    `)`,
+    ``,
+    `if not defined real (`,
+    `  echo agentinel: ${client} is not installed 1>&2`,
+    `  exit /b 127`,
+    `)`,
+    ``,
+    `if defined AGENTINEL_SKIP goto run`,
+    ``,
+    `set "asen="`,
+    `if exist "node_modules\\.bin\\asen.cmd" set "asen=node_modules\\.bin\\asen.cmd"`,
+    `if not defined asen for /f "delims=" %%a in ('where asen 2^>nul') do if not defined asen set "asen=%%a"`,
+    ``,
+    `if defined asen (`,
+    `  call "!asen!" check-command "${client} %*" <nul`,
+    `  if "!errorlevel!"=="${BLOCK_EXIT_CODE}" exit /b 1`,
+    `)`,
+    ``,
+    `:run`,
+    `"!real!" %*`,
+    `exit /b !errorlevel!`,
+    ``
+  ].join("\r\n");
+}
+async function runCheckCommand(command) {
+  if (!command) {
+    return 0;
+  }
+  const { installs, executes } = parseCommand(command);
+  const names = [.../* @__PURE__ */ new Set([...installs, ...executes])];
+  if (names.length === 0) {
+    return 0;
+  }
+  const repoRoot = repoRootOrCwd();
+  const config = loadConfig(repoRoot);
+  const verdicts = await checkPackages(names, config);
+  for (const verdict of verdicts) {
+    const message = formatVerdict(verdict, process.stderr);
+    if (message) {
+      console.error("");
+      console.error(message);
+    }
+  }
+  const risky = verdicts.filter(isRisky);
+  if (config.mode === "strict" && risky.length > 0) {
+    console.error("");
+    console.error(denyReason(risky));
+    return BLOCK_EXIT_CODE;
+  }
+  return 0;
+}
+
+// src/commands/init.ts
+var HOOK_MARKER = "agentinel";
+var HOOK_SUBCOMMAND = "hook claude-code";
+function runInit(options = {}) {
+  const repoRoot = repoRootOrCwd();
+  writeConfig(repoRoot);
+  wireClaudeCodeHook(repoRoot, claudeCodeCommand(repoRoot));
+  wireOtherAgents(repoRoot, agentHookCommand(repoRoot));
+  wirePreCommitHook(repoRoot, gitHookCommand(repoRoot));
+  if (options.shim) {
+    installShim(repoRoot, options.shimTarget);
+  }
+  console.log("\nagentinel is set up. New npm packages will be checked before they land.");
+  console.log('Default mode is warn. Set "mode": "strict" in .agentinel.json to block instead.');
+  if (!hasLocalInstall(repoRoot)) {
+    console.log("\nThe hook runs on every command, and going through npx each time is slow.");
+    console.log("For faster hooks, add it to the repo and run init again:");
+    console.log("  npm install --save-dev agentinel && npx asen init");
+  }
+  return 0;
+}
+function hasLocalInstall(repoRoot) {
+  return existsSync5(join5(repoRoot, "node_modules", ".bin", "asen"));
+}
+function claudeCodeCommand(repoRoot) {
+  if (isWindows()) {
+    return "npx agentinel";
+  }
+  return hasLocalInstall(repoRoot) ? '"$CLAUDE_PROJECT_DIR"/node_modules/.bin/asen' : "npx agentinel";
+}
+function gitHookCommand(repoRoot) {
+  return hasLocalInstall(repoRoot) ? "./node_modules/.bin/asen" : "npx agentinel";
+}
+function writeConfig(repoRoot) {
+  const path = configPath(repoRoot);
+  if (existsSync5(path)) {
+    console.log(".agentinel.json already exists, left alone");
+    return;
+  }
+  saveConfig(repoRoot, defaultConfig());
+  console.log("wrote .agentinel.json");
+}
+function wireClaudeCodeHook(repoRoot, command) {
+  const dir = join5(repoRoot, ".claude");
+  const path = join5(dir, "settings.json");
+  let settings = {};
+  if (existsSync5(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync5(path, "utf8"));
+      if (typeof parsed === "object" && parsed !== null) {
+        settings = parsed;
+      }
+    } catch {
+      console.log(".claude/settings.json is not valid JSON, skipping the Claude Code hook");
+      return;
+    }
+  }
+  const hooks = asRecord2(settings.hooks) ?? {};
+  const preToolUse = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+  if (alreadyRegistered(preToolUse)) {
