@hunyed15/codecgc 0.1.12 → 0.2.1

package/README.md

@@ -16,6 +16,13 @@ CLI 仍然保留，用于本地调试、CI 检查和 MCP 不可用时的回退
 
 安全边界：Claude 可以维护需求、规划、文档、审查和工作流状态；产品代码实现必须经由 CodeCGC 路由到 Codex 或 Gemini。项目 hook 会拦截 `Edit`、`Write`、`MultiEdit`、`Bash` 和 `PowerShell`，防止 Claude 用直接编辑或 shell 写入绕过路由。
 
+## 环境要求
+
+- Node.js >= 20
+- npm >= 9
+- Python >= 3.10
+- 可选：Claude Code、Codex CLI、Gemini CLI
+
 ## 安装
 
 全局安装 CLI：
@@ -30,7 +37,7 @@ npm install -g @hunyed15/codecgc --registry=https://registry.npmjs.org/
 
 ```bash
 cd your-project
-cgc-install
+cgc-init
 cgc-start
 cgc-status
 cgc-doctor
@@ -39,17 +46,17 @@ cgc-doctor
 在 Claude 中可以使用对应 slash command：
 
 ```text
-/cgc-install
+/cgc-init
 /cgc-start
 /cgc-status
 /cgc-doctor
 ```
 
-`/cgc-install` 和 `cgc-install` 默认都是项目级安装。它们会把集成文件写入当前项目，而不是写入 `~/.claude`。只有用户显式请求 user 模式时，才会处理用户级 Claude 集成。
+`/cgc-init` 和 `cgc-init` 默认都是项目级安装。它们会把集成文件写入当前项目，不会写入 `~/.claude` 等全局目录。
 
 ## 安装后生成的项目文件
 
-`cgc-install` 会在目标项目中创建或同步：
+`cgc-init` 会在目标项目中创建或同步：
 
 ```text
 .mcp.json
@@ -150,7 +157,7 @@ cgc-external-audit
 
 ```bash
 python -m pytest tests --basetemp D:\tmp\codecgc-pytest
-python -m compileall -q scripts codecgcmcp\src codexmcp\src geminimcp\src
+python -m compileall -q scripts mcp\codecgcmcp\src mcp\codexmcp\src mcp\geminimcp\src
 python scripts\audit_codecgc_package_runtime.py --format json
 python scripts\audit_codecgc_release_readiness.py --format json
 npm pack --dry-run --json
@@ -165,6 +172,47 @@ set CODECGC_RELEASE_PROBE_ROOT=D:\tmp
 python scripts\audit_codecgc_release_readiness.py --format json
 ```
 
+## 常见问题
+
+### `cgc` 命令找不到
+
+确认 npm 全局 bin 目录已加入 `PATH`：
+
+```bash
+npm config get prefix
+```
+
+然后检查对应系统的全局 bin 路径是否在环境变量中。
+
+### `cgc-doctor` 提示 Python 或 MCP 依赖缺失
+
+先确认 Python 可用：
+
+```bash
+python --version
+```
+
+再安装核心依赖：
+
+```bash
+python -m pip install -r requirements.txt
+```
+
+如果是在源码开发环境中，可以按 `cgc-doctor` 输出的建议执行 editable install。
+
+### 项目级集成缺失或过期
+
+在目标项目根目录重新执行：
+
+```bash
+cgc-init
+cgc-status
+```
+
+### 写入被 hook 拦截
+
+检查 `model-routing.yaml`。如果目标路径属于 unknown 或 shared，应该先明确文件归属或拆分任务，而不是绕过 hook。
+
 ## 参考文档
 
