cmd/

The `wardyn audit` command, split out of commands.go at the file-size gate's seam (scripts/check-file-size.sh): one command, its flags, the paging/truncation contract, and the run-scope guard read as one thing here rather than being 100 lines of a 1000-line file.

Command wardyn-aws-sso is Wardyn's in-sandbox AWS SSO credential capture helper.

Command wardyn-git-helper is the git credential helper for Wardyn-governed agent sandboxes.

Command wardyn-proxy is the L2 per-workspace egress sidecar: an HTTP forward proxy that enforces Wardyn's default-deny domain allowlist, method rules, and first-use approval; streams decision logs to the control plane; and injects third-party credentials proxy-side so secrets never enter the sandbox.

Command wardyn-rec is Wardyn's per-workspace PTY session recorder.

Command wardyn-runnerd serves a registered local Docker runner over its outbound, authenticated organisation connection.

Command wardyn-scan is Wardyn's in-sandbox workspace scanner.

Command wardyn-tetragon-ingest is the host-scoped eBPF GROUND-TRUTH sidecar: the SECOND of Wardyn's three advertised audit streams.

wardyn-toolgate is the in-sandbox relay that turns Claude Code's tool-use permission prompts into Wardyn approvals.

The LISTEN-ADDRESS CLASSIFIERS: the one place that answers "what does this bind actually expose", split out of main.go for the 1000-line file-size gate (scripts/check-file-size.sh) when hostname resolution was added.