codebot-ai 1.7.0 → 1.9.0

package/dist/cli.js

@@ -49,7 +49,10 @@ const scheduler_1 = require("./scheduler");
 const audit_1 = require("./audit");
 const policy_1 = require("./policy");
 const sandbox_1 = require("./sandbox");
-const VERSION = '1.7.0';
+const replay_1 = require("./replay");
+const risk_1 = require("./risk");
+const sarif_1 = require("./sarif");
+const VERSION = '1.9.0';
 const C = {
     reset: '\x1b[0m',
     bold: '\x1b[1m',
@@ -168,6 +171,78 @@ async function main() {
         console.log(`  Network: ${info.defaults.network ? 'enabled' : 'disabled'} by default`);
         return;
     }
+    // --replay: Replay a saved session
+    if (args.replay) {
+        const replayId = typeof args.replay === 'string'
+            ? args.replay
+            : history_1.SessionManager.latest();
+        if (!replayId) {
+            console.log(c('No session to replay. Specify an ID or ensure a previous session exists.', 'yellow'));
+            return;
+        }
+        const data = (0, replay_1.loadSessionForReplay)(replayId);
+        if (!data) {
+            console.log(c(`Session ${replayId} not found or empty.`, 'red'));
+            return;
+        }
+        console.log(c(`\nReplaying session ${replayId.substring(0, 12)}...`, 'cyan'));
+        console.log(c(`  ${data.messages.length} messages (${data.userMessages.length} user, ${data.assistantMessages.length} assistant)`, 'dim'));
+        const replayProvider = new replay_1.ReplayProvider(data.assistantMessages);
+        const config = await resolveConfig(args);
+        const agent = new agent_1.Agent({
+            provider: replayProvider,
+            model: config.model,
+            providerName: 'replay',
+            autoApprove: true,
+        });
+        // Collect recorded tool results in order for sequential comparison
+        const recordedResults = Array.from(data.toolResults.values());
+        let resultIndex = 0;
+        let divergences = 0;
+        for (const userMsg of data.userMessages) {
+            console.log(c(`\n> ${truncate(userMsg.content, 100)}`, 'cyan'));
+            for await (const event of agent.run(userMsg.content)) {
+                if (event.type === 'tool_result' && event.toolResult && !event.toolResult.is_error) {
+                    const recorded = recordedResults[resultIndex++];
+                    if (recorded !== undefined) {
+                        const diff = (0, replay_1.compareOutputs)(recorded, event.toolResult.result);
+                        if (diff) {
+                            divergences++;
+                            console.log(c(`  ⚠ Divergence in ${event.toolResult.name || 'tool'}:`, 'yellow'));
+                            console.log(c(`    ${diff.split('\n').join('\n    ')}`, 'dim'));
+                        }
+                        else {
+                            console.log(c(`  ✓ ${event.toolResult.name || 'tool'} — output matches`, 'green'));
+                        }
+                    }
+                }
+                else if (event.type === 'text') {
+                    process.stdout.write(c('.', 'dim'));
+                }
+            }
+        }
+        console.log(c(`\n\nReplay complete.`, 'bold'));
+        if (divergences === 0) {
+            console.log(c('  All tool outputs match — session is reproducible.', 'green'));
+        }
+        else {
+            console.log(c(`  ${divergences} divergence(s) detected — environment may have changed.`, 'yellow'));
+        }
+        return;
+    }
+    // --export-audit sarif: Export audit log as SARIF 2.1.0
+    if (args['export-audit'] === 'sarif' || args['export-audit'] === true) {
+        const logger = new audit_1.AuditLogger();
+        const sessionId = typeof args['session'] === 'string' ? args['session'] : undefined;
+        const entries = sessionId ? logger.query({ sessionId }) : logger.query();
+        if (entries.length === 0) {
+            console.error(c('No audit entries found.', 'yellow'));
+            process.exit(1);
+        }
+        const sarif = (0, sarif_1.exportSarif)(entries, { version: VERSION, sessionId });
+        process.stdout.write((0, sarif_1.sarifToString)(sarif) + '\n');
+        return;
+    }
     // First run: auto-launch setup if nothing is configured
     if ((0, setup_1.isFirstRun)() && process.stdin.isTTY && !args.message) {
         console.log(c('Welcome! No configuration found — launching setup...', 'cyan'));
@@ -177,6 +252,11 @@ async function main() {
     }
     const config = await resolveConfig(args);
     const provider = createProvider(config);
+    // Deterministic mode: set temperature=0
+    if (args.deterministic) {
+        provider.temperature = 0;
+        console.log(c('  Deterministic mode: temperature=0', 'dim'));
+    }
     // Session management
     let resumeId;
     if (args.continue) {
@@ -234,7 +314,7 @@ async function main() {
     // Cleanup scheduler on exit
     scheduler.stop();
 }
-/** Print session summary with tokens, cost, tool calls, files modified */
+/** Print session summary with tokens, cost, tool calls, files modified, metrics */
