@connexum/ai-governance 1.0.0-beta.15 → 1.0.0-beta.16

package/dist/cli/index.d.ts

@@ -116,10 +116,46 @@ export interface GovernanceJsonConfig {
  */
 export declare function readLicenseServerUrl(projectDir: string): string;
 export declare function generateConfig(packs: string[], license: LicenseInfo, licenseServerUrl?: string, runtime?: GovernanceJsonConfig['runtime']): GovernanceJsonConfig;
+/**
+ * P0 install-safety guard. Governance is a PROJECT-LOCAL install: hooks are
+ * written to `<projectDir>/.claude/settings.json`. If `init` runs from the
+ * home directory, that path resolves to the GLOBAL Claude Code config
+ * (`~/.claude/settings.json`) and the hooks fire in EVERY project on the
+ * machine — the root cause of the 2026-06-03 global-hook-hang incident, where
+ * audit-logger.sh stacked up and froze Claude Code across all terminals.
+ *
+ * Throws an actionable Error if `projectDir` is the home directory, or if
+ * `<projectDir>/.claude` is the global Claude config dir (honoring a relocated
+ * CLAUDE_CONFIG_DIR). The CLI handler converts the throw into a clean
+ * stderr message + exit 1; calling installHooks directly still fails closed.
+ */
+export declare function assertSafeInstallDir(projectDir: string): void;
 export declare function installHooks(projectDir: string, config: GovernanceJsonConfig): {
     installed: number;
     errors: string[];
 };
+/**
+ * Clean removal escape hatch for `ai-governance uninstall`.
+ *
+ * The 2026-06-03 incident had NO uninstall path, so recovery meant manually
+ * killing processes and `rm -rf`. This:
+ *   1. strips ONLY our hooks from `<projectDir>/.claude/settings.json`
+ *      (identified by a command referencing `<projectDir>/.governance/hooks/`),
+ *      preserving any hooks the user added themselves;
+ *   2. removes the generated hook scripts and `.governance.json`;
+ *   3. PRESERVES the tamper-evident audit chain (`.governance/audit/`) by
+ *      default — it is compliance evidence — deleting it only when `purge` is
+ *      set.
+ *
+ * Idempotent and non-throwing on a project with nothing installed.
+ */
+export declare function uninstallGovernance(projectDir: string, opts?: {
+    purge?: boolean;
+}): {
+    hooksRemoved: number;
+    removedPaths: string[];
+    auditPreserved: string | null;
+};
 /** Structured aiIntegrations block in the nonInteractiveInit JSON output. */
 export interface AiIntegrationsResult {
     claudeCode: {

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAIrC,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyD7E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAA6B,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAWD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC,CA2EhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,IAAI,CAsBjH;AA0BD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,QAAQ,GACR,UAAU,GACV,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,SAAS,CAAC;AAEd,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAoBzD;AAkBD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAyCrE;AAsBD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,oBAAoB,CA8BtB;AAGD,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAuEtH;AAylBD,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE;QACV,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAwFrE;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAmEtE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CA4CtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqC9D;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CA0DnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAkCvF;AAGD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAmEf;AAuED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;KAAE,CAAC,CAAC;IACzG,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,oBAAoB,CA0DvB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CA6QrE;AA6JD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,aAAa,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,IAAI,CA0GN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAIrC,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyD7E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAA6B,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAWD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC,CA2EhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,IAAI,CAsBjH;AAmDD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,QAAQ,GACR,UAAU,GACV,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,SAAS,CAAC;AAEd,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAoBzD;AAkBD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAyCrE;AAsBD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,oBAAoB,CA8BtB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAgC7D;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CA0EtH;AAsFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAsEjF;AA0iBD,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE;QACV,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAwFrE;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAmEtE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CA4CtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqC9D;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CA0DnF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAkCvF;AAGD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAmEf;AAuED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;KAAE,CAAC,CAAC;IACzG,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,oBAAoB,CA0DvB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CA6QrE;AA6JD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,aAAa,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,IAAI,CA0GN"}

package/dist/cli/index.js

@@ -55,7 +55,9 @@ exports.detectIde = detectIde;
 exports.validateLegacyLicense = validateLegacyLicense;
 exports.readLicenseServerUrl = readLicenseServerUrl;
 exports.generateConfig = generateConfig;
+exports.assertSafeInstallDir = assertSafeInstallDir;
 exports.installHooks = installHooks;
+exports.uninstallGovernance = uninstallGovernance;
 exports.writeClaudeSlashCommands = writeClaudeSlashCommands;
 exports.writeGovernanceScannerAgent = writeGovernanceScannerAgent;
 exports.writeCursorGovernanceRules = writeCursorGovernanceRules;
@@ -68,6 +70,7 @@ exports.verifyChain = verifyChain;
 exports.generateAutowrapArtifacts = generateAutowrapArtifacts;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const os = __importStar(require("os"));
 const crypto = __importStar(require("crypto"));
 const readline = __importStar(require("readline"));
 const https = __importStar(require("https"));
@@ -311,6 +314,31 @@ const IS_WINDOWS = process.platform === 'win32';
 const HOOK_EXT = IS_WINDOWS ? '.ps1' : '.sh';
 const HOOK_RUNNER = IS_WINDOWS ? 'pwsh' : 'bash';
 const HOOK_SUBDIR = IS_WINDOWS ? 'powershell' : '';
+// P0 no-hang bound. Every generated hook carries this timeout (seconds) so a
+// hook can never block the agent's tool call — the 2026-06-03 incident had a
+// hung audit-logger.sh stack up for >1h because the entries had no timeout.
+// Enforced two ways: the host honors the `timeout` field, and where a coreutils
+// timeout binary exists the command self-limits via `timeout -k`. Honors
+// Invariant 2 (advisory, never in the synchronous critical path).
+const HOOK_TIMEOUT_SECONDS = 10;
+// Resolve a coreutils timeout binary present on this machine: GNU `timeout`
+// (Linux) or `gtimeout` (macOS + coreutils). Returns null on Windows or when
+// neither exists (a default macOS) — callers must then NOT wrap the command in
+// it, or the hook would fail with "command not found" and silently not run.
+function resolveTimeoutBin() {
+    if (IS_WINDOWS)
+        return null;
+    const { spawnSync } = require('node:child_process');
+    for (const bin of ['timeout', 'gtimeout']) {
+        try {
+            if (spawnSync('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' }).status === 0) {
+                return bin;
+            }
+        }
+        catch { /* fall through */ }
+    }
+    return null;
+}
 function detectIde(projectDir) {
     const markers = [
         { dir: '.claude', ide: 'claude-code' },
@@ -508,7 +536,52 @@ function generateConfig(packs, license, licenseServerUrl, runtime) {
     };
 }
 // --- Hook installation ---
+/**
+ * P0 install-safety guard. Governance is a PROJECT-LOCAL install: hooks are
+ * written to `<projectDir>/.claude/settings.json`. If `init` runs from the
+ * home directory, that path resolves to the GLOBAL Claude Code config
+ * (`~/.claude/settings.json`) and the hooks fire in EVERY project on the
+ * machine — the root cause of the 2026-06-03 global-hook-hang incident, where
+ * audit-logger.sh stacked up and froze Claude Code across all terminals.
+ *
+ * Throws an actionable Error if `projectDir` is the home directory, or if
+ * `<projectDir>/.claude` is the global Claude config dir (honoring a relocated
+ * CLAUDE_CONFIG_DIR). The CLI handler converts the throw into a clean
+ * stderr message + exit 1; calling installHooks directly still fails closed.
