calllint 1.0.1 → 1.1.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { execFileSync } from "node:child_process";
 
 // src/args.ts
@@ -58,16 +58,23 @@ USAGE
 
 COMMANDS
   check [target]     Compact safety decision for an MCP config or install snippet
+  inventory          List all discovered agent configs (auto-discovery, no scan)
   scan-all           Scan every agent-tool surface in the repo (compact table)
   explain <server>   Explain the verdict for one server from the last scan
   verify [target]    Compare a fresh scan against the baseline (drift / rug-pull)
 
   Advanced:
   scan [target]      Full ScanReport for an MCP config / npm:<pkg> / github:<repo>
+  scan --auto        Discover and scan all agent configs (auto-discovery)
+  scan --agent <type>  Discover and scan a specific agent (cursor, claude-code, claude-desktop, vscode, windsurf)
+  action inspect <f>    Preflight a planned external action (calllint.action.v0)
+  inbox inspect <f>     Preflight a normalized agent inbox event
   diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
   approve            Record the repo-wide capability surface as approved state (L4)
-  receipt verify <f>    Structurally validate a local calllint.receipt.v0 file
+  receipt verify <f>    Validate a calllint.receipt.v0 (structure + signature if present)
+  receipt sign <f>      Sign a receipt with a local key (--key; development/testing)
+  receipt keygen        Generate a local ed25519 keypair (--out; development/testing)
   gen-rule --host <h>   Emit the CallLint agent-safety rule for a host (CLAUDE.md, etc.)
   policy init        Write a default calllint.policy.json
   policy explain     Show the effective policy
@@ -85,6 +92,8 @@ TARGETS
   github:<owner/repo>[@ref]   A GitHub repo (requires --online)
 
 SCAN OPTIONS
+  --auto             Discover and scan all agent configs (P0+P1: Cursor, Claude Code, Claude Desktop, VS Code, Windsurf)
+  --agent <type>     Discover and scan a specific agent type
   --changed          Scan only the agent-tool configs changed in the git diff
   --json             Emit the ScanReport JSON (stable, emoji-free)
   --compact          One line per server
@@ -93,7 +102,7 @@ SCAN OPTIONS
   --markdown         Emit Markdown for PR comments / GitHub Step Summary
   --html             Emit a self-contained HTML report
   --badge            Emit a shields.io endpoint badge JSON (SAFE/REVIEW/UNKNOWN/BLOCK)
-  --receipt          Also write a local calllint.receipt.v0 (offline reporting layer)
+  --receipt          Generate a cryptographically-verifiable audit receipt (for CI/compliance)
   --receipt-out <f>  Receipt output path (default: calllint-receipt.json)
   --policy <file>    Use a policy file (default: built-in defaults)
   --stdin            Read config JSON from stdin
@@ -108,6 +117,9 @@ VERIFY OPTIONS
   --json             Emit the drift report JSON
 
 EXAMPLES
+  calllint inventory                    # List discovered agent configs
+  calllint scan --auto                  # Discover and scan all agents
+  calllint scan --agent cursor          # Scan only Cursor configs
   calllint check .cursor/mcp.json
   calllint check npm:mcp-weather@1.0.0
   echo "npx -y demo-mcp@1.2.3" | calllint check --stdin
@@ -115,7 +127,10 @@ EXAMPLES
   calllint check ./mcp.json --json
   calllint scan .cursor/mcp.json --markdown
   calllint scan .cursor/mcp.json --badge > calllint-badge.json
-  calllint scan .cursor/mcp.json --receipt && calllint receipt verify calllint-receipt.json
+  calllint scan .cursor/mcp.json --receipt  # Generate audit receipt
+  calllint receipt verify calllint-receipt.json  # Verify receipt integrity
+  calllint action inspect payment.json
+  calllint inbox inspect gmail-reply.normalized.json
   calllint verify ./mcp.json --ci
   calllint approve && calllint verify --approved --ci
   calllint explain filesystem
@@ -125,7 +140,7 @@ function helpCommand() {
 }
 
 // src/commands/scan.ts
-import { join as join6, resolve as resolve2 } from "node:path";
+import { join as join11, resolve as resolve3 } from "node:path";
 
 // ../../packages/policy/src/defaultPolicy.ts
 function defaultPolicy() {
@@ -3883,11 +3898,437 @@ function readDocumentSurfaces(dir) {
 }
 