 - [快速开始](codecgc/reference/quickstart.md)

package/bin/{cgc-install.js → cgc-init.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-process.env.CODECGC_BIN_NAME = "cgc-install";
+process.env.CODECGC_BIN_NAME = "cgc-init";
 require("./codecgc.js");

package/bin/codecgc.js

@@ -42,7 +42,7 @@ const helpText = `CodeCGC 命令入口
   cgc --latest
   cgc --slug <workflow-slug>
   cgc-start [--format json|summary] [--workspace <dir>]
-  cgc-install [--mode local|user-dry-run|user|status|doctor|start] [--workspace <dir>] [--user-root <dir>]
+  cgc-init [--mode local|status|doctor|start] [--workspace <dir>]
   cgc-status [--format json|summary]
   cgc-doctor [--format json|summary]
   cgc-package-audit [--format json|summary]
@@ -81,7 +81,7 @@ const helpText = `CodeCGC 命令入口
   我只想让 CodeCGC 告诉我下一步该跑哪个命令
     cgc-route ...
   我想把 CodeCGC 安装或重新同步到当前项目
-    cgc-install
+    cgc-init
   我刚装完，想看当前项目下一步怎么开始
     cgc-start
   我想知道集成面现在是否就绪
@@ -107,7 +107,7 @@ const helpText = `CodeCGC 命令入口
 
 命令职责:
   cgc-start          显示当前项目的首次使用入口和下一步动作
-  cgc-install        同步项目级或用户级集成面
+  cgc-init        同步项目级集成面
   cgc-status         检查集成是否就绪，并给出下一步
   cgc-doctor         检查运行前置、执行器导入与项目集成状态
   cgc-package-audit  检查发布包是否覆盖运行时依赖
@@ -126,7 +126,7 @@ const helpText = `CodeCGC 命令入口
   version            输出当前产品壳版本
 
 首次使用:
-  1. 先在目标项目根目录执行 cgc-install
+  1. 先在目标项目根目录执行 cgc-init
   2. 执行 cgc-start 查看项目本地入口说明
   3. 再执行 cgc-status，必要时补 cgc-doctor
   4. 然后直接使用 cgc "<自然语言需求>" 或 cgc-entry
@@ -147,7 +147,7 @@ const helpText = `CodeCGC 命令入口
   cgc-test --flow feature --slug 2026-05-01-demo-login-ui --step-number 2 --dry-run
   cgc-review --audit-file codecgc/execution/demo-login-ui-step-1.json --decision accepted
   cgc-route --flow feature --slug 2026-05-01-demo-login-ui
-  cgc-install
+  cgc-init
   cgc-status
   cgc-status --format summary
   cgc-doctor --format summary
@@ -157,8 +157,7 @@ const helpText = `CodeCGC 命令入口
   cgc-release-readiness --format summary
   cgc-lifecycle --format summary
   cgc-history --status open --last 10
-  cgc-install --mode user-dry-run --user-root C:\\Users\\Admin\\.claude
-  cgc-install --workspace D:\\Projects\\MyApp
+  cgc-init --workspace D:\\Projects\\MyApp
   cgc-entry --request "新增一个登录页面，放在 src/components/LoginForm.tsx"
 
 环境变量:
@@ -185,7 +184,7 @@ const startHelpText = `CodeCGC Start
     summary 用于新手入口摘要，json 用于调试或自动化消费。
 
 推荐用法:
-  cgc-install
+  cgc-init
   cgc-start
   cgc-status
   cgc-doctor
@@ -195,7 +194,7 @@ const startHelpText = `CodeCGC Start
 const installHelpText = `CodeCGC 安装与自检
 
 用法:
-  cgc-install [--mode <local|user-dry-run|user|status|doctor|start>] [--workspace <dir>] [--user-root <dir>] [--format <json|summary>]
+  cgc-init [--mode <local|status|doctor|start>] [--workspace <dir>] [--format <json|summary>]
 
