cordon-cli - npm Package Compare versions

Comparing version 0.1.11 to 0.1.12

dist/bin/cordon.js

@@ -57,4 +57,42 @@ #!/usr/bin/env node
 
+// src/cli-state.ts
+import { readFileSync, writeFileSync, existsSync as existsSync2, mkdirSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+function statePath() {
+  return join2(homedir2(), ".cordon", "state.json");
+}
+function getState() {
+  const path = statePath();
+  if (!existsSync2(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function setState(patch) {
+  const path = statePath();
+  const dir = join2(homedir2(), ".cordon");
+  try {
+    if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+    const merged = { ...getState(), ...patch };
+    writeFileSync(path, JSON.stringify(merged, null, 2), "utf8");
+  } catch {
+  }
+}
+
 // src/commands/start.ts
+var DASHBOARD_URL = "https://cordon-server-production.up.railway.app/dashboard/";
 async function startCommand(options) {
+  if (!getState().welcomed) {
+    process.stderr.write(
+      `
+\x1B[36m[cordon] Want centralized audit logs + Slack approvals?\x1B[0m
+[cordon] Register at ${DASHBOARD_URL}?utm_source=cli_start
+
+`
+    );
+    setState({ welcomed: true });
+  }
   let config = emptyConfig();
@@ -109,13 +147,14 @@ let configPath = null;
 // src/commands/init.ts
-import { readFileSync, writeFileSync, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "fs";
 import { spawnSync } from "child_process";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+var DASHBOARD_URL2 = "https://cordon-server-production.up.railway.app/dashboard/";
 function ensureCordonSdkInstalled(cwd) {
-  if (existsSync2(join2(cwd, "node_modules", "cordon-sdk", "package.json"))) {
+  if (existsSync3(join3(cwd, "node_modules", "cordon-sdk", "package.json"))) {
     return;
   }
-  if (!existsSync2(join2(cwd, "package.json"))) {
-    writeFileSync(
-      join2(cwd, "package.json"),
+  if (!existsSync3(join3(cwd, "package.json"))) {
+    writeFileSync2(
+      join3(cwd, "package.json"),
       JSON.stringify({ name: "cordon-config", version: "0.0.0", private: true }, null, 2) + "\n",
@@ -148,15 +187,15 @@ "utf8"
     candidates.push(
-      join2(homedir2(), "Library", "Application Support", "Claude", "claude_desktop_config.json")
+      join3(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json")
     );
   } else if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? join2(homedir2(), "AppData", "Roaming");
-    candidates.push(join2(appData, "Claude", "claude_desktop_config.json"));
+    const appData = process.env["APPDATA"] ?? join3(homedir3(), "AppData", "Roaming");
+    candidates.push(join3(appData, "Claude", "claude_desktop_config.json"));
   } else {
-    candidates.push(join2(homedir2(), ".config", "Claude", "claude_desktop_config.json"));
+    candidates.push(join3(homedir3(), ".config", "Claude", "claude_desktop_config.json"));
   }
-  return candidates.find((p) => existsSync2(p)) ?? null;
+  return candidates.find((p) => existsSync3(p)) ?? null;
 }
 async function initCommand() {
-  const outputPath = join2(process.cwd(), "cordon.config.ts");
-  if (existsSync2(outputPath)) {
+  const outputPath = join3(process.cwd(), "cordon.config.ts");
+  if (existsSync3(outputPath)) {
     process.stderr.write(
@@ -174,3 +213,3 @@ `\x1B[33mwarn\x1B[0m: cordon.config.ts already exists \u2014 not overwriting.
     try {
-      claudeConfig = JSON.parse(readFileSync(claudePath, "utf8"));
+      claudeConfig = JSON.parse(readFileSync2(claudePath, "utf8"));
     } catch {
@@ -225,3 +264,3 @@ process.stderr.write(`\x1B[33mwarn\x1B[0m: could not parse Claude Desktop config
 `;
-  writeFileSync(outputPath, content, "utf8");
+  writeFileSync2(outputPath, content, "utf8");
   process.stderr.write(`\x1B[32m\u2713\x1B[0m wrote cordon.config.ts
@@ -243,6 +282,6 @@ `);
     const backupPath = `${claudePath}.cordon-backup`;
-    writeFileSync(backupPath, readFileSync(claudePath, "utf8"), "utf8");
+    writeFileSync2(backupPath, readFileSync2(claudePath, "utf8"), "utf8");
     process.stderr.write(`\x1B[32m\u2713\x1B[0m backed up Claude Desktop config to ${backupPath}
 `);
-    writeFileSync(claudePath, JSON.stringify(newClaudeConfig, null, 2), "utf8");
+    writeFileSync2(claudePath, JSON.stringify(newClaudeConfig, null, 2), "utf8");
     process.stderr.write(`\x1B[32m\u2713\x1B[0m patched Claude Desktop config
@@ -276,2 +315,9 @@ `);
   }
+  process.stderr.write(
+    `
+\x1B[36mWant centralized audit logs + Slack approvals?\x1B[0m
+Register a free account at ${DASHBOARD_URL2}?utm_source=cli_init
+`
+  );
+  setState({ welcomed: true });
 }
@@ -278,0 +324,0 @@