 // src/commands/scan.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "node:fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
+
+// ../../packages/discovery/src/registry.ts
+var ExtractorRegistry = class {
+  extractors = /* @__PURE__ */ new Map();
+  /**
+   * Register an agent extractor.
+   */
+  register(extractor) {
+    if (this.extractors.has(extractor.agentType)) {
+      throw new Error(`Extractor already registered for agent type: ${extractor.agentType}`);
+    }
+    this.extractors.set(extractor.agentType, extractor);
+  }
+  /**
+   * Get extractor for a specific agent type.
+   */
+  get(agentType) {
+    return this.extractors.get(agentType);
+  }
+  /**
+   * Get all registered extractors.
+   */
+  getAll() {
+    return Array.from(this.extractors.values());
+  }
+  /**
+   * Get extractors filtered by agent types.
+   */
+  getByTypes(agentTypes) {
+    return agentTypes.map((type) => this.extractors.get(type)).filter((e) => e !== void 0);
+  }
+  /**
+   * Get extractors filtered by priority tier.
+   */
+  getByPriority(priority) {
+    return this.getAll().filter((e) => e.priority === priority);
+  }
+  /**
+   * Get all extractors sorted by priority (P0 first, P3 last).
+   */
+  getAllSortedByPriority() {
+    const priorityOrder = {
+      P0: 0,
+      P1: 1,
+      P2: 2,
+      P3: 3
+    };
+    return this.getAll().sort((a, b) => {
+      return priorityOrder[a.priority] - priorityOrder[b.priority];
+    });
+  }
+  /**
+   * Clear all registered extractors (for testing).
+   */
+  clear() {
+    this.extractors.clear();
+  }
+};
+var registry = new ExtractorRegistry();
+
+// ../../packages/discovery/src/extractors/base.ts
+var BaseAgentExtractor = class {
+  /**
+   * Resolve home directory (~) to absolute path.
+   */
+  resolveHome() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home) {
+      throw new Error("Could not resolve home directory (HOME/USERPROFILE not set)");
+    }
+    return home;
+  }
+  /**
+   * Get platform-specific application data directory.
+   *
+   * Windows: %APPDATA% (Roaming)
+   * macOS: ~/Library/Application Support
+   * Linux: ~/.config (XDG_CONFIG_HOME or default)
+   */
+  getAppDataDir() {
+    const platform = process.platform;
+    if (platform === "win32") {
+      const appData = process.env.APPDATA;
+      if (!appData) {
+        throw new Error("Could not resolve APPDATA directory on Windows");
+      }
+      return appData;
+    }
+    if (platform === "darwin") {
+      return `${this.resolveHome()}/Library/Application Support`;
+    }
+    return process.env.XDG_CONFIG_HOME || `${this.resolveHome()}/.config`;
+  }
+};
+
+// ../../packages/discovery/src/path-resolver.ts
+import { resolve as resolve2, join as join6, isAbsolute } from "node:path";
+import { existsSync as existsSync6, statSync as statSync3 } from "node:fs";
+function resolvePath(path, cwd) {
+  if (path.startsWith("~/") || path === "~") {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home) {
+      throw new Error("Could not resolve home directory (HOME/USERPROFILE not set)");
+    }
+    return join6(home, path.slice(2));
+  }
+  if (isAbsolute(path)) {
+    return path;
+  }
+  return resolve2(cwd, path);
+}
+function isRegularFile(path) {
+  try {
+    if (!existsSync6(path)) {
+      return false;
+    }
+    const stats = statSync3(path);
+    return stats.isFile();
+  } catch {
+    return false;
+  }
+}
+function isReasonableSize(path) {
+  try {
+    const stats = statSync3(path);
+    const maxSize = 10 * 1024 * 1024;
+    return stats.size < maxSize;
+  } catch {
+    return false;
+  }
+}
+function validateConfigPath(path) {
+  return isRegularFile(path) && isReasonableSize(path);
+}
+
+// ../../packages/discovery/src/extractors/cursor.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+var CursorExtractor = class extends BaseAgentExtractor {
+  agentType = "cursor";
+  priority = "P0";
+  discover(cwd) {
+    const configs = [];
+    const projectPath = resolvePath(".cursor/mcp.json", cwd);
+    configs.push(this.createConfig(projectPath));
+    try {
+      const home = this.resolveHome();
+      const userPath = resolvePath(".cursor/mcp.json", home);
+      if (userPath !== projectPath) {
+        configs.push(this.createConfig(userPath));
+      }
+    } catch {
+    }
+    return configs;
+  }
+  createConfig(configPath) {
+    const exists = this.isValidConfig(configPath);
+    return {
+      agentType: this.agentType,
+      configPath,
+      exists,
+      kind: "cursor-mcp-config",
+      priority: this.priority
+    };
+  }
+  /**
+   * Check if path is a valid Cursor config.
+   * Must exist, be regular file, reasonable size, and contain mcpServers key.
+   */
+  isValidConfig(path) {
+    if (!validateConfigPath(path)) {
+      return false;
+    }
+    try {
+      const content = readFileSync7(path, "utf8");
+      const json = JSON.parse(content);
+      return typeof json === "object" && json !== null && "mcpServers" in json;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// ../../packages/discovery/src/extractors/claude-code.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+import { join as join7 } from "node:path";
+var ClaudeCodeExtractor = class extends BaseAgentExtractor {
+  agentType = "claude-code";
+  priority = "P0";
+  discover(cwd) {
+    const configs = [];
+    const projectPath = resolvePath(".claude/settings.json", cwd);
+    configs.push(this.createConfig(projectPath));
+    try {
+      const userPath = this.getUserSettingsPath();
+      if (userPath !== projectPath) {
+        configs.push(this.createConfig(userPath));
+      }
+    } catch {
+    }
+    return configs;
+  }
+  getUserSettingsPath() {
+    const appDataDir = this.getAppDataDir();
