@rulemetric/cli 0.6.9 → 0.7.1

package/dist/chunk-OKWCKCPE.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/setup-steps.ts"],
+  "sourcesContent": ["import { execSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { isAuthenticated, getDefaultConfigDir } from './auth.js';\nimport { apiGet } from './api-client.js';\nimport { GATEWAY_PORT, isGatewayListening } from './gateway-lifecycle.js';\nimport {\n  detectInstalledTools,\n  mergeClaudeCodeHooks,\n  hasRulemetricClaudeHooks,\n  removeRulemetricMachineState,\n  RULEMETRIC_NO_PROXY,\n} from './hooks-config.js';\n\n/**\n * Data model for the four core onboarding steps, shared (by step-ID list +\n * install-monotonicity) with the web reducer `deriveSetupProgress()`.\n *\n * The two surfaces are separate implementations by necessity, but they no\n * longer read *different sources* for the same fact:\n *   - Server-observable signals (cli-worker heartbeat / captured session) are\n *     unified through the shared `GET /api/setup/status` endpoint \u2014 the CLI's\n *     `workerActive()` and the web's `use-setup-progress.ts` both bottom out on\n *     that one server-side authority, so they cannot drift on it.\n *   - Local signals (auth = `~/.config/rulemetric` creds via `isAuthenticated()`,\n *     hooks = cwd `.claude/settings.local.json`, falling back to the shared\n *     `settings.json` for legacy installs) stay machine-local: the browser\n *     cannot read the user's filesystem, so these legitimately differ from the\n *     web's account-scoped proxies for the same step (see the design doc's\n *     \"Shared step model, two implementations\").\n * Each step exposes:\n *   - detect(): is it done? (reads a local/remote signal, never mutates)\n *   - plan():   what would apply() write? (read-only, returns diffs/artifacts)\n *   - apply():  perform the step (thin \u2014 shells out to existing commands)\n */\n\nexport const CORE_STEP_IDS = ['install', 'auth', 'hooks', 'worker'] as const;\n// Optional steps live in the walk (offered, recommended) but do NOT gate\n// `coreComplete` \u2014 declining them still leaves the user fully onboarded. The\n// proxy/CA capture now ships as the DEFAULT of the core `hooks` step (see that\n// step's plan(), which fully discloses the invasive MITM/keychain side effects\n// up front); it is not a separate opt-in step. The mechanism is retained for\n// any future optional step.\nexport const OPTIONAL_STEP_IDS = [] as const;\nexport const ALL_STEP_IDS = [...CORE_STEP_IDS, ...OPTIONAL_STEP_IDS] as const;\nexport type StepId = (typeof ALL_STEP_IDS)[number];\n\nexport type ArtifactKind = 'file' | 'command' | 'service';\n\nexport interface Artifact {\n  path: string;\n  kind: ArtifactKind;\n  before: string | null;\n  after: string | null;\n  /** True when `after` contains a masked secret (never the raw value). */\n  masked?: boolean;\n}\n\nexport interface StepPlan {\n  id: StepId;\n  title: string;\n  command?: string;\n  artifacts: Artifact[];\n}\n\nexport interface SetupContext {\n  projectPath: string;\n  configDir: string;\n}\n\nexport interface SetupStep {\n  id: StepId;\n  title: string;\n  command?: string;\n  /** Optional steps are offered in the walk but never gate `coreComplete`. */\n  optional?: boolean;\n  detect(ctx: SetupContext): Promise<boolean>;\n  plan(ctx: SetupContext): Promise<StepPlan>;\n  apply(ctx: SetupContext): Promise<void>;\n}\n\nexport interface StepStatus {\n  id: StepId;\n  done: boolean;\n}\n\nexport interface SetupStatus {\n  steps: StepStatus[];\n  coreComplete: boolean;\n  currentStepId: StepId | null;\n}\n\n/** Build the default context from the current process (cwd + config dir). */\nexport function defaultContext(): SetupContext {\n  return {\n    projectPath: process.cwd(),\n    configDir: getDefaultConfigDir(),\n  };\n}\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\n/**\n * Mask a secret: keep the first 4 and last 4 characters, replace the middle\n * with asterisks. Strings too short to reveal safely are fully masked.\n */\nexport function maskToken(s: string): string {\n  if (!s) return '';\n  if (s.length <= 8) return '*'.repeat(s.length);\n  const head = s.slice(0, 4);\n  const tail = s.slice(-4);\n  return `${head}${'*'.repeat(Math.max(4, s.length - 8))}${tail}`;\n}\n\n/**\n * Simple line-oriented +/- diff for terminal display. Not a real LCS \u2014 good\n * enough to show a human/agent exactly which lines an artifact would change.\n */\nexport function renderDiff(before: string | null, after: string | null): string {\n  const beforeLines = before === null ? [] : before.replace(/\\n$/, '').split('\\n');\n  const afterLines = after === null ? [] : after.replace(/\\n$/, '').split('\\n');\n  const out: string[] = [];\n  const max = Math.max(beforeLines.length, afterLines.length);\n  for (let i = 0; i < max; i++) {\n    const b = beforeLines[i];\n    const a = afterLines[i];\n    if (b === a) {\n      out.push(` ${b}`);\n    } else {\n      if (b !== undefined) out.push(`-${b}`);\n      if (a !== undefined) out.push(`+${a}`);\n    }\n  }\n  return out.join('\\n');\n}\n\n/** Read a single KEY=value from the env file, or null if absent. */\nfunction readEnvValue(configDir: string, key: string): string | null {\n  const envPath = join(configDir, 'env');\n  if (!existsSync(envPath)) return null;\n  try {\n    const content = readFileSync(envPath, 'utf-8');\n    const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n    return match ? match[1] : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Is a CLI worker heartbeat active for the caller? (best-effort, network)\n *\n * Reads the shared `GET /api/setup/status` endpoint's `workerActive` field\n * rather than re-deriving it from `/api/workers/status`. That endpoint computes\n * the cli-worker heartbeat signal server-side using the SAME window +\n * staleness thresholds + `workerType === 'cli-worker'` filter the web strip\n * uses, so the CLI and web can't drift on this fact by construction (they used\n * to each filter/threshold client-side, which is exactly how they could\n * disagree). Fast-fails after 2.5s so `setup --json` / `setup plan` degrade to\n * \"not running\" instead of blocking on a stalled connection \u2014 detection is a\n * UX signal, not a correctness gate; offline \u2192 false.\n */\nasync function workerActive(): Promise<boolean> {\n  if (!isAuthenticated()) return false;\n  try {\n    const status = await Promise.race([\n      apiGet<{\n        cliEverConnected?: boolean;\n        anyCapturedSession?: boolean;\n        workerActive?: boolean;\n      }>('/api/setup/status'),\n      new Promise<never>((_, reject) =>\n        setTimeout(() => reject(new Error('setup/status timeout')), 2500),\n      ),\n    ]);\n    return status?.workerActive === true;\n  } catch {\n    return false;\n  }\n}\n\n/** Read a project `.claude/<fileName>` settings file for a read-only preview (no throw). */\nfunction readProjectSettings(\n  projectPath: string,\n  fileName: string,\n): { settings: Record<string, unknown>; before: string | null } {\n  const settingsPath = join(projectPath, '.claude', fileName);\n  let settings: Record<string, unknown> = {};\n  let before: string | null = null;\n  if (existsSync(settingsPath)) {\n    try {\n      before = readFileSync(settingsPath, 'utf-8').replace(/\\n$/, '');\n      settings = JSON.parse(before) as Record<string, unknown>;\n    } catch {\n      settings = {};\n    }\n  }\n  return { settings, before };\n}\n\n/**\n * Compute the in-memory `.claude/settings.local.json` after the RuleMetric\n * session HOOKS are merged, WITHOUT touching disk. This is the \u00A71 (hooks)\n * portion of the diff; the proxy env block that `hooks install` \u00A72 also writes\n * is disclosed separately via projectProxyEnvSettings so the two changes read\n * distinctly. Machine-local state targets settings.local.json \u2014 the shared\n * settings.json is typically checked into git (see claudeSettingsInstallPath).\n */\nfunction projectHooksSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath, 'settings.local.json');\n  mergeClaudeCodeHooks(settings);\n  return { before, after: JSON.stringify(settings, null, 2) };\n}\n\n/**\n * The proxy-env addition to `.claude/settings.local.json` that `hooks install`\n * \u00A72 makes on the default path \u2014 for the disclosure diff only. Read-only.\n */\nfunction projectProxyEnvSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath, 'settings.local.json');\n  const env = { ...((settings.env as Record<string, string>) ?? {}) };\n  env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n  env.NO_PROXY = RULEMETRIC_NO_PROXY;\n  env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n  return { before, after: JSON.stringify({ ...settings, env }, null, 2) };\n}\n\n/**\n * The migration edit `hooks install` makes to the SHARED `.claude/settings.json`\n * when it still carries RuleMetric machine-local state (legacy installs wrote\n * hooks + proxy env there; that state moves to settings.local.json). Returns\n * null when there is nothing of ours to remove \u2014 including when the shared\n * file is absent or unparseable (install skips it then too). Read-only.\n */\nfunction projectSharedSettingsMigration(projectPath: string): { before: string | null; after: string } | null {\n  const { settings, before } = readProjectSettings(projectPath, 'settings.json');\n  if (before === null) return null;\n  const { removed } = removeRulemetricMachineState(settings, GATEWAY_PORT);\n  if (!removed) return null;\n  return { before, after: JSON.stringify(settings, null, 2) };\n}\n\nconst WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', 'com.rulemetric.worker.plist');\nconst WORKER_SYSTEMD_PATH = join(homedir(), '.config', 'systemd', 'user', 'rulemetric-worker.service');\n\n/** Run a command with inherited stdio (interactive-friendly). Thin apply(). */\nfunction runCommand(cmd: string): void {\n  execSync(cmd, { stdio: 'inherit' });\n}\n\nexport const STEPS: SetupStep[] = [\n  {\n    id: 'install',\n    title: 'Install the CLI',\n    command: 'npm install -g @rulemetric/cli',\n    // Monotonic: the CLI must exist to produce any downstream signal, so it\n    // greens off auth or worker presence (nothing local phones home before).\n    async detect(): Promise<boolean> {\n      return isAuthenticated() || (await workerActive());\n    },\n    async plan(): Promise<StepPlan> {\n      return {\n        id: 'install',\n        title: 'Install the CLI',\n        command: 'npm install -g @rulemetric/cli',\n        artifacts: [\n          {\n            path: 'npm install -g @rulemetric/cli',\n            kind: 'command',\n            before: null,\n            after: 'rulemetric --version   # verifies the binary is on PATH',\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('npm install -g @rulemetric/cli');\n    },\n  },\n  {\n    id: 'auth',\n    title: 'Authenticate',\n    command: 'rulemetric auth login',\n    async detect(): Promise<boolean> {\n      return isAuthenticated();\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const envPath = join(ctx.configDir, 'env');\n      // Guard the read like the sibling helpers (readEnvValue /\n      // projectHooksSettings) do: a TOCTOU race or permission error between\n      // existsSync and readFileSync must NOT throw out of plan(). Fall back to\n      // a secret-free marker rather than crashing `setup plan`/`--show`.\n      let before: string | null = null;\n      if (existsSync(envPath)) {\n        try {\n          before = maskEnvFile(readFileSync(envPath, 'utf-8'));\n        } catch {\n          before = '(unreadable)';\n        }\n      }\n      const rawToken = readEnvValue(ctx.configDir, 'RULEMETRIC_ACCESS_TOKEN');\n      const tokenDisplay = rawToken ? maskToken(rawToken) : maskToken('<token-from-login>');\n      // Reconstruct EXACTLY what `auth login`'s saveEnvFile writes so the diff\n      // doesn't show phantom changes: line order [TOKEN, KEY?, URL?], the key\n      // preserved (masked) when present, and the URL sourced from\n      // process.env.RULEMETRIC_API_URL \u2014 the same value login passes \u2014 and OMITTED\n      // when unset (login writes no URL line then). All masking preserved; the raw\n      // token/key are never emitted.\n      const afterLines = [`RULEMETRIC_ACCESS_TOKEN=${tokenDisplay}`];\n      const rawApiKey = readEnvValue(ctx.configDir, 'RULEMETRIC_API_KEY');\n      if (rawApiKey) {\n        afterLines.push(`RULEMETRIC_API_KEY=${maskToken(rawApiKey)}`);\n      }\n      const loginUrl = process.env.RULEMETRIC_API_URL;\n      if (loginUrl) {\n        afterLines.push(`RULEMETRIC_API_URL=${loginUrl}`);\n      }\n      const after = afterLines.join('\\n');\n      return {\n        id: 'auth',\n        title: 'Authenticate',\n        command: 'rulemetric auth login',\n        artifacts: [\n          {\n            path: envPath,\n            kind: 'file',\n            before,\n            after,\n            masked: true,\n          },\n          // `auth login` (saveToken) also writes auth.json \u2014 disclose it so the\n          // plan matches every file apply() touches.\n          {\n            path: join(ctx.configDir, 'auth.json'),\n            kind: 'file',\n            before: existsSync(join(ctx.configDir, 'auth.json')) ? '(existing session tokens)' : null,\n            after: '{ accessToken, refreshToken, expiresAt, email }  \u2014 OAuth session tokens (secret)',\n            masked: true,\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric auth login');\n    },\n  },\n  {\n    id: 'hooks',\n    title: 'Install hooks + capture proxy',\n    // Default onboarding installs the FULL capture path: session hooks PLUS the\n    // MITM proxy (rendered-system-prompt / instruction linking + cross-tool\n    // capture). Every invasive side effect is disclosed up front in plan()\n    // below \u2014 nothing is silent. `hooks install` fails SAFE: if the CA sudo\n    // trust is declined it degrades to hooks-only (no machine-wide proxy pin),\n    // and HTTPS_PROXY is only pinned once the gateway actually answers on\n    // :8787 \u2014 so the default never bricks Claude Code. detect() greens on the\n    // capture hooks being present, so `coreComplete` is reachable even when the\n    // user declines the proxy.\n    command: 'rulemetric hooks install',\n    async detect(ctx): Promise<boolean> {\n      // Current installs write machine-local hooks to settings.local.json;\n      // legacy installs wrote the shared settings.json. Claude Code merges and\n      // runs hooks from both, so presence in EITHER file means capture is wired\n      // up. Ready when capture hooks are actually present \u2014 NOT when a proxy\n      // env var was written (that greened even against a dead proxy port). The\n      // proxy is a best-effort upgrade layered on top; hooks presence is the\n      // honest \"capture is working\" signal.\n      for (const fileName of ['settings.local.json', 'settings.json']) {\n        const settingsPath = join(ctx.projectPath, '.claude', fileName);\n        if (!existsSync(settingsPath)) continue;\n        try {\n          const settings = JSON.parse(readFileSync(settingsPath, 'utf-8')) as Record<string, unknown>;\n          if (hasRulemetricClaudeHooks(settings)) return true;\n        } catch {\n          /* unparseable \u2014 treat as absent */\n        }\n      }\n      return false;\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.local.json');\n      const { before, after } = projectHooksSettings(ctx.projectPath);\n      const artifacts: Artifact[] = [\n        { path: settingsPath, kind: 'file', before, after },\n        // Disclose what the hooks DO, not just that they're registered \u2014 these\n        // are the privacy-relevant behaviors a user is consenting to.\n        {\n          path: 'what these hooks capture',\n          kind: 'service',\n          before: null,\n          after:\n            'session-end reimports the FULL transcript to the API; post-tool-use records each ' +\n            'tool call and snapshots the working tree to a LOCAL shadow git ref (paper-trail, ' +\n            'never pushed); user-prompt posts prompt text. All scoped to sessions in this project.',\n        },\n        // FULL DISCLOSURE of the proxy layer \u2014 every invasive side effect of\n        // `hooks install` \u00A72 is enumerated here so the default path hides\n        // nothing. Each degrades gracefully (see the step comment): a declined\n        // CA-trust sudo skips the machine-wide layer and stays hooks-only.\n        {\n          // The proxy env block `hooks install` \u00A72 adds to the SAME\n          // .claude/settings.local.json (HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS).\n          path: `${settingsPath} (proxy env block)`,\n          kind: 'file',\n          ...projectProxyEnvSettings(ctx.projectPath),\n        },\n        {\n          path: 'system keychain \u2014 mitmproxy root CA',\n          kind: 'service',\n          before: existsSync(CERT_PATH) ? '(CA generated; trust state unchanged)' : '(no CA yet)',\n          after:\n            'Installs + trusts the mitmproxy CA (requires sudo). This lets the ' +\n            'proxy DECRYPT Claude Code HTTPS request/response bodies \u2014 the ' +\n            'capability that powers rendered-system-prompt / instruction linking. ' +\n            'Decline the sudo prompt and setup stays hooks-only (still fully onboarded).',\n        },\n        {\n          path: 'launchctl setenv HTTPS_PROXY (machine-wide, all GUI apps)',\n          kind: 'command',\n          before: null,\n          after: `http://localhost:${GATEWAY_PORT}  \u2014 routes every GUI app's HTTPS through the local gateway (only when the CA is trusted AND :${GATEWAY_PORT} is live)`,\n        },\n        {\n          path: 'VS Code + Cursor user settings (http.proxy)',\n          kind: 'file',\n          before: null,\n          after: `http.proxy \u2192 http://localhost:${GATEWAY_PORT} (+ http.proxyStrictSSL=false)`,\n        },\n        {\n          path: `gateway process on :${GATEWAY_PORT}`,\n          kind: 'service',\n          before: null,\n          after: 'started (routes Claude Code \u2192 mitmproxy \u2192 Anthropic; falls back to direct if mitmproxy is down)',\n        },\n      ];\n      // Migration disclosure: when a legacy/poisoned shared settings.json still\n      // carries RuleMetric machine-local state, install strips it (the state\n      // moves to settings.local.json above). That is a write to a typically\n      // checked-in file, so the plan must name it.\n      const sharedMigration = projectSharedSettingsMigration(ctx.projectPath);\n      if (sharedMigration) {\n        artifacts.push({\n          path: `${join(ctx.projectPath, '.claude', 'settings.json')} (removes RuleMetric machine-local state left by an older install \u2014 see the local-file artifacts above for where it moves)`,\n          kind: 'file',\n          ...sharedMigration,\n        });\n      }\n      // Workspace-level editor configs, only if those dirs exist here.\n      for (const tool of detectInstalledTools(ctx.projectPath).filter((t) => t === 'cursor' || t === 'copilot_agent')) {\n        artifacts.push({\n          path: `${ctx.projectPath} (${tool} workspace proxy config)`,\n          kind: 'file',\n          before: null,\n          after: `proxy \u2192 http://localhost:${GATEWAY_PORT}`,\n        });\n      }\n      // Cross-tool USER-level hooks \u2014 disclosed here, and (post-F2) written ONLY\n      // when the tool is already present so we never manufacture config for a\n      // tool the user doesn't have.\n      for (const [tool, home, file] of [\n        ['Cursor', join(homedir(), '.cursor'), join(homedir(), '.cursor', 'hooks.json')],\n        ['Antigravity/Gemini', join(homedir(), '.gemini'), join(homedir(), '.gemini', 'config', 'hooks.json')],\n      ] as const) {\n        if (existsSync(home)) {\n          artifacts.push({\n            path: `${file} (${tool} user hooks)`,\n            kind: 'file',\n            before: existsSync(file) ? '(existing config)' : null,\n            after: 'adds RuleMetric session-capture hooks for this tool',\n          });\n        }\n      }\n      return {\n        id: 'hooks',\n        title: 'Install hooks + capture proxy',\n        command: 'rulemetric hooks install',\n        artifacts,\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric hooks install');\n    },\n  },\n  {\n    id: 'worker',\n    title: 'Run the worker',\n    command: 'rulemetric service install --worker-only',\n    async detect(): Promise<boolean> {\n      return workerActive();\n    },\n    async plan(): Promise<StepPlan> {\n      const isMac = process.platform === 'darwin';\n      const servicePath = isMac ? WORKER_PLIST_PATH : WORKER_SYSTEMD_PATH;\n      // SECURITY: never read the installed plist/systemd unit into `before` \u2014\n      // those files embed RULEMETRIC_ACCESS_TOKEN / RULEMETRIC_API_KEY verbatim\n      // (service/install.ts writes them from ALLOWED_ENV_VARS), so echoing the\n      // file contents would leak the raw secret through `plan`, `--show`, and\n      // `--json`. Use a synthetic, secret-free marker for the current state.\n      const before = existsSync(servicePath)\n        ? `(service already installed at ${servicePath})`\n        : null;\n      // Concise representation (path + ExecStart node/cli invocation) rather\n      // than reconstructing the full plist \u2014 keep read-only + legible.\n      const after = isMac\n        ? [\n            `Label: com.rulemetric.worker`,\n            `ProgramArguments: <node> <cli>/bin/run.js evals agent`,\n            `RunAtLoad: true, KeepAlive: true`,\n          ].join('\\n')\n        : [\n            `[Service]`,\n            `ExecStart=<node> <cli>/bin/run.js evals agent`,\n            `Restart=on-failure`,\n          ].join('\\n');\n      return {\n        id: 'worker',\n        title: 'Run the worker',\n        command: 'rulemetric service install --worker-only',\n        artifacts: [\n          { path: servicePath, kind: 'service', before, after },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric service install --worker-only');\n    },\n  },\n];\n\nconst STEP_BY_ID = new Map<StepId, SetupStep>(STEPS.map((s) => [s.id, s]));\n\nexport function getStep(id: StepId): SetupStep {\n  const step = STEP_BY_ID.get(id);\n  if (!step) throw new Error(`Unknown setup step: ${id}`);\n  return step;\n}\n\nexport function isStepId(value: string): value is StepId {\n  return (ALL_STEP_IDS as readonly string[]).includes(value);\n}\n\n/**\n * Keys whose values are safe to show verbatim in the env-file diff. Everything\n * NOT in this set is masked. Deny-by-default is deliberate: `~/.config/rulemetric/env`\n * can legitimately hold DATABASE_URL, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_JWT_SECRET,\n * GITHUB_TOKEN, RESEND_API_KEY, etc. (see ALLOWED_ENV_VARS in service/install.ts),\n * so an allowlist-to-hide would leak any secret we forgot to enumerate. Revealing\n * only known-safe keys means a future secret added to the file is masked automatically.\n */\nconst SAFE_ENV_KEYS = new Set([\n  'RULEMETRIC_API_URL',\n  'RULEMETRIC_USER_ID',\n  'RULEMETRIC_CLIENT_NAME',\n  'RESEND_FROM_EMAIL',\n  'SENTRY_DSN', // a DSN is not a secret\n  'PG_POOL_MAX',\n  'PG_IDLE_TIMEOUT',\n  'PG_STATEMENT_TIMEOUT_MS',\n  'NODE_ENV',\n]);\n\n/**\n * Mask secret-bearing lines in a raw env file for display. Deny-by-default:\n * every `KEY=value` line has its value masked unless KEY is in SAFE_ENV_KEYS.\n * Non-assignment lines (comments, blanks) pass through untouched.\n */\nfunction maskEnvFile(content: string): string {\n  return content\n    .replace(/\\n$/, '')\n    .split('\\n')\n    .map((line) => {\n      const match = line.match(/^([A-Z0-9_]+)=(.+)$/);\n      if (!match) return line; // comment / blank / non-assignment\n      const [, key, value] = match;\n      return SAFE_ENV_KEYS.has(key) ? line : `${key}=${maskToken(value)}`;\n    })\n    .join('\\n');\n}\n\n/**\n * Run every step's detect() and derive the overall status. `currentStepId` is\n * the first incomplete step in core order (mirrors the web reducer).\n */\nexport async function computeStatus(ctx: SetupContext = defaultContext()): Promise<SetupStatus> {\n  const steps: StepStatus[] = [];\n  for (const step of STEPS) {\n    // Sequential: detect() may hit the network; order is stable + cheap.\n    // eslint-disable-next-line no-await-in-loop\n    const done = await step.detect(ctx);\n    steps.push({ id: step.id, done });\n  }\n  // Monotonicity (mirrors the web reducer's `cliDetected`): the CLI binary must\n  // exist to produce ANY downstream signal, so `install` greens whenever auth,\n  // hooks, or worker is detected \u2014 even if `install.detect()` alone (which only\n  // sees auth/worker, not hooks) came back false. Without this, a user with\n  // hooks installed but no live worker sees \"Install the CLI: waiting\" while\n  // \"Install hooks: done\" \u2014 a contradiction.\n  const install = steps.find((s) => s.id === 'install');\n  if (install && !install.done) {\n    install.done = steps.some((s) => s.id !== 'install' && s.done);\n  }\n\n  // coreComplete + currentStepId are derived from CORE steps only. The proxy now\n  // ships inside the `hooks` step (whose detect() greens on hooks-presence, so a\n  // declined CA still completes it); any future OPTIONAL_STEP_IDS never block\n  // \"done\" or steal the cursor. Mirrors the web reducer's optional-step handling.\n  const coreIds = new Set<string>(CORE_STEP_IDS);\n  const coreSteps = steps.filter((s) => coreIds.has(s.id));\n  const currentStepId = coreSteps.find((s) => !s.done)?.id ?? null;\n  const coreComplete = coreSteps.every((s) => s.done);\n  return { steps, coreComplete, currentStepId };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AAkCd,IAAM,gBAAgB,CAAC,WAAW,QAAQ,SAAS,QAAQ;AAO3D,IAAM,oBAAoB,CAAC;AAC3B,IAAM,eAAe,CAAC,GAAG,eAAe,GAAG,iBAAiB;AAiD5D,SAAS,iBAA+B;AAC7C,SAAO;AAAA,IACL,aAAa,QAAQ,IAAI;AAAA,IACzB,WAAW,oBAAoB;AAAA,EACjC;AACF;AAEA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAMhE,SAAS,UAAU,GAAmB;AAC3C,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,EAAE,UAAU,EAAG,QAAO,IAAI,OAAO,EAAE,MAAM;AAC7C,QAAM,OAAO,EAAE,MAAM,GAAG,CAAC;AACzB,QAAM,OAAO,EAAE,MAAM,EAAE;AACvB,SAAO,GAAG,IAAI,GAAG,IAAI,OAAO,KAAK,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/D;AAMO,SAAS,WAAW,QAAuB,OAA8B;AAC9E,QAAM,cAAc,WAAW,OAAO,CAAC,IAAI,OAAO,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC/E,QAAM,aAAa,UAAU,OAAO,CAAC,IAAI,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC5E,QAAM,MAAgB,CAAC;AACvB,QAAM,MAAM,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC1D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,IAAI,YAAY,CAAC;AACvB,UAAM,IAAI,WAAW,CAAC;AACtB,QAAI,MAAM,GAAG;AACX,UAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IAClB,OAAO;AACL,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AACrC,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IACvC;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAGA,SAAS,aAAa,WAAmB,KAA4B;AACnE,QAAM,UAAU,KAAK,WAAW,KAAK;AACrC,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,UAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,WAAO,QAAQ,MAAM,CAAC,IAAI;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAiC;AAC9C,MAAI,CAAC,gBAAgB,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChC,OAIG,mBAAmB;AAAA,MACtB,IAAI;AAAA,QAAe,CAAC,GAAG,WACrB,WAAW,MAAM,OAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,IAAI;AAAA,MAClE;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,iBAAiB;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,oBACP,aACA,UAC8D;AAC9D,QAAM,eAAe,KAAK,aAAa,WAAW,QAAQ;AAC1D,MAAI,WAAoC,CAAC;AACzC,MAAI,SAAwB;AAC5B,MAAI,WAAW,YAAY,GAAG;AAC5B,QAAI;AACF,eAAS,aAAa,cAAc,OAAO,EAAE,QAAQ,OAAO,EAAE;AAC9D,iBAAW,KAAK,MAAM,MAAM;AAAA,IAC9B,QAAQ;AACN,iBAAW,CAAC;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,UAAU,OAAO;AAC5B;AAUA,SAAS,qBAAqB,aAA+D;AAC3F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,aAAa,qBAAqB;AACnF,uBAAqB,QAAQ;AAC7B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;AAC5D;AAMA,SAAS,wBAAwB,aAA+D;AAC9F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,aAAa,qBAAqB;AACnF,QAAM,MAAM,EAAE,GAAK,SAAS,OAAkC,CAAC,EAAG;AAClE,MAAI,cAAc,oBAAoB,YAAY;AAClD,MAAI,WAAW;AACf,MAAI,sBAAsB;AAC1B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,EAAE,GAAG,UAAU,IAAI,GAAG,MAAM,CAAC,EAAE;AACxE;AASA,SAAS,+BAA+B,aAAsE;AAC5G,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,aAAa,eAAe;AAC7E,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,EAAE,QAAQ,IAAI,6BAA6B,UAAU,YAAY;AACvE,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;AAC5D;AAEA,IAAM,oBAAoB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,6BAA6B;AAClG,IAAM,sBAAsB,KAAK,QAAQ,GAAG,WAAW,WAAW,QAAQ,2BAA2B;AAGrG,SAAS,WAAW,KAAmB;AACrC,WAAS,KAAK,EAAE,OAAO,UAAU,CAAC;AACpC;AAEO,IAAM,QAAqB;AAAA,EAChC;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA;AAAA;AAAA,IAGT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB,KAAM,MAAM,aAAa;AAAA,IAClD;AAAA,IACA,MAAM,OAA0B;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,gCAAgC;AAAA,IAC7C;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB;AAAA,IACzB;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,UAAU,KAAK,IAAI,WAAW,KAAK;AAKzC,UAAI,SAAwB;AAC5B,UAAI,WAAW,OAAO,GAAG;AACvB,YAAI;AACF,mBAAS,YAAY,aAAa,SAAS,OAAO,CAAC;AAAA,QACrD,QAAQ;AACN,mBAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM,WAAW,aAAa,IAAI,WAAW,yBAAyB;AACtE,YAAM,eAAe,WAAW,UAAU,QAAQ,IAAI,UAAU,oBAAoB;AAOpF,YAAM,aAAa,CAAC,2BAA2B,YAAY,EAAE;AAC7D,YAAM,YAAY,aAAa,IAAI,WAAW,oBAAoB;AAClE,UAAI,WAAW;AACb,mBAAW,KAAK,sBAAsB,UAAU,SAAS,CAAC,EAAE;AAAA,MAC9D;AACA,YAAM,WAAW,QAAQ,IAAI;AAC7B,UAAI,UAAU;AACZ,mBAAW,KAAK,sBAAsB,QAAQ,EAAE;AAAA,MAClD;AACA,YAAM,QAAQ,WAAW,KAAK,IAAI;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA;AAAA;AAAA,UAGA;AAAA,YACE,MAAM,KAAK,IAAI,WAAW,WAAW;AAAA,YACrC,MAAM;AAAA,YACN,QAAQ,WAAW,KAAK,IAAI,WAAW,WAAW,CAAC,IAAI,8BAA8B;AAAA,YACrF,OAAO;AAAA,YACP,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,uBAAuB;AAAA,IACpC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUP,SAAS;AAAA,IACT,MAAM,OAAO,KAAuB;AAQlC,iBAAW,YAAY,CAAC,uBAAuB,eAAe,GAAG;AAC/D,cAAM,eAAe,KAAK,IAAI,aAAa,WAAW,QAAQ;AAC9D,YAAI,CAAC,WAAW,YAAY,EAAG;AAC/B,YAAI;AACF,gBAAM,WAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAC/D,cAAI,yBAAyB,QAAQ,EAAG,QAAO;AAAA,QACjD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,qBAAqB;AAC3E,YAAM,EAAE,QAAQ,MAAM,IAAI,qBAAqB,IAAI,WAAW;AAC9D,YAAM,YAAwB;AAAA,QAC5B,EAAE,MAAM,cAAc,MAAM,QAAQ,QAAQ,MAAM;AAAA;AAAA;AAAA,QAGlD;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OACE;AAAA,QAGJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA;AAAA;AAAA;AAAA,UAGE,MAAM,GAAG,YAAY;AAAA,UACrB,MAAM;AAAA,UACN,GAAG,wBAAwB,IAAI,WAAW;AAAA,QAC5C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ,WAAW,SAAS,IAAI,0CAA0C;AAAA,UAC1E,OACE;AAAA,QAIJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,oBAAoB,YAAY,qGAAgG,YAAY;AAAA,QACrJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,sCAAiC,YAAY;AAAA,QACtD;AAAA,QACA;AAAA,UACE,MAAM,uBAAuB,YAAY;AAAA,UACzC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO;AAAA,QACT;AAAA,MACF;AAKA,YAAM,kBAAkB,+BAA+B,IAAI,WAAW;AACtE,UAAI,iBAAiB;AACnB,kBAAU,KAAK;AAAA,UACb,MAAM,GAAG,KAAK,IAAI,aAAa,WAAW,eAAe,CAAC;AAAA,UAC1D,MAAM;AAAA,UACN,GAAG;AAAA,QACL,CAAC;AAAA,MACH;AAEA,iBAAW,QAAQ,qBAAqB,IAAI,WAAW,EAAE,OAAO,CAAC,MAAM,MAAM,YAAY,MAAM,eAAe,GAAG;AAC/G,kBAAU,KAAK;AAAA,UACb,MAAM,GAAG,IAAI,WAAW,KAAK,IAAI;AAAA,UACjC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,iCAA4B,YAAY;AAAA,QACjD,CAAC;AAAA,MACH;AAIA,iBAAW,CAAC,MAAM,MAAM,IAAI,KAAK;AAAA,QAC/B,CAAC,UAAU,KAAK,QAAQ,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,WAAW,YAAY,CAAC;AAAA,QAC/E,CAAC,sBAAsB,KAAK,QAAQ,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,WAAW,UAAU,YAAY,CAAC;AAAA,MACvG,GAAY;AACV,YAAI,WAAW,IAAI,GAAG;AACpB,oBAAU,KAAK;AAAA,YACb,MAAM,GAAG,IAAI,KAAK,IAAI;AAAA,YACtB,MAAM;AAAA,YACN,QAAQ,WAAW,IAAI,IAAI,sBAAsB;AAAA,YACjD,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0BAA0B;AAAA,IACvC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,aAAa;AAAA,IACtB;AAAA,IACA,MAAM,OAA0B;AAC9B,YAAM,QAAQ,QAAQ,aAAa;AACnC,YAAM,cAAc,QAAQ,oBAAoB;AAMhD,YAAM,SAAS,WAAW,WAAW,IACjC,iCAAiC,WAAW,MAC5C;AAGJ,YAAM,QAAQ,QACV;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI,IACX;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT,EAAE,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0CAA0C;AAAA,IACvD;AAAA,EACF;AACF;AAEA,IAAM,aAAa,IAAI,IAAuB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAElE,SAAS,QAAQ,IAAuB;AAC7C,QAAM,OAAO,WAAW,IAAI,EAAE;AAC9B,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,uBAAuB,EAAE,EAAE;AACtD,SAAO;AACT;AAEO,SAAS,SAAS,OAAgC;AACvD,SAAQ,aAAmC,SAAS,KAAK;AAC3D;AAUA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,YAAY,SAAyB;AAC5C,SAAO,QACJ,QAAQ,OAAO,EAAE,EACjB,MAAM,IAAI,EACV,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,MAAM,qBAAqB;AAC9C,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,CAAC,EAAE,KAAK,KAAK,IAAI;AACvB,WAAO,cAAc,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,IAAI,UAAU,KAAK,CAAC;AAAA,EACnE,CAAC,EACA,KAAK,IAAI;AACd;AAMA,eAAsB,cAAc,MAAoB,eAAe,GAAyB;AAC9F,QAAM,QAAsB,CAAC;AAC7B,aAAW,QAAQ,OAAO;AAGxB,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG;AAClC,UAAM,KAAK,EAAE,IAAI,KAAK,IAAI,KAAK,CAAC;AAAA,EAClC;AAOA,QAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS;AACpD,MAAI,WAAW,CAAC,QAAQ,MAAM;AAC5B,YAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,aAAa,EAAE,IAAI;AAAA,EAC/D;AAMA,QAAM,UAAU,IAAI,IAAY,aAAa;AAC7C,QAAM,YAAY,MAAM,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,CAAC;AACvD,QAAM,gBAAgB,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM;AAC5D,QAAM,eAAe,UAAU,MAAM,CAAC,MAAM,EAAE,IAAI;AAClD,SAAO,EAAE,OAAO,cAAc,cAAc;AAC9C;",
+  "names": []
+}

