prae-cli 0.2.1 → 0.4.0

package/lib/{cli-6hDu8-nF.js → cli-BvAYSK5w.js}

@@ -1,425 +1,13 @@
-import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-BU0sOciR.js";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { t as evaluate } from "./evaluate-BilZez15.js";
+import { p as seal, t as Ledger } from "./src-CAUNqZJ1.js";
+import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
+import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, extname, join, normalize, resolve, sep } from "node:path";
-import { createHash } from "node:crypto";
+import { extname, join, normalize, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
 import { createServer } from "node:http";
 
-//#region ../kernel/src/command.ts
-/** Wrappers whose first operand is the program actually being run. */
-const WRAPPERS = new Set([
-	"sudo",
-	"command",
-	"env",
-	"nohup",
-	"time",
-	"xargs"
-]);
-/** Wrapper options that consume the next token, so it is not the program. */
-const OPTION_WITH_VALUE = new Set([
-	"-u",
-	"-g",
-	"-p",
-	"-h",
-	"-C",
-	"-r",
-	"-t",
-	"-U",
-	"-I",
-	"-n",
-	"-P",
-	"-L",
-	"-s"
-]);
-const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
-/**
-* Split a line into pipeline segments of words, one scan, quote-aware.
-*
-* Splitting on `|` before parsing quotes is the classic mistake — it turns
-* `echo "a | b"` into two segments — so quoting and separators are read
-* together.
-*/
-function scan(command) {
-	const parts = [];
-	let tokens = [];
-	let current = "";
-	let quote;
-	const endToken = () => {
-		if (current !== "") tokens.push(current);
-		current = "";
-	};
-	const endSegment = () => {
-		endToken();
-		if (tokens.length > 0) parts.push(tokens);
-		tokens = [];
-	};
-	for (let at = 0; at < command.length; at += 1) {
-		const ch = command[at];
-		if (quote !== void 0) {
-			if (ch === quote) quote = void 0;
-			else current += ch;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			continue;
-		}
-		if (ch === ";") {
-			endSegment();
-			continue;
-		}
-		if (ch === "|" || ch === "&") {
-			endSegment();
-			if (command[at + 1] === ch) at += 1;
-			continue;
-		}
-		if (/\s/.test(ch)) {
-			endToken();
-			continue;
-		}
-		current += ch;
-	}
-	endSegment();
-	return parts;
-}
-/** Decompose a command line into pipeline segments. */
-function segments(command) {
-	const found = [];
-	for (const tokens of scan(command)) {
-		let at = 0;
-		while (at < tokens.length) {
-			const token = tokens[at];
-			if (ASSIGNMENT.test(token)) {
-				at += 1;
-				continue;
-			}
-			if (WRAPPERS.has(token)) {
-				at += 1;
-				while (at < tokens.length) {
-					const option = tokens[at];
-					if (!option.startsWith("-")) break;
-					at += OPTION_WITH_VALUE.has(option) ? 2 : 1;
-				}
-				continue;
-			}
-			break;
-		}
-		const name = tokens[at];
-		if (name === void 0) continue;
-		found.push({
-			name: (name.split("/").pop() ?? name).toLowerCase(),
-			tokens: tokens.slice(at + 1)
-		});
-	}
-	return found;
-}
-/** `git*` matches `git`, `github`; bare strings match exactly. */
-function matches$1(pattern, value) {
-	if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
-	return value === pattern;
-}
-const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
-/**
-* Judge one command line against one matcher. Every present field must hold.
-*/
-function commandMatches(match, command) {
-	const parts = segments(command);
-	if (parts.length === 0) return false;
-	const names = list(match.name);
-	const args = list(match.token);
-	const pipes = list(match.pipedTo);
-	if (names.length > 0) {
-		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name)));
-		if (hit.length === 0) return false;
-		if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-	} else if (args.length > 0) {
-		if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-	}
-	if (pipes.length > 0) {
-		if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
-	}
-	return true;
-}
-
-//#endregion
-//#region ../kernel/src/path.ts
-/**
-* Path normalization and glob containment, with no filesystem access.