 function printSessionSummary(agent) {
     const tracker = agent.getTokenTracker();
     tracker.saveUsage();
@@ -249,6 +329,27 @@ function printSessionSummary(agent) {
     console.log(`  Requests:  ${summary.requestCount}`);
     console.log(`  Tools:     ${summary.toolCalls} calls`);
     console.log(`  Files:     ${summary.filesModified} modified`);
+    // v1.9.0: Per-tool breakdown from MetricsCollector
+    const metrics = agent.getMetrics();
+    const snap = metrics.snapshot();
+    const toolCounters = snap.counters.filter(c => c.name === 'tool_calls_total');
+    if (toolCounters.length > 0) {
+        console.log(c('  Per-tool:', 'dim'));
+        for (const tc of toolCounters.sort((a, b) => b.value - a.value)) {
+            const hist = snap.histograms.find(h => h.name === 'tool_latency_seconds' && h.labels.tool === tc.labels.tool);
+            const avg = hist && hist.count > 0 ? (hist.sum / hist.count * 1000).toFixed(0) : '?';
+            console.log(c(`    ${tc.labels.tool}: ${tc.value} calls (avg ${avg}ms)`, 'dim'));
+        }
+    }
+    // Risk summary
+    const riskScorer = agent.getRiskScorer();
+    const riskAvg = riskScorer.getSessionAverage();
+    if (riskScorer.getHistory().length > 0) {
+        console.log(`  Risk:      avg ${riskAvg}/100`);
+    }
+    // Save metrics
+    metrics.save();
+    metrics.exportOtel();
 }
 function createProvider(config) {
     if (config.provider === 'anthropic') {
@@ -328,8 +429,14 @@ function renderEvent(event, agent) {
                 process.stdout.write('\n');
                 isThinking = false;
             }
-            console.log(c(`\n⚡ ${event.toolCall?.name}`, 'yellow') +
-                c(`(${formatArgs(event.toolCall?.args)})`, 'dim'));
+            {
+                const riskStr = event.risk
+                    ? ' ' + risk_1.RiskScorer.formatIndicator({ score: event.risk.score, level: event.risk.level, factors: [] })
+                    : '';
+                console.log(c(`\n⚡ ${event.toolCall?.name}`, 'yellow') +
+                    c(`(${formatArgs(event.toolCall?.args)})`, 'dim') +
+                    riskStr);
+            }
             break;
         case 'tool_result':
             if (event.toolResult?.is_error) {
@@ -402,6 +509,8 @@ function handleSlashCommand(input, agent, config) {
   /undo      Undo last file edit (/undo [path])
   /usage     Show token usage & cost for this session
   /cost      Show running cost
+  /metrics   Show session metrics (counters + histograms)
+  /risk      Show risk assessment summary
   /policy    Show current security policy
   /audit     Verify audit chain for this session
   /config    Show current config
@@ -478,6 +587,26 @@ function handleSlashCommand(input, agent, config) {
             console.log(c(`  ${tracker.formatStatusLine()}`, 'dim'));
             break;
         }
+        case '/metrics': {
+            const metricsOutput = agent.getMetrics().formatSummary();
+            console.log('\n' + metricsOutput);
+            break;
+        }
+        case '/risk': {
+            const riskHistory = agent.getRiskScorer().getHistory();
+            if (riskHistory.length === 0) {
+                console.log(c('No risk assessments yet.', 'dim'));
+            }
+            else {
+                const avg = agent.getRiskScorer().getSessionAverage();
+                console.log(c(`\nRisk Summary: ${riskHistory.length} assessments, avg ${avg}/100`, 'bold'));
+                const last5 = riskHistory.slice(-5);
+                for (const a of last5) {
+                    console.log(`  ${risk_1.RiskScorer.formatIndicator(a)}`);
+                }
+            }
+            break;
+        }
         case '/policy': {
             const policy = agent.getPolicyEnforcer().getPolicy();
             console.log(c('\nCurrent Policy:', 'bold'));
@@ -637,6 +766,32 @@ function parseArgs(argv) {
             }
             continue;
         }
+        if (arg === '--export-audit') {
+            const next = argv[i + 1];
+            if (next && !next.startsWith('--')) {
+                result['export-audit'] = next;
+                i++;
+            }
+            else {
+                result['export-audit'] = true;
+            }
+            continue;
+        }
+        if (arg === '--replay') {
+            const next = argv[i + 1];
+            if (next && !next.startsWith('--')) {
+                result['replay'] = next;
+                i++;
+            }
+            else {
+                result['replay'] = true; // replay latest
+            }
+            continue;
+        }
+        if (arg === '--deterministic') {
+            result['deterministic'] = true;
+            continue;
+        }
         if (arg.startsWith('--')) {
             const key = arg.slice(2);
             const next = argv[i + 1];
@@ -690,8 +845,13 @@ ${c('Options:', 'bold')}
 ${c('Security & Policy:', 'bold')}
   --init-policy        Generate default .codebot/policy.json
   --verify-audit [id]  Verify audit log hash chain integrity
+  --export-audit sarif Export audit log as SARIF 2.1.0 JSON
   --sandbox-info       Show Docker sandbox status
 
