@golproductions/check 3.2.13 → 3.2.14

package/dist/index.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{readFileSync as e,writeFileSync as o,mkdirSync as n,existsSync as t,createWriteStream as s,chmodSync as r,unlinkSync as c,rmSync as i}from"node:fs";import{spawnSync as l}from"node:child_process";import{join as a}from"node:path";import{homedir as h,platform as u,arch as d}from"node:os";import{pipeline as m}from"node:stream/promises";import{Readable as p}from"node:stream";const f="3.2.14",k="https://triage.golproductions.com/preflight",g=process.env.GOL_CLIENT_ID||"";function y(){if(g)return g;try{const o=e(a(h(),".check","key"),"utf8").trim();if(o)return o}catch{}try{const o=JSON.parse(e(a(h(),".claude","settings.json"),"utf8"));return o.env?.GOL_CLIENT_ID||""}catch{return""}}function v(e){return e&&(e.includes(".check")||e.includes("truth-gate"))}function C(e){return!!v(e.command)||!!e.args?.some(e=>v(e))}function w(){console.log(`\n  Check v${f} — Anti-hallucination layer for AI coding agents\n\n  Usage:\n\n    npx @golproductions/check --install <key>   Install Check with your Client ID\n    npx @golproductions/check --uninstall        Remove Check from all tools\n    npx @golproductions/check --status           Show what is installed and active\n    npx @golproductions/check --credits          Check your usage and balance\n    npx @golproductions/check --docs             View documentation\n    npx @golproductions/check --help             Show this help\n\n  Get your key:  https://golproductions.com/check\n  Pricing:       120 free/day, then $0.0068 AUD per check\n`),process.exit(0)}const T=process.argv.slice(2);function P(e,o,n){if(o){const o={cursor:{permission:"allow"},gemini:{decision:"allow"},claude:{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow"}}};process.stdout.write(JSON.stringify(o[e]||o.claude)),process.exit(0)}"gemini"===e&&(process.stdout.write(JSON.stringify({decision:"deny",reason:n})),process.exit(2));const t={cursor:{permission:"deny",agent_message:n},claude:{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:n}}};process.stdout.write(JSON.stringify(t[e]||t.claude)),process.exit(0)}function S(e,s){let r=!0;try{const e=a(h(),".check","credits-warned-"+(new Date).toISOString().slice(0,10));r=t(e),r||(n(a(h(),".check"),{recursive:!0}),o(e,"1"))}catch{r=!1}const c=r?void 0:s;if("gemini"===e&&(process.stdout.write(JSON.stringify({decision:"allow"})),c&&process.stderr.write(c),process.exit(0)),"cursor"===e){const e={permission:"allow"};c&&(e.user_message=c),process.stdout.write(JSON.stringify(e)),process.exit(0)}const i={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow"}};c&&(i.systemMessage=c),process.stdout.write(JSON.stringify(i)),process.exit(0)}T.includes("--install")&&await async function(){let c=process.argv[3]||process.env.GOL_CLIENT_ID||"";c&&"your_key"!==c||(console.log("\n  Activating Check (free, no signup)...\n"),c=await async function(){try{const e=await async function(){const{createHash:e}=await import("node:crypto"),{hostname:o,userInfo:n}=await import("node:os");let t="";try{t=n().username||""}catch{}const s=[o(),u(),d(),t].join("|");return e("sha256").update(s).digest("hex")}(),o=await fetch(k.replace("/preflight","/instant-key"),{method:"POST",headers:{"Content-Type":"application/json","User-Agent":"c/"+f},body:JSON.stringify({fingerprint:e,channel:"npm"}),signal:AbortSignal.timeout(1e4)});if(!o.ok)return null;const n=await o.json();return n&&n.client_id?n.client_id:null}catch{return null}}(),c||(console.log("  Could not activate automatically (offline, or this network hit its daily limit).\n"),console.log("  Get a key the manual way: https://golproductions.com/check\n"),console.log("  Then run:  npx @golproductions/check --install YOUR_KEY\n"),process.exit(1)),console.log("  Activated. 120 free checks per day.\n"));const i=await async function(e){try{const o=await fetch(k,{method:"POST",headers:{"Content-Type":"application/json","X-GOL-CLIENT-ID":e,"User-Agent":"c/"+f},body:JSON.stringify({command:"echo check-install-verify",cwd:process.cwd(),v:f}),signal:AbortSignal.timeout(1e4)});if(o.ok)return{valid:!0,expired:!1};let n={};try{n=await o.json()}catch{}return{valid:!1,expired:/expir/i.test(n.reason||n.error||n.message||"")}}catch{return{valid:!1,expired:!1}}}(c);i.valid||(i.expired?(console.log("\n  Your Client ID has expired: "+c),console.log("\n  Renew your key at: https://golproductions.com/check\n")):(console.log("\n  Invalid Client ID: "+c),console.log("\n  Get a valid key at: https://golproductions.com/check\n")),process.exit(1)),console.log("\n  Key verified. Installing Check...\n");const l=h();let g=0;const y=e(new URL(import.meta.url),"utf8"),w=a(l,".check");n(w,{recursive:!0});const T=a(w,"check.mjs").replace(/\\/g,"/");o(T,y,"utf8"),o(a(w,"key"),c,"utf8");const P="win32"===u()?".exe":"",S=a(w,"truth-gate"+P).replace(/\\/g,"/");await async function(e){const o="win32"===u()?"win":"darwin"===u()?"macos":"linux",n=`https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases/truth-gate-v3.0.0-${o}-${"arm64"===d()?"arm64":"x64"}${"win"===o?".exe":""}`,t=await fetch(n);if(!t.ok)throw new Error(`Download failed: ${t.status}`);if(await m(p.fromWeb(t.body),s(e)),"win"!==o)try{r(e,493)}catch{}}(S);const b={command:"npx",args:["@golproductions/check","--mcp"],env:{GOL_CLIENT_ID:c}},x=[{name:"Claude Code",dir:a(l,".claude"),file:"settings.json",config:e=>(e.hooks=e.hooks||{},e.hooks.PreToolUse=(e.hooks.PreToolUse||[]).filter(e=>!e.hooks?.some(C)),e.hooks.PreToolUse.push({matcher:"Bash|PowerShell",hooks:[{type:"command",command:"node",args:[T]}]}),e.hooks.PostToolUse=(e.hooks.PostToolUse||[]).filter(e=>!e.hooks?.some(C)),e.hooks.PostToolUse.push({matcher:"Bash|PowerShell",hooks:[{type:"command",command:S}]},{matcher:"Edit|Write|NotebookEdit",hooks:[{type:"command",command:S}]}),e.env=e.env||{},e.env.GOL_CLIENT_ID=c,e)},{name:"Gemini CLI / Antigravity",dir:a(l,".gemini"),file:"settings.json",config:e=>{e.hooks=e.hooks||{},e.hooks.BeforeTool=e.hooks.BeforeTool||[];const o=e.hooks.BeforeTool;return o.find(e=>e.hooks?.some(e=>"check-gate"===e.name))||o.push({matcher:".*",hooks:[{type:"command",command:"node "+T,name:"check-gate"}]}),e}},{name:"Cursor",dir:a(l,".cursor"),file:"hooks.json",config:e=>(e.version=e.version||1,e.hooks=e.hooks||{},e.hooks.beforeShellExecution=(e.hooks.beforeShellExecution||[]).filter(e=>!v(e.command)),e.hooks.beforeShellExecution.push({command:"node "+T}),e)},{name:"Homebase",dir:a(l,".homebase"),file:"hooks.json",config:e=>(e.hooks=e.hooks||{},e.hooks.PreToolUse=(e.hooks.PreToolUse||[]).filter(e=>!e.hooks?.some(C)),e.hooks.PreToolUse.push({matcher:"Bash|PowerShell",hooks:[{type:"command",command:"node",args:[T]}]}),e.hooks.PostToolUse=(e.hooks.PostToolUse||[]).filter(e=>!e.hooks?.some(C)),e.hooks.PostToolUse.push({matcher:"Bash|PowerShell",hooks:[{type:"command",command:S}]}),e.env=e.env||{},e.env.GOL_CLIENT_ID=c,e)},{name:"Windsurf (MCP)",dir:a(l,".codeium","windsurf"),file:"mcp_config.json",config:e=>(e.mcpServers=e.mcpServers||{},e.mcpServers.Check=b,e)},{name:"Continue (MCP)",dir:a(process.cwd(),".continue","mcpServers"),file:"check.json",config:()=>({mcpServers:{Check:b}})},{name:"Amazon Q Developer (MCP)",dir:a(l,".aws","amazonq"),file:"mcp.json",config:e=>(e.mcpServers=e.mcpServers||{},e.mcpServers.Check={type:"stdio",...b},e)},{name:"Roo Code (project MCP)",dir:a(process.cwd(),".roo"),file:"mcp.json",config:e=>(e.mcpServers=e.mcpServers||{},e.mcpServers.Check=b,e)},{name:"Project MCP (shared)",dir:process.cwd(),file:".mcp.json",config:e=>(e.mcpServers=e.mcpServers||{},e.mcpServers.Check=b,e)}],U=["Windsurf (MCP)","Continue (MCP)","Amazon Q Developer (MCP)","Roo Code (project MCP)","Project MCP (shared)"];let j=!1;for(const s of x){const r=U.includes(s.name);if(!r&&!t(s.dir))continue;r&&n(s.dir,{recursive:!0});const c=a(s.dir,s.file);let i={};try{i=JSON.parse(e(c,"utf8"))}catch{}const l=s.config(i);o(c,JSON.stringify(l,null,2)+"\n","utf8"),g++,"Claude Code"===s.name&&(j=!0)}if(0===g){n(a(l,".claude"),{recursive:!0});const t=a(l,".claude","settings.json");let s={};try{s=JSON.parse(e(t,"utf8"))}catch{}const r=x[0].config(s);o(t,JSON.stringify(r,null,2)+"\n","utf8"),j=!0}const O=j?"CLAUDE.md":"AGENTS.md",_=a(process.cwd(),O);try{const n=t(_)?e(_,"utf8"):"";if(!n.includes("Never fabricate")){const e=n.length>0?n.trimEnd()+"\n\n":"";o(_,e+"Never fabricate, hallucinate, or invent values. If you don't have it, say you don't have it. No fake keys, no fake IDs, no fake paths, no fake URLs. If unsure, ask. Never guess and present it as fact.