@great-arrow/cli 0.1.47 → 0.1.49

package/dist/index.js

@@ -104,7 +104,7 @@ var require_polyfills = __commonJS({
       }
       if (platform === "win32") {
         fs6.rename = typeof fs6.rename !== "function" ? fs6.rename : (function(fs$rename) {
-          function rename(from, to, cb) {
+          function rename2(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
@@ -124,8 +124,8 @@ var require_polyfills = __commonJS({
               if (cb) cb(er);
             });
           }
-          if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
-          return rename;
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
+          return rename2;
         })(fs6.rename);
       }
       fs6.read = typeof fs6.read !== "function" ? fs6.read : (function(fs$read) {
@@ -529,8 +529,8 @@ var require_graceful_fs = __commonJS({
       fs7.createReadStream = createReadStream;
       fs7.createWriteStream = createWriteStream;
       var fs$readFile = fs7.readFile;
-      fs7.readFile = readFile5;
-      function readFile5(path10, options, cb) {
+      fs7.readFile = readFile7;
+      function readFile7(path10, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path10, options, cb);
@@ -546,8 +546,8 @@ var require_graceful_fs = __commonJS({
         }
       }
       var fs$writeFile = fs7.writeFile;
-      fs7.writeFile = writeFile5;
-      function writeFile5(path10, data, options, cb) {
+      fs7.writeFile = writeFile6;
+      function writeFile6(path10, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$writeFile(path10, data, options, cb);
@@ -582,8 +582,8 @@ var require_graceful_fs = __commonJS({
       }
       var fs$copyFile = fs7.copyFile;
       if (fs$copyFile)
-        fs7.copyFile = copyFile2;
-      function copyFile2(src, dest, flags, cb) {
+        fs7.copyFile = copyFile3;
+      function copyFile3(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
           flags = 0;
@@ -1964,7 +1964,7 @@ var require_minimist = __commonJS({
 var require_rc = __commonJS({
   "node_modules/.pnpm/rc@1.2.8/node_modules/rc/index.js"(exports, module) {
     var cc = require_utils();
-    var join9 = __require("path").join;
+    var join10 = __require("path").join;
     var deepExtend = require_deep_extend();
     var etc = "/etc";
     var win = process.platform === "win32";
@@ -1989,15 +1989,15 @@ var require_rc = __commonJS({
       }
       if (!win)
         [
-          join9(etc, name, "config"),
-          join9(etc, name + "rc")
+          join10(etc, name, "config"),
+          join10(etc, name + "rc")
         ].forEach(addConfigFile);
       if (home)
         [
-          join9(home, ".config", name, "config"),
-          join9(home, ".config", name),
-          join9(home, "." + name, "config"),
-          join9(home, "." + name + "rc")
+          join10(home, ".config", name, "config"),
+          join10(home, ".config", name),
+          join10(home, "." + name, "config"),
+          join10(home, "." + name + "rc")
         ].forEach(addConfigFile);
       addConfigFile(cc.find("." + name + "rc"));
       if (env4.config) addConfigFile(env4.config);
@@ -2078,7 +2078,7 @@ var require_polyfills2 = __commonJS({
       }
       if (platform === "win32") {
         fs6.rename = typeof fs6.rename !== "function" ? fs6.rename : (function(fs$rename) {
-          function rename(from, to, cb) {
+          function rename2(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
@@ -2098,8 +2098,8 @@ var require_polyfills2 = __commonJS({
               if (cb) cb(er);
             });
           }
-          if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
-          return rename;
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
+          return rename2;
         })(fs6.rename);
       }
       fs6.read = typeof fs6.read !== "function" ? fs6.read : (function(fs$read) {
@@ -2503,8 +2503,8 @@ var require_graceful_fs2 = __commonJS({
       fs7.createReadStream = createReadStream;
       fs7.createWriteStream = createWriteStream;
       var fs$readFile = fs7.readFile;
-      fs7.readFile = readFile5;
-      function readFile5(path10, options, cb) {
+      fs7.readFile = readFile7;
+      function readFile7(path10, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path10, options, cb);
@@ -2520,8 +2520,8 @@ var require_graceful_fs2 = __commonJS({
         }
       }
       var fs$writeFile = fs7.writeFile;
-      fs7.writeFile = writeFile5;
-      function writeFile5(path10, data, options, cb) {
+      fs7.writeFile = writeFile6;
+      function writeFile6(path10, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$writeFile(path10, data, options, cb);
@@ -2556,8 +2556,8 @@ var require_graceful_fs2 = __commonJS({
       }
       var fs$copyFile = fs7.copyFile;
       if (fs$copyFile)
-        fs7.copyFile = copyFile2;
-      function copyFile2(src, dest, flags, cb) {
+        fs7.copyFile = copyFile3;
+      function copyFile3(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
           flags = 0;
@@ -3335,11 +3335,11 @@ var require_util = __commonJS({
           if (files.includes("node_modules") || files.includes("package.json") || files.includes("package.json5") || files.includes("package.yaml") || files.includes("pnpm-workspace.yaml")) {
             return name2;
           }
-          const dirname6 = path10.dirname(name2);
-          if (dirname6 === name2) {
+          const dirname7 = path10.dirname(name2);
+          if (dirname7 === name2) {
             return original;
           }
-          return find(dirname6, original);
+          return find(dirname7, original);
         } catch (error) {
           if (name2 === original) {
             if (error.code === "ENOENT") {
@@ -9399,7 +9399,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.47";
+var CLI_VERSION = "0.1.49";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9865,6 +9865,10 @@ function trimSlash(url) {
 }
 
