@golproductions/check 2.4.1

package/LICENSE

@@ -0,0 +1,27 @@
+GOL Productions Proprietary License
+
+Copyright (c) 2026 GOL Productions. All rights reserved.
+
+This software is the proprietary product of GOL Productions
+("GOL"). It is licensed, not sold.
+
+GRANT OF LICENSE. GOL grants you a limited, non-exclusive,
+non-transferable, revocable licence to use this software
+exclusively with GOL's Check API service.
+
+RESTRICTIONS. You may not:
+  1. Copy, modify, or create derivative works of this software.
+  2. Redistribute, sublicense, sell, or otherwise transfer this
+     software to any third party.
+  3. Use this software with any competing command-validation or
+     preflight service.
+  4. Reverse-engineer, decompile, or disassemble this software.
+
+TERMINATION. This licence terminates immediately if you breach
+any of its terms or if GOL revokes it at its discretion.
+
+DISCLAIMER. THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY
+OF ANY KIND. GOL DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED.
+
+GOVERNING LAW. This licence is governed by the laws of the
+State of Victoria, Australia.

package/README.md

@@ -0,0 +1,31 @@
+# Check — The Anti-Hallucination Layer for AI Agents
+
+Your AI says "done" when it isn't. Check stops that.
+
+## Install
+
+One command. Every IDE.
+
+```
+npx @golproductions/check --install your_key
+```
+
+Auto-detects Claude Code, Gemini CLI, Antigravity, and Cursor. Writes the hook config, sets your key, done. Restart your IDE to activate.
+
+Get your free API key at [golproductions.com/check.html](https://www.golproductions.com/check.html)
+
+## What it does
+
+Check sits between your AI and the shell. Every command is verified before execution. If something is wrong, the AI knows before it speaks. No more hallucinated success, no more blind retries.
+
+## Pricing
+
+$0.0068 AUD per check. 120 free checks on signup. Credits never expire.
+
+## Links
+
+- [Documentation](https://www.golproductions.com/docs-triage-gate.html)
+- [Pricing](https://www.golproductions.com/pricing.html)
+- [VS Code extension](https://open-vsx.org/extension/golproductions/gol-check)
+
+Copyright (c) 2026 GOL Productions. All rights reserved.

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@golproductions/check",
+  "version": "2.4.1",
+  "description": "The anti-hallucination layer for AI agents. Your AI says done when it isn't. Check stops that. Supports Claude Code, Gemini CLI, Antigravity, and Cursor.",
+  "bin": {
+    "check": "src/index.js",
+    "check-mcp": "src/mcp.js"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "src/",
+    "LICENSE",
+    "README.md"
+  ],
+  "keywords": [
+    "claude-code",
+    "gemini-cli",
+    "antigravity",
+    "cursor",
+    "hooks",
+    "pretooluse",
+    "beforetool",
+    "beforeshellexecution",
+    "command-validation",
+    "anti-hallucination",
+    "firewall",
+    "ai-agents",
+    "vscode",
+    "openvsx",
+    "windsurf",
+    "mcp",
+    "model-context-protocol"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "zod": "^3.24.0"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/golproductions/check.git"
+  },
+  "homepage": "https://www.golproductions.com/check.html"
+}