dist/bin/cordon.js.map

@@ -1,1 +0,1 @@
-{"version":3,"sources":["../../src/bin/cordon.ts","../../src/commands/start.ts","../../src/config-loader.ts","../../src/commands/init.ts"],"sourcesContent":["import { Command } from 'commander';\nimport { startCommand } from '../commands/start.js';\nimport { initCommand } from '../commands/init.js';\n\nconst program = new Command();\n\nprogram\n  .name('cordon')\n  .description('The security gateway for AI agents')\n  .version('0.1.0');\n\nprogram\n  .command('start')\n  .description('Start the Cordon gateway')\n  .option('-c, --config <path>', 'Path to cordon.config.ts')\n  .action(startCommand);\n\nprogram\n  .command('init')\n  .description('Generate cordon.config.ts and patch Claude Desktop config')\n  .action(initCommand);\n\nprogram.parse();\n","import { CordonGateway } from '@getcordon/core';\nimport type { ResolvedConfig } from 'cordon-sdk';\nimport { emptyConfig, findConfigPath, loadConfig } from '../config-loader.js';\n\ninterface StartOptions {\n  config?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  // Default to an empty server list so auto-install probes (Glama, MCP\n  // registry, fresh `npx -y cordon-cli start`) succeed instead of crashing.\n  // Real users get a loud stderr warning so they don't silently run a no-op.\n  let config: ResolvedConfig = emptyConfig();\n  let configPath: string | null = null;\n\n  try {\n    configPath = await findConfigPath(options.config);\n  } catch (err) {\n    if (options.config) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n    process.stderr.write(\n      '\\x1b[33m[cordon] no cordon.config.ts found — starting with zero upstream servers.\\x1b[0m\\n' +\n        '[cordon] Run `cordon init` to generate a config and connect real MCP servers.\\n',\n    );\n  }\n\n  if (configPath) {\n    process.stderr.write(`[cordon] loading config from ${configPath}\\n`);\n    try {\n      config = await loadConfig(configPath);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  }\n\n  const gateway = new CordonGateway(config);\n\n  const shutdown = async () => {\n    process.stderr.write('\\n[cordon] shutting down...\\n');\n    try {\n      await gateway.stop();\n      process.exit(0);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: shutdown failed: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  };\n\n  process.on('SIGINT', shutdown);\n  process.on('SIGTERM', shutdown);\n\n  try {\n    await gateway.start();\n  } catch (err) {\n    process.stderr.write(`\\x1b[31merror\\x1b[0m: gateway failed: ${String(err)}\\n`);\n    process.exit(1);\n  }\n}\n","import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { createJiti } from 'jiti';\nimport type { CordonConfig, ResolvedConfig } from 'cordon-sdk';\n\nconst SEARCH_PATHS = [\n  () => join(process.cwd(), 'cordon.config.ts'),\n  () => join(process.cwd(), 'cordon.config.js'),\n  () => join(homedir(), '.cordon', 'config.ts'),\n  () => join(homedir(), '.cordon', 'config.js'),\n];\n\nexport async function findConfigPath(explicit?: string): Promise<string> {\n  if (explicit) {\n    if (!existsSync(explicit)) {\n      throw new Error(`Config file not found: ${explicit}`);\n    }\n    return explicit;\n  }\n\n  for (const candidate of SEARCH_PATHS) {\n    const p = candidate();\n    if (existsSync(p)) return p;\n  }\n\n  throw new Error(\n    'No cordon config found. Run `cordon init` to create one, or pass --config <path>.',\n  );\n}\n\nexport async function loadConfig(configPath: string): Promise<ResolvedConfig> {\n  // jiti handles TypeScript config files without requiring a separate compile step\n  const jiti = createJiti(import.meta.url);\n  const mod = await jiti.import(configPath);\n\n  const raw = (mod as { default?: CordonConfig }).default ?? (mod as CordonConfig);\n\n  if (!raw || typeof raw !== 'object' || !Array.isArray(raw.servers)) {\n    throw new Error(\n      `Invalid config at ${configPath}: expected an object with a 'servers' array. ` +\n        `Make sure you are using \\`export default defineConfig({...})\\`.`,\n    );\n  }\n\n  return applyDefaults(raw as CordonConfig);\n}\n\nfunction applyDefaults(config: CordonConfig): ResolvedConfig {\n  return {\n    ...config,\n    audit: config.audit ?? { enabled: true, output: 'stdout' },\n    approvals: config.approvals ?? { channel: 'terminal' },\n  };\n}\n\nexport function emptyConfig(): ResolvedConfig {\n  return applyDefaults({ servers: [] });\n}\n","import { readFileSync, writeFileSync, existsSync } from 'node:fs';\nimport { spawnSync } from 'node:child_process';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\n\nfunction ensureCordonSdkInstalled(cwd: string): void {\n  // Config imports from 'cordon-sdk', and jiti resolves it from the config\n  // file's directory. Without a local install, `cordon start` dies with\n  // \"Cannot find module 'cordon-sdk'\" even when the CLI is global.\n  if (existsSync(join(cwd, 'node_modules', 'cordon-sdk', 'package.json'))) {\n    return;\n  }\n\n  if (!existsSync(join(cwd, 'package.json'))) {\n    writeFileSync(\n      join(cwd, 'package.json'),\n      JSON.stringify({ name: 'cordon-config', version: '0.0.0', private: true }, null, 2) + '\\n',\n      'utf8',\n    );\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m created package.json\\n`);\n  }\n\n  process.stderr.write(`[cordon] installing cordon-sdk...\\n`);\n  const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';\n  const result = spawnSync(npmCmd, ['install', 'cordon-sdk'], {\n    cwd,\n    stdio: ['ignore', 'inherit', 'inherit'],\n  });\n\n  if (result.status === 0) {\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m installed cordon-sdk\\n`);\n  } else {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: could not auto-install cordon-sdk. ` +\n        `Run 'npm install cordon-sdk' in this directory before 'cordon start'.\\n`,\n    );\n  }\n}\n\ninterface ClaudeDesktopConfig {\n  mcpServers?: Record<string, { command: string; args?: string[]; env?: Record<string, string> }>;\n}\n\nfunction getClaudeConfigPath(): string | null {\n  const candidates: string[] = [];\n\n  if (process.platform === 'darwin') {\n    candidates.push(\n      join(homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),\n    );\n  } else if (process.platform === 'win32') {\n    const appData = process.env['APPDATA'] ?? join(homedir(), 'AppData', 'Roaming');\n    candidates.push(join(appData, 'Claude', 'claude_desktop_config.json'));\n  } else {\n    candidates.push(join(homedir(), '.config', 'Claude', 'claude_desktop_config.json'));\n  }\n\n  return candidates.find((p) => existsSync(p)) ?? null;\n}\n\nexport async function initCommand(): Promise<void> {\n  const outputPath = join(process.cwd(), 'cordon.config.ts');\n\n  if (existsSync(outputPath)) {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: cordon.config.ts already exists — not overwriting.\\n`,\n    );\n    process.exit(1);\n  }\n\n  // Try to discover existing MCP servers from Claude Desktop config\n  const claudePath = getClaudeConfigPath();\n  let claudeConfig: ClaudeDesktopConfig = {};\n\n  if (claudePath) {\n    process.stderr.write(`[cordon] found Claude Desktop config at ${claudePath}\\n`);\n    try {\n      claudeConfig = JSON.parse(readFileSync(claudePath, 'utf8')) as ClaudeDesktopConfig;\n    } catch {\n      process.stderr.write(`\\x1b[33mwarn\\x1b[0m: could not parse Claude Desktop config\\n`);\n    }\n  } else {\n    process.stderr.write(\n      `[cordon] no Claude Desktop config found — generating a blank config\\n`,\n    );\n  }\n\n  const servers = Object.entries(claudeConfig.mcpServers ?? {});\n\n  // Generate cordon.config.ts\n  const serverBlocks = servers.length > 0\n    ? servers\n        .map(([name, cfg]) => {\n          const argsStr = cfg.args?.length\n            ? `, args: ${JSON.stringify(cfg.args)}`\n            : '';\n          const envStr =\n            cfg.env && Object.keys(cfg.env).length\n              ? `, env: ${JSON.stringify(cfg.env)}`\n            : '';\n          return `    {\n      name: '${name}',\n      transport: 'stdio',\n      command: '${cfg.command}'${argsStr}${envStr},\n      policy: 'allow',\n      // tools: {\n      //   execute: 'approve',\n      //   delete:  'block',\n      // },\n    },`;\n        })\n        .join('\\n')\n    : `    // {\n    //   name: 'my-server',\n    //   transport: 'stdio',\n    //   command: 'npx',\n    //   args: ['-y', '@my-org/my-mcp-server'],\n    //   policy: 'allow',\n    // },`;\n\n  const content = `import { defineConfig } from 'cordon-sdk';\n\nexport default defineConfig({\n  servers: [\n${serverBlocks}\n  ],\n\n  audit: {\n    enabled: true,\n    output: 'stdout',\n  },\n\n  approvals: {\n    channel: 'terminal',\n    // timeoutMs: 60_000,\n  },\n});\n`;\n\n  writeFileSync(outputPath, content, 'utf8');\n  process.stderr.write(`\\x1b[32m✓\\x1b[0m wrote cordon.config.ts\\n`);\n\n  // The config imports from 'cordon-sdk'. Install it locally so jiti can\n  // resolve it when `cordon start` runs.\n  ensureCordonSdkInstalled(process.cwd());\n\n  // Patch Claude Desktop config to route through cordon\n  if (claudePath && servers.length > 0) {\n    const cordonConfigPath = outputPath.replace(/\\\\/g, '/');\n    // On Windows, Claude Desktop spawns MCP servers via CreateProcess which\n    // won't auto-resolve `npx` without the .cmd extension.\n    const npxCommand = process.platform === 'win32' ? 'npx.cmd' : 'npx';\n\n    const newClaudeConfig: ClaudeDesktopConfig = {\n      ...claudeConfig,\n      mcpServers: {\n        cordon: {\n          command: npxCommand,\n          args: ['-y', 'cordon-cli', 'start', '--config', cordonConfigPath],\n        },\n      },\n    };\n\n    // Backup the original\n    const backupPath = `${claudePath}.cordon-backup`;\n    writeFileSync(backupPath, readFileSync(claudePath, 'utf8'), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m backed up Claude Desktop config to ${backupPath}\\n`);\n\n    writeFileSync(claudePath, JSON.stringify(newClaudeConfig, null, 2), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m patched Claude Desktop config\\n`);\n    process.stderr.write(\n      `\\n\\x1b[36mRestart Claude Desktop to activate Cordon.\\x1b[0m\\n`,\n    );\n  } else if (!claudePath) {\n    process.stderr.write(\n      `\\n\\x1b[33mwarn\\x1b[0m: Claude Desktop config not found on this system.\\n` +\n      `Edit cordon.config.ts, then manually add Cordon to your MCP client config:\\n\\n` +\n      `  \"mcpServers\": {\\n` +\n      `    \"cordon\": {\\n` +\n      `      \"command\": \"${process.platform === 'win32' ? 'npx.cmd' : 'npx'}\",\\n` +\n      `      \"args\": [\"-y\", \"cordon-cli\", \"start\", \"--config\", \"${outputPath.replace(/\\\\/g, '/')}\"]\\n` +\n      `    }\\n` +\n      `  }\\n`,\n    );\n  } else {\n    // claudePath found but no existing servers — config written, no patching needed\n    process.stderr.write(\n      `\\nEdit cordon.config.ts to add your MCP servers, then run \\x1b[36mnpx cordon start\\x1b[0m.