calllint 0.3.0-preview.0

package/dist/index.js

@@ -0,0 +1,2539 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+
+// src/args.ts
+var EXIT = {
+  OK: 0,
+  USAGE: 2,
+  ERROR: 3,
+  REVIEW: 10,
+  UNKNOWN: 20,
+  BLOCK: 30,
+  DRIFT: 40
+};
+function parseArgs(argv) {
+  const [command, ...rest] = argv;
+  const positionals = [];
+  const flags = {};
+  for (let i = 0; i < rest.length; i++) {
+    const tok = rest[i];
+    if (tok.startsWith("--")) {
+      const body = tok.slice(2);
+      const eq = body.indexOf("=");
+      if (eq !== -1) {
+        flags[body.slice(0, eq)] = body.slice(eq + 1);
+      } else {
+        const next = rest[i + 1];
+        if (next !== void 0 && !next.startsWith("-")) {
+          flags[body] = next;
+          i++;
+        } else {
+          flags[body] = true;
+        }
+      }
+    } else if (tok.startsWith("-") && tok.length > 1) {
+      flags[tok.slice(1)] = true;
+    } else {
+      positionals.push(tok);
+    }
+  }
+  return { command, positionals, flags };
+}
+function flagStr(flags, key) {
+  const v = flags[key];
+  return typeof v === "string" ? v : void 0;
+}
+function flagBool(flags, key) {
+  return flags[key] === true || flags[key] === "true";
+}
+
+// src/commands/help.ts
+var HELP = `calllint \u2014 evidence-backed verdicts for agent tools
+
+USAGE
+  calllint <command> [options]
+
+COMMANDS
+  scan [target]      Scan an MCP config file, or npm:<pkg> / github:<owner/repo>
+  baseline [target]  Record the approved risk surface as a baseline
+  verify [target]    Compare a fresh scan against the baseline (drift / rug-pull)
+  explain <server>   Explain the verdict for one server from the last scan
+  policy init        Write a default calllint.policy.json
+  policy explain     Show the effective policy
+  help               Show this help
+
+TARGETS
+  <path>             A config file (default: detect common locations)
+  npm:<pkg>[@ver]    Synthesize a config for an npm package (offline)
+  github:<owner/repo>[@ref]   A GitHub repo (requires --online)
+
+SCAN OPTIONS
+  --json             Emit the ScanReport JSON (stable, emoji-free)
+  --compact          One line per server
+  --no-emoji         Plain-text symbols (good for CI logs)
+  --sarif            Emit SARIF 2.1.0 (GitHub Code Scanning / CI)
+  --html             Emit a self-contained HTML report
+  --policy <file>    Use a policy file (default: built-in defaults)
+  --stdin            Read config JSON from stdin
+  --ci               Exit non-zero per policy (BLOCK=30, UNKNOWN=20, REVIEW=10 if enabled)
+  --generated-at <iso>  Pin the report timestamp (ISO 8601) for deterministic output
+
+VERIFY OPTIONS
+  --baseline <file>  Baseline path (default: .calllint/baseline.json)
+  --ci               Exit 40 if the risk surface drifted from the baseline
+  --json             Emit the drift report JSON
+
+EXAMPLES
+  calllint scan .cursor/mcp.json
+  cat .cursor/mcp.json | calllint scan --stdin --json
+  calllint scan ./mcp.json --ci --no-emoji
+  calllint scan npm:mcp-weather@1.0.0
+  calllint scan github:owner/repo --online
+  calllint baseline ./mcp.json
+  calllint verify ./mcp.json --ci
+  calllint explain filesystem
+`;
+function helpCommand() {
+  return { stdout: HELP, exitCode: 0 };
+}
+
+// src/commands/scan.ts
+import { join as join3 } from "node:path";
+
+// ../../packages/policy/src/defaultPolicy.ts
+function defaultPolicy() {
+  return {
+    schemaVersion: "calllint.policy.v0",
+    defaults: {
+      unknownSource: "deny",
+      unpinnedPackage: "warn",
+      broadFilesystemAccess: "deny",
+      arbitraryCommandExecution: "deny",
+      promptPoisoning: "deny",
+      externalMutation: "warn",
+      financialAction: "deny"
+    },
+    ci: {
+      failOn: ["BLOCK", "UNKNOWN"],
+      failOnReview: false
+    },
+    allowedSources: [
+      "npm:@modelcontextprotocol/*",
+      "github:modelcontextprotocol/*"
+    ],
+    allowedPaths: ["${workspaceFolder}"],
+    overrides: []
+  };
+}
+function defaultPolicyJson() {
+  return JSON.stringify(defaultPolicy(), null, 2) + "\n";
+}
+
+// ../../packages/policy/src/validatePolicy.ts
+var PolicyValidationError = class extends Error {
+  constructor(issues) {
+    super(
+      "Invalid policy:\n" + issues.map((i) => `  - ${i.path}: ${i.message}`).join("\n")
+    );
+    this.issues = issues;
+    this.name = "PolicyValidationError";
+  }
+};
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var DANGEROUS_SYMBOLS = /* @__PURE__ */ new Set(["EXEC", "MONEY"]);
+function validateOverride(o, index, issues) {
+  const base = `overrides[${index}]`;
+  if (!isRecord(o)) {
+    issues.push({ path: base, message: "must be an object" });
+    return;
+  }
+  if (typeof o.target !== "string" || !o.target) {
+    issues.push({ path: `${base}.target`, message: "is required" });
+  }
+  if (typeof o.reason !== "string" || !o.reason.trim()) {
+    issues.push({
+      path: `${base}.reason`,
+      message: "is required (overrides without a reason are not allowed)"
+    });
+  }
+  if (typeof o.expiresAt !== "string" || Number.isNaN(Date.parse(o.expiresAt))) {
+    issues.push({
+      path: `${base}.expiresAt`,
+      message: "must be a valid ISO timestamp (overrides must expire)"
+    });
+  }
+  const allow = Array.isArray(o.allow) ? o.allow : [];
+  const allowsDangerous = allow.some(
+    (s) => typeof s === "string" && DANGEROUS_SYMBOLS.has(s)
+  );
+  if (allowsDangerous && o.dangerousOverride !== true) {
+    issues.push({
+      path: `${base}.allow`,
+      message: "may not allow EXEC or MONEY unless dangerousOverride is set to true"
+    });
+  }
+}
+function validatePolicy(value) {
+  const issues = [];
+  if (!isRecord(value)) {
+    throw new PolicyValidationError([{ path: "", message: "must be an object" }]);
+  }
+  if (value.schemaVersion !== "calllint.policy.v0") {
+    issues.push({
+      path: "schemaVersion",
+      message: 'must be "calllint.policy.v0"'
+    });
+  }
+  if (!isRecord(value.defaults)) {
+    issues.push({ path: "defaults", message: "is required" });
+  }
+  if (!isRecord(value.ci)) {
+    issues.push({ path: "ci", message: "is required" });
+  }
+  const overrides = Array.isArray(value.overrides) ? value.overrides : [];
+  overrides.forEach((o, i) => validateOverride(o, i, issues));
+  if (issues.length > 0) throw new PolicyValidationError(issues);
+  return value;
+}
+function isOverrideActive(o, now) {
+  const exp = Date.parse(o.expiresAt);
+  return !Number.isNaN(exp) && exp > now;
+}
+
+// ../../packages/policy/src/loadPolicy.ts
+import { readFileSync } from "node:fs";
+var PolicyLoadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PolicyLoadError";
+  }
+};
+function loadPolicyFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (err) {
+    throw new PolicyLoadError(
+      `Could not read policy file ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new PolicyLoadError(
+      `Policy file ${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return validatePolicy(parsed);
+}
+function loadPolicyOrDefault(path) {
+  return path ? loadPolicyFile(path) : defaultPolicy();
+}
+
+// ../../packages/policy/src/applyPolicy.ts
+function applyPolicy(rawVerdict, serverName, blockingFindings, policy, now) {
+  if (rawVerdict !== "BLOCK") {
+    return { verdict: rawVerdict, changed: false };
+  }
+  const override = policy.overrides.find(
+    (o) => o.target === serverName && isOverrideActive(o, now)
+  );
+  if (!override) return { verdict: rawVerdict, changed: false };
+  const allowed = new Set(override.allow ?? []);
+  const blockingSymbols = new Set(
+    blockingFindings.filter((f) => f.blocker).map((f) => f.symbol)
+  );
+  const allCovered = [...blockingSymbols].every((s) => allowed.has(s));
+  if (!allCovered) return { verdict: rawVerdict, changed: false };
+  return {
+    verdict: "REVIEW",
+    changed: true,
+    note: `Policy decision: override for "${serverName}" (expires ${override.expiresAt}) \u2014 ${override.reason}`
+  };
+}
+function shouldFailCi(verdict, policy) {
+  if (verdict === "REVIEW") return policy.ci.failOnReview;
+  return policy.ci.failOn.includes(verdict);
+}
+
+// ../../packages/core/src/options.ts
+function resolveScanOptions(opts) {
+  return {
+    policy: opts?.policy ?? defaultPolicy(),
+    now: opts?.now ?? 0,
+    generatedAt: opts?.generatedAt ?? "1970-01-01T00:00:00.000Z",
+    extraFindings: opts?.extraFindings ?? {}
+  };
+}
+
+// ../../packages/types/src/verdict.ts
+var VERDICT_SEVERITY = {
+  SAFE: 0,
+  REVIEW: 1,
+  UNKNOWN: 2,
+  BLOCK: 3
+};
+var VERDICT_CLI_SYMBOL = {
+  SAFE: "\u{1F6E1} SAFE",
+  REVIEW: "\u26A0 REVIEW",
+  BLOCK: "\u26D4 BLOCK",
+  UNKNOWN: "\u25C7 UNKNOWN"
+};
+var VERDICT_TEXT_SYMBOL = {
+  SAFE: "SAFE",
+  REVIEW: "REVIEW",
+  BLOCK: "BLOCK",
+  UNKNOWN: "UNKNOWN"
+};
+var VERDICT_PUBLIC_LABEL = {
+  SAFE: "No blockers observed",
+  REVIEW: "Review required",
+  BLOCK: "Blocked by policy",
+  UNKNOWN: "Insufficient evidence"
+};
+function mostSevereVerdict(verdicts) {
+  let worst = "SAFE";
+  for (const v of verdicts) {
+    if (VERDICT_SEVERITY[v] > VERDICT_SEVERITY[worst]) worst = v;
+  }
+  return worst;
+}
+
+// ../../packages/types/src/symbols.ts
+var RISK_SYMBOL_EMOJI = {
+  SECRETS: "\u{1F510}",
+  FILES: "\u{1F4C1}",
+  NETWORK: "\u{1F310}",
+  PROMPT: "\u{1F9E0}",
+  EXEC: "\u2699\uFE0F",
+  ACTION: "\u2709\uFE0F",
+  MONEY: "\u{1F4B8}",
+  SUPPLY: "\u{1F9E9}",
+  RUGPULL: "\u{1F501}"
+};
+var RISK_SYMBOL_LABEL = {
+  SECRETS: "Secrets",
+  FILES: "Files",
+  NETWORK: "Network",
+  PROMPT: "Prompt",
+  EXEC: "Exec",
+  ACTION: "Action",
+  MONEY: "Money",
+  SUPPLY: "Supply Chain",
+  RUGPULL: "Rug Pull"
+};
+var RISK_CLASS_LABEL = {
+  S0: "Metadata only",
+  S1: "Read-only utility",
+  S2: "Sensitive read",
+  S3: "External mutation",
+  S4: "Execution / automation",
+  S5: "Financial / irreversible"
+};
+var RISK_CLASS_RANK = {
+  S0: 0,
+  S1: 1,
+  S2: 2,
+  S3: 3,
+  S4: 4,
+  S5: 5
+};
+function highestRiskClass(classes) {
+  let worst = "S0";
+  for (const c of classes) {
+    if (RISK_CLASS_RANK[c] > RISK_CLASS_RANK[worst]) worst = c;
+  }
+  return worst;
+}
+
+// ../../packages/resolver/src/npmSpec.ts
+var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "pnpm", "yarn", "bunx", "uvx", "pipx"]);
+var SHELL_COMMANDS = /* @__PURE__ */ new Set([
+  "bash",
+  "sh",
+  "zsh",
+  "cmd",
+  "cmd.exe",
+  "powershell",
+  "powershell.exe",
+  "pwsh"
+]);
+function parseNpmSpec(arg) {
+  if (!arg || arg.startsWith("-")) return void 0;
+  if (arg.includes("/") && !arg.startsWith("@")) return void 0;
+  if (arg.includes("://")) return void 0;
+  if (arg.startsWith("@")) {