 // src/lib/oauth/token-exchange.ts
+var TOKEN_HEADERS = {
+  "content-type": "application/x-www-form-urlencoded",
+  "user-agent": `gad-cli/${CLI_VERSION}`
+};
 var RefreshRejected = class extends Error {
   constructor(message) {
     super(message);
@@ -9898,7 +9902,7 @@ var TOKEN_POST_TIMEOUT_MS = 8e3;
 async function postToken(apiUrl, form, fetchImpl, timeoutMs = TOKEN_POST_TIMEOUT_MS) {
   const res = await fetchImpl(`${trimSlash2(apiUrl)}/api/oauth/token`, {
     method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
+    headers: TOKEN_HEADERS,
     body: new URLSearchParams(form).toString(),
     signal: AbortSignal.timeout(timeoutMs)
   });
@@ -9940,7 +9944,7 @@ async function revokeToken(opts) {
   try {
     const res = await doFetch(`${trimSlash2(opts.apiUrl)}/api/oauth/revoke`, {
       method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
+      headers: TOKEN_HEADERS,
       body: new URLSearchParams(form).toString(),
       signal: AbortSignal.timeout(TOKEN_POST_TIMEOUT_MS)
     });
@@ -10457,6 +10461,14 @@ async function resolveAuth() {
       tokenType: "personal"
     });
   }
+  const codexEnvToken = process.env.GREAT_ARROW_TOKEN;
+  if (codexEnvToken) {
+    return withWorkspace({
+      token: codexEnvToken,
+      apiUrl: configApiUrl,
+      tokenType: "personal"
+    });
+  }
   throw authError(
     "No authentication token found.",
     "Run 'gad login' to authenticate, or set the GAD_TOKEN environment variable."
@@ -10751,6 +10763,46 @@ function isRetryable(error) {
   }
   return false;
 }
+var RETRY_SAFE_TOOLS = /* @__PURE__ */ new Set([
+  "workspace_introspect",
+  "mcp_capabilities",
+  "tools_discover",
+  "memory_search",
+  "memory_list",
+  "memory_get",
+  "memory_tags",
+  "todo_list",
+  "todo_get",
+  "workspace_list",
+  "workspace_settings_get",
+  "surfaces_list",
+  "agent_list",
+  "engineering_guardrails_list",
+  "model_local_get",
+  "glance",
+  "did_you_know"
+]);
+var CONNECTION_PHASE_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "UND_ERR_CONNECT_TIMEOUT"
+]);
+function hasConnectionPhaseCode(value) {
+  if (!value || typeof value !== "object") return false;
+  const errors = value.errors;
+  if (Array.isArray(errors) && errors.length > 0) {
+    return errors.every(hasConnectionPhaseCode);
+  }
+  const code = value.code;
+  return typeof code === "string" && CONNECTION_PHASE_CODES.has(code);
+}
+function isConnectionPhaseFailure(error) {
+  if (!(error instanceof TypeError)) return false;
+  return hasConnectionPhaseCode(error.cause);
+}
 function isRetryableStatus(status) {
   return status >= 500 && status < 600;
 }
@@ -10806,7 +10858,7 @@ var GadClient = class {
   /**
    * Execute a fetch request with timeout and retry logic.
    */
-  async fetchWithRetry(url, init, timeoutMs) {
+  async fetchWithRetry(url, init, timeoutMs, policy = "transient") {
     const effectiveTimeout = timeoutMs ?? this.timeout;
     let lastError;
     for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
@@ -10818,7 +10870,7 @@ var GadClient = class {
           signal: controller.signal
         });
         clearTimeout(timer);
-        if (isRetryableStatus(response.status)) {
+        if (policy === "transient" && isRetryableStatus(response.status)) {
           lastError = response;
           if (attempt < MAX_RETRIES - 1) {
             await sleep(retryDelay(attempt));
@@ -10830,7 +10882,8 @@ var GadClient = class {
       } catch (error) {
         clearTimeout(timer);
         lastError = error;
-        if (isRetryable(error) && attempt < MAX_RETRIES - 1) {
+        const retryable = policy === "transient" ? isRetryable(error) : isConnectionPhaseFailure(error);
+        if (retryable && attempt < MAX_RETRIES - 1) {
           await sleep(retryDelay(attempt));
           continue;
         }
@@ -10899,7 +10952,8 @@ var GadClient = class {
           headers: this.buildHeaders(),
           body
         },
-        timeoutMs
+        timeoutMs,
+        RETRY_SAFE_TOOLS.has(toolName) ? "transient" : "connection-only"
       );
     } catch (error) {
       if (error instanceof CliError) throw error;
@@ -10991,11 +11045,16 @@ var GadClient = class {
     const url = `${this.apiUrl}${path10}`;
     let response;
     try {
-      response = await this.fetchWithRetry(url, {
-        method: "POST",
-        headers: this.buildHeaders(),
-        body: JSON.stringify(body)
-      });
+      response = await this.fetchWithRetry(
+        url,
+        {
+          method: "POST",
+          headers: this.buildHeaders(),
+          body: JSON.stringify(body)
+        },
+        void 0,
+        "connection-only"
+      );
     } catch (error) {
       if (error instanceof CliError) throw error;
       void captureCliEvent({
@@ -12966,10 +13025,10 @@ function guardrailsCommand() {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync3 } from "node:fs";
-import { copyFile, mkdir as mkdir4, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { existsSync as existsSync5 } from "node:fs";
+import { copyFile as copyFile2, mkdir as mkdir5, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname5, join as join8 } from "node:path";
 
 // src/lib/codex-config.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
@@ -13756,6 +13815,285 @@ function inspectConfiguredHooks(hooks, deps) {
   return issues;
 }
 
