lucifer-gate 0.8.9 → 0.8.10-alpha.2.b3f7c1e

package/dist/server/cli/args.js

@@ -0,0 +1,7 @@
+export function getArgValue(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1 || idx >= args.length - 1)
+        return undefined;
+    return args[idx + 1];
+}
+//# sourceMappingURL=args.js.map

package/dist/server/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../../server/src/cli/args.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,IAAY;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACvB,CAAC"}

package/dist/server/cli/init_config.js

@@ -0,0 +1,81 @@
+import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { generateApiKey, generateAdminSecret } from '../domains/command-gateway/repository/api_key_store.js';
+export function initConfig(targetDir) {
+    const configDir = resolve(targetDir, 'config');
+    const dataDir = resolve(targetDir, 'data');
+    mkdirSync(configDir, { recursive: true });
+    mkdirSync(dataDir, { recursive: true });
+    const luciferJsonPath = join(configDir, 'lucifer.json');
+    const apiKeysPath = join(configDir, 'api-keys.json');
+    const commandRulesPath = join(configDir, 'command-rules.json');
+    const proxyConfigPath = join(configDir, 'proxy-config.json');
+    if (existsSync(luciferJsonPath)) {
+        console.log(`Config already exists: ${luciferJsonPath}`);
+        console.log('Delete it first if you want to regenerate.');
+        return;
+    }
+    const { key, salt, keyHash } = generateApiKey();
+    const { secret: adminSecret, salt: adminSalt, secretHash: adminHash } = generateAdminSecret();
+    writeFileSync(luciferJsonPath, JSON.stringify({
+        port: 3001,
+        adminSecretHash: adminHash,
+        adminSecretSalt: adminSalt,
+        approvalTimeoutSeconds: 300,
+        executionTimeoutSeconds: 120,
+        maxConcurrentExecutions: 5,
+        maxOutputBytes: 10485760,
+        rateLimitPerMinute: 10,
+        onApprovalTimeout: 'deny',
+        dataDir: '../data',
+        logFile: 'lucifer.log',
+    }, null, 2) + '\n');
+    writeFileSync(apiKeysPath, JSON.stringify({
+        keys: [{
+                id: crypto.randomUUID(),
+                name: 'default',
+                keyHash,
+                salt,
+                allowedIps: [],
+                createdAt: new Date().toISOString(),
+                active: true,
+            }],
+    }, null, 2) + '\n');
+    writeFileSync(commandRulesPath, JSON.stringify({
+        rules: [
+            { prefix: 'echo ', action: 'always_approve' },
+            { prefix: 'git status', action: 'always_approve' },
+            { prefix: 'git pull', action: 'manual_approve' },
+            { prefix: 'git push', action: 'manual_approve' },
+            { prefix: 'npm test', action: 'always_approve' },
+            { prefix: 'npm run', action: 'manual_approve' },
+            { prefix: 'rm ', action: 'always_deny' },
+        ],
+        defaultAction: 'always_deny',
+    }, null, 2) + '\n');
+    writeFileSync(proxyConfigPath, JSON.stringify({
+        proxies: [],
+    }, null, 2) + '\n');
+    console.log('Config files generated:');
+    console.log(`  ${luciferJsonPath}`);
+    console.log(`  ${apiKeysPath}`);
+    console.log(`  ${commandRulesPath}`);
+    console.log(`  ${proxyConfigPath}`);
+    console.log('');
+    console.log('Your API key (save this, it cannot be recovered):');
+    console.log(`  ${key}`);
+    console.log('');
+    console.log('Your admin secret for the web approval UI (save this, it cannot be recovered):');
+    console.log(`  ${adminSecret}`);
+    console.log('');
+    console.log('Quick start:');
+    console.log('  # Dev mode (no Telegram needed):');
+    console.log(`  LUCIFER_TELEGRAM_TOKEN=skip lucifer-gate --config ${luciferJsonPath} --auto-approve`);
+    console.log('');
+    console.log('  # Production — pair your Telegram chat first:');
+    console.log(`  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate pair --config ${luciferJsonPath}`);
+    console.log('');
+    console.log('  # Then start the server:');
+    console.log(`  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate --config ${luciferJsonPath}`);
+}
+//# sourceMappingURL=init_config.js.map

