wezard 0.3.3 → 1.0.0

package/.claude-plugin/marketplace.json

@@ -1,11 +1,11 @@
 {
-  "name": "weclaude-local",
+  "name": "wezard-local",
   "version": "0.0.1",
-  "description": "Local marketplace shim — exposes weclaude plugin from this repo.",
+  "description": "Local marketplace shim — exposes wezard plugin from this repo.",
   "owner": { "name": "zyy" },
   "plugins": [
     {
-      "name": "weclaude",
+      "name": "wezard",
       "source": "./",
       "description": "Remote-control Claude Code from WeCom (/wrc).",
       "category": "productivity"

package/.claude-plugin/plugin.json

@@ -1,12 +1,12 @@
 {
-  "name": "weclaude",
-  "version": "0.2.7",
+  "name": "wezard",
+  "version": "1.0.0",
   "description": "Remote-control Claude Code from WeCom (/wrc) via WebSocket smart bot. Cards for tool approval, skills for doc r/w.",
   "author": {
     "name": "zyy"
   },
   "mcpServers": {
-    "weclaude": {
+    "wezard": {
       "command": "node",
       "args": ["${CLAUDE_PLUGIN_ROOT}/dist/mcp/server.js"]
     }

package/CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this project is
 
-`weclaude` (CLI `weclaude`) bridges Claude Code and WeCom (企业微信) smart bots:
+`wezard` (CLI `wezard`) bridges Claude Code and WeCom (企业微信) smart bots:
 - **PreToolUse approval forwarding**: every tool call is gated by a button card pushed to WeCom; clicking ✅/❌/⏱ resolves the long-poll the hook is parked on.
 - **Remote `/wrc`**: messages sent to the bot drive a local Claude (headless `claude -p` or mirroring an interactive session).
 - **MCP server** (`wecom`): exposes `send_markdown` / `send_card` / `ask_user` / `daemon_status` tools that talk to the resident daemon over loopback HTTP.
@@ -15,23 +15,23 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 npm run build        # tsc → dist/, then chmod +x on the three bin entry scripts
 npm run typecheck    # tsc --noEmit
 npm run dev:daemon   # tsx daemon/index.ts  (no install / hot iteration)
-npm run dev:cli      # tsx cli/weclaude.ts
+npm run dev:cli      # tsx cli/wezard.ts
 ```
 
 There are **no tests**. Don't fabricate test commands.
 
 Local dev loop:
 ```bash
-npm run build && ./cli/weclaude.sh reload    # rebuild, then bounce the resident daemon
-./cli/weclaude.sh logs -f                    # tail ~/.weclaude/daemon.log
-./cli/weclaude.sh status                     # HTTP /status — wsConnected, pending count, sourcePath
+npm run build && ./cli/wezard.sh reload    # rebuild, then bounce the resident daemon
+./cli/wezard.sh logs -f                    # tail ~/.wezard/daemon.log
+./cli/wezard.sh status                     # HTTP /status — wsConnected, pending count, sourcePath
 ```
 
-When the user says **"reload"** in this repo, it means exactly: `npm run build && ./cli/weclaude.sh reload`. The global `weclaude` binary may not be on `$PATH` in dev shells — always invoke `./cli/weclaude.sh` from the repo root.
+When the user says **"reload"** in this repo, it means exactly: `npm run build && ./cli/wezard.sh reload`. The global `wezard` binary may not be on `$PATH` in dev shells — always invoke `./cli/wezard.sh` from the repo root.
 
 ## High-level architecture
 
-Three processes, all coordinating via 127.0.0.1:17890 and `~/.weclaude/`:
+Three processes, all coordinating via 127.0.0.1:17890 and `~/.wezard/`:
 
 ```
  WeCom  ── WS ──►  daemon (resident, launchd/systemd --user)
@@ -46,31 +46,31 @@ Three processes, all coordinating via 127.0.0.1:17890 and `~/.weclaude/`:
 - `ws.ts` owns the `@wecom/aibot-node-sdk` `WSClient`. Fatal auth/reconnect → `process.exit(1)` (launchd respawns).
 - `approval.ts` builds the button card, parks an HTTP request via `pending.ts`, and resolves it on `event.template_card_event`. Three click outcomes: `allow` / `allow_window` (auto-allow N min for that session) / `deny`. `session-cache.ts` short-circuits repeats.
 - `inbound.ts` routes `message.text` / `message.image` / `message.mixed` → either headless `cc-bridge.ts` or `mirror-bridge.ts`. Gates on `allowFrom`; one-shot exception is the bootstrap claim (see below).
-- `cc-bridge.ts` (mode=headless) spawns `claude -p --output-format stream-json --verbose`, parses `assistant`/`stream_event` lines, and pumps text via `client.replyStream`. Per-principal queue serializes turns; session id is captured from the `system/init` line and persisted to `~/.weclaude/sessions.json` for `--resume`.
+- `cc-bridge.ts` (mode=headless) spawns `claude -p --output-format stream-json --verbose`, parses `assistant`/`stream_event` lines, and pumps text via `client.replyStream`. Per-principal queue serializes turns; session id is captured from the `system/init` line and persisted to `~/.wezard/sessions.json` for `--resume`.
 - `mirror-bridge.ts` (mode=mirror) tails `<projectsDir>/<encoded(cwd)>/<sid>.jsonl` and pushes new `assistant` content to a chat. Inbound injection is either `claude --resume <sid> -p` (writes a turn into the same jsonl) or `tmux paste-buffer` against a live TTY (only path that makes WeCom messages visible in the user's CLI window). `recentInjects` ring buffer suppresses the WeCom→CLI echo when tailing.
 - `claim.ts` is a single-shot bootstrap: an exact-match magic phrase from any sender bypasses `allowFrom`, writes that principal as `defaultChat`, and appends to `allowFrom`. This is the **only** legitimate ingress for first-time setup.
 - `peers.ts` is the read side of multi-agent awareness: sibling sessions of one chat are exactly the target keys sharing a base principal (`baseOfKey`), i.e. the untagged default plus every `#tag`. Pure parsing only — bounded transcript-tail reads (`tailTurns` / `lastAssistantText` / `summarizeTail`, shared with `session-scan.ts`) and pane classification (`paneIsBusy`). **Busy detection matches the TUI spinner footer** (`… (12m 31s · …)` on current versions, `esc to interrupt` on older ones) in the last 8 non-blank rows — transcript mtime is useless here, it goes quiet during long tool calls.
 - `graph.ts` is the loop-graph runner: `nodes` = tagged sessions (own cli/model/cwd), `steps` = an ordered pipeline walked `rounds` times, each step injecting a prompt, waiting for that agent to go idle, then feeding its reply forward as `{{last}}` / `{{<tag>}}`. Stops early on the `until` sentinel. All effects go through injected deps backed by `mirror-bridge`, so a step is exactly what a human typing `#tag …` would do. Runs are **in-memory only** — a reload cancels them (panes survive).
 
