calllint 0.4.0 → 0.6.0

package/dist/index.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { execFileSync } from "node:child_process";
 
 // src/args.ts
 var EXIT = {
@@ -56,25 +57,39 @@ USAGE
   calllint <command> [options]
 
 COMMANDS
-  scan [target]      Scan an MCP config file, or npm:<pkg> / github:<owner/repo>
+  check [target]     Compact safety decision for an MCP config or install snippet
+  scan-all           Scan every agent-tool surface in the repo (compact table)
+  explain <server>   Explain the verdict for one server from the last scan
+  verify [target]    Compare a fresh scan against the baseline (drift / rug-pull)
+
+  Advanced:
+  scan [target]      Full ScanReport for an MCP config / npm:<pkg> / github:<repo>
   diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
-  verify [target]    Compare a fresh scan against the baseline (drift / rug-pull)
-  explain <server>   Explain the verdict for one server from the last scan
+  approve            Record the repo-wide capability surface as approved state (L4)
+  gen-rule --host <h>   Emit the CallLint agent-safety rule for a host (CLAUDE.md, etc.)
   policy init        Write a default calllint.policy.json
   policy explain     Show the effective policy
   help               Show this help
 
+CHECK OPTIONS
+  --stdin            Read a config JSON or install snippet from stdin
+  --json             Emit the compact decision JSON (calllint.decision.v0, <1 KB)
+  --explain          Show the full evidence-backed report instead of the compact view
+  --no-emoji         Plain-text symbols (good for CI logs)
+
 TARGETS
   <path>             A config file (default: detect common locations)
   npm:<pkg>[@ver]    Synthesize a config for an npm package (offline)
   github:<owner/repo>[@ref]   A GitHub repo (requires --online)
 
 SCAN OPTIONS
+  --changed          Scan only the agent-tool configs changed in the git diff
   --json             Emit the ScanReport JSON (stable, emoji-free)
   --compact          One line per server
   --no-emoji         Plain-text symbols (good for CI logs)
   --sarif            Emit SARIF 2.1.0 (GitHub Code Scanning / CI)
+  --markdown         Emit Markdown for PR comments / GitHub Step Summary
   --html             Emit a self-contained HTML report
   --policy <file>    Use a policy file (default: built-in defaults)
   --stdin            Read config JSON from stdin
@@ -83,18 +98,20 @@ SCAN OPTIONS
 
 VERIFY OPTIONS
   --baseline <file>  Baseline path (default: .calllint/baseline.json)
-  --ci               Exit 40 if the risk surface drifted from the baseline
+  --approved [file]  Diff the repo-wide capability surface against approved state
+                     (default: .calllint/approved.json) instead of the baseline
+  --ci               Exit 40 if the surface drifted (from baseline or approved state)
   --json             Emit the drift report JSON
 
 EXAMPLES
-  calllint scan .cursor/mcp.json
-  cat .cursor/mcp.json | calllint scan --stdin --json
-  calllint scan ./mcp.json --ci --no-emoji
-  calllint diagnostics ./mcp.json --json
-  calllint scan npm:mcp-weather@1.0.0
-  calllint scan github:owner/repo --online
-  calllint baseline ./mcp.json
+  calllint check .cursor/mcp.json
+  calllint check npm:mcp-weather@1.0.0
+  echo "npx -y demo-mcp@1.2.3" | calllint check --stdin
+  calllint scan-all --no-emoji
+  calllint check ./mcp.json --json
+  calllint scan .cursor/mcp.json --markdown
   calllint verify ./mcp.json --ci
+  calllint approve && calllint verify --approved --ci
   calllint explain filesystem
 `;
 function helpCommand() {
@@ -102,7 +119,7 @@ function helpCommand() {
 }
 
 // src/commands/scan.ts
-import { join as join4, resolve } from "node:path";
+import { join as join6, resolve as resolve2 } from "node:path";
 
 // ../../packages/policy/src/defaultPolicy.ts
 function defaultPolicy() {
@@ -168,6 +185,12 @@ function validateOverride(o, index, issues) {
       message: "must be a valid ISO timestamp (overrides must expire)"
     });
   }
+  if (o.owner !== void 0 && (typeof o.owner !== "string" || !o.owner.trim())) {
+    issues.push({
+      path: `${base}.owner`,
+      message: "must be a non-empty string when present"
+    });
+  }
   const allow = Array.isArray(o.allow) ? o.allow : [];
   const allowsDangerous = allow.some(
     (s) => typeof s === "string" && DANGEROUS_SYMBOLS.has(s)
@@ -255,7 +278,7 @@ function applyPolicy(rawVerdict, serverName, blockingFindings, policy, now) {
   return {
     verdict: "REVIEW",
     changed: true,
-    note: `Policy decision: override for "${serverName}" (expires ${override.expiresAt}) \u2014 ${override.reason}`
+    note: `Policy decision: override for "${serverName}" (expires ${override.expiresAt}${override.owner ? `, owner: ${override.owner}` : ""}) \u2014 ${override.reason}`
   };
 }
 function shouldFailCi(verdict, policy) {
@@ -354,6 +377,100 @@ function highestRiskClass(classes) {
   return worst;
 }
 
+// ../../packages/types/src/reasonCodes.ts
+var REASON_CODES = [
+  "UNPINNED_PACKAGE",
+  "UNKNOWN_REMOTE",
+  "SECRET_IN_WORKSPACE_CONFIG",
+  "BROAD_FILESYSTEM_ACCESS",
+  "SHELL_OR_DOCKER_EXECUTION",
+  "EXTERNAL_MUTATION_UNKNOWN",
+  "MONEY_OR_PAYMENT_CAPABILITY",
+  "MESSAGING_OR_EMAIL_SEND",
+  "PROMPT_METADATA_INSTRUCTION",
+  "OAUTH_SCOPE_UNKNOWN_OR_EXPANDED",
+  "TOOL_DESCRIPTOR_CHANGED",
+  "LONG_RUNNING_GATEWAY_RUNTIME"
+];
+var REASON_CODE_META = {
+  UNPINNED_PACKAGE: {
+    backedBy: ["supply.unpinned-package"],
+    status: "wired",
+    label: "Unpinned package"
+  },
+  UNKNOWN_REMOTE: {
+    backedBy: ["supply.unknown-remote"],
+    status: "wired",
+    label: "Unknown remote endpoint"
+  },
+  SECRET_IN_WORKSPACE_CONFIG: {
+    backedBy: ["secrets.env-key"],
+    status: "wired",
+    label: "Secret in workspace config"
+  },
+  BROAD_FILESYSTEM_ACCESS: {
+    backedBy: ["files.broad-path"],
+    status: "wired",
+    label: "Broad filesystem access"
+  },
+  SHELL_OR_DOCKER_EXECUTION: {
+    backedBy: ["exec.dangerous-command", "exec.unverified-local-source"],
+    status: "wired",
+    label: "Shell or Docker execution"
+  },
+  EXTERNAL_MUTATION_UNKNOWN: {
+    backedBy: ["action.external-mutation"],
+    status: "wired",
+    label: "Unknown external mutation"
+  },
+  MONEY_OR_PAYMENT_CAPABILITY: {
+    backedBy: ["action.financial", "action.financial-observed"],
+    status: "wired",
+    label: "Money or payment capability"
+  },
+  MESSAGING_OR_EMAIL_SEND: {
+    backedBy: ["action.messaging-send"],
+    status: "wired",
+    label: "Messaging or email send"
+  },
+  PROMPT_METADATA_INSTRUCTION: {
+    backedBy: ["prompt.hidden-instructions", "prompt.poisoning"],
+    status: "wired",
+    label: "Prompt-metadata instruction"
+  },
+  OAUTH_SCOPE_UNKNOWN_OR_EXPANDED: {
+    backedBy: ["auth.oauth-scope"],
+    status: "wired",
+    label: "OAuth scope unknown or expanded"
+  },
+  TOOL_DESCRIPTOR_CHANGED: {
+    // Backed by the drift signal (toolMetadataHash change), not a static detector.
+    // Wired via the verify/drift path in P1/P4, not findingsToReasonCodes.
+    backedBy: ["drift:toolMetadataHash"],
+    status: "wired",
+    label: "Tool descriptor changed"
+  },
+  LONG_RUNNING_GATEWAY_RUNTIME: {
+    backedBy: ["runtime.gateway"],
+    status: "wired",
+    label: "Long-running gateway runtime"
+  }
+};
+function reasonCodeForFinding(findingId) {
+  for (const code of REASON_CODES) {
+    if (REASON_CODE_META[code].backedBy.includes(findingId)) return code;
+  }
+  return void 0;
+}
+
+// ../../packages/types/src/decision.ts
+var VERDICT_NEXT_ACTION = {
+  SAFE: "continue",
+  REVIEW: "ask_before_continue",
+  BLOCK: "stop",
+  UNKNOWN: "gather_more_evidence"
+};
+
 // ../../packages/resolver/src/npmSpec.ts
 var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "pnpm", "yarn", "bunx", "uvx", "pipx"]);
 var SHELL_COMMANDS = /* @__PURE__ */ new Set([
@@ -1207,6 +1324,177 @@ function detectHiddenInstructions(ctx) {
   ];
 }
 