+    return join7(appDataDir, "Claude", "settings.json");
+  }
+  createConfig(configPath) {
+    const exists = this.isValidConfig(configPath);
+    return {
+      agentType: this.agentType,
+      configPath,
+      exists,
+      kind: "claude-settings",
+      priority: this.priority
+    };
+  }
+  /**
+   * Check if path is a valid Claude Code config.
+   * Must exist, be regular file, reasonable size, and contain mcpServers key.
+   */
+  isValidConfig(path) {
+    if (!validateConfigPath(path)) {
+      return false;
+    }
+    try {
+      const content = readFileSync8(path, "utf8");
+      const json = JSON.parse(content);
+      return typeof json === "object" && json !== null && "mcpServers" in json;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// ../../packages/discovery/src/extractors/claude-desktop.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+var ClaudeDesktopExtractor = class extends BaseAgentExtractor {
+  agentType = "claude-desktop";
+  priority = "P0";
+  discover(_cwd) {
+    const configs = [];
+    try {
+      const userPath = this.getUserConfigPath();
+      configs.push(this.createConfig(userPath));
+    } catch {
+    }
+    return configs;
+  }
+  getUserConfigPath() {
+    const appDataDir = this.getAppDataDir();
+    return join8(appDataDir, "Claude", "claude_desktop_config.json");
+  }
+  createConfig(configPath) {
+    const exists = this.isValidConfig(configPath);
+    return {
+      agentType: this.agentType,
+      configPath,
+      exists,
+      kind: "claude-settings",
+      priority: this.priority
+    };
+  }
+  /**
+   * Check if path is a valid Claude Desktop config.
+   * Must exist, be regular file, reasonable size, and contain mcpServers key.
+   */
+  isValidConfig(path) {
+    if (!validateConfigPath(path)) {
+      return false;
+    }
+    try {
+      const content = readFileSync9(path, "utf8");
+      const json = JSON.parse(content);
+      return typeof json === "object" && json !== null && "mcpServers" in json;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// ../../packages/discovery/src/extractors/vscode.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+import { join as join9 } from "node:path";
+var VSCodeExtractor = class extends BaseAgentExtractor {
+  agentType = "vscode";
+  priority = "P1";
+  discover(cwd) {
+    const configs = [];
+    try {
+      const userPath = this.getUserConfigPath();
+      configs.push(this.createConfig(userPath));
+    } catch {
+    }
+    return configs;
+  }
+  getUserConfigPath() {
+    const appDataDir = this.getAppDataDir();
+    return join9(appDataDir, "Code", "User", "mcp.json");
+  }
+  createConfig(configPath) {
+    const exists = this.isValidConfig(configPath);
+    return {
+      agentType: this.agentType,
+      configPath,
+      exists,
+      kind: "vscode-mcp-config",
+      priority: this.priority
+    };
+  }
+  /**
+   * Check if path is a valid VS Code MCP config.
+   * Must exist, be regular file, reasonable size, and contain mcpServers key.
+   */
+  isValidConfig(path) {
+    if (!validateConfigPath(path)) {
+      return false;
+    }
+    try {
+      const content = readFileSync10(path, "utf8");
+      const json = JSON.parse(content);
+      return typeof json === "object" && json !== null && "mcpServers" in json && json.mcpServers !== null;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// ../../packages/discovery/src/extractors/windsurf.ts
+import { readFileSync as readFileSync11 } from "node:fs";
+import { join as join10 } from "node:path";
+var WindsurfExtractor = class extends BaseAgentExtractor {
+  agentType = "windsurf";
+  priority = "P1";
+  discover(cwd) {
+    const configs = [];
+    try {
+      const userPath = this.getUserConfigPath();
+      configs.push(this.createConfig(userPath));
+    } catch {
+    }
+    return configs;
+  }
+  getUserConfigPath() {
+    const appDataDir = this.getAppDataDir();
+    return join10(appDataDir, "Windsurf", "mcp.json");
+  }
+  createConfig(configPath) {
+    const exists = this.isValidConfig(configPath);
+    return {
+      agentType: this.agentType,
+      configPath,
+      exists,
+      kind: "windsurf-mcp-config",
+      priority: this.priority
+    };
+  }
+  /**
+   * Check if path is a valid Windsurf MCP config.
+   * Must exist, be regular file, reasonable size, and contain mcpServers key.
+   */
+  isValidConfig(path) {
+    if (!validateConfigPath(path)) {
+      return false;
+    }
+    try {
+      const content = readFileSync11(path, "utf8");
+      const json = JSON.parse(content);
+      return typeof json === "object" && json !== null && "mcpServers" in json && json.mcpServers !== null;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// ../../packages/discovery/src/bootstrap.ts
+function bootstrapExtractors() {
+  registry.register(new CursorExtractor());
+  registry.register(new ClaudeCodeExtractor());
+  registry.register(new ClaudeDesktopExtractor());
+  registry.register(new VSCodeExtractor());
+  registry.register(new WindsurfExtractor());
+}
+bootstrapExtractors();
+
+// ../../packages/discovery/src/discovery-engine.ts
+function discoverConfigs(options) {
+  const { cwd, agentTypes, includeMissing = false } = options;
+  const extractors = agentTypes ? registry.getByTypes(agentTypes) : registry.getAllSortedByPriority();
+  const results = extractors.map((extractor) => {
+    try {
+      return extractor.discover(cwd);
+    } catch (error) {
+      console.error(`[discovery] Extractor ${extractor.agentType} failed:`, error);
+      return [];
+    }
+  });
+  const allDiscovered = results.flat();
+  const discovered = includeMissing ? allDiscovered : allDiscovered.filter((config) => config.exists);