 用途:
   准备、检查或修复 CodeCGC 在 Claude 与 MCP 启动链路上的集成面。
@@ -203,12 +202,8 @@ const installHelpText = `CodeCGC 安装与自检
 模式:
   local
     把项目级 .mcp.json、.claude/settings.json 与 route-edit.ps1 hook 同步到目标工作区。
-  user-dry-run
-    只预演用户级 Claude 集成，不写入文件。
-  user
-    把用户级 Claude 集成写入指定的 Claude 根目录。
   status
-    检查项目级集成是否就绪，并附带用户级集成预览状态。
+    检查项目级集成是否就绪。
   doctor
     检查运行前置、执行器可导入性，以及项目级集成是否就绪。
   start
@@ -217,19 +212,16 @@ const installHelpText = `CodeCGC 安装与自检
 主要参数:
   --workspace <dir>
     local/status/doctor 模式下的目标项目根目录。默认使用当前 shell 所在目录。
-  --user-root <dir>
-    user 与 user-dry-run 模式下显式指定 Claude 用户目录。
   --format <json|summary>
     面向 Claude 或人工阅读时建议使用 summary；排查底层细节时用 json。
 
 推荐用法:
-  cgc-install
+  cgc-init
   cgc-start
-  cgc-install --workspace D:\\Projects\\MyApp
-  cgc-install --mode start --format summary
-  cgc-install --mode status --format summary
-  cgc-install --mode doctor --format summary
-  cgc-install --mode user-dry-run --user-root C:\\Users\\Admin\\.claude
+  cgc-init --workspace D:\\Projects\\MyApp
+  cgc-init --mode start --format summary
+  cgc-init --mode status --format summary
+  cgc-init --mode doctor --format summary
 
 相关命令:
   cgc-start
@@ -274,7 +266,7 @@ const statusHelpText = `CodeCGC 安装状态
 相关命令:
   cgc-start
     查看当前项目首次使用入口。
-  cgc-install
+  cgc-init
     同步或修复当前项目集成面。
   cgc-doctor
     检查运行前置、执行器导入和项目集成状态。
@@ -306,7 +298,7 @@ const doctorHelpText = `CodeCGC Doctor
 相关命令:
   cgc-status
     快速查看项目集成是否就绪。
-  cgc-install
+  cgc-init
     同步或修复集成文件。
   cgc-package-audit
     检查发布包运行面与发布就绪状态。
@@ -333,7 +325,7 @@ const packageAuditHelpText = `CodeCGC 发布包审计
   cgc-package-audit --format json
 
 相关命令:
-  cgc-install
+  cgc-init
     检查并同步当前项目的 Claude/MCP 集成面。
   cgc-status
     查看当前项目集成状态。
@@ -1109,10 +1101,13 @@ function normalizeWorkflowHelpText(rawText, subcommand) {
     .replaceAll("python  scripts/codecgc_cli.py", "cgc");
 }
 
+const BINARY_ALIASES = { "cgc-init": "cgc-install" };
+
 function resolveCommandInvocation(invokedName, rawArgs) {
-    if (DASH_COMMANDS.has(invokedName)) {
+  const resolvedName = BINARY_ALIASES[invokedName] || invokedName;
+    if (DASH_COMMANDS.has(resolvedName)) {
       return {
-        subcommand: invokedName.slice(4),
+        subcommand: resolvedName.slice(4),
         rest: rawArgs,
         invokedAsRoot: false,
       };

package/codecgc/cgc/SKILL.md

@@ -20,7 +20,7 @@ Before answering:
 
 ## Route Table
 
-- installing or repairing CodeCGC in a repo: `cgc-install` and `cgc-onboard`
+- installing or repairing CodeCGC in a repo: `cgc-init` and `cgc-onboard`
 - shaping or clarifying a request: `cgc-plan`
 - starting or continuing feature delivery: `cgc-build`
 - starting or continuing issue fixing: `cgc-fix`

package/codecgc/cgc-arch/SKILL.md

@@ -26,7 +26,7 @@ Read:
 Then inspect:
 
 - accepted feature or issue artifacts related to the change
-- relevant files under `scripts/`, `bin/`, `.claude/`, `codexmcp/`, `geminimcp/`
+- relevant files under `scripts/`, `bin/`, `.claude/`, `mcp/codexmcp/`, `mcp/geminimcp/`
 - existing docs under `codecgc/architecture/`
 
 ## What Belongs Here

package/codecgc/cgc-onboard/SKILL.md

@@ -42,7 +42,7 @@ Also inspect:
 After onboarding, the repo should be ready to use:
 