package/dist/server/cli/init_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init_config.js","sourceRoot":"","sources":["../../../server/src/cli/init_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAE7G,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAE7D,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,eAAe,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAE9F,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC;QAC5C,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,SAAS;QAC1B,eAAe,EAAE,SAAS;QAC1B,sBAAsB,EAAE,GAAG;QAC3B,uBAAuB,EAAE,GAAG;QAC5B,uBAAuB,EAAE,CAAC;QAC1B,cAAc,EAAE,QAAQ;QACxB,kBAAkB,EAAE,EAAE;QACtB,iBAAiB,EAAE,MAAM;QACzB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,aAAa;KACvB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpB,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QACxC,IAAI,EAAE,CAAC;gBACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,IAAI,EAAE,SAAS;gBACf,OAAO;gBACP,IAAI;gBACJ,UAAU,EAAE,EAAE;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,MAAM,EAAE,IAAI;aACb,CAAC;KACH,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpB,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7C,KAAK,EAAE;YACL,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAC7C,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAClD,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAChD,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAChD,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAChD,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE;SACzC;QACD,aAAa,EAAE,aAAa;KAC7B,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpB,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC;QAC5C,OAAO,EAAE,EAAE;KACZ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,uDAAuD,eAAe,iBAAiB,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,kEAAkE,eAAe,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,6DAA6D,eAAe,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/server/cli/print_help.js

@@ -0,0 +1,27 @@
+export function printHelp() {
+    console.log(`
+lucifer-gate - AI Agent Command Firewall
+
+Usage:
+  lucifer-gate start [options]        Start the server (explicit form)
+  lucifer-gate [options]              Start the server (implicit, same as 'start')
+  lucifer-gate --init [dir]           Generate starter config files
+  lucifer-gate pair [--config <path>] Pair a Telegram chat for approvals
+  lucifer-gate log [--limit N]        Query audit log
+  lucifer-gate stats                  Show approval statistics
+
+Server options:
+  --config <path>    Path to lucifer.json (default: ./config/lucifer.json)
+  --port <number>    Server port (default: 3001, or PORT env var)
+  --data-dir <path>  Directory for SQLite database (default: ./data)
+  --auto-approve     Auto-approve all commands (dev mode, no Telegram needed)
+  --help             Show this help
+
+Environment variables:
+  LUCIFER_TELEGRAM_TOKEN   Telegram bot token (required for production)
+  LUCIFER_TELEGRAM_CHAT_ID Telegram chat ID for approvals (or use 'pair' command)
+  PORT                     Server port (default: 3001)
+  LOG_LEVEL                Log level: debug, info, warn, error (default: debug / info in production)
+`);
+}
+//# sourceMappingURL=print_help.js.map

package/dist/server/cli/print_help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"print_help.js","sourceRoot":"","sources":["../../../server/src/cli/print_help.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;CAuBb,CAAC,CAAC;AACH,CAAC"}

package/dist/server/cli/run_log.js

@@ -0,0 +1,29 @@
+import { getDatabase } from '../domains/command-gateway/repository/database.js';
+import { createAuditLog } from '../domains/command-gateway/repository/audit_log.js';
+import { redactApiKeyName } from '../domains/command-gateway/service/redact_api_key_name.js';
+export async function runLog(limit, dataDir) {
+    const db = getDatabase(dataDir);
+    const auditLog = createAuditLog(db);
+    const entries = auditLog.query(limit);
+    if (entries.length === 0) {
+        console.log('No audit log entries found.');
+        return;
+    }
+    const reversed = [...entries].reverse();
+    for (const entry of reversed) {
+        const time = entry.ts.replace('T', ' ').replace(/\.\d+Z$/, 'Z');
+        const parts = [time, entry.type.toUpperCase().padEnd(16)];
+        if (entry.command)
+            parts.push(entry.command);
+        if (entry.apiKeyName)
+            parts.push(`key=${redactApiKeyName(entry.apiKeyName)}`);
+        if (entry.exitCode !== undefined && entry.exitCode !== null)
+            parts.push(`exit=${entry.exitCode}`);
+        if (entry.durationMs !== undefined && entry.durationMs !== null)
+            parts.push(`${entry.durationMs}ms`);
+        if (entry.error)
+            parts.push(`error: ${entry.error}`);
+        console.log(parts.join('  '));
+    }
+}
+//# sourceMappingURL=run_log.js.map

package/dist/server/cli/run_log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run_log.js","sourceRoot":"","sources":["../../../server/src/cli/run_log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mDAAmD,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAE7F,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,OAAe;IACzD,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QACrG,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/server/cli/run_pair.js