+    const slash = arg.indexOf("/");
+    if (slash === -1) return void 0;
+    const at2 = arg.indexOf("@", slash);
+    if (at2 === -1) return { name: arg };
+    return { name: arg.slice(0, at2), versionSpec: arg.slice(at2 + 1) || void 0 };
+  }
+  const at = arg.indexOf("@");
+  if (at <= 0) return { name: arg };
+  return { name: arg.slice(0, at), versionSpec: arg.slice(at + 1) || void 0 };
+}
+function isPackageRunner(command) {
+  if (!command) return false;
+  return PACKAGE_RUNNERS.has(command.toLowerCase());
+}
+function isPinnedVersion(versionSpec) {
+  if (!versionSpec) return false;
+  if (versionSpec === "latest" || versionSpec === "*") return false;
+  if (/[\^~><]/.test(versionSpec)) return false;
+  return /^\d/.test(versionSpec);
+}
+
+// ../../packages/resolver/src/resolveRuntimeBinding.ts
+function runtimeKindFor(server) {
+  if (server.url) {
+    return server.transport === "sse" ? "sse" : "http";
+  }
+  const cmd = (server.command ?? "").toLowerCase();
+  if (!cmd) return "unknown";
+  if (cmd === "npx" || cmd === "bunx" || cmd === "pnpm" || cmd === "yarn") return "npx";
+  if (cmd === "uvx" || cmd === "pipx") return "uvx";
+  if (cmd === "node" || cmd === "node.exe") return "node";
+  if (cmd === "python" || cmd === "python3" || cmd === "py") return "python";
+  if (cmd === "docker") return "docker";
+  if (SHELL_COMMANDS.has(cmd)) return "unknown";
+  return "unknown";
+}
+function firstPackageArg(args) {
+  for (const a of args) {
+    if (a === "-y" || a === "--yes" || a.startsWith("-")) continue;
+    return a;
+  }
+  return void 0;
+}
+function resolveRuntimeBinding(server) {
+  const runtimeKind = runtimeKindFor(server);
+  if (server.url) {
+    return {
+      declaredCommand: server.command,
+      declaredArgs: server.args,
+      transport: server.transport,
+      runtimeKind,
+      isVersionPinned: false,
+      remoteUrl: server.url,
+      sourceKnown: false,
+      installMayRunScripts: false,
+      runtimeExecutable: false
+    };
+  }
+  const command = server.command;
+  const args = server.args;
+  if (isPackageRunner(command)) {
+    const pkgArg = firstPackageArg(args);
+    const spec = pkgArg ? parseNpmSpec(pkgArg) : void 0;
+    const installMayRunScripts = args.includes("-y") || args.includes("--yes") || true;
+    return {
+      declaredCommand: command,
+      declaredArgs: args,
+      transport: "stdio",
+      runtimeKind,
+      packageName: spec?.name,
+      packageVersionSpec: spec?.versionSpec,
+      isVersionPinned: isPinnedVersion(spec?.versionSpec),
+      sourceKnown: Boolean(spec?.name),
+      installMayRunScripts,
+      runtimeExecutable: true
+    };
+  }
+  if (command && SHELL_COMMANDS.has(command.toLowerCase())) {
+    return {
+      declaredCommand: command,
+      declaredArgs: args,
+      transport: "stdio",
+      runtimeKind: "unknown",
+      isVersionPinned: false,
+      sourceKnown: false,
+      installMayRunScripts: false,
+      runtimeExecutable: true
+    };
+  }
+  return {
+    declaredCommand: command,
+    declaredArgs: args,
+    transport: server.transport === "unknown" ? "stdio" : server.transport,
+    runtimeKind,
+    isVersionPinned: false,
+    // A bare local script path is "known" in that we can see it; a missing
+    // command is genuinely unknown.
+    sourceKnown: Boolean(command),
+    installMayRunScripts: false,
+    runtimeExecutable: Boolean(command)
+  };
+}
+
+// ../../packages/static-analyzer/src/detectors/unpinnedPackage.ts
+function detectUnpinnedPackage(ctx) {
+  const { binding } = ctx;
+  if (!binding.packageName) return [];
+  if (binding.isVersionPinned) return [];
+  const spec = binding.packageVersionSpec;
+  const display = spec ? `${binding.packageName}@${spec}` : binding.packageName;
+  return [
+    {
+      id: "supply.unpinned-package",
+      title: "Package version is not pinned",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S1",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "runtime-binding",
+      evidence: [
+        {
+          type: "runtime-binding",
+          key: "package",
+          value: display
+        }
+      ],
+      impact: "The installed code can change between scans and runs, so this verdict may not match what actually executes.",
+      fix: `Pin the package to an exact version, e.g. ${binding.packageName}@1.0.0.`,
+      falsePositiveNote: "Intentional during local development, but should be pinned before autonomous or CI use."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/broadFilesystemPath.ts
+var BROAD_PATHS = [
+  "/",
+  "~",
+  "/Users",
+  "/home",
+  "/root",
+  "/etc",
+  "/var",
+  "C:\\",
+  "C:\\Users",
+  "${HOME}",
+  "$HOME",
+  "%USERPROFILE%",
+  "%APPDATA%",
+  "%HOMEPATH%"
+];
+function isWorkspaceScoped(arg) {
+  return arg.includes("${workspaceFolder}") || arg.includes("${workspaceRoot}") || arg === "." || arg === "./";
+}
+function looksLikeBroadPath(arg) {
+  if (isWorkspaceScoped(arg)) return false;
+  for (const p of BROAD_PATHS) {
+    if (arg === p) return true;
+    if (arg.startsWith(p + "/") || arg.startsWith(p + "\\")) return true;
+  }
+  if (/^\/Users\/[^/]+\/?$/.test(arg)) return true;
+  if (/^\/home\/[^/]+\/?$/.test(arg)) return true;
+  if (/^[A-Za-z]:\\Users\\[^\\]+\\?$/.test(arg)) return true;
+  return false;
+}
+function detectBroadFilesystemPath(ctx) {
+  const { server } = ctx;
+  const evidence = [];
+  for (const arg of server.args) {
+    if (looksLikeBroadPath(arg)) {
+      evidence.push({
+        type: "config",
+        path: server.sourceConfigPath,
+        key: "args",
+        value: arg
+      });
+    }
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "files.broad-path",
+      title: "Broad local filesystem access",
+      severity: "critical",
+      blocker: true,
+      symbol: "FILES",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "arg-analysis",
+      evidence,
+      impact: "An agent-triggered tool could read private local files outside the project.",
+      fix: "Restrict filesystem access to the current workspace, e.g. ${workspaceFolder}.",
+      falsePositiveNote: "A developer may intentionally grant broad access for a local-only experiment."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/secretEnvKeys.ts
+var SECRET_HINTS = [
+  "TOKEN",
+  "SECRET",
+  "PASSWORD",
+  "PASSWD",
+  "API_KEY",
+  "APIKEY",
+  "ACCESS_KEY",
+  "PRIVATE_KEY",
+  "CREDENTIAL",
+  "AUTH",
+  "SESSION"
+];
+function looksSecret(key) {
+  const upper = key.toUpperCase();
+  return SECRET_HINTS.some((h) => upper.includes(h));
+}
+function detectSecretEnvKeys(ctx) {
+  const { server } = ctx;
+  const evidence = [];
+  for (const key of server.envKeys) {
+    if (looksSecret(key)) {
+      evidence.push({
+        type: "config",
+        path: server.sourceConfigPath,
+        key: "env",
+        // Report the key name, never the value.
+        value: key
+      });
+    }
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "secrets.env-key",
+      title: "Server is configured with credentials",
+      severity: "medium",
+      blocker: false,
+      symbol: "SECRETS",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "env-analysis",
+      evidence,
+      impact: "The server receives credentials. If the agent invokes it autonomously, those credentials act on the agent's behalf.",
+      fix: "Confirm the credential scope is minimal and that autonomous use is intended; prefer least-privilege tokens.",
+      falsePositiveNote: "Most API-backed servers legitimately require a token; this flags the data-sensitivity surface, not a vulnerability."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/dangerousCommand.ts
+var INLINE_EXEC_FLAGS = /* @__PURE__ */ new Set(["-c", "-e", "--eval", "--command"]);
+function detectDangerousCommand(ctx) {
+  const { server } = ctx;
+  const command = server.command;
+  if (!command) return [];
+  const cmd = command.toLowerCase();
+  const evidence = [];
+  let reason;
+  if (SHELL_COMMANDS.has(cmd)) {
+    reason = `Server command is a shell (${command}).`;
+    evidence.push({
+      type: "config",
+      path: server.sourceConfigPath,
+      key: "command",
+      value: command
+    });
+  }
+  const inlineFlag = server.args.find((a) => INLINE_EXEC_FLAGS.has(a));
+  if (inlineFlag) {
+    reason = reason ?? `Server runs an inline command via ${inlineFlag}.`;
+    evidence.push({
+      type: "config",
+      path: server.sourceConfigPath,
+      key: "args",
+      value: inlineFlag
+    });
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "exec.dangerous-command",
+      title: "Arbitrary command execution",
+      severity: "critical",
+      blocker: true,
+      symbol: "EXEC",
+      riskClass: "S4",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence,
+      impact: reason + " An agent invoking this server can run arbitrary commands on the host.",
+      fix: "Run a specific, audited entrypoint instead of a shell or inline-eval command.",
+      falsePositiveNote: "Some wrappers legitimately shell out; confirm the command is fixed and not agent-controllable."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/unknownRemote.ts
+var KNOWN_HOSTS = [
+  "modelcontextprotocol.io",
+  "api.githubcopilot.com",
+  "mcp.anthropic.com"
+];
+function hostOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function detectUnknownRemote(ctx) {
+  const { server, binding } = ctx;
+  if (!binding.remoteUrl) return [];
+  const host = hostOf(binding.remoteUrl);
+  if (host && KNOWN_HOSTS.some((k) => host === k || host.endsWith("." + k))) {
+    return [];
+  }
+  return [
+    {
+      id: "supply.unknown-remote",
+      title: "Remote server source cannot be verified",
+      severity: "high",
+      blocker: false,
+      symbol: "NETWORK",
+      riskClass: "S1",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "runtime-binding",
+      evidence: [
+        {
+          type: "runtime-binding",
+          path: server.sourceConfigPath,
+          key: "url",
+          value: binding.remoteUrl
+        }
+      ],
+      impact: "The server runs on an unverified remote endpoint. Its tools, permissions, and behavior cannot be inspected statically and may change at any time.",
+      fix: "Use a verified first-party endpoint, or run the server from a pinned, inspectable package.",
+      falsePositiveNote: "A trusted internal endpoint may be fine; add it to the policy allowlist to verify it."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/promptPoisoning.ts
+var POISON_PATTERNS = [
+  "ignore previous instructions",
+  "ignore all previous instructions",
