@scopebond/hook 0.3.0 → 0.5.0

package/README.md

@@ -1,26 +1,60 @@
 # @scopebond/hook
 
-The Scopebond connector for **Claude Code** and **Cursor**. It checks every tool
+The Scopebond connector for **Claude Code**, **Cursor**, and **OpenAI Codex**. It checks every tool
 call a coding agent makes against your policy *before it runs*, blocks the ones
 outside policy, and records a signed receipt — locally, on the machine, and
 optionally mirrored to your Scopebond Cloud workspace for monitoring.
 
-- **Label:** in-path · prevents (a Claude Code `PreToolUse` deny via exit code 2
-  blocks even in bypass-permissions mode).
-- **Ceiling:** it governs actions the harness routes through its tool system
+- **What it does:** checks supported agent actions before they run and blocks an
+  action when it breaks your policy.
+- **Where it works:** actions the coding agent routes through its tool system
   (shell, file, MCP, web). A process started outside the harness is not covered.
 
-## Enroll
+## Install once for your machine
 
 ```
-npx @scopebond/hook init            # Claude Code (or: init --cursor)
+npm i -g @scopebond/hook
+scopebond install                   # detects Cursor and Codex
+scopebond install --codex           # set up Codex only
 ```
 
-`init` scaffolds `.scopebond/` (a machine signing key, a countersigning key, a
-starter policy — "protect main and production paths" — and a `.gitignore` so none
-of it is committed) and prints the hook configuration to add to
-`.claude/settings.json` or `.cursor/hooks.json`. Then run one safe command in the
-agent and see the receipt in `.scopebond/receipts.db`.
+`install` sets Scopebond up **once per developer machine**, not per repository: it
+scaffolds a user-level home (`~/.scopebond`, override `SCOPEBOND_HOME`) with a
+signing key, a countersigning key and a starter policy, and registers the hook by
+absolute path in your user-level `~/.claude/settings.json`, `~/.cursor/hooks.json`,
+or `~/.codex/hooks.json`. After Codex setup, open Codex, run `/hooks`, review
+Scopebond, and choose **Trust** once. Every project you open is then governed, and a project-local
+`.scopebond/` still takes precedence when you want a per-repo policy.
+
+```
+scopebond status                    # home, which agents are configured, cloud, receipts
+scopebond doctor                    # node version, config location, cloud reachability
+scopebond log                       # recent decisions        scopebond verify   # offline
+scopebond uninstall                 # remove the hook (add --purge to delete keys too)
+```
+
+### Install as a Claude Code plugin
+
+Scopebond is also a Claude Code plugin (this repo is a plugin marketplace):
+
+```
+/plugin marketplace add avouro-com/scopebond
+/plugin install scopebond
+```
+
+### Per-repository enroll (alternative)
+
+```
+npx @scopebond/hook init            # Claude Code
+npx @scopebond/hook init --cursor   # Cursor
+npx @scopebond/hook init --codex    # Codex, then approve it once with /hooks
+```
+
+`init` scaffolds `.scopebond/` in the current project (a machine signing key, a
+countersigning key, a starter policy — "protect main and production paths" — and a
+`.gitignore` so none of it is committed) and configures `.claude/settings.json`,
+`.cursor/hooks.json`, or `.codex/hooks.json`. Then run one safe command in the agent and see the receipt in
+`.scopebond/receipts.db`.
 
 ## Connect it to your workspace (optional)
 
@@ -32,11 +66,13 @@ as `scopebond-enrollment.json`, then:
 npx @scopebond/hook connect https://<your-workspace> scopebond-enrollment.json
 ```
 
+In Windows PowerShell, use `npx.cmd` instead of `npx` if script execution policy blocks `npx.ps1`; no execution-policy change is needed. Enrollment registers both the gateway attester and the hook's separate agent signing key with proof of possession, so Cloud can verify authenticated receipts.
+
 `connect` does the whole setup in one command: it scaffolds `.scopebond/` if needed,
 enrolls this machine's countersigning key, stores a scoped machine credential in
-`.scopebond/cloud.json` (a secret — never commit it), **and configures Claude Code
-for you** (it merges the hook into `.claude/settings.json`, preserving anything
-already there — pass `--no-install` to skip, or `--cursor` for Cursor). The
+`.scopebond/cloud.json` (a secret — never commit it), **and configures your coding
+agent for you** (it merges the hook into the agent's settings, preserving anything
+already there — pass `--no-install` to skip, `--cursor` for Cursor, or `--codex` for Codex). The
 enrollment argument can be a file, an inline blob, or JSON on stdin, so the portal
 can hand you a single copy-paste command with nothing to save.
 
@@ -51,8 +87,8 @@ anything still queued — run it on a session-end hook (and set
 Each tool call is mapped to a normalized [Action Taxonomy](https://github.com/avouro-com/scopebond)
 action (`shell.exec`, `git.push`, `file.write`, `mcp.tool.call`, …), signed by the
 machine key and decided against your policy by an in-process check-only gateway.
-An allowed action is a **cooperative allow** (recorded, never executed by the
-hook — the agent performs it); a denied action is blocked. Unknown tools are
+An allowed action is recorded and left to the coding agent's normal permission
+prompt; the hook never auto-approves it. A denied action is blocked. Unknown tools are
 recorded as *not evaluated* and grant nothing. Anything unexpected fails closed
 (deny) with a repair message.
 
@@ -68,10 +104,10 @@ unmapped tools too — fail-closed coverage for anything the taxonomy does not m
 The mapper and runtime are exported for testing and embedding:
 
 ```js
-import { mapClaudeToolUse, createHookRuntime } from "@scopebond/hook";
+import { mapClaudeToolUse, mapCodexToolUse, createHookRuntime } from "@scopebond/hook";
 ```
 
-`mapClaudeToolUse` / `mapCursorEvent` are pure functions (native payload →
+`mapClaudeToolUse`, `mapCursorEvent`, and `mapCodexToolUse` are pure functions (native payload →
 normalized action). `createHookRuntime` builds the check-only gateway from a
 policy, a machine key and a local receipt log; pass `cloud: { connection }` (from
 `connectCloud`) to mirror receipts to a workspace.

package/dist/cli.js

@@ -4,8 +4,9 @@
 //
 //   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)
 //   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)
-//   scopebond-hook init [--cursor] [--no-install]  scaffold keys + starter policy and configure the agent
-//   scopebond-hook connect <url> <bundle.json> [--cursor]
+//   scopebond-hook codex                      evaluate a Codex PreToolUse call (stdin JSON)
+//   scopebond-hook init [--cursor|--codex] [--no-install]
+//   scopebond-hook connect <url> <bundle.json> [--cursor|--codex]
 //                                             enroll with a Cloud workspace and start exporting
 //   scopebond-hook log [-n N]                 show the most recent local receipts
 //   scopebond-hook verify                     verify every local receipt offline against the attester key
@@ -20,10 +21,13 @@ import { tmpdir } from "node:os";
 import { execFileSync } from "node:child_process";
 import { verifyReceipt } from "@scopebond/gateway";
 import { openReceiptStore, loadOrCreateAttester } from "@scopebond/gateway/node";
-import { mapClaudeToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
+import { mapClaudeToolUse, mapCodexToolUse, mapCursorEvent, fillPushBranch } from "./map.js";
 import { createHookRuntime } from "./runtime.js";
 import { scaffold, harnessSnippet, installHarness } from "./init.js";
+import { userHome, userHarnessFile, resolveConfigDir, writeHarnessConfig, removeHarnessConfig, cursorDetected, codexDetected, absoluteHookCommand, isHarnessConfigured, purgeHome, } from "./install.js";
 import { connectCloud, loadConnection } from "./cloud.js";
+import { cliCommand, hookVersion } from "./version.js";
+import { fileURLToPath } from "node:url";
 /** The current git branch in `cwd` (best-effort). A bare `git push` pushes it, so
  *  the runtime fills it in before evaluating; on failure the ref stays absent and
  *  the starter policy fails closed. */
