@vigil-guard/vge-cc-guard 0.9.0-beta.1

package/dist/commands/config.js

@@ -0,0 +1,41 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { render } from 'ink';
+import { App } from '../tui/App.js';
+function lacksWindowsRawMode(input) {
+    return process.platform === 'win32' && typeof input.setRawMode !== 'function';
+}
+export async function runConfig() {
+    if (!process.stdin.isTTY) {
+        process.stderr.write('vge-cc-guard config: interactive TUI requires a real terminal (TTY).\n' +
+            'For automated configuration, edit ~/.vge-cc-guard/config.json directly.\n');
+        process.exit(2);
+    }
+    if (lacksWindowsRawMode(process.stdin)) {
+        process.stderr.write('vge-cc-guard config: Windows interactive TUI requires raw terminal input.\n' +
+            'Run it from Windows Terminal, PowerShell, or cmd.exe.\n');
+        process.exit(2);
+    }
+    // Switch to the terminal's alternate screen buffer so screen transitions
+    // (e.g. leaving ViewConfig back to MainMenu) start from a clean canvas
+    // instead of leaving the previous, larger render in the scrollback.
+    process.stdout.write('\x1b[?1049h\x1b[H');
+    const restore = () => {
+        process.stdout.write('\x1b[?1049l');
+    };
+    process.once('exit', restore);
+    const onClearScreen = () => {
+        // Wipe the alt-buffer (viewport + scrollback) and tell ink to forget its
+        // last frame so the next mount paints fresh from the top.
+        process.stdout.write('\x1b[2J\x1b[3J\x1b[H');
+        instance.clear();
+    };
+    const instance = render(_jsx(App, { onClearScreen: onClearScreen }));
+    try {
+        await instance.waitUntilExit();
+    }
+    finally {
+        process.off('exit', restore);
+        restore();
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,SAAS,mBAAmB,CAAC,KAA2B;IACtD,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wEAAwE;YACtE,2EAA2E,CAC9E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6EAA6E;YAC3E,yDAAyD,CAC5D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,yEAAyE;QACzE,0DAA0D;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7C,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAC,GAAG,IAAC,aAAa,EAAE,aAAa,GAAI,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/commands/daemon.d.ts

@@ -0,0 +1,2 @@
+export declare function runDaemonCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=daemon.d.ts.map

package/dist/commands/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/commands/daemon.ts"],"names":[],"mappings":"AAKA,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BpE"}

package/dist/commands/daemon.js

@@ -0,0 +1,116 @@
+import { startDaemon } from '../daemon/http-server.js';
+import { post } from '../tui/lib/daemon-client.js';
+const USAGE = 'Usage: vge-cc-guard daemon status|reload|stop|restart';
+export async function runDaemonCommand(args) {
+    const subcommand = args[0];
+    if (!subcommand) {
+        await startDaemon();
+        return;
+    }
+    if (subcommand === 'status') {
+        await printStatus();
+        return;
+    }
+    if (subcommand === 'reload') {
+        await reloadDaemon();
+        return;
+    }
+    if (subcommand === 'stop') {
+        await stopDaemon();
+        return;
+    }
+    if (subcommand === 'restart') {
+        await restartDaemon();
+        return;
+    }
+    console.error(USAGE);
+    process.exitCode = 1;
+}
+async function printStatus() {
+    const status = await readStatus();
+    if (!status.ok) {
+        console.log('Daemon status: not_running');
+        return;
+    }
+    const stale = status.staleBuild ? ' stale_build' : '';
+    console.log(`Daemon status: running pid=${status.pid} configRevision=${status.configRevision} ` +
+        `build=${status.binarySha256.slice(0, 12)}${stale}`);
+}
+async function reloadDaemon() {
+    try {
+        const response = await post('/v1/control/reload-config', {});
+        const revision = numberField(response.json, 'configRevision');
+        if (response.status >= 200 && response.status < 300 && revision !== null) {
+            console.log(`Daemon reloaded config revision ${revision}.`);
+            return;
+        }
+        console.error(`Daemon reload failed: ${errorField(response.json) ?? `HTTP ${response.status}`}`);
+        process.exitCode = 1;
+    }
+    catch (err) {
+        console.error(`Daemon reload failed: ${errorMessage(err)}`);
+        process.exitCode = 1;
+    }
+}
+async function stopDaemon() {
+    try {
+        const response = await post('/v1/control/stop', {});
+        if (response.status >= 200 && response.status < 300) {
+            console.log('Daemon stopping.');
+            return;
+        }
+        console.error(`Daemon stop failed: ${errorField(response.json) ?? `HTTP ${response.status}`}`);
+        process.exitCode = 1;
+    }
+    catch {
+        console.log('Daemon status: not_running');
+    }
+}
+async function restartDaemon() {
+    const status = await readStatus();
+    if (status.ok && status.pendingDecisionCount > 0) {
+        console.error(`Daemon restart refused: ${status.pendingDecisionCount} pending decision(s).`);
+        process.exitCode = 1;
+        return;
+    }
+    console.error('Daemon restart is not implemented yet. Use `vge-cc-guard daemon stop`, then start the daemon again.');
+    process.exitCode = 1;
+}
+async function readStatus() {
+    try {
+        const response = await post('/v1/control/status', {});
+        if (response.status < 200 || response.status >= 300)
+            return { ok: false };
+        const json = response.json;
+        const build = typeof json['build'] === 'object' && json['build'] !== null
+            ? json['build']
+            : {};
+        return {
+            ok: true,
+            pid: numberField(json, 'pid') ?? 0,
+            configRevision: numberField(json, 'configRevision') ?? 0,
+            staleBuild: json['staleBuild'] === true,
+            pendingDecisionCount: numberField(json, 'pendingDecisionCount') ?? 0,
+            binarySha256: typeof build['binarySha256'] === 'string' ? build['binarySha256'] : 'unknown',
+        };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+function numberField(json, field) {
+    if (typeof json !== 'object' || json === null)
+        return null;
+    const value = json[field];
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+function errorField(json) {
+    if (typeof json !== 'object' || json === null)
+        return null;
+    const value = json['error'];
+    return typeof value === 'string' ? value : null;
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=daemon.js.map