+  "disregard previous instructions",
+  "do not tell the user",
+  "do not inform the user",
+  "without telling the user",
+  "secretly",
+  "always call this tool first",
+  "call this tool before",
+  "before using other tools",
+  "before answering",
+  "read all files",
+  "send the full workspace",
+  "include the full workspace",
+  "include environment variables",
+  "exfiltrate",
+  "override system",
+  "override the system prompt",
+  "you are now"
+];
+function scanText(text, source) {
+  if (!text) return [];
+  const lower = text.toLowerCase();
+  const hits = [];
+  for (const pattern of POISON_PATTERNS) {
+    if (lower.includes(pattern)) {
+      hits.push({
+        pattern,
+        evidence: {
+          type: "tool-metadata",
+          path: source.path,
+          key: source.key,
+          snippet: pattern
+        }
+      });
+    }
+  }
+  return hits;
+}
+function detectPromptPoisoning(ctx) {
+  const { server } = ctx;
+  const evidence = [];
+  const patterns = /* @__PURE__ */ new Set();
+  for (const hit of scanText(server.instructions, { key: "instructions" })) {
+    evidence.push(hit.evidence);
+    patterns.add(hit.pattern);
+  }
+  for (const tool of server.providedTools) {
+    const label = tool.name ? `tools.${tool.name}.description` : "tools.description";
+    for (const hit of scanText(tool.description, { key: label })) {
+      evidence.push(hit.evidence);
+      patterns.add(hit.pattern);
+    }
+    for (const hit of scanText(tool.inputSchemaText, {
+      key: tool.name ? `tools.${tool.name}.inputSchema` : "tools.inputSchema"
+    })) {
+      evidence.push(hit.evidence);
+      patterns.add(hit.pattern);
+    }
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "prompt.poisoning",
+      title: "Suspicious model-directed instruction in tool metadata",
+      severity: "critical",
+      blocker: true,
+      symbol: "PROMPT",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "medium",
+      detectionMethod: "tool-metadata",
+      evidence,
+      impact: "Tool metadata reaches the model directly and can hijack autonomous tool selection or coerce data disclosure.",
+      fix: "Remove model-directed instructions from tool names, descriptions, schemas, and server instructions.",
+      falsePositiveNote: "Phrases may appear innocently in documentation; review the surrounding metadata in context."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/externalMutation.ts
+var MUTATION_HINTS = [
+  "github",
+  "gitlab",
+  "slack",
+  "email",
+  "mail",
+  "calendar",
+  "jira",
+  "linear",
+  "notion",
+  "stripe",
+  "twilio",
+  "sendgrid"
+];
+function collectHints(text) {
+  if (!text) return [];
+  const lower = text.toLowerCase();
+  return MUTATION_HINTS.filter((h) => lower.includes(h));
+}
+function detectExternalMutation(ctx) {
+  const { server, binding } = ctx;
+  const hints = /* @__PURE__ */ new Set();
+  const evidence = [];
+  for (const h of collectHints(binding.packageName)) {
+    hints.add(h);
+    evidence.push({
+      type: "runtime-binding",
+      key: "package",
+      value: binding.packageName
+    });
+  }
+  for (const tool of server.providedTools) {
+    for (const h of collectHints(tool.name)) {
+      hints.add(h);
+      evidence.push({ type: "tool-metadata", key: "tool", value: tool.name });
+    }
+  }
+  if (hints.size === 0) return [];
+  return [
+    {
+      id: "action.external-mutation",
+      title: "May perform external side effects",
+      severity: "medium",
+      blocker: false,
+      symbol: "ACTION",
+      riskClass: "S3",
+      mode: "INFERRED",
+      confidence: "low",
+      detectionMethod: "package-metadata",
+      evidence,
+      impact: "The server appears to integrate with an external system and may take actions (e.g. open PRs, send messages) on the agent's behalf.",
+      fix: "Confirm which mutating tools are exposed and require manual approval for autonomous use.",
+      falsePositiveNote: "Name-based inference; a read-only integration would not actually mutate anything."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/financialAction.ts
+var FINANCIAL_HINTS = [
+  "stripe",
+  "paypal",
+  "braintree",
+  "adyen",
+  "payment",
+  "payments",
+  "payout",
+  "payouts",
+  "payroll",
+  "charge",
+  "invoice",
+  "invoicing",
+  "billing",
+  "refund",
+  "transfer",
+  "wire",
+  "ach",
+  "sepa",
+  "wallet",
+  "coinbase",
+  "treasury",
+  "bank",
+  "checkout"
+];
+var PAYMENT_ACTION_VERBS = [
+  "create_payment",
+  "create_charge",
+  "create payment",
+  "make_payment",
+  "make payment",
+  "send_payment",
+  "send money",
+  "send_money",
+  "transfer_funds",
+  "transfer funds",
+  "create_payout",
+  "create payout",
+  "create_transfer",
+  "charge_card",
+  "charge card",
+  "process_payment",
+  "process payment",
+  "issue_refund",
+  "purchase",
+  "buy_",
+  "place_order",
+  "place order",
+  "withdraw"
+];
+function collectHints2(text) {
+  if (!text) return [];
+  const lower = text.toLowerCase();
+  return FINANCIAL_HINTS.filter((h) => lower.includes(h));
+}
+function collectActionVerbs(text) {
+  if (!text) return [];
+  const lower = text.toLowerCase();
+  return PAYMENT_ACTION_VERBS.filter((v) => lower.includes(v));
+}
+function detectFinancialAction(ctx) {
+  const { server, binding } = ctx;
+  const findings = [];
+  const actionEvidence = [];
+  const verbs = /* @__PURE__ */ new Set();
+  for (const tool of server.providedTools) {
+    for (const v of collectActionVerbs(tool.name)) {
+      verbs.add(v);
+      actionEvidence.push({ type: "tool-metadata", key: "tool", value: tool.name });
+    }
+    for (const v of collectActionVerbs(tool.description)) {
+      verbs.add(v);
+      actionEvidence.push({
+        type: "tool-metadata",
+        key: tool.name ? `tools.${tool.name}.description` : "tools.description",
+        snippet: v
+      });
+    }
+  }
+  if (verbs.size > 0) {
+    const hasSecret = server.envKeys.some(
+      (k) => /TOKEN|SECRET|KEY|PASSWORD|CREDENTIAL|AUTH/i.test(k)
+    );
+    const networkCapable = Boolean(binding.remoteUrl) || binding.runtimeExecutable;
+    if (hasSecret) {
+      actionEvidence.push({ type: "config", key: "env", value: "credential present" });
+    }
+    if (hasSecret || networkCapable) {
+      findings.push({
+        id: "action.financial-observed",
+        title: "Exposes an observed money-moving action",
+        severity: "critical",
+        blocker: true,
+        symbol: "MONEY",
+        riskClass: "S5",
+        mode: "OBSERVED",
+        confidence: "high",
+        detectionMethod: "tool-metadata",
+        evidence: actionEvidence,
+        impact: "A provided tool explicitly performs a financial action (e.g. create a payment, transfer funds, issue a refund) and the server carries credentials or network access. An autonomous agent invoking it could move money irreversibly.",
+        fix: "Require explicit human approval for this tool, enforce a hard spending boundary, and never allow autonomous invocation.",
+        falsePositiveNote: "If the tool only reads payment data (not moves money), reclassify it; this fires on money-moving verbs in the model-visible metadata."
+      });
+      return findings;
+    }
+  }
+  const hints = /* @__PURE__ */ new Set();
+  const evidence = [];
+  for (const h of collectHints2(binding.packageName)) {
+    hints.add(h);
+    evidence.push({
+      type: "runtime-binding",
+      key: "package",
+      value: binding.packageName
+    });
+  }
+  for (const tool of server.providedTools) {
+    for (const h of collectHints2(tool.name)) {
+      hints.add(h);
+      evidence.push({ type: "tool-metadata", key: "tool", value: tool.name });
+    }
+  }
+  if (hints.size === 0) return findings;
+  findings.push({
+    id: "action.financial",
+    title: "May perform financial or irreversible actions",
+    severity: "high",
+    blocker: false,
+    symbol: "MONEY",
+    riskClass: "S5",
+    mode: "INFERRED",
+    confidence: "low",
+    detectionMethod: "package-metadata",
+    evidence,
+    impact: "The server appears to integrate with a payments or financial system and could move money or take irreversible actions on the agent's behalf.",
+    fix: "Confirm which financial tools are exposed, require manual approval, and never allow autonomous use without a hard spending boundary.",
+    falsePositiveNote: "Name-based inference; a read-only reporting integration would not actually move money."
+  });
+  return findings;
+}
+
+// ../../packages/static-analyzer/src/analyzeServerConfig.ts
+var DETECTORS = [
+  detectBroadFilesystemPath,
+  detectDangerousCommand,
+  detectPromptPoisoning,
+  detectSecretEnvKeys,
+  detectUnpinnedPackage,
+  detectUnknownRemote,
+  detectExternalMutation,
+  detectFinancialAction
+];
+function analyzeServerConfig(server) {
+  const binding = resolveRuntimeBinding(server);
+  const ctx = { server, binding };
+  const findings = [];
+  for (const detector of DETECTORS) {
+    findings.push(...detector(ctx));
+  }
+  return findings;
+}
+
+// ../../packages/risk-engine/src/computeRiskClass.ts
+function computeRiskClass(findings, binding) {
+  const classes = findings.map((f) => f.riskClass);
+  if (classes.length === 0) {
+    return binding.runtimeExecutable || binding.remoteUrl ? "S1" : "S0";
+  }
+  return highestRiskClass(classes);
+}
+
+// ../../packages/risk-engine/src/computeVerdict.ts
+function computeVerdict(findings, binding) {
+  if (findings.some((f) => f.blocker)) return "BLOCK";
+  const unverifiable = !binding.sourceKnown && (Boolean(binding.remoteUrl) || binding.runtimeExecutable);
+  if (unverifiable) return "UNKNOWN";
+  if (findings.some((f) => f.severity === "high" || f.severity === "critical")) {
+    return "REVIEW";
+  }
+  if (findings.length > 0) return "REVIEW";
+  return "SAFE";
+}
+function computeConfidence(findings) {
+  if (findings.length === 0) return "high";
+  const rank = { low: 0, medium: 1, high: 2 };
+  let worst = "high";
+  for (const f of findings) {
+    if (rank[f.confidence] < rank[worst]) worst = f.confidence;
+  }
+  return worst;
+}
+function computeRecommendedPolicy(verdict, findings) {
+  const hasExec = findings.some((f) => f.symbol === "EXEC" || f.symbol === "MONEY");
+  const hasFiles = findings.some((f) => f.symbol === "FILES");
+  if (verdict === "BLOCK") {
+    return {
+      autonomousUse: "deny",
+      manualApproval: "required",
+      sandbox: hasExec || hasFiles ? "required" : "recommended"
+    };
+  }
+  if (verdict === "UNKNOWN") {
+    return {
+      autonomousUse: "deny",
+      manualApproval: "required",
+      sandbox: "required"
