codehere 0.5.0-alpha.5 → 0.6.0-alpha.1

package/dist/infrastructure/cost/spend-aggregator.js

@@ -0,0 +1,147 @@
+/**
+ * v0.6 S3 slice 1 — spend-today aggregator.
+ *
+ * Reads ~/.codehere/sessions.jsonl (the same append-only log session-persistence
+ * writes), filters completed records to today (local timezone), and estimates
+ * dollar spend per agent based on token usage × per-tier output-rate ceilings.
+ *
+ * Why · claim_market_position v3 lists "cost-bounded execution" as one of the
+ * few capture-strategy edges still possibly open. Demonstrating cost awareness
+ * starts here: surface what the user has actually spent today across all spawned
+ * agents, then (slice 2) enforce a per-day ceiling.
+ *
+ * Why estimates not exact · codehere doesn't see provider invoices. Adapters
+ * report token counts via TaskArtifacts.usage; we multiply by published tier
+ * ceilings. Per feedback_overconfidence_guard.md, copy frames this as
+ * "estimate" and points to vendor dashboards as authoritative.
+ *
+ * Cost table · output-tier ceilings (input is rougher; we use a 5x ratio).
+ * All values 2026 published rates. When a model isn't surfaced in usage,
+ * default to the agent's typical tier.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+/** Resolved at call time, not module load, so test setups that swap $HOME
+ *  after import still get a fresh path on each invocation. */
+function sessionsFile() {
+    return join(homedir(), '.codehere', 'sessions.jsonl');
+}
+/** USD per million OUTPUT tokens at the agent's typical 2026 tier. Input is
+ *  estimated at 1/5 of output rate (Anthropic + OpenAI both publish ~5x
+ *  output:input ratios on their flagship coding tiers). Cache reads ~1/10
+ *  of input. Free-tier agents → 0.
+ *
+ *  Conservative-ceiling philosophy: better to over-estimate spend than
+ *  under-promise and miss a real bill. */
+const COST_PER_M_OUTPUT_TOKENS_USD = {
+    'claude-code': 15.0, // Sonnet 4.6 baseline
+    'codex': 10.0, // GPT-5 / codex baseline
+    'aider': 15.0, // typically Sonnet
+    'gemini': 0, // free tier (Google AI Studio)
+    'opencode': 0, // typically free local / NIM-routed
+    'conductor': 15.0, // routes to Claude Code by default
+};
+const INPUT_RATE_RATIO = 0.2; // input ≈ 1/5 of output
+const CACHE_READ_RATIO = 0.1; // cache reads ≈ 1/10 of input (so 1/50 output)
+/**
+ * Estimate dollar cost for one session's token usage at one agent's typical tier.
+ * Returns 0 for free-tier agents and unknown agents (no mapping → no estimate).
+ */
+export function estimateCostUsd(agent, usage) {
+    if (!usage)
+        return 0;
+    const outputRate = COST_PER_M_OUTPUT_TOKENS_USD[agent];
+    if (outputRate === undefined || outputRate === 0)
+        return 0;
+    const inputRate = outputRate * INPUT_RATE_RATIO;
+    const cacheReadRate = inputRate * CACHE_READ_RATIO;
+    // Cache CREATION is billed at input rate (Anthropic). Use same default.
+    const tokens = {
+        input: Math.max(0, usage.inputTokens || 0),
+        output: Math.max(0, usage.outputTokens || 0),
+        cacheRead: Math.max(0, usage.cacheReadTokens || 0),
+        cacheCreate: Math.max(0, usage.cacheCreationTokens || 0),
+    };
+    return ((tokens.input / 1_000_000) * inputRate +
+        (tokens.output / 1_000_000) * outputRate +
+        (tokens.cacheRead / 1_000_000) * cacheReadRate +
+        (tokens.cacheCreate / 1_000_000) * inputRate);
+}
+/** Return the millisecond timestamp for the start of "today" in local time. */
+function startOfTodayLocalMs(now = new Date()) {
+    const d = new Date(now);
+    d.setHours(0, 0, 0, 0);
+    return d.getTime();
+}
+/**
+ * Walk sessions.jsonl, sum estimated USD spend for sessions whose
+ * `completedAt` falls within today (local). Best-effort: missing file =
+ * empty report; parse errors per-line ignored. Pairs spawned + completed
+ * by id so we know which agent spent what.