-*
-* The contract, stated here because getting it wrong is how path policies
-* become theatre: **this module compares strings.** It resolves `.` and `..`
-* lexically so that `./src/../../etc/passwd` cannot pose as a workspace path,
-* but it cannot see a symlink. A link inside an allowed directory pointing out
-* of it will pass every check here.
-*
-* That is not a gap to paper over in the matcher — it is a gap the caller
-* closes by resolving before it asks. `dsh-overlay-check` learned this the
-* hard way during the plugin-store gate review: lexical containment accepted a
-* symlink escape cleanly, and the fix was to resolve both the path and its
-* nearest existing ancestor before deciding. Adapters that can touch the
-* filesystem must resolve first and pass the resolved path in.
-*/
-/** Split a path into segments, resolving `.` and `..` lexically. */
-function normalize$1(path) {
-	const absolute = path.startsWith("/");
-	const out = [];
-	let escaped = false;
-	for (const raw of path.split(/[/\\]+/)) {
-		if (raw === "" || raw === ".") continue;
-		if (raw === "..") {
-			if (out.length > 0) out.pop();
-			else escaped = true;
-			continue;
-		}
-		out.push(raw);
-	}
-	return {
-		segments: out,
-		absolute,
-		escaped
-	};
-}
-/** Turn one glob segment into an anchored regular expression. */
-function segmentPattern(segment) {
-	const body = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
-	return /* @__PURE__ */ new RegExp(`^${body}$`);
-}
-/**
-* Wildcard segment matching, where `**` spans zero or more segments.
-*
-* Two-pointer with backtracking rather than a recursive walk: the pattern
-* comes from a policy pack and the path from a tool call, and a catastrophic
-* backtrack in the hot path of every call would be a denial of service handed
-* to whoever writes the pack.
-*/
-function matchSegments(path, pattern) {
-	let i = 0;
-	let j = 0;
-	let starPattern = -1;
-	let starPath = 0;
-	while (i < path.length) {
-		const segment = j < pattern.length ? pattern[j] : void 0;
-		const here = path[i];
-		if (segment === "**") {
-			starPattern = j;
-			starPath = i;
-			j += 1;
-			continue;
-		}
-		if (segment !== void 0 && here !== void 0 && segmentPattern(segment).test(here)) {
-			i += 1;
-			j += 1;
-			continue;
-		}
-		if (starPattern >= 0) {
-			starPath += 1;
-			i = starPath;
-			j = starPattern + 1;
-			continue;
-		}
-		return false;
-	}
-	while (j < pattern.length && pattern[j] === "**") j += 1;
-	return j === pattern.length;
-}
-/**
-* Is `path` contained by `glob`?
-*
-* A glob naming a directory contains everything under it: `./src` and
-* `./src/**` both match `src/app/main.ts`. Writing the shorter form is the
-* common intent, and treating it as "this exact directory entry only" is a
-* trap that silently grants the whole subtree past the rule.
-*/
-function within(path, glob) {
-	const target = normalize$1(path);
-	if (target.escaped) return false;
-	const trimmed = glob.trim();
-	if (!(trimmed === "**" || trimmed.startsWith("**/")) && target.absolute !== trimmed.startsWith("/")) return false;
-	const pattern = normalize$1(glob);
-	if (matchSegments(target.segments, pattern.segments)) return true;
-	return matchSegments(target.segments, [...pattern.segments, "**"]);
-}
-/** Is `path` inside any of these globs? */
-function withinAny(path, globs) {
-	return globs.some((glob) => within(path, glob));
-}
-/**
-* The host of a URL, or undefined when it is not a URL we can read.
-*
-* Unparseable input returns undefined, and callers treat that as "no host" —
-* which for a `notIn` rule means the rule matches. Failing toward the rule is
-* the only safe direction: a string we cannot parse is exactly the shape an
-* evasion attempt takes.
-*/
-function hostOf(url) {
-	try {
-		return new URL(url).hostname.toLowerCase();
-	} catch {
-		return;
-	}
-}
-/**
-* Host list membership, where a leading dot means "this domain or below".