+// src/lib/suggest-hook.ts
+import { existsSync as existsSync3 } from "node:fs";
+import {
+  chmod,
+  copyFile,
+  mkdir as mkdir4,
+  readFile as readFile3,
+  rename,
+  unlink as unlink2,
+  writeFile as writeFile3
+} from "node:fs/promises";
+import { dirname as dirname4, join as join7 } from "node:path";
+import { fileURLToPath } from "node:url";
+var SUGGEST_HOOK_FILE = "gad-suggest-tools.mjs";
+var SUGGEST_HOOK_EVENT = "UserPromptSubmit";
+var SUGGEST_HOOK_DISCLOSURE = "Tool suggestions (optional, off by default): when on, every prompt you type in Claude Code is sent \u2014 its text only, up to 2,000 characters, never your session id, transcript or working directory \u2014 to greatarrow.ai over your own Great Arrow token, so it can name up to three Great Arrow tools that may help. The prompt is ranked and dropped: it is not stored and not logged. The hook gives up after 1.5 seconds and never blocks a prompt. Turn it off any time with `gad mcp suggest-tools off`.";
+function asObject2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function isOurs(hook) {
+  return !!hook && typeof hook.command === "string" && hook.command.includes(SUGGEST_HOOK_FILE);
+}
+function parseSettings(content) {
+  const parsed = content.trim() ? JSON.parse(content) : {};
+  const cfg = asObject2(parsed);
+  if (!cfg) throw new Error("settings.json is not a JSON object");
+  return cfg;
+}
+function promptGroups(cfg) {
+  const groups = asObject2(cfg.hooks)?.[SUGGEST_HOOK_EVENT];
+  return Array.isArray(groups) ? groups : [];
+}
+function isSuggestHookEnabled(settingsContent) {
+  try {
+    return promptGroups(parseSettings(settingsContent)).some(
+      (g) => Array.isArray(g?.hooks) && g.hooks.some(isOurs)
+    );
+  } catch {
+    return false;
+  }
+}
+function suggestHookCommand(scriptPath) {
+  return `node "${scriptPath}"`;
+}
+function planEnableSuggestHook(settingsContent, command) {
+  if (isSuggestHookEnabled(settingsContent)) {
+    return { content: settingsContent, changed: false };
+  }
+  const cfg = parseSettings(settingsContent);
+  const hooks = asObject2(cfg.hooks) ?? {};
+  cfg.hooks = hooks;
+  const groups = promptGroups(cfg);
+  groups.push({ hooks: [{ type: "command", command, timeout: 5 }] });
+  hooks[SUGGEST_HOOK_EVENT] = groups;
+  return { content: JSON.stringify(cfg, null, 2) + "\n", changed: true };
+}
+function planDisableSuggestHook(settingsContent) {
+  if (!isSuggestHookEnabled(settingsContent)) {
+    return { content: settingsContent, changed: false };
+  }
+  const cfg = parseSettings(settingsContent);
+  const hooks = asObject2(cfg.hooks);
+  const kept = promptGroups(cfg).map(
+    (g) => Array.isArray(g?.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isOurs(h)) } : g
+  ).filter((g) => !Array.isArray(g?.hooks) || g.hooks.length > 0);
+  if (kept.length > 0) hooks[SUGGEST_HOOK_EVENT] = kept;
+  else delete hooks[SUGGEST_HOOK_EVENT];
+  if (Object.keys(hooks).length === 0) delete cfg.hooks;
+  return { content: JSON.stringify(cfg, null, 2) + "\n", changed: true };
+}
+function suggestHookPaths(home) {
+  return {
+    settingsPath: join7(home, ".claude", "settings.json"),
+    scriptPath: join7(home, ".great-arrow", SUGGEST_HOOK_FILE),
+    hookConfigPath: join7(home, ".great-arrow", "hook-config.json")
+  };
+}
+function packagedSuggestHookPath() {
+  const here = dirname4(fileURLToPath(import.meta.url));
+  for (const candidate of [
+    join7(here, "hooks", SUGGEST_HOOK_FILE),
+    join7(here, "..", "..", "dist", "hooks", SUGGEST_HOOK_FILE)
+  ]) {
+    if (existsSync3(candidate)) return candidate;
+  }
+  return null;
+}
+async function readOrEmpty(path10) {
+  try {
+    return await readFile3(path10, "utf8");
+  } catch {
+    return "";
+  }
+}
+async function atomicWrite(path10, content, mode) {
+  await mkdir4(dirname4(path10), { recursive: true });
+  const tmp = `${path10}.tmp-${process.pid}`;
+  await writeFile3(tmp, content, mode === void 0 ? "utf8" : { mode });
+  await rename(tmp, path10);
+}
+function hasHookCredential(content) {
+  try {
+    const cfg = asObject2(JSON.parse(content));
+    return typeof cfg?.token === "string" && cfg.token.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+async function suggestHookStatus(home) {
+  const p = suggestHookPaths(home);
+  return {
+    enabled: isSuggestHookEnabled(await readOrEmpty(p.settingsPath)),
+    scriptPresent: existsSync3(p.scriptPath),
+    credentialPresent: hasHookCredential(await readOrEmpty(p.hookConfigPath))
+  };
+}
+async function enableSuggestHook(opts) {
+  const p = suggestHookPaths(opts.home);
+  const settings = await readOrEmpty(p.settingsPath);
+  const plan = planEnableSuggestHook(
+    settings,
+    suggestHookCommand(p.scriptPath)
+  );
+  await mkdir4(dirname4(p.scriptPath), { recursive: true, mode: 448 });
+  await copyFile(opts.packagedScript, p.scriptPath);
+  await chmod(p.scriptPath, 493);
+  if (plan.changed) await atomicWrite(p.settingsPath, plan.content);
+  return { changed: plan.changed };
+}
+async function disableSuggestHook(opts) {
+  const p = suggestHookPaths(opts.home);
+  const plan = planDisableSuggestHook(await readOrEmpty(p.settingsPath));
+  if (plan.changed) await atomicWrite(p.settingsPath, plan.content);
+  if (existsSync3(p.scriptPath)) await unlink2(p.scriptPath);
+  return { changed: plan.changed };
+}
+async function runSuggestHookOptIn(opts) {
+  if (opts.choice === false) {
+    await opts.disable();
+    return "disabled";
+  }
+  if (opts.choice === void 0 && !opts.interactive) return "unchanged";
+  opts.print(SUGGEST_HOOK_DISCLOSURE);
+  if (opts.choice === void 0) {
+    const yes = await opts.confirm("Turn on tool suggestions?");
+    if (!yes) return "unchanged";
+  }
+  await opts.enable();
+  return "enabled";
+}
+
+// src/lib/hook-credential.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { readFile as readFile4 } from "node:fs/promises";
+function issuesToChecks(issues) {
+  return issues.map((issue) => {
+    const check = {
+      name: `Hook credential: ${issue.code}`,
+      status: issue.level,
+      message: issue.message
+    };
+    if (issue.hint) check.hint = issue.hint;
+    return check;
+  });
+}
+function mergeHookConfig(existing, url, token) {
+  let base = {};
+  if (existing) {
+    try {
+      const parsed = JSON.parse(existing);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        base = parsed;
+      }
+    } catch {
+      base = {};
+    }
+  }
+  return JSON.stringify({ ...base, url, token }, null, 2);
+}
+async function ensureHookCredential(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const { hookConfigPath, apiUrl, auth } = opts;
+  const checks = [];
+  const repairs = [];
+  let url = null;
+  let token = null;
+  let existing = null;
+  if (existsSync4(hookConfigPath)) {
+    existing = await readFile4(hookConfigPath, "utf8");
+    const inspection = inspectHookConfig(existing);
+    url = inspection.url;
+    token = inspection.token;
+    checks.push(...issuesToChecks(inspection.issues));
+  } else {
+    checks.push({
+      name: "Hook credential: not found",
+      status: "warn",
+      message: `${hookConfigPath} does not exist \u2014 hooks cannot authenticate`,
+      hint: "Run with --enforce to write it from your gad login credential."
+    });
+  }
+  const probe = async (t, base) => {
+    const res = await fetchImpl(`${base}/api/mcp/ping`, {
+      headers: { Authorization: `Bearer ${t}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    return res.status;
+  };
+  let tokenOk = false;
+  if (token) {
+    try {
+      const status = await probe(token, url ?? apiUrl);
+      tokenOk = status >= 200 && status < 300;
+      if (status === 401 || status === 403) {
+        checks.push({
+          name: "Hook credential: token rejected",
+          status: "fail",
+          message: `The hook-config.json token was rejected (HTTP ${status}) \u2014 transcript capture and the session glance are silently failing`,
+          hint: "Run with --enforce to rewrite it from your gad login credential."
+        });
+      } else if (!tokenOk) {
+        checks.push({
+          name: "Hook credential: probe inconclusive",
+          status: "warn",
+          message: `Ping returned HTTP ${status} \u2014 could not confirm the hook token`
+        });
+      } else {
+        checks.push({
+          name: "Hook credential: token valid",
+          status: "pass",
+          message: "hook-config.json token authenticates"
+        });
+      }
+    } catch (e) {
+      checks.push({
+        name: "Hook credential: probe failed",
+        status: "warn",
+        message: `Could not reach ${url ?? apiUrl}: ${String(
+          e instanceof Error ? e.message : e
+        )}`
+      });
+    }
+  }
+  let verified = tokenOk;
+  if (opts.repair && !tokenOk) {
+    if (auth?.token) {
+      await opts.write(
+        hookConfigPath,
+        mergeHookConfig(existing, apiUrl, auth.token)
+      );
+      repairs.push("hook-config.json: rewrote from gad credential");
+      try {
+        const status = await probe(auth.token, apiUrl);
+        verified = status >= 200 && status < 300;
+        checks.push({
+          name: "Hook credential: after repair",
+          status: verified ? "pass" : "fail",
+          message: verified ? "Rewritten token authenticates" : `Rewritten token still failing (HTTP ${status})`
+        });
+      } catch (err) {
+        checks.push({
+          name: "Hook credential: after repair",
+          status: "warn",
+          message: `Rewrote the token but could not re-probe it (${err instanceof Error ? err.message : String(err)})`,
+          hint: "Re-run `gad doctor` once the network is reachable to confirm."
+        });
+      }
+    } else {
+      checks.push({
+        name: "Hook credential: no repair source",
+        status: "fail",
+        message: "No gad login credential available to rewrite hook-config.json",
+        hint: "Run `gad login` first, then re-run with --enforce."
+      });
+    }
+  }
+  return { checks, repairs, verified };
+}
+
 // src/lib/mcp-doctor.ts
 import { createHash as createHash2 } from "node:crypto";
 