 - `cgc`
-- `cgc-install`
+- `cgc-init`
 - `cgc-status`
 - `cgc-doctor`
 - `cgc-plan`

package/codecgc/reference/README.md

@@ -33,7 +33,7 @@ Claude /cgc -> CodeCGC MCP tool -> CodeCGC runtime -> Codex or Gemini executor
 The normal install path is:
 
 ```text
-npm global install -> project-local cgc-install -> cgc-start -> project .mcp.json / .claude / model-routing.yaml
+npm global install -> project-local cgc-init -> cgc-start -> project .mcp.json / .claude / model-routing.yaml
 ```
 
 User-level Claude installation is optional and must be explicit.
@@ -43,7 +43,7 @@ User-level Claude installation is optional and must be explicit.
 The preferred Claude-facing commands are intentionally small:
 
 - `/cgc`
-- `/cgc-install`
+- `/cgc-init`
 - `/cgc-status`
 - `/cgc-doctor`
 - `/cgc-review`

package/codecgc/reference/mcp-tool-surface.md

@@ -91,6 +91,7 @@ Runtime payloads may provide a more specific `error_category` or `failure_catego
 - `codecgc.test`
 - `codecgc.package_audit`
 - `codecgc.external_audit`
+- `codecgc.external_status`
 - `codecgc.release_readiness`
 - `codecgc.lifecycle`
 

package/codecgc/reference/onboarding.md

@@ -1,10 +1,10 @@
 # CodeCGC Onboarding
 
-This document defines the real-project entry experience after `cgc-install`.
+This document defines the real-project entry experience after `cgc-init`.
 
 ## Contract
 
-`cgc-install` is project-local by default. After a successful install, a target project should contain:
+`cgc-init` is project-local by default. After a successful install, a target project should contain:
 
 ```text
 codecgc/START_HERE.md
@@ -18,7 +18,7 @@ codecgc/START_HERE.md
 Inside Claude:
 
 ```text
-/cgc-install
+/cgc-init
 /cgc-start
 /cgc-status
 /cgc-doctor
@@ -28,7 +28,7 @@ Inside Claude:
 Outside Claude:
 
 ```bash
-cgc-install
+cgc-init
 cgc-start
 cgc-status
 cgc-doctor
@@ -42,13 +42,13 @@ cgc "新增一个登录页面，放在 src/components/LoginForm.tsx"
 - whether `codecgc/START_HERE.md` exists and matches the current onboarding contract
 - the project-local onboarding file path
 - the shortest next actions for Claude and CLI users
-- the fallback action when onboarding is missing, normally `/cgc-install` or `cgc-install`
+- the fallback action when onboarding is missing, normally `/cgc-init` or `cgc-init`
 
 The CLI equivalent is `cgc-start`.
 
 ## Why This Exists
 
-Without an explicit first-run entry, new users can install successfully but still be unsure whether to use `/cgc`, `/cgc-install`, `cgc-plan`, `cgc-build`, or another lower-level command. The onboarding surface keeps ordinary users on the product path:
+Without an explicit first-run entry, new users can install successfully but still be unsure whether to use `/cgc`, `/cgc-init`, `cgc-plan`, `cgc-build`, or another lower-level command. The onboarding surface keeps ordinary users on the product path:
 
 ```text
 install -> start -> status/doctor -> /cgc natural-language request
@@ -61,7 +61,7 @@ Maintainer commands remain available, but they should not be required for the fi
 If `cgc-start` reports missing onboarding, run:
 
 ```bash
-cgc-install
+cgc-init
 ```
 
 If `cgc-status` reports `onboarding_file` as missing or outdated, the same repair action applies.

package/codecgc/reference/operation-guide.md

@@ -10,7 +10,7 @@ CodeCGC 的推荐用户入口是 Claude 内的 `/cgc`，背后优先调用 CodeC
 
 - `/cgc`
 - `/cgc-start`
-- `/cgc-install`
+- `/cgc-init`
 - `/cgc-status`
 - `/cgc-doctor`
 - `/cgc-review`
@@ -30,7 +30,7 @@ CLI 命令继续保留，但主要用于本地调试、CI、维护和 MCP 不可
 
