codiedev 0.10.0-beta.4 → 0.10.0-beta.6

package/dist/securityDeepScan.js

@@ -1,248 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mergeDeepScanFindings = mergeDeepScanFindings;
-exports.runDeepSecurityScan = runDeepSecurityScan;
-const child_process_1 = require("child_process");
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-/** Adds component-addressable OSS scanner findings to the uploadable inventory.
- * Workspace-level findings (for example OSV dependency results) stay in the
- * deep-scan report because they do not identify one agent component. */
-function mergeDeepScanFindings(report, deep) {
-    const byComponent = new Map();
-    for (const finding of deep.findings) {
-        if (!finding.componentKey)
-            continue;
-        const current = byComponent.get(finding.componentKey) ?? [];
-        current.push(finding);
-        byComponent.set(finding.componentKey, current);
-    }
-    return {
-        ...report,
-        components: report.components.map((component) => {
-            const external = byComponent.get(component.componentKey) ?? [];
-            const findings = [
-                ...component.findings,
-                ...external.map((finding) => ({
-                    code: `oss:${finding.scanner}:${finding.ruleId ?? "finding"}`.slice(0, 240),
-                    severity: finding.severity,
-                    detail: finding.title,
-                })),
-            ];
-            return {
-                ...component,
-                findings: [...new Map(findings.map((finding) => [`${finding.code}:${finding.detail}`, finding])).values()].slice(0, 100),
-            };
-        }),
-    };
-}
-function defaultRunner(command, args, timeoutMs) {
-    return (0, child_process_1.spawnSync)(command, args, { encoding: "utf8", timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 });
-}
-function actualPath(source, homeDir, workspace) {
-    if (source === ".")
-        return workspace;
-    if (source.startsWith("~/"))
-        return path.join(homeDir, source.slice(2));
-    if (source.startsWith("[external:"))
-        return null;
-    return path.join(workspace, source);
-}
-function severity(value) {
-    const normalized = String(value ?? "medium").toLowerCase();
-    if (normalized === "critical" || normalized === "high" || normalized === "low")
-        return normalized;
-    return "medium";
-}
-function collectFindingObjects(value, scanner, componentKey) {
-    const findings = [];
-    const visit = (child, depth) => {
-        if (depth > 8 || findings.length >= 500 || child === null || child === undefined)
-            return;
-        if (Array.isArray(child)) {
-            for (const item of child.slice(0, 1_000))
-                visit(item, depth + 1);
-            return;
-        }
-        if (typeof child !== "object")
-            return;
-        const row = child;
-        const ruleId = row.rule_id ?? row.ruleId ?? row.id ?? row.code;
-        // Do not import scanner messages/descriptions: several engines include the
-        // matched source snippet there. Titles and rule names are bounded metadata.
-        const title = row.title ?? row.rule_name ?? row.ruleName ?? row.name ??
-            (ruleId !== undefined ? `Scanner finding ${String(ruleId)}` : undefined);
-        const severityValue = row.severity ?? row.level ?? row.risk;
-        const looksLikeFinding = typeof title === "string" && (severityValue !== undefined || ruleId !== undefined || row.match !== undefined || row.finding !== undefined);
-        if (looksLikeFinding) {
-            findings.push({
-                scanner,
-                ...(componentKey ? { componentKey } : {}),
-                severity: severity(severityValue),
-                ...(ruleId !== undefined ? { ruleId: String(ruleId).slice(0, 160) } : {}),
-                title: String(title).replace(/\s+/g, " ").slice(0, 500),
-            });
-        }
-        for (const nested of Object.values(row))
-            visit(nested, depth + 1);
-    };
-    visit(value, 0);
-    return [...new Map(findings.map((finding) => [
-            `${finding.scanner}:${finding.componentKey}:${finding.ruleId}:${finding.title}`,
-            finding,
-        ])).values()];
-}
-function runJsonScanner(args) {
-    const result = args.runner(args.command, args.commandArgs, args.timeoutMs);
-    if (result.error && result.error.code === "ENOENT") {
-        return { scanner: args.scanner, status: "unavailable", detail: `${args.command} is not installed`, findings: [] };
-    }
-    const stdout = String(result.stdout ?? "").trim();
-    const stderr = String(result.stderr ?? "").trim();
-    let parsed = null;
-    if (stdout) {
-        try {
-            parsed = JSON.parse(stdout);
-        }
-        catch {
-            const start = stdout.indexOf("{");
-            const end = stdout.lastIndexOf("}");
