@golproductions/check 3.1.3 → 3.1.5

package/README.md

@@ -7,12 +7,10 @@ No AI inside. Deterministic. Sub-100ms.
 ## Install
 
 ```
-npx @golproductions/check --install YOUR_KEY
+npx @golproductions/check --install
 ```
 
-One command. Auto-detects your environment and configures everything.
-
-120 free checks on signup at [golproductions.com/check](https://www.golproductions.com/check.html)
+One command. It auto-detects your AI tools, wires them up, and activates a free key on first run. No signup, no API key to paste, no browser.
 
 ## Supported environments
 
@@ -20,16 +18,31 @@ Claude Code, Cursor, Gemini CLI, Windsurf, Devin Desktop, Continue, Amazon Q, Ro
 
 ## Pricing
 
-$0.0068 AUD per check. No subscription. Credits never expire.
+120 free checks every day. After that, $0.0068 AUD per check. No subscription. Credits never expire.
 
 | Tier | Checks |
 |------|--------|
-| Free | 120 |
+| Free | 120 / day |
 | $5 | ~735 |
 | $10 | ~1,470 |
 | $25 | ~3,676 |
 | $50 | ~7,352 |
 
+## Bring your own key (optional)
+
+A key is minted for you automatically. If you already have a Client ID, or want the same one across machines, set it and Check uses that instead:
+
+```
+export GOL_CLIENT_ID=your_key
+```
+
+## Manage
+
+```
+npx @golproductions/check --status      Show your client ID and where Check is installed
+npx @golproductions/check --uninstall   Remove Check from every tool
+```
+
 ## Links
 
 - [Product page](https://www.golproductions.com/check.html)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@golproductions/check",
-  "version": "3.1.3",
+  "version": "3.1.5",
   "description": "The universal anti-hallucination engine for AI coding agents. Catches what is not real before it reaches your project.",
   "bin": {
     "check": "src/index.js",

package/src/index.js

@@ -5,7 +5,7 @@ import { homedir, platform, arch } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 
-const VERSION = "3.1.3";
+const VERSION = "3.1.5";
 const BINARY_VERSION = "3.0.0";
 const API = "https://triage.golproductions.com/preflight";
 const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";
@@ -13,6 +13,12 @@ const CLIENT_ID = process.env.GOL_CLIENT_ID || "";
 
 function getClientId() {
   if (CLIENT_ID) return CLIENT_ID;
+  // Universal fallback written at install time. Cursor and Gemini spawn hooks
+  // with no GOL_CLIENT_ID in the environment, so the env var alone is not enough.
+  try {
+    const k = readFileSync(join(homedir(), ".check", "key"), "utf8").trim();
+    if (k) return k;
+  } catch {}
   try {
     const cfg = JSON.parse(readFileSync(join(homedir(), ".claude", "settings.json"), "utf8"));
     return cfg.env?.GOL_CLIENT_ID || "";
@@ -115,6 +121,8 @@ async function install() {
   mkdirSync(hooksDir, { recursive: true });
   const scriptPath = join(hooksDir, "check.mjs").replace(/\\/g, "/");
   writeFileSync(scriptPath, scriptSrc, "utf8");
+  // Key file is the fallback for tools that don't pass env to hooks (Cursor, Gemini).
+  writeFileSync(join(hooksDir, "key"), key, "utf8");
 
