calllint 1.3.0 → 1.5.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { execFileSync } from "node:child_process";
 
 // src/args.ts
@@ -74,6 +74,10 @@ COMMANDS
   diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
   approve            Record the repo-wide capability surface as approved state (L4)
+  guard              Continuous Guard: re-decide on authority change; silent when unchanged
+  guard install --host <h>  Install a guard hook (git pre-commit, github workflow)
+  guard status       Show baseline / disable / installed-hook state
+  guard disable      Turn Continuous Guard off (.calllint/guard.json)
   receipt verify <f>    Validate a calllint.receipt.v0 (structure + signature if present)
   receipt sign <f>      Sign a receipt with a local key (--key; development/testing)
   receipt keygen        Generate a local ed25519 keypair (--out; development/testing)
@@ -106,6 +110,10 @@ SCAN OPTIONS
   --badge            Emit a shields.io endpoint badge JSON (SAFE/REVIEW/UNKNOWN/BLOCK)
   --receipt          Generate a cryptographically-verifiable audit receipt (for CI/compliance)
   --receipt-out <f>  Receipt output path (default: calllint-receipt.json)
+  --evidence <file>  Attach an external scanner report (e.g. SkillSpector JSON/SARIF)
+                     as supporting evidence; shown side-by-side in a joint Trust
+                     Packet. Never re-scored, never changes the CallLint verdict.
+  --evidence-format <fmt>  Force evidence format (json|sarif); default auto-detect
   --policy <file>    Use a policy file (default: built-in defaults)
   --stdin            Read config JSON from stdin
   --ci               Exit non-zero per policy (BLOCK=30, UNKNOWN=20, REVIEW=10 if enabled)
@@ -118,6 +126,13 @@ VERIFY OPTIONS
   --ci               Exit 40 if the surface drifted (from baseline or approved state)
   --json             Emit the drift report JSON
 
+GUARD OPTIONS
+  --host <h>         guard install target: git (pre-commit) | github (workflow)
+  --approved [file]  Approved baseline to diff against (default: .calllint/approved.json)
+  --json             Emit the guard assessment / status JSON
+  (exit) silent/note=0, REVIEW=10, UNKNOWN=20, BLOCK=30; guard self-failure is non-zero
+  (env)  CALLLINT_GUARD=0 disables the guard
+
 EXAMPLES
   calllint inventory                    # List discovered agent configs
   calllint scan --auto                  # Discover and scan all agents
@@ -130,11 +145,14 @@ EXAMPLES
   calllint scan .cursor/mcp.json --markdown
   calllint scan .cursor/mcp.json --badge > calllint-badge.json
   calllint scan .cursor/mcp.json --receipt  # Generate audit receipt
+  calllint scan .cursor/mcp.json --evidence skillspector-report.json  # Joint Trust Packet
   calllint receipt verify calllint-receipt.json  # Verify receipt integrity
   calllint action inspect payment.json
   calllint inbox inspect gmail-reply.normalized.json
   calllint verify ./mcp.json --ci
   calllint approve && calllint verify --approved --ci
+  calllint approve && calllint guard install --host git   # re-decide on every commit
+  calllint guard --json                 # authority-change assessment (silent when unchanged)
   calllint explain filesystem
 `;
 function helpCommand() {
@@ -402,7 +420,10 @@ var REASON_CODES = [
   "PROMPT_METADATA_INSTRUCTION",
   "OAUTH_SCOPE_UNKNOWN_OR_EXPANDED",
   "TOOL_DESCRIPTOR_CHANGED",
-  "LONG_RUNNING_GATEWAY_RUNTIME"
+  "LONG_RUNNING_GATEWAY_RUNTIME",
+  // #13 — appended last (ADR 0044) so the frozen order 0–11 is unchanged. Backed by
+  // the flow object (calllint.flow.v0), not a static detector; see REASON_CODE_META.
+  "TOXIC_FLOW_COMPOSITION"
 ];
 var REASON_CODE_META = {
   UNPINNED_PACKAGE: {
@@ -466,6 +487,16 @@ var REASON_CODE_META = {
     backedBy: ["runtime.gateway"],
     status: "wired",
     label: "Long-running gateway runtime"
+  },
+  TOXIC_FLOW_COMPOSITION: {
+    // Backed by the flow object (calllint.flow.v0, built by the flow-analyzer package),
+    // NOT a static detector Finding. The synthetic backing id keeps every wired code
+    // naming its backing without inventing a new status value. No detector emits this id,
+    // so findingsToReasonCodes never fabricates the code — it is produced only by the
+    // explicit flow-fold step. See ADR 0044 / 0040.
+    backedBy: ["flow:toxic-composition"],
+    status: "wired",
+    label: "Cross-tool toxic-flow composition"
   }
 };
 function reasonCodeForFinding(findingId) {
@@ -486,6 +517,9 @@ var VERDICT_NEXT_ACTION = {
 // ../../packages/types/src/authority.ts
 var AUTHORITY_SCHEMA_VERSION = "calllint.authority.v0";
 
+// ../../packages/types/src/flow.ts
+var FLOW_SCHEMA_VERSION = "calllint.flow.v0";
+
 // ../../packages/types/src/trustDecision.ts
 var DECISION_SCHEMA_VERSION = "calllint.decision.v0";
 
@@ -619,11 +653,13 @@ function evidenceFloor(evidence) {
 function decideOverAuthority(input) {
   const { authority, policy } = input;
   const evidence = input.evidence ?? [];
-  const reasons = authority.capabilities.map((c) => {
+  const capabilityReasons = authority.capabilities.map((c) => {
     const code = reasonCodeFor(c);
     const contributes = moreSevere(baseVerdict(c), policyFloor(code, policy));
     return { code, evidenceSource: c.evidenceSource, contributes };
   });
+  const flowReasons = input.flowReasons ?? [];
+  const reasons = [...capabilityReasons, ...flowReasons];
   const unknowns = [...authority.unknowns];
   const contributions = reasons.map((r) => r.contributes);
   if (authority.subject.artifactDigest === null) {
@@ -682,7 +718,8 @@ function resolveScanOptions(opts) {
     now: opts?.now ?? 0,
     generatedAt: opts?.generatedAt ?? "1970-01-01T00:00:00.000Z",
     extraFindings: opts?.extraFindings ?? {},
-    surfaces: opts?.surfaces ?? []
+    surfaces: opts?.surfaces ?? [],
+    evidence: opts?.evidence ?? []
   };
 }
 
@@ -1857,6 +1894,21 @@ function analyzeDocumentSurfaces(surfaces) {
   ];
 }
 
+// ../../packages/static-analyzer/src/trustSource.ts
+function classifyTrustSource(cap) {
+  if (cap.action === "read" && cap.resource === "secret") return "sensitive.secret";
+  if (cap.action === "execute" && cap.resource === "process" && cap.evidenceSource === "server.command") {
+    return "trusted.local_project";
+  }
+  return "unknown";
+}
+function withTrustSource(caps) {
+  return caps.map((c) => {
+    const ts = classifyTrustSource(c);
+    return ts === "unknown" ? { ...c } : { ...c, trustSource: ts };
+  });
+}
+
 // ../../packages/static-analyzer/src/instructionAuthority.ts
 var RULES = [
   // 1. privilege-escalation → execute × process (irreversible, must be approved)
@@ -2062,7 +2114,7 @@ function extractInstructionAuthority(surfaces) {
       }
     }
   }
-  return sortCapabilities([...seen.values()]);
+  return withTrustSource(sortCapabilities([...seen.values()]));
 }
 function sortCapabilities(caps) {
   return caps.sort((a, b) => {
@@ -2149,7 +2201,7 @@ function deriveConfigCapabilities(server) {
       completeness: "complete"
     });
   }
-  return sortCapabilities(caps);
+  return sortCapabilities(withTrustSource(caps));
 }
 
 // ../../packages/risk-engine/src/computeRiskClass.ts
@@ -2670,7 +2722,7 @@ function enrichEvidencePositions(reports, positions) {
 }
 