+${c('Debugging & Replay:', 'bold')}
+  --replay [id]        Replay a session, re-execute tools, compare outputs
+  --deterministic      Set temperature=0 for reproducible outputs
+
 ${c('Supported Providers:', 'bold')}
   Local:      Ollama, LM Studio, vLLM (auto-detected)
   Anthropic:  Claude Opus/Sonnet/Haiku (ANTHROPIC_API_KEY)
@@ -711,6 +871,7 @@ ${c('Examples:', 'bold')}
   codebot --autonomous "refactor src/"     Full auto, no prompts
   codebot --init-policy                    Create security policy
   codebot --verify-audit                   Check audit integrity
+  codebot --export-audit sarif > r.sarif   Export SARIF report
 
 ${c('Interactive Commands:', 'bold')}
   /help      Show commands
@@ -722,6 +883,8 @@ ${c('Interactive Commands:', 'bold')}
   /compact   Force context compaction
   /usage     Show token usage & cost
   /cost      Show running cost
+  /metrics   Show session metrics
+  /risk      Show risk assessment summary
   /policy    Show security policy
   /audit     Verify session audit chain
   /config    Show configuration

package/dist/history.d.ts

@@ -1,4 +1,5 @@
 import { Message } from './types';
+import { IntegrityResult } from './integrity';
 export interface SessionMeta {
     id: string;
     model: string;
@@ -11,14 +12,17 @@ export declare class SessionManager {
     private sessionId;
     private filePath;
     private model;
+    private integrityKey;
     constructor(model: string, sessionId?: string);
     getId(): string;
-    /** Append a message to the session file */
+    /** Append a message to the session file (HMAC signed) */
     save(message: Message): void;
-    /** Save all messages (atomic overwrite via temp file + rename) */
+    /** Save all messages (atomic overwrite, HMAC signed) */
     saveAll(messages: Message[]): void;
-    /** Load messages from a session file (skips malformed lines) */
+    /** Load messages from a session file (verifies HMAC, drops tampered) */
     load(): Message[];
+    /** Verify integrity of all messages in this session. */
+    verifyIntegrity(): IntegrityResult;
     /** List recent sessions */
     static list(limit?: number): SessionMeta[];
     /** Get the most recent session ID */