+    };
+  }
+  if (verdict === "REVIEW") {
+    return {
+      autonomousUse: "warn",
+      manualApproval: "recommended",
+      sandbox: "recommended"
+    };
+  }
+  return {
+    autonomousUse: "allow",
+    manualApproval: "none",
+    sandbox: "none"
+  };
+}
+
+// ../../packages/risk-engine/src/computeReproducibility.ts
+function computeReproducibility(binding, _findings) {
+  const reasons = [];
+  if (binding.packageName && !binding.isVersionPinned) {
+    reasons.push("Package version is not pinned");
+  }
+  if (binding.remoteUrl && !binding.sourceKnown) {
+    reasons.push("Remote endpoint could not be verified");
+  }
+  if (binding.runtimeExecutable && !binding.sourceKnown && !binding.remoteUrl) {
+    reasons.push("Runtime source could not be identified");
+  }
+  let level;
+  if (reasons.length === 0) level = "HIGH";
+  else if (reasons.length === 1) level = "MEDIUM";
+  else level = "LOW";
+  return { level, reasons };
+}
+
+// ../../packages/risk-engine/src/assessServer.ts
+var SEVERITY_RANK = {
+  info: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+function uniqueSymbols(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const f of findings) {
+    if (!seen.has(f.symbol)) {
+      seen.add(f.symbol);
+      out.push(f.symbol);
+    }
+  }
+  return out;
+}
+function rankFindings(findings) {
+  return [...findings].sort((a, b) => {
+    if (a.blocker !== b.blocker) return a.blocker ? -1 : 1;
+    return SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity];
+  });
+}
+function assessServer(findings, binding) {
+  const verdict = computeVerdict(findings, binding);
+  const riskClass = computeRiskClass(findings, binding);
+  const symbols = uniqueSymbols(rankFindings(findings));
+  const confidence = computeConfidence(findings);
+  const reproducibility = computeReproducibility(binding, findings);
+  const policy = computeRecommendedPolicy(verdict, findings);
+  return {
+    verdict,
+    riskClass,
+    symbols,
+    confidence,
+    reproducibility,
+    policy,
+    observed: findings.filter((f) => f.mode === "OBSERVED"),
+    inferred: findings.filter((f) => f.mode === "INFERRED"),
+    topFindings: rankFindings(findings).slice(0, 3)
+  };
+}
+
+// ../../packages/fingerprint/src/hashJson.ts
+import { createHash } from "node:crypto";
+function sha256(input) {
+  return "sha256:" + createHash("sha256").update(input, "utf8").digest("hex");
+}
+function stableStringify(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+      out[key] = sortValue(value[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function hashJson(value) {
+  return sha256(stableStringify(value));
+}
+
+// ../../packages/fingerprint/src/computeFingerprints.ts
+function computeFingerprints(input) {
+  const { server, binding, symbols, findingIds } = input;
+  const targetSpec = {
+    command: binding.declaredCommand,
+    args: binding.declaredArgs,
+    envKeys: [...server.envKeys].sort(),
+    remoteUrl: binding.remoteUrl
+  };
+  const packageSpec = binding.packageName !== void 0 ? `${binding.packageName}@${binding.packageVersionSpec ?? ""}` : void 0;
+  const riskSurface = {
+    symbols: [...symbols].sort(),
+    findingIds: [...findingIds].sort()
+  };
+  const sourceText = server.instructions ?? (server.providedTools.length > 0 ? JSON.stringify(server.providedTools) : void 0);
+  const toolMetadata = server.providedTools.length > 0 ? server.providedTools : void 0;
+  const fp = {
+    configHash: hashJson(server.raw),
+    targetSpecHash: hashJson(targetSpec),
+    riskSurfaceHash: hashJson(riskSurface)
+  };
+  if (packageSpec !== void 0) fp.packageSpecHash = sha256(packageSpec);
+  if (sourceText !== void 0) fp.sourceHash = sha256(sourceText);
+  if (toolMetadata !== void 0) fp.toolMetadataHash = hashJson(toolMetadata);
+  return fp;
+}
+
+// ../../packages/core/src/summarize.ts
+function summarize(name, verdict, a, policyApplied) {
+  const symbolText = a.symbols.length > 0 ? a.symbols.map((s) => RISK_SYMBOL_LABEL[s]).join(", ") : "no risk surface observed";
+  const cls = `${a.riskClass} ${RISK_CLASS_LABEL[a.riskClass]}`;
+  switch (verdict) {
+    case "BLOCK":
+      return policyApplied ? `"${name}" would be blocked but was downgraded by policy. Risk: ${symbolText} (${cls}).` : `"${name}" is blocked. Risk: ${symbolText} (${cls}).`;
+    case "UNKNOWN":
+      return `"${name}" could not be verified (insufficient evidence). Risk: ${symbolText} (${cls}).`;
+    case "REVIEW":
+      return `"${name}" needs review. Risk: ${symbolText} (${cls}).`;
+    case "SAFE":
+      return `"${name}" has no blockers observed (${cls}).`;
+  }
+}
+
+// ../../packages/core/src/scanServer.ts
+function scanServer(input, opts) {
+  const { policy, now, generatedAt, extraFindings } = resolveScanOptions(opts);
+  const { server } = input;
+  const binding = resolveRuntimeBinding(server);
+  const staticFindings = analyzeServerConfig(server);
+  const injected = extraFindings[server.name] ?? [];
+  const findings = [...staticFindings, ...injected];
+  const assessment = assessServer(findings, binding);
+  if (injected.length > 0) {
+    const offlineVerdict = assessServer(staticFindings, binding).verdict;
+    if (VERDICT_SEVERITY[assessment.verdict] < VERDICT_SEVERITY[offlineVerdict]) {
+      throw new Error(
+        `Online enrichment downgraded verdict for "${server.name}" (${offlineVerdict} -> ${assessment.verdict}); enrichment must never lower risk.`
+      );
+    }
+  }
+  const decision = applyPolicy(
+    assessment.verdict,
+    server.name,
+    findings,
+    policy,
+    now
+  );
+  const verdict = decision.verdict;
+  const fingerprints = computeFingerprints({
+    server,
+    binding,
+    symbols: assessment.symbols,
+    findingIds: findings.map((f) => f.id)
+  });
+  const diagnostics = [];
+  if (decision.changed && decision.note) {
+    diagnostics.push({ level: "info", code: "policy.applied", message: decision.note });
+  }
+  const target = {
+    name: server.name,
+    kind: input.targetKind ?? "cursor-mcp-config",
+    source: binding.packageName ?? binding.remoteUrl,
+    version: binding.packageVersionSpec,
+    configPath: server.sourceConfigPath
+  };
+  return {
+    schemaVersion: "calllint.report.v0",
+    reportKind: "single-target",
+    target,
+    verdict,
+    publicVerdictLabel: VERDICT_PUBLIC_LABEL[verdict],
+    policyApplied: decision.changed,
+    riskClass: assessment.riskClass,
+    symbols: assessment.symbols,
+    confidence: assessment.confidence,
+    reproducibility: assessment.reproducibility,
+    summary: summarize(server.name, verdict, assessment, decision.changed),
+    observed: assessment.observed,
+    inferred: assessment.inferred,
+    findings,
+    topFindings: assessment.topFindings,
+    policy: assessment.policy,
+    fingerprints,
+    diagnostics,
+    generatedAt
+  };
+}
+
+// ../../packages/config-parser/src/parseJsonFile.ts
+var ConfigParseError = class extends Error {
+  constructor(message, path) {
+    super(message);
+    this.path = path;
+    this.name = "ConfigParseError";
+  }
+  code = "config.parse-error";
+};
+function parseJsonText(text, path) {
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new ConfigParseError(`Invalid JSON: ${reason}`, path);
+  }
+}
+
+// ../../packages/config-parser/src/normalizeMcpServers.ts
+function isRecord2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function asString(v) {
+  return typeof v === "string" ? v : void 0;
+}
+function asStringArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter((x) => typeof x === "string");
+}
+function transportFor(server) {
+  if (asString(server.url)) {
+    const type = asString(server.type);
+    if (type === "sse") return "sse";
+    if (type === "http" || type === "streamable-http") return "http";
+    return "http";
+  }
+  if (asString(server.command)) return "stdio";
+  return "unknown";
+}
+function extractProvidedTools(server) {
+  const guard = server["x-calllint"];
+  if (!isRecord2(guard)) return [];
+  const tools = guard.tools;
+  if (!Array.isArray(tools)) return [];
+  const out = [];
+  for (const t of tools) {
+    if (!isRecord2(t)) continue;
+    out.push({
+      name: asString(t.name),
+      description: asString(t.description),
+      inputSchemaText: asString(t.inputSchemaText)
+    });
+  }
+  return out;
+}
+function extractInstructions(server) {
+  const guard = server["x-calllint"];
+  if (isRecord2(guard) && asString(guard.instructions)) {
+    return asString(guard.instructions);
+  }
+  return asString(server.instructions);
+}
+function findServerMap(root) {
+  if (!isRecord2(root)) return {};
+  if (isRecord2(root.mcpServers)) return root.mcpServers;
+  if (isRecord2(root.servers)) return root.servers;
+  const entries = Object.entries(root);
+  if (entries.length > 0 && entries.every(
+    ([, v]) => isRecord2(v) && ("command" in v || "url" in v)
+  )) {
+    return root;
+  }
+  return {};
+}
+function normalizeMcpServers(root, sourceConfigPath) {
+  const map = findServerMap(root);
+  const servers = [];
+  for (const [name, value] of Object.entries(map)) {
+    const server = isRecord2(value) ? value : {};
+    const envRaw = isRecord2(server.env) ? server.env : {};
+    const env = {};
+    for (const [k, v] of Object.entries(envRaw)) {
+      env[k] = typeof v === "string" ? v : String(v);
+    }
+    servers.push({
+      name,
+      sourceConfigPath,
+      transport: transportFor(server),
+      command: asString(server.command),
+      args: asStringArray(server.args),
+      envKeys: Object.keys(env),
+      env,
+      url: asString(server.url),
+      instructions: extractInstructions(server),
+      providedTools: extractProvidedTools(server),
+      raw: value
+    });
+  }
+  return servers;
+}
+
+// ../../packages/config-parser/src/parseConfig.ts
+import { basename } from "node:path";
+function kindForPath(path) {
+  const base = basename(path).toLowerCase();
+  if (base.includes("settings")) return "claude-settings";
+  if (base === "mcp.json" || path.includes(".cursor")) return "cursor-mcp-config";
+  return "cursor-mcp-config";
+}
+function parseConfigText(text, configPath = "<inline>") {
+  const root = parseJsonText(text, configPath);
+  return {
+    configPath,
+    kind: configPath === "<inline>" ? "inline" : kindForPath(configPath),
+    servers: normalizeMcpServers(root, configPath),
+    root
+  };
+}
+
+// ../../packages/core/src/scanConfig.ts
+function aggregate(configPath, reports, generatedAt) {
+  const counts = { SAFE: 0, REVIEW: 0, BLOCK: 0, UNKNOWN: 0 };
+  for (const r of reports) counts[r.verdict]++;