+ */
+function assertSafeInstallDir(projectDir) {
+    // Resolve symlinks so a link pointing at $HOME can't slip past a string-only
+    // comparison (review S1). realpathSync throws ENOENT for a path that doesn't
+    // exist yet — fall back to lexical resolution then (a non-existent dir can't
+    // be a symlink to home).
+    const real = (p) => {
+        try {
+            return fs.realpathSync(p);
+        }
+        catch {
+            return path.resolve(p);
+        }
+    };
+    const resolved = real(projectDir);
+    const home = real(os.homedir());
+    if (resolved === home) {
+        throw new Error(`Refusing to install governance into your home directory (${home}).\n` +
+            `That would write hooks into your GLOBAL Claude Code config ` +
+            `(~/.claude/settings.json) and run them in every project on this machine.\n` +
+            `cd into a specific project (one with package.json or .git) and run ` +
+            `'ai-governance init' there.`);
+    }
+    const globalClaudeDir = real(process.env['CLAUDE_CONFIG_DIR'] || path.join(home, '.claude'));
+    if (path.join(resolved, '.claude') === globalClaudeDir) {
+        throw new Error(`Refusing to install: ${path.join(projectDir, '.claude')} is your global ` +
+            `Claude config directory. Governance must be installed into a project, not ` +
+            `globally, or its hooks run in every project on this machine.\n` +
+            `cd into a specific project and run 'ai-governance init' there.`);
+    }
+}
 function installHooks(projectDir, config) {
+    // Fail closed before any scaffolding: never poison the global Claude config.
+    assertSafeInstallDir(projectDir);
     const errors = [];
     let installed = 0;
     // Find the package's hooks directory (bash or powershell based on OS)
@@ -585,13 +658,27 @@ function installClaudeCodeSettings(projectDir, config, hooksDestDir) {
         fs.mkdirSync(claudeSettingsDir, { recursive: true });
     }
     const settingsFile = path.join(claudeSettingsDir, 'settings.json');
-    const buildBlock = (hookFile) => ({
-        matcher: '*',
-        hooks: [{
-                type: 'command',
-                command: `${HOOK_RUNNER} "${path.join(hooksDestDir, hookFile)}"`,
-            }],
-    });
+    // Resolve a coreutils timeout binary on THIS machine (init runs on the
+    // customer's box, same OS as runtime). GNU `timeout` ships on Linux;
+    // `gtimeout` is the macOS+coreutils name; a default macOS has neither and
+    // Windows has none. When present we wrap the hook command as a hard
+    // self-limit; when absent we emit the plain command and rely solely on the
+    // host-enforced `timeout` field below — never a hard dependency on a binary
+    // that may be missing (which would make the hook fail to run).
+    const timeoutBin = resolveTimeoutBin();
+    const buildBlock = (hookFile) => {
+        const hookPath = path.join(hooksDestDir, hookFile);
+        // `-k 2` escalates to SIGKILL 2s after SIGTERM. Both layers honor
+        // Invariant 2: the host-enforced `timeout` field bounds the hook on every
+        // platform; the wrapper adds a process-level self-limit where available.
+        const command = timeoutBin
+            ? `${timeoutBin} -k 2 ${HOOK_TIMEOUT_SECONDS} ${HOOK_RUNNER} "${hookPath}"`
+            : `${HOOK_RUNNER} "${hookPath}"`;
+        return {
+            matcher: '*',
+            hooks: [{ type: 'command', command, timeout: HOOK_TIMEOUT_SECONDS }],
+        };
+    };
     const preEntries = config.hooks.preToolUse.map(buildBlock);
     const postEntries = config.hooks.postToolUse.map(buildBlock);
     let settings = {};
@@ -604,13 +691,119 @@ function installClaudeCodeSettings(projectDir, config, hooksDestDir) {
     const existingHooks = (settings['hooks'] && typeof settings['hooks'] === 'object' && !Array.isArray(settings['hooks']))
         ? settings['hooks']
         : {};
+    // Merge, never clobber. A previous version replaced the whole
+    // PreToolUse/PostToolUse arrays, which wiped any hooks the user added and
+    // made re-running `init` destructive. Keep the user's hooks, drop only our
+    // own previous entries (identified by a command referencing this project's
+    // hooks dir), then append the fresh set — idempotent, no duplicates.