 // ../../packages/core/src/scanConfig.ts
-function aggregate(configPath, reports, generatedAt) {
+function aggregate(configPath, reports, generatedAt, evidence) {
   const counts = { SAFE: 0, REVIEW: 0, BLOCK: 0, UNKNOWN: 0 };
   for (const r of reports) counts[r.verdict]++;
   const verdict = reports.length === 0 ? "UNKNOWN" : mostSevereVerdict(reports.map((r) => r.verdict));
@@ -2683,18 +2735,23 @@ function aggregate(configPath, reports, generatedAt) {
     counts,
     reports,
     diagnostics: [],
-    generatedAt
+    generatedAt,
+    // Additive projection (ADR 0034). Attached only when the CLI imported evidence
+    // via `scan --evidence`; omitted otherwise so default scan output is
+    // byte-identical (the offline corpus never attaches evidence). Never re-scored:
+    // the `verdict` above is unaffected by these findings.
+    ...evidence.length > 0 ? { evidence } : {}
   };
 }
 function scanParsed(parsed, opts) {
-  const { generatedAt, surfaces } = resolveScanOptions(opts);
+  const { generatedAt, surfaces, evidence } = resolveScanOptions(opts);
   const reports = parsed.servers.map(
     (server) => scanServer({ server, targetKind: parsed.kind }, opts)
   );
   enrichEvidencePositions(reports, parsed.positions);
   const surfaceReport = scanDocumentSurfaces(surfaces, parsed.configPath, generatedAt);
   if (surfaceReport) reports.push(surfaceReport);
-  return aggregate(parsed.configPath, reports, generatedAt);
+  return aggregate(parsed.configPath, reports, generatedAt, evidence);
 }
 function scanConfigText(text, configPath, opts) {
   return scanParsed(parseConfigText(text, configPath), opts);
@@ -3355,6 +3412,60 @@ function escalate(current) {
   return current === "BLOCK" || current === "UNKNOWN" ? current : "REVIEW";
 }
 
+// ../../packages/core/src/state/continuousGuard.ts
+function assessGuardDrift(report) {
+  if (!report.drifted) {
+    return {
+      action: "silent",
+      verdict: "SAFE",
+      drifted: false,
+      summary: "No authority change since the approved baseline."
+    };
+  }
+  const changed = report.entries.filter((e) => e.status !== "unchanged");
+  const n = changed.length;
+  const surfaces = `${n} surface${n === 1 ? "" : "s"}`;
+  switch (report.verdict) {
+    case "BLOCK":
+      return {
+        action: "refuse",
+        verdict: "BLOCK",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; the new surface is blocked by policy.`
+      };
+    case "UNKNOWN":
+      return {
+        action: "request-evidence",
+        verdict: "UNKNOWN",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; the new surface could not be verified \u2014 evidence or approval required.`
+      };
+    case "REVIEW":
+      return {
+        action: "prompt",
+        verdict: "REVIEW",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; review the new surface before proceeding.`
+      };
+    case "SAFE":
+      return {
+        action: "note",
+        verdict: "SAFE",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; no new blockers observed.`
+      };
+  }
+}
+function guardFailClosed(failure) {
+  return {
+    action: "fail-closed",
+    verdict: "UNKNOWN",
+    drifted: false,
+    summary: "Continuous Guard could not verify the authority surface; failing closed.",
+    failure
+  };
+}
+
 // ../../packages/core/src/distribution/agentRule.ts
 var RELEVANT_SURFACES = [
   ".cursor/mcp.json",
@@ -3488,6 +3599,64 @@ ${rule()}
   }
 }
 
+// ../../packages/core/src/distribution/ciGate.ts
+var CI_GATE_PATHS = [
+  "**/mcp.json",
+  "**/.mcp.json",
+  "**/settings.json",
+  "**/config.toml",
+  ".cursor/**",
+  ".vscode/**",
+  "claude_desktop_config.json",
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".calllint/approved.json"
+];
+function pathsBlock() {
+  return CI_GATE_PATHS.map((p) => `      - ${JSON.stringify(p)}`).join("\n");
+}
+var DRIFT_STEP = `      - name: CallLint drift gate
+        shell: bash
+        run: |
+          if [ -f .calllint/approved.json ]; then
+            npx -y calllint verify --approved --ci --no-emoji
+          else
+            echo "No .calllint/approved.json \u2014 seed it with: npx calllint approve"
+            echo "Running report-only scan-all (not gating)."
+            npx -y calllint scan-all --no-emoji || true
+          fi`;
+var SCAN_ALL_STEP = `      - name: CallLint scan-all (report-only)
+        shell: bash
+        run: npx -y calllint scan-all --no-emoji || true`;
+function renderCiGate(opts = {}) {
+  const mode = opts.mode ?? "drift";
+  const step = mode === "scan-all" ? SCAN_ALL_STEP : DRIFT_STEP;
+  const headline = mode === "scan-all" ? "CallLint agent-tool surface report (report-only; never gates)." : "CallLint agent-tool surface drift gate (fails on approved-state drift).";
+  return `# ${headline}
+# Generated by \`calllint\` (generate_ci_gate_snippet). CallLint is static and
+# NEVER executes a scanned server.
+name: calllint
+
+on:
+  pull_request:
+    paths:
+${pathsBlock()}
+
+permissions:
+  contents: read
+
+jobs:
+  surface-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+${step}
+`;
+}
+
 // ../../packages/core/src/receipt/createReceipt.ts
 import { randomBytes } from "node:crypto";
 function newReceiptId() {
@@ -4442,144 +4611,413 @@ function renderHtml(summary) {
 </html>`;
 }
 
-// src/exitCode.ts
-function exitCodeFor(summary, policy) {
-  const verdict = summary.verdict;
-  if (!shouldFailCi(verdict, policy)) return EXIT.OK;
-  switch (verdict) {
-    case "BLOCK":
-      return EXIT.BLOCK;
-    case "UNKNOWN":
-      return EXIT.UNKNOWN;
-    case "REVIEW":
-      return EXIT.REVIEW;
-    case "SAFE":
-      return EXIT.OK;
+// ../../packages/report-renderer/src/renderTrustPacket.ts
+var COMPLETENESS_HINT = {
+  complete: "complete",
+  partial: "partial (incomplete \u2014 treat as inconclusive)",
+  degraded: "degraded (not a pass)",
+  failed: "failed (not a pass)"
+};
+function topProviderSeverity(ev) {
+  const sevs = ev.findings.map(
+    (f) => f && typeof f === "object" && "providerSeverity" in f ? String(f.providerSeverity) : void 0
+  ).filter((s) => Boolean(s));
+  return sevs[0];
+}
+function whyTheyDiffer(ev, authorityVerdict) {
+  if (ev.completeness === "failed" || ev.completeness === "degraded") {
+    return "Why they differ: the content scan is " + COMPLETENESS_HINT[ev.completeness] + ", so it carries no weight here; CallLint's authority verdict stands on its own evidence.";
+  }
+  if (ev.findings.length === 0 && authorityVerdict !== "SAFE") {
+    return "Why they differ: the content scan found nothing malicious, but CallLint judges the granted authority itself too broad \u2014 clean code can still request unsafe capabilities.";
+  }
+  return "Why they differ: the two tools answer different questions \u2014 content risk (the scanner) vs. whether the requested authority is acceptable (CallLint). Neither overrides the other.";
+}
+function renderTrustPacket(summary, toolVersion, style = DEFAULT_STYLE) {
+  const evidence = summary.evidence;
+  if (!evidence || evidence.length === 0) return "";
+  const lines = ["", "Joint Trust Packet", "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"];
+  lines.push("Content scan");
+  for (const ev of evidence) {
+    const sev = topProviderSeverity(ev);
+    const findingsLabel = ev.findings.length === 0 ? "no findings" : `${ev.findings.length} finding${ev.findings.length === 1 ? "" : "s"}` + (sev ? ` (top severity: ${sev})` : "");
+    lines.push(
+      `  ${ev.provider} ${ev.providerVersion}  scanMode: ${ev.scanMode}  completeness: ${COMPLETENESS_HINT[ev.completeness]}`
+    );
+    lines.push(`    ${findingsLabel}`);
+    lines.push(`    raw report digest: ${ev.rawReportDigest}`);
+    for (const reason of ev.degradedReasons) {
+      lines.push(`    degraded: ${reason}`);
+    }
   }
+  lines.push("Authority scan");
+  lines.push(
+    `  CallLint ${toolVersion}  ${verdictTag(summary.verdict, style)}  (${summary.publicVerdictLabel})`
+  );
+  lines.push(whyTheyDiffer(evidence[0], summary.verdict));
+  return lines.join("\n");
 }
 