package/dist/{chunk-AHDRN6NE.js → chunk-OO7JDFS4.js}

@@ -1,6 +1,3 @@
-import {
-  PermanentJobError
-} from "./chunk-DGHWRQXL.js";
 import {
   sendEmail
 } from "./chunk-QSN77T7C.js";
@@ -10,7 +7,10 @@ import {
   getDb,
   notificationPreferences,
   profiles
-} from "./chunk-6EMZI4Y3.js";
+} from "./chunk-EI5BHWXA.js";
+import {
+  PermanentJobError
+} from "./chunk-DGHWRQXL.js";
 
 // src/lib/handlers/process-announcement.ts
 import { and, asc, eq, gt, isNotNull } from "drizzle-orm";
@@ -154,4 +154,4 @@ async function sendOne(args) {
 export {
   processAnnouncement
 };
-//# sourceMappingURL=chunk-AHDRN6NE.js.map
+//# sourceMappingURL=chunk-OO7JDFS4.js.map

package/dist/{chunk-N2X35ITW.js → chunk-OQBBVTDG.js}

@@ -163,6 +163,15 @@ function removeStatuslineShim(settings) {
   delete settings.statusLine;
   return true;
 }
+var STATUSLINE_SHIM_SUFFIX = "/.claude/statusline-rulemetric.sh";
+function removeStatuslineShimAnyHome(settings) {
+  const current = settings.statusLine;
+  const cmd = typeof current === "string" ? current : typeof current === "object" && current !== null ? current.command : void 0;
+  const isShim = typeof cmd === "string" && (cmd === STATUSLINE_SHIM_PATH || cmd.endsWith(STATUSLINE_SHIM_SUFFIX));
+  if (!isShim) return false;
+  delete settings.statusLine;
+  return true;
+}
 function isStatuslineShimInstalled(settings) {
   const current = settings.statusLine;
   if (!current) return false;
@@ -179,6 +188,7 @@ export {
   STATUSLINE_SETTINGS_VALUE,
   readCurrentStatusLine,
   removeStatuslineShim,
+  removeStatuslineShimAnyHome,
   isStatuslineShimInstalled
 };
-//# sourceMappingURL=chunk-N2X35ITW.js.map
+//# sourceMappingURL=chunk-OQBBVTDG.js.map