@@ -0,0 +1,61 @@
+import { resolve } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { runTelegramPairing } from '../domains/command-gateway/service/telegram_pairing.js';
+import { getTelegramToken } from '../domains/command-gateway/config/gateway_config.js';
+import { updateJsonConfig } from '../lib/json_config_writer.js';
+function createReadlinePairingIO() {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return {
+        print(msg) {
+            console.log(msg);
+        },
+        async choose(prompt, options) {
+            console.log(`\n${prompt}`);
+            for (let i = 0; i < options.length; i++) {
+                console.log(`  ${i + 1}. ${options[i]}`);
+            }
+            while (true) {
+                const answer = await rl.question(`\nEnter number (1-${options.length}): `);
+                const num = Number.parseInt(answer.trim(), 10);
+                if (num >= 1 && num <= options.length)
+                    return num - 1;
+                console.log(`Please enter a number between 1 and ${options.length}.`);
+            }
+        },
+        async confirm(prompt) {
+            const answer = await rl.question(`${prompt} [y/N] `);
+            return /^y(es)?$/i.test(answer.trim());
+        },
+        async prompt(msg) {
+            return rl.question(`${msg} `);
+        },
+        close() {
+            rl.close();
+        },
+    };
+}
+export async function runPair(configPath) {
+    const resolvedConfigPath = resolve(configPath);
+    let token;
+    try {
+        token = getTelegramToken();
+    }
+    catch {
+        console.error('LUCIFER_TELEGRAM_TOKEN environment variable is required for pairing.\n' +
+            'Create a bot via @BotFather on Telegram and set the token:\n\n' +
+            '  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate pair');
+        process.exit(1);
+    }
+    const io = createReadlinePairingIO();
+    try {
+        const result = await runTelegramPairing(token, io, { waitForChats: true });
+        updateJsonConfig(resolvedConfigPath, { telegramChatId: result.chatId });
+        console.log(`\nChat ID ${result.chatId} saved to ${resolvedConfigPath}`);
+        console.log('You can now start Lucifer without LUCIFER_TELEGRAM_CHAT_ID:');
+        console.log(`\n  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate start --config ${resolvedConfigPath}`);
+    }
+    finally {
+        io.close();
+    }
+}
+//# sourceMappingURL=run_pair.js.map

package/dist/server/cli/run_pair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run_pair.js","sourceRoot":"","sources":["../../../server/src/cli/run_pair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wDAAwD,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AACvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAGhE,SAAS,uBAAuB;IAC9B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7E,OAAO;QACL,KAAK,CAAC,GAAW;YACf,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAiB;YAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3C,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC/C,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAO,GAAG,GAAG,CAAC,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,uCAAuC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAc;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;YACrD,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,KAAK;YACH,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAkB;IAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,gBAAgB,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CACX,wEAAwE;YACxE,gEAAgE;YAChE,uDAAuD,CACxD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,GAAG,uBAAuB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,aAAa,kBAAkB,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,qEAAqE,kBAAkB,EAAE,CAAC,CAAC;IACzG,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/server/cli/run_server.js

@@ -0,0 +1,24 @@
+import { createApp } from '../create_app.js';
+import { logger } from '../lib/logger.js';
+export async function runServer(options) {
+    if (options.port) {
+        process.env.PORT = options.port;
+    }
+    const { app, config, start, stop } = createApp({
+        configPath: options.configPath,
+        autoApprove: options.autoApprove,
+    });
+    const server = app.listen(config.port, async () => {
+        logger.info({ port: config.port, autoApprove: options.autoApprove }, 'Lucifer listening');
+        await start();
+    });
+    const shutdown = async () => {
+        logger.info('Shutting down');
+        await stop();
+        server.close();
+        process.exit(0);
+    };
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+}
+//# sourceMappingURL=run_server.js.map