-// src/commands/resolveInput.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
-import { join as join4 } from "node:path";
-var DEFAULT_CONFIG_PATHS = [
-  ".cursor/mcp.json",
-  ".mcp.json",
-  "mcp.json",
-  ".claude/settings.json",
-  ".vscode/mcp.json"
-];
-function findDefaultConfig(cwd) {
-  for (const rel of DEFAULT_CONFIG_PATHS) {
-    const p = join4(cwd, rel);
-    if (existsSync3(p)) return p;
-  }
-  return void 0;
-}
-function isInputError(v) {
-  return "error" in v;
+// ../../packages/evidence/src/types.ts
+var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
+
+// ../../packages/evidence/src/providers/skillspector.ts
+function pinnedVersion(raw) {
+  const tool = raw.tool;
+  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
+  if (commit) return `git:${commit}`;
+  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
+  return version || void 0;
 }
-function resolveConfigInput(args, deps) {
-  if (flagBool(args.flags, "stdin")) {
-    return { text: deps.readStdin(), configPath: "<stdin>" };
-  }
-  const given = args.positionals[0];
-  if (given) {
-    const spec = parseTargetSpec(given);
-    if (spec.kind === "npm") {
-      if (!spec.packageSpec) {
-        return { error: "Empty npm target. Use npm:<package>[@version].", exitCode: EXIT.USAGE };
-      }
-      return synthesizeNpmConfig(spec.packageSpec);
-    }
-    if (spec.kind === "github") {
-      return {
-        error: "GitHub targets require network access. Re-run with --online to fetch repo MCP configs.",
-        exitCode: EXIT.USAGE
-      };
-    }
-  }
-  const resolved = given ?? findDefaultConfig(deps.cwd);
-  if (!resolved) {
+function parseSkillSpectorJson(parsed) {
+  const raw = asObject(parsed, "SkillSpector JSON root");
+  const degradedReasons = [];
+  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
+  const scanMode = usedLlm ? "llm" : "static";
+  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
+  const findings = rawFindings.map((f) => {
+    const o = asObject(f, "SkillSpector finding");
     return {
-      error: "No config given and none found. Pass a path or use --stdin.\nLooked in: " + DEFAULT_CONFIG_PATHS.join(", "),
-      exitCode: EXIT.USAGE
+      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
+      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
+      message: typeof o.message === "string" ? o.message : void 0,
+      locations: extractLocations(o)
     };
+  });
+  let completenessHint;
+  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
+  if (status && status !== "complete" && status !== "completed" && status !== "success") {
+    degradedReasons.push(`SkillSpector reported status "${status}"`);
+    completenessHint = status === "partial" ? "partial" : "degraded";
   }
-  if (!existsSync3(resolved)) {
-    return { error: `File not found: ${resolved}`, exitCode: EXIT.USAGE };
-  }
-  return { text: readFileSync5(resolved, "utf8"), configPath: resolved };
-}
-
-// src/commands/changedConfigs.ts
-import { basename as basename3, resolve } from "node:path";
-import { existsSync as existsSync4 } from "node:fs";
-function changedConfigPaths(cwd, diff) {
-  let raw;
-  try {
-    raw = diff();
-  } catch {
-    return [];
+  if (raw.partial === true) {
+    degradedReasons.push("SkillSpector reported a partial scan");
+    completenessHint = completenessHint ?? "partial";
   }
-  const knownLeaves = new Set(DEFAULT_CONFIG_PATHS.map((p) => basename3(p)));
-  const knownPaths = new Set(DEFAULT_CONFIG_PATHS);
-  return raw.split("\n").map((l) => l.trim()).filter(
-    (f) => f.length > 0 && (knownPaths.has(f) || DEFAULT_CONFIG_PATHS.some((p) => f.endsWith("/" + p)) || knownLeaves.has(basename3(f)))
-  ).map((f) => resolve(cwd, f)).filter((abs) => existsSync4(abs));
-}
-
-// src/commands/surfaces.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { join as join5 } from "node:path";
-var SURFACE_SIZE_CAP = 256 * 1024;
-var SURFACE_FILES = [
-  { file: "README.md", kind: "readme" },
-  { file: "SKILL.md", kind: "skill" },
-  { file: "AGENTS.md", kind: "agents" }
-];
-function readCapped2(path) {
-  try {
-    const st = statSync2(path);
-    if (!st.isFile()) return void 0;
-    const raw = readFileSync6(path, "utf8");
-    if (raw.length > SURFACE_SIZE_CAP) {
-      return { text: raw.slice(0, SURFACE_SIZE_CAP), truncated: true };
-    }
-    return { text: raw, truncated: false };
-  } catch {
-    return void 0;
+  if (raw.degraded === true) {
+    degradedReasons.push("SkillSpector reported a degraded scan");
+    completenessHint = "degraded";
   }
+  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
+  return {
+    provider: "skillspector",
+    providerVersion: pinnedVersion(raw),
+    scanMode,
+    coverage,
+    findings,
+    degradedReasons,
+    completenessHint
+  };
 }
-function readDocumentSurfaces(dir) {
-  const surfaces = [];
-  if (!existsSync5(dir)) return surfaces;
-  for (const { file, kind } of SURFACE_FILES) {
-    const got = readCapped2(join5(dir, file));
-    if (got) surfaces.push({ path: file, kind, text: got.text, truncated: got.truncated });
+function parseSkillSpectorSarif(parsed) {
+  const raw = asObject(parsed, "SARIF root");
+  const runs = arrayOf(raw.runs) ?? [];
+  if (runs.length === 0) {
+    return {
+      provider: "skillspector",
+      findings: [],
+      degradedReasons: ["SARIF had no runs"]
+    };
   }
-  const pkgPath = join5(dir, "package.json");
-  const pkgRaw = readCapped2(pkgPath);
-  if (pkgRaw) {
-    try {
-      const pkg = JSON.parse(pkgRaw.text);
-      const description = pkg && typeof pkg === "object" && !Array.isArray(pkg) ? pkg.description : void 0;
-      if (typeof description === "string") {
-        surfaces.push({
-          path: "package.json",
-          kind: "package-description",
-          text: description,
-          truncated: pkgRaw.truncated
-        });
-      }
-    } catch {
+  const degradedReasons = [];
+  const findings = [];
+  let providerVersion;
+  const coverage = [];
+  for (const runUnknown of runs) {
+    const run2 = asObject(runUnknown, "SARIF run");
+    const tool = asObject(run2.tool ?? {}, "SARIF tool");
+    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
+    if (!providerVersion) {
+      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
+      if (v) providerVersion = v;
+    }
+    const results = arrayOf(run2.results) ?? [];
+    for (const resUnknown of results) {
+      const res = asObject(resUnknown, "SARIF result");
+      findings.push({
+        providerRuleId: String(res.ruleId ?? "unknown"),
+        providerSeverity: String(res.level ?? "warning"),
+        message: extractSarifMessage(res),
+        locations: extractSarifLocations(res)
+      });
     }
   }
-  return surfaces;
+  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
+  return {
+    provider: "skillspector",
+    providerVersion,
+    scanMode: "static",
+    coverage,
+    findings,
+    degradedReasons
+  };
 }
-
-// src/commands/scan.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
-
+function asObject(v, what) {
+  if (v && typeof v === "object" && !Array.isArray(v)) return v;
+  throw new Error(`expected object for ${what}`);
+}
+function arrayOf(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function extractLocations(o) {
+  const loc = o.location ?? o.locations ?? o.path;
+  if (typeof loc === "string") return [loc];
+  if (Array.isArray(loc)) return loc.map((x) => String(x));
+  return void 0;
+}
+function extractSarifMessage(res) {
+  const msg = res.message;
+  if (msg && typeof msg.text === "string") return msg.text;
+  return void 0;
+}
+function extractSarifLocations(res) {
+  const locs = arrayOf(res.locations);
+  if (!locs) return void 0;
+  const out = [];
+  for (const l of locs) {
+    const lo = l;
+    const phys = lo?.physicalLocation;
+    const art = phys?.artifactLocation;
+    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
+    const region = phys?.region;
+    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
+    if (uri) out.push(line ? `${uri}:${line}` : uri);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
+// ../../packages/evidence/src/importEvidence.ts
+var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
+function detectProvider(raw, explicit) {
+  if (explicit) return explicit;
+  const r = raw;
+  if (!r) return "unknown";
+  const topTool = r.tool;
+  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
+  let sarifName = "";
+  const runs = r.runs;
+  if (Array.isArray(runs) && runs.length > 0) {
+    const run2 = runs[0];
+    const tool = run2?.tool;
+    const driver = tool?.driver;
+    if (driver && typeof driver.name === "string") sarifName = driver.name;
+  }
+  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
+    return "skillspector";
+  }
+  return "unknown";
+}
+function importEvidence(rawText, opts = {}) {
+  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
+  const rawReportDigest = sha256(rawText);
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch {
+    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
+      `report is not valid JSON (format=${format})`
+    ]);
+  }
+  const provider = detectProvider(parsed, opts.provider);
+  let result;
+  try {
+    if (provider === "skillspector") {
+      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
+    } else {
+      return failClosed(provider, rawReportDigest, [
+        `no adapter for provider "${provider}"; evidence not interpreted`
+      ]);
+    }
+  } catch (err2) {
+    return failClosed(provider, rawReportDigest, [
+      `adapter error: ${err2.message}`
+    ]);
+  }
+  return finalizeEnvelope(result, rawReportDigest);
+}
+function failClosed(provider, rawReportDigest, reasons) {
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: provider || "unknown",
+    providerVersion: "unknown",
+    artifactDigest: ZERO_DIGEST,
+    scanMode: "static",
+    coverage: [],
+    completeness: "failed",
+    findings: [],
+    rawReportDigest,
+    degradedReasons: reasons
+  };
+}
+function finalizeEnvelope(r, rawReportDigest) {
+  const degradedReasons = [...r.degradedReasons ?? []];
+  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
+  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
+  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
+  let providerVersion = r.providerVersion?.trim() || "";
+  if (!providerVersion) {
+    providerVersion = "unknown";
+    degradedReasons.push("provider version not pinned (no release/commit reported)");
+    level = Math.max(level, rank.degraded);
+  }
+  const completeness = rankToCompleteness[level];
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: r.provider,
+    providerVersion,
+    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
+    scanMode: r.scanMode ?? "static",
+    coverage: r.coverage ?? [],
+    completeness,
+    findings: r.findings,
+    rawReportDigest,
+    startedAt: r.startedAt,
+    finishedAt: r.finishedAt,
+    degradedReasons
+  };
+}
+function looksLikeSarif(text) {
+  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
+}
+
+// src/exitCode.ts
+function exitCodeFor(summary, policy) {
+  const verdict = summary.verdict;
+  if (!shouldFailCi(verdict, policy)) return EXIT.OK;
+  switch (verdict) {
+    case "BLOCK":
+      return EXIT.BLOCK;
+    case "UNKNOWN":
+      return EXIT.UNKNOWN;
+    case "REVIEW":
+      return EXIT.REVIEW;
+    case "SAFE":
+      return EXIT.OK;
+  }
+}
+
+// src/commands/resolveInput.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { join as join4 } from "node:path";
+var DEFAULT_CONFIG_PATHS = [
+  ".cursor/mcp.json",
+  ".mcp.json",
+  "mcp.json",
+  ".claude/settings.json",
+  ".vscode/mcp.json"
+];
+function findDefaultConfig(cwd) {
+  for (const rel of DEFAULT_CONFIG_PATHS) {
+    const p = join4(cwd, rel);
+    if (existsSync3(p)) return p;
+  }
+  return void 0;
+}
+function isInputError(v) {
+  return "error" in v;
+}
+function resolveConfigInput(args, deps) {
+  if (flagBool(args.flags, "stdin")) {
+    return { text: deps.readStdin(), configPath: "<stdin>" };
+  }
+  const given = args.positionals[0];
+  if (given) {
+    const spec = parseTargetSpec(given);
+    if (spec.kind === "npm") {
+      if (!spec.packageSpec) {
+        return { error: "Empty npm target. Use npm:<package>[@version].", exitCode: EXIT.USAGE };
+      }
+      return synthesizeNpmConfig(spec.packageSpec);
+    }
+    if (spec.kind === "github") {
+      return {
+        error: "GitHub targets require network access. Re-run with --online to fetch repo MCP configs.",
+        exitCode: EXIT.USAGE
+      };
+    }
+  }
+  const resolved = given ?? findDefaultConfig(deps.cwd);
+  if (!resolved) {
+    return {
+      error: "No config given and none found. Pass a path or use --stdin.\nLooked in: " + DEFAULT_CONFIG_PATHS.join(", "),
+      exitCode: EXIT.USAGE
+    };
+  }
+  if (!existsSync3(resolved)) {
+    return { error: `File not found: ${resolved}`, exitCode: EXIT.USAGE };
+  }
+  return { text: readFileSync5(resolved, "utf8"), configPath: resolved };
+}
+
+// src/commands/changedConfigs.ts
+import { basename as basename3, resolve } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+function changedConfigPaths(cwd, diff) {
+  let raw;
+  try {
+    raw = diff();
+  } catch {
+    return [];
+  }
+  const knownLeaves = new Set(DEFAULT_CONFIG_PATHS.map((p) => basename3(p)));
+  const knownPaths = new Set(DEFAULT_CONFIG_PATHS);
+  return raw.split("\n").map((l) => l.trim()).filter(
+    (f) => f.length > 0 && (knownPaths.has(f) || DEFAULT_CONFIG_PATHS.some((p) => f.endsWith("/" + p)) || knownLeaves.has(basename3(f)))
+  ).map((f) => resolve(cwd, f)).filter((abs) => existsSync4(abs));
+}
+
+// src/commands/surfaces.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { join as join5 } from "node:path";
+var SURFACE_SIZE_CAP = 256 * 1024;
+var SURFACE_FILES = [
+  { file: "README.md", kind: "readme" },
+  { file: "SKILL.md", kind: "skill" },
+  { file: "AGENTS.md", kind: "agents" }
+];
+function readCapped2(path) {
+  try {
+    const st = statSync2(path);
+    if (!st.isFile()) return void 0;
+    const raw = readFileSync6(path, "utf8");
+    if (raw.length > SURFACE_SIZE_CAP) {
+      return { text: raw.slice(0, SURFACE_SIZE_CAP), truncated: true };
+    }
+    return { text: raw, truncated: false };
+  } catch {
+    return void 0;
+  }
+}
+function readDocumentSurfaces(dir) {
+  const surfaces = [];
+  if (!existsSync5(dir)) return surfaces;
+  for (const { file, kind } of SURFACE_FILES) {
+    const got = readCapped2(join5(dir, file));
+    if (got) surfaces.push({ path: file, kind, text: got.text, truncated: got.truncated });
+  }
+  const pkgPath = join5(dir, "package.json");
+  const pkgRaw = readCapped2(pkgPath);
+  if (pkgRaw) {
+    try {
+      const pkg = JSON.parse(pkgRaw.text);
+      const description = pkg && typeof pkg === "object" && !Array.isArray(pkg) ? pkg.description : void 0;
+      if (typeof description === "string") {
+        surfaces.push({
+          path: "package.json",
+          kind: "package-description",
+          text: description,
+          truncated: pkgRaw.truncated
+        });
+      }
+    } catch {
+    }
+  }
+  return surfaces;
+}
+
+// src/commands/scan.ts
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
+
 // ../../packages/discovery/src/registry.ts
 var ExtractorRegistry = class {
   extractors = /* @__PURE__ */ new Map();
@@ -5030,6 +5468,15 @@ function scanCommand(args, deps) {
 function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true) {
   const surfaceDir = flagStr(args.flags, "surface-dir");
   const surfaces = surfaceDir ? readDocumentSurfaces(resolve3(deps.cwd, surfaceDir)) : void 0;
+  const evidenceFile = flagStr(args.flags, "evidence");
+  let evidence;
+  if (evidenceFile) {
+    const loaded = loadEvidence(evidenceFile, args, deps);
+    if ("error" in loaded) {
+      return { stdout: "", stderr: loaded.error, exitCode: loaded.exitCode };
+    }
+    evidence = [loaded];
+  }
   let summary;
   try {
     summary = scanConfigText(text, configPath, {
@@ -5037,7 +5484,8 @@ function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true
       now: deps.now,
       generatedAt: deps.generatedAt,
       extraFindings: deps.online?.extraFindings,
-      surfaces
+      surfaces,
+      evidence
     });
   } catch (err2) {
     if (err2 instanceof ConfigParseError) {
@@ -5055,7 +5503,7 @@ function scanOneConfig(text, configPath, policy, args, deps, allowReceipt = true
     } catch {
     }
   }
-  const stdout = renderSummary(summary, args);
+  const stdout = renderSummary(summary, args, deps.toolVersion);
   if (allowReceipt && flagBool(args.flags, "receipt")) {
     const err2 = writeReceiptFile(summary, text, configPath, policy, args, deps);
     if (err2) return { stdout: "", stderr: err2, exitCode: EXIT.ERROR };
@@ -5088,15 +5536,31 @@ function writeReceiptFile(summary, text, configPath, policy, args, deps) {
   }
   return void 0;
 }
-function renderSummary(summary, args) {
+function loadEvidence(file, args, deps) {
+  let rawText;
+  try {
+    rawText = readFileSync12(resolve3(deps.cwd, file), "utf8");
+  } catch (err2) {
+    const e = err2;
+    return {
+      error: e.code === "ENOENT" ? `Evidence file not found: ${file}` : e.message,
+      exitCode: EXIT.USAGE
+    };
+  }
+  const fmt = flagStr(args.flags, "evidence-format");
+  const format = fmt === "sarif" ? "sarif" : fmt === "json" ? "json" : void 0;
+  return importEvidence(rawText, { format });
+}
+function renderSummary(summary, args, toolVersion) {
   const style = flagBool(args.flags, "no-emoji") ? NO_EMOJI_STYLE : DEFAULT_STYLE;
   if (flagBool(args.flags, "json")) return renderJson(summary);
   if (flagBool(args.flags, "sarif")) return renderSarif(summary);
   if (flagBool(args.flags, "markdown")) return renderMarkdown(summary);
   if (flagBool(args.flags, "badge")) return renderBadge(summary);
   if (flagBool(args.flags, "html")) return renderHtml(summary);
-  if (flagBool(args.flags, "compact")) return renderCompact(summary, style);
-  return renderTerminal(summary, style);
+  const base = flagBool(args.flags, "compact") ? renderCompact(summary, style) : renderTerminal(summary, style);
+  const packet = renderTrustPacket(summary, toolVersion ?? "0.0.0-dev", style);
+  return packet ? base + "\n" + packet : base;
 }
 function scanChangedCommand(args, deps) {
   const policyPath = flagStr(args.flags, "policy");
@@ -7441,291 +7905,67 @@ function inventoryCommand(args, deps) {
       lines.push("Searched agents: Cursor, Claude Code, Claude Desktop");
       lines.push("To scan a specific config: calllint scan --config <path>");
     } else {
-      lines.push(`Discovered ${result.discovered.length} agent config(s):`);
-      lines.push("");
-      const byAgent = /* @__PURE__ */ new Map();
-      for (const config of result.discovered) {
-        const existing = byAgent.get(config.agentType) || [];
-        existing.push(config);
-        byAgent.set(config.agentType, existing);
-      }
-      const sortedAgents = Array.from(byAgent.keys()).sort((a, b) => {
-        const priorityA = result.discovered.find((c) => c.agentType === a)?.priority || "P3";
-        const priorityB = result.discovered.find((c) => c.agentType === b)?.priority || "P3";
-        return priorityA.localeCompare(priorityB);
-      });
-      for (const agentType of sortedAgents) {
-        const configs = byAgent.get(agentType);
-        const priority = configs[0].priority;
-        const agentLabel = formatAgentType(agentType);
-        lines.push(`${agentLabel} (${priority}):`);
-        for (const config of configs) {
-          lines.push(`  ${config.configPath}`);
-        }
-        lines.push("");
-      }