\\n`,\n    );\n  }\n}\n"],"mappings":";;;AAAA,SAAS,eAAe;;;ACAxB,SAAS,qBAAqB;;;ACA9B,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAG3B,IAAM,eAAe;AAAA,EACnB,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAC9C;AAEA,eAAsB,eAAe,UAAoC;AACvE,MAAI,UAAU;AACZ,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,cAAc;AACpC,UAAM,IAAI,UAAU;AACpB,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,WAAW,YAA6C;AAE5E,QAAM,OAAO,WAAW,YAAY,GAAG;AACvC,QAAM,MAAM,MAAM,KAAK,OAAO,UAAU;AAExC,QAAM,MAAO,IAAmC,WAAY;AAE5D,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,IAAI,OAAO,GAAG;AAClE,UAAM,IAAI;AAAA,MACR,qBAAqB,UAAU;AAAA,IAEjC;AAAA,EACF;AAEA,SAAO,cAAc,GAAmB;AAC1C;AAEA,SAAS,cAAc,QAAsC;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,OAAO,SAAS,EAAE,SAAS,MAAM,QAAQ,SAAS;AAAA,IACzD,WAAW,OAAO,aAAa,EAAE,SAAS,WAAW;AAAA,EACvD;AACF;AAEO,SAAS,cAA8B;AAC5C,SAAO,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;AACtC;;;ADlDA,eAAsB,aAAa,SAAsC;AAIvE,MAAI,SAAyB,YAAY;AACzC,MAAI,aAA4B;AAEhC,MAAI;AACF,iBAAa,MAAM,eAAe,QAAQ,MAAM;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,QAAQ,QAAQ;AAClB,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,gCAAgC,UAAU;AAAA,CAAI;AACnE,QAAI;AACF,eAAS,MAAM,WAAW,UAAU;AAAA,IACtC,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,cAAc,MAAM;AAExC,QAAM,WAAW,YAAY;AAC3B,YAAQ,OAAO,MAAM,+BAA+B;AACpD,QAAI;AACF,YAAM,QAAQ,KAAK;AACnB,cAAQ,KAAK,CAAC;AAAA,IAChB,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,0CAA0C,OAAO,GAAG,CAAC;AAAA,CAAI;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAE9B,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,EACtB,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,yCAAyC,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;AE5DA,SAAS,cAAc,eAAe,cAAAA,mBAAkB;AACxD,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AAExB,SAAS,yBAAyB,KAAmB;AAInD,MAAIF,YAAWC,MAAK,KAAK,gBAAgB,cAAc,cAAc,CAAC,GAAG;AACvE;AAAA,EACF;AAEA,MAAI,CAACD,YAAWC,MAAK,KAAK,cAAc,CAAC,GAAG;AAC1C;AAAA,MACEA,MAAK,KAAK,cAAc;AAAA,MACxB,KAAK,UAAU,EAAE,MAAM,iBAAiB,SAAS,SAAS,SAAS,KAAK,GAAG,MAAM,CAAC,IAAI;AAAA,MACtF;AAAA,IACF;AACA,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE;AAEA,UAAQ,OAAO,MAAM;AAAA,CAAqC;AAC1D,QAAM,SAAS,QAAQ,aAAa,UAAU,YAAY;AAC1D,QAAM,SAAS,UAAU,QAAQ,CAAC,WAAW,YAAY,GAAG;AAAA,IAC1D;AAAA,IACA,OAAO,CAAC,UAAU,WAAW,SAAS;AAAA,EACxC,CAAC;AAED,MAAI,OAAO,WAAW,GAAG;AACvB,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IAEF;AAAA,EACF;AACF;AAMA,SAAS,sBAAqC;AAC5C,QAAM,aAAuB,CAAC;AAE9B,MAAI,QAAQ,aAAa,UAAU;AACjC,eAAW;AAAA,MACTA,MAAKC,SAAQ,GAAG,WAAW,uBAAuB,UAAU,4BAA4B;AAAA,IAC1F;AAAA,EACF,WAAW,QAAQ,aAAa,SAAS;AACvC,UAAM,UAAU,QAAQ,IAAI,SAAS,KAAKD,MAAKC,SAAQ,GAAG,WAAW,SAAS;AAC9E,eAAW,KAAKD,MAAK,SAAS,UAAU,4BAA4B,CAAC;AAAA,EACvE,OAAO;AACL,eAAW,KAAKA,MAAKC,SAAQ,GAAG,WAAW,UAAU,4BAA4B,CAAC;AAAA,EACpF;AAEA,SAAO,WAAW,KAAK,CAAC,MAAMF,YAAW,CAAC,CAAC,KAAK;AAClD;AAEA,eAAsB,cAA6B;AACjD,QAAM,aAAaC,MAAK,QAAQ,IAAI,GAAG,kBAAkB;AAEzD,MAAID,YAAW,UAAU,GAAG;AAC1B,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,aAAa,oBAAoB;AACvC,MAAI,eAAoC,CAAC;AAEzC,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,2CAA2C,UAAU;AAAA,CAAI;AAC9E,QAAI;AACF,qBAAe,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AAAA,IAC5D,QAAQ;AACN,cAAQ,OAAO,MAAM;AAAA,CAA8D;AAAA,IACrF;AAAA,EACF,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,QAAQ,aAAa,cAAc,CAAC,CAAC;AAG5D,QAAM,eAAe,QAAQ,SAAS,IAClC,QACG,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;AACpB,UAAM,UAAU,IAAI,MAAM,SACtB,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,KACnC;AACJ,UAAM,SACJ,IAAI,OAAO,OAAO,KAAK,IAAI,GAAG,EAAE,SAC5B,UAAU,KAAK,UAAU,IAAI,GAAG,CAAC,KACnC;AACJ,WAAO;AAAA,eACF,IAAI;AAAA;AAAA,kBAED,IAAI,OAAO,IAAI,OAAO,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,CAAC,EACA,KAAK,IAAI,IACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQJ,QAAM,UAAU;AAAA;AAAA;AAAA;AAAA,EAIhB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeZ,gBAAc,YAAY,SAAS,MAAM;AACzC,UAAQ,OAAO,MAAM;AAAA,CAA2C;AAIhE,2BAAyB,QAAQ,IAAI,CAAC;AAGtC,MAAI,cAAc,QAAQ,SAAS,GAAG;AACpC,UAAM,mBAAmB,WAAW,QAAQ,OAAO,GAAG;AAGtD,UAAM,aAAa,QAAQ,aAAa,UAAU,YAAY;AAE9D,UAAM,kBAAuC;AAAA,MAC3C,GAAG;AAAA,MACH,YAAY;AAAA,QACV,QAAQ;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,MAAM,cAAc,SAAS,YAAY,gBAAgB;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,GAAG,UAAU;AAChC,kBAAc,YAAY,aAAa,YAAY,MAAM,GAAG,MAAM;AAClE,YAAQ,OAAO,MAAM,4DAAuD,UAAU;AAAA,CAAI;AAE1F,kBAAc,YAAY,KAAK,UAAU,iBAAiB,MAAM,CAAC,GAAG,MAAM;AAC1E,YAAQ,OAAO,MAAM;AAAA,CAAkD;AACvE,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF,WAAW,CAAC,YAAY;AACtB,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAIqB,QAAQ,aAAa,UAAU,YAAY,KAAK;AAAA,2DACT,WAAW,QAAQ,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,IAG5F;AAAA,EACF,OAAO;AAEL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF;AACF;;;AH1LA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,QAAQ,EACb,YAAY,oCAAoC,EAChD,QAAQ,OAAO;AAElB,QACG,QAAQ,OAAO,EACf,YAAY,0BAA0B,EACtC,OAAO,uBAAuB,0BAA0B,EACxD,OAAO,YAAY;AAEtB,QACG,QAAQ,MAAM,EACd,YAAY,2DAA2D,EACvE,OAAO,WAAW;AAErB,QAAQ,MAAM;","names":["existsSync","join","homedir"]}
+{"version":3,"sources":["../../src/bin/cordon.ts","../../src/commands/start.ts","../../src/config-loader.ts","../../src/cli-state.ts","../../src/commands/init.ts"],"sourcesContent":["import { Command } from 'commander';\nimport { startCommand } from '../commands/start.js';\nimport { initCommand } from '../commands/init.js';\n\nconst program = new Command();\n\nprogram\n  .name('cordon')\n  .description('The security gateway for AI agents')\n  .version('0.1.0');\n\nprogram\n  .command('start')\n  .description('Start the Cordon gateway')\n  .option('-c, --config <path>', 'Path to cordon.config.ts')\n  .action(startCommand);\n\nprogram\n  .command('init')\n  .description('Generate cordon.config.ts and patch Claude Desktop config')\n  .action(initCommand);\n\nprogram.parse();\n","import { CordonGateway } from '@getcordon/core';\nimport type { ResolvedConfig } from 'cordon-sdk';\nimport { emptyConfig, findConfigPath, loadConfig } from '../config-loader.js';\nimport { getState, setState } from '../cli-state.js';\n\nconst DASHBOARD_URL = 'https://cordon-server-production.up.railway.app/dashboard/';\n\ninterface StartOptions {\n  config?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  if (!getState().welcomed) {\n    process.stderr.write(\n      `\\n\\x1b[36m[cordon] Want centralized audit logs + Slack approvals?\\x1b[0m\\n` +\n      `[cordon] Register at ${DASHBOARD_URL}?utm_source=cli_start\\n\\n`,\n    );\n    setState({ welcomed: true });\n  }\n\n  // Default to an empty server list so auto-install probes (Glama, MCP\n  // registry, fresh `npx -y cordon-cli start`) succeed instead of crashing.\n  // Real users get a loud stderr warning so they don't silently run a no-op.\n  let config: ResolvedConfig = emptyConfig();\n  let configPath: string | null = null;\n\n  try {\n    configPath = await findConfigPath(options.config);\n  } catch (err) {\n    if (options.config) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n    process.stderr.write(\n      '\\x1b[33m[cordon] no cordon.config.ts found — starting with zero upstream servers.\\x1b[0m\\n' +\n        '[cordon] Run `cordon init` to generate a config and connect real MCP servers.\\n',\n    );\n  }\n\n  if (configPath) {\n    process.stderr.write(`[cordon] loading config from ${configPath}\\n`);\n    try {\n      config = await loadConfig(configPath);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  }\n\n  const gateway = new CordonGateway(config);\n\n  const shutdown = async () => {\n    process.stderr.write('\\n[cordon] shutting down...\\n');\n    try {\n      await gateway.stop();\n      process.exit(0);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: shutdown failed: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  };\n\n  process.on('SIGINT', shutdown);\n  process.on('SIGTERM', shutdown);\n\n  try {\n    await gateway.start();\n  } catch (err) {\n    process.stderr.write(`\\x1b[31merror\\x1b[0m: gateway failed: ${String(err)}\\n`);\n    process.exit(1);\n  }\n}\n","import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { createJiti } from 'jiti';\nimport type { CordonConfig, ResolvedConfig } from 'cordon-sdk';\n\nconst SEARCH_PATHS = [\n  () => join(process.cwd(), 'cordon.config.ts'),\n  () => join(process.cwd(), 'cordon.config.js'),\n  () => join(homedir(), '.cordon', 'config.ts'),\n  () => join(homedir(), '.cordon', 'config.js'),\n];\n\nexport async function findConfigPath(explicit?: string): Promise<string> {\n  if (explicit) {\n    if (!existsSync(explicit)) {\n      throw new Error(`Config file not found: ${explicit}`);\n    }\n    return explicit;\n  }\n\n  for (const candidate of SEARCH_PATHS) {\n    const p = candidate();\n    if (existsSync(p)) return p;\n  }\n\n  throw new Error(\n    'No cordon config found. Run `cordon init` to create one, or pass --config <path>.',\n  );\n}\n\nexport async function loadConfig(configPath: string): Promise<ResolvedConfig> {\n  // jiti handles TypeScript config files without requiring a separate compile step\n  const jiti = createJiti(import.meta.url);\n  const mod = await jiti.import(configPath);\n\n  const raw = (mod as { default?: CordonConfig }).default ?? (mod as CordonConfig);\n\n  if (!raw || typeof raw !== 'object' || !Array.isArray(raw.servers)) {\n    throw new Error(\n      `Invalid config at ${configPath}: expected an object with a 'servers' array. ` +\n        `Make sure you are using \\`export default defineConfig({...})\\`.`,\n    );\n  }\n\n  return applyDefaults(raw as CordonConfig);\n}\n\nfunction applyDefaults(config: CordonConfig): ResolvedConfig {\n  return {\n    ...config,\n    audit: config.audit ?? { enabled: true, output: 'stdout' },\n    approvals: config.approvals ?? { channel: 'terminal' },\n  };\n}\n\nexport function emptyConfig(): ResolvedConfig {\n  return applyDefaults({ servers: [] });\n}\n","import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\n\ninterface CliState {\n  welcomed?: boolean;\n}\n\nfunction statePath(): string {\n  return join(homedir(), '.cordon', 'state.json');\n}\n\nexport function getState(): CliState {\n  const path = statePath();\n  if (!existsSync(path)) return {};\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as CliState;\n  } catch {\n    return {};\n  }\n}\n\nexport function setState(patch: CliState): void {\n  const path = statePath();\n  const dir = join(homedir(), '.cordon');\n  try {\n    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });\n    const merged = { ...getState(), ...patch };\n    writeFileSync(path, JSON.stringify(merged, null, 2), 'utf8');\n  } catch {\n    // Non-fatal: missing state just means we re-show the banner next time.\n  }\n}\n","import { readFileSync, writeFileSync, existsSync } from 'node:fs';\nimport { spawnSync } from 'node:child_process';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { setState } from '../cli-state.js';\n\nconst DASHBOARD_URL = 'https://cordon-server-production.up.railway.app/dashboard/';\n\nfunction ensureCordonSdkInstalled(cwd: string): void {\n  // Config imports from 'cordon-sdk', and jiti resolves it from the config\n  // file's directory. Without a local install, `cordon start` dies with\n  // \"Cannot find module 'cordon-sdk'\" even when the CLI is global.\n  if (existsSync(join(cwd, 'node_modules', 'cordon-sdk', 'package.json'))) {\n    return;\n  }\n\n  if (!existsSync(join(cwd, 'package.json'))) {\n    writeFileSync(\n      join(cwd, 'package.json'),\n      JSON.stringify({ name: 'cordon-config', version: '0.0.0', private: true }, null, 2) + '\\n',\n      'utf8',\n    );\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m created package.json\\n`);\n  }\n\n  process.stderr.write(`[cordon] installing cordon-sdk...\\n`);\n  const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';\n  const result = spawnSync(npmCmd, ['install', 'cordon-sdk'], {\n    cwd,\n    stdio: ['ignore', 'inherit', 'inherit'],\n  });\n\n  if (result.status === 0) {\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m installed cordon-sdk\\n`);\n  } else {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: could not auto-install cordon-sdk. ` +\n        `Run 'npm install cordon-sdk' in this directory before 'cordon start'.