+  const verdict = mostSevereVerdict(reports.map((r) => r.verdict));
+  return {
+    schemaVersion: "calllint.report.v0",
+    reportKind: "config-summary",
+    configPath,
+    verdict,
+    publicVerdictLabel: VERDICT_PUBLIC_LABEL[verdict],
+    counts,
+    reports,
+    diagnostics: [],
+    generatedAt
+  };
+}
+function scanParsed(parsed, opts) {
+  const { generatedAt } = resolveScanOptions(opts);
+  const reports = parsed.servers.map(
+    (server) => scanServer({ server, targetKind: parsed.kind }, opts)
+  );
+  return aggregate(parsed.configPath, reports, generatedAt);
+}
+function scanConfigText(text, configPath, opts) {
+  return scanParsed(parseConfigText(text, configPath), opts);
+}
+
+// ../../packages/core/src/drift.ts
+function entryFromReport(report) {
+  return {
+    server: report.target.name,
+    verdict: report.verdict,
+    symbols: [...report.symbols],
+    findingIds: report.findings.map((f) => f.id).sort(),
+    fingerprints: report.fingerprints
+  };
+}
+function buildBaseline(summary, createdAt) {
+  return {
+    schemaVersion: "calllint.baseline.v0",
+    configPath: summary.configPath,
+    entries: summary.reports.map(entryFromReport),
+    createdAt
+  };
+}
+function sameStringSet(a, b) {
+  if (a.length !== b.length) return false;
+  const sortedA = [...a].sort();
+  const sortedB = [...b].sort();
+  return sortedA.every((v, i) => v === sortedB[i]);
+}
+function diffEntry(base, cur) {
+  const reasons = [];
+  let rugPull = false;
+  const fpBase = base.fingerprints;
+  const fpCur = cur.fingerprints;
+  if (fpBase.packageSpecHash !== fpCur.packageSpecHash) {
+    reasons.push("package spec changed (rug-pull signal)");
+    rugPull = true;
+  }
+  if (fpBase.sourceHash !== fpCur.sourceHash) {
+    reasons.push("source text changed");
+    rugPull = true;
+  }
+  if (fpBase.toolMetadataHash !== fpCur.toolMetadataHash) {
+    reasons.push("tool metadata changed");
+    rugPull = true;
+  }
+  if (fpBase.riskSurfaceHash !== fpCur.riskSurfaceHash) {
+    reasons.push("risk surface changed");
+  }
+  if (fpBase.configHash !== fpCur.configHash) {
+    reasons.push("config changed");
+  }
+  if (base.verdict !== cur.verdict) {
+    reasons.push(`verdict ${base.verdict} -> ${cur.verdict}`);
+  }
+  if (!sameStringSet(base.findingIds, cur.findingIds)) {
+    reasons.push("finding set changed");
+  }
+  let status = "unchanged";
+  if (rugPull) status = "package-changed";
+  else if (base.verdict !== cur.verdict) status = "verdict-changed";
+  else if (fpBase.riskSurfaceHash !== fpCur.riskSurfaceHash) status = "risk-surface-changed";
+  else if (fpBase.configHash !== fpCur.configHash) status = "config-changed";
+  return {
+    server: base.server,
+    status,
+    reasons,
+    baselineVerdict: base.verdict,
+    currentVerdict: cur.verdict,
+    rugPull
+  };
+}
+function computeDrift(baseline, summary, generatedAt) {
+  const current = /* @__PURE__ */ new Map();
+  for (const r of summary.reports) current.set(r.target.name, entryFromReport(r));
+  const baseByName = /* @__PURE__ */ new Map();
+  for (const e of baseline.entries) baseByName.set(e.server, e);
+  const entries = [];
+  for (const base of baseline.entries) {
+    const cur = current.get(base.server);
+    if (!cur) {
+      entries.push({
+        server: base.server,
+        status: "removed",
+        reasons: ["server removed from config"],
+        baselineVerdict: base.verdict,
+        rugPull: false
+      });
+      continue;
+    }
+    entries.push(diffEntry(base, cur));
+  }
+  for (const [name, cur] of current) {
+    if (!baseByName.has(name)) {
+      entries.push({
+        server: name,
+        status: "added",
+        reasons: ["new server not in baseline"],
+        currentVerdict: cur.verdict,
+        rugPull: false
+      });
+    }
+  }
+  const drifted = entries.some((e) => e.status !== "unchanged");
+  const rugPullDetected = entries.some((e) => e.rugPull);
+  return {
+    schemaVersion: "calllint.drift.v0",
+    configPath: summary.configPath,
+    drifted,
+    rugPullDetected,
+    entries,
+    generatedAt
+  };
+}
+
+// ../../packages/core/src/targets.ts
+function parseTargetSpec(arg) {
+  if (arg.startsWith("npm:")) {
+    return { kind: "npm", raw: arg, packageSpec: arg.slice("npm:".length) };
+  }
+  if (arg.startsWith("github:")) {
+    const rest = arg.slice("github:".length);
+    const at = rest.lastIndexOf("@");
+    const slash = rest.indexOf("/");
+    if (at > slash && at !== -1) {
+      return { kind: "github", raw: arg, repo: rest.slice(0, at), ref: rest.slice(at + 1) };
+    }
+    return { kind: "github", raw: arg, repo: rest };
+  }
+  return { kind: "path", raw: arg };
+}
+function serverNameForPackage(packageSpec) {
+  const noVersion = packageSpec.startsWith("@") ? packageSpec.replace(/(@[^/]+\/[^@]+)@.*/, "$1") : packageSpec.split("@")[0];
+  return noVersion.replace(/^@/, "").replace(/\//g, "-");
+}
+function synthesizeNpmConfig(packageSpec) {
+  const name = serverNameForPackage(packageSpec);
+  const config = {
+    mcpServers: {
+      [name]: {
+        command: "npx",
+        args: ["-y", packageSpec]
+      }
+    }
+  };
+  return { text: JSON.stringify(config), configPath: `npm:${packageSpec}` };
+}
+
+// ../../packages/core/src/cache.ts
+import { writeFileSync, readFileSync as readFileSync2, mkdirSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+function defaultCachePath(cwd = process.cwd()) {
+  return join(cwd, ".calllint", "last-scan.json");
+}
+function writeCache(report, path = defaultCachePath()) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(report, null, 2), "utf8");
+}
+function readCache(path = defaultCachePath()) {
+  if (!existsSync(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function defaultBaselinePath(cwd = process.cwd()) {
+  return join(cwd, ".calllint", "baseline.json");
+}
+function writeBaseline(baseline, path = defaultBaselinePath()) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(baseline, null, 2), "utf8");
+}
+function readBaseline(path = defaultBaselinePath()) {
+  if (!existsSync(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/report-renderer/src/style.ts
+var DEFAULT_STYLE = { emoji: true };
+var NO_EMOJI_STYLE = { emoji: false };
+function verdictTag(verdict, style) {
+  return style.emoji ? VERDICT_CLI_SYMBOL[verdict] : VERDICT_TEXT_SYMBOL[verdict];
+}
+function symbolTag(symbol, style) {
+  return style.emoji ? `${RISK_SYMBOL_EMOJI[symbol]} ${symbol}` : symbol;
+}
+function symbolList(symbols, style) {
+  if (symbols.length === 0) return "\u2014";
+  return symbols.map((s) => symbolTag(s, style)).join("  ");
+}
+
+// ../../packages/report-renderer/src/renderJson.ts
+function renderJson(summary) {
+  return JSON.stringify(summary, null, 2);
+}
+
+// ../../packages/report-renderer/src/renderTerminal.ts
+function renderFindingLine(f) {
+  const lines = [];
+  const flag = f.blocker ? "[BLOCKER] " : "";
+  lines.push(`  \u2022 ${flag}${f.title}  (${f.id}, ${f.mode.toLowerCase()}, confidence ${f.confidence})`);
+  if (f.evidence.length > 0) {
+    const e = f.evidence[0];
+    const ev = e.value ?? e.snippet ?? e.key ?? e.path ?? "";
+    lines.push(`      evidence: ${e.key ?? e.type}${ev ? ` = ${ev}` : ""}`);
+  }
+  lines.push(`      impact: ${f.impact}`);
+  lines.push(`      fix: ${f.fix}`);
+  return lines;
+}
+function renderServer(r, style) {
+  const lines = [];
+  lines.push("");
+  lines.push(`${verdictTag(r.verdict, style)}  ${r.target.name}    ${symbolList(r.symbols, style)}`);
+  lines.push(`  ${r.riskClass} ${RISK_CLASS_LABEL[r.riskClass]} \xB7 reproducibility ${r.reproducibility.level} \xB7 confidence ${r.confidence}`);
+  lines.push(`  ${r.summary}`);
+  if (r.policyApplied) {
+    const note = r.diagnostics.find((d) => d.code === "policy.applied");
+    if (note) lines.push(`  \u2691 ${note.message}`);
+  }
+  const top = r.topFindings;
+  if (top.length > 0) {
+    lines.push("");
+    for (const f of top) lines.push(...renderFindingLine(f));
+  }
+  if (r.reproducibility.reasons.length > 0) {
+    lines.push("");
+    lines.push(`  reproducibility notes: ${r.reproducibility.reasons.join("; ")}`);
+  }
+  lines.push("");
+  lines.push(`  autonomous use: ${r.policy.autonomousUse} \xB7 manual approval: ${r.policy.manualApproval} \xB7 sandbox: ${r.policy.sandbox}`);
+  return lines;
+}
+function renderTerminal(summary, style = DEFAULT_STYLE) {
+  const lines = [];
+  lines.push("CallLint scan");
+  lines.push(`config: ${summary.configPath}`);
+  lines.push(
+    `result: ${verdictTag(summary.verdict, style)}   (BLOCK ${summary.counts.BLOCK} \xB7 UNKNOWN ${summary.counts.UNKNOWN} \xB7 REVIEW ${summary.counts.REVIEW} \xB7 SAFE ${summary.counts.SAFE})`
+  );
+  lines.push("\u2500".repeat(60));
+  for (const r of summary.reports) lines.push(...renderServer(r, style));
+  return lines.join("\n");
+}
+
+// ../../packages/report-renderer/src/renderCompact.ts
+function renderCompact(summary, style = DEFAULT_STYLE) {
+  const lines = [];
+  for (const r of summary.reports) {
+    lines.push(
+      `${verdictTag(r.verdict, style)}	${r.target.name}	${symbolList(r.symbols, style)}	${r.riskClass}`
+    );
+  }
+  lines.push(
+    `${verdictTag(summary.verdict, style)}	TOTAL	BLOCK ${summary.counts.BLOCK} \xB7 UNKNOWN ${summary.counts.UNKNOWN} \xB7 REVIEW ${summary.counts.REVIEW} \xB7 SAFE ${summary.counts.SAFE}`
+  );
+  return lines.join("\n");
+}
+
+// ../../packages/report-renderer/src/renderExplain.ts
+function renderFindingDetail(f, n) {
+  const lines = [];
+  lines.push(`${n}. ${f.title}  ${f.blocker ? "[BLOCKER]" : ""}`);
+  lines.push(`   id:         ${f.id}`);
+  lines.push(`   symbol:     ${RISK_SYMBOL_LABEL[f.symbol]} (${f.symbol})`);
+  lines.push(`   class:      ${f.riskClass} ${RISK_CLASS_LABEL[f.riskClass]}`);
+  lines.push(`   severity:   ${f.severity}`);
+  lines.push(`   mode:       ${f.mode}   confidence: ${f.confidence}`);
+  lines.push(`   method:     ${f.detectionMethod}`);
+  if (f.evidence.length > 0) {
+    lines.push(`   evidence:`);
+    for (const e of f.evidence) {
+      const loc = [e.path, e.line ? `:${e.line}` : ""].filter(Boolean).join("");
+      const detail = e.value ?? e.snippet ?? "";
+      lines.push(`     - [${e.type}] ${e.key ?? ""}${detail ? ` = ${detail}` : ""}${loc ? `  (${loc})` : ""}`);
+    }
+  }
+  lines.push(`   impact:     ${f.impact}`);
+  lines.push(`   fix:        ${f.fix}`);
+  if (f.falsePositiveNote) lines.push(`   note:       ${f.falsePositiveNote}`);
+  return lines;
+}
+function renderExplain(r, style = DEFAULT_STYLE) {
+  const lines = [];
+  lines.push(`${verdictTag(r.verdict, style)}  ${r.target.name}`);