-      lines.push(`To scan all: calllint scan --auto`);
-      lines.push(`To scan one: calllint scan --agent ${result.discovered[0].agentType}`);
-    }
-    return {
-      exitCode: 0,
-      stdout: lines.join("\n") + "\n",
-      stderr: ""
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      exitCode: 1,
-      stdout: "",
-      stderr: `Error discovering configs: ${message}
-`
-    };
-  }
-}
-function formatAgentType(agentType) {
-  switch (agentType) {
-    case "cursor":
-      return "Cursor";
-    case "claude-code":
-      return "Claude Code";
-    case "claude-desktop":
-      return "Claude Desktop";
-    case "vscode":
-      return "VS Code";
-    case "windsurf":
-      return "Windsurf";
-    default:
-      return agentType;
-  }
-}
-
-// src/commands/evidence.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
-
-// ../../packages/evidence/src/types.ts
-var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
-
-// ../../packages/evidence/src/providers/skillspector.ts
-function pinnedVersion(raw) {
-  const tool = raw.tool;
-  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
-  if (commit) return `git:${commit}`;
-  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
-  return version || void 0;
-}
-function parseSkillSpectorJson(parsed) {
-  const raw = asObject(parsed, "SkillSpector JSON root");
-  const degradedReasons = [];
-  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
-  const scanMode = usedLlm ? "llm" : "static";
-  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
-  const findings = rawFindings.map((f) => {
-    const o = asObject(f, "SkillSpector finding");
-    return {
-      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
-      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
-      message: typeof o.message === "string" ? o.message : void 0,
-      locations: extractLocations(o)
-    };
-  });
-  let completenessHint;
-  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
-  if (status && status !== "complete" && status !== "completed" && status !== "success") {
-    degradedReasons.push(`SkillSpector reported status "${status}"`);
-    completenessHint = status === "partial" ? "partial" : "degraded";
-  }
-  if (raw.partial === true) {
-    degradedReasons.push("SkillSpector reported a partial scan");
-    completenessHint = completenessHint ?? "partial";
-  }
-  if (raw.degraded === true) {
-    degradedReasons.push("SkillSpector reported a degraded scan");
-    completenessHint = "degraded";
-  }
-  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
-  return {
-    provider: "skillspector",
-    providerVersion: pinnedVersion(raw),
-    scanMode,
-    coverage,
-    findings,
-    degradedReasons,
-    completenessHint
-  };
-}
-function parseSkillSpectorSarif(parsed) {
-  const raw = asObject(parsed, "SARIF root");
-  const runs = arrayOf(raw.runs) ?? [];
-  if (runs.length === 0) {
-    return {
-      provider: "skillspector",
-      findings: [],
-      degradedReasons: ["SARIF had no runs"]
-    };
-  }
-  const degradedReasons = [];
-  const findings = [];
-  let providerVersion;
-  const coverage = [];
-  for (const runUnknown of runs) {
-    const run2 = asObject(runUnknown, "SARIF run");
-    const tool = asObject(run2.tool ?? {}, "SARIF tool");
-    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
-    if (!providerVersion) {
-      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
-      if (v) providerVersion = v;
-    }
-    const results = arrayOf(run2.results) ?? [];
-    for (const resUnknown of results) {
-      const res = asObject(resUnknown, "SARIF result");
-      findings.push({
-        providerRuleId: String(res.ruleId ?? "unknown"),
-        providerSeverity: String(res.level ?? "warning"),
-        message: extractSarifMessage(res),
-        locations: extractSarifLocations(res)
-      });
-    }
-  }
-  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
-  return {
-    provider: "skillspector",
-    providerVersion,
-    scanMode: "static",
-    coverage,
-    findings,
-    degradedReasons
-  };
-}
-function asObject(v, what) {
-  if (v && typeof v === "object" && !Array.isArray(v)) return v;
-  throw new Error(`expected object for ${what}`);
-}
-function arrayOf(v) {
-  return Array.isArray(v) ? v : void 0;
-}
-function extractLocations(o) {
-  const loc = o.location ?? o.locations ?? o.path;
-  if (typeof loc === "string") return [loc];
-  if (Array.isArray(loc)) return loc.map((x) => String(x));
-  return void 0;
-}
-function extractSarifMessage(res) {
-  const msg = res.message;
-  if (msg && typeof msg.text === "string") return msg.text;
-  return void 0;
-}
-function extractSarifLocations(res) {
-  const locs = arrayOf(res.locations);
-  if (!locs) return void 0;
-  const out = [];
-  for (const l of locs) {
-    const lo = l;
-    const phys = lo?.physicalLocation;
-    const art = phys?.artifactLocation;
-    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
-    const region = phys?.region;
-    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
-    if (uri) out.push(line ? `${uri}:${line}` : uri);
-  }
-  return out.length > 0 ? out : void 0;
-}
-
-// ../../packages/evidence/src/importEvidence.ts
-var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
-function detectProvider(raw, explicit) {
-  if (explicit) return explicit;
-  const r = raw;
-  if (!r) return "unknown";
-  const topTool = r.tool;
-  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
-  let sarifName = "";
-  const runs = r.runs;
-  if (Array.isArray(runs) && runs.length > 0) {
-    const run2 = runs[0];
-    const tool = run2?.tool;
-    const driver = tool?.driver;
-    if (driver && typeof driver.name === "string") sarifName = driver.name;
-  }
-  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
-    return "skillspector";
-  }
-  return "unknown";
-}
-function importEvidence(rawText, opts = {}) {
-  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
-  const rawReportDigest = sha256(rawText);
-  let parsed;
-  try {
-    parsed = JSON.parse(rawText);
-  } catch {
-    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
-      `report is not valid JSON (format=${format})`
-    ]);
-  }
-  const provider = detectProvider(parsed, opts.provider);
-  let result;
-  try {
-    if (provider === "skillspector") {
-      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
-    } else {
-      return failClosed(provider, rawReportDigest, [
-        `no adapter for provider "${provider}"; evidence not interpreted`
-      ]);
+      lines.push(`Discovered ${result.discovered.length} agent config(s):`);
+      lines.push("");
+      const byAgent = /* @__PURE__ */ new Map();
+      for (const config of result.discovered) {
+        const existing = byAgent.get(config.agentType) || [];
+        existing.push(config);
+        byAgent.set(config.agentType, existing);
+      }
+      const sortedAgents = Array.from(byAgent.keys()).sort((a, b) => {
+        const priorityA = result.discovered.find((c) => c.agentType === a)?.priority || "P3";
+        const priorityB = result.discovered.find((c) => c.agentType === b)?.priority || "P3";
+        return priorityA.localeCompare(priorityB);
+      });
+      for (const agentType of sortedAgents) {
+        const configs = byAgent.get(agentType);
+        const priority = configs[0].priority;
+        const agentLabel = formatAgentType(agentType);
+        lines.push(`${agentLabel} (${priority}):`);
+        for (const config of configs) {
+          lines.push(`  ${config.configPath}`);
+        }
+        lines.push("");
+      }
+      lines.push(`To scan all: calllint scan --auto`);
+      lines.push(`To scan one: calllint scan --agent ${result.discovered[0].agentType}`);
     }
-  } catch (err2) {
-    return failClosed(provider, rawReportDigest, [
-      `adapter error: ${err2.message}`
-    ]);
+    return {
+      exitCode: 0,
+      stdout: lines.join("\n") + "\n",
+      stderr: ""
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: `Error discovering configs: ${message}
+`
+    };
   }
-  return finalizeEnvelope(result, rawReportDigest);
-}
-function failClosed(provider, rawReportDigest, reasons) {
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: provider || "unknown",
-    providerVersion: "unknown",
-    artifactDigest: ZERO_DIGEST,
-    scanMode: "static",
-    coverage: [],
-    completeness: "failed",
-    findings: [],
-    rawReportDigest,
-    degradedReasons: reasons
-  };
 }
-function finalizeEnvelope(r, rawReportDigest) {
-  const degradedReasons = [...r.degradedReasons ?? []];
-  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
-  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
-  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
-  let providerVersion = r.providerVersion?.trim() || "";
-  if (!providerVersion) {
-    providerVersion = "unknown";
-    degradedReasons.push("provider version not pinned (no release/commit reported)");
-    level = Math.max(level, rank.degraded);
+function formatAgentType(agentType) {
+  switch (agentType) {
+    case "cursor":
+      return "Cursor";
+    case "claude-code":
+      return "Claude Code";
+    case "claude-desktop":
+      return "Claude Desktop";
+    case "vscode":
+      return "VS Code";
+    case "windsurf":
+      return "Windsurf";
+    default:
+      return agentType;
   }
-  const completeness = rankToCompleteness[level];
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: r.provider,
-    providerVersion,
-    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
-    scanMode: r.scanMode ?? "static",
-    coverage: r.coverage ?? [],
-    completeness,
-    findings: r.findings,
-    rawReportDigest,
-    startedAt: r.startedAt,
-    finishedAt: r.finishedAt,
-    degradedReasons
-  };
-}
-function looksLikeSarif(text) {
-  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
 }
 