-*
-* `example.com` matches only that host. `.example.com` also matches
-* `api.example.com`, and deliberately still matches `example.com` itself —
-* an operator writing the suffix form means the organisation, not a rule that
-* covers every subdomain except the one they first thought of.
-*/
-function hostIn(host, list$1) {
-	return list$1.some((entry) => {
-		const want = entry.toLowerCase();
-		if (want.startsWith(".")) return host === want.slice(1) || host.endsWith(want);
-		return host === want;
-	});
-}
-
-//#endregion
-//#region ../kernel/src/rule.ts
-/**
-* Strength ordering, used when several rules match one call.
-*
-* Higher wins. This is the property that makes a pack safe to extend: adding a
-* rule can raise the strength of a decision and never lower it, so an operator
-* appending to a pack can never accidentally widen what an agent may do.
-*/
-const STRENGTH = {
-	warn: 1,
-	correct: 2,
-	ask: 3,
-	deny: 4
-};
-
-//#endregion
-//#region ../kernel/src/evaluate.ts
-function listed(value, want) {
-	if (want === void 0) return true;
-	if (value === void 0) return false;
-	return typeof want === "string" ? value === want : want.includes(value);
-}
-function argMatches(match, args) {
-	const has = Object.hasOwn(args, match.name);
-	if (match.present !== void 0 && match.present !== has) return false;
-	if (!has) return match.above === void 0 && match.below === void 0 && match.equals === void 0 && match.oneOf === void 0;
-	const value = args[match.name];
-	if (match.above !== void 0) {
-		if (typeof value !== "number" || !(value > match.above)) return false;
-	}
-	if (match.below !== void 0) {
-		if (typeof value !== "number" || !(value < match.below)) return false;
-	}
-	if (match.equals !== void 0 && value !== match.equals) return false;
-	if (match.oneOf !== void 0) {
-		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return false;
-		if (!match.oneOf.includes(value)) return false;
-	}
-	return true;
-}
-function matches(when, facts) {
-	if (!listed(facts.tool, when.tool)) return false;
-	if (!listed(facts.capability, when.capability)) return false;
-	if (!listed(facts.plugin, when.plugin)) return false;
-	if (!listed(facts.agent, when.agent)) return false;
-	if (when.command !== void 0) {
-		const raw = facts.args.command ?? facts.args.cmd ?? facts.args.script;
-		if (typeof raw !== "string") return false;
-		if (!commandMatches(when.command, raw)) return false;
-	}
-	if (when.path !== void 0) {
-		const raw = facts.args[when.path.arg ?? "path"];
-		if (typeof raw !== "string") return false;
-		if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
-		if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;
-	}
-	if (when.host !== void 0) {
-		const raw = facts.args[when.host.arg ?? "url"];
-		if (typeof raw !== "string") return false;
-		const host = hostOf(raw);
-		if (host === void 0) return when.host.notIn !== void 0;
-		if (when.host.in !== void 0 && !hostIn(host, when.host.in)) return false;
-		if (when.host.notIn !== void 0 && hostIn(host, when.host.notIn)) return false;
-	}
-	if (when.arg !== void 0) {
-		for (const one of when.arg) if (!argMatches(one, facts.args)) return false;
-	}
-	if (when.count !== void 0) {
-		const key = facts.capability;
-		if (key === void 0) return false;
-		if (!((facts.counts?.[key] ?? 0) > when.count.above)) return false;
-	}
-	return true;
-}
-function step(rule, effect) {
-	return {
-		rule: rule.id,
-		...rule.title === void 0 ? {} : { title: rule.title },
-		effect: effect.kind,
-		because: effect.because
-	};
-}
-/**
-* Decide one call against one pack.
-*
-* Every matching rule lands in the trace; the strongest effect decides. Ties
-* go to the first rule in pack order, so a pack reads top-down the way its
-* author wrote it.
-*
-* `correct` is the effect the rest of this ecosystem does not have. A rival
-* guardrail can allow a call or refuse it; a rule here can also rewrite an
-* argument and let it through, recording what it changed. Refusing is not
-* always the safe option — an agent denied mid-task retries, and the retry is
-* rarely safer than the clamp would have been.
-*/
-function evaluate(pack, facts) {
-	const hits = [];
-	for (const rule of pack.rules) if (matches(rule.when, facts)) hits.push({
-		rule,
-		effect: rule.effect
-	});
-	if (hits.length === 0) return {
-		kind: "allow",
-		trace: [],
-		evaluated: pack.rules.length
-	};
-	hits.sort((a, b) => STRENGTH[b.effect.kind] - STRENGTH[a.effect.kind]);
-	const trace = hits.map((hit) => step(hit.rule, hit.effect));
-	const evaluated = pack.rules.length;
-	const strongest = hits[0];
-	if (strongest === void 0) return {
-		kind: "allow",
-		trace: [],
-		evaluated
-	};
-	const winner = strongest.effect.kind;
-	if (winner === "deny" || winner === "ask") return {
-		kind: winner,
-		rule: strongest.rule.id,
-		reason: strongest.effect.because,
-		trace,
-		evaluated
-	};
-	if (winner === "correct") {
-		const args = { ...facts.args };
-		for (const hit of hits) if (hit.effect.kind === "correct") Object.assign(args, hit.effect.set);
-		return {
-			kind: "correct",
-			rule: strongest.rule.id,
-			reason: strongest.effect.because,
-			args,
-			trace,
-			evaluated
-		};
-	}
-	return {
-		kind: "allow",
-		trace,
-		evaluated
-	};
-}
-
-//#endregion
 //#region ../kernel/src/pack.ts
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -545,12 +133,12 @@ function readHostMatch(check$1, path, value) {
 		if (arg !== void 0) out.arg = arg;
 	}
 	if (value.in !== void 0) {
-		const list$1 = check$1.globs(`${path}.in`, value.in);
-		if (list$1 !== void 0) out.in = list$1;
+		const list = check$1.globs(`${path}.in`, value.in);
+		if (list !== void 0) out.in = list;
 	}
 	if (value.notIn !== void 0) {
-		const list$1 = check$1.globs(`${path}.notIn`, value.notIn);
-		if (list$1 !== void 0) out.notIn = list$1;
+		const list = check$1.globs(`${path}.notIn`, value.notIn);
+		if (list !== void 0) out.notIn = list;
 	}
 	return out;
 }
@@ -585,6 +173,33 @@ function readArgMatch(check$1, path, value) {
 	else out.present = value.present;
 	return out;
 }
+function readSecretsMatch(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	check$1.keys(path, value, [
+		"types",
+		"minConfidence",
+		"atLeast"
+	]);
+	const out = {};
+	if (value.types !== void 0) {
+		const types = check$1.globs(`${path}.types`, value.types);
+		if (types !== void 0) out.types = types;
+	}
+	if (value.minConfidence !== void 0) {
+		const n = check$1.number(`${path}.minConfidence`, value.minConfidence);
+		if (n !== void 0) if (n < 0 || n > 1) check$1.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
+		else out.minConfidence = n;
+	}
+	if (value.atLeast !== void 0) {
+		const n = check$1.number(`${path}.atLeast`, value.atLeast);
+		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check$1.fail(`${path}.atLeast`, "expected an integer of at least 1");
+		else out.atLeast = n;
+	}
+	return out;
+}
 function readMatch(check$1, path, value) {
 	if (!isObject(value)) {
 		check$1.fail(path, "expected an object");
@@ -599,7 +214,8 @@ function readMatch(check$1, path, value) {
 		"path",
 		"host",
 		"arg",
-		"count"
+		"count",
+		"secrets"
 	]);
 	const out = {};
 	for (const key of [
@@ -625,12 +241,12 @@ function readMatch(check$1, path, value) {
 	}
 	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check$1.fail(`${path}.arg`, "expected an array of argument matchers");
 	else {
-		const list$1 = [];
+		const list = [];
 		value.arg.forEach((entry, index) => {
 			const one = readArgMatch(check$1, `${path}.arg[${index}]`, entry);
-			if (one !== void 0) list$1.push(one);
+			if (one !== void 0) list.push(one);
 		});
-		out.arg = list$1;
+		out.arg = list;
 	}
 	if (value.count !== void 0) if (!isObject(value.count)) check$1.fail(`${path}.count`, "expected an object");
 	else {
@@ -638,6 +254,10 @@ function readMatch(check$1, path, value) {
 		const above = check$1.number(`${path}.count.above`, value.count.above);
 		if (above !== void 0) out.count = { above };
 	}
+	if (value.secrets !== void 0) {
+		const match = readSecretsMatch(check$1, `${path}.secrets`, value.secrets);
+		if (match !== void 0) out.secrets = match;
+	}
 	return out;
 }
 function readEffect(check$1, path, value) {
@@ -774,165 +394,6 @@ function parsePack(source) {
 	};
 }
 
-//#endregion
-//#region ../ledger/src/entry.ts
-/** The hash a chain starts from. */
-const GENESIS = "0".repeat(64);
-/**
-* Deterministic serialization: object keys sorted at every depth.
-*
-* A hash over `JSON.stringify(entry)` would depend on key insertion order,
-* which means a re-serialized entry could hash differently while saying
-* exactly the same thing — and a verifier that reports tampering on a
-* faithful copy trains its operators to ignore it.
-*/
-function canonical(value) {
-	if (value === null || typeof value !== "object") return JSON.stringify(value);
-	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-}
-/** Hash one entry's content together with its position and predecessor. */
-function hashEntry(record, seq, prev) {
-	return createHash("sha256").update(canonical({
-		...record,
-		seq,
-		prev
-	})).digest("hex");
-}
-/** Chain a record onto a predecessor. */
-function chain(record, seq, prev) {
-	return {
-		...record,
-		seq,
-		prev,
-		hash: hashEntry(record, seq, prev)
-	};
-}
-/** The short form an auditor quotes from a screenshot. */
-function seal(entry) {
-	return `${entry.hash.slice(0, 4)}…${entry.hash.slice(-4)}`;
-}
-
-//#endregion
-//#region ../ledger/src/ledger.ts
-/**
-* Read a ledger held as text.
-*
-* Split out from the class because a ledger is not always a file being
-* appended to: a build step renders one it imported, and a reader pastes one
-* in. Those callers need the same parsing and the same verification the CLI
-* runs, and a second implementation of either is how two answers to "does this
-* chain hold" come to exist.
-*/
-function readEntries(text) {
-	return text.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
-}
-/** Re-derive every hash and confirm each entry names its predecessor. */
-function verifyEntries(text) {
-	const problems = [];
-	let expectedPrev = GENESIS;
-	let expectedSeq = 0;
-	let count = 0;
-	const lines = text.split("\n").filter((line) => line.trim() !== "");
-	for (const [index, line] of lines.entries()) {
-		const at = index + 1;
-		count += 1;
-		let entry;
-		try {
-			entry = JSON.parse(line);
-		} catch {
-			problems.push({
-				line: at,
-				message: "not valid JSON"
-			});
-			return {
-				ok: false,
-				entries: count,
-				problems
-			};
-		}
-		if (entry.seq !== expectedSeq) problems.push({
-			line: at,
-			message: `expected seq ${expectedSeq}, found ${entry.seq}`
-		});
-		if (entry.prev !== expectedPrev) problems.push({
-			line: at,
-			message: "does not name the previous entry; a row was removed or reordered"
-		});
-		const { seq, prev, hash,...record } = entry;
-		if (hashEntry(record, seq, prev) !== hash) problems.push({
-			line: at,
-			message: "contents do not match the sealed hash"
-		});
-		expectedPrev = entry.hash;
-		expectedSeq = entry.seq + 1;
-	}
-	return {
-		ok: problems.length === 0,
-		entries: count,
-		problems
-	};
-}
-var Ledger = class Ledger {
-	path;
-	seq;
-	last;
-	constructor(path, seq, last) {
-		this.path = path;
-		this.seq = seq;
-		this.last = last;
-	}
-	/**
-	* Open a ledger, reading the tail to continue an existing chain.
-	*
-	* A corrupt or truncated final line is a hard error rather than something to
-	* skip past: appending onto a chain whose end we could not read would bury
-	* the damage under valid-looking entries.
-	*/
-	static open(path) {
-		mkdirSync(dirname(path), { recursive: true });
-		let text = "";
-		try {
-			text = readFileSync(path, "utf8");
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-			writeFileSync(path, "", { flag: "wx" });
-			return new Ledger(path, 0, GENESIS);
-		}
-		const tail = text.split("\n").filter((line) => line.trim() !== "").at(-1);
-		if (tail === void 0) return new Ledger(path, 0, GENESIS);
-		let entry;
-		try {
-			entry = JSON.parse(tail);
-		} catch {
-			throw new Error(`prae ledger: last line of ${path} is not readable; refusing to append onto a chain that cannot be continued`);
-		}
-		return new Ledger(path, entry.seq + 1, entry.hash);
-	}
-	/** Append one decision and return the entry as written. */
-	append(record) {
-		const entry = chain(record, this.seq, this.last);
-		appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
-		this.seq += 1;
-		this.last = entry.hash;
-		return entry;
-	}
-	/** Every entry, in order. */
-	read() {
-		return readEntries(readFileSync(this.path, "utf8"));
-	}
-	/**
-	* Re-derive every hash and confirm each entry names its predecessor.
-	*
-	* Catches a deleted row, an edited field, and a reordering. Does not catch a
-	* wholesale rewrite of the file by someone holding the same code — see the
-	* note in `entry.ts`.
-	*/
-	verify() {
-		return verifyEntries(readFileSync(this.path, "utf8"));
-	}
-};
-
 //#endregion
 //#region src/console/ledger.ts
 function ago(iso, now) {
@@ -1381,8 +842,27 @@ const USAGE = `prae — operator policy for agent harnesses
   prae explain <pack.json> <tool> [key=value ...]
       Judge one call against the pack and print the trace. Nothing is executed.
 
-  prae verify <ledger.jsonl>
-      Re-derive every hash in a decision log and report any break.
+  prae scan <file> [--pack <pack.json>] [--json]
+      Inspect a file for credentials the way the gate would before a read.
+      Findings name the type and the line, never the secret. With --pack,
+      also print the verdict the pack would reach.
+
+  prae mcp --root <dir> [--pack <pack.json>] [--ledger <file>]
+      Serve gated filesystem access over MCP stdio. Any MCP-capable agent or
+      IDE mounts this as its file tool; every read is inspected before its
+      contents are returned, and every decision lands in the ledger.
+      (no --pack mounts the bundled secret-catcher pack)
+
+  prae verify <ledger.jsonl> [--key <public.pem>]
+      Re-derive every hash in a decision log and report any break. With
+      --key, also verify each row's signature against that pinned key.
+
+  prae keygen [--out <dir>]
+      Generate an Ed25519 keypair for signing ledger rows. Prints the
+      fingerprint a counterparty pins.
+
+  prae receipt <ledger.jsonl> <seq> --key <private.pem> [--out <file>]
+      Export one decision as a self-contained signed receipt.
 
   prae report <ledger.jsonl> [--out <file.html>]
       Render the decision record as a printable evidence report.
@@ -1437,6 +917,70 @@ async function check(path) {
 		console.log(`  ${rule.id.padEnd(10)} ${rule.effect.kind.toUpperCase().padEnd(8)} ${label}`);
 	}
 }
+/**
+* `prae scan`: the gate's pre-read inspection, runnable by hand.
+*
+* This is the command a pilot runs first — point it at a file that holds a
+* credential and watch the gate see it without repeating it. Output carries
+* type, rule, line and confidence; the matched text is structurally absent
+* from the findings, so there is nothing here to be careful about printing.
+*/
+async function scanFile(path, packPath, json) {
+	const { scan } = await import("./src-Vnr0fcpK.js");
+	let content;
+	try {
+		content = await readFile(path, "utf8");
+	} catch {
+		return fail(`cannot read ${path}`);
+	}
+	const findings = scan(content);
+	if (json) console.log(JSON.stringify({
+		file: path,
+		findings
+	}, null, 2));
+	else if (findings.length === 0) console.log(`${path} — no credentials detected`);
+	else {
+		console.log(`${path} — ${findings.length} finding(s)\n`);
+		for (const f of findings) {
+			const score = `${Math.round(f.confidence * 100)}%`;
+			console.log(`  line ${String(f.line).padEnd(5)} ${f.type.padEnd(18)} ${f.rule.padEnd(22)} ${score}`);
+		}
+	}
+	if (packPath !== void 0) {
+		const pack = await loadPack(packPath);
+		const decision = evaluate(pack, {
+			tool: "read",
+			capability: "fs:read",
+			args: { path },
+			secrets: findings
+		});
+		const label = VERDICT_LABEL[decision.kind];
+		console.log(`\n${pack.pack} ${pack.version} would say: ${label}${decision.rule === void 0 ? "" : ` (${decision.rule})`}`);
+	}
+}
+/**
+* `prae mcp`: mount the gate as a filesystem MCP server on stdio.
+*
+* With no --pack, the bundled secret-catcher mounts — same day-zero logic as
+* `init`'s baseline: a gate whose whole point is content inspection should
+* not come up inspecting nothing.
+*/
+async function mcp(root, packPath, ledgerPath) {
+	const { serveMcp } = await import("./mcp-BH5I4Eyu.js");
+	const { resolve: resolve$1 } = await import("node:path");
+	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
+	const chosen = packPath ?? bundled;
+	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
+	const pack = await loadPack(chosen);
+	const { Ledger: Ledger$1 } = await import("./src-CBK_quVO.js");
+	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
+	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
+	await serveMcp({
+		pack,
+		root: resolve$1(root),
+		...ledger === void 0 ? {} : { ledger }
+	});
+}
 /** `key=value` pairs, with numbers and booleans read as themselves. */
 function parseArgs(pairs) {
 	const args = {};
@@ -1467,12 +1011,57 @@ async function explain(path, tool, pairs) {
 	if (decision.trace.length === 0) console.log("\n        no rule matched this call");
 	else {
 		console.log("");
-		for (const step$1 of decision.trace) console.log(`        ${step$1.rule.padEnd(10)} ${step$1.effect.padEnd(8)} ${step$1.because}`);
+		for (const step of decision.trace) console.log(`        ${step.rule.padEnd(10)} ${step.effect.padEnd(8)} ${step.because}`);
 	}
 	console.log(`\n${pack.pack} ${pack.version} · ${decision.evaluated} rules considered`);
 	if (capability === void 0) console.log(`\nnote: no capability claims \`${tool}\`, so capability rules did not apply`);
 }
-async function verify(path) {
+/**
+* Keys for signing rows.
+*
+* Written 0600 and never printed. What is printed is the fingerprint — the
+* thing a counterparty pins out-of-band, because a signature checked against
+* a key that arrived beside it is checked against nothing.
+*/
+async function keygen(dir) {
+	const { generateKeypair, fingerprint } = await import("./src-CBK_quVO.js");
+	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
+	const keys = generateKeypair();
+	const priv = join(dir, "prae-signing.pem");
+	const pub = join(dir, "prae-signing.pub.pem");
+	writeFileSync$1(priv, keys.privateKey, { mode: 384 });
+	writeFileSync$1(pub, keys.publicKey);
+	console.log(`private     ${priv}  (0600 — this signs; guard it)`);
+	console.log(`public      ${pub}`);
+	console.log(`fingerprint ${fingerprint(keys.publicKey)}`);
+	console.log("");
+	console.log("Give the PUBLIC key and fingerprint to whoever will verify");
+	console.log("receipts, through a channel they trust. Point the plugin at the");
+	console.log("private key with `signingKey` to sign every row.");
+}
+async function receipt(path, seq, keyPath, out) {
+	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-CBK_quVO.js");
+	const { readFileSync: readFileSync$1 } = await import("node:fs");
+	const { createPublicKey } = await import("node:crypto");