\n","utf8")}}catch{}console.log(`\n  Your free GOL Client ID (this machine):  ${c}`),console.log("  Shared by every editor on this machine. 120 free checks/day."),console.log("  Need more? Get a GOL API Key (paid, prepaid balance) at"),console.log("  https://www.golproductions.com/console"),console.log("\n  By using Check you agree to the Terms and Privacy Policy:"),console.log("  golproductions.com/terms  |  golproductions.com/privacy"),console.log("\nSafe travels wanderer..\n"),process.exit(0)}(),T.includes("--uninstall")&&await async function(){const n=h();let s=0;console.log("\n  Removing Check...\n");let r=Promise.resolve();try{const e=y();e&&(r=fetch(k.replace("/preflight","/log"),{method:"POST",headers:{"Content-Type":"application/json","X-GOL-CLIENT-ID":e,"User-Agent":"c/"+f},body:JSON.stringify({verdict:"uninstall",channel:"npm",os:u(),arch:d(),version:f}),signal:AbortSignal.timeout(3e3)}).catch(()=>{}))}catch{}const l=[{name:"Claude Code",path:a(n,".claude","settings.json"),clean:e=>(e.hooks?.PreToolUse&&(e.hooks.PreToolUse=e.hooks.PreToolUse.filter(e=>!e.hooks?.some(C)),0===e.hooks.PreToolUse.length&&delete e.hooks.PreToolUse),e.hooks?.PostToolUse&&(e.hooks.PostToolUse=e.hooks.PostToolUse.filter(e=>!e.hooks?.some(C)),0===e.hooks.PostToolUse.length&&delete e.hooks.PostToolUse),e.hooks&&0===Object.keys(e.hooks).length&&delete e.hooks,e.env&&(delete e.env.GOL_CLIENT_ID,0===Object.keys(e.env).length&&delete e.env),e)},{name:"Gemini CLI",path:a(n,".gemini","settings.json"),clean:e=>(e.hooks?.BeforeTool&&(e.hooks.BeforeTool=e.hooks.BeforeTool.filter(e=>!e.hooks?.some(e=>"check-gate"===e.name)),0===e.hooks.BeforeTool.length&&delete e.hooks.BeforeTool,0===Object.keys(e.hooks).length&&delete e.hooks),e)},{name:"Cursor",path:a(n,".cursor","hooks.json"),clean:e=>(e.hooks?.beforeShellExecution&&(e.hooks.beforeShellExecution=e.hooks.beforeShellExecution.filter(e=>!v(e.command)),0===e.hooks.beforeShellExecution.length&&delete e.hooks.beforeShellExecution,0===Object.keys(e.hooks).length&&delete e.hooks),e)},{name:"Homebase",path:a(n,".homebase","hooks.json"),clean:e=>(e.hooks?.PreToolUse&&(e.hooks.PreToolUse=e.hooks.PreToolUse.filter(e=>!e.hooks?.some(C)),0===e.hooks.PreToolUse.length&&delete e.hooks.PreToolUse),e.hooks?.PostToolUse&&(e.hooks.PostToolUse=e.hooks.PostToolUse.filter(e=>!e.hooks?.some(C)),0===e.hooks.PostToolUse.length&&delete e.hooks.PostToolUse),e.hooks&&0===Object.keys(e.hooks).length&&delete e.hooks,e.env&&(delete e.env.GOL_CLIENT_ID,0===Object.keys(e.env).length&&delete e.env),e)}],m=[{name:"Windsurf",path:a(n,".codeium","windsurf","mcp_config.json")},{name:"Amazon Q",path:a(n,".aws","amazonq","mcp.json")}],p=[{name:"Continue",path:a(process.cwd(),".continue","mcpServers","check.json"),deleteFile:!0},{name:"Roo Code",path:a(process.cwd(),".roo","mcp.json")},{name:"Project MCP",path:a(process.cwd(),".mcp.json")}];for(const n of l)if(t(n.path))try{const t=JSON.parse(e(n.path,"utf8")),r=n.clean(t);o(n.path,JSON.stringify(r,null,2)+"\n","utf8"),console.log("    removed  "+n.name),s++}catch{}for(const n of[...m,...p])if(t(n.path))try{if(n.deleteFile)c(n.path),console.log("    removed  "+n.name),s++;else{const t=JSON.parse(e(n.path,"utf8"));t.mcpServers?.Check&&(delete t.mcpServers.Check,0===Object.keys(t.mcpServers).length&&delete t.mcpServers,o(n.path,JSON.stringify(t,null,2)+"\n","utf8"),console.log("    removed  "+n.name),s++)}}catch{}const g=a(n,".check");if(t(g))try{i(g,{recursive:!0,force:!0}),console.log("    removed  ~/.check/")}catch{}0===s?console.log("  No Check installations found.\n"):(console.log(`\n  Removed from ${s} tool${1!==s?"s":""}.`),console.log("  CLAUDE.md / AGENTS.md rules were left in place.\n"));try{await r}catch{}process.exit(0)}(),T.includes("--status")&&await async function(){const o=h(),n=a(o,".check"),s="win32"===u()?".exe":"",r=y();if(console.log(`\n  Check v${f}\n`),r){const e=r.length>12?r.slice(0,8)+"..."+r.slice(-4):r;console.log("  Client ID:  "+e)}else console.log("  Client ID:  not set");const c=a(n,"truth-gate"+s);console.log("  Binary:     "+(t(c)?"installed":"not found"));const i=a(n,"check.mjs");console.log("  Script:     "+(t(i)?"installed":"not found")),console.log("\n  Integrations:\n");const l=[{name:"Claude Code",path:a(o,".claude","settings.json"),test:e=>e.hooks?.PreToolUse?.some(e=>e.hooks?.some(C))||e.hooks?.PostToolUse?.some(e=>e.hooks?.some(C)),detail:e=>{const o=[];return e.hooks?.PreToolUse?.some(e=>e.hooks?.some(C))&&o.push("PreToolUse"),e.hooks?.PostToolUse?.some(e=>e.hooks?.some(C))&&o.push("PostToolUse"),o.join(", ")}},{name:"Gemini CLI",path:a(o,".gemini","settings.json"),test:e=>e.hooks?.BeforeTool?.some(e=>e.hooks?.some(e=>"check-gate"===e.name)),detail:()=>"BeforeTool"},{name:"Cursor",path:a(o,".cursor","hooks.json"),test:e=>e.hooks?.beforeShellExecution?.some(e=>v(e.command)),detail:()=>"beforeShellExecution"},{name:"Homebase",path:a(o,".homebase","hooks.json"),test:e=>e.hooks?.PreToolUse?.some(e=>e.hooks?.some(C))||e.hooks?.PostToolUse?.some(e=>e.hooks?.some(C)),detail:e=>{const o=[];return e.hooks?.PreToolUse?.some(e=>e.hooks?.some(C))&&o.push("PreToolUse"),e.hooks?.PostToolUse?.some(e=>e.hooks?.some(C))&&o.push("PostToolUse"),o.join(", ")}},{name:"Windsurf",path:a(o,".codeium","windsurf","mcp_config.json"),test:e=>!!e.mcpServers?.Check,detail:()=>"MCP"},{name:"Continue",path:a(process.cwd(),".continue","mcpServers","check.json"),test:e=>!!e.mcpServers?.Check,detail:()=>"MCP (project)"},{name:"Amazon Q",path:a(o,".aws","amazonq","mcp.json"),test:e=>!!e.mcpServers?.Check,detail:()=>"MCP"},{name:"Roo Code",path:a(process.cwd(),".roo","mcp.json"),test:e=>!!e.mcpServers?.Check,detail:()=>"MCP (project)"},{name:"Project MCP",path:a(process.cwd(),".mcp.json"),test:e=>!!e.mcpServers?.Check,detail:()=>"MCP (project)"}];for(const o of l)if(t(o.path))try{const n=JSON.parse(e(o.path,"utf8"));o.test(n)?console.log("    +  "+o.name.padEnd(14)+" active ("+o.detail(n)+")"):console.log("    -  "+o.name.padEnd(14)+" tool installed, Check not configured")}catch{console.log("    ?  "+o.name.padEnd(14)+" config unreadable")}else console.log("    -  "+o.name.padEnd(14)+" not detected");console.log(""),process.exit(0)}(),T.includes("--credits")&&await async function(){const e=y();e||(console.log("\n  No Client ID found. Set GOL_CLIENT_ID or run --install first.\n"),process.exit(1));try{const o=await fetch(k.replace("/preflight","/credits"),{method:"GET",headers:{"X-GOL-CLIENT-ID":e,"User-Agent":"c/"+f},signal:AbortSignal.timeout(1e4)});o.ok||(console.log("\n  Could not fetch credits (HTTP "+o.status+").\n"),process.exit(1));const n=await o.json();console.log(`\n  Check v${f} — Credits\n`),void 0!==n.free_remaining&&console.log("  Free today:    "+n.free_remaining+" / "+(n.free_daily||120)),void 0!==n.calls_today&&console.log("  Calls today:   "+n.calls_today),void 0!==n.balance&&console.log("  Balance:       $"+n.balance+" AUD"),void 0!==n.total_calls&&console.log("  Total calls:   "+n.total_calls),n.plan&&console.log("  Plan:          "+n.plan),0===Object.keys(n).length&&console.log("  "+JSON.stringify(n)),console.log("")}catch(e){console.log("\n  Could not reach API: "+e.message+"\n")}process.exit(0)}(),T.includes("--docs")&&await async function(){console.log(`\n  Check v${f} — Documentation\n\n  Install:      npx @golproductions/check --install <key>\n  Uninstall:    npx @golproductions/check --uninstall\n  Status:       npx @golproductions/check --status\n  Credits:      npx @golproductions/check --credits\n\n  How it works:\n\n    Check installs hooks into your AI coding tools. Every time\n    the AI runs a command or edits a file, Check verifies it\n    before or after execution.\n\n    PreToolUse    Validates commands before they run.\n    PostToolUse   Verifies results after execution.\n    MCP Server    Provides Check and CheckAndExecute tools.\n    CLAUDE.md     Adds anti-fabrication instructions.\n\n  Supported tools:\n\n    Claude Code, Gemini CLI, Cursor, Windsurf, Continue,\n    Amazon Q Developer, Roo Code, Homebase\n\n  Pricing:\n\n    120 free checks per day. Then $0.0068 AUD per check.\n    Credits never expire. Pay as you go.