@@ -13927,7 +14265,7 @@ function knownConfigLocations(home, cwd, platform = process.platform, appData) {
   ];
 }
 var GREAT_ARROW_NAME = /great[-_ ]?arrow|ai[-_]memory/i;
-function asObject2(value) {
+function asObject3(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function isGreatArrowServer(name, entry) {
@@ -13948,13 +14286,13 @@ function classifySurface(entry, clientId, hooksInstalled) {
 }
 function serverMapsFromJson(parsed, serversKey) {
   const maps = [];
-  const top = asObject2(parsed[serversKey]);
+  const top = asObject3(parsed[serversKey]);
   if (top) maps.push({ servers: top });
-  const projects = asObject2(parsed.projects);
+  const projects = asObject3(parsed.projects);
   if (projects) {
     for (const [dir, value] of Object.entries(projects)) {
-      const section = asObject2(value);
-      const servers = section ? asObject2(section[serversKey]) : null;
+      const section = asObject3(value);
+      const servers = section ? asObject3(section[serversKey]) : null;
       if (servers && Object.keys(servers).length > 0) {
         maps.push({ servers, projectDir: dir });
       }
@@ -13992,7 +14330,7 @@ function findGreatArrowEntries(location, content, options = {}) {
   if (location.format === "toml") return findCodexEntries(location, content);
   let parsed = null;
   try {
-    parsed = asObject2(JSON.parse(content));
+    parsed = asObject3(JSON.parse(content));
   } catch {
     return [];
   }
@@ -14004,7 +14342,7 @@ function findGreatArrowEntries(location, content, options = {}) {
     serversKey
   )) {
     for (const [name, value] of Object.entries(servers)) {
-      const entry = asObject2(value);
+      const entry = asObject3(value);
       if (!entry) continue;
       if (!isGreatArrowServer(name, entry)) continue;
       entries.push({
@@ -14027,7 +14365,7 @@ function findGreatArrowEntries(location, content, options = {}) {
 function hasGreatArrowHooks(settingsContent) {
   let parsed = null;
   try {
-    parsed = asObject2(JSON.parse(settingsContent));
+    parsed = asObject3(JSON.parse(settingsContent));
   } catch {
     return false;
   }
@@ -14101,7 +14439,7 @@ function describeStoredCredential(raw) {
   if (!trimmed) return null;
   if (trimmed.startsWith("{")) {
     try {
-      const parsed = asObject2(JSON.parse(trimmed));
+      const parsed = asObject3(JSON.parse(trimmed));
       const refreshToken = parsed?.refreshToken;
       if (typeof refreshToken === "string" && refreshToken.length > 0) {
         return {
@@ -14500,7 +14838,7 @@ async function checkMcp(auth) {
   }
 }
 function defaultCodexConfigPath() {
-  return join7(homedir5(), ".codex", "config.toml");
+  return join8(homedir5(), ".codex", "config.toml");
 }
 function codexIssuesToChecks(issues) {
   return issues.map((issue) => {
@@ -14538,16 +14876,16 @@ function codexCommand() {
       });
       const configPath = options.config ?? defaultCodexConfigPath();
       const expectedRepoUrl = options.expectedRepo ?? detectGitOrigin2();
-      let content = existsSync3(configPath) ? await readFile3(configPath, "utf8") : "";
+      let content = existsSync5(configPath) ? await readFile5(configPath, "utf8") : "";
       let backupPath = null;
       let removedServers = [];
       if (options.enforce) {
         const apiUrl = extractCodexGreatArrowApiUrl(content) ?? (await resolveAuth()).apiUrl;
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        await mkdir4(dirname4(configPath), { recursive: true });
+        await mkdir5(dirname5(configPath), { recursive: true });
         if (content.trim()) {
           backupPath = `${configPath}.bak.${timestamp}`;
-          await copyFile(configPath, backupPath);
+          await copyFile2(configPath, backupPath);
         }
         content = upsertCodexServerBlock(content, apiUrl, expectedRepoUrl);
         const preRepair = inspectCodexConfig(content, expectedRepoUrl);
@@ -14557,7 +14895,7 @@ function codexCommand() {
         );
         content = repaired.content;
         removedServers = repaired.removedServers;
-        await writeFile3(configPath, content, "utf8");
+        await writeFile4(configPath, content, "utf8");
       }
       const inspection = inspectCodexConfig(content, expectedRepoUrl);
       const checks = codexIssuesToChecks(inspection.issues);
@@ -14639,11 +14977,11 @@ function claudeCommand() {
       noColor: g.noColor
     });
     const home = homedir5();
-    const gaDir = join7(home, ".great-arrow");
-    const userConfigPath = join7(home, ".claude.json");
-    const settingsPath = join7(home, ".claude", "settings.json");
-    const hookConfigPath = join7(gaDir, "hook-config.json");
-    const glanceHookPath = join7(gaDir, "claude-glance-hook.mjs");
+    const gaDir = join8(home, ".great-arrow");
+    const userConfigPath = join8(home, ".claude.json");
+    const settingsPath = join8(home, ".claude", "settings.json");
+    const hookConfigPath = join8(gaDir, "hook-config.json");
+    const glanceHookPath = join8(gaDir, "claude-glance-hook.mjs");
     const checks = [];
     const repairs = [];
     const backups = [];
@@ -14660,13 +14998,13 @@ function claudeCommand() {
       }
     };
     const backupAndWrite = async (path10, content) => {
-      if (existsSync3(path10)) {
+      if (existsSync5(path10)) {
         const backupPath = `${path10}.bak.${timestamp}`;
-        await copyFile(path10, backupPath);
+        await copyFile2(path10, backupPath);
         backups.push(backupPath);
       }
-      await mkdir4(dirname4(path10), { recursive: true });
-      await writeFile3(path10, content, "utf8");
+      await mkdir5(dirname5(path10), { recursive: true });
+      await writeFile4(path10, content, "utf8");
     };
     let auth = null;
     try {
@@ -14675,8 +15013,8 @@ function claudeCommand() {
       auth = null;
     }
     const apiUrl = auth?.apiUrl ?? "https://www.greatarrow.ai";
-    if (existsSync3(userConfigPath)) {
-      let content = await readFile3(userConfigPath, "utf8");
+    if (existsSync5(userConfigPath)) {
+      let content = await readFile5(userConfigPath, "utf8");
       if (options.enforce) {
         const repaired = repairClaudeUserConfig(content);
         if (repaired.changed.length > 0) {
@@ -14696,7 +15034,7 @@ function claudeCommand() {
       });
     }
     {
-      let content = existsSync3(settingsPath) ? await readFile3(settingsPath, "utf8") : "";
+      let content = existsSync5(settingsPath) ? await readFile5(settingsPath, "utf8") : "";
       if (options.enforce) {
         const glanceCommand = `node "${glanceHookPath}"`;
         const repaired = repairClaudeHookSettings(content, glanceCommand);
@@ -14705,15 +15043,15 @@ function claudeCommand() {
           content = repaired.content;
           repairs.push(...repaired.changed.map((c) => `settings.json: ${c}`));
         }
-        if (!existsSync3(glanceHookPath)) {
+        if (!existsSync5(glanceHookPath)) {
           try {
             const res = await fetch(
               `${apiUrl}/api/install/claude-glance-hook`,
               { signal: AbortSignal.timeout(1e4) }
             );
             if (res.ok) {
-              await mkdir4(gaDir, { recursive: true });
-              await writeFile3(glanceHookPath, await res.text(), {
+              await mkdir5(gaDir, { recursive: true });
+              await writeFile4(glanceHookPath, await res.text(), {
                 mode: 493
               });
               repairs.push(`downloaded ${glanceHookPath}`);
@@ -14734,7 +15072,7 @@ function claudeCommand() {
         }
       }
       toChecks("Claude hooks", inspectClaudeHookSettings(content).issues);
-      if (!options.enforce && !existsSync3(glanceHookPath)) {
+      if (!options.enforce && !existsSync5(glanceHookPath)) {
         checks.push({
           name: "Glance hook script: missing",
           status: "warn",
@@ -14744,96 +15082,31 @@ function claudeCommand() {