+    console.log("Claude Code hook already registered, left alone");
+    return;
+  }
+  preToolUse.push({
+    matcher: "Bash",
+    hooks: [{ type: "command", command: `${command} hook claude-code` }]
+  });
+  hooks.PreToolUse = preToolUse;
+  settings.hooks = hooks;
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync3(path, JSON.stringify(settings, null, 2) + "\n", "utf8");
+  console.log("registered the Claude Code PreToolUse hook in .claude/settings.json");
+}
+function agentHookCommand(repoRoot) {
+  if (isWindows()) {
+    return "npx agentinel";
+  }
+  return hasLocalInstall(repoRoot) ? '"$(git rev-parse --show-toplevel)"/node_modules/.bin/asen' : "npx agentinel";
+}
+function wireOtherAgents(repoRoot, command) {
+  if (uses(repoRoot, ".codex")) {
+    wireCodexHook(repoRoot, command);
+  }
+  if (uses(repoRoot, ".copilot") || existsSync5(join5(repoRoot, ".github", "hooks"))) {
+    wireCopilotHook(repoRoot, command);
+  }
+  if (uses(repoRoot, ".gemini")) {
+    wireGeminiHook(repoRoot, command);
+  }
+}
+function uses(repoRoot, dir) {
+  return existsSync5(join5(repoRoot, dir)) || existsSync5(join5(homedir2(), dir));
+}
+function wireCodexHook(repoRoot, command) {
+  const path = join5(repoRoot, ".codex", "hooks.json");
+  const file = readJson(path);
+  if (file === null) {
+    console.log(".codex/hooks.json is not valid JSON, skipping the Codex hook");
+    return;
+  }
+  const hooks = asRecord2(file.hooks) ?? {};
+  const preToolUse = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+  if (registers(preToolUse, "codex")) {
+    console.log("Codex hook already registered, left alone");
+    return;
+  }
+  preToolUse.push({
+    matcher: "Bash",
+    hooks: [{ type: "command", command: `${command} hook codex` }]
+  });
+  hooks.PreToolUse = preToolUse;
+  file.hooks = hooks;
+  writeJson(path, file);
+  console.log("registered the Codex PreToolUse hook in .codex/hooks.json");
+}
+function wireCopilotHook(repoRoot, command) {
+  const path = join5(repoRoot, ".github", "hooks", "agentinel.json");
+  const file = readJson(path);
+  if (file === null) {
+    console.log(".github/hooks/agentinel.json is not valid JSON, skipping the Copilot hook");
+    return;
+  }
+  const hooks = asRecord2(file.hooks) ?? {};
+  const preToolUse = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
+  if (registers(preToolUse, "copilot")) {
+    console.log("Copilot hook already registered, left alone");
+    return;
+  }
+  preToolUse.push({ type: "command", matcher: "bash", bash: `${command} hook copilot` });
+  hooks.preToolUse = preToolUse;
+  file.version = 1;
+  file.hooks = hooks;
+  writeJson(path, file);
+  console.log("registered the Copilot preToolUse hook in .github/hooks/agentinel.json");
+}
+function wireGeminiHook(repoRoot, command) {
+  const path = join5(repoRoot, ".gemini", "settings.json");
+  const file = readJson(path);
+  if (file === null) {
+    console.log(".gemini/settings.json is not valid JSON, skipping the Gemini hook");
+    return;
+  }
+  const hooks = asRecord2(file.hooks) ?? {};
+  const beforeTool = Array.isArray(hooks.BeforeTool) ? hooks.BeforeTool : [];
+  if (registers(beforeTool, "gemini")) {
+    console.log("Gemini hook already registered, left alone");
+    return;
+  }
+  beforeTool.push({
+    matcher: "run_shell_command",
+    hooks: [{ type: "command", command: `${command} hook gemini` }]
+  });
+  hooks.BeforeTool = beforeTool;
+  file.hooks = hooks;
+  writeJson(path, file);
+  console.log("registered the Gemini BeforeTool hook in .gemini/settings.json");
+}
+function readJson(path) {
+  if (!existsSync5(path)) {
+    return {};
+  }
+  try {
+    return asRecord2(JSON.parse(readFileSync5(path, "utf8"))) ?? {};
+  } catch {
+    return null;
+  }
+}
+function writeJson(path, value) {