package/dist/{chunk-N2X35ITW.js.map → chunk-OQBBVTDG.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib/statusline-shim.ts"],
-  "sourcesContent": ["import { existsSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\n// Path where the shim script lives \u2014 readable by the `statusLine` config key.\nexport const STATUSLINE_SHIM_PATH = join(homedir(), '.claude', 'statusline-rulemetric.sh');\n\n/**\n * Write ~/.claude/statusline-rulemetric.sh.\n *\n * The script is invoked by Claude Code on every statusline refresh cycle.\n * Claude Code feeds a JSON payload on stdin that includes `rate_limits`\n * (same shape as GET /api/oauth/usage) using its own in-memory token \u2014\n * so freshness is tied to the statusline cadence, not the proxy capturing\n * a stale keychain token.\n *\n * The script:\n *   1. Reads stdin once (Claude Code closes it after the payload).\n *   2. If jq is available, extracts each rate_limit window and POSTs it to\n *      POST /api/internal/research/observe as an oauth_usage observation.\n *   3. If a `prevCommand` is supplied (the user's original statusLine value),\n *      it is executed with the same stdin forwarded so the user's prompt text\n *      is still displayed \u2014 we must chain, not replace.\n *   4. Exits 0 regardless so Claude Code always gets a clean statusline.\n *\n * Auth is read from the same priority chain as the hook scripts:\n *   ~/.config/rulemetric/env  (RULEMETRIC_ACCESS_TOKEN / RULEMETRIC_API_KEY)\n *   RULEMETRIC_API_KEY / RULEMETRIC_ACCESS_TOKEN env vars\n *\n * Returns the path written.\n */\nexport function writeStatuslineShim(prevCommand?: string): string {\n  const chainBlock = prevCommand\n    ? `\n# Chain to the original statusLine command so the user's prompt is preserved.\necho \"$STDIN_PAYLOAD\" | ${prevCommand}`\n    : '';\n\n  const script = `#!/usr/bin/env bash\n# RuleMetric statusline shim \u2014 auto-generated by \\`rulemetric hooks install --statusline-usage\\`\n# Captures Claude Code rate_limits from statusline stdin and forwards to the research pipeline.\n# DO NOT EDIT \u2014 re-run \\`rulemetric hooks install --statusline-usage\\` to regenerate.\n\nset -euo pipefail\n\n# Read stdin once (Claude Code closes the pipe after the payload).\nSTDIN_PAYLOAD=\"$(cat)\"\n\n# \u2500\u2500 Auth \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCONFIG_ENV=\"$HOME/.config/rulemetric/env\"\nif [ -f \"$CONFIG_ENV\" ]; then\n  # shellcheck source=/dev/null\n  source \"$CONFIG_ENV\"\nfi\n\nAPI_URL=\"\\${RULEMETRIC_API_URL:-https://rulemetric.com}\"\nAUTH_TOKEN=\"\\${RULEMETRIC_ACCESS_TOKEN:-\\${RULEMETRIC_API_KEY:-}}\"\n\nif [ -z \"$AUTH_TOKEN\" ]; then\n  # No auth \u2014 still chain so the user's statusline works.\n${chainBlock}\n  exit 0\nfi\n\n# \u2500\u2500 Extract + POST rate_limit windows \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nif ! command -v jq &>/dev/null; then\n  # jq missing \u2014 chain and bail; don't break the user's statusline.\n${chainBlock}\n  exit 0\nfi\n\nOBSERVED_AT=\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"\nCACHE_DIR=\"$HOME/.config/rulemetric\"\nmkdir -p \"$CACHE_DIR\" 2>/dev/null || true\n\nfor WIRE_KEY in five_hour seven_day seven_day_opus; do\n  # Map wire key \u2192 limit_type (case statement avoids bash 4 associative arrays).\n  case \"$WIRE_KEY\" in\n    five_hour)      LIMIT_TYPE=\"five_hour_percent\" ;;\n    seven_day)      LIMIT_TYPE=\"seven_day_percent\" ;;\n    seven_day_opus) LIMIT_TYPE=\"seven_day_opus_percent\" ;;\n    *)              continue ;;\n  esac\n\n  # Try both wire shapes:\n  #   Legacy: { \"rate_limits\": { \"five_hour\": { \"used_percentage\": ..., \"resets_at\": ... } } }\n  #   Current: { \"five_hour\": { \"used_percentage\": ..., \"resets_at\": ... } }\n  WINDOW=\"$(echo \"$STDIN_PAYLOAD\" | jq -c \".rate_limits.\\${WIRE_KEY} // .\\${WIRE_KEY} // empty\" 2>/dev/null || true)\"\n\n  if [ -z \"$WINDOW\" ] || [ \"$WINDOW\" = \"null\" ]; then\n    continue\n  fi\n\n  USED_PCT=\"$(echo \"$WINDOW\" | jq '.used_percentage // empty' 2>/dev/null || true)\"\n  RESETS_AT_EPOCH=\"$(echo \"$WINDOW\" | jq '.resets_at // empty' 2>/dev/null || true)\"\n\n  if [ -z \"$USED_PCT\" ] || [ \"$USED_PCT\" = \"null\" ]; then\n    continue\n  fi\n\n  # Convert unix epoch to ISO-8601 if present.\n  if [ -n \"$RESETS_AT_EPOCH\" ] && [ \"$RESETS_AT_EPOCH\" != \"null\" ]; then\n    RESETS_AT_ISO=\"$(date -u -r \"$RESETS_AT_EPOCH\" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \\\n      || date -u -d \"@$RESETS_AT_EPOCH\" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \\\n      || echo \"\")\"\n  else\n    RESETS_AT_ISO=\"\"\n  fi\n\n  # Skip stale windows. Claude Code can keep re-emitting a cached rate_limits\n  # block after the reset time has passed; storing those rows floods the DB and\n  # corrupts the \"current limits\" view.\n  if [ -n \"$RESETS_AT_EPOCH\" ] && [ \"$RESETS_AT_EPOCH\" != \"null\" ]; then\n    NOW_EPOCH=\"$(date -u +%s)\"\n    if [ \"$RESETS_AT_EPOCH\" -lt \"$NOW_EPOCH\" ] 2>/dev/null; then\n      continue\n    fi\n  else\n    NOW_EPOCH=\"$(date -u +%s)\"\n  fi\n\n  # Local duplicate suppression mirrors the API's 30-minute freshness floor.\n  # The statusline refreshes often; if the same window/value/reset is already\n  # posted recently, another POST only burns an API request and DB connection.\n  CACHE_FILE=\"$CACHE_DIR/statusline-usage-\\${LIMIT_TYPE}.cache\"\n  CACHE_KEY=\"\\${LIMIT_TYPE}|\\${USED_PCT}|\\${RESETS_AT_ISO}\"\n  if [ -f \"$CACHE_FILE\" ]; then\n    read -r CACHED_AT CACHED_KEY < \"$CACHE_FILE\" || true\n    if [ \"\\${CACHED_KEY:-}\" = \"$CACHE_KEY\" ] && [ $((NOW_EPOCH - \\${CACHED_AT:-0})) -lt 1800 ] 2>/dev/null; then\n      continue\n    fi\n  fi\n  printf '%s %s\\n' \"$NOW_EPOCH\" \"$CACHE_KEY\" > \"$CACHE_FILE.tmp\" 2>/dev/null \\\n    && mv \"$CACHE_FILE.tmp\" \"$CACHE_FILE\" 2>/dev/null || true\n\n  PAYLOAD=\"$(jq -nc \\\\\n    --arg provider \"anthropic\" \\\\\n    --arg plan \"unknown\" \\\\\n    --argjson value \"$USED_PCT\" \\\\\n    --arg limitType \"$LIMIT_TYPE\" \\\\\n    --arg observedAt \"$OBSERVED_AT\" \\\\\n    --arg resetsAt \"$RESETS_AT_ISO\" \\\\\n    '{\n      provider: $provider,\n      plan: $plan,\n      limitType: $limitType,\n      value: $value,\n      unit: \"percentage\",\n      comparator: \"=\",\n      sourceType: \"oauth_usage\",\n      sourceUrl: null,\n      confidence: 1.0,\n      observedAt: $observedAt,\n      resetsAt: (if $resetsAt == \"\" then null else $resetsAt end)\n    }')\"\n\n  curl -sf -o /dev/null \\\\\n    -X POST \"$API_URL/api/internal/research/observe\" \\\\\n    -H \"Content-Type: application/json\" \\\\\n    -H \"Authorization: Bearer $AUTH_TOKEN\" \\\\\n    --max-time 3 \\\\\n    --data \"$PAYLOAD\" >/dev/null 2>&1 &\ndone\n\n${chainBlock}\nexit 0\n`;\n\n  writeFileSync(STATUSLINE_SHIM_PATH, script, { encoding: 'utf-8' });\n  chmodSync(STATUSLINE_SHIM_PATH, 0o755);\n  return STATUSLINE_SHIM_PATH;\n}\n\n// The settings object shape for statusLine (Claude Code v1.x+).\nexport const STATUSLINE_SETTINGS_VALUE = {\n  type: 'command' as const,\n  command: STATUSLINE_SHIM_PATH,\n  refreshInterval: 30,\n};\n\n/**\n * Read the current statusLine command from a settings object, if any.\n * Returns undefined if not set or already points to the shim (idempotent).\n * Handles both the legacy string form and the current object form.\n */\nexport function readCurrentStatusLine(\n  settings: Record<string, unknown>,\n): string | undefined {\n  const current = settings.statusLine;\n  if (!current) return undefined;\n  if (typeof current === 'string') {\n    if (current === STATUSLINE_SHIM_PATH) return undefined;\n    return current;\n  }\n  if (typeof current === 'object' && current !== null) {\n    const cmd = (current as Record<string, unknown>).command;\n    if (typeof cmd !== 'string') return undefined;\n    if (cmd === STATUSLINE_SHIM_PATH) return undefined; // already installed\n    return cmd;\n  }\n  return undefined;\n}\n\n/**\n * Remove our statusline shim from a settings object (uninstall). Only deletes\n * `settings.statusLine` when it points at OUR shim \u2014 a user-owned statusLine is\n * left untouched. Returns true iff it removed the shim. Without this, `hooks\n * uninstall` leaves Claude Code POSTing usage to rulemetric.com via the shim\n * even after the hooks + CLI are gone.\n */\nexport function removeStatuslineShim(settings: Record<string, unknown>): boolean {\n  if (!isStatuslineShimInstalled(settings)) return false;\n  delete settings.statusLine;\n  return true;\n}\n\n/**\n * Returns true if the settings object already points to the shim.\n */\nexport function isStatuslineShimInstalled(settings: Record<string, unknown>): boolean {\n  const current = settings.statusLine;\n  if (!current) return false;\n  if (typeof current === 'string') return current === STATUSLINE_SHIM_PATH;\n  if (typeof current === 'object' && current !== null) {\n    return (current as Record<string, unknown>).command === STATUSLINE_SHIM_PATH;\n  }\n  return false;\n}\n"],
-  "mappings": ";AAAA,SAAmC,eAAe,iBAAiB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAGd,IAAM,uBAAuB,KAAK,QAAQ,GAAG,WAAW,0BAA0B;AA0BlF,SAAS,oBAAoB,aAA8B;AAChE,QAAM,aAAa,cACf;AAAA;AAAA,0BAEoB,WAAW,KAC/B;AAEJ,QAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBf,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOV,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiGV,UAAU;AAAA;AAAA;AAIV,gBAAc,sBAAsB,QAAQ,EAAE,UAAU,QAAQ,CAAC;AACjE,YAAU,sBAAsB,GAAK;AACrC,SAAO;AACT;AAGO,IAAM,4BAA4B;AAAA,EACvC,MAAM;AAAA,EACN,SAAS;AAAA,EACT,iBAAiB;AACnB;AAOO,SAAS,sBACd,UACoB;AACpB,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI,YAAY,qBAAsB,QAAO;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,UAAM,MAAO,QAAoC;AACjD,QAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAI,QAAQ,qBAAsB,QAAO;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AASO,SAAS,qBAAqB,UAA4C;AAC/E,MAAI,CAAC,0BAA0B,QAAQ,EAAG,QAAO;AACjD,SAAO,SAAS;AAChB,SAAO;AACT;AAKO,SAAS,0BAA0B,UAA4C;AACpF,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO,YAAY;AACpD,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAQ,QAAoC,YAAY;AAAA,EAC1D;AACA,SAAO;AACT;",
+  "sourcesContent": ["import { existsSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\n// Path where the shim script lives \u2014 readable by the `statusLine` config key.\nexport const STATUSLINE_SHIM_PATH = join(homedir(), '.claude', 'statusline-rulemetric.sh');\n\n/**\n * Write ~/.claude/statusline-rulemetric.sh.\n *\n * The script is invoked by Claude Code on every statusline refresh cycle.\n * Claude Code feeds a JSON payload on stdin that includes `rate_limits`\n * (same shape as GET /api/oauth/usage) using its own in-memory token \u2014\n * so freshness is tied to the statusline cadence, not the proxy capturing\n * a stale keychain token.\n *\n * The script:\n *   1. Reads stdin once (Claude Code closes it after the payload).\n *   2. If jq is available, extracts each rate_limit window and POSTs it to\n *      POST /api/internal/research/observe as an oauth_usage observation.\n *   3. If a `prevCommand` is supplied (the user's original statusLine value),\n *      it is executed with the same stdin forwarded so the user's prompt text\n *      is still displayed \u2014 we must chain, not replace.\n *   4. Exits 0 regardless so Claude Code always gets a clean statusline.\n *\n * Auth is read from the same priority chain as the hook scripts:\n *   ~/.config/rulemetric/env  (RULEMETRIC_ACCESS_TOKEN / RULEMETRIC_API_KEY)\n *   RULEMETRIC_API_KEY / RULEMETRIC_ACCESS_TOKEN env vars\n *\n * Returns the path written.\n */\nexport function writeStatuslineShim(prevCommand?: string): string {\n  const chainBlock = prevCommand\n    ? `\n# Chain to the original statusLine command so the user's prompt is preserved.\necho \"$STDIN_PAYLOAD\" | ${prevCommand}`\n    : '';\n\n  const script = `#!/usr/bin/env bash\n# RuleMetric statusline shim \u2014 auto-generated by \\`rulemetric hooks install --statusline-usage\\`\n# Captures Claude Code rate_limits from statusline stdin and forwards to the research pipeline.\n# DO NOT EDIT \u2014 re-run \\`rulemetric hooks install --statusline-usage\\` to regenerate.\n\nset -euo pipefail\n\n# Read stdin once (Claude Code closes the pipe after the payload).\nSTDIN_PAYLOAD=\"$(cat)\"\n\n# \u2500\u2500 Auth \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nCONFIG_ENV=\"$HOME/.config/rulemetric/env\"\nif [ -f \"$CONFIG_ENV\" ]; then\n  # shellcheck source=/dev/null\n  source \"$CONFIG_ENV\"\nfi\n\nAPI_URL=\"\\${RULEMETRIC_API_URL:-https://rulemetric.com}\"\nAUTH_TOKEN=\"\\${RULEMETRIC_ACCESS_TOKEN:-\\${RULEMETRIC_API_KEY:-}}\"\n\nif [ -z \"$AUTH_TOKEN\" ]; then\n  # No auth \u2014 still chain so the user's statusline works.\n${chainBlock}\n  exit 0\nfi\n\n# \u2500\u2500 Extract + POST rate_limit windows \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nif ! command -v jq &>/dev/null; then\n  # jq missing \u2014 chain and bail; don't break the user's statusline.\n${chainBlock}\n  exit 0\nfi\n\nOBSERVED_AT=\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"\nCACHE_DIR=\"$HOME/.config/rulemetric\"\nmkdir -p \"$CACHE_DIR\" 2>/dev/null || true\n\nfor WIRE_KEY in five_hour seven_day seven_day_opus; do\n  # Map wire key \u2192 limit_type (case statement avoids bash 4 associative arrays).\n  case \"$WIRE_KEY\" in\n    five_hour)      LIMIT_TYPE=\"five_hour_percent\" ;;\n    seven_day)      LIMIT_TYPE=\"seven_day_percent\" ;;\n    seven_day_opus) LIMIT_TYPE=\"seven_day_opus_percent\" ;;\n    *)              continue ;;\n  esac\n\n  # Try both wire shapes:\n  #   Legacy: { \"rate_limits\": { \"five_hour\": { \"used_percentage\": ..., \"resets_at\": ... } } }\n  #   Current: { \"five_hour\": { \"used_percentage\": ..., \"resets_at\": ... } }\n  WINDOW=\"$(echo \"$STDIN_PAYLOAD\" | jq -c \".rate_limits.\\${WIRE_KEY} // .\\${WIRE_KEY} // empty\" 2>/dev/null || true)\"\n\n  if [ -z \"$WINDOW\" ] || [ \"$WINDOW\" = \"null\" ]; then\n    continue\n  fi\n\n  USED_PCT=\"$(echo \"$WINDOW\" | jq '.used_percentage // empty' 2>/dev/null || true)\"\n  RESETS_AT_EPOCH=\"$(echo \"$WINDOW\" | jq '.resets_at // empty' 2>/dev/null || true)\"\n\n  if [ -z \"$USED_PCT\" ] || [ \"$USED_PCT\" = \"null\" ]; then\n    continue\n  fi\n\n  # Convert unix epoch to ISO-8601 if present.\n  if [ -n \"$RESETS_AT_EPOCH\" ] && [ \"$RESETS_AT_EPOCH\" != \"null\" ]; then\n    RESETS_AT_ISO=\"$(date -u -r \"$RESETS_AT_EPOCH\" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \\\n      || date -u -d \"@$RESETS_AT_EPOCH\" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \\\n      || echo \"\")\"\n  else\n    RESETS_AT_ISO=\"\"\n  fi\n\n  # Skip stale windows. Claude Code can keep re-emitting a cached rate_limits\n  # block after the reset time has passed; storing those rows floods the DB and\n  # corrupts the \"current limits\" view.\n  if [ -n \"$RESETS_AT_EPOCH\" ] && [ \"$RESETS_AT_EPOCH\" != \"null\" ]; then\n    NOW_EPOCH=\"$(date -u +%s)\"\n    if [ \"$RESETS_AT_EPOCH\" -lt \"$NOW_EPOCH\" ] 2>/dev/null; then\n      continue\n    fi\n  else\n    NOW_EPOCH=\"$(date -u +%s)\"\n  fi\n\n  # Local duplicate suppression mirrors the API's 30-minute freshness floor.\n  # The statusline refreshes often; if the same window/value/reset is already\n  # posted recently, another POST only burns an API request and DB connection.\n  CACHE_FILE=\"$CACHE_DIR/statusline-usage-\\${LIMIT_TYPE}.cache\"\n  CACHE_KEY=\"\\${LIMIT_TYPE}|\\${USED_PCT}|\\${RESETS_AT_ISO}\"\n  if [ -f \"$CACHE_FILE\" ]; then\n    read -r CACHED_AT CACHED_KEY < \"$CACHE_FILE\" || true\n    if [ \"\\${CACHED_KEY:-}\" = \"$CACHE_KEY\" ] && [ $((NOW_EPOCH - \\${CACHED_AT:-0})) -lt 1800 ] 2>/dev/null; then\n      continue\n    fi\n  fi\n  printf '%s %s\\n' \"$NOW_EPOCH\" \"$CACHE_KEY\" > \"$CACHE_FILE.tmp\" 2>/dev/null \\\n    && mv \"$CACHE_FILE.tmp\" \"$CACHE_FILE\" 2>/dev/null || true\n\n  PAYLOAD=\"$(jq -nc \\\\\n    --arg provider \"anthropic\" \\\\\n    --arg plan \"unknown\" \\\\\n    --argjson value \"$USED_PCT\" \\\\\n    --arg limitType \"$LIMIT_TYPE\" \\\\\n    --arg observedAt \"$OBSERVED_AT\" \\\\\n    --arg resetsAt \"$RESETS_AT_ISO\" \\\\\n    '{\n      provider: $provider,\n      plan: $plan,\n      limitType: $limitType,\n      value: $value,\n      unit: \"percentage\",\n      comparator: \"=\",\n      sourceType: \"oauth_usage\",\n      sourceUrl: null,\n      confidence: 1.0,\n      observedAt: $observedAt,\n      resetsAt: (if $resetsAt == \"\" then null else $resetsAt end)\n    }')\"\n\n  curl -sf -o /dev/null \\\\\n    -X POST \"$API_URL/api/internal/research/observe\" \\\\\n    -H \"Content-Type: application/json\" \\\\\n    -H \"Authorization: Bearer $AUTH_TOKEN\" \\\\\n    --max-time 3 \\\\\n    --data \"$PAYLOAD\" >/dev/null 2>&1 &\ndone\n\n${chainBlock}\nexit 0\n`;\n\n  writeFileSync(STATUSLINE_SHIM_PATH, script, { encoding: 'utf-8' });\n  chmodSync(STATUSLINE_SHIM_PATH, 0o755);\n  return STATUSLINE_SHIM_PATH;\n}\n\n// The settings object shape for statusLine (Claude Code v1.x+).\nexport const STATUSLINE_SETTINGS_VALUE = {\n  type: 'command' as const,\n  command: STATUSLINE_SHIM_PATH,\n  refreshInterval: 30,\n};\n\n/**\n * Read the current statusLine command from a settings object, if any.\n * Returns undefined if not set or already points to the shim (idempotent).\n * Handles both the legacy string form and the current object form.\n */\nexport function readCurrentStatusLine(\n  settings: Record<string, unknown>,\n): string | undefined {\n  const current = settings.statusLine;\n  if (!current) return undefined;\n  if (typeof current === 'string') {\n    if (current === STATUSLINE_SHIM_PATH) return undefined;\n    return current;\n  }\n  if (typeof current === 'object' && current !== null) {\n    const cmd = (current as Record<string, unknown>).command;\n    if (typeof cmd !== 'string') return undefined;\n    if (cmd === STATUSLINE_SHIM_PATH) return undefined; // already installed\n    return cmd;\n  }\n  return undefined;\n}\n\n/**\n * Remove our statusline shim from a settings object (uninstall). Only deletes\n * `settings.statusLine` when it points at OUR shim \u2014 a user-owned statusLine is\n * left untouched. Returns true iff it removed the shim. Without this, `hooks\n * uninstall` leaves Claude Code POSTing usage to rulemetric.com via the shim\n * even after the hooks + CLI are gone.\n */\nexport function removeStatuslineShim(settings: Record<string, unknown>): boolean {\n  if (!isStatuslineShimInstalled(settings)) return false;\n  delete settings.statusLine;\n  return true;\n}\n\n// The shim's path suffix is identical on every machine \u2014 only the $HOME prefix\n// differs. Forward slashes only: settings files are written with POSIX paths\n// on the platforms the shim supports (the shim itself is a bash script).\nconst STATUSLINE_SHIM_SUFFIX = '/.claude/statusline-rulemetric.sh';\n\n/**\n * Like removeStatuslineShim, but also matches a shim written by ANOTHER\n * machine's install: the statusLine path is $HOME-anchored, so a shared\n * `.claude/settings.json` poisoned by a teammate's install carries THEIR home\n * prefix and the exact-path check misses it. Only our fixed shim filename can\n * match \u2014 a user-owned statusLine is never removed. Returns true iff removed.\n */\nexport function removeStatuslineShimAnyHome(settings: Record<string, unknown>): boolean {\n  const current = settings.statusLine;\n  const cmd =\n    typeof current === 'string'\n      ? current\n      : typeof current === 'object' && current !== null\n        ? (current as Record<string, unknown>).command\n        : undefined;\n  const isShim =\n    typeof cmd === 'string' && (cmd === STATUSLINE_SHIM_PATH || cmd.endsWith(STATUSLINE_SHIM_SUFFIX));\n  if (!isShim) return false;\n  delete settings.statusLine;\n  return true;\n}\n\n/**\n * Returns true if the settings object already points to the shim.\n */\nexport function isStatuslineShimInstalled(settings: Record<string, unknown>): boolean {\n  const current = settings.statusLine;\n  if (!current) return false;\n  if (typeof current === 'string') return current === STATUSLINE_SHIM_PATH;\n  if (typeof current === 'object' && current !== null) {\n    return (current as Record<string, unknown>).command === STATUSLINE_SHIM_PATH;\n  }\n  return false;\n}\n"],
+  "mappings": ";AAAA,SAAmC,eAAe,iBAAiB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAGd,IAAM,uBAAuB,KAAK,QAAQ,GAAG,WAAW,0BAA0B;AA0BlF,SAAS,oBAAoB,aAA8B;AAChE,QAAM,aAAa,cACf;AAAA;AAAA,0BAEoB,WAAW,KAC/B;AAEJ,QAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBf,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOV,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiGV,UAAU;AAAA;AAAA;AAIV,gBAAc,sBAAsB,QAAQ,EAAE,UAAU,QAAQ,CAAC;AACjE,YAAU,sBAAsB,GAAK;AACrC,SAAO;AACT;AAGO,IAAM,4BAA4B;AAAA,EACvC,MAAM;AAAA,EACN,SAAS;AAAA,EACT,iBAAiB;AACnB;AAOO,SAAS,sBACd,UACoB;AACpB,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI,YAAY,qBAAsB,QAAO;AAC7C,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,UAAM,MAAO,QAAoC;AACjD,QAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAI,QAAQ,qBAAsB,QAAO;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AASO,SAAS,qBAAqB,UAA4C;AAC/E,MAAI,CAAC,0BAA0B,QAAQ,EAAG,QAAO;AACjD,SAAO,SAAS;AAChB,SAAO;AACT;AAKA,IAAM,yBAAyB;AASxB,SAAS,4BAA4B,UAA4C;AACtF,QAAM,UAAU,SAAS;AACzB,QAAM,MACJ,OAAO,YAAY,WACf,UACA,OAAO,YAAY,YAAY,YAAY,OACxC,QAAoC,UACrC;AACR,QAAM,SACJ,OAAO,QAAQ,aAAa,QAAQ,wBAAwB,IAAI,SAAS,sBAAsB;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,SAAS;AAChB,SAAO;AACT;AAKO,SAAS,0BAA0B,UAA4C;AACpF,QAAM,UAAU,SAAS;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO,YAAY;AACpD,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAQ,QAAoC,YAAY;AAAA,EAC1D;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/{chunk-3QH73QOQ.js → chunk-PED7L5GX.js}