       }
     }
     {
-      let url = null;
-      let token = null;
-      if (existsSync3(hookConfigPath)) {
-        const inspection = inspectHookConfig(
-          await readFile3(hookConfigPath, "utf8")
-        );
-        url = inspection.url;
-        token = inspection.token;
-        toChecks("Hook credential", inspection.issues);
-      } else {
-        checks.push({
-          name: "Hook credential: not found",
-          status: "warn",
-          message: `${hookConfigPath} does not exist \u2014 hooks cannot authenticate`,
-          hint: "Run with --enforce to write it from your gad login credential."
-        });
-      }
-      const probe = async (t, base) => {
-        const res = await fetch(`${base}/api/mcp/ping`, {
-          headers: { Authorization: `Bearer ${t}` },
-          signal: AbortSignal.timeout(1e4)
-        });
-        return res.status;
+      const credential = await ensureHookCredential({
+        hookConfigPath,
+        apiUrl,
+        auth,
+        repair: Boolean(options.enforce),
+        write: backupAndWrite
+      });
+      checks.push(...credential.checks);
+      repairs.push(...credential.repairs);
+    }
+    {
+      const suggest = await suggestHookStatus(home);
+      const check = {
+        name: "Tool suggestions (opt-in)",
+        status: "pass",
+        message: suggest.enabled ? "ON \u2014 each prompt's text is sent to Great Arrow for tool suggestions" : "OFF"
       };
-      let tokenOk = false;
-      if (token) {
-        try {
-          const status = await probe(token, url ?? apiUrl);
-          tokenOk = status >= 200 && status < 300;
-          if (status === 401 || status === 403) {
-            checks.push({
-              name: "Hook credential: token rejected",
-              status: "fail",
-              message: `The hook-config.json token was rejected (HTTP ${status}) \u2014 transcript capture and the session glance are silently failing`,
-              hint: "Run with --enforce to rewrite it from your gad login credential."
-            });
-          } else if (!tokenOk) {
-            checks.push({
-              name: "Hook credential: probe inconclusive",
-              status: "warn",
-              message: `Ping returned HTTP ${status} \u2014 could not confirm the hook token`
-            });
-          } else {
-            checks.push({
-              name: "Hook credential: token valid",
-              status: "pass",
-              message: "hook-config.json token authenticates"
-            });
-          }
-        } catch (e) {
-          checks.push({
-            name: "Hook credential: probe failed",
-            status: "warn",
-            message: `Could not reach ${url ?? apiUrl}: ${String(
-              e instanceof Error ? e.message : e
-            )}`
-          });
-        }
-      }
-      if (options.enforce && !tokenOk) {
-        if (auth?.token) {
-          await backupAndWrite(
-            hookConfigPath,
-            JSON.stringify({ url: apiUrl, token: auth.token }, null, 2)
-          );
-          repairs.push("hook-config.json: rewrote from gad credential");
-          try {
-            const status = await probe(auth.token, apiUrl);
-            checks.push({
-              name: "Hook credential: after repair",
-              status: status >= 200 && status < 300 ? "pass" : "fail",
-              message: status >= 200 && status < 300 ? "Rewritten token authenticates" : `Rewritten token still failing (HTTP ${status})`
-            });
-          } catch (err) {
-            checks.push({
-              name: "Hook credential: after repair",
-              status: "warn",
-              message: `Rewrote the token but could not re-probe it (${err instanceof Error ? err.message : String(err)})`,
-              hint: "Re-run `gad doctor` once the network is reachable to confirm."
-            });
-          }
-        } else {
-          checks.push({
-            name: "Hook credential: no repair source",
-            status: "fail",
-            message: "No gad login credential available to rewrite hook-config.json",
-            hint: "Run `gad login` first, then re-run with --enforce."
-          });
-        }
+      if (suggest.enabled && !suggest.credentialPresent) {
+        check.status = "warn";
+        check.message = "ON but no hook credential \u2014 the hook sends nothing";
+        check.hint = "Run `gad login`, then `gad mcp suggest-tools on`.";
+      } else if (!suggest.enabled) {
+        check.hint = "Opt in with `gad mcp suggest-tools on`.";
       }
+      checks.push(check);
     }
     {
       let root = command;
@@ -14851,23 +15124,23 @@ function claudeCommand() {
           file: "/Library/Application Support/ClaudeCode/managed-settings.json"
         },
         { scope: "user", file: settingsPath },
-        { scope: "project", file: join7(cwd, ".claude", "settings.json") },
-        { scope: "local", file: join7(cwd, ".claude", "settings.local.json") }
+        { scope: "project", file: join8(cwd, ".claude", "settings.json") },
+        { scope: "local", file: join8(cwd, ".claude", "settings.local.json") }
       ];
       const configured = [];
       for (const { scope, file } of scopes) {
-        if (!existsSync3(file)) continue;
+        if (!existsSync5(file)) continue;
         configured.push(
           ...collectConfiguredHooks(
             scope,
             file,
-            await readFile3(file, "utf8")
+            await readFile5(file, "utf8")
           )
         );
       }
       const hookIssues = inspectConfiguredHooks(configured, {
         knownGadVerbs,
-        fileExists: existsSync3
+        fileExists: existsSync5
       });
       toChecks("Configured hooks", hookIssues);
       if (configured.length > 0 && hookIssues.length === 0) {
@@ -14923,10 +15196,10 @@ function claudeCommand() {
 function defaultJsonClientConfigs() {
   const home = homedir5();
   return [
-    { name: "Claude Code", path: join7(home, ".claude.json") },
-    { name: "Cursor", path: join7(home, ".cursor", "mcp.json") },
-    { name: "Kiro", path: join7(home, ".kiro", "settings", "mcp.json") },
-    { name: "Gemini CLI", path: join7(home, ".gemini", "settings.json") }
+    { name: "Claude Code", path: join8(home, ".claude.json") },
+    { name: "Cursor", path: join8(home, ".cursor", "mcp.json") },
+    { name: "Kiro", path: join8(home, ".kiro", "settings", "mcp.json") },
+    { name: "Gemini CLI", path: join8(home, ".gemini", "settings.json") }
   ];
 }
 function clientsCommand() {
@@ -14952,8 +15225,8 @@ function clientsCommand() {
       const checks = [];
       const results = [];
       for (const { name, path: path10 } of defaultJsonClientConfigs()) {
-        if (!existsSync3(path10)) continue;
-        let content = await readFile3(path10, "utf8");
+        if (!existsSync5(path10)) continue;
+        let content = await readFile5(path10, "utf8");
         let backupPath = null;
         let removedServers = [];
         if (options.enforce) {
@@ -14961,14 +15234,14 @@ function clientsCommand() {
           if (!pre.parseError && pre.staleRepoServers.length > 0) {
             const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
             backupPath = `${path10}.bak.${timestamp}`;
-            await copyFile(path10, backupPath);
+            await copyFile2(path10, backupPath);
             const repaired = repairJsonMcpConfig(
               content,
               pre.staleRepoServers
             );
             content = repaired.content;
             removedServers = repaired.removedServers;
-            await writeFile3(path10, content, "utf8");
+            await writeFile4(path10, content, "utf8");
           }
         }
         const inspection = inspectJsonMcpConfig(content, expectedRepoUrl);
@@ -15463,6 +15736,107 @@ async function runStdioBridge(options) {
   });
 }
 
