@great-arrow/cli 0.1.20 → 0.1.23

package/README.md

@@ -1,6 +1,6 @@
 # @great-arrow/cli (`gad`)
 
-Terminal-based access to the Great Arrow Digital platform — memory management, workspace administration, integration diagnostics, MCP tooling, and deployment operations.
+Terminal-based access to the Great Arrow Digital platform — memory management, workspace administration, integration diagnostics, and MCP tooling.
 
 ## Install
 
@@ -109,6 +109,14 @@ override: `ALLOW_FOREIGN_WORKTREE=1`.
 # Full health check (token, API, integrations, MCP)
 gad doctor
 
+# Claude Code surface: server entry, hook wiring, hook credential — and
+# whether every hook you have CONFIGURED can actually run. That last check
+# reads all four settings scopes (managed, user, project, local), because a
+# hook that cannot execute fails silently on every single session and no
+# repo-side test can see your user or local file.
+gad doctor claude
+gad doctor claude --enforce   # back up and repair what is repairable
+
 # Integration management
 gad integrations list
 gad integrations sync github
@@ -175,12 +183,9 @@ gad agent invoke research-analyst --task "Summarize Q2 metrics"
 gad ask "What did we decide about the caching layer?"
 ```
 
-### Deployment & Operations
+### Operations
 
 ```bash
-gad deploy              # Interactive confirmation
-gad deploy --confirm    # CI/CD (no prompt)
-gad migrate             # Run pending DB migrations
 gad smoke               # MCP smoke test suite
 ```
 

package/dist/index.js

@@ -9399,7 +9399,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.20";
+var CLI_VERSION = "0.1.23";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9427,9 +9427,10 @@ var ACCOUNT = "api-token";
 function credentialFilePath() {
   return join(homedir(), ".great-arrow", "credential");
 }
-async function loadKeytar() {
+async function loadEntry() {
   try {
-    return await import("keytar");
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    return new AsyncEntry(SERVICE, ACCOUNT);
   } catch {
     return null;
   }
@@ -9444,10 +9445,10 @@ async function readFileFallback() {
   }
 }
 async function getToken() {
-  const keytar = await loadKeytar();
-  if (keytar) {
+  const entry = await loadEntry();
+  if (entry) {
     try {
-      const value = await keytar.getPassword(SERVICE, ACCOUNT);
+      const value = await entry.getPassword();
       if (value) return value;
     } catch (err) {
       debugSwallow("keychain.getToken", err);
@@ -9456,10 +9457,10 @@ async function getToken() {
   return readFileFallback();
 }
 async function setToken(token) {
-  const keytar = await loadKeytar();
-  if (keytar) {
+  const entry = await loadEntry();
+  if (entry) {
     try {
-      await keytar.setPassword(SERVICE, ACCOUNT, token);
+      await entry.setPassword(token);
       return true;
     } catch (err) {
       debugSwallow("keychain.setToken", err);
@@ -9475,10 +9476,10 @@ async function setToken(token) {
   }
 }
 async function deleteToken() {
-  const keytar = await loadKeytar();
-  if (keytar) {
+  const entry = await loadEntry();
+  if (entry) {
     try {
-      await keytar.deletePassword(SERVICE, ACCOUNT);
+      await entry.deletePassword();
     } catch (err) {
       debugSwallow("keychain.deleteToken", err);
     }
@@ -12669,6 +12670,7 @@ import { dirname as dirname4, join as join5 } from "node:path";
 import { execFileSync as execFileSync5 } from "node:child_process";
 var CODEX_SERVER_NAME = "great-arrow";
 var CODEX_CLIENT_ID = "codex-cli";
+var CODEX_APPROVAL_POLICY = 'approval_policy = "never"';
 var SAFE_GLOBAL_MCP_SERVERS = /* @__PURE__ */ new Set([
   CODEX_SERVER_NAME,
   "great-arrow-kiro-terminal",
@@ -12747,7 +12749,7 @@ function repoKey(repoUrl) {
 function generateCodexConfigToml(apiUrl, repoUrl) {
   const repoHeader = repoUrl ? `X-Repo-URL = "${tomlEscape(repoUrl)}"
 ` : "";
-  return `approval_policy = "never"
+  return `${CODEX_APPROVAL_POLICY}
 
 [mcp_servers.${CODEX_SERVER_NAME}]
 url = "${tomlEscape(mcpEndpoint(apiUrl))}"
@@ -12818,14 +12820,20 @@ function removeServerSections(content, servers) {
   }).map((section) => section.text).join("").replace(/\n{3,}/g, "\n\n");
 }
 function upsertCodexServerBlock(existingContent, apiUrl, repoUrl) {
-  const block = generateCodexConfigToml(apiUrl, repoUrl).trimEnd();
+  const block = generateCodexConfigToml(apiUrl, repoUrl).replace(/^approval_policy\s*=.*\n\n/, "").trimEnd();
   const withoutGreatArrow = removeServerSections(
     existingContent,
     /* @__PURE__ */ new Set([CODEX_SERVER_NAME])
-  ).replace(/\s*$/, "");
-  if (!withoutGreatArrow) return `${block}
+  ).replace(/^\s*approval_policy\s*=.*(?:\n|$)/gm, "").replace(/^\s+/, "").replace(/\s*$/, "");
+  if (!withoutGreatArrow) {
+    return `${CODEX_APPROVAL_POLICY}
+
+${block}
 `;
-  return `${withoutGreatArrow}
+  }
+  return `${CODEX_APPROVAL_POLICY}
+
+${withoutGreatArrow}
 
 ${block}
 `;
@@ -13361,6 +13369,62 @@ function inspectHookConfig(content) {
   }
   return { parseError: false, url, token, issues };
 }
+function collectConfiguredHooks(scope, file, content) {
+  let parsed;
+  try {
+    parsed = content.trim() ? JSON.parse(content) : {};
+  } catch {
+    return [];
+  }
+  const hooks = asObject(asObject(parsed)?.hooks ?? null);
+  if (!hooks) return [];
+  const out = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      if (!group || !Array.isArray(group.hooks)) continue;
+      for (const hook of group.hooks) {
+        if (hook && typeof hook.command === "string" && hook.command.trim()) {
+          out.push({ scope, file, event, command: hook.command });
+        }
+      }
+    }
+  }
+  return out;
+}
+function nodeScriptTarget(command) {
+  const m = command.match(/\bnode\s+(?:"([^"]+)"|'([^']+)'|(\S+))/);
+  return m ? m[1] ?? m[2] ?? m[3] ?? null : null;
+}
+function gadVerb(command) {
+  return command.match(/(?:^|[;&|]\s*)gad\s+([a-z][a-z-]*)/)?.[1] ?? null;
+}
+function inspectConfiguredHooks(hooks, deps) {
+  const issues = [];
+  for (const hook of hooks) {
+    const where = `${hook.event} hook in ${hook.file}`;
+    const verb = gadVerb(hook.command);
+    if (verb !== null && !deps.knownGadVerbs.has(verb)) {
+      issues.push({
+        code: "hook_unknown_gad_verb",
+        level: "fail",
+        message: `${where} runs \`gad ${verb}\`, which this CLI does not define \u2014 it fails on every ${hook.event}`,
+        hint: `Remove that hook from ${hook.file}, or correct the verb (\`gad --help\` lists them).`
+      });
+      continue;
+    }
+    const script = nodeScriptTarget(hook.command);
+    if (script && !script.includes("$") && !deps.fileExists(script)) {
+      issues.push({
+        code: "hook_script_missing",
+        level: "fail",
+        message: `${where} runs a script that does not exist: ${script}`,
+        hint: `Re-run the installer to restore it, or remove the hook from ${hook.file}.`
+      });
+    }
+  }
+  return issues;
+}
 
 // src/lib/mcp-doctor.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -14395,6 +14459,49 @@ function claudeCommand() {
         }
       }
     }
+    {
+      let root = command;
+      while (root.parent) root = root.parent;
+      const knownGadVerbs = /* @__PURE__ */ new Set();
+      for (const sub of root.commands) {
+        knownGadVerbs.add(sub.name());
+        for (const alias of sub.aliases()) knownGadVerbs.add(alias);
+      }
+      const cwd = process.cwd();
+      const scopes = [
+        { scope: "managed", file: "/etc/claude-code/managed-settings.json" },
+        {
+          scope: "managed",
+          file: "/Library/Application Support/ClaudeCode/managed-settings.json"
+        },
+        { scope: "user", file: settingsPath },
+        { scope: "project", file: join5(cwd, ".claude", "settings.json") },
+        { scope: "local", file: join5(cwd, ".claude", "settings.local.json") }
+      ];
+      const configured = [];
+      for (const { scope, file } of scopes) {
+        if (!existsSync3(file)) continue;
+        configured.push(
+          ...collectConfiguredHooks(
+            scope,
+            file,
+            await readFile3(file, "utf8")
+          )
+        );
+      }
+      const hookIssues = inspectConfiguredHooks(configured, {
+        knownGadVerbs,
+        fileExists: existsSync3
+      });
+      toChecks("Configured hooks", hookIssues);
+      if (configured.length > 0 && hookIssues.length === 0) {
+        checks.push({
+          name: "Configured hooks: all runnable",
+          status: "pass",
+          message: `${configured.length} command hook(s) across ${new Set(configured.map((h) => h.file)).size} settings file(s) resolve`
+        });
+      }
+    }
     if (options.enforce) {
       const enforcement = {
         name: "Claude surface: enforcement",
@@ -15444,8 +15551,9 @@ async function readIfExists(path10) {
 }
 async function readKeychainOnly() {
   try {
-    const keytar = await import("keytar");
-    return await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    const entry = new AsyncEntry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    return await entry.getPassword() ?? null;
   } catch {
     return null;
   }
@@ -15716,135 +15824,6 @@ ${c.dim("Credential migration")}
 var mcpCommand = new Command("mcp").description("Manage and diagnose the MCP server connection").addCommand(startCommand).addCommand(statusCommand).addCommand(logsCommand).addCommand(testCommand).addCommand(doctorSubcommand).addCommand(installCommand);
 var mcp_default = mcpCommand;
 
-// src/commands/deploy.ts
-var DEPLOY_TIMEOUT_MS = 9e4;
-function deployCommand() {
-  const cmd = new Command("deploy").description("Trigger a production deployment").option("--confirm", "Skip interactive confirmation (required in CI)").option("--json", "Output as JSON").option("--quiet", "Suppress decorative output").option("--no-color", "Disable color output").action(async (options, command) => {
-    const g = globalOutputOpts(command);
-    const fmt = createFormatter({
-      json: g.json,
-      quiet: g.quiet,
-      isTTY: isTTY(),
-      noColor: g.noColor
-    });
-    if (!options.confirm) {
-      if (!isTTY()) {
-        fmt.error(
-          "Cannot deploy without confirmation in non-interactive mode."
-        );
-        fmt.info("Pass --confirm to bypass interactive confirmation in CI.");
-        process.exit(3 /* VALIDATION_ERROR */);
-      }
-      const confirmed = await confirm(
-        "\u26A0\uFE0F  This will deploy to production. Continue?"
-      );
-      if (!confirmed) {
-        fmt.info("Deploy cancelled.");
-        return;
-      }
-    }
-    const auth = await resolveAuth();
-    const client = new GadClient({
-      token: auth.token,
-      apiUrl: auth.apiUrl,
-      timeout: DEPLOY_TIMEOUT_MS
