calllint 1.4.0 → 1.5.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { execFileSync } from "node:child_process";
 
 // src/args.ts
@@ -74,6 +74,10 @@ COMMANDS
   diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
   approve            Record the repo-wide capability surface as approved state (L4)
+  guard              Continuous Guard: re-decide on authority change; silent when unchanged
+  guard install --host <h>  Install a guard hook (git pre-commit, github workflow)
+  guard status       Show baseline / disable / installed-hook state
+  guard disable      Turn Continuous Guard off (.calllint/guard.json)
   receipt verify <f>    Validate a calllint.receipt.v0 (structure + signature if present)
   receipt sign <f>      Sign a receipt with a local key (--key; development/testing)
   receipt keygen        Generate a local ed25519 keypair (--out; development/testing)
@@ -122,6 +126,13 @@ VERIFY OPTIONS
   --ci               Exit 40 if the surface drifted (from baseline or approved state)
   --json             Emit the drift report JSON
 
+GUARD OPTIONS
+  --host <h>         guard install target: git (pre-commit) | github (workflow)
+  --approved [file]  Approved baseline to diff against (default: .calllint/approved.json)
+  --json             Emit the guard assessment / status JSON
+  (exit) silent/note=0, REVIEW=10, UNKNOWN=20, BLOCK=30; guard self-failure is non-zero
+  (env)  CALLLINT_GUARD=0 disables the guard
+
 EXAMPLES
   calllint inventory                    # List discovered agent configs
   calllint scan --auto                  # Discover and scan all agents
@@ -140,6 +151,8 @@ EXAMPLES
   calllint inbox inspect gmail-reply.normalized.json
   calllint verify ./mcp.json --ci
   calllint approve && calllint verify --approved --ci
+  calllint approve && calllint guard install --host git   # re-decide on every commit
+  calllint guard --json                 # authority-change assessment (silent when unchanged)
   calllint explain filesystem
 `;
 function helpCommand() {
@@ -407,7 +420,10 @@ var REASON_CODES = [
   "PROMPT_METADATA_INSTRUCTION",
   "OAUTH_SCOPE_UNKNOWN_OR_EXPANDED",
   "TOOL_DESCRIPTOR_CHANGED",
-  "LONG_RUNNING_GATEWAY_RUNTIME"
+  "LONG_RUNNING_GATEWAY_RUNTIME",
+  // #13 — appended last (ADR 0044) so the frozen order 0–11 is unchanged. Backed by
+  // the flow object (calllint.flow.v0), not a static detector; see REASON_CODE_META.
+  "TOXIC_FLOW_COMPOSITION"
 ];
 var REASON_CODE_META = {
   UNPINNED_PACKAGE: {
@@ -471,6 +487,16 @@ var REASON_CODE_META = {
     backedBy: ["runtime.gateway"],
     status: "wired",
     label: "Long-running gateway runtime"
+  },
+  TOXIC_FLOW_COMPOSITION: {
+    // Backed by the flow object (calllint.flow.v0, built by the flow-analyzer package),
+    // NOT a static detector Finding. The synthetic backing id keeps every wired code
+    // naming its backing without inventing a new status value. No detector emits this id,
+    // so findingsToReasonCodes never fabricates the code — it is produced only by the
+    // explicit flow-fold step. See ADR 0044 / 0040.
+    backedBy: ["flow:toxic-composition"],
+    status: "wired",
+    label: "Cross-tool toxic-flow composition"
   }
 };
 function reasonCodeForFinding(findingId) {
@@ -491,6 +517,9 @@ var VERDICT_NEXT_ACTION = {
 // ../../packages/types/src/authority.ts
 var AUTHORITY_SCHEMA_VERSION = "calllint.authority.v0";
 
+// ../../packages/types/src/flow.ts
+var FLOW_SCHEMA_VERSION = "calllint.flow.v0";
+
 // ../../packages/types/src/trustDecision.ts
 var DECISION_SCHEMA_VERSION = "calllint.decision.v0";
 
@@ -624,11 +653,13 @@ function evidenceFloor(evidence) {
 function decideOverAuthority(input) {
   const { authority, policy } = input;
   const evidence = input.evidence ?? [];
-  const reasons = authority.capabilities.map((c) => {
+  const capabilityReasons = authority.capabilities.map((c) => {
     const code = reasonCodeFor(c);
     const contributes = moreSevere(baseVerdict(c), policyFloor(code, policy));
     return { code, evidenceSource: c.evidenceSource, contributes };
   });
+  const flowReasons = input.flowReasons ?? [];
+  const reasons = [...capabilityReasons, ...flowReasons];
   const unknowns = [...authority.unknowns];
   const contributions = reasons.map((r) => r.contributes);
   if (authority.subject.artifactDigest === null) {
@@ -1863,6 +1894,21 @@ function analyzeDocumentSurfaces(surfaces) {
   ];
 }
 
+// ../../packages/static-analyzer/src/trustSource.ts
+function classifyTrustSource(cap) {
+  if (cap.action === "read" && cap.resource === "secret") return "sensitive.secret";
+  if (cap.action === "execute" && cap.resource === "process" && cap.evidenceSource === "server.command") {
+    return "trusted.local_project";
+  }
+  return "unknown";
+}
+function withTrustSource(caps) {
+  return caps.map((c) => {
+    const ts = classifyTrustSource(c);
+    return ts === "unknown" ? { ...c } : { ...c, trustSource: ts };
+  });
+}
+
 // ../../packages/static-analyzer/src/instructionAuthority.ts
 var RULES = [
   // 1. privilege-escalation → execute × process (irreversible, must be approved)
@@ -2068,7 +2114,7 @@ function extractInstructionAuthority(surfaces) {
       }
     }
   }
-  return sortCapabilities([...seen.values()]);
+  return withTrustSource(sortCapabilities([...seen.values()]));
 }
 function sortCapabilities(caps) {
   return caps.sort((a, b) => {
@@ -2155,7 +2201,7 @@ function deriveConfigCapabilities(server) {
       completeness: "complete"
     });
   }
-  return sortCapabilities(caps);
+  return sortCapabilities(withTrustSource(caps));
 }
 
 // ../../packages/risk-engine/src/computeRiskClass.ts
@@ -3366,6 +3412,60 @@ function escalate(current) {
   return current === "BLOCK" || current === "UNKNOWN" ? current : "REVIEW";
 }
 
+// ../../packages/core/src/state/continuousGuard.ts
+function assessGuardDrift(report) {
+  if (!report.drifted) {
+    return {
+      action: "silent",
+      verdict: "SAFE",
+      drifted: false,
+      summary: "No authority change since the approved baseline."
+    };
+  }
+  const changed = report.entries.filter((e) => e.status !== "unchanged");
+  const n = changed.length;
+  const surfaces = `${n} surface${n === 1 ? "" : "s"}`;
+  switch (report.verdict) {
+    case "BLOCK":
+      return {
+        action: "refuse",
+        verdict: "BLOCK",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; the new surface is blocked by policy.`
+      };
+    case "UNKNOWN":
+      return {
+        action: "request-evidence",
+        verdict: "UNKNOWN",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; the new surface could not be verified \u2014 evidence or approval required.`
+      };
+    case "REVIEW":
+      return {
+        action: "prompt",
+        verdict: "REVIEW",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; review the new surface before proceeding.`
+      };
+    case "SAFE":
+      return {
+        action: "note",
+        verdict: "SAFE",
+        drifted: true,
+        summary: `Authority changed on ${surfaces}; no new blockers observed.`
+      };
+  }
+}
+function guardFailClosed(failure) {
+  return {
+    action: "fail-closed",
+    verdict: "UNKNOWN",
+    drifted: false,
+    summary: "Continuous Guard could not verify the authority surface; failing closed.",
+    failure
+  };
+}
+
 // ../../packages/core/src/distribution/agentRule.ts
 var RELEVANT_SURFACES = [
   ".cursor/mcp.json",
@@ -3499,6 +3599,64 @@ ${rule()}
   }
 }
 
+// ../../packages/core/src/distribution/ciGate.ts
+var CI_GATE_PATHS = [
+  "**/mcp.json",
+  "**/.mcp.json",
+  "**/settings.json",
+  "**/config.toml",
+  ".cursor/**",
+  ".vscode/**",
+  "claude_desktop_config.json",
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".calllint/approved.json"
+];
+function pathsBlock() {
+  return CI_GATE_PATHS.map((p) => `      - ${JSON.stringify(p)}`).join("\n");
+}
+var DRIFT_STEP = `      - name: CallLint drift gate
+        shell: bash
+        run: |
+          if [ -f .calllint/approved.json ]; then
+            npx -y calllint verify --approved --ci --no-emoji
+          else
+            echo "No .calllint/approved.json \u2014 seed it with: npx calllint approve"
+            echo "Running report-only scan-all (not gating)."
+            npx -y calllint scan-all --no-emoji || true
+          fi`;
+var SCAN_ALL_STEP = `      - name: CallLint scan-all (report-only)
+        shell: bash
+        run: npx -y calllint scan-all --no-emoji || true`;
+function renderCiGate(opts = {}) {
+  const mode = opts.mode ?? "drift";
+  const step = mode === "scan-all" ? SCAN_ALL_STEP : DRIFT_STEP;
+  const headline = mode === "scan-all" ? "CallLint agent-tool surface report (report-only; never gates)." : "CallLint agent-tool surface drift gate (fails on approved-state drift).";
+  return `# ${headline}
+# Generated by \`calllint\` (generate_ci_gate_snippet). CallLint is static and
+# NEVER executes a scanned server.
+name: calllint
+
+on:
+  pull_request:
+    paths:
+${pathsBlock()}
+
+permissions:
+  contents: read
+
+jobs:
+  surface-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20
+${step}
+`;
+}
+
 // ../../packages/core/src/receipt/createReceipt.ts
 import { randomBytes } from "node:crypto";
 function newReceiptId() {
@@ -7918,6 +8076,235 @@ import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as rea
 import { basename as basename4, join as join16, resolve as resolvePath4 } from "node:path";
 import { homedir, userInfo } from "node:os";
 
+// ../../packages/flow-analyzer/src/flowRules.ts
+var UNTRUSTED_OR_SENSITIVE = /* @__PURE__ */ new Set([
+  "sensitive.secret",
+  "sensitive.private_data",
+  "untrusted.public_content",
+  "untrusted.tool_output",
+  "untrusted.peer_agent",
+  "untrusted.memory"
+]);
+var TRUSTED = /* @__PURE__ */ new Set([
+  "trusted.policy",
+  "trusted.user_explicit",
+  "trusted.local_project",
+  "trusted.signed_component"
+]);
+function isUntrustedOrSensitive(ts) {
+  return ts !== void 0 && UNTRUSTED_OR_SENSITIVE.has(ts);
+}
+function isTrusted(ts) {
+  return ts !== void 0 && TRUSTED.has(ts);
+}
+function sinkKind(sink) {
+  const key = `${sink.action}:${sink.resource}`;
+  if (key === "send:network" || key === "connect:network") return "network";
+  if (key === "send:message") return "message";
+  if (key === "spend:financial") return "financial";
+  return "other";
+}
+function hasExternalDestination(sink) {
+  return typeof sink.destination === "string" && sink.destination.length > 0;
+}
+var FLOW_RULES = [
+  // CL-FLOW-001 — the canonical toxic flow: untrusted/sensitive data → external network
+  // egress with a concrete outbound destination. The motivating incident (new9): a
+  // secret / injected public content leaving to an attacker-controlled host.
+  {
+    id: "CL-FLOW-001",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "network" && hasExternalDestination(k),
+    decisionHint: "BLOCK",
+    riskClass: "critical"
+  },
+  // CL-FLOW-002 — untrusted/sensitive data → financial action (spend). Money leaving is
+  // irreversible; a tainted source driving it is a blocker regardless of destination.
+  {
+    id: "CL-FLOW-002",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "financial",
+    decisionHint: "BLOCK",
+    riskClass: "critical"
+  },
+  // CL-FLOW-003 — untrusted/sensitive data → external network egress WITHOUT a pinned
+  // destination (host unknown). Still dangerous, but the sink is less determined, so it
+  // warrants human review rather than an outright block.
+  {
+    id: "CL-FLOW-003",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "network" && !hasExternalDestination(k),
+    decisionHint: "REVIEW",
+    riskClass: "high"
+  },
+  // CL-FLOW-004 — untrusted/sensitive data → outbound messaging (email/chat). Exfiltration
+  // via a messaging channel; review-worthy.
