@rulemetric/cli 0.6.9 → 0.7.1

package/dist/commands/gateway/ensure.js

@@ -1,24 +1,67 @@
 import {
+  repinEditorProxies,
+  unpinEditorProxies
+} from "../../chunk-3S7223UR.js";
+import {
+  writeCursorUserProxyConfig,
+  writeVSCodeUserProxyConfig
+} from "../../chunk-LXKPNATC.js";
+import "../../chunk-OQBBVTDG.js";
+import {
+  GATEWAY_PORT,
   isGatewayRunning,
+  isRulemetricGatewayListening,
   spawnGateway
-} from "../../chunk-DAJNO4OI.js";
+} from "../../chunk-4LYCDS2N.js";
+import "../../chunk-7LVVKQMZ.js";
+import {
+  MITMPROXY_COMMAND_PATTERN,
+  isPidLiveAndMatching
+} from "../../chunk-5EDMGK3W.js";
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
-import "../../chunk-SLL3OBKN.js";
+import "../../chunk-GQNJO2P2.js";
+import "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
-import "../../chunk-ZRLYHBPN.js";
+import "../../chunk-ZUJBM6HE.js";
 import "../../chunk-W2YERO7E.js";
 import "../../chunk-NSBPE2FW.js";
 
 // src/commands/gateway/ensure.ts
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var CONFIG_DIR = join(homedir(), ".config", "rulemetric");
+var ADDON_VERSION_FILE = join(CONFIG_DIR, "proxy-addon.version");
+var PROXY_PID_FILE = join(CONFIG_DIR, "proxy.pid");
+var DRIFT_RESTART_MARKER = join(CONFIG_DIR, "proxy-drift-restart.at");
+var DRIFT_RESTART_COOLDOWN_MS = 10 * 6e4;
 var GatewayEnsure = class _GatewayEnsure extends BaseCommand {
   static description = "Ensure the gateway proxy is running (called by hooks, not for direct use)";
   static hidden = true;
   async run() {
     await this.parse(_GatewayEnsure);
-    if (isGatewayRunning()) {
+    this.maybeRestartStaleProxy();
+    const identity = await isRulemetricGatewayListening(GATEWAY_PORT);
+    if (identity.status === "ours-live") {
+      const repinned = repinEditorProxies((editor) => {
+        if (editor === "vscode") writeVSCodeUserProxyConfig(GATEWAY_PORT);
+        else writeCursorUserProxyConfig(GATEWAY_PORT);
+      });
+      if (repinned.length > 0) {
+        console.error(`[RuleMetric] Gateway healthy again \u2014 restored ${repinned.join(", ")} proxy settings.`);
+      }
+      return;
+    }
+    if (identity.status === "foreign") {
+      if (isGatewayRunning()) return;
+      const unpinned = unpinEditorProxies(GATEWAY_PORT);
+      console.error(
+        `[RuleMetric] A non-RuleMetric process holds :${GATEWAY_PORT} \u2014 cannot start gateway. ` + (unpinned.length > 0 ? `Unpinned ${unpinned.join(", ")} proxy settings so editors are not routed through it. ` : "") + "Run `rulemetric diagnostics` if Claude Code HTTPS requests fail."
+      );
       return;
     }
     try {
@@ -27,6 +70,33 @@ var GatewayEnsure = class _GatewayEnsure extends BaseCommand {
       console.error(`[RuleMetric] Could not start gateway: ${err.message}`);
     }
   }
+  maybeRestartStaleProxy() {
+    try {
+      if (!existsSync(ADDON_VERSION_FILE)) return;
+      const runningVersion = readFileSync(ADDON_VERSION_FILE, "utf-8").trim();
+      if (!runningVersion || runningVersion === this.config.version) return;
+      const pidRaw = readFileSync(PROXY_PID_FILE, "utf-8").trim();
+      const pid = Number(pidRaw);
+      if (!Number.isFinite(pid) || !isPidLiveAndMatching(pid, MITMPROXY_COMMAND_PATTERN)) {
+        return;
+      }
+      try {
+        const age = Date.now() - statSync(DRIFT_RESTART_MARKER).mtimeMs;
+        if (age < DRIFT_RESTART_COOLDOWN_MS) return;
+      } catch {
+      }
+      writeFileSync(DRIFT_RESTART_MARKER, (/* @__PURE__ */ new Date()).toISOString());
+      const child = spawn(process.execPath, [process.argv[1], "proxy", "restart"], {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.unref();
+      console.error(
+        `[RuleMetric] Capture proxy is running CLI ${runningVersion} but ${this.config.version} is installed \u2014 restarting it in the background.`
+      );
+    } catch {
+    }
+  }
 };
 export {
   GatewayEnsure as default

package/dist/commands/gateway/ensure.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/gateway/ensure.ts"],
-  "sourcesContent": ["import { BaseCommand } from '../../base-command.js';\nimport { isGatewayRunning, spawnGateway } from '../../lib/gateway-lifecycle.js';\n\nexport default class GatewayEnsure extends BaseCommand {\n  static override description = 'Ensure the gateway proxy is running (called by hooks, not for direct use)';\n  static override hidden = true;\n\n  async run(): Promise<void> {\n    await this.parse(GatewayEnsure);\n\n    if (isGatewayRunning()) {\n      return; // Already running, silent success\n    }\n\n    try {\n      spawnGateway(this.config.version);\n    } catch (err) {\n      // Don't crash the hook \u2014 just warn\n      console.error(`[RuleMetric] Could not start gateway: ${(err as Error).message}`);\n    }\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;AAGA,IAAqB,gBAArB,MAAqB,uBAAsB,YAAY;AAAA,EACrD,OAAgB,cAAc;AAAA,EAC9B,OAAgB,SAAS;AAAA,EAEzB,MAAM,MAAqB;AACzB,UAAM,KAAK,MAAM,cAAa;AAE9B,QAAI,iBAAiB,GAAG;AACtB;AAAA,IACF;AAEA,QAAI;AACF,mBAAa,KAAK,OAAO,OAAO;AAAA,IAClC,SAAS,KAAK;AAEZ,cAAQ,MAAM,yCAA0C,IAAc,OAAO,EAAE;AAAA,IACjF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { spawn } from 'node:child_process';\nimport { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport {\n  isGatewayRunning,\n  isRulemetricGatewayListening,\n  spawnGateway,\n  GATEWAY_PORT,\n} from '../../lib/gateway-lifecycle.js';\nimport { isPidLiveAndMatching, MITMPROXY_COMMAND_PATTERN } from '../../lib/pid-identity.js';\nimport { unpinEditorProxies, repinEditorProxies } from '../../lib/editor-proxy-pins.js';\nimport { writeVSCodeUserProxyConfig, writeCursorUserProxyConfig } from '../../lib/hooks-config.js';\n\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst ADDON_VERSION_FILE = join(CONFIG_DIR, 'proxy-addon.version');\nconst PROXY_PID_FILE = join(CONFIG_DIR, 'proxy.pid');\nconst DRIFT_RESTART_MARKER = join(CONFIG_DIR, 'proxy-drift-restart.at');\nconst DRIFT_RESTART_COOLDOWN_MS = 10 * 60_000;\n\nexport default class GatewayEnsure extends BaseCommand {\n  static override description = 'Ensure the gateway proxy is running (called by hooks, not for direct use)';\n  static override hidden = true;\n\n  async run(): Promise<void> {\n    await this.parse(GatewayEnsure);\n\n    // Addon staleness: the gateway\u2194addon version-drift restart is CIRCULAR \u2014\n    // both sides compare versions frozen at their own spawn, so after\n    // `npm i -g` upgrades the CLI, a healthy old proxy keeps running old addon\n    // code forever (published capture fixes never reach the machine). THIS\n    // process is exec'd fresh by every session-start hook, so its\n    // config.version is always the on-disk truth \u2014 making it the one component\n    // that can detect the drift. Debounced, detached, never blocks the hook.\n    this.maybeRestartStaleProxy();\n\n    // Port truth first: the identity handshake distinguishes our live gateway\n    // from a foreign process squatting on :8787. Spawning against a held port\n    // just produces an EADDRINUSE child; spawning is only useful on 'dead'.\n    const identity = await isRulemetricGatewayListening(GATEWAY_PORT);\n\n    if (identity.status === 'ours-live') {\n      // Restore any editor pins a prior dead/foreign window removed \u2014 the\n      // gateway is verifiably ours again. The writers refuse to overwrite a\n      // user-owned proxy, so this can never clobber a corporate setting.\n      const repinned = repinEditorProxies((editor) => {\n        if (editor === 'vscode') writeVSCodeUserProxyConfig(GATEWAY_PORT);\n        else writeCursorUserProxyConfig(GATEWAY_PORT);\n      });\n      if (repinned.length > 0) {\n        console.error(`[RuleMetric] Gateway healthy again \u2014 restored ${repinned.join(', ')} proxy settings.`);\n      }\n      return; // Already running, silent success\n    }\n\n    if (identity.status === 'foreign') {\n      // A gateway from an older CLI build answers TCP but not the handshake;\n      // the PID-identity check on the pidfile confirms it's ours \u2014 leave it be.\n      if (isGatewayRunning()) return;\n      // Genuinely foreign: warn (don't crash the hook) \u2014 HTTPS_PROXY may be\n      // pinned at a port we don't own, which breaks Claude Code's HTTPS. The\n      // editor user-level pins are worse still (http.proxy + strictSSL=false\n      // routing at a port someone else owns), and nothing else can heal them\n      // \u2014 unpin now; the marker restores them once the port is ours again.\n      const unpinned = unpinEditorProxies(GATEWAY_PORT);\n      console.error(\n        `[RuleMetric] A non-RuleMetric process holds :${GATEWAY_PORT} \u2014 cannot start gateway. ` +\n          (unpinned.length > 0\n            ? `Unpinned ${unpinned.join(', ')} proxy settings so editors are not routed through it. `\n            : '') +\n          'Run `rulemetric diagnostics` if Claude Code HTTPS requests fail.',\n      );\n      return;\n    }\n\n    try {\n      spawnGateway(this.config.version);\n    } catch (err) {\n      // Don't crash the hook \u2014 just warn\n      console.error(`[RuleMetric] Could not start gateway: ${(err as Error).message}`);\n    }\n  }\n\n  private maybeRestartStaleProxy(): void {\n    try {\n      if (!existsSync(ADDON_VERSION_FILE)) return;\n      const runningVersion = readFileSync(ADDON_VERSION_FILE, 'utf-8').trim();\n      if (!runningVersion || runningVersion === this.config.version) return;\n\n      // Only restart a proxy that is actually OURS and alive \u2014 a stale version\n      // file next to a dead (or docker-marked) proxy is proxy start's problem.\n      const pidRaw = readFileSync(PROXY_PID_FILE, 'utf-8').trim();\n      const pid = Number(pidRaw);\n      if (!Number.isFinite(pid) || !isPidLiveAndMatching(pid, MITMPROXY_COMMAND_PATTERN)) {\n        return;\n      }\n\n      // Cooldown: session starts can cluster, and `proxy restart` needs time to\n      // rewrite the version file before the drift signal clears.\n      try {\n        const age = Date.now() - statSync(DRIFT_RESTART_MARKER).mtimeMs;\n        if (age < DRIFT_RESTART_COOLDOWN_MS) return;\n      } catch {\n        /* no marker yet \u2014 proceed */\n      }\n      writeFileSync(DRIFT_RESTART_MARKER, new Date().toISOString());\n\n      // process.argv[1] is this CLI's entry script (bin/run.js \u2014 dev or global\n      // install alike), so the restarted proxy runs the NEW on-disk code and\n      // re-stamps the version file, converging the drift.\n      const child = spawn(process.execPath, [process.argv[1], 'proxy', 'restart'], {\n        detached: true,\n        stdio: 'ignore',\n      });\n      child.unref();\n      console.error(\n        `[RuleMetric] Capture proxy is running CLI ${runningVersion} but ${this.config.version} is installed \u2014 restarting it in the background.`,\n      );\n    } catch {\n      /* never break the session-start hook */\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,YAAY,cAAc,UAAU,qBAAqB;AAClE,SAAS,eAAe;AACxB,SAAS,YAAY;AAYrB,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,qBAAqB,KAAK,YAAY,qBAAqB;AACjE,IAAM,iBAAiB,KAAK,YAAY,WAAW;AACnD,IAAM,uBAAuB,KAAK,YAAY,wBAAwB;AACtE,IAAM,4BAA4B,KAAK;AAEvC,IAAqB,gBAArB,MAAqB,uBAAsB,YAAY;AAAA,EACrD,OAAgB,cAAc;AAAA,EAC9B,OAAgB,SAAS;AAAA,EAEzB,MAAM,MAAqB;AACzB,UAAM,KAAK,MAAM,cAAa;AAS9B,SAAK,uBAAuB;AAK5B,UAAM,WAAW,MAAM,6BAA6B,YAAY;AAEhE,QAAI,SAAS,WAAW,aAAa;AAInC,YAAM,WAAW,mBAAmB,CAAC,WAAW;AAC9C,YAAI,WAAW,SAAU,4BAA2B,YAAY;AAAA,YAC3D,4BAA2B,YAAY;AAAA,MAC9C,CAAC;AACD,UAAI,SAAS,SAAS,GAAG;AACvB,gBAAQ,MAAM,sDAAiD,SAAS,KAAK,IAAI,CAAC,kBAAkB;AAAA,MACtG;AACA;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,WAAW;AAGjC,UAAI,iBAAiB,EAAG;AAMxB,YAAM,WAAW,mBAAmB,YAAY;AAChD,cAAQ;AAAA,QACN,gDAAgD,YAAY,oCACzD,SAAS,SAAS,IACf,YAAY,SAAS,KAAK,IAAI,CAAC,2DAC/B,MACJ;AAAA,MACJ;AACA;AAAA,IACF;AAEA,QAAI;AACF,mBAAa,KAAK,OAAO,OAAO;AAAA,IAClC,SAAS,KAAK;AAEZ,cAAQ,MAAM,yCAA0C,IAAc,OAAO,EAAE;AAAA,IACjF;AAAA,EACF;AAAA,EAEQ,yBAA+B;AACrC,QAAI;AACF,UAAI,CAAC,WAAW,kBAAkB,EAAG;AACrC,YAAM,iBAAiB,aAAa,oBAAoB,OAAO,EAAE,KAAK;AACtE,UAAI,CAAC,kBAAkB,mBAAmB,KAAK,OAAO,QAAS;AAI/D,YAAM,SAAS,aAAa,gBAAgB,OAAO,EAAE,KAAK;AAC1D,YAAM,MAAM,OAAO,MAAM;AACzB,UAAI,CAAC,OAAO,SAAS,GAAG,KAAK,CAAC,qBAAqB,KAAK,yBAAyB,GAAG;AAClF;AAAA,MACF;AAIA,UAAI;AACF,cAAM,MAAM,KAAK,IAAI,IAAI,SAAS,oBAAoB,EAAE;AACxD,YAAI,MAAM,0BAA2B;AAAA,MACvC,QAAQ;AAAA,MAER;AACA,oBAAc,uBAAsB,oBAAI,KAAK,GAAE,YAAY,CAAC;AAK5D,YAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,QAAQ,KAAK,CAAC,GAAG,SAAS,SAAS,GAAG;AAAA,QAC3E,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AACD,YAAM,MAAM;AACZ,cAAQ;AAAA,QACN,6CAA6C,cAAc,QAAQ,KAAK,OAAO,OAAO;AAAA,MACxF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/commands/hooks/install.js