+  lines.push(`label:   ${r.publicVerdictLabel}`);
+  lines.push(`source:  ${r.target.source ?? "\u2014"}${r.target.version ? `@${r.target.version}` : ""}`);
+  lines.push(`class:   ${r.riskClass} ${RISK_CLASS_LABEL[r.riskClass]}`);
+  lines.push(`symbols: ${r.symbols.length ? r.symbols.map((s) => RISK_SYMBOL_LABEL[s]).join(", ") : "none"}`);
+  lines.push(`repro:   ${r.reproducibility.level}${r.reproducibility.reasons.length ? ` (${r.reproducibility.reasons.join("; ")})` : ""}`);
+  lines.push("");
+  lines.push(r.summary);
+  if (r.findings.length > 0) {
+    lines.push("");
+    lines.push("Findings");
+    lines.push("\u2500".repeat(60));
+    r.findings.forEach((f, i) => {
+      lines.push(...renderFindingDetail(f, i + 1));
+      lines.push("");
+    });
+  } else {
+    lines.push("");
+    lines.push("No findings.");
+  }
+  lines.push("Recommended policy");
+  lines.push("\u2500".repeat(60));
+  lines.push(`autonomous use:  ${r.policy.autonomousUse}`);
+  lines.push(`manual approval: ${r.policy.manualApproval}`);
+  lines.push(`sandbox:         ${r.policy.sandbox}`);
+  lines.push("");
+  lines.push("Fingerprints");
+  lines.push("\u2500".repeat(60));
+  lines.push(`config:      ${r.fingerprints.configHash}`);
+  lines.push(`target spec: ${r.fingerprints.targetSpecHash}`);
+  lines.push(`risk surface:${r.fingerprints.riskSurfaceHash}`);
+  if (r.fingerprints.packageSpecHash) lines.push(`package:     ${r.fingerprints.packageSpecHash}`);
+  return lines.join("\n");
+}
+
+// ../../packages/report-renderer/src/renderDrift.ts
+function renderDriftJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+var STATUS_TAG = {
+  unchanged: "OK   ",
+  "config-changed": "CFG  ",
+  "risk-surface-changed": "RISK ",
+  "verdict-changed": "VRDCT",
+  "package-changed": "RUG! ",
+  added: "ADD  ",
+  removed: "DEL  "
+};
+function renderDrift(report) {
+  const lines = [];
+  lines.push("CallLint verify (drift vs baseline)");
+  lines.push(`config: ${report.configPath}`);
+  const headline = report.rugPullDetected ? "RUG-PULL SIGNAL \u2014 package/source changed since baseline" : report.drifted ? "DRIFT \u2014 risk surface changed since baseline" : "no drift \u2014 matches baseline";
+  lines.push(`result: ${headline}`);
+  lines.push("\u2500".repeat(60));
+  for (const e of report.entries) {
+    const tag = STATUS_TAG[e.status] ?? e.status;
+    lines.push(`${tag}  ${e.server}`);
+    for (const reason of e.reasons) {
+      lines.push(`        \u2022 ${reason}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// ../../packages/report-renderer/src/renderSarif.ts
+function levelForSeverity(sev) {
+  if (sev === "critical" || sev === "high") return "error";
+  if (sev === "medium") return "warning";
+  return "note";
+}
+function toUri(path) {
+  if (path === "<stdin>" || path === "<inline>") return path;
+  return path.replace(/\\/g, "/");
+}
+function ruleFromFinding(f) {
+  return {
+    id: f.id,
+    name: f.title,
+    shortDescription: { text: f.title },
+    fullDescription: { text: f.impact },
+    defaultConfiguration: { level: levelForSeverity(f.severity) },
+    properties: {
+      symbol: f.symbol,
+      riskClass: f.riskClass,
+      tags: ["calllint", f.symbol.toLowerCase(), f.riskClass.toLowerCase()]
+    }
+  };
+}
+function resultFromFinding(f, report, configUri) {
+  const ev = f.evidence[0];
+  const region = ev?.line ? { startLine: ev.line } : void 0;
+  const messageParts = [f.impact];
+  if (f.fix) messageParts.push(`Fix: ${f.fix}`);
+  if (f.falsePositiveNote) messageParts.push(`Note: ${f.falsePositiveNote}`);
+  return {
+    ruleId: f.id,
+    level: levelForSeverity(f.severity),
+    message: { text: messageParts.join(" ") },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: ev?.path ? toUri(ev.path) : configUri },
+          ...region ? { region } : {}
+        },
+        logicalLocations: [{ name: report.target.name, kind: "namespace" }]
+      }
+    ],
+    partialFingerprints: {
+      configHash: report.fingerprints.configHash,
+      riskSurfaceHash: report.fingerprints.riskSurfaceHash
+    },
+    properties: {
+      server: report.target.name,
+      verdict: report.verdict,
+      symbol: f.symbol,
+      riskClass: f.riskClass,
+      mode: f.mode,
+      confidence: f.confidence,
+      blocker: f.blocker
+    }
+  };
+}
+function renderSarif(summary) {
+  const configUri = toUri(summary.configPath);
+  const rules = /* @__PURE__ */ new Map();
+  const results = [];
+  for (const report of summary.reports) {
+    for (const f of report.findings) {
+      if (!rules.has(f.id)) rules.set(f.id, ruleFromFinding(f));
+      results.push(resultFromFinding(f, report, configUri));
+    }
+  }
+  const sarif = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "CallLint",
+            informationUri: "https://calllint.com",
+            rules: [...rules.values()]
+          }
+        },
+        results,
+        properties: {
+          aggregateVerdict: summary.verdict,
+          counts: summary.counts,
+          generatedAt: summary.generatedAt
+        }
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+
+// ../../packages/report-renderer/src/logoBase64.ts
+var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAADAFBMVEX+/v7+/v3VAADbChn+///9/f39+/v////+/f3+/Pz9/PzYAAraChn+/f7++/zWAADXAAfbDRzXAAraCxn9+vvbDBv9+vrZARHaDh3YAA7aCxvaDRz87O7bDhzZAQ/fKDXZBhTXAA3bEB/XAAX99vfcGCbaAxLaBhXYAAj9+fnnXmfZBQ/aCRb9/f7bChnZBBTaDRrfJTHZAA387u7eIC763+DcFiL519r41tjYAA3wnKLxqK3YAAvWAAbiPUjcEyD9+Pn76evZAxDZBRP3ys3pcXnnY2zkS1b//v776+zcGSbiO0biRE/ulJvqcnvXAALjQk39/v7tipHZCRj++vvaCRj+/P3qdn7pbXXcFCL75+noanPUAADkUlzxpqzoZ3D76Or409bYAAz2xsn53d/++vr3yczyrbH41NfnYmzfKjb52NrlVWD++PjmYGjWAAPyqq/dIy/86uzsgIfZCBbWAALaDhnkTVjiPUnyr7P89PXiQEzYAAPkRlL2xMjlU17hOUX1wcX2x8rtjJLjSVTpb3jcDh3lTFfgMT30trvsgorlUVzqe4Ppa3P0ub3siZDtjpTZAArth43ztLjre4P64eT75ebdJDHaExvvkZjeJDD98vPdHyz++frreIDtjJPvmaD5293qd3/vmqDnY23fMz/rfYbnYGraFiLmX2jdGyfaFh/gLTnkUVvnZW740dPhPUjpbnbumJ7reYL87u/hOUTiSVLlVmHbEB753N/fLzzcER/eLDbiQEr64OL88PH52dvnaHHXAAnbCRn0vcHzsrb+//7zsbbjUFfwpKnjTFLrdn71ur7lW2X++fr89fbqdH398/PztbndHivzrbP0trzuipHwnqT3ztH75ujwo6jgNUHyqq/52tzwoabtjpX2zND//f7vkpjqfYTeMz3vlZv1vMDdJjTdJzPnXWjzsrfdIi3tjJXzsrnqdHzhOEL1vMHkVWDZEB7ulZvVAALnbXXaFiTdGCbtkpnWAQr99fXZDBbshIv1wcblWGPhP0ryJPiiAAAACXBIWXMAAAsSAAALEgHS3X78AAAEpUlEQVRIx41WB1QUVxSdnf0798/u4hbqsouURYrAAQkR6bjUpYurBBQFg6DYIFgCBhRL7L1jj6iADdTYY0mvJ72YnPQeU000MYkxw4ZDwB0W35wz55+ZV+79/857wzA9TcaEdK8YRsLYsRHC1W0hzAgZZbqDRcw2lyXRTnZq84TDR3tgkTH9WLcDT05u2fEQ4Xs/p31X5HBFrZ4Mjt5Teoa64I8ZmXd+2w0nagd2dxDPIfpWwuWzLbHHwcnvzmbjT10csPbWX7cvljXM1q4B40QldjfVSQ5D86xDjdPOXfizoWXWt2bwTg72mIB+56laenl7u6sp89Le/ew3tRR9HoGMEt+KemNQjiXy8MCZwa6Vw+hjQXFZFa8SKutypN3grazkOBvsPa8U+6576drzooLdjmPSae+wYeBtklvXlJK6r88hea7WpPAs21SpMGnby8n+al8iE6fBJZISn0xfT6PGM6WIkJLXKvXGLYHtCZtJIifOOB3L2Y3m82ED18Mil3NYo3MvvPq5qgbp6XdroRMSX5U91dhm+HKds1dCKXieRBZ6eaz77GSb8ZfscYTa6IFhnshNqr8YmRGqdFM8gAEcFj+pcfQfNOX+eq8ZP4G3lTjJcjtGGiNM7k9JQyMMhBiaQh1HOSdVNyK58GHRgLk+6TlqL41SKpX6LQOednUUVhovdUpixuM2ATJrQOCcCR6mkXqlR0A+kB+ll2pG6dyi0uoGzRevcJ47bYxfaQr393BdBYyJOuM/wXTiTu483wzxgDwf7h/Verw8p9BP9SLB82OTbqatxt/sPN/OChImRCahXTslk1hJn+GO/G4mDMqeWTuOkJiFz5XhUzI8I833Zry1gqSHvCmlmONYl1oLjnNhAEGiwu1ZF4sctdMvXT/VG5L13DgcDDd0HAXHAwPMBobcZ5YDcidcuVHi3WrLQeaCA4+UZrNfwbLgpUVbXiGYHLGoYMFE/Mz+OomtAdf7y5R0VhinimlQDb66IlRhiksjKJ5hig1dUdKqul3FxnQGSHoIXJAvjymxq8xuGUMCpGFuusFAqtZHo1Q0tfkYxnuX2kJiKHE5fG3nEkWwcNRh2gJgpVavlDoHK5YEVlfyRKTNcDiRWx4T+6hSKagvGnhB5y6oxENRlazaCLEPgscxReu0piRnqaC5ZGCY80ip1NlvyLTWCe+JIOoEhSPasugAvdLddWmg0L/jB7pLNQHRe72LIbf1ttJuCJjqEK/ThymWg3PCQoVGr8scPVX9oEiA5L+uMV71RmTYTP+hZeBHY3OGv9SxdAM7XhyQFVPRm0OHv69z3YZAygRin1/4u+aWHUXos4tzeFudhwNxg8vBy/FJs3oXyVKvhqV3O6b/y1BmQT6bisXszI+BbEd2DI6O3Q3OzqijctLBpuBHtbZimc7YgQL2RheBviYqpfx0Ngc1xmueubsE/+kWGe1nztGJzQKqPUGKbbjCHtzJ0P4mI09pzthTEzdUORSzKTzlmX6N8vg+7sKmki9mvYPRlLkHE4boD1u3Hpr9VtcY7T9IGKMfzv9gCuwPq17Tl8Pr2+3tvyh1eZ8vHWz+PCRdnUTM/gUe0BB8YRiSMgAAAABJRU5ErkJggg==";
+
+// ../../packages/report-renderer/src/renderHtml.ts
+function esc(value) {
+  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var VERDICT_COLOR = {
+  SAFE: "#1a7f37",
+  REVIEW: "#9a6700",
+  BLOCK: "#cf222e",
+  UNKNOWN: "#6e7781"
+};
+function badge(verdict) {
+  return `<span class="badge" style="background:${VERDICT_COLOR[verdict]}">${esc(verdict)}</span>`;
+}
+function findingRow(f) {
+  const ev = f.evidence.map((e) => {
+    const loc = e.path ? ` (${esc(e.path)}${e.line ? `:${e.line}` : ""})` : "";
+    const detail = e.value ?? e.snippet ?? "";
+    return `<li><code>${esc(e.type)}</code> ${esc(e.key ?? "")}${detail ? ` = ${esc(detail)}` : ""}${loc}</li>`;
+  }).join("");
+  return `
+    <tr class="sev-${esc(f.severity)}">
+      <td>${f.blocker ? "\u26D4 " : ""}${esc(f.title)}</td>
+      <td><code>${esc(f.id)}</code></td>
+      <td>${esc(RISK_SYMBOL_LABEL[f.symbol])} <small>(${esc(f.symbol)})</small></td>
+      <td>${esc(f.riskClass)}</td>
+      <td>${esc(f.severity)}</td>
+      <td>${esc(f.mode)}</td>
+      <td>
+        <div class="impact">${esc(f.impact)}</div>
+        <div class="fix"><strong>Fix:</strong> ${esc(f.fix)}</div>
+        ${f.evidence.length ? `<ul class="evidence">${ev}</ul>` : ""}
+        ${f.falsePositiveNote ? `<div class="fp"><em>${esc(f.falsePositiveNote)}</em></div>` : ""}
+      </td>
+    </tr>`;
+}
+function serverCard(r) {
+  const symbols = r.symbols.map((s) => `<span class="sym">${esc(RISK_SYMBOL_LABEL[s])}</span>`).join(" ");
+  const findings = r.findings.length ? `<table class="findings">
+        <thead><tr><th>Finding</th><th>Rule</th><th>Symbol</th><th>Class</th><th>Severity</th><th>Mode</th><th>Detail</th></tr></thead>
+        <tbody>${r.findings.map(findingRow).join("")}</tbody>
+      </table>` : `<p class="none">No findings.</p>`;
+  return `
+    <section class="server">
+      <h2>${badge(r.verdict)} ${esc(r.target.name)}</h2>
+      <p class="meta">
+        Class <strong>${esc(r.riskClass)}</strong> ${esc(RISK_CLASS_LABEL[r.riskClass])}
+        \xB7 confidence ${esc(r.confidence)}
+        \xB7 reproducibility ${esc(r.reproducibility.level)}
+      </p>
+      <p class="symbols">${symbols || '<span class="sym none">no risk symbols</span>'}</p>
+      <p class="summary">${esc(r.summary)}</p>
+      ${findings}
+      <p class="policy">autonomous use: <strong>${esc(r.policy.autonomousUse)}</strong>
+        \xB7 manual approval: <strong>${esc(r.policy.manualApproval)}</strong>
+        \xB7 sandbox: <strong>${esc(r.policy.sandbox)}</strong></p>
+    </section>`;
+}
+var LOGO_SRC = `data:image/png;base64,${LOGO_REPORT_BASE64}`;
+var STYLE = `