+  const searchedPaths = allDiscovered.map((config) => config.configPath);
+  return {
+    cwd,
+    discovered,
+    searchedPaths
+  };
+}
+function discoverAgent(agentType, options) {
+  const extractor = registry.get(agentType);
+  if (!extractor) {
+    throw new Error(`Unknown agent type: ${agentType}`);
+  }
+  try {
+    return extractor.discover(options.cwd);
+  } catch (error) {
+    console.error(`[discovery] Failed to discover ${agentType}:`, error);
+    return [];
+  }
+}
+
+// src/commands/scan.ts
 function scanCommand(args, deps) {
   if (flagBool(args.flags, "changed")) {
     return scanChangedCommand(args, deps);
   }
+  if (flagBool(args.flags, "auto")) {
+    return scanAutoCommand(args, deps);
+  }
+  const agentType = flagStr(args.flags, "agent");
+  if (agentType) {
+    return scanAgentCommand(agentType, args, deps);
+  }
   const policyPath = flagStr(args.flags, "policy");
   let policy;
   try {
@@ -3908,7 +4349,7 @@ function scanCommand(args, deps) {
 }
 function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true) {
   const surfaceDir = flagStr(args.flags, "surface-dir");
-  const surfaces = surfaceDir ? readDocumentSurfaces(resolve2(deps.cwd, surfaceDir)) : void 0;
+  const surfaces = surfaceDir ? readDocumentSurfaces(resolve3(deps.cwd, surfaceDir)) : void 0;
   let summary;
   try {
     summary = scanConfigText(text, configPath, {
@@ -3930,7 +4371,7 @@ function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true
   }
   if (deps.writeCacheFile !== false) {
     try {
-      writeCache(summary, join6(deps.cwd, ".calllint", "last-scan.json"));
+      writeCache(summary, join11(deps.cwd, ".calllint", "last-scan.json"));
     } catch {
     }
   }
@@ -3956,7 +4397,7 @@ function writeReceiptFile(summary, text, configPath, policy, args, deps) {
     },
     deps.generatedAt
   );
-  const outPath = resolve2(
+  const outPath = resolve3(
     deps.cwd,
     flagStr(args.flags, "receipt-out") ?? "calllint-receipt.json"
   );
@@ -4004,7 +4445,7 @@ function scanChangedCommand(args, deps) {
     };
   }
   const results = paths.map((p) => {
-    const text = readFileSync7(p, "utf8");
+    const text = readFileSync12(p, "utf8");
     return scanOneConfig(text, p, policy, args, deps);
   });
   const exitCode = results.reduce((worst, r) => Math.max(worst, r.exitCode), EXIT.OK);
@@ -4017,6 +4458,95 @@ function scanChangedCommand(args, deps) {
   const stderr = results.map((r) => r.stderr).filter(Boolean).join("\n");
   return { stdout, exitCode, ...stderr ? { stderr } : {} };
 }
+function scanAutoCommand(args, deps) {
+  const policyPath = flagStr(args.flags, "policy");
+  let policy;
+  try {
+    policy = loadPolicyOrDefault(policyPath);
+  } catch (err2) {
+    return {
+      stdout: "",
+      stderr: err2 instanceof Error ? err2.message : String(err2),
+      exitCode: EXIT.ERROR
+    };
+  }
+  const discovered = discoverConfigs({ cwd: deps.cwd });
+  if (discovered.discovered.length === 0) {
+    return {
+      stdout: "",
+      stderr: "No agent configs discovered. Try: calllint inventory\n",
+      exitCode: EXIT.ERROR
+    };
+  }
+  const results = [];
+  for (const config of discovered.discovered) {
+    let text;
+    try {
+      text = readFileSync12(config.configPath, "utf8");
+    } catch (err2) {
+      results.push({
+        stdout: "",
+        stderr: `Could not read ${config.configPath}: ${err2 instanceof Error ? err2.message : String(err2)}`,
+        exitCode: EXIT.ERROR
+      });
+      continue;
+    }
+    const result = scanOneConfig(text, config.configPath, policy, args, deps, false);
+    results.push(result);
+  }
+  const isJson = flagBool(args.flags, "json");
+  const stdout = isJson ? JSON.stringify(results.map((r) => JSON.parse(r.stdout)), null, 2) + "\n" : results.map((r) => r.stdout).join("\n---\n\n");
+  const exitCode = flagBool(args.flags, "ci") ? Math.max(...results.map((r) => r.exitCode)) : EXIT.OK;
+  const stderr = results.map((r) => r.stderr).filter(Boolean).join("\n");
+  return { stdout, exitCode, ...stderr ? { stderr } : {} };
+}
+function scanAgentCommand(agentType, args, deps) {
+  const policyPath = flagStr(args.flags, "policy");
+  let policy;
+  try {
+    policy = loadPolicyOrDefault(policyPath);
+  } catch (err2) {
+    return {
+      stdout: "",
+      stderr: err2 instanceof Error ? err2.message : String(err2),
+      exitCode: EXIT.ERROR
+    };
+  }
+  const discovered = discoverAgent(agentType, { cwd: deps.cwd });
+  const existing = discovered.filter((c) => c.exists);
+  if (existing.length === 0) {
+    return {
+      stdout: "",
+      stderr: `No config found for agent '${agentType}'. Try: calllint inventory
+`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  const results = [];
+  for (const config of existing) {
+    let text;
+    try {
+      text = readFileSync12(config.configPath, "utf8");
+    } catch (err2) {
+      results.push({
+        stdout: "",
+        stderr: `Could not read ${config.configPath}: ${err2 instanceof Error ? err2.message : String(err2)}`,
+        exitCode: EXIT.ERROR
+      });
+      continue;
+    }
+    const result = scanOneConfig(text, config.configPath, policy, args, deps, true);
+    results.push(result);
+  }
+  if (results.length === 1) {
+    return results[0];
+  }
+  const isJson = flagBool(args.flags, "json");
+  const stdout = isJson ? JSON.stringify(results.map((r) => JSON.parse(r.stdout)), null, 2) + "\n" : results.map((r) => r.stdout).join("\n---\n\n");
+  const exitCode = flagBool(args.flags, "ci") ? Math.max(...results.map((r) => r.exitCode)) : EXIT.OK;
+  const stderr = results.map((r) => r.stderr).filter(Boolean).join("\n");
+  return { stdout, exitCode, ...stderr ? { stderr } : {} };
+}
 