@@ -5,14 +5,11 @@ import {
   findBinary
 } from "../../chunk-42GFSAJP.js";
 import {
-  STATUSLINE_SETTINGS_VALUE,
-  isStatuslineShimInstalled,
-  readCurrentStatusLine,
-  writeStatuslineShim
-} from "../../chunk-N2X35ITW.js";
-import {
+  RULEMETRIC_NO_PROXY,
+  claudeSettingsInstallPath,
   installMacOSProxyEnv,
   mergeClaudeCodeHooks,
+  migrateSharedClaudeSettings,
   readClaudeSettings,
   removeClaudeCodeHooks,
   writeAntigravityHooks,
@@ -25,27 +22,45 @@ import {
   writeCursorUserProxyConfig,
   writeVSCodeProxyConfig,
   writeVSCodeUserProxyConfig
-} from "../../chunk-XN23W5HL.js";
+} from "../../chunk-LXKPNATC.js";
+import {
+  STATUSLINE_SETTINGS_VALUE,
+  STATUSLINE_SHIM_PATH,
+  isStatuslineShimInstalled,
+  readCurrentStatusLine,
+  writeStatuslineShim
+} from "../../chunk-OQBBVTDG.js";
+import "../../chunk-KRBQLMOP.js";
 import {
   GATEWAY_PORT,
   isGatewayRunning,
+  isRulemetricGatewayListening,
   spawnGateway,
-  waitForGatewayListening
-} from "../../chunk-DAJNO4OI.js";
-import "../../chunk-KRBQLMOP.js";
+  stopGateway,
+  waitForRulemetricGateway
+} from "../../chunk-4LYCDS2N.js";
 import {
-  emitSetupEvent
-} from "../../chunk-TX2HKJLA.js";
+  describePortOwner
+} from "../../chunk-7LVVKQMZ.js";
+import "../../chunk-5EDMGK3W.js";
+import {
+  ensureDeviceApiKey
+} from "../../chunk-EJ3YAFDP.js";
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
+import {
+  emitSetupEvent
+} from "../../chunk-GQNJO2P2.js";
 import {
   bootstrapActiveOrg
-} from "../../chunk-SLL3OBKN.js";
+} from "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
-import "../../chunk-ZRLYHBPN.js";
-import "../../chunk-W2YERO7E.js";
+import "../../chunk-ZUJBM6HE.js";
+import {
+  loadEnvFileAuth
+} from "../../chunk-W2YERO7E.js";
 import "../../chunk-NSBPE2FW.js";
 
 // src/commands/hooks/install.ts
@@ -105,7 +120,8 @@ var HooksInstall = class _HooksInstall extends BaseCommand {
     const isGlobal = flags.global;
     const projectPath = isGlobal ? homedir() : flags["project-dir"] ?? process.cwd();
     const configDir = join(projectPath, ".claude");
-    const configPath = join(configDir, "settings.json");
+    const configPath = claudeSettingsInstallPath(configDir, isGlobal);
+    const settingsFileName = isGlobal ? "settings.json" : "settings.local.json";
     const noProxy = flags["no-proxy"];
     let proxyActive = false;
     let proxyReason = noProxy ? "no_proxy_flag" : void 0;
@@ -118,11 +134,27 @@ var HooksInstall = class _HooksInstall extends BaseCommand {
     if (recoveredBackup) {
       this.log(`[!!] ${configPath} was not valid JSON \u2014 backed it up to ${recoveredBackup} and continued with a fresh file.`);
     }
+    if (!isGlobal) {
+      const migration = migrateSharedClaudeSettings(join(configDir, "settings.json"), GATEWAY_PORT);
+      if (migration.migrated) {
+        this.log("[OK] Moved RuleMetric machine-local state out of the shared .claude/settings.json (it now lives in .claude/settings.local.json)");
+        if (migration.backupPath) {
+          this.log(`     Previous shared settings backed up \u2192 ${migration.backupPath}`);
+        }
+        if (migration.removedStatusline && existsSync(STATUSLINE_SHIM_PATH) && !isStatuslineShimInstalled(settings)) {
+          settings.statusLine = STATUSLINE_SETTINGS_VALUE;
+        }
+      }
+    }
+    const envAuth = loadEnvFileAuth();
+    if ((envAuth.accessToken || process.env.RULEMETRIC_ACCESS_TOKEN) && !envAuth.apiKey && !process.env.RULEMETRIC_API_KEY) {
+      await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this), this.config.version);
+    }
     const refreshedHooks = removeClaudeCodeHooks(settings);
     const hookBinDir = resolveHookBinDir();
     mergeClaudeCodeHooks(settings, hookBinDir);
     this.log(
-      refreshedHooks ? "[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/settings.json" : "[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/settings.json"
+      refreshedHooks ? `[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/${settingsFileName}` : `[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/${settingsFileName}`
     );
     if (!noProxy) {
       let mitmAvailable = Boolean(findBinary("mitmdump"));
@@ -172,10 +204,23 @@ var HooksInstall = class _HooksInstall extends BaseCommand {
         this.log("[OK] CA certificate already trusted");
         caTrusted = true;
       }
-      if (isGatewayLaunchdManaged()) {
+      const launchdManaged = isGatewayLaunchdManaged();
+      const portIdentity = await isRulemetricGatewayListening(GATEWAY_PORT);
+      if (launchdManaged) {
         this.log("[OK] Gateway managed by launchd (com.rulemetric.gateway)");
-      } else if (isGatewayRunning()) {
+      } else if (portIdentity.status === "ours-live") {
         this.log("[OK] Gateway already running");
+      } else if (portIdentity.status === "foreign" && isGatewayRunning()) {
+        this.log("[..] Restarting gateway (running build predates the identity handshake)...");
+        stopGateway();
+        await new Promise((resolve) => setTimeout(resolve, 500));
+        try {
+          const pid = spawnGateway(this.config.version);
+          this.log(`[OK] Gateway restarted (PID ${pid})`);
+        } catch (err) {
+          this.log(`[!!] Could not restart gateway: ${err.message}`);
+        }
+      } else if (portIdentity.status === "foreign") {
       } else {
         try {
           const pid = spawnGateway(this.config.version);
@@ -184,12 +229,20 @@ var HooksInstall = class _HooksInstall extends BaseCommand {
           this.log(`[!!] Could not start gateway: ${err.message}`);
         }
       }
-      const gatewayLive = await waitForGatewayListening(GATEWAY_PORT, { timeoutMs: 4e3 });
+      const gatewayIdentity = await waitForRulemetricGateway(GATEWAY_PORT, { timeoutMs: 4e3 });
       if (!caGenerated) {
         proxyReason = mitmAvailable ? "ca_not_generated" : pkgManagers.length === 0 ? "no_package_manager" : "mitmproxy_install_failed";
         this.log("[!!] No CA certificate \u2014 NOT setting HTTPS_PROXY (capture stays hooks-only).");
         this.log("     Install mitmproxy, then re-run: rulemetric hooks install");
-      } else if (!gatewayLive) {
+      } else if (gatewayIdentity.status === "foreign" && !launchdManaged) {
+        proxyReason = "gateway_port_foreign";
+        const owner = describePortOwner(GATEWAY_PORT);
+        this.log(`[!!] Port :${GATEWAY_PORT} is held by a process that is NOT the RuleMetric gateway \u2014 NOT setting HTTPS_PROXY.`);
+        this.log(
+          owner ? `     Holding the port: ${owner}` : `     Could not identify the holder (try: lsof -nP -iTCP:${GATEWAY_PORT} -sTCP:LISTEN)`
+        );
+        this.log("     Capture still works via hooks. Free the port, then re-run: rulemetric hooks install");
+      } else if (gatewayIdentity.status === "dead") {
         proxyReason = "gateway_not_live";
         this.log(`[!!] Gateway is not answering on :${GATEWAY_PORT} \u2014 NOT setting HTTPS_PROXY.`);
         this.log("     Capture still works via hooks. To enable deep (proxy) capture later:");
@@ -197,7 +250,7 @@ var HooksInstall = class _HooksInstall extends BaseCommand {
       } else {
         const env = settings.env ?? {};
         env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;
-        env.NO_PROXY = "localhost,127.0.0.1,*.supabase.co,*.supabase.in";
+        env.NO_PROXY = RULEMETRIC_NO_PROXY;
         if (existsSync(CERT_PATH)) {
           env.NODE_EXTRA_CA_CERTS = CERT_PATH;
         }

package/dist/commands/hooks/install.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/hooks/install.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execFileSync, spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, dirname } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { isGatewayRunning, waitForGatewayListening, spawnGateway, GATEWAY_PORT } from '../../lib/gateway-lifecycle.js';\nimport { findBinary } from '../../lib/which.js';\n\n// Resolve the directory holding the `rulemetric` executable, so hook commands\n// can prepend it to PATH. Claude Code runs hooks via `/bin/sh -c` with a\n// minimal PATH that omits nvm/pnpm global bin dirs \u2014 so a bare `rulemetric`\n// hits \"command not found\" and capture (plus the session-start gateway\n// auto-start) silently fails. We resolve it here, in the install process's\n// full PATH, and bake the dir into the hook command. Returns undefined on\n// failure \u2192 callers fall back to the bare `rulemetric` (dev/back-compat).\nfunction resolveHookBinDir(): string | undefined {\n  try {\n    const out = execFileSync('/bin/sh', ['-c', 'command -v rulemetric'], {\n      encoding: 'utf-8',\n    }).trim();\n    if (out && existsSync(out)) return dirname(out);\n  } catch {\n    /* not resolvable \u2014 fall back to bare `rulemetric` */\n  }\n  return undefined;\n}\n\n// True iff `rulemetric service install` has wired the gateway up as a launchd\n// agent. When this returns true, hooks install must NOT spawn its own\n// detached gateway \u2014 two processes fighting for :8787 means one crash-loops\n// and Claude Code's HTTPS_PROXY breaks.\nfunction isGatewayLaunchdManaged(): boolean {\n  try {\n    execFileSync('launchctl', ['list', 'com.rulemetric.gateway'], {\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    return true;\n  } catch {\n    // Non-zero exit = label not loaded\n    return false;\n  }\n}\nimport {\n  writeStatuslineShim,\n  readCurrentStatusLine,\n  isStatuslineShimInstalled,\n  STATUSLINE_SETTINGS_VALUE,\n} from '../../lib/statusline-shim.js';\nimport {\n  mergeClaudeCodeHooks,\n  removeClaudeCodeHooks,\n  readClaudeSettings,\n  writeClaudeSettingsWithBackup,\n  writeCursorProxyConfig,\n  writeCursorUserProxyConfig,\n  writeVSCodeProxyConfig,\n  installMacOSProxyEnv,\n  writeVSCodeUserProxyConfig,\n  writeCursorHooks,\n  writeCursorUserHooks,\n  writeCopilotHooks,\n  writeAntigravityHooks,\n  writeAntigravityUserHooks,\n} from '../../lib/hooks-config.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { emitSetupEvent } from '../../lib/telemetry.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\nexport default class HooksInstall extends BaseCommand {\n  static override description = 'Install session tracking hooks and context capture proxy for Claude Code';\n\n  static override examples = [\n    '<%= config.bin %> hooks install',\n    '<%= config.bin %> hooks install --global',\n    '<%= config.bin %> hooks install --no-proxy',\n  ];\n\n  static override flags = {\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip proxy/gateway configuration (hooks only)',\n    }),\n    'project-dir': Flags.string({\n      description: 'Project directory to install hooks in (defaults to cwd)',\n    }),\n    global: Flags.boolean({\n      char: 'g',\n      default: false,\n      description: 'Install hooks globally (~/.claude/settings.json) so all projects are tracked',\n    }),\n    'statusline-usage': Flags.boolean({\n      default: false,\n      description: 'Install the statusline shim so Claude Code pushes live rate_limits on every refresh (makes /usage rings update in real time without needing the proxy)',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(HooksInstall);\n    const isGlobal = flags.global;\n    const projectPath = isGlobal ? homedir() : (flags['project-dir'] ?? process.cwd());\n    const configDir = join(projectPath, '.claude');\n    const configPath = join(configDir, 'settings.json');\n    const noProxy = flags['no-proxy'];\n    // Whether the capture proxy actually went live this run (HTTPS_PROXY pinned\n    // against a verified-live gateway). Drives the \"next steps\" copy so we never\n    // tell the user to start a proxy that is already running.\n    let proxyActive = false;\n    // Why the proxy is NOT fully active (undefined = fully active + CA trusted).\n    // Reported via telemetry so a remote install's outcome is debuggable without\n    // a relayed log: 'no_proxy_flag' | 'mitmproxy_unavailable' | 'ca_not_generated'\n    // | 'gateway_not_live' | 'ca_untrusted' (proxy pinned, Claude-Code-only).