package/src/index.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+const VERSION = "2.4.0";
+const API = "https://triage.golproductions.com/preflight";
+const CLIENT_ID = process.env.GOL_CLIENT_ID || "";
+
+function install() {
+  const key = process.argv[3] || process.env.GOL_CLIENT_ID || "your_key";
+  const home = homedir();
+  let installed = 0;
+
+  const scriptSrc = readFileSync(new URL(import.meta.url), "utf8");
+  const hooksDir = join(home, ".check");
+  mkdirSync(hooksDir, { recursive: true });
+  const scriptPath = join(hooksDir, "check.mjs");
+  writeFileSync(scriptPath, scriptSrc, "utf8");
+
+  const targets = [
+    {
+      name: "Claude Code",
+      dir: join(home, ".claude"),
+      file: "settings.json",
+      config: (existing) => {
+        existing.hooks = existing.hooks || {};
+        existing.hooks.PreToolUse = [{
+          matcher: "Bash|PowerShell",
+          hooks: [{ type: "command", command: "node", args: [scriptPath] }]
+        }];
+        existing.env = existing.env || {};
+        existing.env.GOL_CLIENT_ID = key;
+        return existing;
+      }
+    },
+    {
+      name: "Antigravity IDE",
+      dir: join(home, ".gemini", "config"),
+      file: "hooks.json",
+      config: (existing) => {
+        existing["check-gate"] = {
+          enabled: true,
+          PreToolUse: [{
+            matcher: "run_command",
+            hooks: [{ type: "command", command: "node " + scriptPath }]
+          }]
+        };
+        return existing;
+      }
+    },
+    {
+      name: "Cursor",
+      dir: join(home, ".cursor"),
+      file: "hooks.json",
+      config: (existing) => {
+        existing.version = existing.version || 1;
+        existing.hooks = existing.hooks || {};
+        existing.hooks.beforeShellExecution = [{
+          command: "node " + scriptPath
+        }];
+        return existing;
+      }
+    }
+  ];
+
+  for (const t of targets) {
+    if (!existsSync(t.dir)) continue;
+    const filepath = join(t.dir, t.file);
+    let existing = {};
+    try { existing = JSON.parse(readFileSync(filepath, "utf8")); } catch {}
+    const updated = t.config(existing);
+    writeFileSync(filepath, JSON.stringify(updated, null, 2) + "\n", "utf8");
+    installed++;
+  }
+
+  if (installed === 0) {
+    mkdirSync(join(home, ".claude"), { recursive: true });
+    const filepath = join(home, ".claude", "settings.json");
+    let existing = {};
+    try { existing = JSON.parse(readFileSync(filepath, "utf8")); } catch {}
+    const updated = targets[0].config(existing);
+    writeFileSync(filepath, JSON.stringify(updated, null, 2) + "\n", "utf8");
+  }
+
+  const agentsMd = join(process.cwd(), "AGENTS.md");
+  const checkRule = "Never fabricate, hallucinate, or invent values. If you don't have it, say you don't have it. No fake keys, no fake IDs, no fake paths, no fake URLs. If unsure, ask. Never guess and present it as fact.";
+  try {
+    const existing = existsSync(agentsMd) ? readFileSync(agentsMd, "utf8") : "";
+    if (!existing.includes("Never fabricate")) {
+      const prefix = existing.length > 0 ? existing.trimEnd() + "\n\n" : "";
+      writeFileSync(agentsMd, prefix + checkRule + "\n", "utf8");
+    }
+  } catch {}
+
+  console.log(`\nSafe travels wanderer..\n`);
+  process.exit(0);
+}
+
+if (process.argv.includes("--install")) { install(); }
+if (process.argv.includes("--mcp")) { await import("./mcp.js"); process.exit(0); }
+
+function detect(p) {
+  if (typeof p.command === "string" && !p.tool_input) return "cursor";
+  if (p.hook_event_name === "BeforeTool") return "gemini";
+  if (p.toolCall?.argumentsJson) return "antigravity";
+  return "claude";
+}
+
+function cmd(p, f) {
+  if (f === "cursor") return p.command;
+  if (f === "antigravity") {
+    try {
+      const a = typeof p.toolCall.argumentsJson === "string" ? JSON.parse(p.toolCall.argumentsJson) : p.toolCall.argumentsJson;
+      return a.command || a.CommandLine || a.command_line;
+    } catch { return null; }
+  }
+  return p.tool_input?.command;
+}
+
+function out(f, ok, reason) {
+  if (ok) {
+    const r = { cursor: { permission: "allow" }, gemini: { decision: "allow" }, antigravity: { decision: "allow" }, claude: { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } } };
+    process.stdout.write(JSON.stringify(r[f]));
+    process.exit(0);
+  }
+  if (f === "gemini" || f === "antigravity") { process.stderr.write(reason + "\n"); process.exit(2); }
+  const r = { cursor: { permission: "deny", user_message: reason, agent_message: reason }, claude: { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } } };
+  process.stdout.write(JSON.stringify(r[f]));
+  process.exit(0);
+}
+
+async function main() {
+  let f = "claude";
+  try {
+    let input = "";
+    for await (const chunk of process.stdin) input += chunk;
+    input = input.replace(/^/, "").trim();
+    let p;
+    try { p = JSON.parse(input); } catch { out("claude", true); return; }
+    if (p.hook_event_name === "PostToolUse") { process.exit(0); return; }
+    f = detect(p);
+    const c = cmd(p, f);
+    if (!c) { out(f, true); return; }
+    if (!CLIENT_ID) { process.stderr.write("check: GOL_CLIENT_ID not set. Get your key at https://www.golproductions.com/check.html\n"); out(f, true); return; }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 5000);
+    const res = await fetch(API, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": CLIENT_ID, "User-Agent": "c/" + VERSION },
+      body: JSON.stringify({ command: c, cwd: p.cwd || process.cwd(), platform: f, tool_name: p.tool_name, transcript_path: p.transcript_path, v: VERSION }),
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    const d = await res.json();
+    if (d.verdict === "runnable") { out(f, true); }
+    else { out(f, false, d.reason || "denied — address the issue before continuing"); }
+  } catch { out(f, true); }
+}
+
+main();

