graph-indexer 2.1.1 → 3.0.1

package/prompts/languages/PHP.md

@@ -1,23 +0,0 @@
-<environment_prompt layer="2" type="language" name="php" requires="graph-indexer-core" version="1.0">
-
-    <scope>Indexed code is PHP (.php). Deltas to core; hard limits unchanged.</scope>
-
-    <index_facts>
-        <fact>Chunks are functions and WHOLE CLASSES — one class is ONE chunk with all its methods, UNTIL the class exceeds ~200 lines: a god-class is split so its methods become their own resolvable chunks. Class-sized questions on normal classes are cheap: one model/service class is one card, its full body one get_chunk.</fact>
-        <fact>get_file_skeleton(path) parses the live file and lists EVERY method + line ranges (~80 tok) — THE tool for a large class. One skeleton call replaces searching method names inside it.</fact>
-        <fact priority="critical">Topology WEAK BY DESIGN: only include/require tracked, namespace `use` imports are NOT. In autoloaded (PSR-4) code Deps:/Used by: are sparse/empty and mean NOTHING about usage. Map consumers by name search: chunks mentioning "ClassName" surface alongside its definition.</fact>
-        <fact>Closures and arrow functions have no symbol — callback logic belongs to the enclosing function/class chunk.</fact>
-    </index_facts>
-
-    <rules>
-        <rule name="batched-class-questions">"Explain classes A, B, C, D (and where used)" = ONE search_code(query: "A B C D", detail: "smart", top_k: 2×N). Definitions rank top (name boost), consumers follow. Escalate ONCE to detail: "full" + token_budget (e.g. 3000) when complete bodies of several small classes are needed. NEVER one resolve_symbol/search per class — the budget-killing failure.</rule>
-        <rule name="usage-mapping">Consumers of ONE class: search_code(query: "what it's used for", exact_tokens: "ClassName") — REPLACES the missing Used by:. get_call_graph works for function/method NAMES, not class references.</rule>
-        <rule name="one-method-of-a-class">In a normal (sub-200-line) class, method names aren't independently resolvable: get_file_skeleton(file) for the method map + line range, or get_chunk_summary(classChunkId) for the interface — only then decide if the full body is worth it. In a god-class (≥200 lines) the methods ARE their own chunks, so resolve_symbol / search_code on the method name hits directly.</rule>
-        <rule name="magic-methods">__call/__callStatic/__get/__set/__invoke route behaviour with NO edges. If a called method isn't in the class chunk, check its magic methods and `use TraitName;` lines — trait methods live in the TRAIT's chunk; resolve ONE trait.</rule>
-        <rule name="dynamic-dispatch">`$obj->$method()`, call_user_func, 'Class::method' strings create no edges — search the name as a string literal. Dispatch binds by name: get_call_graph("handle") mixes every handle; confirm receivers via class context.</rule>
-        <rule name="namespaces">Resolve SHORT class names; the file path mirrors the namespace under PSR-4 — disambiguate from paths on the cards, no extra calls.</rule>
-    </rules>
-
-    <playbook question="explain models Country, Community, Region, Location and where used" calls="1-2">ONE search_code(query: "Country Community Region Location", detail: "smart", top_k: 10) → the four model cards (relation methods in the smart body lines) plus the controllers/components mentioning them → answer structure AND usage. Optional 2nd call: detail: "full", token_budget: 3000 only if every method body must be quoted. Four resolve_symbol calls here = budget dead.</playbook>
-
-</environment_prompt>

package/prompts/languages/PYTHON.md

@@ -1,23 +0,0 @@
-<environment_prompt layer="2" type="language" name="python" requires="graph-indexer-core" version="1.0">
-
-    <scope>Indexed code is Python (.py). Deltas to core; hard limits unchanged.</scope>
-
-    <index_facts>
-        <fact>Chunks: top-level defs, classes, methods. Decorator lines are INSIDE the chunk — routing/caching/permission behaviour is visible in summaries and searchable as body text.</fact>
-        <fact>Topology RELIABLE — absolute and relative imports tracked.</fact>
-        <fact>Calling a class — `UserService(...)` — records a call to the CLASS name: get_call_graph("UserService") finds instantiation sites; get_call_graph("__init__") is noise.</fact>
-        <fact>Module-level statements (constants, registrations, import-time side effects) live outside any function — if behaviour happens "at import time", get_file_skeleton(path) shows it; don't hunt for a function that doesn't exist.</fact>
-    </index_facts>
-
-    <rules>