 **Configuration** (`shared/config.ts`):
-- Loaded by every binary via `loadConfig()`. Resolution order: explicit arg → `$WECLAUDE_CONFIG` → `~/.weclaude/config.jsonc` → `~/.weclaude/config.json`.
-- Secrets (`bot.botId`, `bot.secret`) live in `~/.weclaude/secrets.json` and are deep-merged on top of the main config — keeps secrets out of dotfile repos.
+- Loaded by every binary via `loadConfig()`. Resolution order: explicit arg → `$WEZARD_CONFIG` → `~/.wezard/config.jsonc` → `~/.wezard/config.json`.
+- Secrets (`bot.botId`, `bot.secret`) live in `~/.wezard/secrets.json` and are deep-merged on top of the main config — keeps secrets out of dotfile repos.
 - Schema is zod (`ConfigSchema`); shape mismatches throw with a path-pointed error.
 - `shared/config-writer.ts` is the only sanctioned way to mutate the on-disk jsonc — it preserves comments via `jsonc-parser` edits. `cli/init.ts` and `daemon/claim.ts` use it.
 
 **Hook + sync**:
 - `hooks/hooks.json` is registered automatically by Claude Code when the plugin is installed (uses `${CLAUDE_PLUGIN_ROOT:-${CODEBUDDY_PLUGIN_ROOT}}` so the same file works under CodeBuddy's plugin loader if ever published there).
-- For non-plugin installs (`claude-internal` wrapper), `cli/sync.ts` writes the MCP server entry + `WECLAUDE_DAEMON_BASE` env into target `settings.json`s listed in `config.sync.targets`. **It deliberately strips legacy hook entries** for `kind:"claude"` targets — registering both the plugin's `hooks.json` AND a settings.json hook fires the hook twice per tool call (= duplicate cards). For `kind:"codebuddy"` targets, since the weclaude plugin is not published to CodeBuddy's marketplace, sync **writes the hook directly into `~/.codebuddy/settings.json`** with an absolute path to `hooks/pre-tool-use.sh` — this is the only registration path for CodeBuddy. `~/.weclaude/sync.lock.json` tracks what was written so `--remove` is reversible.
+- For non-plugin installs (`claude-internal` wrapper), `cli/sync.ts` writes the MCP server entry + `WEZARD_DAEMON_BASE` env into target `settings.json`s listed in `config.sync.targets`. **It deliberately strips legacy hook entries** for `kind:"claude"` targets — registering both the plugin's `hooks.json` AND a settings.json hook fires the hook twice per tool call (= duplicate cards). For `kind:"codebuddy"` targets, since the wezard plugin is not published to CodeBuddy's marketplace, sync **writes the hook directly into `~/.codebuddy/settings.json`** with an absolute path to `hooks/pre-tool-use.sh` — this is the only registration path for CodeBuddy. `~/.wezard/sync.lock.json` tracks what was written so `--remove` is reversible.
 
 **MCP server** (`mcp/server.ts`): stdio transport, completely stateless w.r.t. WeCom. Every tool just `POST`s to the daemon. Add a tool here AND a route handler in `daemon/`. The peer tools (`list_peers` / `peek_peer` / `send_peer` / `wait_peer` / `run_agent_graph` / `graph_status` / `stop_graph`) all send `selfRef()` = `{sessionId, tmuxPane}` so the daemon can resolve *which* session is asking — env sessionId goes stale after a `/clear`, pane id doesn't. Their descriptions are the whole discovery mechanism for agent↔agent collaboration: an agent only realizes it can drive `#fix` because `send_peer` says so.
 