@@ -1,7 +1,7 @@
 import {
   apiGet,
   apiPost
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/lib/eval-benchmark.ts
 function computeStats(values) {
@@ -89,4 +89,4 @@ export {
   aggregateBenchmark,
   postBenchmark
 };
-//# sourceMappingURL=chunk-3QH73QOQ.js.map
+//# sourceMappingURL=chunk-PED7L5GX.js.map

package/dist/{chunk-VBGUNFKY.js → chunk-PMI56ED5.js}

@@ -1,10 +1,10 @@
+import {
+  buildRecommendationPrompt
+} from "./chunk-E3BIT53W.js";
 import {
   detectLlmBackend,
   runLlmPrompt
 } from "./chunk-FZKLLNDS.js";
-import {
-  buildRecommendationPrompt
-} from "./chunk-E3BIT53W.js";
 import {
   detectLanguages
 } from "./chunk-OQSQC7VB.js";
@@ -14,7 +14,7 @@ import {
 import {
   apiGet,
   apiPost
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/lib/handlers/cron-suggest-instructions.ts
 import { readFileSync } from "node:fs";
@@ -164,4 +164,4 @@ var cronSuggestInstructions = async (_payload, helpers) => {
 export {
   cronSuggestInstructions
 };
-//# sourceMappingURL=chunk-VBGUNFKY.js.map
+//# sourceMappingURL=chunk-PMI56ED5.js.map

package/dist/{chunk-RCMXTLQF.js → chunk-RMTT4KDY.js}

@@ -17,7 +17,7 @@ import {
   apiGet,
   apiPatch,
   apiPost
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/lib/handlers/process-eval.ts
 async function processEval(payload, helpers) {
@@ -188,4 +188,4 @@ function buildSummary(results) {
 export {
   processEval
 };
-//# sourceMappingURL=chunk-RCMXTLQF.js.map
+//# sourceMappingURL=chunk-RMTT4KDY.js.map

package/dist/{chunk-W4MZXKZ2.js → chunk-UKMLICWS.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_API_URL
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/dashboard/launcher/api.ts
 function apiUrl() {
@@ -48,4 +48,4 @@ export {
   cancelLaunchJob,
   listLaunchers
 };
-//# sourceMappingURL=chunk-W4MZXKZ2.js.map
+//# sourceMappingURL=chunk-UKMLICWS.js.map

package/dist/{chunk-3POYC5NA.js → chunk-XK42ZBDE.js}

@@ -1,9 +1,9 @@
 import {
   processConversationJob
-} from "./chunk-DR5WLIOU.js";
+} from "./chunk-KJKBDQ4D.js";
 import {
   apiPatch
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/lib/handlers/process-conversation.ts
 async function processConversation(payload, helpers) {
@@ -20,4 +20,4 @@ async function processConversation(payload, helpers) {
 export {
   processConversation
 };
-//# sourceMappingURL=chunk-3POYC5NA.js.map
+//# sourceMappingURL=chunk-XK42ZBDE.js.map

package/dist/{chunk-ZSGKRCKD.js → chunk-XUV6DDBF.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-F5N6CLJJ.js";
 import {
   DEFAULT_API_URL
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/dashboard/data.ts
 import * as fs from "node:fs";
@@ -121,4 +121,4 @@ export {
   loadApiInsights,
   loadLinkedInstructions
 };
-//# sourceMappingURL=chunk-ZSGKRCKD.js.map
+//# sourceMappingURL=chunk-XUV6DDBF.js.map

package/dist/{chunk-LAKZUE35.js → chunk-Y3WD5CSW.js}

@@ -1,7 +1,7 @@
 import {
   ApiError,
   apiPost
-} from "./chunk-ZRLYHBPN.js";
+} from "./chunk-ZUJBM6HE.js";
 
 // src/lib/research-client.ts
 function serializeDate(v) {
@@ -46,4 +46,4 @@ export {
   postObservation,
   postObservations
 };
-//# sourceMappingURL=chunk-LAKZUE35.js.map
+//# sourceMappingURL=chunk-Y3WD5CSW.js.map

package/dist/{chunk-3QVMIJUL.js → chunk-YOBA3NAM.js}

@@ -1,11 +1,11 @@
-import {
-  runLlmPrompt
-} from "./chunk-FZKLLNDS.js";
 import {
   getDb,
   sessionEvents,
   sessions
-} from "./chunk-6EMZI4Y3.js";
+} from "./chunk-EI5BHWXA.js";
+import {
+  runLlmPrompt
+} from "./chunk-FZKLLNDS.js";
 
 // src/lib/handlers/process-session-goal.ts
 import { eq, asc, sql } from "drizzle-orm";
@@ -52,4 +52,4 @@ async function processSessionGoal(payload, deps = {}) {
 export {
   processSessionGoal
 };
-//# sourceMappingURL=chunk-3QVMIJUL.js.map
+//# sourceMappingURL=chunk-YOBA3NAM.js.map

package/dist/{chunk-ZRLYHBPN.js → chunk-ZUJBM6HE.js}

@@ -62,14 +62,32 @@ async function api(path, options = {}) {
     delete process.env.HTTPS_PROXY;
     delete process.env.HTTP_PROXY;
   }
+  const controller = options.timeoutMs ? new AbortController() : void 0;
+  let timedOut = false;
+  const timer = controller ? setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, options.timeoutMs) : void 0;
   let response;
   try {
     response = await fetch(url, {
       method: options.method ?? "GET",
       headers,
-      body: options.body ? JSON.stringify(options.body) : void 0
+      body: options.body ? JSON.stringify(options.body) : void 0,
+      signal: controller?.signal
     });
+  } catch (err) {
+    if (timedOut) {
+      const host = new URL(url).host;
+      const secs = Math.round(options.timeoutMs / 1e3);
+      throw new ApiError(
+        408,
+        `Request to ${host} timed out after ${secs}s. This is usually transient or a local proxy/gateway issue \u2014 retry, and if it persists check HTTPS_PROXY / the RuleMetric gateway (:8787).`
+      );
+    }
+    throw err;
   } finally {
+    if (timer) clearTimeout(timer);
     if (isLocalhost) {
       if (savedProxy !== void 0) process.env.HTTPS_PROXY = savedProxy;
       if (savedHttpProxy !== void 0) process.env.HTTP_PROXY = savedHttpProxy;
@@ -104,4 +122,4 @@ export {
   apiPatch,
   apiDelete
 };
-//# sourceMappingURL=chunk-ZRLYHBPN.js.map
+//# sourceMappingURL=chunk-ZUJBM6HE.js.map