-            if (start >= 0 && end > start) {
-                try {
-                    parsed = JSON.parse(stdout.slice(start, end + 1));
-                }
-                catch { /* handled below */ }
-            }
-        }
-    }
-    const findings = collectFindingObjects(parsed, args.scanner, args.componentKey);
-    if (result.status === 0 || findings.length > 0) {
-        return {
-            scanner: args.scanner,
-            status: findings.length > 0 ? "findings" : "passed",
-            detail: findings.length > 0 ? `${findings.length} finding(s)` : "scan completed with no findings",
-            findings,
-        };
-    }
-    return {
-        scanner: args.scanner,
-        status: "error",
-        detail: (stderr || `scanner exited ${result.status ?? "without a status"}`).replace(/\s+/g, " ").slice(0, 500),
-        findings: [],
-    };
-}
-function pathsFor(report, kind, homeDir, workspace) {
-    return report.components
-        .filter((component) => component.kind === kind)
-        .map((component) => ({ component, filePath: actualPath(component.source, homeDir, workspace) }))
-        .filter((item) => Boolean(item.filePath && fs.existsSync(item.filePath)));
-}
-/**
- * Runs optional open-source scanners. No scanner is downloaded implicitly.
- * MCP server connection is a separate opt-in because scanning a live stdio
- * server starts third-party code; the normal deep scan remains static.
- */
-function runDeepSecurityScan(report, options = {}) {
-    const homeDir = path.resolve(options.homeDir ?? os.homedir());
-    const workspace = path.resolve(options.workspace ?? process.cwd());
-    const timeoutMs = options.timeoutMs ?? 120_000;
-    const runner = options.runner ?? defaultRunner;
-    const runs = [];
-    const skillPaths = pathsFor(report, "skill", homeDir, workspace);
-    for (const { component, filePath } of skillPaths) {
-        // Cisco's scanner is preferred when present; ATR is the lightweight
-        // fallback. The current ATR CLI does not expose its internal detection
-        // lanes, so only high/critical findings are imported for review.
-        const cisco = runJsonScanner({
-            scanner: "cisco-skill-scanner", command: "skill-scanner",
-            commandArgs: ["scan", filePath, "--format", "json"], componentKey: component.componentKey,
-            timeoutMs, runner,
-        });
-        if (cisco.status !== "unavailable")
-            runs.push(cisco);
-        else
-            runs.push(runJsonScanner({
-                scanner: "agent-threat-rules", command: "atr",
-                commandArgs: ["scan", filePath, "--json", "--severity", "high", "--no-report"],
-                componentKey: component.componentKey, timeoutMs, runner,
-            }));
-    }
-    if (skillPaths.length === 0) {
-        runs.push({ scanner: "skill", status: "skipped", detail: "no skills discovered", findings: [] });
-    }
-    runs.push(runJsonScanner({
-        scanner: "osv-scanner", command: "osv-scanner",
-        commandArgs: ["scan", "source", "-r", "--format", "json", workspace], timeoutMs, runner,
-    }));
-    if (options.connectMcp) {
-        const configPaths = [...new Set(pathsFor(report, "mcp-server", homeDir, workspace).map((item) => item.filePath))];
-        for (const configPath of configPaths) {
-            runs.push(runJsonScanner({
-                scanner: "cisco-mcp-scanner", command: "mcp-scanner",
-                commandArgs: ["--config-path", configPath, "--analyzers", "yara", "--format", "raw"],
-                timeoutMs, runner,
-            }));
-        }
-        if (configPaths.length === 0)
-            runs.push({ scanner: "cisco-mcp-scanner", status: "skipped", detail: "no MCP configurations discovered", findings: [] });
-    }
-    else {
-        runs.push({ scanner: "cisco-mcp-scanner", status: "skipped", detail: "live MCP startup disabled; pass --connect-mcp to opt in", findings: [] });
-    }
-    if (options.supplyChain) {
-        for (const { component } of pathsFor(report, "extension", homeDir, workspace)) {
-            runs.push(runJsonScanner({
-                scanner: "guarddog", command: "guarddog",
-                commandArgs: [
-                    "extension", "scan", component.name,
-                    ...(component.version ? ["--version", component.version] : []),
-                    "--output-format=json",
-                ],
-                componentKey: component.componentKey, timeoutMs, runner,
-            }));
-        }
-    }
-    else {
-        runs.push({ scanner: "guarddog", status: "skipped", detail: "registry downloads disabled; pass --supply-chain to opt in", findings: [] });
-    }
-    return {
-        schemaVersion: 1,
-        generatedAt: new Date((options.now ?? Date.now)()).toISOString(),
-        runs,
-        findings: runs.flatMap((run) => run.findings),
-    };
-}