+// src/commands/suggest-tools.ts
+import { homedir as homedir6 } from "node:os";
+var HOOK_CREDENTIAL_FIX_LINE = "Tool suggestions are on, but the hook's Great Arrow token could not be confirmed \u2014 run `gad doctor claude --enforce` (after `gad login` if needed) to fix it.";
+async function enableSuggestTools(home, deps = {}) {
+  const packagedScript = deps.packagedScript === void 0 ? packagedSuggestHookPath() : deps.packagedScript;
+  if (!packagedScript) {
+    throw validationError(
+      "The tool-suggestion hook script is missing from this @great-arrow/cli install.",
+      "Reinstall with `npm install -g @great-arrow/cli@latest`."
+    );
+  }
+  await enableSuggestHook({ home, packagedScript });
+  let auth = null;
+  try {
+    auth = await (deps.resolveAuth ?? resolveAuth)();
+  } catch {
+    auth = null;
+  }
+  const credential = await ensureHookCredential({
+    hookConfigPath: suggestHookPaths(home).hookConfigPath,
+    apiUrl: auth?.apiUrl ?? DEFAULT_API_URL,
+    auth,
+    repair: true,
+    write: (path10, content) => atomicWrite(path10, content, 384),
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+  });
+  return { verified: credential.verified };
+}
+async function applySuggestToolsChoice(choice, home = homedir6(), deps = {}) {
+  const out = deps.out ?? createFormatter({
+    json: false,
+    quiet: false,
+    isTTY: isTTY(),
+    noColor: false
+  });
+  let verified = true;
+  const outcome = await runSuggestHookOptIn({
+    choice,
+    interactive: deps.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    print: (line) => out.info(line),
+    confirm: deps.confirm ?? confirm,
+    enable: async () => {
+      verified = (await enableSuggestTools(home, deps)).verified;
+    },
+    disable: () => disableSuggestHook({ home })
+  });
+  const { settingsPath } = suggestHookPaths(home);
+  if (outcome === "enabled") {
+    out.success(`Tool suggestions ON (registered in ${settingsPath}).`);
+    if (!verified) out.warn(HOOK_CREDENTIAL_FIX_LINE);
+  } else if (outcome === "disabled") {
+    out.success("Tool suggestions OFF (our hook entry removed).");
+  }
+  return outcome;
+}
+function suggestToolsCommand() {
+  return new Command("suggest-tools").description(
+    "Opt-in Claude Code prompt hook that names Great Arrow tools which may help (sends each prompt's text)"
+  ).argument("[action]", "on | off | status", "status").option("--yes", "Accept the disclosure without an interactive prompt").option("--json", "Output status as JSON").action(
+    async (action, options) => {
+      const home = homedir6();
+      if (action === "status") {
+        const status = await suggestHookStatus(home);
+        if (options.json) {
+          process.stdout.write(JSON.stringify(status) + "\n");
+          return;
+        }
+        process.stdout.write(
+          `Tool suggestions: ${status.enabled ? "ON" : "OFF"}` + (status.enabled && !status.scriptPresent ? " (hook script missing \u2014 run `gad mcp suggest-tools on`)" : "") + (status.enabled && !status.credentialPresent ? " (no hook credential \u2014 run `gad login`, then `gad mcp suggest-tools on`)" : "") + "\n"
+        );
+        return;
+      }
+      if (action === "off") {
+        await applySuggestToolsChoice(false, home);
+        return;
+      }
+      if (action === "on") {
+        const outcome = await applySuggestToolsChoice(
+          options.yes ? true : void 0,
+          home
+        );
+        if (outcome === "unchanged") {
+          if (!(process.stdin.isTTY && process.stdout.isTTY)) {
+            process.stdout.write(`${SUGGEST_HOOK_DISCLOSURE}
+
+`);
+          }
+          process.stdout.write(
+            "Tool suggestions left OFF. To turn on without a prompt: `gad mcp suggest-tools on --yes`.\n"
+          );
+        }
+        return;
+      }
+      throw validationError(
+        `Unknown action "${action}".`,
+        "Use one of: on, off, status."
+      );
+    }
+  );
+}
+
 // src/commands/mcp.ts
 var SUPPORTED_CLIENTS = [
   "claude",
@@ -15572,33 +15946,33 @@ async function pathExists(path10) {
   }
 }
 async function installCodexConfig(apiUrl, token, repoUrl) {
-  const { homedir: homedir7 } = await import("node:os");
-  const { join: join9 } = await import("node:path");
-  const { chmod, copyFile: copyFile2, mkdir: mkdir6, readFile: readFile5, writeFile: writeFile5 } = await import("node:fs/promises");
-  const codexDir = join9(homedir7(), ".codex");
-  const configPath = join9(codexDir, "config.toml");
-  const envPath = join9(codexDir, ".env");
+  const { homedir: homedir8 } = await import("node:os");
+  const { join: join10 } = await import("node:path");
+  const { chmod: chmod2, copyFile: copyFile3, mkdir: mkdir7, readFile: readFile7, writeFile: writeFile6 } = await import("node:fs/promises");
+  const codexDir = join10(homedir8(), ".codex");
+  const configPath = join10(codexDir, "config.toml");
+  const envPath = join10(codexDir, ".env");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  await mkdir6(codexDir, { recursive: true });
-  const existingConfig = await pathExists(configPath) ? await readFile5(configPath, "utf8") : "";
+  await mkdir7(codexDir, { recursive: true });
+  const existingConfig = await pathExists(configPath) ? await readFile7(configPath, "utf8") : "";
   if (existingConfig.trim()) {
-    await copyFile2(configPath, `${configPath}.bak.${timestamp}`);
+    await copyFile3(configPath, `${configPath}.bak.${timestamp}`);
   }
-  await writeFile5(
+  await writeFile6(
     configPath,
     upsertCodexServerBlock(existingConfig, apiUrl, repoUrl),
     "utf8"
   );
-  const existingEnv = await pathExists(envPath) ? await readFile5(envPath, "utf8") : "";
+  const existingEnv = await pathExists(envPath) ? await readFile7(envPath, "utf8") : "";
   if (existingEnv.trim()) {
-    await copyFile2(envPath, `${envPath}.bak.${timestamp}`);
+    await copyFile3(envPath, `${envPath}.bak.${timestamp}`);
   }
-  await writeFile5(
+  await writeFile6(
     envPath,
     upsertEnvValue(existingEnv, "GREAT_ARROW_TOKEN", token),
     "utf8"
   );
-  await chmod(envPath, 384);
+  await chmod2(envPath, 384);
   return { configPath, envPath };
 }
 var startCommand = new Command("start").description(
@@ -15825,6 +16199,12 @@ var installCommand = new Command("install").description("Generate MCP configurat
 ).option("--stdout", "Print config to stdout instead of writing file").option(
   "--repo-url <url>",
   "Repo URL to pin MCP requests to (defaults to current git origin)"
+).option(
+  "--suggest-tools",
+  "claude only: turn on the opt-in prompt hook that sends each prompt's text to Great Arrow for tool suggestions"
+).option(
+  "--no-suggest-tools",
+  "claude only: turn the tool-suggestion prompt hook off (removes only its entry)"
 ).action(
   async (clientName, options) => {
     const fmt = createFormatter({
@@ -15876,15 +16256,15 @@ var installCommand = new Command("install").description("Generate MCP configurat
         process.stdout.write(configJson2 + "\n");
         return;
       }
-      const { homedir: homedir7 } = await import("node:os");
-      const { join: join10 } = await import("node:path");
-      const { mkdir: mkdir6, readFile: readFile5, writeFile: writeFile6 } = await import("node:fs/promises");
-      const geminiDir = join10(homedir7(), ".gemini");
-      const mcpPath = join10(geminiDir, "settings.json");
-      await mkdir6(geminiDir, { recursive: true });
+      const { homedir: homedir8 } = await import("node:os");
+      const { join: join11 } = await import("node:path");
+      const { mkdir: mkdir7, readFile: readFile7, writeFile: writeFile7 } = await import("node:fs/promises");
+      const geminiDir = join11(homedir8(), ".gemini");
+      const mcpPath = join11(geminiDir, "settings.json");
+      await mkdir7(geminiDir, { recursive: true });
       let existingConfig = {};
       try {
-        const content = await readFile5(mcpPath, "utf-8");
+        const content = await readFile7(mcpPath, "utf-8");
         existingConfig = JSON.parse(content);
       } catch {
         existingConfig = {};
@@ -15896,20 +16276,20 @@ var installCommand = new Command("install").description("Generate MCP configurat
           ...config2.mcpServers
         }
       };
-      await writeFile6(
+      await writeFile7(
         mcpPath,
         JSON.stringify(existingConfig, null, 2) + "\n",
         "utf-8"
       );
       fmt.success(`Wrote gemini MCP config to ${mcpPath}`);
-      const agyMcpDir = join10(
+      const agyMcpDir = join11(
         geminiDir,
         "antigravity-cli",
         "mcp",
         MCP_SERVER_NAME
       );
-      await mkdir6(agyMcpDir, { recursive: true });
-      const instructionsPath = join10(agyMcpDir, "instructions.md");
+      await mkdir7(agyMcpDir, { recursive: true });
+      const instructionsPath = join11(agyMcpDir, "instructions.md");
       const instructionsContent = `You are connected to greatarrow.ai - the user's private workspace memory + integrations brain.
 