\\n`,\n    );\n  }\n}\n\ninterface ClaudeDesktopConfig {\n  mcpServers?: Record<string, { command: string; args?: string[]; env?: Record<string, string> }>;\n}\n\nfunction getClaudeConfigPath(): string | null {\n  const candidates: string[] = [];\n\n  if (process.platform === 'darwin') {\n    candidates.push(\n      join(homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),\n    );\n  } else if (process.platform === 'win32') {\n    const appData = process.env['APPDATA'] ?? join(homedir(), 'AppData', 'Roaming');\n    candidates.push(join(appData, 'Claude', 'claude_desktop_config.json'));\n  } else {\n    candidates.push(join(homedir(), '.config', 'Claude', 'claude_desktop_config.json'));\n  }\n\n  return candidates.find((p) => existsSync(p)) ?? null;\n}\n\nexport async function initCommand(): Promise<void> {\n  const outputPath = join(process.cwd(), 'cordon.config.ts');\n\n  if (existsSync(outputPath)) {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: cordon.config.ts already exists — not overwriting.\\n`,\n    );\n    process.exit(1);\n  }\n\n  // Try to discover existing MCP servers from Claude Desktop config\n  const claudePath = getClaudeConfigPath();\n  let claudeConfig: ClaudeDesktopConfig = {};\n\n  if (claudePath) {\n    process.stderr.write(`[cordon] found Claude Desktop config at ${claudePath}\\n`);\n    try {\n      claudeConfig = JSON.parse(readFileSync(claudePath, 'utf8')) as ClaudeDesktopConfig;\n    } catch {\n      process.stderr.write(`\\x1b[33mwarn\\x1b[0m: could not parse Claude Desktop config\\n`);\n    }\n  } else {\n    process.stderr.write(\n      `[cordon] no Claude Desktop config found — generating a blank config\\n`,\n    );\n  }\n\n  const servers = Object.entries(claudeConfig.mcpServers ?? {});\n\n  // Generate cordon.config.ts\n  const serverBlocks = servers.length > 0\n    ? servers\n        .map(([name, cfg]) => {\n          const argsStr = cfg.args?.length\n            ? `, args: ${JSON.stringify(cfg.args)}`\n            : '';\n          const envStr =\n            cfg.env && Object.keys(cfg.env).length\n              ? `, env: ${JSON.stringify(cfg.env)}`\n            : '';\n          return `    {\n      name: '${name}',\n      transport: 'stdio',\n      command: '${cfg.command}'${argsStr}${envStr},\n      policy: 'allow',\n      // tools: {\n      //   execute: 'approve',\n      //   delete:  'block',\n      // },\n    },`;\n        })\n        .join('\\n')\n    : `    // {\n    //   name: 'my-server',\n    //   transport: 'stdio',\n    //   command: 'npx',\n    //   args: ['-y', '@my-org/my-mcp-server'],\n    //   policy: 'allow',\n    // },`;\n\n  const content = `import { defineConfig } from 'cordon-sdk';\n\nexport default defineConfig({\n  servers: [\n${serverBlocks}\n  ],\n\n  audit: {\n    enabled: true,\n    output: 'stdout',\n  },\n\n  approvals: {\n    channel: 'terminal',\n    // timeoutMs: 60_000,\n  },\n});\n`;\n\n  writeFileSync(outputPath, content, 'utf8');\n  process.stderr.write(`\\x1b[32m✓\\x1b[0m wrote cordon.config.ts\\n`);\n\n  // The config imports from 'cordon-sdk'. Install it locally so jiti can\n  // resolve it when `cordon start` runs.\n  ensureCordonSdkInstalled(process.cwd());\n\n  // Patch Claude Desktop config to route through cordon\n  if (claudePath && servers.length > 0) {\n    const cordonConfigPath = outputPath.replace(/\\\\/g, '/');\n    // On Windows, Claude Desktop spawns MCP servers via CreateProcess which\n    // won't auto-resolve `npx` without the .cmd extension.\n    const npxCommand = process.platform === 'win32' ? 'npx.cmd' : 'npx';\n\n    const newClaudeConfig: ClaudeDesktopConfig = {\n      ...claudeConfig,\n      mcpServers: {\n        cordon: {\n          command: npxCommand,\n          args: ['-y', 'cordon-cli', 'start', '--config', cordonConfigPath],\n        },\n      },\n    };\n\n    // Backup the original\n    const backupPath = `${claudePath}.cordon-backup`;\n    writeFileSync(backupPath, readFileSync(claudePath, 'utf8'), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m backed up Claude Desktop config to ${backupPath}\\n`);\n\n    writeFileSync(claudePath, JSON.stringify(newClaudeConfig, null, 2), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m patched Claude Desktop config\\n`);\n    process.stderr.write(\n      `\\n\\x1b[36mRestart Claude Desktop to activate Cordon.\\x1b[0m\\n`,\n    );\n  } else if (!claudePath) {\n    process.stderr.write(\n      `\\n\\x1b[33mwarn\\x1b[0m: Claude Desktop config not found on this system.\\n` +\n      `Edit cordon.config.ts, then manually add Cordon to your MCP client config:\\n\\n` +\n      `  \"mcpServers\": {\\n` +\n      `    \"cordon\": {\\n` +\n      `      \"command\": \"${process.platform === 'win32' ? 'npx.cmd' : 'npx'}\",\\n` +\n      `      \"args\": [\"-y\", \"cordon-cli\", \"start\", \"--config\", \"${outputPath.replace(/\\\\/g, '/')}\"]\\n` +\n      `    }\\n` +\n      `  }\\n`,\n    );\n  } else {\n    // claudePath found but no existing servers — config written, no patching needed\n    process.stderr.write(\n      `\\nEdit cordon.config.ts to add your MCP servers, then run \\x1b[36mnpx cordon start\\x1b[0m.\\n`,\n    );\n  }\n\n  process.stderr.write(\n    `\\n\\x1b[36mWant centralized audit logs + Slack approvals?\\x1b[0m\\n` +\n    `Register a free account at ${DASHBOARD_URL}?utm_source=cli_init\\n`,\n  );\n  setState({ welcomed: true });\n}\n"],"mappings":";;;AAAA,SAAS,eAAe;;;ACAxB,SAAS,qBAAqB;;;ACA9B,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAG3B,IAAM,eAAe;AAAA,EACnB,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAC9C;AAEA,eAAsB,eAAe,UAAoC;AACvE,MAAI,UAAU;AACZ,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,cAAc;AACpC,UAAM,IAAI,UAAU;AACpB,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,WAAW,YAA6C;AAE5E,QAAM,OAAO,WAAW,YAAY,GAAG;AACvC,QAAM,MAAM,MAAM,KAAK,OAAO,UAAU;AAExC,QAAM,MAAO,IAAmC,WAAY;AAE5D,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,IAAI,OAAO,GAAG;AAClE,UAAM,IAAI;AAAA,MACR,qBAAqB,UAAU;AAAA,IAEjC;AAAA,EACF;AAEA,SAAO,cAAc,GAAmB;AAC1C;AAEA,SAAS,cAAc,QAAsC;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,OAAO,SAAS,EAAE,SAAS,MAAM,QAAQ,SAAS;AAAA,IACzD,WAAW,OAAO,aAAa,EAAE,SAAS,WAAW;AAAA,EACvD;AACF;AAEO,SAAS,cAA8B;AAC5C,SAAO,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;AACtC;;;AC1DA,SAAS,cAAc,eAAe,cAAAA,aAAY,iBAAiB;AACnE,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AAMxB,SAAS,YAAoB;AAC3B,SAAOD,MAAKC,SAAQ,GAAG,WAAW,YAAY;AAChD;AAEO,SAAS,WAAqB;AACnC,QAAM,OAAO,UAAU;AACvB,MAAI,CAACF,YAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,SAAS,OAAuB;AAC9C,QAAM,OAAO,UAAU;AACvB,QAAM,MAAMC,MAAKC,SAAQ,GAAG,SAAS;AACrC,MAAI;AACF,QAAI,CAACF,YAAW,GAAG,EAAG,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACxD,UAAM,SAAS,EAAE,GAAG,SAAS,GAAG,GAAG,MAAM;AACzC,kBAAc,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,MAAM;AAAA,EAC7D,QAAQ;AAAA,EAER;AACF;;;AF3BA,IAAM,gBAAgB;AAMtB,eAAsB,aAAa,SAAsC;AACvE,MAAI,CAAC,SAAS,EAAE,UAAU;AACxB,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,uBACwB,aAAa;AAAA;AAAA;AAAA,IACvC;AACA,aAAS,EAAE,UAAU,KAAK,CAAC;AAAA,EAC7B;AAKA,MAAI,SAAyB,YAAY;AACzC,MAAI,aAA4B;AAEhC,MAAI;AACF,iBAAa,MAAM,eAAe,QAAQ,MAAM;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,QAAQ,QAAQ;AAClB,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,gCAAgC,UAAU;AAAA,CAAI;AACnE,QAAI;AACF,eAAS,MAAM,WAAW,UAAU;AAAA,IACtC,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,cAAc,MAAM;AAExC,QAAM,WAAW,YAAY;AAC3B,YAAQ,OAAO,MAAM,+BAA+B;AACpD,QAAI;AACF,YAAM,QAAQ,KAAK;AACnB,cAAQ,KAAK,CAAC;AAAA,IAChB,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,0CAA0C,OAAO,GAAG,CAAC;AAAA,CAAI;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAE9B,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,EACtB,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,yCAAyC,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;AGvEA,SAAS,gBAAAG,eAAc,iBAAAC,gBAAe,cAAAC,mBAAkB;AACxD,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AAGxB,IAAMC,iBAAgB;AAEtB,SAAS,yBAAyB,KAAmB;AAInD,MAAIC,YAAWC,MAAK,KAAK,gBAAgB,cAAc,cAAc,CAAC,GAAG;AACvE;AAAA,EACF;AAEA,MAAI,CAACD,YAAWC,MAAK,KAAK,cAAc,CAAC,GAAG;AAC1C,IAAAC;AAAA,MACED,MAAK,KAAK,cAAc;AAAA,MACxB,KAAK,UAAU,EAAE,MAAM,iBAAiB,SAAS,SAAS,SAAS,KAAK,GAAG,MAAM,CAAC,IAAI;AAAA,MACtF;AAAA,IACF;AACA,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE;AAEA,UAAQ,OAAO,MAAM;AAAA,CAAqC;AAC1D,QAAM,SAAS,QAAQ,aAAa,UAAU,YAAY;AAC1D,QAAM,SAAS,UAAU,QAAQ,CAAC,WAAW,YAAY,GAAG;AAAA,IAC1D;AAAA,IACA,OAAO,CAAC,UAAU,WAAW,SAAS;AAAA,EACxC,CAAC;AAED,MAAI,OAAO,WAAW,GAAG;AACvB,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IAEF;AAAA,EACF;AACF;AAMA,SAAS,sBAAqC;AAC5C,QAAM,aAAuB,CAAC;AAE9B,MAAI,QAAQ,aAAa,UAAU;AACjC,eAAW;AAAA,MACTA,MAAKE,SAAQ,GAAG,WAAW,uBAAuB,UAAU,4BAA4B;AAAA,IAC1F;AAAA,EACF,WAAW,QAAQ,aAAa,SAAS;AACvC,UAAM,UAAU,QAAQ,IAAI,SAAS,KAAKF,MAAKE,SAAQ,GAAG,WAAW,SAAS;AAC9E,eAAW,KAAKF,MAAK,SAAS,UAAU,4BAA4B,CAAC;AAAA,EACvE,OAAO;AACL,eAAW,KAAKA,MAAKE,SAAQ,GAAG,WAAW,UAAU,4BAA4B,CAAC;AAAA,EACpF;AAEA,SAAO,WAAW,KAAK,CAAC,MAAMH,YAAW,CAAC,CAAC,KAAK;AAClD;AAEA,eAAsB,cAA6B;AACjD,QAAM,aAAaC,MAAK,QAAQ,IAAI,GAAG,kBAAkB;AAEzD,MAAID,YAAW,UAAU,GAAG;AAC1B,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,aAAa,oBAAoB;AACvC,MAAI,eAAoC,CAAC;AAEzC,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,2CAA2C,UAAU;AAAA,CAAI;AAC9E,QAAI;AACF,qBAAe,KAAK,MAAMI,cAAa,YAAY,MAAM,CAAC;AAAA,IAC5D,QAAQ;AACN,cAAQ,OAAO,MAAM;AAAA,CAA8D;AAAA,IACrF;AAAA,EACF,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,QAAQ,aAAa,cAAc,CAAC,CAAC;AAG5D,QAAM,eAAe,QAAQ,SAAS,IAClC,QACG,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;AACpB,UAAM,UAAU,IAAI,MAAM,SACtB,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,KACnC;AACJ,UAAM,SACJ,IAAI,OAAO,OAAO,KAAK,IAAI,GAAG,EAAE,SAC5B,UAAU,KAAK,UAAU,IAAI,GAAG,CAAC,KACnC;AACJ,WAAO;AAAA,eACF,IAAI;AAAA;AAAA,kBAED,IAAI,OAAO,IAAI,OAAO,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,CAAC,EACA,KAAK,IAAI,IACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQJ,QAAM,UAAU;AAAA;AAAA;AAAA;AAAA,EAIhB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeZ,EAAAF,eAAc,YAAY,SAAS,MAAM;AACzC,UAAQ,OAAO,MAAM;AAAA,CAA2C;AAIhE,2BAAyB,QAAQ,IAAI,CAAC;AAGtC,MAAI,cAAc,QAAQ,SAAS,GAAG;AACpC,UAAM,mBAAmB,WAAW,QAAQ,OAAO,GAAG;AAGtD,UAAM,aAAa,QAAQ,aAAa,UAAU,YAAY;AAE9D,UAAM,kBAAuC;AAAA,MAC3C,GAAG;AAAA,MACH,YAAY;AAAA,QACV,QAAQ;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,MAAM,cAAc,SAAS,YAAY,gBAAgB;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,GAAG,UAAU;AAChC,IAAAA,eAAc,YAAYE,cAAa,YAAY,MAAM,GAAG,MAAM;AAClE,YAAQ,OAAO,MAAM,4DAAuD,UAAU;AAAA,CAAI;AAE1F,IAAAF,eAAc,YAAY,KAAK,UAAU,iBAAiB,MAAM,CAAC,GAAG,MAAM;AAC1E,YAAQ,OAAO,MAAM;AAAA,CAAkD;AACvE,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF,WAAW,CAAC,YAAY;AACtB,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAIqB,QAAQ,aAAa,UAAU,YAAY,KAAK;AAAA,2DACT,WAAW,QAAQ,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,IAG5F;AAAA,EACF,OAAO;AAEL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,OAAO;AAAA,IACb;AAAA;AAAA,6BAC8BH,cAAa;AAAA;AAAA,EAC7C;AACA,WAAS,EAAE,UAAU,KAAK,CAAC;AAC7B;;;AJnMA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,QAAQ,EACb,YAAY,oCAAoC,EAChD,QAAQ,OAAO;AAElB,QACG,QAAQ,OAAO,EACf,YAAY,0BAA0B,EACtC,OAAO,uBAAuB,0BAA0B,EACxD,OAAO,YAAY;AAEtB,QACG,QAAQ,MAAM,EACd,YAAY,2DAA2D,EACvE,OAAO,WAAW;AAErB,QAAQ,MAAM;","names":["existsSync","join","homedir","readFileSync","writeFileSync","existsSync","join","homedir","DASHBOARD_URL","existsSync","join","writeFileSync","homedir","readFileSync"]}