package/dist/securityDoctor.d.ts

@@ -1,32 +0,0 @@
-import { type SecurityInstallInspection, type SecurityInstallManifest } from "./securityInstall";
-export type SecurityDoctorStatus = "pass" | "fail" | "warn";
-export interface SecurityDoctorCheck {
-    name: string;
-    status: SecurityDoctorStatus;
-    detail: string;
-}
-export interface SecurityDoctorReport {
-    schemaVersion: 1;
-    ok: boolean;
-    integrity: {
-        ok: boolean;
-        detail: string;
-    };
-    manifest: SecurityInstallManifest | null;
-    installations: SecurityInstallInspection[];
-    policyExists: boolean;
-    /** Retained for `codiedev security doctor --json` compatibility. */
-    policySignature: {
-        ok: boolean;
-        trusted: boolean;
-        detail: string;
-    };
-    policySelfTest: {
-        ok: boolean;
-        cases: number;
-    };
-}
-/** One security-health model shared by `doctor` and its legacy alias. */
-export declare function collectSecurityDoctorReport(companyId?: string): SecurityDoctorReport;
-/** Convert security health into the same compact rows used by core doctor. */
-export declare function securityDoctorChecks(report: SecurityDoctorReport): SecurityDoctorCheck[];

package/dist/securityDoctor.js

@@ -1,63 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.collectSecurityDoctorReport = collectSecurityDoctorReport;
-exports.securityDoctorChecks = securityDoctorChecks;
-const securityInstall_1 = require("./securityInstall");
-const securityPilot_1 = require("./securityPilot");
-const securityPolicy_1 = require("./securityPolicy");
-/** One security-health model shared by `doctor` and its legacy alias. */
-function collectSecurityDoctorReport(companyId) {
-    const manifest = (0, securityInstall_1.readSecurityInstallManifest)();
-    const integrity = (0, securityInstall_1.verifySecurityInstallManifest)(manifest);
-    const installations = (0, securityInstall_1.inspectSecurityInstallation)();
-    const pilot = (0, securityPilot_1.runSyntheticSecurityPilot)();
-    const policy = (0, securityPolicy_1.inspectEndpointSecurityPolicy)(undefined, undefined, companyId);
-    const ok = integrity.ok &&
-        policy.verification.ok &&
-        pilot.ok &&
-        !installations.some((result) => result.status === "fail");
-    return {
-        schemaVersion: 1,
-        ok,
-        integrity,
-        manifest,
-        installations,
-        policyExists: policy.exists,
-        policySignature: policy.verification,
-        policySelfTest: { ok: pilot.ok, cases: pilot.cases.length },
-    };
-}
-/** Convert security health into the same compact rows used by core doctor. */
-function securityDoctorChecks(report) {
-    const checks = [
-        {
-            name: "Agent Security hook integrity",
-            status: report.integrity.ok ? "pass" : "fail",
-            detail: report.integrity.detail,
-        },
-        ...report.installations.map((installation) => ({
-            name: `Agent Security ${installation.surface}`,
-            status: installation.status === "pass"
-                ? "pass"
-                : installation.status === "not-installed"
-                    ? "warn"
-                    : "fail",
-            detail: installation.detail,
-        })),
-        {
-            name: "Agent Security policy",
-            status: !report.policyExists
-                ? "warn"
-                : report.policySignature.ok
-                    ? "pass"
-                    : "fail",
-            detail: report.policySignature.detail,
-        },
-        {
-            name: "Agent Security policy self-test",
-            status: report.policySelfTest.ok ? "pass" : "fail",
-            detail: `${report.policySelfTest.cases} deterministic cases`,
-        },
-    ];
-    return checks;
-}