\n\n  Links:\n\n    Website:    https://golproductions.com/check\n    Docs:       https://github.com/golproductions/check\n    Support:    support@golproductions.com\n`);try{const{execSync:e}=await import("node:child_process"),o="https://github.com/golproductions/check";"win32"===u()?e(`start "" "${o}"`,{stdio:"ignore",shell:!0}):"darwin"===u()?e(`open "${o}"`,{stdio:"ignore"}):e(`xdg-open "${o}"`,{stdio:"ignore"})}catch{}process.exit(0)}(),(T.includes("--help")||T.includes("-h"))&&w(),T.includes("--mcp")&&(await import("./mcp.js"),process.exit(0)),!T.some(e=>e.startsWith("-"))&&process.stdin.isTTY&&w();const b=new Set(["sudo","nohup","nice","time","timeout","env"]),x=new Set(["cd","echo","printf","pwd","export","set","unset","alias","unalias","true","false","test","[","[[","exit","return","break","continue","shift","source",".","eval","exec","trap","wait","jobs","fg","bg","read","readonly","local","declare","typeset","let","getopts","hash","type","command","builtin","ulimit","umask","times","dirs","pushd","popd","for","while","until","if","then","else","elif","fi","do","done","case","esac","in","function","select","{","}","!"]);function U(){if("win32"!==u())return"bash";const e=[process.env.CLAUDE_CODE_GIT_BASH_PATH,"C:/Program Files/Git/bin/bash.exe","C:/Program Files/Git/usr/bin/bash.exe","C:/Program Files (x86)/Git/bin/bash.exe"].filter(Boolean);for(const o of e)try{if(t(o))return o}catch{}return null}function j(e,o){if(!e)return null;const n=e.split(/\r?\n/).find(e=>e.includes(o));if(!n)return null;let t=n.slice(n.indexOf(o)+o.length);return t=t.replace(/^['"\s:]+/,"").replace(/\s+$/,""),t?o+": "+t:null}function O(e,o,n){try{if("powershell"===n){const n=l("powershell",["-NoProfile","-NonInteractive","-Command","try { $null = Get-Command $env:CHECK_PROBE -ErrorAction Stop; exit 0 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }"],{cwd:o,timeout:4e3,encoding:"utf8",env:{...process.env,CHECK_PROBE:e}});return n.error?null:{known:0===n.status,why:0===n.status?null:j(n.stderr,e)}}const t=U();if(!t)return null;const s=l(t,["-c",'type -- "$1"',"check",e],{cwd:o,timeout:4e3,encoding:"utf8"});return s.error?null:{known:0===s.status,why:0===s.status?null:j(s.stderr,e)}}catch{return null}}!async function(){let e="claude";try{let o,n="";for await(const e of process.stdin)n+=e;n=n.replace(/^/,"").trim(),n||(process.stderr.write("check: no hook input on stdin. This entrypoint is for tool hooks; run --help for CLI usage.\n"),process.exit(1));try{o=JSON.parse(n)}catch{return void P("claude",!1,"check: unreadable hook input (not JSON), command blocked")}if("PostToolUse"===o.hook_event_name)return void process.exit(0);e=function(e){return"string"!=typeof e.command||e.tool_input?"BeforeTool"===e.hook_event_name||e.toolCall?.argumentsJson?"gemini":"claude":"cursor"}(o);const t=function(e,o){if("cursor"===o)return e.command;if("gemini"===o){if(e.tool_input?.command)return e.tool_input.command;if(e.toolCall?.argumentsJson)try{const o="string"==typeof e.toolCall.argumentsJson?JSON.parse(e.toolCall.argumentsJson):e.toolCall.argumentsJson;return o.command||o.CommandLine||o.command_line}catch{return null}return null}return e.tool_input?.command}(o,e);if(!t)return void P(e,!0);const s=y();if(!s)return void P(e,!1,"check: GOL_CLIENT_ID not set. Get your key at https://golproductions.com/check");if("Bash"===o.tool_name){const o=await async function(e){try{const o=U();if(!o)return null;const n=l(o,["-n"],{input:e,timeout:4e3,encoding:"utf8"});if(n.error)return null;if(0===n.status){const e=(n.stderr||"").split("\n").find(e=>/here-document.*end-of-file/i.test(e));return!!e&&e.replace(/^[^:]*bash[^:]*:\s*/i,"").trim()}return((n.stderr||"").split("\n").find(e=>e.trim())||"syntax error").replace(/^[^:]*bash[^:]*:\s*/i,"").trim()}catch{return null}}(t);if("string"==typeof o)return void P(e,!1,`check: syntax error — ${o}`)}const r=new AbortController,c=setTimeout(()=>r.abort(),5e3),i=[],a=function(e,o,n,t){try{let s=function(e){const o=[[]];let n="",t=null;for(let s=0;s<e.length;s++){const r=e[s];t?r===t?t=null:n+=r:'"'!==r&&"'"!==r?"|"!==r&&"&"!==r&&";"!==r&&"\n"!==r?/\s/.test(r)?n&&(o[o.length-1].push(n),n=""):n+=r:(n&&(o[o.length-1].push(n),n=""),o[o.length-1].length&&o.push([]),"|"!==r&&"&"!==r||e[s+1]!==r||s++):t=r}n&&o[o.length-1].push(n);const s=new Set(["do","then","else","elif","if","while","until","!","{"]),r=[];for(const e of o){let o=null;for(const n of e)if(n&&!b.has(n)&&!s.has(n)&&!/^[\d.]+[smhd]?$/.test(n)&&(!n.includes("=")||n.startsWith("-"))&&!n.startsWith("-")){o=n;break}o&&r.push(o)}return r}(function(e){const o=e.split("\n"),n=[],t=[];for(const e of o){if(t.length){const{delim:o,dashed:n}=t[0];(n?e.replace(/^\t+/,""):e)===o&&t.shift();continue}n.push(e);for(const o of e.matchAll(/<<(-?)(?!<)\s*(?:'([^']+)'|"([^"]+)"|(\w+))/g))t.push({delim:o[2]||o[3]||o[4],dashed:"-"===o[1]})}return n.join("\n")}(e).replace(/\\\r?\n/g," "));if("powershell"!==n&&(s=s.filter(e=>!x.has(e))),0===s.length)return!0;if(s.some(e=>!/^[A-Za-z0-9_.\/\\~:@+=-]+$/.test(e)))return null;let r=!0;for(const e of s){const s=O(e,o,n);if(null===s)return null;!1===s.known&&(r=!1,t&&t.push(s.why||e+": not found"))}return r}catch{return null}}(t,o.cwd,"PowerShell"===o.tool_name?"powershell":"bash",i);if(!1===a&&i.length)return void P(e,!1,"denied by the shell that would run it. "+i.join("; "));const h={command:t,cwd:o.cwd||process.cwd(),platform:e,channel:"npm",tool_name:o.tool_name,v:f};null!==a&&(h.binary_exists=a);const u=await fetch(k,{method:"POST",headers:{"Content-Type":"application/json","X-GOL-CLIENT-ID":s,"User-Agent":"c/"+f},body:JSON.stringify(h),signal:r.signal});clearTimeout(c);const d=await u.json();if(!u.ok){if(429===u.status||/rate limit/i.test(d.reason||d.error||""))return void S(e,"check: rate limited (60 checks/min), command ran unverified. Check resumes automatically.");if(u.status>=500)return void S(e,"check: validation service error (HTTP "+u.status+"), command ran unverified. Check resumes automatically.");if(402===u.status){return void S(e,`check: you've used all ${d.daily_free||120} free checks for today and your balance is empty. Check is off until tomorrow — commands run unverified. Credits you buy never expire. ${d.upgrade||"Top up at https://www.golproductions.com/console.html"}`)}return void P(e,!1,d.reason||d.error||"check: request not authorized, command blocked")}"runnable"===d.verdict?P(e,!0):P(e,!1,(i.length?"denied by the shell that would run it. "+i.join("; "):null)||d.reason||"denied. Address the issue before continuing.")}catch{S(e,"check: validation service unreachable, command ran unverified. Check resumes automatically.")}}();

package/dist/mcp.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import{McpServer as t}from"@modelcontextprotocol/sdk/server/mcp.js";import{StdioServerTransport as e}from"@modelcontextprotocol/sdk/server/stdio.js";import{z as n}from"zod";import{execFile as r,spawnSync as o}from"node:child_process";import{existsSync as s}from"node:fs";import{platform as c}from"node:os";import{promisify as i}from"node:util";const a=i(r),l="3.2.8",u=process.env.GOL_CLIENT_ID,d="win32"===process.platform;u||(process.stderr.write("check: GOL_CLIENT_ID environment variable is required.\nGet your key at https://www.golproductions.com/check.html\n"),process.exit(1));const m=new Set(["sudo","nohup","nice","time","timeout","env"]),h=new Set(["cd","echo","printf","pwd","export","set","unset","alias","unalias","true","false","test","[","[[","exit","return","break","continue","shift","source",".","eval","exec","trap","wait","jobs","fg","bg","read","readonly","local","declare","typeset","let","getopts","hash","type","command","builtin","ulimit","umask","times","dirs","pushd","popd","for","while","until","if","then","else","elif","fi","do","done","case","esac","in","function","select","{","}","!"]);function p(t){try{const e=function(){if("win32"!==c())return"bash";const t=[process.env.CLAUDE_CODE_GIT_BASH_PATH,"C:/Program Files/Git/bin/bash.exe","C:/Program Files/Git/usr/bin/bash.exe","C:/Program Files (x86)/Git/bin/bash.exe"].filter(Boolean);for(const e of t)try{if(s(e))return e}catch{}return null}();if(!e)return null;const n=o(e,["-c",'type -- "$1" >/dev/null 2>&1',"check",t],{timeout:4e3,stdio:"ignore"});return n.error?null:0===n.status}catch{return null}}async function f(t){const e=function(t){try{let e=function(t){const e=[[]];let n="",r=null;for(let o=0;o<t.length;o++){const s=t[o];r?s===r?r=null:n+=s:'"'!==s&&"'"!==s?"|"!==s&&"&"!==s&&";"!==s&&"\n"!==s?/\s/.test(s)?n&&(e[e.length-1].push(n),n=""):n+=s:(n&&(e[e.length-1].push(n),n=""),e[e.length-1].length&&e.push([]),"|"!==s&&"&"!==s||t[o+1]!==s||o++):r=s}n&&e[e.length-1].push(n);const o=[];for(const t of e){let e=null;for(const n of t)if(n&&!m.has(n)&&!/^[\d.]+[smhd]?