\n    let proxyReason: string | undefined = noProxy ? 'no_proxy_flag' : undefined;\n    // Whether the mitmproxy CA is trusted in the system store (gates machine-wide\n    // capture). Hoisted from \u00A72 so telemetry can report the partial state.\n    let caTrusted = false;\n    // Package managers detected on this machine (brew/pipx/uv) \u2014 reported in\n    // telemetry so a remote `mitmproxy_unavailable` is DISAMBIGUATED: [] means\n    // \"no package manager, proxy genuinely can't install here\"; a non-empty list\n    // with reason:mitmproxy_install_failed means one was present but the install\n    // failed (a real bug to chase, not a bare machine).\n    let pkgManagers: string[] = [];\n\n    if (isGlobal) {\n      this.log(`Installing hooks globally \u2192 ${configPath}`);\n    }\n\n    // Read or create .claude/settings.json. Never crash on a malformed file \u2014\n    // a fresh user's hand-edited settings.json must not block capture install.\n    const { settings, recoveredBackup } = readClaudeSettings(configPath);\n    if (recoveredBackup) {\n      this.log(`[!!] ${configPath} was not valid JSON \u2014 backed it up to ${recoveredBackup} and continued with a fresh file.`);\n    }\n\n    // \u2500\u2500 1. Install Claude Code session-tracking hooks (hooks-first, zero-proxy\n    // capture). Strip any stale rulemetric entries first \u2014 handles old command\n    // formats, preserves the user's own hooks \u2014 then merge the current canonical\n    // set. Runs regardless of --no-proxy: this is the whole point of the hooks\n    // path, which captures full sessions (lifecycle + SessionEnd transcript\n    // reimport) without mitmproxy / CA trust / gateway. The proxy adds the\n    // rendered system prompt (instruction-linking) + cross-tool capture on top.\n    const refreshedHooks = removeClaudeCodeHooks(settings);\n    // Resolve once; every hook writer (Claude Code, Cursor, Copilot) needs the\n    // same PATH prefix so a GUI-launched tool with a minimal PATH can find the CLI.\n    const hookBinDir = resolveHookBinDir();\n    mergeClaudeCodeHooks(settings, hookBinDir);\n    this.log(\n      refreshedHooks\n        ? '[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/settings.json'\n        : '[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/settings.json',\n    );\n\n    // \u2500\u2500 2. Configure gateway + proxy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      // Ensure mitmproxy is available\n      let mitmAvailable = Boolean(findBinary('mitmdump'));\n      if (!mitmAvailable) {\n        this.log('');\n        this.log('[!!] mitmproxy not found \u2014 installing...');\n        // Record which package managers exist (telemetry disambiguation).\n        pkgManagers = ['brew', 'pipx', 'uv'].filter((m) => Boolean(findBinary(m)));\n        mitmAvailable = this.installMitmproxy();\n        if (!mitmAvailable) {\n          this.log('[!!] Could not install mitmproxy. Skipping proxy config.');\n          this.log('     Install manually: pipx install mitmproxy');\n          this.log('     Then re-run: rulemetric hooks install');\n        }\n      }\n\n      // Generate CA cert if missing\n      if (!existsSync(CERT_PATH)) {\n        this.log('[..] Generating CA certificate...');\n        const mitmdump = findBinary('mitmdump');\n        if (mitmdump) {\n          spawnSync(mitmdump, ['--set', 'listen_port=0', '-q'], {\n            timeout: 5000,\n            stdio: 'ignore',\n          });\n          if (existsSync(CERT_PATH)) {\n            this.log(`[OK] CA certificate generated at ${CERT_PATH}`);\n          } else {\n            this.log('[!!] Could not generate CA cert');\n          }\n        }\n      } else {\n        this.log('[OK] CA certificate found');\n      }\n\n      // Trust CA cert in system store (if not already trusted). Track the\n      // result: whether the CA is trusted decides if we may route MACHINE-WIDE /\n      // native-app traffic through the MITM proxy (native apps validate against\n      // the system keychain, so an untrusted CA breaks their TLS).\n      const caGenerated = existsSync(CERT_PATH);\n      if (caGenerated && !this.isCACertTrusted()) {\n        this.log('[..] Installing CA certificate into system trust store (requires admin)...');\n        caTrusted = this.trustCACert();\n        if (caTrusted) {\n          this.log('[OK] CA certificate trusted by system');\n        } else {\n          this.log('[!!] Could not install CA cert automatically.');\n          if (process.platform === 'darwin') {\n            this.log(`     Run manually: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERT_PATH}`);\n          } else if (process.platform === 'linux') {\n            this.log(`     Run manually: sudo cp ${CERT_PATH} /usr/local/share/ca-certificates/mitmproxy-ca.crt && sudo update-ca-certificates`);\n          }\n        }\n      } else if (caGenerated) {\n        this.log('[OK] CA certificate already trusted');\n        caTrusted = true;\n      }\n\n      // Start the gateway BEFORE pinning HTTPS_PROXY. Three possible owners (in\n      // order of precedence):\n      //   1. launchd (`rulemetric service install` plist) \u2014 authoritative;\n      //      hooks must NOT spawn a competing copy that would fight for :8787\n      //   2. legacy PID-file (this same code path from a previous run)\n      //   3. nothing \u2014 spawn a fresh detached process\n      if (isGatewayLaunchdManaged()) {\n        this.log('[OK] Gateway managed by launchd (com.rulemetric.gateway)');\n      } else if (isGatewayRunning()) {\n        this.log('[OK] Gateway already running');\n      } else {\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway started (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not start gateway: ${(err as Error).message}`);\n        }\n      }\n\n      // Liveness guard: ONLY pin HTTPS_PROXY once :8787 actually accepts\n      // connections. Writing it against a dead port is the fresh-laptop\n      // ConnectionRefused footgun \u2014 it breaks all of Claude Code's HTTPS. If the\n      // gateway isn't answering, we leave Claude Code talking to Anthropic\n      // directly; capture still works via the hooks installed in \u00A71.\n      // Poll (not a one-shot probe): a just-spawned gateway needs a moment to\n      // bind :8787, and a single immediate probe would fail-close every fresh\n      // install and silently disable deep capture.\n      const gatewayLive = await waitForGatewayListening(GATEWAY_PORT, { timeoutMs: 4000 });\n      if (!caGenerated) {\n        // No CA \u2192 mitmproxy will regenerate one and intercept, but nothing\n        // trusts it, so pinning HTTPS_PROXY would break even Claude Code's TLS.\n        // Stay hooks-only rather than pin a proxy nothing can validate. Name the\n        // precise cause: no mitmproxy AND no package manager to install it (a\n        // genuine bare-machine gap) vs. a manager was present but the install\n        // failed (a bug to chase, not a missing prereq).\n        proxyReason = mitmAvailable\n          ? 'ca_not_generated'\n          : pkgManagers.length === 0\n            ? 'no_package_manager'\n            : 'mitmproxy_install_failed';\n        this.log('[!!] No CA certificate \u2014 NOT setting HTTPS_PROXY (capture stays hooks-only).');\n        this.log('     Install mitmproxy, then re-run: rulemetric hooks install');\n      } else if (!gatewayLive) {\n        proxyReason = 'gateway_not_live';\n        this.log(`[!!] Gateway is not answering on :${GATEWAY_PORT} \u2014 NOT setting HTTPS_PROXY.`);\n        this.log('     Capture still works via hooks. To enable deep (proxy) capture later:');\n        this.log('     rulemetric proxy start  &&  rulemetric hooks install');\n      } else {\n        // Set permanent HTTPS_PROXY and NODE_EXTRA_CA_CERTS in settings.json.\n        // These point to the gateway (verified live above), not mitmproxy directly.\n        const env = (settings.env ?? {}) as Record<string, string>;\n        env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n        // Bypass proxy for non-Anthropic traffic (Supabase auth, npm, etc.)\n        env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n        if (existsSync(CERT_PATH)) {\n          env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n        }\n        settings.env = env;\n        proxyActive = true;\n        this.log(`[OK] HTTPS_PROXY set to gateway on :${GATEWAY_PORT} (verified live)`);\n\n        // Configure Cursor proxy (if .cursor/ exists)\n        const cursorProxy = writeCursorProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (cursorProxy) {\n          this.log('[OK] Cursor proxy configured \u2192 .cursor/settings.json');\n        }\n\n        // Configure VS Code proxy for Copilot capture (workspace settings)\n        const vscodeProxy = writeVSCodeProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (vscodeProxy) {\n          this.log('[OK] VS Code workspace proxy configured \u2192 .vscode/settings.json');\n        }\n\n        // Set http.proxy in VS Code user settings (workspace-level is silently ignored\n        // for http.proxy due to APPLICATION scope \u2014 microsoft/vscode#236932)\n        const vscodeUserProxy = writeVSCodeUserProxyConfig(GATEWAY_PORT);\n        if (vscodeUserProxy) {\n          this.log('[OK] VS Code user proxy configured \u2192 ~/Library/Application Support/Code/User/settings.json');\n        }\n\n        // Same for Cursor (VS Code fork inherits the APPLICATION-scope restriction).\n        const cursorUserProxy = writeCursorUserProxyConfig(GATEWAY_PORT);\n        if (cursorUserProxy) {\n          this.log('[OK] Cursor user proxy configured \u2192 ~/Library/Application Support/Cursor/User/settings.json');\n        }\n\n        // Set HTTPS_PROXY for all GUI apps via launchctl + LaunchAgent (macOS)\n        // Copilot reads process.env.HTTPS_PROXY directly \u2014 VS Code settings alone\n        // are insufficient because workspace http.proxy is ignored and extensions\n        // may bypass vscode-proxy-agent (microsoft/vscode#12588).\n        //\n        // GATED ON CA TRUST: this routes EVERY GUI/native app's HTTPS through the\n        // MITM proxy machine-wide. Native apps validate against the system\n        // keychain, so if the CA isn't trusted (sudo declined / non-admin) this\n        // would break their TLS with an unknown-CA error attributed to nothing\n        // obvious. Claude Code + Node apps are unaffected either way (they trust\n        // NODE_EXTRA_CA_CERTS), so we keep that path and only skip the\n        // machine-wide native layer.\n        if (caTrusted) {\n          const macProxy = installMacOSProxyEnv(GATEWAY_PORT, CERT_PATH);\n          if (macProxy) {\n            this.log('[OK] HTTPS_PROXY set for GUI apps (launchctl + LaunchAgent)');\n          }\n        } else {\n          // Partial success: HTTPS_PROXY IS pinned (proxyActive) and Claude Code\n          // capture works via NODE_EXTRA_CA_CERTS, but the CA isn't system-trusted\n          // so cross-tool/machine-wide capture is skipped. Report it so a remote\n          // install shows \"proxy live but Claude-Code-only\" rather than looking\n          // fully green.\n          proxyReason = 'ca_untrusted';\n          this.log('[!!] CA not trusted \u2014 skipping machine-wide GUI proxy (would break native-app TLS).');\n          this.log('     Claude Code capture is unaffected. Trust the CA + re-run to enable cross-app capture.');\n        }\n      }\n    }\n\n    // \u2500\u2500 3. Write Cursor + Copilot hook configs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // These are independent of the proxy (they capture editor lifecycle\n    // events, not LLM traffic), so they run regardless of --no-proxy. Both\n    // helpers no-op when the target directory (.cursor/ or .github/)\n    // doesn't exist.\n    if (!isGlobal) {\n      const cursorHooks = writeCursorHooks(projectPath, hookBinDir);\n      if (cursorHooks) {\n        this.log(`[OK] Cursor hooks configured \u2192 ${cursorHooks}`);\n      }\n\n      const copilotHooks = writeCopilotHooks(projectPath, hookBinDir);\n      if (copilotHooks) {\n        this.log(`[OK] Copilot Agent hooks configured \u2192 ${copilotHooks}`);\n      }\n\n      const antigravityHooks = writeAntigravityHooks(projectPath);\n      if (antigravityHooks) {\n        this.log(`[OK] Antigravity workspace hooks configured \u2192 ${antigravityHooks}`);\n      }\n    }\n\n    // User-level Antigravity hooks at ~/.gemini/config/hooks.json \u2014 covers any\n    // workspace the user opens, not just the install-time cwd. Written ONLY when\n    // ~/.gemini already exists (the tool is present); returns null otherwise so\n    // we never manufacture config for a tool the user doesn't have (F2).