package/dist/securityFeature.d.ts

@@ -1,5 +0,0 @@
-export interface AgentSecurityEntitlement {
-    agentSecurityEnabled?: boolean;
-}
-/** Security is opt-in per company. Missing/stale entitlement data is dormant. */
-export declare function isAgentSecurityEnabled(config: AgentSecurityEntitlement | null | undefined): boolean;

package/dist/securityFeature.js

@@ -1,7 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAgentSecurityEnabled = isAgentSecurityEnabled;
-/** Security is opt-in per company. Missing/stale entitlement data is dormant. */
-function isAgentSecurityEnabled(config) {
-    return config?.agentSecurityEnabled === true;
-}

package/dist/securityInstall.d.ts

@@ -1,63 +0,0 @@
-export type SecuritySurface = "claude-code" | "codex" | "cursor" | "codie-harness";
-export interface SecurityInstallTarget {
-    surface: SecuritySurface;
-    configPath: string;
-}
-export interface SecurityRollbackFile {
-    originalPath: string;
-    snapshotPath: string;
-}
-export interface SecurityInstallSnapshot {
-    id: string;
-    createdAt: string;
-    files: SecurityRollbackFile[];
-}
-export interface SecurityInstallManifest {
-    schemaVersion: 1;
-    cliVersion: string;
-    installedAt: string;
-    hookScriptPath: string;
-    hookScriptSha256: string;
-    targets: SecurityInstallTarget[];
-    rollbackSnapshotId: string;
-    rollbackFiles: SecurityRollbackFile[];
-}
-export interface SecurityInstallInspection {
-    surface: SecuritySurface;
-    status: "pass" | "fail" | "not-installed";
-    detail: string;
-}
-/**
- * Capture the exact pre-update hook configuration. This function never removes
- * or restores anything; it creates the evidence needed for an explicit,
- * administrator-approved rollback later.
- */
-export declare function createSecurityInstallSnapshot(configPaths: string[], stateDir?: string, now?: () => number): SecurityInstallSnapshot;
-export declare function writeSecurityInstallManifest(options: {
-    stateDir?: string;
-    hookScriptPath: string;
-    snapshot: SecurityInstallSnapshot;
-    targets: SecurityInstallTarget[];
-    now?: () => number;
-}): SecurityInstallManifest;
-export declare function readSecurityInstallManifest(stateDir?: string): SecurityInstallManifest | null;
-export declare function verifySecurityInstallManifest(manifest: SecurityInstallManifest | null): {
-    ok: boolean;
-    detail: string;
-};
-/**
- * Restore only files recorded in the selected install manifest. The snapshot
- * location is validated before any write and each replacement is atomic, so a
- * partial copy cannot leave a hook configuration truncated.
- */
-export declare function restoreSecurityInstallSnapshot(manifest: SecurityInstallManifest | null): {
-    restored: number;
-    snapshotId: string;
-};
-export declare function inspectSecurityInstallation(paths?: {
-    claudeSettingsPath?: string;
-    codexHooksPath?: string;
-    codexConfigPath?: string;
-    cursorHooksPath?: string;
-    codiePluginPath?: string;
-}): SecurityInstallInspection[];