 // src/commands/evidence.ts
+import { readFileSync as readFileSync16 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
 function evidenceCommand(args, deps) {
   const subcommand = args.positionals[0];
   if (!subcommand || subcommand === "help") {
@@ -7836,6 +8076,235 @@ import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as rea
 import { basename as basename4, join as join16, resolve as resolvePath4 } from "node:path";
 import { homedir, userInfo } from "node:os";
 
+// ../../packages/flow-analyzer/src/flowRules.ts
+var UNTRUSTED_OR_SENSITIVE = /* @__PURE__ */ new Set([
+  "sensitive.secret",
+  "sensitive.private_data",
+  "untrusted.public_content",
+  "untrusted.tool_output",
+  "untrusted.peer_agent",
+  "untrusted.memory"
+]);
+var TRUSTED = /* @__PURE__ */ new Set([
+  "trusted.policy",
+  "trusted.user_explicit",
+  "trusted.local_project",
+  "trusted.signed_component"
+]);
+function isUntrustedOrSensitive(ts) {
+  return ts !== void 0 && UNTRUSTED_OR_SENSITIVE.has(ts);
+}
+function isTrusted(ts) {
+  return ts !== void 0 && TRUSTED.has(ts);
+}
+function sinkKind(sink) {
+  const key = `${sink.action}:${sink.resource}`;
+  if (key === "send:network" || key === "connect:network") return "network";
+  if (key === "send:message") return "message";
+  if (key === "spend:financial") return "financial";
+  return "other";
+}
+function hasExternalDestination(sink) {
+  return typeof sink.destination === "string" && sink.destination.length > 0;
+}
+var FLOW_RULES = [
+  // CL-FLOW-001 — the canonical toxic flow: untrusted/sensitive data → external network
+  // egress with a concrete outbound destination. The motivating incident (new9): a
+  // secret / injected public content leaving to an attacker-controlled host.
+  {
+    id: "CL-FLOW-001",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "network" && hasExternalDestination(k),
+    decisionHint: "BLOCK",
+    riskClass: "critical"
+  },
+  // CL-FLOW-002 — untrusted/sensitive data → financial action (spend). Money leaving is
+  // irreversible; a tainted source driving it is a blocker regardless of destination.
+  {
+    id: "CL-FLOW-002",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "financial",
+    decisionHint: "BLOCK",
+    riskClass: "critical"
+  },
+  // CL-FLOW-003 — untrusted/sensitive data → external network egress WITHOUT a pinned
+  // destination (host unknown). Still dangerous, but the sink is less determined, so it
+  // warrants human review rather than an outright block.
+  {
+    id: "CL-FLOW-003",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "network" && !hasExternalDestination(k),
+    decisionHint: "REVIEW",
+    riskClass: "high"
+  },
+  // CL-FLOW-004 — untrusted/sensitive data → outbound messaging (email/chat). Exfiltration
+  // via a messaging channel; review-worthy.
+  {
+    id: "CL-FLOW-004",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "message",
+    decisionHint: "REVIEW",
+    riskClass: "high"
+  },
+  // CL-FLOW-ALLOW-001 — an established TRUSTED source reaching an egress sink is the
+  // benign counterpart (ADR 0041 §2: trusted.user_explicit → send is routine). Only fires
+  // when the source is positively trusted — never on unknown (I-04).
+  {
+    id: "CL-FLOW-ALLOW-001",
+    when: (s, k) => isTrusted(s.trustSource) && sinkKind(k) !== "other",
+    decisionHint: "ALLOW",
+    riskClass: "none"
+  },
+  // CL-FLOW-REVIEW-000 — fail-safe catch-all. Any composition not positively classified
+  // above (including one whose source trust could not be established) is REVIEW, never
+  // ALLOW/SAFE. This keeps the classifier total and dangerous-flow-never-SAFE.
+  {
+    id: "CL-FLOW-REVIEW-000",
+    when: () => true,
+    decisionHint: "REVIEW",
+    riskClass: "medium"
+  }
+];
+function classifyFlow(source, sink) {
+  for (const rule2 of FLOW_RULES) {
+    if (rule2.when(source, sink)) {
+      return { ruleId: rule2.id, decisionHint: rule2.decisionHint, riskClass: rule2.riskClass };
+    }
+  }
+  return { ruleId: "CL-FLOW-REVIEW-000", decisionHint: "REVIEW", riskClass: "medium" };
+}
+
+// ../../packages/flow-analyzer/src/buildFlows.ts
+var CLASSIFIED_SOURCE_TRUST = /* @__PURE__ */ new Set([
+  "sensitive.secret",
+  "sensitive.private_data",
+  "untrusted.public_content",
+  "untrusted.tool_output",
+  "untrusted.peer_agent",
+  "untrusted.memory",
+  "trusted.policy",
+  "trusted.user_explicit",
+  "trusted.local_project",
+  "trusted.signed_component"
+]);
+var EGRESS_SINKS = /* @__PURE__ */ new Set([
+  "send:network",
+  "send:message",
+  "connect:network",
+  "spend:financial"
+]);
+function isSource(c) {
+  return c.action === "read" && c.trustSource !== void 0 && CLASSIFIED_SOURCE_TRUST.has(c.trustSource);
+}
+function isSink(c) {
+  return EGRESS_SINKS.has(`${c.action}:${c.resource}`);
+}
+function sourceFamily(ts) {
+  if (ts.startsWith("sensitive.")) return "sensitive";
+  if (ts.startsWith("trusted.")) return "trusted";
+  return "untrusted";
+}
+var SEVERITY = {
+  none: 0,
+  low: 20,
+  medium: 50,
+  high: 75,
+  critical: 95
+};
+function cmp3(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function capKey(t) {
+  const c = t.cap;
+  return [
+    t.manifestDigest,
+    c.trustSource ?? "",
+    c.action,
+    c.resource,
+    c.scope ?? "",
+    c.destination ?? "",
+    c.evidenceSource
+  ].join("|");
+}
+function sealFlow(flow) {
+  return { ...flow, digest: hashJson(flow) };
+}
+function buildFlows(manifests) {
+  const tagged = manifests.flatMap((m) => m.capabilities.map((cap) => ({ cap, manifestDigest: m.digest }))).sort((a, b) => cmp3(capKey(a), capKey(b)));
+  const sources = tagged.filter((t) => isSource(t.cap));
+  const sinks = tagged.filter((t) => isSink(t.cap));
+  const byDigest = /* @__PURE__ */ new Map();
+  for (const src of sources) {
+    for (const snk of sinks) {
+      if (src.cap === snk.cap) continue;
+      const ts = src.cap.trustSource;
+      const outcome = classifyFlow(src.cap, snk.cap);
+      const risk = {
+        class: outcome.riskClass,
+        severity: SEVERITY[outcome.riskClass]
+      };
+      const sinkTag = `${snk.cap.action}-${snk.cap.resource}`;
+      const flowId = `flow:${sourceFamily(ts)}-to-${sinkTag}`;
+      const evidence = [.../* @__PURE__ */ new Set([src.cap.evidenceSource, snk.cap.evidenceSource])].sort();
+      const authorityDigests = [.../* @__PURE__ */ new Set([src.manifestDigest, snk.manifestDigest])].sort();
+      const flow = sealFlow({
+        schema: FLOW_SCHEMA_VERSION,
+        flowId,
+        source: { trustSource: ts, evidence: [src.cap.evidenceSource] },