 ## Important patterns / pitfalls
 
 - **PATH for spawn**: `cc-bridge.ts` and `mirror-bridge.ts` both `augmentedPath()` because launchd/systemd start the daemon with a stripped PATH that often lacks nvm/homebrew. If you spawn anything new from the daemon, do the same or it will ENOENT in production but work fine under `npm run dev:daemon`.
-- **launchd respawn**: `KeepAlive.SuccessfulExit=false`. `weclaude reload` does `POST /shutdown` AND `launchctl kickstart`; just hitting `/shutdown` won't bounce the binary.
-- **Uninstall order**: `weclaude uninstall` *before* `npm uninstall -g weclaude`. Otherwise launchd repeatedly tries to relaunch a deleted binary. State at `~/.weclaude/` is intentionally preserved.
+- **launchd respawn**: `KeepAlive.SuccessfulExit=false`. `wezard reload` does `POST /shutdown` AND `launchctl kickstart`; just hitting `/shutdown` won't bounce the binary.
+- **Uninstall order**: `wezard uninstall` *before* `npm uninstall -g wezard`. Otherwise launchd repeatedly tries to relaunch a deleted binary. State at `~/.wezard/` is intentionally preserved.
 - **Card update has a 5s window**: `client.updateTemplateCard` only works within 5s of the click event — `installApprovalEventListener` does the rewrite synchronously inside the event handler.
-- **Mirror mode** runs against either `~/.claude-internal/projects/` or `~/.claude/projects/` — `cli/weclaude.sh mirror` probes both bases for the encoded cwd.
+- **Mirror mode** runs against either `~/.claude-internal/projects/` or `~/.claude/projects/` — `cli/wezard.sh mirror` probes both bases for the encoded cwd.
 - **Long-poll timeouts**: hook curl `--max-time` (`approval.hookTimeoutSec`, default 43210) must be **strictly larger** than `approval.longPollSec` (default 43200 = 12h), or the hook returns `ask` while the daemon is still waiting on a click.
 - **Sensitive arg redaction** (`daemon/redact.ts`) runs before card render when `approval.sensitiveArgRedact=true`. Only the redacted form is shown in WeCom and stored in pending meta.
 

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 weclaude contributors
+Copyright (c) 2026 wezard contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,4 +1,4 @@
-# weclaude
+# wezard
 
 **把 Claude Code 装进企业微信。** 在地铁上、被窝里、开会摸鱼时，照样能跟你电脑上的 Claude 干活。
 
@@ -12,7 +12,7 @@
 - 📡 **MCP 主动推送** — Claude 通过 `wecom__send_markdown` / `wecom__send_card` / `wecom__ask_user` 主动汇报或问询。
 - 📄 **文档读写** — Claude 通过 `wecom_doc_list_tools` / `wecom_doc_call` 直接调企业微信智能机器人的 doc / smartsheet / smartpage MCP，新建在线文档、写 Markdown、读链接、操作智能表格——全程在内网，不需要 corp access_token。
 - 🗂 **多会话发现/切换** — Claude 通过 `list_claude_sessions` / `switch_claude_session` / `new_claude_session` 列出本机 tmux 内所有在跑的 Claude 会话（带摘要 + 稳定动物 emoji 标签）、把 IM 镜像切到其中任一个、或在指定路径新开一个会话。审批卡标题也带同一枚 emoji，多个会话兜底到同一 IM 时一眼区分。
-- 🔄 **重启即续** — 电脑重启 / tmux 全没了 / daemon 崩了都不掉档：IM ↔ 会话绑定持久化在 `~/.weclaude/mirror-attachments.json`，下一条 IM 消息自动 `claude --resume` 拉起新 tmux pane，历史完整继承；`tmux attach -t weclaude` 接管即可。
+- 🔄 **重启即续** — 电脑重启 / tmux 全没了 / daemon 崩了都不掉档：IM ↔ 会话绑定持久化在 `~/.wezard/mirror-attachments.json`，下一条 IM 消息自动 `claude --resume` 拉起新 tmux pane，历史完整继承；`tmux attach -t wezard` 接管即可。
 
 ---
 
@@ -21,18 +21,18 @@
 **前置**：macOS / Linux、Node ≥ 20、PATH 里能找到 `claude` 或 `claude-internal`、企业微信「智能机器人」的 `botId` + `secret`。镜像模式额外需要 `tmux`。
 
 ```bash
-npm install -g weclaude
-weclaude init
+npm install -g wezard
+wezard init
 ```
 
-`init` 会交互式问你 4 个问题，把配置落到 `~/.weclaude/`：
+`init` 会交互式问你 4 个问题，把配置落到 `~/.wezard/`：
 
 | 问什么 | 落到哪 |
 | --- | --- |
-| botId / secret | `~/.weclaude/secrets.json` |
-| 用哪个 Claude（`claude` / `claude-internal` / 自定义路径） | `~/.weclaude/config.jsonc` |
-| 用哪种模式（`headless` / `mirror`，见下文） | `~/.weclaude/config.jsonc` |
-| 是否开启 PreToolUse 远程审批 | `~/.weclaude/config.jsonc` |
+| botId / secret | `~/.wezard/secrets.json` |
+| 用哪个 Claude（`claude` / `claude-internal` / 自定义路径） | `~/.wezard/config.jsonc` |
+| 用哪种模式（`headless` / `mirror`，见下文） | `~/.wezard/config.jsonc` |
+| 是否开启 PreToolUse 远程审批 | `~/.wezard/config.jsonc` |
 
 然后自动：编译 → 注入 hook/MCP → 装常驻 daemon（macOS launchd / Linux systemd --user）→ 等 WebSocket 鉴权。
 
@@ -49,28 +49,28 @@ weclaude init
 **从某个 fork / 分支装（自带改动的版本）**：`dist/` 不入库，但 `prepare` 脚本会在 git 安装时自动编译，所以可以直接：
 
 ```bash
-npm i -g github:<你的用户名>/weclaude          # 默认分支
-npm i -g github:<你的用户名>/weclaude#<分支名>   # 指定分支
+npm i -g github:<你的用户名>/wezard          # 默认分支
+npm i -g github:<你的用户名>/wezard#<分支名>   # 指定分支
 ```
 