package/dist/securityInstall.js

@@ -1,239 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSecurityInstallSnapshot = createSecurityInstallSnapshot;
-exports.writeSecurityInstallManifest = writeSecurityInstallManifest;
-exports.readSecurityInstallManifest = readSecurityInstallManifest;
-exports.verifySecurityInstallManifest = verifySecurityInstallManifest;
-exports.restoreSecurityInstallSnapshot = restoreSecurityInstallSnapshot;
-exports.inspectSecurityInstallation = inspectSecurityInstallation;
-const crypto = __importStar(require("crypto"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const configDir_1 = require("./configDir");
-const detection_1 = require("./detection");
-const codexHookTrust_1 = require("./codexHookTrust");
-const version_1 = require("./version");
-const MANIFEST_FILE = "security-install.json";
-function sha256File(filePath) {
-    return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
-}
-function safeSnapshotName(index, filePath) {
-    const digest = crypto.createHash("sha256").update(filePath).digest("hex").slice(0, 12);
-    return `${String(index + 1).padStart(2, "0")}-${digest}-${path.basename(filePath)}`;
-}
-/**
- * Capture the exact pre-update hook configuration. This function never removes
- * or restores anything; it creates the evidence needed for an explicit,
- * administrator-approved rollback later.
- */
-function createSecurityInstallSnapshot(configPaths, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now) {
-    const timestamp = now();
-    const id = `${timestamp}-${process.pid}`;
-    const snapshotDir = path.join(stateDir, "security-rollbacks", id);
-    fs.mkdirSync(snapshotDir, { recursive: true, mode: 0o700 });
-    const files = [];
-    for (const [index, originalPath] of [...new Set(configPaths)].entries()) {
-        if (!fs.existsSync(originalPath) || !fs.statSync(originalPath).isFile())
-            continue;
-        const snapshotPath = path.join(snapshotDir, safeSnapshotName(index, originalPath));
-        fs.copyFileSync(originalPath, snapshotPath);
-        fs.chmodSync(snapshotPath, 0o600);
-        files.push({ originalPath, snapshotPath });
-    }
-    return { id, createdAt: new Date(timestamp).toISOString(), files };
-}
-function writeSecurityInstallManifest(options) {
-    const stateDir = options.stateDir ?? (0, configDir_1.codiedevStateDir)();
-    const now = options.now ?? Date.now;
-    if (!fs.existsSync(options.hookScriptPath)) {
-        throw new Error(`security hook script not found: ${options.hookScriptPath}`);
-    }
-    const manifest = {
-        schemaVersion: 1,
-        cliVersion: version_1.CLI_VERSION,
-        installedAt: new Date(now()).toISOString(),
-        hookScriptPath: path.resolve(options.hookScriptPath),
-        hookScriptSha256: sha256File(options.hookScriptPath),
-        targets: options.targets,
-        rollbackSnapshotId: options.snapshot.id,
-        rollbackFiles: options.snapshot.files,
-    };
-    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
-    const manifestPath = path.join(stateDir, MANIFEST_FILE);
-    fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
-    fs.chmodSync(manifestPath, 0o600);
-    return manifest;
-}
-function readSecurityInstallManifest(stateDir = (0, configDir_1.codiedevStateDir)()) {
-    try {
-        const value = JSON.parse(fs.readFileSync(path.join(stateDir, MANIFEST_FILE), "utf8"));
-        return value?.schemaVersion === 1 ? value : null;
-    }
-    catch {
-        return null;
-    }
-}
-function verifySecurityInstallManifest(manifest) {
-    if (!manifest)
-        return { ok: false, detail: "security install manifest is missing" };
-    if (!fs.existsSync(manifest.hookScriptPath)) {
-        return { ok: false, detail: "recorded security hook script is missing" };
-    }
-    if (sha256File(manifest.hookScriptPath) !== manifest.hookScriptSha256) {
-        return {
-            ok: false,
-            detail: "installed hook does not match the recorded SHA-256 integrity digest",
-        };
-    }
-    return {
-        ok: true,
-        detail: `v${manifest.cliVersion}; rollback snapshot ${manifest.rollbackSnapshotId} available`,
-    };
-}
-/**
- * Restore only files recorded in the selected install manifest. The snapshot
- * location is validated before any write and each replacement is atomic, so a
- * partial copy cannot leave a hook configuration truncated.
- */
-function restoreSecurityInstallSnapshot(manifest) {
-    if (!manifest)
-        throw new Error("security install manifest is missing");
-    let restored = 0;
-    for (const file of manifest.rollbackFiles) {
-        const snapshotPath = path.resolve(file.snapshotPath);
-        const snapshotDir = path.dirname(snapshotPath);
-        if (path.basename(snapshotDir) !== manifest.rollbackSnapshotId ||
-            path.basename(path.dirname(snapshotDir)) !== "security-rollbacks") {
-            throw new Error(`rollback file does not match rollback snapshot ${manifest.rollbackSnapshotId}`);