$/.test(n)&&(!n.includes("=")||n.startsWith("-"))&&!n.startsWith("-")){e=n;break}e&&o.push(e)}return o}(t);if(e=e.filter(t=>!h.has(t)),0===e.length)return!0;if(e.some(t=>/[(){}$`]/.test(t)))return null;let n=!0;for(const t of e){const e=p(t);if(null===e)return null;!1===e&&(n=!1)}return n}catch{return null}}(t),n={command:t,v:l,channel:"mcp",platform:"mcp"};null!==e&&(n.binary_exists=e);const r=await fetch("https://triage.golproductions.com/preflight",{method:"POST",headers:{"Content-Type":"application/json","X-GOL-CLIENT-ID":u,"User-Agent":"c/"+l},body:JSON.stringify(n)}),o=await r.json();return o._status=r.status,o}const x=new t({name:"check",version:l});x.tool("Check","Know if a command will work before running it. Returns 'runnable' or 'invalid'. $0.0068 AUD per Check.",{command:n.string().max(1e4).describe("The shell command to validate before execution")},async({command:t})=>{try{const e=await f(t);return 402===e._status?{content:[{type:"text",text:"Verdict: RUNNABLE (unverified). Check: daily free checks used and balance is empty. Command NOT verified — Check resumes tomorrow or after a top-up at https://www.golproductions.com/console.html"}]}:e.verdict?{content:[{type:"text",text:"Verdict: "+("runnable"===e.verdict?"RUNNABLE":"INVALID")}]}:{content:[{type:"text",text:`Error: ${e.error||"unknown"}`}],isError:!0}}catch(t){return{content:[{type:"text",text:`Check API error: ${t.message}`}],isError:!0}}}),x.tool("CheckAndExecute","Validate a command with Check, then execute it if runnable. Returns the command output if valid, or blocks it.",{command:n.string().max(1e4).describe("The shell command to validate and execute")},async({command:t})=>{try{const e=await f(t);if(402!==e._status&&"runnable"!==e.verdict)return{content:[{type:"text",text:"BLOCKED: "+(e.reason||"command is invalid")}]};const{stdout:n,stderr:r}=await a(d?"cmd":"bash",d?["/c",t]:["-c",t],{timeout:3e4});return{content:[{type:"text",text:(n||"")+(r?"\nSTDERR: "+r:"")||"(no output)"}]}}catch(t){return t.stdout||t.stderr?{content:[{type:"text",text:`Exit ${t.code||1}:\n${(t.stdout||"")+(t.stderr?"\nSTDERR: "+t.stderr:"")}`}]}:{content:[{type:"text",text:`Error: ${t.message}`}],isError:!0}}});const w=new e;await x.connect(w);

package/package.json

@@ -1,17 +1,21 @@
 {
   "name": "@golproductions/check",
-  "version": "3.2.13",
+  "version": "3.2.14",
   "description": "Less hallucinations. A command firewall for AI agents: validates every shell command before execution, so fabricated commands are denied before they run.",
   "bin": {
-    "check": "src/index.js",
-    "check-mcp": "src/mcp.js"
+    "check": "dist/index.js",
+    "check-mcp": "dist/mcp.js"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "prepublishOnly": "node build.mjs"
   },
   "type": "module",
   "engines": {
     "node": ">=18"
   },
   "files": [
-    "src/",
+    "dist/",
     "LICENSE",
     "README.md"
   ],

package/src/index.js

@@ -1,963 +0,0 @@
-#!/usr/bin/env node
-import { readFileSync, writeFileSync, mkdirSync, existsSync, createWriteStream, chmodSync, unlinkSync, rmSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { join } from "node:path";
-import { homedir, platform, arch } from "node:os";
-import { pipeline } from "node:stream/promises";
-import { Readable } from "node:stream";
-
-const VERSION = "3.2.13";
-const BINARY_VERSION = "3.0.0";
-const API = "https://triage.golproductions.com/preflight";
-const CDN = "https://pub-e55366a7f5994be9be04f0e205179f4a.r2.dev/releases";
-const CLIENT_ID = process.env.GOL_CLIENT_ID || "";
-
-function getClientId() {
-  if (CLIENT_ID) return CLIENT_ID;
-  // Universal fallback written at install time. Cursor and Gemini spawn hooks
-  // with no GOL_CLIENT_ID in the environment, so the env var alone is not enough.
-  try {
-    const k = readFileSync(join(homedir(), ".check", "key"), "utf8").trim();
-    if (k) return k;
-  } catch {}
-  try {
-    const cfg = JSON.parse(readFileSync(join(homedir(), ".claude", "settings.json"), "utf8"));
-    return cfg.env?.GOL_CLIENT_ID || "";
-  } catch { return ""; }
-}
-
-async function validateKey(key) {
-  try {
-    const res = await fetch(API, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": key, "User-Agent": "c/" + VERSION },
-      body: JSON.stringify({ command: "echo check-install-verify", cwd: process.cwd(), v: VERSION }),
-      signal: AbortSignal.timeout(10000),
-    });
-    if (res.ok) return { valid: true, expired: false };
-    let body = {};
-    try { body = await res.json(); } catch {}
-    const expired = /expir/i.test(body.reason || body.error || body.message || "");
-    return { valid: false, expired };
-  } catch {
-    return { valid: false, expired: false };
-  }
-}
-
-// Stable anonymous device fingerprint: one-way hash of coarse machine facts.
-// No personal data. Server uses it only to rate-limit free-key minting.
-async function deviceFingerprint() {
-  const { createHash } = await import("node:crypto");
-  const { hostname, userInfo } = await import("node:os");
-  let user = "";
-  try { user = userInfo().username || ""; } catch {}
-  const seed = [hostname(), platform(), arch(), user].join("|");
-  return createHash("sha256").update(seed).digest("hex");
-}
-
-// Mint a free key with no email and no browser. Returns the client_id or null.
-async function mintInstantKey() {
-  try {
-    const fp = await deviceFingerprint();
-    const res = await fetch(API.replace("/preflight", "/instant-key"), {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "User-Agent": "c/" + VERSION },
-      body: JSON.stringify({ fingerprint: fp, channel: "npm" }),
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!res.ok) return null;
-    const d = await res.json();
-    return d && d.client_id ? d.client_id : null;
-  } catch {
-    return null;
-  }
-}
-
-async function downloadBinary(dest) {
-  const os = platform() === "win32" ? "win" : platform() === "darwin" ? "macos" : "linux";
-  const cpu = arch() === "arm64" ? "arm64" : "x64";
-  const ext = os === "win" ? ".exe" : "";
-  const url = `${CDN}/truth-gate-v${BINARY_VERSION}-${os}-${cpu}${ext}`;
-  const res = await fetch(url);
-  if (!res.ok) throw new Error(`Download failed: ${res.status}`);
-  await pipeline(Readable.fromWeb(res.body), createWriteStream(dest));
-  if (os !== "win") try { chmodSync(dest, 0o755); } catch {}
-}
-
-async function install() {
-  let key = process.argv[3] || process.env.GOL_CLIENT_ID || "";
-
-  // No key provided: mint one instantly. No email, no browser, no copy-paste.
-  if (!key || key === "your_key") {
-    console.log("\n  Activating Check (free, no signup)...\n");
-    key = await mintInstantKey();
-    if (!key) {
-      console.log("  Could not activate automatically (offline, or this network hit its daily limit).\n");
-      console.log("  Get a key the manual way: https://golproductions.com/check\n");
-      console.log("  Then run:  npx @golproductions/check --install YOUR_KEY\n");
-      process.exit(1);
-    }
-    console.log("  Activated. 120 free checks per day.\n");
-  }
-
-  const result = await validateKey(key);
-  if (!result.valid) {
-    if (result.expired) {
-      console.log("\n  Your Client ID has expired: " + key);
-      console.log("\n  Renew your key at: https://golproductions.com/check\n");
-    } else {
-      console.log("\n  Invalid Client ID: " + key);
-      console.log("\n  Get a valid key at: https://golproductions.com/check\n");
-    }
-    process.exit(1);
-  }
-
-  console.log("\n  Key verified. Installing Check...\n");
-
-  const home = homedir();
-  let installed = 0;
-
-  const scriptSrc = readFileSync(new URL(import.meta.url), "utf8");
-  const hooksDir = join(home, ".check");
-  mkdirSync(hooksDir, { recursive: true });
-  const scriptPath = join(hooksDir, "check.mjs").replace(/\\/g, "/");
-  writeFileSync(scriptPath, scriptSrc, "utf8");
-  // Key file is the fallback for tools that don't pass env to hooks (Cursor, Gemini).
-  writeFileSync(join(hooksDir, "key"), key, "utf8");
-
-  const ext = platform() === "win32" ? ".exe" : "";
-  const binaryPath = join(hooksDir, "truth-gate" + ext).replace(/\\/g, "/");
-  await downloadBinary(binaryPath);
-
-  const mcpEntry = { command: "npx", args: ["@golproductions/check", "--mcp"], env: { GOL_CLIENT_ID: key } };
-
-  const targets = [
-    {
-      name: "Claude Code",
-      dir: join(home, ".claude"),
-      file: "settings.json",
-      config: (existing) => {
-        // Merge, never clobber: drop stale Check entries, keep the user's own
-        // hooks, then append ours.