@@ -90,30 +94,48 @@ function denyClaude(reason) {
     process.stderr.write(`Scopebond: ${reason}\n`);
     process.exit(2);
 }
-async function runClaude() {
+/** Codex accepts the structured deny response on a successful hook exit. Keeping
+ *  exit 0 lets its UI show a completed policy check instead of a failed hook while
+ *  still preventing the tool call. */
+function denyCodex(reason) {
+    process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason },
+    }) + "\n");
+    process.exit(0);
+}
+const harnessName = (harness) => harness === "claude" ? "Claude Code" : harness === "cursor" ? "Cursor" : "Codex";
+const harnessFileName = (harness) => harness === "claude" ? ".claude/settings.json" : harness === "cursor" ? ".cursor/hooks.json" : ".codex/hooks.json";
+const selectedHarness = (args) => args.includes("--codex") ? "codex" : args.includes("--cursor") ? "cursor" : "claude";
+const codexTrustStep = "Open Codex, run `/hooks`, review Scopebond, and choose Trust. Then start a new task.";
+async function runPreToolUse(mapper, deny = denyClaude) {
     let input;
     try {
         input = JSON.parse(readStdin());
     }
     catch {
-        denyClaude("hook received invalid JSON on stdin");
+        deny("hook received invalid JSON on stdin");
     }
     try {
         const cwd = input?.cwd ? String(input.cwd) : process.cwd();
-        const runtime = createHookRuntime(runtimePaths(configDir()));
-        const decision = await runtime.evaluate(fillPushBranch(mapClaudeToolUse(input), currentBranch(cwd)));
+        const runtime = createHookRuntime(runtimePaths(resolveConfigDir(cwd)));
+        const decision = await runtime.evaluate(fillPushBranch(mapper(input), currentBranch(cwd)));
         await runtime.flush();
         if (decision.decision === "deny")
-            denyClaude(decision.reason);
-        // allow and not_evaluated both DEFER to Claude Code's own permission flow: the
-        // hook records the receipt but never returns permissionDecision:"allow", which
-        // would suppress the user's normal review. Scopebond blocks; it does not approve.
+            deny(decision.reason);
+        // Stay silent on allow/not_evaluated so the coding agent's normal permission
+        // flow remains in charge. Scopebond blocks; it never silently approves.
         process.exit(0);
     }
     catch (error) {
-        denyClaude(`Scopebond hook failed closed: ${error.message}. Repair: run \`scopebond-hook init\`.`);
+        deny(`Scopebond hook failed closed: ${error.message}. Repair: run \`${cliCommand("init")}\`.`);
     }
 }
+async function runClaude() {
+    await runPreToolUse(mapClaudeToolUse);
+}
+async function runCodex() {
+    await runPreToolUse(mapCodexToolUse, denyCodex);
+}
 async function runCursor() {
     let input = {};
     try {
@@ -125,7 +147,7 @@ async function runCursor() {
     let message = "Scopebond hook failed closed";
     try {
         const cwd = input?.cwd ? String(input.cwd) : process.cwd();
-        const runtime = createHookRuntime(runtimePaths(configDir()));
+        const runtime = createHookRuntime(runtimePaths(resolveConfigDir(cwd)));
         const decision = await runtime.evaluate(fillPushBranch(mapCursorEvent(event, input), currentBranch(cwd)));
         await runtime.flush();
         // Only an out-of-policy action is denied outright; an allowed or unevaluated
@@ -135,13 +157,13 @@ async function runCursor() {
     }
     catch (error) {
         permission = "deny";
-        message = `Scopebond hook failed closed: ${error.message}. Repair: run \`scopebond-hook init\`.`;
+        message = `Scopebond hook failed closed: ${error.message}. Repair: run \`${cliCommand("init")}\`.`;
     }
     process.stdout.write(JSON.stringify({ permission, agentMessage: message }) + "\n");
     process.exit(0);
 }
 function runInit(args) {
-    const harness = args.includes("--cursor") ? "cursor" : "claude";
+    const harness = selectedHarness(args);
     const dir = configDir();
     const { agentKid, policyPath } = scaffold(dir, { force: args.includes("--force") });
     console.log(`Scopebond hook enrolled in ${dir}`);
@@ -152,16 +174,20 @@ function runInit(args) {
     // hand-editing step; --no-install prints the snippet instead.