 // src/commands/check.ts
 function checkCommand(args, deps) {
@@ -4106,7 +4636,7 @@ function worstExit2(decisions) {
 
 // src/commands/genRule.ts
 import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname3, join as join7, resolve as resolve3 } from "node:path";
+import { dirname as dirname3, join as join12, resolve as resolve4 } from "node:path";
 function isRuleHost(v) {
   return v !== void 0 && RULE_HOSTS.includes(v);
 }
@@ -4137,7 +4667,7 @@ Run \`calllint gen-rule\` to list hosts.`,
     return { stdout: content, exitCode: EXIT.OK };
   }
   const rel = flagStr(args.flags, "out") ?? RULE_TARGETS[host].path;
-  const abs = resolve3(deps.cwd, rel);
+  const abs = resolve4(deps.cwd, rel);
   const write = deps.writeFile ?? defaultWrite;
   try {
     write(abs, content);
@@ -4203,7 +4733,7 @@ function diagnosticsCommand(args, deps) {
 }
 
 // src/commands/explain.ts
-import { join as join8 } from "node:path";
+import { join as join13 } from "node:path";
 function explainCommand(args, deps) {
   const serverName = args.positionals[0];
   if (!serverName) {
@@ -4213,7 +4743,7 @@ function explainCommand(args, deps) {
       exitCode: EXIT.USAGE
     };
   }
-  const summary = readCache(join8(deps.cwd, ".calllint", "last-scan.json"));
+  const summary = readCache(join13(deps.cwd, ".calllint", "last-scan.json"));
   if (!summary) {
     return {
       stdout: "",
@@ -4235,13 +4765,13 @@ function explainCommand(args, deps) {
 }
 
 // src/commands/policy.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join14 } from "node:path";
 function policyCommand(args, deps) {
   const sub = args.positionals[0];
   if (sub === "init") {
-    const path = join9(deps.cwd, "calllint.policy.json");
-    if (existsSync6(path) && !flagBool(args.flags, "force")) {
+    const path = join14(deps.cwd, "calllint.policy.json");
+    if (existsSync9(path) && !flagBool(args.flags, "force")) {
       return {
         stdout: "",
         stderr: `${path} already exists. Use --force to overwrite.`,
@@ -4271,7 +4801,7 @@ function policyCommand(args, deps) {
 }
 