-        existing.hooks = existing.hooks || {};
-        existing.hooks.PreToolUse = (existing.hooks.PreToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
-        existing.hooks.PreToolUse.push({
-          matcher: "Bash|PowerShell",
-          hooks: [{ type: "command", command: "node", args: [scriptPath] }]
-        });
-        existing.hooks.PostToolUse = (existing.hooks.PostToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
-        existing.hooks.PostToolUse.push(
-          { matcher: "Bash|PowerShell", hooks: [{ type: "command", command: binaryPath }] },
-          { matcher: "Edit|Write|NotebookEdit", hooks: [{ type: "command", command: binaryPath }] }
-        );
-        existing.env = existing.env || {};
-        existing.env.GOL_CLIENT_ID = key;
-        return existing;
-      }
-    },
-    {
-      name: "Gemini CLI / Antigravity",
-      dir: join(home, ".gemini"),
-      file: "settings.json",
-      config: (existing) => {
-        existing.hooks = existing.hooks || {};
-        existing.hooks.BeforeTool = existing.hooks.BeforeTool || [];
-        const hooks = existing.hooks.BeforeTool;
-        if (!hooks.find(h => h.hooks?.some(hh => hh.name === "check-gate"))) {
-          hooks.push({
-            matcher: ".*",
-            hooks: [{ type: "command", command: "node " + scriptPath, name: "check-gate" }]
-          });
-        }
-        return existing;
-      }
-    },
-    {
-      name: "Cursor",
-      dir: join(home, ".cursor"),
-      file: "hooks.json",
-      config: (existing) => {
-        existing.version = existing.version || 1;
-        existing.hooks = existing.hooks || {};
-        existing.hooks.beforeShellExecution = (existing.hooks.beforeShellExecution || []).filter(h => !isCheckRef(h.command));
-        existing.hooks.beforeShellExecution.push({
-          command: "node " + scriptPath
-        });
-        return existing;
-      }
-    },
-    {
-      name: "Homebase",
-      dir: join(home, ".homebase"),
-      file: "hooks.json",
-      config: (existing) => {
-        existing.hooks = existing.hooks || {};
-        existing.hooks.PreToolUse = (existing.hooks.PreToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
-        existing.hooks.PreToolUse.push({
-          matcher: "Bash|PowerShell",
-          hooks: [{ type: "command", command: "node", args: [scriptPath] }]
-        });
-        existing.hooks.PostToolUse = (existing.hooks.PostToolUse || []).filter(h => !h.hooks?.some(isCheckHook));
-        existing.hooks.PostToolUse.push(
-          { matcher: "Bash|PowerShell", hooks: [{ type: "command", command: binaryPath }] }
-        );
-        existing.env = existing.env || {};
-        existing.env.GOL_CLIENT_ID = key;
-        return existing;
-      }
-    },
-    {
-      name: "Windsurf (MCP)",
-      dir: join(home, ".codeium", "windsurf"),
-      file: "mcp_config.json",
-      config: (existing) => {
-        existing.mcpServers = existing.mcpServers || {};
-        existing.mcpServers.Check = mcpEntry;
-        return existing;
-      }
-    },
-    {
-      name: "Continue (MCP)",
-      dir: join(process.cwd(), ".continue", "mcpServers"),
-      file: "check.json",
-      config: () => {
-        return { mcpServers: { Check: mcpEntry } };
-      }
-    },
-    {
-      name: "Amazon Q Developer (MCP)",
-      dir: join(home, ".aws", "amazonq"),
-      file: "mcp.json",
-      config: (existing) => {
-        existing.mcpServers = existing.mcpServers || {};
-        existing.mcpServers.Check = { type: "stdio", ...mcpEntry };
-        return existing;
-      }
-    },
-    {
-      name: "Roo Code (project MCP)",
-      dir: join(process.cwd(), ".roo"),
-      file: "mcp.json",
-      config: (existing) => {
-        existing.mcpServers = existing.mcpServers || {};
-        existing.mcpServers.Check = mcpEntry;
-        return existing;
-      }
-    },
-    {
-      name: "Project MCP (shared)",
-      dir: process.cwd(),
-      file: ".mcp.json",
-      config: (existing) => {
-        existing.mcpServers = existing.mcpServers || {};
-        existing.mcpServers.Check = mcpEntry;
-        return existing;
-      }
-    }
-  ];
-
-  const mcpTargets = ["Windsurf (MCP)", "Continue (MCP)", "Amazon Q Developer (MCP)", "Roo Code (project MCP)", "Project MCP (shared)"];
-
-  let hasClaude = false;
-  for (const t of targets) {
-    const isMcp = mcpTargets.includes(t.name);
-    if (!isMcp && !existsSync(t.dir)) continue;
-    if (isMcp) mkdirSync(t.dir, { recursive: true });
-    const filepath = join(t.dir, t.file);
-    let existing = {};
-    try { existing = JSON.parse(readFileSync(filepath, "utf8")); } catch {}
-    const updated = t.config(existing);
-    writeFileSync(filepath, JSON.stringify(updated, null, 2) + "\n", "utf8");
-    installed++;
-    if (t.name === "Claude Code") hasClaude = true;
-  }
-
-  if (installed === 0) {
-    mkdirSync(join(home, ".claude"), { recursive: true });
-    const filepath = join(home, ".claude", "settings.json");
-    let existing = {};
-    try { existing = JSON.parse(readFileSync(filepath, "utf8")); } catch {}
-    const updated = targets[0].config(existing);
-    writeFileSync(filepath, JSON.stringify(updated, null, 2) + "\n", "utf8");
-    hasClaude = true;
-  }
-
-  const checkRule = "Never fabricate, hallucinate, or invent values. If you don't have it, say you don't have it. No fake keys, no fake IDs, no fake paths, no fake URLs. If unsure, ask. Never guess and present it as fact.";
-  const ruleFile = hasClaude ? "CLAUDE.md" : "AGENTS.md";
-  const rulePath = join(process.cwd(), ruleFile);
-  try {
-    const existing = existsSync(rulePath) ? readFileSync(rulePath, "utf8") : "";
-    if (!existing.includes("Never fabricate")) {
-      const prefix = existing.length > 0 ? existing.trimEnd() + "\n\n" : "";
-      writeFileSync(rulePath, prefix + checkRule + "\n", "utf8");
-    }
-  } catch {}
-
-  console.log(`\n  Your free GOL Client ID (this machine):  ${key}`);
-  console.log(`  Shared by every editor on this machine. 120 free checks/day.`);
-  console.log(`  Need more? Get a GOL API Key (paid, prepaid balance) at`);
-  console.log(`  https://www.golproductions.com/console`);
-  console.log(`\n  By using Check you agree to the Terms and Privacy Policy:`);
-  console.log(`  golproductions.com/terms  |  golproductions.com/privacy`);
-  console.log(`\nSafe travels wanderer..\n`);
-  process.exit(0);
-}
-
-function isCheckRef(str) {
-  return str && (str.includes(".check") || str.includes("truth-gate"));
-}
-
-function isCheckHook(hook) {
-  if (isCheckRef(hook.command)) return true;
-  if (hook.args?.some(a => isCheckRef(a))) return true;
-  return false;
-}
-
-async function uninstall() {
-  const home = homedir();
-  let removed = 0;
-
-  console.log("\n  Removing Check...\n");
-
-  // Silent lifecycle ping. No output, failures swallowed — the uninstall
-  // itself must never be affected. Awaited just before exit so the process
-  // doesn't kill it mid-flight; the 3s abort caps worst-case delay.
-  let uninstallPing = Promise.resolve();
-  try {
-    const key = getClientId();
-    if (key) {
-      uninstallPing = fetch(API.replace("/preflight", "/log"), {
-        method: "POST",
-        headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": key, "User-Agent": "c/" + VERSION },
-        body: JSON.stringify({ verdict: "uninstall", channel: "npm", os: platform(), arch: arch(), version: VERSION }),
-        signal: AbortSignal.timeout(3000),
-      }).catch(() => {});
-    }
-  } catch {}
-
-  const hookTargets = [
-    {
-      name: "Claude Code",
-      path: join(home, ".claude", "settings.json"),
-      clean: (cfg) => {
-        if (cfg.hooks?.PreToolUse) {
-          cfg.hooks.PreToolUse = cfg.hooks.PreToolUse.filter(h => !h.hooks?.some(isCheckHook));
-          if (cfg.hooks.PreToolUse.length === 0) delete cfg.hooks.PreToolUse;
-        }
-        if (cfg.hooks?.PostToolUse) {
-          cfg.hooks.PostToolUse = cfg.hooks.PostToolUse.filter(h => !h.hooks?.some(isCheckHook));
-          if (cfg.hooks.PostToolUse.length === 0) delete cfg.hooks.PostToolUse;
-        }
-        if (cfg.hooks && Object.keys(cfg.hooks).length === 0) delete cfg.hooks;
-        if (cfg.env) {
-          delete cfg.env.GOL_CLIENT_ID;
-          if (Object.keys(cfg.env).length === 0) delete cfg.env;
-        }
-        return cfg;
-      }
-    },
-    {
-      name: "Gemini CLI",
-      path: join(home, ".gemini", "settings.json"),
-      clean: (cfg) => {
-        if (cfg.hooks?.BeforeTool) {
-          cfg.hooks.BeforeTool = cfg.hooks.BeforeTool.filter(h => !h.hooks?.some(hh => hh.name === "check-gate"));
-          if (cfg.hooks.BeforeTool.length === 0) delete cfg.hooks.BeforeTool;
-          if (Object.keys(cfg.hooks).length === 0) delete cfg.hooks;
-        }
-        return cfg;
-      }
-    },
-    {
-      name: "Cursor",
-      path: join(home, ".cursor", "hooks.json"),
-      clean: (cfg) => {
-        if (cfg.hooks?.beforeShellExecution) {
-          cfg.hooks.beforeShellExecution = cfg.hooks.beforeShellExecution.filter(h => !isCheckRef(h.command));
-          if (cfg.hooks.beforeShellExecution.length === 0) delete cfg.hooks.beforeShellExecution;
-          if (Object.keys(cfg.hooks).length === 0) delete cfg.hooks;
-        }
-        return cfg;
-      }
-    },
-    {
-      name: "Homebase",
-      path: join(home, ".homebase", "hooks.json"),
-      clean: (cfg) => {
-        if (cfg.hooks?.PreToolUse) {
-          cfg.hooks.PreToolUse = cfg.hooks.PreToolUse.filter(h => !h.hooks?.some(isCheckHook));
-          if (cfg.hooks.PreToolUse.length === 0) delete cfg.hooks.PreToolUse;
-        }
-        if (cfg.hooks?.PostToolUse) {
-          cfg.hooks.PostToolUse = cfg.hooks.PostToolUse.filter(h => !h.hooks?.some(isCheckHook));
-          if (cfg.hooks.PostToolUse.length === 0) delete cfg.hooks.PostToolUse;
-        }
-        if (cfg.hooks && Object.keys(cfg.hooks).length === 0) delete cfg.hooks;
-        if (cfg.env) {
-          delete cfg.env.GOL_CLIENT_ID;
-          if (Object.keys(cfg.env).length === 0) delete cfg.env;
-        }
-        return cfg;
-      }
-    }
-  ];
-
-  const mcpUserTargets = [
-    { name: "Windsurf", path: join(home, ".codeium", "windsurf", "mcp_config.json") },
-    { name: "Amazon Q", path: join(home, ".aws", "amazonq", "mcp.json") },
-  ];
-
-  const mcpProjectTargets = [
-    { name: "Continue", path: join(process.cwd(), ".continue", "mcpServers", "check.json"), deleteFile: true },
-    { name: "Roo Code", path: join(process.cwd(), ".roo", "mcp.json") },
-    { name: "Project MCP", path: join(process.cwd(), ".mcp.json") },
-  ];