 如果你是第一次把 CodeCGC 接入某个项目，建议顺序是：
 
-1. 在目标项目根目录运行 `cgc-install`
+1. 在目标项目根目录运行 `cgc-init`
 2. 运行 `cgc-start` 查看项目本地首次使用入口
 3. 运行 `cgc-status`，必要时再运行 `cgc-doctor`
 4. 在 Claude 中用 `/cgc <自然语言需求>` 开始
@@ -39,7 +39,7 @@ CLI 命令继续保留，但主要用于本地调试、CI、维护和 MCP 不可
 最小示例：
 
 ```bash
-cgc-install
+cgc-init
 cgc-start
 cgc-status
 cgc "新增一个登录页面，放在 src/components/LoginForm.tsx"
@@ -48,7 +48,7 @@ cgc "新增一个登录页面，放在 src/components/LoginForm.tsx"
 如果当前 shell 目录不是目标项目根目录：
 
 ```bash
-cgc-install --workspace D:\Projects\MyApp
+cgc-init --workspace D:\Projects\MyApp
 cgc-status --workspace D:\Projects\MyApp
 ```
 

package/codecgc/reference/path-contract.md

@@ -37,7 +37,7 @@ Use project-relative paths for persisted product state, audits, fixtures, review
 
 ## Installer Responsibility
 
-`cgc-install` is responsible for writing machine-specific runtime paths into the target project integration files.
+`cgc-init` is responsible for writing machine-specific runtime paths into the target project integration files.
 
 It should not hard-code paths from the development machine into reusable templates or persisted workflow artifacts.
 

package/codecgc/reference/policy-routing.md

@@ -34,10 +34,10 @@ Project install is the default integration path:
 
 ```bash
 cd your-project
-cgc-install
+cgc-init
 ```
 
-This creates project-local `.mcp.json`, `.claude/`, `model-routing.yaml`, and the `codecgc/` workflow directories. User-level install modes are explicit escape hatches only.
+This creates project-local `.mcp.json`, `.claude/`, `model-routing.yaml`, and the `codecgc/` workflow directories.
 
 ## Policy Checker
 

package/codecgc/reference/project-structure.md

@@ -10,9 +10,10 @@ These files are source-controlled and ship with the npm package:
 bin/
 scripts/
   codecgc_runtime/
-codecgcmcp/
-codexmcp/
-geminimcp/
+mcp/
+  codecgcmcp/
+  codexmcp/
+  geminimcp/
 codecgc/reference/
 codecgc/cgc*/
 .claude/hooks/route-edit.ps1
@@ -25,7 +26,7 @@ Package runtime files define commands, MCP servers, policy checking, and referen
 
 ## Source Repository Hygiene
 
-The source repository should not commit project-local install output. These files are generated by `cgc-install` and may contain machine-specific paths:
+The source repository should not commit project-local install output. These files are generated by `cgc-init` and may contain machine-specific paths:
 
 ```text
 .mcp.json
@@ -48,7 +49,7 @@ Keep `codecgc/fixtures/`, `codecgc/reference/`, `codecgc/roadmap/`, and `codecgc
 
 ## Target Project Surface
 
-`cgc-install` creates or syncs these files in the target project:
+`cgc-init` creates or syncs these files in the target project:
 
 ```text
 .mcp.json

package/codecgc/reference/quickstart.md

@@ -18,13 +18,13 @@ Run project-local install from the target project root:
 
 ```bash
 cd your-project
-cgc-install
+cgc-init
 cgc-start
 cgc-status
 cgc-doctor
 ```
 
-Inside Claude, use `/cgc-install` and then `/cgc-start` for the same project-local path.
+Inside Claude, use `/cgc-init` and then `/cgc-start` for the same project-local path.
 
 The project install syncs:
 
@@ -48,7 +48,7 @@ Run:
 cgc-start
 ```
 
-This is a read-only first-run guide for the current project. If it reports missing onboarding, run `cgc-install` again from the target project root.
+This is a read-only first-run guide for the current project. If it reports missing onboarding, run `cgc-init` again from the target project root.
 