+  mkdirSync2(join5(path, ".."), { recursive: true });
+  writeFileSync3(path, JSON.stringify(value, null, 2) + "\n", "utf8");
+}
+function registers(entries, kind) {
+  return JSON.stringify(entries).includes(`hook ${kind}`);
+}
+function git2(repoRoot, args) {
+  try {
+    return execFileSync3("git", args, {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function hooksDirectory(repoRoot) {
+  const configured = git2(repoRoot, ["config", "--get", "core.hooksPath"]);
+  if (configured) {
+    return isAbsolute(configured) ? configured : join5(repoRoot, configured);
+  }
+  const path = git2(repoRoot, ["rev-parse", "--git-path", "hooks"]);
+  if (path) {
+    return isAbsolute(path) ? path : join5(repoRoot, path);
+  }
+  return join5(repoRoot, ".git", "hooks");
+}
+function wirePreCommitHook(repoRoot, command) {
+  if (!existsSync5(join5(repoRoot, ".git"))) {
+    console.log("not a git repo, skipping the pre-commit hook");
+    return;
+  }
+  const dir = hooksDirectory(repoRoot);
+  const path = join5(dir, "pre-commit");
+  const script = `#!/bin/sh
+# ${HOOK_MARKER}: check newly added npm packages before they get committed
+${command} hook pre-commit
+`;
+  if (existsSync5(path)) {
+    const existing = readFileSync5(path, "utf8");
+    if (existing.includes(HOOK_MARKER)) {
+      console.log("pre-commit hook already installed, left alone");
+      return;
+    }
+    console.log("a pre-commit hook already exists, not overwriting it");
+    console.log(`add this line to ${path}:
+  ${command} hook pre-commit`);
+    return;
+  }
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync3(path, script, "utf8");
+  chmodSync2(path, 493);
+  console.log(`installed the git pre-commit hook in ${dir}`);
+}
+function alreadyRegistered(preToolUse) {
+  return JSON.stringify(preToolUse).includes(`${HOOK_SUBCOMMAND}`);
+}
+function asRecord2(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+
+// src/hooks/claude-code.ts
+import { existsSync as existsSync6 } from "fs";
+import { join as join6 } from "path";
+
+// src/checks/package-guard/resolve.ts
+import { execFileSync as execFileSync4 } from "child_process";
+var TIMEOUT_MS2 = 2e4;
+function resolveInstall(repoRoot, packages) {
+  if (packages.length === 0) {
+    return [];
+  }
+  const npm = npmCommand();
+  let output;
+  try {
+    output = execFileSync4(
+      npm.file,
+      ["install", "--dry-run", "--no-audit", "--no-fund", ...packages],
+      {
+        cwd: repoRoot,
+        encoding: "utf8",
+        timeout: TIMEOUT_MS2,
+        stdio: ["ignore", "pipe", "ignore"],
+        shell: npm.shell,
+        env: { ...process.env, NO_COLOR: "1" }
+      }
+    );
+  } catch (error) {
+    const stdout = error.stdout;
+    output = typeof stdout === "string" ? stdout : "";
+  }
+  return parseAddLines(output);
+}
+function parseAddLines(output) {
+  const found = /* @__PURE__ */ new Map();
+  for (const line of output.split("\n")) {
+    const match = /^add\s+(\S+)\s+(\S+)/.exec(line.trim());
+    if (match?.[1] && match[2]) {
+      found.set(match[1], { name: match[1], version: match[2] });
+    }
+  }
+  return [...found.values()];
+}
+
+// src/hooks/claude-code.ts
+async function runClaudeCodeHook() {
+  const payload = await readStdinJson();
+  const command = extractCommand(payload);
+  if (!command) {
+    return;
+  }
+  const repoRoot = typeof payload?.cwd === "string" ? payload.cwd : repoRootOrCwd();
+  const { named, tree } = candidatesFor(command, repoRoot);
+  if (named.length === 0 && tree.length === 0) {
+    return;
+  }
+  const config = loadConfig(repoRoot);
+  const verdicts = await scan(named, tree, config);
+  const risky = verdicts.filter(isRisky);
+  if (config.mode === "strict" && risky.length > 0) {
+    emit({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: denyReason(risky)