   const ext = platform() === "win32" ? ".exe" : "";
   const binaryPath = join(hooksDir, "truth-gate" + ext).replace(/\\/g, "/");
@@ -128,15 +136,19 @@ async function install() {
       dir: join(home, ".claude"),
       file: "settings.json",
       config: (existing) => {
+        // Merge, never clobber: drop stale Check entries, keep the user's own
+        // hooks, then append ours.
         existing.hooks = existing.hooks || {};
-        existing.hooks.PreToolUse = [{
+        existing.hooks.PreToolUse = (existing.hooks.PreToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
+        existing.hooks.PreToolUse.push({
           matcher: "Bash|PowerShell",
           hooks: [{ type: "command", command: "node", args: [scriptPath] }]
-        }];
-        existing.hooks.PostToolUse = [
+        });
+        existing.hooks.PostToolUse = (existing.hooks.PostToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
+        existing.hooks.PostToolUse.push(
           { matcher: "Bash|PowerShell", hooks: [{ type: "command", command: binaryPath }] },
           { matcher: "Edit|Write|NotebookEdit", hooks: [{ type: "command", command: binaryPath }] }
-        ];
+        );
         existing.env = existing.env || {};
         existing.env.GOL_CLIENT_ID = key;
         return existing;
@@ -166,9 +178,10 @@ async function install() {
       config: (existing) => {
         existing.version = existing.version || 1;
         existing.hooks = existing.hooks || {};
-        existing.hooks.beforeShellExecution = [{
+        existing.hooks.beforeShellExecution = (existing.hooks.beforeShellExecution || []).filter(h => !isCheckRef(h.command));
+        existing.hooks.beforeShellExecution.push({
           command: "node " + scriptPath
-        }];
+        });
         return existing;
       }
     },
@@ -178,13 +191,15 @@ async function install() {
       file: "hooks.json",
       config: (existing) => {
         existing.hooks = existing.hooks || {};
-        existing.hooks.PreToolUse = [{
+        existing.hooks.PreToolUse = (existing.hooks.PreToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
+        existing.hooks.PreToolUse.push({
           matcher: "Bash|PowerShell",
           hooks: [{ type: "command", command: "node", args: [scriptPath] }]
-        }];
-        existing.hooks.PostToolUse = [
+        });
+        existing.hooks.PostToolUse = (existing.hooks.PostToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
+        existing.hooks.PostToolUse.push(
           { matcher: "Bash|PowerShell", hooks: [{ type: "command", command: binaryPath }] }
-        ];
+        );
         existing.env = existing.env || {};
         existing.env.GOL_CLIENT_ID = key;
         return existing;
@@ -297,6 +312,22 @@ async function uninstall() {
 
   console.log("\n  Removing Check...\n");
 
+  // Silent lifecycle ping. No output, failures swallowed — the uninstall
+  // itself must never be affected. Awaited just before exit so the process
+  // doesn't kill it mid-flight; the 3s abort caps worst-case delay.
+  let uninstallPing = Promise.resolve();
+  try {
+    const key = getClientId();
+    if (key) {
+      uninstallPing = fetch(API.replace("/preflight", "/log"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": key, "User-Agent": "c/" + VERSION },
+        body: JSON.stringify({ verdict: "uninstall", channel: "npm", os: platform(), arch: arch(), version: VERSION }),
+        signal: AbortSignal.timeout(3000),
+      }).catch(() => {});
+    }
+  } catch {}
+
   const hookTargets = [
     {
       name: "Claude Code",
@@ -421,6 +452,7 @@ async function uninstall() {
     console.log("  CLAUDE.md / AGENTS.md rules were left in place.\n");
   }
 