+    // Match on the hooks dir WITH a trailing separator so a sibling like
+    // `.governance/hooks-extra/` is not mistaken for ours (review S2). Generated
+    // commands always reference `<hooksDestDir>/<file>`, so the separator is
+    // present for our entries.
+    const ourHooksPrefix = hooksDestDir + path.sep;
+    const isOurs = (block) => {
+        const inner = block?.hooks;
+        return Array.isArray(inner) && inner.some((h) => typeof h?.command === 'string' &&
+            (h.command).includes(ourHooksPrefix));
+    };
+    const mergeEvent = (existing, fresh) => [
+        ...(Array.isArray(existing) ? existing.filter((b) => !isOurs(b)) : []),
+        ...fresh,
+    ];
     settings['hooks'] = {
         ...existingHooks,
-        PreToolUse: preEntries,
-        PostToolUse: postEntries,
+        PreToolUse: mergeEvent(existingHooks['PreToolUse'], preEntries),
+        PostToolUse: mergeEvent(existingHooks['PostToolUse'], postEntries),
     };
     fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2));
 }
+/**
+ * Clean removal escape hatch for `ai-governance uninstall`.
+ *
+ * The 2026-06-03 incident had NO uninstall path, so recovery meant manually
+ * killing processes and `rm -rf`. This:
+ *   1. strips ONLY our hooks from `<projectDir>/.claude/settings.json`
+ *      (identified by a command referencing `<projectDir>/.governance/hooks/`),
+ *      preserving any hooks the user added themselves;
+ *   2. removes the generated hook scripts and `.governance.json`;
+ *   3. PRESERVES the tamper-evident audit chain (`.governance/audit/`) by
+ *      default — it is compliance evidence — deleting it only when `purge` is
+ *      set.
+ *
+ * Idempotent and non-throwing on a project with nothing installed.
+ */
+function uninstallGovernance(projectDir, opts = {}) {
+    const removedPaths = [];
+    let hooksRemoved = 0;
+    const govDir = path.join(projectDir, '.governance');
+    const govHooksDir = path.join(govDir, 'hooks');
+    // 1. Strip our hooks from .claude/settings.json, keeping the user's own.
+    const settingsFile = path.join(projectDir, '.claude', 'settings.json');
+    if (fs.existsSync(settingsFile)) {
+        try {
+            const settings = JSON.parse(fs.readFileSync(settingsFile, 'utf-8'));
+            const hooks = settings['hooks'];
+            if (hooks && typeof hooks === 'object' && !Array.isArray(hooks)) {
+                const hookMap = hooks;
+                for (const event of ['PreToolUse', 'PostToolUse']) {
+                    const arr = hookMap[event];
+                    if (!Array.isArray(arr))
+                        continue;
+                    // Trailing separator so a sibling like `.governance/hooks-extra/` is
+                    // not removed as ours (review S2). Our commands reference
+                    // `<govHooksDir>/<file>`, so the separator is present for our entries.
+                    const ourHooksPrefix = govHooksDir + path.sep;
+                    hookMap[event] = arr.filter((block) => {
+                        const inner = block?.hooks;
+                        const isOurs = Array.isArray(inner) && inner.some((h) => typeof h?.command === 'string' &&
+                            (h.command).includes(ourHooksPrefix));
+                        if (isOurs)
+                            hooksRemoved++;
+                        return !isOurs;
+                    });
+                }
+                fs.writeFileSync(settingsFile, JSON.stringify(settings, null, 2));
+            }
+        }
+        catch {
+            // Malformed settings.json: leave it untouched for the user to inspect.
