@chainpatrol/cli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @chainpatrol/cli
 
+## 0.7.0
+
+### Minor Changes
+
+- c170343: Add `chainpatrol setup --cloud` flag that also installs a Claude Code
+  SessionStart hook at `~/.claude/hooks/chainpatrol-login.sh` and registers
+  it in `~/.claude/settings.json`. When the user has no chainpatrol
+  credentials, the hook emits SessionStart `additionalContext` so Claude
+  surfaces the device-code login URL on the first user turn — useful for
+  cloud Claude Code environments that can't run the interactive login from
+  a container startup script. The hook is a silent no-op once the user is
+  authenticated. Local installs (without `--cloud`) leave Claude Code
+  hooks untouched. `chainpatrol uninstall` always removes the hook if
+  present, without disturbing unrelated hooks or settings.
+
 ## 0.6.0
 
 ### Minor Changes

package/dist/{chunk-XOXQPUR6.js → chunk-ZN3VMRWG.js}

@@ -4,13 +4,125 @@ import {
 } from "./chunk-IUZB3DQW.js";
 
 // src/commands/setup-skill.ts
-import { mkdirSync, writeFileSync, existsSync, readFileSync as readFileSync2, rmSync } from "fs";
-import { join } from "path";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+
+// src/commands/login-hook.ts
+import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync } from "fs";
 import { homedir } from "os";
+import { join, dirname } from "path";
+var CLAUDE_DIR = join(homedir(), ".claude");
+var HOOK_DIR = join(CLAUDE_DIR, "hooks");
+var HOOK_FILE = join(HOOK_DIR, "chainpatrol-login.sh");
+var SETTINGS_FILE = join(CLAUDE_DIR, "settings.json");
+var HOOK_SCRIPT = `#!/bin/bash
+# chainpatrol auto-login hook \u2014 installed by \`chainpatrol setup\`.
+# On Claude Code session start, if the user has no chainpatrol credentials,
+# emit additionalContext so Claude surfaces the device-code login URL on
+# the first user turn. Safe to run repeatedly: no-ops once authenticated.
+set -uo pipefail
+
+CONFIG_DIR="\${CHAINPATROL_CONFIG_DIR:-$HOME/.chainpatrol}"
+if [ -s "$CONFIG_DIR/credentials.json" ]; then
+  exit 0
+fi
+
+# Only nudge when the CLI is reachable \u2014 otherwise we'd ask Claude to run
+# a command that isn't installed.
+if ! command -v chainpatrol >/dev/null 2>&1 \\
+   && [ ! -x /usr/local/bin/chainpatrol ] \\
+   && ! ls /opt/node*/bin/chainpatrol >/dev/null 2>&1; then
+  exit 0
+fi
+
+cat <<'JSON'
+{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"chainpatrol auto-login: the user is not authenticated with ChainPatrol (no credentials.json found). If the user's task involves ChainPatrol or the chainpatrol CLI, start \`chainpatrol login\` in the background per the /chainpatrol skill's headless runbook (background + tail /tmp/cp-login.out) and surface the verification URL before doing anything else. If the user's task is unrelated, ignore this notice."}}
+JSON
+exit 0
+`;
+function installLoginHook() {
+  mkdirSync(HOOK_DIR, { recursive: true });
+  const hookWritten = !existsSync(HOOK_FILE) || readFileSync(HOOK_FILE, "utf-8") !== HOOK_SCRIPT;
+  if (hookWritten) {
+    writeFileSync(HOOK_FILE, HOOK_SCRIPT, { mode: 493 });
+  }
+  const settingsUpdated = registerHookInSettings();
+  return {
+    hookPath: HOOK_FILE,
+    hookWritten,
+    settingsPath: SETTINGS_FILE,
+    settingsUpdated
+  };
+}
+function uninstallLoginHook() {
+  let hookRemoved = false;
+  if (existsSync(HOOK_FILE)) {
+    unlinkSync(HOOK_FILE);
+    hookRemoved = true;
+  }
+  const settingsUpdated = unregisterHookFromSettings();
+  return { hookRemoved, settingsUpdated };
+}
+function readSettings() {
+  if (!existsSync(SETTINGS_FILE)) return {};
+  const raw = readFileSync(SETTINGS_FILE, "utf-8");
+  if (raw.trim() === "") return {};
+  return JSON.parse(raw);
+}
+function writeSettings(settings) {
+  mkdirSync(dirname(SETTINGS_FILE), { recursive: true });
+  writeFileSync(SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n", {
+    mode: 420
+  });
+}
+function hasHookEntry(settings) {
+  const matchers = settings.hooks?.SessionStart;
+  if (!Array.isArray(matchers)) return false;
+  return matchers.some(
+    (matcher) => Array.isArray(matcher?.hooks) && matcher.hooks.some((h) => h?.command === HOOK_FILE)
+  );
+}
+function registerHookInSettings() {
+  const settings = readSettings();
+  if (hasHookEntry(settings)) return false;
+  const hooks = settings.hooks ??= {};
+  const sessionStart = hooks.SessionStart ??= [];
+  sessionStart.push({
+    hooks: [{ type: "command", command: HOOK_FILE }]
+  });
+  writeSettings(settings);
+  return true;
+}
+function unregisterHookFromSettings() {
+  if (!existsSync(SETTINGS_FILE)) return false;
+  const settings = readSettings();
+  const sessionStart = settings.hooks?.SessionStart;
+  if (!Array.isArray(sessionStart)) return false;
+  let changed = false;
+  const filtered = sessionStart.map((matcher) => {
+    if (!Array.isArray(matcher?.hooks)) return matcher;
+    const remaining = matcher.hooks.filter((h) => h?.command !== HOOK_FILE);
+    if (remaining.length === matcher.hooks.length) return matcher;
+    changed = true;
+    return remaining.length > 0 ? { ...matcher, hooks: remaining } : null;
+  }).filter((m) => m !== null);
+  if (!changed) return false;
+  if (filtered.length === 0) {
+    delete settings.hooks.SessionStart;
+    if (Object.keys(settings.hooks).length === 0) {
+      delete settings.hooks;
+    }
+  } else {
+    settings.hooks.SessionStart = filtered;
+  }
+  writeSettings(settings);
+  return true;
+}
 