package/dist/chunk-ZUJBM6HE.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/api-client.ts"],
+  "sourcesContent": ["import { fileURLToPath } from 'node:url';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { loadToken, loadEnvFileAuth } from './auth.js';\n\n/**\n * Read the CLI's own version. Walks up from this module's location to find\n * `@rulemetric/cli`'s package.json \u2014 robust whether running unbundled from\n * `src/lib/` (dev) or from a bundled chunk at a different `dist/` depth (prod),\n * where a fixed relative `../../package.json` would resolve to the wrong file.\n */\nfunction readCliVersion(): string {\n  let dir = dirname(fileURLToPath(import.meta.url));\n  for (let i = 0; i < 8; i++) {\n    const pj = join(dir, 'package.json');\n    if (existsSync(pj)) {\n      try {\n        const parsed = JSON.parse(readFileSync(pj, 'utf8')) as { name?: string; version?: string };\n        if (parsed.name === '@rulemetric/cli' && parsed.version) return parsed.version;\n      } catch {\n        /* unreadable/parse error \u2014 keep walking up */\n      }\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return '0.0.0';\n}\n\nconst version = readCliVersion();\n\n/**\n * Default API base URL for the CLI. Points at PRODUCTION so a fresh `npm i -g\n * @rulemetric/cli` (no config, no env vars) can `auth login` out of the box.\n * Dev opts into localhost by setting `RULEMETRIC_API_URL` \u2014 `bin/dev.js` sets\n * it to `http://localhost:3000` automatically, and `scripts/start.sh` exports\n * it for the launchd services.\n */\nexport const DEFAULT_API_URL = 'https://rulemetric.com';\n\nexport class ApiError extends Error {\n  constructor(\n    public statusCode: number,\n    message: string,\n  ) {\n    super(message);\n    this.name = 'ApiError';\n  }\n}\n\ninterface ApiOptions {\n  method?: string;\n  body?: unknown;\n  headers?: Record<string, string>;\n  /**\n   * Client-side timeout in ms. OPT-IN: when unset there is NO timeout, so the\n   * worker's ~30s `/api/work/next` long-poll and slow imports (which share this\n   * client) are never aborted. Interactive onboarding calls (auth login/signup)\n   * pass a short budget so a held/502'd connection or a broken local proxy\n   * fails fast + retryable instead of appearing frozen for minutes.\n   */\n  timeoutMs?: number;\n}\n\nfunction getBaseUrl(): string {\n  // Additive fallback to the env file's URL so a key/token read from that same\n  // file (see the auth header below) is sent to the SERVER it belongs to,\n  // not the localhost default.\n  const url = process.env.RULEMETRIC_API_URL ?? loadEnvFileAuth().apiUrl ?? DEFAULT_API_URL;\n\n  // Enforce HTTPS for non-localhost URLs\n  const parsed = new URL(url);\n  if (parsed.protocol === 'http:' && parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {\n    throw new Error(`API URL must use HTTPS for non-localhost hosts: ${url}`);\n  }\n\n  return url;\n}\n\nexport async function api<T>(path: string, options: ApiOptions = {}): Promise<T> {\n  const baseUrl = getBaseUrl();\n  const url = `${baseUrl}${path}`;\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'User-Agent': `rulemetric-cli/${version}`,\n    ...options.headers,\n  };\n\n  // Auth header resolution, first match wins:\n  //   1. process.env.RULEMETRIC_API_KEY   \u2014 exported long-lived key\n  //   2. env-file RULEMETRIC_API_KEY      \u2014 long-lived key on disk (create-key)\n  //   3. auth.json OAuth accessToken      \u2014 fresh right after `auth login`\n  //   4. env-file RULEMETRIC_ACCESS_TOKEN \u2014 token persisted by login\n  // The long-lived API key is preferred over the OAuth token because the latter\n  // EXPIRES \u2014 auth.json can hold a stale token, so trying it first would 401\n  // (\"Session expired\") even when a valid key sits right there in the env file.\n  const envAuth = loadEnvFileAuth();\n  const bearer =\n    process.env.RULEMETRIC_API_KEY ||\n    envAuth.apiKey ||\n    loadToken()?.accessToken ||\n    envAuth.accessToken;\n  if (bearer) {\n    headers['Authorization'] = `Bearer ${bearer}`;\n  }\n\n  // Bypass proxy for localhost API calls \u2014 HTTPS_PROXY is for Claude Code \u2192 Anthropic,\n  // not for CLI \u2192 local API. Node.js fetch doesn't respect NO_PROXY reliably, so we\n  // temporarily unset the proxy env vars for localhost calls.\n  const parsed = new URL(url);\n  const isLocalhost = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n  const savedProxy = process.env.HTTPS_PROXY;\n  const savedHttpProxy = process.env.HTTP_PROXY;\n  if (isLocalhost) {\n    delete process.env.HTTPS_PROXY;\n    delete process.env.HTTP_PROXY;\n  }\n\n  // Opt-in client-side timeout (see ApiOptions.timeoutMs). Without it, no signal\n  // is attached and behavior is unchanged (long-poll / import safe).\n  const controller = options.timeoutMs ? new AbortController() : undefined;\n  let timedOut = false;\n  const timer = controller\n    ? setTimeout(() => {\n        timedOut = true;\n        controller.abort();\n      }, options.timeoutMs)\n    : undefined;\n\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      method: options.method ?? 'GET',\n      headers,\n      body: options.body ? JSON.stringify(options.body) : undefined,\n      signal: controller?.signal,\n    });\n  } catch (err) {\n    // A timeout abort surfaces as an AbortError. Translate it into a clear,\n    // actionable ApiError \u2014 base-command otherwise maps a raw network failure to\n    // \"Could not connect to the API server. Is it running?\", which is misleading\n    // when the server IS up but a held connection or a broken local proxy/gateway\n    // (HTTPS_PROXY \u2192 :8787) is eating the request.\n    if (timedOut) {\n      const host = new URL(url).host;\n      const secs = Math.round((options.timeoutMs as number) / 1000);\n      throw new ApiError(\n        408,\n        `Request to ${host} timed out after ${secs}s. This is usually transient or a ` +\n          `local proxy/gateway issue \u2014 retry, and if it persists check HTTPS_PROXY / the ` +\n          `RuleMetric gateway (:8787).`,\n      );\n    }\n    throw err;\n  } finally {\n    if (timer) clearTimeout(timer);\n    // Restore proxy vars so claude -p calls still route through the proxy\n    if (isLocalhost) {\n      if (savedProxy !== undefined) process.env.HTTPS_PROXY = savedProxy;\n      if (savedHttpProxy !== undefined) process.env.HTTP_PROXY = savedHttpProxy;\n    }\n  }\n\n  let responseBody: unknown;\n  const contentType = response.headers.get('content-type');\n  if (contentType?.includes('application/json')) {\n    responseBody = await response.json();\n  } else {\n    responseBody = await response.text();\n  }\n\n  if (!response.ok) {\n    // Extract only the error message, not the full response body\n    const message =\n      responseBody && typeof responseBody === 'object' && 'error' in responseBody\n        ? String((responseBody as { error: string }).error)\n        : `HTTP ${response.status}`;\n    throw new ApiError(response.status, message);\n  }\n\n  return responseBody as T;\n}\n\nexport const apiGet = <T>(path: string): Promise<T> => api<T>(path);\nexport const apiPost = <T>(path: string, body: unknown): Promise<T> => api<T>(path, { method: 'POST', body });\nexport const apiPut = <T>(path: string, body: unknown): Promise<T> => api<T>(path, { method: 'PUT', body });\nexport const apiPatch = <T>(path: string, body: unknown): Promise<T> => api<T>(path, { method: 'PATCH', body });\nexport const apiDelete = <T>(path: string): Promise<T> => api<T>(path, { method: 'DELETE' });\n"],
+  "mappings": ";;;;;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,YAAY,oBAAoB;AACzC,SAAS,SAAS,YAAY;AAS9B,SAAS,iBAAyB;AAChC,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,KAAK,KAAK,KAAK,cAAc;AACnC,QAAI,WAAW,EAAE,GAAG;AAClB,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC;AAClD,YAAI,OAAO,SAAS,qBAAqB,OAAO,QAAS,QAAO,OAAO;AAAA,MACzE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,IAAM,UAAU,eAAe;AASxB,IAAM,kBAAkB;AAExB,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YACS,YACP,SACA;AACA,UAAM,OAAO;AAHN;AAIP,SAAK,OAAO;AAAA,EACd;AACF;AAgBA,SAAS,aAAqB;AAI5B,QAAM,MAAM,QAAQ,IAAI,sBAAsB,gBAAgB,EAAE,UAAU;AAG1E,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,eAAe,OAAO,aAAa,aAAa;AACrG,UAAM,IAAI,MAAM,mDAAmD,GAAG,EAAE;AAAA,EAC1E;AAEA,SAAO;AACT;AAEA,eAAsB,IAAO,MAAc,UAAsB,CAAC,GAAe;AAC/E,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,GAAG,OAAO,GAAG,IAAI;AAE7B,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,cAAc,kBAAkB,OAAO;AAAA,IACvC,GAAG,QAAQ;AAAA,EACb;AAUA,QAAM,UAAU,gBAAgB;AAChC,QAAM,SACJ,QAAQ,IAAI,sBACZ,QAAQ,UACR,UAAU,GAAG,eACb,QAAQ;AACV,MAAI,QAAQ;AACV,YAAQ,eAAe,IAAI,UAAU,MAAM;AAAA,EAC7C;AAKA,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAM,cAAc,OAAO,aAAa,eAAe,OAAO,aAAa;AAC3E,QAAM,aAAa,QAAQ,IAAI;AAC/B,QAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAI,aAAa;AACf,WAAO,QAAQ,IAAI;AACnB,WAAO,QAAQ,IAAI;AAAA,EACrB;AAIA,QAAM,aAAa,QAAQ,YAAY,IAAI,gBAAgB,IAAI;AAC/D,MAAI,WAAW;AACf,QAAM,QAAQ,aACV,WAAW,MAAM;AACf,eAAW;AACX,eAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,SAAS,IACpB;AAEJ,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,KAAK;AAAA,MAC1B,QAAQ,QAAQ,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,MACpD,QAAQ,YAAY;AAAA,IACtB,CAAC;AAAA,EACH,SAAS,KAAK;AAMZ,QAAI,UAAU;AACZ,YAAM,OAAO,IAAI,IAAI,GAAG,EAAE;AAC1B,YAAM,OAAO,KAAK,MAAO,QAAQ,YAAuB,GAAI;AAC5D,YAAM,IAAI;AAAA,QACR;AAAA,QACA,cAAc,IAAI,oBAAoB,IAAI;AAAA,MAG5C;AAAA,IACF;AACA,UAAM;AAAA,EACR,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAE7B,QAAI,aAAa;AACf,UAAI,eAAe,OAAW,SAAQ,IAAI,cAAc;AACxD,UAAI,mBAAmB,OAAW,SAAQ,IAAI,aAAa;AAAA,IAC7D;AAAA,EACF;AAEA,MAAI;AACJ,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,MAAI,aAAa,SAAS,kBAAkB,GAAG;AAC7C,mBAAe,MAAM,SAAS,KAAK;AAAA,EACrC,OAAO;AACL,mBAAe,MAAM,SAAS,KAAK;AAAA,EACrC;AAEA,MAAI,CAAC,SAAS,IAAI;AAEhB,UAAM,UACJ,gBAAgB,OAAO,iBAAiB,YAAY,WAAW,eAC3D,OAAQ,aAAmC,KAAK,IAChD,QAAQ,SAAS,MAAM;AAC7B,UAAM,IAAI,SAAS,SAAS,QAAQ,OAAO;AAAA,EAC7C;AAEA,SAAO;AACT;AAEO,IAAM,SAAS,CAAI,SAA6B,IAAO,IAAI;AAC3D,IAAM,UAAU,CAAI,MAAc,SAA8B,IAAO,MAAM,EAAE,QAAQ,QAAQ,KAAK,CAAC;AACrG,IAAM,SAAS,CAAI,MAAc,SAA8B,IAAO,MAAM,EAAE,QAAQ,OAAO,KAAK,CAAC;AACnG,IAAM,WAAW,CAAI,MAAc,SAA8B,IAAO,MAAM,EAAE,QAAQ,SAAS,KAAK,CAAC;AACvG,IAAM,YAAY,CAAI,SAA6B,IAAO,MAAM,EAAE,QAAQ,SAAS,CAAC;",
+  "names": []
+}

package/dist/commands/antigravity/backfill.js

@@ -3,14 +3,15 @@ import {
   findMaxStepIndex,
   readNewRecords,
   stateApi
-} from "../../chunk-RUCSRN7F.js";
+} from "../../chunk-2ORJWTNZ.js";
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
-import "../../chunk-SLL3OBKN.js";
+import "../../chunk-GQNJO2P2.js";
+import "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
-import "../../chunk-ZRLYHBPN.js";
+import "../../chunk-ZUJBM6HE.js";
 import "../../chunk-W2YERO7E.js";
 import "../../chunk-NSBPE2FW.js";
 