+  {
+    id: "CL-FLOW-004",
+    when: (s, k) => isUntrustedOrSensitive(s.trustSource) && sinkKind(k) === "message",
+    decisionHint: "REVIEW",
+    riskClass: "high"
+  },
+  // CL-FLOW-ALLOW-001 — an established TRUSTED source reaching an egress sink is the
+  // benign counterpart (ADR 0041 §2: trusted.user_explicit → send is routine). Only fires
+  // when the source is positively trusted — never on unknown (I-04).
+  {
+    id: "CL-FLOW-ALLOW-001",
+    when: (s, k) => isTrusted(s.trustSource) && sinkKind(k) !== "other",
+    decisionHint: "ALLOW",
+    riskClass: "none"
+  },
+  // CL-FLOW-REVIEW-000 — fail-safe catch-all. Any composition not positively classified
+  // above (including one whose source trust could not be established) is REVIEW, never
+  // ALLOW/SAFE. This keeps the classifier total and dangerous-flow-never-SAFE.
+  {
+    id: "CL-FLOW-REVIEW-000",
+    when: () => true,
+    decisionHint: "REVIEW",
+    riskClass: "medium"
+  }
+];
+function classifyFlow(source, sink) {
+  for (const rule2 of FLOW_RULES) {
+    if (rule2.when(source, sink)) {
+      return { ruleId: rule2.id, decisionHint: rule2.decisionHint, riskClass: rule2.riskClass };
+    }
+  }
+  return { ruleId: "CL-FLOW-REVIEW-000", decisionHint: "REVIEW", riskClass: "medium" };
+}
+
+// ../../packages/flow-analyzer/src/buildFlows.ts
+var CLASSIFIED_SOURCE_TRUST = /* @__PURE__ */ new Set([
+  "sensitive.secret",
+  "sensitive.private_data",
+  "untrusted.public_content",
+  "untrusted.tool_output",
+  "untrusted.peer_agent",
+  "untrusted.memory",
+  "trusted.policy",
+  "trusted.user_explicit",
+  "trusted.local_project",
+  "trusted.signed_component"
+]);
+var EGRESS_SINKS = /* @__PURE__ */ new Set([
+  "send:network",
+  "send:message",
+  "connect:network",
+  "spend:financial"
+]);
+function isSource(c) {
+  return c.action === "read" && c.trustSource !== void 0 && CLASSIFIED_SOURCE_TRUST.has(c.trustSource);
+}
+function isSink(c) {
+  return EGRESS_SINKS.has(`${c.action}:${c.resource}`);
+}
+function sourceFamily(ts) {
+  if (ts.startsWith("sensitive.")) return "sensitive";
+  if (ts.startsWith("trusted.")) return "trusted";
+  return "untrusted";
+}
+var SEVERITY = {
+  none: 0,
+  low: 20,
+  medium: 50,
+  high: 75,
+  critical: 95
+};
+function cmp3(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function capKey(t) {
+  const c = t.cap;
+  return [
+    t.manifestDigest,
+    c.trustSource ?? "",
+    c.action,
+    c.resource,
+    c.scope ?? "",
+    c.destination ?? "",
+    c.evidenceSource
+  ].join("|");
+}
+function sealFlow(flow) {
+  return { ...flow, digest: hashJson(flow) };
+}
+function buildFlows(manifests) {
+  const tagged = manifests.flatMap((m) => m.capabilities.map((cap) => ({ cap, manifestDigest: m.digest }))).sort((a, b) => cmp3(capKey(a), capKey(b)));
+  const sources = tagged.filter((t) => isSource(t.cap));
+  const sinks = tagged.filter((t) => isSink(t.cap));
+  const byDigest = /* @__PURE__ */ new Map();
+  for (const src of sources) {
+    for (const snk of sinks) {
+      if (src.cap === snk.cap) continue;
+      const ts = src.cap.trustSource;
+      const outcome = classifyFlow(src.cap, snk.cap);
+      const risk = {
+        class: outcome.riskClass,
+        severity: SEVERITY[outcome.riskClass]
+      };
+      const sinkTag = `${snk.cap.action}-${snk.cap.resource}`;
+      const flowId = `flow:${sourceFamily(ts)}-to-${sinkTag}`;
+      const evidence = [.../* @__PURE__ */ new Set([src.cap.evidenceSource, snk.cap.evidenceSource])].sort();
+      const authorityDigests = [.../* @__PURE__ */ new Set([src.manifestDigest, snk.manifestDigest])].sort();
+      const flow = sealFlow({
+        schema: FLOW_SCHEMA_VERSION,
+        flowId,