 // src/lib/version.ts
-import { readFileSync } from "fs";
-import { dirname, resolve } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, resolve } from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "@chainpatrol/cli";
 var cached;
@@ -21,7 +133,7 @@ function getCliVersion() {
 }
 function resolveCliVersion() {
   try {
-    const here = dirname(fileURLToPath(import.meta.url));
+    const here = dirname2(fileURLToPath(import.meta.url));
     const candidates = [
       resolve(here, "..", "package.json"),
       resolve(here, "..", "..", "package.json")
@@ -36,7 +148,7 @@ function resolveCliVersion() {
 }
 function tryReadVersion(path) {
   try {
-    const raw = readFileSync(path, "utf-8");
+    const raw = readFileSync2(path, "utf-8");
     const pkg = JSON.parse(raw);
     if (pkg.name === PACKAGE_NAME && typeof pkg.version === "string") {
       return pkg.version;
@@ -66,8 +178,8 @@ function compareVersions(a, b) {
 }
 
 // src/commands/setup-skill.ts
-var SKILL_DIR = join(homedir(), ".claude", "skills", "chainpatrol");
-var SKILL_FILE = join(SKILL_DIR, "SKILL.md");
+var SKILL_DIR = join2(homedir2(), ".claude", "skills", "chainpatrol");
+var SKILL_FILE = join2(SKILL_DIR, "SKILL.md");
 function buildSkillContent(version) {
   return `---
 name: chainpatrol
@@ -971,16 +1083,16 @@ function getBundledSkillContent() {
   return buildSkillContent(getCliVersion());
 }
 function readInstalledSkillVersion() {
-  if (!existsSync(SKILL_FILE)) return void 0;
+  if (!existsSync2(SKILL_FILE)) return void 0;
   try {
-    const raw = readFileSync2(SKILL_FILE, "utf-8");
+    const raw = readFileSync3(SKILL_FILE, "utf-8");
     return parseSkillVersion(raw);
   } catch {
     return void 0;
   }
 }
 function isSkillInstalled() {
-  return existsSync(SKILL_FILE);
+  return existsSync2(SKILL_FILE);
 }
 function parseSkillVersion(content) {
   const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -1001,66 +1113,94 @@ var LOGO = `
 `;
 function setupSkill(options) {
   const skillContent = buildSkillContent(getCliVersion());
-  const alreadyExists = existsSync(SKILL_FILE);
-  if (alreadyExists) {
-    const existing = readFileSync2(SKILL_FILE, "utf-8");
-    if (existing === skillContent) {
-      if (options.json) {
-        console.log(JSON.stringify({ status: "up-to-date", path: SKILL_FILE }));
-      } else {
-        console.log("Claude Code skill is already up to date.");
-      }
-      return;
-    }
+  const skillAlreadyExists = existsSync2(SKILL_FILE);
+  const skillUpToDate = skillAlreadyExists && readFileSync3(SKILL_FILE, "utf-8") === skillContent;
+  let skillStatus;
+  if (!skillAlreadyExists) {
+    mkdirSync2(SKILL_DIR, { recursive: true });
+    writeFileSync2(SKILL_FILE, skillContent, { mode: 420 });
+    skillStatus = "installed";
+  } else if (!skillUpToDate) {
+    writeFileSync2(SKILL_FILE, skillContent, { mode: 420 });
+    skillStatus = "updated";
+  } else {
+    skillStatus = "up-to-date";
   }
-  mkdirSync(SKILL_DIR, { recursive: true });
-  writeFileSync(SKILL_FILE, skillContent, { mode: 420 });
   const completionResult = installCompletions();
+  const loginHookResult = options.cloud ? installLoginHook() : null;
+  const completionsChanged = completionResult.installed || completionResult.configuredShellRc;
+  const loginHookChanged = loginHookResult != null && (loginHookResult.hookWritten || loginHookResult.settingsUpdated);
+  const overallStatus = skillStatus !== "up-to-date" ? skillStatus : completionsChanged || loginHookChanged ? "updated" : "up-to-date";
   if (options.json) {
