@rulemetric/cli 0.6.1 → 0.6.3

package/dist/{chunk-OVGP4OGK.js → chunk-DAJNO4OI.js}

@@ -3,7 +3,9 @@ import { spawn } from "node:child_process";
 import { createConnection } from "node:net";
 import { existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
 var GATEWAY_PID_FILE = join(CONFIG_DIR, "gateway.pid");
 var GATEWAY_LOG_FILE = join(CONFIG_DIR, "gateway.log");
@@ -50,8 +52,13 @@ function getGatewayPid() {
 }
 function findGatewayEntry() {
   const candidates = [
-    resolve(import.meta.dirname, "./gateway-entry.js"),
-    resolve(import.meta.dirname, "../lib/gateway-entry.js")
+    resolve(MODULE_DIR, "./gateway-entry.js"),
+    // sibling (unbundled)
+    resolve(MODULE_DIR, "./lib/gateway-entry.js"),
+    // bundled chunk at dist root
+    resolve(MODULE_DIR, "../lib/gateway-entry.js"),
+    // nested command dir → dist/lib
+    resolve(MODULE_DIR, "../../lib/gateway-entry.js")
   ];
   for (const p of candidates) {
     if (existsSync(p)) return p;
@@ -117,4 +124,4 @@ export {
   spawnGateway,
   stopGateway
 };
-//# sourceMappingURL=chunk-OVGP4OGK.js.map
+//# sourceMappingURL=chunk-DAJNO4OI.js.map

package/dist/chunk-DAJNO4OI.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/gateway-lifecycle.ts"],
+  "sourcesContent": ["/**\n * Gateway process lifecycle helpers \u2014 spawn, stop, check status.\n * Used by hooks install/uninstall, session-start hook, and proxy status.\n */\nimport { spawn } from 'node:child_process';\nimport { createConnection } from 'node:net';\nimport { existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\n// `import.meta.dirname` only exists on Node >= 20.11 \u2014 on Node 18.x/\u226420.10 it is\n// `undefined`, and `resolve(undefined, \u2026)` throws, surfacing as a spurious\n// \"Could not find gateway-entry.js\" on fresh npm installs (the launchd gateway\n// masks it in dev). Derive the dir portably instead. See onboarding field report\n// 2026-07-07 F1.\nconst MODULE_DIR = dirname(fileURLToPath(import.meta.url));\n\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nexport const GATEWAY_PID_FILE = join(CONFIG_DIR, 'gateway.pid');\nexport const GATEWAY_LOG_FILE = join(CONFIG_DIR, 'gateway.log');\nexport const GATEWAY_PORT = 8787;\nexport const MITMPROXY_PORT = 8788;\n\n/**\n * TCP liveness probe: does something actually ACCEPT a connection on the port?\n * Distinct from isGatewayRunning() (which only checks the PID is alive) \u2014 a\n * process can be \"running\" per its pidfile while :8787 accepts nothing. This is\n * the check that must gate writing HTTPS_PROXY: never pin Claude Code's proxy\n * at a port with nothing behind it (the fresh-laptop ConnectionRefused footgun).\n */\nexport function isGatewayListening(port: number = GATEWAY_PORT, timeoutMs = 1500): Promise<boolean> {\n  return new Promise((resolveProbe) => {\n    const socket = createConnection({ host: '127.0.0.1', port });\n    const finish = (result: boolean) => {\n      socket.destroy();\n      resolveProbe(result);\n    };\n    socket.setTimeout(timeoutMs);\n    socket.once('connect', () => finish(true));\n    socket.once('timeout', () => finish(false));\n    socket.once('error', () => finish(false));\n  });\n}\n\n/**\n * Poll isGatewayListening() until it's true or the window elapses. spawnGateway()\n * returns as soon as it writes the PID file \u2014 the detached child hasn't bound\n * :8787 yet (Node bootstrap + module load). A one-shot probe microseconds later\n * fails-closed on every fresh install, so the proxy/deep-capture layer silently\n * never turns on. This tolerates a normal cold-start bind delay.\n */\nexport async function waitForGatewayListening(\n  port: number = GATEWAY_PORT,\n  { timeoutMs = 3000, intervalMs = 150 }: { timeoutMs?: number; intervalMs?: number } = {},\n): Promise<boolean> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    if (await isGatewayListening(port, Math.min(1500, timeoutMs))) return true;\n    if (Date.now() >= deadline) return false;\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n  }\n}\n\nexport function isGatewayRunning(): boolean {\n  if (!existsSync(GATEWAY_PID_FILE)) return false;\n\n  const content = readFileSync(GATEWAY_PID_FILE, 'utf-8').trim();\n  const pid = parseInt(content, 10);\n  if (isNaN(pid)) return false;\n\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function getGatewayPid(): number | null {\n  if (!existsSync(GATEWAY_PID_FILE)) return null;\n  const content = readFileSync(GATEWAY_PID_FILE, 'utf-8').trim();\n  const pid = parseInt(content, 10);\n  return isNaN(pid) ? null : pid;\n}\n\nfunction findGatewayEntry(): string {\n  // Resolve the compiled gateway-entry.js across BOTH layouts:\n  //  - unbundled (dev/tsx, or tsc output): this module sits in dist/lib, so\n  //    gateway-entry.js is a sibling (`./gateway-entry.js`).\n  //  - BUNDLED (published build): esbuild flattens this module into\n  //    dist/chunk-*.js at the dist ROOT, so MODULE_DIR is dist/ and the entry\n  //    (kept as a separate build entry) is at dist/lib/gateway-entry.js\n  //    (`./lib/gateway-entry.js`). Without this candidate the gateway never\n  //    spawns on a clean npm install \u2014 masked in dev by the launchd gateway\n  //    short-circuiting before this runs. See onboarding field report F1.\n  const candidates = [\n    resolve(MODULE_DIR, './gateway-entry.js'),        // sibling (unbundled)\n    resolve(MODULE_DIR, './lib/gateway-entry.js'),    // bundled chunk at dist root\n    resolve(MODULE_DIR, '../lib/gateway-entry.js'),   // nested command dir \u2192 dist/lib\n    resolve(MODULE_DIR, '../../lib/gateway-entry.js'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(p)) return p;\n  }\n  throw new Error(\n    'Could not find gateway-entry.js. Is the CLI built?\\n' +\n    'Searched:\\n' + candidates.map(c => `  ${c}`).join('\\n'),\n  );\n}\n\nexport function spawnGateway(cliVersion?: string): number {\n  if (isGatewayRunning()) {\n    const pid = getGatewayPid();\n    if (pid) return pid;\n  }\n\n  mkdirSync(CONFIG_DIR, { recursive: true });\n\n  const entryPath = findGatewayEntry();\n  const logFd = openSync(GATEWAY_LOG_FILE, 'a');\n\n  const child = spawn(process.execPath, [entryPath], {\n    detached: true,\n    stdio: ['ignore', logFd, logFd],\n    // The gateway inherits the spawning CLI's env. RULEMETRIC_CLI_VERSION\n    // identifies the CLI version that started this gateway \u2014 used to\n    // detect drift when a newer CLI starts mitmproxy with a different\n    // version. RULEMETRIC_CLI_ENTRY is the path to the oclif entry point\n    // (process.argv[1]) so the gateway can re-invoke the CLI for\n    // `proxy restart` without needing the binary in PATH. Falls back to\n    // \"unknown\" if the caller didn't pass them.\n    env: {\n      ...process.env,\n      RULEMETRIC_CLI_VERSION: cliVersion ?? 'unknown',\n      RULEMETRIC_CLI_ENTRY: process.argv[1] ?? '',\n    },\n  });\n\n  child.unref();\n\n  if (!child.pid) {\n    throw new Error('Failed to spawn gateway process');\n  }\n\n  writeFileSync(GATEWAY_PID_FILE, String(child.pid));\n  return child.pid;\n}\n\nexport function stopGateway(): boolean {\n  const pid = getGatewayPid();\n  if (pid === null) return false;\n\n  try {\n    process.kill(pid, 'SIGTERM');\n  } catch {\n    // Process already gone\n  }\n\n  try { unlinkSync(GATEWAY_PID_FILE); } catch { /* already gone */ }\n  return true;\n}\n"],
+  "mappings": ";AAIA,SAAS,aAAa;AACtB,SAAS,wBAAwB;AACjC,SAAS,YAAY,WAAW,UAAU,cAAc,YAAY,qBAAqB;AACzF,SAAS,eAAe;AACxB,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,qBAAqB;AAO9B,IAAM,aAAa,QAAQ,cAAc,YAAY,GAAG,CAAC;AAEzD,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AACnD,IAAM,mBAAmB,KAAK,YAAY,aAAa;AACvD,IAAM,mBAAmB,KAAK,YAAY,aAAa;AACvD,IAAM,eAAe;AACrB,IAAM,iBAAiB;AASvB,SAAS,mBAAmB,OAAe,cAAc,YAAY,MAAwB;AAClG,SAAO,IAAI,QAAQ,CAAC,iBAAiB;AACnC,UAAM,SAAS,iBAAiB,EAAE,MAAM,aAAa,KAAK,CAAC;AAC3D,UAAM,SAAS,CAAC,WAAoB;AAClC,aAAO,QAAQ;AACf,mBAAa,MAAM;AAAA,IACrB;AACA,WAAO,WAAW,SAAS;AAC3B,WAAO,KAAK,WAAW,MAAM,OAAO,IAAI,CAAC;AACzC,WAAO,KAAK,WAAW,MAAM,OAAO,KAAK,CAAC;AAC1C,WAAO,KAAK,SAAS,MAAM,OAAO,KAAK,CAAC;AAAA,EAC1C,CAAC;AACH;AASA,eAAsB,wBACpB,OAAe,cACf,EAAE,YAAY,KAAM,aAAa,IAAI,IAAiD,CAAC,GACrE;AAClB,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,QAAI,MAAM,mBAAmB,MAAM,KAAK,IAAI,MAAM,SAAS,CAAC,EAAG,QAAO;AACtE,QAAI,KAAK,IAAI,KAAK,SAAU,QAAO;AACnC,UAAM,IAAI,QAAQ,CAACA,aAAY,WAAWA,UAAS,UAAU,CAAC;AAAA,EAChE;AACF;AAEO,SAAS,mBAA4B;AAC1C,MAAI,CAAC,WAAW,gBAAgB,EAAG,QAAO;AAE1C,QAAM,UAAU,aAAa,kBAAkB,OAAO,EAAE,KAAK;AAC7D,QAAM,MAAM,SAAS,SAAS,EAAE;AAChC,MAAI,MAAM,GAAG,EAAG,QAAO;AAEvB,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAA+B;AAC7C,MAAI,CAAC,WAAW,gBAAgB,EAAG,QAAO;AAC1C,QAAM,UAAU,aAAa,kBAAkB,OAAO,EAAE,KAAK;AAC7D,QAAM,MAAM,SAAS,SAAS,EAAE;AAChC,SAAO,MAAM,GAAG,IAAI,OAAO;AAC7B;AAEA,SAAS,mBAA2B;AAUlC,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,oBAAoB;AAAA;AAAA,IACxC,QAAQ,YAAY,wBAAwB;AAAA;AAAA,IAC5C,QAAQ,YAAY,yBAAyB;AAAA;AAAA,IAC7C,QAAQ,YAAY,4BAA4B;AAAA,EAClD;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,QAAM,IAAI;AAAA,IACR,oEACgB,WAAW,IAAI,OAAK,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,EACzD;AACF;AAEO,SAAS,aAAa,YAA6B;AACxD,MAAI,iBAAiB,GAAG;AACtB,UAAM,MAAM,cAAc;AAC1B,QAAI,IAAK,QAAO;AAAA,EAClB;AAEA,YAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AAEzC,QAAM,YAAY,iBAAiB;AACnC,QAAM,QAAQ,SAAS,kBAAkB,GAAG;AAE5C,QAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,SAAS,GAAG;AAAA,IACjD,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQ9B,KAAK;AAAA,MACH,GAAG,QAAQ;AAAA,MACX,wBAAwB,cAAc;AAAA,MACtC,sBAAsB,QAAQ,KAAK,CAAC,KAAK;AAAA,IAC3C;AAAA,EACF,CAAC;AAED,QAAM,MAAM;AAEZ,MAAI,CAAC,MAAM,KAAK;AACd,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AAEA,gBAAc,kBAAkB,OAAO,MAAM,GAAG,CAAC;AACjD,SAAO,MAAM;AACf;AAEO,SAAS,cAAuB;AACrC,QAAM,MAAM,cAAc;AAC1B,MAAI,QAAQ,KAAM,QAAO;AAEzB,MAAI;AACF,YAAQ,KAAK,KAAK,SAAS;AAAA,EAC7B,QAAQ;AAAA,EAER;AAEA,MAAI;AAAE,eAAW,gBAAgB;AAAA,EAAG,QAAQ;AAAA,EAAqB;AACjE,SAAO;AACT;",
+  "names": ["resolve"]
+}

package/dist/{chunk-HWGRTIXN.js → chunk-XN23W5HL.js}

@@ -179,8 +179,10 @@ function writeCursorHooksToDir(cursorDir, binDir) {
 function writeCursorHooks(projectPath, binDir) {
   return writeCursorHooksToDir(join(projectPath, ".cursor"), binDir);
 }
-function writeCursorUserHooks(binDir) {
-  return writeCursorHooksToDir(join(homedir(), ".cursor"), binDir);
+function writeCursorUserHooks(binDir, home = homedir()) {
+  const cursorHome = join(home, ".cursor");
+  if (!existsSync(cursorHome)) return null;
+  return writeCursorHooksToDir(cursorHome, binDir);
 }
 function writeCopilotHooks(projectPath, binDir) {
   const githubDir = join(projectPath, ".github");
@@ -468,9 +470,10 @@ function writeAntigravityHooksToDir(dir) {
 function writeAntigravityHooks(projectPath) {
   return writeAntigravityHooksToDir(join(projectPath, ".agents"));
 }
-function writeAntigravityUserHooks() {
-  const configDir = join(homedir(), ".gemini", "config");
-  return writeAntigravityHooksToDir(configDir);
+function writeAntigravityUserHooks(home = homedir()) {
+  const geminiHome = join(home, ".gemini");
+  if (!existsSync(geminiHome)) return null;
+  return writeAntigravityHooksToDir(join(geminiHome, "config"));
 }
 function removeAntigravityHooksFromFile(configPath) {
   if (!existsSync(configPath)) return false;
@@ -532,4 +535,4 @@ export {
   removeAntigravityHooks,
   removeAntigravityUserHooks
 };
-//# sourceMappingURL=chunk-HWGRTIXN.js.map
+//# sourceMappingURL=chunk-XN23W5HL.js.map

package/dist/chunk-XN23W5HL.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/hooks-config.ts"],
+  "sourcesContent": ["import { execSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, copyFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, dirname } from 'node:path';\n\nexport type DetectedTool = 'claude_code' | 'cursor' | 'copilot_agent' | 'antigravity';\n\n/**\n * Detect which AI coding tools are installed in the project by checking\n * for their config directories.\n */\nexport function detectInstalledTools(projectPath: string): DetectedTool[] {\n  const tools: DetectedTool[] = ['claude_code'];\n\n  if (existsSync(join(projectPath, '.cursor'))) {\n    tools.push('cursor');\n  }\n\n  if (existsSync(join(projectPath, '.github'))) {\n    tools.push('copilot_agent');\n  }\n\n  // Antigravity's workspace config lives at `.agents/`. The user-level hooks\n  // file at ~/.gemini/config/hooks.json is written by writeAntigravityUserHooks()\n  // ONLY when ~/.gemini already exists (the tool is present) \u2014 see F2.\n  if (existsSync(join(projectPath, '.agents'))) {\n    tools.push('antigravity');\n  }\n\n  return tools;\n}\n\n/**\n * Generate Cursor hooks config object.\n *\n * Cursor uses event names like beforeSubmitPrompt, afterFileEdit, etc.\n * Each event maps to an array of hook objects with a `command` field.\n */\nexport function generateCursorHooksConfig(binDir?: string): object {\n  // Event coverage matches Cursor 1.7+ hook API (cursor.com/docs/hooks).\n  // `sessionStart` is required so the registry file is written with\n  // conversation_id before any tool runs; without it the proxy-based linker\n  // path would have nothing to map and we'd drop captures. `sessionEnd`\n  // emits the session-end signal once per chat conversation (vs `stop`\n  // which fires per-turn \u2014 those go through post-tool-use).\n  //\n  // binDir: prepended to PATH like the Claude Code hooks \u2014 Cursor is a GUI app\n  // launched with launchd's minimal PATH (no nvm/pnpm-global bin), so a bare\n  // `rulemetric` silently fails with command-not-found.\n  const prefix = binDir ? `PATH=\"${binDir}:$PATH\" ` : '';\n  const cmd = (name: string) => ({ command: `${prefix}rulemetric hooks run ${name}` });\n  return {\n    version: 1,\n    hooks: {\n      sessionStart: [cmd('session-start')],\n      beforeSubmitPrompt: [cmd('user-prompt')],\n      afterFileEdit: [cmd('post-tool-use')],\n      beforeShellExecution: [cmd('post-tool-use')],\n      afterShellExecution: [cmd('post-tool-use')],\n      beforeMCPExecution: [cmd('post-tool-use')],\n      afterMCPExecution: [cmd('post-tool-use')],\n      // `afterAgentResponse` carries the full assistant response text +\n      // token usage. Verified empirically via a probe hook on\n      // 2026-05-12 \u2014 Cursor passes `text`, `input_tokens`,\n      // `output_tokens`, `cache_read_tokens`, `cache_write_tokens`. This\n      // is the cleanest path to per-turn assistant content for Cursor\n      // (chat traffic itself bypasses the proxy via HTTP/2 \u2014 see\n      // docs/audits/2026-05-11-cursor-capture-architecture.md).\n      afterAgentResponse: [cmd('assistant-response')],\n      // `stop` fires when the agent loop ends for a single turn (status:\n      // completed|aborted|error). Per-turn, NOT per-session \u2014 route it to\n      // post-tool-use, not session-end. The real session boundary is\n      // `sessionEnd` below.\n      stop: [cmd('post-tool-use')],\n      sessionEnd: [cmd('session-end')],\n    },\n  };\n}\n\n/**\n * Generate Copilot Agent hooks config object.\n *\n * Copilot uses event names like sessionStart, userPromptSubmitted, etc.\n * Each event maps to an array of hook objects with `type` and `bash` fields.\n */\nexport function generateCopilotHooksConfig(binDir?: string): object {\n  // binDir prepended to PATH \u2014 Copilot Agent runs in the same GUI/minimal-PATH\n  // environment class as Cursor, so a bare `rulemetric` silently fails.\n  const prefix = binDir ? `PATH=\"${binDir}:$PATH\" ` : '';\n  const cmd = (name: string) => ({ type: 'command', bash: `${prefix}rulemetric hooks run ${name}` });\n  return {\n    version: 1,\n    hooks: {\n      sessionStart: [cmd('session-start')],\n      userPromptSubmitted: [cmd('user-prompt')],\n      postToolUse: [cmd('post-tool-use')],\n      sessionEnd: [cmd('session-end')],\n    },\n  };\n}\n\ninterface ClaudeHookEntry {\n  type: 'command';\n  command: string;\n}\n\ninterface ClaudeHookBlock {\n  matcher?: string;\n  hooks: ClaudeHookEntry[];\n}\n\n/** The `settings.hooks` map RuleMetric installs into a project's `.claude/settings.json`. */\nexport type ClaudeCodeHooksConfig = Record<\n  'SessionStart' | 'UserPromptSubmit' | 'PostToolUse' | 'Stop' | 'SessionEnd',\n  ClaudeHookBlock[]\n>;\n\n/**\n * Generate the Claude Code hooks map for `.claude/settings.json`.\n *\n * Claude Code keys hook blocks by native event name, each block being\n * `{ matcher?, hooks: [{ type: 'command', command }] }`. Unlike Antigravity\n * these carry NO `RULEMETRIC_HOOK_TOOL` prefix \u2014 `_normalize.sh` defaults to\n * the `claude_code` branch (session_id + transcript_path payload shape).\n *\n * This is the hooks-first, zero-proxy capture path: SessionEnd runs\n * `session-end.sh`, which reimports the whole transcript via\n * `POST /api/sessions/:id/reimport` \u2014 no mitmproxy / CA trust / gateway needed.\n * The rendered system prompt is still proxy-only, so instruction-effectiveness\n * linking is handled separately (Phase 2 synthetic snapshot).\n */\nexport function generateClaudeCodeHooksConfig(binDir?: string): ClaudeCodeHooksConfig {\n  // The literal `rulemetric` is always present: it's the marker that install.ts\n  // \u00A71 and mergeClaudeCodeHooks use to dedup/strip our hooks (a resolved\n  // node+run.js path omits 'rulemetric' in a dev checkout, which would silently\n  // break that dedup).\n  //\n  // `binDir`, when provided, is prepended to PATH so the command resolves even\n  // in Claude Code's hook shell \u2014 which runs `/bin/sh -c` with a minimal PATH\n  // that does NOT include nvm/pnpm global bin dirs. Without it, a fresh-install\n  // user hits `rulemetric: command not found` on every hook, so capture (and\n  // the session-start gateway auto-start that keeps the proxy alive) silently\n  // fails. Callers resolve the real bin dir at install time and pass it here.\n  const prefix = binDir ? `PATH=\"${binDir}:$PATH\" ` : '';\n  const mk = (name: string): ClaudeHookEntry => ({\n    type: 'command',\n    command: `${prefix}rulemetric hooks run ${name}`,\n  });\n  return {\n    SessionStart: [{ hooks: [mk('session-start')] }],\n    UserPromptSubmit: [{ hooks: [mk('user-prompt')] }],\n    PostToolUse: [{ matcher: '.*', hooks: [mk('post-tool-use')] }],\n    Stop: [{ hooks: [mk('assistant-response')] }],\n    SessionEnd: [{ hooks: [mk('session-end')] }],\n  };\n}\n\n/**\n * Read a Claude Code `settings.json` for merging, WITHOUT ever crashing the\n * install on a fresh machine. A missing file yields `{}`. A malformed file\n * (hand-edited JSONC, a stray trailing comma, a half-written file) is NOT\n * allowed to throw \u2014 that used to hard-fail `hooks install` with a raw\n * SyntaxError and leave the user with NO capture. Instead we back the\n * unparseable file up (so nothing is silently lost) and proceed on a fresh\n * object so capture still installs.\n *\n * Returns the parsed settings plus `recoveredBackup`: the path the corrupt\n * original was copied to, or `null` when the file was absent/valid.\n */\nexport function readClaudeSettings(configPath: string): {\n  settings: Record<string, unknown>;\n  recoveredBackup: string | null;\n} {\n  if (!existsSync(configPath)) return { settings: {}, recoveredBackup: null };\n  const raw = readFileSync(configPath, 'utf-8');\n  try {\n    return { settings: JSON.parse(raw) as Record<string, unknown>, recoveredBackup: null };\n  } catch {\n    const recoveredBackup = `${configPath}.corrupt.bak`;\n    writeFileSync(recoveredBackup, raw);\n    return { settings: {}, recoveredBackup };\n  }\n}\n\n/**\n * Write a Claude Code `settings.json`, backing up any prior file first so the\n * change is reversible: the `.bak` holds the previous contents for the user to\n * restore manually if a merge ever goes wrong. Creates the parent dir as needed.\n * Returns `backupPath` (the `.bak` written) or `null` when there was no\n * pre-existing file to back up.\n */\nexport function writeClaudeSettingsWithBackup(\n  configPath: string,\n  settings: Record<string, unknown>,\n): { backupPath: string | null } {\n  mkdirSync(dirname(configPath), { recursive: true });\n  let backupPath: string | null = null;\n  if (existsSync(configPath)) {\n    backupPath = `${configPath}.bak`;\n    copyFileSync(configPath, backupPath);\n  }\n  writeFileSync(configPath, JSON.stringify(settings, null, 2) + '\\n');\n  return { backupPath };\n}\n\n/**\n * Read a JSON config file for a safe in-place merge. Returns `{}` when the file\n * is absent, the parsed object when it's valid, and `null` when it EXISTS but is\n * unparseable \u2014 in which case the original is first backed up to `.corrupt.bak`.\n * Callers MUST treat `null` as \"skip, do not write\": editor settings.json files\n * are JSONC (comments + trailing commas are legal and common), so a strict\n * JSON.parse throws on valid user files; blindly resetting to `{}` and writing\n * would clobber the user's ENTIRE editor config down to our few keys. Backing up\n * + skipping is the non-destructive floor (mirrors readClaudeSettings).\n */\nfunction readMergeableJson(configPath: string): Record<string, unknown> | null {\n  if (!existsSync(configPath)) return {};\n  const raw = readFileSync(configPath, 'utf-8');\n  try {\n    return JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    try {\n      writeFileSync(`${configPath}.corrupt.bak`, raw);\n    } catch {\n      /* best-effort backup */\n    }\n    return null;\n  }\n}\n\n/**\n * Merge RuleMetric's Claude Code hooks into an in-memory `.claude/settings.json`\n * object. Claude Code hooks share the same settings.json that install.ts reads,\n * strips (\u00A71), and writes (\u00A75), so this mutates `settings.hooks` in place rather\n * than doing its own file I/O. Idempotent + non-destructive: per event it skips\n * adding when a rulemetric command is already present and otherwise appends,\n * preserving the user's own hooks.\n */\nexport function mergeClaudeCodeHooks(settings: Record<string, unknown>, binDir?: string): void {\n  const generated = generateClaudeCodeHooksConfig(binDir);\n  const hooks = (settings.hooks ?? {}) as Record<string, ClaudeHookBlock[]>;\n  for (const [event, blocks] of Object.entries(generated)) {\n    const current = (hooks[event] ?? []) as ClaudeHookBlock[];\n    const alreadyPresent = current.some((b) =>\n      b?.hooks?.some((h) => typeof h?.command === 'string' && h.command.includes('rulemetric')),\n    );\n    if (!alreadyPresent) {\n      hooks[event] = [...current, ...blocks];\n    }\n  }\n  settings.hooks = hooks;\n}\n\n/**\n * True iff RuleMetric's Claude Code session hooks are present in a settings\n * object \u2014 i.e. capture is actually wired up. This is the honest readiness\n * signal for the onboarding hooks step: capture works when the hooks exist,\n * NOT merely because a proxy env var was written (which greened even when the\n * proxy pointed at a dead port \u2014 the fresh-laptop ConnectionRefused footgun).\n */\nexport function hasRulemetricClaudeHooks(settings: Record<string, unknown>): boolean {\n  if (!settings.hooks || typeof settings.hooks !== 'object') return false;\n  const hooks = settings.hooks as Record<string, ClaudeHookBlock[]>;\n  return Object.values(hooks).some(\n    (blocks) =>\n      Array.isArray(blocks) &&\n      blocks.some((b) =>\n        b?.hooks?.some((h) => typeof h?.command === 'string' && h.command.includes('rulemetric')),\n      ),\n  );\n}\n\n/**\n * Strip RuleMetric's Claude Code hooks from an in-memory settings object while\n * preserving the user's own hook entries. Mirrors install.ts \u00A71 but is reusable\n * for uninstall. Removes emptied event arrays and deletes `settings.hooks` if it\n * ends up empty. Returns true iff anything was removed.\n */\nexport function removeClaudeCodeHooks(settings: Record<string, unknown>): boolean {\n  if (!settings.hooks || typeof settings.hooks !== 'object') return false;\n  const hooks = settings.hooks as Record<string, ClaudeHookBlock[]>;\n  let removed = 0;\n  for (const event of Object.keys(hooks)) {\n    const entries = hooks[event];\n    if (!Array.isArray(entries)) continue;\n    const kept = entries.filter((block) => {\n      const isRulemetric = block?.hooks?.some(\n        (h) => typeof h?.command === 'string' && h.command.includes('rulemetric'),\n      );\n      if (isRulemetric) removed += 1;\n      return !isRulemetric;\n    });\n    if (kept.length === 0) delete hooks[event];\n    else hooks[event] = kept;\n  }\n  if (Object.keys(hooks).length === 0) delete settings.hooks;\n  return removed > 0;\n}\n\n/**\n * Merge rulemetric hooks into a Cursor `hooks.json` at the given directory.\n *\n * Used by both the project (`<repo>/.cursor/`) and user (`~/.cursor/`) writers.\n * Returns the config file path, or null if the cursor dir doesn't exist.\n */\nfunction writeCursorHooksToDir(cursorDir: string, binDir?: string): string | null {\n  if (!existsSync(cursorDir)) {\n    return null;\n  }\n\n  const configPath = join(cursorDir, 'hooks.json');\n  const generated = generateCursorHooksConfig(binDir) as {\n    version: number;\n    hooks: Record<string, Array<{ command: string }>>;\n  };\n\n  const parsed = readMergeableJson(configPath);\n  if (parsed === null) return null; // unparseable \u2014 backed up, don't drop sibling hooks\n  const existing = parsed as { version?: number; hooks?: Record<string, unknown[]> };\n\n  const merged: Record<string, unknown[]> = { ...(existing.hooks ?? {}) };\n\n  for (const [event, hooks] of Object.entries(generated.hooks)) {\n    const current = merged[event] ?? [];\n    const hasRulemetric = current.some(\n      (h: unknown) =>\n        typeof h === 'object' &&\n        h !== null &&\n        'command' in h &&\n        typeof (h as { command: string }).command === 'string' &&\n        (h as { command: string }).command.includes('rulemetric'),\n    );\n    if (!hasRulemetric) {\n      merged[event] = [...current, ...hooks];\n    }\n  }\n\n  const result = {\n    version: existing.version ?? generated.version,\n    hooks: merged,\n  };\n\n  writeFileSync(configPath, JSON.stringify(result, null, 2) + '\\n');\n  return configPath;\n}\n\n/**\n * Write Cursor hooks config to `<projectPath>/.cursor/hooks.json`.\n * Merges with existing config \u2014 appends rulemetric hooks without duplicating.\n * Returns the config file path, or null if `.cursor/` doesn't exist.\n */\nexport function writeCursorHooks(projectPath: string, binDir?: string): string | null {\n  return writeCursorHooksToDir(join(projectPath, '.cursor'), binDir);\n}\n\n/**\n * Write Cursor hooks config to user-level `~/.cursor/hooks.json` so capture\n * works for every Cursor conversation without per-project setup.\n *\n * Returns the config file path, or null if `~/.cursor/` doesn't exist\n * (i.e., Cursor has never been launched on this machine).\n */\nexport function writeCursorUserHooks(binDir?: string, home: string = homedir()): string | null {\n  // Only wire user-level Cursor hooks if Cursor is actually present \u2014 never\n  // manufacture ~/.cursor for a user who doesn't use it (undisclosed scope,\n  // onboarding field report 2026-07-07 F2). `home` is injectable for tests.\n  const cursorHome = join(home, '.cursor');\n  if (!existsSync(cursorHome)) return null;\n  return writeCursorHooksToDir(cursorHome, binDir);\n}\n\n/**\n * Write Copilot Agent hooks config to `.github/hooks/rulemetric.json`.\n * Creates the hooks directory if needed.\n * Returns the config file path, or null if `.github/` doesn't exist.\n */\nexport function writeCopilotHooks(projectPath: string, binDir?: string): string | null {\n  const githubDir = join(projectPath, '.github');\n  if (!existsSync(githubDir)) {\n    return null;\n  }\n\n  const hooksDir = join(githubDir, 'hooks');\n  mkdirSync(hooksDir, { recursive: true });\n\n  const configPath = join(hooksDir, 'rulemetric.json');\n  const config = generateCopilotHooksConfig(binDir);\n\n  writeFileSync(configPath, JSON.stringify(config, null, 2) + '\\n');\n  return configPath;\n}\n\n/**\n * Strip rulemetric hooks from a Cursor `hooks.json` at the given path.\n * Preserves other hooks and removes empty event arrays.\n * Returns true if changes were made.\n */\nfunction removeCursorHooksFromFile(configPath: string): boolean {\n  if (!existsSync(configPath)) {\n    return false;\n  }\n\n  let config: { version?: number; hooks?: Record<string, unknown[]> };\n  try {\n    config = JSON.parse(readFileSync(configPath, 'utf-8'));\n  } catch {\n    return false;\n  }\n\n  if (!config.hooks) {\n    return false;\n  }\n\n  let changed = false;\n  for (const [event, hooks] of Object.entries(config.hooks)) {\n    const filtered = hooks.filter((h: unknown) => {\n      if (typeof h !== 'object' || h === null || !('command' in h)) return true;\n      const cmd = (h as { command: string }).command;\n      if (typeof cmd === 'string' && cmd.includes('rulemetric')) {\n        changed = true;\n        return false;\n      }\n      return true;\n    });\n\n    if (filtered.length === 0) {\n      delete config.hooks[event];\n    } else {\n      config.hooks[event] = filtered;\n    }\n  }\n\n  if (changed) {\n    writeFileSync(configPath, JSON.stringify(config, null, 2) + '\\n');\n  }\n\n  return changed;\n}\n\n/**\n * Remove rulemetric hooks from `<projectPath>/.cursor/hooks.json`.\n */\nexport function removeCursorHooks(projectPath: string): boolean {\n  return removeCursorHooksFromFile(join(projectPath, '.cursor', 'hooks.json'));\n}\n\n/**\n * Remove rulemetric hooks from user-level `~/.cursor/hooks.json`.\n */\nexport function removeCursorUserHooks(): boolean {\n  return removeCursorHooksFromFile(join(homedir(), '.cursor', 'hooks.json'));\n}\n\n/**\n * Write Cursor proxy config to `.cursor/settings.json`.\n * Sets `http.proxy` and `http.proxyStrictSSL` while preserving existing settings.\n * Returns true if `.cursor/` exists and config was written, false otherwise.\n */\nexport function writeCursorProxyConfig(projectPath: string, gatewayPort: number, certPath: string): boolean {\n  const cursorDir = join(projectPath, '.cursor');\n  if (!existsSync(cursorDir)) return false;\n\n  const settingsPath = join(cursorDir, 'settings.json');\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = existsSync(certPath);\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Write VS Code proxy config to `.vscode/settings.json` for Copilot capture.\n * Sets `http.proxy`, `http.proxyStrictSSL`, and Copilot-specific override\n * while preserving existing settings.\n * Returns true if config was written, false if `.vscode/` doesn't exist.\n */\nexport function writeVSCodeProxyConfig(projectPath: string, gatewayPort: number, certPath: string): boolean {\n  const vscodeDir = join(projectPath, '.vscode');\n  // Only touch projects that already use VS Code \u2014 do NOT manufacture a\n  // `.vscode/` in every repo (matches writeCursorProxyConfig's contract and this\n  // function's own docstring). Creating it pollutes Claude-Code-only repos with\n  // an untracked, proxy-pinning settings.json.\n  if (!existsSync(vscodeDir)) return false;\n\n  const settingsPath = join(vscodeDir, 'settings.json');\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = existsSync(certPath);\n\n  // Copilot-specific override for surgical proxy targeting\n  const copilotAdvanced = (settings['github.copilot.advanced'] ?? {}) as Record<string, unknown>;\n  copilotAdvanced['debug.overrideProxyUrl'] = `http://localhost:${gatewayPort}`;\n  settings['github.copilot.advanced'] = copilotAdvanced;\n\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Remove VS Code proxy config from `.vscode/settings.json`.\n * Removes `http.proxy`, `http.proxyStrictSSL`, and Copilot proxy override.\n * Returns true if changes were made.\n */\nexport function removeVSCodeProxyConfig(projectPath: string): boolean {\n  const settingsPath = join(projectPath, '.vscode', 'settings.json');\n  if (!existsSync(settingsPath)) return false;\n\n  let settings: Record<string, unknown>;\n  try { settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); } catch { return false; }\n\n  let changed = false;\n\n  if (settings['http.proxy']) {\n    delete settings['http.proxy'];\n    delete settings['http.proxyStrictSSL'];\n    changed = true;\n  }\n\n  const copilotAdvanced = settings['github.copilot.advanced'] as Record<string, unknown> | undefined;\n  if (copilotAdvanced?.['debug.overrideProxyUrl']) {\n    delete copilotAdvanced['debug.overrideProxyUrl'];\n    if (Object.keys(copilotAdvanced).length === 0) {\n      delete settings['github.copilot.advanced'];\n    }\n    changed = true;\n  }\n\n  if (changed) {\n    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  }\n\n  return changed;\n}\n\n/**\n * Remove Copilot Agent hooks by deleting `.github/hooks/rulemetric.json`.\n * Returns true if the file was removed.\n */\nexport function removeCopilotHooks(projectPath: string): boolean {\n  const configPath = join(projectPath, '.github', 'hooks', 'rulemetric.json');\n  if (!existsSync(configPath)) {\n    return false;\n  }\n\n  unlinkSync(configPath);\n  return true;\n}\n\n// ---------------------------------------------------------------------------\n// macOS LaunchAgent for GUI app env vars (HTTPS_PROXY, NODE_EXTRA_CA_CERTS)\n// ---------------------------------------------------------------------------\n\nconst LAUNCH_AGENT_LABEL = 'com.rulemetric.env';\n\nfunction getLaunchAgentPath(): string {\n  return join(homedir(), 'Library', 'LaunchAgents', `${LAUNCH_AGENT_LABEL}.plist`);\n}\n\n/**\n * Set HTTPS_PROXY and NODE_EXTRA_CA_CERTS for all GUI apps on macOS.\n *\n * Two layers:\n * 1. `launchctl setenv` \u2014 immediate effect for newly launched apps\n * 2. LaunchAgent plist \u2014 persists across reboots\n *\n * This ensures VS Code / Copilot / Cursor route LLM traffic through the\n * gateway even when launched from Dock or Spotlight (not a terminal).\n *\n * References:\n * - anthropics/claude-code#30318 (same pattern for Claude Desktop)\n * - Snyk IDE docs recommend launchctl setenv for macOS\n * - Apple QA1067 (archived) \u2014 original env var mechanism removed in 10.10\n */\nexport function installMacOSProxyEnv(gatewayPort: number, certPath: string): boolean {\n  if (process.platform !== 'darwin') return false;\n\n  const proxyUrl = `http://localhost:${gatewayPort}`;\n\n  // Layer 1: immediate effect via launchctl setenv\n  try {\n    execSync(`launchctl setenv HTTPS_PROXY ${proxyUrl}`, { stdio: 'pipe' });\n    if (existsSync(certPath)) {\n      execSync(`launchctl setenv NODE_EXTRA_CA_CERTS ${certPath}`, { stdio: 'pipe' });\n    }\n  } catch {\n    return false;\n  }\n\n  // Layer 2: LaunchAgent plist for persistence across reboots\n  const plistPath = getLaunchAgentPath();\n  const agentsDir = join(homedir(), 'Library', 'LaunchAgents');\n  mkdirSync(agentsDir, { recursive: true });\n\n  const certLine = existsSync(certPath)\n    ? `launchctl setenv NODE_EXTRA_CA_CERTS ${certPath};`\n    : '';\n\n  // LIVENESS-GUARDED boot command: at every login this re-pins HTTPS_PROXY\n  // machine-wide, but the gateway on :8787 is not a supervised service on the\n  // end-user path \u2014 it dies on logout and nothing restarts it. Pinning a dead\n  // port breaks HTTPS for every GUI app. So probe :8787 first and only setenv\n  // when the gateway actually answers; otherwise clear it (the session-start\n  // hook will re-pin once Claude Code brings the gateway back up).\n  const bootCmd =\n    `if nc -z -w 1 127.0.0.1 ${gatewayPort} 2>/dev/null; then ` +\n    `launchctl setenv HTTPS_PROXY ${proxyUrl};${certLine} ` +\n    `else launchctl unsetenv HTTPS_PROXY; launchctl unsetenv NODE_EXTRA_CA_CERTS; fi`;\n\n  const plist = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\"\n  \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${LAUNCH_AGENT_LABEL}</string>\n  <key>ProgramArguments</key>\n  <array>\n    <string>/bin/sh</string>\n    <string>-c</string>\n    <string>${bootCmd}</string>\n  </array>\n  <key>RunAtLoad</key>\n  <true/>\n</dict>\n</plist>\n`;\n\n  writeFileSync(plistPath, plist);\n  return true;\n}\n\n/**\n * Remove the RuleMetric LaunchAgent and unset env vars.\n */\nexport function uninstallMacOSProxyEnv(): boolean {\n  if (process.platform !== 'darwin') return false;\n\n  let changed = false;\n\n  // Unset env vars for current session\n  try {\n    execSync('launchctl unsetenv HTTPS_PROXY', { stdio: 'pipe' });\n    execSync('launchctl unsetenv NODE_EXTRA_CA_CERTS', { stdio: 'pipe' });\n  } catch { /* may not be set */ }\n\n  // Remove LaunchAgent plist\n  const plistPath = getLaunchAgentPath();\n  if (existsSync(plistPath)) {\n    unlinkSync(plistPath);\n    changed = true;\n  }\n\n  return changed;\n}\n\n// ---------------------------------------------------------------------------\n// VS Code user-level proxy settings\n// ---------------------------------------------------------------------------\n\nfunction getVSCodeUserSettingsPath(): string {\n  if (process.platform === 'darwin') {\n    return join(homedir(), 'Library', 'Application Support', 'Code', 'User', 'settings.json');\n  }\n  if (process.platform === 'win32') {\n    return join(process.env.APPDATA ?? '', 'Code', 'User', 'settings.json');\n  }\n  return join(homedir(), '.config', 'Code', 'User', 'settings.json');\n}\n\n/**\n * Set http.proxy in VS Code user settings (not workspace).\n *\n * Workspace-level http.proxy is silently ignored because VS Code restricts\n * it to APPLICATION scope (microsoft/vscode#236932). User-level settings\n * are the only reliable way to configure http.proxy.\n */\nexport function writeVSCodeUserProxyConfig(gatewayPort: number): boolean {\n  const settingsPath = getVSCodeUserSettingsPath();\n  if (!existsSync(join(settingsPath, '..'))) return false;\n\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber user config\n\n  // Only set if not already configured by the user\n  if (settings['http.proxy'] && !(settings['http.proxy'] as string).includes('localhost')) {\n    return false; // user has a custom proxy, don't overwrite\n  }\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = false;\n\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Remove RuleMetric proxy config from VS Code user settings.\n */\nexport function removeVSCodeUserProxyConfig(): boolean {\n  const settingsPath = getVSCodeUserSettingsPath();\n  if (!existsSync(settingsPath)) return false;\n\n  let settings: Record<string, unknown>;\n  try { settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); } catch { return false; }\n\n  const proxy = settings['http.proxy'] as string | undefined;\n  if (!proxy?.includes('localhost')) return false;\n\n  delete settings['http.proxy'];\n  delete settings['http.proxyStrictSSL'];\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n// ---------------------------------------------------------------------------\n// Cursor user-level proxy settings\n// ---------------------------------------------------------------------------\n//\n// Cursor is a VS Code fork and uses the same settings.json shape, but reads\n// from `Cursor/User/settings.json` instead of `Code/User/settings.json`. The\n// `.cursor/settings.json` (workspace) path can't reach Cursor's Electron main\n// process for the same reason VS Code's workspace path can't reach VS Code's\n// \u2014 the http.proxy setting is restricted to APPLICATION scope and only the\n// user-level file is honored.\n\nfunction getCursorUserSettingsPath(): string {\n  if (process.platform === 'darwin') {\n    return join(homedir(), 'Library', 'Application Support', 'Cursor', 'User', 'settings.json');\n  }\n  if (process.platform === 'win32') {\n    return join(process.env.APPDATA ?? '', 'Cursor', 'User', 'settings.json');\n  }\n  return join(homedir(), '.config', 'Cursor', 'User', 'settings.json');\n}\n\n/**\n * Set http.proxy in Cursor user settings (not workspace). Mirrors\n * `writeVSCodeUserProxyConfig` \u2014 workspace-level http.proxy is silently\n * ignored due to APPLICATION-scope restriction (Cursor inherits this from\n * VS Code, see microsoft/vscode#236932).\n *\n * Returns true if config was written, false if Cursor isn't installed\n * (User dir absent) or the user already has a non-localhost proxy set.\n */\nexport function writeCursorUserProxyConfig(gatewayPort: number): boolean {\n  const settingsPath = getCursorUserSettingsPath();\n  if (!existsSync(join(settingsPath, '..'))) return false;\n\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber user config\n\n  if (settings['http.proxy'] && !(settings['http.proxy'] as string).includes('localhost')) {\n    return false;\n  }\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = false;\n\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Remove RuleMetric proxy config from Cursor user settings.\n */\nexport function removeCursorUserProxyConfig(): boolean {\n  const settingsPath = getCursorUserSettingsPath();\n  if (!existsSync(settingsPath)) return false;\n\n  let settings: Record<string, unknown>;\n  try { settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); } catch { return false; }\n\n  const proxy = settings['http.proxy'] as string | undefined;\n  if (!proxy?.includes('localhost')) return false;\n\n  delete settings['http.proxy'];\n  delete settings['http.proxyStrictSSL'];\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n// \u2500\u2500\u2500 Antigravity (Google's Gemini-based agentic IDE) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Antigravity hooks live in `.agents/hooks.json` (workspace) and\n// `~/.gemini/config/hooks.json` (user-level). Events follow the\n// SessionStart / UserPromptSubmit / PreToolUse / PostToolUse / Stop /\n// SessionEnd vocabulary. Each hook command sets `RULEMETRIC_HOOK_TOOL=\n// antigravity` so `_normalize.sh` routes through the Antigravity branch.\n\ninterface AntigravityHookEntry {\n  type: 'command';\n  command: string;\n  timeout?: number;\n}\n\ninterface AntigravityHookBlock {\n  matcher?: string;\n  hooks: AntigravityHookEntry[];\n}\n\ninterface AntigravityRuleMetricBlock {\n  enabled: boolean;\n  SessionStart: AntigravityHookBlock[];\n  UserPromptSubmit: AntigravityHookBlock[];\n  PreToolUse: AntigravityHookBlock[];\n  PostToolUse: AntigravityHookBlock[];\n  Stop: AntigravityHookBlock[];\n  SessionEnd: AntigravityHookBlock[];\n}\n\nexport type AntigravityHooksConfig = { rulemetric: AntigravityRuleMetricBlock };\n\n/** Resolve the binary string to invoke for a hook command. */\nfunction getRulemetricCommand(): string {\n  // Prefer the local Node binary + bin/run.js so the hook works even when\n  // `rulemetric` isn't on PATH for the GUI Antigravity process.\n  const nodeBin = process.execPath;\n  // bin/run.js lives next to dist/ in the installed CLI; resolve from\n  // import.meta isn't available in a portable way here, so we use the\n  // process argv1 if it's pointing at the CLI entry, else fall back to\n  // the bare command name. In practice this function is called inside\n  // `rulemetric hooks install`, where process.argv[1] is bin/run.js.\n  const cliEntry = process.argv[1];\n  if (cliEntry && cliEntry.endsWith('run.js')) {\n    return `${nodeBin} ${cliEntry}`;\n  }\n  return 'rulemetric';\n}\n\nexport function generateAntigravityHooksConfig(): AntigravityHooksConfig {\n  const cmd = getRulemetricCommand();\n  const mk = (name: string): AntigravityHookEntry => ({\n    type: 'command',\n    command: `RULEMETRIC_HOOK_TOOL=antigravity ${cmd} hooks run ${name}`,\n    timeout: 30,\n  });\n  return {\n    rulemetric: {\n      enabled: true,\n      SessionStart: [{ hooks: [mk('session-start')] }],\n      UserPromptSubmit: [{ hooks: [mk('user-prompt')] }],\n      PreToolUse: [{ matcher: '.*', hooks: [mk('post-tool-use')] }],\n      PostToolUse: [{ matcher: '.*', hooks: [mk('post-tool-use')] }],\n      Stop: [{ hooks: [mk('assistant-response')] }],\n      SessionEnd: [{ hooks: [mk('session-end')] }],\n    },\n  };\n}\n\nfunction writeAntigravityHooksToDir(dir: string): string | null {\n  const configPath = join(dir, 'hooks.json');\n  const existing = readMergeableJson(configPath);\n  if (existing === null) return null; // unparseable \u2014 backed up, don't drop sibling blocks\n  const generated = generateAntigravityHooksConfig();\n  // Antigravity keys hook blocks by name; RuleMetric owns its own block\n  // and never touches sibling blocks the user may have added.\n  const merged = { ...existing, rulemetric: generated.rulemetric };\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(configPath, JSON.stringify(merged, null, 2) + '\\n');\n  return configPath;\n}\n\nexport function writeAntigravityHooks(projectPath: string): string | null {\n  return writeAntigravityHooksToDir(join(projectPath, '.agents'));\n}\n\nexport function writeAntigravityUserHooks(home: string = homedir()): string | null {\n  // Only wire user-level Antigravity/Gemini hooks if the tool is actually\n  // present \u2014 never manufacture ~/.gemini for a user who doesn't use it\n  // (undisclosed scope, onboarding field report 2026-07-07 F2). `home` is\n  // injectable for tests.\n  const geminiHome = join(home, '.gemini');\n  if (!existsSync(geminiHome)) return null;\n  return writeAntigravityHooksToDir(join(geminiHome, 'config'));\n}\n\nfunction removeAntigravityHooksFromFile(configPath: string): boolean {\n  if (!existsSync(configPath)) return false;\n  let existing: Record<string, unknown>;\n  try { existing = JSON.parse(readFileSync(configPath, 'utf-8')); } catch { return false; }\n  if (!('rulemetric' in existing)) return false;\n  delete existing.rulemetric;\n  if (Object.keys(existing).length === 0) {\n    // No other blocks \u2014 remove the file entirely.\n    try { unlinkSync(configPath); } catch { /* ignore */ }\n  } else {\n    writeFileSync(configPath, JSON.stringify(existing, null, 2) + '\\n');\n  }\n  return true;\n}\n\nexport function removeAntigravityHooks(projectPath: string): boolean {\n  return removeAntigravityHooksFromFile(join(projectPath, '.agents', 'hooks.json'));\n}\n\nexport function removeAntigravityUserHooks(): boolean {\n  const modern = removeAntigravityHooksFromFile(join(homedir(), '.gemini', 'config', 'hooks.json'));\n  const legacy = removeAntigravityHooksFromFile(join(homedir(), '.gemini', 'hooks.json'));\n  return modern || legacy;\n}\n"],
+  "mappings": ";AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,WAAW,cAAc,eAAe,YAAY,oBAAoB;AAC7F,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAQvB,SAAS,qBAAqB,aAAqC;AACxE,QAAM,QAAwB,CAAC,aAAa;AAE5C,MAAI,WAAW,KAAK,aAAa,SAAS,CAAC,GAAG;AAC5C,UAAM,KAAK,QAAQ;AAAA,EACrB;AAEA,MAAI,WAAW,KAAK,aAAa,SAAS,CAAC,GAAG;AAC5C,UAAM,KAAK,eAAe;AAAA,EAC5B;AAKA,MAAI,WAAW,KAAK,aAAa,SAAS,CAAC,GAAG;AAC5C,UAAM,KAAK,aAAa;AAAA,EAC1B;AAEA,SAAO;AACT;AAQO,SAAS,0BAA0B,QAAyB;AAWjE,QAAM,SAAS,SAAS,SAAS,MAAM,aAAa;AACpD,QAAM,MAAM,CAAC,UAAkB,EAAE,SAAS,GAAG,MAAM,wBAAwB,IAAI,GAAG;AAClF,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACL,cAAc,CAAC,IAAI,eAAe,CAAC;AAAA,MACnC,oBAAoB,CAAC,IAAI,aAAa,CAAC;AAAA,MACvC,eAAe,CAAC,IAAI,eAAe,CAAC;AAAA,MACpC,sBAAsB,CAAC,IAAI,eAAe,CAAC;AAAA,MAC3C,qBAAqB,CAAC,IAAI,eAAe,CAAC;AAAA,MAC1C,oBAAoB,CAAC,IAAI,eAAe,CAAC;AAAA,MACzC,mBAAmB,CAAC,IAAI,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQxC,oBAAoB,CAAC,IAAI,oBAAoB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAK9C,MAAM,CAAC,IAAI,eAAe,CAAC;AAAA,MAC3B,YAAY,CAAC,IAAI,aAAa,CAAC;AAAA,IACjC;AAAA,EACF;AACF;AAQO,SAAS,2BAA2B,QAAyB;AAGlE,QAAM,SAAS,SAAS,SAAS,MAAM,aAAa;AACpD,QAAM,MAAM,CAAC,UAAkB,EAAE,MAAM,WAAW,MAAM,GAAG,MAAM,wBAAwB,IAAI,GAAG;AAChG,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACL,cAAc,CAAC,IAAI,eAAe,CAAC;AAAA,MACnC,qBAAqB,CAAC,IAAI,aAAa,CAAC;AAAA,MACxC,aAAa,CAAC,IAAI,eAAe,CAAC;AAAA,MAClC,YAAY,CAAC,IAAI,aAAa,CAAC;AAAA,IACjC;AAAA,EACF;AACF;AAgCO,SAAS,8BAA8B,QAAwC;AAYpF,QAAM,SAAS,SAAS,SAAS,MAAM,aAAa;AACpD,QAAM,KAAK,CAAC,UAAmC;AAAA,IAC7C,MAAM;AAAA,IACN,SAAS,GAAG,MAAM,wBAAwB,IAAI;AAAA,EAChD;AACA,SAAO;AAAA,IACL,cAAc,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,IAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,IACjD,aAAa,CAAC,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC;AAAA,IAC5C,YAAY,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,EAC7C;AACF;AAcO,SAAS,mBAAmB,YAGjC;AACA,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO,EAAE,UAAU,CAAC,GAAG,iBAAiB,KAAK;AAC1E,QAAM,MAAM,aAAa,YAAY,OAAO;AAC5C,MAAI;AACF,WAAO,EAAE,UAAU,KAAK,MAAM,GAAG,GAA8B,iBAAiB,KAAK;AAAA,EACvF,QAAQ;AACN,UAAM,kBAAkB,GAAG,UAAU;AACrC,kBAAc,iBAAiB,GAAG;AAClC,WAAO,EAAE,UAAU,CAAC,GAAG,gBAAgB;AAAA,EACzC;AACF;AASO,SAAS,8BACd,YACA,UAC+B;AAC/B,YAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,MAAI,aAA4B;AAChC,MAAI,WAAW,UAAU,GAAG;AAC1B,iBAAa,GAAG,UAAU;AAC1B,iBAAa,YAAY,UAAU;AAAA,EACrC;AACA,gBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAClE,SAAO,EAAE,WAAW;AACtB;AAYA,SAAS,kBAAkB,YAAoD;AAC7E,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO,CAAC;AACrC,QAAM,MAAM,aAAa,YAAY,OAAO;AAC5C,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,QAAI;AACF,oBAAc,GAAG,UAAU,gBAAgB,GAAG;AAAA,IAChD,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;AAUO,SAAS,qBAAqB,UAAmC,QAAuB;AAC7F,QAAM,YAAY,8BAA8B,MAAM;AACtD,QAAM,QAAS,SAAS,SAAS,CAAC;AAClC,aAAW,CAAC,OAAO,MAAM,KAAK,OAAO,QAAQ,SAAS,GAAG;AACvD,UAAM,UAAW,MAAM,KAAK,KAAK,CAAC;AAClC,UAAM,iBAAiB,QAAQ;AAAA,MAAK,CAAC,MACnC,GAAG,OAAO,KAAK,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY,CAAC;AAAA,IAC1F;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,MAAM;AAAA,IACvC;AAAA,EACF;AACA,WAAS,QAAQ;AACnB;AASO,SAAS,yBAAyB,UAA4C;AACnF,MAAI,CAAC,SAAS,SAAS,OAAO,SAAS,UAAU,SAAU,QAAO;AAClE,QAAM,QAAQ,SAAS;AACvB,SAAO,OAAO,OAAO,KAAK,EAAE;AAAA,IAC1B,CAAC,WACC,MAAM,QAAQ,MAAM,KACpB,OAAO;AAAA,MAAK,CAAC,MACX,GAAG,OAAO,KAAK,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY,CAAC;AAAA,IAC1F;AAAA,EACJ;AACF;AAQO,SAAS,sBAAsB,UAA4C;AAChF,MAAI,CAAC,SAAS,SAAS,OAAO,SAAS,UAAU,SAAU,QAAO;AAClE,QAAM,QAAQ,SAAS;AACvB,MAAI,UAAU;AACd,aAAW,SAAS,OAAO,KAAK,KAAK,GAAG;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,QAAQ,OAAO,EAAG;AAC7B,UAAM,OAAO,QAAQ,OAAO,CAAC,UAAU;AACrC,YAAM,eAAe,OAAO,OAAO;AAAA,QACjC,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY;AAAA,MAC1E;AACA,UAAI,aAAc,YAAW;AAC7B,aAAO,CAAC;AAAA,IACV,CAAC;AACD,QAAI,KAAK,WAAW,EAAG,QAAO,MAAM,KAAK;AAAA,QACpC,OAAM,KAAK,IAAI;AAAA,EACtB;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,SAAS;AACrD,SAAO,UAAU;AACnB;AAQA,SAAS,sBAAsB,WAAmB,QAAgC;AAChF,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,KAAK,WAAW,YAAY;AAC/C,QAAM,YAAY,0BAA0B,MAAM;AAKlD,QAAM,SAAS,kBAAkB,UAAU;AAC3C,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,WAAW;AAEjB,QAAM,SAAoC,EAAE,GAAI,SAAS,SAAS,CAAC,EAAG;AAEtE,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,UAAU,KAAK,GAAG;AAC5D,UAAM,UAAU,OAAO,KAAK,KAAK,CAAC;AAClC,UAAM,gBAAgB,QAAQ;AAAA,MAC5B,CAAC,MACC,OAAO,MAAM,YACb,MAAM,QACN,aAAa,KACb,OAAQ,EAA0B,YAAY,YAC7C,EAA0B,QAAQ,SAAS,YAAY;AAAA,IAC5D;AACA,QAAI,CAAC,eAAe;AAClB,aAAO,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,SAAS;AAAA,IACb,SAAS,SAAS,WAAW,UAAU;AAAA,IACvC,OAAO;AAAA,EACT;AAEA,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChE,SAAO;AACT;AAOO,SAAS,iBAAiB,aAAqB,QAAgC;AACpF,SAAO,sBAAsB,KAAK,aAAa,SAAS,GAAG,MAAM;AACnE;AASO,SAAS,qBAAqB,QAAiB,OAAe,QAAQ,GAAkB;AAI7F,QAAM,aAAa,KAAK,MAAM,SAAS;AACvC,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,SAAO,sBAAsB,YAAY,MAAM;AACjD;AAOO,SAAS,kBAAkB,aAAqB,QAAgC;AACrF,QAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,KAAK,WAAW,OAAO;AACxC,YAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AAEvC,QAAM,aAAa,KAAK,UAAU,iBAAiB;AACnD,QAAM,SAAS,2BAA2B,MAAM;AAEhD,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChE,SAAO;AACT;AAOA,SAAS,0BAA0B,YAA6B;AAC9D,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,OAAO,OAAO;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AACd,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG;AACzD,UAAM,WAAW,MAAM,OAAO,CAAC,MAAe;AAC5C,UAAI,OAAO,MAAM,YAAY,MAAM,QAAQ,EAAE,aAAa,GAAI,QAAO;AACrE,YAAM,MAAO,EAA0B;AACvC,UAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,YAAY,GAAG;AACzD,kBAAU;AACV,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT,CAAC;AAED,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO,OAAO,MAAM,KAAK;AAAA,IAC3B,OAAO;AACL,aAAO,MAAM,KAAK,IAAI;AAAA,IACxB;AAAA,EACF;AAEA,MAAI,SAAS;AACX,kBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAClE;AAEA,SAAO;AACT;AAKO,SAAS,kBAAkB,aAA8B;AAC9D,SAAO,0BAA0B,KAAK,aAAa,WAAW,YAAY,CAAC;AAC7E;AAKO,SAAS,wBAAiC;AAC/C,SAAO,0BAA0B,KAAK,QAAQ,GAAG,WAAW,YAAY,CAAC;AAC3E;AAOO,SAAS,uBAAuB,aAAqB,aAAqB,UAA2B;AAC1G,QAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,MAAI,CAAC,WAAW,SAAS,EAAG,QAAO;AAEnC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAE9B,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI,WAAW,QAAQ;AACrD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAQO,SAAS,uBAAuB,aAAqB,aAAqB,UAA2B;AAC1G,QAAM,YAAY,KAAK,aAAa,SAAS;AAK7C,MAAI,CAAC,WAAW,SAAS,EAAG,QAAO;AAEnC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAE9B,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI,WAAW,QAAQ;AAGrD,QAAM,kBAAmB,SAAS,yBAAyB,KAAK,CAAC;AACjE,kBAAgB,wBAAwB,IAAI,oBAAoB,WAAW;AAC3E,WAAS,yBAAyB,IAAI;AAEtC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAOO,SAAS,wBAAwB,aAA8B;AACpE,QAAM,eAAe,KAAK,aAAa,WAAW,eAAe;AACjE,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AAE1F,MAAI,UAAU;AAEd,MAAI,SAAS,YAAY,GAAG;AAC1B,WAAO,SAAS,YAAY;AAC5B,WAAO,SAAS,qBAAqB;AACrC,cAAU;AAAA,EACZ;AAEA,QAAM,kBAAkB,SAAS,yBAAyB;AAC1D,MAAI,kBAAkB,wBAAwB,GAAG;AAC/C,WAAO,gBAAgB,wBAAwB;AAC/C,QAAI,OAAO,KAAK,eAAe,EAAE,WAAW,GAAG;AAC7C,aAAO,SAAS,yBAAyB;AAAA,IAC3C;AACA,cAAU;AAAA,EACZ;AAEA,MAAI,SAAS;AACX,kBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAAA,EACtE;AAEA,SAAO;AACT;AAMO,SAAS,mBAAmB,aAA8B;AAC/D,QAAM,aAAa,KAAK,aAAa,WAAW,SAAS,iBAAiB;AAC1E,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,aAAW,UAAU;AACrB,SAAO;AACT;AAMA,IAAM,qBAAqB;AAE3B,SAAS,qBAA6B;AACpC,SAAO,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,kBAAkB,QAAQ;AACjF;AAiBO,SAAS,qBAAqB,aAAqB,UAA2B;AACnF,MAAI,QAAQ,aAAa,SAAU,QAAO;AAE1C,QAAM,WAAW,oBAAoB,WAAW;AAGhD,MAAI;AACF,aAAS,gCAAgC,QAAQ,IAAI,EAAE,OAAO,OAAO,CAAC;AACtE,QAAI,WAAW,QAAQ,GAAG;AACxB,eAAS,wCAAwC,QAAQ,IAAI,EAAE,OAAO,OAAO,CAAC;AAAA,IAChF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,QAAM,YAAY,mBAAmB;AACrC,QAAM,YAAY,KAAK,QAAQ,GAAG,WAAW,cAAc;AAC3D,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAExC,QAAM,WAAW,WAAW,QAAQ,IAChC,wCAAwC,QAAQ,MAChD;AAQJ,QAAM,UACJ,2BAA2B,WAAW,mDACN,QAAQ,IAAI,QAAQ;AAGtD,QAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAMJ,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,cAKhB,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQnB,gBAAc,WAAW,KAAK;AAC9B,SAAO;AACT;AAKO,SAAS,yBAAkC;AAChD,MAAI,QAAQ,aAAa,SAAU,QAAO;AAE1C,MAAI,UAAU;AAGd,MAAI;AACF,aAAS,kCAAkC,EAAE,OAAO,OAAO,CAAC;AAC5D,aAAS,0CAA0C,EAAE,OAAO,OAAO,CAAC;AAAA,EACtE,QAAQ;AAAA,EAAuB;AAG/B,QAAM,YAAY,mBAAmB;AACrC,MAAI,WAAW,SAAS,GAAG;AACzB,eAAW,SAAS;AACpB,cAAU;AAAA,EACZ;AAEA,SAAO;AACT;AAMA,SAAS,4BAAoC;AAC3C,MAAI,QAAQ,aAAa,UAAU;AACjC,WAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,QAAQ,QAAQ,eAAe;AAAA,EAC1F;AACA,MAAI,QAAQ,aAAa,SAAS;AAChC,WAAO,KAAK,QAAQ,IAAI,WAAW,IAAI,QAAQ,QAAQ,eAAe;AAAA,EACxE;AACA,SAAO,KAAK,QAAQ,GAAG,WAAW,QAAQ,QAAQ,eAAe;AACnE;AASO,SAAS,2BAA2B,aAA8B;AACvE,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,KAAK,cAAc,IAAI,CAAC,EAAG,QAAO;AAElD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,SAAS,YAAY,KAAK,CAAE,SAAS,YAAY,EAAa,SAAS,WAAW,GAAG;AACvF,WAAO;AAAA,EACT;AAEA,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI;AAElC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAKO,SAAS,8BAAuC;AACrD,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AAE1F,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,SAAO,SAAS,YAAY;AAC5B,SAAO,SAAS,qBAAqB;AACrC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAaA,SAAS,4BAAoC;AAC3C,MAAI,QAAQ,aAAa,UAAU;AACjC,WAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,UAAU,QAAQ,eAAe;AAAA,EAC5F;AACA,MAAI,QAAQ,aAAa,SAAS;AAChC,WAAO,KAAK,QAAQ,IAAI,WAAW,IAAI,UAAU,QAAQ,eAAe;AAAA,EAC1E;AACA,SAAO,KAAK,QAAQ,GAAG,WAAW,UAAU,QAAQ,eAAe;AACrE;AAWO,SAAS,2BAA2B,aAA8B;AACvE,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,KAAK,cAAc,IAAI,CAAC,EAAG,QAAO;AAElD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAE9B,MAAI,SAAS,YAAY,KAAK,CAAE,SAAS,YAAY,EAAa,SAAS,WAAW,GAAG;AACvF,WAAO;AAAA,EACT;AAEA,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI;AAElC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAKO,SAAS,8BAAuC;AACrD,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AAE1F,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,SAAO,SAAS,YAAY;AAC5B,SAAO,SAAS,qBAAqB;AACrC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAkCA,SAAS,uBAA+B;AAGtC,QAAM,UAAU,QAAQ;AAMxB,QAAM,WAAW,QAAQ,KAAK,CAAC;AAC/B,MAAI,YAAY,SAAS,SAAS,QAAQ,GAAG;AAC3C,WAAO,GAAG,OAAO,IAAI,QAAQ;AAAA,EAC/B;AACA,SAAO;AACT;AAEO,SAAS,iCAAyD;AACvE,QAAM,MAAM,qBAAqB;AACjC,QAAM,KAAK,CAAC,UAAwC;AAAA,IAClD,MAAM;AAAA,IACN,SAAS,oCAAoC,GAAG,cAAc,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO;AAAA,IACL,YAAY;AAAA,MACV,SAAS;AAAA,MACT,cAAc,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,MAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,MACjD,YAAY,CAAC,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,MAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,MAC7D,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC;AAAA,MAC5C,YAAY,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,KAA4B;AAC9D,QAAM,aAAa,KAAK,KAAK,YAAY;AACzC,QAAM,WAAW,kBAAkB,UAAU;AAC7C,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,YAAY,+BAA+B;AAGjD,QAAM,SAAS,EAAE,GAAG,UAAU,YAAY,UAAU,WAAW;AAC/D,YAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChE,SAAO;AACT;AAEO,SAAS,sBAAsB,aAAoC;AACxE,SAAO,2BAA2B,KAAK,aAAa,SAAS,CAAC;AAChE;AAEO,SAAS,0BAA0B,OAAe,QAAQ,GAAkB;AAKjF,QAAM,aAAa,KAAK,MAAM,SAAS;AACvC,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,SAAO,2BAA2B,KAAK,YAAY,QAAQ,CAAC;AAC9D;AAEA,SAAS,+BAA+B,YAA6B;AACnE,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AACxF,MAAI,EAAE,gBAAgB,UAAW,QAAO;AACxC,SAAO,SAAS;AAChB,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AAEtC,QAAI;AAAE,iBAAW,UAAU;AAAA,IAAG,QAAQ;AAAA,IAAe;AAAA,EACvD,OAAO;AACL,kBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAAA,EACpE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,aAA8B;AACnE,SAAO,+BAA+B,KAAK,aAAa,WAAW,YAAY,CAAC;AAClF;AAEO,SAAS,6BAAsC;AACpD,QAAM,SAAS,+BAA+B,KAAK,QAAQ,GAAG,WAAW,UAAU,YAAY,CAAC;AAChG,QAAM,SAAS,+BAA+B,KAAK,QAAQ,GAAG,WAAW,YAAY,CAAC;AACtF,SAAO,UAAU;AACnB;",
+  "names": []
+}

package/dist/{chunk-YDTUPCBL.js → chunk-XNNOXGP6.js}

@@ -2,10 +2,10 @@ import {
   detectInstalledTools,
   hasRulemetricClaudeHooks,
   mergeClaudeCodeHooks
-} from "./chunk-HWGRTIXN.js";
+} from "./chunk-XN23W5HL.js";
 import {
   GATEWAY_PORT
-} from "./chunk-OVGP4OGK.js";
+} from "./chunk-DAJNO4OI.js";
 import {
   apiGet
 } from "./chunk-ZRLYHBPN.js";
@@ -276,6 +276,19 @@ var STEPS = [
           after: `proxy \u2192 http://localhost:${GATEWAY_PORT}`
         });
       }
+      for (const [tool, home, file] of [
+        ["Cursor", join(homedir(), ".cursor"), join(homedir(), ".cursor", "hooks.json")],
+        ["Antigravity/Gemini", join(homedir(), ".gemini"), join(homedir(), ".gemini", "config", "hooks.json")]
+      ]) {
+        if (existsSync(home)) {
+          artifacts.push({
+            path: `${file} (${tool} user hooks)`,
+            kind: "file",
+            before: existsSync(file) ? "(existing config)" : null,
+            after: "adds RuleMetric session-capture hooks for this tool"
+          });
+        }
+      }
       return {
         id: "hooks",
         title: "Install hooks + capture proxy",
@@ -379,4 +392,4 @@ export {
   isStepId,
   computeStatus
 };
-//# sourceMappingURL=chunk-YDTUPCBL.js.map
+//# sourceMappingURL=chunk-XNNOXGP6.js.map