 ## 4. Start Work From The Single Entry
 

package/codecgc/reference/real-workflow-loop.md

@@ -1,6 +1,6 @@
 # CodeCGC Real Workflow Loop
 
-This page describes the repeatable CodeCGC loop after a project has already run `cgc-install`.
+This page describes the repeatable CodeCGC loop after a project has already run `cgc-init`.
 
 The goal is not to make users memorize every command. The goal is to keep one stable control loop where Claude orchestrates state, Codex or Gemini executes scoped code work, and review closes the loop only when there is enough evidence.
 

package/codecgc/reference/shared-conventions.md

@@ -45,16 +45,23 @@
 当前对外公开命令面是：
 
 - `cgc`
-- `cgc-install`
+- `cgc-init`
+- `cgc-start`
 - `cgc-entry`
 - `cgc-plan`
 - `cgc-build`
 - `cgc-fix`
+- `cgc-test`
 - `cgc-review`
 - `cgc-route`
 - `cgc-status`
 - `cgc-doctor`
 - `cgc-package-audit`
+- `cgc-external-audit`
+- `cgc-external-status`
+- `cgc-release-readiness`
+- `cgc-lifecycle`
+- `cgc-history`
 
 其中：
 

package/codecgc/reference/troubleshooting.md

@@ -7,20 +7,12 @@
 It does not install CodeCGC into every project. Run this per project:
 
 ```bash
-cgc-install
+cgc-init
 cgc-start
 cgc-status
 cgc-doctor
 ```
 
-Use `--mode user-dry-run` only to preview user-level Claude integration:
-
-```bash
-cgc-install --mode user-dry-run
-```
-
-Do not use `--mode user` unless you intentionally want to write user-level Claude files.
-
 ## MCP JSON Parse Errors
 
 If an MCP install tool reports a JSON parse failure, first check whether the files were still written correctly:
@@ -37,7 +29,7 @@ The MCP tool surface should request JSON internally, even when the user asked fo
 If `cgc-start`, `cgc-status`, or `cgc-doctor` reports `onboarding_file` or `onboarding_file_ready`, rerun project-local install:
 
 ```bash
-cgc-install
+cgc-init
 cgc-start
 ```
 

package/codecgc/roadmap/codecgc-release-maintenance/delivery-plan.md

@@ -4,9 +4,8 @@ This delivery plan turns the release maintenance roadmap into concrete work item
 
 ## Immediate Work
 
-1. Keep project-local install as the default product path.
-2. Keep user-level install behind explicit `--mode user` or `--mode user-dry-run`.
-3. Keep `/cgc` and `codecgc.entry` as the primary user path.
+1. Keep project-local install as the only install path (no user-level global writes).
+2. Keep `/cgc` and `codecgc.entry` as the primary user path.
 4. Keep the hook as a write guardrail, not as the orchestration engine.
 5. Keep release docs stable and user-facing.
 

package/codecgc/roadmap/codecgc-release-maintenance/overview.md

@@ -35,7 +35,7 @@ The current baseline is:
 
 ## Success Criteria
 
-- A new user can install and start from `/cgc-install` and `/cgc`.
+- A new user can install and start from `/cgc-init` and `/cgc`.
 - A maintainer can verify release readiness with one documented command chain.
 - Published docs explain install modes, path rules, troubleshooting, and maintainer checks.
 - Package audits catch missing runtime and reference files before publication.

package/codecgc/roadmap/codecgc-release-maintenance/phases.md

@@ -9,7 +9,7 @@ Objective:
 Deliverables:
 
 - `/cgc` as the primary user entry.
-- `/cgc-install`, `/cgc-status`, and `/cgc-doctor` for setup and health checks.
+- `/cgc-init`, `/cgc-status`, and `/cgc-doctor` for setup and health checks.
 - `/cgc-review` and `/cgc-history` for common control points.
 - Documentation that explains when to use CLI fallback.
 