package/dist/history.js

@@ -38,38 +38,50 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const crypto = __importStar(require("crypto"));
+const integrity_1 = require("./integrity");
 const SESSIONS_DIR = path.join(os.homedir(), '.codebot', 'sessions');
 class SessionManager {
     sessionId;
     filePath;
     model;
+    integrityKey;
     constructor(model, sessionId) {
         this.model = model;
         this.sessionId = sessionId || crypto.randomUUID();
+        this.integrityKey = (0, integrity_1.deriveSessionKey)(this.sessionId);
         fs.mkdirSync(SESSIONS_DIR, { recursive: true });
         this.filePath = path.join(SESSIONS_DIR, `${this.sessionId}.jsonl`);
     }
     getId() {
         return this.sessionId;
     }
-    /** Append a message to the session file */
+    /** Append a message to the session file (HMAC signed) */
     save(message) {
         try {
-            const line = JSON.stringify({
+            const record = {
                 ...message,
                 _ts: new Date().toISOString(),
                 _model: this.model,
-            });
-            fs.appendFileSync(this.filePath, line + '\n');
+            };
+            record._sig = (0, integrity_1.signMessage)(record, this.integrityKey);
+            fs.appendFileSync(this.filePath, JSON.stringify(record) + '\n');
         }
         catch {
             // Don't crash on write failure — session persistence is best-effort
         }
     }
-    /** Save all messages (atomic overwrite via temp file + rename) */
+    /** Save all messages (atomic overwrite, HMAC signed) */
     saveAll(messages) {
         try {
-            const lines = messages.map(m => JSON.stringify({ ...m, _ts: new Date().toISOString(), _model: this.model }));
+            const lines = messages.map(m => {
+                const record = {
+                    ...m,
+                    _ts: new Date().toISOString(),
+                    _model: this.model,
+                };
+                record._sig = (0, integrity_1.signMessage)(record, this.integrityKey);
+                return JSON.stringify(record);
+            });
             const tmpPath = this.filePath + '.tmp';
             fs.writeFileSync(tmpPath, lines.join('\n') + '\n');
             fs.renameSync(tmpPath, this.filePath);
@@ -78,7 +90,7 @@ class SessionManager {
             // Don't crash — session persistence is best-effort
         }
     }
-    /** Load messages from a session file (skips malformed lines) */
+    /** Load messages from a session file (verifies HMAC, drops tampered) */
     load() {
         if (!fs.existsSync(this.filePath))
             return [];
@@ -92,20 +104,55 @@ class SessionManager {
         if (!content)
             return [];
         const messages = [];
+        let dropped = 0;
         for (const line of content.split('\n')) {
             try {
                 const obj = JSON.parse(line);
+                // Verify integrity if signature present (backward compat: unsigned messages pass)
+                if (obj._sig) {
+                    if (!(0, integrity_1.verifyMessage)(obj, this.integrityKey)) {
+                        dropped++;
+                        continue; // Drop tampered message
+                    }
+                }
                 delete obj._ts;
                 delete obj._model;
+                delete obj._sig;
                 messages.push(obj);
             }
             catch {
-                // Skip malformed line — don't crash the whole load
                 continue;
             }
         }
+        if (dropped > 0) {
+            console.warn(`Warning: Dropped ${dropped} tampered message(s) from session ${this.sessionId.substring(0, 8)}.`);
+        }
         return messages;
     }
+    /** Verify integrity of all messages in this session. */
+    verifyIntegrity() {
+        if (!fs.existsSync(this.filePath)) {
+            return { valid: 0, tampered: 0, unsigned: 0, tamperedIndices: [] };
+        }
+        try {
+            const content = fs.readFileSync(this.filePath, 'utf-8').trim();
+            if (!content)
+                return { valid: 0, tampered: 0, unsigned: 0, tamperedIndices: [] };
+            const records = [];
+            for (const line of content.split('\n')) {
+                try {
+                    records.push(JSON.parse(line));
+                }
+                catch {
+                    continue;
+                }
+            }
+            return (0, integrity_1.verifyMessages)(records, this.integrityKey);
+        }
+        catch {
+            return { valid: 0, tampered: 0, unsigned: 0, tamperedIndices: [] };
+        }
+    }
     /** List recent sessions */
     static list(limit = 10) {
         if (!fs.existsSync(SESSIONS_DIR))