 // src/commands/verify.ts
-import { join as join10 } from "node:path";
+import { join as join15 } from "node:path";
 function loadPolicy(args) {
   try {
     return loadPolicyOrDefault(flagStr(args.flags, "policy"));
@@ -4280,7 +4810,7 @@ function loadPolicy(args) {
   }
 }
 function baselinePathFor(args, cwd) {
-  return flagStr(args.flags, "baseline") ?? join10(cwd, ".calllint", "baseline.json");
+  return flagStr(args.flags, "baseline") ?? join15(cwd, ".calllint", "baseline.json");
 }
 function baselineCommand(args, deps) {
   const policy = loadPolicy(args);
@@ -4406,8 +4936,8 @@ function approveCommand(args, deps) {
 }
 
 // src/commands/receipt.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 
 // ../../packages/signature/src/ed25519.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -5016,7 +5546,7 @@ function receiptVerify(args, deps) {
   }
   let raw;
   try {
-    raw = readFileSync8(resolve4(deps.cwd, file), "utf8");
+    raw = readFileSync13(resolve5(deps.cwd, file), "utf8");
   } catch (e) {
     return {
       stdout: "",
@@ -5069,6 +5599,43 @@ function receiptVerify(args, deps) {
       exitCode: EXIT.OK
     };
   }
+  if (flagBool(args.flags, "verbose")) {
+    const stdout2 = [
+      "\u2713 CallLint receipt: valid",
+      "",
+      "Receipt Information:",
+      `  ID: ${receipt.receipt_id}`,
+      `  Schema: ${receipt.schema_version}`,
+      `  Created: ${receipt.created_at}`,
+      "",
+      "Tool:",
+      `  Name: ${receipt.tool.name}`,
+      `  Version: ${receipt.tool.version}`,
+      "",
+      "Subject:",
+      `  Type: ${receipt.subject.type}`,
+      `  Target: ${receipt.subject.target}`,
+      "",
+      `Verdict: ${receipt.verdict}`,
+      "",
+      "Hashes:",
+      `  Input:   ${receipt.hashes.input_hash}`,
+      `  Policy:  ${receipt.hashes.policy_hash}`,
+      `  Report:  ${receipt.hashes.report_hash}`,
+      `  Ruleset: ${receipt.hashes.ruleset_hash}`,
+      "",
+      "Risk Summary:",
+      `  BLOCK:   ${receipt.risk_counts.block ?? 0}`,
+      `  REVIEW:  ${receipt.risk_counts.review ?? 0}`,
+      `  UNKNOWN: ${receipt.risk_counts.unknown ?? 0}`,
+      `  SAFE:    ${receipt.risk_counts.safe ?? 0}`,
+      "",
+      `Network: ${receipt.trust_boundaries.network_used ? "Used" : "Not used"}`,
+      "",
+      "Signature: unsigned local receipt"
+    ].join("\n");
+    return { stdout: stdout2, exitCode: EXIT.OK };
+  }
   const stdout = [
     "\u2713 CallLint receipt: valid",
     `  Receipt ID: ${receipt.receipt_id}`,
@@ -5098,7 +5665,7 @@ function verifySignature(receipt, args, deps) {
   }
   let publicKey;
   try {
-    const keyJson = JSON.parse(readFileSync8(resolve4(deps.cwd, publicKeyFlag), "utf8"));
+    const keyJson = JSON.parse(readFileSync13(resolve5(deps.cwd, publicKeyFlag), "utf8"));
     publicKey = keyJson.public_key;
     if (typeof publicKey !== "string") {
       throw new Error("key file has no string 'public_key' field");
@@ -5143,6 +5710,47 @@ function verifySignature(receipt, args, deps) {
     ];
     return { stdout: "", stderr: lines.join("\n"), exitCode: 1 };
   }
+  if (flagBool(args.flags, "verbose")) {
+    const stdout2 = [
+      "\u2713 CallLint receipt: valid",
+      "",
+      "Receipt Information:",
+      `  ID: ${receipt.receipt_id}`,
+      `  Schema: ${receipt.schema_version}`,
+      `  Created: ${receipt.created_at}`,
+      "",
+      "Tool:",
+      `  Name: ${receipt.tool.name}`,
+      `  Version: ${receipt.tool.version}`,
+      "",
+      "Subject:",
+      `  Type: ${receipt.subject.type}`,
+      `  Target: ${receipt.subject.target}`,
+      "",
+      `Verdict: ${receipt.verdict}`,
+      "",
+      "Hashes:",
+      `  Input:   ${receipt.hashes.input_hash}`,
+      `  Policy:  ${receipt.hashes.policy_hash}`,
+      `  Report:  ${receipt.hashes.report_hash}`,
+      `  Ruleset: ${receipt.hashes.ruleset_hash}`,
+      "",
+      "Risk Summary:",
+      `  BLOCK:   ${receipt.risk_counts.block ?? 0}`,
+      `  REVIEW:  ${receipt.risk_counts.review ?? 0}`,
+      `  UNKNOWN: ${receipt.risk_counts.unknown ?? 0}`,
+      `  SAFE:    ${receipt.risk_counts.safe ?? 0}`,
+      "",
+      `Network: ${receipt.trust_boundaries.network_used ? "Used" : "Not used"}`,
+      "",
+      "Signature:",
+      `  Status: valid`,
+      `  Key ID: ${sig.key_id}`,
+      `  Algorithm: ${sig.algorithm}`,
+      `  Signed at: ${sig.signed_at}`
+    ].join("\n");
+    return { stdout: stdout2, exitCode: EXIT.OK };
+  }
   const stdout = [
     "\u2713 CallLint receipt: valid",
     `  Receipt ID: ${receipt.receipt_id}`,
@@ -5171,7 +5779,7 @@ function receiptSign(args, deps) {
   }
   let unsignedReceipt;
   try {
-    unsignedReceipt = JSON.parse(readFileSync8(resolve4(deps.cwd, receiptFile), "utf8"));
+    unsignedReceipt = JSON.parse(readFileSync13(resolve5(deps.cwd, receiptFile), "utf8"));
   } catch (e) {
     return {
       stdout: "",
@@ -5188,7 +5796,7 @@ function receiptSign(args, deps) {
   }
   let keypair;
   try {
-    const keyJson = JSON.parse(readFileSync8(resolve4(deps.cwd, keyFile), "utf8"));
+    const keyJson = JSON.parse(readFileSync13(resolve5(deps.cwd, keyFile), "utf8"));
     keypair = importKeypair(keyJson);
   } catch (e) {
     return {
@@ -5200,7 +5808,7 @@ function receiptSign(args, deps) {
   try {
     const signature = signReceipt(unsignedReceipt, keypair);
     const signedReceipt = { ...unsignedReceipt, signature };
-    writeFileSync6(resolve4(deps.cwd, outFile), JSON.stringify(signedReceipt, null, 2) + "\n", "utf8");
+    writeFileSync6(resolve5(deps.cwd, outFile), JSON.stringify(signedReceipt, null, 2) + "\n", "utf8");
     const stdout = [
       "\u2713 Receipt signed successfully",
       `  Key ID: ${signature.key_id}`,
@@ -5235,7 +5843,7 @@ function receiptKeygen(args, deps) {
   try {
     const keypair = generateKeypair(keyId);
     const exported = exportKeypair(keypair);
-    writeFileSync6(resolve4(deps.cwd, outFile), JSON.stringify(exported, null, 2) + "\n", "utf8");
+    writeFileSync6(resolve5(deps.cwd, outFile), JSON.stringify(exported, null, 2) + "\n", "utf8");
     const stdout = [
       "\u2713 Keypair generated successfully",
       `  Key ID: ${keyId}`,
@@ -5255,8 +5863,8 @@ function receiptKeygen(args, deps) {
 }
 