     if (!args.includes("--no-install")) {
         const file = installHarness(harness);
-        console.log(`✓ ${harness === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+        console.log(`✓ ${harnessName(harness)} configured in ${file}`);
+        if (harness === "codex")
+            console.log(`\nOne last step: ${codexTrustStep}`);
     }
     else {
-        console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+        console.log(`Add this to your ${harnessFileName(harness)}:`);
         console.log(harnessSnippet(harness));
     }
     console.log("");
-    console.log("Next: run one command in the agent, then `scopebond-hook log` to see the receipt");
-    console.log("and `scopebond-hook verify` to check it offline. Try `scopebond-hook test \"rm -rf /\"`.");
-    console.log("To send receipts to a workspace: scopebond-hook connect <workspace-url> <enrollment>");
+    // Print the runnable `npx` form: after `npx @scopebond/hook init` there is no
+    // `scopebond-hook` binary on PATH, so a bare `scopebond-hook log` would fail.
+    console.log(`Next: run one command in the agent, then \`${cliCommand("log")}\` to see the receipt`);
+    console.log(`and \`${cliCommand("verify")}\` to check it offline. Try \`${cliCommand('test "rm -rf /"')}\`.`);
+    console.log(`To send receipts to a workspace: ${cliCommand("connect <workspace-url> <enrollment>")}`);
 }
 function decisionOf(payload) {
     const rr = String(payload.realtime_result ?? "");
@@ -183,7 +209,7 @@ function describeIntent(payload) {
     return `${String(intent.action_type ?? "?")}${bits ? ` ${bits}` : ""}`;
 }
 async function runLog(args) {
-    const dir = configDir();
+    const dir = resolveConfigDir(process.cwd());
     const dbPath = join(dir, "receipts.db");
     if (!existsSync(dbPath)) {
         console.log("no receipts yet — run a command in the agent first.");
@@ -202,10 +228,10 @@ async function runLog(args) {
         const p = r.payload;
         console.log(`${String(p.timestamp ?? "")}  ${decisionOf(p).padEnd(13)}  ${describeIntent(p)}`);
     }
-    console.log(`\n${recent.length} of ${all.length} receipt(s). Verify them: scopebond-hook verify`);
+    console.log(`\n${recent.length} of ${all.length} receipt(s). Verify them: ${cliCommand("verify")}`);
 }
 async function runVerify() {
-    const dir = configDir();
+    const dir = resolveConfigDir(process.cwd());
     const dbPath = join(dir, "receipts.db");
     const attesterPath = join(dir, "attester.key");
     if (!existsSync(dbPath) || !existsSync(attesterPath)) {
@@ -240,7 +266,7 @@ async function runTest(args) {
         console.error('usage: scopebond-hook test "<shell command>"');
         process.exit(1);
     }
-    const dir = configDir();
+    const dir = resolveConfigDir(process.cwd());
     if (!existsSync(join(dir, "policy.json"))) {
         console.error("no policy yet — run `scopebond-hook init` first.");
         process.exit(1);
@@ -272,9 +298,9 @@ async function runConnect(args) {
     const positional = args.filter((a) => !a.startsWith("--"));
     const url = positional[0];
     const bundleArg = positional[1];
-    const harness = args.includes("--cursor") ? "cursor" : "claude";
+    const harness = selectedHarness(args);
     if (!url) {
-        console.error("usage: scopebond-hook connect <workspace-url> <enrollment> [--cursor] [--no-install]");
+        console.error("usage: scopebond-hook connect <workspace-url> <enrollment> [--claude|--cursor|--codex] [--no-install]");
         process.exit(1);
     }
     const dir = configDir();
@@ -298,10 +324,12 @@ async function runConnect(args) {
         // caller opts out. This removes the "paste this snippet" step.