+        steps: [{ action: src.cap.action, resource: src.cap.resource, scope: src.cap.scope }],
+        sink: {
+          action: snk.cap.action,
+          resource: snk.cap.resource,
+          destination: snk.cap.destination
+        },
+        risk,
+        decisionHint: outcome.decisionHint,
+        evidence,
+        authorityDigests
+      });
+      if (!byDigest.has(flow.digest)) byDigest.set(flow.digest, flow);
+    }
+  }
+  return [...byDigest.values()].sort(
+    (a, b) => cmp3(a.flowId, b.flowId) || cmp3(a.digest, b.digest)
+  );
+}
+
+// ../../packages/flow-analyzer/src/foldFlows.ts
+function hintToVerdict(hint) {
+  switch (hint) {
+    case "BLOCK":
+      return "BLOCK";
+    case "REVIEW":
+      return "REVIEW";
+    default:
+      return null;
+  }
+}
+function foldFlowsIntoReasons(flows) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const flow of flows) {
+    const contributes = hintToVerdict(flow.decisionHint);
+    if (contributes === null) continue;
+    const firstEvidence = flow.evidence[0];
+    const evidenceSource = firstEvidence ? `${flow.flowId} (${firstEvidence})` : flow.flowId;
+    const reason = {
+      code: "TOXIC_FLOW_COMPOSITION",
+      evidenceSource,
+      contributes
+    };
+    const prev = byKey.get(evidenceSource);
+    if (!prev || severity(contributes) > severity(prev.contributes)) {
+      byKey.set(evidenceSource, reason);
+    }
+  }
+  return [...byKey.values()].sort(
+    (a, b) => cmp4(a.evidenceSource, b.evidenceSource) || severity(b.contributes) - severity(a.contributes)
+  );
+}
+function severity(v) {
+  return v === "BLOCK" ? 3 : v === "UNKNOWN" ? 2 : v === "REVIEW" ? 1 : 0;
+}
+function cmp4(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
 // ../../packages/install-planner/src/buildPlan.ts
 function ptr(segment) {
   return segment.replace(/~/g, "~0").replace(/\//g, "~1");
@@ -8681,7 +9150,7 @@ function writePlanFile(plan, deps) {
   writeFileSync10(file, JSON.stringify(plan, null, 2) + "\n", "utf8");
   return file;
 }
-function loadEvidence(file, deps, format, provider) {
+function loadEvidence2(file, deps, format, provider) {
   let rawText;
   try {
     rawText = readFileSync18(resolvePath4(deps.cwd, file), "utf8");
@@ -8720,7 +9189,7 @@ function trustPrepare(args, deps) {
   const providerFlag = typeof args.flags["provider"] === "string" ? args.flags["provider"] : void 0;
   let evidence;
   if (evidenceFile) {
-    const imported = loadEvidence(evidenceFile, deps, format, providerFlag);
+    const imported = loadEvidence2(evidenceFile, deps, format, providerFlag);
     if ("error" in imported) {
       return { stdout: "", stderr: `Error: ${imported.error}`, exitCode: imported.exitCode };
     }
@@ -8730,7 +9199,9 @@ function trustPrepare(args, deps) {
   const authority = buildAuthorityForTarget(input, artifact.digest ?? null);
   const policyPath = flagStr(args.flags, "policy");
   const policy = loadPolicyOrDefault(policyPath ? resolvePath4(deps.cwd, policyPath) : void 0);
-  const decision = artifact.resolution === "resolved" ? decideOverAuthority({ authority, evidence, policy }) : void 0;
+  const flows = buildFlows([authority]);
+  const flowReasons = foldFlowsIntoReasons(flows);
+  const decision = artifact.resolution === "resolved" ? decideOverAuthority({ authority, evidence, policy, flowReasons }) : void 0;
   let plan;
   const hostFlag = flagStr(args.flags, "host");
   if (hostFlag && decision && decision.verdict !== "UNKNOWN") {
@@ -8757,10 +9228,18 @@ function trustPrepare(args, deps) {
 plan written: ${file}
 `;
   }
+  const showFlows = flagBool(args.flags, "flows");
   if (flagBool(args.flags, "json")) {
-    return { stdout: JSON.stringify(preparation, null, 2), stderr: "", exitCode };
+    const payload = showFlows ? { preparation, flows } : preparation;
+    return { stdout: JSON.stringify(payload, null, 2), stderr: "", exitCode };
   }
-  return { stdout: renderPreparation(preparation) + planNote, stderr: "", exitCode };
+  const flowNote = showFlows ? renderFlows(flows) : "";
+  const conversion = renderConversionPrompt(preparation);
+  return {
+    stdout: renderPreparation(preparation) + flowNote + planNote + conversion,
+    stderr: "",
+    exitCode
+  };
 }
 function loadPreparation(args, deps) {
   const file = args.positionals[1];
@@ -9055,6 +9534,46 @@ This is the READ-ONLY half of the Trust Gateway. It touched no live config
 `;
   return out;
 }
+function renderConversionPrompt(p) {
+  const d = p.decision;
+  if (!d || d.verdict === "BLOCK" || d.verdict === "UNKNOWN") return "";
+  return `
+Next step (nothing is persisted unless you run one of these):
+  \u2022 Record this surface as approved:   calllint approve
+  \u2022 Re-decide on every authority change: calllint guard install --host git
+  \u2022 Gate pull requests in CI:           calllint guard install --host github
+  \u2022 Teach your agent the safety rule:   calllint gen-rule --host claude --write
+`;
+}
+var FLOW_HINT_SYMBOL = {
+  BLOCK: "\u26D4 BLOCK",
+  REVIEW: "\u26A0 REVIEW",
+  ALLOW: "\u{1F6E1} ALLOW"
+};
+function renderFlows(flows) {
+  if (flows.length === 0) {
+    return `
+toxic-flows:   (none \u2014 no cross-capability composition detected)
+`;
+  }
+  let out = `
+toxic-flows:   ${flows.length} path(s) [calllint.flow.v0]
+`;
+  for (const f of flows) {
+    const dst = f.sink.destination ? ` \u2192 ${f.sink.destination}` : "";
+    out += `  ${FLOW_HINT_SYMBOL[f.decisionHint] ?? f.decisionHint}  ${f.flowId}  (${f.risk.class})
+`;
+    out += `      source: ${f.source.trustSource}  \u2192  sink: ${f.sink.action} ${f.sink.resource}${dst}
+`;
+    out += `      evidence: ${f.evidence.join(", ")}
+`;
+  }
+  out += `  A dangerous flow is folded into the decision as a TOXIC_FLOW_COMPOSITION reason;
+`;
+  out += `  it can only raise the verdict, never lower it. An ALLOW flow contributes nothing.
+`;
+  return out;
+}
 function renderExplanation(p) {
   let out = `
 CallLint trust explain
@@ -9224,6 +9743,9 @@ OPTIONS (prepare)
                         only for a non-blocking decision (SAFE/REVIEW).
   --host-config <path>  Override the host config path (default: ~/.claude.json)
   --write-plan          Persist the plan to .calllint/plans/<plan-id>.json
+  --flows               Show static toxic-flow paths (calllint.flow.v0) behind the
+                        decision's TOXIC_FLOW_COMPOSITION reasons. With --json, emits
+                        { preparation, flows }. A dangerous flow only raises the verdict.
   --no-llm              Default posture: no LLM in the verdict path (accepted, no-op)
   --json                Emit the raw calllint.trust-preparation.v0 document
 
@@ -9268,6 +9790,209 @@ SEE ALSO
 `;
 }
 
+// src/commands/guard.ts
+import { existsSync as existsSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync6 } from "node:fs";
+import { dirname as dirname6, join as join17, resolve as resolve10 } from "node:path";
+var GUARD_HOSTS = ["git", "github"];
+function guardConfigPath(cwd) {
+  return join17(cwd, ".calllint", "guard.json");
+}
+function readGuardConfig(cwd) {
+  const path = guardConfigPath(cwd);
+  if (!existsSync12(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync19(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function isDisabled(cwd, env) {
+  if (env["CALLLINT_GUARD"] === "0") return true;
+  return readGuardConfig(cwd)?.enabled === false;
+}
+function guardCommand(args, deps) {
+  const sub = args.positionals[0];
+  const env = deps.env ?? process.env;
+  switch (sub) {
+    case "install":
+      return guardInstall(args, deps);
+    case "status":
+      return guardStatus(args, deps, env);
+    case "disable":
+      return guardSetEnabled(deps, false);
+    case "enable":
+      return guardSetEnabled(deps, true);
+    case void 0:
+      return guardRun(args, deps, env);
+    default:
+      return {
+        stdout: "",
+        stderr: `Unknown guard subcommand: ${sub}
+Run \`calllint guard\` (assess) or \`calllint guard install|status|disable|enable\`.`,
+        exitCode: EXIT.USAGE
+      };
+  }
+}
+function exitForAction(a) {
+  switch (a.action) {
+    case "silent":
+    case "note":
+      return EXIT.OK;
+    case "prompt":
+      return EXIT.REVIEW;
+    case "request-evidence":
+      return EXIT.UNKNOWN;
+    case "refuse":
+      return EXIT.BLOCK;
+    case "fail-closed":
+      return EXIT.ERROR;
+  }
+}
+function guardRun(args, deps, env) {
+  const json = flagBool(args.flags, "json");
+  if (isDisabled(deps.cwd, env)) {
+    const note = "Continuous Guard is disabled (CALLLINT_GUARD=0 or .calllint/guard.json).";
+    return {
+      stdout: json ? JSON.stringify({ enabled: false, note }) : note,
+      exitCode: EXIT.OK
+    };
+  }
+  const approvedPath = flagStr(args.flags, "approved") ?? defaultApprovedPath(deps.cwd);
+  const approved = readApproved(approvedPath);
+  if (!approved) {
+    return {
+      stdout: "",
+      stderr: `No approved baseline at ${approvedPath}. Run \`calllint approve\` first.`,
+      exitCode: EXIT.USAGE
+    };
+  }
+  let assessment;
+  try {
+    const current = decideRepoSurfaces(deps.cwd, { now: deps.now, generatedAt: deps.generatedAt });
+    const drift = verifyApproved(current, approved, deps.generatedAt);
+    assessment = assessGuardDrift(drift);
+  } catch (err2) {
+    assessment = guardFailClosed(err2 instanceof Error ? err2.message : String(err2));
+  }
+  const exitCode = exitForAction(assessment);
+  if (json) {
+    return { stdout: JSON.stringify(assessment), exitCode };
+  }
+  if (assessment.action === "silent") {
+    return { stdout: "", exitCode: EXIT.OK };
+  }
+  const prefix = assessment.action === "fail-closed" ? "GUARD FAILED CLOSED" : assessment.action === "refuse" ? "BLOCK" : assessment.action === "request-evidence" ? "UNKNOWN" : assessment.action === "prompt" ? "REVIEW" : "NOTE";
+  const failLine = assessment.failure ? `
+  reason: ${assessment.failure}` : "";
+  return { stdout: `${prefix}: ${assessment.summary}${failLine}`, exitCode };
+}
+function isGuardHost(v) {
+  return v !== void 0 && GUARD_HOSTS.includes(v);
+}
+var GIT_HOOK = `#!/usr/bin/env bash
+# CallLint Continuous Guard (ADR 0045). Re-decides the agent-tool authority
+# surface on commit; silent when nothing changed. Generated by \`calllint guard install\`.
+# CallLint is static and NEVER executes a scanned server.
+npx -y calllint guard --no-emoji
+`;
+function guardArtifact(host) {
+  if (host === "git") {
+    return { path: join17(".git", "hooks", "pre-commit"), content: GIT_HOOK, label: "git pre-commit hook" };
+  }
+  return {
+    path: join17(".github", "workflows", "calllint.yml"),
+    content: renderCiGate({ mode: "drift" }),
+    label: "GitHub Actions drift-gate workflow"
+  };
+}
+function guardInstall(args, deps) {
+  const host = flagStr(args.flags, "host");
+  if (!host) {
+    const list = GUARD_HOSTS.map((h2) => `  ${h2.padEnd(8)} \u2192 ${guardArtifact(h2).label}`).join("\n");
+    return {
+      stdout: `Usage: calllint guard install --host <host>
+
+Hosts:
+${list}`,
+      exitCode: EXIT.OK
+    };
+  }
+  if (!isGuardHost(host)) {
+    return {
+      stdout: "",
+      stderr: `Unknown guard host: ${host}
+Run \`calllint guard install\` to list hosts.`,
+      exitCode: EXIT.USAGE
+    };
+  }
+  const art = guardArtifact(host);
+  const rel = flagStr(args.flags, "out") ?? art.path;
+  if (deps.writeFile === false) {
+    return { stdout: `Would write ${rel} (${art.label})`, exitCode: EXIT.OK };
+  }
+  const abs = resolve10(deps.cwd, rel);
+  try {
+    mkdirSync6(dirname6(abs), { recursive: true });
+    writeFileSync11(abs, art.content, "utf8");
+  } catch (e) {
+    return {
+      stdout: "",
+      stderr: `Failed to write ${rel}: ${e instanceof Error ? e.message : String(e)}`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  const note = host === "git" ? `
+Make it executable: chmod +x ${rel}` : "";
+  return { stdout: `Wrote ${rel} (${art.label})${note}`, exitCode: EXIT.OK };
+}
+function guardStatus(args, deps, env) {
+  const approvedPath = flagStr(args.flags, "approved") ?? defaultApprovedPath(deps.cwd);
+  const hasBaseline = existsSync12(approvedPath);
+  const disabled = isDisabled(deps.cwd, env);
+  const gitHook = existsSync12(join17(deps.cwd, ".git", "hooks", "pre-commit"));
+  const ghWorkflow = existsSync12(join17(deps.cwd, ".github", "workflows", "calllint.yml"));
+  const status = {
+    enabled: !disabled,
+    disabledBy: disabled ? env["CALLLINT_GUARD"] === "0" ? "env:CALLLINT_GUARD=0" : "flag:.calllint/guard.json" : null,
+    approvedBaseline: hasBaseline ? approvedPath : null,
+    installedHooks: {
+      "git:pre-commit": gitHook,
+      "github:workflow": ghWorkflow
+    }
+  };
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(status), exitCode: EXIT.OK };
+  }
+  const lines = [
+    `Continuous Guard: ${status.enabled ? "enabled" : `disabled (${status.disabledBy})`}`,
+    `Approved baseline: ${hasBaseline ? approvedPath : "none \u2014 run `calllint approve`"}`,
+    `git pre-commit hook: ${gitHook ? "installed" : "not installed"}`,
+    `GitHub workflow: ${ghWorkflow ? "installed" : "not installed"}`
+  ];
+  return { stdout: lines.join("\n"), exitCode: EXIT.OK };
+}
+function guardSetEnabled(deps, enabled) {
+  const cfg = { schemaVersion: "calllint.guard-config.v0", enabled };
+  if (deps.writeFile === false) {
+    return { stdout: enabled ? "Would enable Continuous Guard" : "Would disable Continuous Guard", exitCode: EXIT.OK };
+  }
+  const path = guardConfigPath(deps.cwd);
+  try {
+    mkdirSync6(dirname6(path), { recursive: true });
+    writeFileSync11(path, JSON.stringify(cfg, null, 2), "utf8");
+  } catch (e) {
+    return {
+      stdout: "",
+      stderr: `Failed to write ${path}: ${e instanceof Error ? e.message : String(e)}`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  return {
+    stdout: enabled ? "Continuous Guard enabled (.calllint/guard.json)." : "Continuous Guard disabled (.calllint/guard.json). Re-enable with `calllint guard enable`.",
+    exitCode: EXIT.OK
+  };
+}
+
 // src/run.ts
 function run(argv, deps) {
   const args = parseArgs(argv);
@@ -9346,6 +10071,13 @@ function run(argv, deps) {
       return evidenceCommand(args, { cwd: deps.cwd });
     case "trust":
       return trustCommand(args, { cwd: deps.cwd, generatedAt: deps.generatedAt, toolVersion: deps.toolVersion });
+    case "guard":
+      return guardCommand(args, {
+        cwd: deps.cwd,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeFile: deps.writeCacheFile
+      });
     case "gen-rule":
       return genRuleCommand(args, { cwd: deps.cwd });
     case "policy":
@@ -9619,13 +10351,13 @@ async function breathe(argv, deps = {}) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join17 } from "node:path";
+import { dirname as dirname7, join as join18 } from "node:path";
 function resolveToolVersion() {
   try {
-    const pkgPath = join17(dirname6(fileURLToPath(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
+    const pkgPath = join18(dirname7(fileURLToPath(import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync20(pkgPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -9635,7 +10367,7 @@ function resolveToolVersion() {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync20(0, "utf8");
+    return readFileSync21(0, "utf8");
   } catch {
     return "";
   }