+        source: { trustSource: ts, evidence: [src.cap.evidenceSource] },
+        steps: [{ action: src.cap.action, resource: src.cap.resource, scope: src.cap.scope }],
+        sink: {
+          action: snk.cap.action,
+          resource: snk.cap.resource,
+          destination: snk.cap.destination
+        },
+        risk,
+        decisionHint: outcome.decisionHint,
+        evidence,
+        authorityDigests
+      });
+      if (!byDigest.has(flow.digest)) byDigest.set(flow.digest, flow);
+    }
+  }
+  return [...byDigest.values()].sort(
+    (a, b) => cmp3(a.flowId, b.flowId) || cmp3(a.digest, b.digest)
+  );
+}
+
+// ../../packages/flow-analyzer/src/foldFlows.ts
+function hintToVerdict(hint) {
+  switch (hint) {
+    case "BLOCK":
+      return "BLOCK";
+    case "REVIEW":
+      return "REVIEW";
+    default:
+      return null;
+  }
+}
+function foldFlowsIntoReasons(flows) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const flow of flows) {
+    const contributes = hintToVerdict(flow.decisionHint);
+    if (contributes === null) continue;
+    const firstEvidence = flow.evidence[0];
+    const evidenceSource = firstEvidence ? `${flow.flowId} (${firstEvidence})` : flow.flowId;
+    const reason = {
+      code: "TOXIC_FLOW_COMPOSITION",
+      evidenceSource,
+      contributes
+    };
+    const prev = byKey.get(evidenceSource);
+    if (!prev || severity(contributes) > severity(prev.contributes)) {
+      byKey.set(evidenceSource, reason);
+    }
+  }
+  return [...byKey.values()].sort(
+    (a, b) => cmp4(a.evidenceSource, b.evidenceSource) || severity(b.contributes) - severity(a.contributes)
+  );
+}
+function severity(v) {
+  return v === "BLOCK" ? 3 : v === "UNKNOWN" ? 2 : v === "REVIEW" ? 1 : 0;
+}
+function cmp4(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
 // ../../packages/install-planner/src/buildPlan.ts
 function ptr(segment) {
   return segment.replace(/~/g, "~0").replace(/\//g, "~1");
@@ -8812,7 +9199,9 @@ function trustPrepare(args, deps) {
   const authority = buildAuthorityForTarget(input, artifact.digest ?? null);
   const policyPath = flagStr(args.flags, "policy");
   const policy = loadPolicyOrDefault(policyPath ? resolvePath4(deps.cwd, policyPath) : void 0);
-  const decision = artifact.resolution === "resolved" ? decideOverAuthority({ authority, evidence, policy }) : void 0;
+  const flows = buildFlows([authority]);
+  const flowReasons = foldFlowsIntoReasons(flows);
+  const decision = artifact.resolution === "resolved" ? decideOverAuthority({ authority, evidence, policy, flowReasons }) : void 0;
   let plan;
   const hostFlag = flagStr(args.flags, "host");
   if (hostFlag && decision && decision.verdict !== "UNKNOWN") {
@@ -8839,10 +9228,18 @@ function trustPrepare(args, deps) {
 plan written: ${file}
 `;
   }
+  const showFlows = flagBool(args.flags, "flows");
   if (flagBool(args.flags, "json")) {
-    return { stdout: JSON.stringify(preparation, null, 2), stderr: "", exitCode };
+    const payload = showFlows ? { preparation, flows } : preparation;
+    return { stdout: JSON.stringify(payload, null, 2), stderr: "", exitCode };
   }
-  return { stdout: renderPreparation(preparation) + planNote, stderr: "", exitCode };
+  const flowNote = showFlows ? renderFlows(flows) : "";
+  const conversion = renderConversionPrompt(preparation);
+  return {
+    stdout: renderPreparation(preparation) + flowNote + planNote + conversion,
+    stderr: "",
+    exitCode
+  };
 }
 function loadPreparation(args, deps) {
   const file = args.positionals[1];
@@ -9137,6 +9534,46 @@ This is the READ-ONLY half of the Trust Gateway. It touched no live config
 `;
   return out;
 }
+function renderConversionPrompt(p) {
+  const d = p.decision;