         if (!args.includes("--no-install")) {
             const file = installHarness(harness);
-            console.log(`✓ ${harness === "cursor" ? "Cursor" : "Claude Code"} configured in ${file}`);
+            console.log(`✓ ${harnessName(harness)} configured in ${file}`);
+            if (harness === "codex")
+                console.log(`\nOne last step: ${codexTrustStep}`);
         }
         else {
-            console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+            console.log(`Add this to your ${harnessFileName(harness)}:`);
             console.log(harnessSnippet(harness));
         }
         console.log("");
@@ -313,7 +341,7 @@ async function runConnect(args) {
     }
 }
 async function runFlush() {
-    const dir = configDir();
+    const dir = resolveConfigDir(process.cwd());
     if (!loadConnection(dir)) {
         console.error("not connected to a workspace; run `scopebond-hook connect` first");
         process.exit(1);
@@ -321,8 +349,122 @@ async function runFlush() {
     const runtime = createHookRuntime(runtimePaths(dir));
     await runtime.exporter?.flush();
     const status = runtime.exporter?.status();
+    runtime.exporter?.stop();
     console.log(`flushed; ${status?.pending ?? 0} receipt(s) still pending${status?.lastError ? ` (last error: ${status.lastError})` : ""}`);
-    process.exit(status && status.pending > 0 ? 1 : 0);
+    // Let pending HTTP handles close normally (forced exit can abort on Windows).
+    process.exitCode = status && status.pending > 0 ? 1 : 0;
+}
+/** The absolute path to this CLI file, for registering the hook by absolute path. */
+function cliPath() {
+    return fileURLToPath(import.meta.url);
+}
+/** `install` — the once-per-machine, user-level install (SB112). Scaffolds the
+ *  user home and registers the hook by absolute path in the user-level agent config,
+ *  so every project a developer opens is governed without a per-repo `init`. */
+function runInstall(args) {
+    const dir = userHome();
+    const { agentKid, policyPath } = scaffold(dir, { force: args.includes("--force") });
+    console.log(`Scopebond installed for this user in ${dir}`);
+    console.log(`  machine key    ${agentKid}`);
+    console.log(`  policy         ${policyPath} (starter — edit the limits)`);
+    console.log("");
+    const harnesses = args.includes("--codex") ? ["codex"]
+        : args.includes("--cursor") ? ["cursor"]
+            : args.includes("--claude") ? ["claude"]
+                : ["claude", ...(cursorDetected() ? ["cursor"] : []), ...(codexDetected() ? ["codex"] : [])];
+    if (!args.includes("--no-install")) {
+        for (const h of harnesses) {
+            const file = writeHarnessConfig(userHarnessFile(h), h, absoluteHookCommand(cliPath(), h));
+            console.log(`✓ ${harnessName(h)} configured in ${file}`);
+        }
+    }
+    else {
+        console.log("Add this to your user-level agent config:");
+        console.log(harnessSnippet(harnesses[0]));
+    }
+    if (harnesses.includes("codex"))
+        console.log(`\nOne last step for Codex: ${codexTrustStep}`);
+    console.log("");
+    console.log("A project-local .scopebond still takes precedence when present.");
+    console.log(`Check it: ${cliCommand("doctor")} · see decisions: ${cliCommand("log")}`);
+    console.log(`To send receipts to a workspace: ${cliCommand("connect <workspace-url> <enrollment>")}`);
+}
+function runStatus() {
+    const home = userHome();
+    const installed = existsSync(join(home, "policy.json"));
+    const claude = isHarnessConfigured(userHarnessFile("claude"));
+    const cursor = isHarnessConfigured(userHarnessFile("cursor"));
+    const codex = isHarnessConfigured(userHarnessFile("codex"));
+    const connected = !!loadConnection(resolveConfigDir(process.cwd()));
+    const dbPath = join(resolveConfigDir(process.cwd()), "receipts.db");
+    console.log(`Scopebond hook ${hookVersion()}`);
+    console.log(`  user home        ${home} ${installed ? "(installed)" : "(not installed — run `scopebond install`)"}`);
+    console.log(`  active config    ${resolveConfigDir(process.cwd())}`);
+    console.log(`  Claude Code      ${claude ? "configured" : "not configured"}`);
+    console.log(`  Cursor           ${cursor ? "configured" : cursorDetected() ? "detected, not configured" : "not detected"}`);