+        }
+    }
+    // 2. Remove the runtime config file (carries serviceToken etc.).
+    const cfg = path.join(projectDir, '.governance.json');
+    if (fs.existsSync(cfg)) {
+        fs.rmSync(cfg, { force: true });
+        removedPaths.push(cfg);
+    }
+    // 3. Remove generated artifacts; preserve the audit chain unless purging.
+    let auditPreserved = null;
+    if (fs.existsSync(govDir)) {
+        const auditDir = path.join(govDir, 'audit');
+        const hasAudit = !opts.purge && fs.existsSync(auditDir) &&
+            fs.readdirSync(auditDir).length > 0;
+        if (opts.purge) {
+            fs.rmSync(govDir, { recursive: true, force: true });
+            removedPaths.push(govDir);
+        }
+        else {
+            for (const entry of fs.readdirSync(govDir)) {
+                if (entry === 'audit' && hasAudit)
+                    continue;
+                const p = path.join(govDir, entry);
+                fs.rmSync(p, { recursive: true, force: true });
+                removedPaths.push(p);
+            }
+            if (hasAudit) {
+                auditPreserved = auditDir;
+            }
+            else if (fs.readdirSync(govDir).length === 0) {
+                fs.rmSync(govDir, { recursive: true, force: true });
+                removedPaths.push(govDir);
+            }
+        }
+    }
+    return { hooksRemoved, removedPaths, auditPreserved };
+}
 const IDE_RULES_SPECS = {
     cursor: {
         ideKey: 'cursor',
@@ -2116,6 +2309,8 @@ Usage:
   ai-governance verify-chain <logDir>        Verify audit chain integrity (standalone)
     [--json]                                 Output machine-readable JSON
   ai-governance status                       Show governance status
+  ai-governance uninstall                    Cleanly remove governance from this project
+    [--purge]                                Also delete the audit chain (default: preserved)
   ai-governance discover                     Scan project + push signed manifests
     --root <path>                            Project directory to scan
     --org-id <org>                           Organisation identifier
@@ -2190,6 +2385,15 @@ Connexum Network Inc.
 if (isDirectRun) {
     const projectDir = process.cwd();
     if (command === 'init') {
+        // P0: refuse to scaffold into the home dir / global Claude config before
+        // doing any provisioning. Friendly message instead of a deep stack trace.
+        try {
+            assertSafeInstallDir(projectDir);
+        }
+        catch (e) {
+            process.stderr.write(`[CLI] ${e.message}\n`);
+            process.exit(1);
+        }
         const ciMode = args.includes('--ci');
         // S-07: Parse vendor code flags
         const vendorCodeIdx = args.indexOf('--vendor-code');
@@ -2662,6 +2866,23 @@ if (isDirectRun) {
     else if (command === 'status') {
         showStatus(projectDir);
     }
+    else if (command === 'uninstall') {
+        // Clean removal escape hatch. Strips our hooks from .claude/settings.json
+        // (keeping the user's own), removes generated scripts + .governance.json,
+        // and preserves the audit chain unless --purge.
+        const purge = args.includes('--purge');
+        const result = uninstallGovernance(projectDir, { purge });
+        process.stdout.write(`[CLI] Removed ${result.hooksRemoved} governance hook(s) from .claude/settings.json\n`);
+        for (const p of result.removedPaths) {
+            process.stdout.write(`[CLI] Removed ${p}\n`);
+        }
+        if (result.auditPreserved) {
+            process.stdout.write(`[CLI] Audit chain preserved at ${result.auditPreserved} ` +
+                `(re-run with --purge to delete it too).\n`);
+        }
+        process.stdout.write('[CLI] Governance uninstalled. Restart Claude Code for the change to take effect.\n');
+        process.exit(0);
+    }
     else if (command === 'packs') {
         // W2: per-project pack selection CLI subcommand
         Promise.resolve().then(() => __importStar(require('./packs.js'))).then(({ runPacksCommand }) => {