+ */
+export function computeSpendToday(now = new Date()) {
+    const cutoff = startOfTodayLocalMs(now);
+    const empty = {
+        totalUsd: 0,
+        tokens: { input: 0, output: 0, cache: 0 },
+        sessionCount: 0,
+        byAgent: {},
+        windowStartedAt: cutoff,
+    };
+    if (!existsSync(sessionsFile()))
+        return empty;
+    let content;
+    try {
+        content = readFileSync(sessionsFile(), 'utf-8');
+    }
+    catch {
+        return empty;
+    }
+    // Pair spawned (carries agent) with completed (carries usage + completedAt).
+    const spawnedAgent = new Map();
+    const report = { ...empty, byAgent: {} };
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let rec;
+        try {
+            rec = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (rec.t === 'spawned' && rec.id && rec.agent) {
+            spawnedAgent.set(rec.id, rec.agent);
+            continue;
+        }
+        if (rec.t !== 'completed' || !rec.id)
+            continue;
+        if (typeof rec.completedAt !== 'number' || rec.completedAt < cutoff)
+            continue;
+        const agent = spawnedAgent.get(rec.id);
+        if (!agent)
+            continue;
+        const usage = rec.artifacts?.usage;
+        const usd = estimateCostUsd(agent, usage);
+        report.sessionCount += 1;
+        if (usage) {
+            report.tokens.input += usage.inputTokens || 0;
+            report.tokens.output += usage.outputTokens || 0;
+            report.tokens.cache += (usage.cacheReadTokens || 0) + (usage.cacheCreationTokens || 0);
+        }
+        report.totalUsd += usd;
+        const cur = report.byAgent[agent] || { usd: 0, sessions: 0 };
+        cur.usd += usd;
+        cur.sessions += 1;
+        report.byAgent[agent] = cur;
+    }
+    // Round totals to 4 decimals (1/100 of a cent) — final display rounds to 2.
+    report.totalUsd = Math.round(report.totalUsd * 10_000) / 10_000;
+    for (const k of Object.keys(report.byAgent)) {
+        report.byAgent[k].usd = Math.round(report.byAgent[k].usd * 10_000) / 10_000;
+    }
+    return report;
+}
+//# sourceMappingURL=spend-aggregator.js.map

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -13,9 +13,12 @@
  *
  * Docs: https://docs.anthropic.com/en/docs/claude-code/hooks
  */
-import { appendFileSync, chmodSync, existsSync, mkdirSync } from 'fs';
+import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, readSync, statSync, readFileSync, } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+import { createHash } from 'crypto';
+// P18 slice 2 — Tier 1 hook honors per-cwd permissions.yaml.
+import { filterAllowed } from '../security/permissions-config.js';
 const PATTERNS = [
     // Prompt Injection
     // Allow chained modifiers: "ignore all previous instructions", "ignore all your prior rules", etc.
@@ -388,6 +391,108 @@ export function calculateRiskScore(findings) {
  * Override at process start with CODEHERE_AUDIT_FILE env var (used by tests, optional for users).
  */
 export const AUDIT_FILE = process.env.CODEHERE_AUDIT_FILE || join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
+const GENESIS_PREV_HASH = '0'.repeat(64);
+/**
+ * Canonicalize an audit entry for hashing. We sort keys alphabetically and
+ * stringify with no whitespace so the hash is reproducible across writers.
+ * The `entryHash` field is excluded from its own hash input (chicken-and-egg).
+ */
+function canonicalizeForHash(entry) {
+    const { entryHash: _entryHash, ...rest } = entry;
+    void _entryHash; // referenced to satisfy lint; the destructure is the point
+    const keys = Object.keys(rest).sort();
+    const ordered = {};
+    for (const k of keys) {
+        ordered[k] = rest[k];
+    }
+    return JSON.stringify(ordered);
+}
+/** SHA-256 hex of an entry's canonical form (entryHash excluded). */
+export function computeEntryHash(entry) {
+    return createHash('sha256').update(canonicalizeForHash(entry)).digest('hex');
+}
+/**
+ * Read the last non-empty line from a file without loading the whole file.
+ * Reads in 4 KB chunks from the end until a newline is found. Returns null
+ * if the file is empty or unreadable.
+ *
+ * For audit-log size <100 KB this is fast (single readSync). Even at 10 MB
+ * the worst case is ~3 reads to find a newline.
+ */
+function readLastLine(filepath) {
+    try {
+        const stats = statSync(filepath);
+        if (stats.size === 0)
+            return null;
+        const fd = openSync(filepath, 'r');
+        try {
+            const chunkSize = 4096;
+            let position = stats.size;
+            let buffer = Buffer.alloc(0);
+            while (position > 0) {
+                const readSize = Math.min(chunkSize, position);
+                position -= readSize;
+                const chunk = Buffer.alloc(readSize);
+                readSync(fd, chunk, 0, readSize, position);
+                buffer = Buffer.concat([chunk, buffer]);
+                // Strip trailing newlines so the last "line" is the actual content
+                const text = buffer.toString('utf-8').replace(/\n+$/, '');
+                const lastNewline = text.lastIndexOf('\n');
+                if (lastNewline >= 0) {
+                    return text.slice(lastNewline + 1);
+                }
+                if (position === 0) {
+                    // Whole file fits in our buffer
+                    return text;
+                }
+            }
+            return null;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the chain tip (seq + entryHash of the last chained entry) from disk.
+ * Walks BACKWARD from EOF looking for the most recent line that carries
+ * chain fields. Pre-fix this only checked the last line — if that line was
+ * legacy (no chain fields), the chain restarted at seq=0 producing a fake
+ * hash_mismatch in verifyAuditChain. Walking backward keeps the chain
+ * continuous across legacy-entry interleavings (rare but possible when
+ * an out-of-band script appends raw JSON to the audit file).
+ */
+function readChainTip(filepath) {
+    if (!existsSync(filepath))
+        return null;
+    let content;
+    try {
+        content = readFileSync(filepath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const lines = content.split('\n');
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const raw = lines[i];
+        if (!raw.trim())
+            continue;
+        try {
+            const entry = JSON.parse(raw);
+            if (typeof entry.seq === 'number' && typeof entry.entryHash === 'string') {
+                return { seq: entry.seq, hash: entry.entryHash };
+            }
+            // Legacy entry — keep walking backward
+        }
+        catch {
+            // Parse failure — skip and continue
+        }
+    }
+    return null;
+}
 export function appendAuditLog(entry) {
     try {
         const dir = AUDIT_FILE.substring(0, AUDIT_FILE.lastIndexOf('/'));
@@ -398,10 +503,17 @@ export function appendAuditLog(entry) {
             // the May 1 2026 /cso security audit (Finding #1, MEDIUM).
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         }
+        // Compute chain fields. Read tip from file (cheap tail read). If no chain
+        // exists (fresh file, or last line is pre-chain legacy), start at genesis.
+        const tip = readChainTip(AUDIT_FILE);
+        const seq = tip ? tip.seq + 1 : 0;
+        const prevHash = tip ? tip.hash : GENESIS_PREV_HASH;
+        const chainedEntry = { ...entry, seq, prevHash };
+        chainedEntry.entryHash = computeEntryHash(chainedEntry);
         // mode 0o600 — owner-only file. Same reasoning as the dir above. Only takes
         // effect on first write (file creation); existing files are chmod'd below
         // for backwards compatibility with audit logs created before this fix.
-        appendFileSync(AUDIT_FILE, JSON.stringify(entry) + '\n', { mode: 0o600 });
+        appendFileSync(AUDIT_FILE, JSON.stringify(chainedEntry) + '\n', { mode: 0o600 });
         // Idempotent: if the file existed pre-fix with 0o644, tighten it now. The
         // chmod is cheap and silent on already-0o600 files.
         try {
@@ -415,6 +527,146 @@ export function appendAuditLog(entry) {
         // Audit log failure must not block tool execution
     }
 }
+/**
+ * Walk the audit file and verify the hash chain. Returns:
+ *   - valid: true iff every chained entry's prevHash matches predecessor's
+ *            entryHash, and every entry's entryHash matches recomputed value
+ *   - totalEntries / chainedEntries / legacyEntries: line counts
+ *   - errors: every detected break (verifier doesn't stop at first failure;
+ *             reporter shows ALL tampering points so a forensic reviewer can
+ *             see the full picture)
+ *
+ * Legacy preamble: pre-2026-05-06 entries (no seq/prevHash/entryHash) are
+ * counted as legacyEntries and skipped. The chain starts at the FIRST entry
+ * with seq=0 — every subsequent chained entry must continue from there.
+ */
+export function verifyAuditChain(filepath = AUDIT_FILE) {
+    const result = {
+        valid: true,
+        totalEntries: 0,
+        chainedEntries: 0,
+        legacyEntries: 0,
+        errors: [],
+    };
+    if (!existsSync(filepath))
+        return result;
+    let content;
+    try {
+        content = readFileSync(filepath, 'utf-8');
+    }
+    catch {
+        return result;
+    }
+    const lines = content.split('\n');
+    let prevHash = null; // null until we hit the first chained entry
+    let prevSeq = null;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        if (!raw.trim())
+            continue;
+        const lineNumber = i + 1;
+        result.totalEntries++;
+        let entry;
+        try {
+            entry = JSON.parse(raw);
+        }
+        catch {
+            result.valid = false;
+            result.errors.push({
+                lineNumber,
+                reason: 'parse_failure',
+                detail: 'JSON parse failed',
+            });
+            continue;
+        }
+        const hasChainFields = typeof entry.seq === 'number' && typeof entry.prevHash === 'string' && typeof entry.entryHash === 'string';
+        if (!hasChainFields) {
+            result.legacyEntries++;
+            continue;
+        }
+        result.chainedEntries++;
+        // Recompute entryHash and check it matches what was stored
+        const recomputed = computeEntryHash(entry);
+        if (recomputed !== entry.entryHash) {
+            result.valid = false;
+            result.errors.push({
+                lineNumber,
+                seq: entry.seq,
+                reason: 'self_hash_mismatch',
+                detail: `entryHash field does not match recomputed hash; entry was modified after writing`,
+            });
+            // Continue checking — we still want to report the chain link below,
+            // but using the STORED hash so cascading errors are honest about the
+            // physical state of the file.
+        }
+        // Chain link check
+        if (prevHash === null) {
+            // First chained entry: must be genesis (seq=0, prevHash=64x0)
+            if (entry.seq !== 0 || entry.prevHash !== GENESIS_PREV_HASH) {
+                result.valid = false;
+                result.errors.push({
+                    lineNumber,
+                    seq: entry.seq,
+                    reason: 'genesis_violation',
+                    detail: `first chained entry must have seq=0 and prevHash=${GENESIS_PREV_HASH.slice(0, 8)}…; got seq=${entry.seq}, prevHash=${entry.prevHash?.slice(0, 8)}…`,
+                });
+            }
+        }
+        else {
+            if (entry.seq !== (prevSeq ?? -1) + 1) {
+                result.valid = false;
+                result.errors.push({
+                    lineNumber,
+                    seq: entry.seq,
+                    reason: 'seq_gap',
+                    detail: `expected seq=${(prevSeq ?? -1) + 1}, got seq=${entry.seq}`,
+                });
+            }
+            if (entry.prevHash !== prevHash) {
+                result.valid = false;
+                result.errors.push({
+                    lineNumber,
+                    seq: entry.seq,
+                    reason: 'hash_mismatch',
+                    detail: `prevHash=${entry.prevHash?.slice(0, 12)}… does not match predecessor entryHash=${prevHash.slice(0, 12)}…`,
+                });
+            }
+        }
+        // Move forward using the STORED entryHash. Even if recomputed mismatched,
+        // the next entry's prevHash was written against the stored value, so we
+        // chain on stored. The self-hash error above already flagged the breach.
+        prevHash = entry.entryHash;
+        prevSeq = entry.seq;
+    }
+    return result;
+}
+/**
+ * Record a trust-override event in the audit log. Used when the scanner is
+ * bypassed for any reason (stdin failure, parse failure, --log-only mode,
+ * scan exception). Per CC frontier Q1 (auditable permission trails) — the
+ * audit MUST capture bypasses, not just block/allow decisions, so a reviewer
+ * can see EVERY case where the safety policy didn't run normally.
+ *
+ * Best-effort: never throws. The bypass already happened by the time we get
+ * here; failure to write the audit just means the bypass is undocumented.
+ *
+ * Fields default to safe minimums: empty toolInput, zero risk, blocked=false
+ * (because the tool DID run). Caller can override what it knows.
+ */
+export function appendOverrideAudit(reason, partial = {}) {
+    const entry = {
+        timestamp: new Date().toISOString(),
+        sessionId: partial.sessionId ?? 'unknown',
+        toolName: partial.toolName ?? 'unknown',
+        toolInput: partial.toolInput ?? '',
+        riskScore: partial.riskScore ?? 0,
+        blocked: false, // override = scanner didn't block, regardless of what it would have decided
+        findings: partial.findings ?? 0,
+        criticalFindings: partial.criticalFindings ?? 0,
+        overrideReason: reason,
+    };
+    appendAuditLog(entry);
+}
 // ── Main hook handler ────────────────────────────────────────────────────────
 /**
  * Process a Claude Code hook event.
@@ -480,12 +732,20 @@ export function processHookEvent(event) {
     // Build context-appropriate scan payload (Bash = full, Write/Edit = path only)
     const payload = buildScanPayload(tool_name, tool_input);
     // Layer 0 scan — local, no API, ~2ms
-    const findings = scanPayload(payload);
+    const rawFindings = scanPayload(payload);
+    // P18 slice 2 — Tier 1 hook now honors per-cwd permissions.yaml.
+    // The hook subprocess inherits Claude Code's cwd when spawned, so
+    // process.cwd() points at the project root where .codehere/
+    // permissions.yaml would live. Allow-listed findings are dropped
+    // from the BLOCK calculation but still recorded in the audit entry
+    // so a forensic reviewer sees what was suppressed and why.
+    const cwd = process.cwd();
+    const { surviving: findings, allowed } = filterAllowed(rawFindings, cwd);
     const riskScore = calculateRiskScore(findings);
     const criticalFindings = findings.filter((f) => f.severity === 'critical');
     // Blocking threshold: critical finding OR risk score too high
     const blocked = criticalFindings.length > 0 || riskScore >= 60;
-    // Build audit entry
+    // Build audit entry — record what got allow-listed for the trail
     const auditEntry = {
         timestamp: new Date().toISOString(),
         sessionId: session_id,
@@ -496,6 +756,22 @@ export function processHookEvent(event) {
         findings: findings.length,
         criticalFindings: criticalFindings.length,
     };
+    if (allowed.length > 0) {
+        // Add to the audit row's toolInput JSON so /history can render
+        // "X findings allow-listed by permissions.yaml" badges later.
+        try {
+            const parsed = JSON.parse(auditEntry.toolInput);
+            parsed.allowedByPermissions = allowed.map((a) => ({
+                category: a.finding.category,
+                matched: a.finding.matched,
+                reason: a.entry.reason ?? '(no reason given)',
+            }));
+            auditEntry.toolInput = JSON.stringify(parsed).substring(0, 800);
+        }
+        catch {
+            // toolInput wasn't JSON (rare path); skip enrichment
+        }
+    }
     appendAuditLog(auditEntry);
     if (!blocked) {
         return null; // allow

package/dist/infrastructure/hooks/hook-mode.js

@@ -0,0 +1,71 @@
+/**
+ * Hook mode detection — Pattern 20 backend.
+ *
+ * Reads ~/.claude/settings.json and reports which posture the safety
+ * hook is in. Mode is encoded as flags on the configured command:
+ *
+ *   off       — no codehere scan-tool entry in PreToolUse
+ *   log-only  — `codehere scan-tool --log-only`
+ *   advisory  — reserved for future; not currently shipped
+ *   block     — `codehere scan-tool` (default critical/high block)
+ *               OR `codehere scan-tool --block-all` (all severity levels)
+ *
+ * Read-only by design — this module never WRITES the config. Mode
+ * switching belongs in `codehere hook install/uninstall` so users go
+ * through the same path that re-validates the hook surface.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const SETTINGS_PATH = join(homedir(), '.claude', 'settings.json');
+/**
+ * Detect the current safety-hook mode from ~/.claude/settings.json.
+ * Defensive against missing / malformed settings — anything we can't
+ * parse cleanly returns 'off' (the most-conservative read).
+ */
+export function getHookMode() {
+    if (!existsSync(SETTINGS_PATH))
+        return 'off';
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8'));
+    }
+    catch {
+        return 'off';
+    }
+    const hooks = (parsed.hooks ?? {});
+    const preToolUse = (hooks.PreToolUse ?? []);
+    if (!Array.isArray(preToolUse) || preToolUse.length === 0)
+        return 'off';
+    let bestMatch = 'off';
+    for (const entry of preToolUse) {
+        if (!entry?.hooks)
+            continue;
+        for (const hk of entry.hooks) {
+            const cmd = hk?.command;
+            if (typeof cmd !== 'string')
+                continue;
+            if (!cmd.includes('codehere scan-tool'))
+                continue;
+            // Earliest match wins block > advisory > log-only — once a stricter
+            // mode is found we keep it. (block is the operational default;
+            // log-only is opt-in.)
+            if (cmd.includes('--log-only')) {
+                if (bestMatch === 'off')
+                    bestMatch = 'log-only';
+            }
+            else if (cmd.includes('--advisory')) {
+                if (bestMatch === 'off' || bestMatch === 'log-only')
+                    bestMatch = 'advisory';
+            }
+            else {
+                // No flag OR --block-all: both render as 'block' in the UI.
+                // Block-all is stricter but the user-visible posture ("safety
+                // hook actively blocks risky calls") is the same.
+                return 'block';
+            }
+        }
+    }
+    return bestMatch;
+}
+//# sourceMappingURL=hook-mode.js.map

package/dist/infrastructure/hooks/mirror-tool-call-to-audit.js

@@ -0,0 +1,43 @@
+/**
+ * Cross-vendor tool-call audit mirror — #110 slice 2 (Codex first).
+ *
+ * When non-Claude adapters emit a tool-call event, we can't BLOCK
+ * (no synchronous pre-tool intercept yet) but we CAN mirror the
+ * call into the audit log post-hoc. Closes the audit-trail-parity
+ * gap: every adapter's tool calls land in the same hook-events.jsonl
+ * the per-tool Claude hook writes to.
+ *
+ * Future slices (per-adapter blocking) replace the post-hoc mirror
+ * with pre-call intercepts. For now: visibility today, blocking next.
+ */
+import { scanPayload, calculateRiskScore, appendAuditLog } from './claude-sdk-hook.js';
+export function mirrorToolCallToAudit(rec) {
+    // Run the same pattern bank the per-tool hook uses, so post-hoc
+    // findings show up in /history with the same severity calibration.
+    const findings = scanPayload(rec.toolInput);
+    const riskScore = calculateRiskScore(findings);
+    const truncated = rec.toolInput.length > 500 ? rec.toolInput.slice(0, 500) + '…' : rec.toolInput;
+    const entry = {
+        timestamp: new Date().toISOString(),
+        sessionId: rec.sessionId,
+        toolName: rec.toolName,
+        toolInput: JSON.stringify({
+            agent: rec.agent,
+            input: truncated,
+            cwd: rec.cwd ?? null,
+            inputLength: rec.toolInput.length,
+            mirrored: true, // marks post-hoc vs the synchronous Claude hook
+        }),
+        riskScore,
+        blocked: false, // post-hoc — can't block, only log
+        findings: findings.length,
+        criticalFindings: findings.filter((f) => f.severity === 'critical').length,
+    };
+    try {
+        appendAuditLog(entry);
+    }
+    catch {
+        // Audit-write failures don't propagate — the agent's already running.
+    }
+}
+//# sourceMappingURL=mirror-tool-call-to-audit.js.map