-**内网 / 需要正向代理**：weclaude 的出站（WeCom WebSocket、智能机器人文档 MCP）会读环境变量里的代理。安装与运行都带上 `HTTPS_PROXY`：
+**内网 / 需要正向代理**：wezard 的出站（WeCom WebSocket、智能机器人文档 MCP）会读环境变量里的代理。安装与运行都带上 `HTTPS_PROXY`：
 
 ```bash
-HTTPS_PROXY=http://your-proxy:port npm i -g github:<你的用户名>/weclaude
+HTTPS_PROXY=http://your-proxy:port npm i -g github:<你的用户名>/wezard
 # 也可在 config.jsonc 写死: bot.proxy = "http://your-proxy:port"（优先级高于环境变量）
 ```
 
 daemon 进程同样需要能读到代理变量（见下方守护脚本里 `export HTTPS_PROXY`）。
 
-**无 systemd 的环境（容器等）**：`init` 装 daemon 这步在 macOS 走 launchd、Linux 走 `systemd --user`。若机器没有 systemd user session（很多容器：PID 1 非 systemd、无 `XDG_RUNTIME_DIR`），这步会失败——其余配置（hook / MCP / 插件）已生效，只差 daemon 没被托管。用一个简单的重启循环守护即可，存成 `~/.weclaude/daemonctl.sh`：
+**无 systemd 的环境（容器等）**：`init` 装 daemon 这步在 macOS 走 launchd、Linux 走 `systemd --user`。若机器没有 systemd user session（很多容器：PID 1 非 systemd、无 `XDG_RUNTIME_DIR`），这步会失败——其余配置（hook / MCP / 插件）已生效，只差 daemon 没被托管。用一个简单的重启循环守护即可，存成 `~/.wezard/daemonctl.sh`：
 
 ```bash
 #!/usr/bin/env bash
-# 无 systemd 时的 weclaude daemon 守护：setsid 脱离终端的重启循环。
+# 无 systemd 时的 wezard daemon 守护：setsid 脱离终端的重启循环。
 set -uo pipefail
-REPO="$(npm root -g)/weclaude"
+REPO="$(npm root -g)/wezard"
 NODE="$(command -v node)"
-WC="$HOME/.weclaude"; PIDFILE="$WC/supervisor.pid"; LOG="$WC/daemon.log"
+WC="$HOME/.wezard"; PIDFILE="$WC/supervisor.pid"; LOG="$WC/daemon.log"
 mkdir -p "$WC"
 # 内网：daemon 出站要走代理。按需改成你的代理地址，或删掉这两行。
 export HTTPS_PROXY="${HTTPS_PROXY:-http://your-proxy:port}"; export https_proxy="$HTTPS_PROXY"
@@ -92,12 +92,12 @@ esac
 ```
 
 ```bash
-chmod +x ~/.weclaude/daemonctl.sh
-~/.weclaude/daemonctl.sh start    # 起 daemon（自带崩溃重启）
-~/.weclaude/daemonctl.sh status   # 看状态
+chmod +x ~/.wezard/daemonctl.sh
+~/.wezard/daemonctl.sh start    # 起 daemon（自带崩溃重启）
+~/.wezard/daemonctl.sh status   # 看状态
 ```
 
-容器重启不会自动拉起 daemon——把 `~/.weclaude/daemonctl.sh start` 加进 shell profile 或容器入口即可（幂等，已在跑就 no-op）。
+容器重启不会自动拉起 daemon——把 `~/.wezard/daemonctl.sh start` 加进 shell profile 或容器入口即可（幂等，已在跑就 no-op）。
 
 ---
 
@@ -111,9 +111,9 @@ chmod +x ~/.weclaude/daemonctl.sh
 | **流式输出** | 转发 assistant 文本块 | 完整流式：打字机、tool_use、思考过程都看得到 |
 | **适合谁** | 简单单轮问答 / CI 类自动化 | 真·远程结对编程 |
 
-镜像模式下，IM 里发 `/new` 直接开新 tmux 窗口 + 新 Claude 会话；`/clear` 清当前上下文；带图消息自动注入剪贴板。所有 IM 聊天共享一个 tmux session（默认名 `weclaude`），每个聊天一个独立 window，**关 tmux / daemon 崩了 / 整机重启都能自愈**：IM↔会话绑定 write-through 落到 `~/.weclaude/mirror-attachments.json`，daemon 起来就 eager restore；重启后 pane 全死，下一条 IM 消息触发 `claude --resume <sid>` 拉起新 pane，`--resume` fork 出的新 jsonl 由 watcher 从 EOF 无缝接管（不会把整段历史再推一遍到 IM）。中途在别处 `/clear` 把 jsonl rotate 掉也不丢绑定，会自愈到同项目目录下最新的 jsonl。
+镜像模式下，IM 里发 `/new` 直接开新 tmux 窗口 + 新 Claude 会话；`/clear` 清当前上下文；带图消息自动注入剪贴板。所有 IM 聊天共享一个 tmux session（默认名 `wezard`），每个聊天一个独立 window，**关 tmux / daemon 崩了 / 整机重启都能自愈**：IM↔会话绑定 write-through 落到 `~/.wezard/mirror-attachments.json`，daemon 起来就 eager restore；重启后 pane 全死，下一条 IM 消息触发 `claude --resume <sid>` 拉起新 pane，`--resume` fork 出的新 jsonl 由 watcher 从 EOF 无缝接管（不会把整段历史再推一遍到 IM）。中途在别处 `/clear` 把 jsonl rotate 掉也不丢绑定，会自愈到同项目目录下最新的 jsonl。
 
-> 💡 **mirror 不要求你必须先在 CLI 里开 tmux**：在企业微信里直接发 `/new` 就能从零起一个新 tmux 窗口 + Claude 会话；甚至首次发任意消息都会自动 spawn + 绑定（首条消息既是绑定信号也是第一句 prompt）。回家打开终端 `tmux attach -t weclaude` 接管即可。
+> 💡 **mirror 不要求你必须先在 CLI 里开 tmux**：在企业微信里直接发 `/new` 就能从零起一个新 tmux 窗口 + Claude 会话；甚至首次发任意消息都会自动 spawn + 绑定（首条消息既是绑定信号也是第一句 prompt）。回家打开终端 `tmux attach -t wezard` 接管即可。
 