package/dist/commands/antigravity/backfill.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../../../src/commands/antigravity/backfill.ts"],
   "sourcesContent": ["import { Args, Flags } from '@oclif/core';\nimport { existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport {\n  emitRecordsAsEvents,\n  findMaxStepIndex,\n  readNewRecords,\n  stateApi,\n} from '../../lib/antigravity-transcript.js';\n\nconst TRANSCRIPT_BRAIN_DIR = join(homedir(), '.gemini', 'antigravity-ide', 'brain');\n\nexport default class AntigravityBackfill extends BaseCommand {\n  static override description =\n    'Backfill historical events from an Antigravity conversation transcript into a RuleMetric session. Useful for seeding a conversation that existed before hooks were installed \u2014 the live hook intentionally only captures forward.';\n\n  static override examples = [\n    '<%= config.bin %> antigravity backfill 26fd215d-f43b-4ea5-b177-dc2c0e696f97 --session 158db9aa-68ee-43fc-961b-f3a180578694',\n    '<%= config.bin %> antigravity backfill 26fd215d-f43b-4ea5-b177-dc2c0e696f97 --dry-run',\n  ];\n\n  static override args = {\n    conversationId: Args.string({\n      description: 'Antigravity conversationId (UUID) \u2014 the directory name under ~/.gemini/antigravity-ide/brain/',\n      required: true,\n    }),\n  };\n\n  static override flags = {\n    session: Flags.string({\n      char: 's',\n      description:\n        'RuleMetric session UUID to POST events into. If omitted, resolved from the hook tmp file ($TMPDIR/rulemetric/<conversationId>) \u2014 fails if neither is present.',\n    }),\n    transcript: Flags.string({\n      description:\n        'Path to the transcript.jsonl file. Defaults to ~/.gemini/antigravity-ide/brain/<conversationId>/.system_generated/logs/transcript.jsonl',\n    }),\n    'after-step': Flags.integer({\n      description:\n        'Only emit records with step_index > this value. Default: read from existing state file, else -1 (everything).',\n    }),\n    limit: Flags.integer({\n      description: 'Cap on the number of records to process this run.',\n    }),\n    'dry-run': Flags.boolean({\n      default: false,\n      description: 'Classify records without POSTing. Reports counts only.',\n    }),\n    'save-state': Flags.boolean({\n      default: true,\n      allowNo: true,\n      description: 'After backfill, persist the highest step_index so the live hook resumes from there.',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { args, flags } = await this.parse(AntigravityBackfill);\n    const conversationId = args.conversationId;\n\n    stateApi.loadEnvFile();\n    if (!process.env.RULEMETRIC_API_URL) {\n      this.error('RULEMETRIC_API_URL is not set. Configure it via env or ~/.config/rulemetric/env.');\n    }\n\n    const transcriptPath =\n      flags.transcript ??\n      join(TRANSCRIPT_BRAIN_DIR, conversationId, '.system_generated', 'logs', 'transcript.jsonl');\n    if (!existsSync(transcriptPath)) {\n      this.error(`Transcript not found: ${transcriptPath}`);\n    }\n\n    const rwSessionId = flags.session ?? stateApi.resolveRwSessionId(conversationId);\n    if (!rwSessionId) {\n      this.error(\n        `No RuleMetric session resolved. Pass --session <uuid>, or run the Antigravity hook at least once so $TMPDIR/rulemetric/${conversationId} is populated.`,\n      );\n    }\n\n    let after = flags['after-step'];\n    if (after === undefined) {\n      const existing = stateApi.load(conversationId);\n      after = existing?.lastStepIdx ?? -1;\n    }\n\n    let records = readNewRecords(transcriptPath, after);\n    if (flags.limit !== undefined && records.length > flags.limit) {\n      records = records.slice(0, flags.limit);\n    }\n\n    const max = findMaxStepIndex(transcriptPath);\n    this.log(\n      `Conversation ${conversationId}: transcript max step = ${max}, after-step = ${after}, records to process = ${records.length}`,\n    );\n    if (records.length === 0) {\n      this.log('Nothing to backfill.');\n      return;\n    }\n\n    if (flags['dry-run']) {\n      // Count classification outcomes without POSTing.\n      let wouldEmit = 0;\n      let wouldSkip = 0;\n      const byEventType: Record<string, number> = {};\n      for (const record of records) {\n        // Use a stable fake sequence \u2014 classification doesn't care about its value.\n        const classified = (await import('../../lib/antigravity-transcript.js')).classifyRecord(record, 0);\n        if (classified) {\n          wouldEmit++;\n          byEventType[classified.eventType] = (byEventType[classified.eventType] ?? 0) + 1;\n        } else {\n          wouldSkip++;\n        }\n      }\n      this.log(\n        `Dry run: would emit ${wouldEmit}, skip ${wouldSkip}. By eventType: ${JSON.stringify(byEventType)}`,\n      );\n      return;\n    }\n\n    const start = Date.now();\n    const result = await emitRecordsAsEvents(records, rwSessionId, conversationId, after, {\n      onProgress: ({ attempted, total }) => {\n        if (attempted % 100 === 0 || attempted === total) {\n          process.stderr.write(`  \u2026${attempted}/${total}\\n`);\n        }\n      },\n    });\n    const elapsedSec = ((Date.now() - start) / 1000).toFixed(1);\n\n    this.log(\n      `Backfill complete in ${elapsedSec}s. attempted=${result.attempted} emitted=${result.emitted} skipped=${result.skipped} failed=${result.failed} highestStepIdx=${result.highestStepIdx}`,\n    );\n\n    if (flags['save-state']) {\n      stateApi.save(conversationId, { lastStepIdx: result.highestStepIdx });\n      this.log(`State saved \u2192 live hook will resume from step_index > ${result.highestStepIdx}.`);\n    } else {\n      this.log('State NOT saved (--no-save-state). Live hook will re-emit any new records from after-step.');\n    }\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,MAAM,aAAa;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,YAAY;AASrB,IAAM,uBAAuB,KAAK,QAAQ,GAAG,WAAW,mBAAmB,OAAO;AAElF,IAAqB,sBAArB,MAAqB,6BAA4B,YAAY;AAAA,EAC3D,OAAgB,cACd;AAAA,EAEF,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,OAAO;AAAA,IACrB,gBAAgB,KAAK,OAAO;AAAA,MAC1B,aAAa;AAAA,MACb,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,SAAS,MAAM,OAAO;AAAA,MACpB,MAAM;AAAA,MACN,aACE;AAAA,IACJ,CAAC;AAAA,IACD,YAAY,MAAM,OAAO;AAAA,MACvB,aACE;AAAA,IACJ,CAAC;AAAA,IACD,cAAc,MAAM,QAAQ;AAAA,MAC1B,aACE;AAAA,IACJ,CAAC;AAAA,IACD,OAAO,MAAM,QAAQ;AAAA,MACnB,aAAa;AAAA,IACf,CAAC;AAAA,IACD,WAAW,MAAM,QAAQ;AAAA,MACvB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,MAAM,QAAQ;AAAA,MAC1B,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,MAAM,oBAAmB;AAC5D,UAAM,iBAAiB,KAAK;AAE5B,aAAS,YAAY;AACrB,QAAI,CAAC,QAAQ,IAAI,oBAAoB;AACnC,WAAK,MAAM,kFAAkF;AAAA,IAC/F;AAEA,UAAM,iBACJ,MAAM,cACN,KAAK,sBAAsB,gBAAgB,qBAAqB,QAAQ,kBAAkB;AAC5F,QAAI,CAAC,WAAW,cAAc,GAAG;AAC/B,WAAK,MAAM,yBAAyB,cAAc,EAAE;AAAA,IACtD;AAEA,UAAM,cAAc,MAAM,WAAW,SAAS,mBAAmB,cAAc;AAC/E,QAAI,CAAC,aAAa;AAChB,WAAK;AAAA,QACH,0HAA0H,cAAc;AAAA,MAC1I;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM,YAAY;AAC9B,QAAI,UAAU,QAAW;AACvB,YAAM,WAAW,SAAS,KAAK,cAAc;AAC7C,cAAQ,UAAU,eAAe;AAAA,IACnC;AAEA,QAAI,UAAU,eAAe,gBAAgB,KAAK;AAClD,QAAI,MAAM,UAAU,UAAa,QAAQ,SAAS,MAAM,OAAO;AAC7D,gBAAU,QAAQ,MAAM,GAAG,MAAM,KAAK;AAAA,IACxC;AAEA,UAAM,MAAM,iBAAiB,cAAc;AAC3C,SAAK;AAAA,MACH,gBAAgB,cAAc,2BAA2B,GAAG,kBAAkB,KAAK,0BAA0B,QAAQ,MAAM;AAAA,IAC7H;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,WAAK,IAAI,sBAAsB;AAC/B;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AAEpB,UAAI,YAAY;AAChB,UAAI,YAAY;AAChB,YAAM,cAAsC,CAAC;AAC7C,iBAAW,UAAU,SAAS;AAE5B,cAAM,cAAc,MAAM,OAAO,qCAAqC,GAAG,eAAe,QAAQ,CAAC;AACjG,YAAI,YAAY;AACd;AACA,sBAAY,WAAW,SAAS,KAAK,YAAY,WAAW,SAAS,KAAK,KAAK;AAAA,QACjF,OAAO;AACL;AAAA,QACF;AAAA,MACF;AACA,WAAK;AAAA,QACH,uBAAuB,SAAS,UAAU,SAAS,mBAAmB,KAAK,UAAU,WAAW,CAAC;AAAA,MACnG;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,SAAS,MAAM,oBAAoB,SAAS,aAAa,gBAAgB,OAAO;AAAA,MACpF,YAAY,CAAC,EAAE,WAAW,MAAM,MAAM;AACpC,YAAI,YAAY,QAAQ,KAAK,cAAc,OAAO;AAChD,kBAAQ,OAAO,MAAM,WAAM,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA,QACnD;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,eAAe,KAAK,IAAI,IAAI,SAAS,KAAM,QAAQ,CAAC;AAE1D,SAAK;AAAA,MACH,wBAAwB,UAAU,gBAAgB,OAAO,SAAS,YAAY,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,OAAO,MAAM,mBAAmB,OAAO,cAAc;AAAA,IACxL;AAEA,QAAI,MAAM,YAAY,GAAG;AACvB,eAAS,KAAK,gBAAgB,EAAE,aAAa,OAAO,eAAe,CAAC;AACpE,WAAK,IAAI,8DAAyD,OAAO,cAAc,GAAG;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,4FAA4F;AAAA,IACvG;AAAA,EACF;AACF;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA,SAAS,MAAM,aAAa;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,YAAY;AASrB,IAAM,uBAAuB,KAAK,QAAQ,GAAG,WAAW,mBAAmB,OAAO;AAElF,IAAqB,sBAArB,MAAqB,6BAA4B,YAAY;AAAA,EAC3D,OAAgB,cACd;AAAA,EAEF,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,OAAO;AAAA,IACrB,gBAAgB,KAAK,OAAO;AAAA,MAC1B,aAAa;AAAA,MACb,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,SAAS,MAAM,OAAO;AAAA,MACpB,MAAM;AAAA,MACN,aACE;AAAA,IACJ,CAAC;AAAA,IACD,YAAY,MAAM,OAAO;AAAA,MACvB,aACE;AAAA,IACJ,CAAC;AAAA,IACD,cAAc,MAAM,QAAQ;AAAA,MAC1B,aACE;AAAA,IACJ,CAAC;AAAA,IACD,OAAO,MAAM,QAAQ;AAAA,MACnB,aAAa;AAAA,IACf,CAAC;AAAA,IACD,WAAW,MAAM,QAAQ;AAAA,MACvB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,MAAM,QAAQ;AAAA,MAC1B,SAAS;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,MAAM,oBAAmB;AAC5D,UAAM,iBAAiB,KAAK;AAE5B,aAAS,YAAY;AACrB,QAAI,CAAC,QAAQ,IAAI,oBAAoB;AACnC,WAAK,MAAM,kFAAkF;AAAA,IAC/F;AAEA,UAAM,iBACJ,MAAM,cACN,KAAK,sBAAsB,gBAAgB,qBAAqB,QAAQ,kBAAkB;AAC5F,QAAI,CAAC,WAAW,cAAc,GAAG;AAC/B,WAAK,MAAM,yBAAyB,cAAc,EAAE;AAAA,IACtD;AAEA,UAAM,cAAc,MAAM,WAAW,SAAS,mBAAmB,cAAc;AAC/E,QAAI,CAAC,aAAa;AAChB,WAAK;AAAA,QACH,0HAA0H,cAAc;AAAA,MAC1I;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM,YAAY;AAC9B,QAAI,UAAU,QAAW;AACvB,YAAM,WAAW,SAAS,KAAK,cAAc;AAC7C,cAAQ,UAAU,eAAe;AAAA,IACnC;AAEA,QAAI,UAAU,eAAe,gBAAgB,KAAK;AAClD,QAAI,MAAM,UAAU,UAAa,QAAQ,SAAS,MAAM,OAAO;AAC7D,gBAAU,QAAQ,MAAM,GAAG,MAAM,KAAK;AAAA,IACxC;AAEA,UAAM,MAAM,iBAAiB,cAAc;AAC3C,SAAK;AAAA,MACH,gBAAgB,cAAc,2BAA2B,GAAG,kBAAkB,KAAK,0BAA0B,QAAQ,MAAM;AAAA,IAC7H;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,WAAK,IAAI,sBAAsB;AAC/B;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AAEpB,UAAI,YAAY;AAChB,UAAI,YAAY;AAChB,YAAM,cAAsC,CAAC;AAC7C,iBAAW,UAAU,SAAS;AAE5B,cAAM,cAAc,MAAM,OAAO,qCAAqC,GAAG,eAAe,QAAQ,CAAC;AACjG,YAAI,YAAY;AACd;AACA,sBAAY,WAAW,SAAS,KAAK,YAAY,WAAW,SAAS,KAAK,KAAK;AAAA,QACjF,OAAO;AACL;AAAA,QACF;AAAA,MACF;AACA,WAAK;AAAA,QACH,uBAAuB,SAAS,UAAU,SAAS,mBAAmB,KAAK,UAAU,WAAW,CAAC;AAAA,MACnG;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,SAAS,MAAM,oBAAoB,SAAS,aAAa,gBAAgB,OAAO;AAAA,MACpF,YAAY,CAAC,EAAE,WAAW,MAAM,MAAM;AACpC,YAAI,YAAY,QAAQ,KAAK,cAAc,OAAO;AAChD,kBAAQ,OAAO,MAAM,WAAM,SAAS,IAAI,KAAK;AAAA,CAAI;AAAA,QACnD;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,eAAe,KAAK,IAAI,IAAI,SAAS,KAAM,QAAQ,CAAC;AAE1D,SAAK;AAAA,MACH,wBAAwB,UAAU,gBAAgB,OAAO,SAAS,YAAY,OAAO,OAAO,YAAY,OAAO,OAAO,WAAW,OAAO,MAAM,mBAAmB,OAAO,cAAc;AAAA,IACxL;AAEA,QAAI,MAAM,YAAY,GAAG;AACvB,eAAS,KAAK,gBAAgB,EAAE,aAAa,OAAO,eAAe,CAAC;AACpE,WAAK,IAAI,8DAAyD,OAAO,cAAc,GAAG;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,4FAA4F;AAAA,IACvG;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/commands/auth/create-key.js