     console.log(
       JSON.stringify({
-        status: alreadyExists ? "updated" : "installed",
+        status: overallStatus,
         path: SKILL_FILE,
-        completions: completionResult
+        skill: { status: skillStatus, path: SKILL_FILE },
+        completions: completionResult,
+        loginHook: loginHookResult
       })
     );
-  } else {
-    console.log(LOGO);
+    return;
+  }
+  if (overallStatus === "up-to-date") {
+    console.log("Claude Code skill, completions, and login hook are already up to date.");
+    return;
+  }
+  console.log(LOGO);
+  if (skillStatus === "installed") {
+    console.log(`Installed Claude Code skill at ${SKILL_FILE}`);
+  } else if (skillStatus === "updated") {
+    console.log(`Updated Claude Code skill at ${SKILL_FILE}`);
+  }
+  console.log("You can now use /chainpatrol in Claude Code from any project.");
+  if (loginHookChanged && loginHookResult) {
+    console.log(`Installed auto-login hook at ${loginHookResult.hookPath}`);
+    if (loginHookResult.settingsUpdated) {
+      console.log(`Registered SessionStart hook in ${loginHookResult.settingsPath}`);
+    }
+  }
+  if (completionResult.installed) {
     console.log(
-      alreadyExists ? `Updated Claude Code skill at ${SKILL_FILE}` : `Installed Claude Code skill at ${SKILL_FILE}`
+      `Installed ${completionResult.shell} completions at ${completionResult.path}`
     );
-    console.log("You can now use /chainpatrol in Claude Code from any project.");
-    if (completionResult.installed) {
-      console.log(
-        `Installed ${completionResult.shell} completions at ${completionResult.path}`
-      );
-      if (completionResult.configuredShellRc) {
-        console.log("Added completion config to ~/.zshrc");
-      }
-      console.log('Run "exec zsh" or open a new terminal to enable tab completion.');
+    if (completionResult.configuredShellRc) {
+      console.log("Added completion config to ~/.zshrc");
     }
+    console.log('Run "exec zsh" or open a new terminal to enable tab completion.');
   }
 }
 function uninstallSkill(options) {
-  if (!existsSync(SKILL_FILE)) {
-    if (options.json) {
-      console.log(JSON.stringify({ status: "not-installed" }));
-    } else {
-      console.log("Claude Code skill is not installed.");
-    }
-    return;
+  const skillInstalled = existsSync2(SKILL_FILE);
+  if (skillInstalled) {
+    rmSync(SKILL_DIR, { recursive: true });
   }
-  rmSync(SKILL_DIR, { recursive: true });
   const removedCompletions = uninstallCompletions();
+  const loginHookResult = uninstallLoginHook();
+  const removedAnything = skillInstalled || removedCompletions || loginHookResult.hookRemoved || loginHookResult.settingsUpdated;
   if (options.json) {
     console.log(
-      JSON.stringify({ status: "uninstalled", path: SKILL_FILE, removedCompletions })
+      JSON.stringify({
+        status: removedAnything ? "uninstalled" : "not-installed",
+        path: SKILL_FILE,
+        removedCompletions,
+        loginHook: loginHookResult
+      })
     );
-  } else {
+    return;
+  }
+  if (!removedAnything) {
+    console.log("Claude Code skill is not installed.");
+    return;
+  }
+  if (skillInstalled) {
     console.log("Removed Claude Code skill from " + SKILL_DIR);
-    if (removedCompletions) {
-      console.log("Removed shell completions.");
-    }
+  }
+  if (loginHookResult.hookRemoved || loginHookResult.settingsUpdated) {
+    console.log("Removed chainpatrol auto-login hook.");
+  }
+  if (removedCompletions) {
+    console.log("Removed shell completions.");
   }
 }
 