-        <rule name="name-overmatch">Dispatch binds by NAME and Python is duck-typed: get_call_graph("save") mixes every save repo-wide, and resolve_symbol may return several — pick by file path + class context from the cards, no extra reads. If your index was built --resolver scip (scip-python), find_references returns a 🎯 SCIP-resolved set that disambiguates the right one — trust it over name-only.</rule>
-        <rule name="dunder-magic">Implicit protocol calls have no edges: `obj()`↛__call__, `a+b`↛__add__, attr access↛__getattr__, `with`↛__enter__/__exit__. An empty call graph on a dunder means nothing.</rule>
-        <rule name="package-barrels">`__init__.py` re-export hubs produce re_export nodes: internal origin → ONE hop; external dependency → stop.</rule>
-        <rule name="decorators-wrap">Call sites point at the DECORATED name even when a decorator wraps it. If runtime behaviour is the question, read the decorator's chunk ONCE — never trace every wrapped function.</rule>
-        <rule name="string-references">getattr/importlib/task-queue registrations and monkey-patching reference code by STRING — no edges. Trace by searching the string literal; when observed behaviour contradicts the source, ONE search of the patched name as a literal.</rule>
-        <rule name="query-style">snake_case splits perfectly ("parse_request_body" matches "parse request body") and docstrings are indexed — query with docstring vocabulary. For duck-typed behaviour use a behavioural sentence, not the method name.</rule>
-    </rules>
-
-    <playbook question="explain function/class X" calls="2-3">resolve_symbol("X") (decorators visible) → get_chunk_summary(id, expand_calls: true) → answer with Used by: list; ≤1 consumer OR the ONE behaviour-defining decorator.</playbook>
-
-</environment_prompt>

package/prompts/languages/RUBY.md

@@ -1,23 +0,0 @@
-<environment_prompt layer="2" type="language" name="ruby" requires="graph-indexer-core" version="1.0">
-
-    <scope>Indexed code is Ruby (.rb). Deltas to core; hard limits unchanged.</scope>
-
-    <index_facts>
-        <fact>Chunks: methods, singleton methods (`def self.x`), classes, MODULES. Instance vs class methods of the same name are DIFFERENT chunks — check the signature for which you hold.</fact>
-        <fact priority="critical">Topology WEAK: only require/require_relative tracked, and most apps autoload — Deps:/Used by: are sparse/empty and mean NOTHING about usage. Map consumers by name search: bodies are indexed, so chunks mentioning "ClassName" surface in the same search as its definition.</fact>
-        <fact>Reopened classes produce MULTIPLE chunks for one name — reopening, not duplication; treat them together, read only the one matching your concern.</fact>
-        <fact>Blocks (`do...end`, `{ }`) have no symbol — logic passed to each/map/DSL methods belongs to the enclosing chunk; find it behaviourally.</fact>
-        <fact>find_references: callers + extends/includes channels only; type_refs (annotation-usage) channel is EMPTY — Ruby is dynamically typed, no annotation tracking. "Where is this class used as a type" must be answered by name search, not find_references.</fact>
-    </index_facts>
-
-    <rules>
-        <rule name="metaprogrammed-methods">define_method, method_missing, attr_accessor/attr_reader, delegate macros create methods with NO chunks. If resolve_symbol misses a method callers clearly use, ONE search of the SYMBOL LITERAL (exact_tokens: ":method_name") or the macro line — the macro call IS the definition.</rule>
-        <rule name="duck-typed-dispatch">Everything dispatches by NAME: get_call_graph("call")/("perform") overmatches massively — prefer rarer names as graph entry points and confirm receivers from context. send/public_send invoke by symbol with no edge — search the symbol literal.</rule>
-        <rule name="mixins">Methods arrive via include/extend/prepend — if a class responds to a method it doesn't define, its include lines (in the class chunk) name the module; resolve ONE module.</rule>
-        <rule name="implicit-hooks">included/inherited/method_added hooks and yield-passed blocks run with no inbound edges — not dead code; the behaviour of `process { }` splits between the method chunk and the ONE call site that matters.</rule>
-        <rule name="query-style">snake_case splits perfectly; pin ?/! suffixed names with exact_tokens. For DSL-heavy code search the DSL keyword or symbol literal ("validates", ":before_save") — the declaration site is the behaviour. Resolve namespaced constants by the LAST segment, disambiguate by path.</rule>
-    </rules>
-
-    <playbook question="explain classes A, B, C (and where used)" calls="1-2">ONE search_code(query: "A B C", detail: "smart", top_k: 2×N): definitions rank top, consumers (bodies mentioning the names) follow — this REPLACES the missing Used by: topology. Escalate ONE chunk to full body only if needed.</playbook>
-
-</environment_prompt>

package/prompts/languages/RUST.md

@@ -1,21 +0,0 @@
-<environment_prompt layer="2" type="language" name="rust" requires="graph-indexer-core" version="1.0">
-
-    <scope>Indexed code is Rust (.rs). Deltas to core; hard limits unchanged.</scope>
-
-    <index_facts>
-        <fact>Chunks: top-level fns, impl-block methods, traits, structs, enums. Attribute lines (#[...]) are part of the chunk — derives and attribute macros are visible in summaries and often ARE the behaviour.</fact>
-        <fact>Topology RELIABLE — `use` declarations tracked.</fact>
-        <fact priority="critical">MACROS ARE NOT EXPANDED: code from #[derive(...)], attribute macros, and macro_rules! has NO chunks, and calls written inside macro invocations may be missing from the call graph. If an impl that "must exist" is unfindable (e.g. Serialize for a struct), the struct's derive attribute IS the answer — never hunt for generated bodies.</fact>
-    </index_facts>
-
-    <rules>
-        <rule name="hidden-calls">Rust inserts calls the source never spells: `?`→From::from, operators→Add::add etc., Deref coercion→deref, scope end→Drop::drop, `.await`→poll. None appear as edges — never call a trait method unused from an empty call graph.</rule>
-        <rule name="trait-dispatch">Calls through generics (T: Trait) or dyn Trait bind to the method NAME: get_call_graph("execute") mixes every execute. Disambiguate by the impl target in each signature. Enumerate implementors: ONE search_code(query: "impl TraitName for", exact_tokens: "TraitName"). If your index was built --resolver scip (rust-analyzer --scip), find_references returns a precise 🎯 SCIP-resolved set that separates same-named methods — trust it over name-only.</rule>
-        <rule name="re-exports">`pub use` hubs (crate roots, preludes) produce re_export nodes: internal origin → ONE hop; external crate → stop.</rule>
-        <rule name="closures-and-generics">Logic inside closures passed to combinators has no edges — behavioural search. A generic fn is ONE chunk regardless of instantiations; per-type behaviour comes from its trait bounds — resolve the bound trait's method ONCE, per-type copies don't exist.</rule>
-        <rule name="query-style">snake_case splits well; pin PascalCase trait/type names with exact_tokens. For error flow, search the error variant name or the thiserror/anyhow message string — far more unique than "error". Trust card file paths over guessed `crate::` paths.</rule>
-    </rules>
-
-    <playbook question="explain type X and its trait impls" calls="1-2">ONE search_code(query: "X impl trait", top_k: 8) — the struct chunk and its impl chunks surface together (name boost); attributes on the struct card answer derive questions. Escalate ONE chunk to full body only if implementation detail is the question.</playbook>
-
-</environment_prompt>

package/prompts/languages/SWIFT.md

@@ -1,21 +0,0 @@
-<environment_prompt layer="2" type="language" name="swift" requires="graph-indexer-core" version="1.0">
-
-    <scope>Indexed code is Swift (.swift). Deltas to core; hard limits unchanged.</scope>
-
-    <index_facts>
-        <fact priority="critical">struct, class, enum, extension, actor ALL appear with card type `class_declaration` — the card does NOT distinguish them, so READ THE KEYWORD in the signature before reasoning about value vs reference semantics. A god-type is split so its methods become their own chunks.</fact>
-        <fact priority="critical">A type's behaviour is SPREAD across its base declaration AND every `extension` — each is a separate chunk, all carry the SAME name, possibly in different files. resolve_symbol("Point") returns the struct AND every extension; protocol conformance is usually in an extension. Read them together, not just the first card.</fact>
-        <fact>Topology WEAK: `import Module` is recorded but Swift resolves by MODULE not file path — an empty Used by: is uninformative, never "unused".</fact>
-    </index_facts>
-
-    <rules>
-        <rule name="protocol-dispatch">Protocol calls bind by NAME across every conformer: get_call_graph("draw") mixes every draw(). Disambiguate by receiver type in each card. Enumerate conformers: ONE search_code(query: "conform protocol", exact_tokens: "ProtocolName") — extension conformances surface by the protocol name.</rule>
-        <rule name="attributes-are-behaviour">Property wrappers/attributes are part of the chunk and frequently ARE the behaviour: @Published, @State/@Binding, @MainActor, @objc, @escaping. A computed property's logic lives in the PROPERTY declaration, not a synthesized getX accessor.</rule>
-        <rule name="synthesized-has-no-chunk">Memberwise inits, synthesized Codable/Equatable/Hashable, enum case accessors have NO chunks — a "missing" member matching that list means the type declaration (or its Codable conformance) IS the answer.</rule>
-        <rule name="closures-and-builders">Trailing closures/combinators (`.map { }`, `Task { }`, `DispatchQueue.async { }`) record a call to the combinator only; SwiftUI `body` and result builders generate view structure with no edges. Closure logic belongs to the enclosing chunk — find it behaviourally. `super.m()`/`self.m()` record receiver hints.</rule>
-        <rule name="query-style">camelCase splits well; pin Type names and argument labels with exact_tokens. A method written `distance(to:)` is searched by its base name `distance`. For error flow, search the thrown error case name or its message string.</rule>
-    </rules>
-
-    <playbook question="explain type X and its conformances" calls="1-3">ONE search_code(query: "X", exact_tokens: "X") — the base declaration and its extension chunks surface together via the name boost; read keyword + attributes off the cards → get_chunk_summary(id, expand_calls: true) on the primary chunk. ≤1 protocol hop.</playbook>
-
-</environment_prompt>

package/seal.mjs

@@ -1,400 +0,0 @@
-/**
- * @file seal.mjs
- * @description Sealed mode (F1): turn "air-gapped by default" from a behaviour you trust into a
- *              guarantee you can verify and enforce. Two opt-in tiers:
- *                • strict — zero network egress; lexical-only (the default path).
- *                • local  — loopback only; local LLM/embedders on this box are allowed, nothing
- *                           leaves it.
- *
- *              Three mechanisms:
- *                1. assertSealCompatible(config) — FAIL-CLOSED validation: refuse to start if any
- *                   enabled feature would egress beyond the tier, naming the feature + remedy.
- *                2. installEgressGuard({allow}) — a deny-by-default runtime hook on the in-process
- *                   network paths (net/tls sockets, http(s), fetch) so an *accidental* call is
- *                   caught, not just the known ones. A best-effort child_process denylist covers
- *                   the obvious out-of-process egress tools (documented limitation: a child
- *                   process has its own socket layer the parent cannot hook).
- *                3. sealManifest(config) — a deterministic attestation document (tier, providers,
- *                   egress posture) an auditor/CI can diff against policy.
- *
- *              Sealed mode is itself opt-in and can only REMOVE capability (fail-closed); it never
- *              changes ranking, the store, or parity. The default path is already strict-compatible.
- *
- *              Language grammars (parse/languages.mjs) are a separate, asset-availability form of
- *              fail-closed: they are not bundled dependencies (installed on demand into
- *              .graph-indexer/node_modules), so under sealed mode auto-install is disabled and
- *              indexer.mjs throws SealViolation if a configured language's grammar isn't already
- *              resolvable — pre-install before sealing rather than silently shipping a partial index.
- * @author MaquinaTech <https://github.com/MaquinaTech>
- * @copyright (c) 2026 MaquinaTech. All rights reserved.
- * @license MIT
- */
-import http from 'node:http';
-import https from 'node:https';
-import net from 'node:net';
-import cp from 'node:child_process';
-import crypto from 'node:crypto';
-
-/** Thrown by the fail-closed validation and by the runtime guard. */
-export class SealViolation extends Error {
-    constructor(message) { super(message); this.name = 'SealViolation'; }
-}
-
-const LOOPBACK_RE = /^(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|::1|0:0:0:0:0:0:0:1)$/i;
-
-/** Is a bare host string a loopback address? (IPv6 brackets tolerated.) */
-export function isLoopbackHost(host) {
-    if (!host) return false;
-    const h = String(host).replace(/^\[|\]$/g, '').trim().toLowerCase();
-    return LOOPBACK_RE.test(h);
-}
-
-/** Is a URL string loopback-bound? Unparseable → false (treated as non-loopback). */
-export function isLoopbackUrl(url) {
-    if (!url) return false;
-    try { return isLoopbackHost(new URL(String(url)).hostname); } catch { return false; }
-}
-
-/** The LLM endpoint a feature would hit, given the active provider. */
-function llmHost(config) {
-    return config.llmProvider === 'mlx' ? config.mlxLmHost : config.ollamaHost;
-}
-
-/**
- * Enumerate the enabled features that make network calls, each tagged with its reach
- * ('loopback' = this box only, 'remote' = off-box) and a remedy. The default config (every
- * optional feature off) returns [].
- *
- * @param {object} config  Resolved config.
- * @returns {Array<{feature:string,reach:'loopback'|'remote',target:string,remedy:string}>}
- */
-export function egressingFeatures(config) {
-    const out = [];
-    const reachOf = (host) => (isLoopbackHost(host) || isLoopbackUrl(host) ? 'loopback' : 'remote');
-
-    if (config.embeddingsEnabled) {
-        const p = config.embedProvider;
-        if (p === 'ollama' || p === 'auto') {
-            out.push({
-                feature: `embeddings (${p === 'auto' ? 'auto→ollama' : 'ollama'})`,
-                reach: reachOf(config.ollamaHost), target: config.ollamaHost,
-                remedy: 'drop --embeddings, or point OLLAMA_HOST at loopback under --sealed local',
-            });
-        } else if (p === 'local') {
-            out.push({
-                feature: 'embeddings (local MiniLM)', reach: 'remote',
-                target: 'model CDN (first-run download)',
-                remedy: 'pre-warm the model cache offline, or drop --embeddings under sealed mode',
-            });
-        } else if (p === 'code-local') {
-            // Same in-process @huggingface/transformers path as 'local' — the code model is
-            // fetched from the model CDN on the FIRST run (air-gapped only once cached).
-            out.push({
-                feature: 'embeddings (code-local code-specialized)', reach: 'remote',
-                target: 'model CDN (first-run download)',
-                remedy: 'pre-warm the code model cache offline, or drop --embeddings under sealed mode',
-            });
-        } else if (p === 'mlx') {
-            out.push({
-                feature: 'embeddings (mlx subprocess)', reach: 'loopback',
-                target: 'local mlx subprocess',
-                remedy: 'drop --embeddings under --sealed strict (local compute only under --sealed local)',
-            });
-        }
-    }
-    if (config.enrichment?.enabled) {
-        out.push({
-            feature: 'enrichment (LLM)', reach: reachOf(llmHost(config)), target: llmHost(config),
-            remedy: 'drop --enrichment under sealed mode',
-        });
-    }
-    if (config.rerank?.enabled) {
-        if (config.rerank.provider === 'cross-encoder') {
-            out.push({
-                feature: 'rerank (cross-encoder)', reach: 'remote',
-                target: 'model CDN (first-run download)',
-                remedy: 'pre-warm the model cache offline, or drop --rerank under sealed mode',
-            });
-        } else {
-            out.push({
-                feature: 'rerank (generative LLM)', reach: reachOf(llmHost(config)), target: llmHost(config),
-                remedy: 'drop --rerank under sealed mode',
-            });
-        }
-    }
-    if (config.hyde?.enabled) {
-        out.push({
-            feature: 'hyde (LLM)', reach: reachOf(llmHost(config)), target: llmHost(config),
-            remedy: 'disable hyde under sealed mode',
-        });
-    }
-    return out;
-}
-
-/**
- * FAIL-CLOSED validation. Throws SealViolation (listing every offending feature) if the config
- * would egress beyond its tier. No-op when sealed is 'off'. Called from resolveConfig so a
- * sealed-incompatible config can never be constructed.
- *
- * @param {object} config  Resolved config (reads config.sealed ∈ {'off','local','strict'}).
- */
-export function assertSealCompatible(config) {
-    const tier = config.sealed || 'off';
-    if (tier === 'off') return;
-    const feats = egressingFeatures(config);
-    // strict forbids ANY egress; local forbids only off-box ('remote') reach.