\n    const antigravityUserHooks = writeAntigravityUserHooks();\n    if (antigravityUserHooks) {\n      this.log(`[OK] Antigravity user hooks configured \u2192 ${antigravityUserHooks}`);\n    }\n\n    // User-level Cursor hooks (~/.cursor/hooks.json) are required for global\n    // capture because Cursor's chat traffic bypasses HTTP proxies (HTTP/2\n    // multiplexed persistent connection \u2014 see cursor.com/docs/hooks). Without\n    // hooks, we get zero Cursor visibility for sessions outside this project.\n    // Runs in both --global and per-project modes since the user file is\n    // machine-wide either way.\n    const cursorUserHooks = writeCursorUserHooks(hookBinDir);\n    if (cursorUserHooks) {\n      this.log(`[OK] Cursor user hooks configured \u2192 ${cursorUserHooks}`);\n    }\n\n    // \u2500\u2500 4. Statusline shim (rate_limits freshness) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // When --statusline-usage is set, write ~/.claude/statusline-rulemetric.sh\n    // and point settings.statusLine at it. If the user already has a statusLine\n    // command configured, chain it so their prompt text is preserved.\n    if (flags['statusline-usage']) {\n      if (isStatuslineShimInstalled(settings)) {\n        this.log('[OK] Statusline shim already installed');\n      } else {\n        const prevCmd = readCurrentStatusLine(settings);\n        writeStatuslineShim(prevCmd);\n        settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        if (prevCmd) {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command} (chains to: ${prevCmd})`);\n        } else {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command}`);\n        }\n        this.log('     Rate-limit rings will now update on Claude Code\\'s statusline refresh cadence');\n      }\n    }\n\n    // \u2500\u2500 5. Write Claude Code settings (backup prior file \u2192 reversible) \u2500\u2500\u2500\u2500\u2500\n    const { backupPath } = writeClaudeSettingsWithBackup(configPath, settings);\n    if (backupPath) {\n      this.log(`[OK] Backed up previous settings \u2192 ${backupPath}`);\n    }\n\n    this.log('');\n    this.log('Setup complete! Next steps:');\n    if (isGlobal) {\n      this.log('  1. Install always-on API:    rulemetric service install');\n      this.log('  2. Start Claude Code in any project \u2014 all sessions tracked automatically');\n      this.log('');\n      this.log('The API service starts on login and restarts on crash.');\n    } else if (!noProxy) {\n      this.log('  1. Start Claude Code \u2014 sessions are captured by hooks immediately');\n      if (proxyActive) {\n        // The proxy IS live (pinned against a verified gateway above) \u2014 don't\n        // tell the user to start something that's already running.\n        this.log('  2. Full-depth capture is ON \u2014 the proxy is live on :' + GATEWAY_PORT + '.');\n      } else {\n        this.log('  2. Enable full depth (proxy not yet live):  rulemetric proxy start');\n      }\n      this.log('');\n      this.log('Hooks capture every session (lifecycle + transcript). The proxy adds the');\n      this.log('rendered system prompt (instruction-effectiveness linking) + cross-tool capture.');\n      this.log('');\n      this.log('To capture traffic from other clients (Python, curl, etc.):');\n      this.log('  eval \"$(rulemetric proxy env --all)\"');\n    } else {\n      // --no-proxy still installs the Claude Code session hooks above, so full\n      // sessions ARE captured (lifecycle + SessionEnd transcript reimport) with\n      // no mitmproxy / CA trust / gateway. Only the proxy-exclusive layer\n      // (rendered system prompt \u2192 instruction-linking, cross-tool) is skipped.\n      this.log('  1. Start Claude Code \u2014 sessions are captured by the hooks just installed');\n      this.log('');\n      this.log('No proxy means no mitmproxy / CA cert needed. The hooks capture full');\n      this.log('sessions on their own; re-run without --no-proxy to also capture system');\n      this.log('prompts for instruction-effectiveness linking.');\n    }\n\n    // Ensure the active-org cache is populated before the user starts a\n    // Claude Code session. BaseCommand fired the guarded refresh earlier\n    // but may have raced with auth init or hit a transient error; this\n    // explicit retry guarantees the cache reflects the user's current\n    // active_org_id at the end of `hooks install`.\n    await bootstrapActiveOrg();\n\n    // Onboarding telemetry (disclosed + opt-outable) \u2014 records that hooks\n    // landed, whether the proxy went live, whether the CA is system-trusted, and\n    // (when not fully green) WHY \u2014 so a remote install's outcome is debuggable\n    // without a relayed log: e.g. proxy:false reason:mitmproxy_unavailable, or\n    // proxy:true reason:ca_untrusted (live but Claude-Code-only).\n    void emitSetupEvent(\n      'hooks_installed',\n      { proxy: proxyActive, caTrusted, reason: proxyReason, installers: pkgManagers, global: isGlobal },\n      this.config.version,\n    );\n\n    // Soft tmux capability check \u2014 live message send needs tmux on the\n    // user's machine. We do not auto-install; just surface one line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  private installMitmproxy(): boolean {\n    for (const [cmd, args] of [\n      ['pipx', ['install', 'mitmproxy']],\n      ['uv', ['tool', 'install', 'mitmproxy']],\n      ['brew', ['install', 'mitmproxy']],\n    ] as const) {\n      // Resolve the FULL path via the shared findBinary (which probes the\n      // well-known install dirs, not just $PATH) and spawn THAT \u2014 a bare\n      // spawnSync('brew', \u2026) would fail under the minimal PATH that a\n      // GUI/agent-launched install has, even after we found brew off-PATH.\n      const bin = findBinary(cmd);\n      if (bin) {\n        this.log(`     Installing via ${cmd}...`);\n        const result = spawnSync(bin, [...args], { stdio: 'inherit' });\n        if (result.status === 0) return true;\n      }\n    }\n    return false;\n  }\n\n  private isCACertTrusted(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('security', ['verify-cert', '-c', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      return existsSync('/usr/local/share/ca-certificates/mitmproxy-ca.crt');\n    }\n\n    if (process.platform === 'win32') {\n      // On Windows, check if cert is in the Root store\n      const result = spawnSync('certutil', ['-verify', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n\n  private trustCACert(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('sudo', [\n        'security', 'add-trusted-cert', '-d', '-r', 'trustRoot',\n        '-k', '/Library/Keychains/System.keychain', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      const cp = spawnSync('sudo', [\n        'cp', CERT_PATH, '/usr/local/share/ca-certificates/mitmproxy-ca.crt',\n      ], { stdio: 'inherit' });\n      if (cp.status !== 0) return false;\n      const update = spawnSync('sudo', ['update-ca-certificates'], { stdio: 'inherit' });\n      return update.status === 0;\n    }\n\n    if (process.platform === 'win32') {\n      const result = spawnSync('certutil', [\n        '-addstore', '-f', 'Root', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,cAAc,iBAAiB;AACxC,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAY9B,SAAS,oBAAwC;AAC/C,MAAI;AACF,UAAM,MAAM,aAAa,WAAW,CAAC,MAAM,uBAAuB,GAAG;AAAA,MACnE,UAAU;AAAA,IACZ,CAAC,EAAE,KAAK;AACR,QAAI,OAAO,WAAW,GAAG,EAAG,QAAO,QAAQ,GAAG;AAAA,EAChD,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAMA,SAAS,0BAAmC;AAC1C,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,wBAAwB,GAAG;AAAA,MAC5D,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AA2BA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAEvE,IAAqB,eAArB,MAAqB,sBAAqB,YAAY;AAAA,EACpD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,OAAO;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,IACD,QAAQ,MAAM,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,oBAAoB,MAAM,QAAQ;AAAA,MAChC,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,aAAY;AAC/C,UAAM,WAAW,MAAM;AACvB,UAAM,cAAc,WAAW,QAAQ,IAAK,MAAM,aAAa,KAAK,QAAQ,IAAI;AAChF,UAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,UAAM,aAAa,KAAK,WAAW,eAAe;AAClD,UAAM,UAAU,MAAM,UAAU;AAIhC,QAAI,cAAc;AAKlB,QAAI,cAAkC,UAAU,kBAAkB;AAGlE,QAAI,YAAY;AAMhB,QAAI,cAAwB,CAAC;AAE7B,QAAI,UAAU;AACZ,WAAK,IAAI,oCAA+B,UAAU,EAAE;AAAA,IACtD;AAIA,UAAM,EAAE,UAAU,gBAAgB,IAAI,mBAAmB,UAAU;AACnE,QAAI,iBAAiB;AACnB,WAAK,IAAI,QAAQ,UAAU,8CAAyC,eAAe,mCAAmC;AAAA,IACxH;AASA,UAAM,iBAAiB,sBAAsB,QAAQ;AAGrD,UAAM,aAAa,kBAAkB;AACrC,yBAAqB,UAAU,UAAU;AACzC,SAAK;AAAA,MACH,iBACI,qFACA;AAAA,IACN;AAGA,QAAI,CAAC,SAAS;AAEZ,UAAI,gBAAgB,QAAQ,WAAW,UAAU,CAAC;AAClD,UAAI,CAAC,eAAe;AAClB,aAAK,IAAI,EAAE;AACX,aAAK,IAAI,+CAA0C;AAEnD,sBAAc,CAAC,QAAQ,QAAQ,IAAI,EAAE,OAAO,CAAC,MAAM,QAAQ,WAAW,CAAC,CAAC,CAAC;AACzE,wBAAgB,KAAK,iBAAiB;AACtC,YAAI,CAAC,eAAe;AAClB,eAAK,IAAI,0DAA0D;AACnE,eAAK,IAAI,+CAA+C;AACxD,eAAK,IAAI,4CAA4C;AAAA,QACvD;AAAA,MACF;AAGA,UAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,aAAK,IAAI,mCAAmC;AAC5C,cAAM,WAAW,WAAW,UAAU;AACtC,YAAI,UAAU;AACZ,oBAAU,UAAU,CAAC,SAAS,iBAAiB,IAAI,GAAG;AAAA,YACpD,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD,cAAI,WAAW,SAAS,GAAG;AACzB,iBAAK,IAAI,oCAAoC,SAAS,EAAE;AAAA,UAC1D,OAAO;AACL,iBAAK,IAAI,iCAAiC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF,OAAO;AACL,aAAK,IAAI,2BAA2B;AAAA,MACtC;AAMA,YAAM,cAAc,WAAW,SAAS;AACxC,UAAI,eAAe,CAAC,KAAK,gBAAgB,GAAG;AAC1C,aAAK,IAAI,4EAA4E;AACrF,oBAAY,KAAK,YAAY;AAC7B,YAAI,WAAW;AACb,eAAK,IAAI,uCAAuC;AAAA,QAClD,OAAO;AACL,eAAK,IAAI,+CAA+C;AACxD,cAAI,QAAQ,aAAa,UAAU;AACjC,iBAAK,IAAI,2GAA2G,SAAS,EAAE;AAAA,UACjI,WAAW,QAAQ,aAAa,SAAS;AACvC,iBAAK,IAAI,8BAA8B,SAAS,mFAAmF;AAAA,UACrI;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,aAAK,IAAI,qCAAqC;AAC9C,oBAAY;AAAA,MACd;AAQA,UAAI,wBAAwB,GAAG;AAC7B,aAAK,IAAI,0DAA0D;AAAA,MACrE,WAAW,iBAAiB,GAAG;AAC7B,aAAK,IAAI,8BAA8B;AAAA,MACzC,OAAO;AACL,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,6BAA6B,GAAG,GAAG;AAAA,QAC9C,SAAS,KAAK;AACZ,eAAK,IAAI,iCAAkC,IAAc,OAAO,EAAE;AAAA,QACpE;AAAA,MACF;AAUA,YAAM,cAAc,MAAM,wBAAwB,cAAc,EAAE,WAAW,IAAK,CAAC;AACnF,UAAI,CAAC,aAAa;AAOhB,sBAAc,gBACV,qBACA,YAAY,WAAW,IACrB,uBACA;AACN,aAAK,IAAI,mFAA8E;AACvF,aAAK,IAAI,+DAA+D;AAAA,MAC1E,WAAW,CAAC,aAAa;AACvB,sBAAc;AACd,aAAK,IAAI,qCAAqC,YAAY,kCAA6B;AACvF,aAAK,IAAI,2EAA2E;AACpF,aAAK,IAAI,2DAA2D;AAAA,MACtE,OAAO;AAGL,cAAM,MAAO,SAAS,OAAO,CAAC;AAC9B,YAAI,cAAc,oBAAoB,YAAY;AAElD,YAAI,WAAW;AACf,YAAI,WAAW,SAAS,GAAG;AACzB,cAAI,sBAAsB;AAAA,QAC5B;AACA,iBAAS,MAAM;AACf,sBAAc;AACd,aAAK,IAAI,uCAAuC,YAAY,kBAAkB;AAG9E,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,2DAAsD;AAAA,QACjE;AAGA,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,sEAAiE;AAAA,QAC5E;AAIA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,iGAA4F;AAAA,QACvG;AAGA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,kGAA6F;AAAA,QACxG;AAcA,YAAI,WAAW;AACb,gBAAM,WAAW,qBAAqB,cAAc,SAAS;AAC7D,cAAI,UAAU;AACZ,iBAAK,IAAI,6DAA6D;AAAA,UACxE;AAAA,QACF,OAAO;AAML,wBAAc;AACd,eAAK,IAAI,0FAAqF;AAC9F,eAAK,IAAI,4FAA4F;AAAA,QACvG;AAAA,MACF;AAAA,IACF;AAOA,QAAI,CAAC,UAAU;AACb,YAAM,cAAc,iBAAiB,aAAa,UAAU;AAC5D,UAAI,aAAa;AACf,aAAK,IAAI,uCAAkC,WAAW,EAAE;AAAA,MAC1D;AAEA,YAAM,eAAe,kBAAkB,aAAa,UAAU;AAC9D,UAAI,cAAc;AAChB,aAAK,IAAI,8CAAyC,YAAY,EAAE;AAAA,MAClE;AAEA,YAAM,mBAAmB,sBAAsB,WAAW;AAC1D,UAAI,kBAAkB;AACpB,aAAK,IAAI,sDAAiD,gBAAgB,EAAE;AAAA,MAC9E;AAAA,IACF;AAMA,UAAM,uBAAuB,0BAA0B;AACvD,QAAI,sBAAsB;AACxB,WAAK,IAAI,iDAA4C,oBAAoB,EAAE;AAAA,IAC7E;AAQA,UAAM,kBAAkB,qBAAqB,UAAU;AACvD,QAAI,iBAAiB;AACnB,WAAK,IAAI,4CAAuC,eAAe,EAAE;AAAA,IACnE;AAMA,QAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAI,0BAA0B,QAAQ,GAAG;AACvC,aAAK,IAAI,wCAAwC;AAAA,MACnD,OAAO;AACL,cAAM,UAAU,sBAAsB,QAAQ;AAC9C,4BAAoB,OAAO;AAC3B,iBAAS,aAAa;AACtB,YAAI,SAAS;AACX,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,gBAAgB,OAAO,GAAG;AAAA,QAC1G,OAAO;AACL,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,EAAE;AAAA,QAClF;AACA,aAAK,IAAI,mFAAoF;AAAA,MAC/F;AAAA,IACF;AAGA,UAAM,EAAE,WAAW,IAAI,8BAA8B,YAAY,QAAQ;AACzE,QAAI,YAAY;AACd,WAAK,IAAI,2CAAsC,UAAU,EAAE;AAAA,IAC7D;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,6BAA6B;AACtC,QAAI,UAAU;AACZ,WAAK,IAAI,2DAA2D;AACpE,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,wDAAwD;AAAA,IACnE,WAAW,CAAC,SAAS;AACnB,WAAK,IAAI,0EAAqE;AAC9E,UAAI,aAAa;AAGf,aAAK,IAAI,gEAA2D,eAAe,GAAG;AAAA,MACxF,OAAO;AACL,aAAK,IAAI,sEAAsE;AAAA,MACjF;AACA,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,0EAA0E;AACnF,WAAK,IAAI,kFAAkF;AAC3F,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,6DAA6D;AACtE,WAAK,IAAI,wCAAwC;AAAA,IACnD,OAAO;AAKL,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,yEAAyE;AAClF,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAOA,UAAM,mBAAmB;AAOzB,SAAK;AAAA,MACH;AAAA,MACA,EAAE,OAAO,aAAa,WAAW,QAAQ,aAAa,YAAY,aAAa,QAAQ,SAAS;AAAA,MAChG,KAAK,OAAO;AAAA,IACd;AAIA,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA,EAEQ,mBAA4B;AAClC,eAAW,CAAC,KAAK,IAAI,KAAK;AAAA,MACxB,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,MACjC,CAAC,MAAM,CAAC,QAAQ,WAAW,WAAW,CAAC;AAAA,MACvC,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,IACnC,GAAY;AAKV,YAAM,MAAM,WAAW,GAAG;AAC1B,UAAI,KAAK;AACP,aAAK,IAAI,uBAAuB,GAAG,KAAK;AACxC,cAAM,SAAS,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7D,YAAI,OAAO,WAAW,EAAG,QAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,kBAA2B;AACjC,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,YAAY,CAAC,eAAe,MAAM,SAAS,GAAG;AAAA,QACrE,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,WAAW,mDAAmD;AAAA,IACvE;AAEA,QAAI,QAAQ,aAAa,SAAS;AAEhC,YAAM,SAAS,UAAU,YAAY,CAAC,WAAW,SAAS,GAAG;AAAA,QAC3D,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAuB;AAC7B,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,QAAQ;AAAA,QAC/B;AAAA,QAAY;AAAA,QAAoB;AAAA,QAAM;AAAA,QAAM;AAAA,QAC5C;AAAA,QAAM;AAAA,QAAsC;AAAA,MAC9C,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,KAAK,UAAU,QAAQ;AAAA,QAC3B;AAAA,QAAM;AAAA,QAAW;AAAA,MACnB,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,UAAI,GAAG,WAAW,EAAG,QAAO;AAC5B,YAAM,SAAS,UAAU,QAAQ,CAAC,wBAAwB,GAAG,EAAE,OAAO,UAAU,CAAC;AACjF,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,SAAS,UAAU,YAAY;AAAA,QACnC;AAAA,QAAa;AAAA,QAAM;AAAA,QAAQ;AAAA,MAC7B,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execFileSync, spawnSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join, dirname } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport {\n  isGatewayRunning,\n  isRulemetricGatewayListening,\n  waitForRulemetricGateway,\n  spawnGateway,\n  stopGateway,\n  GATEWAY_PORT,\n} from '../../lib/gateway-lifecycle.js';\nimport { describePortOwner } from '../../lib/gateway-identity.js';\nimport { findBinary } from '../../lib/which.js';\n\n// Resolve the directory holding the `rulemetric` executable, so hook commands\n// can prepend it to PATH. Claude Code runs hooks via `/bin/sh -c` with a\n// minimal PATH that omits nvm/pnpm global bin dirs \u2014 so a bare `rulemetric`\n// hits \"command not found\" and capture (plus the session-start gateway\n// auto-start) silently fails. We resolve it here, in the install process's\n// full PATH, and bake the dir into the hook command. Returns undefined on\n// failure \u2192 callers fall back to the bare `rulemetric` (dev/back-compat).\nfunction resolveHookBinDir(): string | undefined {\n  try {\n    const out = execFileSync('/bin/sh', ['-c', 'command -v rulemetric'], {\n      encoding: 'utf-8',\n    }).trim();\n    if (out && existsSync(out)) return dirname(out);\n  } catch {\n    /* not resolvable \u2014 fall back to bare `rulemetric` */\n  }\n  return undefined;\n}\n\n// True iff `rulemetric service install` has wired the gateway up as a launchd\n// agent. When this returns true, hooks install must NOT spawn its own\n// detached gateway \u2014 two processes fighting for :8787 means one crash-loops\n// and Claude Code's HTTPS_PROXY breaks.\nfunction isGatewayLaunchdManaged(): boolean {\n  try {\n    execFileSync('launchctl', ['list', 'com.rulemetric.gateway'], {\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    return true;\n  } catch {\n    // Non-zero exit = label not loaded\n    return false;\n  }\n}\nimport {\n  writeStatuslineShim,\n  readCurrentStatusLine,\n  isStatuslineShimInstalled,\n  STATUSLINE_SETTINGS_VALUE,\n  STATUSLINE_SHIM_PATH,\n} from '../../lib/statusline-shim.js';\nimport {\n  mergeClaudeCodeHooks,\n  removeClaudeCodeHooks,\n  readClaudeSettings,\n  writeClaudeSettingsWithBackup,\n  claudeSettingsInstallPath,\n  migrateSharedClaudeSettings,\n  RULEMETRIC_NO_PROXY,\n  writeCursorProxyConfig,\n  writeCursorUserProxyConfig,\n  writeVSCodeProxyConfig,\n  installMacOSProxyEnv,\n  writeVSCodeUserProxyConfig,\n  writeCursorHooks,\n  writeCursorUserHooks,\n  writeCopilotHooks,\n  writeAntigravityHooks,\n  writeAntigravityUserHooks,\n} from '../../lib/hooks-config.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { ensureDeviceApiKey } from '../../lib/ensure-api-key.js';\nimport { loadEnvFileAuth } from '../../lib/auth.js';\nimport { emitSetupEvent } from '../../lib/telemetry.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\nexport default class HooksInstall extends BaseCommand {\n  static override description = 'Install session tracking hooks and context capture proxy for Claude Code';\n\n  static override examples = [\n    '<%= config.bin %> hooks install',\n    '<%= config.bin %> hooks install --global',\n    '<%= config.bin %> hooks install --no-proxy',\n  ];\n\n  static override flags = {\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip proxy/gateway configuration (hooks only)',\n    }),\n    'project-dir': Flags.string({\n      description: 'Project directory to install hooks in (defaults to cwd)',\n    }),\n    global: Flags.boolean({\n      char: 'g',\n      default: false,\n      description: 'Install hooks globally (~/.claude/settings.json) so all projects are tracked',\n    }),\n    'statusline-usage': Flags.boolean({\n      default: false,\n      description: 'Install the statusline shim so Claude Code pushes live rate_limits on every refresh (makes /usage rings update in real time without needing the proxy)',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(HooksInstall);\n    const isGlobal = flags.global;\n    const projectPath = isGlobal ? homedir() : (flags['project-dir'] ?? process.cwd());\n    const configDir = join(projectPath, '.claude');\n    // Project installs write machine-local state (PATH-prefixed hook commands,\n    // HTTPS_PROXY, per-user CA path) to settings.local.json \u2014 the shared\n    // settings.json is typically checked into git, and a committed HTTPS_PROXY\n    // breaks Claude Code on every clone without a live gateway. Global installs\n    // keep ~/.claude/settings.json (not in a repo).\n    const configPath = claudeSettingsInstallPath(configDir, isGlobal);\n    const settingsFileName = isGlobal ? 'settings.json' : 'settings.local.json';\n    const noProxy = flags['no-proxy'];\n    // Whether the capture proxy actually went live this run (HTTPS_PROXY pinned\n    // against a verified-live gateway). Drives the \"next steps\" copy so we never\n    // tell the user to start a proxy that is already running.\n    let proxyActive = false;\n    // Why the proxy is NOT fully active (undefined = fully active + CA trusted).\n    // Reported via telemetry so a remote install's outcome is debuggable without\n    // a relayed log: 'no_proxy_flag' | 'mitmproxy_unavailable' | 'ca_not_generated'\n    // | 'gateway_not_live' | 'gateway_port_foreign' (another app owns :8787)\n    // | 'ca_untrusted' (proxy pinned, Claude-Code-only).\n    let proxyReason: string | undefined = noProxy ? 'no_proxy_flag' : undefined;\n    // Whether the mitmproxy CA is trusted in the system store (gates machine-wide\n    // capture). Hoisted from \u00A72 so telemetry can report the partial state.\n    let caTrusted = false;\n    // Package managers detected on this machine (brew/pipx/uv) \u2014 reported in\n    // telemetry so a remote `mitmproxy_unavailable` is DISAMBIGUATED: [] means\n    // \"no package manager, proxy genuinely can't install here\"; a non-empty list\n    // with reason:mitmproxy_install_failed means one was present but the install\n    // failed (a real bug to chase, not a bare machine).\n    let pkgManagers: string[] = [];\n\n    if (isGlobal) {\n      this.log(`Installing hooks globally \u2192 ${configPath}`);\n    }\n\n    // Read or create the target settings file. Never crash on a malformed\n    // file \u2014 a fresh user's hand-edited settings must not block capture install.\n    const { settings, recoveredBackup } = readClaudeSettings(configPath);\n    if (recoveredBackup) {\n      this.log(`[!!] ${configPath} was not valid JSON \u2014 backed it up to ${recoveredBackup} and continued with a fresh file.`);\n    }\n\n    // \u2500\u2500 0. Migrate machine-local state OUT of the shared settings.json \u2500\u2500\u2500\u2500\u2500\n    // Project installs only (the global home file isn't in a repo). Older\n    // installs wrote hooks + proxy env into .claude/settings.json, which is\n    // typically checked into git: every clone then carries a PATH-prefixed hook\n    // command for someone else's machine and an HTTPS_PROXY pin that breaks\n    // Claude Code wherever no gateway listens on that port. Stripping our\n    // entries here (they're re-written to settings.local.json below) also\n    // prevents double execution \u2014 Claude Code merges and runs hooks from BOTH\n    // files. User-owned hooks/env/statusLine are never touched.\n    if (!isGlobal) {\n      const migration = migrateSharedClaudeSettings(join(configDir, 'settings.json'), GATEWAY_PORT);\n      if (migration.migrated) {\n        this.log('[OK] Moved RuleMetric machine-local state out of the shared .claude/settings.json (it now lives in .claude/settings.local.json)');\n        if (migration.backupPath) {\n          this.log(`     Previous shared settings backed up \u2192 ${migration.backupPath}`);\n        }\n        // A legacy install may have pointed statusLine at this machine's shim\n        // from the shared file; re-home it to the local file so the feature\n        // keeps working \u2014 but only when the shim script actually exists here (a\n        // teammate's poisoned path must not become a broken local statusLine).\n        if (migration.removedStatusline && existsSync(STATUSLINE_SHIM_PATH) && !isStatuslineShimInstalled(settings)) {\n          settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        }\n      }\n    }\n\n    // Self-heal the ~1-hour auth fuse: if this device authenticated but the\n    // auto key-mint failed (or it authenticated pre-0.6.1), the env file holds\n    // only an EXPIRING access token \u2014 hooks/proxy capture silently dies when it\n    // lapses. hooks install is a natural authenticated moment to retry the\n    // mint; ensureDeviceApiKey no-ops when a key already exists and never\n    // throws. Skipped entirely when the device has no credentials at all (an\n    // unauthenticated install would just warn-noise a guaranteed 401).\n    const envAuth = loadEnvFileAuth();\n    if ((envAuth.accessToken || process.env.RULEMETRIC_ACCESS_TOKEN) &&\n        !envAuth.apiKey && !process.env.RULEMETRIC_API_KEY) {\n      await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this), this.config.version);\n    }\n\n    // \u2500\u2500 1. Install Claude Code session-tracking hooks (hooks-first, zero-proxy\n    // capture). Strip any stale rulemetric entries first \u2014 handles old command\n    // formats, preserves the user's own hooks \u2014 then merge the current canonical\n    // set. Runs regardless of --no-proxy: this is the whole point of the hooks\n    // path, which captures full sessions (lifecycle + SessionEnd transcript\n    // reimport) without mitmproxy / CA trust / gateway. The proxy adds the\n    // rendered system prompt (instruction-linking) + cross-tool capture on top.\n    const refreshedHooks = removeClaudeCodeHooks(settings);\n    // Resolve once; every hook writer (Claude Code, Cursor, Copilot) needs the\n    // same PATH prefix so a GUI-launched tool with a minimal PATH can find the CLI.