dist/index.js

@@ -52,4 +52,42 @@ // src/commands/start.ts
 
+// src/cli-state.ts
+import { readFileSync, writeFileSync, existsSync as existsSync2, mkdirSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+function statePath() {
+  return join2(homedir2(), ".cordon", "state.json");
+}
+function getState() {
+  const path = statePath();
+  if (!existsSync2(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function setState(patch) {
+  const path = statePath();
+  const dir = join2(homedir2(), ".cordon");
+  try {
+    if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+    const merged = { ...getState(), ...patch };
+    writeFileSync(path, JSON.stringify(merged, null, 2), "utf8");
+  } catch {
+  }
+}
+
 // src/commands/start.ts
+var DASHBOARD_URL = "https://cordon-server-production.up.railway.app/dashboard/";
 async function startCommand(options) {
+  if (!getState().welcomed) {
+    process.stderr.write(
+      `
+\x1B[36m[cordon] Want centralized audit logs + Slack approvals?\x1B[0m
+[cordon] Register at ${DASHBOARD_URL}?utm_source=cli_start
+
+`
+    );
+    setState({ welcomed: true });
+  }
   let config = emptyConfig();
@@ -104,13 +142,14 @@ let configPath = null;
 // src/commands/init.ts
-import { readFileSync, writeFileSync, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "fs";
 import { spawnSync } from "child_process";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+var DASHBOARD_URL2 = "https://cordon-server-production.up.railway.app/dashboard/";
 function ensureCordonSdkInstalled(cwd) {
-  if (existsSync2(join2(cwd, "node_modules", "cordon-sdk", "package.json"))) {
+  if (existsSync3(join3(cwd, "node_modules", "cordon-sdk", "package.json"))) {
     return;
   }
-  if (!existsSync2(join2(cwd, "package.json"))) {
-    writeFileSync(
-      join2(cwd, "package.json"),
+  if (!existsSync3(join3(cwd, "package.json"))) {
+    writeFileSync2(
+      join3(cwd, "package.json"),
       JSON.stringify({ name: "cordon-config", version: "0.0.0", private: true }, null, 2) + "\n",
@@ -143,15 +182,15 @@ "utf8"
     candidates.push(
-      join2(homedir2(), "Library", "Application Support", "Claude", "claude_desktop_config.json")
+      join3(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json")
     );
   } else if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? join2(homedir2(), "AppData", "Roaming");
-    candidates.push(join2(appData, "Claude", "claude_desktop_config.json"));
+    const appData = process.env["APPDATA"] ?? join3(homedir3(), "AppData", "Roaming");
+    candidates.push(join3(appData, "Claude", "claude_desktop_config.json"));
   } else {
-    candidates.push(join2(homedir2(), ".config", "Claude", "claude_desktop_config.json"));
+    candidates.push(join3(homedir3(), ".config", "Claude", "claude_desktop_config.json"));
   }
-  return candidates.find((p) => existsSync2(p)) ?? null;
+  return candidates.find((p) => existsSync3(p)) ?? null;
 }
 async function initCommand() {
-  const outputPath = join2(process.cwd(), "cordon.config.ts");
-  if (existsSync2(outputPath)) {
+  const outputPath = join3(process.cwd(), "cordon.config.ts");
+  if (existsSync3(outputPath)) {
     process.stderr.write(
@@ -169,3 +208,3 @@ `\x1B[33mwarn\x1B[0m: cordon.config.ts already exists \u2014 not overwriting.
     try {
-      claudeConfig = JSON.parse(readFileSync(claudePath, "utf8"));
+      claudeConfig = JSON.parse(readFileSync2(claudePath, "utf8"));
     } catch {
@@ -220,3 +259,3 @@ process.stderr.write(`\x1B[33mwarn\x1B[0m: could not parse Claude Desktop config
 `;
-  writeFileSync(outputPath, content, "utf8");
+  writeFileSync2(outputPath, content, "utf8");
   process.stderr.write(`\x1B[32m\u2713\x1B[0m wrote cordon.config.ts
@@ -238,6 +277,6 @@ `);
     const backupPath = `${claudePath}.cordon-backup`;
-    writeFileSync(backupPath, readFileSync(claudePath, "utf8"), "utf8");
+    writeFileSync2(backupPath, readFileSync2(claudePath, "utf8"), "utf8");
     process.stderr.write(`\x1B[32m\u2713\x1B[0m backed up Claude Desktop config to ${backupPath}
 `);
-    writeFileSync(claudePath, JSON.stringify(newClaudeConfig, null, 2), "utf8");
+    writeFileSync2(claudePath, JSON.stringify(newClaudeConfig, null, 2), "utf8");
     process.stderr.write(`\x1B[32m\u2713\x1B[0m patched Claude Desktop config
@@ -271,2 +310,9 @@ `);
   }
+  process.stderr.write(
+    `
+\x1B[36mWant centralized audit logs + Slack approvals?\x1B[0m
+Register a free account at ${DASHBOARD_URL2}?utm_source=cli_init
+`
+  );
+  setState({ welcomed: true });
 }
@@ -273,0 +319,0 @@ export {