 CRITICAL DIRECTIVE (MANDATORY STANDARD):
@@ -15925,7 +16305,7 @@ THREE-LAYER LIVE TASK TRACKING:
 - Maintain client-native harness plans, Great Arrow Kanban cards (\`todo_create\`, \`todo_update\`), and resume states.
 
 Always assume full autonomy to leverage these tools to their maximum extent.`;
-      await writeFile6(instructionsPath, instructionsContent, "utf-8");
+      await writeFile7(instructionsPath, instructionsContent, "utf-8");
       fmt.success(`Wrote gemini MCP instructions to ${instructionsPath}`);
       return;
     }
@@ -15940,25 +16320,28 @@ Always assume full autonomy to leverage these tools to their maximum extent.`;
       process.stdout.write(configJson + "\n");
       return;
     }
-    const { writeFile: writeFile5 } = await import("node:fs/promises");
-    const { join: join9 } = await import("node:path");
-    const outputPath = join9(process.cwd(), ".mcp.json");
-    await writeFile5(outputPath, configJson + "\n", { mode: 384 });
+    const { writeFile: writeFile6 } = await import("node:fs/promises");
+    const { join: join10 } = await import("node:path");
+    const outputPath = join10(process.cwd(), ".mcp.json");
+    await writeFile6(outputPath, configJson + "\n", { mode: 384 });
     fmt.success(`Wrote ${clientName} MCP config to .mcp.json`);
     if (await mcpJsonAtRiskOfCommit(process.cwd())) {
       fmt.warn(
         ".mcp.json contains an API token and is NOT gitignored here \u2014 add '.mcp.json' to .gitignore before committing."
       );
     }
+    if (clientName === "claude") {
+      await applySuggestToolsChoice(options.suggestTools);
+    }
   }
 );
 var KEYCHAIN_SERVICE = "GreatArrowDigital";
 var KEYCHAIN_ACCOUNT = "api-token";
 var OAUTH_CRED_FILENAME = "oauth-credential.json";
 async function readIfExists(path10) {
-  const { readFile: readFile5 } = await import("node:fs/promises");
+  const { readFile: readFile7 } = await import("node:fs/promises");
   try {
-    return await readFile5(path10, "utf8");
+    return await readFile7(path10, "utf8");
   } catch {
     return null;
   }
@@ -15973,13 +16356,13 @@ async function readKeychainOnly() {
   }
 }
 async function resolveProxyScript(override) {
-  const { homedir: homedir7 } = await import("node:os");
-  const { join: join9 } = await import("node:path");
+  const { homedir: homedir8 } = await import("node:os");
+  const { join: join10 } = await import("node:path");
   const candidates = [
     override,
     process.env.GAD_PROXY_SCRIPT,
-    join9(homedir7(), ".great-arrow", "mcp-server.mjs"),
-    join9(process.cwd(), "scripts", "mcp-server.mjs")
+    join10(homedir8(), ".great-arrow", "mcp-server.mjs"),
+    join10(process.cwd(), "scripts", "mcp-server.mjs")
   ].filter((c) => Boolean(c));
   for (const candidate of candidates) {
     if (await pathExists(candidate)) return candidate;
@@ -16003,13 +16386,13 @@ async function runProxyDiagnostics(scriptPath) {
   }
 }
 async function findLegacyStores(cwd) {
-  const { join: join9 } = await import("node:path");
+  const { join: join10 } = await import("node:path");
   const { readdir } = await import("node:fs/promises");
   const dirs = /* @__PURE__ */ new Set([cwd]);
   try {
-    const worktreeRoot = join9(cwd, ".claude", "worktrees");
+    const worktreeRoot = join10(cwd, ".claude", "worktrees");
     for (const entry of await readdir(worktreeRoot, { withFileTypes: true })) {
-      if (entry.isDirectory()) dirs.add(join9(worktreeRoot, entry.name));
+      if (entry.isDirectory()) dirs.add(join10(worktreeRoot, entry.name));
     }
   } catch (err) {
     debugSwallow("mcp.findLegacyStores(worktrees)", err);
@@ -16031,18 +16414,18 @@ async function findLegacyStores(cwd) {
   }
   const stores = [];
   for (const dir of dirs) {
-    const path10 = join9(dir, ".mcp", OAUTH_CRED_FILENAME);
+    const path10 = join10(dir, ".mcp", OAUTH_CRED_FILENAME);
     const raw = await readIfExists(path10);
     if (raw !== null) stores.push({ path: path10, raw });
   }
   return stores;
 }
 async function scanConnections() {
-  const { homedir: homedir7 } = await import("node:os");
-  const { join: join9 } = await import("node:path");
-  const home = homedir7();
+  const { homedir: homedir8 } = await import("node:os");
+  const { join: join10 } = await import("node:path");
+  const home = homedir8();
   const hookSettings = await readIfExists(
-    join9(home, ".claude", "settings.json")
+    join10(home, ".claude", "settings.json")
   );
   const hooksInstalled = hookSettings ? hasGreatArrowHooks(hookSettings) : false;
   const entries = [];
@@ -16075,29 +16458,29 @@ async function probeEndpoint() {
   }
 }
 async function applyMigration(plan) {
-  const { homedir: homedir7 } = await import("node:os");
-  const { join: join9 } = await import("node:path");
-  const { mkdir: mkdir6, rename, writeFile: writeFile5 } = await import("node:fs/promises");
+  const { homedir: homedir8 } = await import("node:os");
+  const { join: join10 } = await import("node:path");
+  const { mkdir: mkdir7, rename: rename2, writeFile: writeFile6 } = await import("node:fs/promises");
   const applied = [];
-  const dir = join9(homedir7(), ".great-arrow");
-  await mkdir6(dir, { recursive: true, mode: 448 });
+  const dir = join10(homedir8(), ".great-arrow");
+  await mkdir7(dir, { recursive: true, mode: 448 });
   if (plan.seedFrom) {
     const raw = await readIfExists(plan.seedFrom);
     if (raw !== null) {
-      const target = join9(dir, OAUTH_CRED_FILENAME);
+      const target = join10(dir, OAUTH_CRED_FILENAME);
       const tmp = `${target}.tmp`;
-      await writeFile5(tmp, raw, { mode: 384 });
-      await rename(tmp, target);
+      await writeFile6(tmp, raw, { mode: 384 });
+      await rename2(tmp, target);
       applied.push(`Copied ${plan.seedFrom} \u2192 ${target}`);
     }
   }
   if (plan.syncKeychainToFile) {
     const raw = await readKeychainOnly();
     if (raw) {
-      const target = join9(dir, "credential");
+      const target = join10(dir, "credential");
       const tmp = `${target}.tmp`;
-      await writeFile5(tmp, raw, { mode: 384 });
-      await rename(tmp, target);
+      await writeFile6(tmp, raw, { mode: 384 });
+      await rename2(tmp, target);
       applied.push(`Wrote the keychain credential to ${target}`);
     }
   }
@@ -16120,19 +16503,19 @@ var doctorSubcommand = new Command("doctor").description(
       noColor: false
     });
     const c = createColor(jsonFlag);
-    const { homedir: homedir7 } = await import("node:os");
-    const { join: join9 } = await import("node:path");
-    const home = homedir7();
+    const { homedir: homedir8 } = await import("node:os");
+    const { join: join10 } = await import("node:path");
+    const home = homedir8();
     const proxyPath = await resolveProxyScript(options.proxy);
     const diagnostics = proxyPath ? await runProxyDiagnostics(proxyPath) : null;
     const entries = await scanConnections();
     const duplicates = detectDuplicates(entries);
     const keychain = await readKeychainOnly();
     const credentialFile = await readIfExists(
-      join9(home, ".great-arrow", "credential")
+      join10(home, ".great-arrow", "credential")
     );
     const userStore = await readIfExists(
-      join9(home, ".great-arrow", OAUTH_CRED_FILENAME)
+      join10(home, ".great-arrow", OAUTH_CRED_FILENAME)
     );
     const legacyStores = await findLegacyStores(process.cwd());
     const findings = [
@@ -16235,7 +16618,7 @@ ${c.dim("Credential migration")}
     }
   }
 );
-var mcpCommand = new Command("mcp").description("Manage and diagnose the MCP server connection").addCommand(startCommand).addCommand(statusCommand).addCommand(logsCommand).addCommand(testCommand).addCommand(doctorSubcommand).addCommand(installCommand);
+var mcpCommand = new Command("mcp").description("Manage and diagnose the MCP server connection").addCommand(startCommand).addCommand(statusCommand).addCommand(logsCommand).addCommand(testCommand).addCommand(doctorSubcommand).addCommand(installCommand).addCommand(suggestToolsCommand());
 var mcp_default = mcpCommand;
 