\n    const hookBinDir = resolveHookBinDir();\n    mergeClaudeCodeHooks(settings, hookBinDir);\n    this.log(\n      refreshedHooks\n        ? `[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/${settingsFileName}`\n        : `[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/${settingsFileName}`,\n    );\n\n    // \u2500\u2500 2. Configure gateway + proxy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      // Ensure mitmproxy is available\n      let mitmAvailable = Boolean(findBinary('mitmdump'));\n      if (!mitmAvailable) {\n        this.log('');\n        this.log('[!!] mitmproxy not found \u2014 installing...');\n        // Record which package managers exist (telemetry disambiguation).\n        pkgManagers = ['brew', 'pipx', 'uv'].filter((m) => Boolean(findBinary(m)));\n        mitmAvailable = this.installMitmproxy();\n        if (!mitmAvailable) {\n          this.log('[!!] Could not install mitmproxy. Skipping proxy config.');\n          this.log('     Install manually: pipx install mitmproxy');\n          this.log('     Then re-run: rulemetric hooks install');\n        }\n      }\n\n      // Generate CA cert if missing\n      if (!existsSync(CERT_PATH)) {\n        this.log('[..] Generating CA certificate...');\n        const mitmdump = findBinary('mitmdump');\n        if (mitmdump) {\n          spawnSync(mitmdump, ['--set', 'listen_port=0', '-q'], {\n            timeout: 5000,\n            stdio: 'ignore',\n          });\n          if (existsSync(CERT_PATH)) {\n            this.log(`[OK] CA certificate generated at ${CERT_PATH}`);\n          } else {\n            this.log('[!!] Could not generate CA cert');\n          }\n        }\n      } else {\n        this.log('[OK] CA certificate found');\n      }\n\n      // Trust CA cert in system store (if not already trusted). Track the\n      // result: whether the CA is trusted decides if we may route MACHINE-WIDE /\n      // native-app traffic through the MITM proxy (native apps validate against\n      // the system keychain, so an untrusted CA breaks their TLS).\n      const caGenerated = existsSync(CERT_PATH);\n      if (caGenerated && !this.isCACertTrusted()) {\n        this.log('[..] Installing CA certificate into system trust store (requires admin)...');\n        caTrusted = this.trustCACert();\n        if (caTrusted) {\n          this.log('[OK] CA certificate trusted by system');\n        } else {\n          this.log('[!!] Could not install CA cert automatically.');\n          if (process.platform === 'darwin') {\n            this.log(`     Run manually: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERT_PATH}`);\n          } else if (process.platform === 'linux') {\n            this.log(`     Run manually: sudo cp ${CERT_PATH} /usr/local/share/ca-certificates/mitmproxy-ca.crt && sudo update-ca-certificates`);\n          }\n        }\n      } else if (caGenerated) {\n        this.log('[OK] CA certificate already trusted');\n        caTrusted = true;\n      }\n\n      // Start the gateway BEFORE pinning HTTPS_PROXY. Possible port owners (in\n      // order of precedence):\n      //   1. launchd (`rulemetric service install` plist) \u2014 authoritative;\n      //      hooks must NOT spawn a competing copy that would fight for :8787\n      //   2. an already-live gateway (identity handshake answers on :8787)\n      //   3. a FOREIGN process on :8787 \u2014 never spawn against it, and below,\n      //      never pin HTTPS_PROXY at it\n      //   4. nothing \u2014 spawn a fresh detached process\n      const launchdManaged = isGatewayLaunchdManaged();\n      const portIdentity = await isRulemetricGatewayListening(GATEWAY_PORT);\n      if (launchdManaged) {\n        this.log('[OK] Gateway managed by launchd (com.rulemetric.gateway)');\n      } else if (portIdentity.status === 'ours-live') {\n        this.log('[OK] Gateway already running');\n      } else if (portIdentity.status === 'foreign' && isGatewayRunning()) {\n        // A gateway from an older CLI build predates the identity endpoint and\n        // probes as foreign, but the PID file confirms it's ours. Restart it so\n        // this machine runs the current build (and answers the handshake).\n        this.log('[..] Restarting gateway (running build predates the identity handshake)...');\n        stopGateway();\n        // Brief gap so the dying gateway releases :8787 before the fresh one\n        // binds (same race `proxy restart` guards against).\n        await new Promise((resolve) => setTimeout(resolve, 500));\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway restarted (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not restart gateway: ${(err as Error).message}`);\n        }\n      } else if (portIdentity.status === 'foreign') {\n        // Handled at the pin guard below \u2014 do NOT spawn a doomed copy.\n      } else {\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway started (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not start gateway: ${(err as Error).message}`);\n        }\n      }\n\n      // Identity guard: ONLY pin HTTPS_PROXY once :8787 answers the identity\n      // handshake as OUR gateway. Writing it against a dead port is the\n      // fresh-laptop ConnectionRefused footgun, and writing it against a\n      // FOREIGN process is worse \u2014 either way it breaks all of Claude Code's\n      // HTTPS. If the port isn't verifiably ours, we leave Claude Code talking\n      // to Anthropic directly; capture still works via the hooks installed in \u00A71.\n      // Poll (not a one-shot probe): a just-spawned gateway needs a moment to\n      // bind :8787, and a single immediate probe would fail-close every fresh\n      // install and silently disable deep capture. A launchd-managed gateway on\n      // an older build answers TCP but not the handshake \u2014 trust launchd's\n      // ownership there (the port can't be foreign under its supervision).\n      const gatewayIdentity = await waitForRulemetricGateway(GATEWAY_PORT, { timeoutMs: 4000 });\n      if (!caGenerated) {\n        // No CA \u2192 mitmproxy will regenerate one and intercept, but nothing\n        // trusts it, so pinning HTTPS_PROXY would break even Claude Code's TLS.\n        // Stay hooks-only rather than pin a proxy nothing can validate. Name the\n        // precise cause: no mitmproxy AND no package manager to install it (a\n        // genuine bare-machine gap) vs. a manager was present but the install\n        // failed (a bug to chase, not a missing prereq).\n        proxyReason = mitmAvailable\n          ? 'ca_not_generated'\n          : pkgManagers.length === 0\n            ? 'no_package_manager'\n            : 'mitmproxy_install_failed';\n        this.log('[!!] No CA certificate \u2014 NOT setting HTTPS_PROXY (capture stays hooks-only).');\n        this.log('     Install mitmproxy, then re-run: rulemetric hooks install');\n      } else if (gatewayIdentity.status === 'foreign' && !launchdManaged) {\n        // Something answers on :8787 but it is NOT our gateway. Pinning\n        // HTTPS_PROXY at it would route every HTTPS request Claude Code makes\n        // into an app that is not a proxy \u2014 total HTTPS breakage. Name the\n        // holder so the user can free the port; proceed hooks-only.\n        proxyReason = 'gateway_port_foreign';\n        const owner = describePortOwner(GATEWAY_PORT);\n        this.log(`[!!] Port :${GATEWAY_PORT} is held by a process that is NOT the RuleMetric gateway \u2014 NOT setting HTTPS_PROXY.`);\n        this.log(\n          owner\n            ? `     Holding the port: ${owner}`\n            : `     Could not identify the holder (try: lsof -nP -iTCP:${GATEWAY_PORT} -sTCP:LISTEN)`,\n        );\n        this.log('     Capture still works via hooks. Free the port, then re-run: rulemetric hooks install');\n      } else if (gatewayIdentity.status === 'dead') {\n        proxyReason = 'gateway_not_live';\n        this.log(`[!!] Gateway is not answering on :${GATEWAY_PORT} \u2014 NOT setting HTTPS_PROXY.`);\n        this.log('     Capture still works via hooks. To enable deep (proxy) capture later:');\n        this.log('     rulemetric proxy start  &&  rulemetric hooks install');\n      } else {\n        // ours-live, or launchd-managed answering TCP on an older build (its\n        // supervision means the port holder is ours even without the marker).\n        // Set permanent HTTPS_PROXY and NODE_EXTRA_CA_CERTS in the target\n        // settings file (settings.local.json for project installs \u2014 these\n        // values are machine-local and must never be committed). They point to\n        // the gateway (verified live above), not mitmproxy directly.\n        const env = (settings.env ?? {}) as Record<string, string>;\n        env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n        // Bypass proxy for non-Anthropic traffic (Supabase auth, npm, etc.)\n        env.NO_PROXY = RULEMETRIC_NO_PROXY;\n        if (existsSync(CERT_PATH)) {\n          env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n        }\n        settings.env = env;\n        proxyActive = true;\n        this.log(`[OK] HTTPS_PROXY set to gateway on :${GATEWAY_PORT} (verified live)`);\n\n        // Configure Cursor proxy (if .cursor/ exists)\n        const cursorProxy = writeCursorProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (cursorProxy) {\n          this.log('[OK] Cursor proxy configured \u2192 .cursor/settings.json');\n        }\n\n        // Configure VS Code proxy for Copilot capture (workspace settings)\n        const vscodeProxy = writeVSCodeProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n        if (vscodeProxy) {\n          this.log('[OK] VS Code workspace proxy configured \u2192 .vscode/settings.json');\n        }\n\n        // Set http.proxy in VS Code user settings (workspace-level is silently ignored\n        // for http.proxy due to APPLICATION scope \u2014 microsoft/vscode#236932)\n        const vscodeUserProxy = writeVSCodeUserProxyConfig(GATEWAY_PORT);\n        if (vscodeUserProxy) {\n          this.log('[OK] VS Code user proxy configured \u2192 ~/Library/Application Support/Code/User/settings.json');\n        }\n\n        // Same for Cursor (VS Code fork inherits the APPLICATION-scope restriction).\n        const cursorUserProxy = writeCursorUserProxyConfig(GATEWAY_PORT);\n        if (cursorUserProxy) {\n          this.log('[OK] Cursor user proxy configured \u2192 ~/Library/Application Support/Cursor/User/settings.json');\n        }\n\n        // Set HTTPS_PROXY for all GUI apps via launchctl + LaunchAgent (macOS)\n        // Copilot reads process.env.HTTPS_PROXY directly \u2014 VS Code settings alone\n        // are insufficient because workspace http.proxy is ignored and extensions\n        // may bypass vscode-proxy-agent (microsoft/vscode#12588).\n        //\n        // GATED ON CA TRUST: this routes EVERY GUI/native app's HTTPS through the\n        // MITM proxy machine-wide. Native apps validate against the system\n        // keychain, so if the CA isn't trusted (sudo declined / non-admin) this\n        // would break their TLS with an unknown-CA error attributed to nothing\n        // obvious. Claude Code + Node apps are unaffected either way (they trust\n        // NODE_EXTRA_CA_CERTS), so we keep that path and only skip the\n        // machine-wide native layer.\n        if (caTrusted) {\n          const macProxy = installMacOSProxyEnv(GATEWAY_PORT, CERT_PATH);\n          if (macProxy) {\n            this.log('[OK] HTTPS_PROXY set for GUI apps (launchctl + LaunchAgent)');\n          }\n        } else {\n          // Partial success: HTTPS_PROXY IS pinned (proxyActive) and Claude Code\n          // capture works via NODE_EXTRA_CA_CERTS, but the CA isn't system-trusted\n          // so cross-tool/machine-wide capture is skipped. Report it so a remote\n          // install shows \"proxy live but Claude-Code-only\" rather than looking\n          // fully green.\n          proxyReason = 'ca_untrusted';\n          this.log('[!!] CA not trusted \u2014 skipping machine-wide GUI proxy (would break native-app TLS).');\n          this.log('     Claude Code capture is unaffected. Trust the CA + re-run to enable cross-app capture.');\n        }\n      }\n    }\n\n    // \u2500\u2500 3. Write Cursor + Copilot hook configs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // These are independent of the proxy (they capture editor lifecycle\n    // events, not LLM traffic), so they run regardless of --no-proxy. Both\n    // helpers no-op when the target directory (.cursor/ or .github/)\n    // doesn't exist.\n    if (!isGlobal) {\n      const cursorHooks = writeCursorHooks(projectPath, hookBinDir);\n      if (cursorHooks) {\n        this.log(`[OK] Cursor hooks configured \u2192 ${cursorHooks}`);\n      }\n\n      const copilotHooks = writeCopilotHooks(projectPath, hookBinDir);\n      if (copilotHooks) {\n        this.log(`[OK] Copilot Agent hooks configured \u2192 ${copilotHooks}`);\n      }\n\n      const antigravityHooks = writeAntigravityHooks(projectPath);\n      if (antigravityHooks) {\n        this.log(`[OK] Antigravity workspace hooks configured \u2192 ${antigravityHooks}`);\n      }\n    }\n\n    // User-level Antigravity hooks at ~/.gemini/config/hooks.json \u2014 covers any\n    // workspace the user opens, not just the install-time cwd. Written ONLY when\n    // ~/.gemini already exists (the tool is present); returns null otherwise so\n    // we never manufacture config for a tool the user doesn't have (F2).\n    const antigravityUserHooks = writeAntigravityUserHooks();\n    if (antigravityUserHooks) {\n      this.log(`[OK] Antigravity user hooks configured \u2192 ${antigravityUserHooks}`);\n    }\n\n    // User-level Cursor hooks (~/.cursor/hooks.json) are required for global\n    // capture because Cursor's chat traffic bypasses HTTP proxies (HTTP/2\n    // multiplexed persistent connection \u2014 see cursor.com/docs/hooks). Without\n    // hooks, we get zero Cursor visibility for sessions outside this project.\n    // Runs in both --global and per-project modes since the user file is\n    // machine-wide either way.\n    const cursorUserHooks = writeCursorUserHooks(hookBinDir);\n    if (cursorUserHooks) {\n      this.log(`[OK] Cursor user hooks configured \u2192 ${cursorUserHooks}`);\n    }\n\n    // \u2500\u2500 4. Statusline shim (rate_limits freshness) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // When --statusline-usage is set, write ~/.claude/statusline-rulemetric.sh\n    // and point settings.statusLine at it. If the user already has a statusLine\n    // command configured, chain it so their prompt text is preserved.\n    if (flags['statusline-usage']) {\n      if (isStatuslineShimInstalled(settings)) {\n        this.log('[OK] Statusline shim already installed');\n      } else {\n        const prevCmd = readCurrentStatusLine(settings);\n        writeStatuslineShim(prevCmd);\n        settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        if (prevCmd) {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command} (chains to: ${prevCmd})`);\n        } else {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command}`);\n        }\n        this.log('     Rate-limit rings will now update on Claude Code\\'s statusline refresh cadence');\n      }\n    }\n\n    // \u2500\u2500 5. Write Claude Code settings (backup prior file \u2192 reversible) \u2500\u2500\u2500\u2500\u2500\n    const { backupPath } = writeClaudeSettingsWithBackup(configPath, settings);\n    if (backupPath) {\n      this.log(`[OK] Backed up previous settings \u2192 ${backupPath}`);\n    }\n\n    this.log('');\n    this.log('Setup complete! Next steps:');\n    if (isGlobal) {\n      this.log('  1. Install always-on API:    rulemetric service install');\n      this.log('  2. Start Claude Code in any project \u2014 all sessions tracked automatically');\n      this.log('');\n      this.log('The API service starts on login and restarts on crash.');\n    } else if (!noProxy) {\n      this.log('  1. Start Claude Code \u2014 sessions are captured by hooks immediately');\n      if (proxyActive) {\n        // The proxy IS live (pinned against a verified gateway above) \u2014 don't\n        // tell the user to start something that's already running.\n        this.log('  2. Full-depth capture is ON \u2014 the proxy is live on :' + GATEWAY_PORT + '.');\n      } else {\n        this.log('  2. Enable full depth (proxy not yet live):  rulemetric proxy start');\n      }\n      this.log('');\n      this.log('Hooks capture every session (lifecycle + transcript). The proxy adds the');\n      this.log('rendered system prompt (instruction-effectiveness linking) + cross-tool capture.');\n      this.log('');\n      this.log('To capture traffic from other clients (Python, curl, etc.):');\n      this.log('  eval \"$(rulemetric proxy env --all)\"');\n    } else {\n      // --no-proxy still installs the Claude Code session hooks above, so full\n      // sessions ARE captured (lifecycle + SessionEnd transcript reimport) with\n      // no mitmproxy / CA trust / gateway. Only the proxy-exclusive layer\n      // (rendered system prompt \u2192 instruction-linking, cross-tool) is skipped.\n      this.log('  1. Start Claude Code \u2014 sessions are captured by the hooks just installed');\n      this.log('');\n      this.log('No proxy means no mitmproxy / CA cert needed. The hooks capture full');\n      this.log('sessions on their own; re-run without --no-proxy to also capture system');\n      this.log('prompts for instruction-effectiveness linking.');\n    }\n\n    // Ensure the active-org cache is populated before the user starts a\n    // Claude Code session. BaseCommand fired the guarded refresh earlier\n    // but may have raced with auth init or hit a transient error; this\n    // explicit retry guarantees the cache reflects the user's current\n    // active_org_id at the end of `hooks install`.\n    await bootstrapActiveOrg();\n\n    // Onboarding telemetry (disclosed + opt-outable) \u2014 records that hooks\n    // landed, whether the proxy went live, whether the CA is system-trusted, and\n    // (when not fully green) WHY \u2014 so a remote install's outcome is debuggable\n    // without a relayed log: e.g. proxy:false reason:mitmproxy_unavailable, or\n    // proxy:true reason:ca_untrusted (live but Claude-Code-only).\n    void emitSetupEvent(\n      'hooks_installed',\n      { proxy: proxyActive, caTrusted, reason: proxyReason, installers: pkgManagers, global: isGlobal },\n      this.config.version,\n    );\n\n    // Soft tmux capability check \u2014 live message send needs tmux on the\n    // user's machine. We do not auto-install; just surface one line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  private installMitmproxy(): boolean {\n    for (const [cmd, args] of [\n      ['pipx', ['install', 'mitmproxy']],\n      ['uv', ['tool', 'install', 'mitmproxy']],\n      ['brew', ['install', 'mitmproxy']],\n    ] as const) {\n      // Resolve the FULL path via the shared findBinary (which probes the\n      // well-known install dirs, not just $PATH) and spawn THAT \u2014 a bare\n      // spawnSync('brew', \u2026) would fail under the minimal PATH that a\n      // GUI/agent-launched install has, even after we found brew off-PATH.\n      const bin = findBinary(cmd);\n      if (bin) {\n        this.log(`     Installing via ${cmd}...`);\n        const result = spawnSync(bin, [...args], { stdio: 'inherit' });\n        if (result.status === 0) return true;\n      }\n    }\n    return false;\n  }\n\n  private isCACertTrusted(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('security', ['verify-cert', '-c', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      return existsSync('/usr/local/share/ca-certificates/mitmproxy-ca.crt');\n    }\n\n    if (process.platform === 'win32') {\n      // On Windows, check if cert is in the Root store\n      const result = spawnSync('certutil', ['-verify', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n\n  private trustCACert(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('sudo', [\n        'security', 'add-trusted-cert', '-d', '-r', 'trustRoot',\n        '-k', '/Library/Keychains/System.keychain', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      const cp = spawnSync('sudo', [\n        'cp', CERT_PATH, '/usr/local/share/ca-certificates/mitmproxy-ca.crt',\n      ], { stdio: 'inherit' });\n      if (cp.status !== 0) return false;\n      const update = spawnSync('sudo', ['update-ca-certificates'], { stdio: 'inherit' });\n      return update.status === 0;\n    }\n\n    if (process.platform === 'win32') {\n      const result = spawnSync('certutil', [\n        '-addstore', '-f', 'Root', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,cAAc,iBAAiB;AACxC,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAoB9B,SAAS,oBAAwC;AAC/C,MAAI;AACF,UAAM,MAAM,aAAa,WAAW,CAAC,MAAM,uBAAuB,GAAG;AAAA,MACnE,UAAU;AAAA,IACZ,CAAC,EAAE,KAAK;AACR,QAAI,OAAO,WAAW,GAAG,EAAG,QAAO,QAAQ,GAAG;AAAA,EAChD,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAMA,SAAS,0BAAmC;AAC1C,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,wBAAwB,GAAG;AAAA,MAC5D,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAiCA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAEvE,IAAqB,eAArB,MAAqB,sBAAqB,YAAY;AAAA,EACpD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,OAAO;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,IACD,QAAQ,MAAM,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,oBAAoB,MAAM,QAAQ;AAAA,MAChC,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,aAAY;AAC/C,UAAM,WAAW,MAAM;AACvB,UAAM,cAAc,WAAW,QAAQ,IAAK,MAAM,aAAa,KAAK,QAAQ,IAAI;AAChF,UAAM,YAAY,KAAK,aAAa,SAAS;AAM7C,UAAM,aAAa,0BAA0B,WAAW,QAAQ;AAChE,UAAM,mBAAmB,WAAW,kBAAkB;AACtD,UAAM,UAAU,MAAM,UAAU;AAIhC,QAAI,cAAc;AAMlB,QAAI,cAAkC,UAAU,kBAAkB;AAGlE,QAAI,YAAY;AAMhB,QAAI,cAAwB,CAAC;AAE7B,QAAI,UAAU;AACZ,WAAK,IAAI,oCAA+B,UAAU,EAAE;AAAA,IACtD;AAIA,UAAM,EAAE,UAAU,gBAAgB,IAAI,mBAAmB,UAAU;AACnE,QAAI,iBAAiB;AACnB,WAAK,IAAI,QAAQ,UAAU,8CAAyC,eAAe,mCAAmC;AAAA,IACxH;AAWA,QAAI,CAAC,UAAU;AACb,YAAM,YAAY,4BAA4B,KAAK,WAAW,eAAe,GAAG,YAAY;AAC5F,UAAI,UAAU,UAAU;AACtB,aAAK,IAAI,iIAAiI;AAC1I,YAAI,UAAU,YAAY;AACxB,eAAK,IAAI,kDAA6C,UAAU,UAAU,EAAE;AAAA,QAC9E;AAKA,YAAI,UAAU,qBAAqB,WAAW,oBAAoB,KAAK,CAAC,0BAA0B,QAAQ,GAAG;AAC3G,mBAAS,aAAa;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AASA,UAAM,UAAU,gBAAgB;AAChC,SAAK,QAAQ,eAAe,QAAQ,IAAI,4BACpC,CAAC,QAAQ,UAAU,CAAC,QAAQ,IAAI,oBAAoB;AACtD,YAAM,mBAAmB,KAAK,IAAI,KAAK,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,OAAO;AAAA,IACzF;AASA,UAAM,iBAAiB,sBAAsB,QAAQ;AAGrD,UAAM,aAAa,kBAAkB;AACrC,yBAAqB,UAAU,UAAU;AACzC,SAAK;AAAA,MACH,iBACI,sEAAiE,gBAAgB,KACjF,sEAAiE,gBAAgB;AAAA,IACvF;AAGA,QAAI,CAAC,SAAS;AAEZ,UAAI,gBAAgB,QAAQ,WAAW,UAAU,CAAC;AAClD,UAAI,CAAC,eAAe;AAClB,aAAK,IAAI,EAAE;AACX,aAAK,IAAI,+CAA0C;AAEnD,sBAAc,CAAC,QAAQ,QAAQ,IAAI,EAAE,OAAO,CAAC,MAAM,QAAQ,WAAW,CAAC,CAAC,CAAC;AACzE,wBAAgB,KAAK,iBAAiB;AACtC,YAAI,CAAC,eAAe;AAClB,eAAK,IAAI,0DAA0D;AACnE,eAAK,IAAI,+CAA+C;AACxD,eAAK,IAAI,4CAA4C;AAAA,QACvD;AAAA,MACF;AAGA,UAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,aAAK,IAAI,mCAAmC;AAC5C,cAAM,WAAW,WAAW,UAAU;AACtC,YAAI,UAAU;AACZ,oBAAU,UAAU,CAAC,SAAS,iBAAiB,IAAI,GAAG;AAAA,YACpD,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD,cAAI,WAAW,SAAS,GAAG;AACzB,iBAAK,IAAI,oCAAoC,SAAS,EAAE;AAAA,UAC1D,OAAO;AACL,iBAAK,IAAI,iCAAiC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF,OAAO;AACL,aAAK,IAAI,2BAA2B;AAAA,MACtC;AAMA,YAAM,cAAc,WAAW,SAAS;AACxC,UAAI,eAAe,CAAC,KAAK,gBAAgB,GAAG;AAC1C,aAAK,IAAI,4EAA4E;AACrF,oBAAY,KAAK,YAAY;AAC7B,YAAI,WAAW;AACb,eAAK,IAAI,uCAAuC;AAAA,QAClD,OAAO;AACL,eAAK,IAAI,+CAA+C;AACxD,cAAI,QAAQ,aAAa,UAAU;AACjC,iBAAK,IAAI,2GAA2G,SAAS,EAAE;AAAA,UACjI,WAAW,QAAQ,aAAa,SAAS;AACvC,iBAAK,IAAI,8BAA8B,SAAS,mFAAmF;AAAA,UACrI;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,aAAK,IAAI,qCAAqC;AAC9C,oBAAY;AAAA,MACd;AAUA,YAAM,iBAAiB,wBAAwB;AAC/C,YAAM,eAAe,MAAM,6BAA6B,YAAY;AACpE,UAAI,gBAAgB;AAClB,aAAK,IAAI,0DAA0D;AAAA,MACrE,WAAW,aAAa,WAAW,aAAa;AAC9C,aAAK,IAAI,8BAA8B;AAAA,MACzC,WAAW,aAAa,WAAW,aAAa,iBAAiB,GAAG;AAIlE,aAAK,IAAI,4EAA4E;AACrF,oBAAY;AAGZ,cAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AACvD,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,+BAA+B,GAAG,GAAG;AAAA,QAChD,SAAS,KAAK;AACZ,eAAK,IAAI,mCAAoC,IAAc,OAAO,EAAE;AAAA,QACtE;AAAA,MACF,WAAW,aAAa,WAAW,WAAW;AAAA,MAE9C,OAAO;AACL,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,6BAA6B,GAAG,GAAG;AAAA,QAC9C,SAAS,KAAK;AACZ,eAAK,IAAI,iCAAkC,IAAc,OAAO,EAAE;AAAA,QACpE;AAAA,MACF;AAaA,YAAM,kBAAkB,MAAM,yBAAyB,cAAc,EAAE,WAAW,IAAK,CAAC;AACxF,UAAI,CAAC,aAAa;AAOhB,sBAAc,gBACV,qBACA,YAAY,WAAW,IACrB,uBACA;AACN,aAAK,IAAI,mFAA8E;AACvF,aAAK,IAAI,+DAA+D;AAAA,MAC1E,WAAW,gBAAgB,WAAW,aAAa,CAAC,gBAAgB;AAKlE,sBAAc;AACd,cAAM,QAAQ,kBAAkB,YAAY;AAC5C,aAAK,IAAI,cAAc,YAAY,0FAAqF;AACxH,aAAK;AAAA,UACH,QACI,0BAA0B,KAAK,KAC/B,2DAA2D,YAAY;AAAA,QAC7E;AACA,aAAK,IAAI,0FAA0F;AAAA,MACrG,WAAW,gBAAgB,WAAW,QAAQ;AAC5C,sBAAc;AACd,aAAK,IAAI,qCAAqC,YAAY,kCAA6B;AACvF,aAAK,IAAI,2EAA2E;AACpF,aAAK,IAAI,2DAA2D;AAAA,MACtE,OAAO;AAOL,cAAM,MAAO,SAAS,OAAO,CAAC;AAC9B,YAAI,cAAc,oBAAoB,YAAY;AAElD,YAAI,WAAW