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"sources":["../src/commands/start.ts","../src/config-loader.ts","../src/commands/init.ts"],"sourcesContent":["import { CordonGateway } from '@getcordon/core';\nimport type { ResolvedConfig } from 'cordon-sdk';\nimport { emptyConfig, findConfigPath, loadConfig } from '../config-loader.js';\n\ninterface StartOptions {\n  config?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  // Default to an empty server list so auto-install probes (Glama, MCP\n  // registry, fresh `npx -y cordon-cli start`) succeed instead of crashing.\n  // Real users get a loud stderr warning so they don't silently run a no-op.\n  let config: ResolvedConfig = emptyConfig();\n  let configPath: string | null = null;\n\n  try {\n    configPath = await findConfigPath(options.config);\n  } catch (err) {\n    if (options.config) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n    process.stderr.write(\n      '\\x1b[33m[cordon] no cordon.config.ts found — starting with zero upstream servers.\\x1b[0m\\n' +\n        '[cordon] Run `cordon init` to generate a config and connect real MCP servers.\\n',\n    );\n  }\n\n  if (configPath) {\n    process.stderr.write(`[cordon] loading config from ${configPath}\\n`);\n    try {\n      config = await loadConfig(configPath);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  }\n\n  const gateway = new CordonGateway(config);\n\n  const shutdown = async () => {\n    process.stderr.write('\\n[cordon] shutting down...\\n');\n    try {\n      await gateway.stop();\n      process.exit(0);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: shutdown failed: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  };\n\n  process.on('SIGINT', shutdown);\n  process.on('SIGTERM', shutdown);\n\n  try {\n    await gateway.start();\n  } catch (err) {\n    process.stderr.write(`\\x1b[31merror\\x1b[0m: gateway failed: ${String(err)}\\n`);\n    process.exit(1);\n  }\n}\n","import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { createJiti } from 'jiti';\nimport type { CordonConfig, ResolvedConfig } from 'cordon-sdk';\n\nconst SEARCH_PATHS = [\n  () => join(process.cwd(), 'cordon.config.ts'),\n  () => join(process.cwd(), 'cordon.config.js'),\n  () => join(homedir(), '.cordon', 'config.ts'),\n  () => join(homedir(), '.cordon', 'config.js'),\n];\n\nexport async function findConfigPath(explicit?: string): Promise<string> {\n  if (explicit) {\n    if (!existsSync(explicit)) {\n      throw new Error(`Config file not found: ${explicit}`);\n    }\n    return explicit;\n  }\n\n  for (const candidate of SEARCH_PATHS) {\n    const p = candidate();\n    if (existsSync(p)) return p;\n  }\n\n  throw new Error(\n    'No cordon config found. Run `cordon init` to create one, or pass --config <path>.',\n  );\n}\n\nexport async function loadConfig(configPath: string): Promise<ResolvedConfig> {\n  // jiti handles TypeScript config files without requiring a separate compile step\n  const jiti = createJiti(import.meta.url);\n  const mod = await jiti.import(configPath);\n\n  const raw = (mod as { default?: CordonConfig }).default ?? (mod as CordonConfig);\n\n  if (!raw || typeof raw !== 'object' || !Array.isArray(raw.servers)) {\n    throw new Error(\n      `Invalid config at ${configPath}: expected an object with a 'servers' array. ` +\n        `Make sure you are using \\`export default defineConfig({...})\\`.`,\n    );\n  }\n\n  return applyDefaults(raw as CordonConfig);\n}\n\nfunction applyDefaults(config: CordonConfig): ResolvedConfig {\n  return {\n    ...config,\n    audit: config.audit ?? { enabled: true, output: 'stdout' },\n    approvals: config.approvals ?? { channel: 'terminal' },\n  };\n}\n\nexport function emptyConfig(): ResolvedConfig {\n  return applyDefaults({ servers: [] });\n}\n","import { readFileSync, writeFileSync, existsSync } from 'node:fs';\nimport { spawnSync } from 'node:child_process';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\n\nfunction ensureCordonSdkInstalled(cwd: string): void {\n  // Config imports from 'cordon-sdk', and jiti resolves it from the config\n  // file's directory. Without a local install, `cordon start` dies with\n  // \"Cannot find module 'cordon-sdk'\" even when the CLI is global.\n  if (existsSync(join(cwd, 'node_modules', 'cordon-sdk', 'package.json'))) {\n    return;\n  }\n\n  if (!existsSync(join(cwd, 'package.json'))) {\n    writeFileSync(\n      join(cwd, 'package.json'),\n      JSON.stringify({ name: 'cordon-config', version: '0.0.0', private: true }, null, 2) + '\\n',\n      'utf8',\n    );\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m created package.json\\n`);\n  }\n\n  process.stderr.write(`[cordon] installing cordon-sdk...\\n`);\n  const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';\n  const result = spawnSync(npmCmd, ['install', 'cordon-sdk'], {\n    cwd,\n    stdio: ['ignore', 'inherit', 'inherit'],\n  });\n\n  if (result.status === 0) {\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m installed cordon-sdk\\n`);\n  } else {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: could not auto-install cordon-sdk. ` +\n        `Run 'npm install cordon-sdk' in this directory before 'cordon start'.\\n`,\n    );\n  }\n}\n\ninterface ClaudeDesktopConfig {\n  mcpServers?: Record<string, { command: string; args?: string[]; env?: Record<string, string> }>;\n}\n\nfunction getClaudeConfigPath(): string | null {\n  const candidates: string[] = [];\n\n  if (process.platform === 'darwin') {\n    candidates.push(\n      join(homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),\n    );\n  } else if (process.platform === 'win32') {\n    const appData = process.env['APPDATA'] ?? join(homedir(), 'AppData', 'Roaming');\n    candidates.push(join(appData, 'Claude', 'claude_desktop_config.json'));\n  } else {\n    candidates.push(join(homedir(), '.config', 'Claude', 'claude_desktop_config.json'));\n  }\n\n  return candidates.find((p) => existsSync(p)) ?? null;\n}\n\nexport async function initCommand(): Promise<void> {\n  const outputPath = join(process.cwd(), 'cordon.config.ts');\n\n  if (existsSync(outputPath)) {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: cordon.config.ts already exists — not overwriting.\\n`,\n    );\n    process.exit(1);\n  }\n\n  // Try to discover existing MCP servers from Claude Desktop config\n  const claudePath = getClaudeConfigPath();\n  let claudeConfig: ClaudeDesktopConfig = {};\n\n  if (claudePath) {\n    process.stderr.write(`[cordon] found Claude Desktop config at ${claudePath}\\n`);\n    try {\n      claudeConfig = JSON.parse(readFileSync(claudePath, 'utf8')) as ClaudeDesktopConfig;\n    } catch {\n      process.stderr.write(`\\x1b[33mwarn\\x1b[0m: could not parse Claude Desktop config\\n`);\n    }\n  } else {\n    process.stderr.write(\n      `[cordon] no Claude Desktop config found — generating a blank config\\n`,\n    );\n  }\n\n  const servers = Object.entries(claudeConfig.mcpServers ?? {});\n\n  // Generate cordon.config.ts\n  const serverBlocks = servers.length > 0\n    ? servers\n        .map(([name, cfg]) => {\n          const argsStr = cfg.args?.length\n            ? `, args: ${JSON.stringify(cfg.args)}`\n            : '';\n          const envStr =\n            cfg.env && Object.keys(cfg.env).length\n              ? `, env: ${JSON.stringify(cfg.env)}`\n            : '';\n          return `    {\n      name: '${name}',\n      transport: 'stdio',\n      command: '${cfg.command}'${argsStr}${envStr},\n      policy: 'allow',\n      // tools: {\n      //   execute: 'approve',\n      //   delete:  'block',\n      // },\n    },`;\n        })\n        .join('\\n')\n    : `    // {\n    //   name: 'my-server',\n    //   transport: 'stdio',\n    //   command: 'npx',\n    //   args: ['-y', '@my-org/my-mcp-server'],\n    //   policy: 'allow',\n    // },`;\n\n  const content = `import { defineConfig } from 'cordon-sdk';\n\nexport default defineConfig({\n  servers: [\n${serverBlocks}\n  ],\n\n  audit: {\n    enabled: true,\n    output: 'stdout',\n  },\n\n  approvals: {\n    channel: 'terminal',\n    // timeoutMs: 60_000,\n  },\n});\n`;\n\n  writeFileSync(outputPath, content, 'utf8');\n  process.stderr.write(`\\x1b[32m✓\\x1b[0m wrote cordon.config.ts\\n`);\n\n  // The config imports from 'cordon-sdk'. Install it locally so jiti can\n  // resolve it when `cordon start` runs.\n  ensureCordonSdkInstalled(process.cwd());\n\n  // Patch Claude Desktop config to route through cordon\n  if (claudePath && servers.length > 0) {\n    const cordonConfigPath = outputPath.replace(/\\\\/g, '/');\n    // On Windows, Claude Desktop spawns MCP servers via CreateProcess which\n    // won't auto-resolve `npx` without the .cmd extension.\n    const npxCommand = process.platform === 'win32' ? 'npx.cmd' : 'npx';\n\n    const newClaudeConfig: ClaudeDesktopConfig = {\n      ...claudeConfig,\n      mcpServers: {\n        cordon: {\n          command: npxCommand,\n          args: ['-y', 'cordon-cli', 'start', '--config', cordonConfigPath],\n        },\n      },\n    };\n\n    // Backup the original\n    const backupPath = `${claudePath}.cordon-backup`;\n    writeFileSync(backupPath, readFileSync(claudePath, 'utf8'), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m backed up Claude Desktop config to ${backupPath}\\n`);\n\n    writeFileSync(claudePath, JSON.stringify(newClaudeConfig, null, 2), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m patched Claude Desktop config\\n`);\n    process.stderr.write(\n      `\\n\\x1b[36mRestart Claude Desktop to activate Cordon.\\x1b[0m\\n`,\n    );\n  } else if (!claudePath) {\n    process.stderr.write(\n      `\\n\\x1b[33mwarn\\x1b[0m: Claude Desktop config not found on this system.\\n` +\n      `Edit cordon.config.ts, then manually add Cordon to your MCP client config:\\n\\n` +\n      `  \"mcpServers\": {\\n` +\n      `    \"cordon\": {\\n` +\n      `      \"command\": \"${process.platform === 'win32' ? 'npx.cmd' : 'npx'}\",\\n` +\n      `      \"args\": [\"-y\", \"cordon-cli\", \"start\", \"--config\", \"${outputPath.replace(/\\\\/g, '/')}\"]\\n` +\n      `    }\\n` +\n      `  }\\n`,\n    );\n  } else {\n    // claudePath found but no existing servers — config written, no patching needed\n    process.stderr.write(\n      `\\nEdit cordon.config.ts to add your MCP servers, then run \\x1b[36mnpx cordon start\\x1b[0m.