 // src/commands/smoke.ts
@@ -16556,9 +16939,9 @@ function askCommand() {
 }
 
 // src/lib/glance-footer.ts
-import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir5 } from "node:fs/promises";
-import { homedir as homedir6 } from "node:os";
-import { join as join8, dirname as dirname5 } from "node:path";
+import { readFile as readFile6, writeFile as writeFile5, mkdir as mkdir6 } from "node:fs/promises";
+import { homedir as homedir7 } from "node:os";
+import { join as join9, dirname as dirname6 } from "node:path";
 
 // src/lib/seen.ts
 var SEEN_TIMEOUT_MS = 1e3;
@@ -16945,11 +17328,11 @@ function shouldRequestTip(input) {
   return now - state.lastTipAt >= TIP_THROTTLE_INTERVAL_MS;
 }
 function getGlanceStatePath() {
-  return join8(homedir6(), ".gad", "glance-state.json");
+  return join9(homedir7(), ".gad", "glance-state.json");
 }
 async function loadGlanceState() {
   try {
-    const content = await readFile4(getGlanceStatePath(), "utf-8");
+    const content = await readFile6(getGlanceStatePath(), "utf-8");
     const parsed = JSON.parse(content);
     if (typeof parsed === "object" && parsed !== null) {
       return parsed;
@@ -16961,8 +17344,8 @@ async function loadGlanceState() {
 }
 async function saveGlanceState(state) {
   const path10 = getGlanceStatePath();
-  await mkdir5(dirname5(path10), { recursive: true });
-  await writeFile4(path10, JSON.stringify(state), "utf-8");
+  await mkdir6(dirname6(path10), { recursive: true });
+  await writeFile5(path10, JSON.stringify(state), "utf-8");
 }
 function glanceItemUrl(href, apiUrl) {
   if (!href) return null;
@@ -18844,7 +19227,7 @@ function completionsCommand() {
 // node_modules/.pnpm/update-notifier@7.3.1/node_modules/update-notifier/update-notifier.js
 import process11 from "node:process";
 import { spawn } from "node:child_process";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import path9 from "node:path";
 import { format } from "node:util";
 
@@ -20995,7 +21378,7 @@ var isNpmOrYarn = isNpm || isYarn;
 // node_modules/.pnpm/is-installed-globally@1.0.0/node_modules/is-installed-globally/index.js
 import fs5 from "node:fs";
 import path8 from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // node_modules/.pnpm/global-directory@4.0.1/node_modules/global-directory/index.js
 var import_ini = __toESM(require_ini2(), 1);
@@ -21099,7 +21482,7 @@ function isPathInside(childPath, parentPath) {
 }
 
 // node_modules/.pnpm/is-installed-globally@1.0.0/node_modules/is-installed-globally/index.js
-var __dirname2 = path8.dirname(fileURLToPath(import.meta.url));
+var __dirname2 = path8.dirname(fileURLToPath2(import.meta.url));
 var isInstalledGlobally = (() => {
   try {
     return isPathInside(__dirname2, global_directory_default.yarn.packages) || isPathInside(__dirname2, fs5.realpathSync(global_directory_default.npm.packages));
@@ -22081,7 +22464,7 @@ function pupa(template, data, { ignoreMissing = false, transform = ({ value }) =
 }
 
 // node_modules/.pnpm/update-notifier@7.3.1/node_modules/update-notifier/update-notifier.js
-var __dirname3 = path9.dirname(fileURLToPath2(import.meta.url));
+var __dirname3 = path9.dirname(fileURLToPath3(import.meta.url));
 var ONE_DAY = 1e3 * 60 * 60 * 24;
 var UpdateNotifier = class {
   // Public