-
-  for (const t of hookTargets) {
-    if (!existsSync(t.path)) continue;
-    try {
-      const cfg = JSON.parse(readFileSync(t.path, "utf8"));
-      const cleaned = t.clean(cfg);
-      writeFileSync(t.path, JSON.stringify(cleaned, null, 2) + "\n", "utf8");
-      console.log("    removed  " + t.name);
-      removed++;
-    } catch {}
-  }
-
-  for (const t of [...mcpUserTargets, ...mcpProjectTargets]) {
-    if (!existsSync(t.path)) continue;
-    try {
-      if (t.deleteFile) {
-        unlinkSync(t.path);
-        console.log("    removed  " + t.name);
-        removed++;
-      } else {
-        const cfg = JSON.parse(readFileSync(t.path, "utf8"));
-        if (cfg.mcpServers?.Check) {
-          delete cfg.mcpServers.Check;
-          if (Object.keys(cfg.mcpServers).length === 0) delete cfg.mcpServers;
-          writeFileSync(t.path, JSON.stringify(cfg, null, 2) + "\n", "utf8");
-          console.log("    removed  " + t.name);
-          removed++;
-        }
-      }
-    } catch {}
-  }
-
-  const checkDir = join(home, ".check");
-  if (existsSync(checkDir)) {
-    try {
-      rmSync(checkDir, { recursive: true, force: true });
-      console.log("    removed  ~/.check/");
-    } catch {}
-  }
-
-  if (removed === 0) {
-    console.log("  No Check installations found.\n");
-  } else {
-    console.log(`\n  Removed from ${removed} tool${removed !== 1 ? "s" : ""}.`);
-    console.log("  CLAUDE.md / AGENTS.md rules were left in place.\n");
-  }
-
-  try { await uninstallPing; } catch {}
-  process.exit(0);
-}
-
-async function status() {
-  const home = homedir();
-  const checkDir = join(home, ".check");
-  const ext = platform() === "win32" ? ".exe" : "";
-  const id = getClientId();
-
-  console.log(`\n  Check v${VERSION}\n`);
-
-  if (id) {
-    const masked = id.length > 12 ? id.slice(0, 8) + "..." + id.slice(-4) : id;
-    console.log("  Client ID:  " + masked);
-  } else {
-    console.log("  Client ID:  not set");
-  }
-
-  const binaryPath = join(checkDir, "truth-gate" + ext);
-  console.log("  Binary:     " + (existsSync(binaryPath) ? "installed" : "not found"));
-  const scriptPath = join(checkDir, "check.mjs");
-  console.log("  Script:     " + (existsSync(scriptPath) ? "installed" : "not found"));
-
-  console.log("\n  Integrations:\n");
-
-  const checks = [
-    {
-      name: "Claude Code",
-      path: join(home, ".claude", "settings.json"),
-      test: (cfg) => cfg.hooks?.PreToolUse?.some(h => h.hooks?.some(isCheckHook)) || cfg.hooks?.PostToolUse?.some(h => h.hooks?.some(isCheckHook)),
-      detail: (cfg) => {
-        const parts = [];
-        if (cfg.hooks?.PreToolUse?.some(h => h.hooks?.some(isCheckHook))) parts.push("PreToolUse");
-        if (cfg.hooks?.PostToolUse?.some(h => h.hooks?.some(isCheckHook))) parts.push("PostToolUse");
-        return parts.join(", ");
-      }
-    },
-    {
-      name: "Gemini CLI",
-      path: join(home, ".gemini", "settings.json"),
-      test: (cfg) => cfg.hooks?.BeforeTool?.some(h => h.hooks?.some(hh => hh.name === "check-gate")),
-      detail: () => "BeforeTool"
-    },
-    {
-      name: "Cursor",
-      path: join(home, ".cursor", "hooks.json"),
-      test: (cfg) => cfg.hooks?.beforeShellExecution?.some(h => isCheckRef(h.command)),
-      detail: () => "beforeShellExecution"
-    },
-    {
-      name: "Homebase",
-      path: join(home, ".homebase", "hooks.json"),
-      test: (cfg) => cfg.hooks?.PreToolUse?.some(h => h.hooks?.some(isCheckHook)) || cfg.hooks?.PostToolUse?.some(h => h.hooks?.some(isCheckHook)),
-      detail: (cfg) => {
-        const parts = [];
-        if (cfg.hooks?.PreToolUse?.some(h => h.hooks?.some(isCheckHook))) parts.push("PreToolUse");
-        if (cfg.hooks?.PostToolUse?.some(h => h.hooks?.some(isCheckHook))) parts.push("PostToolUse");
-        return parts.join(", ");
-      }
-    },
-    { name: "Windsurf", path: join(home, ".codeium", "windsurf", "mcp_config.json"), test: (cfg) => !!cfg.mcpServers?.Check, detail: () => "MCP" },
-    { name: "Continue", path: join(process.cwd(), ".continue", "mcpServers", "check.json"), test: (cfg) => !!cfg.mcpServers?.Check, detail: () => "MCP (project)" },
-    { name: "Amazon Q", path: join(home, ".aws", "amazonq", "mcp.json"), test: (cfg) => !!cfg.mcpServers?.Check, detail: () => "MCP" },
-    { name: "Roo Code", path: join(process.cwd(), ".roo", "mcp.json"), test: (cfg) => !!cfg.mcpServers?.Check, detail: () => "MCP (project)" },
-    { name: "Project MCP", path: join(process.cwd(), ".mcp.json"), test: (cfg) => !!cfg.mcpServers?.Check, detail: () => "MCP (project)" },
-  ];
-
-  for (const c of checks) {
-    if (!existsSync(c.path)) {
-      console.log("    -  " + c.name.padEnd(14) + " not detected");
-      continue;
-    }
-    try {
-      const cfg = JSON.parse(readFileSync(c.path, "utf8"));
-      if (c.test(cfg)) {
-        console.log("    +  " + c.name.padEnd(14) + " active (" + c.detail(cfg) + ")");
-      } else {
-        console.log("    -  " + c.name.padEnd(14) + " tool installed, Check not configured");
-      }
-    } catch {
-      console.log("    ?  " + c.name.padEnd(14) + " config unreadable");
-    }
-  }
-
-  console.log("");
-  process.exit(0);
-}
-
-async function credits() {
-  const id = getClientId();
-  if (!id) {
-    console.log("\n  No Client ID found. Set GOL_CLIENT_ID or run --install first.\n");
-    process.exit(1);
-  }
-
-  try {
-    const res = await fetch(API.replace("/preflight", "/credits"), {
-      method: "GET",
-      headers: { "X-GOL-CLIENT-ID": id, "User-Agent": "c/" + VERSION },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (!res.ok) {
-      console.log("\n  Could not fetch credits (HTTP " + res.status + ").\n");
-      process.exit(1);
-    }
-    const d = await res.json();
-    console.log(`\n  Check v${VERSION} — Credits\n`);
-    if (d.free_remaining !== undefined) console.log("  Free today:    " + d.free_remaining + " / " + (d.free_daily || 120));
-    if (d.calls_today !== undefined) console.log("  Calls today:   " + d.calls_today);
-    if (d.balance !== undefined) console.log("  Balance:       $" + d.balance + " AUD");
-    if (d.total_calls !== undefined) console.log("  Total calls:   " + d.total_calls);
-    if (d.plan) console.log("  Plan:          " + d.plan);
-    if (Object.keys(d).length === 0) console.log("  " + JSON.stringify(d));
-    console.log("");
-  } catch (err) {
-    console.log("\n  Could not reach API: " + err.message + "\n");
-  }
-  process.exit(0);
-}
-
-async function docs() {
-  console.log(`
-  Check v${VERSION} — Documentation
-
-  Install:      npx @golproductions/check --install <key>
-  Uninstall:    npx @golproductions/check --uninstall
-  Status:       npx @golproductions/check --status
-  Credits:      npx @golproductions/check --credits
-
-  How it works:
-
-    Check installs hooks into your AI coding tools. Every time
-    the AI runs a command or edits a file, Check verifies it
-    before or after execution.
-
-    PreToolUse    Validates commands before they run.
-    PostToolUse   Verifies results after execution.
-    MCP Server    Provides Check and CheckAndExecute tools.
-    CLAUDE.md     Adds anti-fabrication instructions.
-
-  Supported tools:
-
-    Claude Code, Gemini CLI, Cursor, Windsurf, Continue,
-    Amazon Q Developer, Roo Code, Homebase
-
-  Pricing:
-
-    120 free checks per day. Then $0.0068 AUD per check.
-    Credits never expire. Pay as you go.
-
-  Links:
-
-    Website:    https://golproductions.com/check
-    Docs:       https://github.com/golproductions/check
-    Support:    support@golproductions.com
-`);
-
-  try {
-    const { execSync } = await import("node:child_process");
-    const url = "https://github.com/golproductions/check";
-    if (platform() === "win32") execSync(`start "" "${url}"`, { stdio: "ignore", shell: true });
-    else if (platform() === "darwin") execSync(`open "${url}"`, { stdio: "ignore" });
-    else execSync(`xdg-open "${url}"`, { stdio: "ignore" });
-  } catch {}
-
-  process.exit(0);
-}
-
-function help() {
-  console.log(`
-  Check v${VERSION} — Anti-hallucination layer for AI coding agents
-
-  Usage:
-
-    npx @golproductions/check --install <key>   Install Check with your Client ID
-    npx @golproductions/check --uninstall        Remove Check from all tools
-    npx @golproductions/check --status           Show what is installed and active
-    npx @golproductions/check --credits          Check your usage and balance
-    npx @golproductions/check --docs             View documentation
-    npx @golproductions/check --help             Show this help
-
-  Get your key:  https://golproductions.com/check
-  Pricing:       120 free/day, then $0.0068 AUD per check
-`);
-  process.exit(0);
-}
-
-// CLI routing
-const args = process.argv.slice(2);
-if (args.includes("--install"))   { await install(); }
-if (args.includes("--uninstall")) { await uninstall(); }
-if (args.includes("--status"))    { await status(); }
-if (args.includes("--credits"))   { await credits(); }
-if (args.includes("--docs"))      { await docs(); }
-if (args.includes("--help") || args.includes("-h")) { help(); }
-if (args.includes("--mcp"))       { await import("./mcp.js"); process.exit(0); }
-
-// No flags + interactive terminal = show help
-if (!args.some(a => a.startsWith("-")) && process.stdin.isTTY) { help(); }
-
-// Hook handler (invoked by tools via stdin)
-function detect(p) {
-  if (typeof p.command === "string" && !p.tool_input) return "cursor";
-  if (p.hook_event_name === "BeforeTool" || p.toolCall?.argumentsJson) return "gemini";
-  return "claude";
-}
-
-function cmd(p, f) {
-  if (f === "cursor") return p.command;
-  if (f === "gemini") {
-    if (p.tool_input?.command) return p.tool_input.command;
-    if (p.toolCall?.argumentsJson) {
-      try {
-        const a = typeof p.toolCall.argumentsJson === "string" ? JSON.parse(p.toolCall.argumentsJson) : p.toolCall.argumentsJson;
-        return a.command || a.CommandLine || a.command_line;
-      } catch { return null; }
-    }
-    return null;
-  }
-  return p.tool_input?.command;
-}
-
-function out(f, ok, reason) {
-  if (ok) {
-    const r = { cursor: { permission: "allow" }, gemini: { decision: "allow" }, claude: { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } } };
-    process.stdout.write(JSON.stringify(r[f] || r.claude));
-    process.exit(0);
-  }
-  if (f === "gemini") {
-    process.stdout.write(JSON.stringify({ decision: "deny", reason }));
-    process.exit(2);
-  }
-  // The reason is for the AGENT only: it reads the shell's words, fixes the
-  // command, and moves on. The user never sees the stumble, just clean flow.