\\n`,\n    );\n  }\n}\n"],"mappings":";AAAA,SAAS,qBAAqB;;;ACA9B,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAG3B,IAAM,eAAe;AAAA,EACnB,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAC9C;AAEA,eAAsB,eAAe,UAAoC;AACvE,MAAI,UAAU;AACZ,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,cAAc;AACpC,UAAM,IAAI,UAAU;AACpB,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,WAAW,YAA6C;AAE5E,QAAM,OAAO,WAAW,YAAY,GAAG;AACvC,QAAM,MAAM,MAAM,KAAK,OAAO,UAAU;AAExC,QAAM,MAAO,IAAmC,WAAY;AAE5D,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,IAAI,OAAO,GAAG;AAClE,UAAM,IAAI;AAAA,MACR,qBAAqB,UAAU;AAAA,IAEjC;AAAA,EACF;AAEA,SAAO,cAAc,GAAmB;AAC1C;AAEA,SAAS,cAAc,QAAsC;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,OAAO,SAAS,EAAE,SAAS,MAAM,QAAQ,SAAS;AAAA,IACzD,WAAW,OAAO,aAAa,EAAE,SAAS,WAAW;AAAA,EACvD;AACF;AAEO,SAAS,cAA8B;AAC5C,SAAO,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;AACtC;;;ADlDA,eAAsB,aAAa,SAAsC;AAIvE,MAAI,SAAyB,YAAY;AACzC,MAAI,aAA4B;AAEhC,MAAI;AACF,iBAAa,MAAM,eAAe,QAAQ,MAAM;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,QAAQ,QAAQ;AAClB,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,gCAAgC,UAAU;AAAA,CAAI;AACnE,QAAI;AACF,eAAS,MAAM,WAAW,UAAU;AAAA,IACtC,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,cAAc,MAAM;AAExC,QAAM,WAAW,YAAY;AAC3B,YAAQ,OAAO,MAAM,+BAA+B;AACpD,QAAI;AACF,YAAM,QAAQ,KAAK;AACnB,cAAQ,KAAK,CAAC;AAAA,IAChB,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,0CAA0C,OAAO,GAAG,CAAC;AAAA,CAAI;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAE9B,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,EACtB,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,yCAAyC,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;AE5DA,SAAS,cAAc,eAAe,cAAAA,mBAAkB;AACxD,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AAExB,SAAS,yBAAyB,KAAmB;AAInD,MAAIF,YAAWC,MAAK,KAAK,gBAAgB,cAAc,cAAc,CAAC,GAAG;AACvE;AAAA,EACF;AAEA,MAAI,CAACD,YAAWC,MAAK,KAAK,cAAc,CAAC,GAAG;AAC1C;AAAA,MACEA,MAAK,KAAK,cAAc;AAAA,MACxB,KAAK,UAAU,EAAE,MAAM,iBAAiB,SAAS,SAAS,SAAS,KAAK,GAAG,MAAM,CAAC,IAAI;AAAA,MACtF;AAAA,IACF;AACA,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE;AAEA,UAAQ,OAAO,MAAM;AAAA,CAAqC;AAC1D,QAAM,SAAS,QAAQ,aAAa,UAAU,YAAY;AAC1D,QAAM,SAAS,UAAU,QAAQ,CAAC,WAAW,YAAY,GAAG;AAAA,IAC1D;AAAA,IACA,OAAO,CAAC,UAAU,WAAW,SAAS;AAAA,EACxC,CAAC;AAED,MAAI,OAAO,WAAW,GAAG;AACvB,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IAEF;AAAA,EACF;AACF;AAMA,SAAS,sBAAqC;AAC5C,QAAM,aAAuB,CAAC;AAE9B,MAAI,QAAQ,aAAa,UAAU;AACjC,eAAW;AAAA,MACTA,MAAKC,SAAQ,GAAG,WAAW,uBAAuB,UAAU,4BAA4B;AAAA,IAC1F;AAAA,EACF,WAAW,QAAQ,aAAa,SAAS;AACvC,UAAM,UAAU,QAAQ,IAAI,SAAS,KAAKD,MAAKC,SAAQ,GAAG,WAAW,SAAS;AAC9E,eAAW,KAAKD,MAAK,SAAS,UAAU,4BAA4B,CAAC;AAAA,EACvE,OAAO;AACL,eAAW,KAAKA,MAAKC,SAAQ,GAAG,WAAW,UAAU,4BAA4B,CAAC;AAAA,EACpF;AAEA,SAAO,WAAW,KAAK,CAAC,MAAMF,YAAW,CAAC,CAAC,KAAK;AAClD;AAEA,eAAsB,cAA6B;AACjD,QAAM,aAAaC,MAAK,QAAQ,IAAI,GAAG,kBAAkB;AAEzD,MAAID,YAAW,UAAU,GAAG;AAC1B,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,aAAa,oBAAoB;AACvC,MAAI,eAAoC,CAAC;AAEzC,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,2CAA2C,UAAU;AAAA,CAAI;AAC9E,QAAI;AACF,qBAAe,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AAAA,IAC5D,QAAQ;AACN,cAAQ,OAAO,MAAM;AAAA,CAA8D;AAAA,IACrF;AAAA,EACF,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,QAAQ,aAAa,cAAc,CAAC,CAAC;AAG5D,QAAM,eAAe,QAAQ,SAAS,IAClC,QACG,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;AACpB,UAAM,UAAU,IAAI,MAAM,SACtB,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,KACnC;AACJ,UAAM,SACJ,IAAI,OAAO,OAAO,KAAK,IAAI,GAAG,EAAE,SAC5B,UAAU,KAAK,UAAU,IAAI,GAAG,CAAC,KACnC;AACJ,WAAO;AAAA,eACF,IAAI;AAAA;AAAA,kBAED,IAAI,OAAO,IAAI,OAAO,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,CAAC,EACA,KAAK,IAAI,IACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQJ,QAAM,UAAU;AAAA;AAAA;AAAA;AAAA,EAIhB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeZ,gBAAc,YAAY,SAAS,MAAM;AACzC,UAAQ,OAAO,MAAM;AAAA,CAA2C;AAIhE,2BAAyB,QAAQ,IAAI,CAAC;AAGtC,MAAI,cAAc,QAAQ,SAAS,GAAG;AACpC,UAAM,mBAAmB,WAAW,QAAQ,OAAO,GAAG;AAGtD,UAAM,aAAa,QAAQ,aAAa,UAAU,YAAY;AAE9D,UAAM,kBAAuC;AAAA,MAC3C,GAAG;AAAA,MACH,YAAY;AAAA,QACV,QAAQ;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,MAAM,cAAc,SAAS,YAAY,gBAAgB;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,GAAG,UAAU;AAChC,kBAAc,YAAY,aAAa,YAAY,MAAM,GAAG,MAAM;AAClE,YAAQ,OAAO,MAAM,4DAAuD,UAAU;AAAA,CAAI;AAE1F,kBAAc,YAAY,KAAK,UAAU,iBAAiB,MAAM,CAAC,GAAG,MAAM;AAC1E,YAAQ,OAAO,MAAM;AAAA,CAAkD;AACvE,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF,WAAW,CAAC,YAAY;AACtB,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAIqB,QAAQ,aAAa,UAAU,YAAY,KAAK;AAAA,2DACT,WAAW,QAAQ,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,IAG5F;AAAA,EACF,OAAO;AAEL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF;AACF;","names":["existsSync","join","homedir"]}
+{"version":3,"sources":["../src/commands/start.ts","../src/config-loader.ts","../src/cli-state.ts","../src/commands/init.ts"],"sourcesContent":["import { CordonGateway } from '@getcordon/core';\nimport type { ResolvedConfig } from 'cordon-sdk';\nimport { emptyConfig, findConfigPath, loadConfig } from '../config-loader.js';\nimport { getState, setState } from '../cli-state.js';\n\nconst DASHBOARD_URL = 'https://cordon-server-production.up.railway.app/dashboard/';\n\ninterface StartOptions {\n  config?: string;\n}\n\nexport async function startCommand(options: StartOptions): Promise<void> {\n  if (!getState().welcomed) {\n    process.stderr.write(\n      `\\n\\x1b[36m[cordon] Want centralized audit logs + Slack approvals?\\x1b[0m\\n` +\n      `[cordon] Register at ${DASHBOARD_URL}?utm_source=cli_start\\n\\n`,\n    );\n    setState({ welcomed: true });\n  }\n\n  // Default to an empty server list so auto-install probes (Glama, MCP\n  // registry, fresh `npx -y cordon-cli start`) succeed instead of crashing.\n  // Real users get a loud stderr warning so they don't silently run a no-op.\n  let config: ResolvedConfig = emptyConfig();\n  let configPath: string | null = null;\n\n  try {\n    configPath = await findConfigPath(options.config);\n  } catch (err) {\n    if (options.config) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n    process.stderr.write(\n      '\\x1b[33m[cordon] no cordon.config.ts found — starting with zero upstream servers.\\x1b[0m\\n' +\n        '[cordon] Run `cordon init` to generate a config and connect real MCP servers.\\n',\n    );\n  }\n\n  if (configPath) {\n    process.stderr.write(`[cordon] loading config from ${configPath}\\n`);\n    try {\n      config = await loadConfig(configPath);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  }\n\n  const gateway = new CordonGateway(config);\n\n  const shutdown = async () => {\n    process.stderr.write('\\n[cordon] shutting down...\\n');\n    try {\n      await gateway.stop();\n      process.exit(0);\n    } catch (err) {\n      process.stderr.write(`\\x1b[31merror\\x1b[0m: shutdown failed: ${String(err)}\\n`);\n      process.exit(1);\n    }\n  };\n\n  process.on('SIGINT', shutdown);\n  process.on('SIGTERM', shutdown);\n\n  try {\n    await gateway.start();\n  } catch (err) {\n    process.stderr.write(`\\x1b[31merror\\x1b[0m: gateway failed: ${String(err)}\\n`);\n    process.exit(1);\n  }\n}\n","import { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { createJiti } from 'jiti';\nimport type { CordonConfig, ResolvedConfig } from 'cordon-sdk';\n\nconst SEARCH_PATHS = [\n  () => join(process.cwd(), 'cordon.config.ts'),\n  () => join(process.cwd(), 'cordon.config.js'),\n  () => join(homedir(), '.cordon', 'config.ts'),\n  () => join(homedir(), '.cordon', 'config.js'),\n];\n\nexport async function findConfigPath(explicit?: string): Promise<string> {\n  if (explicit) {\n    if (!existsSync(explicit)) {\n      throw new Error(`Config file not found: ${explicit}`);\n    }\n    return explicit;\n  }\n\n  for (const candidate of SEARCH_PATHS) {\n    const p = candidate();\n    if (existsSync(p)) return p;\n  }\n\n  throw new Error(\n    'No cordon config found. Run `cordon init` to create one, or pass --config <path>.',\n  );\n}\n\nexport async function loadConfig(configPath: string): Promise<ResolvedConfig> {\n  // jiti handles TypeScript config files without requiring a separate compile step\n  const jiti = createJiti(import.meta.url);\n  const mod = await jiti.import(configPath);\n\n  const raw = (mod as { default?: CordonConfig }).default ?? (mod as CordonConfig);\n\n  if (!raw || typeof raw !== 'object' || !Array.isArray(raw.servers)) {\n    throw new Error(\n      `Invalid config at ${configPath}: expected an object with a 'servers' array. ` +\n        `Make sure you are using \\`export default defineConfig({...})\\`.`,\n    );\n  }\n\n  return applyDefaults(raw as CordonConfig);\n}\n\nfunction applyDefaults(config: CordonConfig): ResolvedConfig {\n  return {\n    ...config,\n    audit: config.audit ?? { enabled: true, output: 'stdout' },\n    approvals: config.approvals ?? { channel: 'terminal' },\n  };\n}\n\nexport function emptyConfig(): ResolvedConfig {\n  return applyDefaults({ servers: [] });\n}\n","import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\n\ninterface CliState {\n  welcomed?: boolean;\n}\n\nfunction statePath(): string {\n  return join(homedir(), '.cordon', 'state.json');\n}\n\nexport function getState(): CliState {\n  const path = statePath();\n  if (!existsSync(path)) return {};\n  try {\n    return JSON.parse(readFileSync(path, 'utf8')) as CliState;\n  } catch {\n    return {};\n  }\n}\n\nexport function setState(patch: CliState): void {\n  const path = statePath();\n  const dir = join(homedir(), '.cordon');\n  try {\n    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });\n    const merged = { ...getState(), ...patch };\n    writeFileSync(path, JSON.stringify(merged, null, 2), 'utf8');\n  } catch {\n    // Non-fatal: missing state just means we re-show the banner next time.\n  }\n}\n","import { readFileSync, writeFileSync, existsSync } from 'node:fs';\nimport { spawnSync } from 'node:child_process';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport { setState } from '../cli-state.js';\n\nconst DASHBOARD_URL = 'https://cordon-server-production.up.railway.app/dashboard/';\n\nfunction ensureCordonSdkInstalled(cwd: string): void {\n  // Config imports from 'cordon-sdk', and jiti resolves it from the config\n  // file's directory. Without a local install, `cordon start` dies with\n  // \"Cannot find module 'cordon-sdk'\" even when the CLI is global.\n  if (existsSync(join(cwd, 'node_modules', 'cordon-sdk', 'package.json'))) {\n    return;\n  }\n\n  if (!existsSync(join(cwd, 'package.json'))) {\n    writeFileSync(\n      join(cwd, 'package.json'),\n      JSON.stringify({ name: 'cordon-config', version: '0.0.0', private: true }, null, 2) + '\\n',\n      'utf8',\n    );\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m created package.json\\n`);\n  }\n\n  process.stderr.write(`[cordon] installing cordon-sdk...\\n`);\n  const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';\n  const result = spawnSync(npmCmd, ['install', 'cordon-sdk'], {\n    cwd,\n    stdio: ['ignore', 'inherit', 'inherit'],\n  });\n\n  if (result.status === 0) {\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m installed cordon-sdk\\n`);\n  } else {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: could not auto-install cordon-sdk. ` +\n        `Run 'npm install cordon-sdk' in this directory before 'cordon start'.\\n`,\n    );\n  }\n}\n\ninterface ClaudeDesktopConfig {\n  mcpServers?: Record<string, { command: string; args?: string[]; env?: Record<string, string> }>;\n}\n\nfunction getClaudeConfigPath(): string | null {\n  const candidates: string[] = [];\n\n  if (process.platform === 'darwin') {\n    candidates.push(\n      join(homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),\n    );\n  } else if (process.platform === 'win32') {\n    const appData = process.env['APPDATA'] ?? join(homedir(), 'AppData', 'Roaming');\n    candidates.push(join(appData, 'Claude', 'claude_desktop_config.json'));\n  } else {\n    candidates.push(join(homedir(), '.config', 'Claude', 'claude_desktop_config.json'));\n  }\n\n  return candidates.find((p) => existsSync(p)) ?? null;\n}\n\nexport async function initCommand(): Promise<void> {\n  const outputPath = join(process.cwd(), 'cordon.config.ts');\n\n  if (existsSync(outputPath)) {\n    process.stderr.write(\n      `\\x1b[33mwarn\\x1b[0m: cordon.config.ts already exists — not overwriting.