 ---
 
@@ -145,7 +145,7 @@ chmod +x ~/.weclaude/daemonctl.sh
 
 ## 文档 / 智能表格 / 智能文档
 
-`weclaude` 把企业微信智能机器人的远端 MCP（doc / smartsheet / contact 等）桥接到本地 Claude，**不走 corp access_token**：daemon 直接复用 botId+secret 的 WS 长连，通过 `aibot_get_mcp_config` 命令拉到每个 category 的 Streamable HTTP MCP URL，再以 JSON-RPC 调 `tools/list` / `tools/call`，`x-openclaw-wecom-userid` header 透传文档归属人。
+`wezard` 把企业微信智能机器人的远端 MCP（doc / smartsheet / contact 等）桥接到本地 Claude，**不走 corp access_token**：daemon 直接复用 botId+secret 的 WS 长连，通过 `aibot_get_mcp_config` 命令拉到每个 category 的 Streamable HTTP MCP URL，再以 JSON-RPC 调 `tools/list` / `tools/call`，`x-openclaw-wecom-userid` header 透传文档归属人。
 
 **前置一次性授权**：在企业微信「工作台 - 智能机器人 - 你的机器人 - 可使用权限」里勾选「文档」「智能表格」对应能力。第一次调用如果未授权，远端会返回结构化错误（errcode 851013）+ 授权链接，原样转给 Claude，照着点同意即可。
 
@@ -186,7 +186,7 @@ curl -sS -X POST http://127.0.0.1:17890/wedoc/invalidate -H 'content-type: appli
 
 ## 事件订阅 / 定时广播
 
-一个轻量 pub/sub：任意群或单聊都能订阅一个 **topic**（自定义事件名），任何授权用户都能广播；daemon 内置分钟级调度器，每天定点自动推送。订阅关系与定时任务持久化到 `~/.weclaude/config.jsonc` 的 `topics` 段，`weclaude reload` 后自动恢复。
+一个轻量 pub/sub：任意群或单聊都能订阅一个 **topic**（自定义事件名），任何授权用户都能广播；daemon 内置分钟级调度器，每天定点自动推送。订阅关系与定时任务持久化到 `~/.wezard/config.jsonc` 的 `topics` 段，`wezard reload` 后自动恢复。
 
 **IM 命令**（在已授权的会话里说，中英文均可）：
 
@@ -222,7 +222,7 @@ sequenceDiagram
     autonumber
     participant CC as Claude Code
     participant Hook as PreToolUse hook
-    participant D as weclaude daemon
+    participant D as wezard daemon
     participant WS as WeCom WS
     participant U as 你 (IM)
 
@@ -246,7 +246,7 @@ sequenceDiagram
     autonumber
     participant U as 你 (IM)
     participant WS as WeCom WS
-    participant D as weclaude daemon
+    participant D as wezard daemon
     participant T as tmux + claude
     participant J as session.jsonl
 
@@ -361,37 +361,37 @@ IM 里发 `/help` 可随时拉出完整命令表；每次 `/new`、`/clear` 之
 本机 shell：
 
 ```bash
-weclaude status              # 看 daemon + WS 健康
-weclaude logs -f             # 实时日志
-weclaude send <chat> <text>  # 主动推消息
-weclaude reload              # 重启 daemon（改了配置后用）
-weclaude unsync              # 卸载 hook/MCP（保留 daemon）
-weclaude uninstall           # 完整卸载（先于 npm uninstall）
+wezard status              # 看 daemon + WS 健康
+wezard logs -f             # 实时日志
+wezard send <chat> <text>  # 主动推消息
+wezard reload              # 重启 daemon（改了配置后用）
+wezard unsync              # 卸载 hook/MCP（保留 daemon）
+wezard uninstall           # 完整卸载（先于 npm uninstall）
 ```
 
-> ⚠️ **卸载顺序**：先 `weclaude uninstall` 再 `npm uninstall -g weclaude`。否则 launchd/systemd 会一直尝试拉起已删除的二进制。`~/.weclaude/` 下的 config/secrets 不会被清，二次安装可无缝复用。
+> ⚠️ **卸载顺序**：先 `wezard uninstall` 再 `npm uninstall -g wezard`。否则 launchd/systemd 会一直尝试拉起已删除的二进制。`~/.wezard/` 下的 config/secrets 不会被清，二次安装可无缝复用。
 
 ---
 
 ## 常见问题
 
 **Q: hook 不触发？**
-`cat ~/.claude/settings.json | jq .hooks.PreToolUse`，没东西就跑 `weclaude sync` 重写。
+`cat ~/.claude/settings.json | jq .hooks.PreToolUse`，没东西就跑 `wezard sync` 重写。
 
 **Q: 卡片点了没反应？**
 企业微信卡片就地刷新只有 5 秒窗口，超时不刷新是正常的，决策本身仍然生效。
 
 **Q: daemon 起不来？**
-`weclaude logs -f` 看；常见是 `botId` / `secret` 写错卡在 WebSocket 鉴权。
+`wezard logs -f` 看；常见是 `botId` / `secret` 写错卡在 WebSocket 鉴权。
 
 **Q: 多机部署？**
-`config.jsonc` 可以纳入 dotfiles；`secrets.json` 每台机器独立填。第二台机器跑 `weclaude init` 会跳过覆盖提示，但仍要重新走 claim 步骤拿本机 IM principal。
+`config.jsonc` 可以纳入 dotfiles；`secrets.json` 每台机器独立填。第二台机器跑 `wezard init` 会跳过覆盖提示，但仍要重新走 claim 步骤拿本机 IM principal。
 