-    const violations = tier === 'strict' ? feats : feats.filter(f => f.reach === 'remote');
-    if (violations.length === 0) return;
-    const detail = violations.map(v => `  • ${v.feature} → ${v.reach} (${v.target}); ${v.remedy}`).join('\n');
-    throw new SealViolation(
-        `--sealed ${tier} refuses to start — ${violations.length} enabled feature(s) would egress`
-        + (tier === 'strict' ? ' (strict = lexical-only, zero network):\n' : ' beyond loopback:\n')
-        + detail);
-}
-
-// ── Runtime egress guard ─────────────────────────────────────────────────────────────────────
-
-function hostFromHttpArgs(args) {
-    const a = args[0];
-    if (typeof a === 'string') { try { return new URL(a).hostname; } catch { return 'localhost'; } }
-    if (a && typeof a === 'object') {
-        if (typeof a.href === 'string') { try { return new URL(a.href).hostname; } catch { /* fall through */ } }
-        const h = a.hostname || a.host || 'localhost';
-        return String(h).replace(/:\d+$/, '');
-    }
-    return 'localhost';
-}
-
-function hostFromNetArgs(args) {
-    const a = args[0];
-    if (a && typeof a === 'object') {
-        if (a.path) return null;                 // IPC / unix socket — local, not network
-        return a.host || 'localhost';
-    }
-    if (typeof a === 'number') return typeof args[1] === 'string' ? args[1] : 'localhost';
-    if (typeof a === 'string') return null;      // IPC path
-    return 'localhost';
-}
-
-function hostFromFetch(input) {
-    if (typeof input === 'string') { try { return new URL(input).hostname; } catch { return null; } }
-    if (input && typeof input === 'object') {
-        if (typeof input.url === 'string') { try { return new URL(input.url).hostname; } catch { return null; } }
-        try { return new URL(String(input)).hostname; } catch { return null; }
-    }
-    return null;
-}
-
-const EGRESS_BINS = /^(curl|wget|nc|ncat|telnet|ssh|scp|sftp|rsync)$/i;
-const GIT_NET = /^(fetch|pull|push|clone|remote|ls-remote|submodule)$/i;
-const PKG_MGRS = /^(npm|pnpm|yarn|pip|pip3|gem|cargo|go)$/i;
-const PKG_NET = /\b(install|add|update|upgrade|ci|fetch|download|get)\b/i;
-
-/** Best-effort: would this child process reach the network? (documented as not airtight.) */
-export function commandWouldEgress(cmd, args = []) {
-    const base = String(cmd || '').split(/[\\/]/).pop();
-    if (EGRESS_BINS.test(base)) return true;
-    if (/^git$/i.test(base) && args[0] && GIT_NET.test(String(args[0]))) return true;
-    if (PKG_MGRS.test(base) && args.some(a => PKG_NET.test(String(a)))) return true;
-    // shell strings (exec/execSync) arrive as the whole command in `cmd`.
-    if (!args.length && /\b(curl|wget|nc|ncat|ssh|scp|rsync)\b/i.test(String(cmd))) return true;
-    if (!args.length && /\bgit\s+(fetch|pull|push|clone|remote|ls-remote)\b/i.test(String(cmd))) return true;
-    return false;
-}
-
-let _installed = null;
-
-/**
- * Install the deny-by-default egress guard. Idempotent. The in-process socket/http/fetch hooks are
- * airtight for THIS process; the child_process denylist is best-effort (a child has its own socket
- * layer). Returns a handle with restore() (used by tests + an orderly shutdown).
- *
- * @param {object} [opts]
- * @param {Array<'loopback'>} [opts.allow]  [] (strict) → block all; ['loopback'] (local) → permit loopback.
- */
-export function installEgressGuard({ allow = [] } = {}) {
-    if (_installed) return _installed;
-    const allowLoopback = allow.includes('loopback');
-    const permit = (host) => host !== null && allowLoopback && isLoopbackHost(host);
-    const block = (host, api) => {
-        throw new SealViolation(`sealed mode blocked a network connection to ${host || '(unparseable host)'} via ${api}`);
-    };
-    // A null host from net means IPC/unix socket (local) → allow; from fetch means unparseable → block.
-    const guardNet = (host, api, orig, ctx, args) => {
-        if (host === null || permit(host)) return orig.apply(ctx, args);
-        return block(host, api);
-    };
-
-    const orig = {
-        httpRequest: http.request, httpGet: http.get,
-        httpsRequest: https.request, httpsGet: https.get,
-        netConnect: net.Socket.prototype.connect,
-        fetch: globalThis.fetch,
-        spawn: cp.spawn, spawnSync: cp.spawnSync,
-        exec: cp.exec, execSync: cp.execSync,
-        execFile: cp.execFile, execFileSync: cp.execFileSync,
-    };
-
-    http.request = function (...args) { const h = hostFromHttpArgs(args); return permit(h) ? orig.httpRequest.apply(this, args) : block(h, 'http.request'); };
-    http.get = function (...args) { const h = hostFromHttpArgs(args); return permit(h) ? orig.httpGet.apply(this, args) : block(h, 'http.get'); };
-    https.request = function (...args) { const h = hostFromHttpArgs(args); return permit(h) ? orig.httpsRequest.apply(this, args) : block(h, 'https.request'); };
-    https.get = function (...args) { const h = hostFromHttpArgs(args); return permit(h) ? orig.httpsGet.apply(this, args) : block(h, 'https.get'); };
-    net.Socket.prototype.connect = function (...args) { return guardNet(hostFromNetArgs(args), 'net.connect', orig.netConnect, this, args); };
-    if (orig.fetch) globalThis.fetch = function (input, init) { const h = hostFromFetch(input); return permit(h) ? orig.fetch.call(this, input, init) : block(h, 'fetch'); };
-
-    const guardChild = (name, origFn) => function (cmd, args, ...rest) {
-        const argv = Array.isArray(args) ? args : [];
-        if (commandWouldEgress(cmd, argv)) throw new SealViolation(`sealed mode blocked a network-reaching child process via ${name}: ${cmd}`);
-        return origFn.call(this, cmd, args, ...rest);
-    };
-    cp.spawn = guardChild('spawn', orig.spawn);
-    cp.spawnSync = guardChild('spawnSync', orig.spawnSync);
-    cp.exec = guardChild('exec', orig.exec);
-    cp.execSync = guardChild('execSync', orig.execSync);
-    cp.execFile = guardChild('execFile', orig.execFile);
-    cp.execFileSync = guardChild('execFileSync', orig.execFileSync);
-
-    _installed = {
-        allow,
-        restore() {
-            http.request = orig.httpRequest; http.get = orig.httpGet;
-            https.request = orig.httpsRequest; https.get = orig.httpsGet;
-            net.Socket.prototype.connect = orig.netConnect;
-            if (orig.fetch) globalThis.fetch = orig.fetch;
-            cp.spawn = orig.spawn; cp.spawnSync = orig.spawnSync;
-            cp.exec = orig.exec; cp.execSync = orig.execSync;
-            cp.execFile = orig.execFile; cp.execFileSync = orig.execFileSync;
-            _installed = null;
-        },
-    };
-    return _installed;
-}
-
-/** Whether the guard is currently installed (for stats / idempotency checks). */
-export function egressGuardActive() { return _installed != null; }
-
-/**
- * Deterministic attestation document — the effective sealed posture an auditor/CI can diff against
- * policy. No timestamps in the body (stamp outside if needed) so it is reproducible.
- *
- * @param {object} config  Resolved config.
- */
-export function sealManifest(config) {
-    const tier = config.sealed || 'off';
-    return {
-        sealed: tier,
-        egress: tier === 'strict' ? 'none' : tier === 'local' ? 'loopback-only' : 'unrestricted',
-        providers: {
-            embeddings: config.embeddingsEnabled ? config.embedProvider : 'off',
-            enrichment: config.enrichment?.enabled ? config.llmProvider : 'off',
-            rerank: config.rerank?.enabled ? config.rerank.provider : 'off',
-            llm: config.llmProvider || 'ollama',
-        },
-        egressing_features: egressingFeatures(config).map(f => ({ feature: f.feature, reach: f.reach, target: f.target })),
-    };
-}
-
-// ── Attestation signing (F1 hardening) ───────────────────────────────────────────────────────
-// Turn the manifest from a document you trust into one you can VERIFY: a detached signature over
-// its canonical bytes, so an auditor/CI proves the attested posture is authentic and untampered.
-// Pure local crypto (node:crypto) — no dependency, no network; works under --sealed strict.
-
-/**
- * Deterministic JSON: object keys sorted recursively → stable bytes for signing/verifying. (The
- * manifest is already emitted in a fixed order, but signing over a canonical form makes the
- * signature robust to any future key-order change and to a round-trip through a file.)
- */
-export function canonicalJson(value) {
-    const norm = (v) => {
-        if (Array.isArray(v)) return v.map(norm);
-        if (v && typeof v === 'object') {
-            const out = {};
-            for (const k of Object.keys(v).sort()) out[k] = norm(v[k]);
-            return out;
-        }
-        return v;
-    };
-    return JSON.stringify(norm(value));
-}
-
-/** Map an asymmetric key type to its (node digest, label) signing spec. Ed25519 uses a null digest. */
-function signSpec(keyType) {
-    switch (keyType) {
-        case 'ed25519': return { digest: null, alg: 'ed25519' };
-        case 'ed448': return { digest: null, alg: 'ed448' };
-        case 'rsa':
-        case 'rsa-pss': return { digest: 'sha256', alg: 'rsa-sha256' };
-        case 'ec': return { digest: 'sha256', alg: 'ecdsa-sha256' };
-        default: throw new Error(`unsupported attestation key type: ${keyType}`);
-    }
-}
-
-/** SHA-256 fingerprint (first 16 bytes, hex) of a public key's SPKI/DER encoding — a stable key id. */
-export function publicKeyFingerprint(publicKey) {
-    const der = publicKey.export({ type: 'spki', format: 'der' });
-    return crypto.createHash('sha256').update(der).digest('hex').slice(0, 32);
-}
-
-/**
- * Sign a seal manifest with a PEM private key (Ed25519 / RSA / EC). Returns a signed envelope
- * `{ manifest, signature: { alg, keyType, publicKeyFingerprint, value } }`. The signature covers the
- * CANONICAL JSON of the manifest, so it is reproducible and tamper-evident.
- *
- * @param {object} manifest  Output of sealManifest(config).
- * @param {string|Buffer} privateKeyPem  A PEM-encoded private key.
- */
-export function signManifest(manifest, privateKeyPem) {
-    const privateKey = crypto.createPrivateKey(privateKeyPem);
-    const spec = signSpec(privateKey.asymmetricKeyType);
-    const data = Buffer.from(canonicalJson(manifest), 'utf8');
-    const value = crypto.sign(spec.digest, data, privateKey).toString('base64');
-    const publicKey = crypto.createPublicKey(privateKey);
-    return {
-        manifest,
-        signature: {
-            alg: spec.alg,
-            keyType: privateKey.asymmetricKeyType,
-            publicKeyFingerprint: publicKeyFingerprint(publicKey),
-            value,
-        },
-    };
-}
-
-/**
- * Verify a signed manifest envelope against a PEM public key. Returns `{ valid, reason }` (never
- * throws — a malformed envelope/key is a clean `valid:false`). `valid` is true only if the signature
- * matches the canonical JSON of `envelope.manifest` under the declared algorithm and key.
- *
- * @param {object} envelope  Output of signManifest().
- * @param {string|Buffer} publicKeyPem  A PEM-encoded public key.
- */
-export function verifySignedManifest(envelope, publicKeyPem) {
-    try {
-        if (!envelope || !envelope.manifest || !envelope.signature || !envelope.signature.value) {
-            return { valid: false, reason: 'not a signed manifest envelope (missing manifest/signature)' };
-        }
-        const publicKey = crypto.createPublicKey(publicKeyPem);
-        const spec = signSpec(publicKey.asymmetricKeyType);
-        if (spec.alg !== envelope.signature.alg) {
-            return { valid: false, reason: `algorithm mismatch: envelope=${envelope.signature.alg}, key=${spec.alg}` };
-        }
-        const data = Buffer.from(canonicalJson(envelope.manifest), 'utf8');
-        const ok = crypto.verify(spec.digest, data, publicKey, Buffer.from(envelope.signature.value, 'base64'));
-        if (!ok) return { valid: false, reason: 'signature does not match (tampered manifest or wrong key)' };
-        const fp = publicKeyFingerprint(publicKey);
-        if (envelope.signature.publicKeyFingerprint && envelope.signature.publicKeyFingerprint !== fp) {
-            return { valid: false, reason: 'public-key fingerprint mismatch' };
-        }
-        return { valid: true, reason: 'signature valid', publicKeyFingerprint: fp };
-    } catch (e) {
-        return { valid: false, reason: `verification error: ${e.message}` };
-    }
-}
-
-/** Generate an Ed25519 attestation keypair as PEM strings (`idx-index --gen-attestation-key`). */
-export function generateAttestationKeyPair() {
-    return crypto.generateKeyPairSync('ed25519', {
-        publicKeyEncoding: { type: 'spki', format: 'pem' },
-        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
-    });
-}