+  if (!d || d.verdict === "BLOCK" || d.verdict === "UNKNOWN") return "";
+  return `
+Next step (nothing is persisted unless you run one of these):
+  \u2022 Record this surface as approved:   calllint approve
+  \u2022 Re-decide on every authority change: calllint guard install --host git
+  \u2022 Gate pull requests in CI:           calllint guard install --host github
+  \u2022 Teach your agent the safety rule:   calllint gen-rule --host claude --write
+`;
+}
+var FLOW_HINT_SYMBOL = {
+  BLOCK: "\u26D4 BLOCK",
+  REVIEW: "\u26A0 REVIEW",
+  ALLOW: "\u{1F6E1} ALLOW"
+};
+function renderFlows(flows) {
+  if (flows.length === 0) {
+    return `
+toxic-flows:   (none \u2014 no cross-capability composition detected)
+`;
+  }
+  let out = `
+toxic-flows:   ${flows.length} path(s) [calllint.flow.v0]
+`;
+  for (const f of flows) {
+    const dst = f.sink.destination ? ` \u2192 ${f.sink.destination}` : "";
+    out += `  ${FLOW_HINT_SYMBOL[f.decisionHint] ?? f.decisionHint}  ${f.flowId}  (${f.risk.class})
+`;
+    out += `      source: ${f.source.trustSource}  \u2192  sink: ${f.sink.action} ${f.sink.resource}${dst}
+`;
+    out += `      evidence: ${f.evidence.join(", ")}
+`;
+  }
+  out += `  A dangerous flow is folded into the decision as a TOXIC_FLOW_COMPOSITION reason;
+`;
+  out += `  it can only raise the verdict, never lower it. An ALLOW flow contributes nothing.
+`;
+  return out;
+}
 function renderExplanation(p) {
   let out = `
 CallLint trust explain
@@ -9306,6 +9743,9 @@ OPTIONS (prepare)
                         only for a non-blocking decision (SAFE/REVIEW).
   --host-config <path>  Override the host config path (default: ~/.claude.json)
   --write-plan          Persist the plan to .calllint/plans/<plan-id>.json
+  --flows               Show static toxic-flow paths (calllint.flow.v0) behind the
+                        decision's TOXIC_FLOW_COMPOSITION reasons. With --json, emits
+                        { preparation, flows }. A dangerous flow only raises the verdict.
   --no-llm              Default posture: no LLM in the verdict path (accepted, no-op)
   --json                Emit the raw calllint.trust-preparation.v0 document
 
@@ -9350,6 +9790,209 @@ SEE ALSO
 `;
 }
 
+// src/commands/guard.ts
+import { existsSync as existsSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync6 } from "node:fs";
+import { dirname as dirname6, join as join17, resolve as resolve10 } from "node:path";
+var GUARD_HOSTS = ["git", "github"];
+function guardConfigPath(cwd) {
+  return join17(cwd, ".calllint", "guard.json");
+}
+function readGuardConfig(cwd) {
+  const path = guardConfigPath(cwd);
+  if (!existsSync12(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync19(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function isDisabled(cwd, env) {
+  if (env["CALLLINT_GUARD"] === "0") return true;
+  return readGuardConfig(cwd)?.enabled === false;
+}
+function guardCommand(args, deps) {
+  const sub = args.positionals[0];
+  const env = deps.env ?? process.env;
+  switch (sub) {
+    case "install":
+      return guardInstall(args, deps);
+    case "status":
+      return guardStatus(args, deps, env);
+    case "disable":
+      return guardSetEnabled(deps, false);
+    case "enable":
+      return guardSetEnabled(deps, true);
+    case void 0:
+      return guardRun(args, deps, env);
+    default:
+      return {
+        stdout: "",
+        stderr: `Unknown guard subcommand: ${sub}
+Run \`calllint guard\` (assess) or \`calllint guard install|status|disable|enable\`.`,
+        exitCode: EXIT.USAGE
+      };
+  }
+}
+function exitForAction(a) {
+  switch (a.action) {
+    case "silent":
+    case "note":
+      return EXIT.OK;
+    case "prompt":
+      return EXIT.REVIEW;
+    case "request-evidence":