package/dist/index.d.ts

@@ -11,5 +11,17 @@ export { loadPlugins } from './plugins';
 export { loadMCPTools } from './mcp';
 export { MODEL_REGISTRY, PROVIDER_DEFAULTS, getModelInfo, detectProvider } from './providers/registry';
 export type { ModelInfo } from './providers/registry';
+export { CapabilityChecker } from './capabilities';
+export type { ToolCapabilities, CapabilityConfig } from './capabilities';
+export { deriveSessionKey, signMessage, verifyMessage, verifyMessages } from './integrity';
+export type { IntegrityResult } from './integrity';
+export { ReplayProvider, loadSessionForReplay, compareOutputs, listReplayableSessions } from './replay';
+export type { SessionReplayData, ReplayDivergence } from './replay';
+export { MetricsCollector } from './metrics';
+export type { MetricsSnapshot, CounterValue, HistogramValue } from './metrics';
+export { RiskScorer } from './risk';
+export type { RiskAssessment, RiskFactor } from './risk';
+export { exportSarif, sarifToString } from './sarif';
+export type { SarifLog, SarifResult, SarifRule } from './sarif';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectProvider = exports.getModelInfo = exports.PROVIDER_DEFAULTS = exports.MODEL_REGISTRY = exports.loadMCPTools = exports.loadPlugins = exports.parseToolCalls = exports.MemoryManager = exports.SessionManager = exports.buildRepoMap = exports.ContextManager = exports.ToolRegistry = exports.AnthropicProvider = exports.OpenAIProvider = exports.Agent = void 0;
+exports.sarifToString = exports.exportSarif = exports.RiskScorer = exports.MetricsCollector = exports.listReplayableSessions = exports.compareOutputs = exports.loadSessionForReplay = exports.ReplayProvider = exports.verifyMessages = exports.verifyMessage = exports.signMessage = exports.deriveSessionKey = exports.CapabilityChecker = exports.detectProvider = exports.getModelInfo = exports.PROVIDER_DEFAULTS = exports.MODEL_REGISTRY = exports.loadMCPTools = exports.loadPlugins = exports.parseToolCalls = exports.MemoryManager = exports.SessionManager = exports.buildRepoMap = exports.ContextManager = exports.ToolRegistry = exports.AnthropicProvider = exports.OpenAIProvider = exports.Agent = void 0;
 var agent_1 = require("./agent");
 Object.defineProperty(exports, "Agent", { enumerable: true, get: function () { return agent_1.Agent; } });
 var openai_1 = require("./providers/openai");
@@ -42,5 +42,24 @@ Object.defineProperty(exports, "MODEL_REGISTRY", { enumerable: true, get: functi
 Object.defineProperty(exports, "PROVIDER_DEFAULTS", { enumerable: true, get: function () { return registry_1.PROVIDER_DEFAULTS; } });
 Object.defineProperty(exports, "getModelInfo", { enumerable: true, get: function () { return registry_1.getModelInfo; } });
 Object.defineProperty(exports, "detectProvider", { enumerable: true, get: function () { return registry_1.detectProvider; } });
+var capabilities_1 = require("./capabilities");
+Object.defineProperty(exports, "CapabilityChecker", { enumerable: true, get: function () { return capabilities_1.CapabilityChecker; } });
+var integrity_1 = require("./integrity");
+Object.defineProperty(exports, "deriveSessionKey", { enumerable: true, get: function () { return integrity_1.deriveSessionKey; } });
+Object.defineProperty(exports, "signMessage", { enumerable: true, get: function () { return integrity_1.signMessage; } });
+Object.defineProperty(exports, "verifyMessage", { enumerable: true, get: function () { return integrity_1.verifyMessage; } });
+Object.defineProperty(exports, "verifyMessages", { enumerable: true, get: function () { return integrity_1.verifyMessages; } });
+var replay_1 = require("./replay");
+Object.defineProperty(exports, "ReplayProvider", { enumerable: true, get: function () { return replay_1.ReplayProvider; } });
+Object.defineProperty(exports, "loadSessionForReplay", { enumerable: true, get: function () { return replay_1.loadSessionForReplay; } });
+Object.defineProperty(exports, "compareOutputs", { enumerable: true, get: function () { return replay_1.compareOutputs; } });
+Object.defineProperty(exports, "listReplayableSessions", { enumerable: true, get: function () { return replay_1.listReplayableSessions; } });
+var metrics_1 = require("./metrics");
+Object.defineProperty(exports, "MetricsCollector", { enumerable: true, get: function () { return metrics_1.MetricsCollector; } });
+var risk_1 = require("./risk");
+Object.defineProperty(exports, "RiskScorer", { enumerable: true, get: function () { return risk_1.RiskScorer; } });
+var sarif_1 = require("./sarif");
+Object.defineProperty(exports, "exportSarif", { enumerable: true, get: function () { return sarif_1.exportSarif; } });
+Object.defineProperty(exports, "sarifToString", { enumerable: true, get: function () { return sarif_1.sarifToString; } });
 __exportStar(require("./types"), exports);
 //# sourceMappingURL=index.js.map