package/dist/server/cli/run_server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run_server.js","sourceRoot":"","sources":["../../../server/src/cli/run_server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAQ1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC1F,MAAM,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC"}

package/dist/server/cli/run_stats.js

@@ -0,0 +1,48 @@
+import { getDatabase } from '../domains/command-gateway/repository/database.js';
+import { createAuditLog } from '../domains/command-gateway/repository/audit_log.js';
+import { createApprovalStore } from '../domains/command-gateway/repository/approval_store.js';
+export async function runStats(dataDir) {
+    const db = getDatabase(dataDir);
+    const auditLog = createAuditLog(db);
+    const approvalStore = createApprovalStore(db);
+    const allEntries = auditLog.query(10000);
+    const requests = allEntries.filter(e => e.type === 'request');
+    const approvals = allEntries.filter(e => e.type === 'approved');
+    const denials = allEntries.filter(e => e.type === 'denied');
+    const executions = allEntries.filter(e => e.type === 'executed');
+    const activeApprovals = approvalStore.listAll(10000);
+    const expired = activeApprovals.filter(a => a.expiresAt && new Date(a.expiresAt) < new Date());
+    console.log('Lucifer Stats');
+    console.log('=============');
+    console.log(`Total requests:     ${requests.length}`);
+    console.log(`Approved:           ${approvals.length}`);
+    console.log(`Denied:             ${denials.length}`);
+    console.log(`Executed:           ${executions.length}`);
+    console.log(`Active approvals:   ${activeApprovals.length - expired.length}`);
+    console.log(`Expired approvals:  ${expired.length}`);
+    if (executions.length > 0) {
+        const durations = executions.filter(e => e.durationMs != null).map(e => e.durationMs);
+        if (durations.length > 0) {
+            const avg = Math.round(durations.reduce((a, b) => a + b, 0) / durations.length);
+            const max = Math.max(...durations);
+            console.log(`Avg exec time:      ${avg}ms`);
+            console.log(`Max exec time:      ${max}ms`);
+        }
+    }
+    // Top commands
+    const cmdCounts = new Map();
+    for (const r of requests) {
+        if (r.command) {
+            const cmd = r.command.split(/\s+/).slice(0, 2).join(' ');
+            cmdCounts.set(cmd, (cmdCounts.get(cmd) ?? 0) + 1);
+        }
+    }
+    const topCmds = [...cmdCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 10);
+    if (topCmds.length > 0) {
+        console.log('\nTop commands:');
+        for (const [cmd, count] of topCmds) {
+            console.log(`  ${count.toString().padStart(5)}  ${cmd}`);
+        }
+    }
+}
+//# sourceMappingURL=run_stats.js.map

package/dist/server/cli/run_stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run_stats.js","sourceRoot":"","sources":["../../../server/src/cli/run_stats.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mDAAmD,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yDAAyD,CAAC;AAE9F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAEjE,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAE/F,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,uBAAuB,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAW,CAAC,CAAC;QACvF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,eAAe;IACf,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/server/cli.js