+      return EXIT.UNKNOWN;
+    case "refuse":
+      return EXIT.BLOCK;
+    case "fail-closed":
+      return EXIT.ERROR;
+  }
+}
+function guardRun(args, deps, env) {
+  const json = flagBool(args.flags, "json");
+  if (isDisabled(deps.cwd, env)) {
+    const note = "Continuous Guard is disabled (CALLLINT_GUARD=0 or .calllint/guard.json).";
+    return {
+      stdout: json ? JSON.stringify({ enabled: false, note }) : note,
+      exitCode: EXIT.OK
+    };
+  }
+  const approvedPath = flagStr(args.flags, "approved") ?? defaultApprovedPath(deps.cwd);
+  const approved = readApproved(approvedPath);
+  if (!approved) {
+    return {
+      stdout: "",
+      stderr: `No approved baseline at ${approvedPath}. Run \`calllint approve\` first.`,
+      exitCode: EXIT.USAGE
+    };
+  }
+  let assessment;
+  try {
+    const current = decideRepoSurfaces(deps.cwd, { now: deps.now, generatedAt: deps.generatedAt });
+    const drift = verifyApproved(current, approved, deps.generatedAt);
+    assessment = assessGuardDrift(drift);
+  } catch (err2) {
+    assessment = guardFailClosed(err2 instanceof Error ? err2.message : String(err2));
+  }
+  const exitCode = exitForAction(assessment);
+  if (json) {
+    return { stdout: JSON.stringify(assessment), exitCode };
+  }
+  if (assessment.action === "silent") {
+    return { stdout: "", exitCode: EXIT.OK };
+  }
+  const prefix = assessment.action === "fail-closed" ? "GUARD FAILED CLOSED" : assessment.action === "refuse" ? "BLOCK" : assessment.action === "request-evidence" ? "UNKNOWN" : assessment.action === "prompt" ? "REVIEW" : "NOTE";
+  const failLine = assessment.failure ? `
+  reason: ${assessment.failure}` : "";
+  return { stdout: `${prefix}: ${assessment.summary}${failLine}`, exitCode };
+}
+function isGuardHost(v) {
+  return v !== void 0 && GUARD_HOSTS.includes(v);
+}
+var GIT_HOOK = `#!/usr/bin/env bash
+# CallLint Continuous Guard (ADR 0045). Re-decides the agent-tool authority
+# surface on commit; silent when nothing changed. Generated by \`calllint guard install\`.
+# CallLint is static and NEVER executes a scanned server.
+npx -y calllint guard --no-emoji
+`;
+function guardArtifact(host) {
+  if (host === "git") {
+    return { path: join17(".git", "hooks", "pre-commit"), content: GIT_HOOK, label: "git pre-commit hook" };
+  }
+  return {
+    path: join17(".github", "workflows", "calllint.yml"),
+    content: renderCiGate({ mode: "drift" }),
+    label: "GitHub Actions drift-gate workflow"
+  };
+}
+function guardInstall(args, deps) {
+  const host = flagStr(args.flags, "host");
+  if (!host) {
+    const list = GUARD_HOSTS.map((h2) => `  ${h2.padEnd(8)} \u2192 ${guardArtifact(h2).label}`).join("\n");
+    return {
+      stdout: `Usage: calllint guard install --host <host>
+
+Hosts:
+${list}`,
+      exitCode: EXIT.OK
+    };
+  }
+  if (!isGuardHost(host)) {
+    return {
+      stdout: "",
+      stderr: `Unknown guard host: ${host}
+Run \`calllint guard install\` to list hosts.`,
+      exitCode: EXIT.USAGE
+    };
+  }
+  const art = guardArtifact(host);
+  const rel = flagStr(args.flags, "out") ?? art.path;
+  if (deps.writeFile === false) {
+    return { stdout: `Would write ${rel} (${art.label})`, exitCode: EXIT.OK };
+  }
+  const abs = resolve10(deps.cwd, rel);
+  try {
+    mkdirSync6(dirname6(abs), { recursive: true });
+    writeFileSync11(abs, art.content, "utf8");
+  } catch (e) {
+    return {
+      stdout: "",
+      stderr: `Failed to write ${rel}: ${e instanceof Error ? e.message : String(e)}`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  const note = host === "git" ? `
+Make it executable: chmod +x ${rel}` : "";
+  return { stdout: `Wrote ${rel} (${art.label})${note}`, exitCode: EXIT.OK };
+}