package/dist/{chunk-YDTUPCBL.js.map → chunk-XNNOXGP6.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib/setup-steps.ts"],
-  "sourcesContent": ["import { execSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { isAuthenticated, getDefaultConfigDir } from './auth.js';\nimport { apiGet } from './api-client.js';\nimport { GATEWAY_PORT, isGatewayListening } from './gateway-lifecycle.js';\nimport { detectInstalledTools, mergeClaudeCodeHooks, hasRulemetricClaudeHooks } from './hooks-config.js';\n\n/**\n * Data model for the four core onboarding steps, shared (by step-ID list +\n * install-monotonicity) with the web reducer `deriveSetupProgress()`.\n *\n * The two surfaces are separate implementations by necessity, but they no\n * longer read *different sources* for the same fact:\n *   - Server-observable signals (cli-worker heartbeat / captured session) are\n *     unified through the shared `GET /api/setup/status` endpoint \u2014 the CLI's\n *     `workerActive()` and the web's `use-setup-progress.ts` both bottom out on\n *     that one server-side authority, so they cannot drift on it.\n *   - Local signals (auth = `~/.config/rulemetric` creds via `isAuthenticated()`,\n *     hooks = cwd `.claude/settings.json`) stay machine-local: the browser\n *     cannot read the user's filesystem, so these legitimately differ from the\n *     web's account-scoped proxies for the same step (see the design doc's\n *     \"Shared step model, two implementations\").\n * Each step exposes:\n *   - detect(): is it done? (reads a local/remote signal, never mutates)\n *   - plan():   what would apply() write? (read-only, returns diffs/artifacts)\n *   - apply():  perform the step (thin \u2014 shells out to existing commands)\n */\n\nexport const CORE_STEP_IDS = ['install', 'auth', 'hooks', 'worker'] as const;\n// Optional steps live in the walk (offered, recommended) but do NOT gate\n// `coreComplete` \u2014 declining them still leaves the user fully onboarded. The\n// proxy/CA capture now ships as the DEFAULT of the core `hooks` step (see that\n// step's plan(), which fully discloses the invasive MITM/keychain side effects\n// up front); it is not a separate opt-in step. The mechanism is retained for\n// any future optional step.\nexport const OPTIONAL_STEP_IDS = [] as const;\nexport const ALL_STEP_IDS = [...CORE_STEP_IDS, ...OPTIONAL_STEP_IDS] as const;\nexport type StepId = (typeof ALL_STEP_IDS)[number];\n\nexport type ArtifactKind = 'file' | 'command' | 'service';\n\nexport interface Artifact {\n  path: string;\n  kind: ArtifactKind;\n  before: string | null;\n  after: string | null;\n  /** True when `after` contains a masked secret (never the raw value). */\n  masked?: boolean;\n}\n\nexport interface StepPlan {\n  id: StepId;\n  title: string;\n  command?: string;\n  artifacts: Artifact[];\n}\n\nexport interface SetupContext {\n  projectPath: string;\n  configDir: string;\n}\n\nexport interface SetupStep {\n  id: StepId;\n  title: string;\n  command?: string;\n  /** Optional steps are offered in the walk but never gate `coreComplete`. */\n  optional?: boolean;\n  detect(ctx: SetupContext): Promise<boolean>;\n  plan(ctx: SetupContext): Promise<StepPlan>;\n  apply(ctx: SetupContext): Promise<void>;\n}\n\nexport interface StepStatus {\n  id: StepId;\n  done: boolean;\n}\n\nexport interface SetupStatus {\n  steps: StepStatus[];\n  coreComplete: boolean;\n  currentStepId: StepId | null;\n}\n\n/** Build the default context from the current process (cwd + config dir). */\nexport function defaultContext(): SetupContext {\n  return {\n    projectPath: process.cwd(),\n    configDir: getDefaultConfigDir(),\n  };\n}\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\n/**\n * Mask a secret: keep the first 4 and last 4 characters, replace the middle\n * with asterisks. Strings too short to reveal safely are fully masked.\n */\nexport function maskToken(s: string): string {\n  if (!s) return '';\n  if (s.length <= 8) return '*'.repeat(s.length);\n  const head = s.slice(0, 4);\n  const tail = s.slice(-4);\n  return `${head}${'*'.repeat(Math.max(4, s.length - 8))}${tail}`;\n}\n\n/**\n * Simple line-oriented +/- diff for terminal display. Not a real LCS \u2014 good\n * enough to show a human/agent exactly which lines an artifact would change.\n */\nexport function renderDiff(before: string | null, after: string | null): string {\n  const beforeLines = before === null ? [] : before.replace(/\\n$/, '').split('\\n');\n  const afterLines = after === null ? [] : after.replace(/\\n$/, '').split('\\n');\n  const out: string[] = [];\n  const max = Math.max(beforeLines.length, afterLines.length);\n  for (let i = 0; i < max; i++) {\n    const b = beforeLines[i];\n    const a = afterLines[i];\n    if (b === a) {\n      out.push(` ${b}`);\n    } else {\n      if (b !== undefined) out.push(`-${b}`);\n      if (a !== undefined) out.push(`+${a}`);\n    }\n  }\n  return out.join('\\n');\n}\n\n/** Read a single KEY=value from the env file, or null if absent. */\nfunction readEnvValue(configDir: string, key: string): string | null {\n  const envPath = join(configDir, 'env');\n  if (!existsSync(envPath)) return null;\n  try {\n    const content = readFileSync(envPath, 'utf-8');\n    const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n    return match ? match[1] : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Is a CLI worker heartbeat active for the caller? (best-effort, network)\n *\n * Reads the shared `GET /api/setup/status` endpoint's `workerActive` field\n * rather than re-deriving it from `/api/workers/status`. That endpoint computes\n * the cli-worker heartbeat signal server-side using the SAME window +\n * staleness thresholds + `workerType === 'cli-worker'` filter the web strip\n * uses, so the CLI and web can't drift on this fact by construction (they used\n * to each filter/threshold client-side, which is exactly how they could\n * disagree). Fast-fails after 2.5s so `setup --json` / `setup plan` degrade to\n * \"not running\" instead of blocking on a stalled connection \u2014 detection is a\n * UX signal, not a correctness gate; offline \u2192 false.\n */\nasync function workerActive(): Promise<boolean> {\n  if (!isAuthenticated()) return false;\n  try {\n    const status = await Promise.race([\n      apiGet<{\n        cliEverConnected?: boolean;\n        anyCapturedSession?: boolean;\n        workerActive?: boolean;\n      }>('/api/setup/status'),\n      new Promise<never>((_, reject) =>\n        setTimeout(() => reject(new Error('setup/status timeout')), 2500),\n      ),\n    ]);\n    return status?.workerActive === true;\n  } catch {\n    return false;\n  }\n}\n\n/** Read the project's `.claude/settings.json` for a read-only preview (no throw). */\nfunction readProjectSettings(projectPath: string): { settings: Record<string, unknown>; before: string | null } {\n  const settingsPath = join(projectPath, '.claude', 'settings.json');\n  let settings: Record<string, unknown> = {};\n  let before: string | null = null;\n  if (existsSync(settingsPath)) {\n    try {\n      before = readFileSync(settingsPath, 'utf-8').replace(/\\n$/, '');\n      settings = JSON.parse(before) as Record<string, unknown>;\n    } catch {\n      settings = {};\n    }\n  }\n  return { settings, before };\n}\n\n/**\n * Compute the in-memory `.claude/settings.json` after the RuleMetric session\n * HOOKS are merged, WITHOUT touching disk. This is the \u00A71 (hooks) portion of\n * the diff; the proxy env block that `hooks install` \u00A72 also writes is disclosed\n * separately via projectProxyEnvSettings so the two changes read distinctly.\n */\nfunction projectHooksSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath);\n  mergeClaudeCodeHooks(settings);\n  return { before, after: JSON.stringify(settings, null, 2) };\n}\n\n/**\n * The proxy-env addition to `.claude/settings.json` that `hooks install` \u00A72\n * makes on the default path \u2014 for the disclosure diff only. Read-only.\n */\nfunction projectProxyEnvSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath);\n  const env = { ...((settings.env as Record<string, string>) ?? {}) };\n  env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n  env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n  env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n  return { before, after: JSON.stringify({ ...settings, env }, null, 2) };\n}\n\nconst WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', 'com.rulemetric.worker.plist');\nconst WORKER_SYSTEMD_PATH = join(homedir(), '.config', 'systemd', 'user', 'rulemetric-worker.service');\n\n/** Run a command with inherited stdio (interactive-friendly). Thin apply(). */\nfunction runCommand(cmd: string): void {\n  execSync(cmd, { stdio: 'inherit' });\n}\n\nexport const STEPS: SetupStep[] = [\n  {\n    id: 'install',\n    title: 'Install the CLI',\n    command: 'npm install -g @rulemetric/cli',\n    // Monotonic: the CLI must exist to produce any downstream signal, so it\n    // greens off auth or worker presence (nothing local phones home before).\n    async detect(): Promise<boolean> {\n      return isAuthenticated() || (await workerActive());\n    },\n    async plan(): Promise<StepPlan> {\n      return {\n        id: 'install',\n        title: 'Install the CLI',\n        command: 'npm install -g @rulemetric/cli',\n        artifacts: [\n          {\n            path: 'npm install -g @rulemetric/cli',\n            kind: 'command',\n            before: null,\n            after: 'rulemetric --version   # verifies the binary is on PATH',\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('npm install -g @rulemetric/cli');\n    },\n  },\n  {\n    id: 'auth',\n    title: 'Authenticate',\n    command: 'rulemetric auth login',\n    async detect(): Promise<boolean> {\n      return isAuthenticated();\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const envPath = join(ctx.configDir, 'env');\n      // Guard the read like the sibling helpers (readEnvValue /\n      // projectHooksSettings) do: a TOCTOU race or permission error between\n      // existsSync and readFileSync must NOT throw out of plan(). Fall back to\n      // a secret-free marker rather than crashing `setup plan`/`--show`.\n      let before: string | null = null;\n      if (existsSync(envPath)) {\n        try {\n          before = maskEnvFile(readFileSync(envPath, 'utf-8'));\n        } catch {\n          before = '(unreadable)';\n        }\n      }\n      const rawToken = readEnvValue(ctx.configDir, 'RULEMETRIC_ACCESS_TOKEN');\n      const tokenDisplay = rawToken ? maskToken(rawToken) : maskToken('<token-from-login>');\n      // Reconstruct EXACTLY what `auth login`'s saveEnvFile writes so the diff\n      // doesn't show phantom changes: line order [TOKEN, KEY?, URL?], the key\n      // preserved (masked) when present, and the URL sourced from\n      // process.env.RULEMETRIC_API_URL \u2014 the same value login passes \u2014 and OMITTED\n      // when unset (login writes no URL line then). All masking preserved; the raw\n      // token/key are never emitted.\n      const afterLines = [`RULEMETRIC_ACCESS_TOKEN=${tokenDisplay}`];\n      const rawApiKey = readEnvValue(ctx.configDir, 'RULEMETRIC_API_KEY');\n      if (rawApiKey) {\n        afterLines.push(`RULEMETRIC_API_KEY=${maskToken(rawApiKey)}`);\n      }\n      const loginUrl = process.env.RULEMETRIC_API_URL;\n      if (loginUrl) {\n        afterLines.push(`RULEMETRIC_API_URL=${loginUrl}`);\n      }\n      const after = afterLines.join('\\n');\n      return {\n        id: 'auth',\n        title: 'Authenticate',\n        command: 'rulemetric auth login',\n        artifacts: [\n          {\n            path: envPath,\n            kind: 'file',\n            before,\n            after,\n            masked: true,\n          },\n          // `auth login` (saveToken) also writes auth.json \u2014 disclose it so the\n          // plan matches every file apply() touches.\n          {\n            path: join(ctx.configDir, 'auth.json'),\n            kind: 'file',\n            before: existsSync(join(ctx.configDir, 'auth.json')) ? '(existing session tokens)' : null,\n            after: '{ accessToken, refreshToken, expiresAt, email }  \u2014 OAuth session tokens (secret)',\n            masked: true,\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric auth login');\n    },\n  },\n  {\n    id: 'hooks',\n    title: 'Install hooks + capture proxy',\n    // Default onboarding installs the FULL capture path: session hooks PLUS the\n    // MITM proxy (rendered-system-prompt / instruction linking + cross-tool\n    // capture). Every invasive side effect is disclosed up front in plan()\n    // below \u2014 nothing is silent. `hooks install` fails SAFE: if the CA sudo\n    // trust is declined it degrades to hooks-only (no machine-wide proxy pin),\n    // and HTTPS_PROXY is only pinned once the gateway actually answers on\n    // :8787 \u2014 so the default never bricks Claude Code. detect() greens on the\n    // capture hooks being present, so `coreComplete` is reachable even when the\n    // user declines the proxy.\n    command: 'rulemetric hooks install',\n    async detect(ctx): Promise<boolean> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.json');\n      if (!existsSync(settingsPath)) return false;\n      try {\n        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8')) as Record<string, unknown>;\n        // Ready when capture hooks are actually wired up \u2014 NOT when a proxy env\n        // var was written (that greened even against a dead proxy port). The\n        // proxy is a best-effort upgrade layered on top; hooks presence is the\n        // honest \"capture is working\" signal.\n        return hasRulemetricClaudeHooks(settings);\n      } catch {\n        return false;\n      }\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.json');\n      const { before, after } = projectHooksSettings(ctx.projectPath);\n      const artifacts: Artifact[] = [\n        { path: settingsPath, kind: 'file', before, after },\n        // Disclose what the hooks DO, not just that they're registered \u2014 these\n        // are the privacy-relevant behaviors a user is consenting to.\n        {\n          path: 'what these hooks capture',\n          kind: 'service',\n          before: null,\n          after:\n            'session-end reimports the FULL transcript to the API; post-tool-use records each ' +\n            'tool call and snapshots the working tree to a LOCAL shadow git ref (paper-trail, ' +\n            'never pushed); user-prompt posts prompt text. All scoped to sessions in this project.',\n        },\n        // FULL DISCLOSURE of the proxy layer \u2014 every invasive side effect of\n        // `hooks install` \u00A72 is enumerated here so the default path hides\n        // nothing. Each degrades gracefully (see the step comment): a declined\n        // CA-trust sudo skips the machine-wide layer and stays hooks-only.\n        {\n          // The proxy env block `hooks install` \u00A72 adds to the SAME\n          // .claude/settings.json (HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS).\n          path: `${settingsPath} (proxy env block)`,\n          kind: 'file',\n          ...projectProxyEnvSettings(ctx.projectPath),\n        },\n        {\n          path: 'system keychain \u2014 mitmproxy root CA',\n          kind: 'service',\n          before: existsSync(CERT_PATH) ? '(CA generated; trust state unchanged)' : '(no CA yet)',\n          after:\n            'Installs + trusts the mitmproxy CA (requires sudo). This lets the ' +\n            'proxy DECRYPT Claude Code HTTPS request/response bodies \u2014 the ' +\n            'capability that powers rendered-system-prompt / instruction linking. ' +\n            'Decline the sudo prompt and setup stays hooks-only (still fully onboarded).',\n        },\n        {\n          path: 'launchctl setenv HTTPS_PROXY (machine-wide, all GUI apps)',\n          kind: 'command',\n          before: null,\n          after: `http://localhost:${GATEWAY_PORT}  \u2014 routes every GUI app's HTTPS through the local gateway (only when the CA is trusted AND :${GATEWAY_PORT} is live)`,\n        },\n        {\n          path: 'VS Code + Cursor user settings (http.proxy)',\n          kind: 'file',\n          before: null,\n          after: `http.proxy \u2192 http://localhost:${GATEWAY_PORT} (+ http.proxyStrictSSL=false)`,\n        },\n        {\n          path: `gateway process on :${GATEWAY_PORT}`,\n          kind: 'service',\n          before: null,\n          after: 'started (routes Claude Code \u2192 mitmproxy \u2192 Anthropic; falls back to direct if mitmproxy is down)',\n        },\n      ];\n      // Workspace-level editor configs, only if those dirs exist here.\n      for (const tool of detectInstalledTools(ctx.projectPath).filter((t) => t === 'cursor' || t === 'copilot_agent')) {\n        artifacts.push({\n          path: `${ctx.projectPath} (${tool} workspace proxy config)`,\n          kind: 'file',\n          before: null,\n          after: `proxy \u2192 http://localhost:${GATEWAY_PORT}`,\n        });\n      }\n      return {\n        id: 'hooks',\n        title: 'Install hooks + capture proxy',\n        command: 'rulemetric hooks install',\n        artifacts,\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric hooks install');\n    },\n  },\n  {\n    id: 'worker',\n    title: 'Run the worker',\n    command: 'rulemetric service install --worker-only',\n    async detect(): Promise<boolean> {\n      return workerActive();\n    },\n    async plan(): Promise<StepPlan> {\n      const isMac = process.platform === 'darwin';\n      const servicePath = isMac ? WORKER_PLIST_PATH : WORKER_SYSTEMD_PATH;\n      // SECURITY: never read the installed plist/systemd unit into `before` \u2014\n      // those files embed RULEMETRIC_ACCESS_TOKEN / RULEMETRIC_API_KEY verbatim\n      // (service/install.ts writes them from ALLOWED_ENV_VARS), so echoing the\n      // file contents would leak the raw secret through `plan`, `--show`, and\n      // `--json`. Use a synthetic, secret-free marker for the current state.\n      const before = existsSync(servicePath)\n        ? `(service already installed at ${servicePath})`\n        : null;\n      // Concise representation (path + ExecStart node/cli invocation) rather\n      // than reconstructing the full plist \u2014 keep read-only + legible.\n      const after = isMac\n        ? [\n            `Label: com.rulemetric.worker`,\n            `ProgramArguments: <node> <cli>/bin/run.js evals agent`,\n            `RunAtLoad: true, KeepAlive: true`,\n          ].join('\\n')\n        : [\n            `[Service]`,\n            `ExecStart=<node> <cli>/bin/run.js evals agent`,\n            `Restart=on-failure`,\n          ].join('\\n');\n      return {\n        id: 'worker',\n        title: 'Run the worker',\n        command: 'rulemetric service install --worker-only',\n        artifacts: [\n          { path: servicePath, kind: 'service', before, after },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric service install --worker-only');\n    },\n  },\n];\n\nconst STEP_BY_ID = new Map<StepId, SetupStep>(STEPS.map((s) => [s.id, s]));\n\nexport function getStep(id: StepId): SetupStep {\n  const step = STEP_BY_ID.get(id);\n  if (!step) throw new Error(`Unknown setup step: ${id}`);\n  return step;\n}\n\nexport function isStepId(value: string): value is StepId {\n  return (ALL_STEP_IDS as readonly string[]).includes(value);\n}\n\n/**\n * Keys whose values are safe to show verbatim in the env-file diff. Everything\n * NOT in this set is masked. Deny-by-default is deliberate: `~/.config/rulemetric/env`\n * can legitimately hold DATABASE_URL, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_JWT_SECRET,\n * GITHUB_TOKEN, RESEND_API_KEY, etc. (see ALLOWED_ENV_VARS in service/install.ts),\n * so an allowlist-to-hide would leak any secret we forgot to enumerate. Revealing\n * only known-safe keys means a future secret added to the file is masked automatically.\n */\nconst SAFE_ENV_KEYS = new Set([\n  'RULEMETRIC_API_URL',\n  'RULEMETRIC_USER_ID',\n  'RULEMETRIC_CLIENT_NAME',\n  'RESEND_FROM_EMAIL',\n  'SENTRY_DSN', // a DSN is not a secret\n  'PG_POOL_MAX',\n  'PG_IDLE_TIMEOUT',\n  'PG_STATEMENT_TIMEOUT_MS',\n  'NODE_ENV',\n]);\n\n/**\n * Mask secret-bearing lines in a raw env file for display. Deny-by-default:\n * every `KEY=value` line has its value masked unless KEY is in SAFE_ENV_KEYS.\n * Non-assignment lines (comments, blanks) pass through untouched.\n */\nfunction maskEnvFile(content: string): string {\n  return content\n    .replace(/\\n$/, '')\n    .split('\\n')\n    .map((line) => {\n      const match = line.match(/^([A-Z0-9_]+)=(.+)$/);\n      if (!match) return line; // comment / blank / non-assignment\n      const [, key, value] = match;\n      return SAFE_ENV_KEYS.has(key) ? line : `${key}=${maskToken(value)}`;\n    })\n    .join('\\n');\n}\n\n/**\n * Run every step's detect() and derive the overall status. `currentStepId` is\n * the first incomplete step in core order (mirrors the web reducer).\n */\nexport async function computeStatus(ctx: SetupContext = defaultContext()): Promise<SetupStatus> {\n  const steps: StepStatus[] = [];\n  for (const step of STEPS) {\n    // Sequential: detect() may hit the network; order is stable + cheap.\n    // eslint-disable-next-line no-await-in-loop\n    const done = await step.detect(ctx);\n    steps.push({ id: step.id, done });\n  }\n  // Monotonicity (mirrors the web reducer's `cliDetected`): the CLI binary must\n  // exist to produce ANY downstream signal, so `install` greens whenever auth,\n  // hooks, or worker is detected \u2014 even if `install.detect()` alone (which only\n  // sees auth/worker, not hooks) came back false. Without this, a user with\n  // hooks installed but no live worker sees \"Install the CLI: waiting\" while\n  // \"Install hooks: done\" \u2014 a contradiction.\n  const install = steps.find((s) => s.id === 'install');\n  if (install && !install.done) {\n    install.done = steps.some((s) => s.id !== 'install' && s.done);\n  }\n\n  // coreComplete + currentStepId are derived from CORE steps only. The proxy now\n  // ships inside the `hooks` step (whose detect() greens on hooks-presence, so a\n  // declined CA still completes it); any future OPTIONAL_STEP_IDS never block\n  // \"done\" or steal the cursor. Mirrors the web reducer's optional-step handling.\n  const coreIds = new Set<string>(CORE_STEP_IDS);\n  const coreSteps = steps.filter((s) => coreIds.has(s.id));\n  const currentStepId = coreSteps.find((s) => !s.done)?.id ?? null;\n  const coreComplete = coreSteps.every((s) => s.done);\n  return { steps, coreComplete, currentStepId };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AA2Bd,IAAM,gBAAgB,CAAC,WAAW,QAAQ,SAAS,QAAQ;AAO3D,IAAM,oBAAoB,CAAC;AAC3B,IAAM,eAAe,CAAC,GAAG,eAAe,GAAG,iBAAiB;AAiD5D,SAAS,iBAA+B;AAC7C,SAAO;AAAA,IACL,aAAa,QAAQ,IAAI;AAAA,IACzB,WAAW,oBAAoB;AAAA,EACjC;AACF;AAEA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAMhE,SAAS,UAAU,GAAmB;AAC3C,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,EAAE,UAAU,EAAG,QAAO,IAAI,OAAO,EAAE,MAAM;AAC7C,QAAM,OAAO,EAAE,MAAM,GAAG,CAAC;AACzB,QAAM,OAAO,EAAE,MAAM,EAAE;AACvB,SAAO,GAAG,IAAI,GAAG,IAAI,OAAO,KAAK,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/D;AAMO,SAAS,WAAW,QAAuB,OAA8B;AAC9E,QAAM,cAAc,WAAW,OAAO,CAAC,IAAI,OAAO,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC/E,QAAM,aAAa,UAAU,OAAO,CAAC,IAAI,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC5E,QAAM,MAAgB,CAAC;AACvB,QAAM,MAAM,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC1D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,IAAI,YAAY,CAAC;AACvB,UAAM,IAAI,WAAW,CAAC;AACtB,QAAI,MAAM,GAAG;AACX,UAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IAClB,OAAO;AACL,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AACrC,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IACvC;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAGA,SAAS,aAAa,WAAmB,KAA4B;AACnE,QAAM,UAAU,KAAK,WAAW,KAAK;AACrC,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,UAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,WAAO,QAAQ,MAAM,CAAC,IAAI;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAiC;AAC9C,MAAI,CAAC,gBAAgB,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChC,OAIG,mBAAmB;AAAA,MACtB,IAAI;AAAA,QAAe,CAAC,GAAG,WACrB,WAAW,MAAM,OAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,IAAI;AAAA,MAClE;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,iBAAiB;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,oBAAoB,aAAmF;AAC9G,QAAM,eAAe,KAAK,aAAa,WAAW,eAAe;AACjE,MAAI,WAAoC,CAAC;AACzC,MAAI,SAAwB;AAC5B,MAAI,WAAW,YAAY,GAAG;AAC5B,QAAI;AACF,eAAS,aAAa,cAAc,OAAO,EAAE,QAAQ,OAAO,EAAE;AAC9D,iBAAW,KAAK,MAAM,MAAM;AAAA,IAC9B,QAAQ;AACN,iBAAW,CAAC;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,UAAU,OAAO;AAC5B;AAQA,SAAS,qBAAqB,aAA+D;AAC3F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,WAAW;AAC5D,uBAAqB,QAAQ;AAC7B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;AAC5D;AAMA,SAAS,wBAAwB,aAA+D;AAC9F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,WAAW;AAC5D,QAAM,MAAM,EAAE,GAAK,SAAS,OAAkC,CAAC,EAAG;AAClE,MAAI,cAAc,oBAAoB,YAAY;AAClD,MAAI,WAAW;AACf,MAAI,sBAAsB;AAC1B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,EAAE,GAAG,UAAU,IAAI,GAAG,MAAM,CAAC,EAAE;AACxE;AAEA,IAAM,oBAAoB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,6BAA6B;AAClG,IAAM,sBAAsB,KAAK,QAAQ,GAAG,WAAW,WAAW,QAAQ,2BAA2B;AAGrG,SAAS,WAAW,KAAmB;AACrC,WAAS,KAAK,EAAE,OAAO,UAAU,CAAC;AACpC;AAEO,IAAM,QAAqB;AAAA,EAChC;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA;AAAA;AAAA,IAGT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB,KAAM,MAAM,aAAa;AAAA,IAClD;AAAA,IACA,MAAM,OAA0B;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,gCAAgC;AAAA,IAC7C;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB;AAAA,IACzB;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,UAAU,KAAK,IAAI,WAAW,KAAK;AAKzC,UAAI,SAAwB;AAC5B,UAAI,WAAW,OAAO,GAAG;AACvB,YAAI;AACF,mBAAS,YAAY,aAAa,SAAS,OAAO,CAAC;AAAA,QACrD,QAAQ;AACN,mBAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM,WAAW,aAAa,IAAI,WAAW,yBAAyB;AACtE,YAAM,eAAe,WAAW,UAAU,QAAQ,IAAI,UAAU,oBAAoB;AAOpF,YAAM,aAAa,CAAC,2BAA2B,YAAY,EAAE;AAC7D,YAAM,YAAY,aAAa,IAAI,WAAW,oBAAoB;AAClE,UAAI,WAAW;AACb,mBAAW,KAAK,sBAAsB,UAAU,SAAS,CAAC,EAAE;AAAA,MAC9D;AACA,YAAM,WAAW,QAAQ,IAAI;AAC7B,UAAI,UAAU;AACZ,mBAAW,KAAK,sBAAsB,QAAQ,EAAE;AAAA,MAClD;AACA,YAAM,QAAQ,WAAW,KAAK,IAAI;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA;AAAA;AAAA,UAGA;AAAA,YACE,MAAM,KAAK,IAAI,WAAW,WAAW;AAAA,YACrC,MAAM;AAAA,YACN,QAAQ,WAAW,KAAK,IAAI,WAAW,WAAW,CAAC,IAAI,8BAA8B;AAAA,YACrF,OAAO;AAAA,YACP,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,uBAAuB;AAAA,IACpC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUP,SAAS;AAAA,IACT,MAAM,OAAO,KAAuB;AAClC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,eAAe;AACrE,UAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AACtC,UAAI;AACF,cAAM,WAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAK/D,eAAO,yBAAyB,QAAQ;AAAA,MAC1C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,eAAe;AACrE,YAAM,EAAE,QAAQ,MAAM,IAAI,qBAAqB,IAAI,WAAW;AAC9D,YAAM,YAAwB;AAAA,QAC5B,EAAE,MAAM,cAAc,MAAM,QAAQ,QAAQ,MAAM;AAAA;AAAA;AAAA,QAGlD;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OACE;AAAA,QAGJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA;AAAA;AAAA;AAAA,UAGE,MAAM,GAAG,YAAY;AAAA,UACrB,MAAM;AAAA,UACN,GAAG,wBAAwB,IAAI,WAAW;AAAA,QAC5C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ,WAAW,SAAS,IAAI,0CAA0C;AAAA,UAC1E,OACE;AAAA,QAIJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,oBAAoB,YAAY,qGAAgG,YAAY;AAAA,QACrJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,sCAAiC,YAAY;AAAA,QACtD;AAAA,QACA;AAAA,UACE,MAAM,uBAAuB,YAAY;AAAA,UACzC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO;AAAA,QACT;AAAA,MACF;AAEA,iBAAW,QAAQ,qBAAqB,IAAI,WAAW,EAAE,OAAO,CAAC,MAAM,MAAM,YAAY,MAAM,eAAe,GAAG;AAC/G,kBAAU,KAAK;AAAA,UACb,MAAM,GAAG,IAAI,WAAW,KAAK,IAAI;AAAA,UACjC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,iCAA4B,YAAY;AAAA,QACjD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0BAA0B;AAAA,IACvC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,aAAa;AAAA,IACtB;AAAA,IACA,MAAM,OAA0B;AAC9B,YAAM,QAAQ,QAAQ,aAAa;AACnC,YAAM,cAAc,QAAQ,oBAAoB;AAMhD,YAAM,SAAS,WAAW,WAAW,IACjC,iCAAiC,WAAW,MAC5C;AAGJ,YAAM,QAAQ,QACV;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI,IACX;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT,EAAE,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0CAA0C;AAAA,IACvD;AAAA,EACF;AACF;AAEA,IAAM,aAAa,IAAI,IAAuB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAElE,SAAS,QAAQ,IAAuB;AAC7C,QAAM,OAAO,WAAW,IAAI,EAAE;AAC9B,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,uBAAuB,EAAE,EAAE;AACtD,SAAO;AACT;AAEO,SAAS,SAAS,OAAgC;AACvD,SAAQ,aAAmC,SAAS,KAAK;AAC3D;AAUA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,YAAY,SAAyB;AAC5C,SAAO,QACJ,QAAQ,OAAO,EAAE,EACjB,MAAM,IAAI,EACV,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,MAAM,qBAAqB;AAC9C,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,CAAC,EAAE,KAAK,KAAK,IAAI;AACvB,WAAO,cAAc,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,IAAI,UAAU,KAAK,CAAC;AAAA,EACnE,CAAC,EACA,KAAK,IAAI;AACd;AAMA,eAAsB,cAAc,MAAoB,eAAe,GAAyB;AAC9F,QAAM,QAAsB,CAAC;AAC7B,aAAW,QAAQ,OAAO;AAGxB,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG;AAClC,UAAM,KAAK,EAAE,IAAI,KAAK,IAAI,KAAK,CAAC;AAAA,EAClC;AAOA,QAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS;AACpD,MAAI,WAAW,CAAC,QAAQ,MAAM;AAC5B,YAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,aAAa,EAAE,IAAI;AAAA,EAC/D;AAMA,QAAM,UAAU,IAAI,IAAY,aAAa;AAC7C,QAAM,YAAY,MAAM,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,CAAC;AACvD,QAAM,gBAAgB,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM;AAC5D,QAAM,eAAe,UAAU,MAAM,CAAC,MAAM,EAAE,IAAI;AAClD,SAAO,EAAE,OAAO,cAAc,cAAc;AAC9C;",
+  "sourcesContent": ["import { execSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { isAuthenticated, getDefaultConfigDir } from './auth.js';\nimport { apiGet } from './api-client.js';\nimport { GATEWAY_PORT, isGatewayListening } from './gateway-lifecycle.js';\nimport { detectInstalledTools, mergeClaudeCodeHooks, hasRulemetricClaudeHooks } from './hooks-config.js';\n\n/**\n * Data model for the four core onboarding steps, shared (by step-ID list +\n * install-monotonicity) with the web reducer `deriveSetupProgress()`.\n *\n * The two surfaces are separate implementations by necessity, but they no\n * longer read *different sources* for the same fact:\n *   - Server-observable signals (cli-worker heartbeat / captured session) are\n *     unified through the shared `GET /api/setup/status` endpoint \u2014 the CLI's\n *     `workerActive()` and the web's `use-setup-progress.ts` both bottom out on\n *     that one server-side authority, so they cannot drift on it.\n *   - Local signals (auth = `~/.config/rulemetric` creds via `isAuthenticated()`,\n *     hooks = cwd `.claude/settings.json`) stay machine-local: the browser\n *     cannot read the user's filesystem, so these legitimately differ from the\n *     web's account-scoped proxies for the same step (see the design doc's\n *     \"Shared step model, two implementations\").\n * Each step exposes:\n *   - detect(): is it done? (reads a local/remote signal, never mutates)\n *   - plan():   what would apply() write? (read-only, returns diffs/artifacts)\n *   - apply():  perform the step (thin \u2014 shells out to existing commands)\n */\n\nexport const CORE_STEP_IDS = ['install', 'auth', 'hooks', 'worker'] as const;\n// Optional steps live in the walk (offered, recommended) but do NOT gate\n// `coreComplete` \u2014 declining them still leaves the user fully onboarded. The\n// proxy/CA capture now ships as the DEFAULT of the core `hooks` step (see that\n// step's plan(), which fully discloses the invasive MITM/keychain side effects\n// up front); it is not a separate opt-in step. The mechanism is retained for\n// any future optional step.\nexport const OPTIONAL_STEP_IDS = [] as const;\nexport const ALL_STEP_IDS = [...CORE_STEP_IDS, ...OPTIONAL_STEP_IDS] as const;\nexport type StepId = (typeof ALL_STEP_IDS)[number];\n\nexport type ArtifactKind = 'file' | 'command' | 'service';\n\nexport interface Artifact {\n  path: string;\n  kind: ArtifactKind;\n  before: string | null;\n  after: string | null;\n  /** True when `after` contains a masked secret (never the raw value). */\n  masked?: boolean;\n}\n\nexport interface StepPlan {\n  id: StepId;\n  title: string;\n  command?: string;\n  artifacts: Artifact[];\n}\n\nexport interface SetupContext {\n  projectPath: string;\n  configDir: string;\n}\n\nexport interface SetupStep {\n  id: StepId;\n  title: string;\n  command?: string;\n  /** Optional steps are offered in the walk but never gate `coreComplete`. */\n  optional?: boolean;\n  detect(ctx: SetupContext): Promise<boolean>;\n  plan(ctx: SetupContext): Promise<StepPlan>;\n  apply(ctx: SetupContext): Promise<void>;\n}\n\nexport interface StepStatus {\n  id: StepId;\n  done: boolean;\n}\n\nexport interface SetupStatus {\n  steps: StepStatus[];\n  coreComplete: boolean;\n  currentStepId: StepId | null;\n}\n\n/** Build the default context from the current process (cwd + config dir). */\nexport function defaultContext(): SetupContext {\n  return {\n    projectPath: process.cwd(),\n    configDir: getDefaultConfigDir(),\n  };\n}\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\n/**\n * Mask a secret: keep the first 4 and last 4 characters, replace the middle\n * with asterisks. Strings too short to reveal safely are fully masked.\n */\nexport function maskToken(s: string): string {\n  if (!s) return '';\n  if (s.length <= 8) return '*'.repeat(s.length);\n  const head = s.slice(0, 4);\n  const tail = s.slice(-4);\n  return `${head}${'*'.repeat(Math.max(4, s.length - 8))}${tail}`;\n}\n\n/**\n * Simple line-oriented +/- diff for terminal display. Not a real LCS \u2014 good\n * enough to show a human/agent exactly which lines an artifact would change.\n */\nexport function renderDiff(before: string | null, after: string | null): string {\n  const beforeLines = before === null ? [] : before.replace(/\\n$/, '').split('\\n');\n  const afterLines = after === null ? [] : after.replace(/\\n$/, '').split('\\n');\n  const out: string[] = [];\n  const max = Math.max(beforeLines.length, afterLines.length);\n  for (let i = 0; i < max; i++) {\n    const b = beforeLines[i];\n    const a = afterLines[i];\n    if (b === a) {\n      out.push(` ${b}`);\n    } else {\n      if (b !== undefined) out.push(`-${b}`);\n      if (a !== undefined) out.push(`+${a}`);\n    }\n  }\n  return out.join('\\n');\n}\n\n/** Read a single KEY=value from the env file, or null if absent. */\nfunction readEnvValue(configDir: string, key: string): string | null {\n  const envPath = join(configDir, 'env');\n  if (!existsSync(envPath)) return null;\n  try {\n    const content = readFileSync(envPath, 'utf-8');\n    const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n    return match ? match[1] : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Is a CLI worker heartbeat active for the caller? (best-effort, network)\n *\n * Reads the shared `GET /api/setup/status` endpoint's `workerActive` field\n * rather than re-deriving it from `/api/workers/status`. That endpoint computes\n * the cli-worker heartbeat signal server-side using the SAME window +\n * staleness thresholds + `workerType === 'cli-worker'` filter the web strip\n * uses, so the CLI and web can't drift on this fact by construction (they used\n * to each filter/threshold client-side, which is exactly how they could\n * disagree). Fast-fails after 2.5s so `setup --json` / `setup plan` degrade to\n * \"not running\" instead of blocking on a stalled connection \u2014 detection is a\n * UX signal, not a correctness gate; offline \u2192 false.\n */\nasync function workerActive(): Promise<boolean> {\n  if (!isAuthenticated()) return false;\n  try {\n    const status = await Promise.race([\n      apiGet<{\n        cliEverConnected?: boolean;\n        anyCapturedSession?: boolean;\n        workerActive?: boolean;\n      }>('/api/setup/status'),\n      new Promise<never>((_, reject) =>\n        setTimeout(() => reject(new Error('setup/status timeout')), 2500),\n      ),\n    ]);\n    return status?.workerActive === true;\n  } catch {\n    return false;\n  }\n}\n\n/** Read the project's `.claude/settings.json` for a read-only preview (no throw). */\nfunction readProjectSettings(projectPath: string): { settings: Record<string, unknown>; before: string | null } {\n  const settingsPath = join(projectPath, '.claude', 'settings.json');\n  let settings: Record<string, unknown> = {};\n  let before: string | null = null;\n  if (existsSync(settingsPath)) {\n    try {\n      before = readFileSync(settingsPath, 'utf-8').replace(/\\n$/, '');\n      settings = JSON.parse(before) as Record<string, unknown>;\n    } catch {\n      settings = {};\n    }\n  }\n  return { settings, before };\n}\n\n/**\n * Compute the in-memory `.claude/settings.json` after the RuleMetric session\n * HOOKS are merged, WITHOUT touching disk. This is the \u00A71 (hooks) portion of\n * the diff; the proxy env block that `hooks install` \u00A72 also writes is disclosed\n * separately via projectProxyEnvSettings so the two changes read distinctly.\n */\nfunction projectHooksSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath);\n  mergeClaudeCodeHooks(settings);\n  return { before, after: JSON.stringify(settings, null, 2) };\n}\n\n/**\n * The proxy-env addition to `.claude/settings.json` that `hooks install` \u00A72\n * makes on the default path \u2014 for the disclosure diff only. Read-only.\n */\nfunction projectProxyEnvSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath);\n  const env = { ...((settings.env as Record<string, string>) ?? {}) };\n  env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n  env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n  env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n  return { before, after: JSON.stringify({ ...settings, env }, null, 2) };\n}\n\nconst WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', 'com.rulemetric.worker.plist');\nconst WORKER_SYSTEMD_PATH = join(homedir(), '.config', 'systemd', 'user', 'rulemetric-worker.service');\n\n/** Run a command with inherited stdio (interactive-friendly). Thin apply(). */\nfunction runCommand(cmd: string): void {\n  execSync(cmd, { stdio: 'inherit' });\n}\n\nexport const STEPS: SetupStep[] = [\n  {\n    id: 'install',\n    title: 'Install the CLI',\n    command: 'npm install -g @rulemetric/cli',\n    // Monotonic: the CLI must exist to produce any downstream signal, so it\n    // greens off auth or worker presence (nothing local phones home before).\n    async detect(): Promise<boolean> {\n      return isAuthenticated() || (await workerActive());\n    },\n    async plan(): Promise<StepPlan> {\n      return {\n        id: 'install',\n        title: 'Install the CLI',\n        command: 'npm install -g @rulemetric/cli',\n        artifacts: [\n          {\n            path: 'npm install -g @rulemetric/cli',\n            kind: 'command',\n            before: null,\n            after: 'rulemetric --version   # verifies the binary is on PATH',\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('npm install -g @rulemetric/cli');\n    },\n  },\n  {\n    id: 'auth',\n    title: 'Authenticate',\n    command: 'rulemetric auth login',\n    async detect(): Promise<boolean> {\n      return isAuthenticated();\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const envPath = join(ctx.configDir, 'env');\n      // Guard the read like the sibling helpers (readEnvValue /\n      // projectHooksSettings) do: a TOCTOU race or permission error between\n      // existsSync and readFileSync must NOT throw out of plan(). Fall back to\n      // a secret-free marker rather than crashing `setup plan`/`--show`.\n      let before: string | null = null;\n      if (existsSync(envPath)) {\n        try {\n          before = maskEnvFile(readFileSync(envPath, 'utf-8'));\n        } catch {\n          before = '(unreadable)';\n        }\n      }\n      const rawToken = readEnvValue(ctx.configDir, 'RULEMETRIC_ACCESS_TOKEN');\n      const tokenDisplay = rawToken ? maskToken(rawToken) : maskToken('<token-from-login>');\n      // Reconstruct EXACTLY what `auth login`'s saveEnvFile writes so the diff\n      // doesn't show phantom changes: line order [TOKEN, KEY?, URL?], the key\n      // preserved (masked) when present, and the URL sourced from\n      // process.env.RULEMETRIC_API_URL \u2014 the same value login passes \u2014 and OMITTED\n      // when unset (login writes no URL line then). All masking preserved; the raw\n      // token/key are never emitted.\n      const afterLines = [`RULEMETRIC_ACCESS_TOKEN=${tokenDisplay}`];\n      const rawApiKey = readEnvValue(ctx.configDir, 'RULEMETRIC_API_KEY');\n      if (rawApiKey) {\n        afterLines.push(`RULEMETRIC_API_KEY=${maskToken(rawApiKey)}`);\n      }\n      const loginUrl = process.env.RULEMETRIC_API_URL;\n      if (loginUrl) {\n        afterLines.push(`RULEMETRIC_API_URL=${loginUrl}`);\n      }\n      const after = afterLines.join('\\n');\n      return {\n        id: 'auth',\n        title: 'Authenticate',\n        command: 'rulemetric auth login',\n        artifacts: [\n          {\n            path: envPath,\n            kind: 'file',\n            before,\n            after,\n            masked: true,\n          },\n          // `auth login` (saveToken) also writes auth.json \u2014 disclose it so the\n          // plan matches every file apply() touches.\n          {\n            path: join(ctx.configDir, 'auth.json'),\n            kind: 'file',\n            before: existsSync(join(ctx.configDir, 'auth.json')) ? '(existing session tokens)' : null,\n            after: '{ accessToken, refreshToken, expiresAt, email }  \u2014 OAuth session tokens (secret)',\n            masked: true,\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric auth login');\n    },\n  },\n  {\n    id: 'hooks',\n    title: 'Install hooks + capture proxy',\n    // Default onboarding installs the FULL capture path: session hooks PLUS the\n    // MITM proxy (rendered-system-prompt / instruction linking + cross-tool\n    // capture). Every invasive side effect is disclosed up front in plan()\n    // below \u2014 nothing is silent. `hooks install` fails SAFE: if the CA sudo\n    // trust is declined it degrades to hooks-only (no machine-wide proxy pin),\n    // and HTTPS_PROXY is only pinned once the gateway actually answers on\n    // :8787 \u2014 so the default never bricks Claude Code. detect() greens on the\n    // capture hooks being present, so `coreComplete` is reachable even when the\n    // user declines the proxy.\n    command: 'rulemetric hooks install',\n    async detect(ctx): Promise<boolean> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.json');\n      if (!existsSync(settingsPath)) return false;\n      try {\n        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8')) as Record<string, unknown>;\n        // Ready when capture hooks are actually wired up \u2014 NOT when a proxy env\n        // var was written (that greened even against a dead proxy port). The\n        // proxy is a best-effort upgrade layered on top; hooks presence is the\n        // honest \"capture is working\" signal.\n        return hasRulemetricClaudeHooks(settings);\n      } catch {\n        return false;\n      }\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.json');\n      const { before, after } = projectHooksSettings(ctx.projectPath);\n      const artifacts: Artifact[] = [\n        { path: settingsPath, kind: 'file', before, after },\n        // Disclose what the hooks DO, not just that they're registered \u2014 these\n        // are the privacy-relevant behaviors a user is consenting to.\n        {\n          path: 'what these hooks capture',\n          kind: 'service',\n          before: null,\n          after:\n            'session-end reimports the FULL transcript to the API; post-tool-use records each ' +\n            'tool call and snapshots the working tree to a LOCAL shadow git ref (paper-trail, ' +\n            'never pushed); user-prompt posts prompt text. All scoped to sessions in this project.',\n        },\n        // FULL DISCLOSURE of the proxy layer \u2014 every invasive side effect of\n        // `hooks install` \u00A72 is enumerated here so the default path hides\n        // nothing. Each degrades gracefully (see the step comment): a declined\n        // CA-trust sudo skips the machine-wide layer and stays hooks-only.\n        {\n          // The proxy env block `hooks install` \u00A72 adds to the SAME\n          // .claude/settings.json (HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS).\n          path: `${settingsPath} (proxy env block)`,\n          kind: 'file',\n          ...projectProxyEnvSettings(ctx.projectPath),\n        },\n        {\n          path: 'system keychain \u2014 mitmproxy root CA',\n          kind: 'service',\n          before: existsSync(CERT_PATH) ? '(CA generated; trust state unchanged)' : '(no CA yet)',\n          after:\n            'Installs + trusts the mitmproxy CA (requires sudo). This lets the ' +\n            'proxy DECRYPT Claude Code HTTPS request/response bodies \u2014 the ' +\n            'capability that powers rendered-system-prompt / instruction linking. ' +\n            'Decline the sudo prompt and setup stays hooks-only (still fully onboarded).',\n        },\n        {\n          path: 'launchctl setenv HTTPS_PROXY (machine-wide, all GUI apps)',\n          kind: 'command',\n          before: null,\n          after: `http://localhost:${GATEWAY_PORT}  \u2014 routes every GUI app's HTTPS through the local gateway (only when the CA is trusted AND :${GATEWAY_PORT} is live)`,\n        },\n        {\n          path: 'VS Code + Cursor user settings (http.proxy)',\n          kind: 'file',\n          before: null,\n          after: `http.proxy \u2192 http://localhost:${GATEWAY_PORT} (+ http.proxyStrictSSL=false)`,\n        },\n        {\n          path: `gateway process on :${GATEWAY_PORT}`,\n          kind: 'service',\n          before: null,\n          after: 'started (routes Claude Code \u2192 mitmproxy \u2192 Anthropic; falls back to direct if mitmproxy is down)',\n        },\n      ];\n      // Workspace-level editor configs, only if those dirs exist here.\n      for (const tool of detectInstalledTools(ctx.projectPath).filter((t) => t === 'cursor' || t === 'copilot_agent')) {\n        artifacts.push({\n          path: `${ctx.projectPath} (${tool} workspace proxy config)`,\n          kind: 'file',\n          before: null,\n          after: `proxy \u2192 http://localhost:${GATEWAY_PORT}`,\n        });\n      }\n      // Cross-tool USER-level hooks \u2014 disclosed here, and (post-F2) written ONLY\n      // when the tool is already present so we never manufacture config for a\n      // tool the user doesn't have.\n      for (const [tool, home, file] of [\n        ['Cursor', join(homedir(), '.cursor'), join(homedir(), '.cursor', 'hooks.json')],\n        ['Antigravity/Gemini', join(homedir(), '.gemini'), join(homedir(), '.gemini', 'config', 'hooks.json')],\n      ] as const) {\n        if (existsSync(home)) {\n          artifacts.push({\n            path: `${file} (${tool} user hooks)`,\n            kind: 'file',\n            before: existsSync(file) ? '(existing config)' : null,\n            after: 'adds RuleMetric session-capture hooks for this tool',\n          });\n        }\n      }\n      return {\n        id: 'hooks',\n        title: 'Install hooks + capture proxy',\n        command: 'rulemetric hooks install',\n        artifacts,\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric hooks install');\n    },\n  },\n  {\n    id: 'worker',\n    title: 'Run the worker',\n    command: 'rulemetric service install --worker-only',\n    async detect(): Promise<boolean> {\n      return workerActive();\n    },\n    async plan(): Promise<StepPlan> {\n      const isMac = process.platform === 'darwin';\n      const servicePath = isMac ? WORKER_PLIST_PATH : WORKER_SYSTEMD_PATH;\n      // SECURITY: never read the installed plist/systemd unit into `before` \u2014\n      // those files embed RULEMETRIC_ACCESS_TOKEN / RULEMETRIC_API_KEY verbatim\n      // (service/install.ts writes them from ALLOWED_ENV_VARS), so echoing the\n      // file contents would leak the raw secret through `plan`, `--show`, and\n      // `--json`. Use a synthetic, secret-free marker for the current state.\n      const before = existsSync(servicePath)\n        ? `(service already installed at ${servicePath})`\n        : null;\n      // Concise representation (path + ExecStart node/cli invocation) rather\n      // than reconstructing the full plist \u2014 keep read-only + legible.\n      const after = isMac\n        ? [\n            `Label: com.rulemetric.worker`,\n            `ProgramArguments: <node> <cli>/bin/run.js evals agent`,\n            `RunAtLoad: true, KeepAlive: true`,\n          ].join('\\n')\n        : [\n            `[Service]`,\n            `ExecStart=<node> <cli>/bin/run.js evals agent`,\n            `Restart=on-failure`,\n          ].join('\\n');\n      return {\n        id: 'worker',\n        title: 'Run the worker',\n        command: 'rulemetric service install --worker-only',\n        artifacts: [\n          { path: servicePath, kind: 'service', before, after },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric service install --worker-only');\n    },\n  },\n];\n\nconst STEP_BY_ID = new Map<StepId, SetupStep>(STEPS.map((s) => [s.id, s]));\n\nexport function getStep(id: StepId): SetupStep {\n  const step = STEP_BY_ID.get(id);\n  if (!step) throw new Error(`Unknown setup step: ${id}`);\n  return step;\n}\n\nexport function isStepId(value: string): value is StepId {\n  return (ALL_STEP_IDS as readonly string[]).includes(value);\n}\n\n/**\n * Keys whose values are safe to show verbatim in the env-file diff. Everything\n * NOT in this set is masked. Deny-by-default is deliberate: `~/.config/rulemetric/env`\n * can legitimately hold DATABASE_URL, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_JWT_SECRET,\n * GITHUB_TOKEN, RESEND_API_KEY, etc. (see ALLOWED_ENV_VARS in service/install.ts),\n * so an allowlist-to-hide would leak any secret we forgot to enumerate. Revealing\n * only known-safe keys means a future secret added to the file is masked automatically.\n */\nconst SAFE_ENV_KEYS = new Set([\n  'RULEMETRIC_API_URL',\n  'RULEMETRIC_USER_ID',\n  'RULEMETRIC_CLIENT_NAME',\n  'RESEND_FROM_EMAIL',\n  'SENTRY_DSN', // a DSN is not a secret\n  'PG_POOL_MAX',\n  'PG_IDLE_TIMEOUT',\n  'PG_STATEMENT_TIMEOUT_MS',\n  'NODE_ENV',\n]);\n\n/**\n * Mask secret-bearing lines in a raw env file for display. Deny-by-default:\n * every `KEY=value` line has its value masked unless KEY is in SAFE_ENV_KEYS.\n * Non-assignment lines (comments, blanks) pass through untouched.\n */\nfunction maskEnvFile(content: string): string {\n  return content\n    .replace(/\\n$/, '')\n    .split('\\n')\n    .map((line) => {\n      const match = line.match(/^([A-Z0-9_]+)=(.+)$/);\n      if (!match) return line; // comment / blank / non-assignment\n      const [, key, value] = match;\n      return SAFE_ENV_KEYS.has(key) ? line : `${key}=${maskToken(value)}`;\n    })\n    .join('\\n');\n}\n\n/**\n * Run every step's detect() and derive the overall status. `currentStepId` is\n * the first incomplete step in core order (mirrors the web reducer).\n */\nexport async function computeStatus(ctx: SetupContext = defaultContext()): Promise<SetupStatus> {\n  const steps: StepStatus[] = [];\n  for (const step of STEPS) {\n    // Sequential: detect() may hit the network; order is stable + cheap.\n    // eslint-disable-next-line no-await-in-loop\n    const done = await step.detect(ctx);\n    steps.push({ id: step.id, done });\n  }\n  // Monotonicity (mirrors the web reducer's `cliDetected`): the CLI binary must\n  // exist to produce ANY downstream signal, so `install` greens whenever auth,\n  // hooks, or worker is detected \u2014 even if `install.detect()` alone (which only\n  // sees auth/worker, not hooks) came back false. Without this, a user with\n  // hooks installed but no live worker sees \"Install the CLI: waiting\" while\n  // \"Install hooks: done\" \u2014 a contradiction.\n  const install = steps.find((s) => s.id === 'install');\n  if (install && !install.done) {\n    install.done = steps.some((s) => s.id !== 'install' && s.done);\n  }\n\n  // coreComplete + currentStepId are derived from CORE steps only. The proxy now\n  // ships inside the `hooks` step (whose detect() greens on hooks-presence, so a\n  // declined CA still completes it); any future OPTIONAL_STEP_IDS never block\n  // \"done\" or steal the cursor. Mirrors the web reducer's optional-step handling.\n  const coreIds = new Set<string>(CORE_STEP_IDS);\n  const coreSteps = steps.filter((s) => coreIds.has(s.id));\n  const currentStepId = coreSteps.find((s) => !s.done)?.id ?? null;\n  const coreComplete = coreSteps.every((s) => s.done);\n  return { steps, coreComplete, currentStepId };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AA2Bd,IAAM,gBAAgB,CAAC,WAAW,QAAQ,SAAS,QAAQ;AAO3D,IAAM,oBAAoB,CAAC;AAC3B,IAAM,eAAe,CAAC,GAAG,eAAe,GAAG,iBAAiB;AAiD5D,SAAS,iBAA+B;AAC7C,SAAO;AAAA,IACL,aAAa,QAAQ,IAAI;AAAA,IACzB,WAAW,oBAAoB;AAAA,EACjC;AACF;AAEA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAMhE,SAAS,UAAU,GAAmB;AAC3C,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,EAAE,UAAU,EAAG,QAAO,IAAI,OAAO,EAAE,MAAM;AAC7C,QAAM,OAAO,EAAE,MAAM,GAAG,CAAC;AACzB,QAAM,OAAO,EAAE,MAAM,EAAE;AACvB,SAAO,GAAG,IAAI,GAAG,IAAI,OAAO,KAAK,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/D;AAMO,SAAS,WAAW,QAAuB,OAA8B;AAC9E,QAAM,cAAc,WAAW,OAAO,CAAC,IAAI,OAAO,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC/E,QAAM,aAAa,UAAU,OAAO,CAAC,IAAI,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC5E,QAAM,MAAgB,CAAC;AACvB,QAAM,MAAM,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC1D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,IAAI,YAAY,CAAC;AACvB,UAAM,IAAI,WAAW,CAAC;AACtB,QAAI,MAAM,GAAG;AACX,UAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IAClB,OAAO;AACL,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AACrC,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IACvC;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAGA,SAAS,aAAa,WAAmB,KAA4B;AACnE,QAAM,UAAU,KAAK,WAAW,KAAK;AACrC,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,UAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,WAAO,QAAQ,MAAM,CAAC,IAAI;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAiC;AAC9C,MAAI,CAAC,gBAAgB,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChC,OAIG,mBAAmB;AAAA,MACtB,IAAI;AAAA,QAAe,CAAC,GAAG,WACrB,WAAW,MAAM,OAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,IAAI;AAAA,MAClE;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,iBAAiB;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,oBAAoB,aAAmF;AAC9G,QAAM,eAAe,KAAK,aAAa,WAAW,eAAe;AACjE,MAAI,WAAoC,CAAC;AACzC,MAAI,SAAwB;AAC5B,MAAI,WAAW,YAAY,GAAG;AAC5B,QAAI;AACF,eAAS,aAAa,cAAc,OAAO,EAAE,QAAQ,OAAO,EAAE;AAC9D,iBAAW,KAAK,MAAM,MAAM;AAAA,IAC9B,QAAQ;AACN,iBAAW,CAAC;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,UAAU,OAAO;AAC5B;AAQA,SAAS,qBAAqB,aAA+D;AAC3F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,WAAW;AAC5D,uBAAqB,QAAQ;AAC7B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;AAC5D;AAMA,SAAS,wBAAwB,aAA+D;AAC9F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,WAAW;AAC5D,QAAM,MAAM,EAAE,GAAK,SAAS,OAAkC,CAAC,EAAG;AAClE,MAAI,cAAc,oBAAoB,YAAY;AAClD,MAAI,WAAW;AACf,MAAI,sBAAsB;AAC1B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,EAAE,GAAG,UAAU,IAAI,GAAG,MAAM,CAAC,EAAE;AACxE;AAEA,IAAM,oBAAoB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,6BAA6B;AAClG,IAAM,sBAAsB,KAAK,QAAQ,GAAG,WAAW,WAAW,QAAQ,2BAA2B;AAGrG,SAAS,WAAW,KAAmB;AACrC,WAAS,KAAK,EAAE,OAAO,UAAU,CAAC;AACpC;AAEO,IAAM,QAAqB;AAAA,EAChC;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA;AAAA;AAAA,IAGT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB,KAAM,MAAM,aAAa;AAAA,IAClD;AAAA,IACA,MAAM,OAA0B;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,gCAAgC;AAAA,IAC7C;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB;AAAA,IACzB;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,UAAU,KAAK,IAAI,WAAW,KAAK;AAKzC,UAAI,SAAwB;AAC5B,UAAI,WAAW,OAAO,GAAG;AACvB,YAAI;AACF,mBAAS,YAAY,aAAa,SAAS,OAAO,CAAC;AAAA,QACrD,QAAQ;AACN,mBAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM,WAAW,aAAa,IAAI,WAAW,yBAAyB;AACtE,YAAM,eAAe,WAAW,UAAU,QAAQ,IAAI,UAAU,oBAAoB;AAOpF,YAAM,aAAa,CAAC,2BAA2B,YAAY,EAAE;AAC7D,YAAM,YAAY,aAAa,IAAI,WAAW,oBAAoB;AAClE,UAAI,WAAW;AACb,mBAAW,KAAK,sBAAsB,UAAU,SAAS,CAAC,EAAE;AAAA,MAC9D;AACA,YAAM,WAAW,QAAQ,IAAI;AAC7B,UAAI,UAAU;AACZ,mBAAW,KAAK,sBAAsB,QAAQ,EAAE;AAAA,MAClD;AACA,YAAM,QAAQ,WAAW,KAAK,IAAI;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA;AAAA;AAAA,UAGA;AAAA,YACE,MAAM,KAAK,IAAI,WAAW,WAAW;AAAA,YACrC,MAAM;AAAA,YACN,QAAQ,WAAW,KAAK,IAAI,WAAW,WAAW,CAAC,IAAI,8BAA8B;AAAA,YACrF,OAAO;AAAA,YACP,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,uBAAuB;AAAA,IACpC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUP,SAAS;AAAA,IACT,MAAM,OAAO,KAAuB;AAClC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,eAAe;AACrE,UAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AACtC,UAAI;AACF,cAAM,WAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAK/D,eAAO,yBAAyB,QAAQ;AAAA,MAC1C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,eAAe;AACrE,YAAM,EAAE,QAAQ,MAAM,IAAI,qBAAqB,IAAI,WAAW;AAC9D,YAAM,YAAwB;AAAA,QAC5B,EAAE,MAAM,cAAc,MAAM,QAAQ,QAAQ,MAAM;AAAA;AAAA;AAAA,QAGlD;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OACE;AAAA,QAGJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA;AAAA;AAAA;AAAA,UAGE,MAAM,GAAG,YAAY;AAAA,UACrB,MAAM;AAAA,UACN,GAAG,wBAAwB,IAAI,WAAW;AAAA,QAC5C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ,WAAW,SAAS,IAAI,0CAA0C;AAAA,UAC1E,OACE;AAAA,QAIJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,oBAAoB,YAAY,qGAAgG,YAAY;AAAA,QACrJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,sCAAiC,YAAY;AAAA,QACtD;AAAA,QACA;AAAA,UACE,MAAM,uBAAuB,YAAY;AAAA,UACzC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO;AAAA,QACT;AAAA,MACF;AAEA,iBAAW,QAAQ,qBAAqB,IAAI,WAAW,EAAE,OAAO,CAAC,MAAM,MAAM,YAAY,MAAM,eAAe,GAAG;AAC/G,kBAAU,KAAK;AAAA,UACb,MAAM,GAAG,IAAI,WAAW,KAAK,IAAI;AAAA,UACjC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,iCAA4B,YAAY;AAAA,QACjD,CAAC;AAAA,MACH;AAIA,iBAAW,CAAC,MAAM,MAAM,IAAI,KAAK;AAAA,QAC/B,CAAC,UAAU,KAAK,QAAQ,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,WAAW,YAAY,CAAC;AAAA,QAC/E,CAAC,sBAAsB,KAAK,QAAQ,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,WAAW,UAAU,YAAY,CAAC;AAAA,MACvG,GAAY;AACV,YAAI,WAAW,IAAI,GAAG;AACpB,oBAAU,KAAK;AAAA,YACb,MAAM,GAAG,IAAI,KAAK,IAAI;AAAA,YACtB,MAAM;AAAA,YACN,QAAQ,WAAW,IAAI,IAAI,sBAAsB;AAAA,YACjD,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0BAA0B;AAAA,IACvC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,aAAa;AAAA,IACtB;AAAA,IACA,MAAM,OAA0B;AAC9B,YAAM,QAAQ,QAAQ,aAAa;AACnC,YAAM,cAAc,QAAQ,oBAAoB;AAMhD,YAAM,SAAS,WAAW,WAAW,IACjC,iCAAiC,WAAW,MAC5C;AAGJ,YAAM,QAAQ,QACV;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI,IACX;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT,EAAE,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0CAA0C;AAAA,IACvD;AAAA,EACF;AACF;AAEA,IAAM,aAAa,IAAI,IAAuB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAElE,SAAS,QAAQ,IAAuB;AAC7C,QAAM,OAAO,WAAW,IAAI,EAAE;AAC9B,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,uBAAuB,EAAE,EAAE;AACtD,SAAO;AACT;AAEO,SAAS,SAAS,OAAgC;AACvD,SAAQ,aAAmC,SAAS,KAAK;AAC3D;AAUA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,YAAY,SAAyB;AAC5C,SAAO,QACJ,QAAQ,OAAO,EAAE,EACjB,MAAM,IAAI,EACV,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,MAAM,qBAAqB;AAC9C,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,CAAC,EAAE,KAAK,KAAK,IAAI;AACvB,WAAO,cAAc,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,IAAI,UAAU,KAAK,CAAC;AAAA,EACnE,CAAC,EACA,KAAK,IAAI;AACd;AAMA,eAAsB,cAAc,MAAoB,eAAe,GAAyB;AAC9F,QAAM,QAAsB,CAAC;AAC7B,aAAW,QAAQ,OAAO;AAGxB,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG;AAClC,UAAM,KAAK,EAAE,IAAI,KAAK,IAAI,KAAK,CAAC;AAAA,EAClC;AAOA,QAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS;AACpD,MAAI,WAAW,CAAC,QAAQ,MAAM;AAC5B,YAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,aAAa,EAAE,IAAI;AAAA,EAC/D;AAMA,QAAM,UAAU,IAAI,IAAY,aAAa;AAC7C,QAAM,YAAY,MAAM,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,CAAC;AACvD,QAAM,gBAAgB,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM;AAC5D,QAAM,eAAe,UAAU,MAAM,CAAC,MAAM,EAAE,IAAI;AAClD,SAAO,EAAE,OAAO,cAAc,cAAc;AAC9C;",
   "names": []
 }

package/dist/commands/gateway/ensure.js

@@ -1,7 +1,7 @@
 import {
   isGatewayRunning,
   spawnGateway
-} from "../../chunk-OVGP4OGK.js";
+} from "../../chunk-DAJNO4OI.js";
 import {
   BaseCommand
 } from "../../chunk-SZ7VDCD6.js";

package/dist/commands/hooks/install.js

@@ -22,13 +22,13 @@ import {
   writeCursorUserProxyConfig,
   writeVSCodeProxyConfig,
   writeVSCodeUserProxyConfig
-} from "../../chunk-HWGRTIXN.js";
+} from "../../chunk-XN23W5HL.js";
 import {
   GATEWAY_PORT,
   isGatewayRunning,
   spawnGateway,
   waitForGatewayListening
-} from "../../chunk-OVGP4OGK.js";
+} from "../../chunk-DAJNO4OI.js";
 import "../../chunk-KRBQLMOP.js";
 import {
   BaseCommand

package/dist/commands/hooks/install.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/hooks/install.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execFileSync, execSync, spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, dirname } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { isGatewayRunning, waitForGatewayListening, spawnGateway, GATEWAY_PORT } from '../../lib/gateway-lifecycle.js';\n\n// Resolve the directory holding the `rulemetric` executable, so hook commands\n// can prepend it to PATH. Claude Code runs hooks via `/bin/sh -c` with a\n// minimal PATH that omits nvm/pnpm global bin dirs \u2014 so a bare `rulemetric`\n// hits \"command not found\" and capture (plus the session-start gateway\n// auto-start) silently fails. We resolve it here, in the install process's\n// full PATH, and bake the dir into the hook command. Returns undefined on\n// failure \u2192 callers fall back to the bare `rulemetric` (dev/back-compat).\nfunction resolveHookBinDir(): string | undefined {\n  try {\n    const out = execFileSync('/bin/sh', ['-c', 'command -v rulemetric'], {\n      encoding: 'utf-8',\n    }).trim();\n    if (out && existsSync(out)) return dirname(out);\n  } catch {\n    /* not resolvable \u2014 fall back to bare `rulemetric` */\n  }\n  return undefined;\n}\n\n// True iff `rulemetric service install` has wired the gateway up as a launchd\n// agent. When this returns true, hooks install must NOT spawn its own\n// detached gateway \u2014 two processes fighting for :8787 means one crash-loops\n// and Claude Code's HTTPS_PROXY breaks.\nfunction isGatewayLaunchdManaged(): boolean {\n  try {\n    execFileSync('launchctl', ['list', 'com.rulemetric.gateway'], {\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    return true;\n  } catch {\n    // Non-zero exit = label not loaded\n    return false;\n  }\n}\nimport {\n  writeStatuslineShim,\n  readCurrentStatusLine,\n  isStatuslineShimInstalled,\n  STATUSLINE_SETTINGS_VALUE,\n} from '../../lib/statusline-shim.js';\nimport {\n  mergeClaudeCodeHooks,\n  removeClaudeCodeHooks,\n  readClaudeSettings,\n  writeClaudeSettingsWithBackup,\n  writeCursorProxyConfig,\n  writeCursorUserProxyConfig,\n  writeVSCodeProxyConfig,\n  installMacOSProxyEnv,\n  writeVSCodeUserProxyConfig,\n  writeCursorHooks,\n  writeCursorUserHooks,\n  writeCopilotHooks,\n  writeAntigravityHooks,\n  writeAntigravityUserHooks,\n} from '../../lib/hooks-config.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\nexport default class HooksInstall extends BaseCommand {\n  static override description = 'Install session tracking hooks and context capture proxy for Claude Code';\n\n  static override examples = [\n    '<%= config.bin %> hooks install',\n    '<%= config.bin %> hooks install --global',\n    '<%= config.bin %> hooks install --no-proxy',\n  ];\n\n  static override flags = {\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip proxy/gateway configuration (hooks only)',\n    }),\n    'project-dir': Flags.string({\n      description: 'Project directory to install hooks in (defaults to cwd)',\n    }),\n    global: Flags.boolean({\n      char: 'g',\n      default: false,\n      description: 'Install hooks globally (~/.claude/settings.json) so all projects are tracked',\n    }),\n    'statusline-usage': Flags.boolean({\n      default: false,\n      description: 'Install the statusline shim so Claude Code pushes live rate_limits on every refresh (makes /usage rings update in real time without needing the proxy)',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(HooksInstall);\n    const isGlobal = flags.global;\n    const projectPath = isGlobal ? homedir() : (flags['project-dir'] ?? process.cwd());\n    const configDir = join(projectPath, '.claude');\n    const configPath = join(configDir, 'settings.json');\n    const noProxy = flags['no-proxy'];\n    // Whether the capture proxy actually went live this run (HTTPS_PROXY pinned\n    // against a verified-live gateway). Drives the \"next steps\" copy so we never\n    // tell the user to start a proxy that is already running.\n    let proxyActive = false;\n\n    if (isGlobal) {\n      this.log(`Installing hooks globally \u2192 ${configPath}`);\n    }\n\n    // Read or create .claude/settings.json. Never crash on a malformed file \u2014\n    // a fresh user's hand-edited settings.json must not block capture install.\n    const { settings, recoveredBackup } = readClaudeSettings(configPath);\n    if (recoveredBackup) {\n      this.log(`[!!] ${configPath} was not valid JSON \u2014 backed it up to ${recoveredBackup} and continued with a fresh file.`);\n    }\n\n    // \u2500\u2500 1. Install Claude Code session-tracking hooks (hooks-first, zero-proxy\n    // capture). Strip any stale rulemetric entries first \u2014 handles old command\n    // formats, preserves the user's own hooks \u2014 then merge the current canonical\n    // set. Runs regardless of --no-proxy: this is the whole point of the hooks\n    // path, which captures full sessions (lifecycle + SessionEnd transcript\n    // reimport) without mitmproxy / CA trust / gateway. The proxy adds the\n    // rendered system prompt (instruction-linking) + cross-tool capture on top.\n    const refreshedHooks = removeClaudeCodeHooks(settings);\n    // Resolve once; every hook writer (Claude Code, Cursor, Copilot) needs the\n    // same PATH prefix so a GUI-launched tool with a minimal PATH can find the CLI.\n    const hookBinDir = resolveHookBinDir();\n    mergeClaudeCodeHooks(settings, hookBinDir);\n    this.log(\n      refreshedHooks\n        ? '[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/settings.json'\n        : '[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/settings.json',\n    );\n\n    // \u2500\u2500 2. Configure gateway + proxy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      // Ensure mitmproxy is available\n      const hasMitmproxy = this.findBinary('mitmdump');\n      if (!hasMitmproxy) {\n        this.log('');\n        this.log('[!!] mitmproxy not found \u2014 installing...');\n        const installed = this.installMitmproxy();\n        if (!installed) {\n          this.log('[!!] Could not install mitmproxy. Skipping proxy config.');\n          this.log('     Install manually: pipx install mitmproxy');\n          this.log('     Then re-run: rulemetric hooks install');\n        }\n      }\n\n      // Generate CA cert if missing\n      if (!existsSync(CERT_PATH)) {\n        this.log('[..] Generating CA certificate...');\n        const mitmdump = this.findBinary('mitmdump');\n        if (mitmdump) {\n          spawnSync(mitmdump, ['--set', 'listen_port=0', '-q'], {\n            timeout: 5000,\n            stdio: 'ignore',\n          });\n          if (existsSync(CERT_PATH)) {\n            this.log(`[OK] CA certificate generated at ${CERT_PATH}`);\n          } else {\n            this.log('[!!] Could not generate CA cert');\n          }\n        }\n      } else {\n        this.log('[OK] CA certificate found');\n      }\n\n      // Trust CA cert in system store (if not already trusted). Track the\n      // result: whether the CA is trusted decides if we may route MACHINE-WIDE /\n      // native-app traffic through the MITM proxy (native apps validate against\n      // the system keychain, so an untrusted CA breaks their TLS).\n      const caGenerated = existsSync(CERT_PATH);\n      let caTrusted = false;\n      if (caGenerated && !this.isCACertTrusted()) {\n        this.log('[..] Installing CA certificate into system trust store (requires admin)...');\n        caTrusted = this.trustCACert();\n        if (caTrusted) {\n          this.log('[OK] CA certificate trusted by system');\n        } else {\n          this.log('[!!] Could not install CA cert automatically.');\n          if (process.platform === 'darwin') {\n            this.log(`     Run manually: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERT_PATH}`);\n          } else if (process.platform === 'linux') {\n            this.log(`     Run manually: sudo cp ${CERT_PATH} /usr/local/share/ca-certificates/mitmproxy-ca.crt && sudo update-ca-certificates`);\n          }\n        }\n      } else if (caGenerated) {\n        this.log('[OK] CA certificate already trusted');\n        caTrusted = true;\n      }\n\n      // Start the gateway BEFORE pinning HTTPS_PROXY. Three possible owners (in\n      // order of precedence):\n      //   1. launchd (`rulemetric service install` plist) \u2014 authoritative;\n      //      hooks must NOT spawn a competing copy that would fight for :8787\n      //   2. legacy PID-file (this same code path from a previous run)\n      //   3. nothing \u2014 spawn a fresh detached process\n      if (isGatewayLaunchdManaged()) {\n        this.log('[OK] Gateway managed by launchd (com.rulemetric.gateway)');\n      } else if (isGatewayRunning()) {\n        this.log('[OK] Gateway already running');\n      } else {\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway started (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not start gateway: ${(err as Error).message}`);\n        }\n      }\n\n      // Liveness guard: ONLY pin HTTPS_PROXY once :8787 actually accepts\n      // connections. Writing it against a dead port is the fresh-laptop\n      // ConnectionRefused footgun \u2014 it breaks all of Claude Code's HTTPS. If the\n      // gateway isn't answering, we leave Claude Code talking to Anthropic\n      // directly; capture still works via the hooks installed in \u00A71.\n      // Poll (not a one-shot probe): a just-spawned gateway needs a moment to\n      // bind :8787, and a single immediate probe would fail-close every fresh\n      // install and silently disable deep capture.\n      const gatewayLive = await waitForGatewayListening(GATEWAY_PORT, { timeoutMs: 4000 });\n      if (!caGenerated) {\n        // No CA \u2192 mitmproxy will regenerate one and intercept, but nothing\n        // trusts it, so pinning HTTPS_PROXY would break even Claude Code's TLS.\n        // Stay hooks-only rather than pin a proxy nothing can validate.\n        this.log('[!!] No CA certificate \u2014 NOT setting HTTPS_PROXY (capture stays hooks-only).');\n        this.log('     Install mitmproxy, then re-run: rulemetric hooks install');\n      } else if (!gatewayLive) {\n        this.log(`[!!] Gateway is not answering on :${GATEWAY_PORT} \u2014 NOT setting HTTPS_PROXY.`);\n        this.log('     Capture still works via hooks. To enable deep (proxy) capture later:');\n        this.log('     rulemetric proxy start  &&  rulemetric hooks install');\n      } else {\n        // Set permanent HTTPS_PROXY and NODE_EXTRA_CA_CERTS in settings.json.\n        // These point to the gateway (verified live above), not mitmproxy directly.\n        const env = (settings.env ?? {}) as Record<string, string>;\n        env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n        // Bypass proxy for non-Anthropic traffic (Supabase auth, npm, etc.)\n        env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n        if (existsSync(CERT_PATH)) {\n          env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n        }\n        settings.env = env;\n        proxyActive = true;\n        this.log(`[OK] HTTPS_PROXY set to gateway on :${GATEWAY_PORT} (verified live)`);\n\n        // Configure Cursor proxy (if .cursor/ exists)\n        const cursorProxy = writeCursorProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (cursorProxy) {\n          this.log('[OK] Cursor proxy configured \u2192 .cursor/settings.json');\n        }\n\n        // Configure VS Code proxy for Copilot capture (workspace settings)\n        const vscodeProxy = writeVSCodeProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (vscodeProxy) {\n          this.log('[OK] VS Code workspace proxy configured \u2192 .vscode/settings.json');\n        }\n\n        // Set http.proxy in VS Code user settings (workspace-level is silently ignored\n        // for http.proxy due to APPLICATION scope \u2014 microsoft/vscode#236932)\n        const vscodeUserProxy = writeVSCodeUserProxyConfig(GATEWAY_PORT);\n        if (vscodeUserProxy) {\n          this.log('[OK] VS Code user proxy configured \u2192 ~/Library/Application Support/Code/User/settings.json');\n        }\n\n        // Same for Cursor (VS Code fork inherits the APPLICATION-scope restriction).\n        const cursorUserProxy = writeCursorUserProxyConfig(GATEWAY_PORT);\n        if (cursorUserProxy) {\n          this.log('[OK] Cursor user proxy configured \u2192 ~/Library/Application Support/Cursor/User/settings.json');\n        }\n\n        // Set HTTPS_PROXY for all GUI apps via launchctl + LaunchAgent (macOS)\n        // Copilot reads process.env.HTTPS_PROXY directly \u2014 VS Code settings alone\n        // are insufficient because workspace http.proxy is ignored and extensions\n        // may bypass vscode-proxy-agent (microsoft/vscode#12588).\n        //\n        // GATED ON CA TRUST: this routes EVERY GUI/native app's HTTPS through the\n        // MITM proxy machine-wide. Native apps validate against the system\n        // keychain, so if the CA isn't trusted (sudo declined / non-admin) this\n        // would break their TLS with an unknown-CA error attributed to nothing\n        // obvious. Claude Code + Node apps are unaffected either way (they trust\n        // NODE_EXTRA_CA_CERTS), so we keep that path and only skip the\n        // machine-wide native layer.\n        if (caTrusted) {\n          const macProxy = installMacOSProxyEnv(GATEWAY_PORT, CERT_PATH);\n          if (macProxy) {\n            this.log('[OK] HTTPS_PROXY set for GUI apps (launchctl + LaunchAgent)');\n          }\n        } else {\n          this.log('[!!] CA not trusted \u2014 skipping machine-wide GUI proxy (would break native-app TLS).');\n          this.log('     Claude Code capture is unaffected. Trust the CA + re-run to enable cross-app capture.');\n        }\n      }\n    }\n\n    // \u2500\u2500 3. Write Cursor + Copilot hook configs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // These are independent of the proxy (they capture editor lifecycle\n    // events, not LLM traffic), so they run regardless of --no-proxy. Both\n    // helpers no-op when the target directory (.cursor/ or .github/)\n    // doesn't exist.\n    if (!isGlobal) {\n      const cursorHooks = writeCursorHooks(projectPath, hookBinDir);\n      if (cursorHooks) {\n        this.log(`[OK] Cursor hooks configured \u2192 ${cursorHooks}`);\n      }\n\n      const copilotHooks = writeCopilotHooks(projectPath, hookBinDir);\n      if (copilotHooks) {\n        this.log(`[OK] Copilot Agent hooks configured \u2192 ${copilotHooks}`);\n      }\n\n      const antigravityHooks = writeAntigravityHooks(projectPath);\n      if (antigravityHooks) {\n        this.log(`[OK] Antigravity workspace hooks configured \u2192 ${antigravityHooks}`);\n      }\n    }\n\n    // User-level Antigravity hooks at ~/.gemini/config/hooks.json. Required\n    // because the GUI Antigravity process is launched once per machine and\n    // covers any workspace the user opens, not just the install-time cwd.\n    const antigravityUserHooks = writeAntigravityUserHooks();\n    if (antigravityUserHooks) {\n      this.log(`[OK] Antigravity user hooks configured \u2192 ${antigravityUserHooks}`);\n    }\n\n    // User-level Cursor hooks (~/.cursor/hooks.json) are required for global\n    // capture because Cursor's chat traffic bypasses HTTP proxies (HTTP/2\n    // multiplexed persistent connection \u2014 see cursor.com/docs/hooks). Without\n    // hooks, we get zero Cursor visibility for sessions outside this project.\n    // Runs in both --global and per-project modes since the user file is\n    // machine-wide either way.\n    const cursorUserHooks = writeCursorUserHooks(hookBinDir);\n    if (cursorUserHooks) {\n      this.log(`[OK] Cursor user hooks configured \u2192 ${cursorUserHooks}`);\n    }\n\n    // \u2500\u2500 4. Statusline shim (rate_limits freshness) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // When --statusline-usage is set, write ~/.claude/statusline-rulemetric.sh\n    // and point settings.statusLine at it. If the user already has a statusLine\n    // command configured, chain it so their prompt text is preserved.\n    if (flags['statusline-usage']) {\n      if (isStatuslineShimInstalled(settings)) {\n        this.log('[OK] Statusline shim already installed');\n      } else {\n        const prevCmd = readCurrentStatusLine(settings);\n        writeStatuslineShim(prevCmd);\n        settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        if (prevCmd) {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command} (chains to: ${prevCmd})`);\n        } else {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command}`);\n        }\n        this.log('     Rate-limit rings will now update on Claude Code\\'s statusline refresh cadence');\n      }\n    }\n\n    // \u2500\u2500 5. Write Claude Code settings (backup prior file \u2192 reversible) \u2500\u2500\u2500\u2500\u2500\n    const { backupPath } = writeClaudeSettingsWithBackup(configPath, settings);\n    if (backupPath) {\n      this.log(`[OK] Backed up previous settings \u2192 ${backupPath}`);\n    }\n\n    this.log('');\n    this.log('Setup complete! Next steps:');\n    if (isGlobal) {\n      this.log('  1. Install always-on API:    rulemetric service install');\n      this.log('  2. Start Claude Code in any project \u2014 all sessions tracked automatically');\n      this.log('');\n      this.log('The API service starts on login and restarts on crash.');\n    } else if (!noProxy) {\n      this.log('  1. Start Claude Code \u2014 sessions are captured by hooks immediately');\n      if (proxyActive) {\n        // The proxy IS live (pinned against a verified gateway above) \u2014 don't\n        // tell the user to start something that's already running.\n        this.log('  2. Full-depth capture is ON \u2014 the proxy is live on :' + GATEWAY_PORT + '.');\n      } else {\n        this.log('  2. Enable full depth (proxy not yet live):  rulemetric proxy start');\n      }\n      this.log('');\n      this.log('Hooks capture every session (lifecycle + transcript). The proxy adds the');\n      this.log('rendered system prompt (instruction-effectiveness linking) + cross-tool capture.');\n      this.log('');\n      this.log('To capture traffic from other clients (Python, curl, etc.):');\n      this.log('  eval \"$(rulemetric proxy env --all)\"');\n    } else {\n      // --no-proxy still installs the Claude Code session hooks above, so full\n      // sessions ARE captured (lifecycle + SessionEnd transcript reimport) with\n      // no mitmproxy / CA trust / gateway. Only the proxy-exclusive layer\n      // (rendered system prompt \u2192 instruction-linking, cross-tool) is skipped.\n      this.log('  1. Start Claude Code \u2014 sessions are captured by the hooks just installed');\n      this.log('');\n      this.log('No proxy means no mitmproxy / CA cert needed. The hooks capture full');\n      this.log('sessions on their own; re-run without --no-proxy to also capture system');\n      this.log('prompts for instruction-effectiveness linking.');\n    }\n\n    // Ensure the active-org cache is populated before the user starts a\n    // Claude Code session. BaseCommand fired the guarded refresh earlier\n    // but may have raced with auth init or hit a transient error; this\n    // explicit retry guarantees the cache reflects the user's current\n    // active_org_id at the end of `hooks install`.\n    await bootstrapActiveOrg();\n\n    // Soft tmux capability check \u2014 live message send needs tmux on the\n    // user's machine. We do not auto-install; just surface one line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  private findBinary(name: string): string | null {\n    try {\n      return execSync(`which ${name} 2>/dev/null`, { encoding: 'utf-8' }).trim() || null;\n    } catch {\n      return null;\n    }\n  }\n\n  private installMitmproxy(): boolean {\n    for (const [cmd, args] of [\n      ['pipx', ['install', 'mitmproxy']],\n      ['uv', ['tool', 'install', 'mitmproxy']],\n      ['brew', ['install', 'mitmproxy']],\n    ] as const) {\n      if (this.findBinary(cmd)) {\n        this.log(`     Installing via ${cmd}...`);\n        const result = spawnSync(cmd, [...args], { stdio: 'inherit' });\n        if (result.status === 0) return true;\n      }\n    }\n    return false;\n  }\n\n  private isCACertTrusted(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('security', ['verify-cert', '-c', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      return existsSync('/usr/local/share/ca-certificates/mitmproxy-ca.crt');\n    }\n\n    if (process.platform === 'win32') {\n      // On Windows, check if cert is in the Root store\n      const result = spawnSync('certutil', ['-verify', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n\n  private trustCACert(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('sudo', [\n        'security', 'add-trusted-cert', '-d', '-r', 'trustRoot',\n        '-k', '/Library/Keychains/System.keychain', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      const cp = spawnSync('sudo', [\n        'cp', CERT_PATH, '/usr/local/share/ca-certificates/mitmproxy-ca.crt',\n      ], { stdio: 'inherit' });\n      if (cp.status !== 0) return false;\n      const update = spawnSync('sudo', ['update-ca-certificates'], { stdio: 'inherit' });\n      return update.status === 0;\n    }\n\n    if (process.platform === 'win32') {\n      const result = spawnSync('certutil', [\n        '-addstore', '-f', 'Root', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,cAAc,UAAU,iBAAiB;AAClD,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAW9B,SAAS,oBAAwC;AAC/C,MAAI;AACF,UAAM,MAAM,aAAa,WAAW,CAAC,MAAM,uBAAuB,GAAG;AAAA,MACnE,UAAU;AAAA,IACZ,CAAC,EAAE,KAAK;AACR,QAAI,OAAO,WAAW,GAAG,EAAG,QAAO,QAAQ,GAAG;AAAA,EAChD,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAMA,SAAS,0BAAmC;AAC1C,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,wBAAwB,GAAG;AAAA,MAC5D,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AA0BA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAEvE,IAAqB,eAArB,MAAqB,sBAAqB,YAAY;AAAA,EACpD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,OAAO;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,IACD,QAAQ,MAAM,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,oBAAoB,MAAM,QAAQ;AAAA,MAChC,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,aAAY;AAC/C,UAAM,WAAW,MAAM;AACvB,UAAM,cAAc,WAAW,QAAQ,IAAK,MAAM,aAAa,KAAK,QAAQ,IAAI;AAChF,UAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,UAAM,aAAa,KAAK,WAAW,eAAe;AAClD,UAAM,UAAU,MAAM,UAAU;AAIhC,QAAI,cAAc;AAElB,QAAI,UAAU;AACZ,WAAK,IAAI,oCAA+B,UAAU,EAAE;AAAA,IACtD;AAIA,UAAM,EAAE,UAAU,gBAAgB,IAAI,mBAAmB,UAAU;AACnE,QAAI,iBAAiB;AACnB,WAAK,IAAI,QAAQ,UAAU,8CAAyC,eAAe,mCAAmC;AAAA,IACxH;AASA,UAAM,iBAAiB,sBAAsB,QAAQ;AAGrD,UAAM,aAAa,kBAAkB;AACrC,yBAAqB,UAAU,UAAU;AACzC,SAAK;AAAA,MACH,iBACI,qFACA;AAAA,IACN;AAGA,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,KAAK,WAAW,UAAU;AAC/C,UAAI,CAAC,cAAc;AACjB,aAAK,IAAI,EAAE;AACX,aAAK,IAAI,+CAA0C;AACnD,cAAM,YAAY,KAAK,iBAAiB;AACxC,YAAI,CAAC,WAAW;AACd,eAAK,IAAI,0DAA0D;AACnE,eAAK,IAAI,+CAA+C;AACxD,eAAK,IAAI,4CAA4C;AAAA,QACvD;AAAA,MACF;AAGA,UAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,aAAK,IAAI,mCAAmC;AAC5C,cAAM,WAAW,KAAK,WAAW,UAAU;AAC3C,YAAI,UAAU;AACZ,oBAAU,UAAU,CAAC,SAAS,iBAAiB,IAAI,GAAG;AAAA,YACpD,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD,cAAI,WAAW,SAAS,GAAG;AACzB,iBAAK,IAAI,oCAAoC,SAAS,EAAE;AAAA,UAC1D,OAAO;AACL,iBAAK,IAAI,iCAAiC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF,OAAO;AACL,aAAK,IAAI,2BAA2B;AAAA,MACtC;AAMA,YAAM,cAAc,WAAW,SAAS;AACxC,UAAI,YAAY;AAChB,UAAI,eAAe,CAAC,KAAK,gBAAgB,GAAG;AAC1C,aAAK,IAAI,4EAA4E;AACrF,oBAAY,KAAK,YAAY;AAC7B,YAAI,WAAW;AACb,eAAK,IAAI,uCAAuC;AAAA,QAClD,OAAO;AACL,eAAK,IAAI,+CAA+C;AACxD,cAAI,QAAQ,aAAa,UAAU;AACjC,iBAAK,IAAI,2GAA2G,SAAS,EAAE;AAAA,UACjI,WAAW,QAAQ,aAAa,SAAS;AACvC,iBAAK,IAAI,8BAA8B,SAAS,mFAAmF;AAAA,UACrI;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,aAAK,IAAI,qCAAqC;AAC9C,oBAAY;AAAA,MACd;AAQA,UAAI,wBAAwB,GAAG;AAC7B,aAAK,IAAI,0DAA0D;AAAA,MACrE,WAAW,iBAAiB,GAAG;AAC7B,aAAK,IAAI,8BAA8B;AAAA,MACzC,OAAO;AACL,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,6BAA6B,GAAG,GAAG;AAAA,QAC9C,SAAS,KAAK;AACZ,eAAK,IAAI,iCAAkC,IAAc,OAAO,EAAE;AAAA,QACpE;AAAA,MACF;AAUA,YAAM,cAAc,MAAM,wBAAwB,cAAc,EAAE,WAAW,IAAK,CAAC;AACnF,UAAI,CAAC,aAAa;AAIhB,aAAK,IAAI,mFAA8E;AACvF,aAAK,IAAI,+DAA+D;AAAA,MAC1E,WAAW,CAAC,aAAa;AACvB,aAAK,IAAI,qCAAqC,YAAY,kCAA6B;AACvF,aAAK,IAAI,2EAA2E;AACpF,aAAK,IAAI,2DAA2D;AAAA,MACtE,OAAO;AAGL,cAAM,MAAO,SAAS,OAAO,CAAC;AAC9B,YAAI,cAAc,oBAAoB,YAAY;AAElD,YAAI,WAAW;AACf,YAAI,WAAW,SAAS,GAAG;AACzB,cAAI,sBAAsB;AAAA,QAC5B;AACA,iBAAS,MAAM;AACf,sBAAc;AACd,aAAK,IAAI,uCAAuC,YAAY,kBAAkB;AAG9E,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,2DAAsD;AAAA,QACjE;AAGA,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,sEAAiE;AAAA,QAC5E;AAIA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,iGAA4F;AAAA,QACvG;AAGA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,kGAA6F;AAAA,QACxG;AAcA,YAAI,WAAW;AACb,gBAAM,WAAW,qBAAqB,cAAc,SAAS;AAC7D,cAAI,UAAU;AACZ,iBAAK,IAAI,6DAA6D;AAAA,UACxE;AAAA,QACF,OAAO;AACL,eAAK,IAAI,0FAAqF;AAC9F,eAAK,IAAI,4FAA4F;AAAA,QACvG;AAAA,MACF;AAAA,IACF;AAOA,QAAI,CAAC,UAAU;AACb,YAAM,cAAc,iBAAiB,aAAa,UAAU;AAC5D,UAAI,aAAa;AACf,aAAK,IAAI,uCAAkC,WAAW,EAAE;AAAA,MAC1D;AAEA,YAAM,eAAe,kBAAkB,aAAa,UAAU;AAC9D,UAAI,cAAc;AAChB,aAAK,IAAI,8CAAyC,YAAY,EAAE;AAAA,MAClE;AAEA,YAAM,mBAAmB,sBAAsB,WAAW;AAC1D,UAAI,kBAAkB;AACpB,aAAK,IAAI,sDAAiD,gBAAgB,EAAE;AAAA,MAC9E;AAAA,IACF;AAKA,UAAM,uBAAuB,0BAA0B;AACvD,QAAI,sBAAsB;AACxB,WAAK,IAAI,iDAA4C,oBAAoB,EAAE;AAAA,IAC7E;AAQA,UAAM,kBAAkB,qBAAqB,UAAU;AACvD,QAAI,iBAAiB;AACnB,WAAK,IAAI,4CAAuC,eAAe,EAAE;AAAA,IACnE;AAMA,QAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAI,0BAA0B,QAAQ,GAAG;AACvC,aAAK,IAAI,wCAAwC;AAAA,MACnD,OAAO;AACL,cAAM,UAAU,sBAAsB,QAAQ;AAC9C,4BAAoB,OAAO;AAC3B,iBAAS,aAAa;AACtB,YAAI,SAAS;AACX,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,gBAAgB,OAAO,GAAG;AAAA,QAC1G,OAAO;AACL,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,EAAE;AAAA,QAClF;AACA,aAAK,IAAI,mFAAoF;AAAA,MAC/F;AAAA,IACF;AAGA,UAAM,EAAE,WAAW,IAAI,8BAA8B,YAAY,QAAQ;AACzE,QAAI,YAAY;AACd,WAAK,IAAI,2CAAsC,UAAU,EAAE;AAAA,IAC7D;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,6BAA6B;AACtC,QAAI,UAAU;AACZ,WAAK,IAAI,2DAA2D;AACpE,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,wDAAwD;AAAA,IACnE,WAAW,CAAC,SAAS;AACnB,WAAK,IAAI,0EAAqE;AAC9E,UAAI,aAAa;AAGf,aAAK,IAAI,gEAA2D,eAAe,GAAG;AAAA,MACxF,OAAO;AACL,aAAK,IAAI,sEAAsE;AAAA,MACjF;AACA,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,0EAA0E;AACnF,WAAK,IAAI,kFAAkF;AAC3F,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,6DAA6D;AACtE,WAAK,IAAI,wCAAwC;AAAA,IACnD,OAAO;AAKL,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,yEAAyE;AAClF,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAOA,UAAM,mBAAmB;AAIzB,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI;AACF,aAAO,SAAS,SAAS,IAAI,gBAAgB,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK,KAAK;AAAA,IAChF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,mBAA4B;AAClC,eAAW,CAAC,KAAK,IAAI,KAAK;AAAA,MACxB,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,MACjC,CAAC,MAAM,CAAC,QAAQ,WAAW,WAAW,CAAC;AAAA,MACvC,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,IACnC,GAAY;AACV,UAAI,KAAK,WAAW,GAAG,GAAG;AACxB,aAAK,IAAI,uBAAuB,GAAG,KAAK;AACxC,cAAM,SAAS,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7D,YAAI,OAAO,WAAW,EAAG,QAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,kBAA2B;AACjC,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,YAAY,CAAC,eAAe,MAAM,SAAS,GAAG;AAAA,QACrE,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,WAAW,mDAAmD;AAAA,IACvE;AAEA,QAAI,QAAQ,aAAa,SAAS;AAEhC,YAAM,SAAS,UAAU,YAAY,CAAC,WAAW,SAAS,GAAG;AAAA,QAC3D,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAuB;AAC7B,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,QAAQ;AAAA,QAC/B;AAAA,QAAY;AAAA,QAAoB;AAAA,QAAM;AAAA,QAAM;AAAA,QAC5C;AAAA,QAAM;AAAA,QAAsC;AAAA,MAC9C,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,KAAK,UAAU,QAAQ;AAAA,QAC3B;AAAA,QAAM;AAAA,QAAW;AAAA,MACnB,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,UAAI,GAAG,WAAW,EAAG,QAAO;AAC5B,YAAM,SAAS,UAAU,QAAQ,CAAC,wBAAwB,GAAG,EAAE,OAAO,UAAU,CAAC;AACjF,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,SAAS,UAAU,YAAY;AAAA,QACnC;AAAA,QAAa;AAAA,QAAM;AAAA,QAAQ;AAAA,MAC7B,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execFileSync, execSync, spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, dirname } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { isGatewayRunning, waitForGatewayListening, spawnGateway, GATEWAY_PORT } from '../../lib/gateway-lifecycle.js';\n\n// Resolve the directory holding the `rulemetric` executable, so hook commands\n// can prepend it to PATH. Claude Code runs hooks via `/bin/sh -c` with a\n// minimal PATH that omits nvm/pnpm global bin dirs \u2014 so a bare `rulemetric`\n// hits \"command not found\" and capture (plus the session-start gateway\n// auto-start) silently fails. We resolve it here, in the install process's\n// full PATH, and bake the dir into the hook command. Returns undefined on\n// failure \u2192 callers fall back to the bare `rulemetric` (dev/back-compat).\nfunction resolveHookBinDir(): string | undefined {\n  try {\n    const out = execFileSync('/bin/sh', ['-c', 'command -v rulemetric'], {\n      encoding: 'utf-8',\n    }).trim();\n    if (out && existsSync(out)) return dirname(out);\n  } catch {\n    /* not resolvable \u2014 fall back to bare `rulemetric` */\n  }\n  return undefined;\n}\n\n// True iff `rulemetric service install` has wired the gateway up as a launchd\n// agent. When this returns true, hooks install must NOT spawn its own\n// detached gateway \u2014 two processes fighting for :8787 means one crash-loops\n// and Claude Code's HTTPS_PROXY breaks.\nfunction isGatewayLaunchdManaged(): boolean {\n  try {\n    execFileSync('launchctl', ['list', 'com.rulemetric.gateway'], {\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    return true;\n  } catch {\n    // Non-zero exit = label not loaded\n    return false;\n  }\n}\nimport {\n  writeStatuslineShim,\n  readCurrentStatusLine,\n  isStatuslineShimInstalled,\n  STATUSLINE_SETTINGS_VALUE,\n} from '../../lib/statusline-shim.js';\nimport {\n  mergeClaudeCodeHooks,\n  removeClaudeCodeHooks,\n  readClaudeSettings,\n  writeClaudeSettingsWithBackup,\n  writeCursorProxyConfig,\n  writeCursorUserProxyConfig,\n  writeVSCodeProxyConfig,\n  installMacOSProxyEnv,\n  writeVSCodeUserProxyConfig,\n  writeCursorHooks,\n  writeCursorUserHooks,\n  writeCopilotHooks,\n  writeAntigravityHooks,\n  writeAntigravityUserHooks,\n} from '../../lib/hooks-config.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\nexport default class HooksInstall extends BaseCommand {\n  static override description = 'Install session tracking hooks and context capture proxy for Claude Code';\n\n  static override examples = [\n    '<%= config.bin %> hooks install',\n    '<%= config.bin %> hooks install --global',\n    '<%= config.bin %> hooks install --no-proxy',\n  ];\n\n  static override flags = {\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip proxy/gateway configuration (hooks only)',\n    }),\n    'project-dir': Flags.string({\n      description: 'Project directory to install hooks in (defaults to cwd)',\n    }),\n    global: Flags.boolean({\n      char: 'g',\n      default: false,\n      description: 'Install hooks globally (~/.claude/settings.json) so all projects are tracked',\n    }),\n    'statusline-usage': Flags.boolean({\n      default: false,\n      description: 'Install the statusline shim so Claude Code pushes live rate_limits on every refresh (makes /usage rings update in real time without needing the proxy)',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(HooksInstall);\n    const isGlobal = flags.global;\n    const projectPath = isGlobal ? homedir() : (flags['project-dir'] ?? process.cwd());\n    const configDir = join(projectPath, '.claude');\n    const configPath = join(configDir, 'settings.json');\n    const noProxy = flags['no-proxy'];\n    // Whether the capture proxy actually went live this run (HTTPS_PROXY pinned\n    // against a verified-live gateway). Drives the \"next steps\" copy so we never\n    // tell the user to start a proxy that is already running.\n    let proxyActive = false;\n\n    if (isGlobal) {\n      this.log(`Installing hooks globally \u2192 ${configPath}`);\n    }\n\n    // Read or create .claude/settings.json. Never crash on a malformed file \u2014\n    // a fresh user's hand-edited settings.json must not block capture install.\n    const { settings, recoveredBackup } = readClaudeSettings(configPath);\n    if (recoveredBackup) {\n      this.log(`[!!] ${configPath} was not valid JSON \u2014 backed it up to ${recoveredBackup} and continued with a fresh file.`);\n    }\n\n    // \u2500\u2500 1. Install Claude Code session-tracking hooks (hooks-first, zero-proxy\n    // capture). Strip any stale rulemetric entries first \u2014 handles old command\n    // formats, preserves the user's own hooks \u2014 then merge the current canonical\n    // set. Runs regardless of --no-proxy: this is the whole point of the hooks\n    // path, which captures full sessions (lifecycle + SessionEnd transcript\n    // reimport) without mitmproxy / CA trust / gateway. The proxy adds the\n    // rendered system prompt (instruction-linking) + cross-tool capture on top.\n    const refreshedHooks = removeClaudeCodeHooks(settings);\n    // Resolve once; every hook writer (Claude Code, Cursor, Copilot) needs the\n    // same PATH prefix so a GUI-launched tool with a minimal PATH can find the CLI.\n    const hookBinDir = resolveHookBinDir();\n    mergeClaudeCodeHooks(settings, hookBinDir);\n    this.log(\n      refreshedHooks\n        ? '[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/settings.json'\n        : '[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/settings.json',\n    );\n\n    // \u2500\u2500 2. Configure gateway + proxy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      // Ensure mitmproxy is available\n      const hasMitmproxy = this.findBinary('mitmdump');\n      if (!hasMitmproxy) {\n        this.log('');\n        this.log('[!!] mitmproxy not found \u2014 installing...');\n        const installed = this.installMitmproxy();\n        if (!installed) {\n          this.log('[!!] Could not install mitmproxy. Skipping proxy config.');\n          this.log('     Install manually: pipx install mitmproxy');\n          this.log('     Then re-run: rulemetric hooks install');\n        }\n      }\n\n      // Generate CA cert if missing\n      if (!existsSync(CERT_PATH)) {\n        this.log('[..] Generating CA certificate...');\n        const mitmdump = this.findBinary('mitmdump');\n        if (mitmdump) {\n          spawnSync(mitmdump, ['--set', 'listen_port=0', '-q'], {\n            timeout: 5000,\n            stdio: 'ignore',\n          });\n          if (existsSync(CERT_PATH)) {\n            this.log(`[OK] CA certificate generated at ${CERT_PATH}`);\n          } else {\n            this.log('[!!] Could not generate CA cert');\n          }\n        }\n      } else {\n        this.log('[OK] CA certificate found');\n      }\n\n      // Trust CA cert in system store (if not already trusted). Track the\n      // result: whether the CA is trusted decides if we may route MACHINE-WIDE /\n      // native-app traffic through the MITM proxy (native apps validate against\n      // the system keychain, so an untrusted CA breaks their TLS).\n      const caGenerated = existsSync(CERT_PATH);\n      let caTrusted = false;\n      if (caGenerated && !this.isCACertTrusted()) {\n        this.log('[..] Installing CA certificate into system trust store (requires admin)...');\n        caTrusted = this.trustCACert();\n        if (caTrusted) {\n          this.log('[OK] CA certificate trusted by system');\n        } else {\n          this.log('[!!] Could not install CA cert automatically.');\n          if (process.platform === 'darwin') {\n            this.log(`     Run manually: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERT_PATH}`);\n          } else if (process.platform === 'linux') {\n            this.log(`     Run manually: sudo cp ${CERT_PATH} /usr/local/share/ca-certificates/mitmproxy-ca.crt && sudo update-ca-certificates`);\n          }\n        }\n      } else if (caGenerated) {\n        this.log('[OK] CA certificate already trusted');\n        caTrusted = true;\n      }\n\n      // Start the gateway BEFORE pinning HTTPS_PROXY. Three possible owners (in\n      // order of precedence):\n      //   1. launchd (`rulemetric service install` plist) \u2014 authoritative;\n      //      hooks must NOT spawn a competing copy that would fight for :8787\n      //   2. legacy PID-file (this same code path from a previous run)\n      //   3. nothing \u2014 spawn a fresh detached process\n      if (isGatewayLaunchdManaged()) {\n        this.log('[OK] Gateway managed by launchd (com.rulemetric.gateway)');\n      } else if (isGatewayRunning()) {\n        this.log('[OK] Gateway already running');\n      } else {\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway started (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not start gateway: ${(err as Error).message}`);\n        }\n      }\n\n      // Liveness guard: ONLY pin HTTPS_PROXY once :8787 actually accepts\n      // connections. Writing it against a dead port is the fresh-laptop\n      // ConnectionRefused footgun \u2014 it breaks all of Claude Code's HTTPS. If the\n      // gateway isn't answering, we leave Claude Code talking to Anthropic\n      // directly; capture still works via the hooks installed in \u00A71.\n      // Poll (not a one-shot probe): a just-spawned gateway needs a moment to\n      // bind :8787, and a single immediate probe would fail-close every fresh\n      // install and silently disable deep capture.\n      const gatewayLive = await waitForGatewayListening(GATEWAY_PORT, { timeoutMs: 4000 });\n      if (!caGenerated) {\n        // No CA \u2192 mitmproxy will regenerate one and intercept, but nothing\n        // trusts it, so pinning HTTPS_PROXY would break even Claude Code's TLS.\n        // Stay hooks-only rather than pin a proxy nothing can validate.\n        this.log('[!!] No CA certificate \u2014 NOT setting HTTPS_PROXY (capture stays hooks-only).');\n        this.log('     Install mitmproxy, then re-run: rulemetric hooks install');\n      } else if (!gatewayLive) {\n        this.log(`[!!] Gateway is not answering on :${GATEWAY_PORT} \u2014 NOT setting HTTPS_PROXY.`);\n        this.log('     Capture still works via hooks. To enable deep (proxy) capture later:');\n        this.log('     rulemetric proxy start  &&  rulemetric hooks install');\n      } else {\n        // Set permanent HTTPS_PROXY and NODE_EXTRA_CA_CERTS in settings.json.\n        // These point to the gateway (verified live above), not mitmproxy directly.\n        const env = (settings.env ?? {}) as Record<string, string>;\n        env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n        // Bypass proxy for non-Anthropic traffic (Supabase auth, npm, etc.)\n        env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n        if (existsSync(CERT_PATH)) {\n          env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n        }\n        settings.env = env;\n        proxyActive = true;\n        this.log(`[OK] HTTPS_PROXY set to gateway on :${GATEWAY_PORT} (verified live)`);\n\n        // Configure Cursor proxy (if .cursor/ exists)\n        const cursorProxy = writeCursorProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (cursorProxy) {\n          this.log('[OK] Cursor proxy configured \u2192 .cursor/settings.json');\n        }\n\n        // Configure VS Code proxy for Copilot capture (workspace settings)\n        const vscodeProxy = writeVSCodeProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (vscodeProxy) {\n          this.log('[OK] VS Code workspace proxy configured \u2192 .vscode/settings.json');\n        }\n\n        // Set http.proxy in VS Code user settings (workspace-level is silently ignored\n        // for http.proxy due to APPLICATION scope \u2014 microsoft/vscode#236932)\n        const vscodeUserProxy = writeVSCodeUserProxyConfig(GATEWAY_PORT);\n        if (vscodeUserProxy) {\n          this.log('[OK] VS Code user proxy configured \u2192 ~/Library/Application Support/Code/User/settings.json');\n        }\n\n        // Same for Cursor (VS Code fork inherits the APPLICATION-scope restriction).\n        const cursorUserProxy = writeCursorUserProxyConfig(GATEWAY_PORT);\n        if (cursorUserProxy) {\n          this.log('[OK] Cursor user proxy configured \u2192 ~/Library/Application Support/Cursor/User/settings.json');\n        }\n\n        // Set HTTPS_PROXY for all GUI apps via launchctl + LaunchAgent (macOS)\n        // Copilot reads process.env.HTTPS_PROXY directly \u2014 VS Code settings alone\n        // are insufficient because workspace http.proxy is ignored and extensions\n        // may bypass vscode-proxy-agent (microsoft/vscode#12588).\n        //\n        // GATED ON CA TRUST: this routes EVERY GUI/native app's HTTPS through the\n        // MITM proxy machine-wide. Native apps validate against the system\n        // keychain, so if the CA isn't trusted (sudo declined / non-admin) this\n        // would break their TLS with an unknown-CA error attributed to nothing\n        // obvious. Claude Code + Node apps are unaffected either way (they trust\n        // NODE_EXTRA_CA_CERTS), so we keep that path and only skip the\n        // machine-wide native layer.\n        if (caTrusted) {\n          const macProxy = installMacOSProxyEnv(GATEWAY_PORT, CERT_PATH);\n          if (macProxy) {\n            this.log('[OK] HTTPS_PROXY set for GUI apps (launchctl + LaunchAgent)');\n          }\n        } else {\n          this.log('[!!] CA not trusted \u2014 skipping machine-wide GUI proxy (would break native-app TLS).');\n          this.log('     Claude Code capture is unaffected. Trust the CA + re-run to enable cross-app capture.');\n        }\n      }\n    }\n\n    // \u2500\u2500 3. Write Cursor + Copilot hook configs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // These are independent of the proxy (they capture editor lifecycle\n    // events, not LLM traffic), so they run regardless of --no-proxy. Both\n    // helpers no-op when the target directory (.cursor/ or .github/)\n    // doesn't exist.\n    if (!isGlobal) {\n      const cursorHooks = writeCursorHooks(projectPath, hookBinDir);\n      if (cursorHooks) {\n        this.log(`[OK] Cursor hooks configured \u2192 ${cursorHooks}`);\n      }\n\n      const copilotHooks = writeCopilotHooks(projectPath, hookBinDir);\n      if (copilotHooks) {\n        this.log(`[OK] Copilot Agent hooks configured \u2192 ${copilotHooks}`);\n      }\n\n      const antigravityHooks = writeAntigravityHooks(projectPath);\n      if (antigravityHooks) {\n        this.log(`[OK] Antigravity workspace hooks configured \u2192 ${antigravityHooks}`);\n      }\n    }\n\n    // User-level Antigravity hooks at ~/.gemini/config/hooks.json \u2014 covers any\n    // workspace the user opens, not just the install-time cwd. Written ONLY when\n    // ~/.gemini already exists (the tool is present); returns null otherwise so\n    // we never manufacture config for a tool the user doesn't have (F2).\n    const antigravityUserHooks = writeAntigravityUserHooks();\n    if (antigravityUserHooks) {\n      this.log(`[OK] Antigravity user hooks configured \u2192 ${antigravityUserHooks}`);\n    }\n\n    // User-level Cursor hooks (~/.cursor/hooks.json) are required for global\n    // capture because Cursor's chat traffic bypasses HTTP proxies (HTTP/2\n    // multiplexed persistent connection \u2014 see cursor.com/docs/hooks). Without\n    // hooks, we get zero Cursor visibility for sessions outside this project.\n    // Runs in both --global and per-project modes since the user file is\n    // machine-wide either way.\n    const cursorUserHooks = writeCursorUserHooks(hookBinDir);\n    if (cursorUserHooks) {\n      this.log(`[OK] Cursor user hooks configured \u2192 ${cursorUserHooks}`);\n    }\n\n    // \u2500\u2500 4. Statusline shim (rate_limits freshness) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // When --statusline-usage is set, write ~/.claude/statusline-rulemetric.sh\n    // and point settings.statusLine at it. If the user already has a statusLine\n    // command configured, chain it so their prompt text is preserved.\n    if (flags['statusline-usage']) {\n      if (isStatuslineShimInstalled(settings)) {\n        this.log('[OK] Statusline shim already installed');\n      } else {\n        const prevCmd = readCurrentStatusLine(settings);\n        writeStatuslineShim(prevCmd);\n        settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        if (prevCmd) {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command} (chains to: ${prevCmd})`);\n        } else {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command}`);\n        }\n        this.log('     Rate-limit rings will now update on Claude Code\\'s statusline refresh cadence');\n      }\n    }\n\n    // \u2500\u2500 5. Write Claude Code settings (backup prior file \u2192 reversible) \u2500\u2500\u2500\u2500\u2500\n    const { backupPath } = writeClaudeSettingsWithBackup(configPath, settings);\n    if (backupPath) {\n      this.log(`[OK] Backed up previous settings \u2192 ${backupPath}`);\n    }\n\n    this.log('');\n    this.log('Setup complete! Next steps:');\n    if (isGlobal) {\n      this.log('  1. Install always-on API:    rulemetric service install');\n      this.log('  2. Start Claude Code in any project \u2014 all sessions tracked automatically');\n      this.log('');\n      this.log('The API service starts on login and restarts on crash.');\n    } else if (!noProxy) {\n      this.log('  1. Start Claude Code \u2014 sessions are captured by hooks immediately');\n      if (proxyActive) {\n        // The proxy IS live (pinned against a verified gateway above) \u2014 don't\n        // tell the user to start something that's already running.\n        this.log('  2. Full-depth capture is ON \u2014 the proxy is live on :' + GATEWAY_PORT + '.');\n      } else {\n        this.log('  2. Enable full depth (proxy not yet live):  rulemetric proxy start');\n      }\n      this.log('');\n      this.log('Hooks capture every session (lifecycle + transcript). The proxy adds the');\n      this.log('rendered system prompt (instruction-effectiveness linking) + cross-tool capture.');\n      this.log('');\n      this.log('To capture traffic from other clients (Python, curl, etc.):');\n      this.log('  eval \"$(rulemetric proxy env --all)\"');\n    } else {\n      // --no-proxy still installs the Claude Code session hooks above, so full\n      // sessions ARE captured (lifecycle + SessionEnd transcript reimport) with\n      // no mitmproxy / CA trust / gateway. Only the proxy-exclusive layer\n      // (rendered system prompt \u2192 instruction-linking, cross-tool) is skipped.\n      this.log('  1. Start Claude Code \u2014 sessions are captured by the hooks just installed');\n      this.log('');\n      this.log('No proxy means no mitmproxy / CA cert needed. The hooks capture full');\n      this.log('sessions on their own; re-run without --no-proxy to also capture system');\n      this.log('prompts for instruction-effectiveness linking.');\n    }\n\n    // Ensure the active-org cache is populated before the user starts a\n    // Claude Code session. BaseCommand fired the guarded refresh earlier\n    // but may have raced with auth init or hit a transient error; this\n    // explicit retry guarantees the cache reflects the user's current\n    // active_org_id at the end of `hooks install`.\n    await bootstrapActiveOrg();\n\n    // Soft tmux capability check \u2014 live message send needs tmux on the\n    // user's machine. We do not auto-install; just surface one line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  private findBinary(name: string): string | null {\n    try {\n      return execSync(`which ${name} 2>/dev/null`, { encoding: 'utf-8' }).trim() || null;\n    } catch {\n      return null;\n    }\n  }\n\n  private installMitmproxy(): boolean {\n    for (const [cmd, args] of [\n      ['pipx', ['install', 'mitmproxy']],\n      ['uv', ['tool', 'install', 'mitmproxy']],\n      ['brew', ['install', 'mitmproxy']],\n    ] as const) {\n      if (this.findBinary(cmd)) {\n        this.log(`     Installing via ${cmd}...`);\n        const result = spawnSync(cmd, [...args], { stdio: 'inherit' });\n        if (result.status === 0) return true;\n      }\n    }\n    return false;\n  }\n\n  private isCACertTrusted(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('security', ['verify-cert', '-c', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      return existsSync('/usr/local/share/ca-certificates/mitmproxy-ca.crt');\n    }\n\n    if (process.platform === 'win32') {\n      // On Windows, check if cert is in the Root store\n      const result = spawnSync('certutil', ['-verify', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n\n  private trustCACert(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('sudo', [\n        'security', 'add-trusted-cert', '-d', '-r', 'trustRoot',\n        '-k', '/Library/Keychains/System.keychain', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      const cp = spawnSync('sudo', [\n        'cp', CERT_PATH, '/usr/local/share/ca-certificates/mitmproxy-ca.crt',\n      ], { stdio: 'inherit' });\n      if (cp.status !== 0) return false;\n      const update = spawnSync('sudo', ['update-ca-certificates'], { stdio: 'inherit' });\n      return update.status === 0;\n    }\n\n    if (process.platform === 'win32') {\n      const result = spawnSync('certutil', [\n        '-addstore', '-f', 'Root', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,cAAc,UAAU,iBAAiB;AAClD,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAW9B,SAAS,oBAAwC;AAC/C,MAAI;AACF,UAAM,MAAM,aAAa,WAAW,CAAC,MAAM,uBAAuB,GAAG;AAAA,MACnE,UAAU;AAAA,IACZ,CAAC,EAAE,KAAK;AACR,QAAI,OAAO,WAAW,GAAG,EAAG,QAAO,QAAQ,GAAG;AAAA,EAChD,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAMA,SAAS,0BAAmC;AAC1C,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,wBAAwB,GAAG;AAAA,MAC5D,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AA0BA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAEvE,IAAqB,eAArB,MAAqB,sBAAqB,YAAY;AAAA,EACpD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,OAAO;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,IACD,QAAQ,MAAM,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,oBAAoB,MAAM,QAAQ;AAAA,MAChC,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,aAAY;AAC/C,UAAM,WAAW,MAAM;AACvB,UAAM,cAAc,WAAW,QAAQ,IAAK,MAAM,aAAa,KAAK,QAAQ,IAAI;AAChF,UAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,UAAM,aAAa,KAAK,WAAW,eAAe;AAClD,UAAM,UAAU,MAAM,UAAU;AAIhC,QAAI,cAAc;AAElB,QAAI,UAAU;AACZ,WAAK,IAAI,oCAA+B,UAAU,EAAE;AAAA,IACtD;AAIA,UAAM,EAAE,UAAU,gBAAgB,IAAI,mBAAmB,UAAU;AACnE,QAAI,iBAAiB;AACnB,WAAK,IAAI,QAAQ,UAAU,8CAAyC,eAAe,mCAAmC;AAAA,IACxH;AASA,UAAM,iBAAiB,sBAAsB,QAAQ;AAGrD,UAAM,aAAa,kBAAkB;AACrC,yBAAqB,UAAU,UAAU;AACzC,SAAK;AAAA,MACH,iBACI,qFACA;AAAA,IACN;AAGA,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,KAAK,WAAW,UAAU;AAC/C,UAAI,CAAC,cAAc;AACjB,aAAK,IAAI,EAAE;AACX,aAAK,IAAI,+CAA0C;AACnD,cAAM,YAAY,KAAK,iBAAiB;AACxC,YAAI,CAAC,WAAW;AACd,eAAK,IAAI,0DAA0D;AACnE,eAAK,IAAI,+CAA+C;AACxD,eAAK,IAAI,4CAA4C;AAAA,QACvD;AAAA,MACF;AAGA,UAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,aAAK,IAAI,mCAAmC;AAC5C,cAAM,WAAW,KAAK,WAAW,UAAU;AAC3C,YAAI,UAAU;AACZ,oBAAU,UAAU,CAAC,SAAS,iBAAiB,IAAI,GAAG;AAAA,YACpD,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD,cAAI,WAAW,SAAS,GAAG;AACzB,iBAAK,IAAI,oCAAoC,SAAS,EAAE;AAAA,UAC1D,OAAO;AACL,iBAAK,IAAI,iCAAiC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF,OAAO;AACL,aAAK,IAAI,2BAA2B;AAAA,MACtC;AAMA,YAAM,cAAc,WAAW,SAAS;AACxC,UAAI,YAAY;AAChB,UAAI,eAAe,CAAC,KAAK,gBAAgB,GAAG;AAC1C,aAAK,IAAI,4EAA4E;AACrF,oBAAY,KAAK,YAAY;AAC7B,YAAI,WAAW;AACb,eAAK,IAAI,uCAAuC;AAAA,QAClD,OAAO;AACL,eAAK,IAAI,+CAA+C;AACxD,cAAI,QAAQ,aAAa,UAAU;AACjC,iBAAK,IAAI,2GAA2G,SAAS,EAAE;AAAA,UACjI,WAAW,QAAQ,aAAa,SAAS;AACvC,iBAAK,IAAI,8BAA8B,SAAS,mFAAmF;AAAA,UACrI;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,aAAK,IAAI,qCAAqC;AAC9C,oBAAY;AAAA,MACd;AAQA,UAAI,wBAAwB,GAAG;AAC7B,aAAK,IAAI,0DAA0D;AAAA,MACrE,WAAW,iBAAiB,GAAG;AAC7B,aAAK,IAAI,8BAA8B;AAAA,MACzC,OAAO;AACL,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,6BAA6B,GAAG,GAAG;AAAA,QAC9C,SAAS,KAAK;AACZ,eAAK,IAAI,iCAAkC,IAAc,OAAO,EAAE;AAAA,QACpE;AAAA,MACF;AAUA,YAAM,cAAc,MAAM,wBAAwB,cAAc,EAAE,WAAW,IAAK,CAAC;AACnF,UAAI,CAAC,aAAa;AAIhB,aAAK,IAAI,mFAA8E;AACvF,aAAK,IAAI,+DAA+D;AAAA,MAC1E,WAAW,CAAC,aAAa;AACvB,aAAK,IAAI,qCAAqC,YAAY,kCAA6B;AACvF,aAAK,IAAI,2EAA2E;AACpF,aAAK,IAAI,2DAA2D;AAAA,MACtE,OAAO;AAGL,cAAM,MAAO,SAAS,OAAO,CAAC;AAC9B,YAAI,cAAc,oBAAoB,YAAY;AAElD,YAAI,WAAW;AACf,YAAI,WAAW,SAAS,GAAG;AACzB,cAAI,sBAAsB;AAAA,QAC5B;AACA,iBAAS,MAAM;AACf,sBAAc;AACd,aAAK,IAAI,uCAAuC,YAAY,kBAAkB;AAG9E,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,2DAAsD;AAAA,QACjE;AAGA,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,sEAAiE;AAAA,QAC5E;AAIA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,iGAA4F;AAAA,QACvG;AAGA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,kGAA6F;AAAA,QACxG;AAcA,YAAI,WAAW;AACb,gBAAM,WAAW,qBAAqB,cAAc,SAAS;AAC7D,cAAI,UAAU;AACZ,iBAAK,IAAI,6DAA6D;AAAA,UACxE;AAAA,QACF,OAAO;AACL,eAAK,IAAI,0FAAqF;AAC9F,eAAK,IAAI,4FAA4F;AAAA,QACvG;AAAA,MACF;AAAA,IACF;AAOA,QAAI,CAAC,UAAU;AACb,YAAM,cAAc,iBAAiB,aAAa,UAAU;AAC5D,UAAI,aAAa;AACf,aAAK,IAAI,uCAAkC,WAAW,EAAE;AAAA,MAC1D;AAEA,YAAM,eAAe,kBAAkB,aAAa,UAAU;AAC9D,UAAI,cAAc;AAChB,aAAK,IAAI,8CAAyC,YAAY,EAAE;AAAA,MAClE;AAEA,YAAM,mBAAmB,sBAAsB,WAAW;AAC1D,UAAI,kBAAkB;AACpB,aAAK,IAAI,sDAAiD,gBAAgB,EAAE;AAAA,MAC9E;AAAA,IACF;AAMA,UAAM,uBAAuB,0BAA0B;AACvD,QAAI,sBAAsB;AACxB,WAAK,IAAI,iDAA4C,oBAAoB,EAAE;AAAA,IAC7E;AAQA,UAAM,kBAAkB,qBAAqB,UAAU;AACvD,QAAI,iBAAiB;AACnB,WAAK,IAAI,4CAAuC,eAAe,EAAE;AAAA,IACnE;AAMA,QAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAI,0BAA0B,QAAQ,GAAG;AACvC,aAAK,IAAI,wCAAwC;AAAA,MACnD,OAAO;AACL,cAAM,UAAU,sBAAsB,QAAQ;AAC9C,4BAAoB,OAAO;AAC3B,iBAAS,aAAa;AACtB,YAAI,SAAS;AACX,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,gBAAgB,OAAO,GAAG;AAAA,QAC1G,OAAO;AACL,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,EAAE;AAAA,QAClF;AACA,aAAK,IAAI,mFAAoF;AAAA,MAC/F;AAAA,IACF;AAGA,UAAM,EAAE,WAAW,IAAI,8BAA8B,YAAY,QAAQ;AACzE,QAAI,YAAY;AACd,WAAK,IAAI,2CAAsC,UAAU,EAAE;AAAA,IAC7D;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,6BAA6B;AACtC,QAAI,UAAU;AACZ,WAAK,IAAI,2DAA2D;AACpE,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,wDAAwD;AAAA,IACnE,WAAW,CAAC,SAAS;AACnB,WAAK,IAAI,0EAAqE;AAC9E,UAAI,aAAa;AAGf,aAAK,IAAI,gEAA2D,eAAe,GAAG;AAAA,MACxF,OAAO;AACL,aAAK,IAAI,sEAAsE;AAAA,MACjF;AACA,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,0EAA0E;AACnF,WAAK,IAAI,kFAAkF;AAC3F,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,6DAA6D;AACtE,WAAK,IAAI,wCAAwC;AAAA,IACnD,OAAO;AAKL,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,yEAAyE;AAClF,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAOA,UAAM,mBAAmB;AAIzB,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI;AACF,aAAO,SAAS,SAAS,IAAI,gBAAgB,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK,KAAK;AAAA,IAChF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,mBAA4B;AAClC,eAAW,CAAC,KAAK,IAAI,KAAK;AAAA,MACxB,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,MACjC,CAAC,MAAM,CAAC,QAAQ,WAAW,WAAW,CAAC;AAAA,MACvC,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,IACnC,GAAY;AACV,UAAI,KAAK,WAAW,GAAG,GAAG;AACxB,aAAK,IAAI,uBAAuB,GAAG,KAAK;AACxC,cAAM,SAAS,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7D,YAAI,OAAO,WAAW,EAAG,QAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,kBAA2B;AACjC,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,YAAY,CAAC,eAAe,MAAM,SAAS,GAAG;AAAA,QACrE,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,WAAW,mDAAmD;AAAA,IACvE;AAEA,QAAI,QAAQ,aAAa,SAAS;AAEhC,YAAM,SAAS,UAAU,YAAY,CAAC,WAAW,SAAS,GAAG;AAAA,QAC3D,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAuB;AAC7B,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,QAAQ;AAAA,QAC/B;AAAA,QAAY;AAAA,QAAoB;AAAA,QAAM;AAAA,QAAM;AAAA,QAC5C;AAAA,QAAM;AAAA,QAAsC;AAAA,MAC9C,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,KAAK,UAAU,QAAQ;AAAA,QAC3B;AAAA,QAAM;AAAA,QAAW;AAAA,MACnB,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,UAAI,GAAG,WAAW,EAAG,QAAO;AAC5B,YAAM,SAAS,UAAU,QAAQ,CAAC,wBAAwB,GAAG,EAAE,OAAO,UAAU,CAAC;AACjF,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,SAAS,UAAU,YAAY;AAAA,QACnC;AAAA,QAAa;AAAA,QAAM;AAAA,QAAQ;AAAA,MAC7B,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/commands/hooks/uninstall.js

@@ -14,10 +14,10 @@ import {
   removeVSCodeUserProxyConfig,
   uninstallMacOSProxyEnv,
   writeClaudeSettingsWithBackup
-} from "../../chunk-HWGRTIXN.js";
+} from "../../chunk-XN23W5HL.js";
 import {
   stopGateway
-} from "../../chunk-OVGP4OGK.js";
+} from "../../chunk-DAJNO4OI.js";
 import {
   BaseCommand
 } from "../../chunk-SZ7VDCD6.js";

package/dist/commands/proxy/env.js

@@ -1,6 +1,6 @@
 import {
   GATEWAY_PORT
-} from "../../chunk-OVGP4OGK.js";
+} from "../../chunk-DAJNO4OI.js";
 import {
   BaseCommand
 } from "../../chunk-SZ7VDCD6.js";

package/dist/commands/proxy/start.js

@@ -18,7 +18,9 @@ import { Flags } from "@oclif/core";
 import { execSync, spawn, spawnSync } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 var DEFAULT_PORT = 8788;
 var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
 var PID_FILE = join(CONFIG_DIR, "proxy.pid");
@@ -27,9 +29,9 @@ var DOCKER_IMAGE = "rulemetric/proxy";
 var DOCKER_CONTAINER = "rulemetric-proxy";
 function findAddonPath() {
   const candidates = [
-    resolve(import.meta.dirname, "../../../../../packages/proxy/addon/rulemetric_addon.py"),
-    resolve(import.meta.dirname, "../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py"),
-    resolve(import.meta.dirname, "../../../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py")
+    resolve(MODULE_DIR, "../../../../../packages/proxy/addon/rulemetric_addon.py"),
+    resolve(MODULE_DIR, "../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py"),
+    resolve(MODULE_DIR, "../../../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py")
   ];
   for (const p of candidates) {
     if (existsSync(p)) return p;
@@ -40,9 +42,9 @@ function findAddonPath() {
 }
 function findDockerfilePath() {
   const candidates = [
-    resolve(import.meta.dirname, "../../../../../packages/proxy"),
-    resolve(import.meta.dirname, "../../../node_modules/@rulemetric/proxy"),
-    resolve(import.meta.dirname, "../../../../../node_modules/@rulemetric/proxy")
+    resolve(MODULE_DIR, "../../../../../packages/proxy"),
+    resolve(MODULE_DIR, "../../../node_modules/@rulemetric/proxy"),
+    resolve(MODULE_DIR, "../../../../../node_modules/@rulemetric/proxy")
   ];
   for (const p of candidates) {
     if (existsSync(join(p, "Dockerfile"))) return p;
@@ -178,7 +180,7 @@ var ProxyStart = class _ProxyStart extends BaseCommand {
   findComposeFile() {
     const candidates = [
       join(process.cwd(), "docker-compose.yml"),
-      resolve(import.meta.dirname, "../../../../../docker-compose.yml")
+      resolve(MODULE_DIR, "../../../../../docker-compose.yml")
     ];
     for (const p of candidates) {
       if (existsSync(p)) return p;