\\n`,\n    );\n    process.exit(1);\n  }\n\n  // Try to discover existing MCP servers from Claude Desktop config\n  const claudePath = getClaudeConfigPath();\n  let claudeConfig: ClaudeDesktopConfig = {};\n\n  if (claudePath) {\n    process.stderr.write(`[cordon] found Claude Desktop config at ${claudePath}\\n`);\n    try {\n      claudeConfig = JSON.parse(readFileSync(claudePath, 'utf8')) as ClaudeDesktopConfig;\n    } catch {\n      process.stderr.write(`\\x1b[33mwarn\\x1b[0m: could not parse Claude Desktop config\\n`);\n    }\n  } else {\n    process.stderr.write(\n      `[cordon] no Claude Desktop config found — generating a blank config\\n`,\n    );\n  }\n\n  const servers = Object.entries(claudeConfig.mcpServers ?? {});\n\n  // Generate cordon.config.ts\n  const serverBlocks = servers.length > 0\n    ? servers\n        .map(([name, cfg]) => {\n          const argsStr = cfg.args?.length\n            ? `, args: ${JSON.stringify(cfg.args)}`\n            : '';\n          const envStr =\n            cfg.env && Object.keys(cfg.env).length\n              ? `, env: ${JSON.stringify(cfg.env)}`\n            : '';\n          return `    {\n      name: '${name}',\n      transport: 'stdio',\n      command: '${cfg.command}'${argsStr}${envStr},\n      policy: 'allow',\n      // tools: {\n      //   execute: 'approve',\n      //   delete:  'block',\n      // },\n    },`;\n        })\n        .join('\\n')\n    : `    // {\n    //   name: 'my-server',\n    //   transport: 'stdio',\n    //   command: 'npx',\n    //   args: ['-y', '@my-org/my-mcp-server'],\n    //   policy: 'allow',\n    // },`;\n\n  const content = `import { defineConfig } from 'cordon-sdk';\n\nexport default defineConfig({\n  servers: [\n${serverBlocks}\n  ],\n\n  audit: {\n    enabled: true,\n    output: 'stdout',\n  },\n\n  approvals: {\n    channel: 'terminal',\n    // timeoutMs: 60_000,\n  },\n});\n`;\n\n  writeFileSync(outputPath, content, 'utf8');\n  process.stderr.write(`\\x1b[32m✓\\x1b[0m wrote cordon.config.ts\\n`);\n\n  // The config imports from 'cordon-sdk'. Install it locally so jiti can\n  // resolve it when `cordon start` runs.\n  ensureCordonSdkInstalled(process.cwd());\n\n  // Patch Claude Desktop config to route through cordon\n  if (claudePath && servers.length > 0) {\n    const cordonConfigPath = outputPath.replace(/\\\\/g, '/');\n    // On Windows, Claude Desktop spawns MCP servers via CreateProcess which\n    // won't auto-resolve `npx` without the .cmd extension.\n    const npxCommand = process.platform === 'win32' ? 'npx.cmd' : 'npx';\n\n    const newClaudeConfig: ClaudeDesktopConfig = {\n      ...claudeConfig,\n      mcpServers: {\n        cordon: {\n          command: npxCommand,\n          args: ['-y', 'cordon-cli', 'start', '--config', cordonConfigPath],\n        },\n      },\n    };\n\n    // Backup the original\n    const backupPath = `${claudePath}.cordon-backup`;\n    writeFileSync(backupPath, readFileSync(claudePath, 'utf8'), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m backed up Claude Desktop config to ${backupPath}\\n`);\n\n    writeFileSync(claudePath, JSON.stringify(newClaudeConfig, null, 2), 'utf8');\n    process.stderr.write(`\\x1b[32m✓\\x1b[0m patched Claude Desktop config\\n`);\n    process.stderr.write(\n      `\\n\\x1b[36mRestart Claude Desktop to activate Cordon.\\x1b[0m\\n`,\n    );\n  } else if (!claudePath) {\n    process.stderr.write(\n      `\\n\\x1b[33mwarn\\x1b[0m: Claude Desktop config not found on this system.\\n` +\n      `Edit cordon.config.ts, then manually add Cordon to your MCP client config:\\n\\n` +\n      `  \"mcpServers\": {\\n` +\n      `    \"cordon\": {\\n` +\n      `      \"command\": \"${process.platform === 'win32' ? 'npx.cmd' : 'npx'}\",\\n` +\n      `      \"args\": [\"-y\", \"cordon-cli\", \"start\", \"--config\", \"${outputPath.replace(/\\\\/g, '/')}\"]\\n` +\n      `    }\\n` +\n      `  }\\n`,\n    );\n  } else {\n    // claudePath found but no existing servers — config written, no patching needed\n    process.stderr.write(\n      `\\nEdit cordon.config.ts to add your MCP servers, then run \\x1b[36mnpx cordon start\\x1b[0m.\\n`,\n    );\n  }\n\n  process.stderr.write(\n    `\\n\\x1b[36mWant centralized audit logs + Slack approvals?\\x1b[0m\\n` +\n    `Register a free account at ${DASHBOARD_URL}?utm_source=cli_init\\n`,\n  );\n  setState({ welcomed: true });\n}\n"],"mappings":";AAAA,SAAS,qBAAqB;;;ACA9B,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAG3B,IAAM,eAAe;AAAA,EACnB,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,IAAI,GAAG,kBAAkB;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAAA,EAC5C,MAAM,KAAK,QAAQ,GAAG,WAAW,WAAW;AAC9C;AAEA,eAAsB,eAAe,UAAoC;AACvE,MAAI,UAAU;AACZ,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,cAAc;AACpC,UAAM,IAAI,UAAU;AACpB,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,WAAW,YAA6C;AAE5E,QAAM,OAAO,WAAW,YAAY,GAAG;AACvC,QAAM,MAAM,MAAM,KAAK,OAAO,UAAU;AAExC,QAAM,MAAO,IAAmC,WAAY;AAE5D,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,IAAI,OAAO,GAAG;AAClE,UAAM,IAAI;AAAA,MACR,qBAAqB,UAAU;AAAA,IAEjC;AAAA,EACF;AAEA,SAAO,cAAc,GAAmB;AAC1C;AAEA,SAAS,cAAc,QAAsC;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,OAAO,SAAS,EAAE,SAAS,MAAM,QAAQ,SAAS;AAAA,IACzD,WAAW,OAAO,aAAa,EAAE,SAAS,WAAW;AAAA,EACvD;AACF;AAEO,SAAS,cAA8B;AAC5C,SAAO,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;AACtC;;;AC1DA,SAAS,cAAc,eAAe,cAAAA,aAAY,iBAAiB;AACnE,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AAMxB,SAAS,YAAoB;AAC3B,SAAOD,MAAKC,SAAQ,GAAG,WAAW,YAAY;AAChD;AAEO,SAAS,WAAqB;AACnC,QAAM,OAAO,UAAU;AACvB,MAAI,CAACF,YAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,SAAS,OAAuB;AAC9C,QAAM,OAAO,UAAU;AACvB,QAAM,MAAMC,MAAKC,SAAQ,GAAG,SAAS;AACrC,MAAI;AACF,QAAI,CAACF,YAAW,GAAG,EAAG,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACxD,UAAM,SAAS,EAAE,GAAG,SAAS,GAAG,GAAG,MAAM;AACzC,kBAAc,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,MAAM;AAAA,EAC7D,QAAQ;AAAA,EAER;AACF;;;AF3BA,IAAM,gBAAgB;AAMtB,eAAsB,aAAa,SAAsC;AACvE,MAAI,CAAC,SAAS,EAAE,UAAU;AACxB,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,uBACwB,aAAa;AAAA;AAAA;AAAA,IACvC;AACA,aAAS,EAAE,UAAU,KAAK,CAAC;AAAA,EAC7B;AAKA,MAAI,SAAyB,YAAY;AACzC,MAAI,aAA4B;AAEhC,MAAI;AACF,iBAAa,MAAM,eAAe,QAAQ,MAAM;AAAA,EAClD,SAAS,KAAK;AACZ,QAAI,QAAQ,QAAQ;AAClB,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,gCAAgC,UAAU;AAAA,CAAI;AACnE,QAAI;AACF,eAAS,MAAM,WAAW,UAAU;AAAA,IACtC,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,cAAc,MAAM;AAExC,QAAM,WAAW,YAAY;AAC3B,YAAQ,OAAO,MAAM,+BAA+B;AACpD,QAAI;AACF,YAAM,QAAQ,KAAK;AACnB,cAAQ,KAAK,CAAC;AAAA,IAChB,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,0CAA0C,OAAO,GAAG,CAAC;AAAA,CAAI;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAE9B,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,EACtB,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,yCAAyC,OAAO,GAAG,CAAC;AAAA,CAAI;AAC7E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;AGvEA,SAAS,gBAAAG,eAAc,iBAAAC,gBAAe,cAAAC,mBAAkB;AACxD,SAAS,iBAAiB;AAC1B,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AAGxB,IAAMC,iBAAgB;AAEtB,SAAS,yBAAyB,KAAmB;AAInD,MAAIC,YAAWC,MAAK,KAAK,gBAAgB,cAAc,cAAc,CAAC,GAAG;AACvE;AAAA,EACF;AAEA,MAAI,CAACD,YAAWC,MAAK,KAAK,cAAc,CAAC,GAAG;AAC1C,IAAAC;AAAA,MACED,MAAK,KAAK,cAAc;AAAA,MACxB,KAAK,UAAU,EAAE,MAAM,iBAAiB,SAAS,SAAS,SAAS,KAAK,GAAG,MAAM,CAAC,IAAI;AAAA,MACtF;AAAA,IACF;AACA,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE;AAEA,UAAQ,OAAO,MAAM;AAAA,CAAqC;AAC1D,QAAM,SAAS,QAAQ,aAAa,UAAU,YAAY;AAC1D,QAAM,SAAS,UAAU,QAAQ,CAAC,WAAW,YAAY,GAAG;AAAA,IAC1D;AAAA,IACA,OAAO,CAAC,UAAU,WAAW,SAAS;AAAA,EACxC,CAAC;AAED,MAAI,OAAO,WAAW,GAAG;AACvB,YAAQ,OAAO,MAAM;AAAA,CAAyC;AAAA,EAChE,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IAEF;AAAA,EACF;AACF;AAMA,SAAS,sBAAqC;AAC5C,QAAM,aAAuB,CAAC;AAE9B,MAAI,QAAQ,aAAa,UAAU;AACjC,eAAW;AAAA,MACTA,MAAKE,SAAQ,GAAG,WAAW,uBAAuB,UAAU,4BAA4B;AAAA,IAC1F;AAAA,EACF,WAAW,QAAQ,aAAa,SAAS;AACvC,UAAM,UAAU,QAAQ,IAAI,SAAS,KAAKF,MAAKE,SAAQ,GAAG,WAAW,SAAS;AAC9E,eAAW,KAAKF,MAAK,SAAS,UAAU,4BAA4B,CAAC;AAAA,EACvE,OAAO;AACL,eAAW,KAAKA,MAAKE,SAAQ,GAAG,WAAW,UAAU,4BAA4B,CAAC;AAAA,EACpF;AAEA,SAAO,WAAW,KAAK,CAAC,MAAMH,YAAW,CAAC,CAAC,KAAK;AAClD;AAEA,eAAsB,cAA6B;AACjD,QAAM,aAAaC,MAAK,QAAQ,IAAI,GAAG,kBAAkB;AAEzD,MAAID,YAAW,UAAU,GAAG;AAC1B,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,aAAa,oBAAoB;AACvC,MAAI,eAAoC,CAAC;AAEzC,MAAI,YAAY;AACd,YAAQ,OAAO,MAAM,2CAA2C,UAAU;AAAA,CAAI;AAC9E,QAAI;AACF,qBAAe,KAAK,MAAMI,cAAa,YAAY,MAAM,CAAC;AAAA,IAC5D,QAAQ;AACN,cAAQ,OAAO,MAAM;AAAA,CAA8D;AAAA,IACrF;AAAA,EACF,OAAO;AACL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,QAAQ,aAAa,cAAc,CAAC,CAAC;AAG5D,QAAM,eAAe,QAAQ,SAAS,IAClC,QACG,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;AACpB,UAAM,UAAU,IAAI,MAAM,SACtB,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,KACnC;AACJ,UAAM,SACJ,IAAI,OAAO,OAAO,KAAK,IAAI,GAAG,EAAE,SAC5B,UAAU,KAAK,UAAU,IAAI,GAAG,CAAC,KACnC;AACJ,WAAO;AAAA,eACF,IAAI;AAAA;AAAA,kBAED,IAAI,OAAO,IAAI,OAAO,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOzC,CAAC,EACA,KAAK,IAAI,IACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQJ,QAAM,UAAU;AAAA;AAAA;AAAA;AAAA,EAIhB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeZ,EAAAF,eAAc,YAAY,SAAS,MAAM;AACzC,UAAQ,OAAO,MAAM;AAAA,CAA2C;AAIhE,2BAAyB,QAAQ,IAAI,CAAC;AAGtC,MAAI,cAAc,QAAQ,SAAS,GAAG;AACpC,UAAM,mBAAmB,WAAW,QAAQ,OAAO,GAAG;AAGtD,UAAM,aAAa,QAAQ,aAAa,UAAU,YAAY;AAE9D,UAAM,kBAAuC;AAAA,MAC3C,GAAG;AAAA,MACH,YAAY;AAAA,QACV,QAAQ;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,MAAM,cAAc,SAAS,YAAY,gBAAgB;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,GAAG,UAAU;AAChC,IAAAA,eAAc,YAAYE,cAAa,YAAY,MAAM,GAAG,MAAM;AAClE,YAAQ,OAAO,MAAM,4DAAuD,UAAU;AAAA,CAAI;AAE1F,IAAAF,eAAc,YAAY,KAAK,UAAU,iBAAiB,MAAM,CAAC,GAAG,MAAM;AAC1E,YAAQ,OAAO,MAAM;AAAA,CAAkD;AACvE,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF,WAAW,CAAC,YAAY;AACtB,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAIqB,QAAQ,aAAa,UAAU,YAAY,KAAK;AAAA,2DACT,WAAW,QAAQ,OAAO,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA,IAG5F;AAAA,EACF,OAAO;AAEL,YAAQ,OAAO;AAAA,MACb;AAAA;AAAA;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,OAAO;AAAA,IACb;AAAA;AAAA,6BAC8BH,cAAa;AAAA;AAAA,EAC7C;AACA,WAAS,EAAE,UAAU,KAAK,CAAC;AAC7B;","names":["existsSync","join","homedir","readFileSync","writeFileSync","existsSync","join","homedir","DASHBOARD_URL","existsSync","join","writeFileSync","homedir","readFileSync"]}

package.json

 {
   "name": "cordon-cli",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "mcpName": "io.github.marras0914/cordon",
@@ -5,0 +5,0 @@ "description": "The security gateway for AI agents — firewall, auditor, and remote control for MCP tool calls",

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

61170

15.73%

Lines of code

628

16.3%

Worsened metrics

Number of low supply chain risk alerts

11

57.14%

No dependency changes