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-XOXQPUR6.js";
+} from "./chunk-ZN3VMRWG.js";
 import "./chunk-IUZB3DQW.js";
 import {
   DateTime
@@ -354,7 +354,10 @@ var HELP = {
   },
   setup: {
     description: "Install Claude Code skill and shell completions.",
-    usage: "chainpatrol setup"
+    usage: "chainpatrol setup [--cloud]",
+    options: [
+      "--cloud              Also install a SessionStart hook that surfaces the device-code login URL when the user is not authenticated. Intended for Claude Code cloud / headless environments; omit for local installs."
+    ]
   },
   uninstall: {
     description: "Remove Claude Code skill and shell completions.",
@@ -651,7 +654,8 @@ ${getTopLevelHelp()}
     version: { type: "boolean", shortFlag: "V" },
     quiet: { type: "boolean", default: false, shortFlag: "q" },
     noInput: { type: "boolean", default: false },
-    noColor: { type: "boolean", default: false }
+    noColor: { type: "boolean", default: false },
+    cloud: { type: "boolean", default: false }
   }
 });
 var [command, subcommand, action] = cli.input;
@@ -1148,12 +1152,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-BTR2IZ4E.js");
-      setupSkill({ json: jsonMode });
+      const { setupSkill } = await import("./setup-skill-J7PZYVCE.js");
+      setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-BTR2IZ4E.js");
+      const { uninstallSkill } = await import("./setup-skill-J7PZYVCE.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{setup-skill-BTR2IZ4E.js → setup-skill-J7PZYVCE.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-XOXQPUR6.js";
+} from "./chunk-ZN3VMRWG.js";
 import "./chunk-IUZB3DQW.js";
 export {
   getBundledSkillContent,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [