@tanagram/cli 0.4.10 → 0.4.13

package/README.md

@@ -1,4 +1,4 @@
-# Tanagram
+# Tanagram CLI
 
 A lightweight Go CLI that enforces policies from `AGENTS.md` files on your local git changes.
 
@@ -23,8 +23,10 @@ webui/src/Button.tsx:42 - [No hardcoded colors] Don't use hard-coded color value
 # 1. Install globally via npm
 npm install -g @tanagram/cli
 
-# 2. Setup Claude Code hook (automatic)
+# 2. Automatically add a Claude Code hook
 tanagram config claude
+# and/or if you use Cursor:
+tanagram config cursor
 
 # 3. Run tanagram (will prompt for API key on first run)
 tanagram
@@ -45,28 +47,6 @@ Tanagram uses Claude AI (via Anthropic API) to extract policies from your instru
 2. Create an API key in the dashboard
 3. Run `tanagram` and enter your key when prompted
 
-### Local Development
-
-```bash
-cd cli
-npm install  # Builds the Go binary
-./bin/tanagram
-```
-
-### Install Locally for Testing
-
-Install globally from the local directory to test as if it were published:
-
-```bash
-cd /Users/molinar/tanagram/cli
-npm install -g .
-```
-
-Then run from anywhere:
-```bash
-tanagram
-```
-
 ## Usage
 
 ```bash
@@ -113,35 +93,26 @@ tanagram config list
 **Manual setup (alternative):**
 If you prefer to manually edit your settings, add this to your `~/.claude/settings.json` (user settings) or `.claude/settings.json` (project settings):
 
-```json
-"hooks": {
-  "PostToolUse": [
-    {
-      "matcher": "Edit|Write",
-      "hooks": [
-        {
-          "type": "command",
-          "command": "tanagram"
-        }
-      ]
-    }
-  ]
-}
-```
-
-For example, your full `settings.json` file might look like this:
-
 ```json
 {
-  "alwaysThinkingEnabled": true,
   "hooks": {
-    "PostToolUse": [
+    "SessionStart": [
       {
-        "matcher": "Edit|Write",
         "hooks": [
           {
-            "type": "command",
-            "command": "tanagram"
+            "command": "tanagram snapshot",
+            "type": "command"
+          }
+        ],
+        "matcher": "startup|clear"
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "command": "tanagram",
+            "type": "command"
           }
         ]
       }
@@ -152,6 +123,45 @@ For example, your full `settings.json` file might look like this:
 
 If you have existing hooks, you can merge this hook into your existing config.
 
+### Cursor Hook
+
+Install the CLI as a Cursor Code [hook](https://cursor.com/docs/agent/hooks) to have Cursor automatically iterate on Tanagram's output.
+
+**Easy setup (recommended):**
+```bash
+tanagram config cursor
+```
+
+This automatically adds the hook to your `~/.cursor/hooks.json`. It's safe to run multiple times and will preserve any existing settings.
+
+**Check hook status:**
+```bash
+tanagram config list
+```
+
+**Manual setup (alternative):**
+If you prefer to manually edit your settings, add this to your `~/.cursor/hooks.json` (user settings) or `.cursor/hooks.json` (project settings):
+
+```json
+{
+  "hooks": {
+    "beforeSubmitPrompt": [
+      {
+        "command": "tanagram snapshot"
+      }
+    ],
+    "stop": [
+      {
+        "command": "tanagram"
+      }
+    ]
+  },
+  "version": 1
+}
+```
+
+If you have existing hooks, you can merge this hook into your existing config.
+
 
 ## How It Works
 
@@ -171,24 +181,6 @@ Policies are cached in `.tanagram/cache.gob` at your git repository root. Add th
 .tanagram/
 ```
 
-## Fully LLM-Based Architecture
-
-Tanagram uses **100% LLM-powered** policy extraction and enforcement:
-
-### Extraction Phase
-Claude AI extracts **ALL** policies from instruction files:
-- No classification needed (no MUST_NOT_USE, MUST_USE, etc.)
-- No regex pattern generation
-- Simple: Just extract policy names and descriptions
-- Fast: Simpler prompts = faster responses
-
-### Detection Phase
-Claude AI analyzes code changes against all policies:
-- **Semantic understanding** - Not just pattern matching
-- **Context-aware** - Understands code intent and structure
-- **Language-agnostic** - Works with any programming language
-- **Detailed reasoning** - Explains why code violates each policy
-
 ### What Can Be Enforced
 
 **Everything!** Because the LLM reads and understands code like a human:
@@ -210,7 +202,7 @@ Claude AI analyzes code changes against all policies:
 - Won't flag Go code for missing Python type hints
 - Understands JavaScript !== Python !== Go
 
-## Exit Codes
+### Exit Codes
 
 - `0` - No violations found
 - `2` - Violations found (triggers Claude Code automatic fix behavior)
@@ -246,6 +238,28 @@ Then run `tanagram` to enforce them locally!
 
 **Note:** For `.mdc` files, Tanagram extracts policies from the markdown content only (YAML frontmatter is used by Cursor and ignored during policy extraction).
 
+## Tanagram Web Integration
+
+You can also use [Tanagram](https://tanagram.ai) to manage policies across your organization and enforce them on PRs.
+If you have policies defined online, you can enforce them while you develop locally with the CLI as well.
+
+```bash
+# Connect your account
+tanagram login
+
+# Download policies from your Tanagram account and cache them locally
+tanagram sync
+```
+
+For customers with an on-prem installation, set the `TANAGRAM_WEB_HOSTNAME` environment variable to the URL of your Tanagram instance — for example:
+
+```bash
+export TANAGRAM_WEB_HOSTNAME=https://yourcompany.tanagram.ai
+
+tanagram login
+tanagram sync
+```
+
 ---
 
 Built by [@fluttermatt](https://x.com/fluttermatt) and the [Tanagram](https://tanagram.ai/) team. Talk to us [on Twitter](https://x.com/tanagram_) or email: founders AT tanagram.ai

package/api/client.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/tanagram/cli/auth"
@@ -50,8 +52,16 @@ type PolicyListResponse struct {
 
 // getAPIBaseURL returns the API base URL
 func getAPIBaseURL() string {
-	if url := os.Getenv("TANAGRAM_API_URL"); url != "" {
-		return url
+	if urlStr := os.Getenv("TANAGRAM_WEB_HOSTNAME"); urlStr != "" {
+		u, err := url.Parse(urlStr)
+		if err != nil {
+			return urlStr
+		}
+		if !strings.HasPrefix(u.Host, "api-") {
+			u.Host = "api-" + u.Host
+			return u.String()
+		}
+		return urlStr
 	}
 	return "https://api.tanagram.ai"
 }

package/api/client_test.go

@@ -0,0 +1,53 @@
+package api
+
+import (
+	"os"
+	"testing"
+)
+
+func TestGetAPIBaseURL(t *testing.T) {
+	// Save original env var
+	orig := os.Getenv("TANAGRAM_WEB_HOSTNAME")
+	defer os.Setenv("TANAGRAM_WEB_HOSTNAME", orig)
+
+	tests := []struct {
+		name     string
+		envValue string
+		want     string
+	}{
+		{
+			name:     "default",
+			envValue: "",
+			want:     "https://api.tanagram.ai",
+		},
+		{
+			name:     "with api- prefix",
+			envValue: "https://api-runway.tanagram.ai",
+			want:     "https://api-runway.tanagram.ai",
+		},
+		{
+			name:     "without api- prefix",
+			envValue: "https://runway.tanagram.ai",
+			want:     "https://api-runway.tanagram.ai",
+		},
+		{
+			name:     "http without api- prefix",
+			envValue: "http://localhost:8080",
+			want:     "http://api-localhost:8080",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.envValue == "" {
+				os.Unsetenv("TANAGRAM_WEB_HOSTNAME")
+			} else {
+				os.Setenv("TANAGRAM_WEB_HOSTNAME", tt.envValue)
+			}
+
+			if got := getAPIBaseURL(); got != tt.want {
+				t.Errorf("getAPIBaseURL() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

package/commands/config.go

@@ -22,36 +22,36 @@ func ConfigClaude(settingsPath string) error {
 		settings["hooks"] = hooks
 	}
 
-	// Check if PreToolUse exists
-	preToolUse, preToolUseExist := hooks["PreToolUse"].([]interface{})
-	if !preToolUseExist {
-		preToolUse = []interface{}{}
+	// Check if SessionStart exists
+	sessionStart, sessionStartExist := hooks["SessionStart"].([]interface{})
+	if !sessionStartExist {
+		sessionStart = []interface{}{}
 	}
 
-	// Check if PostToolUse exists
-	postToolUse, postToolUseExist := hooks["PostToolUse"].([]interface{})
-	if !postToolUseExist {
-		postToolUse = []interface{}{}
+	// Check if Stop exists
+	stopHooks, stopHooksExist := hooks["Stop"].([]interface{})
+	if !stopHooksExist {
+		stopHooks = []interface{}{}
 	}
 
 	// Check if tanagram hooks already exist
-	preHookExists := false
-	postHookExists := false
+	sessionStartHookExists := false
+	stopHookExists := false
 
-	for _, hook := range preToolUse {
+	for _, hook := range sessionStart {
 		hookMap, ok := hook.(map[string]interface{})
 		if !ok {
 			continue
 		}
 
-		if matcher, ok := hookMap["matcher"].(string); ok && matcher == "Edit|Write" {
+		if matcher, ok := hookMap["matcher"].(string); ok && matcher == "startup|clear" {
 			innerHooks, ok := hookMap["hooks"].([]interface{})
 			if ok {
 				for _, innerHook := range innerHooks {
 					innerHookMap, ok := innerHook.(map[string]interface{})
 					if ok {
-						if cmd, ok := innerHookMap["command"].(string); ok && cmd == "tanagram snapshot" {
-							preHookExists = true
+						if cmd, ok := innerHookMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram snapshot") {
+							sessionStartHookExists = true
 							break
 						}
 					}
@@ -60,37 +60,34 @@ func ConfigClaude(settingsPath string) error {
 		}
 	}
 
-	for _, hook := range postToolUse {
+	for _, hook := range stopHooks {
 		hookMap, ok := hook.(map[string]interface{})
 		if !ok {
 			continue
 		}
 
-		if matcher, ok := hookMap["matcher"].(string); ok && matcher == "Edit|Write" {
-			innerHooks, ok := hookMap["hooks"].([]interface{})
-			if ok {
-				for _, innerHook := range innerHooks {
-					innerHookMap, ok := innerHook.(map[string]interface{})
-					if ok {
-						if cmd, ok := innerHookMap["command"].(string); ok && cmd == "tanagram" {
-							postHookExists = true
-							break
-						}
+		innerHooks, ok := hookMap["hooks"].([]interface{})
+		if ok {
+			for _, innerHook := range innerHooks {
+				innerHookMap, ok := innerHook.(map[string]interface{})
+				if ok {
+					if cmd, ok := innerHookMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram") {
+						stopHookExists = true
+						break
 					}
 				}
 			}
-
 		}
 	}
 
-	if preHookExists && postHookExists {
+	if sessionStartHookExists && stopHookExists {
 		fmt.Printf("✓ Tanagram hooks are already configured in %s\n", settingsPath)
 		return nil
 	}
 
-	if !preHookExists {
-		preHook := map[string]interface{}{
-			"matcher": "Edit|Write",
+	if !sessionStartHookExists {
+		startHook := map[string]interface{}{
+			"matcher": "startup|clear",
 			"hooks": []interface{}{
 				map[string]interface{}{
 					"type":    "command",
@@ -98,13 +95,12 @@ func ConfigClaude(settingsPath string) error {
 				},
 			},
 		}
-		preToolUse = append(preToolUse, preHook)
-		hooks["PreToolUse"] = preToolUse
+		sessionStart = append(sessionStart, startHook)
+		hooks["SessionStart"] = sessionStart
 	}
 
-	if !postHookExists {
-		postHook := map[string]interface{}{
-			"matcher": "Edit|Write",
+	if !stopHookExists {
+		stopHook := map[string]interface{}{
 			"hooks": []interface{}{
 				map[string]interface{}{
 					"type":    "command",
@@ -112,8 +108,8 @@ func ConfigClaude(settingsPath string) error {
 				},
 			},
 		}
-		postToolUse = append(postToolUse, postHook)
-		hooks["PostToolUse"] = postToolUse
+		stopHooks = append(stopHooks, stopHook)
+		hooks["Stop"] = stopHooks
 	}
 
 	if err := saveConfig(settingsPath, settings); err != nil {
@@ -122,8 +118,8 @@ func ConfigClaude(settingsPath string) error {
 
 	fmt.Printf("✓ Tanagram hooks added to %s\n", settingsPath)
 	fmt.Println("\nClaude Code will now:")
-	fmt.Println("  - Snapshot file state before each Edit/Write (PreToolUse)")
-	fmt.Println("  - Check only Claude's changes after Edit/Write (PostToolUse)")
+	fmt.Println("  - Snapshot file state at session start (SessionStart)")
+	fmt.Println("  - Check only Claude's changes after agent completes (Stop)")
 	fmt.Println("  - Send policy violations to Claude for automatic fixing")
 	fmt.Println("\nThis prevents false positives from user-written code!")
 
@@ -172,7 +168,7 @@ func ConfigCursor(hooksPath string) error {
 			continue
 		}
 
-		if cmd, ok := hookMap["command"].(string); ok && cmd == "tanagram snapshot" {
+		if cmd, ok := hookMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram snapshot") {
 			beforeSubmitHookExists = true
 			break
 		}
@@ -184,7 +180,7 @@ func ConfigCursor(hooksPath string) error {
 			continue
 		}
 
-		if cmd, ok := hookMap["command"].(string); ok && cmd == "tanagram" {
+		if cmd, ok := hookMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram") {
 			stopHookExists = true
 			break
 		}
@@ -264,13 +260,13 @@ func ConfigList() error {
 
 // ClaudeHookStatus represents the status of a hook configuration
 type ClaudeHookStatus struct {
-	FileExists     bool
-	PreHookExists  bool
-	PostHookExists bool
-	IsUpToDate     bool
-	PreCommand     string
-	PostCommand    string
-	Error          error
+	FileExists             bool
+	SessionStartHookExists bool
+	StopHookExists         bool
+	IsUpToDate             bool
+	SessionStartCommand    string
+	StopCommand            string
+	Error                  error
 }
 
 // CursorHookStatus represents the status of a Cursor hook configuration
@@ -287,13 +283,13 @@ type CursorHookStatus struct {
 // checkClaudeHookStatus checks the status of Tanagram hook in a settings file
 func checkClaudeHookStatus(settingsPath string) ClaudeHookStatus {
 	status := ClaudeHookStatus{
-		FileExists:     false,
-		PreHookExists:  false,
-		PostHookExists: false,
-		IsUpToDate:     false,
-		PreCommand:     "",
-		PostCommand:    "",
-		Error:          nil,
+		FileExists:             false,
+		SessionStartHookExists: false,
+		StopHookExists:         false,
+		IsUpToDate:             false,
+		SessionStartCommand:    "",
+		StopCommand:            "",
+		Error:                  nil,
 	}
 
 	if _, err := os.Stat(settingsPath); os.IsNotExist(err) {
@@ -313,15 +309,15 @@ func checkClaudeHookStatus(settingsPath string) ClaudeHookStatus {
 		return status
 	}
 
-	if preToolUse, ok := hooks["PreToolUse"].([]interface{}); ok {
-		for _, hook := range preToolUse {
+	if sessionStart, ok := hooks["SessionStart"].([]interface{}); ok {
+		for _, hook := range sessionStart {
 			hookMap, ok := hook.(map[string]interface{})
 			if !ok {
 				continue
 			}
 
 			matcher, ok := hookMap["matcher"].(string)
-			if !ok || matcher != "Edit|Write" {
+			if !ok || matcher != "startup|clear" {
 				continue
 			}
 
@@ -338,25 +334,20 @@ func checkClaudeHookStatus(settingsPath string) ClaudeHookStatus {
 
 				cmd, cmdOk := innerHookMap["command"].(string)
 				if cmdOk && strings.Contains(cmd, "tanagram snapshot") {
-					status.PreHookExists = true
-					status.PreCommand = cmd
+					status.SessionStartHookExists = true
+					status.SessionStartCommand = cmd
 				}
 			}
 		}
 	}
 
-	if postToolUse, ok := hooks["PostToolUse"].([]interface{}); ok {
-		for _, hook := range postToolUse {
+	if stopHooks, ok := hooks["Stop"].([]interface{}); ok {
+		for _, hook := range stopHooks {
 			hookMap, ok := hook.(map[string]interface{})
 			if !ok {
 				continue
 			}
 
-			matcher, ok := hookMap["matcher"].(string)
-			if !ok || matcher != "Edit|Write" {
-				continue
-			}
-
 			innerHooks, ok := hookMap["hooks"].([]interface{})
 			if !ok {
 				continue
@@ -371,15 +362,15 @@ func checkClaudeHookStatus(settingsPath string) ClaudeHookStatus {
 				cmd, cmdOk := innerHookMap["command"].(string)
 				hookType, typeOk := innerHookMap["type"].(string)
 
-				if cmdOk && cmd == "tanagram" && typeOk && hookType == "command" {
-					status.PostHookExists = true
-					status.PostCommand = cmd
+				if cmdOk && strings.HasSuffix(cmd, "tanagram") && typeOk && hookType == "command" {
+					status.StopHookExists = true
+					status.StopCommand = cmd
 				}
 			}
 		}
 	}
 
-	if status.PreHookExists && status.PostHookExists {
+	if status.SessionStartHookExists && status.StopHookExists {
 		status.IsUpToDate = true
 	}
 
@@ -423,7 +414,7 @@ func checkCursorHookStatus(hooksPath string) CursorHookStatus {
 			}
 
 			cmd, cmdOk := hookMap["command"].(string)
-			if cmdOk && cmd == "tanagram snapshot" {
+			if cmdOk && strings.HasSuffix(cmd, "tanagram snapshot") {
 				status.BeforeSubmitExists = true
 				status.BeforeSubmitCommand = cmd
 			}
@@ -438,7 +429,7 @@ func checkCursorHookStatus(hooksPath string) CursorHookStatus {
 			}
 
 			cmd, cmdOk := hookMap["command"].(string)
-			if cmdOk && cmd == "tanagram" {
+			if cmdOk && strings.HasSuffix(cmd, "tanagram") {
 				status.StopExists = true
 				status.StopCommand = cmd
 			}
@@ -465,7 +456,7 @@ func printClaudeHookStatus(status ClaudeHookStatus, path string) {
 		return
 	}
 
-	if !status.PreHookExists && !status.PostHookExists {
+	if !status.SessionStartHookExists && !status.StopHookExists {
 		fmt.Printf("  ○ Not configured\n")
 		fmt.Printf("  → Run: tanagram config claude\n")
 		return
@@ -473,20 +464,20 @@ func printClaudeHookStatus(status ClaudeHookStatus, path string) {
 
 	if status.IsUpToDate {
 		fmt.Printf("  ✓ Configured and up to date\n")
-		fmt.Printf("  PreToolUse: %s\n", status.PreCommand)
-		fmt.Printf("  PostToolUse: %s\n", status.PostCommand)
+		fmt.Printf("  SessionStart: %s\n", status.SessionStartCommand)
+		fmt.Printf("  Stop: %s\n", status.StopCommand)
 		fmt.Printf("  Location: %s\n", path)
 	} else {
 		fmt.Printf("  ⚠ Configured but incomplete\n")
-		if status.PreHookExists {
-			fmt.Printf("  ✓ PreToolUse: %s\n", status.PreCommand)
+		if status.SessionStartHookExists {
+			fmt.Printf("  ✓ SessionStart: %s\n", status.SessionStartCommand)
 		} else {
-			fmt.Printf("  ✗ PreToolUse: missing\n")
+			fmt.Printf("  ✗ SessionStart: missing\n")
 		}
-		if status.PostHookExists {
-			fmt.Printf("  ✓ PostToolUse: %s\n", status.PostCommand)
+		if status.StopHookExists {
+			fmt.Printf("  ✓ Stop: %s\n", status.StopCommand)
 		} else {
-			fmt.Printf("  ✗ PostToolUse: missing\n")
+			fmt.Printf("  ✗ Stop: missing\n")
 		}
 		fmt.Printf("  → Run: tanagram config claude\n")
 	}
@@ -550,7 +541,7 @@ func ensureClaudeConfigured() error {
 	}
 
 	// If file doesn't exist or hooks aren't configured, set them up
-	if !status.FileExists || !status.PreHookExists || !status.PostHookExists {
+	if !status.FileExists || !status.SessionStartHookExists || !status.StopHookExists {
 		fmt.Println("Setting up Claude Code integration...")
 		if err := ConfigClaude(settingsPath); err != nil {
 			// Don't fail the command if hook setup fails - just warn

package/commands/config_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -31,12 +32,12 @@ func TestConfigClaude(t *testing.T) {
 		}
 
 		settings := readSettings(t, settingsPath)
-		pre, post := checkHooks(settings)
-		if !pre {
-			t.Error("PreToolUse hook not created")
+		sessionStart, stop := checkHooks(settings)
+		if !sessionStart {
+			t.Error("SessionStart hook not created")
 		}
-		if !post {
-			t.Error("PostToolUse hook not created")
+		if !stop {
+			t.Error("Stop hook not created")
 		}
 	})
 
@@ -47,22 +48,22 @@ func TestConfigClaude(t *testing.T) {
 		}
 
 		settings := readSettings(t, settingsPath)
-		pre, post := checkHooks(settings)
-		if !pre || !post {
+		sessionStart, stop := checkHooks(settings)
+		if !sessionStart || !stop {
 			t.Error("Hooks missing after second run")
 		}
 
 		// Check that we didn't duplicate them (rudimentary check: count of items)
 		hooks := settings["hooks"].(map[string]interface{})
-		preToolUse := hooks["PreToolUse"].([]interface{})
-		postToolUse := hooks["PostToolUse"].([]interface{})
+		sessionStartHooks := hooks["SessionStart"].([]interface{})
+		stopHooks := hooks["Stop"].([]interface{})
 
 		// We expect exactly 1 hook in each since we started fresh
-		if len(preToolUse) != 1 {
-			t.Errorf("Expected 1 PreToolUse hook, got %d", len(preToolUse))
+		if len(sessionStartHooks) != 1 {
+			t.Errorf("Expected 1 SessionStart hook, got %d", len(sessionStartHooks))
 		}
-		if len(postToolUse) != 1 {
-			t.Errorf("Expected 1 PostToolUse hook, got %d", len(postToolUse))
+		if len(stopHooks) != 1 {
+			t.Errorf("Expected 1 Stop hook, got %d", len(stopHooks))
 		}
 	})
 
@@ -70,9 +71,9 @@ func TestConfigClaude(t *testing.T) {
 		// Reset with a file that has other hooks
 		otherHook := map[string]interface{}{
 			"hooks": map[string]interface{}{
-				"PreToolUse": []interface{}{
+				"SessionStart": []interface{}{
 					map[string]interface{}{
-						"matcher": "Read",
+						"matcher": "startup|clear",
 						"hooks": []interface{}{
 							map[string]interface{}{"command": "echo existing"},
 						},
@@ -100,19 +101,19 @@ func TestConfigClaude(t *testing.T) {
 		}
 
 		settings := readSettings(t, settingsPath)
-		pre, post := checkHooks(settings)
-		if !pre || !post {
+		sessionStart, stop := checkHooks(settings)
+		if !sessionStart || !stop {
 			t.Error("Tanagram hooks missing when merging with existing config")
 		}
 
 		// Check if existing hook is still there
 		hooks := settings["hooks"].(map[string]interface{})
-		preToolUse := hooks["PreToolUse"].([]interface{})
+		sessionStartHooks := hooks["SessionStart"].([]interface{})
 
 		foundExisting := false
-		for _, h := range preToolUse {
+		for _, h := range sessionStartHooks {
 			hMap := h.(map[string]interface{})
-			if hMap["matcher"] == "Read" {
+			if hMap["matcher"] == "startup|clear" {
 				// Check for the specific command to be sure it's the right one
 				if commands, ok := hMap["hooks"].([]interface{}); ok {
 					for _, cmd := range commands {
@@ -133,6 +134,85 @@ func TestConfigClaude(t *testing.T) {
 			t.Error("Existing hook was lost")
 		}
 	})
+
+	t.Run("Preserve existing absolute path hooks", func(t *testing.T) {
+		// Reset with a file that has absolute path hooks
+		absHook := map[string]interface{}{
+			"hooks": map[string]interface{}{
+				"SessionStart": []interface{}{
+					map[string]interface{}{
+						"matcher": "startup|clear",
+						"hooks": []interface{}{
+							map[string]interface{}{"command": "/absolute/path/to/tanagram snapshot"},
+						},
+					},
+				},
+				"Stop": []interface{}{
+					map[string]interface{}{
+						"hooks": []interface{}{
+							map[string]interface{}{
+								"type":    "command",
+								"command": "/absolute/path/to/tanagram",
+							},
+						},
+					},
+				},
+			},
+		}
+
+		// Clean up previous run
+		os.RemoveAll(filepath.Dir(settingsPath))
+
+		dir := filepath.Dir(settingsPath)
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			t.Fatalf("Failed to create dir: %v", err)
+		}
+
+		// Write absHook to settingsPath
+		data, _ := json.Marshal(absHook)
+		if err := os.WriteFile(settingsPath, data, 0644); err != nil {
+			t.Fatalf("Failed to write settings: %v", err)
+		}
+
+		if err := ConfigClaude(settingsPath); err != nil {
+			t.Fatalf("ConfigClaude() failed: %v", err)
+		}
+
+		settings := readSettings(t, settingsPath)
+
+		// Check duplication
+		hooks := settings["hooks"].(map[string]interface{})
+		sessionStartHooks := hooks["SessionStart"].([]interface{})