@@ -1,253 +1,12 @@
 #!/usr/bin/env node
-import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
-import { resolve, join } from 'node:path';
-import { createInterface } from 'node:readline/promises';
-import { createApp } from './create_app.js';
-import { generateApiKey, generateAdminSecret } from './domains/command-gateway/repository/api_key_store.js';
-import { getDatabase } from './domains/command-gateway/repository/database.js';
-import { createAuditLog } from './domains/command-gateway/repository/audit_log.js';
-import { createApprovalStore } from './domains/command-gateway/repository/approval_store.js';
-import { runTelegramPairing } from './domains/command-gateway/service/telegram_pairing.js';
-import { redactApiKeyName } from './domains/command-gateway/service/redact_api_key_name.js';
-import { getTelegramToken } from './domains/command-gateway/config/gateway_config.js';
-import { updateJsonConfig } from './lib/json_config_writer.js';
-import { logger } from './lib/logger.js';
+import { getArgValue } from './cli/args.js';
+import { printHelp } from './cli/print_help.js';
+import { initConfig } from './cli/init_config.js';
+import { runLog } from './cli/run_log.js';
+import { runStats } from './cli/run_stats.js';
+import { runPair } from './cli/run_pair.js';
+import { runServer } from './cli/run_server.js';
 const args = process.argv.slice(2);
-function printHelp() {
-    console.log(`
-lucifer-gate - AI Agent Command Firewall
-
-Usage:
-  lucifer-gate start [options]        Start the server (explicit form)
-  lucifer-gate [options]              Start the server (implicit, same as 'start')
-  lucifer-gate --init [dir]           Generate starter config files
-  lucifer-gate pair [--config <path>] Pair a Telegram chat for approvals
-  lucifer-gate log [--limit N]        Query audit log
-  lucifer-gate stats                  Show approval statistics
-
-Server options:
-  --config <path>    Path to lucifer.json (default: ./config/lucifer.json)
-  --port <number>    Server port (default: 3001, or PORT env var)
-  --data-dir <path>  Directory for SQLite database (default: ./data)
-  --auto-approve     Auto-approve all commands (dev mode, no Telegram needed)
-  --help             Show this help
-
-Environment variables:
-  LUCIFER_TELEGRAM_TOKEN   Telegram bot token (required for production)
-  LUCIFER_TELEGRAM_CHAT_ID Telegram chat ID for approvals (or use 'pair' command)
-  PORT                     Server port (default: 3001)
-  LOG_LEVEL                Log level: debug, info, warn, error (default: debug / info in production)
-`);
-}
-function initConfig(targetDir) {
-    const configDir = resolve(targetDir, 'config');
-    const dataDir = resolve(targetDir, 'data');
-    mkdirSync(configDir, { recursive: true });
-    mkdirSync(dataDir, { recursive: true });
-    const luciferJsonPath = join(configDir, 'lucifer.json');
-    const apiKeysPath = join(configDir, 'api-keys.json');
-    const commandRulesPath = join(configDir, 'command-rules.json');
-    const proxyConfigPath = join(configDir, 'proxy-config.json');
-    if (existsSync(luciferJsonPath)) {
-        console.log(`Config already exists: ${luciferJsonPath}`);
-        console.log('Delete it first if you want to regenerate.');
-        return;
-    }
-    const { key, salt, keyHash } = generateApiKey();
-    const { secret: adminSecret, salt: adminSalt, secretHash: adminHash } = generateAdminSecret();
-    writeFileSync(luciferJsonPath, JSON.stringify({
-        port: 3001,
-        adminSecretHash: adminHash,
-        adminSecretSalt: adminSalt,
-        approvalTimeoutSeconds: 300,
-        executionTimeoutSeconds: 120,
-        maxConcurrentExecutions: 5,
-        maxOutputBytes: 10485760,
-        rateLimitPerMinute: 10,
-        onApprovalTimeout: 'deny',
-        dataDir: '../data',
-        logFile: 'lucifer.log',
-    }, null, 2) + '\n');
-    writeFileSync(apiKeysPath, JSON.stringify({
-        keys: [{
-                id: crypto.randomUUID(),
-                name: 'default',
-                keyHash,
-                salt,
-                allowedIps: [],
-                createdAt: new Date().toISOString(),
-                active: true,
-            }],
-    }, null, 2) + '\n');
-    writeFileSync(commandRulesPath, JSON.stringify({
-        rules: [
-            { prefix: 'echo ', action: 'always_approve' },
-            { prefix: 'git status', action: 'always_approve' },
-            { prefix: 'git pull', action: 'manual_approve' },
-            { prefix: 'git push', action: 'manual_approve' },