 // src/commands/action.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
 
 // ../../packages/action-analyzer/src/types.ts
 var KIND_RISK_PROFILES = {
@@ -5730,8 +6338,8 @@ function actionInspect(args, deps) {
     };
   }
   try {
-    const absolutePath = resolve5(deps.cwd, actionFile);
-    const content = readFileSync9(absolutePath, "utf-8");
+    const absolutePath = resolve6(deps.cwd, actionFile);
+    const content = readFileSync14(absolutePath, "utf-8");
     const descriptor = JSON.parse(content);
     if (descriptor.schema_version !== "calllint.action.v0") {
       return {
@@ -5742,7 +6350,7 @@ Expected: calllint.action.v0`,
       };
     }
     const policyPath = args.flags["policy"];
-    const policy = loadPolicyOrDefault(policyPath ? resolve5(deps.cwd, policyPath) : void 0);
+    const policy = loadPolicyOrDefault(policyPath ? resolve6(deps.cwd, policyPath) : void 0);
     const findings = analyzeAction(descriptor);
     const verdict = computeActionVerdict(findings, policy);
     const actionReport = {
@@ -5869,7 +6477,7 @@ function writeActionReceipt(descriptor, rawContent, actionReport, policy, args,
     },
     deps.generatedAt || (/* @__PURE__ */ new Date()).toISOString()
   );
-  const outPath = resolve5(
+  const outPath = resolve6(
     deps.cwd,
     args.flags["receipt-out"] ?? "calllint-action-receipt.json"
   );
@@ -5882,8 +6490,8 @@ function writeActionReceipt(descriptor, rawContent, actionReport, policy, args,
 }
 