-  // (Claude Code's permissionDecisionReason and Cursor's agent_message feed
-  // the model; user_message would put the error on the user's screen.)
-  const r = { cursor: { permission: "deny", agent_message: reason }, claude: { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } } };
-  process.stdout.write(JSON.stringify(r[f] || r.claude));
-  process.exit(0);
-}
-
-// Out of checks is a billing state, not a bad command. Warn, then let the
-// command run without the gate. The warning fires once per day per machine.
-function outCreditsExhausted(f, reason) {
-  let warned = true;
-  try {
-    const marker = join(homedir(), ".check", "credits-warned-" + new Date().toISOString().slice(0, 10));
-    warned = existsSync(marker);
-    if (!warned) { mkdirSync(join(homedir(), ".check"), { recursive: true }); writeFileSync(marker, "1"); }
-  } catch { warned = false; }
-  const msg = warned ? undefined : reason;
-  if (f === "gemini") {
-    process.stdout.write(JSON.stringify({ decision: "allow" }));
-    if (msg) process.stderr.write(msg);
-    process.exit(0);
-  }
-  if (f === "cursor") {
-    const r = { permission: "allow" };
-    if (msg) r.user_message = msg;
-    process.stdout.write(JSON.stringify(r));
-    process.exit(0);
-  }
-  const r = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } };
-  if (msg) r.systemMessage = msg;
-  process.stdout.write(JSON.stringify(r));
-  process.exit(0);
-}
-
-// The machine's own PATH resolution is the ground truth for whether a
-// command exists. This is the same lookup the shell performs at launch:
-// walk PATH (plus PATHEXT on Windows), pure filesystem reads, deterministic.
-// The server honors binary_exists as proof, so real-but-unlisted tools
-// (claude, codex, aider, internal CLIs) are never falsely blocked.
-const PREFIX_WORDS = new Set(["sudo", "nohup", "nice", "time", "timeout", "env"]);
-
-// POSIX shell builtins and keywords. Frozen by spec since 1992: these are
-// provided by the shell itself, not the filesystem, and are treated as
-// present. This set is evergreen — it does not rot the way a tool list does.
-const SHELL_BUILTINS = new Set([
-  "cd", "echo", "printf", "pwd", "export", "set", "unset", "alias", "unalias",
-  "true", "false", "test", "[", "[[", "exit", "return", "break", "continue",
-  "shift", "source", ".", "eval", "exec", "trap", "wait", "jobs", "fg", "bg",
-  "read", "readonly", "local", "declare", "typeset", "let", "getopts", "hash",
-  "type", "command", "builtin", "ulimit", "umask", "times", "dirs", "pushd",
-  "popd", "for", "while", "until", "if", "then", "else", "elif", "fi", "do",
-  "done", "case", "esac", "in", "function", "select", "{", "}", "!",
-]);
-
-// Quote-aware: "./spaced name.sh" is ONE token, and connectors inside
-// quotes are literal text, not separators.
-function segmentBases(command) {
-  const segs = [[]];
-  let cur = "", q = null;
-  for (let i = 0; i < command.length; i++) {
-    const ch = command[i];
-    if (q) { if (ch === q) q = null; else cur += ch; continue; }
-    if (ch === '"' || ch === "'") { q = ch; continue; }
-    if (ch === "|" || ch === "&" || ch === ";" || ch === "\n") {
-      if (cur) { segs[segs.length - 1].push(cur); cur = ""; }
-      if (segs[segs.length - 1].length) segs.push([]);
-      if ((ch === "|" || ch === "&") && command[i + 1] === ch) i++;
-      continue;
-    }
-    if (/\s/.test(ch)) { if (cur) { segs[segs.length - 1].push(cur); cur = ""; } continue; }
-    cur += ch;
-  }
-  if (cur) segs[segs.length - 1].push(cur);
-
-  const bases = [];
-  for (const words of segs) {
-    let base = null;
-    for (const w of words) {
-      if (!w) continue;
-      if (PREFIX_WORDS.has(w)) continue;
-      if (/^[\d.]+[smhd]?$/.test(w)) continue;
-      if (w.includes("=") && !w.startsWith("-")) continue;
-      if (w.startsWith("-")) continue;
-      base = w;
-      break;
-    }
-    if (base) bases.push(base);
-  }
-  return bases;
-}
-
-// THE ROD: do not model the shell — ask it. `type` is the shell reporting
-// on itself: builtins, keywords, functions, and PATH binaries all answer
-// through the exact resolution the shell will use at launch. A model of the
-// shell can drift from the shell; the shell cannot drift from itself.
-// On Windows, bare "bash" is a trap: PATH can resolve to WSL's
-// System32\bash.exe — a different operating system with a different
-// filesystem. The command will actually run in Git Bash, so the probe
-// must ask Git Bash, located explicitly. If it cannot be located,
-// abstain — never let the wrong interpreter answer for the right one.
-function bashPath() {
-  if (platform() !== "win32") return "bash";
-  const candidates = [
-    process.env.CLAUDE_CODE_GIT_BASH_PATH,
-    "C:/Program Files/Git/bin/bash.exe",
-    "C:/Program Files/Git/usr/bin/bash.exe",
-    "C:/Program Files (x86)/Git/bin/bash.exe",
-  ].filter(Boolean);
-  for (const c of candidates) { try { if (existsSync(c)) return c; } catch {} }
-  return null;
-}
-
-// When the shell refuses a name, keep its own words. The reason shown on a
-// deny must come from the interpreter that would have run the command, not
-// from us: deterministic (same machine, same words) and never argued with.
-// Normalized as "<name>: <the shell's phrase>", pure string ops.
-function shellWhy(raw, name) {
-  if (!raw) return null;
-  const line = raw.split(/\r?\n/).find(l => l.includes(name));
-  if (!line) return null;
-  let tail = line.slice(line.indexOf(name) + name.length);
-  tail = tail.replace(/^['"\s:]+/, "").replace(/\s+$/, "");
-  return tail ? name + ": " + tail : null;
-}
-
-function shellKnows(name, cwd, shell) {
-  try {
-    if (shell === "powershell") {
-      const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-Command",
-        "try { $null = Get-Command $env:CHECK_PROBE -ErrorAction Stop; exit 0 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }"],
-        { cwd, timeout: 4000, encoding: "utf8", env: { ...process.env, CHECK_PROBE: name } });
-      if (r.error) return null;
-      return { known: r.status === 0, why: r.status === 0 ? null : shellWhy(r.stderr, name) };
-    }
-    const bash = bashPath();
-    if (!bash) return null;
-    const r = spawnSync(bash, ["-c", 'type -- "$1"', "check", name],
-      { cwd, timeout: 4000, encoding: "utf8" });
-    if (r.error) return null;
-    return { known: r.status === 0, why: r.status === 0 ? null : shellWhy(r.stderr, name) };
-  } catch { return null; }
-}
-
-// Tri-state ground truth from the interpreter itself: true = every command
-// word proven resolvable, false = at least one proven unresolvable, null =
-// cannot be determined without executing (subshells, expansions) — abstain,
-// never guess.
-function allBinariesExist(command, cwd, shell, misses) {
-  try {
-    let bases = segmentBases(command);
-    if (shell !== "powershell") bases = bases.filter(b => !SHELL_BUILTINS.has(b));
-    if (bases.length === 0) return true;
-    if (bases.some(b => /[(){}$`]/.test(b))) return null;
-    let verdict = true;
-    for (const b of bases) {
-      const probe = shellKnows(b, cwd, shell);
-      if (probe === null) return null;
-      if (probe.known === false) {
-        verdict = false;
-        if (misses) misses.push(probe.why || b + ": not found");
-      }
-    }
-    return verdict;
-  } catch { return null; }
-}
-
-async function main() {
-  let f = "claude";
-  try {
-    let input = "";
-    for await (const chunk of process.stdin) input += chunk;
-    input = input.replace(/^/, "").trim();
-    // A firewall fails closed on a broken contract. Empty stdin means no tool
-    // is asking for a verdict (someone ran the CLI wrong): refuse loudly, and
-    // never print an "allow" nobody asked for. Garbage stdin means a tool IS
-    // asking but the payload is corrupt: deny, because we cannot see the
-    // command we are supposed to gate. Only an unreachable network fails open
-    // (Terms, section 5) — that path is below, and it is deliberate.
-    if (!input) {
-      process.stderr.write("check: no hook input on stdin. This entrypoint is for tool hooks; run --help for CLI usage.\n");
-      process.exit(1);
-    }
-    let p;
-    try { p = JSON.parse(input); } catch {
-      out("claude", false, "check: unreadable hook input (not JSON), command blocked");
-      return;
-    }
-    if (p.hook_event_name === "PostToolUse") { process.exit(0); return; }
-    f = detect(p);
-    const c = cmd(p, f);
-    if (!c) { out(f, true); return; }
-    const hookKey = getClientId();
-    if (!hookKey) { out(f, false, "check: GOL_CLIENT_ID not set. Get your key at https://golproductions.com/check"); return; }
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 5000);
-    // Ask the same interpreter that will run the command.
-    const misses = [];
-    const exists = allBinariesExist(c, p.cwd, p.tool_name === "PowerShell" ? "powershell" : "bash", misses);
-    // LOCAL FAST DENY: the shell just proved a command word does not resolve.
-    // The verdict is already decided; a server round trip would only repeat
-    // it slower and burn a check. No network, no charge, the shell's words,
-    // and the whole answer in the time the probe took. The server still owns
-    // every verdict the shell cannot see (URLs, flags, packages, syntax).
-    if (exists === false && misses.length) {
-      out(f, false, "denied by the shell that would run it. " + misses.join("; "));
-      return;
-    }
-    // Send only what the verdict needs. No transcript paths, no usernames
-    // beyond what cwd itself carries — the check is about the command.