package/dist/commands/proxy/start.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/proxy/start.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execSync, spawn, spawnSync } from 'node:child_process';\nimport { appendFileSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { isAuthenticated } from '../../lib/auth.js';\nimport { findBinary } from '../../lib/which.js';\n\nconst DEFAULT_PORT = 8788;\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst PID_FILE = join(CONFIG_DIR, 'proxy.pid');\nconst LOG_FILE = join(CONFIG_DIR, 'proxy.log');\nconst DOCKER_IMAGE = 'rulemetric/proxy';\nconst DOCKER_CONTAINER = 'rulemetric-proxy';\n\nfunction findAddonPath(): string {\n  const candidates = [\n    resolve(import.meta.dirname, '../../../../../packages/proxy/addon/rulemetric_addon.py'),\n    resolve(import.meta.dirname, '../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py'),\n    resolve(import.meta.dirname, '../../../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(p)) return p;\n  }\n  throw new Error(\n    'Could not find rulemetric_addon.py. Is @rulemetric/proxy installed?\\n' +\n    'Searched:\\n' + candidates.map(c => `  ${c}`).join('\\n'),\n  );\n}\n\nfunction findDockerfilePath(): string {\n  const candidates = [\n    resolve(import.meta.dirname, '../../../../../packages/proxy'),\n    resolve(import.meta.dirname, '../../../node_modules/@rulemetric/proxy'),\n    resolve(import.meta.dirname, '../../../../../node_modules/@rulemetric/proxy'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(join(p, 'Dockerfile'))) return p;\n  }\n  throw new Error('Could not find proxy Dockerfile. Is @rulemetric/proxy installed?');\n}\n\nfunction dockerImageExists(): boolean {\n  const result = spawnSync('docker', ['image', 'inspect', DOCKER_IMAGE], { stdio: 'ignore' });\n  return result.status === 0;\n}\n\nfunction dockerContainerRunning(): boolean {\n  const result = spawnSync('docker', ['container', 'inspect', '-f', '{{.State.Running}}', DOCKER_CONTAINER], {\n    encoding: 'utf-8',\n    stdio: ['ignore', 'pipe', 'ignore'],\n  });\n  return result.status === 0 && result.stdout?.trim() === 'true';\n}\n\nexport default class ProxyStart extends BaseCommand {\n  static override description = 'Start context capture proxy';\n\n  static override examples = [\n    '<%= config.bin %> proxy start',\n    '<%= config.bin %> proxy start --docker',\n    '<%= config.bin %> proxy start --port 9090',\n    '<%= config.bin %> proxy start --web',\n  ];\n\n  static override flags = {\n    port: Flags.integer({ char: 'p', default: DEFAULT_PORT, description: 'Proxy listen port' }),\n    docker: Flags.boolean({ char: 'd', default: false, description: 'Run proxy in Docker (no local mitmproxy needed)' }),\n    web: Flags.boolean({ default: false, description: 'Launch mitmweb debug UI instead of mitmdump (local mode only)' }),\n    'skip-checks': Flags.boolean({ default: false, description: 'Skip prerequisite checks' }),\n    build: Flags.boolean({ default: false, description: 'Force rebuild Docker image' }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(ProxyStart);\n    const port = flags.port;\n\n    if (flags.docker) {\n      await this.startDocker(port, flags.build);\n    } else {\n      await this.startLocal(port, flags.web, flags['skip-checks']);\n    }\n  }\n\n  private async startDocker(port: number, forceBuild: boolean): Promise<void> {\n    // Check Docker is available\n    try {\n      execSync('docker info', { stdio: 'ignore' });\n    } catch {\n      this.error('Docker is not running. Start Docker Desktop and try again.');\n    }\n\n    // Check if already running\n    if (dockerContainerRunning()) {\n      this.error(`Proxy container already running. Stop it first: rulemetric proxy stop`);\n    }\n\n    // Find the compose file (monorepo root or project root)\n    const composeFile = this.findComposeFile();\n\n    // Ensure mount dirs exist\n    const certDir = join(homedir(), '.mitmproxy');\n    mkdirSync(certDir, { recursive: true });\n    const tmpDir = process.env.TMPDIR || '/tmp';\n    mkdirSync(join(tmpDir, 'rulemetric'), { recursive: true });\n\n    // Load auth from env file if not in environment\n    const envOverrides: Record<string, string> = {\n      PROXY_PORT: String(port),\n      RULEMETRIC_PROJECT_PATH: process.cwd(),\n    };\n\n    if (!process.env.RULEMETRIC_API_KEY && !process.env.RULEMETRIC_ACCESS_TOKEN) {\n      const envFile = join(homedir(), '.config', 'rulemetric', 'env');\n      if (existsSync(envFile)) {\n        for (const line of readFileSync(envFile, 'utf-8').split('\\n')) {\n          const trimmed = line.trim();\n          if (trimmed && !trimmed.startsWith('#') && trimmed.includes('=')) {\n            const [key, ...rest] = trimmed.split('=');\n            envOverrides[key] = rest.join('=');\n          }\n        }\n      }\n    }\n\n    if (composeFile) {\n      // Use docker compose\n      const composeEnv = { ...process.env, ...envOverrides };\n      const buildFlag = forceBuild ? '--build' : '';\n      const args = ['compose', '-f', composeFile, 'up', '-d', 'proxy'];\n      if (forceBuild) args.splice(4, 0, '--build');\n\n      this.log(forceBuild ? 'Building and starting proxy via Docker Compose...' : 'Starting proxy via Docker Compose...');\n      const result = spawnSync('docker', args, {\n        env: composeEnv,\n        stdio: 'inherit',\n      });\n\n      if (result.status !== 0) {\n        this.error('Docker Compose failed. Try: docker compose -f docker-compose.yml up proxy');\n      }\n    } else {\n      // Fallback: raw docker run\n      if (forceBuild || !dockerImageExists()) {\n        const proxyDir = findDockerfilePath();\n        this.log('Building proxy Docker image...');\n        const build = spawnSync('docker', ['build', '-t', DOCKER_IMAGE, proxyDir], { stdio: 'inherit' });\n        if (build.status !== 0) {\n          this.error('Docker build failed');\n        }\n      }\n\n      spawnSync('docker', ['rm', '-f', DOCKER_CONTAINER], { stdio: 'ignore' });\n\n      const envArgs: string[] = [];\n      for (const [key, val] of Object.entries(envOverrides)) {\n        envArgs.push('-e', `${key}=${val}`);\n      }\n      // Pass through from current env\n      for (const key of ['RULEMETRIC_API_URL', 'RULEMETRIC_API_KEY', 'RULEMETRIC_ACCESS_TOKEN']) {\n        if (process.env[key]) envArgs.push('-e', `${key}=${process.env[key]}`);\n      }\n\n      const dockerArgs = [\n        'run', '-d',\n        '--name', DOCKER_CONTAINER,\n        '-p', `${port}:8787`,\n        '-v', `${certDir}:/root/.mitmproxy`,\n        '-v', `${join(tmpDir, 'rulemetric')}:/tmp/rulemetric:ro`,\n        ...envArgs,\n        DOCKER_IMAGE,\n      ];\n\n      const result = spawnSync('docker', dockerArgs, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });\n      if (result.status !== 0) {\n        this.error(`Failed to start container: ${result.stderr}`);\n      }\n    }\n\n    // Write marker so proxy stop knows it's Docker\n    mkdirSync(CONFIG_DIR, { recursive: true });\n    writeFileSync(PID_FILE, `docker:${DOCKER_CONTAINER}`);\n\n    // Wait for container to be ready\n    await new Promise(resolve => setTimeout(resolve, 2000));\n\n    const inspectResult = spawnSync('docker', ['container', 'inspect', '-f', '{{.Id}}', DOCKER_CONTAINER], {\n      encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],\n    });\n    const containerId = inspectResult.stdout?.trim().slice(0, 12) || 'unknown';\n\n    this.log(`Proxy running in Docker on localhost:${port} (container: ${containerId})`);\n\n    this.log('');\n    this.log('View logs: rulemetric proxy logs -f');\n  }\n\n  private findComposeFile(): string | null {\n    const candidates = [\n      join(process.cwd(), 'docker-compose.yml'),\n      resolve(import.meta.dirname, '../../../../../docker-compose.yml'),\n    ];\n    for (const p of candidates) {\n      if (existsSync(p)) return p;\n    }\n    return null;\n  }\n\n  private async startLocal(port: number, useWeb: boolean, skipChecks: boolean): Promise<void> {\n    // Check if already running\n    if (existsSync(PID_FILE)) {\n      const content = readFileSync(PID_FILE, 'utf-8').trim();\n      if (content.startsWith('docker:')) {\n        this.error('Proxy is running in Docker. Stop it first: rulemetric proxy stop');\n      }\n      const pid = Number.parseInt(content, 10);\n      if (!Number.isNaN(pid)) {\n        try {\n          process.kill(pid, 0);\n          this.error(`Proxy already running (PID ${pid}). Stop it first: rulemetric proxy stop`);\n        } catch { /* stale PID, continue */ }\n      }\n    }\n\n    // Check mitmproxy is installed (portable PATH scan \u2014 Windows has no `which`)\n    const binary = useWeb ? 'mitmweb' : 'mitmdump';\n    if (!findBinary(binary)) {\n      this.error(\n        `${binary} not found. Use Docker mode instead:\\n` +\n        '  rulemetric proxy start --docker\\n\\n' +\n        'Or install mitmproxy locally:\\n' +\n        '  pipx install mitmproxy\\n' +\n        '  brew install mitmproxy',\n      );\n    }\n\n    // Prerequisite warnings (non-blocking)\n    if (!skipChecks) {\n      const warnings: string[] = [];\n\n      if (!isAuthenticated() && !process.env.RULEMETRIC_API_KEY) {\n        const envFile = join(homedir(), '.config', 'rulemetric', 'env');\n        let hasEnvAuth = false;\n        if (existsSync(envFile)) {\n          const content = readFileSync(envFile, 'utf-8');\n          hasEnvAuth = content.includes('RULEMETRIC_API_KEY') || content.includes('RULEMETRIC_ACCESS_TOKEN');\n        }\n        if (!hasEnvAuth) {\n          warnings.push('Not authenticated \u2014 snapshots cannot be stored. Run `rulemetric auth login`.');\n        }\n      }\n\n      const certPath = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n      if (!existsSync(certPath)) {\n        warnings.push('CA cert not found \u2014 HTTPS interception may fail. Run `rulemetric proxy setup`.');\n      }\n\n      const settingsPath = join(process.cwd(), '.claude', 'settings.json');\n      if (!existsSync(settingsPath)) {\n        warnings.push('Session hooks not installed \u2014 snapshots won\\'t link to sessions. Run `rulemetric hooks install`.');\n      }\n\n      if (warnings.length > 0) {\n        for (const w of warnings) {\n          this.log(`  Warning: ${w}`);\n        }\n        this.log('');\n      }\n    }\n\n    // Find addon\n    const addonPath = findAddonPath();\n\n    // Build env \u2014 pass through auth credentials for the reporter\n    const env: Record<string, string | undefined> = {\n      ...process.env,\n      RULEMETRIC_PROJECT_PATH: process.cwd(),\n      // Bound to this CLI binary's version. The addon writes this to a\n      // version file the gateway watches; on drift the gateway restarts\n      // mitmproxy so an upgraded CLI doesn't sit next to a stale proxy.\n      RULEMETRIC_CLI_VERSION: this.config.version,\n    };\n\n    // Load auth from env file if not already in environment\n    if (!env.RULEMETRIC_API_KEY && !env.RULEMETRIC_ACCESS_TOKEN) {\n      const envFile = join(homedir(), '.config', 'rulemetric', 'env');\n      if (existsSync(envFile)) {\n        for (const line of readFileSync(envFile, 'utf-8').split('\\n')) {\n          const trimmed = line.trim();\n          if (trimmed && !trimmed.startsWith('#') && trimmed.includes('=')) {\n            const [key, ...rest] = trimmed.split('=');\n            env[key] = rest.join('=');\n          }\n        }\n      }\n    }\n\n    // Ensure config dir exists\n    mkdirSync(CONFIG_DIR, { recursive: true });\n\n    // Open log file for proxy output (fd for spawn stdio)\n    appendFileSync(LOG_FILE, `\\n--- Proxy started at ${new Date().toISOString()} (port ${port}) ---\\n`);\n    const logFd = openSync(LOG_FILE, 'a');\n\n    // Spawn mitmproxy with output redirected to log file\n    const args = [\n      '--listen-port', String(port),\n      '-s', addonPath,\n      '--set', 'console_eventlog_verbosity=info',\n    ];\n    const child = spawn(binary, args, {\n      env,\n      stdio: ['ignore', logFd, logFd],\n      detached: true,\n    });\n\n    child.unref();\n\n    if (!child.pid) {\n      this.error('Failed to start proxy process');\n    }\n\n    // Brief wait to check if process crashes immediately\n    await new Promise<void>((resolve) => {\n      let exited = false;\n      child.once('exit', (code) => {\n        exited = true;\n        this.error(`Proxy exited immediately with code ${code}. Check logs:\\n  ${LOG_FILE}`);\n      });\n      setTimeout(() => {\n        if (!exited) resolve();\n      }, 500);\n    });\n\n    // Write PID file\n    writeFileSync(PID_FILE, String(child.pid));\n\n    this.log(`Proxy running on localhost:${port} (PID ${child.pid})`);\n    this.log(`Log file: ${LOG_FILE}`);\n\n    if (useWeb) {\n      this.log('');\n      this.log('Debug UI: http://localhost:8081');\n    }\n\n    this.log('');\n    this.log('View logs: rulemetric proxy logs -f');\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,UAAU,OAAO,iBAAiB;AAC3C,SAAS,gBAAgB,YAAY,WAAW,UAAU,cAAc,qBAAqB;AAC7F,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAK9B,IAAM,eAAe;AACrB,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,WAAW,KAAK,YAAY,WAAW;AAC7C,IAAM,WAAW,KAAK,YAAY,WAAW;AAC7C,IAAM,eAAe;AACrB,IAAM,mBAAmB;AAEzB,SAAS,gBAAwB;AAC/B,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,SAAS,yDAAyD;AAAA,IACtF,QAAQ,YAAY,SAAS,mEAAmE;AAAA,IAChG,QAAQ,YAAY,SAAS,yEAAyE;AAAA,EACxG;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,QAAM,IAAI;AAAA,IACR,qFACgB,WAAW,IAAI,OAAK,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,EACzD;AACF;AAEA,SAAS,qBAA6B;AACpC,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,SAAS,+BAA+B;AAAA,IAC5D,QAAQ,YAAY,SAAS,yCAAyC;AAAA,IACtE,QAAQ,YAAY,SAAS,+CAA+C;AAAA,EAC9E;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,KAAK,GAAG,YAAY,CAAC,EAAG,QAAO;AAAA,EAChD;AACA,QAAM,IAAI,MAAM,kEAAkE;AACpF;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,UAAU,UAAU,CAAC,SAAS,WAAW,YAAY,GAAG,EAAE,OAAO,SAAS,CAAC;AAC1F,SAAO,OAAO,WAAW;AAC3B;AAEA,SAAS,yBAAkC;AACzC,QAAM,SAAS,UAAU,UAAU,CAAC,aAAa,WAAW,MAAM,sBAAsB,gBAAgB,GAAG;AAAA,IACzG,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,EACpC,CAAC;AACD,SAAO,OAAO,WAAW,KAAK,OAAO,QAAQ,KAAK,MAAM;AAC1D;AAEA,IAAqB,aAArB,MAAqB,oBAAmB,YAAY;AAAA,EAClD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,MAAM,MAAM,QAAQ,EAAE,MAAM,KAAK,SAAS,cAAc,aAAa,oBAAoB,CAAC;AAAA,IAC1F,QAAQ,MAAM,QAAQ,EAAE,MAAM,KAAK,SAAS,OAAO,aAAa,kDAAkD,CAAC;AAAA,IACnH,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO,aAAa,gEAAgE,CAAC;AAAA,IACnH,eAAe,MAAM,QAAQ,EAAE,SAAS,OAAO,aAAa,2BAA2B,CAAC;AAAA,IACxF,OAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,aAAa,6BAA6B,CAAC;AAAA,EACpF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,WAAU;AAC7C,UAAM,OAAO,MAAM;AAEnB,QAAI,MAAM,QAAQ;AAChB,YAAM,KAAK,YAAY,MAAM,MAAM,KAAK;AAAA,IAC1C,OAAO;AACL,YAAM,KAAK,WAAW,MAAM,MAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IAC7D;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,MAAc,YAAoC;AAE1E,QAAI;AACF,eAAS,eAAe,EAAE,OAAO,SAAS,CAAC;AAAA,IAC7C,QAAQ;AACN,WAAK,MAAM,4DAA4D;AAAA,IACzE;AAGA,QAAI,uBAAuB,GAAG;AAC5B,WAAK,MAAM,uEAAuE;AAAA,IACpF;AAGA,UAAM,cAAc,KAAK,gBAAgB;AAGzC,UAAM,UAAU,KAAK,QAAQ,GAAG,YAAY;AAC5C,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,UAAM,SAAS,QAAQ,IAAI,UAAU;AACrC,cAAU,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAGzD,UAAM,eAAuC;AAAA,MAC3C,YAAY,OAAO,IAAI;AAAA,MACvB,yBAAyB,QAAQ,IAAI;AAAA,IACvC;AAEA,QAAI,CAAC,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,IAAI,yBAAyB;AAC3E,YAAM,UAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,KAAK;AAC9D,UAAI,WAAW,OAAO,GAAG;AACvB,mBAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,gBAAM,UAAU,KAAK,KAAK;AAC1B,cAAI,WAAW,CAAC,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAChE,kBAAM,CAAC,KAAK,GAAG,IAAI,IAAI,QAAQ,MAAM,GAAG;AACxC,yBAAa,GAAG,IAAI,KAAK,KAAK,GAAG;AAAA,UACnC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa;AAEf,YAAM,aAAa,EAAE,GAAG,QAAQ,KAAK,GAAG,aAAa;AACrD,YAAM,YAAY,aAAa,YAAY;AAC3C,YAAM,OAAO,CAAC,WAAW,MAAM,aAAa,MAAM,MAAM,OAAO;AAC/D,UAAI,WAAY,MAAK,OAAO,GAAG,GAAG,SAAS;AAE3C,WAAK,IAAI,aAAa,sDAAsD,sCAAsC;AAClH,YAAM,SAAS,UAAU,UAAU,MAAM;AAAA,QACvC,KAAK;AAAA,QACL,OAAO;AAAA,MACT,CAAC;AAED,UAAI,OAAO,WAAW,GAAG;AACvB,aAAK,MAAM,2EAA2E;AAAA,MACxF;AAAA,IACF,OAAO;AAEL,UAAI,cAAc,CAAC,kBAAkB,GAAG;AACtC,cAAM,WAAW,mBAAmB;AACpC,aAAK,IAAI,gCAAgC;AACzC,cAAM,QAAQ,UAAU,UAAU,CAAC,SAAS,MAAM,cAAc,QAAQ,GAAG,EAAE,OAAO,UAAU,CAAC;AAC/F,YAAI,MAAM,WAAW,GAAG;AACtB,eAAK,MAAM,qBAAqB;AAAA,QAClC;AAAA,MACF;AAEA,gBAAU,UAAU,CAAC,MAAM,MAAM,gBAAgB,GAAG,EAAE,OAAO,SAAS,CAAC;AAEvE,YAAM,UAAoB,CAAC;AAC3B,iBAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,YAAY,GAAG;AACrD,gBAAQ,KAAK,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE;AAAA,MACpC;AAEA,iBAAW,OAAO,CAAC,sBAAsB,sBAAsB,yBAAyB,GAAG;AACzF,YAAI,QAAQ,IAAI,GAAG,EAAG,SAAQ,KAAK,MAAM,GAAG,GAAG,IAAI,QAAQ,IAAI,GAAG,CAAC,EAAE;AAAA,MACvE;AAEA,YAAM,aAAa;AAAA,QACjB;AAAA,QAAO;AAAA,QACP;AAAA,QAAU;AAAA,QACV;AAAA,QAAM,GAAG,IAAI;AAAA,QACb;AAAA,QAAM,GAAG,OAAO;AAAA,QAChB;AAAA,QAAM,GAAG,KAAK,QAAQ,YAAY,CAAC;AAAA,QACnC,GAAG;AAAA,QACH;AAAA,MACF;AAEA,YAAM,SAAS,UAAU,UAAU,YAAY,EAAE,UAAU,SAAS,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACvG,UAAI,OAAO,WAAW,GAAG;AACvB,aAAK,MAAM,8BAA8B,OAAO,MAAM,EAAE;AAAA,MAC1D;AAAA,IACF;AAGA,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACzC,kBAAc,UAAU,UAAU,gBAAgB,EAAE;AAGpD,UAAM,IAAI,QAAQ,CAAAA,aAAW,WAAWA,UAAS,GAAI,CAAC;AAEtD,UAAM,gBAAgB,UAAU,UAAU,CAAC,aAAa,WAAW,MAAM,WAAW,gBAAgB,GAAG;AAAA,MACrG,UAAU;AAAA,MAAS,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACvD,CAAC;AACD,UAAM,cAAc,cAAc,QAAQ,KAAK,EAAE,MAAM,GAAG,EAAE,KAAK;AAEjE,SAAK,IAAI,wCAAwC,IAAI,gBAAgB,WAAW,GAAG;AAEnF,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,qCAAqC;AAAA,EAChD;AAAA,EAEQ,kBAAiC;AACvC,UAAM,aAAa;AAAA,MACjB,KAAK,QAAQ,IAAI,GAAG,oBAAoB;AAAA,MACxC,QAAQ,YAAY,SAAS,mCAAmC;AAAA,IAClE;AACA,eAAW,KAAK,YAAY;AAC1B,UAAI,WAAW,CAAC,EAAG,QAAO;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,MAAc,QAAiB,YAAoC;AAE1F,QAAI,WAAW,QAAQ,GAAG;AACxB,YAAM,UAAU,aAAa,UAAU,OAAO,EAAE,KAAK;AACrD,UAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,aAAK,MAAM,kEAAkE;AAAA,MAC/E;AACA,YAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AACvC,UAAI,CAAC,OAAO,MAAM,GAAG,GAAG;AACtB,YAAI;AACF,kBAAQ,KAAK,KAAK,CAAC;AACnB,eAAK,MAAM,8BAA8B,GAAG,yCAAyC;AAAA,QACvF,QAAQ;AAAA,QAA4B;AAAA,MACtC;AAAA,IACF;AAGA,UAAM,SAAS,SAAS,YAAY;AACpC,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AAAA,QACH,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKX;AAAA,IACF;AAGA,QAAI,CAAC,YAAY;AACf,YAAM,WAAqB,CAAC;AAE5B,UAAI,CAAC,gBAAgB,KAAK,CAAC,QAAQ,IAAI,oBAAoB;AACzD,cAAM,UAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,KAAK;AAC9D,YAAI,aAAa;AACjB,YAAI,WAAW,OAAO,GAAG;AACvB,gBAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,uBAAa,QAAQ,SAAS,oBAAoB,KAAK,QAAQ,SAAS,yBAAyB;AAAA,QACnG;AACA,YAAI,CAAC,YAAY;AACf,mBAAS,KAAK,mFAA8E;AAAA,QAC9F;AAAA,MACF;AAEA,YAAM,WAAW,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AACtE,UAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,iBAAS,KAAK,qFAAgF;AAAA,MAChG;AAEA,YAAM,eAAe,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe;AACnE,UAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,iBAAS,KAAK,sGAAkG;AAAA,MAClH;AAEA,UAAI,SAAS,SAAS,GAAG;AACvB,mBAAW,KAAK,UAAU;AACxB,eAAK,IAAI,cAAc,CAAC,EAAE;AAAA,QAC5B;AACA,aAAK,IAAI,EAAE;AAAA,MACb;AAAA,IACF;AAGA,UAAM,YAAY,cAAc;AAGhC,UAAM,MAA0C;AAAA,MAC9C,GAAG,QAAQ;AAAA,MACX,yBAAyB,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,MAIrC,wBAAwB,KAAK,OAAO;AAAA,IACtC;AAGA,QAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,yBAAyB;AAC3D,YAAM,UAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,KAAK;AAC9D,UAAI,WAAW,OAAO,GAAG;AACvB,mBAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,gBAAM,UAAU,KAAK,KAAK;AAC1B,cAAI,WAAW,CAAC,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAChE,kBAAM,CAAC,KAAK,GAAG,IAAI,IAAI,QAAQ,MAAM,GAAG;AACxC,gBAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AAGzC,mBAAe,UAAU;AAAA,wBAA0B,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,IAAI;AAAA,CAAS;AAClG,UAAM,QAAQ,SAAS,UAAU,GAAG;AAGpC,UAAM,OAAO;AAAA,MACX;AAAA,MAAiB,OAAO,IAAI;AAAA,MAC5B;AAAA,MAAM;AAAA,MACN;AAAA,MAAS;AAAA,IACX;AACA,UAAM,QAAQ,MAAM,QAAQ,MAAM;AAAA,MAChC;AAAA,MACA,OAAO,CAAC,UAAU,OAAO,KAAK;AAAA,MAC9B,UAAU;AAAA,IACZ,CAAC;AAED,UAAM,MAAM;AAEZ,QAAI,CAAC,MAAM,KAAK;AACd,WAAK,MAAM,+BAA+B;AAAA,IAC5C;AAGA,UAAM,IAAI,QAAc,CAACA,aAAY;AACnC,UAAI,SAAS;AACb,YAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,iBAAS;AACT,aAAK,MAAM,sCAAsC,IAAI;AAAA,IAAoB,QAAQ,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW,MAAM;AACf,YAAI,CAAC,OAAQ,CAAAA,SAAQ;AAAA,MACvB,GAAG,GAAG;AAAA,IACR,CAAC;AAGD,kBAAc,UAAU,OAAO,MAAM,GAAG,CAAC;AAEzC,SAAK,IAAI,8BAA8B,IAAI,SAAS,MAAM,GAAG,GAAG;AAChE,SAAK,IAAI,aAAa,QAAQ,EAAE;AAEhC,QAAI,QAAQ;AACV,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,iCAAiC;AAAA,IAC5C;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,qCAAqC;AAAA,EAChD;AACF;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execSync, spawn, spawnSync } from 'node:child_process';\nimport { appendFileSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { BaseCommand } from '../../base-command.js';\nimport { isAuthenticated } from '../../lib/auth.js';\nimport { findBinary } from '../../lib/which.js';\n\n// import.meta.dirname is undefined on Node < 20.11 (breaks resolve()); derive\n// portably. See onboarding field report 2026-07-07 F1.\nconst MODULE_DIR = dirname(fileURLToPath(import.meta.url));\n\nconst DEFAULT_PORT = 8788;\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst PID_FILE = join(CONFIG_DIR, 'proxy.pid');\nconst LOG_FILE = join(CONFIG_DIR, 'proxy.log');\nconst DOCKER_IMAGE = 'rulemetric/proxy';\nconst DOCKER_CONTAINER = 'rulemetric-proxy';\n\nfunction findAddonPath(): string {\n  const candidates = [\n    resolve(MODULE_DIR, '../../../../../packages/proxy/addon/rulemetric_addon.py'),\n    resolve(MODULE_DIR, '../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py'),\n    resolve(MODULE_DIR, '../../../../../node_modules/@rulemetric/proxy/addon/rulemetric_addon.py'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(p)) return p;\n  }\n  throw new Error(\n    'Could not find rulemetric_addon.py. Is @rulemetric/proxy installed?\\n' +\n    'Searched:\\n' + candidates.map(c => `  ${c}`).join('\\n'),\n  );\n}\n\nfunction findDockerfilePath(): string {\n  const candidates = [\n    resolve(MODULE_DIR, '../../../../../packages/proxy'),\n    resolve(MODULE_DIR, '../../../node_modules/@rulemetric/proxy'),\n    resolve(MODULE_DIR, '../../../../../node_modules/@rulemetric/proxy'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(join(p, 'Dockerfile'))) return p;\n  }\n  throw new Error('Could not find proxy Dockerfile. Is @rulemetric/proxy installed?');\n}\n\nfunction dockerImageExists(): boolean {\n  const result = spawnSync('docker', ['image', 'inspect', DOCKER_IMAGE], { stdio: 'ignore' });\n  return result.status === 0;\n}\n\nfunction dockerContainerRunning(): boolean {\n  const result = spawnSync('docker', ['container', 'inspect', '-f', '{{.State.Running}}', DOCKER_CONTAINER], {\n    encoding: 'utf-8',\n    stdio: ['ignore', 'pipe', 'ignore'],\n  });\n  return result.status === 0 && result.stdout?.trim() === 'true';\n}\n\nexport default class ProxyStart extends BaseCommand {\n  static override description = 'Start context capture proxy';\n\n  static override examples = [\n    '<%= config.bin %> proxy start',\n    '<%= config.bin %> proxy start --docker',\n    '<%= config.bin %> proxy start --port 9090',\n    '<%= config.bin %> proxy start --web',\n  ];\n\n  static override flags = {\n    port: Flags.integer({ char: 'p', default: DEFAULT_PORT, description: 'Proxy listen port' }),\n    docker: Flags.boolean({ char: 'd', default: false, description: 'Run proxy in Docker (no local mitmproxy needed)' }),\n    web: Flags.boolean({ default: false, description: 'Launch mitmweb debug UI instead of mitmdump (local mode only)' }),\n    'skip-checks': Flags.boolean({ default: false, description: 'Skip prerequisite checks' }),\n    build: Flags.boolean({ default: false, description: 'Force rebuild Docker image' }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(ProxyStart);\n    const port = flags.port;\n\n    if (flags.docker) {\n      await this.startDocker(port, flags.build);\n    } else {\n      await this.startLocal(port, flags.web, flags['skip-checks']);\n    }\n  }\n\n  private async startDocker(port: number, forceBuild: boolean): Promise<void> {\n    // Check Docker is available\n    try {\n      execSync('docker info', { stdio: 'ignore' });\n    } catch {\n      this.error('Docker is not running. Start Docker Desktop and try again.');\n    }\n\n    // Check if already running\n    if (dockerContainerRunning()) {\n      this.error(`Proxy container already running. Stop it first: rulemetric proxy stop`);\n    }\n\n    // Find the compose file (monorepo root or project root)\n    const composeFile = this.findComposeFile();\n\n    // Ensure mount dirs exist\n    const certDir = join(homedir(), '.mitmproxy');\n    mkdirSync(certDir, { recursive: true });\n    const tmpDir = process.env.TMPDIR || '/tmp';\n    mkdirSync(join(tmpDir, 'rulemetric'), { recursive: true });\n\n    // Load auth from env file if not in environment\n    const envOverrides: Record<string, string> = {\n      PROXY_PORT: String(port),\n      RULEMETRIC_PROJECT_PATH: process.cwd(),\n    };\n\n    if (!process.env.RULEMETRIC_API_KEY && !process.env.RULEMETRIC_ACCESS_TOKEN) {\n      const envFile = join(homedir(), '.config', 'rulemetric', 'env');\n      if (existsSync(envFile)) {\n        for (const line of readFileSync(envFile, 'utf-8').split('\\n')) {\n          const trimmed = line.trim();\n          if (trimmed && !trimmed.startsWith('#') && trimmed.includes('=')) {\n            const [key, ...rest] = trimmed.split('=');\n            envOverrides[key] = rest.join('=');\n          }\n        }\n      }\n    }\n\n    if (composeFile) {\n      // Use docker compose\n      const composeEnv = { ...process.env, ...envOverrides };\n      const buildFlag = forceBuild ? '--build' : '';\n      const args = ['compose', '-f', composeFile, 'up', '-d', 'proxy'];\n      if (forceBuild) args.splice(4, 0, '--build');\n\n      this.log(forceBuild ? 'Building and starting proxy via Docker Compose...' : 'Starting proxy via Docker Compose...');\n      const result = spawnSync('docker', args, {\n        env: composeEnv,\n        stdio: 'inherit',\n      });\n\n      if (result.status !== 0) {\n        this.error('Docker Compose failed. Try: docker compose -f docker-compose.yml up proxy');\n      }\n    } else {\n      // Fallback: raw docker run\n      if (forceBuild || !dockerImageExists()) {\n        const proxyDir = findDockerfilePath();\n        this.log('Building proxy Docker image...');\n        const build = spawnSync('docker', ['build', '-t', DOCKER_IMAGE, proxyDir], { stdio: 'inherit' });\n        if (build.status !== 0) {\n          this.error('Docker build failed');\n        }\n      }\n\n      spawnSync('docker', ['rm', '-f', DOCKER_CONTAINER], { stdio: 'ignore' });\n\n      const envArgs: string[] = [];\n      for (const [key, val] of Object.entries(envOverrides)) {\n        envArgs.push('-e', `${key}=${val}`);\n      }\n      // Pass through from current env\n      for (const key of ['RULEMETRIC_API_URL', 'RULEMETRIC_API_KEY', 'RULEMETRIC_ACCESS_TOKEN']) {\n        if (process.env[key]) envArgs.push('-e', `${key}=${process.env[key]}`);\n      }\n\n      const dockerArgs = [\n        'run', '-d',\n        '--name', DOCKER_CONTAINER,\n        '-p', `${port}:8787`,\n        '-v', `${certDir}:/root/.mitmproxy`,\n        '-v', `${join(tmpDir, 'rulemetric')}:/tmp/rulemetric:ro`,\n        ...envArgs,\n        DOCKER_IMAGE,\n      ];\n\n      const result = spawnSync('docker', dockerArgs, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });\n      if (result.status !== 0) {\n        this.error(`Failed to start container: ${result.stderr}`);\n      }\n    }\n\n    // Write marker so proxy stop knows it's Docker\n    mkdirSync(CONFIG_DIR, { recursive: true });\n    writeFileSync(PID_FILE, `docker:${DOCKER_CONTAINER}`);\n\n    // Wait for container to be ready\n    await new Promise(resolve => setTimeout(resolve, 2000));\n\n    const inspectResult = spawnSync('docker', ['container', 'inspect', '-f', '{{.Id}}', DOCKER_CONTAINER], {\n      encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],\n    });\n    const containerId = inspectResult.stdout?.trim().slice(0, 12) || 'unknown';\n\n    this.log(`Proxy running in Docker on localhost:${port} (container: ${containerId})`);\n\n    this.log('');\n    this.log('View logs: rulemetric proxy logs -f');\n  }\n\n  private findComposeFile(): string | null {\n    const candidates = [\n      join(process.cwd(), 'docker-compose.yml'),\n      resolve(MODULE_DIR, '../../../../../docker-compose.yml'),\n    ];\n    for (const p of candidates) {\n      if (existsSync(p)) return p;\n    }\n    return null;\n  }\n\n  private async startLocal(port: number, useWeb: boolean, skipChecks: boolean): Promise<void> {\n    // Check if already running\n    if (existsSync(PID_FILE)) {\n      const content = readFileSync(PID_FILE, 'utf-8').trim();\n      if (content.startsWith('docker:')) {\n        this.error('Proxy is running in Docker. Stop it first: rulemetric proxy stop');\n      }\n      const pid = Number.parseInt(content, 10);\n      if (!Number.isNaN(pid)) {\n        try {\n          process.kill(pid, 0);\n          this.error(`Proxy already running (PID ${pid}). Stop it first: rulemetric proxy stop`);\n        } catch { /* stale PID, continue */ }\n      }\n    }\n\n    // Check mitmproxy is installed (portable PATH scan \u2014 Windows has no `which`)\n    const binary = useWeb ? 'mitmweb' : 'mitmdump';\n    if (!findBinary(binary)) {\n      this.error(\n        `${binary} not found. Use Docker mode instead:\\n` +\n        '  rulemetric proxy start --docker\\n\\n' +\n        'Or install mitmproxy locally:\\n' +\n        '  pipx install mitmproxy\\n' +\n        '  brew install mitmproxy',\n      );\n    }\n\n    // Prerequisite warnings (non-blocking)\n    if (!skipChecks) {\n      const warnings: string[] = [];\n\n      if (!isAuthenticated() && !process.env.RULEMETRIC_API_KEY) {\n        const envFile = join(homedir(), '.config', 'rulemetric', 'env');\n        let hasEnvAuth = false;\n        if (existsSync(envFile)) {\n          const content = readFileSync(envFile, 'utf-8');\n          hasEnvAuth = content.includes('RULEMETRIC_API_KEY') || content.includes('RULEMETRIC_ACCESS_TOKEN');\n        }\n        if (!hasEnvAuth) {\n          warnings.push('Not authenticated \u2014 snapshots cannot be stored. Run `rulemetric auth login`.');\n        }\n      }\n\n      const certPath = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n      if (!existsSync(certPath)) {\n        warnings.push('CA cert not found \u2014 HTTPS interception may fail. Run `rulemetric proxy setup`.');\n      }\n\n      const settingsPath = join(process.cwd(), '.claude', 'settings.json');\n      if (!existsSync(settingsPath)) {\n        warnings.push('Session hooks not installed \u2014 snapshots won\\'t link to sessions. Run `rulemetric hooks install`.');\n      }\n\n      if (warnings.length > 0) {\n        for (const w of warnings) {\n          this.log(`  Warning: ${w}`);\n        }\n        this.log('');\n      }\n    }\n\n    // Find addon\n    const addonPath = findAddonPath();\n\n    // Build env \u2014 pass through auth credentials for the reporter\n    const env: Record<string, string | undefined> = {\n      ...process.env,\n      RULEMETRIC_PROJECT_PATH: process.cwd(),\n      // Bound to this CLI binary's version. The addon writes this to a\n      // version file the gateway watches; on drift the gateway restarts\n      // mitmproxy so an upgraded CLI doesn't sit next to a stale proxy.\n      RULEMETRIC_CLI_VERSION: this.config.version,\n    };\n\n    // Load auth from env file if not already in environment\n    if (!env.RULEMETRIC_API_KEY && !env.RULEMETRIC_ACCESS_TOKEN) {\n      const envFile = join(homedir(), '.config', 'rulemetric', 'env');\n      if (existsSync(envFile)) {\n        for (const line of readFileSync(envFile, 'utf-8').split('\\n')) {\n          const trimmed = line.trim();\n          if (trimmed && !trimmed.startsWith('#') && trimmed.includes('=')) {\n            const [key, ...rest] = trimmed.split('=');\n            env[key] = rest.join('=');\n          }\n        }\n      }\n    }\n\n    // Ensure config dir exists\n    mkdirSync(CONFIG_DIR, { recursive: true });\n\n    // Open log file for proxy output (fd for spawn stdio)\n    appendFileSync(LOG_FILE, `\\n--- Proxy started at ${new Date().toISOString()} (port ${port}) ---\\n`);\n    const logFd = openSync(LOG_FILE, 'a');\n\n    // Spawn mitmproxy with output redirected to log file\n    const args = [\n      '--listen-port', String(port),\n      '-s', addonPath,\n      '--set', 'console_eventlog_verbosity=info',\n    ];\n    const child = spawn(binary, args, {\n      env,\n      stdio: ['ignore', logFd, logFd],\n      detached: true,\n    });\n\n    child.unref();\n\n    if (!child.pid) {\n      this.error('Failed to start proxy process');\n    }\n\n    // Brief wait to check if process crashes immediately\n    await new Promise<void>((resolve) => {\n      let exited = false;\n      child.once('exit', (code) => {\n        exited = true;\n        this.error(`Proxy exited immediately with code ${code}. Check logs:\\n  ${LOG_FILE}`);\n      });\n      setTimeout(() => {\n        if (!exited) resolve();\n      }, 500);\n    });\n\n    // Write PID file\n    writeFileSync(PID_FILE, String(child.pid));\n\n    this.log(`Proxy running on localhost:${port} (PID ${child.pid})`);\n    this.log(`Log file: ${LOG_FILE}`);\n\n    if (useWeb) {\n      this.log('');\n      this.log('Debug UI: http://localhost:8081');\n    }\n\n    this.log('');\n    this.log('View logs: rulemetric proxy logs -f');\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,UAAU,OAAO,iBAAiB;AAC3C,SAAS,gBAAgB,YAAY,WAAW,UAAU,cAAc,qBAAqB;AAC7F,SAAS,eAAe;AACxB,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,qBAAqB;AAO9B,IAAM,aAAa,QAAQ,cAAc,YAAY,GAAG,CAAC;AAEzD,IAAM,eAAe;AACrB,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,WAAW,KAAK,YAAY,WAAW;AAC7C,IAAM,WAAW,KAAK,YAAY,WAAW;AAC7C,IAAM,eAAe;AACrB,IAAM,mBAAmB;AAEzB,SAAS,gBAAwB;AAC/B,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,yDAAyD;AAAA,IAC7E,QAAQ,YAAY,mEAAmE;AAAA,IACvF,QAAQ,YAAY,yEAAyE;AAAA,EAC/F;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,QAAM,IAAI;AAAA,IACR,qFACgB,WAAW,IAAI,OAAK,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,EACzD;AACF;AAEA,SAAS,qBAA6B;AACpC,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,+BAA+B;AAAA,IACnD,QAAQ,YAAY,yCAAyC;AAAA,IAC7D,QAAQ,YAAY,+CAA+C;AAAA,EACrE;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,KAAK,GAAG,YAAY,CAAC,EAAG,QAAO;AAAA,EAChD;AACA,QAAM,IAAI,MAAM,kEAAkE;AACpF;AAEA,SAAS,oBAA6B;AACpC,QAAM,SAAS,UAAU,UAAU,CAAC,SAAS,WAAW,YAAY,GAAG,EAAE,OAAO,SAAS,CAAC;AAC1F,SAAO,OAAO,WAAW;AAC3B;AAEA,SAAS,yBAAkC;AACzC,QAAM,SAAS,UAAU,UAAU,CAAC,aAAa,WAAW,MAAM,sBAAsB,gBAAgB,GAAG;AAAA,IACzG,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,EACpC,CAAC;AACD,SAAO,OAAO,WAAW,KAAK,OAAO,QAAQ,KAAK,MAAM;AAC1D;AAEA,IAAqB,aAArB,MAAqB,oBAAmB,YAAY;AAAA,EAClD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,MAAM,MAAM,QAAQ,EAAE,MAAM,KAAK,SAAS,cAAc,aAAa,oBAAoB,CAAC;AAAA,IAC1F,QAAQ,MAAM,QAAQ,EAAE,MAAM,KAAK,SAAS,OAAO,aAAa,kDAAkD,CAAC;AAAA,IACnH,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO,aAAa,gEAAgE,CAAC;AAAA,IACnH,eAAe,MAAM,QAAQ,EAAE,SAAS,OAAO,aAAa,2BAA2B,CAAC;AAAA,IACxF,OAAO,MAAM,QAAQ,EAAE,SAAS,OAAO,aAAa,6BAA6B,CAAC;AAAA,EACpF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,WAAU;AAC7C,UAAM,OAAO,MAAM;AAEnB,QAAI,MAAM,QAAQ;AAChB,YAAM,KAAK,YAAY,MAAM,MAAM,KAAK;AAAA,IAC1C,OAAO;AACL,YAAM,KAAK,WAAW,MAAM,MAAM,KAAK,MAAM,aAAa,CAAC;AAAA,IAC7D;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,MAAc,YAAoC;AAE1E,QAAI;AACF,eAAS,eAAe,EAAE,OAAO,SAAS,CAAC;AAAA,IAC7C,QAAQ;AACN,WAAK,MAAM,4DAA4D;AAAA,IACzE;AAGA,QAAI,uBAAuB,GAAG;AAC5B,WAAK,MAAM,uEAAuE;AAAA,IACpF;AAGA,UAAM,cAAc,KAAK,gBAAgB;AAGzC,UAAM,UAAU,KAAK,QAAQ,GAAG,YAAY;AAC5C,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,UAAM,SAAS,QAAQ,IAAI,UAAU;AACrC,cAAU,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAGzD,UAAM,eAAuC;AAAA,MAC3C,YAAY,OAAO,IAAI;AAAA,MACvB,yBAAyB,QAAQ,IAAI;AAAA,IACvC;AAEA,QAAI,CAAC,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,IAAI,yBAAyB;AAC3E,YAAM,UAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,KAAK;AAC9D,UAAI,WAAW,OAAO,GAAG;AACvB,mBAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,gBAAM,UAAU,KAAK,KAAK;AAC1B,cAAI,WAAW,CAAC,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAChE,kBAAM,CAAC,KAAK,GAAG,IAAI,IAAI,QAAQ,MAAM,GAAG;AACxC,yBAAa,GAAG,IAAI,KAAK,KAAK,GAAG;AAAA,UACnC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa;AAEf,YAAM,aAAa,EAAE,GAAG,QAAQ,KAAK,GAAG,aAAa;AACrD,YAAM,YAAY,aAAa,YAAY;AAC3C,YAAM,OAAO,CAAC,WAAW,MAAM,aAAa,MAAM,MAAM,OAAO;AAC/D,UAAI,WAAY,MAAK,OAAO,GAAG,GAAG,SAAS;AAE3C,WAAK,IAAI,aAAa,sDAAsD,sCAAsC;AAClH,YAAM,SAAS,UAAU,UAAU,MAAM;AAAA,QACvC,KAAK;AAAA,QACL,OAAO;AAAA,MACT,CAAC;AAED,UAAI,OAAO,WAAW,GAAG;AACvB,aAAK,MAAM,2EAA2E;AAAA,MACxF;AAAA,IACF,OAAO;AAEL,UAAI,cAAc,CAAC,kBAAkB,GAAG;AACtC,cAAM,WAAW,mBAAmB;AACpC,aAAK,IAAI,gCAAgC;AACzC,cAAM,QAAQ,UAAU,UAAU,CAAC,SAAS,MAAM,cAAc,QAAQ,GAAG,EAAE,OAAO,UAAU,CAAC;AAC/F,YAAI,MAAM,WAAW,GAAG;AACtB,eAAK,MAAM,qBAAqB;AAAA,QAClC;AAAA,MACF;AAEA,gBAAU,UAAU,CAAC,MAAM,MAAM,gBAAgB,GAAG,EAAE,OAAO,SAAS,CAAC;AAEvE,YAAM,UAAoB,CAAC;AAC3B,iBAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,YAAY,GAAG;AACrD,gBAAQ,KAAK,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE;AAAA,MACpC;AAEA,iBAAW,OAAO,CAAC,sBAAsB,sBAAsB,yBAAyB,GAAG;AACzF,YAAI,QAAQ,IAAI,GAAG,EAAG,SAAQ,KAAK,MAAM,GAAG,GAAG,IAAI,QAAQ,IAAI,GAAG,CAAC,EAAE;AAAA,MACvE;AAEA,YAAM,aAAa;AAAA,QACjB;AAAA,QAAO;AAAA,QACP;AAAA,QAAU;AAAA,QACV;AAAA,QAAM,GAAG,IAAI;AAAA,QACb;AAAA,QAAM,GAAG,OAAO;AAAA,QAChB;AAAA,QAAM,GAAG,KAAK,QAAQ,YAAY,CAAC;AAAA,QACnC,GAAG;AAAA,QACH;AAAA,MACF;AAEA,YAAM,SAAS,UAAU,UAAU,YAAY,EAAE,UAAU,SAAS,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AACvG,UAAI,OAAO,WAAW,GAAG;AACvB,aAAK,MAAM,8BAA8B,OAAO,MAAM,EAAE;AAAA,MAC1D;AAAA,IACF;AAGA,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACzC,kBAAc,UAAU,UAAU,gBAAgB,EAAE;AAGpD,UAAM,IAAI,QAAQ,CAAAA,aAAW,WAAWA,UAAS,GAAI,CAAC;AAEtD,UAAM,gBAAgB,UAAU,UAAU,CAAC,aAAa,WAAW,MAAM,WAAW,gBAAgB,GAAG;AAAA,MACrG,UAAU;AAAA,MAAS,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACvD,CAAC;AACD,UAAM,cAAc,cAAc,QAAQ,KAAK,EAAE,MAAM,GAAG,EAAE,KAAK;AAEjE,SAAK,IAAI,wCAAwC,IAAI,gBAAgB,WAAW,GAAG;AAEnF,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,qCAAqC;AAAA,EAChD;AAAA,EAEQ,kBAAiC;AACvC,UAAM,aAAa;AAAA,MACjB,KAAK,QAAQ,IAAI,GAAG,oBAAoB;AAAA,MACxC,QAAQ,YAAY,mCAAmC;AAAA,IACzD;AACA,eAAW,KAAK,YAAY;AAC1B,UAAI,WAAW,CAAC,EAAG,QAAO;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WAAW,MAAc,QAAiB,YAAoC;AAE1F,QAAI,WAAW,QAAQ,GAAG;AACxB,YAAM,UAAU,aAAa,UAAU,OAAO,EAAE,KAAK;AACrD,UAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,aAAK,MAAM,kEAAkE;AAAA,MAC/E;AACA,YAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AACvC,UAAI,CAAC,OAAO,MAAM,GAAG,GAAG;AACtB,YAAI;AACF,kBAAQ,KAAK,KAAK,CAAC;AACnB,eAAK,MAAM,8BAA8B,GAAG,yCAAyC;AAAA,QACvF,QAAQ;AAAA,QAA4B;AAAA,MACtC;AAAA,IACF;AAGA,UAAM,SAAS,SAAS,YAAY;AACpC,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AAAA,QACH,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKX;AAAA,IACF;AAGA,QAAI,CAAC,YAAY;AACf,YAAM,WAAqB,CAAC;AAE5B,UAAI,CAAC,gBAAgB,KAAK,CAAC,QAAQ,IAAI,oBAAoB;AACzD,cAAM,UAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,KAAK;AAC9D,YAAI,aAAa;AACjB,YAAI,WAAW,OAAO,GAAG;AACvB,gBAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,uBAAa,QAAQ,SAAS,oBAAoB,KAAK,QAAQ,SAAS,yBAAyB;AAAA,QACnG;AACA,YAAI,CAAC,YAAY;AACf,mBAAS,KAAK,mFAA8E;AAAA,QAC9F;AAAA,MACF;AAEA,YAAM,WAAW,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AACtE,UAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,iBAAS,KAAK,qFAAgF;AAAA,MAChG;AAEA,YAAM,eAAe,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe;AACnE,UAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,iBAAS,KAAK,sGAAkG;AAAA,MAClH;AAEA,UAAI,SAAS,SAAS,GAAG;AACvB,mBAAW,KAAK,UAAU;AACxB,eAAK,IAAI,cAAc,CAAC,EAAE;AAAA,QAC5B;AACA,aAAK,IAAI,EAAE;AAAA,MACb;AAAA,IACF;AAGA,UAAM,YAAY,cAAc;AAGhC,UAAM,MAA0C;AAAA,MAC9C,GAAG,QAAQ;AAAA,MACX,yBAAyB,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,MAIrC,wBAAwB,KAAK,OAAO;AAAA,IACtC;AAGA,QAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,yBAAyB;AAC3D,YAAM,UAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,KAAK;AAC9D,UAAI,WAAW,OAAO,GAAG;AACvB,mBAAW,QAAQ,aAAa,SAAS,OAAO,EAAE,MAAM,IAAI,GAAG;AAC7D,gBAAM,UAAU,KAAK,KAAK;AAC1B,cAAI,WAAW,CAAC,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAChE,kBAAM,CAAC,KAAK,GAAG,IAAI,IAAI,QAAQ,MAAM,GAAG;AACxC,gBAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AAGzC,mBAAe,UAAU;AAAA,wBAA0B,oBAAI,KAAK,GAAE,YAAY,CAAC,UAAU,IAAI;AAAA,CAAS;AAClG,UAAM,QAAQ,SAAS,UAAU,GAAG;AAGpC,UAAM,OAAO;AAAA,MACX;AAAA,MAAiB,OAAO,IAAI;AAAA,MAC5B;AAAA,MAAM;AAAA,MACN;AAAA,MAAS;AAAA,IACX;AACA,UAAM,QAAQ,MAAM,QAAQ,MAAM;AAAA,MAChC;AAAA,MACA,OAAO,CAAC,UAAU,OAAO,KAAK;AAAA,MAC9B,UAAU;AAAA,IACZ,CAAC;AAED,UAAM,MAAM;AAEZ,QAAI,CAAC,MAAM,KAAK;AACd,WAAK,MAAM,+BAA+B;AAAA,IAC5C;AAGA,UAAM,IAAI,QAAc,CAACA,aAAY;AACnC,UAAI,SAAS;AACb,YAAM,KAAK,QAAQ,CAAC,SAAS;AAC3B,iBAAS;AACT,aAAK,MAAM,sCAAsC,IAAI;AAAA,IAAoB,QAAQ,EAAE;AAAA,MACrF,CAAC;AACD,iBAAW,MAAM;AACf,YAAI,CAAC,OAAQ,CAAAA,SAAQ;AAAA,MACvB,GAAG,GAAG;AAAA,IACR,CAAC;AAGD,kBAAc,UAAU,OAAO,MAAM,GAAG,CAAC;AAEzC,SAAK,IAAI,8BAA8B,IAAI,SAAS,MAAM,GAAG,GAAG;AAChE,SAAK,IAAI,aAAa,QAAQ,EAAE;AAEhC,QAAI,QAAQ;AACV,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,iCAAiC;AAAA,IAC5C;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,qCAAqC;AAAA,EAChD;AACF;",
   "names": ["resolve"]
 }