-            { prefix: 'npm test', action: 'always_approve' },
-            { prefix: 'npm run', action: 'manual_approve' },
-            { prefix: 'rm ', action: 'always_deny' },
-        ],
-        defaultAction: 'always_deny',
-    }, null, 2) + '\n');
-    writeFileSync(proxyConfigPath, JSON.stringify({
-        proxies: [],
-    }, null, 2) + '\n');
-    console.log('Config files generated:');
-    console.log(`  ${luciferJsonPath}`);
-    console.log(`  ${apiKeysPath}`);
-    console.log(`  ${commandRulesPath}`);
-    console.log(`  ${proxyConfigPath}`);
-    console.log('');
-    console.log('Your API key (save this, it cannot be recovered):');
-    console.log(`  ${key}`);
-    console.log('');
-    console.log('Your admin secret for the web approval UI (save this, it cannot be recovered):');
-    console.log(`  ${adminSecret}`);
-    console.log('');
-    console.log('Quick start:');
-    console.log('  # Dev mode (no Telegram needed):');
-    console.log(`  LUCIFER_TELEGRAM_TOKEN=skip lucifer-gate --config ${luciferJsonPath} --auto-approve`);
-    console.log('');
-    console.log('  # Production — pair your Telegram chat first:');
-    console.log(`  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate pair --config ${luciferJsonPath}`);
-    console.log('');
-    console.log('  # Then start the server:');
-    console.log(`  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate --config ${luciferJsonPath}`);
-}
-async function runLog(limit) {
-    const dataDir = getArgValue('--data-dir') ?? './data';
-    const db = getDatabase(dataDir);
-    const auditLog = createAuditLog(db);
-    const entries = auditLog.query(limit);
-    if (entries.length === 0) {
-        console.log('No audit log entries found.');
-        return;
-    }
-    const reversed = [...entries].reverse();
-    for (const entry of reversed) {
-        const time = entry.ts.replace('T', ' ').replace(/\.\d+Z$/, 'Z');
-        const parts = [time, entry.type.toUpperCase().padEnd(16)];
-        if (entry.command)
-            parts.push(entry.command);
-        if (entry.apiKeyName)
-            parts.push(`key=${redactApiKeyName(entry.apiKeyName)}`);
-        if (entry.exitCode !== undefined && entry.exitCode !== null)
-            parts.push(`exit=${entry.exitCode}`);
-        if (entry.durationMs !== undefined && entry.durationMs !== null)
-            parts.push(`${entry.durationMs}ms`);
-        if (entry.error)
-            parts.push(`error: ${entry.error}`);
-        console.log(parts.join('  '));
-    }
-}
-async function runStats() {
-    const dataDir = getArgValue('--data-dir') ?? './data';
-    const db = getDatabase(dataDir);
-    const auditLog = createAuditLog(db);
-    const approvalStore = createApprovalStore(db);
-    const allEntries = auditLog.query(10000);
-    const requests = allEntries.filter(e => e.type === 'request');
-    const approvals = allEntries.filter(e => e.type === 'approved');
-    const denials = allEntries.filter(e => e.type === 'denied');
-    const executions = allEntries.filter(e => e.type === 'executed');
-    const activeApprovals = approvalStore.listAll(10000);
-    const expired = activeApprovals.filter(a => a.expiresAt && new Date(a.expiresAt) < new Date());
-    console.log('Lucifer Stats');
-    console.log('=============');
-    console.log(`Total requests:     ${requests.length}`);
-    console.log(`Approved:           ${approvals.length}`);
-    console.log(`Denied:             ${denials.length}`);
-    console.log(`Executed:           ${executions.length}`);
-    console.log(`Active approvals:   ${activeApprovals.length - expired.length}`);
-    console.log(`Expired approvals:  ${expired.length}`);
-    if (executions.length > 0) {
-        const durations = executions.filter(e => e.durationMs != null).map(e => e.durationMs);
-        if (durations.length > 0) {
-            const avg = Math.round(durations.reduce((a, b) => a + b, 0) / durations.length);
-            const max = Math.max(...durations);
-            console.log(`Avg exec time:      ${avg}ms`);
-            console.log(`Max exec time:      ${max}ms`);
-        }
-    }
-    // Top commands
-    const cmdCounts = new Map();
-    for (const r of requests) {
-        if (r.command) {
-            const cmd = r.command.split(/\s+/).slice(0, 2).join(' ');
-            cmdCounts.set(cmd, (cmdCounts.get(cmd) ?? 0) + 1);
-        }
-    }
-    const topCmds = [...cmdCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 10);