package/codecgc/templates/project/claude/hooks/route-edit.ps1

@@ -0,0 +1,87 @@
+$ErrorActionPreference = "Stop"
+
+function Write-Approve {
+    $payload = @{
+        decision = "approve"
+    } | ConvertTo-Json -Compress
+    [Console]::Out.Write($payload)
+    exit 0
+}
+
+function Write-Deny($reason) {
+    $payload = @{
+        decision = "deny"
+        reason   = $reason
+    } | ConvertTo-Json -Compress
+    [Console]::Out.Write($payload)
+    exit 0
+}
+
+$inputJson = [Console]::In.ReadToEnd()
+if ([string]::IsNullOrWhiteSpace($inputJson)) {
+    Write-Approve
+}
+
+$configuredPackageRoot = [Environment]::GetEnvironmentVariable("CODECGC_PACKAGE_ROOT")
+if (-not [string]::IsNullOrWhiteSpace($configuredPackageRoot)) {
+    $packageRoot = Resolve-Path $configuredPackageRoot
+} else {
+    $packageRoot = Resolve-Path (Join-Path $PSScriptRoot "..\..")
+}
+
+$configuredWorkspaceRoot = [Environment]::GetEnvironmentVariable("CODECGC_WORKSPACE_ROOT")
+if (-not [string]::IsNullOrWhiteSpace($configuredWorkspaceRoot)) {
+    $workspaceRoot = Resolve-Path $configuredWorkspaceRoot
+} else {
+    $workspaceRoot = Resolve-Path (Get-Location)
+}
+
+$policyScript = Join-Path $packageRoot "scripts\codecgc_policy.py"
+$routingFile = Join-Path $workspaceRoot "model-routing.yaml"
+$mcpConfigFile = Join-Path $workspaceRoot ".mcp.json"
+
+if (-not (Test-Path $policyScript)) {
+    Write-Deny "CodeCGC: policy checker is missing: $policyScript"
+}
+
+$pythonCommand = [Environment]::GetEnvironmentVariable("CODECGC_PYTHON_COMMAND")
+if ([string]::IsNullOrWhiteSpace($pythonCommand) -and (Test-Path $mcpConfigFile)) {
+    try {
+        $mcpConfig = Get-Content -Raw $mcpConfigFile | ConvertFrom-Json
+        $pythonCommand = [string]$mcpConfig.mcpServers.codecgc.command
+    } catch {
+        $pythonCommand = ""
+    }
+}
+if ([string]::IsNullOrWhiteSpace($pythonCommand)) {
+    $pythonCommand = "python"
+}
+
+$psi = New-Object System.Diagnostics.ProcessStartInfo
+$psi.FileName = $pythonCommand
+$escapedPolicyScript = $policyScript.Replace('"', '\"')
+$escapedRoutingFile = $routingFile.Replace('"', '\"')
+$psi.Arguments = "`"$escapedPolicyScript`" --hook-check --actor claude --operation write --routing-file `"$escapedRoutingFile`""
+$psi.RedirectStandardInput = $true
+$psi.RedirectStandardOutput = $true
+$psi.RedirectStandardError = $true
+$psi.UseShellExecute = $false
+$psi.CreateNoWindow = $true
+
+$process = [System.Diagnostics.Process]::Start($psi)
+$process.StandardInput.Write($inputJson)
+$process.StandardInput.Close()
+$stdout = $process.StandardOutput.ReadToEnd()
+$stderr = $process.StandardError.ReadToEnd()
+$process.WaitForExit()
+
+if ($process.ExitCode -ne 0) {
+    $detail = if ([string]::IsNullOrWhiteSpace($stderr)) { $stdout } else { $stderr }
+    Write-Deny "CodeCGC: policy checker failed. $detail"
+}
+
+if ([string]::IsNullOrWhiteSpace($stdout)) {
+    Write-Approve
+}
+
+[Console]::Out.Write($stdout)