package/src/mcp.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const VERSION = "2.4.0";
+const API = "https://triage.golproductions.com/preflight";
+const CLIENT_ID = process.env.GOL_CLIENT_ID;
+const IS_WIN = process.platform === "win32";
+
+if (!CLIENT_ID) {
+  process.stderr.write("check: GOL_CLIENT_ID environment variable is required.\nGet your key at https://www.golproductions.com/check.html\n");
+  process.exit(1);
+}
+
+async function validate(command) {
+  const res = await fetch(API, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": CLIENT_ID, "User-Agent": "c/" + VERSION },
+    body: JSON.stringify({ command, v: VERSION })
+  });
+  return res.json();
+}
+
+const server = new McpServer({ name: "check", version: VERSION });
+
+server.tool(
+  "Check",
+  "Know if a command will work before running it. Returns 'runnable' or 'invalid'. $0.0068 AUD per Check.",
+  { command: z.string().max(10000).describe("The shell command to validate before execution") },
+  async ({ command }) => {
+    try {
+      const d = await validate(command);
+      if (!d.verdict) return { content: [{ type: "text", text: `Error: ${d.error || "unknown"}` }], isError: true };
+      return { content: [{ type: "text", text: `Verdict: ${d.verdict === "runnable" ? "RUNNABLE" : "INVALID"}` }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: `Check API error: ${err.message}` }], isError: true };
+    }
+  }
+);
+
+server.tool(
+  "CheckAndExecute",
+  "Validate a command with Check, then execute it if runnable. Returns the command output if valid, or blocks it.",
+  { command: z.string().max(10000).describe("The shell command to validate and execute") },
+  async ({ command }) => {
+    try {
+      const d = await validate(command);
+      if (d.verdict !== "runnable") return { content: [{ type: "text", text: "BLOCKED: " + (d.reason || "command is invalid") }] };
+      const { stdout, stderr } = await execFileAsync(IS_WIN ? "cmd" : "bash", IS_WIN ? ["/c", command] : ["-c", command], { timeout: 30000 });
+      return { content: [{ type: "text", text: (stdout || "") + (stderr ? "\nSTDERR: " + stderr : "") || "(no output)" }] };
+    } catch (err) {
+      if (err.stdout || err.stderr) return { content: [{ type: "text", text: `Exit ${err.code || 1}:\n${(err.stdout || "") + (err.stderr ? "\nSTDERR: " + err.stderr : "")}` }] };
+      return { content: [{ type: "text", text: `Error: ${err.message}` }], isError: true };
+    }
+  }
+);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);