package/dist/commands/proxy/status.js

@@ -3,7 +3,7 @@ import {
   MITMPROXY_PORT,
   getGatewayPid,
   isGatewayRunning
-} from "../../chunk-OVGP4OGK.js";
+} from "../../chunk-DAJNO4OI.js";
 import {
   BaseCommand
 } from "../../chunk-SZ7VDCD6.js";

package/dist/commands/proxy/stop.js

@@ -12,7 +12,9 @@ import "../../chunk-NSBPE2FW.js";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
 var PID_FILE = join(CONFIG_DIR, "proxy.pid");
 var ProxyStop = class _ProxyStop extends BaseCommand {
@@ -69,7 +71,7 @@ var ProxyStop = class _ProxyStop extends BaseCommand {
   findComposeFile() {
     const candidates = [
       join(process.cwd(), "docker-compose.yml"),
-      resolve(import.meta.dirname, "../../../../../docker-compose.yml")
+      resolve(MODULE_DIR, "../../../../../docker-compose.yml")
     ];
     for (const p of candidates) {
       if (existsSync(p)) return p;

package/dist/commands/proxy/stop.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/proxy/stop.ts"],
-  "sourcesContent": ["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync, unlinkSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\n\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst PID_FILE = join(CONFIG_DIR, 'proxy.pid');\n\nexport default class ProxyStop extends BaseCommand {\n  static override description = 'Stop the context capture proxy';\n\n  static override examples = ['<%= config.bin %> proxy stop'];\n\n  async run(): Promise<void> {\n    await this.parse(ProxyStop);\n\n    if (!existsSync(PID_FILE)) {\n      this.log('No proxy process found (no PID file).');\n      return;\n    }\n\n    const content = readFileSync(PID_FILE, 'utf-8').trim();\n\n    // Docker mode: PID file contains \"docker:<container-name>\"\n    if (content.startsWith('docker:')) {\n      const containerName = content.slice('docker:'.length);\n      // Try docker compose first, fall back to docker stop\n      const composeFile = this.findComposeFile();\n      if (composeFile) {\n        spawnSync('docker', ['compose', '-f', composeFile, 'stop', 'proxy'], { stdio: 'inherit' });\n        spawnSync('docker', ['compose', '-f', composeFile, 'rm', '-f', 'proxy'], { stdio: 'ignore' });\n      } else {\n        spawnSync('docker', ['stop', containerName], { stdio: 'ignore' });\n        spawnSync('docker', ['rm', containerName], { stdio: 'ignore' });\n      }\n      this.log(`Proxy container stopped.`);\n      try { unlinkSync(PID_FILE); } catch { /* already gone */ }\n      return;\n    }\n\n    // Local mode: PID file contains a process ID\n    const pid = Number.parseInt(content, 10);\n\n    if (Number.isNaN(pid)) {\n      unlinkSync(PID_FILE);\n      this.log('Invalid PID file removed.');\n      return;\n    }\n\n    try {\n      process.kill(pid, 'SIGTERM');\n      this.log(`Proxy stopped (PID ${pid}).`);\n    } catch (err: unknown) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === 'ESRCH') {\n        this.log('Proxy process not running (stale PID file removed).');\n      } else {\n        this.error(`Failed to stop proxy: ${(err as Error).message}`);\n      }\n    }\n\n    try { unlinkSync(PID_FILE); } catch { /* already gone */ }\n\n    this.log('');\n    this.log('Gateway is still running \u2014 Claude Code will route direct until proxy restarts.');\n  }\n\n  private findComposeFile(): string | null {\n    const candidates = [\n      join(process.cwd(), 'docker-compose.yml'),\n      resolve(import.meta.dirname, '../../../../../docker-compose.yml'),\n    ];\n    for (const p of candidates) {\n      if (existsSync(p)) return p;\n    }\n    return null;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;AAAA,SAAS,iBAAiB;AAC1B,SAAS,YAAY,cAAc,kBAAkB;AACrD,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAG9B,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,WAAW,KAAK,YAAY,WAAW;AAE7C,IAAqB,YAArB,MAAqB,mBAAkB,YAAY;AAAA,EACjD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW,CAAC,8BAA8B;AAAA,EAE1D,MAAM,MAAqB;AACzB,UAAM,KAAK,MAAM,UAAS;AAE1B,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,IAAI,uCAAuC;AAChD;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,UAAU,OAAO,EAAE,KAAK;AAGrD,QAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,YAAM,gBAAgB,QAAQ,MAAM,UAAU,MAAM;AAEpD,YAAM,cAAc,KAAK,gBAAgB;AACzC,UAAI,aAAa;AACf,kBAAU,UAAU,CAAC,WAAW,MAAM,aAAa,QAAQ,OAAO,GAAG,EAAE,OAAO,UAAU,CAAC;AACzF,kBAAU,UAAU,CAAC,WAAW,MAAM,aAAa,MAAM,MAAM,OAAO,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,MAC9F,OAAO;AACL,kBAAU,UAAU,CAAC,QAAQ,aAAa,GAAG,EAAE,OAAO,SAAS,CAAC;AAChE,kBAAU,UAAU,CAAC,MAAM,aAAa,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,MAChE;AACA,WAAK,IAAI,0BAA0B;AACnC,UAAI;AAAE,mBAAW,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAAqB;AACzD;AAAA,IACF;AAGA,UAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAEvC,QAAI,OAAO,MAAM,GAAG,GAAG;AACrB,iBAAW,QAAQ;AACnB,WAAK,IAAI,2BAA2B;AACpC;AAAA,IACF;AAEA,QAAI;AACF,cAAQ,KAAK,KAAK,SAAS;AAC3B,WAAK,IAAI,sBAAsB,GAAG,IAAI;AAAA,IACxC,SAAS,KAAc;AACrB,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,SAAS;AACpB,aAAK,IAAI,qDAAqD;AAAA,MAChE,OAAO;AACL,aAAK,MAAM,yBAA0B,IAAc,OAAO,EAAE;AAAA,MAC9D;AAAA,IACF;AAEA,QAAI;AAAE,iBAAW,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAqB;AAEzD,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,qFAAgF;AAAA,EAC3F;AAAA,EAEQ,kBAAiC;AACvC,UAAM,aAAa;AAAA,MACjB,KAAK,QAAQ,IAAI,GAAG,oBAAoB;AAAA,MACxC,QAAQ,YAAY,SAAS,mCAAmC;AAAA,IAClE;AACA,eAAW,KAAK,YAAY;AAC1B,UAAI,WAAW,CAAC,EAAG,QAAO;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync, unlinkSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { BaseCommand } from '../../base-command.js';\n\n// MODULE_DIR is undefined on Node < 20.11 (breaks resolve()); derive\n// portably. See onboarding field report 2026-07-07 F1.\nconst MODULE_DIR = dirname(fileURLToPath(import.meta.url));\n\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst PID_FILE = join(CONFIG_DIR, 'proxy.pid');\n\nexport default class ProxyStop extends BaseCommand {\n  static override description = 'Stop the context capture proxy';\n\n  static override examples = ['<%= config.bin %> proxy stop'];\n\n  async run(): Promise<void> {\n    await this.parse(ProxyStop);\n\n    if (!existsSync(PID_FILE)) {\n      this.log('No proxy process found (no PID file).');\n      return;\n    }\n\n    const content = readFileSync(PID_FILE, 'utf-8').trim();\n\n    // Docker mode: PID file contains \"docker:<container-name>\"\n    if (content.startsWith('docker:')) {\n      const containerName = content.slice('docker:'.length);\n      // Try docker compose first, fall back to docker stop\n      const composeFile = this.findComposeFile();\n      if (composeFile) {\n        spawnSync('docker', ['compose', '-f', composeFile, 'stop', 'proxy'], { stdio: 'inherit' });\n        spawnSync('docker', ['compose', '-f', composeFile, 'rm', '-f', 'proxy'], { stdio: 'ignore' });\n      } else {\n        spawnSync('docker', ['stop', containerName], { stdio: 'ignore' });\n        spawnSync('docker', ['rm', containerName], { stdio: 'ignore' });\n      }\n      this.log(`Proxy container stopped.`);\n      try { unlinkSync(PID_FILE); } catch { /* already gone */ }\n      return;\n    }\n\n    // Local mode: PID file contains a process ID\n    const pid = Number.parseInt(content, 10);\n\n    if (Number.isNaN(pid)) {\n      unlinkSync(PID_FILE);\n      this.log('Invalid PID file removed.');\n      return;\n    }\n\n    try {\n      process.kill(pid, 'SIGTERM');\n      this.log(`Proxy stopped (PID ${pid}).`);\n    } catch (err: unknown) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === 'ESRCH') {\n        this.log('Proxy process not running (stale PID file removed).');\n      } else {\n        this.error(`Failed to stop proxy: ${(err as Error).message}`);\n      }\n    }\n\n    try { unlinkSync(PID_FILE); } catch { /* already gone */ }\n\n    this.log('');\n    this.log('Gateway is still running \u2014 Claude Code will route direct until proxy restarts.');\n  }\n\n  private findComposeFile(): string | null {\n    const candidates = [\n      join(process.cwd(), 'docker-compose.yml'),\n      resolve(MODULE_DIR, '../../../../../docker-compose.yml'),\n    ];\n    for (const p of candidates) {\n      if (existsSync(p)) return p;\n    }\n    return null;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;AAAA,SAAS,iBAAiB;AAC1B,SAAS,YAAY,cAAc,kBAAkB;AACrD,SAAS,eAAe;AACxB,SAAS,SAAS,MAAM,eAAe;AACvC,SAAS,qBAAqB;AAK9B,IAAM,aAAa,QAAQ,cAAc,YAAY,GAAG,CAAC;AAEzD,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,WAAW,KAAK,YAAY,WAAW;AAE7C,IAAqB,YAArB,MAAqB,mBAAkB,YAAY;AAAA,EACjD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW,CAAC,8BAA8B;AAAA,EAE1D,MAAM,MAAqB;AACzB,UAAM,KAAK,MAAM,UAAS;AAE1B,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,IAAI,uCAAuC;AAChD;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,UAAU,OAAO,EAAE,KAAK;AAGrD,QAAI,QAAQ,WAAW,SAAS,GAAG;AACjC,YAAM,gBAAgB,QAAQ,MAAM,UAAU,MAAM;AAEpD,YAAM,cAAc,KAAK,gBAAgB;AACzC,UAAI,aAAa;AACf,kBAAU,UAAU,CAAC,WAAW,MAAM,aAAa,QAAQ,OAAO,GAAG,EAAE,OAAO,UAAU,CAAC;AACzF,kBAAU,UAAU,CAAC,WAAW,MAAM,aAAa,MAAM,MAAM,OAAO,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,MAC9F,OAAO;AACL,kBAAU,UAAU,CAAC,QAAQ,aAAa,GAAG,EAAE,OAAO,SAAS,CAAC;AAChE,kBAAU,UAAU,CAAC,MAAM,aAAa,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,MAChE;AACA,WAAK,IAAI,0BAA0B;AACnC,UAAI;AAAE,mBAAW,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAAqB;AACzD;AAAA,IACF;AAGA,UAAM,MAAM,OAAO,SAAS,SAAS,EAAE;AAEvC,QAAI,OAAO,MAAM,GAAG,GAAG;AACrB,iBAAW,QAAQ;AACnB,WAAK,IAAI,2BAA2B;AACpC;AAAA,IACF;AAEA,QAAI;AACF,cAAQ,KAAK,KAAK,SAAS;AAC3B,WAAK,IAAI,sBAAsB,GAAG,IAAI;AAAA,IACxC,SAAS,KAAc;AACrB,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,SAAS;AACpB,aAAK,IAAI,qDAAqD;AAAA,MAChE,OAAO;AACL,aAAK,MAAM,yBAA0B,IAAc,OAAO,EAAE;AAAA,MAC9D;AAAA,IACF;AAEA,QAAI;AAAE,iBAAW,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAqB;AAEzD,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,qFAAgF;AAAA,EAC3F;AAAA,EAEQ,kBAAiC;AACvC,UAAM,aAAa;AAAA,MACjB,KAAK,QAAQ,IAAI,GAAG,oBAAoB;AAAA,MACxC,QAAQ,YAAY,mCAAmC;AAAA,IACzD;AACA,eAAW,KAAK,YAAY;AAC1B,UAAI,WAAW,CAAC,EAAG,QAAO;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/commands/setup.js

@@ -6,9 +6,9 @@ import {
   getStep,
   isStepId,
   renderDiff
-} from "../chunk-YDTUPCBL.js";
-import "../chunk-HWGRTIXN.js";
-import "../chunk-OVGP4OGK.js";
+} from "../chunk-XNNOXGP6.js";
+import "../chunk-XN23W5HL.js";
+import "../chunk-DAJNO4OI.js";
 import {
   BaseCommand
 } from "../chunk-SZ7VDCD6.js";

package/dist/lib/gateway-lifecycle.js

@@ -9,7 +9,7 @@ import {
   spawnGateway,
   stopGateway,
   waitForGatewayListening
-} from "../chunk-OVGP4OGK.js";
+} from "../chunk-DAJNO4OI.js";
 import "../chunk-NSBPE2FW.js";
 export {
   GATEWAY_LOG_FILE,

package/dist/lib/hooks-config.js

@@ -28,7 +28,7 @@ import {
   writeCursorUserProxyConfig,
   writeVSCodeProxyConfig,
   writeVSCodeUserProxyConfig
-} from "../chunk-HWGRTIXN.js";
+} from "../chunk-XN23W5HL.js";
 import "../chunk-NSBPE2FW.js";
 export {
   detectInstalledTools,

package/dist/lib/setup-steps.js

@@ -9,9 +9,9 @@ import {
   isStepId,
   maskToken,
   renderDiff
-} from "../chunk-YDTUPCBL.js";
-import "../chunk-HWGRTIXN.js";
-import "../chunk-OVGP4OGK.js";
+} from "../chunk-XNNOXGP6.js";
+import "../chunk-XN23W5HL.js";
+import "../chunk-DAJNO4OI.js";
 import "../chunk-ZRLYHBPN.js";
 import "../chunk-W2YERO7E.js";
 import "../chunk-NSBPE2FW.js";

package/oclif.manifest.json

@@ -4066,5 +4066,5 @@
       ]
     }
   },
-  "version": "0.6.1"
+  "version": "0.6.3"
 }

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@rulemetric/cli",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
+  "engines": {
+    "node": ">=18.18"
+  },
   "bin": {
     "rulemetric": "./bin/run.js"
   },
@@ -70,9 +73,9 @@
     "postgres": "^3.4.0",
     "react": "^19.0.0",
     "zod": "^3.24.0",
-    "@rulemetric/proxy": "0.6.1",
-    "@rulemetric/skills-registry": "0.6.1",
-    "@rulemetric/hooks": "0.6.1"
+    "@rulemetric/proxy": "0.6.3",
+    "@rulemetric/skills-registry": "0.6.3",
+    "@rulemetric/hooks": "0.6.3"
   },
   "//deps": "Worker (`evals agent`) runtime deps: the @opentelemetry/* set, @sentry/node, and postgres are STATIC top-level imports loaded at worker startup (via bundled @rulemetric/{telemetry,db}) — they MUST be runtime deps or a clean `npm i -g` crashes with ModuleLoadError. `better-sqlite3` is optionalDependencies (below): it's a native module, lazy `require()`'d inside a try/catch (packages/session providers cursor/opencode) so a missing binary degrades gracefully — making it a hard dep would break `npm i -g` on platforms without prebuilt binaries. `resend` stays a devDep: lazy `await import('resend')` guarded by RESEND_API_KEY, which end-user workers never set (provider falls back to noop). Classification verified via import-graph scan of dist/commands/evals/agent.js + per-importer static/lazy check.",
   "optionalDependencies": {
@@ -94,9 +97,9 @@
     "@rulemetric/core": "0.0.1",
     "@rulemetric/db": "0.0.1",
     "@rulemetric/email": "0.0.1",
-    "@rulemetric/session": "0.2.1",
+    "@rulemetric/telemetry": "0.0.1",
     "@rulemetric/typescript-config": "0.0.0",
-    "@rulemetric/telemetry": "0.0.1"
+    "@rulemetric/session": "0.2.1"
   },
   "scripts": {
     "build": "node scripts/build.mjs",