+		stopHooks := hooks["Stop"].([]interface{})
+
+		// We expect exactly 1 hook since we started with 1 and it should match
+		if len(sessionStartHooks) != 1 {
+			t.Errorf("Expected 1 SessionStart hook, got %d", len(sessionStartHooks))
+		}
+		if len(stopHooks) != 1 {
+			t.Errorf("Expected 1 Stop hook, got %d", len(stopHooks))
+		}
+
+		// Check content
+		h := sessionStartHooks[0].(map[string]interface{})
+		innerHooks := h["hooks"].([]interface{})
+		cmdMap := innerHooks[0].(map[string]interface{})
+		cmd := cmdMap["command"].(string)
+
+		if cmd != "/absolute/path/to/tanagram snapshot" {
+			t.Errorf("Expected command to be preserved as '/absolute/path/to/tanagram snapshot', got '%s'", cmd)
+		}
+
+		// Check post content
+		hPost := stopHooks[0].(map[string]interface{})
+		innerHooksPost := hPost["hooks"].([]interface{})
+		cmdMapPost := innerHooksPost[0].(map[string]interface{})
+		cmdPost := cmdMapPost["command"].(string)
+
+		if cmdPost != "/absolute/path/to/tanagram" {
+			t.Errorf("Expected command to be preserved as '/absolute/path/to/tanagram', got '%s'", cmdPost)
+		}
+	})
 }
 
 func TestConfigCursor(t *testing.T) {
@@ -243,6 +323,69 @@ func TestConfigCursor(t *testing.T) {
 			t.Error("Existing hook was lost")
 		}
 	})
+
+	t.Run("Preserve existing absolute path hooks", func(t *testing.T) {
+		// Reset with a file that has absolute path hooks
+		absHook := map[string]interface{}{
+			"hooks": map[string]interface{}{
+				"beforeSubmitPrompt": []interface{}{
+					map[string]interface{}{"command": "/absolute/path/to/tanagram snapshot"},
+				},
+				"stop": []interface{}{
+					map[string]interface{}{"command": "/absolute/path/to/tanagram"},
+				},
+			},
+		}
+
+		// Clean up previous run
+		os.RemoveAll(filepath.Dir(hooksPath))
+
+		dir := filepath.Dir(hooksPath)
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			t.Fatalf("Failed to create dir: %v", err)
+		}
+
+		// Write absHook to hooksPath
+		data, _ := json.Marshal(absHook)
+		if err := os.WriteFile(hooksPath, data, 0644); err != nil {
+			t.Fatalf("Failed to write settings: %v", err)
+		}
+
+		if err := ConfigCursor(hooksPath); err != nil {
+			t.Fatalf("ConfigCursor() failed: %v", err)
+		}
+
+		settings := readSettings(t, hooksPath)
+
+		// Check duplication
+		hooks := settings["hooks"].(map[string]interface{})
+		beforeSubmitHooks := hooks["beforeSubmitPrompt"].([]interface{})
+		stopHooks := hooks["stop"].([]interface{})
+
+		// We expect exactly 1 hook since we started with 1 and it should match
+		if len(beforeSubmitHooks) != 1 {
+			t.Errorf("Expected 1 beforeSubmitPrompt hook, got %d", len(beforeSubmitHooks))
+		}
+		if len(stopHooks) != 1 {
+			t.Errorf("Expected 1 stop hook, got %d", len(stopHooks))
+		}
+
+		// Check content
+		h := beforeSubmitHooks[0].(map[string]interface{})
+		cmd, _ := h["command"].(string)
+
+		if cmd != "/absolute/path/to/tanagram snapshot" {
+			t.Errorf("Expected command to be preserved as '/absolute/path/to/tanagram snapshot', got '%s'", cmd)
+		}
+
+		// Check stop content
+		hStop := stopHooks[0].(map[string]interface{})
+		cmdStop, _ := hStop["command"].(string)
+
+		if cmdStop != "/absolute/path/to/tanagram" {
+			t.Errorf("Expected command to be preserved as '/absolute/path/to/tanagram', got '%s'", cmdStop)
+		}
+	})
 }
 
 func TestEnsureHooksConfigured(t *testing.T) {
@@ -277,12 +420,12 @@ func TestEnsureHooksConfigured(t *testing.T) {
 		// Check Claude settings
 		claudeSettingsPath := filepath.Join(tempHome, ".claude", "settings.json")
 		claudeSettings := readSettings(t, claudeSettingsPath)
-		pre, post := checkHooks(claudeSettings)
-		if !pre {
-			t.Error("PreToolUse hook not created")
+		sessionStart, stop := checkHooks(claudeSettings)
+		if !sessionStart {
+			t.Error("SessionStart hook not created")
 		}
-		if !post {
-			t.Error("PostToolUse hook not created")
+		if !stop {
+			t.Error("Stop hook not created")
 		}
 
 		// Check Cursor hooks
@@ -316,16 +459,16 @@ func checkHooks(settings map[string]interface{}) (bool, bool) {
 		return false, false
 	}
 
-	preExists := false
-	if preToolUse, ok := hooks["PreToolUse"].([]interface{}); ok {
-		for _, h := range preToolUse {
+	sessionStartExists := false
+	if sessionStart, ok := hooks["SessionStart"].([]interface{}); ok {
+		for _, h := range sessionStart {
 			if hMap, ok := h.(map[string]interface{}); ok {
-				if hMap["matcher"] == "Edit|Write" {
+				if hMap["matcher"] == "startup|clear" {
 					if innerHooks, ok := hMap["hooks"].([]interface{}); ok {
 						for _, ih := range innerHooks {
 							if ihMap, ok := ih.(map[string]interface{}); ok {
-								if ihMap["command"] == "tanagram snapshot" {
-									preExists = true
+								if cmd, ok := ihMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram snapshot") {
+									sessionStartExists = true
 								}
 							}
 						}
@@ -335,17 +478,15 @@ func checkHooks(settings map[string]interface{}) (bool, bool) {
 		}
 	}
 
-	postExists := false
-	if postToolUse, ok := hooks["PostToolUse"].([]interface{}); ok {
-		for _, h := range postToolUse {
+	stopExists := false
+	if stopHooks, ok := hooks["Stop"].([]interface{}); ok {
+		for _, h := range stopHooks {
 			if hMap, ok := h.(map[string]interface{}); ok {
-				if hMap["matcher"] == "Edit|Write" {
-					if innerHooks, ok := hMap["hooks"].([]interface{}); ok {
-						for _, ih := range innerHooks {
-							if ihMap, ok := ih.(map[string]interface{}); ok {
-								if ihMap["command"] == "tanagram" {
-									postExists = true
-								}
+				if innerHooks, ok := hMap["hooks"].([]interface{}); ok {
+					for _, ih := range innerHooks {
+						if ihMap, ok := ih.(map[string]interface{}); ok {
+							if cmd, ok := ihMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram") {
+								stopExists = true
 							}
 						}
 					}
@@ -354,7 +495,7 @@ func checkHooks(settings map[string]interface{}) (bool, bool) {
 		}
 	}
 
-	return preExists, postExists
+	return sessionStartExists, stopExists
 }
 
 func checkCursorHooks(settings map[string]interface{}) (bool, bool) {
@@ -367,7 +508,7 @@ func checkCursorHooks(settings map[string]interface{}) (bool, bool) {
 	if beforeSubmit, ok := hooks["beforeSubmitPrompt"].([]interface{}); ok {
 		for _, h := range beforeSubmit {
 			if hMap, ok := h.(map[string]interface{}); ok {
-				if cmd, ok := hMap["command"].(string); ok && cmd == "tanagram snapshot" {
+				if cmd, ok := hMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram snapshot") {
 					beforeSubmitExists = true
 				}
 			}
@@ -378,7 +519,7 @@ func checkCursorHooks(settings map[string]interface{}) (bool, bool) {
 	if stop, ok := hooks["stop"].([]interface{}); ok {
 		for _, h := range stop {
 			if hMap, ok := h.(map[string]interface{}); ok {
-				if cmd, ok := hMap["command"].(string); ok && cmd == "tanagram" {
+				if cmd, ok := hMap["command"].(string); ok && strings.HasSuffix(cmd, "tanagram") {
 					stopExists = true
 				}
 			}

package/commands/login.go

@@ -19,7 +19,7 @@ import (
 // getWebAppURL returns the web app URL based on environment
 func getWebAppURL() string {
 	// Check environment variable first
-	if url := os.Getenv("TANAGRAM_WEB_URL"); url != "" {
+	if url := os.Getenv("TANAGRAM_WEB_HOSTNAME"); url != "" {
 		return url
 	}
 
@@ -79,7 +79,7 @@ func Login() error {
 
 		// Send success message to browser
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		fmt.Fprintf(w, `
+		fmt.Fprint(w, `
 			<!DOCTYPE html>
 			<html lang="en">
 			<head>

package/commands/snapshot_test.go

@@ -10,11 +10,11 @@ import (
 func TestSnapshot_Cursor(t *testing.T) {
 	// Save original functions
 	origFindGitRoot := findGitRoot
-	origCreateSnapshot := createSnapshot
+	origCreateSnapshot := createOptimized
 	origGetParentProcess := getParentProcess
 	defer func() {
 		findGitRoot = origFindGitRoot
-		createSnapshot = origCreateSnapshot
+		createOptimized = origCreateSnapshot
 		getParentProcess = origGetParentProcess
 	}()
 
@@ -22,7 +22,7 @@ func TestSnapshot_Cursor(t *testing.T) {
 	findGitRoot = func() (string, error) {
 		return "/tmp/mock-git-root", nil
 	}
-	createSnapshot = func(root string) error {
+	createOptimized = func(root string, files []string) error {
 		return nil
 	}
 

package/git/diff.go

@@ -66,6 +66,40 @@ func GetAllChanges() (*DiffResult, error) {
 	return result, nil
 }
 
+// DiffFiles compares two files using git diff --no-index
+func DiffFiles(oldFile, newFile, displayPath string) (*DiffResult, error) {
+	cmd := exec.Command("git", "diff", "--no-index", "--unified=0", oldFile, newFile)
+	output, err := cmd.Output()
+	
+	// git diff --no-index returns exit code 1 if there are differences
+	// It returns 0 if identical
+	if err != nil {
+		if exitError, ok := err.(*exec.ExitError); ok {
+			if exitError.ExitCode() != 1 {
+				// Anything other than 0 or 1 is an actual error
+				return nil, fmt.Errorf("failed to run git diff: %w", err)
+			}
+			// Exit code 1 means differences found, proceed to parse
+		} else {
+			return nil, fmt.Errorf("failed to run git diff: %w", err)
+		}
+	}
+
+	// Parse the diff output
+	result, err := parseDiff(string(output))
+	if err != nil {
+		return nil, err
+	}
+
+	// Fix up the file paths in the result to match the displayPath
+	// git diff --no-index outputs temp file paths like "b/tmp/..."
+	for i := range result.Changes {
+		result.Changes[i].File = displayPath
+	}
+
+	return result, nil
+}
+
 // parseDiff parses unified diff format and extracts changed lines
 func parseDiff(diffText string) (*DiffResult, error) {
 	result := &DiffResult{

package/main.go

@@ -255,8 +255,8 @@ HOOK WORKFLOW:
   When configured with 'tanagram config claude' or 'tanagram config cursor':
   
   Claude Code:
-  1. PreToolUse (Edit|Write): Creates snapshot before Claude makes changes
-  2. PostToolUse (Edit|Write): Checks only Claude's changes against policies
+  1. SessionStart: Creates snapshot before Claude makes changes
+  2. Stop: Checks only Claude's changes against policies
   
   Cursor:
   1. beforeSubmitPrompt: Creates snapshot before agent starts working

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanagram/cli",
-  "version": "0.4.10",
+  "version": "0.4.13",
   "description": "Tanagram - Catch sloppy code before it ships",
   "main": "index.js",
   "bin": {

package/snapshot/snapshot.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/tanagram/cli/git"
 	"github.com/tanagram/cli/storage"
 )
 
@@ -21,6 +22,7 @@ type FileState struct {
 	Hash         string    `json:"hash"`
 	Size         int64     `json:"size"`
 	ModifiedTime time.Time `json:"modified_time"`
+	Content      string    `json:"content,omitempty"`
 }
 
 // Snapshot represents a snapshot of the working directory
@@ -179,11 +181,18 @@ func CreateOptimized(gitRoot string, targetFiles []string) error {
 			continue
 		}
 
+		// Read content
+		contentBytes, err := os.ReadFile(fullPath)
+		if err != nil {
+			continue
+		}
+
 		snapshot.Files[relPath] = &FileState{
 			Path:         relPath,
 			Hash:         hash,
 			Size:         info.Size(),
 			ModifiedTime: info.ModTime(),
+			Content:      string(contentBytes),
 		}
 	}
 
@@ -490,31 +499,113 @@ type ChangedLine struct {
 func GetChangedLinesForChecker(gitRoot string, snapshot *Snapshot, compareResult *CompareResult) ([]ChangedLine, error) {
 	var changes []ChangedLine
 
-	// For each modified file, include all non-empty lines
-	// (we can't easily determine which specific lines changed without doing a full diff)
+	// For modified files, we diff against the snapshot version
 	for _, relPath := range compareResult.ModifiedFiles {
 		fullPath := filepath.Join(gitRoot, relPath)
 
-		// Read new content
+		// Get New Content (Current)
 		newData, err := os.ReadFile(fullPath)
 		if err != nil {
 			continue
 		}
-
-		// Skip binary files
 		if !isText(newData) {
 			continue
 		}
 
-		newLines := strings.Split(string(newData), "\n")
+		// Get Old Content (Snapshot)
+		var oldData []byte
+		
+		if fileState, ok := snapshot.Files[relPath]; ok && fileState.Content != "" {
+			// Was dirty -> use stored content
+			oldData = []byte(fileState.Content)
+		} else {
+			// Was clean -> use git show
+			// If it wasn't in snapshot.Files but is in ModifiedFiles, it must have been clean at HEAD
+			// and now is modified.
+			// Note: If snapshot.Files has it but Content is empty, that means it was clean but we stored it?
+			// No, CreateOptimized only stores Content for dirty files.
+			// But wait, CreateOptimized only adds files to snapshot.Files if they are dirty or targetted.
+			// If a file is NOT in snapshot.Files, it is assumed clean at HeadCommit.
+			
+			// However, compareResult.ModifiedFiles includes files that:
+			// 1. Were in snapshot (hash changed)
+			// 2. Were NOT in snapshot (current hash != HEAD hash)
+			
+			// Case 1: In snapshot
+			if fileState, ok := snapshot.Files[relPath]; ok {
+				if fileState.Content != "" {
+					oldData = []byte(fileState.Content)
+				} else {
+					// It was in snapshot but no content? This happens if it was > 1MB
+					// or if we used the legacy Create method which doesn't store content.
+					// In that case we fall back to reading from HEAD (imperfect but best effort)
+					// OR we just treat all lines as changed (current behavior) if we can't get old content.
+					
+					// Try to get from HEAD just in case it matches
+					hash, _ := getHashAtCommit(gitRoot, snapshot.HeadCommit, relPath)
+					if hash == fileState.Hash {
+						// It matches HEAD, so we can get content from HEAD
+						out, err := runGit(gitRoot, "show", fmt.Sprintf("%s:%s", snapshot.HeadCommit, relPath))
+						if err == nil {
+							oldData = []byte(out)
+						}
+					}
+				}
+			} else {
+				// Case 2: Not in snapshot (was clean at HEAD)
+				out, err := runGit(gitRoot, "show", fmt.Sprintf("%s:%s", snapshot.HeadCommit, relPath))
+				if err == nil {
+					oldData = []byte(out)
+				}
+			}
+		}
+
+		// If we couldn't get old data, fallback to treating all lines as new (safest)
+		if len(oldData) == 0 {
+			newLines := strings.Split(string(newData), "\n")
+			for i, line := range newLines {
+				if strings.TrimSpace(line) != "" {
+					changes = append(changes, ChangedLine{
+						File:       relPath,
+						LineNumber: i + 1,
+						Content:    line,
+						ChangeType: "+",
+					})
+				}
+			}
+			continue
+		}
 
-		// Include all non-empty lines from modified files
-		for i, line := range newLines {
-			if strings.TrimSpace(line) != "" {
+		// Do the diff
+		// Write to temp files
+		tmpOld, err := os.CreateTemp("", "tanagram-old-*")
+		if err != nil {
+			continue
+		}
+		defer os.Remove(tmpOld.Name())
+		tmpOld.Write(oldData)
+		tmpOld.Close()
+
+		tmpNew, err := os.CreateTemp("", "tanagram-new-*")
+		if err != nil {
+			continue
+		}
+		defer os.Remove(tmpNew.Name())
+		tmpNew.Write(newData)
+		tmpNew.Close()
+
+		diffResult, err := git.DiffFiles(tmpOld.Name(), tmpNew.Name(), relPath)
+		if err != nil {
+			continue
+		}
+
+		// Convert git.ChangedLine to snapshot.ChangedLine
+		for _, c := range diffResult.Changes {
+			if c.ChangeType == "+" {
 				changes = append(changes, ChangedLine{
 					File:       relPath,
-					LineNumber: i + 1,
-					Content:    line,
+					LineNumber: c.LineNumber,
+					Content:    c.Content,
 					ChangeType: "+",
 				})
 			}