 ---
 
 ## 架构一瞥
 
-三个进程走 `127.0.0.1:17890` + `~/.weclaude/`：
+三个进程走 `127.0.0.1:17890` + `~/.wezard/`：
 
 ```
  WeCom ── WebSocket ──► daemon (常驻, launchd/systemd)

package/cli/{weclaude.sh → wezard.sh}

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# weclaude CLI — talks to local weclaude daemon over HTTP and toggles launchd/systemd.
+# wezard CLI — talks to local wezard daemon over HTTP and toggles launchd/systemd.
 set -uo pipefail
 
-DAEMON_BASE="${WECLAUDE_DAEMON_BASE:-http://127.0.0.1:17890}"
-LABEL="com.weclaude.daemon"
+DAEMON_BASE="${WEZARD_DAEMON_BASE:-http://127.0.0.1:17890}"
+LABEL="com.wezard.daemon"
 HOME_DIR="$HOME"
 OS="$(uname -s)"
 
 # Resolve symlinks so REPO_ROOT points at the real package dir even when this
-# script is invoked via the npm-installed bin symlink (e.g. ~/.npm-global/bin/weclaude).
+# script is invoked via the npm-installed bin symlink (e.g. ~/.npm-global/bin/wezard).
 # macOS ships BSD readlink without -f, so chase the chain by hand.
 self="${BASH_SOURCE[0]}"
 while [[ -L "$self" ]]; do
@@ -24,8 +24,10 @@ shift || true
 
 usage() {
   cat <<'EOF'
-weclaude <subcommand>
+wezard <subcommand>
   init                 interactive onboarding (write config, install daemon, claim default chat, run demo)
+  migrate              upgrade an existing weclaude install (state + daemon + plugin + settings.json)
+                       flags: --dry-run --force --purge -y
   status               daemon health + connection state
   start                load resident daemon (launchd/systemd)
   stop                 unload resident daemon
@@ -42,8 +44,8 @@ weclaude <subcommand>
   unsync                 remove our entries from sync.targets settings.json
   audit [tag]            token/cost breakdown for current Claude session (main + subagents)
   uninstall              full teardown: stop daemon + unsync + plugin uninstall + remove daemon (run before `npm uninstall -g`)
-                         add `--purge` to also delete ~/.weclaude state
-  version                print weclaude version
+                         add `--purge` to also delete ~/.wezard state
+  version                print wezard version
   help
 EOF
 }
@@ -51,37 +53,40 @@ EOF
 http_get() { curl -sS --max-time 5 "$DAEMON_BASE$1"; }
 http_post() { curl -sS --max-time 5 -X POST -H 'content-type: application/json' -d "${2:-{\}}" "$DAEMON_BASE$1"; }
 
+# Run a dist/ entry script, building first when we're sitting in a dev checkout.
+# npm installs ship dist/ in the tarball, so a missing script there means a
+# broken install — fail loudly instead of invoking tsc against no tsconfig.
+exec_node() {
+  local rel="$1"; shift
+  local script="$REPO_ROOT/$rel"
+  if [[ ! -f "$script" ]]; then
+    if [[ -f "$REPO_ROOT/tsconfig.json" ]]; then
+      echo "[wezard] building..."
+      (cd "$REPO_ROOT" && npm install --silent && npx tsc -p tsconfig.json) || { echo "build failed"; exit 1; }
+    else
+      echo "[wezard] missing $script — try 'npm install -g wezard' to reinstall" >&2
+      exit 1
+    fi
+  fi
+  exec "$(command -v node)" "$script" "$@"
+}
+
 svc_load() {
   case "$OS" in
     Darwin) launchctl load -w "$HOME_DIR/Library/LaunchAgents/${LABEL}.plist" ;;
-    Linux)  systemctl --user start weclaude.service ;;
+    Linux)  systemctl --user start wezard.service ;;
   esac
 }
 svc_unload() {
   case "$OS" in
     Darwin) launchctl unload "$HOME_DIR/Library/LaunchAgents/${LABEL}.plist" ;;
-    Linux)  systemctl --user stop weclaude.service ;;
+    Linux)  systemctl --user stop wezard.service ;;
   esac
 }
 
 case "$cmd" in
-  init)
-    NODE_BIN="$(command -v node)"
-    SCRIPT="$REPO_ROOT/dist/cli/init.js"
-    if [[ ! -f "$SCRIPT" ]]; then
-      # Dev repo: tsconfig.json present → build. npm install: tarball ships dist/,
-      # so a missing init.js means a broken install — fail clearly instead of
-      # invoking tsc against a non-existent tsconfig.
-      if [[ -f "$REPO_ROOT/tsconfig.json" ]]; then
-        echo "[weclaude init] building..."
-        (cd "$REPO_ROOT" && npm install --silent && npx tsc -p tsconfig.json) || { echo "build failed"; exit 1; }
-      else
-        echo "[weclaude init] missing $SCRIPT — try 'npm install -g weclaude' to reinstall" >&2
-        exit 1
-      fi
-    fi
-    exec "$NODE_BIN" "$SCRIPT" "$@"
-    ;;
+  init)    exec_node dist/cli/init.js "$@" ;;
+  migrate) exec_node dist/cli/migrate.js "$@" ;;
   status)
     if ! out=$(http_get /status 2>/dev/null); then
       echo "daemon: down ($DAEMON_BASE)"
@@ -97,14 +102,14 @@ case "$cmd" in
     http_post /shutdown >/dev/null 2>&1 || true
     case "$OS" in
       Darwin) launchctl kickstart -k "gui/$(id -u)/${LABEL}" >/dev/null && echo "daemon: reloaded" ;;
-      Linux)  systemctl --user restart weclaude.service && echo "daemon: reloaded" ;;
+      Linux)  systemctl --user restart wezard.service && echo "daemon: reloaded" ;;
     esac
     ;;
   send)
     chat="${1:-}"; shift || true
     text="${*:-}"
     if [[ -z "$chat" || -z "$text" ]]; then
-      echo "usage: weclaude send <chat> <text>"; exit 1
+      echo "usage: wezard send <chat> <text>"; exit 1
     fi