-    });
-    if (!options.quiet) {
-      fmt.info("Deploying to production...");
-    }
-    const result = await client.mcpCall("deploy_to_vercel", {});
-    if (g.json) {
-      process.stdout.write(JSON.stringify(result) + "\n");
-      return;
-    }
-    if (result.error) {
-      fmt.error(`Deployment failed: ${result.error}`);
-      process.exit(2 /* NETWORK_ERROR */);
-    }
-    if (result.url) {
-      fmt.success(`Deployment triggered successfully`);
-      fmt.info(`URL: ${result.url}`);
-    } else {
-      fmt.success("Deployment triggered successfully");
-    }
-    if (result.status) {
-      fmt.info(`Status: ${result.status}`);
-    }
-    if (result.buildId) {
-      fmt.info(`Build ID: ${result.buildId}`);
-    }
-  });
-  return cmd;
-}
-
-// src/commands/migrate.ts
-async function ensureConfirmation(hasConfirmFlag, tty2) {
-  if (hasConfirmFlag) {
-    return true;
-  }
-  if (!tty2) {
-    process.stderr.write(
-      "\u2717 --confirm flag is required in non-interactive environments.\n  Use: gad migrate --confirm\n"
-    );
-    process.exit(3 /* VALIDATION_ERROR */);
-  }
-  const confirmed = await confirm(
-    "This will run pending database migrations. Continue?"
-  );
-  if (!confirmed) {
-    process.stderr.write("Aborted.\n");
-  }
-  return confirmed;
-}
-function displayResults(result, fmt) {
-  const applied = result?.applied ?? 0;
-  const migrations = result?.migrations;
-  if (applied === 0) {
-    fmt.success("No pending migrations. Database is up to date.");
-    return;
-  }
-  fmt.success(
-    `${applied} migration${applied === 1 ? "" : "s"} applied successfully.`
-  );
-  if (migrations && migrations.length > 0) {
-    fmt.table(migrations, [
-      { key: "name", header: "Migration", width: 40 },
-      { key: "status", header: "Status", width: 12 }
-    ]);
-  }
-}
-var migrateCommand = new Command("migrate").description("Run pending database migrations").option("--confirm", "Skip confirmation prompt (required in non-TTY)").option("--json", "Output results as JSON").option("--quiet", "Suppress decorative output").action(async (opts, command) => {
-  const g = globalOutputOpts(command);
-  const tty2 = isTTY();
-  const fmt = createFormatter({
-    json: g.json,
-    quiet: g.quiet,
-    isTTY: tty2,
-    noColor: !tty2
-  });
-  const confirmed = await ensureConfirmation(Boolean(opts.confirm), tty2);
-  if (!confirmed) {
-    return;
-  }
-  const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
-  fmt.info("Running pending migrations\u2026");
-  const result = await client.mcpCall("apply_migration", {});
-  if (g.json) {
-    const applied = result?.applied ?? 0;
-    const status = result?.status ?? "complete";
-    fmt.table(
-      [{ applied, status }],
-      [
-        { key: "applied", header: "Applied" },
-        { key: "status", header: "Status" }
-      ]
-    );
-  } else {
-    displayResults(result, fmt);
-  }
-});
-
 // src/commands/smoke.ts
 var SMOKE_TESTS = [
   {
@@ -17632,8 +17611,6 @@ var COMMANDS = [
   "doctor",
   "integrations",
   "mcp",
-  "deploy",
-  "migrate",
   "smoke",
   "agent",
   "ask",
@@ -17706,8 +17683,6 @@ _gad() {
     'doctor:Run health checks'
     'integrations:Manage integrations (list, sync)'
     'mcp:MCP server management (status, logs, test, install)'
-    'deploy:Deploy to production'
-    'migrate:Run database migrations'
     'smoke:Run smoke tests'
     'agent:Manage agents (list, invoke)'
     'ask:Ask the orchestrator a question'
@@ -17766,8 +17741,6 @@ function generateFish() {
     doctor: "Run health checks",
     integrations: "Manage integrations",
     mcp: "MCP server management",
-    deploy: "Deploy to production",
-    migrate: "Run database migrations",
     smoke: "Run smoke tests",
     agent: "Manage agents",
     ask: "Ask the orchestrator a question",
@@ -21268,8 +21241,6 @@ program2.addCommand(mcp_default);
 program2.addCommand(agentCommand);
 program2.addCommand(askCommand());
 program2.addCommand(localCommand());
-program2.addCommand(deployCommand());
-program2.addCommand(migrateCommand);
 program2.addCommand(smokeCommand());
 program2.addCommand(openCommand());
 program2.addCommand(completionsCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.20",
+  "version": "0.1.23",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {
@@ -17,6 +17,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@napi-rs/keyring": "1.3.0",
     "commander": "^15.0.0",
     "update-notifier": "^7.3.1"
   },
@@ -44,9 +45,6 @@
     "url": "https://www.greatarrow.ai/support"
   },
   "author": "GreatArrow.ai <support@greatarrow.ai>",
-  "optionalDependencies": {
-    "keytar": "^7.9.0"
-  },
   "overrides": {
     "postcss": ">=8.5.23",
     "nanoid": "^3.3.17"