+  try { await uninstallPing; } catch {}
   process.exit(0);
 }
 
@@ -658,6 +690,33 @@ function out(f, ok, reason) {
   process.exit(0);
 }
 
+// Out of checks is a billing state, not a bad command. Warn, then let the
+// command run without the gate. The warning fires once per day per machine.
+function outCreditsExhausted(f, reason) {
+  let warned = true;
+  try {
+    const marker = join(homedir(), ".check", "credits-warned-" + new Date().toISOString().slice(0, 10));
+    warned = existsSync(marker);
+    if (!warned) { mkdirSync(join(homedir(), ".check"), { recursive: true }); writeFileSync(marker, "1"); }
+  } catch { warned = false; }
+  const msg = warned ? undefined : reason;
+  if (f === "gemini") {
+    process.stdout.write(JSON.stringify({ decision: "allow" }));
+    if (msg) process.stderr.write(msg);
+    process.exit(0);
+  }
+  if (f === "cursor") {
+    const r = { permission: "allow" };
+    if (msg) r.user_message = msg;
+    process.stdout.write(JSON.stringify(r));
+    process.exit(0);
+  }
+  const r = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } };
+  if (msg) r.systemMessage = msg;
+  process.stdout.write(JSON.stringify(r));
+  process.exit(0);
+}
+
 async function main() {
   let f = "claude";
   try {
@@ -670,12 +729,13 @@ async function main() {
     f = detect(p);
     const c = cmd(p, f);
     if (!c) { out(f, true); return; }
-    if (!CLIENT_ID) { out(f, false, "check: GOL_CLIENT_ID not set. Get your key at https://golproductions.com/check"); return; }
+    const hookKey = getClientId();
+    if (!hookKey) { out(f, false, "check: GOL_CLIENT_ID not set. Get your key at https://golproductions.com/check"); return; }
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), 5000);
     const res = await fetch(API, {
       method: "POST",
-      headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": CLIENT_ID, "User-Agent": "c/" + VERSION },
+      headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": hookKey, "User-Agent": "c/" + VERSION },
       body: JSON.stringify({ command: c, cwd: p.cwd || process.cwd(), platform: f, channel: "npm", tool_name: p.tool_name, transcript_path: p.transcript_path, v: VERSION }),
       signal: controller.signal
     });
@@ -691,7 +751,7 @@ async function main() {
       if (res.status === 402) {
         const free = d.daily_free || 120;
         const upsell = d.upgrade || "Top up at https://www.golproductions.com/console.html";
-        out(f, false, `check: you've used all ${free} free checks for today. Credits you buy never expire. ${upsell}`);
+        outCreditsExhausted(f, `check: you've used all ${free} free checks for today and your balance is empty. Check is off until tomorrow — commands run unverified. Credits you buy never expire. ${upsell}`);
         return;
       }
       out(f, false, d.reason || d.error || "check: request not authorized, command blocked");

package/src/mcp.js

@@ -6,7 +6,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
-const VERSION = "3.0.8";
+const VERSION = "3.1.5";
 const API = "https://triage.golproductions.com/preflight";
 const CLIENT_ID = process.env.GOL_CLIENT_ID;
 const IS_WIN = process.platform === "win32";
@@ -20,11 +20,17 @@ async function validate(command) {
   const res = await fetch(API, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": CLIENT_ID, "User-Agent": "c/" + VERSION },
-    body: JSON.stringify({ command, v: VERSION })
+    body: JSON.stringify({ command, v: VERSION, channel: "mcp", platform: "mcp" })
   });
-  return res.json();
+  const d = await res.json();
+  d._status = res.status;
+  return d;
 }
 
+// 402 = out of free checks with an empty balance. That is a billing state,
+// not a bad command: warn and let the command through unverified.
+const CREDITS_MSG = "Check: daily free checks used and balance is empty. Command NOT verified — Check resumes tomorrow or after a top-up at https://www.golproductions.com/console.html";
+
 const server = new McpServer({ name: "check", version: VERSION });
 
 server.tool(
@@ -34,6 +40,7 @@ server.tool(
   async ({ command }) => {
     try {
       const d = await validate(command);
+      if (d._status === 402) return { content: [{ type: "text", text: `Verdict: RUNNABLE (unverified). ${CREDITS_MSG}` }] };
       if (!d.verdict) return { content: [{ type: "text", text: `Error: ${d.error || "unknown"}` }], isError: true };
       return { content: [{ type: "text", text: `Verdict: ${d.verdict === "runnable" ? "RUNNABLE" : "INVALID"}` }] };
     } catch (err) {
@@ -49,7 +56,7 @@ server.tool(
   async ({ command }) => {
     try {
       const d = await validate(command);
-      if (d.verdict !== "runnable") return { content: [{ type: "text", text: "BLOCKED: " + (d.reason || "command is invalid") }] };
+      if (d._status !== 402 && d.verdict !== "runnable") return { content: [{ type: "text", text: "BLOCKED: " + (d.reason || "command is invalid") }] };
       const { stdout, stderr } = await execFileAsync(IS_WIN ? "cmd" : "bash", IS_WIN ? ["/c", command] : ["-c", command], { timeout: 30000 });
       return { content: [{ type: "text", text: (stdout || "") + (stderr ? "\nSTDERR: " + stderr : "") || "(no output)" }] };
     } catch (err) {