+  :root { font-family: -apple-system, Segoe UI, Roboto, sans-serif; --brand: #c41e3a; --brand-glow: rgba(196, 30, 58, 0.35); }
+  body { margin: 0; background: #f6f8fa; color: #1f2328; }
+  header { background: #24292f; color: #fff; padding: 24px 32px; }
+  .header-row { display: flex; align-items: center; gap: 14px; }
+  .brand-mark { width: 40px; height: 40px; flex: 0 0 auto; animation: mark-enter 0.6s cubic-bezier(0.22, 1, 0.36, 1) both, mark-glow 4s ease-in-out 0.6s infinite; }
+  header h1 { margin: 0 0 4px; font-size: 20px; }
+  header .sub { color: #b1b8c0; font-size: 13px; }
+  @keyframes mark-enter { from { opacity: 0; transform: scale(0.88); } to { opacity: 1; transform: scale(1); } }
+  @keyframes mark-glow { 0%, 100% { filter: drop-shadow(0 0 0 transparent); } 50% { filter: drop-shadow(0 0 8px var(--brand-glow)); } }
+  @media (prefers-reduced-motion: reduce) { .brand-mark { animation: none; } }
+  .counts { padding: 16px 32px; background: #fff; border-bottom: 1px solid #d0d7de; }
+  .counts span { margin-right: 16px; font-size: 14px; }
+  main { padding: 24px 32px; max-width: 1100px; }
+  .server { background: #fff; border: 1px solid #d0d7de; border-radius: 8px; padding: 20px 24px; margin-bottom: 20px; }
+  .server h2 { margin: 0 0 8px; font-size: 17px; }
+  .badge { color: #fff; padding: 2px 10px; border-radius: 12px; font-size: 12px; font-weight: 600; vertical-align: middle; }
+  .meta, .symbols, .summary, .policy { font-size: 13px; color: #57606a; margin: 6px 0; }
+  .sym { background: #eaeef2; border-radius: 4px; padding: 2px 8px; font-size: 12px; }
+  .sym.none { background: transparent; color: #8c959f; }
+  table.findings { width: 100%; border-collapse: collapse; margin: 12px 0; font-size: 13px; }
+  table.findings th, table.findings td { border: 1px solid #d0d7de; padding: 6px 8px; text-align: left; vertical-align: top; }
+  table.findings th { background: #f6f8fa; }
+  tr.sev-critical td:first-child, tr.sev-high td:first-child { border-left: 3px solid #cf222e; }
+  .evidence { margin: 6px 0; padding-left: 18px; }
+  .fix { color: #1a7f37; margin-top: 4px; }
+  .fp { color: #8c959f; margin-top: 4px; }
+  .none { color: #1a7f37; font-style: italic; }
+  code { background: #eff1f3; padding: 1px 4px; border-radius: 3px; font-size: 12px; }
+  footer { padding: 16px 32px; color: #8c959f; font-size: 12px; }
+`;
+function renderHtml(summary) {
+  const c = summary.counts;
+  const cards = summary.reports.map(serverCard).join("");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>CallLint report \u2014 ${esc(summary.configPath)}</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<header>
+  <div class="header-row">
+    <img class="brand-mark" src="${LOGO_SRC}" width="40" height="40" alt="CallLint">
+    <div>
+      <h1>CallLint report ${badge(summary.verdict)}</h1>
+      <div class="sub">${esc(summary.configPath)} \xB7 generated ${esc(summary.generatedAt)}</div>
+    </div>
+  </div>
+</header>
+<div class="counts">
+  <span>\u26D4 BLOCK: <strong>${c.BLOCK}</strong></span>
+  <span>\u25C7 UNKNOWN: <strong>${c.UNKNOWN}</strong></span>
+  <span>\u26A0 REVIEW: <strong>${c.REVIEW}</strong></span>
+  <span>\u{1F6E1} SAFE: <strong>${c.SAFE}</strong></span>
+</div>
+<main>${cards}</main>
+<footer>CallLint \xB7 evidence-backed verdicts for agent tools \xB7 static analysis, no server executed</footer>
+</body>
+</html>`;
+}
+
+// src/exitCode.ts
+function exitCodeFor(summary, policy) {
+  const verdict = summary.verdict;
+  if (!shouldFailCi(verdict, policy)) return EXIT.OK;
+  switch (verdict) {
+    case "BLOCK":
+      return EXIT.BLOCK;
+    case "UNKNOWN":
+      return EXIT.UNKNOWN;
+    case "REVIEW":
+      return EXIT.REVIEW;
+    case "SAFE":
+      return EXIT.OK;
+  }
+}
+
+// src/commands/resolveInput.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { join as join2 } from "node:path";
+var DEFAULT_CONFIG_PATHS = [
+  ".cursor/mcp.json",
+  ".mcp.json",
+  "mcp.json",
+  ".claude/settings.json",
+  ".vscode/mcp.json"
+];
+function findDefaultConfig(cwd) {
+  for (const rel of DEFAULT_CONFIG_PATHS) {
+    const p = join2(cwd, rel);
+    if (existsSync2(p)) return p;
+  }
+  return void 0;
+}
+function isInputError(v) {
+  return "error" in v;
+}
+function resolveConfigInput(args, deps) {
+  if (flagBool(args.flags, "stdin")) {
+    return { text: deps.readStdin(), configPath: "<stdin>" };
+  }
+  const given = args.positionals[0];
+  if (given) {
+    const spec = parseTargetSpec(given);
+    if (spec.kind === "npm") {
+      if (!spec.packageSpec) {
+        return { error: "Empty npm target. Use npm:<package>[@version].", exitCode: EXIT.USAGE };
+      }
+      return synthesizeNpmConfig(spec.packageSpec);
+    }
+    if (spec.kind === "github") {
+      return {
+        error: "GitHub targets require network access. Re-run with --online to fetch repo MCP configs.",
+        exitCode: EXIT.USAGE
+      };
+    }
+  }
+  const resolved = given ?? findDefaultConfig(deps.cwd);
+  if (!resolved) {
+    return {
+      error: "No config given and none found. Pass a path or use --stdin.\nLooked in: " + DEFAULT_CONFIG_PATHS.join(", "),
+      exitCode: EXIT.USAGE
+    };
+  }
+  if (!existsSync2(resolved)) {
+    return { error: `File not found: ${resolved}`, exitCode: EXIT.USAGE };
+  }
+  return { text: readFileSync3(resolved, "utf8"), configPath: resolved };
+}
+
+// src/commands/scan.ts
+function scanCommand(args, deps) {
+  const policyPath = flagStr(args.flags, "policy");
+  let policy;
+  try {
+    policy = loadPolicyOrDefault(policyPath);
+  } catch (err) {
+    return {
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err),
+      exitCode: EXIT.ERROR
+    };
+  }
+  const input = deps.online?.inputOverride ?? resolveConfigInput(args, deps);
+  if (isInputError(input)) {
+    return { stdout: "", stderr: input.error, exitCode: input.exitCode };
+  }
+  const { text, configPath } = input;
+  let summary;
+  try {
+    summary = scanConfigText(text, configPath, {
+      policy,
+      now: deps.now,
+      generatedAt: deps.generatedAt,
+      extraFindings: deps.online?.extraFindings
+    });
+  } catch (err) {
+    if (err instanceof ConfigParseError) {
+      return {
+        stdout: "",
+        stderr: `Parse error in ${configPath}: ${err.message}`,
+        exitCode: EXIT.ERROR
+      };
+    }
+    throw err;
+  }
+  if (deps.writeCacheFile !== false) {
+    try {
+      writeCache(summary, join3(deps.cwd, ".calllint", "last-scan.json"));
+    } catch {
+    }
+  }
+  const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
+  let stdout;
+  if (flagBool(args.flags, "json")) stdout = renderJson(summary);
+  else if (flagBool(args.flags, "sarif")) stdout = renderSarif(summary);
+  else if (flagBool(args.flags, "html")) stdout = renderHtml(summary);
+  else if (flagBool(args.flags, "compact")) stdout = renderCompact(summary, style);
+  else stdout = renderTerminal(summary, style);
+  const exitCode = flagBool(args.flags, "ci") ? exitCodeFor(summary, policy) : EXIT.OK;
+  return { stdout, exitCode };
+}
+
+// src/commands/explain.ts
+import { join as join4 } from "node:path";
+function explainCommand(args, deps) {
+  const serverName = args.positionals[0];
+  if (!serverName) {
+    return {
+      stdout: "",
+      stderr: "Usage: calllint explain <server>",
+      exitCode: EXIT.USAGE
+    };
+  }
+  const summary = readCache(join4(deps.cwd, ".calllint", "last-scan.json"));
+  if (!summary) {
+    return {
+      stdout: "",
+      stderr: "No cached scan found. Run `calllint scan` first.",
+      exitCode: EXIT.ERROR
+    };
+  }
+  const report = summary.reports.find((r) => r.target.name === serverName);
+  if (!report) {
+    const names = summary.reports.map((r) => r.target.name).join(", ");
+    return {
+      stdout: "",
+      stderr: `Server "${serverName}" not in last scan. Available: ${names || "(none)"}`,
+      exitCode: EXIT.USAGE
+    };
+  }
+  const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
+  return { stdout: renderExplain(report, style), exitCode: EXIT.OK };
+}
+
+// src/commands/policy.ts
+import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+function policyCommand(args, deps) {
+  const sub = args.positionals[0];
+  if (sub === "init") {
+    const path = join5(deps.cwd, "calllint.policy.json");
+    if (existsSync3(path) && !flagBool(args.flags, "force")) {
+      return {
+        stdout: "",
+        stderr: `${path} already exists. Use --force to overwrite.`,
+        exitCode: EXIT.USAGE
+      };
+    }
+    writeFileSync2(path, defaultPolicyJson(), "utf8");
+    return { stdout: `Wrote default policy to ${path}`, exitCode: EXIT.OK };
+  }
+  if (sub === "explain") {
+    try {
+      const policy = loadPolicyOrDefault(flagStr(args.flags, "policy"));
+      return { stdout: JSON.stringify(policy, null, 2), exitCode: EXIT.OK };
+    } catch (err) {
+      return {
+        stdout: "",
+        stderr: err instanceof Error ? err.message : String(err),
+        exitCode: EXIT.ERROR
+      };
+    }
+  }
+  return {
+    stdout: "",
+    stderr: "Usage: calllint policy <init|explain>",
+    exitCode: EXIT.USAGE
+  };
+}
+
+// src/commands/verify.ts
+import { join as join6 } from "node:path";
+function loadPolicy(args) {
+  try {
+    return loadPolicyOrDefault(flagStr(args.flags, "policy"));
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function baselinePathFor(args, cwd) {
+  return flagStr(args.flags, "baseline") ?? join6(cwd, ".calllint", "baseline.json");
+}
+function baselineCommand(args, deps) {
+  const policy = loadPolicy(args);
+  if ("error" in policy) return { stdout: "", stderr: policy.error, exitCode: EXIT.ERROR };
+  const input = deps.online?.inputOverride ?? resolveConfigInput(args, deps);
+  if (isInputError(input)) return { stdout: "", stderr: input.error, exitCode: input.exitCode };
+  let summary;
+  try {
+    summary = scanConfigText(input.text, input.configPath, {
+      policy,
+      generatedAt: deps.generatedAt,
+      extraFindings: deps.online?.extraFindings
+    });
+  } catch (err) {
+    if (err instanceof ConfigParseError) {
+      return { stdout: "", stderr: `Parse error in ${input.configPath}: ${err.message}`, exitCode: EXIT.ERROR };
+    }
+    throw err;
+  }
+  const baseline = buildBaseline(summary, deps.generatedAt);
+  const path = baselinePathFor(args, deps.cwd);
+  if (deps.writeBaselineFile !== false) {
+    try {
+      writeBaseline(baseline, path);
+    } catch (err) {
+      return { stdout: "", stderr: `Could not write baseline: ${String(err)}`, exitCode: EXIT.ERROR };
+    }
+  }
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(baseline, null, 2), exitCode: EXIT.OK };
+  }