-        }
-        if (!fs.existsSync(snapshotPath) || !fs.statSync(snapshotPath).isFile()) {
-            throw new Error(`rollback file is missing: ${snapshotPath}`);
-        }
-        const originalPath = path.resolve(file.originalPath);
-        fs.mkdirSync(path.dirname(originalPath), { recursive: true, mode: 0o700 });
-        const temporaryPath = `${originalPath}.codiedev-rollback-${process.pid}`;
-        fs.copyFileSync(snapshotPath, temporaryPath);
-        fs.chmodSync(temporaryPath, 0o600);
-        fs.renameSync(temporaryPath, originalPath);
-        restored += 1;
-    }
-    return { restored, snapshotId: manifest.rollbackSnapshotId };
-}
-function hookCommands(parsed, eventName, allowFlat) {
-    const entries = parsed?.hooks?.[eventName];
-    if (!Array.isArray(entries))
-        return [];
-    const commands = [];
-    for (const entry of entries) {
-        const flatCommand = entry.command;
-        if (allowFlat && typeof flatCommand === "string" && (0, detection_1.isCodiedevHookCommand)(flatCommand)) {
-            commands.push(flatCommand);
-        }
-        const nested = entry?.hooks;
-        if (!Array.isArray(nested))
-            continue;
-        for (const hook of nested) {
-            if (typeof hook.command === "string" && (0, detection_1.isCodiedevHookCommand)(hook.command)) {
-                commands.push(hook.command);
-            }
-        }
-    }
-    return commands;
-}
-function inspectJsonSurface(surface, filePath, codexConfigPath) {
-    if (!fs.existsSync(filePath)) {
-        return { surface, status: "not-installed", detail: `${filePath} not found` };
-    }
-    try {
-        const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-        const expected = surface === "cursor"
-            ? [
-                ["beforeSubmitPrompt", "security-prompt-cursor"],
-                ["preToolUse", "security-pre-cursor"],
-                ["postToolUse", "security-post-cursor"],
-                ["postToolUseFailure", "security-failure-cursor"],
-            ]
-            : [
-                ["UserPromptSubmit", surface === "codex" ? "discover-codex" : "discover"],
-                ["PreToolUse", surface === "codex" ? "security-pre-codex" : "security-pre"],
-                ["PostToolUse", surface === "codex" ? "security-post-codex" : "security-post"],
-                ...(surface === "claude-code"
-                    ? [["PostToolUseFailure", "security-failure"]]
-                    : []),
-            ];
-        const missing = expected
-            .filter(([eventName, subcommand]) => !hookCommands(parsed, eventName, surface === "cursor").some((command) => command.trim().endsWith(subcommand)))
-            .map(([eventName]) => eventName);
-        if (missing.length > 0) {
-            return { surface, status: "fail", detail: `missing security hooks: ${missing.join(", ")}` };
-        }
-        if (surface === "codex") {
-            const trust = (0, codexHookTrust_1.inspectCodexHookTrust)(codexConfigPath ?? path.join(path.dirname(filePath), "config.toml"), filePath, parsed, ["discover-codex", "security-pre-codex", "security-post-codex"]);
-            if (!trust.ok) {
-                return { surface, status: "fail", detail: `Codex hook trust missing or stale (${trust.trusted}/${trust.total} trusted)` };
-            }
-        }
-        return { surface, status: "pass", detail: "prompt guard and tool telemetry hooks installed and active" };
-    }
-    catch (error) {
-        return { surface, status: "fail", detail: `invalid hook configuration: ${error.message}` };
-    }
-}
-function inspectSecurityInstallation(paths = {}) {
-    const home = os.homedir();
-    const claude = paths.claudeSettingsPath ?? path.join(home, ".claude", "settings.json");
-    const codex = paths.codexHooksPath ?? path.join(home, ".codex", "hooks.json");
-    const cursor = paths.cursorHooksPath ?? path.join(home, ".cursor", "hooks.json");
-    const codie = paths.codiePluginPath ?? path.join(home, ".config", "opencode", "plugins", "codiedev.js");
-    const results = [
-        inspectJsonSurface("claude-code", claude),
-        inspectJsonSurface("codex", codex, paths.codexConfigPath),
-        inspectJsonSurface("cursor", cursor),
-    ];
-    if (!fs.existsSync(codie)) {
-        results.push({ surface: "codie-harness", status: "not-installed", detail: `${codie} not found` });
-    }
-    else {
-        const source = fs.readFileSync(codie, "utf8");
-        const markers = ["security-pre-codie", "security-post-codie", "chat.message", "tool.execute.before", "tool.execute.after"];
-        const missing = markers.filter((marker) => !source.includes(marker));
-        results.push(missing.length === 0
-            ? { surface: "codie-harness", status: "pass", detail: "prompt guard and tool telemetry adapter installed" }
-            : { surface: "codie-harness", status: "fail", detail: `adapter missing: ${missing.join(", ")}` });
-    }
-    return results;
-}