package/dist/chunk-HWGRTIXN.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/hooks-config.ts"],
-  "sourcesContent": ["import { execSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, copyFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, dirname } from 'node:path';\n\nexport type DetectedTool = 'claude_code' | 'cursor' | 'copilot_agent' | 'antigravity';\n\n/**\n * Detect which AI coding tools are installed in the project by checking\n * for their config directories.\n */\nexport function detectInstalledTools(projectPath: string): DetectedTool[] {\n  const tools: DetectedTool[] = ['claude_code'];\n\n  if (existsSync(join(projectPath, '.cursor'))) {\n    tools.push('cursor');\n  }\n\n  if (existsSync(join(projectPath, '.github'))) {\n    tools.push('copilot_agent');\n  }\n\n  // Antigravity's workspace config lives at `.agents/`. The user-level\n  // hooks file at ~/.gemini/config/hooks.json is installed unconditionally\n  // by writeAntigravityUserHooks() so we don't gate on that here.\n  if (existsSync(join(projectPath, '.agents'))) {\n    tools.push('antigravity');\n  }\n\n  return tools;\n}\n\n/**\n * Generate Cursor hooks config object.\n *\n * Cursor uses event names like beforeSubmitPrompt, afterFileEdit, etc.\n * Each event maps to an array of hook objects with a `command` field.\n */\nexport function generateCursorHooksConfig(binDir?: string): object {\n  // Event coverage matches Cursor 1.7+ hook API (cursor.com/docs/hooks).\n  // `sessionStart` is required so the registry file is written with\n  // conversation_id before any tool runs; without it the proxy-based linker\n  // path would have nothing to map and we'd drop captures. `sessionEnd`\n  // emits the session-end signal once per chat conversation (vs `stop`\n  // which fires per-turn \u2014 those go through post-tool-use).\n  //\n  // binDir: prepended to PATH like the Claude Code hooks \u2014 Cursor is a GUI app\n  // launched with launchd's minimal PATH (no nvm/pnpm-global bin), so a bare\n  // `rulemetric` silently fails with command-not-found.\n  const prefix = binDir ? `PATH=\"${binDir}:$PATH\" ` : '';\n  const cmd = (name: string) => ({ command: `${prefix}rulemetric hooks run ${name}` });\n  return {\n    version: 1,\n    hooks: {\n      sessionStart: [cmd('session-start')],\n      beforeSubmitPrompt: [cmd('user-prompt')],\n      afterFileEdit: [cmd('post-tool-use')],\n      beforeShellExecution: [cmd('post-tool-use')],\n      afterShellExecution: [cmd('post-tool-use')],\n      beforeMCPExecution: [cmd('post-tool-use')],\n      afterMCPExecution: [cmd('post-tool-use')],\n      // `afterAgentResponse` carries the full assistant response text +\n      // token usage. Verified empirically via a probe hook on\n      // 2026-05-12 \u2014 Cursor passes `text`, `input_tokens`,\n      // `output_tokens`, `cache_read_tokens`, `cache_write_tokens`. This\n      // is the cleanest path to per-turn assistant content for Cursor\n      // (chat traffic itself bypasses the proxy via HTTP/2 \u2014 see\n      // docs/audits/2026-05-11-cursor-capture-architecture.md).\n      afterAgentResponse: [cmd('assistant-response')],\n      // `stop` fires when the agent loop ends for a single turn (status:\n      // completed|aborted|error). Per-turn, NOT per-session \u2014 route it to\n      // post-tool-use, not session-end. The real session boundary is\n      // `sessionEnd` below.\n      stop: [cmd('post-tool-use')],\n      sessionEnd: [cmd('session-end')],\n    },\n  };\n}\n\n/**\n * Generate Copilot Agent hooks config object.\n *\n * Copilot uses event names like sessionStart, userPromptSubmitted, etc.\n * Each event maps to an array of hook objects with `type` and `bash` fields.\n */\nexport function generateCopilotHooksConfig(binDir?: string): object {\n  // binDir prepended to PATH \u2014 Copilot Agent runs in the same GUI/minimal-PATH\n  // environment class as Cursor, so a bare `rulemetric` silently fails.\n  const prefix = binDir ? `PATH=\"${binDir}:$PATH\" ` : '';\n  const cmd = (name: string) => ({ type: 'command', bash: `${prefix}rulemetric hooks run ${name}` });\n  return {\n    version: 1,\n    hooks: {\n      sessionStart: [cmd('session-start')],\n      userPromptSubmitted: [cmd('user-prompt')],\n      postToolUse: [cmd('post-tool-use')],\n      sessionEnd: [cmd('session-end')],\n    },\n  };\n}\n\ninterface ClaudeHookEntry {\n  type: 'command';\n  command: string;\n}\n\ninterface ClaudeHookBlock {\n  matcher?: string;\n  hooks: ClaudeHookEntry[];\n}\n\n/** The `settings.hooks` map RuleMetric installs into a project's `.claude/settings.json`. */\nexport type ClaudeCodeHooksConfig = Record<\n  'SessionStart' | 'UserPromptSubmit' | 'PostToolUse' | 'Stop' | 'SessionEnd',\n  ClaudeHookBlock[]\n>;\n\n/**\n * Generate the Claude Code hooks map for `.claude/settings.json`.\n *\n * Claude Code keys hook blocks by native event name, each block being\n * `{ matcher?, hooks: [{ type: 'command', command }] }`. Unlike Antigravity\n * these carry NO `RULEMETRIC_HOOK_TOOL` prefix \u2014 `_normalize.sh` defaults to\n * the `claude_code` branch (session_id + transcript_path payload shape).\n *\n * This is the hooks-first, zero-proxy capture path: SessionEnd runs\n * `session-end.sh`, which reimports the whole transcript via\n * `POST /api/sessions/:id/reimport` \u2014 no mitmproxy / CA trust / gateway needed.\n * The rendered system prompt is still proxy-only, so instruction-effectiveness\n * linking is handled separately (Phase 2 synthetic snapshot).\n */\nexport function generateClaudeCodeHooksConfig(binDir?: string): ClaudeCodeHooksConfig {\n  // The literal `rulemetric` is always present: it's the marker that install.ts\n  // \u00A71 and mergeClaudeCodeHooks use to dedup/strip our hooks (a resolved\n  // node+run.js path omits 'rulemetric' in a dev checkout, which would silently\n  // break that dedup).\n  //\n  // `binDir`, when provided, is prepended to PATH so the command resolves even\n  // in Claude Code's hook shell \u2014 which runs `/bin/sh -c` with a minimal PATH\n  // that does NOT include nvm/pnpm global bin dirs. Without it, a fresh-install\n  // user hits `rulemetric: command not found` on every hook, so capture (and\n  // the session-start gateway auto-start that keeps the proxy alive) silently\n  // fails. Callers resolve the real bin dir at install time and pass it here.\n  const prefix = binDir ? `PATH=\"${binDir}:$PATH\" ` : '';\n  const mk = (name: string): ClaudeHookEntry => ({\n    type: 'command',\n    command: `${prefix}rulemetric hooks run ${name}`,\n  });\n  return {\n    SessionStart: [{ hooks: [mk('session-start')] }],\n    UserPromptSubmit: [{ hooks: [mk('user-prompt')] }],\n    PostToolUse: [{ matcher: '.*', hooks: [mk('post-tool-use')] }],\n    Stop: [{ hooks: [mk('assistant-response')] }],\n    SessionEnd: [{ hooks: [mk('session-end')] }],\n  };\n}\n\n/**\n * Read a Claude Code `settings.json` for merging, WITHOUT ever crashing the\n * install on a fresh machine. A missing file yields `{}`. A malformed file\n * (hand-edited JSONC, a stray trailing comma, a half-written file) is NOT\n * allowed to throw \u2014 that used to hard-fail `hooks install` with a raw\n * SyntaxError and leave the user with NO capture. Instead we back the\n * unparseable file up (so nothing is silently lost) and proceed on a fresh\n * object so capture still installs.\n *\n * Returns the parsed settings plus `recoveredBackup`: the path the corrupt\n * original was copied to, or `null` when the file was absent/valid.\n */\nexport function readClaudeSettings(configPath: string): {\n  settings: Record<string, unknown>;\n  recoveredBackup: string | null;\n} {\n  if (!existsSync(configPath)) return { settings: {}, recoveredBackup: null };\n  const raw = readFileSync(configPath, 'utf-8');\n  try {\n    return { settings: JSON.parse(raw) as Record<string, unknown>, recoveredBackup: null };\n  } catch {\n    const recoveredBackup = `${configPath}.corrupt.bak`;\n    writeFileSync(recoveredBackup, raw);\n    return { settings: {}, recoveredBackup };\n  }\n}\n\n/**\n * Write a Claude Code `settings.json`, backing up any prior file first so the\n * change is reversible: the `.bak` holds the previous contents for the user to\n * restore manually if a merge ever goes wrong. Creates the parent dir as needed.\n * Returns `backupPath` (the `.bak` written) or `null` when there was no\n * pre-existing file to back up.\n */\nexport function writeClaudeSettingsWithBackup(\n  configPath: string,\n  settings: Record<string, unknown>,\n): { backupPath: string | null } {\n  mkdirSync(dirname(configPath), { recursive: true });\n  let backupPath: string | null = null;\n  if (existsSync(configPath)) {\n    backupPath = `${configPath}.bak`;\n    copyFileSync(configPath, backupPath);\n  }\n  writeFileSync(configPath, JSON.stringify(settings, null, 2) + '\\n');\n  return { backupPath };\n}\n\n/**\n * Read a JSON config file for a safe in-place merge. Returns `{}` when the file\n * is absent, the parsed object when it's valid, and `null` when it EXISTS but is\n * unparseable \u2014 in which case the original is first backed up to `.corrupt.bak`.\n * Callers MUST treat `null` as \"skip, do not write\": editor settings.json files\n * are JSONC (comments + trailing commas are legal and common), so a strict\n * JSON.parse throws on valid user files; blindly resetting to `{}` and writing\n * would clobber the user's ENTIRE editor config down to our few keys. Backing up\n * + skipping is the non-destructive floor (mirrors readClaudeSettings).\n */\nfunction readMergeableJson(configPath: string): Record<string, unknown> | null {\n  if (!existsSync(configPath)) return {};\n  const raw = readFileSync(configPath, 'utf-8');\n  try {\n    return JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    try {\n      writeFileSync(`${configPath}.corrupt.bak`, raw);\n    } catch {\n      /* best-effort backup */\n    }\n    return null;\n  }\n}\n\n/**\n * Merge RuleMetric's Claude Code hooks into an in-memory `.claude/settings.json`\n * object. Claude Code hooks share the same settings.json that install.ts reads,\n * strips (\u00A71), and writes (\u00A75), so this mutates `settings.hooks` in place rather\n * than doing its own file I/O. Idempotent + non-destructive: per event it skips\n * adding when a rulemetric command is already present and otherwise appends,\n * preserving the user's own hooks.\n */\nexport function mergeClaudeCodeHooks(settings: Record<string, unknown>, binDir?: string): void {\n  const generated = generateClaudeCodeHooksConfig(binDir);\n  const hooks = (settings.hooks ?? {}) as Record<string, ClaudeHookBlock[]>;\n  for (const [event, blocks] of Object.entries(generated)) {\n    const current = (hooks[event] ?? []) as ClaudeHookBlock[];\n    const alreadyPresent = current.some((b) =>\n      b?.hooks?.some((h) => typeof h?.command === 'string' && h.command.includes('rulemetric')),\n    );\n    if (!alreadyPresent) {\n      hooks[event] = [...current, ...blocks];\n    }\n  }\n  settings.hooks = hooks;\n}\n\n/**\n * True iff RuleMetric's Claude Code session hooks are present in a settings\n * object \u2014 i.e. capture is actually wired up. This is the honest readiness\n * signal for the onboarding hooks step: capture works when the hooks exist,\n * NOT merely because a proxy env var was written (which greened even when the\n * proxy pointed at a dead port \u2014 the fresh-laptop ConnectionRefused footgun).\n */\nexport function hasRulemetricClaudeHooks(settings: Record<string, unknown>): boolean {\n  if (!settings.hooks || typeof settings.hooks !== 'object') return false;\n  const hooks = settings.hooks as Record<string, ClaudeHookBlock[]>;\n  return Object.values(hooks).some(\n    (blocks) =>\n      Array.isArray(blocks) &&\n      blocks.some((b) =>\n        b?.hooks?.some((h) => typeof h?.command === 'string' && h.command.includes('rulemetric')),\n      ),\n  );\n}\n\n/**\n * Strip RuleMetric's Claude Code hooks from an in-memory settings object while\n * preserving the user's own hook entries. Mirrors install.ts \u00A71 but is reusable\n * for uninstall. Removes emptied event arrays and deletes `settings.hooks` if it\n * ends up empty. Returns true iff anything was removed.\n */\nexport function removeClaudeCodeHooks(settings: Record<string, unknown>): boolean {\n  if (!settings.hooks || typeof settings.hooks !== 'object') return false;\n  const hooks = settings.hooks as Record<string, ClaudeHookBlock[]>;\n  let removed = 0;\n  for (const event of Object.keys(hooks)) {\n    const entries = hooks[event];\n    if (!Array.isArray(entries)) continue;\n    const kept = entries.filter((block) => {\n      const isRulemetric = block?.hooks?.some(\n        (h) => typeof h?.command === 'string' && h.command.includes('rulemetric'),\n      );\n      if (isRulemetric) removed += 1;\n      return !isRulemetric;\n    });\n    if (kept.length === 0) delete hooks[event];\n    else hooks[event] = kept;\n  }\n  if (Object.keys(hooks).length === 0) delete settings.hooks;\n  return removed > 0;\n}\n\n/**\n * Merge rulemetric hooks into a Cursor `hooks.json` at the given directory.\n *\n * Used by both the project (`<repo>/.cursor/`) and user (`~/.cursor/`) writers.\n * Returns the config file path, or null if the cursor dir doesn't exist.\n */\nfunction writeCursorHooksToDir(cursorDir: string, binDir?: string): string | null {\n  if (!existsSync(cursorDir)) {\n    return null;\n  }\n\n  const configPath = join(cursorDir, 'hooks.json');\n  const generated = generateCursorHooksConfig(binDir) as {\n    version: number;\n    hooks: Record<string, Array<{ command: string }>>;\n  };\n\n  const parsed = readMergeableJson(configPath);\n  if (parsed === null) return null; // unparseable \u2014 backed up, don't drop sibling hooks\n  const existing = parsed as { version?: number; hooks?: Record<string, unknown[]> };\n\n  const merged: Record<string, unknown[]> = { ...(existing.hooks ?? {}) };\n\n  for (const [event, hooks] of Object.entries(generated.hooks)) {\n    const current = merged[event] ?? [];\n    const hasRulemetric = current.some(\n      (h: unknown) =>\n        typeof h === 'object' &&\n        h !== null &&\n        'command' in h &&\n        typeof (h as { command: string }).command === 'string' &&\n        (h as { command: string }).command.includes('rulemetric'),\n    );\n    if (!hasRulemetric) {\n      merged[event] = [...current, ...hooks];\n    }\n  }\n\n  const result = {\n    version: existing.version ?? generated.version,\n    hooks: merged,\n  };\n\n  writeFileSync(configPath, JSON.stringify(result, null, 2) + '\\n');\n  return configPath;\n}\n\n/**\n * Write Cursor hooks config to `<projectPath>/.cursor/hooks.json`.\n * Merges with existing config \u2014 appends rulemetric hooks without duplicating.\n * Returns the config file path, or null if `.cursor/` doesn't exist.\n */\nexport function writeCursorHooks(projectPath: string, binDir?: string): string | null {\n  return writeCursorHooksToDir(join(projectPath, '.cursor'), binDir);\n}\n\n/**\n * Write Cursor hooks config to user-level `~/.cursor/hooks.json` so capture\n * works for every Cursor conversation without per-project setup.\n *\n * Returns the config file path, or null if `~/.cursor/` doesn't exist\n * (i.e., Cursor has never been launched on this machine).\n */\nexport function writeCursorUserHooks(binDir?: string): string | null {\n  return writeCursorHooksToDir(join(homedir(), '.cursor'), binDir);\n}\n\n/**\n * Write Copilot Agent hooks config to `.github/hooks/rulemetric.json`.\n * Creates the hooks directory if needed.\n * Returns the config file path, or null if `.github/` doesn't exist.\n */\nexport function writeCopilotHooks(projectPath: string, binDir?: string): string | null {\n  const githubDir = join(projectPath, '.github');\n  if (!existsSync(githubDir)) {\n    return null;\n  }\n\n  const hooksDir = join(githubDir, 'hooks');\n  mkdirSync(hooksDir, { recursive: true });\n\n  const configPath = join(hooksDir, 'rulemetric.json');\n  const config = generateCopilotHooksConfig(binDir);\n\n  writeFileSync(configPath, JSON.stringify(config, null, 2) + '\\n');\n  return configPath;\n}\n\n/**\n * Strip rulemetric hooks from a Cursor `hooks.json` at the given path.\n * Preserves other hooks and removes empty event arrays.\n * Returns true if changes were made.\n */\nfunction removeCursorHooksFromFile(configPath: string): boolean {\n  if (!existsSync(configPath)) {\n    return false;\n  }\n\n  let config: { version?: number; hooks?: Record<string, unknown[]> };\n  try {\n    config = JSON.parse(readFileSync(configPath, 'utf-8'));\n  } catch {\n    return false;\n  }\n\n  if (!config.hooks) {\n    return false;\n  }\n\n  let changed = false;\n  for (const [event, hooks] of Object.entries(config.hooks)) {\n    const filtered = hooks.filter((h: unknown) => {\n      if (typeof h !== 'object' || h === null || !('command' in h)) return true;\n      const cmd = (h as { command: string }).command;\n      if (typeof cmd === 'string' && cmd.includes('rulemetric')) {\n        changed = true;\n        return false;\n      }\n      return true;\n    });\n\n    if (filtered.length === 0) {\n      delete config.hooks[event];\n    } else {\n      config.hooks[event] = filtered;\n    }\n  }\n\n  if (changed) {\n    writeFileSync(configPath, JSON.stringify(config, null, 2) + '\\n');\n  }\n\n  return changed;\n}\n\n/**\n * Remove rulemetric hooks from `<projectPath>/.cursor/hooks.json`.\n */\nexport function removeCursorHooks(projectPath: string): boolean {\n  return removeCursorHooksFromFile(join(projectPath, '.cursor', 'hooks.json'));\n}\n\n/**\n * Remove rulemetric hooks from user-level `~/.cursor/hooks.json`.\n */\nexport function removeCursorUserHooks(): boolean {\n  return removeCursorHooksFromFile(join(homedir(), '.cursor', 'hooks.json'));\n}\n\n/**\n * Write Cursor proxy config to `.cursor/settings.json`.\n * Sets `http.proxy` and `http.proxyStrictSSL` while preserving existing settings.\n * Returns true if `.cursor/` exists and config was written, false otherwise.\n */\nexport function writeCursorProxyConfig(projectPath: string, gatewayPort: number, certPath: string): boolean {\n  const cursorDir = join(projectPath, '.cursor');\n  if (!existsSync(cursorDir)) return false;\n\n  const settingsPath = join(cursorDir, 'settings.json');\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = existsSync(certPath);\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Write VS Code proxy config to `.vscode/settings.json` for Copilot capture.\n * Sets `http.proxy`, `http.proxyStrictSSL`, and Copilot-specific override\n * while preserving existing settings.\n * Returns true if config was written, false if `.vscode/` doesn't exist.\n */\nexport function writeVSCodeProxyConfig(projectPath: string, gatewayPort: number, certPath: string): boolean {\n  const vscodeDir = join(projectPath, '.vscode');\n  // Only touch projects that already use VS Code \u2014 do NOT manufacture a\n  // `.vscode/` in every repo (matches writeCursorProxyConfig's contract and this\n  // function's own docstring). Creating it pollutes Claude-Code-only repos with\n  // an untracked, proxy-pinning settings.json.\n  if (!existsSync(vscodeDir)) return false;\n\n  const settingsPath = join(vscodeDir, 'settings.json');\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = existsSync(certPath);\n\n  // Copilot-specific override for surgical proxy targeting\n  const copilotAdvanced = (settings['github.copilot.advanced'] ?? {}) as Record<string, unknown>;\n  copilotAdvanced['debug.overrideProxyUrl'] = `http://localhost:${gatewayPort}`;\n  settings['github.copilot.advanced'] = copilotAdvanced;\n\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Remove VS Code proxy config from `.vscode/settings.json`.\n * Removes `http.proxy`, `http.proxyStrictSSL`, and Copilot proxy override.\n * Returns true if changes were made.\n */\nexport function removeVSCodeProxyConfig(projectPath: string): boolean {\n  const settingsPath = join(projectPath, '.vscode', 'settings.json');\n  if (!existsSync(settingsPath)) return false;\n\n  let settings: Record<string, unknown>;\n  try { settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); } catch { return false; }\n\n  let changed = false;\n\n  if (settings['http.proxy']) {\n    delete settings['http.proxy'];\n    delete settings['http.proxyStrictSSL'];\n    changed = true;\n  }\n\n  const copilotAdvanced = settings['github.copilot.advanced'] as Record<string, unknown> | undefined;\n  if (copilotAdvanced?.['debug.overrideProxyUrl']) {\n    delete copilotAdvanced['debug.overrideProxyUrl'];\n    if (Object.keys(copilotAdvanced).length === 0) {\n      delete settings['github.copilot.advanced'];\n    }\n    changed = true;\n  }\n\n  if (changed) {\n    writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  }\n\n  return changed;\n}\n\n/**\n * Remove Copilot Agent hooks by deleting `.github/hooks/rulemetric.json`.\n * Returns true if the file was removed.\n */\nexport function removeCopilotHooks(projectPath: string): boolean {\n  const configPath = join(projectPath, '.github', 'hooks', 'rulemetric.json');\n  if (!existsSync(configPath)) {\n    return false;\n  }\n\n  unlinkSync(configPath);\n  return true;\n}\n\n// ---------------------------------------------------------------------------\n// macOS LaunchAgent for GUI app env vars (HTTPS_PROXY, NODE_EXTRA_CA_CERTS)\n// ---------------------------------------------------------------------------\n\nconst LAUNCH_AGENT_LABEL = 'com.rulemetric.env';\n\nfunction getLaunchAgentPath(): string {\n  return join(homedir(), 'Library', 'LaunchAgents', `${LAUNCH_AGENT_LABEL}.plist`);\n}\n\n/**\n * Set HTTPS_PROXY and NODE_EXTRA_CA_CERTS for all GUI apps on macOS.\n *\n * Two layers:\n * 1. `launchctl setenv` \u2014 immediate effect for newly launched apps\n * 2. LaunchAgent plist \u2014 persists across reboots\n *\n * This ensures VS Code / Copilot / Cursor route LLM traffic through the\n * gateway even when launched from Dock or Spotlight (not a terminal).\n *\n * References:\n * - anthropics/claude-code#30318 (same pattern for Claude Desktop)\n * - Snyk IDE docs recommend launchctl setenv for macOS\n * - Apple QA1067 (archived) \u2014 original env var mechanism removed in 10.10\n */\nexport function installMacOSProxyEnv(gatewayPort: number, certPath: string): boolean {\n  if (process.platform !== 'darwin') return false;\n\n  const proxyUrl = `http://localhost:${gatewayPort}`;\n\n  // Layer 1: immediate effect via launchctl setenv\n  try {\n    execSync(`launchctl setenv HTTPS_PROXY ${proxyUrl}`, { stdio: 'pipe' });\n    if (existsSync(certPath)) {\n      execSync(`launchctl setenv NODE_EXTRA_CA_CERTS ${certPath}`, { stdio: 'pipe' });\n    }\n  } catch {\n    return false;\n  }\n\n  // Layer 2: LaunchAgent plist for persistence across reboots\n  const plistPath = getLaunchAgentPath();\n  const agentsDir = join(homedir(), 'Library', 'LaunchAgents');\n  mkdirSync(agentsDir, { recursive: true });\n\n  const certLine = existsSync(certPath)\n    ? `launchctl setenv NODE_EXTRA_CA_CERTS ${certPath};`\n    : '';\n\n  // LIVENESS-GUARDED boot command: at every login this re-pins HTTPS_PROXY\n  // machine-wide, but the gateway on :8787 is not a supervised service on the\n  // end-user path \u2014 it dies on logout and nothing restarts it. Pinning a dead\n  // port breaks HTTPS for every GUI app. So probe :8787 first and only setenv\n  // when the gateway actually answers; otherwise clear it (the session-start\n  // hook will re-pin once Claude Code brings the gateway back up).\n  const bootCmd =\n    `if nc -z -w 1 127.0.0.1 ${gatewayPort} 2>/dev/null; then ` +\n    `launchctl setenv HTTPS_PROXY ${proxyUrl};${certLine} ` +\n    `else launchctl unsetenv HTTPS_PROXY; launchctl unsetenv NODE_EXTRA_CA_CERTS; fi`;\n\n  const plist = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\"\n  \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${LAUNCH_AGENT_LABEL}</string>\n  <key>ProgramArguments</key>\n  <array>\n    <string>/bin/sh</string>\n    <string>-c</string>\n    <string>${bootCmd}</string>\n  </array>\n  <key>RunAtLoad</key>\n  <true/>\n</dict>\n</plist>\n`;\n\n  writeFileSync(plistPath, plist);\n  return true;\n}\n\n/**\n * Remove the RuleMetric LaunchAgent and unset env vars.\n */\nexport function uninstallMacOSProxyEnv(): boolean {\n  if (process.platform !== 'darwin') return false;\n\n  let changed = false;\n\n  // Unset env vars for current session\n  try {\n    execSync('launchctl unsetenv HTTPS_PROXY', { stdio: 'pipe' });\n    execSync('launchctl unsetenv NODE_EXTRA_CA_CERTS', { stdio: 'pipe' });\n  } catch { /* may not be set */ }\n\n  // Remove LaunchAgent plist\n  const plistPath = getLaunchAgentPath();\n  if (existsSync(plistPath)) {\n    unlinkSync(plistPath);\n    changed = true;\n  }\n\n  return changed;\n}\n\n// ---------------------------------------------------------------------------\n// VS Code user-level proxy settings\n// ---------------------------------------------------------------------------\n\nfunction getVSCodeUserSettingsPath(): string {\n  if (process.platform === 'darwin') {\n    return join(homedir(), 'Library', 'Application Support', 'Code', 'User', 'settings.json');\n  }\n  if (process.platform === 'win32') {\n    return join(process.env.APPDATA ?? '', 'Code', 'User', 'settings.json');\n  }\n  return join(homedir(), '.config', 'Code', 'User', 'settings.json');\n}\n\n/**\n * Set http.proxy in VS Code user settings (not workspace).\n *\n * Workspace-level http.proxy is silently ignored because VS Code restricts\n * it to APPLICATION scope (microsoft/vscode#236932). User-level settings\n * are the only reliable way to configure http.proxy.\n */\nexport function writeVSCodeUserProxyConfig(gatewayPort: number): boolean {\n  const settingsPath = getVSCodeUserSettingsPath();\n  if (!existsSync(join(settingsPath, '..'))) return false;\n\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber user config\n\n  // Only set if not already configured by the user\n  if (settings['http.proxy'] && !(settings['http.proxy'] as string).includes('localhost')) {\n    return false; // user has a custom proxy, don't overwrite\n  }\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = false;\n\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Remove RuleMetric proxy config from VS Code user settings.\n */\nexport function removeVSCodeUserProxyConfig(): boolean {\n  const settingsPath = getVSCodeUserSettingsPath();\n  if (!existsSync(settingsPath)) return false;\n\n  let settings: Record<string, unknown>;\n  try { settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); } catch { return false; }\n\n  const proxy = settings['http.proxy'] as string | undefined;\n  if (!proxy?.includes('localhost')) return false;\n\n  delete settings['http.proxy'];\n  delete settings['http.proxyStrictSSL'];\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n// ---------------------------------------------------------------------------\n// Cursor user-level proxy settings\n// ---------------------------------------------------------------------------\n//\n// Cursor is a VS Code fork and uses the same settings.json shape, but reads\n// from `Cursor/User/settings.json` instead of `Code/User/settings.json`. The\n// `.cursor/settings.json` (workspace) path can't reach Cursor's Electron main\n// process for the same reason VS Code's workspace path can't reach VS Code's\n// \u2014 the http.proxy setting is restricted to APPLICATION scope and only the\n// user-level file is honored.\n\nfunction getCursorUserSettingsPath(): string {\n  if (process.platform === 'darwin') {\n    return join(homedir(), 'Library', 'Application Support', 'Cursor', 'User', 'settings.json');\n  }\n  if (process.platform === 'win32') {\n    return join(process.env.APPDATA ?? '', 'Cursor', 'User', 'settings.json');\n  }\n  return join(homedir(), '.config', 'Cursor', 'User', 'settings.json');\n}\n\n/**\n * Set http.proxy in Cursor user settings (not workspace). Mirrors\n * `writeVSCodeUserProxyConfig` \u2014 workspace-level http.proxy is silently\n * ignored due to APPLICATION-scope restriction (Cursor inherits this from\n * VS Code, see microsoft/vscode#236932).\n *\n * Returns true if config was written, false if Cursor isn't installed\n * (User dir absent) or the user already has a non-localhost proxy set.\n */\nexport function writeCursorUserProxyConfig(gatewayPort: number): boolean {\n  const settingsPath = getCursorUserSettingsPath();\n  if (!existsSync(join(settingsPath, '..'))) return false;\n\n  const settings = readMergeableJson(settingsPath);\n  if (settings === null) return false; // unparseable JSONC \u2014 backed up, don't clobber user config\n\n  if (settings['http.proxy'] && !(settings['http.proxy'] as string).includes('localhost')) {\n    return false;\n  }\n\n  settings['http.proxy'] = `http://localhost:${gatewayPort}`;\n  settings['http.proxyStrictSSL'] = false;\n\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n/**\n * Remove RuleMetric proxy config from Cursor user settings.\n */\nexport function removeCursorUserProxyConfig(): boolean {\n  const settingsPath = getCursorUserSettingsPath();\n  if (!existsSync(settingsPath)) return false;\n\n  let settings: Record<string, unknown>;\n  try { settings = JSON.parse(readFileSync(settingsPath, 'utf-8')); } catch { return false; }\n\n  const proxy = settings['http.proxy'] as string | undefined;\n  if (!proxy?.includes('localhost')) return false;\n\n  delete settings['http.proxy'];\n  delete settings['http.proxyStrictSSL'];\n  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\\n');\n  return true;\n}\n\n// \u2500\u2500\u2500 Antigravity (Google's Gemini-based agentic IDE) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Antigravity hooks live in `.agents/hooks.json` (workspace) and\n// `~/.gemini/config/hooks.json` (user-level). Events follow the\n// SessionStart / UserPromptSubmit / PreToolUse / PostToolUse / Stop /\n// SessionEnd vocabulary. Each hook command sets `RULEMETRIC_HOOK_TOOL=\n// antigravity` so `_normalize.sh` routes through the Antigravity branch.\n\ninterface AntigravityHookEntry {\n  type: 'command';\n  command: string;\n  timeout?: number;\n}\n\ninterface AntigravityHookBlock {\n  matcher?: string;\n  hooks: AntigravityHookEntry[];\n}\n\ninterface AntigravityRuleMetricBlock {\n  enabled: boolean;\n  SessionStart: AntigravityHookBlock[];\n  UserPromptSubmit: AntigravityHookBlock[];\n  PreToolUse: AntigravityHookBlock[];\n  PostToolUse: AntigravityHookBlock[];\n  Stop: AntigravityHookBlock[];\n  SessionEnd: AntigravityHookBlock[];\n}\n\nexport type AntigravityHooksConfig = { rulemetric: AntigravityRuleMetricBlock };\n\n/** Resolve the binary string to invoke for a hook command. */\nfunction getRulemetricCommand(): string {\n  // Prefer the local Node binary + bin/run.js so the hook works even when\n  // `rulemetric` isn't on PATH for the GUI Antigravity process.\n  const nodeBin = process.execPath;\n  // bin/run.js lives next to dist/ in the installed CLI; resolve from\n  // import.meta isn't available in a portable way here, so we use the\n  // process argv1 if it's pointing at the CLI entry, else fall back to\n  // the bare command name. In practice this function is called inside\n  // `rulemetric hooks install`, where process.argv[1] is bin/run.js.\n  const cliEntry = process.argv[1];\n  if (cliEntry && cliEntry.endsWith('run.js')) {\n    return `${nodeBin} ${cliEntry}`;\n  }\n  return 'rulemetric';\n}\n\nexport function generateAntigravityHooksConfig(): AntigravityHooksConfig {\n  const cmd = getRulemetricCommand();\n  const mk = (name: string): AntigravityHookEntry => ({\n    type: 'command',\n    command: `RULEMETRIC_HOOK_TOOL=antigravity ${cmd} hooks run ${name}`,\n    timeout: 30,\n  });\n  return {\n    rulemetric: {\n      enabled: true,\n      SessionStart: [{ hooks: [mk('session-start')] }],\n      UserPromptSubmit: [{ hooks: [mk('user-prompt')] }],\n      PreToolUse: [{ matcher: '.*', hooks: [mk('post-tool-use')] }],\n      PostToolUse: [{ matcher: '.*', hooks: [mk('post-tool-use')] }],\n      Stop: [{ hooks: [mk('assistant-response')] }],\n      SessionEnd: [{ hooks: [mk('session-end')] }],\n    },\n  };\n}\n\nfunction writeAntigravityHooksToDir(dir: string): string | null {\n  const configPath = join(dir, 'hooks.json');\n  const existing = readMergeableJson(configPath);\n  if (existing === null) return null; // unparseable \u2014 backed up, don't drop sibling blocks\n  const generated = generateAntigravityHooksConfig();\n  // Antigravity keys hook blocks by name; RuleMetric owns its own block\n  // and never touches sibling blocks the user may have added.\n  const merged = { ...existing, rulemetric: generated.rulemetric };\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(configPath, JSON.stringify(merged, null, 2) + '\\n');\n  return configPath;\n}\n\nexport function writeAntigravityHooks(projectPath: string): string | null {\n  return writeAntigravityHooksToDir(join(projectPath, '.agents'));\n}\n\nexport function writeAntigravityUserHooks(): string | null {\n  const configDir = join(homedir(), '.gemini', 'config');\n  return writeAntigravityHooksToDir(configDir);\n}\n\nfunction removeAntigravityHooksFromFile(configPath: string): boolean {\n  if (!existsSync(configPath)) return false;\n  let existing: Record<string, unknown>;\n  try { existing = JSON.parse(readFileSync(configPath, 'utf-8')); } catch { return false; }\n  if (!('rulemetric' in existing)) return false;\n  delete existing.rulemetric;\n  if (Object.keys(existing).length === 0) {\n    // No other blocks \u2014 remove the file entirely.\n    try { unlinkSync(configPath); } catch { /* ignore */ }\n  } else {\n    writeFileSync(configPath, JSON.stringify(existing, null, 2) + '\\n');\n  }\n  return true;\n}\n\nexport function removeAntigravityHooks(projectPath: string): boolean {\n  return removeAntigravityHooksFromFile(join(projectPath, '.agents', 'hooks.json'));\n}\n\nexport function removeAntigravityUserHooks(): boolean {\n  const modern = removeAntigravityHooksFromFile(join(homedir(), '.gemini', 'config', 'hooks.json'));\n  const legacy = removeAntigravityHooksFromFile(join(homedir(), '.gemini', 'hooks.json'));\n  return modern || legacy;\n}\n"],
-  "mappings": ";AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,WAAW,cAAc,eAAe,YAAY,oBAAoB;AAC7F,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAQvB,SAAS,qBAAqB,aAAqC;AACxE,QAAM,QAAwB,CAAC,aAAa;AAE5C,MAAI,WAAW,KAAK,aAAa,SAAS,CAAC,GAAG;AAC5C,UAAM,KAAK,QAAQ;AAAA,EACrB;AAEA,MAAI,WAAW,KAAK,aAAa,SAAS,CAAC,GAAG;AAC5C,UAAM,KAAK,eAAe;AAAA,EAC5B;AAKA,MAAI,WAAW,KAAK,aAAa,SAAS,CAAC,GAAG;AAC5C,UAAM,KAAK,aAAa;AAAA,EAC1B;AAEA,SAAO;AACT;AAQO,SAAS,0BAA0B,QAAyB;AAWjE,QAAM,SAAS,SAAS,SAAS,MAAM,aAAa;AACpD,QAAM,MAAM,CAAC,UAAkB,EAAE,SAAS,GAAG,MAAM,wBAAwB,IAAI,GAAG;AAClF,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACL,cAAc,CAAC,IAAI,eAAe,CAAC;AAAA,MACnC,oBAAoB,CAAC,IAAI,aAAa,CAAC;AAAA,MACvC,eAAe,CAAC,IAAI,eAAe,CAAC;AAAA,MACpC,sBAAsB,CAAC,IAAI,eAAe,CAAC;AAAA,MAC3C,qBAAqB,CAAC,IAAI,eAAe,CAAC;AAAA,MAC1C,oBAAoB,CAAC,IAAI,eAAe,CAAC;AAAA,MACzC,mBAAmB,CAAC,IAAI,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQxC,oBAAoB,CAAC,IAAI,oBAAoB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAK9C,MAAM,CAAC,IAAI,eAAe,CAAC;AAAA,MAC3B,YAAY,CAAC,IAAI,aAAa,CAAC;AAAA,IACjC;AAAA,EACF;AACF;AAQO,SAAS,2BAA2B,QAAyB;AAGlE,QAAM,SAAS,SAAS,SAAS,MAAM,aAAa;AACpD,QAAM,MAAM,CAAC,UAAkB,EAAE,MAAM,WAAW,MAAM,GAAG,MAAM,wBAAwB,IAAI,GAAG;AAChG,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,MACL,cAAc,CAAC,IAAI,eAAe,CAAC;AAAA,MACnC,qBAAqB,CAAC,IAAI,aAAa,CAAC;AAAA,MACxC,aAAa,CAAC,IAAI,eAAe,CAAC;AAAA,MAClC,YAAY,CAAC,IAAI,aAAa,CAAC;AAAA,IACjC;AAAA,EACF;AACF;AAgCO,SAAS,8BAA8B,QAAwC;AAYpF,QAAM,SAAS,SAAS,SAAS,MAAM,aAAa;AACpD,QAAM,KAAK,CAAC,UAAmC;AAAA,IAC7C,MAAM;AAAA,IACN,SAAS,GAAG,MAAM,wBAAwB,IAAI;AAAA,EAChD;AACA,SAAO;AAAA,IACL,cAAc,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,IAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,IACjD,aAAa,CAAC,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC;AAAA,IAC5C,YAAY,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,EAC7C;AACF;AAcO,SAAS,mBAAmB,YAGjC;AACA,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO,EAAE,UAAU,CAAC,GAAG,iBAAiB,KAAK;AAC1E,QAAM,MAAM,aAAa,YAAY,OAAO;AAC5C,MAAI;AACF,WAAO,EAAE,UAAU,KAAK,MAAM,GAAG,GAA8B,iBAAiB,KAAK;AAAA,EACvF,QAAQ;AACN,UAAM,kBAAkB,GAAG,UAAU;AACrC,kBAAc,iBAAiB,GAAG;AAClC,WAAO,EAAE,UAAU,CAAC,GAAG,gBAAgB;AAAA,EACzC;AACF;AASO,SAAS,8BACd,YACA,UAC+B;AAC/B,YAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,MAAI,aAA4B;AAChC,MAAI,WAAW,UAAU,GAAG;AAC1B,iBAAa,GAAG,UAAU;AAC1B,iBAAa,YAAY,UAAU;AAAA,EACrC;AACA,gBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAClE,SAAO,EAAE,WAAW;AACtB;AAYA,SAAS,kBAAkB,YAAoD;AAC7E,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO,CAAC;AACrC,QAAM,MAAM,aAAa,YAAY,OAAO;AAC5C,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,QAAI;AACF,oBAAc,GAAG,UAAU,gBAAgB,GAAG;AAAA,IAChD,QAAQ;AAAA,IAER;AACA,WAAO;AAAA,EACT;AACF;AAUO,SAAS,qBAAqB,UAAmC,QAAuB;AAC7F,QAAM,YAAY,8BAA8B,MAAM;AACtD,QAAM,QAAS,SAAS,SAAS,CAAC;AAClC,aAAW,CAAC,OAAO,MAAM,KAAK,OAAO,QAAQ,SAAS,GAAG;AACvD,UAAM,UAAW,MAAM,KAAK,KAAK,CAAC;AAClC,UAAM,iBAAiB,QAAQ;AAAA,MAAK,CAAC,MACnC,GAAG,OAAO,KAAK,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY,CAAC;AAAA,IAC1F;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,MAAM;AAAA,IACvC;AAAA,EACF;AACA,WAAS,QAAQ;AACnB;AASO,SAAS,yBAAyB,UAA4C;AACnF,MAAI,CAAC,SAAS,SAAS,OAAO,SAAS,UAAU,SAAU,QAAO;AAClE,QAAM,QAAQ,SAAS;AACvB,SAAO,OAAO,OAAO,KAAK,EAAE;AAAA,IAC1B,CAAC,WACC,MAAM,QAAQ,MAAM,KACpB,OAAO;AAAA,MAAK,CAAC,MACX,GAAG,OAAO,KAAK,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY,CAAC;AAAA,IAC1F;AAAA,EACJ;AACF;AAQO,SAAS,sBAAsB,UAA4C;AAChF,MAAI,CAAC,SAAS,SAAS,OAAO,SAAS,UAAU,SAAU,QAAO;AAClE,QAAM,QAAQ,SAAS;AACvB,MAAI,UAAU;AACd,aAAW,SAAS,OAAO,KAAK,KAAK,GAAG;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,QAAQ,OAAO,EAAG;AAC7B,UAAM,OAAO,QAAQ,OAAO,CAAC,UAAU;AACrC,YAAM,eAAe,OAAO,OAAO;AAAA,QACjC,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY;AAAA,MAC1E;AACA,UAAI,aAAc,YAAW;AAC7B,aAAO,CAAC;AAAA,IACV,CAAC;AACD,QAAI,KAAK,WAAW,EAAG,QAAO,MAAM,KAAK;AAAA,QACpC,OAAM,KAAK,IAAI;AAAA,EACtB;AACA,MAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,SAAS;AACrD,SAAO,UAAU;AACnB;AAQA,SAAS,sBAAsB,WAAmB,QAAgC;AAChF,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,KAAK,WAAW,YAAY;AAC/C,QAAM,YAAY,0BAA0B,MAAM;AAKlD,QAAM,SAAS,kBAAkB,UAAU;AAC3C,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,WAAW;AAEjB,QAAM,SAAoC,EAAE,GAAI,SAAS,SAAS,CAAC,EAAG;AAEtE,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,UAAU,KAAK,GAAG;AAC5D,UAAM,UAAU,OAAO,KAAK,KAAK,CAAC;AAClC,UAAM,gBAAgB,QAAQ;AAAA,MAC5B,CAAC,MACC,OAAO,MAAM,YACb,MAAM,QACN,aAAa,KACb,OAAQ,EAA0B,YAAY,YAC7C,EAA0B,QAAQ,SAAS,YAAY;AAAA,IAC5D;AACA,QAAI,CAAC,eAAe;AAClB,aAAO,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,KAAK;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,SAAS;AAAA,IACb,SAAS,SAAS,WAAW,UAAU;AAAA,IACvC,OAAO;AAAA,EACT;AAEA,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChE,SAAO;AACT;AAOO,SAAS,iBAAiB,aAAqB,QAAgC;AACpF,SAAO,sBAAsB,KAAK,aAAa,SAAS,GAAG,MAAM;AACnE;AASO,SAAS,qBAAqB,QAAgC;AACnE,SAAO,sBAAsB,KAAK,QAAQ,GAAG,SAAS,GAAG,MAAM;AACjE;AAOO,SAAS,kBAAkB,aAAqB,QAAgC;AACrF,QAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,KAAK,WAAW,OAAO;AACxC,YAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AAEvC,QAAM,aAAa,KAAK,UAAU,iBAAiB;AACnD,QAAM,SAAS,2BAA2B,MAAM;AAEhD,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChE,SAAO;AACT;AAOA,SAAS,0BAA0B,YAA6B;AAC9D,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,OAAO,OAAO;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AACd,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG;AACzD,UAAM,WAAW,MAAM,OAAO,CAAC,MAAe;AAC5C,UAAI,OAAO,MAAM,YAAY,MAAM,QAAQ,EAAE,aAAa,GAAI,QAAO;AACrE,YAAM,MAAO,EAA0B;AACvC,UAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,YAAY,GAAG;AACzD,kBAAU;AACV,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT,CAAC;AAED,QAAI,SAAS,WAAW,GAAG;AACzB,aAAO,OAAO,MAAM,KAAK;AAAA,IAC3B,OAAO;AACL,aAAO,MAAM,KAAK,IAAI;AAAA,IACxB;AAAA,EACF;AAEA,MAAI,SAAS;AACX,kBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAClE;AAEA,SAAO;AACT;AAKO,SAAS,kBAAkB,aAA8B;AAC9D,SAAO,0BAA0B,KAAK,aAAa,WAAW,YAAY,CAAC;AAC7E;AAKO,SAAS,wBAAiC;AAC/C,SAAO,0BAA0B,KAAK,QAAQ,GAAG,WAAW,YAAY,CAAC;AAC3E;AAOO,SAAS,uBAAuB,aAAqB,aAAqB,UAA2B;AAC1G,QAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,MAAI,CAAC,WAAW,SAAS,EAAG,QAAO;AAEnC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAE9B,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI,WAAW,QAAQ;AACrD,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAQO,SAAS,uBAAuB,aAAqB,aAAqB,UAA2B;AAC1G,QAAM,YAAY,KAAK,aAAa,SAAS;AAK7C,MAAI,CAAC,WAAW,SAAS,EAAG,QAAO;AAEnC,QAAM,eAAe,KAAK,WAAW,eAAe;AACpD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAE9B,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI,WAAW,QAAQ;AAGrD,QAAM,kBAAmB,SAAS,yBAAyB,KAAK,CAAC;AACjE,kBAAgB,wBAAwB,IAAI,oBAAoB,WAAW;AAC3E,WAAS,yBAAyB,IAAI;AAEtC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAOO,SAAS,wBAAwB,aAA8B;AACpE,QAAM,eAAe,KAAK,aAAa,WAAW,eAAe;AACjE,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AAE1F,MAAI,UAAU;AAEd,MAAI,SAAS,YAAY,GAAG;AAC1B,WAAO,SAAS,YAAY;AAC5B,WAAO,SAAS,qBAAqB;AACrC,cAAU;AAAA,EACZ;AAEA,QAAM,kBAAkB,SAAS,yBAAyB;AAC1D,MAAI,kBAAkB,wBAAwB,GAAG;AAC/C,WAAO,gBAAgB,wBAAwB;AAC/C,QAAI,OAAO,KAAK,eAAe,EAAE,WAAW,GAAG;AAC7C,aAAO,SAAS,yBAAyB;AAAA,IAC3C;AACA,cAAU;AAAA,EACZ;AAEA,MAAI,SAAS;AACX,kBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAAA,EACtE;AAEA,SAAO;AACT;AAMO,SAAS,mBAAmB,aAA8B;AAC/D,QAAM,aAAa,KAAK,aAAa,WAAW,SAAS,iBAAiB;AAC1E,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT;AAEA,aAAW,UAAU;AACrB,SAAO;AACT;AAMA,IAAM,qBAAqB;AAE3B,SAAS,qBAA6B;AACpC,SAAO,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,kBAAkB,QAAQ;AACjF;AAiBO,SAAS,qBAAqB,aAAqB,UAA2B;AACnF,MAAI,QAAQ,aAAa,SAAU,QAAO;AAE1C,QAAM,WAAW,oBAAoB,WAAW;AAGhD,MAAI;AACF,aAAS,gCAAgC,QAAQ,IAAI,EAAE,OAAO,OAAO,CAAC;AACtE,QAAI,WAAW,QAAQ,GAAG;AACxB,eAAS,wCAAwC,QAAQ,IAAI,EAAE,OAAO,OAAO,CAAC;AAAA,IAChF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,QAAM,YAAY,mBAAmB;AACrC,QAAM,YAAY,KAAK,QAAQ,GAAG,WAAW,cAAc;AAC3D,YAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAExC,QAAM,WAAW,WAAW,QAAQ,IAChC,wCAAwC,QAAQ,MAChD;AAQJ,QAAM,UACJ,2BAA2B,WAAW,mDACN,QAAQ,IAAI,QAAQ;AAGtD,QAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAMJ,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,cAKhB,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQnB,gBAAc,WAAW,KAAK;AAC9B,SAAO;AACT;AAKO,SAAS,yBAAkC;AAChD,MAAI,QAAQ,aAAa,SAAU,QAAO;AAE1C,MAAI,UAAU;AAGd,MAAI;AACF,aAAS,kCAAkC,EAAE,OAAO,OAAO,CAAC;AAC5D,aAAS,0CAA0C,EAAE,OAAO,OAAO,CAAC;AAAA,EACtE,QAAQ;AAAA,EAAuB;AAG/B,QAAM,YAAY,mBAAmB;AACrC,MAAI,WAAW,SAAS,GAAG;AACzB,eAAW,SAAS;AACpB,cAAU;AAAA,EACZ;AAEA,SAAO;AACT;AAMA,SAAS,4BAAoC;AAC3C,MAAI,QAAQ,aAAa,UAAU;AACjC,WAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,QAAQ,QAAQ,eAAe;AAAA,EAC1F;AACA,MAAI,QAAQ,aAAa,SAAS;AAChC,WAAO,KAAK,QAAQ,IAAI,WAAW,IAAI,QAAQ,QAAQ,eAAe;AAAA,EACxE;AACA,SAAO,KAAK,QAAQ,GAAG,WAAW,QAAQ,QAAQ,eAAe;AACnE;AASO,SAAS,2BAA2B,aAA8B;AACvE,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,KAAK,cAAc,IAAI,CAAC,EAAG,QAAO;AAElD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAG9B,MAAI,SAAS,YAAY,KAAK,CAAE,SAAS,YAAY,EAAa,SAAS,WAAW,GAAG;AACvF,WAAO;AAAA,EACT;AAEA,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI;AAElC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAKO,SAAS,8BAAuC;AACrD,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AAE1F,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,SAAO,SAAS,YAAY;AAC5B,SAAO,SAAS,qBAAqB;AACrC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAaA,SAAS,4BAAoC;AAC3C,MAAI,QAAQ,aAAa,UAAU;AACjC,WAAO,KAAK,QAAQ,GAAG,WAAW,uBAAuB,UAAU,QAAQ,eAAe;AAAA,EAC5F;AACA,MAAI,QAAQ,aAAa,SAAS;AAChC,WAAO,KAAK,QAAQ,IAAI,WAAW,IAAI,UAAU,QAAQ,eAAe;AAAA,EAC1E;AACA,SAAO,KAAK,QAAQ,GAAG,WAAW,UAAU,QAAQ,eAAe;AACrE;AAWO,SAAS,2BAA2B,aAA8B;AACvE,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,KAAK,cAAc,IAAI,CAAC,EAAG,QAAO;AAElD,QAAM,WAAW,kBAAkB,YAAY;AAC/C,MAAI,aAAa,KAAM,QAAO;AAE9B,MAAI,SAAS,YAAY,KAAK,CAAE,SAAS,YAAY,EAAa,SAAS,WAAW,GAAG;AACvF,WAAO;AAAA,EACT;AAEA,WAAS,YAAY,IAAI,oBAAoB,WAAW;AACxD,WAAS,qBAAqB,IAAI;AAElC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAKO,SAAS,8BAAuC;AACrD,QAAM,eAAe,0BAA0B;AAC/C,MAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AAEtC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AAE1F,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,SAAO,SAAS,YAAY;AAC5B,SAAO,SAAS,qBAAqB;AACrC,gBAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AACpE,SAAO;AACT;AAkCA,SAAS,uBAA+B;AAGtC,QAAM,UAAU,QAAQ;AAMxB,QAAM,WAAW,QAAQ,KAAK,CAAC;AAC/B,MAAI,YAAY,SAAS,SAAS,QAAQ,GAAG;AAC3C,WAAO,GAAG,OAAO,IAAI,QAAQ;AAAA,EAC/B;AACA,SAAO;AACT;AAEO,SAAS,iCAAyD;AACvE,QAAM,MAAM,qBAAqB;AACjC,QAAM,KAAK,CAAC,UAAwC;AAAA,IAClD,MAAM;AAAA,IACN,SAAS,oCAAoC,GAAG,cAAc,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO;AAAA,IACL,YAAY;AAAA,MACV,SAAS;AAAA,MACT,cAAc,CAAC,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,MAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,MACjD,YAAY,CAAC,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,MAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,OAAO,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,MAC7D,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC;AAAA,MAC5C,YAAY,CAAC,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,KAA4B;AAC9D,QAAM,aAAa,KAAK,KAAK,YAAY;AACzC,QAAM,WAAW,kBAAkB,UAAU;AAC7C,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,YAAY,+BAA+B;AAGjD,QAAM,SAAS,EAAE,GAAG,UAAU,YAAY,UAAU,WAAW;AAC/D,YAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAChE,SAAO;AACT;AAEO,SAAS,sBAAsB,aAAoC;AACxE,SAAO,2BAA2B,KAAK,aAAa,SAAS,CAAC;AAChE;AAEO,SAAS,4BAA2C;AACzD,QAAM,YAAY,KAAK,QAAQ,GAAG,WAAW,QAAQ;AACrD,SAAO,2BAA2B,SAAS;AAC7C;AAEA,SAAS,+BAA+B,YAA6B;AACnE,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,MAAI;AACJ,MAAI;AAAE,eAAW,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAO;AACxF,MAAI,EAAE,gBAAgB,UAAW,QAAO;AACxC,SAAO,SAAS;AAChB,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AAEtC,QAAI;AAAE,iBAAW,UAAU;AAAA,IAAG,QAAQ;AAAA,IAAe;AAAA,EACvD,OAAO;AACL,kBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAAA,EACpE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,aAA8B;AACnE,SAAO,+BAA+B,KAAK,aAAa,WAAW,YAAY,CAAC;AAClF;AAEO,SAAS,6BAAsC;AACpD,QAAM,SAAS,+BAA+B,KAAK,QAAQ,GAAG,WAAW,UAAU,YAAY,CAAC;AAChG,QAAM,SAAS,+BAA+B,KAAK,QAAQ,GAAG,WAAW,YAAY,CAAC;AACtF,SAAO,UAAU;AACnB;",
-  "names": []
-}

package/dist/chunk-OVGP4OGK.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/gateway-lifecycle.ts"],
-  "sourcesContent": ["/**\n * Gateway process lifecycle helpers \u2014 spawn, stop, check status.\n * Used by hooks install/uninstall, session-start hook, and proxy status.\n */\nimport { spawn } from 'node:child_process';\nimport { createConnection } from 'node:net';\nimport { existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, resolve } from 'node:path';\n\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nexport const GATEWAY_PID_FILE = join(CONFIG_DIR, 'gateway.pid');\nexport const GATEWAY_LOG_FILE = join(CONFIG_DIR, 'gateway.log');\nexport const GATEWAY_PORT = 8787;\nexport const MITMPROXY_PORT = 8788;\n\n/**\n * TCP liveness probe: does something actually ACCEPT a connection on the port?\n * Distinct from isGatewayRunning() (which only checks the PID is alive) \u2014 a\n * process can be \"running\" per its pidfile while :8787 accepts nothing. This is\n * the check that must gate writing HTTPS_PROXY: never pin Claude Code's proxy\n * at a port with nothing behind it (the fresh-laptop ConnectionRefused footgun).\n */\nexport function isGatewayListening(port: number = GATEWAY_PORT, timeoutMs = 1500): Promise<boolean> {\n  return new Promise((resolveProbe) => {\n    const socket = createConnection({ host: '127.0.0.1', port });\n    const finish = (result: boolean) => {\n      socket.destroy();\n      resolveProbe(result);\n    };\n    socket.setTimeout(timeoutMs);\n    socket.once('connect', () => finish(true));\n    socket.once('timeout', () => finish(false));\n    socket.once('error', () => finish(false));\n  });\n}\n\n/**\n * Poll isGatewayListening() until it's true or the window elapses. spawnGateway()\n * returns as soon as it writes the PID file \u2014 the detached child hasn't bound\n * :8787 yet (Node bootstrap + module load). A one-shot probe microseconds later\n * fails-closed on every fresh install, so the proxy/deep-capture layer silently\n * never turns on. This tolerates a normal cold-start bind delay.\n */\nexport async function waitForGatewayListening(\n  port: number = GATEWAY_PORT,\n  { timeoutMs = 3000, intervalMs = 150 }: { timeoutMs?: number; intervalMs?: number } = {},\n): Promise<boolean> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    if (await isGatewayListening(port, Math.min(1500, timeoutMs))) return true;\n    if (Date.now() >= deadline) return false;\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n  }\n}\n\nexport function isGatewayRunning(): boolean {\n  if (!existsSync(GATEWAY_PID_FILE)) return false;\n\n  const content = readFileSync(GATEWAY_PID_FILE, 'utf-8').trim();\n  const pid = parseInt(content, 10);\n  if (isNaN(pid)) return false;\n\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function getGatewayPid(): number | null {\n  if (!existsSync(GATEWAY_PID_FILE)) return null;\n  const content = readFileSync(GATEWAY_PID_FILE, 'utf-8').trim();\n  const pid = parseInt(content, 10);\n  return isNaN(pid) ? null : pid;\n}\n\nfunction findGatewayEntry(): string {\n  // Look for the compiled gateway-entry.js relative to this file's location\n  const candidates = [\n    resolve(import.meta.dirname, './gateway-entry.js'),\n    resolve(import.meta.dirname, '../lib/gateway-entry.js'),\n  ];\n  for (const p of candidates) {\n    if (existsSync(p)) return p;\n  }\n  throw new Error(\n    'Could not find gateway-entry.js. Is the CLI built?\\n' +\n    'Searched:\\n' + candidates.map(c => `  ${c}`).join('\\n'),\n  );\n}\n\nexport function spawnGateway(cliVersion?: string): number {\n  if (isGatewayRunning()) {\n    const pid = getGatewayPid();\n    if (pid) return pid;\n  }\n\n  mkdirSync(CONFIG_DIR, { recursive: true });\n\n  const entryPath = findGatewayEntry();\n  const logFd = openSync(GATEWAY_LOG_FILE, 'a');\n\n  const child = spawn(process.execPath, [entryPath], {\n    detached: true,\n    stdio: ['ignore', logFd, logFd],\n    // The gateway inherits the spawning CLI's env. RULEMETRIC_CLI_VERSION\n    // identifies the CLI version that started this gateway \u2014 used to\n    // detect drift when a newer CLI starts mitmproxy with a different\n    // version. RULEMETRIC_CLI_ENTRY is the path to the oclif entry point\n    // (process.argv[1]) so the gateway can re-invoke the CLI for\n    // `proxy restart` without needing the binary in PATH. Falls back to\n    // \"unknown\" if the caller didn't pass them.\n    env: {\n      ...process.env,\n      RULEMETRIC_CLI_VERSION: cliVersion ?? 'unknown',\n      RULEMETRIC_CLI_ENTRY: process.argv[1] ?? '',\n    },\n  });\n\n  child.unref();\n\n  if (!child.pid) {\n    throw new Error('Failed to spawn gateway process');\n  }\n\n  writeFileSync(GATEWAY_PID_FILE, String(child.pid));\n  return child.pid;\n}\n\nexport function stopGateway(): boolean {\n  const pid = getGatewayPid();\n  if (pid === null) return false;\n\n  try {\n    process.kill(pid, 'SIGTERM');\n  } catch {\n    // Process already gone\n  }\n\n  try { unlinkSync(GATEWAY_PID_FILE); } catch { /* already gone */ }\n  return true;\n}\n"],
-  "mappings": ";AAIA,SAAS,aAAa;AACtB,SAAS,wBAAwB;AACjC,SAAS,YAAY,WAAW,UAAU,cAAc,YAAY,qBAAqB;AACzF,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAE9B,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AACnD,IAAM,mBAAmB,KAAK,YAAY,aAAa;AACvD,IAAM,mBAAmB,KAAK,YAAY,aAAa;AACvD,IAAM,eAAe;AACrB,IAAM,iBAAiB;AASvB,SAAS,mBAAmB,OAAe,cAAc,YAAY,MAAwB;AAClG,SAAO,IAAI,QAAQ,CAAC,iBAAiB;AACnC,UAAM,SAAS,iBAAiB,EAAE,MAAM,aAAa,KAAK,CAAC;AAC3D,UAAM,SAAS,CAAC,WAAoB;AAClC,aAAO,QAAQ;AACf,mBAAa,MAAM;AAAA,IACrB;AACA,WAAO,WAAW,SAAS;AAC3B,WAAO,KAAK,WAAW,MAAM,OAAO,IAAI,CAAC;AACzC,WAAO,KAAK,WAAW,MAAM,OAAO,KAAK,CAAC;AAC1C,WAAO,KAAK,SAAS,MAAM,OAAO,KAAK,CAAC;AAAA,EAC1C,CAAC;AACH;AASA,eAAsB,wBACpB,OAAe,cACf,EAAE,YAAY,KAAM,aAAa,IAAI,IAAiD,CAAC,GACrE;AAClB,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,QAAI,MAAM,mBAAmB,MAAM,KAAK,IAAI,MAAM,SAAS,CAAC,EAAG,QAAO;AACtE,QAAI,KAAK,IAAI,KAAK,SAAU,QAAO;AACnC,UAAM,IAAI,QAAQ,CAACA,aAAY,WAAWA,UAAS,UAAU,CAAC;AAAA,EAChE;AACF;AAEO,SAAS,mBAA4B;AAC1C,MAAI,CAAC,WAAW,gBAAgB,EAAG,QAAO;AAE1C,QAAM,UAAU,aAAa,kBAAkB,OAAO,EAAE,KAAK;AAC7D,QAAM,MAAM,SAAS,SAAS,EAAE;AAChC,MAAI,MAAM,GAAG,EAAG,QAAO;AAEvB,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAA+B;AAC7C,MAAI,CAAC,WAAW,gBAAgB,EAAG,QAAO;AAC1C,QAAM,UAAU,aAAa,kBAAkB,OAAO,EAAE,KAAK;AAC7D,QAAM,MAAM,SAAS,SAAS,EAAE;AAChC,SAAO,MAAM,GAAG,IAAI,OAAO;AAC7B;AAEA,SAAS,mBAA2B;AAElC,QAAM,aAAa;AAAA,IACjB,QAAQ,YAAY,SAAS,oBAAoB;AAAA,IACjD,QAAQ,YAAY,SAAS,yBAAyB;AAAA,EACxD;AACA,aAAW,KAAK,YAAY;AAC1B,QAAI,WAAW,CAAC,EAAG,QAAO;AAAA,EAC5B;AACA,QAAM,IAAI;AAAA,IACR,oEACgB,WAAW,IAAI,OAAK,KAAK,CAAC,EAAE,EAAE,KAAK,IAAI;AAAA,EACzD;AACF;AAEO,SAAS,aAAa,YAA6B;AACxD,MAAI,iBAAiB,GAAG;AACtB,UAAM,MAAM,cAAc;AAC1B,QAAI,IAAK,QAAO;AAAA,EAClB;AAEA,YAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AAEzC,QAAM,YAAY,iBAAiB;AACnC,QAAM,QAAQ,SAAS,kBAAkB,GAAG;AAE5C,QAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,SAAS,GAAG;AAAA,IACjD,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,OAAO,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQ9B,KAAK;AAAA,MACH,GAAG,QAAQ;AAAA,MACX,wBAAwB,cAAc;AAAA,MACtC,sBAAsB,QAAQ,KAAK,CAAC,KAAK;AAAA,IAC3C;AAAA,EACF,CAAC;AAED,QAAM,MAAM;AAEZ,MAAI,CAAC,MAAM,KAAK;AACd,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AAEA,gBAAc,kBAAkB,OAAO,MAAM,GAAG,CAAC;AACjD,SAAO,MAAM;AACf;AAEO,SAAS,cAAuB;AACrC,QAAM,MAAM,cAAc;AAC1B,MAAI,QAAQ,KAAM,QAAO;AAEzB,MAAI;AACF,YAAQ,KAAK,KAAK,SAAS;AAAA,EAC7B,QAAQ;AAAA,EAER;AAEA,MAAI;AAAE,eAAW,gBAAgB;AAAA,EAAG,QAAQ;AAAA,EAAqB;AACjE,SAAO;AACT;",
-  "names": ["resolve"]
-}