+// ../../packages/static-analyzer/src/detectors/messagingSend.ts
+var MESSAGING_PACKAGE_HINTS = [
+  "slack",
+  "discord",
+  "telegram",
+  "sendgrid",
+  "twilio",
+  "mailgun",
+  "postmark",
+  "gmail",
+  "smtp",
+  "nodemailer",
+  "mailchimp",
+  "ses-email",
+  "whatsapp",
+  "messagebird",
+  "vonage",
+  "nexmo"
+];
+var SEND_PATTERNS = [
+  /\bsend[_-]?(e?mail|message|sms|text|dm|notification|push)\b/i,
+  /\bpost[_-]?message\b/i,
+  /\bsend[_-]?mail\b/i,
+  /\b(e?mail|sms|message)[_-]?send\b/i,
+  /\bdeliver[_-]?(message|email)\b/i
+];
+function packageHint(name) {
+  if (!name) return void 0;
+  const lower = name.toLowerCase();
+  return MESSAGING_PACKAGE_HINTS.find((h) => lower.includes(h));
+}
+function textMatchesSend(text) {
+  if (!text) return false;
+  return SEND_PATTERNS.some((re) => re.test(text));
+}
+function detectMessagingSend(ctx) {
+  const { server, binding } = ctx;
+  const evidence = [];
+  let observed = false;
+  for (const tool of server.providedTools) {
+    if (textMatchesSend(tool.name) || textMatchesSend(tool.description)) {
+      observed = true;
+      evidence.push({ type: "tool-metadata", key: "tool", value: tool.name ?? "(unnamed)" });
+    }
+  }
+  const pkgHint = packageHint(binding.packageName);
+  if (pkgHint) {
+    evidence.push({ type: "runtime-binding", key: "package", value: binding.packageName });
+  }
+  if (evidence.length === 0) return [];
+  return [
+    {
+      id: "action.messaging-send",
+      title: "May send messages or email on your behalf",
+      severity: "medium",
+      blocker: false,
+      symbol: "ACTION",
+      riskClass: "S2",
+      mode: observed ? "OBSERVED" : "INFERRED",
+      confidence: observed ? "high" : "low",
+      detectionMethod: observed ? "tool-metadata" : "package-metadata",
+      evidence,
+      impact: "The server appears able to send messages (email, SMS, chat, or push) as you. A compromised or confused agent could send unwanted or harmful messages.",
+      fix: "Confirm which send tools are exposed, require approval before sending, and scope credentials to the minimum needed.",
+      falsePositiveNote: observed ? void 0 : "Name-based inference; a read-only integration with the same provider would not actually send."
+    }
+  ];
+}
+
+// ../../packages/static-analyzer/src/detectors/oauthScope.ts
+var BROAD_SCOPE_HINTS = [
+  "*",
+  "admin",
+  "full_access",
+  "fullaccess",
+  "read_write_all",
+  "offline_access",
+  "all",
+  "write:org",
+  "repo"
+];
+function readOauth(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const oauth = raw.oauth;
+  if (typeof oauth !== "object" || oauth === null) return void 0;
+  const scopesRaw = oauth.scopes;
+  const scopes = Array.isArray(scopesRaw) ? scopesRaw.filter((s) => typeof s === "string") : void 0;
+  return { scopes };
+}
+function broadScope(scopes) {
+  for (const s of scopes) {
+    const lower = s.toLowerCase();
+    if (BROAD_SCOPE_HINTS.some((h) => lower === h || lower.includes(h))) return s;
+  }
+  return void 0;
+}
+function detectOauthScope(ctx) {
+  const oauth = readOauth(ctx.server.raw);
+  if (!oauth) return [];
+  const evidence = [{ type: "config", key: "oauth", value: "present" }];
+  if (!oauth.scopes || oauth.scopes.length === 0) {
+    return [
+      {
+        id: "auth.oauth-scope",
+        title: "OAuth scope is not declared",
+        severity: "medium",
+        blocker: false,
+        symbol: "ACTION",
+        riskClass: "S2",
+        mode: "INFERRED",
+        confidence: "low",
+        detectionMethod: "config-analysis",
+        evidence,
+        impact: "This server authenticates via OAuth but does not declare its scopes, so the powers it grants the agent are unknown.",
+        fix: "Declare the exact OAuth scopes the server requests and confirm they are the minimum required.",
+        falsePositiveNote: "Scope may be declared elsewhere; CallLint only sees the provided config."
+      }
+    ];
+  }
+  const broad = broadScope(oauth.scopes);
+  if (broad) {
+    evidence.push({ type: "config", key: "scope", value: broad });
+    return [
+      {
+        id: "auth.oauth-scope",
+        title: "OAuth scope is broad or expansive",
+        severity: "high",
+        blocker: false,
+        symbol: "ACTION",
+        riskClass: "S2",
+        mode: "OBSERVED",
+        confidence: "high",
+        detectionMethod: "config-analysis",
+        evidence,
+        impact: `The server requests a broad OAuth scope (\`${broad}\`), granting the agent wide access to the connected account.`,
+        fix: "Narrow the OAuth scopes to only what the exposed tools need."
+      }
+    ];
+  }
+  return [];
+}
+
+// ../../packages/static-analyzer/src/detectors/gatewayRuntime.ts
+function gatewayName(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const g = raw.gateway;
+  return typeof g === "string" ? g : void 0;
+}
+function detectGatewayRuntime(ctx) {
+  const gateway = gatewayName(ctx.server.raw);
+  if (!gateway) return [];
+  const evidence = [{ type: "config", key: "gateway", value: gateway }];
+  return [
+    {
+      id: "runtime.gateway",
+      title: "Long-running gateway runtime",
+      severity: "medium",
+      blocker: false,
+      symbol: "ACTION",
+      riskClass: "S2",
+      mode: "OBSERVED",
+      confidence: "high",
+      detectionMethod: "config-analysis",
+      evidence,
+      impact: "This is a gateway runtime that proxies and re-exposes many downstream tools under its own process and auth. Its tool surface can change after you approve it.",
+      fix: "Treat the gateway as a standing capability: pin its version, review which downstream tools it exposes, and re-verify after upgrades.",
+      falsePositiveNote: "A gateway you fully control and monitor may be acceptable; the verdict reflects standing capability, not a specific exploit."
+    }
+  ];
+}
+
 // ../../packages/static-analyzer/src/analyzeServerConfig.ts
 var DETECTORS = [
   detectBroadFilesystemPath,
@@ -1218,7 +1506,10 @@ var DETECTORS = [
   detectExternalMutation,
   detectFinancialAction,
   detectUnverifiedLocalSource,
-  detectHiddenInstructions
+  detectHiddenInstructions,
+  detectMessagingSend,
+  detectOauthScope,
+  detectGatewayRuntime
 ];
 function analyzeServerConfig(server) {
   const binding = resolveRuntimeBinding(server);
@@ -2040,6 +2331,617 @@ function readBaseline(path = defaultBaselinePath()) {
   }
 }
 