 // src/commands/inbox.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
 function inboxCommand(args, deps) {
   const subcommand = args.positionals[0];
   if (!subcommand || subcommand === "help") {
@@ -5913,8 +6521,8 @@ function inboxInspect(args, deps) {
     };
   }
   try {
-    const absolutePath = resolve6(deps.cwd, eventFile);
-    const content = readFileSync10(absolutePath, "utf-8");
+    const absolutePath = resolve7(deps.cwd, eventFile);
+    const content = readFileSync15(absolutePath, "utf-8");
     const event = JSON.parse(content);
     if (event.schema_version !== "calllint.agent-inbox-event.v0") {
       return {
@@ -5932,7 +6540,7 @@ Expected: calllint.agent-inbox-event.v0`,
       };
     }
     const policyPath = args.flags["policy"];
-    const policy = loadPolicyOrDefault(policyPath ? resolve6(deps.cwd, policyPath) : void 0);
+    const policy = loadPolicyOrDefault(policyPath ? resolve7(deps.cwd, policyPath) : void 0);
     const actionCandidate = event.action_candidate;
     let verdict;
     let findings;
@@ -6080,7 +6688,7 @@ function writeInboxReceipt(event, rawContent, verdict, findings, policy, args, d
       deps.generatedAt || (/* @__PURE__ */ new Date()).toISOString()
     );
     const receiptOutPath = args.flags["receipt-out"] || "calllint-inbox-receipt.json";
-    const absoluteReceiptPath = resolve6(deps.cwd, receiptOutPath);
+    const absoluteReceiptPath = resolve7(deps.cwd, receiptOutPath);
     writeFileSync8(absoluteReceiptPath, JSON.stringify(receipt, null, 2) + "\n", "utf-8");
     return null;
   } catch (error) {
@@ -6135,6 +6743,82 @@ SEE ALSO
 `;
 }
 
+// src/commands/inventory.ts
+function inventoryCommand(args, deps) {
+  try {
+    const result = discoverConfigs({ cwd: deps.cwd });
+    if (args.flags.json) {
+      return {
+        exitCode: 0,
+        stdout: JSON.stringify(result, null, 2) + "\n",
+        stderr: ""
+      };
+    }
+    const lines = [];
+    if (result.discovered.length === 0) {
+      lines.push("No agent configs discovered.");
+      lines.push("");
+      lines.push("Searched agents: Cursor, Claude Code, Claude Desktop");
+      lines.push("To scan a specific config: calllint scan --config <path>");
+    } else {
+      lines.push(`Discovered ${result.discovered.length} agent config(s):`);
+      lines.push("");
+      const byAgent = /* @__PURE__ */ new Map();
+      for (const config of result.discovered) {
+        const existing = byAgent.get(config.agentType) || [];
+        existing.push(config);
+        byAgent.set(config.agentType, existing);
+      }
+      const sortedAgents = Array.from(byAgent.keys()).sort((a, b) => {
+        const priorityA = result.discovered.find((c) => c.agentType === a)?.priority || "P3";
+        const priorityB = result.discovered.find((c) => c.agentType === b)?.priority || "P3";
+        return priorityA.localeCompare(priorityB);
+      });
+      for (const agentType of sortedAgents) {
+        const configs = byAgent.get(agentType);
+        const priority = configs[0].priority;
+        const agentLabel = formatAgentType(agentType);
+        lines.push(`${agentLabel} (${priority}):`);
+        for (const config of configs) {
+          lines.push(`  ${config.configPath}`);
+        }
+        lines.push("");
+      }
+      lines.push(`To scan all: calllint scan --auto`);
+      lines.push(`To scan one: calllint scan --agent ${result.discovered[0].agentType}`);
+    }
+    return {
+      exitCode: 0,
+      stdout: lines.join("\n") + "\n",
+      stderr: ""
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: `Error discovering configs: ${message}
+`
+    };
+  }
+}
+function formatAgentType(agentType) {
+  switch (agentType) {
+    case "cursor":
+      return "Cursor";
+    case "claude-code":
+      return "Claude Code";
+    case "claude-desktop":
+      return "Claude Desktop";
+    case "vscode":
+      return "VS Code";
+    case "windsurf":
+      return "Windsurf";
+    default:
+      return agentType;
+  }
+}
+
 // src/run.ts
 function run(argv, deps) {
   const args = parseArgs(argv);
@@ -6207,6 +6891,8 @@ function run(argv, deps) {
       return actionCommand(args, { cwd: deps.cwd, toolVersion: deps.toolVersion, generatedAt: deps.generatedAt });
     case "inbox":
       return inboxCommand(args, { cwd: deps.cwd, toolVersion: deps.toolVersion, generatedAt: deps.generatedAt });
+    case "inventory":
+      return inventoryCommand(args, { cwd: deps.cwd });
     case "gen-rule":
       return genRuleCommand(args, { cwd: deps.cwd });
     case "policy":
@@ -6480,13 +7166,13 @@ async function breathe(argv, deps = {}) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname4, join as join11 } from "node:path";
+import { dirname as dirname4, join as join16 } from "node:path";
 function resolveToolVersion() {
   try {
-    const pkgPath = join11(dirname4(fileURLToPath(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+    const pkgPath = join16(dirname4(fileURLToPath(import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -6496,7 +7182,7 @@ function resolveToolVersion() {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync12(0, "utf8");
+    return readFileSync17(0, "utf8");
   } catch {
     return "";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",
@@ -51,6 +51,7 @@
   "devDependencies": {
     "@calllint/action-analyzer": "workspace:*",
     "@calllint/core": "workspace:*",
+    "@calllint/discovery": "workspace:*",
     "@calllint/fixtures": "workspace:*",
     "@calllint/online": "workspace:*",
     "@calllint/policy": "workspace:*",