+      }
+    });
+    return;
+  }
+  warn(verdicts);
+}
+function candidatesFor(command, repoRoot) {
+  const intent = parseCommand(command);
+  const executes = intent.executes.filter((name) => !isLocalTool(repoRoot, name));
+  const named = [.../* @__PURE__ */ new Set([...intent.installs, ...executes])];
+  const resolved = intent.installs.length > 0 ? resolveInstall(repoRoot, intent.installs) : [];
+  const fromLockfile = intent.lockfile ? packagesInLockfile(repoRoot) : [];
+  const tree = /* @__PURE__ */ new Map();
+  for (const entry of [...resolved, ...fromLockfile]) {
+    if (!named.includes(entry.name)) {
+      tree.set(entry.name, entry);
+    }
+  }
+  return { named, tree: [...tree.values()] };
+}
+function isLocalTool(repoRoot, name) {
+  const binary = name.includes("/") ? name.split("/").pop() : name;
+  return existsSync6(join6(repoRoot, "node_modules", ".bin", binary));
+}
+function warn(verdicts) {
+  const summary = plainSummary(verdicts);
+  if (summary === null) {
+    return;
+  }
+  emit({
+    systemMessage: summary,
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      additionalContext: summary
+    }
+  });
+}
+function emit(output) {
+  process.stdout.write(JSON.stringify(output) + "\n");
+}
+function extractCommand(payload) {
+  if (!payload || payload.tool_name !== "Bash") {
+    return null;
+  }
+  const input = payload.tool_input;
+  if (typeof input !== "object" || input === null) {
+    return null;
+  }
+  const command = input.command;
+  return typeof command === "string" ? command : null;
+}
+async function readStdinJson() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const text = Buffer.concat(chunks).toString("utf8").trim();
+  if (!text) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/hooks/agents.ts
+var AGENT_KINDS = ["claude-code", "codex", "copilot", "gemini"];
+function isAgentKind(value) {
+  return AGENT_KINDS.includes(value);
+}
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "shell", "run_shell_command", "execute_bash"]);
+var SHAPES = {
+  // stdout JSON on exit 0. `systemMessage` reaches the user, `additionalContext` reaches the model.
+  "claude-code": {
+    command: (payload) => snakeCommand(payload),
+    warn: (summary) => ({
+      systemMessage: summary,
+      hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: summary }
+    }),
+    deny: (reason) => ({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    })
+  },
+  // Same envelope as Claude Code, and the same snake_case payload. Codex documents
+  // `additionalContext` but no user-facing message field, so in warn mode the agent is told and the
+  // user reads it through the agent.
+  codex: {
+    command: (payload) => snakeCommand(payload),
+    warn: (summary) => ({
+      hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: summary }
+    }),
+    deny: (reason) => ({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    })
+  },
+  // camelCase payload, and permission fields are the only documented output: there is no
+  // `additionalContext` or `systemMessage` on preToolUse. So warn mode uses `ask`, the one channel
+  // that puts our text in front of the person before the install runs. It is not a block, the user
+  // decides. A clean or merely skipped check stays silent, so nothing extra is ever prompted for.
+  copilot: {
+    command: (payload) => camelCommand(payload),
+    warn: (summary, risky) => risky ? { permissionDecision: "ask", permissionDecisionReason: summary } : null,
+    deny: (reason) => ({ permissionDecision: "deny", permissionDecisionReason: reason })
+  },
+  // BeforeTool. A flat `decision`/`reason` pair rather than an envelope, and `systemMessage` is
+  // shown to the user immediately, which is what carries warn mode here.