+// ../../packages/core/src/extract/fingerprint.ts
+function deriveLaunch(binding) {
+  switch (binding.runtimeKind) {
+    case "npx":
+      return "local:npx";
+    case "uvx":
+      return "local:uvx";
+    case "node":
+      return "local:node";
+    case "python":
+      return "local:python";
+    case "docker":
+      return "local:docker";
+    case "http":
+      return "remote:http";
+    case "sse":
+      return "remote:sse";
+    default:
+      return "unknown";
+  }
+}
+function deriveTransport(binding) {
+  switch (binding.transport) {
+    case "stdio":
+      return "stdio";
+    case "http":
+      return "http";
+    case "sse":
+      return "sse";
+    default:
+      return "unknown";
+  }
+}
+function deriveSource(binding) {
+  if (binding.packageName) {
+    const spec = binding.packageVersionSpec ? `${binding.packageName}@${binding.packageVersionSpec}` : binding.packageName;
+    return `npm:${spec}`;
+  }
+  if (binding.remoteUrl) {
+    try {
+      const u = new URL(binding.remoteUrl);
+      return `url:${u.host}${u.pathname}`.replace(/\/$/, "");
+    } catch {
+      return `url:${binding.remoteUrl}`;
+    }
+  }
+  if (binding.declaredCommand) {
+    return `local:${binding.declaredCommand}`;
+  }
+  return "unknown";
+}
+function deriveScope(origin, launch) {
+  if (origin === "workspace") return "workspace";
+  if (origin === "user") return "user";
+  if (origin === "system") return "system";
+  if (origin === "remote") return "external";
+  if (launch === "remote:http" || launch === "remote:sse") return "external";
+  return "unknown";
+}
+function deriveEffects(findings, server, kind) {
+  const effects = /* @__PURE__ */ new Set();
+  for (const f of findings) {
+    switch (f.symbol) {
+      case "FILES":
+        effects.add("filesystem_broad");
+        break;
+      case "EXEC":
+        effects.add("local_execution");
+        break;
+      case "NETWORK":
+        effects.add("network_egress");
+        break;
+      case "ACTION":
+        effects.add("external_mutation_unknown");
+        break;
+      case "MONEY":
+        effects.add("payment");
+        break;
+      case "PROMPT":
+        effects.add("prompt_instruction");
+        break;
+      default:
+        break;
+    }
+  }
+  if (kind === "gateway_runtime") effects.add("gateway_runtime");
+  if (hasOauthMetadata(server)) effects.add("oauth_scope");
+  return [...effects].sort();
+}
+function hasOauthMetadata(server) {
+  const raw = server.raw;
+  return typeof raw === "object" && raw !== null && "oauth" in raw;
+}
+function deriveIdentity(binding) {
+  return binding.sourceKnown ? "known" : "unknown";
+}
+function buildFingerprint(input) {
+  const { server, binding, findings, origin, kind } = input;
+  const launch = deriveLaunch(binding);
+  const resolvedKind = kind ?? "mcp_server";
+  return {
+    schemaVersion: "calllint.fingerprint.v0",
+    kind: resolvedKind,
+    source: deriveSource(binding),
+    launch,
+    transport: deriveTransport(binding),
+    // Env KEY NAMES only — never values (secret redaction by construction).
+    authority: [...new Set(server.envKeys)].sort().map((k) => `env:${k}`),
+    scope: deriveScope(origin, launch),
+    effects: deriveEffects(findings, server, resolvedKind),
+    identity: deriveIdentity(binding)
+  };
+}
+function fingerprintHash(fp) {
+  const { schemaVersion: _schemaVersion, ...semantic } = fp;
+  const normalized = {
+    ...semantic,
+    authority: [...new Set(fp.authority)].sort(),
+    effects: [...new Set(fp.effects)].sort()
+  };
+  return hashJson(normalized);
+}
+
+// ../../packages/core/src/rules/reasonCodes.ts
+function findingsToReasonCodes(findings) {
+  const present = /* @__PURE__ */ new Set();
+  for (const f of findings) {
+    const code = reasonCodeForFinding(f.id);
+    if (code) present.add(code);
+  }
+  return REASON_CODES.filter((c) => present.has(c));
+}
+
+// ../../packages/core/src/rules/sparseRules.ts
+function sparseDecision(verdict, findings) {
+  return {
+    verdict,
+    reasonCodes: findingsToReasonCodes(findings),
+    nextAction: VERDICT_NEXT_ACTION[verdict]
+  };
+}
+
+// ../../packages/core/src/decision/decide.ts
+function toCompactDecision(report, surface, fingerprint) {
+  const fp = fingerprint ?? report.fingerprint;
+  const hash = fp ? fingerprintHash(fp) : "";
+  const sparse = sparseDecision(report.verdict, report.findings);
+  return {
+    schemaVersion: "calllint.decision.v0",
+    verdict: sparse.verdict,
+    surface,
+    fingerprintHash: hash,
+    reasonCodes: sparse.reasonCodes,
+    nextAction: sparse.nextAction
+  };
+}
+
+// ../../packages/core/src/decision/checkParsed.ts
+function checkParsed(parsed, surface, origin, opts) {
+  resolveScanOptions(opts);
+  return parsed.servers.map((server) => {
+    const binding = resolveRuntimeBinding(server);
+    const findings = analyzeServerConfig(server);
+    const report = scanServer({ server, targetKind: parsed.kind }, opts);
+    const fingerprint = buildFingerprint({ server, binding, findings, origin });
+    const decision = toCompactDecision(report, surface, fingerprint);
+    return { decision: { ...decision }, report: { ...report, fingerprint, decision } };
+  });
+}
+
+// ../../packages/core/src/surface/detect.ts
+var MCP_CONFIG_BASENAMES = /* @__PURE__ */ new Set([
+  ".mcp.json",
+  "mcp.json",
+  "claude_desktop_config.json",
+  "mcp_config.json"
+]);
+var MCP_PATH_HINTS = [
+  "/.cursor/mcp.json",
+  "/.vscode/mcp.json",
+  "\\.cursor\\mcp.json",
+  "\\.vscode\\mcp.json"
+];
+var SNIPPET_MARKERS = [
+  /\bclaude\s+mcp\s+add\b/,
+  /\bnpx\s+-y?\b/,
+  /\buvx\b/,
+  /\bbunx\b/,
+  /\bdocker\s+run\b/,
+  /\bopenclaw\s+mcp\b/
+];
+function normalize(path) {
+  return path.replace(/\\/g, "/").toLowerCase();
+}
+function basename2(path) {
+  const n = normalize(path);
+  const i = n.lastIndexOf("/");
+  return i === -1 ? n : n.slice(i + 1);
+}
+function classifySurface(path, content) {
+  const n = normalize(path);
+  if (n.includes("/node_modules/") || n.startsWith("node_modules/")) return "NOOP";
+  if (/(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/.test(n)) return "NOOP";
+  const base = basename2(path);
+  if (MCP_CONFIG_BASENAMES.has(base)) return "SCAN";
+  if (MCP_PATH_HINTS.some((h) => normalize(path).includes(normalize(h)))) return "SCAN";
+  if (base === "config.toml" && content && /\[mcp_servers?\.[^\]]+\]/.test(content)) {
+    return "SCAN";
+  }
+  if (base === "settings.json" && content && /"mcpServers"\s*:/.test(content)) {
+    return "SCAN";
+  }
+  if (/\.(md|markdown)$/.test(n) && content && SNIPPET_MARKERS.some((r) => r.test(content))) {
+    return "SCAN";
+  }
+  if (/\/\.github\/workflows\/[^/]+\.ya?ml$/.test(n) && content && SNIPPET_MARKERS.some((r) => r.test(content))) {
+    return "SCAN";
+  }
+  if ((path === "-" || path === "" || base === "stdin") && content && SNIPPET_MARKERS.some((r) => r.test(content))) {
+    return "SCAN";
+  }
+  return "NOOP";
+}
+
+// ../../packages/core/src/surface/load.ts
+function inferOrigin(path) {
+  const n = path.replace(/\\/g, "/").toLowerCase();
+  if (n.startsWith("npm:") || n.startsWith("http://") || n.startsWith("https://")) {
+    return "remote";
+  }
+  if (n.includes("/library/application support/") || // macOS
+  n.includes("/.config/") || n.includes("/appdata/") || // Windows
+  n.includes("/users/") && n.includes("/.cursor/") === false && n.includes("/.vscode/") === false) {
+    if (!n.includes("/.cursor/") && !n.includes("/.vscode/") && !n.startsWith("./")) {
+      return "user";
+    }
+  }
+  if (n.includes("/.cursor/") || n.includes("/.vscode/") || n.includes("/.github/") || n.startsWith(".cursor/") || n.startsWith(".vscode/") || n.startsWith(".github/") || n === ".mcp.json" || n.startsWith("./")) {
+    return "workspace";
+  }
+  return "unknown";
+}
+function loadSurfaceText(text, configPath = "<inline>") {
+  return { parsed: parseConfigText(text, configPath), origin: inferOrigin(configPath) };
+}
+
+// ../../packages/core/src/surface/snippet.ts
+var RUNNER_RE = /\b(?:npx|uvx|bunx|pnpm dlx)\s+(?:-y\s+|--yes\s+)?(@?[\w./-]+(?:@[\w.^~>=<-]+)?)/;
+var CLAUDE_ADD_RE = /\bclaude\s+mcp\s+add\b.*?--\s+(.+)$/;
+function extractPackageSpec(text) {
+  const trimmed = text.trim();
+  const claude = CLAUDE_ADD_RE.exec(trimmed);
+  if (claude) {
+    const inner = extractPackageSpec(claude[1]);
+    if (inner) return inner;
+  }
+  const runner = RUNNER_RE.exec(trimmed);
+  if (runner) return runner[1];
+  if (/^@?[\w./-]+(@[\w.^~>=<-]+)?$/.test(trimmed)) return trimmed;
+  return void 0;
+}
+function parseSnippet(text) {
+  const spec = extractPackageSpec(text);
+  if (!spec) {
+    throw new Error("No agent-tool package recognized in snippet");
+  }
+  const { text: configText, configPath } = synthesizeNpmConfig(spec);
+  return { parsed: parseConfigText(configText, configPath), packageSpec: spec };
+}
+
+// ../../packages/core/src/surface/walk.ts
+import { readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
+import { join as join2, relative } from "node:path";
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  "coverage"
+]);
+var MAX_DEPTH = 6;
+var MAX_FILE_BYTES = 256 * 1024;
+function findSurfaces(root) {
+  const found = [];
+  function walk(dir, depth) {
+    if (depth > MAX_DEPTH) return;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true, encoding: "utf8" });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const full = join2(dir, e.name);
+      if (e.isDirectory()) {
+        if (SKIP_DIRS.has(e.name)) continue;
+        walk(full, depth + 1);
+      } else if (e.isFile()) {
+        if (classifySurface(full) === "SCAN") {
+          found.push(full);
+          continue;
+        }
+        if (needsContentCheck(e.name)) {
+          const content = readCapped(full);
+          if (content && classifySurface(full, content) === "SCAN") found.push(full);
+        }
+      }
+    }
+  }
+  walk(root, 0);
+  return found;
+}
+function needsContentCheck(name) {
+  return name === "config.toml" || name === "settings.json" || /\.(md|markdown|ya?ml)$/.test(name);
+}
+function readCapped(path) {
+  try {
+    const st = statSync(path);
+    if (!st.isFile() || st.size > MAX_FILE_BYTES) return void 0;
+    return readFileSync3(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function unknownDecision(surface) {
+  return {
+    schemaVersion: "calllint.decision.v0",
+    verdict: "UNKNOWN",
+    surface,
+    fingerprintHash: "",
+    reasonCodes: [],
+    nextAction: "gather_more_evidence"
+  };
+}
+function decideRepoSurfaces(root, opts) {
+  const surfaces = findSurfaces(root);
+  const decisions = [];
+  for (const abs of surfaces) {
+    const rel = relative(root, abs) || abs;
+    const text = readCapped(abs);
+    if (!text) continue;
+    try {
+      const loaded = loadSurfaceText(text, rel);
+      const results = checkParsed(loaded.parsed, rel, inferOrigin(rel), opts);
+      for (const r of results) decisions.push(r.decision);
+    } catch (e) {
+      if (e instanceof ConfigParseError) {
+        decisions.push(unknownDecision(rel));
+        continue;
+      }
+      throw e;
+    }
+  }
+  return decisions;
+}
+
+// ../../packages/core/src/state/approve.ts
+import { writeFileSync as writeFileSync2, readFileSync as readFileSync4, mkdirSync as mkdirSync2, existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+function defaultApprovedPath(cwd = process.cwd()) {
+  return join3(cwd, ".calllint", "approved.json");
+}
+function entryFromDecision(d, approvedAt) {
+  const entry = {
+    fingerprintHash: d.fingerprintHash,
+    surface: d.surface,
+    verdict: d.verdict,
+    approvedAt
+  };
+  if (d.reasonCodes.length > 0) entry.reasonCodes = [...d.reasonCodes];
+  return entry;
+}
+function buildApproved(decisions, approvedAt) {
+  const seen = /* @__PURE__ */ new Set();
+  const approved = [];
+  for (const d of decisions) {
+    const key = `${d.surface}\0${d.fingerprintHash}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    approved.push(entryFromDecision(d, approvedAt));
+  }
+  approved.sort(
+    (a, b) => a.surface === b.surface ? a.fingerprintHash.localeCompare(b.fingerprintHash) : a.surface.localeCompare(b.surface)
+  );
+  return { schemaVersion: "calllint.approved.v0", approved };
+}
+function writeApproved(state, path = defaultApprovedPath()) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, JSON.stringify(state, null, 2), "utf8");
+}
+function readApproved(path = defaultApprovedPath()) {
+  if (!existsSync2(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/core/src/state/verifyApproved.ts
+function verifyApproved(current, approved, generatedAt) {
+  const approvedBySurface = /* @__PURE__ */ new Map();
+  for (const a of approved.approved) approvedBySurface.set(a.surface, a);
+  const currentBySurface = /* @__PURE__ */ new Map();
+  for (const d of current) currentBySurface.set(d.surface, d);
+  const entries = [];
+  const driftVerdicts = [];
+  for (const a of approved.approved) {
+    const cur = currentBySurface.get(a.surface);
+    if (!cur) {
+      entries.push({
+        surface: a.surface,
+        status: "removed",
+        approvedHash: a.fingerprintHash,
+        approvedVerdict: a.verdict
+      });
+      driftVerdicts.push("REVIEW");
+      continue;
+    }
+    if (cur.fingerprintHash !== a.fingerprintHash) {
+      entries.push({
+        surface: a.surface,
+        status: "hash-changed",
+        approvedHash: a.fingerprintHash,
+        currentHash: cur.fingerprintHash,
+        approvedVerdict: a.verdict,
+        currentVerdict: cur.verdict
+      });
+      driftVerdicts.push(escalate(cur.verdict));
+      continue;
+    }
+    if (cur.verdict !== a.verdict) {
+      entries.push({
+        surface: a.surface,
+        status: "verdict-changed",
+        approvedHash: a.fingerprintHash,
+        currentHash: cur.fingerprintHash,
+        approvedVerdict: a.verdict,
+        currentVerdict: cur.verdict
+      });
+      driftVerdicts.push(escalate(cur.verdict));
+      continue;
+    }
+    entries.push({
+      surface: a.surface,
+      status: "unchanged",
+      approvedHash: a.fingerprintHash,
+      currentHash: cur.fingerprintHash,
+      approvedVerdict: a.verdict,
+      currentVerdict: cur.verdict
+    });
+  }
+  for (const d of current) {
+    if (!approvedBySurface.has(d.surface)) {
+      entries.push({
+        surface: d.surface,
+        status: "added",
+        currentHash: d.fingerprintHash,
+        currentVerdict: d.verdict
+      });
+      driftVerdicts.push(escalate(d.verdict));
+    }
+  }
+  const drifted = entries.some((e) => e.status !== "unchanged");
+  const verdict = drifted ? mostSevereVerdict(driftVerdicts) : "SAFE";
+  return {
+    schemaVersion: "calllint.approveddrift.v0",
+    drifted,
+    verdict,
+    entries,
+    generatedAt
+  };
+}
+function escalate(current) {
+  return current === "BLOCK" || current === "UNKNOWN" ? current : "REVIEW";
+}
+
+// ../../packages/core/src/distribution/agentRule.ts
+var RELEVANT_SURFACES = [
+  ".cursor/mcp.json",
+  ".vscode/mcp.json",
+  ".mcp.json",
+  ".claude/settings.json",
+  "claude_desktop_config.json",
+  "~/.claude.json",
+  ".codex/config.toml",
+  ".gemini/settings.json",
+  "package.json",
+  "README.md",
+  "AGENTS.md",
+  "CLAUDE.md",
+  ".cursor/rules/*.mdc",
+  ".github/workflows/*.yml"
+];
+var UNIVERSAL_AGENT_RULE = `Before adding, editing, approving, installing, running, publishing, or merging any MCP or agent-tool configuration, run CallLint first and explain the result.
+
+Run:
+  npx -y calllint check <config-file-or-snippet>
+
+Decision policy:
+- SAFE: continue only after stating that no blockers were observed.
+- REVIEW: explain the findings and ask before continuing.
+- BLOCK: stop. Do not proceed unless the user explicitly overrides.
+- UNKNOWN: do not auto-approve; ask for explicit review.
+- ERROR: do not silently continue.
+
+Always:
+- Never execute a scanned MCP server just to decide whether it is safe.
+- Never print secret values.
+- Treat SAFE as "no blockers observed", not as proof of runtime safety.`;
+
+// ../../packages/core/src/distribution/hostRules.ts
+var RULE_HOSTS = [
+  "claude",
+  "agents",
+  "cursor",
+  "copilot",
+  "codex",
+  "gemini",
+  "windsurf",
+  "cline",
+  "command"
+];
+var RULE_TARGETS = {
+  claude: { host: "claude", path: "CLAUDE.md", label: "Claude Code / Claude Desktop" },
+  agents: { host: "agents", path: "AGENTS.md", label: "Generic coding/IDE/CI agents" },
+  cursor: { host: "cursor", path: ".cursor/rules/calllint.mdc", label: "Cursor" },
+  copilot: {
+    host: "copilot",
+    path: ".github/copilot-instructions.md",
+    label: "VS Code / GitHub Copilot"
+  },
+  codex: { host: "codex", path: ".codex/AGENTS.md", label: "OpenAI Codex" },
+  gemini: { host: "gemini", path: ".gemini/GEMINI.md", label: "Gemini CLI" },
+  windsurf: { host: "windsurf", path: ".windsurf/rules/calllint.md", label: "Windsurf" },
+  cline: { host: "cline", path: ".clinerules/calllint.md", label: "Cline" },
+  command: { host: "command", path: ".claude/commands/calllint.md", label: "Claude slash command" }
+};
+function surfaceList() {
+  return RELEVANT_SURFACES.map((s) => `- ${s}`).join("\n");
+}
+function rule() {
+  return UNIVERSAL_AGENT_RULE;
+}
+function markdownBody(intro) {
+  return `# CallLint Agent Tool Safety Rule
+
+${intro}
+
+Relevant files include:
+
+${surfaceList()}
+
+${rule()}
+`;
+}
+function renderHostRule(host) {
+  switch (host) {
+    case "claude":
+      return markdownBody(
+        "Treat MCP and agent-tool configuration as security-sensitive infrastructure in this repository."
+      );
+    case "agents":
+      return markdownBody(
+        "This rule applies to all coding agents, IDE agents, CI agents, and automation agents working in this repository. Treat MCP and agent-tool configuration as security-sensitive infrastructure."
+      );
+    case "copilot":
+      return markdownBody(
+        "When working in this repository, treat MCP and agent-tool configuration as security-sensitive infrastructure."
+      );
+    case "codex":
+    case "gemini":
+    case "windsurf":
+    case "cline":
+      return markdownBody(
+        `Treat MCP and agent-tool configuration as security-sensitive infrastructure (${RULE_TARGETS[host].label}).`
+      );
+    case "cursor":
+      return `---
+description: Require CallLint before MCP or agent-tool permission changes
+alwaysApply: true
+---
+
+Treat MCP and agent-tool configuration as security-sensitive infrastructure.
+
+Relevant files include:
+
+${surfaceList()}
+
+${rule()}
+`;
+    case "command":
+      return `# /calllint
+
+Run CallLint against MCP and agent-tool configuration in this repository.
+
+Steps:
+
+1. Find relevant files:
+
+${surfaceList()}
+
+2. For each, run \`npx -y calllint check <file>\` (or \`calllint scan-all\` for the whole repo).
+3. Apply the decision policy below.
+
+${rule()}
+`;
+  }
+}
+
 // ../../packages/report-renderer/src/style.ts
 var DEFAULT_STYLE = { emoji: true };
 var NO_EMOJI_STYLE = { emoji: false };
@@ -2122,6 +3024,42 @@ function renderCompact(summary, style = DEFAULT_STYLE) {
   return lines.join("\n");
 }
 