     body=$(jq -nc --arg c "$chat" --arg t "$text" '{chat:$c,text:$t}')
     http_post /message "$body"
@@ -118,14 +123,14 @@ case "$cmd" in
     ;;
   logs)
     log_path=$(http_get /status 2>/dev/null | jq -r '.logFile // empty' 2>/dev/null || true)
-    log_path="${log_path:-$HOME_DIR/.weclaude/daemon.log}"
+    log_path="${log_path:-$HOME_DIR/.wezard/daemon.log}"
     if [[ "${1:-}" == "-f" ]]; then tail -f "$log_path"; else tail -n 100 "$log_path"; fi
     ;;
   config-path) http_get /status | jq -r '.sourcePath // empty' ;;
   uninstall)
     # Order matters: stop the daemon FIRST so it can't rewrite settings/lock
     # files mid-teardown; then strip MCP/env from agent settings; then remove
-    # the plist/unit + Claude plugin registration. State at ~/.weclaude is
+    # the plist/unit + Claude plugin registration. State at ~/.wezard is
     # preserved unless `--purge` is given.
     purge=0
     [[ "${1:-}" == "--purge" ]] && purge=1
@@ -134,14 +139,14 @@ case "$cmd" in
     SYNC_SCRIPT="$REPO_ROOT/dist/cli/sync.js"
     [[ -f "$SYNC_SCRIPT" ]] && "$NODE_BIN" "$SYNC_SCRIPT" --remove || true
     bash "$REPO_ROOT/scripts/uninstall.sh"
-    rm -f "$HOME_DIR/.weclaude/sync.lock.json"
+    rm -f "$HOME_DIR/.wezard/sync.lock.json"
     if (( purge )); then
-      rm -rf "$HOME_DIR/.weclaude"
-      echo "[weclaude] state purged (~/.weclaude removed)"
+      rm -rf "$HOME_DIR/.wezard"
+      echo "[wezard] state purged (~/.wezard removed)"
     else
-      echo "[weclaude] cleaned. state kept at ~/.weclaude — remove with 'weclaude uninstall --purge' or 'rm -rf ~/.weclaude'"
+      echo "[wezard] cleaned. state kept at ~/.wezard — remove with 'wezard uninstall --purge' or 'rm -rf ~/.wezard'"
     fi
-    echo "[weclaude] safe to 'npm uninstall -g weclaude' now"
+    echo "[wezard] safe to 'npm uninstall -g wezard' now"
     ;;
   mirror)
     cwd="${CLAUDE_PROJECT_DIR:-${CODEBUDDY_PROJECT_DIR:-$(pwd)}}"

package/commands/audit.md

@@ -1,7 +1,7 @@
 ---
 description: 统计当前会话（含子会话）的 token 用量与成本，不跨 /clear
-allowed-tools: Bash(${CLAUDE_PLUGIN_ROOT}/cli/weclaude.sh:*)
+allowed-tools: Bash(${CLAUDE_PLUGIN_ROOT}/cli/wezard.sh:*)
 argument-hint: [tag]
 ---
 
-!`${CLAUDE_PLUGIN_ROOT}/cli/weclaude.sh audit $ARGUMENTS`
+!`${CLAUDE_PLUGIN_ROOT}/cli/wezard.sh audit $ARGUMENTS`

package/commands/wrc.md

@@ -1,7 +1,7 @@
 ---
 description: WeCom remote control — mirror current Claude session to WeCom
-allowed-tools: Bash(${CLAUDE_PLUGIN_ROOT}/cli/weclaude.sh:*)
+allowed-tools: Bash(${CLAUDE_PLUGIN_ROOT}/cli/wezard.sh:*)
 argument-hint: [user:<userid>|chat:<chatid>]
 ---
 
-!`${CLAUDE_PLUGIN_ROOT}/cli/weclaude.sh mirror $ARGUMENTS`
+!`${CLAUDE_PLUGIN_ROOT}/cli/wezard.sh mirror $ARGUMENTS`

package/config.example.jsonc

@@ -1,5 +1,5 @@
-// Declarative config for weclaude. Copy to ~/.weclaude/config.jsonc and edit.
-// All paths support `~`. Secrets (botId/secret) can also live in ~/.weclaude/secrets.json
+// Declarative config for wezard. Copy to ~/.wezard/config.jsonc and edit.
+// All paths support `~`. Secrets (botId/secret) can also live in ~/.wezard/secrets.json
 // (same shape, deep-merged on top — keep secrets out of dotfile repos).
 {
   "$schema": "./schema.json",
@@ -19,8 +19,8 @@
   "daemon": {
     "host": "127.0.0.1",
     "port": 17890,
-    "stateDir": "~/.weclaude/state",
-    "logFile": "~/.weclaude/daemon.log",
+    "stateDir": "~/.wezard/state",
+    "logFile": "~/.wezard/daemon.log",
     "logLevel": "info"           // trace|debug|info|warn|error
   },
 
@@ -43,7 +43,7 @@
     //   "codebuddy": { "bin": "/usr/local/bin/codebuddy" }
     // },
     "cwd": "~",                  // workdir (mirror: must match the running claude's cwd)
-    "sessionMapFile": "~/.weclaude/sessions.json",
+    "sessionMapFile": "~/.wezard/sessions.json",
     "extraArgs": [],             // appended to `claude -p`
     "mirror": {
       // Pin a session id; empty → auto-pick latest .jsonl mtime under
@@ -69,11 +69,24 @@
     "sessionCacheMinutes": 30,   // (session_id, tool, cmd_prefix_hash) → decision
     "windowMinutes": 5,          // 「⏱ N 分钟」按钮：开窗口期间所有请求自动 allow
     "sensitiveArgRedact": true,  // mask password/token-like values before sending to IM
-    "fallbackOnError": "ask"     // never "deny" — never break workflow
+    "fallbackOnError": "ask",    // never "deny" — never break workflow
+
+    // 危险名单：命中者强制逐次单独审批 —— 不吃自动窗口、不吃 session cache、
+    // 不参与批量合流、卡上没有「N 分钟全过」按钮、超时降级 ask 不静默放行。
+    // 内置覆盖 rm/git push/kubectl delete/DROP TABLE/敏感路径等；下面三组正则
+    // (大小写不敏感) 追加自定义规则，allowPatterns 优先级最高。
+    "danger": {
+      "enabled": true,
+      "builtin": true,
+      "commandPatterns": [],     // 例: ["\\bpm2\\s+delete\\b"]
+      "toolPatterns": [],        // 例: ["^mcp__prod__"]
+      "pathPatterns": [],        // 例: ["/prod/"]
+      "allowPatterns": []        // 例: ["\\brm\\s+-rf\\s+node_modules\\b"]
+    }
   },
 
   // ── claude / codebuddy wrapper sync ───────────────────────────────
-  // `weclaude sync` writes hooks/MCP/permissions into every target settings.json
+  // `wezard sync` writes hooks/MCP/permissions into every target settings.json
   // listed below. Multi-CLI setups (claude + codebuddy 同时装) 列多项即可。