;AACf,YAAI,WAAW,SAAS,GAAG;AACzB,cAAI,sBAAsB;AAAA,QAC5B;AACA,iBAAS,MAAM;AACf,sBAAc;AACd,aAAK,IAAI,uCAAuC,YAAY,kBAAkB;AAG9E,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,2DAAsD;AAAA,QACjE;AAGA,cAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,YAAI,aAAa;AACf,eAAK,IAAI,sEAAiE;AAAA,QAC5E;AAIA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,iGAA4F;AAAA,QACvG;AAGA,cAAM,kBAAkB,2BAA2B,YAAY;AAC/D,YAAI,iBAAiB;AACnB,eAAK,IAAI,kGAA6F;AAAA,QACxG;AAcA,YAAI,WAAW;AACb,gBAAM,WAAW,qBAAqB,cAAc,SAAS;AAC7D,cAAI,UAAU;AACZ,iBAAK,IAAI,6DAA6D;AAAA,UACxE;AAAA,QACF,OAAO;AAML,wBAAc;AACd,eAAK,IAAI,0FAAqF;AAC9F,eAAK,IAAI,4FAA4F;AAAA,QACvG;AAAA,MACF;AAAA,IACF;AAOA,QAAI,CAAC,UAAU;AACb,YAAM,cAAc,iBAAiB,aAAa,UAAU;AAC5D,UAAI,aAAa;AACf,aAAK,IAAI,uCAAkC,WAAW,EAAE;AAAA,MAC1D;AAEA,YAAM,eAAe,kBAAkB,aAAa,UAAU;AAC9D,UAAI,cAAc;AAChB,aAAK,IAAI,8CAAyC,YAAY,EAAE;AAAA,MAClE;AAEA,YAAM,mBAAmB,sBAAsB,WAAW;AAC1D,UAAI,kBAAkB;AACpB,aAAK,IAAI,sDAAiD,gBAAgB,EAAE;AAAA,MAC9E;AAAA,IACF;AAMA,UAAM,uBAAuB,0BAA0B;AACvD,QAAI,sBAAsB;AACxB,WAAK,IAAI,iDAA4C,oBAAoB,EAAE;AAAA,IAC7E;AAQA,UAAM,kBAAkB,qBAAqB,UAAU;AACvD,QAAI,iBAAiB;AACnB,WAAK,IAAI,4CAAuC,eAAe,EAAE;AAAA,IACnE;AAMA,QAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAI,0BAA0B,QAAQ,GAAG;AACvC,aAAK,IAAI,wCAAwC;AAAA,MACnD,OAAO;AACL,cAAM,UAAU,sBAAsB,QAAQ;AAC9C,4BAAoB,OAAO;AAC3B,iBAAS,aAAa;AACtB,YAAI,SAAS;AACX,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,gBAAgB,OAAO,GAAG;AAAA,QAC1G,OAAO;AACL,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,EAAE;AAAA,QAClF;AACA,aAAK,IAAI,mFAAoF;AAAA,MAC/F;AAAA,IACF;AAGA,UAAM,EAAE,WAAW,IAAI,8BAA8B,YAAY,QAAQ;AACzE,QAAI,YAAY;AACd,WAAK,IAAI,2CAAsC,UAAU,EAAE;AAAA,IAC7D;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,6BAA6B;AACtC,QAAI,UAAU;AACZ,WAAK,IAAI,2DAA2D;AACpE,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,wDAAwD;AAAA,IACnE,WAAW,CAAC,SAAS;AACnB,WAAK,IAAI,0EAAqE;AAC9E,UAAI,aAAa;AAGf,aAAK,IAAI,gEAA2D,eAAe,GAAG;AAAA,MACxF,OAAO;AACL,aAAK,IAAI,sEAAsE;AAAA,MACjF;AACA,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,0EAA0E;AACnF,WAAK,IAAI,kFAAkF;AAC3F,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,6DAA6D;AACtE,WAAK,IAAI,wCAAwC;AAAA,IACnD,OAAO;AAKL,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,yEAAyE;AAClF,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAOA,UAAM,mBAAmB;AAOzB,SAAK;AAAA,MACH;AAAA,MACA,EAAE,OAAO,aAAa,WAAW,QAAQ,aAAa,YAAY,aAAa,QAAQ,SAAS;AAAA,MAChG,KAAK,OAAO;AAAA,IACd;AAIA,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA,EAEQ,mBAA4B;AAClC,eAAW,CAAC,KAAK,IAAI,KAAK;AAAA,MACxB,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,MACjC,CAAC,MAAM,CAAC,QAAQ,WAAW,WAAW,CAAC;AAAA,MACvC,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,IACnC,GAAY;AAKV,YAAM,MAAM,WAAW,GAAG;AAC1B,UAAI,KAAK;AACP,aAAK,IAAI,uBAAuB,GAAG,KAAK;AACxC,cAAM,SAAS,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7D,YAAI,OAAO,WAAW,EAAG,QAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,kBAA2B;AACjC,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,YAAY,CAAC,eAAe,MAAM,SAAS,GAAG;AAAA,QACrE,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,WAAW,mDAAmD;AAAA,IACvE;AAEA,QAAI,QAAQ,aAAa,SAAS;AAEhC,YAAM,SAAS,UAAU,YAAY,CAAC,WAAW,SAAS,GAAG;AAAA,QAC3D,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAuB;AAC7B,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,QAAQ;AAAA,QAC/B;AAAA,QAAY;AAAA,QAAoB;AAAA,QAAM;AAAA,QAAM;AAAA,QAC5C;AAAA,QAAM;AAAA,QAAsC;AAAA,MAC9C,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,KAAK,UAAU,QAAQ;AAAA,QAC3B;AAAA,QAAM;AAAA,QAAW;AAAA,MACnB,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,UAAI,GAAG,WAAW,EAAG,QAAO;AAC5B,YAAM,SAAS,UAAU,QAAQ,CAAC,wBAAwB,GAAG,EAAE,OAAO,UAAU,CAAC;AACjF,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,SAAS,UAAU,YAAY;AAAA,QACnC;AAAA,QAAa;AAAA,QAAM;AAAA,QAAQ;AAAA,MAC7B,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/commands/hooks/run.js

@@ -1,10 +1,11 @@
 import {
   BaseCommand
-} from "../../chunk-SZ7VDCD6.js";
+} from "../../chunk-2HK7RGZB.js";
 import "../../chunk-R56PH7YE.js";
-import "../../chunk-SLL3OBKN.js";
+import "../../chunk-GQNJO2P2.js";
+import "../../chunk-37LN5O7M.js";
 import "../../chunk-EKJ2CABV.js";
-import "../../chunk-ZRLYHBPN.js";
+import "../../chunk-ZUJBM6HE.js";
 import "../../chunk-W2YERO7E.js";
 import "../../chunk-NSBPE2FW.js";
 

package/dist/commands/hooks/run.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../../../src/commands/hooks/run.ts"],
   "sourcesContent": ["import { Args } from '@oclif/core';\nimport { execFileSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { join, delimiter } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\n\nconst VALID_HOOKS = ['session-start', 'session-end', 'user-prompt', 'post-tool-use', 'assistant-response'] as const;\n\nexport default class HooksRun extends BaseCommand {\n  static override description = 'Execute a hook script (called by AI tool hooks, not for direct use)';\n  static override hidden = true;\n\n  static override args = {\n    hook: Args.string({\n      description: 'Hook name to run',\n      required: true,\n      options: [...VALID_HOOKS],\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { args } = await this.parse(HooksRun);\n    const hookName = args.hook;\n\n    // Resolve bundled script path\n    const { scriptsDir } = await import('@rulemetric/hooks/scripts-dir');\n    const scriptPath = join(scriptsDir, `${hookName}.sh`);\n\n    if (!existsSync(scriptPath)) {\n      this.error(`Hook script not found: ${scriptPath}`);\n    }\n\n    try {\n      // Read stdin and pass it to the bash script\n      const stdin = await this.readStdin();\n      // APPEND the bundled scripts dir to PATH so the shipped `jq` shim resolves\n      // when the host has no real jq (macOS ships none). Appended, not prepended,\n      // so a real jq earlier on PATH still wins. Every hook `source`s\n      // _normalize.sh, which calls bare `jq` under `set -e` \u2014 without this the\n      // whole hooks-capture path silently dies on a jq-less machine.\n      const augmentedPath = `${process.env.PATH ?? ''}${delimiter}${scriptsDir}`;\n      // session-end reimports the full transcript + enrich/link/cleanup \u2014 it\n      // budgets ~17s of network internally, so a 10s cap SIGKILLs it mid-reimport\n      // and silently drops the session. Give it headroom; other hooks are quick.\n      const timeout = hookName === 'session-end' ? 30_000 : 10_000;\n      execFileSync('bash', [scriptPath], {\n        input: stdin,\n        stdio: ['pipe', 'inherit', 'inherit'],\n        timeout,\n        env: { ...process.env, PATH: augmentedPath },\n      });\n\n      // Antigravity-specific: tail the conversation transcript and emit\n      // user_message / assistant_response / tool_result events that the\n      // bash hook can't see. Antigravity does not fire UserPromptSubmit\n      // or Stop hooks, and the Gemini streaming traffic bypasses the\n      // proxy. First fire for a conversation primes state to the current\n      // transcript end and returns immediately \u2014 capture is forward-only.\n      if (\n        process.env.RULEMETRIC_HOOK_TOOL === 'antigravity' &&\n        hookName === 'post-tool-use'\n      ) {\n        try {\n          const { tailAntigravityTranscript } = await import(\n            '../../lib/antigravity-transcript.js'\n          );\n          await tailAntigravityTranscript(stdin);\n        } catch (err) {\n          process.stderr.write(\n            `[antigravity-tailer] ${(err as Error).message}\\n`,\n          );\n        }\n      }\n    } catch (error: unknown) {\n      // Capture hooks are BEST-EFFORT telemetry \u2014 a non-zero exit here surfaces\n      // in the user's session as \"Stop hook error: Failed with non-blocking\n      // status code\" (harmless, but alarming litter). Previously we re-propagated\n      // the script's exit code, which contradicted this method's own \"exit\n      // silently\" intent. Swallow it: always exit 0 so the AI tool never shows a\n      // hook error for our telemetry. The failure is still visible for debugging\n      // via RULEMETRIC_HOOK_DEBUG (and the script's own _rulemetric_log).\n      const code = (error as { status?: number; message?: string }).status;\n      if (process.env.RULEMETRIC_HOOK_DEBUG) {\n        process.stderr.write(\n          `[rulemetric hooks run ${hookName}] non-fatal exit ${code ?? '?'}: ${(error as { message?: string }).message ?? ''}\\n`,\n        );\n      }\n      // process.exitCode intentionally left 0.\n    }\n  }\n\n  private readStdin(): Promise<string> {\n    return new Promise((resolve) => {\n      const chunks: Buffer[] = [];\n      process.stdin.on('data', (chunk) => chunks.push(chunk));\n      process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));\n      // If stdin is already closed (no piped input), resolve immediately\n      if (process.stdin.readableEnded) {\n        resolve(Buffer.concat(chunks).toString('utf-8'));\n      }\n    });\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;AAAA,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,MAAM,iBAAiB;AAGhC,IAAM,cAAc,CAAC,iBAAiB,eAAe,eAAe,iBAAiB,oBAAoB;AAEzG,IAAqB,WAArB,MAAqB,kBAAiB,YAAY;AAAA,EAChD,OAAgB,cAAc;AAAA,EAC9B,OAAgB,SAAS;AAAA,EAEzB,OAAgB,OAAO;AAAA,IACrB,MAAM,KAAK,OAAO;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS,CAAC,GAAG,WAAW;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,MAAM,SAAQ;AAC1C,UAAM,WAAW,KAAK;AAGtB,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,+BAA+B;AACnE,UAAM,aAAa,KAAK,YAAY,GAAG,QAAQ,KAAK;AAEpD,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAK,MAAM,0BAA0B,UAAU,EAAE;AAAA,IACnD;AAEA,QAAI;AAEF,YAAM,QAAQ,MAAM,KAAK,UAAU;AAMnC,YAAM,gBAAgB,GAAG,QAAQ,IAAI,QAAQ,EAAE,GAAG,SAAS,GAAG,UAAU;AAIxE,YAAM,UAAU,aAAa,gBAAgB,MAAS;AACtD,mBAAa,QAAQ,CAAC,UAAU,GAAG;AAAA,QACjC,OAAO;AAAA,QACP,OAAO,CAAC,QAAQ,WAAW,SAAS;AAAA,QACpC;AAAA,QACA,KAAK,EAAE,GAAG,QAAQ,KAAK,MAAM,cAAc;AAAA,MAC7C,CAAC;AAQD,UACE,QAAQ,IAAI,yBAAyB,iBACrC,aAAa,iBACb;AACA,YAAI;AACF,gBAAM,EAAE,0BAA0B,IAAI,MAAM,OAC1C,qCACF;AACA,gBAAM,0BAA0B,KAAK;AAAA,QACvC,SAAS,KAAK;AACZ,kBAAQ,OAAO;AAAA,YACb,wBAAyB,IAAc,OAAO;AAAA;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AAQvB,YAAM,OAAQ,MAAgD;AAC9D,UAAI,QAAQ,IAAI,uBAAuB;AACrC,gBAAQ,OAAO;AAAA,UACb,yBAAyB,QAAQ,oBAAoB,QAAQ,GAAG,KAAM,MAA+B,WAAW,EAAE;AAAA;AAAA,QACpH;AAAA,MACF;AAAA,IAEF;AAAA,EACF;AAAA,EAEQ,YAA6B;AACnC,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,YAAM,SAAmB,CAAC;AAC1B,cAAQ,MAAM,GAAG,QAAQ,CAAC,UAAU,OAAO,KAAK,KAAK,CAAC;AACtD,cAAQ,MAAM,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC;AAE9E,UAAI,QAAQ,MAAM,eAAe;AAC/B,gBAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO,CAAC;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
+  "mappings": ";;;;;;;;;;;;AAAA,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,MAAM,iBAAiB;AAGhC,IAAM,cAAc,CAAC,iBAAiB,eAAe,eAAe,iBAAiB,oBAAoB;AAEzG,IAAqB,WAArB,MAAqB,kBAAiB,YAAY;AAAA,EAChD,OAAgB,cAAc;AAAA,EAC9B,OAAgB,SAAS;AAAA,EAEzB,OAAgB,OAAO;AAAA,IACrB,MAAM,KAAK,OAAO;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS,CAAC,GAAG,WAAW;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,MAAM,SAAQ;AAC1C,UAAM,WAAW,KAAK;AAGtB,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,+BAA+B;AACnE,UAAM,aAAa,KAAK,YAAY,GAAG,QAAQ,KAAK;AAEpD,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAK,MAAM,0BAA0B,UAAU,EAAE;AAAA,IACnD;AAEA,QAAI;AAEF,YAAM,QAAQ,MAAM,KAAK,UAAU;AAMnC,YAAM,gBAAgB,GAAG,QAAQ,IAAI,QAAQ,EAAE,GAAG,SAAS,GAAG,UAAU;AAIxE,YAAM,UAAU,aAAa,gBAAgB,MAAS;AACtD,mBAAa,QAAQ,CAAC,UAAU,GAAG;AAAA,QACjC,OAAO;AAAA,QACP,OAAO,CAAC,QAAQ,WAAW,SAAS;AAAA,QACpC;AAAA,QACA,KAAK,EAAE,GAAG,QAAQ,KAAK,MAAM,cAAc;AAAA,MAC7C,CAAC;AAQD,UACE,QAAQ,IAAI,yBAAyB,iBACrC,aAAa,iBACb;AACA,YAAI;AACF,gBAAM,EAAE,0BAA0B,IAAI,MAAM,OAC1C,qCACF;AACA,gBAAM,0BAA0B,KAAK;AAAA,QACvC,SAAS,KAAK;AACZ,kBAAQ,OAAO;AAAA,YACb,wBAAyB,IAAc,OAAO;AAAA;AAAA,UAChD;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AAQvB,YAAM,OAAQ,MAAgD;AAC9D,UAAI,QAAQ,IAAI,uBAAuB;AACrC,gBAAQ,OAAO;AAAA,UACb,yBAAyB,QAAQ,oBAAoB,QAAQ,GAAG,KAAM,MAA+B,WAAW,EAAE;AAAA;AAAA,QACpH;AAAA,MACF;AAAA,IAEF;AAAA,EACF;AAAA,EAEQ,YAA6B;AACnC,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,YAAM,SAAmB,CAAC;AAC1B,cAAQ,MAAM,GAAG,QAAQ,CAAC,UAAU,OAAO,KAAK,KAAK,CAAC;AACtD,cAAQ,MAAM,GAAG,OAAO,MAAM,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC;AAE9E,UAAI,QAAQ,MAAM,eAAe;AAC/B,gBAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO,CAAC;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
   "names": []
 }