@@ -1,12 +1,13 @@
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
-import "../../chunk-SLL3OBKN.js";
+import "../../chunk-GQNJO2P2.js";
+import "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
 import {
   apiPost
-} from "../../chunk-ZRLYHBPN.js";
+} from "../../chunk-ZUJBM6HE.js";
 import {
   getDefaultConfigDir,
   saveApiKey

package/dist/commands/auth/create-key.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../../../src/commands/auth/create-key.ts"],
   "sourcesContent": ["import * as path from 'node:path';\nimport { Flags } from '@oclif/core';\nimport { BaseCommand } from '../../base-command.js';\nimport { apiPost } from '../../lib/api-client.js';\nimport { saveApiKey, getDefaultConfigDir } from '../../lib/auth.js';\n\ninterface CreateKeyResponse {\n  id: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  createdAt: string;\n}\n\nexport default class AuthCreateKey extends BaseCommand {\n  static override description = 'Create a long-lived API key for CLI and proxy authentication';\n\n  static override examples = [\n    '<%= config.bin %> auth create-key --name \"laptop\"',\n    '<%= config.bin %> auth create-key --name \"work proxy\" --save',\n  ];\n\n  static override flags = {\n    name: Flags.string({ char: 'n', description: 'Name for this key', required: true }),\n    save: Flags.boolean({ char: 's', description: 'Save key to ~/.config/rulemetric/env for hooks/proxy', default: true }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(AuthCreateKey);\n\n    const data = await apiPost<CreateKeyResponse>('/api/auth/api-keys', { name: flags.name });\n\n    this.log('');\n    this.log('API key created successfully:');\n    this.log('');\n    this.log(`  Name:   ${data.name}`);\n    this.log(`  Key:    ${data.key}`);\n    this.log(`  Prefix: ${data.keyPrefix}`);\n    this.log('');\n    this.warn('Save this key now \u2014 it will not be shown again.');\n\n    if (flags.save) {\n      saveApiKey(data.key, process.env.RULEMETRIC_API_URL);\n      this.log('');\n      this.log(`Key saved to ${path.join(getDefaultConfigDir(), 'env')} (RULEMETRIC_API_KEY)`);\n      this.log('Hooks and proxy will use this key automatically.');\n    }\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;AAAA,YAAY,UAAU;AACtB,SAAS,aAAa;AAatB,IAAqB,gBAArB,MAAqB,uBAAsB,YAAY;AAAA,EACrD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,MAAM,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,qBAAqB,UAAU,KAAK,CAAC;AAAA,IAClF,MAAM,MAAM,QAAQ,EAAE,MAAM,KAAK,aAAa,wDAAwD,SAAS,KAAK,CAAC;AAAA,EACvH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAa;AAEhD,UAAM,OAAO,MAAM,QAA2B,sBAAsB,EAAE,MAAM,MAAM,KAAK,CAAC;AAExF,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,+BAA+B;AACxC,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,aAAa,KAAK,IAAI,EAAE;AACjC,SAAK,IAAI,aAAa,KAAK,GAAG,EAAE;AAChC,SAAK,IAAI,aAAa,KAAK,SAAS,EAAE;AACtC,SAAK,IAAI,EAAE;AACX,SAAK,KAAK,sDAAiD;AAE3D,QAAI,MAAM,MAAM;AACd,iBAAW,KAAK,KAAK,QAAQ,IAAI,kBAAkB;AACnD,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,gBAAqB,UAAK,oBAAoB,GAAG,KAAK,CAAC,uBAAuB;AACvF,WAAK,IAAI,kDAAkD;AAAA,IAC7D;AAAA,EACF;AACF;",
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA,YAAY,UAAU;AACtB,SAAS,aAAa;AAatB,IAAqB,gBAArB,MAAqB,uBAAsB,YAAY;AAAA,EACrD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,MAAM,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,qBAAqB,UAAU,KAAK,CAAC;AAAA,IAClF,MAAM,MAAM,QAAQ,EAAE,MAAM,KAAK,aAAa,wDAAwD,SAAS,KAAK,CAAC;AAAA,EACvH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAa;AAEhD,UAAM,OAAO,MAAM,QAA2B,sBAAsB,EAAE,MAAM,MAAM,KAAK,CAAC;AAExF,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,+BAA+B;AACxC,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,aAAa,KAAK,IAAI,EAAE;AACjC,SAAK,IAAI,aAAa,KAAK,GAAG,EAAE;AAChC,SAAK,IAAI,aAAa,KAAK,SAAS,EAAE;AACtC,SAAK,IAAI,EAAE;AACX,SAAK,KAAK,sDAAiD;AAE3D,QAAI,MAAM,MAAM;AACd,iBAAW,KAAK,KAAK,QAAQ,IAAI,kBAAkB;AACnD,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,gBAAqB,UAAK,oBAAoB,GAAG,KAAK,CAAC,uBAAuB;AACvF,WAAK,IAAI,kDAAkD;AAAA,IAC7D;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/commands/auth/login.js

@@ -1,21 +1,21 @@
 import {
   ensureDeviceApiKey
-} from "../../chunk-HNZLEEG2.js";
-import {
-  emitSetupEvent
-} from "../../chunk-TX2HKJLA.js";
+} from "../../chunk-EJ3YAFDP.js";
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
+import {
+  emitSetupEvent
+} from "../../chunk-GQNJO2P2.js";
 import {
   bootstrapActiveOrg
-} from "../../chunk-SLL3OBKN.js";
+} from "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
 import {
   ApiError,
-  apiPost
-} from "../../chunk-ZRLYHBPN.js";
+  api
+} from "../../chunk-ZUJBM6HE.js";
 import {
   saveEnvFile,
   saveToken
@@ -54,7 +54,11 @@ var AuthLogin = class _AuthLogin extends BaseCommand {
     }
     let data;
     try {
-      data = await apiPost("/auth/login", { email, password });
+      data = await api("/auth/login", {
+        method: "POST",
+        body: { email, password },
+        timeoutMs: 2e4
+      });
     } catch (err) {
       if (err instanceof ApiError && err.statusCode === 401) {
         this.error("Invalid email or password.");

package/dist/commands/auth/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/auth/login.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { BaseCommand } from '../../base-command.js';\nimport { saveToken, saveEnvFile } from '../../lib/auth.js';\nimport { apiPost, ApiError } from '../../lib/api-client.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { ensureDeviceApiKey } from '../../lib/ensure-api-key.js';\nimport { emitSetupEvent } from '../../lib/telemetry.js';\n\ninterface LoginResponse {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: string | null;\n  email: string;\n}\n\nexport default class AuthLogin extends BaseCommand {\n  static override description = 'Log in to RuleMetric';\n\n  static override examples = [\n    '<%= config.bin %> auth login',\n    '<%= config.bin %> auth login -e user@example.com',\n  ];\n\n  static override flags = {\n    email: Flags.string({ char: 'e', description: 'Email address' }),\n    password: Flags.string({ char: 'p', description: 'Password (for non-interactive use)' }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(AuthLogin);\n\n    let email = flags.email;\n    let password = flags.password;\n\n    if (!email || !password) {\n      // Interactive prompts hang forever with no output in a non-TTY (CI, SSH\n      // pipe, an agent driving the CLI). Fail fast with actionable guidance\n      // instead of appearing to freeze.\n      if (!process.stdin.isTTY) {\n        this.error(\n          'Missing credentials in a non-interactive shell. Pass --email/-e and --password/-p, ' +\n            'or set RULEMETRIC_API_KEY (create a key at https://rulemetric.com/settings).',\n        );\n      }\n      const { input, password: passwordPrompt } = await import('@inquirer/prompts');\n\n      if (!email) {\n        email = await input({ message: 'Email:' });\n      }\n\n      if (!password) {\n        password = await passwordPrompt({ message: 'Password:' });\n      }\n    }\n\n    let data: LoginResponse;\n    try {\n      data = await apiPost<LoginResponse>('/auth/login', { email, password });\n    } catch (err) {\n      // A 401 HERE means the email/password were rejected \u2014 not that a prior\n      // session expired. base-command's generic catch maps every 401 to\n      // \"Session expired. Run auth login\", which is nonsensical mid-login and\n      // loops the user. Give the real reason.\n      if (err instanceof ApiError && err.statusCode === 401) {\n        this.error('Invalid email or password.');\n      }\n      throw err;\n    }\n\n    const expiresAt = data.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString();\n\n    saveToken({\n      accessToken: data.accessToken,\n      refreshToken: data.refreshToken,\n      expiresAt,\n      email: data.email,\n    });\n\n    saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);\n\n    // Bootstrap the active-org cache now that auth is available. BaseCommand\n    // fired the guarded refresh BEFORE login completed (no creds \u2192 401 \u2192\n    // swallowed); without this explicit retry, the cache stays empty until\n    // the user runs another CLI command, and any Claude Code session that\n    // fires in the meantime lands with org_id = NULL.\n    await bootstrapActiveOrg();\n\n    // Auto-mint a hooks/proxy API key so create-key isn't a separate manual\n    // step (best-effort; no-ops if a key already exists, never fails login).\n    await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this), this.config.version);\n\n    // Onboarding telemetry (disclosed + opt-outable) \u2014 first authenticated\n    // event, so a remote install becomes visible from here on.\n    void emitSetupEvent('auth_login', {}, this.config.version);\n\n    this.log(`Logged in as ${data.email}`);\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AAetB,IAAqB,YAArB,MAAqB,mBAAkB,YAAY;AAAA,EACjD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,OAAO,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,gBAAgB,CAAC;AAAA,IAC/D,UAAU,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,qCAAqC,CAAC;AAAA,EACzF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,UAAS;AAE5C,QAAI,QAAQ,MAAM;AAClB,QAAI,WAAW,MAAM;AAErB,QAAI,CAAC,SAAS,CAAC,UAAU;AAIvB,UAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,aAAK;AAAA,UACH;AAAA,QAEF;AAAA,MACF;AACA,YAAM,EAAE,OAAO,UAAU,eAAe,IAAI,MAAM,OAAO,mBAAmB;AAE5E,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC;AAAA,MAC3C;AAEA,UAAI,CAAC,UAAU;AACb,mBAAW,MAAM,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,MAC1D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAuB,eAAe,EAAE,OAAO,SAAS,CAAC;AAAA,IACxE,SAAS,KAAK;AAKZ,UAAI,eAAe,YAAY,IAAI,eAAe,KAAK;AACrD,aAAK,MAAM,4BAA4B;AAAA,MACzC;AACA,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,KAAK,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,GAAI,EAAE,YAAY;AAEnF,cAAU;AAAA,MACR,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,MACA,OAAO,KAAK;AAAA,IACd,CAAC;AAED,gBAAY,KAAK,aAAa,QAAQ,IAAI,kBAAkB;AAO5D,UAAM,mBAAmB;AAIzB,UAAM,mBAAmB,KAAK,IAAI,KAAK,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,OAAO;AAIvF,SAAK,eAAe,cAAc,CAAC,GAAG,KAAK,OAAO,OAAO;AAEzD,SAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE;AAAA,EACvC;AACF;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { BaseCommand } from '../../base-command.js';\nimport { saveToken, saveEnvFile } from '../../lib/auth.js';\nimport { api, ApiError } from '../../lib/api-client.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { ensureDeviceApiKey } from '../../lib/ensure-api-key.js';\nimport { emitSetupEvent } from '../../lib/telemetry.js';\n\ninterface LoginResponse {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: string | null;\n  email: string;\n}\n\nexport default class AuthLogin extends BaseCommand {\n  static override description = 'Log in to RuleMetric';\n\n  static override examples = [\n    '<%= config.bin %> auth login',\n    '<%= config.bin %> auth login -e user@example.com',\n  ];\n\n  static override flags = {\n    email: Flags.string({ char: 'e', description: 'Email address' }),\n    password: Flags.string({ char: 'p', description: 'Password (for non-interactive use)' }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(AuthLogin);\n\n    let email = flags.email;\n    let password = flags.password;\n\n    if (!email || !password) {\n      // Interactive prompts hang forever with no output in a non-TTY (CI, SSH\n      // pipe, an agent driving the CLI). Fail fast with actionable guidance\n      // instead of appearing to freeze.\n      if (!process.stdin.isTTY) {\n        this.error(\n          'Missing credentials in a non-interactive shell. Pass --email/-e and --password/-p, ' +\n            'or set RULEMETRIC_API_KEY (create a key at https://rulemetric.com/settings).',\n        );\n      }\n      const { input, password: passwordPrompt } = await import('@inquirer/prompts');\n\n      if (!email) {\n        email = await input({ message: 'Email:' });\n      }\n\n      if (!password) {\n        password = await passwordPrompt({ message: 'Password:' });\n      }\n    }\n\n    let data: LoginResponse;\n    try {\n      // Bounded so the first onboarding step fails fast + retryable instead of\n      // hanging for minutes on a held/502'd connection or a broken local proxy.\n      data = await api<LoginResponse>('/auth/login', {\n        method: 'POST',\n        body: { email, password },\n        timeoutMs: 20_000,\n      });\n    } catch (err) {\n      // A 401 HERE means the email/password were rejected \u2014 not that a prior\n      // session expired. base-command's generic catch maps every 401 to\n      // \"Session expired. Run auth login\", which is nonsensical mid-login and\n      // loops the user. Give the real reason.\n      if (err instanceof ApiError && err.statusCode === 401) {\n        this.error('Invalid email or password.');\n      }\n      throw err;\n    }\n\n    const expiresAt = data.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString();\n\n    saveToken({\n      accessToken: data.accessToken,\n      refreshToken: data.refreshToken,\n      expiresAt,\n      email: data.email,\n    });\n\n    saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);\n\n    // Bootstrap the active-org cache now that auth is available. BaseCommand\n    // fired the guarded refresh BEFORE login completed (no creds \u2192 401 \u2192\n    // swallowed); without this explicit retry, the cache stays empty until\n    // the user runs another CLI command, and any Claude Code session that\n    // fires in the meantime lands with org_id = NULL.\n    await bootstrapActiveOrg();\n\n    // Auto-mint a hooks/proxy API key so create-key isn't a separate manual\n    // step (best-effort; no-ops if a key already exists, never fails login).\n    await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this), this.config.version);\n\n    // Onboarding telemetry (disclosed + opt-outable) \u2014 first authenticated\n    // event, so a remote install becomes visible from here on.\n    void emitSetupEvent('auth_login', {}, this.config.version);\n\n    this.log(`Logged in as ${data.email}`);\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AAetB,IAAqB,YAArB,MAAqB,mBAAkB,YAAY;AAAA,EACjD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,OAAO,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,gBAAgB,CAAC;AAAA,IAC/D,UAAU,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,qCAAqC,CAAC;AAAA,EACzF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,UAAS;AAE5C,QAAI,QAAQ,MAAM;AAClB,QAAI,WAAW,MAAM;AAErB,QAAI,CAAC,SAAS,CAAC,UAAU;AAIvB,UAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,aAAK;AAAA,UACH;AAAA,QAEF;AAAA,MACF;AACA,YAAM,EAAE,OAAO,UAAU,eAAe,IAAI,MAAM,OAAO,mBAAmB;AAE5E,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC;AAAA,MAC3C;AAEA,UAAI,CAAC,UAAU;AACb,mBAAW,MAAM,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,MAC1D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AAGF,aAAO,MAAM,IAAmB,eAAe;AAAA,QAC7C,QAAQ;AAAA,QACR,MAAM,EAAE,OAAO,SAAS;AAAA,QACxB,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,KAAK;AAKZ,UAAI,eAAe,YAAY,IAAI,eAAe,KAAK;AACrD,aAAK,MAAM,4BAA4B;AAAA,MACzC;AACA,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,KAAK,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,GAAI,EAAE,YAAY;AAEnF,cAAU;AAAA,MACR,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,MACA,OAAO,KAAK;AAAA,IACd,CAAC;AAED,gBAAY,KAAK,aAAa,QAAQ,IAAI,kBAAkB;AAO5D,UAAM,mBAAmB;AAIzB,UAAM,mBAAmB,KAAK,IAAI,KAAK,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,OAAO;AAIvF,SAAK,eAAe,cAAc,CAAC,GAAG,KAAK,OAAO,OAAO;AAEzD,SAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE;AAAA,EACvC;AACF;",
   "names": []
 }

package/dist/commands/auth/logout.js

@@ -1,10 +1,11 @@
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
-import "../../chunk-SLL3OBKN.js";
+import "../../chunk-GQNJO2P2.js";
+import "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
-import "../../chunk-ZRLYHBPN.js";
+import "../../chunk-ZUJBM6HE.js";
 import {
   clearEnvFile,
   clearToken