+  gemini: {
+    command: (payload) => snakeCommand(payload),
+    warn: (summary) => ({ systemMessage: summary }),
+    deny: (reason) => ({ decision: "deny", reason, systemMessage: reason })
+  }
+};
+async function runAgentHook(kind) {
+  try {
+    await check(kind);
+  } catch (error) {
+    process.stderr.write(`agentinel: check skipped (${describe3(error)})
+`);
+  }
+}
+async function check(kind) {
+  const shape = SHAPES[kind];
+  const payload = await readStdinJson2();
+  if (!payload) {
+    return;
+  }
+  const command = shape.command(payload);
+  if (!command) {
+    return;
+  }
+  const repoRoot = typeof payload.cwd === "string" ? payload.cwd : repoRootOrCwd();
+  const { named, tree } = candidatesFor(command, repoRoot);
+  if (named.length === 0 && tree.length === 0) {
+    return;
+  }
+  const config = loadConfig(repoRoot);
+  const verdicts = await scan(named, tree, config);
+  const risky = verdicts.filter(isRisky);
+  if (config.mode === "strict" && risky.length > 0) {
+    emit2(shape.deny(denyReason(risky)));
+    return;
+  }
+  const summary = plainSummary(verdicts);
+  if (summary === null) {
+    return;
+  }
+  const output = shape.warn(summary, risky.length > 0);
+  if (output !== null) {
+    emit2(output);
+  }
+}
+function snakeCommand(payload) {
+  return shellCommand(payload.tool_name, payload.tool_input);
+}
+function camelCommand(payload) {
+  return shellCommand(payload.toolName, payload.toolArgs);
+}
+function shellCommand(toolName, args) {
+  if (typeof toolName !== "string" || !SHELL_TOOLS.has(toolName.toLowerCase())) {
+    return null;
+  }
+  if (typeof args !== "object" || args === null) {
+    return null;
+  }
+  const command = args.command;
+  if (typeof command === "string") {
+    return command;
+  }
+  if (Array.isArray(command) && command.every((part) => typeof part === "string")) {
+    return command.join(" ");
+  }
+  return null;
+}
+function emit2(output) {
+  process.stdout.write(JSON.stringify(output) + "\n");
+}
+async function readStdinJson2() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const text = Buffer.concat(chunks).toString("utf8").trim();
+  if (!text) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function describe3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/hooks/pre-commit.ts
+async function scanStagedPackages(repoRoot) {
+  const named = newStagedDependencies(repoRoot);
+  const tree = stagedLockfilePackages(repoRoot).filter((entry) => !named.includes(entry.name));
+  if (named.length === 0 && tree.length === 0) {
+    return [];
+  }
+  return scan(named, tree, loadConfig(repoRoot));
+}
+async function runPreCommitHook() {
+  const repoRoot = repoRootOrCwd();
+  const verdicts = await scanStagedPackages(repoRoot);
+  for (const verdict of verdicts) {
+    const message = formatVerdict(verdict, process.stderr);
+    if (message) {
+      process.stderr.write("\n" + message + "\n");
+    }
+  }
+  if (!verdicts.some(isRisky)) {
+    return 0;
+  }
+  if (loadConfig(repoRoot).mode === "strict") {
+    process.stderr.write("\ncommit blocked by agentinel (strict mode)\n");
+    return 1;
+  }
+  return 0;
+}
+
+// bin/asen.ts
+var USAGE = `asen, a guard for AI coding agent workflows
+
+  asen init [--shim]                 set up the hooks and config in this repo
+  asen check [pkg...]                check staged dependencies, or specific packages
+  asen allow <pkg> --reason "..."    allowlist a flagged package, with a logged reason
+  asen unshim                        remove the PATH shims that --shim installed
+`;
+async function main(argv2) {
+  const [command, ...rest] = argv2;
+  switch (command) {
+    case "init":
+      return runInit({ shim: rest.includes("--shim") });
+    case "check":
+      return runCheck(positionals(rest));
+    case "allow":
+      return runAllow(positionals(rest)[0], readFlag(rest, "--reason"));
+    case "unshim":
+      return removeShim();
+    // Not documented in the usage text on purpose. These are what the installed hooks call.
+    case "hook":
+      return runHook(rest[0]);
+    // What the PATH shims call, with the whole command line as one argument.
+    case "check-command":
+      return runCheckCommand(rest[0]);
+    case "--help":
+    case "-h":
+    case void 0:
+      console.log(USAGE);
+      return 0;
+    default:
+      console.error(`unknown command: ${command}
+`);
+      console.error(USAGE);
+      return 1;
+  }
+}
+async function runHook(name) {
+  if (name === "claude-code") {
+    await runClaudeCodeHook();
+    return 0;
+  }
+  if (name && isAgentKind(name)) {
+    await runAgentHook(name);
+    return 0;
+  }
+  if (name === "pre-commit") {
+    return runPreCommitHook();
+  }
+  console.error(`unknown hook: ${name}`);
+  return 0;
+}
+var argv = process.argv.slice(2);
+function failsOpen(args) {
+  return args[0] === "hook" || args[0] === "check-command";
+}
+main(argv).then((code) => {
+  process.exitCode = code;
+}).catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  if (error instanceof ConfigError) {
+    console.error(`agentinel: ${message}`);
+    process.exitCode = failsOpen(argv) ? 0 : 1;
+    return;
+  }
+  if (failsOpen(argv)) {
+    console.error(`agentinel: check skipped (${message})`);
+    process.exitCode = 0;
+    return;
+  }
+  console.error(`agentinel: ${message}`);
+  process.exitCode = 1;
+});