+	const privateKey = readFileSync$1(keyPath, "utf8");
+	const publicKey = createPublicKey(privateKey).export({
+		type: "spki",
+		format: "pem"
+	}).toString();
+	const entry = Ledger$1.open(path).read().find((row$1) => row$1.seq === seq);
+	if (entry === void 0) return fail(`no row with seq ${seq} in ${path}`);
+	const packaged = makeReceipt(entry, privateKey, publicKey);
+	const text = `${JSON.stringify(packaged, null, 2)}\n`;
+	if (out === void 0) console.log(text);
+	else {
+		await writeFile(out, text);
+		console.log(`${out} · seq ${seq} · ${entry.verdict} ${entry.tool} ${entry.subject ?? ""}`);
+	}
+	console.log(`fingerprint ${fingerprint(publicKey)}`);
+	console.log("The verifier compares that fingerprint against the one they");
+	console.log("pinned — a receipt is only as good as the key they trust.");
+}
+async function verify(path, keyPath) {
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1481,8 +1070,26 @@ async function verify(path) {
 	}
 	const result = ledger.verify();
 	if (result.ok) {
-		const last = ledger.read().at(-1);
+		const entries = ledger.read();
+		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
+		if (keyPath !== void 0) {
+			const { verifySignature, fingerprint } = await import("./src-CBK_quVO.js");
+			const { readFileSync: readFileSync$1 } = await import("node:fs");
+			const publicKey = readFileSync$1(keyPath, "utf8");
+			let signed = 0;
+			const bad = [];
+			for (const entry of entries) {
+				if (entry.sig === void 0) continue;
+				signed += 1;
+				if (!verifySignature(entry, entry.sig, publicKey)) bad.push(entry.seq);
+			}
+			if (bad.length > 0) {
+				console.error(`signatures: ${bad.length} of ${signed} FAIL against ${fingerprint(publicKey)} — rows ${bad.join(", ")}`);
+				process.exitCode = 1;
+			} else if (signed === 0) console.log("signatures: none present — this ledger is not signed");
+			else console.log(`signatures: ${signed}/${entries.length} rows verify against ${fingerprint(publicKey)}`);
+		}
 		console.log("tamper-evident: a removed, edited, or reordered row breaks this chain.");
 		console.log("It does not prove against a rewrite of the whole file by someone holding this code.");
 		return;
@@ -1543,7 +1150,7 @@ async function report(path, out) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-BrZXeEez.js");
+	const { ingest } = await import("./src-CCeafjdm.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -1579,7 +1186,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-BrZXeEez.js"), import("./src-Dd2_8m2g.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-CCeafjdm.js"), import("./src-aU5WW02C.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -1639,9 +1246,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-BrZXeEez.js"),
-			import("./src-Dd2_8m2g.js"),
-			import("./instructions-ijuj4IP1.js")
+			import("./src-CCeafjdm.js"),
+			import("./src-aU5WW02C.js"),
+			import("./instructions-D4VOn2lk.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1740,10 +1347,27 @@ async function main(argv) {
 			if (path === void 0 || tool === void 0) fail("explain needs a pack file and a tool name");
 			return explain(path, tool, pairs);
 		}
+		case "scan": {
+			const path = rest[0];
+			if (path === void 0) fail("scan needs a file");
+			return scanFile(path, flag(rest, "pack"), rest.includes("--json"));
+		}
+		case "mcp": {
+			const root = flag(rest, "root");
+			if (root === void 0) fail("mcp needs --root <dir>; serving without a boundary is not a gate");
+			return mcp(root, flag(rest, "pack"), flag(rest, "ledger"));
+		}
+		case "keygen": return keygen(flag(rest, "out") ?? ".");
+		case "receipt": {
+			const [path, seq] = rest;
+			const key = flag(rest, "key");
+			if (path === void 0 || seq === void 0 || key === void 0) fail("receipt needs <ledger.jsonl> <seq> --key <private.pem>");
+			return receipt(path, Number(seq), key, flag(rest, "out"));
+		}
 		case "verify": {
 			const path = rest[0];
 			if (path === void 0) fail("verify needs a ledger file");
-			return verify(path);
+			return verify(path, flag(rest, "key"));
 		}
 		case "report": {
 			const path = rest[0];