+  const n = baseline.entries.length;
+  return {
+    stdout: `Baseline written for ${n} server${n === 1 ? "" : "s"} \u2192 ${path}`,
+    exitCode: EXIT.OK
+  };
+}
+function verifyCommand(args, deps) {
+  const policy = loadPolicy(args);
+  if ("error" in policy) return { stdout: "", stderr: policy.error, exitCode: EXIT.ERROR };
+  const path = baselinePathFor(args, deps.cwd);
+  const baseline = readBaseline(path);
+  if (!baseline) {
+    return {
+      stdout: "",
+      stderr: `No baseline found at ${path}. Run \`calllint baseline\` first.`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  const input = deps.online?.inputOverride ?? resolveConfigInput(args, deps);
+  if (isInputError(input)) return { stdout: "", stderr: input.error, exitCode: input.exitCode };
+  let summary;
+  try {
+    summary = scanConfigText(input.text, input.configPath, {
+      policy,
+      generatedAt: deps.generatedAt,
+      extraFindings: deps.online?.extraFindings
+    });
+  } catch (err) {
+    if (err instanceof ConfigParseError) {
+      return { stdout: "", stderr: `Parse error in ${input.configPath}: ${err.message}`, exitCode: EXIT.ERROR };
+    }
+    throw err;
+  }
+  const drift = computeDrift(baseline, summary, deps.generatedAt);
+  const stdout = flagBool(args.flags, "json") ? renderDriftJson(drift) : renderDrift(drift);
+  const exitCode = flagBool(args.flags, "ci") && drift.drifted ? EXIT.DRIFT : EXIT.OK;
+  return { stdout, exitCode };
+}
+
+// src/run.ts
+function run(argv, deps) {
+  const args = parseArgs(argv);
+  const cmd = args.command;
+  if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
+    return helpCommand();
+  }
+  switch (cmd) {
+    case "scan":
+      return scanCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeCacheFile: deps.writeCacheFile,
+        online: deps.online
+      });
+    case "baseline":
+      return baselineCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        generatedAt: deps.generatedAt,
+        writeBaselineFile: deps.writeCacheFile,
+        online: deps.online
+      });
+    case "verify":
+      return verifyCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        generatedAt: deps.generatedAt,
+        writeBaselineFile: deps.writeCacheFile,
+        online: deps.online
+      });
+    case "explain":
+      return explainCommand(args, { cwd: deps.cwd });
+    case "policy":
+      return policyCommand(args, { cwd: deps.cwd });
+    default:
+      return {
+        stdout: "",
+        stderr: `Unknown command: ${cmd}
+Run \`calllint help\`.`,
+        exitCode: 2
+      };
+  }
+}
+
+// ../../packages/online/src/npm.ts
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseSpec(packageSpec) {
+  if (packageSpec.startsWith("@")) {
+    const slash = packageSpec.indexOf("/");
+    const at2 = packageSpec.indexOf("@", slash);
+    if (at2 === -1) return { name: packageSpec };
+    return { name: packageSpec.slice(0, at2), version: packageSpec.slice(at2 + 1) || void 0 };
+  }
+  const at = packageSpec.indexOf("@");
+  if (at <= 0) return { name: packageSpec };
+  return { name: packageSpec.slice(0, at), version: packageSpec.slice(at + 1) || void 0 };
+}
+var INSTALL_SCRIPT_KEYS = ["preinstall", "install", "postinstall"];
+async function fetchNpmFacts(packageSpec, fetchJson) {
+  const { name, version } = parseSpec(packageSpec);
+  const url = `https://registry.npmjs.org/${name.replace(/\//g, "%2f")}`;
+  let doc;
+  try {
+    doc = await fetchJson(url);
+  } catch {
+    return { name, versionExists: false, installScripts: [] };
+  }
+  if (!isRecord3(doc)) return { name, versionExists: false, installScripts: [] };
+  const distTags = isRecord3(doc["dist-tags"]) ? doc["dist-tags"] : {};
+  const latestVersion = typeof distTags.latest === "string" ? distTags.latest : void 0;
+  const versions = isRecord3(doc.versions) ? doc.versions : {};
+  const isFloating = !version || version === "latest" || /[\^~><*]/.test(version);
+  const resolvedVersion = isFloating ? latestVersion : version;
+  const versionDoc = resolvedVersion && isRecord3(versions[resolvedVersion]) ? versions[resolvedVersion] : void 0;
+  if (!versionDoc) {
+    return { name, versionExists: false, installScripts: [], latestVersion, resolvedVersion };
+  }
+  const scripts = isRecord3(versionDoc.scripts) ? versionDoc.scripts : {};
+  const installScripts = INSTALL_SCRIPT_KEYS.filter(
+    (k) => typeof scripts[k] === "string" && scripts[k].length > 0
+  );
+  const deprecated = typeof versionDoc.deprecated === "string" ? versionDoc.deprecated : void 0;
+  return {
+    name,
+    versionExists: true,
+    installScripts,
+    deprecated,
+    latestVersion,
+    resolvedVersion
+  };
+}
+function findingsFromNpmFacts(facts, fetchedAt) {
+  const findings = [];
+  const stamp = (f) => ({ ...f, source: "online", fetchedAt });
+  if (!facts.versionExists) {
+    findings.push(stamp({
+      id: "supply.version-not-found",
+      title: "Package version not found in registry",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S1",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "package-metadata",
+      evidence: [{ type: "package-metadata", key: "registry", value: facts.name }],
+      impact: "The requested package version does not exist on the npm registry, so the configured server cannot be verified or may resolve to something unexpected.",
+      fix: "Pin to a published, existing version of the package."
+    }));
+    return findings;
+  }
+  if (facts.installScripts.length > 0) {
+    findings.push(stamp({
+      id: "supply.install-scripts",
+      title: "Package runs install scripts",
+      severity: "high",
+      blocker: false,
+      symbol: "EXEC",
+      riskClass: "S4",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "package-metadata",
+      evidence: facts.installScripts.map((s) => ({
+        type: "package-metadata",
+        key: "script",
+        value: s
+      })),
+      impact: "npm install/postinstall scripts execute arbitrary code on the host at install time, before the agent ever invokes a tool.",
+      fix: "Review the install scripts, or install with --ignore-scripts and vendor the package.",
+      falsePositiveNote: "Many legitimate packages use postinstall for native builds; review what the script does."
+    }));
+  }
+  if (facts.deprecated) {
+    findings.push(stamp({
+      id: "supply.deprecated",
+      title: "Package version is deprecated",
+      severity: "medium",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S1",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "package-metadata",
+      evidence: [{ type: "package-metadata", key: "deprecated", value: facts.deprecated }],
+      impact: "A deprecated package may be unmaintained and miss security fixes.",
+      fix: "Migrate to the maintained successor or a supported version."
+    }));
+  }
+  return findings;
+}
+async function enrichNpmPackage(packageSpec, fetchJson, fetchedAt) {
+  const facts = await fetchNpmFacts(packageSpec, fetchJson);
+  return { facts, findings: findingsFromNpmFacts(facts, fetchedAt) };
+}
+
+// ../../packages/online/src/github.ts
+var GITHUB_CONFIG_CANDIDATES = [
+  ".cursor/mcp.json",
+  ".mcp.json",
+  "mcp.json",
+  ".vscode/mcp.json",
+  ".claude/settings.json"
+];
+function rawUrl(repo, ref, path) {
+  return `https://raw.githubusercontent.com/${repo}/${ref}/${path}`;
+}
+async function fetchGithubConfig(repo, fetchText, ref = "HEAD") {
+  for (const path of GITHUB_CONFIG_CANDIDATES) {
+    const text = await fetchText(rawUrl(repo, ref, path));
+    if (text && text.trim().length > 0) {
+      return { text, foundPath: path, ref };
+    }
+  }
+  return { ref };
+}
+
+// src/online.ts
+var realFetchJson = async (url) => {
+  const res = await fetch(url);
+  if (!res.ok) throw new Error(`HTTP ${res.status} for ${url}`);
+  return res.json();
+};
+var realFetchText = async (url) => {
+  const res = await fetch(url);
+  if (!res.ok) return void 0;
+  return res.text();
+};
+async function computeOnlineEnrichment(argv, deps = {}) {
+  const args = parseArgs(argv);
+  if (!flagBool(args.flags, "online")) return void 0;
+  const given = args.positionals[0];
+  if (!given) return void 0;
+  const spec = parseTargetSpec(given);
+  const fetchJson = deps.fetchJson ?? realFetchJson;
+  const fetchText = deps.fetchText ?? realFetchText;
+  const fetchedAt = deps.fetchedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  if (spec.kind === "npm" && spec.packageSpec) {
+    const serverName = serverNameForPackage(spec.packageSpec);
+    const { findings } = await enrichNpmPackage(spec.packageSpec, fetchJson, fetchedAt);
+    return { extraFindings: { [serverName]: findings } };
+  }
+  if (spec.kind === "github" && spec.repo) {
+    const result = await fetchGithubConfig(spec.repo, fetchText, spec.ref ?? "HEAD");
+    if (result.text) {
+      return {
+        inputOverride: {
+          text: result.text,
+          configPath: `github:${spec.repo}@${result.ref}/${result.foundPath}`
+        },
+        note: `fetched ${result.foundPath} @ ${result.ref}`
+      };
+    }
+    return void 0;
+  }
+  return void 0;
+}
+
+// src/clock.ts
+function resolveClock(argv, fallback) {
+  const { flags } = parseArgs(argv);
+  const raw = flagStr(flags, "generated-at");
+  if (raw !== void 0) {
+    const ms = Date.parse(raw);
+    if (Number.isNaN(ms)) {
+      throw new Error(
+        `Invalid --generated-at value: "${raw}" (expected an ISO 8601 timestamp)`
+      );
+    }
+    return { generatedAt: new Date(ms).toISOString(), now: ms };
+  }
+  const d = fallback();
+  return { generatedAt: d.toISOString(), now: d.getTime() };
+}
+
+// src/index.ts
+function readStdin() {
+  try {
+    return readFileSync4(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  let clock;
+  try {
+    clock = resolveClock(argv, () => /* @__PURE__ */ new Date());
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+    process.exitCode = 2;
+    return;
+  }
+  const { generatedAt, now } = clock;
+  let online;
+  try {
+    online = await computeOnlineEnrichment(argv, { fetchedAt: generatedAt });
+  } catch (err) {
+    process.stderr.write(`--online failed: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exitCode = 3;
+    return;
+  }
+  if (online?.note) process.stderr.write(`online: ${online.note}
+`);
+  const result = run(argv, {
+    cwd: process.cwd(),
+    readStdin,
+    now,
+    generatedAt,
+    online
+  });
+  if (result.stdout) process.stdout.write(result.stdout + "\n");
+  if (result.stderr) process.stderr.write(result.stderr + "\n");
+  process.exitCode = result.exitCode;
+}
+void main();