-    if (topCmds.length > 0) {
-        console.log('\nTop commands:');
-        for (const [cmd, count] of topCmds) {
-            console.log(`  ${count.toString().padStart(5)}  ${cmd}`);
-        }
-    }
-}
-function createReadlinePairingIO() {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    return {
-        print(msg) {
-            console.log(msg);
-        },
-        async choose(prompt, options) {
-            console.log(`\n${prompt}`);
-            for (let i = 0; i < options.length; i++) {
-                console.log(`  ${i + 1}. ${options[i]}`);
-            }
-            while (true) {
-                const answer = await rl.question(`\nEnter number (1-${options.length}): `);
-                const num = Number.parseInt(answer.trim(), 10);
-                if (num >= 1 && num <= options.length)
-                    return num - 1;
-                console.log(`Please enter a number between 1 and ${options.length}.`);
-            }
-        },
-        async confirm(prompt) {
-            const answer = await rl.question(`${prompt} [y/N] `);
-            return /^y(es)?$/i.test(answer.trim());
-        },
-        async prompt(msg) {
-            return rl.question(`${msg} `);
-        },
-        close() {
-            rl.close();
-        },
-    };
-}
-async function runPair() {
-    const configPath = resolve(getArgValue('--config') ?? './config/lucifer.json');
-    let token;
-    try {
-        token = getTelegramToken();
-    }
-    catch {
-        console.error('LUCIFER_TELEGRAM_TOKEN environment variable is required for pairing.\n' +
-            'Create a bot via @BotFather on Telegram and set the token:\n\n' +
-            '  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate pair');
-        process.exit(1);
-    }
-    const io = createReadlinePairingIO();
-    try {
-        const result = await runTelegramPairing(token, io, { waitForChats: true });
-        updateJsonConfig(configPath, { telegramChatId: result.chatId });
-        console.log(`\nChat ID ${result.chatId} saved to ${configPath}`);
-        console.log('You can now start Lucifer without LUCIFER_TELEGRAM_CHAT_ID:');
-        console.log(`\n  LUCIFER_TELEGRAM_TOKEN=your_token lucifer-gate start --config ${configPath}`);
-    }
-    finally {
-        io.close();
-    }
-}
-function getArgValue(flag) {
-    const idx = args.indexOf(flag);
-    if (idx === -1 || idx >= args.length - 1)
-        return undefined;
-    return args[idx + 1];
-}
 async function main() {
     if (args.includes('--help') || args.includes('-h')) {
         printHelp();
@@ -259,16 +18,16 @@ async function main() {
         process.exit(0);
     }
     if (args[0] === 'pair') {
-        await runPair();
+        await runPair(getArgValue(args, '--config') ?? './config/lucifer.json');
         process.exit(0);
     }
     if (args[0] === 'log') {
-        const limitStr = getArgValue('--limit');
-        await runLog(limitStr ? parseInt(limitStr, 10) : 50);
+        const limitStr = getArgValue(args, '--limit');
+        await runLog(limitStr ? parseInt(limitStr, 10) : 50, getArgValue(args, '--data-dir') ?? './data');
         process.exit(0);
     }
     if (args[0] === 'stats') {
-        await runStats();
+        await runStats(getArgValue(args, '--data-dir') ?? './data');
         process.exit(0);
     }
     // Server mode — either `start` (explicit) or no subcommand (implicit).
@@ -280,28 +39,11 @@ async function main() {
         console.error(`Run 'lucifer-gate --help' for usage.`);
         process.exit(1);
     }
-    const configPath = getArgValue('--config') ?? './config/lucifer.json';
-    const port = getArgValue('--port');
-    const autoApprove = args.includes('--auto-approve');
-    if (port) {
-        process.env.PORT = port;
-    }
-    const { app, config, start, stop } = createApp({
-        configPath,
-        autoApprove,
+    await runServer({
+        configPath: getArgValue(args, '--config') ?? './config/lucifer.json',
+        port: getArgValue(args, '--port'),
+        autoApprove: args.includes('--auto-approve'),
     });
-    const server = app.listen(config.port, async () => {
-        logger.info({ port: config.port, autoApprove }, 'Lucifer listening');
-        await start();
-    });
-    const shutdown = async () => {
-        logger.info('Shutting down');
-        await stop();
-        server.close();
-        process.exit(0);
-    };
-    process.on('SIGTERM', shutdown);
-    process.on('SIGINT', shutdown);
 }
 try {
     await main();