+    console.log(`  Codex            ${codex ? "configured (approve once with /hooks)" : codexDetected() ? "detected, not configured" : "not detected"}`);
+    console.log(`  cloud workspace  ${connected ? "connected" : "not connected (local only)"}`);
+    console.log(`  local receipts   ${existsSync(dbPath) ? dbPath : "none yet"}`);
+}
+async function runDoctor() {
+    const problems = [];
+    const [major, minor] = process.versions.node.split(".").map(Number);
+    const nodeOk = major > 22 || (major === 22 && minor >= 13);
+    console.log(`Scopebond doctor`);
+    console.log(`  node             ${process.versions.node} ${nodeOk ? "ok" : "TOO OLD (need >=22.13)"}`);
+    if (!nodeOk)
+        problems.push("node >=22.13 is required (the Cloud outbox uses node:sqlite)");
+    const cli = cliPath();
+    console.log(`  cli              ${cli} ${existsSync(cli) ? "ok" : "MISSING"}`);
+    const active = resolveConfigDir(process.cwd());
+    const hasPolicy = existsSync(join(active, "policy.json"));
+    console.log(`  active config    ${active} ${hasPolicy ? "ok" : "no policy (run `scopebond install` or `init`)"}`);
+    if (!hasPolicy)
+        problems.push("no policy found in the active config dir");
+    const codex = isHarnessConfigured(userHarnessFile("codex"));
+    console.log(`  Codex hook       ${codex ? "configured" : codexDetected() ? "not configured — run `scopebond install --codex`" : "not detected"}`);
+    if (codex)
+        console.log(`  Codex approval   run /hooks in Codex and approve Scopebond once`);
+    const connection = loadConnection(active);
+    if (!connection) {
+        console.log(`  cloud            not connected (local only) — receipts stay on this machine`);
+    }
+    else {
+        let reachable = "unknown";
+        try {
+            const res = await fetch(new URL("/healthz", connection.url).toString(), { method: "GET" });
+            reachable = res.ok ? "reachable" : `unhealthy (${res.status})`;
+        }
+        catch (error) {
+            reachable = `unreachable (${error.message})`;
+        }
+        console.log(`  cloud            ${connection.url} — ${reachable}`);
+    }
+    console.log(problems.length ? `\n${problems.length} problem(s): ${problems.join("; ")}` : `\nAll good.`);
+    process.exitCode = problems.length ? 1 : 0;
+}
+function runUninstall(args) {
+    let removed = 0;
+    for (const h of ["claude", "cursor", "codex"]) {
+        if (removeHarnessConfig(userHarnessFile(h))) {
+            console.log(`✓ removed the Scopebond hook from ${userHarnessFile(h)}`);
+            removed++;
+        }
+    }
+    if (removed === 0)
+        console.log("no user-level harness config found.");
+    if (args.includes("--purge")) {
+        purgeHome();
+        console.log(`✓ purged ${userHome()} (keys, policy, receipts)`);
+    }
+    else
+        console.log(`Kept ${userHome()} (keys, policy, receipts). Use --purge to remove it too.`);
+}
+function runLogin() {
+    console.log("Device-code login is not available yet.");
+    console.log(`For now, connect with a one-time enrollment from your workspace:`);
+    console.log(`  ${cliCommand("connect <workspace-url> <enrollment>")}`);
+    process.exit(0);
 }
 const [cmd, ...rest] = process.argv.slice(2);
 if (cmd === "claude") {
@@ -331,9 +473,15 @@ if (cmd === "claude") {
 else if (cmd === "cursor") {
     await runCursor();
 }
+else if (cmd === "codex") {
+    await runCodex();
+}
 else if (cmd === "init") {
     runInit(rest);
 }
+else if (cmd === "install") {
+    runInstall(rest);
+}
 else if (cmd === "connect") {
     await runConnect(rest);
 }
@@ -349,8 +497,20 @@ else if (cmd === "test") {
 else if (cmd === "flush") {
     await runFlush();
 }
+else if (cmd === "status") {
+    runStatus();
+}
+else if (cmd === "doctor") {
+    await runDoctor();
+}
+else if (cmd === "uninstall") {
+    runUninstall(rest);
+}
+else if (cmd === "login") {
+    runLogin();
+}
 else {
-    console.error("usage: scopebond-hook <claude|cursor|init|connect|log|verify|test|flush> [--cursor] [--force] [--strict] [--no-install]");
+    console.error("usage: scopebond <claude|cursor|codex|init|install|connect|log|verify|test|flush|status|doctor|uninstall|login> [--cursor] [--claude] [--codex] [--force] [--strict] [--no-install] [--purge]");
     process.exit(1);
 }
 //# sourceMappingURL=cli.js.map