   // kind: "claude" (含 claude-internal 等 fork) | "codebuddy"
   //   • claude-internal 通过 settingsPath: "~/.claude-internal/settings.json" 表达
@@ -90,13 +103,13 @@
     ]
   },
 
-  // ── Standalone detail relay (weclaude svr) ────────────────────────
-  // `weclaude svr` 读这里作为默认参数, CLI --host/--port 仍可覆盖。省略整段等于
+  // ── Standalone detail relay (wezard svr) ────────────────────────
+  // `wezard svr` 读这里作为默认参数, CLI --host/--port 仍可覆盖。省略整段等于
   // 用硬编码兜底 (0.0.0.0:17891)。改到 80 让详情页 URL 用标准端口 (需 root)。
   "svr": {
     "host": "0.0.0.0",
     "port": 17891,
-    "stateDir": "~/.weclaude/svr",
-    "tokenFile": "~/.weclaude/svr-token"
+    "stateDir": "~/.wezard/svr",
+    "tokenFile": "~/.wezard/svr-token"
   }
 }

package/dist/cli/audit.js

@@ -1,4 +1,4 @@
-// Slash-command entry: `weclaude audit [tag]`.
+// Slash-command entry: `wezard audit [tag]`.
 //   - With a tag: ask the daemon for the newest-by-mtime mirror whose target
 //     carries `#<tag>` and audit THAT session (regardless of which CLI/pane
 //     the command was fired from). Fails hard when the daemon is down or no
@@ -13,7 +13,7 @@ import { readdirSync, statSync, existsSync } from "node:fs";
 import { basename, join } from "node:path";
 import { homedir } from "node:os";
 import { computeAuditReport } from "../daemon/audit.js";
-const DAEMON_BASE = process.env.WECLAUDE_DAEMON_BASE || "http://127.0.0.1:17890";
+const DAEMON_BASE = process.env.WEZARD_DAEMON_BASE || "http://127.0.0.1:17890";
 const PROJECT_BASES = [
     join(homedir(), ".claude-internal", "projects"),
     join(homedir(), ".claude", "projects"),

package/dist/cli/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../cli/audit.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,2DAA2D;AAC3D,4EAA4E;AAC5E,qEAAqE;AACrE,kDAAkD;AAClD,4EAA4E;AAC5E,iFAAiF;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,wBAAwB,CAAC;AAEjF,MAAM,aAAa,GAAG;IACpB,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC;CAC1C,CAAC;AAEF,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;IACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAW,EAAiB,EAAE;IACpD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,OAAO,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,KAAK,KAAK,GAAG;YAAE,MAAM;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAC7D,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM;QAC5B,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAiB,EAAE;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACnF,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;gBACzC,MAAM,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAIjG,4EAA4E;AAC5E,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,eAAe,GAAG,KAAK,EAAE,GAAW,EAA6B,EAAE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;QAC/D,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,EAAE,GAAG,CAAC,CAAC;YACX,IAAI,CAAC;gBAAC,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACnB,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAiB,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO;QAC1B,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA8B,CAAC;QACrE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,KAAK,CAAC,GAAG,WAAW,UAAU,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAE7E,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,0CAA0C,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../cli/audit.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,2DAA2D;AAC3D,4EAA4E;AAC5E,qEAAqE;AACrE,kDAAkD;AAClD,4EAA4E;AAC5E,iFAAiF;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;AAE/E,MAAM,aAAa,GAAG;IACpB,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC;CAC1C,CAAC;AAEF,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;IACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAW,EAAiB,EAAE;IACpD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,OAAO,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,KAAK,KAAK,GAAG;YAAE,MAAM;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAC7D,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM;QAC5B,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAiB,EAAE;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACnF,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,MAAM,GAA0C,IAAI,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;gBACzC,MAAM,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAIjG,4EAA4E;AAC5E,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,eAAe,GAAG,KAAK,EAAE,GAAW,EAA6B,EAAE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;QAC/D,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,EAAE,GAAG,CAAC,CAAC;YACX,IAAI,CAAC;gBAAC,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACnB,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAiB,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO;QAC1B,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA8B,CAAC;QACrE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,KAAK,CAAC,GAAG,WAAW,UAAU,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAChD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAE7E,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,0CAA0C,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC"}