+function guardStatus(args, deps, env) {
+  const approvedPath = flagStr(args.flags, "approved") ?? defaultApprovedPath(deps.cwd);
+  const hasBaseline = existsSync12(approvedPath);
+  const disabled = isDisabled(deps.cwd, env);
+  const gitHook = existsSync12(join17(deps.cwd, ".git", "hooks", "pre-commit"));
+  const ghWorkflow = existsSync12(join17(deps.cwd, ".github", "workflows", "calllint.yml"));
+  const status = {
+    enabled: !disabled,
+    disabledBy: disabled ? env["CALLLINT_GUARD"] === "0" ? "env:CALLLINT_GUARD=0" : "flag:.calllint/guard.json" : null,
+    approvedBaseline: hasBaseline ? approvedPath : null,
+    installedHooks: {
+      "git:pre-commit": gitHook,
+      "github:workflow": ghWorkflow
+    }
+  };
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(status), exitCode: EXIT.OK };
+  }
+  const lines = [
+    `Continuous Guard: ${status.enabled ? "enabled" : `disabled (${status.disabledBy})`}`,
+    `Approved baseline: ${hasBaseline ? approvedPath : "none \u2014 run `calllint approve`"}`,
+    `git pre-commit hook: ${gitHook ? "installed" : "not installed"}`,
+    `GitHub workflow: ${ghWorkflow ? "installed" : "not installed"}`
+  ];
+  return { stdout: lines.join("\n"), exitCode: EXIT.OK };
+}
+function guardSetEnabled(deps, enabled) {
+  const cfg = { schemaVersion: "calllint.guard-config.v0", enabled };
+  if (deps.writeFile === false) {
+    return { stdout: enabled ? "Would enable Continuous Guard" : "Would disable Continuous Guard", exitCode: EXIT.OK };
+  }
+  const path = guardConfigPath(deps.cwd);
+  try {
+    mkdirSync6(dirname6(path), { recursive: true });
+    writeFileSync11(path, JSON.stringify(cfg, null, 2), "utf8");
+  } catch (e) {
+    return {
+      stdout: "",
+      stderr: `Failed to write ${path}: ${e instanceof Error ? e.message : String(e)}`,
+      exitCode: EXIT.ERROR
+    };
+  }
+  return {
+    stdout: enabled ? "Continuous Guard enabled (.calllint/guard.json)." : "Continuous Guard disabled (.calllint/guard.json). Re-enable with `calllint guard enable`.",
+    exitCode: EXIT.OK
+  };
+}
+
 // src/run.ts
 function run(argv, deps) {
   const args = parseArgs(argv);
@@ -9428,6 +10071,13 @@ function run(argv, deps) {
       return evidenceCommand(args, { cwd: deps.cwd });
     case "trust":
       return trustCommand(args, { cwd: deps.cwd, generatedAt: deps.generatedAt, toolVersion: deps.toolVersion });
+    case "guard":
+      return guardCommand(args, {
+        cwd: deps.cwd,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeFile: deps.writeCacheFile
+      });
     case "gen-rule":
       return genRuleCommand(args, { cwd: deps.cwd });
     case "policy":
@@ -9701,13 +10351,13 @@ async function breathe(argv, deps = {}) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join17 } from "node:path";
+import { dirname as dirname7, join as join18 } from "node:path";
 function resolveToolVersion() {
   try {
-    const pkgPath = join17(dirname6(fileURLToPath(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
+    const pkgPath = join18(dirname7(fileURLToPath(import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync20(pkgPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -9717,7 +10367,7 @@ function resolveToolVersion() {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync20(0, "utf8");
+    return readFileSync21(0, "utf8");
   } catch {
     return "";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",
@@ -55,6 +55,7 @@
     "@calllint/evidence": "workspace:*",
     "@calllint/fingerprint": "workspace:*",
     "@calllint/fixtures": "workspace:*",
+    "@calllint/flow-analyzer": "workspace:*",
     "@calllint/install-planner": "workspace:*",
     "@calllint/online": "workspace:*",
     "@calllint/policy": "workspace:*",