-    const body = { command: c, cwd: p.cwd || process.cwd(), platform: f, channel: "npm", tool_name: p.tool_name, v: VERSION };
-    if (exists !== null) body.binary_exists = exists;
-    const res = await fetch(API, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": hookKey, "User-Agent": "c/" + VERSION },
-      body: JSON.stringify(body),
-      signal: controller.signal
-    });
-    clearTimeout(timer);
-    const d = await res.json();
-
-    // Billing and account states arrive as non-2xx and carry no `verdict`.
-    // Surface what the server actually said so the user knows this is about
-    // their account, not their command. Without this, the free-tier wall
-    // (HTTP 402) falls through to the generic "denied" below and reads like
-    // the command itself was rejected.
-    if (!res.ok) {
-      // Rate limit is a traffic state, not a verdict. A deny must mean "your
-      // command is wrong", never "you typed too fast" — heavy agent sessions
-      // hit 60/min in normal use. Same trade as the credits wall: warn, let
-      // the command run ungated, resume when the window clears.
-      if (res.status === 429 || /rate limit/i.test(d.reason || d.error || "")) {
-        outCreditsExhausted(f, "check: rate limited (60 checks/min), command ran unverified. Check resumes automatically.");
-        return;
-      }
-      // Server-side failure is the service breaking, not the command being
-      // wrong. Same law as an unreachable network (Terms, section 5): the
-      // gate's own outage must never block the user's work.
-      if (res.status >= 500) {
-        outCreditsExhausted(f, "check: validation service error (HTTP " + res.status + "), command ran unverified. Check resumes automatically.");
-        return;
-      }
-      if (res.status === 402) {
-        const free = d.daily_free || 120;
-        const upsell = d.upgrade || "Top up at https://www.golproductions.com/console.html";
-        outCreditsExhausted(f, `check: you've used all ${free} free checks for today and your balance is empty. Check is off until tomorrow — commands run unverified. Credits you buy never expire. ${upsell}`);
-        return;
-      }
-      out(f, false, d.reason || d.error || "check: request not authorized, command blocked");
-      return;
-    }
-
-    if (d.verdict === "runnable") { out(f, true); }
-    else {
-      // Prefer the shell's own words: when the interpreter that would run
-      // this command already said why it can't, that sentence is the reason.
-      // Server reason covers everything the shell can't see (URLs, syntax).
-      const local = misses.length ? "denied by the shell that would run it. " + misses.join("; ") : null;
-      out(f, false, local || d.reason || "denied. Address the issue before continuing.");
-    }
-  } catch {
-    // Network failure or timeout: fail OPEN. An unreachable validation
-    // service must never block the user's work (Terms, section 5).
-    outCreditsExhausted(f, "check: validation service unreachable, command ran unverified. Check resumes automatically.");
-  }
-}
-
-main();

package/src/mcp.js

@@ -1,171 +0,0 @@
-#!/usr/bin/env node
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-import { execFile, spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { platform } from "node:os";
-import { promisify } from "node:util";
-
-const execFileAsync = promisify(execFile);
-const VERSION = "3.2.8";
-const API = "https://triage.golproductions.com/preflight";
-const CLIENT_ID = process.env.GOL_CLIENT_ID;
-const IS_WIN = process.platform === "win32";
-
-if (!CLIENT_ID) {
-  process.stderr.write("check: GOL_CLIENT_ID environment variable is required.\nGet your key at https://www.golproductions.com/check.html\n");
-  process.exit(1);
-}
-
-// THE ROD (ported from index.js): do not model the shell — ask it. The
-// machine's own PATH resolution is the ground truth for whether a command
-// exists. Tri-state: true = proven present, false = proven absent, null =
-// cannot be determined without executing — abstain, never guess.
-const PREFIX_WORDS = new Set(["sudo", "nohup", "nice", "time", "timeout", "env"]);
-
-const SHELL_BUILTINS = new Set([
-  "cd", "echo", "printf", "pwd", "export", "set", "unset", "alias", "unalias",
-  "true", "false", "test", "[", "[[", "exit", "return", "break", "continue",
-  "shift", "source", ".", "eval", "exec", "trap", "wait", "jobs", "fg", "bg",
-  "read", "readonly", "local", "declare", "typeset", "let", "getopts", "hash",
-  "type", "command", "builtin", "ulimit", "umask", "times", "dirs", "pushd",
-  "popd", "for", "while", "until", "if", "then", "else", "elif", "fi", "do",
-  "done", "case", "esac", "in", "function", "select", "{", "}", "!",
-]);
-
-// Quote-aware: "./spaced name.sh" is ONE token, and connectors inside
-// quotes are literal text, not separators.
-function segmentBases(command) {
-  const segs = [[]];
-  let cur = "", q = null;
-  for (let i = 0; i < command.length; i++) {
-    const ch = command[i];
-    if (q) { if (ch === q) q = null; else cur += ch; continue; }
-    if (ch === '"' || ch === "'") { q = ch; continue; }
-    if (ch === "|" || ch === "&" || ch === ";" || ch === "\n") {
-      if (cur) { segs[segs.length - 1].push(cur); cur = ""; }
-      if (segs[segs.length - 1].length) segs.push([]);
-      if ((ch === "|" || ch === "&") && command[i + 1] === ch) i++;
-      continue;
-    }
-    if (/\s/.test(ch)) { if (cur) { segs[segs.length - 1].push(cur); cur = ""; } continue; }
-    cur += ch;
-  }
-  if (cur) segs[segs.length - 1].push(cur);
-
-  const bases = [];
-  for (const words of segs) {
-    let base = null;
-    for (const w of words) {
-      if (!w) continue;
-      if (PREFIX_WORDS.has(w)) continue;
-      if (/^[\d.]+[smhd]?$/.test(w)) continue;
-      if (w.includes("=") && !w.startsWith("-")) continue;
-      if (w.startsWith("-")) continue;
-      base = w;
-      break;
-    }
-    if (base) bases.push(base);
-  }
-  return bases;
-}
-
-// On Windows, bare "bash" is a trap: PATH can resolve to WSL's
-// System32\bash.exe — a different operating system. The MCP executor
-// runs cmd on Windows, but the probe still asks Git Bash for bash-family
-// commands; if it cannot be located, abstain.
-function bashPath() {
-  if (platform() !== "win32") return "bash";
-  const candidates = [
-    process.env.CLAUDE_CODE_GIT_BASH_PATH,
-    "C:/Program Files/Git/bin/bash.exe",
-    "C:/Program Files/Git/usr/bin/bash.exe",
-    "C:/Program Files (x86)/Git/bin/bash.exe",
-  ].filter(Boolean);
-  for (const c of candidates) { try { if (existsSync(c)) return c; } catch {} }
-  return null;
-}
-
-function shellKnows(name) {
-  try {
-    const bash = bashPath();
-    if (!bash) return null;
-    const r = spawnSync(bash, ["-c", 'type -- "$1" >/dev/null 2>&1', "check", name],
-      { timeout: 4000, stdio: "ignore" });
-    return r.error ? null : r.status === 0;
-  } catch { return null; }
-}
-
-function allBinariesExist(command) {
-  try {
-    let bases = segmentBases(command);
-    bases = bases.filter(b => !SHELL_BUILTINS.has(b));
-    if (bases.length === 0) return true;
-    if (bases.some(b => /[(){}$`]/.test(b))) return null;
-    let verdict = true;
-    for (const b of bases) {
-      const known = shellKnows(b);
-      if (known === null) return null;
-      if (known === false) verdict = false;
-    }
-    return verdict;
-  } catch { return null; }
-}
-
-async function validate(command) {
-  // Ask the interpreter before asking the server, same as the hook client.
-  const exists = allBinariesExist(command);
-  const body = { command, v: VERSION, channel: "mcp", platform: "mcp" };
-  if (exists !== null) body.binary_exists = exists;
-  const res = await fetch(API, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": CLIENT_ID, "User-Agent": "c/" + VERSION },
-    body: JSON.stringify(body)
-  });
-  const d = await res.json();
-  d._status = res.status;
-  return d;
-}
-
-// 402 = out of free checks with an empty balance. That is a billing state,
-// not a bad command: warn and let the command through unverified.
-const CREDITS_MSG = "Check: daily free checks used and balance is empty. Command NOT verified — Check resumes tomorrow or after a top-up at https://www.golproductions.com/console.html";
-
-const server = new McpServer({ name: "check", version: VERSION });
-
-server.tool(
-  "Check",
-  "Know if a command will work before running it. Returns 'runnable' or 'invalid'. $0.0068 AUD per Check.",
-  { command: z.string().max(10000).describe("The shell command to validate before execution") },
-  async ({ command }) => {
-    try {
-      const d = await validate(command);
-      if (d._status === 402) return { content: [{ type: "text", text: `Verdict: RUNNABLE (unverified). ${CREDITS_MSG}` }] };
-      if (!d.verdict) return { content: [{ type: "text", text: `Error: ${d.error || "unknown"}` }], isError: true };
-      return { content: [{ type: "text", text: `Verdict: ${d.verdict === "runnable" ? "RUNNABLE" : "INVALID"}` }] };
-    } catch (err) {
-      return { content: [{ type: "text", text: `Check API error: ${err.message}` }], isError: true };
-    }
-  }
-);
-
-server.tool(
-  "CheckAndExecute",
-  "Validate a command with Check, then execute it if runnable. Returns the command output if valid, or blocks it.",
-  { command: z.string().max(10000).describe("The shell command to validate and execute") },
-  async ({ command }) => {
-    try {
-      const d = await validate(command);
-      if (d._status !== 402 && d.verdict !== "runnable") return { content: [{ type: "text", text: "BLOCKED: " + (d.reason || "command is invalid") }] };
-      const { stdout, stderr } = await execFileAsync(IS_WIN ? "cmd" : "bash", IS_WIN ? ["/c", command] : ["-c", command], { timeout: 30000 });
-      return { content: [{ type: "text", text: (stdout || "") + (stderr ? "\nSTDERR: " + stderr : "") || "(no output)" }] };
-    } catch (err) {
-      if (err.stdout || err.stderr) return { content: [{ type: "text", text: `Exit ${err.code || 1}:\n${(err.stdout || "") + (err.stderr ? "\nSTDERR: " + err.stderr : "")}` }] };
-      return { content: [{ type: "text", text: `Error: ${err.message}` }], isError: true };
-    }
-  }
-);
-
-const transport = new StdioServerTransport();
-await server.connect(transport);