+// ../../packages/report-renderer/src/renderDecision.ts
+var NEXT_ACTION_HINT = {
+  continue: "No blockers observed \u2014 safe to continue.",
+  ask_before_continue: "Review required \u2014 confirm before continuing.",
+  stop: "Blocked \u2014 do not proceed without resolving the blocker.",
+  gather_more_evidence: "Insufficient evidence \u2014 gather more before continuing."
+};
+function shortSurface(surface) {
+  return surface.length > 60 ? "\u2026" + surface.slice(-59) : surface;
+}
+function renderDecision(decision, style = DEFAULT_STYLE) {
+  const lines = [];
+  lines.push(`${verdictTag(decision.verdict, style)} ${shortSurface(decision.surface)}`);
+  if (decision.reasonCodes.length > 0) {
+    lines.push(`Reasons: ${decision.reasonCodes.join(", ")}`);
+  } else {
+    lines.push("Reasons: none observed");
+  }
+  lines.push(`Next: ${NEXT_ACTION_HINT[decision.nextAction]}`);
+  return lines.join("\n");
+}
+function renderDecisionTable(decisions, style = DEFAULT_STYLE) {
+  if (decisions.length === 0) {
+    return "0 agent-tool surfaces found";
+  }
+  const lines = [
+    `${decisions.length} agent-tool surface${decisions.length === 1 ? "" : "s"} found`,
+    ""
+  ];
+  for (const d of decisions) {
+    const codes = d.reasonCodes.length > 0 ? d.reasonCodes.join(", ") : "no blockers observed";
+    lines.push(`${verdictTag(d.verdict, style)}	${shortSurface(d.surface)}	${codes}`);
+  }
+  return lines.join("\n");
+}
+
 // ../../packages/report-renderer/src/renderExplain.ts
 function renderFindingDetail(f, n) {
   const lines = [];
@@ -2212,6 +3150,39 @@ function renderDrift(report) {
   return lines.join("\n");
 }
 
+// ../../packages/report-renderer/src/renderApprovedDrift.ts
+function renderApprovedDriftJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+var STATUS_TAG2 = {
+  unchanged: "OK   ",
+  "hash-changed": "HASH ",
+  "verdict-changed": "VRDCT",
+  added: "ADD  ",
+  removed: "DEL  "
+};
+function renderApprovedDrift(report) {
+  const lines = [];
+  lines.push("CallLint verify (drift vs approved state)");
+  const headline = report.drifted ? `DRIFT \u2014 approved capability surface changed (${report.verdict})` : "no drift \u2014 matches approved state";
+  lines.push(`result: ${headline}`);
+  lines.push("\u2500".repeat(60));
+  for (const e of report.entries) {
+    const tag = STATUS_TAG2[e.status] ?? e.status;
+    lines.push(`${tag}  ${e.surface}`);
+    if (e.status === "hash-changed") {
+      lines.push(`        \u2022 ${e.approvedHash} \u2192 ${e.currentHash}`);
+    } else if (e.status === "verdict-changed") {
+      lines.push(`        \u2022 verdict ${e.approvedVerdict} \u2192 ${e.currentVerdict}`);
+    } else if (e.status === "added") {
+      lines.push(`        \u2022 new surface, not in approved state (${e.currentVerdict})`);
+    } else if (e.status === "removed") {
+      lines.push(`        \u2022 approved surface no longer present`);
+    }
+  }
+  return lines.join("\n");
+}
+
 // ../../packages/report-renderer/src/renderSarif.ts
 function levelForSeverity(sev) {
   if (sev === "critical" || sev === "high") return "error";
@@ -2304,6 +3275,92 @@ function renderSarif(summary) {
   return JSON.stringify(sarif, null, 2);
 }
 
+// ../../packages/report-renderer/src/renderMarkdown.ts
+function renderMarkdown(summary) {
+  const out = [];
+  const c = summary.counts;
+  out.push(`## CallLint: ${summary.verdict} \u2014 ${summary.publicVerdictLabel}`);
+  out.push("");
+  out.push(
+    `CallLint statically checked \`${summary.configPath}\` before the agent tool runs. It never executes, installs, or connects to the server it judges.`
+  );
+  out.push("");
+  out.push("| Server | Verdict | Risk class | Findings |");
+  out.push("| --- | --- | --- | --- |");
+  for (const r of summary.reports) {
+    out.push(
+      `| ${mdCell(r.target.name)} | ${r.verdict} | ${r.riskClass} | ${r.findings.length} |`
+    );
+  }
+  out.push(
+    `| **TOTAL** | **${summary.verdict}** | \u2014 | BLOCK ${c.BLOCK} \xB7 UNKNOWN ${c.UNKNOWN} \xB7 REVIEW ${c.REVIEW} \xB7 SAFE ${c.SAFE} |`
+  );
+  out.push("");
+  for (const r of summary.reports) {
+    renderServer2(out, r);
+  }
+  out.push("---");
+  out.push("");
+  out.push(
+    "> CallLint does not prove runtime safety. `SAFE` means no blockers observed under current evidence; `UNKNOWN` is never `SAFE`. Verdicts are heuristic decision support, not a safety guarantee."
+  );
+  return out.join("\n");
+}
+function renderServer2(out, r) {
+  out.push(`### ${r.target.name} \u2014 ${r.verdict}`);
+  out.push("");
+  if (r.summary) {
+    out.push(r.summary);
+    out.push("");
+  }
+  if (r.findings.length === 0) {
+    out.push("_No findings._");
+    out.push("");
+  } else {
+    for (const f of r.findings) {
+      renderFinding(out, f);
+    }
+  }
+  renderRecommendation(out, r.policy);
+  out.push("");
+}
+function renderFinding(out, f) {
+  const tag = f.blocker ? "BLOCKER" : f.severity.toUpperCase();
+  out.push(`#### ${tag}: ${f.title}`);
+  out.push("");
+  out.push(`- Risk: ${f.symbol} \xB7 ${f.riskClass} \xB7 ${f.mode} \xB7 confidence ${f.confidence}`);
+  const ev = f.evidence[0];
+  if (ev) {
+    const loc = ev.path ? ` \`${ev.path}\`${ev.line ? `:${ev.line}` : ""}` : "";
+    const shown = ev.snippet ?? ev.value ?? ev.key;
+    out.push(`- Evidence:${loc}`);
+    if (shown) {
+      out.push("");
+      out.push("  ```text");
+      for (const line of String(shown).split("\n")) out.push(`  ${line}`);
+      out.push("  ```");
+    }
+  }
+  out.push("");
+  out.push(`Why it matters: ${f.impact}`);
+  out.push("");
+  out.push(`Recommended fix: ${f.fix}`);
+  if (f.falsePositiveNote) {
+    out.push("");
+    out.push(`Note: ${f.falsePositiveNote}`);
+  }
+  out.push("");
+}
+function renderRecommendation(out, p) {
+  out.push("Policy recommendation:");
+  out.push(`- Autonomous use: ${p.autonomousUse}`);
+  out.push(`- Manual approval: ${p.manualApproval}`);
+  out.push(`- Sandbox: ${p.sandbox}`);
+}
+function mdCell(s) {
+  return s.replace(/\|/g, "\\|").replace(/\n/g, " ");
+}
+
 // ../../packages/report-renderer/src/renderDiagnostics.ts
 function verdictContributionFor(f) {
   if (f.blocker) return "blocker";
@@ -2500,8 +3557,8 @@ function exitCodeFor(summary, policy) {
 }
 
 // src/commands/resolveInput.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { join as join2 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { join as join4 } from "node:path";
 var DEFAULT_CONFIG_PATHS = [
   ".cursor/mcp.json",
   ".mcp.json",
@@ -2511,8 +3568,8 @@ var DEFAULT_CONFIG_PATHS = [
 ];
 function findDefaultConfig(cwd) {
   for (const rel of DEFAULT_CONFIG_PATHS) {
-    const p = join2(cwd, rel);
-    if (existsSync2(p)) return p;
+    const p = join4(cwd, rel);
+    if (existsSync3(p)) return p;
   }
   return void 0;
 }
@@ -2546,26 +3603,43 @@ function resolveConfigInput(args, deps) {
       exitCode: EXIT.USAGE
     };
   }
-  if (!existsSync2(resolved)) {
+  if (!existsSync3(resolved)) {
     return { error: `File not found: ${resolved}`, exitCode: EXIT.USAGE };
   }
-  return { text: readFileSync3(resolved, "utf8"), configPath: resolved };
+  return { text: readFileSync5(resolved, "utf8"), configPath: resolved };
+}
+
+// src/commands/changedConfigs.ts
+import { basename as basename3, resolve } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+function changedConfigPaths(cwd, diff) {
+  let raw;
+  try {
+    raw = diff();
+  } catch {
+    return [];
+  }
+  const knownLeaves = new Set(DEFAULT_CONFIG_PATHS.map((p) => basename3(p)));
+  const knownPaths = new Set(DEFAULT_CONFIG_PATHS);
+  return raw.split("\n").map((l) => l.trim()).filter(
+    (f) => f.length > 0 && (knownPaths.has(f) || DEFAULT_CONFIG_PATHS.some((p) => f.endsWith("/" + p)) || knownLeaves.has(basename3(f)))
+  ).map((f) => resolve(cwd, f)).filter((abs) => existsSync4(abs));
 }
 
 // src/commands/surfaces.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, statSync } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { join as join5 } from "node:path";
 var SURFACE_SIZE_CAP = 256 * 1024;
 var SURFACE_FILES = [
   { file: "README.md", kind: "readme" },
   { file: "SKILL.md", kind: "skill" },
   { file: "AGENTS.md", kind: "agents" }
 ];
-function readCapped(path) {
+function readCapped2(path) {
   try {
-    const st = statSync(path);
+    const st = statSync2(path);
     if (!st.isFile()) return void 0;
-    const raw = readFileSync4(path, "utf8");
+    const raw = readFileSync6(path, "utf8");
     if (raw.length > SURFACE_SIZE_CAP) {
       return { text: raw.slice(0, SURFACE_SIZE_CAP), truncated: true };
     }
@@ -2576,13 +3650,13 @@ function readCapped(path) {
 }
 function readDocumentSurfaces(dir) {
   const surfaces = [];
-  if (!existsSync3(dir)) return surfaces;
+  if (!existsSync5(dir)) return surfaces;
   for (const { file, kind } of SURFACE_FILES) {
-    const got = readCapped(join3(dir, file));
+    const got = readCapped2(join5(dir, file));
     if (got) surfaces.push({ path: file, kind, text: got.text, truncated: got.truncated });
   }
-  const pkgPath = join3(dir, "package.json");
-  const pkgRaw = readCapped(pkgPath);
+  const pkgPath = join5(dir, "package.json");
+  const pkgRaw = readCapped2(pkgPath);
   if (pkgRaw) {
     try {
       const pkg = JSON.parse(pkgRaw.text);
@@ -2602,7 +3676,11 @@ function readDocumentSurfaces(dir) {
 }
 
 // src/commands/scan.ts
+import { readFileSync as readFileSync7 } from "node:fs";
 function scanCommand(args, deps) {
+  if (flagBool(args.flags, "changed")) {
+    return scanChangedCommand(args, deps);
+  }
   const policyPath = flagStr(args.flags, "policy");
   let policy;
   try {
@@ -2619,8 +3697,11 @@ function scanCommand(args, deps) {
     return { stdout: "", stderr: input.error, exitCode: input.exitCode };
   }
   const { text, configPath } = input;
+  return scanOneConfig(text, configPath, policy, args, deps);
+}
+function scanOneConfig(text, configPath, policy, args, deps) {
   const surfaceDir = flagStr(args.flags, "surface-dir");
-  const surfaces = surfaceDir ? readDocumentSurfaces(resolve(deps.cwd, surfaceDir)) : void 0;
+  const surfaces = surfaceDir ? readDocumentSurfaces(resolve2(deps.cwd, surfaceDir)) : void 0;
   let summary;
   try {
     summary = scanConfigText(text, configPath, {
@@ -2642,20 +3723,200 @@ function scanCommand(args, deps) {
   }
   if (deps.writeCacheFile !== false) {
     try {
-      writeCache(summary, join4(deps.cwd, ".calllint", "last-scan.json"));
+      writeCache(summary, join6(deps.cwd, ".calllint", "last-scan.json"));
     } catch {
     }
   }
-  const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
-  let stdout;
-  if (flagBool(args.flags, "json")) stdout = renderJson(summary);
-  else if (flagBool(args.flags, "sarif")) stdout = renderSarif(summary);
-  else if (flagBool(args.flags, "html")) stdout = renderHtml(summary);
-  else if (flagBool(args.flags, "compact")) stdout = renderCompact(summary, style);
-  else stdout = renderTerminal(summary, style);
+  const stdout = renderSummary(summary, args);
   const exitCode = flagBool(args.flags, "ci") ? exitCodeFor(summary, policy) : EXIT.OK;
   return { stdout, exitCode };
 }
+function renderSummary(summary, args) {
+  const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
+  if (flagBool(args.flags, "json")) return renderJson(summary);
+  if (flagBool(args.flags, "sarif")) return renderSarif(summary);
+  if (flagBool(args.flags, "markdown")) return renderMarkdown(summary);
+  if (flagBool(args.flags, "html")) return renderHtml(summary);
+  if (flagBool(args.flags, "compact")) return renderCompact(summary, style);
+  return renderTerminal(summary, style);
+}
+function scanChangedCommand(args, deps) {
+  const policyPath = flagStr(args.flags, "policy");
+  let policy;
+  try {
+    policy = loadPolicyOrDefault(policyPath);
+  } catch (err) {
+    return {
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err),
+      exitCode: EXIT.ERROR
+    };
+  }
+  if (!deps.getChangedFilesDiff) {
+    return {
+      stdout: "",
+      stderr: "--changed needs a git diff source. Run inside a git repository, or scan a path directly.",
+      exitCode: EXIT.USAGE
+    };
+  }
+  const paths = changedConfigPaths(deps.cwd, deps.getChangedFilesDiff);
+  if (paths.length === 0) {
+    return {
+      stdout: "No agent-tool configs changed in the git diff. Nothing to scan.",
+      exitCode: EXIT.OK
+    };
+  }
+  const results = paths.map((p) => {
+    const text = readFileSync7(p, "utf8");
+    return scanOneConfig(text, p, policy, args, deps);
+  });
+  const exitCode = results.reduce((worst, r) => Math.max(worst, r.exitCode), EXIT.OK);
+  let stdout;
+  if (flagBool(args.flags, "json")) {
+    stdout = "[" + results.map((r) => r.stdout).join(",\n") + "]";
+  } else {
+    stdout = results.map((r) => r.stdout).join("\n\n---\n\n");
+  }
+  const stderr = results.map((r) => r.stderr).filter(Boolean).join("\n");
+  return { stdout, exitCode, ...stderr ? { stderr } : {} };
+}
+
+// src/commands/check.ts
+function checkCommand(args, deps) {
+  const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
+  const opts = { now: deps.now, generatedAt: deps.generatedAt };
+  const input = resolveConfigInput(args, deps);
+  if (isInputError(input)) {
+    return { stdout: "", stderr: input.error, exitCode: input.exitCode };
+  }
+  let decisions;
+  try {
+    const looksLikeJson = input.text.trim().startsWith("{");
+    if (input.configPath === "<stdin>" && !looksLikeJson) {
+      const { parsed } = parseSnippet(input.text);
+      decisions = checkParsed(parsed, "stdin:snippet", "remote", opts);
+    } else {
+      const loaded = loadSurfaceText(input.text, input.configPath);
+      decisions = checkParsed(loaded.parsed, input.configPath, loaded.origin, opts);
+    }
+  } catch (e) {
+    if (e instanceof ConfigParseError) {
+      return { stdout: "", stderr: `Parse error: ${e.message}`, exitCode: EXIT.ERROR };
+    }
+    if (e instanceof Error) {
+      return { stdout: "", stderr: e.message, exitCode: EXIT.UNKNOWN };
+    }
+    throw e;
+  }
+  if (decisions.length === 0) {
+    return {
+      stdout: "UNKNOWN  no agent-tool capability found in input",
+      exitCode: EXIT.UNKNOWN
+    };
+  }
+  if (flagBool(args.flags, "explain") || flagBool(args.flags, "full")) {
+    const stdout2 = decisions.map((d) => renderExplain(d.report, style)).join("\n\n");
+    return { stdout: stdout2, exitCode: worstExit(decisions) };
+  }
+  if (flagBool(args.flags, "json")) {
+    const payload = decisions.length === 1 ? decisions[0].decision : decisions.map((d) => d.decision);
+    return { stdout: JSON.stringify(payload), exitCode: worstExit(decisions) };
+  }
+  const stdout = decisions.map((d) => renderDecision(d.decision, style)).join("\n\n");
+  return { stdout, exitCode: worstExit(decisions) };
+}
+function worstExit(decisions) {
+  let worst = EXIT.OK;
+  for (const d of decisions) {
+    const code = exitForVerdict(d.decision.verdict);
+    if (code > worst) worst = code;
+  }
+  return worst;
+}
+function exitForVerdict(verdict) {
+  switch (verdict) {
+    case "BLOCK":
+      return EXIT.BLOCK;
+    case "UNKNOWN":
+      return EXIT.UNKNOWN;
+    case "REVIEW":
+      return EXIT.REVIEW;
+    case "SAFE":
+      return EXIT.OK;
+  }
+}
+
+// src/commands/scanAll.ts
+function scanAllCommand(args, deps) {
+  const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
+  const decisions = decideRepoSurfaces(deps.cwd, {
+    now: deps.now,
+    generatedAt: deps.generatedAt
+  });
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(decisions), exitCode: worstExit2(decisions) };
+  }
+  return { stdout: renderDecisionTable(decisions, style), exitCode: worstExit2(decisions) };
+}
+function worstExit2(decisions) {
+  let worst = EXIT.OK;
+  for (const d of decisions) {
+    const code = d.verdict === "BLOCK" ? EXIT.BLOCK : d.verdict === "UNKNOWN" ? EXIT.UNKNOWN : d.verdict === "REVIEW" ? EXIT.REVIEW : EXIT.OK;
+    if (code > worst) worst = code;
+  }
+  return worst;
+}
+
+// src/commands/genRule.ts
+import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname3, join as join7, resolve as resolve3 } from "node:path";
+function isRuleHost(v) {
+  return v !== void 0 && RULE_HOSTS.includes(v);
+}
+function genRuleCommand(args, deps) {
+  const host = flagStr(args.flags, "host");
+  if (!host) {
+    const list = RULE_HOSTS.map(
+      (h) => `  ${h.padEnd(10)} \u2192 ${RULE_TARGETS[h].path}  (${RULE_TARGETS[h].label})`
+    ).join("\n");
+    return {
+      stdout: `Usage: calllint gen-rule --host <host> [--write] [--out <path>]
+
+Hosts:
+${list}`,
+      exitCode: EXIT.OK
+    };
+  }
+  if (!isRuleHost(host)) {
+    return {
+      stdout: "",
+      stderr: `Unknown host: ${host}
+Run \`calllint gen-rule\` to list hosts.`,
+      exitCode: EXIT.USAGE
+    };
+  }
+  const content = renderHostRule(host);
+  if (!flagBool(args.flags, "write")) {
+    return { stdout: content, exitCode: EXIT.OK };
+  }
+  const rel = flagStr(args.flags, "out") ?? RULE_TARGETS[host].path;
+  const abs = resolve3(deps.cwd, rel);
+  const write = deps.writeFile ?? defaultWrite;
+  try {
+    write(abs, content);
+  } catch (e) {
+    return {
+      stdout: "",
+      stderr: `Failed to write ${rel}: ${e instanceof Error ? e.message : String(e)}`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  return { stdout: `Wrote ${rel} (${RULE_TARGETS[host].label})`, exitCode: EXIT.OK };
+}
+function defaultWrite(path, content) {
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync3(path, content, "utf8");
+}
 
 // src/commands/diagnostics.ts
 function diagnosticsCommand(args, deps) {
@@ -2705,7 +3966,7 @@ function diagnosticsCommand(args, deps) {
 }
 
 // src/commands/explain.ts
-import { join as join5 } from "node:path";
+import { join as join8 } from "node:path";
 function explainCommand(args, deps) {
   const serverName = args.positionals[0];
   if (!serverName) {
@@ -2715,7 +3976,7 @@ function explainCommand(args, deps) {
       exitCode: EXIT.USAGE
     };
   }
-  const summary = readCache(join5(deps.cwd, ".calllint", "last-scan.json"));
+  const summary = readCache(join8(deps.cwd, ".calllint", "last-scan.json"));
   if (!summary) {
     return {
       stdout: "",
@@ -2737,20 +3998,20 @@ function explainCommand(args, deps) {
 }
 
 // src/commands/policy.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 function policyCommand(args, deps) {
   const sub = args.positionals[0];
   if (sub === "init") {
-    const path = join6(deps.cwd, "calllint.policy.json");
-    if (existsSync4(path) && !flagBool(args.flags, "force")) {
+    const path = join9(deps.cwd, "calllint.policy.json");
+    if (existsSync6(path) && !flagBool(args.flags, "force")) {
       return {
         stdout: "",
         stderr: `${path} already exists. Use --force to overwrite.`,
         exitCode: EXIT.USAGE
       };
     }
-    writeFileSync2(path, defaultPolicyJson(), "utf8");
+    writeFileSync4(path, defaultPolicyJson(), "utf8");
     return { stdout: `Wrote default policy to ${path}`, exitCode: EXIT.OK };
   }
   if (sub === "explain") {
@@ -2773,7 +4034,7 @@ function policyCommand(args, deps) {
 }
 
 // src/commands/verify.ts
-import { join as join7 } from "node:path";
+import { join as join10 } from "node:path";
 function loadPolicy(args) {
   try {
     return loadPolicyOrDefault(flagStr(args.flags, "policy"));
@@ -2782,7 +4043,7 @@ function loadPolicy(args) {
   }
 }
 function baselinePathFor(args, cwd) {
-  return flagStr(args.flags, "baseline") ?? join7(cwd, ".calllint", "baseline.json");
+  return flagStr(args.flags, "baseline") ?? join10(cwd, ".calllint", "baseline.json");
 }
 function baselineCommand(args, deps) {
   const policy = loadPolicy(args);
@@ -2821,6 +4082,9 @@ function baselineCommand(args, deps) {
   };
 }
 function verifyCommand(args, deps) {
+  if (flagBool(args.flags, "approved")) {
+    return verifyApprovedMode(args, deps);
+  }
   const policy = loadPolicy(args);
   if ("error" in policy) return { stdout: "", stderr: policy.error, exitCode: EXIT.ERROR };
   const path = baselinePathFor(args, deps.cwd);
@@ -2852,6 +4116,57 @@ function verifyCommand(args, deps) {
   const exitCode = flagBool(args.flags, "ci") && drift.drifted ? EXIT.DRIFT : EXIT.OK;
   return { stdout, exitCode };
 }
+function approvedPathFor(args, cwd) {
+  const flag = flagStr(args.flags, "approved");
+  return typeof flag === "string" && flag.length > 0 ? flag : defaultApprovedPath(cwd);
+}
+function verifyApprovedMode(args, deps) {
+  const path = approvedPathFor(args, deps.cwd);
+  const approved = readApproved(path);
+  if (!approved) {
+    return {
+      stdout: "",
+      stderr: `No approved state found at ${path}. Run \`calllint approve\` first.`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  const current = decideRepoSurfaces(deps.cwd, {
+    now: deps.now ?? (Date.parse(deps.generatedAt) || 0),
+    generatedAt: deps.generatedAt
+  });
+  const drift = verifyApproved(current, approved, deps.generatedAt);
+  const stdout = flagBool(args.flags, "json") ? renderApprovedDriftJson(drift) : renderApprovedDrift(drift);
+  const exitCode = flagBool(args.flags, "ci") && drift.drifted ? EXIT.DRIFT : EXIT.OK;
+  return { stdout, exitCode };
+}
+
+// src/commands/approve.ts
+function approvedPathFor2(args, cwd) {
+  return flagStr(args.flags, "approved") ?? defaultApprovedPath(cwd);
+}
+function approveCommand(args, deps) {
+  const decisions = decideRepoSurfaces(deps.cwd, {
+    now: deps.now,
+    generatedAt: deps.generatedAt
+  });
+  const state = buildApproved(decisions, deps.generatedAt);
+  const path = approvedPathFor2(args, deps.cwd);
+  if (deps.writeFile !== false) {
+    try {
+      writeApproved(state, path);
+    } catch (err) {
+      return { stdout: "", stderr: `Could not write approved state: ${String(err)}`, exitCode: EXIT.ERROR };
+    }
+  }
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(state, null, 2), exitCode: EXIT.OK };
+  }
+  const n = state.approved.length;
+  return {
+    stdout: `Approved ${n} surface${n === 1 ? "" : "s"} \u2192 ${path}`,
+    exitCode: EXIT.OK
+  };
+}
 
 // src/run.ts
 function run(argv, deps) {
@@ -2861,6 +4176,19 @@ function run(argv, deps) {
     return helpCommand();
   }
   switch (cmd) {
+    case "check":
+      return checkCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt
+      });
+    case "scan-all":
+      return scanAllCommand(args, {
+        cwd: deps.cwd,
+        now: deps.now,
+        generatedAt: deps.generatedAt
+      });
     case "scan":
       return scanCommand(args, {
         cwd: deps.cwd,
@@ -2868,7 +4196,8 @@ function run(argv, deps) {
         now: deps.now,
         generatedAt: deps.generatedAt,
         writeCacheFile: deps.writeCacheFile,
-        online: deps.online
+        online: deps.online,
+        getChangedFilesDiff: deps.getChangedFilesDiff
       });
     case "diagnostics":
       return diagnosticsCommand(args, {
@@ -2890,12 +4219,22 @@ function run(argv, deps) {
       return verifyCommand(args, {
         cwd: deps.cwd,
         readStdin: deps.readStdin,
+        now: deps.now,
         generatedAt: deps.generatedAt,
         writeBaselineFile: deps.writeCacheFile,
         online: deps.online
       });
+    case "approve":
+      return approveCommand(args, {
+        cwd: deps.cwd,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeFile: deps.writeCacheFile
+      });
     case "explain":
       return explainCommand(args, { cwd: deps.cwd });
+    case "gen-rule":
+      return genRuleCommand(args, { cwd: deps.cwd });
     case "policy":
       return policyCommand(args, { cwd: deps.cwd });
     default:
@@ -3112,6 +4451,7 @@ function shouldBreathe(argv, deps = {}) {
   const { flags } = parseArgs(argv);
   if (flagBool(flags, "json")) return false;
   if (flagBool(flags, "sarif")) return false;
+  if (flagBool(flags, "markdown")) return false;
   if (flagBool(flags, "html")) return false;
   if (flagBool(flags, "compact")) return false;
   if (flagBool(flags, "no-color")) return false;
@@ -3141,7 +4481,18 @@ async function breathe(argv, deps = {}) {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync5(0, "utf8");
+    return readFileSync8(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function gitChangedFiles(cwd) {
+  try {
+    return execFileSync("git", ["diff", "--name-only", "HEAD"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
   } catch {
     return "";
   }
@@ -3178,7 +4529,8 @@ async function main() {
     readStdin,
     now,
     generatedAt,
-    online
+    online,
+    getChangedFilesDiff: () => gitChangedFiles(process.cwd())
   });
   if (result.stdout) process.stdout.write(result.stdout + "\n");
   if (result.stderr) process.stderr.write(result.stderr + "\n");