package/dist/integrity.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Session History Integrity for CodeBot v1.8.0
+ *
+ * HMAC-SHA256 signing/verification for session messages.
+ * Key: SHA-256(sessionId + machineId) where machineId = hostname:username.
+ *
+ * This is tamper-DETECTION, not tamper-prevention. The key is deterministic
+ * per session+machine so verification works without storing keys separately.
+ *
+ * Uses Node's built-in crypto module — zero runtime dependencies.
+ */
+/** Derive a per-session HMAC key. Deterministic for same session+machine. */
+export declare function deriveSessionKey(sessionId: string): Buffer;
+/**
+ * Compute HMAC-SHA256 signature for a message object.
+ * Excludes the _sig field from the signing input.
+ */
+export declare function signMessage(message: Record<string, unknown>, key: Buffer): string;
+/**
+ * Verify a message's HMAC signature.
+ * Returns false if no signature present or if it doesn't match.
+ */
+export declare function verifyMessage(message: Record<string, unknown>, key: Buffer): boolean;
+export interface IntegrityResult {
+    valid: number;
+    tampered: number;
+    unsigned: number;
+    tamperedIndices: number[];
+}
+/**
+ * Verify an array of signed messages.
+ * Unsigned messages (pre-v1.8.0) are counted but not flagged as tampered.
+ */
+export declare function verifyMessages(messages: Array<Record<string, unknown>>, key: Buffer): IntegrityResult;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/integrity.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Session History Integrity for CodeBot v1.8.0
+ *
+ * HMAC-SHA256 signing/verification for session messages.
+ * Key: SHA-256(sessionId + machineId) where machineId = hostname:username.
+ *
+ * This is tamper-DETECTION, not tamper-prevention. The key is deterministic
+ * per session+machine so verification works without storing keys separately.
+ *
+ * Uses Node's built-in crypto module — zero runtime dependencies.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveSessionKey = deriveSessionKey;
+exports.signMessage = signMessage;
+exports.verifyMessage = verifyMessage;
+exports.verifyMessages = verifyMessages;
+const crypto = __importStar(require("crypto"));
+const os = __importStar(require("os"));
+// ── Key Derivation ──
+/** Derive a per-session HMAC key. Deterministic for same session+machine. */
+function deriveSessionKey(sessionId) {
+    const machineId = os.hostname() + ':' + getUserName();
+    return crypto.createHash('sha256')
+        .update(sessionId + machineId)
+        .digest();
+}
+/** Get username safely. */
+function getUserName() {
+    try {
+        return os.userInfo().username;
+    }
+    catch {
+        return 'unknown';
+    }
+}
+// ── Signing & Verification ──
+/**
+ * Compute HMAC-SHA256 signature for a message object.
+ * Excludes the _sig field from the signing input.
+ */
+function signMessage(message, key) {
+    const payload = canonicalize(message);
+    return crypto.createHmac('sha256', key)
+        .update(payload)
+        .digest('hex');
+}
+/**
+ * Verify a message's HMAC signature.
+ * Returns false if no signature present or if it doesn't match.
+ */
+function verifyMessage(message, key) {
+    const sig = message._sig;
+    if (!sig)
+        return false;
+    const expected = signMessage(message, key);
+    try {
+        return crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expected, 'hex'));
+    }
+    catch {
+        return false; // Different lengths or invalid hex
+    }
+}
+/**
+ * Canonical JSON representation for signing.
+ * Excludes _sig field. Keys are sorted for determinism.
+ */
+function canonicalize(obj) {
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+        if (key === '_sig')
+            continue;
+        sorted[key] = obj[key];
+    }
+    return JSON.stringify(sorted);
+}
+/**
+ * Verify an array of signed messages.
+ * Unsigned messages (pre-v1.8.0) are counted but not flagged as tampered.
+ */
+function verifyMessages(messages, key) {
+    let valid = 0;
+    let tampered = 0;
+    let unsigned = 0;
+    const tamperedIndices = [];
+    for (let i = 0; i < messages.length; i++) {
+        const msg = messages[i];
+        if (!msg._sig) {
+            unsigned++;
+            continue;
+        }
+        if (verifyMessage(msg, key)) {
+            valid++;
+        }
+        else {
+            tampered++;
+            tamperedIndices.push(i);
+        }
+    }
+    return { valid, tampered, unsigned, tamperedIndices };
+}
+//# sourceMappingURL=integrity.js.map