package/dist/commands/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAEnD,MAAM,KAAK,GAAG,uDAAuD,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,YAAY,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,UAAU,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,aAAa,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,CAAC,GAAG,CACT,8BAA8B,MAAM,CAAC,GAAG,mBAAmB,MAAM,CAAC,cAAc,GAAG;QACnF,SAAS,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,mCAAmC,QAAQ,GAAG,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,yBAAyB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,yBAAyB,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,uBAAuB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,oBAAoB,uBAAuB,CAAC,CAAC;QAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACrH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,UAAU;IAIvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI;YACvE,CAAC,CAAC,IAAI,CAAC,OAAO,CAA4B;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;YAClC,cAAc,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YACxD,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI;YACvC,oBAAoB,EAAE,WAAW,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;YACpE,YAAY,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,KAAa;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAI,IAAgC,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAI,IAAgC,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+export declare function runDoctor(args: string[]): Promise<void>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AASA,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC7D"}

package/dist/commands/doctor.js

@@ -0,0 +1,53 @@
+import { ccContractNextAction, createCcContractStatus, getCcContractHealth, writeCcContractStatus, } from '../daemon/cc-contract-status.js';
+import { checkVgeConnectivity } from '../daemon/vge-connectivity.js';
+import { readConfigOrDefault } from '../shared/config-io.js';
+export async function runDoctor(args) {
+    if (!args.includes('--cc-contract')) {
+        const skipVge = args.includes('--no-vge');
+        const health = getCcContractHealth();
+        console.log(`Claude Code contract state: ${health.state}`);
+        console.log(`L0 output replacement: ${health.l0RedactionAvailable ? 'enabled' : 'disabled'}`);
+        console.log(`Reason: ${health.reason}`);
+        console.log(`Next action: ${ccContractNextAction(health.reason)}`);
+        console.log(`Claude Code version: ${health.claudeVersion ?? 'unknown'}`);
+        console.log(`Live contract: ${health.liveContract ?? 'unknown'}`);
+        console.log(`Checked at: ${health.checkedAt ?? 'never'}`);
+        if (skipVge) {
+            console.log('VGE connectivity: skipped (--no-vge)');
+            return;
+        }
+        const vgeHealth = await checkVgeConnectivity(readConfigOrDefault());
+        console.log(`VGE connectivity: ${vgeHealth.ok ? 'healthy' : 'degraded'}`);
+        console.log(`VGE API URL: ${vgeHealth.apiUrl ?? 'unknown'}`);
+        console.log(`VGE input key: ${vgeHealth.inputKey}`);
+        console.log(`VGE output key: ${vgeHealth.outputKey}`);
+        if (!vgeHealth.ok) {
+            console.log(`VGE reason: ${vgeHealth.failureReason ?? 'unknown'}`);
+            console.log(`VGE next action: ${vgeNextAction(vgeHealth.failureReason)}`);
+        }
+        return;
+    }
+    const assumeLivePassed = args.includes('--assume-live-pass');
+    if (assumeLivePassed) {
+        console.warn('WARNING: --assume-live-pass marks the Claude Code contract healthy without running a live verification. L0 redaction may be enabled based on this manual override.');
+    }
+    const status = createCcContractStatus({ assumeLivePassed });
+    const target = writeCcContractStatus(status);
+    console.log(`Claude Code contract status: ${status.status}`);
+    console.log(`Claude Code version: ${status.claudeVersion}`);
+    console.log(`Live contract: ${status.liveContract ?? 'unknown'}`);
+    console.log(`Wrote: ${target}`);
+}
+function vgeNextAction(reason) {
+    if (reason === 'config_missing') {
+        return 'Set VGE API URL and input key, then run Test Connection from API Keys.';
+    }
+    if (reason === 'auth_failed') {
+        return 'Verify the input and output key roles for the configured VGE endpoint.';
+    }
+    if (reason === 'tls_error') {
+        return 'Verify system CA trust for the daemon process and restart the daemon.';
+    }
+    return 'Check daemon Runtime VGE status and verify endpoint, CA trust, and key role configuration.';
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,oBAAoB,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACV,oKAAoK,CACrK,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B;IAC/C,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,wEAAwE,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,wEAAwE,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,uEAAuE,CAAC;IACjF,CAAC;IACD,OAAO,4FAA4F,CAAC;AACtG,CAAC"}

package/dist/commands/install-wizard.d.ts

@@ -0,0 +1,2 @@
+export declare function runInstallWizard(initialScope: 'user' | 'project'): Promise<void>;
+//# sourceMappingURL=install-wizard.d.ts.map

package/dist/commands/install-wizard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-wizard.d.ts","sourceRoot":"","sources":["../../src/commands/install-wizard.tsx"],"names":[],"mappings":"AAkIA,wBAAsB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBtF"}

package/dist/commands/install-wizard.js

@@ -0,0 +1,85 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Box, Text, render, useApp, useInput } from 'ink';
+import { runInstallHeadless } from './install.js';
+import { SelectList } from '../tui/components/SelectList.js';
+import { App as ConfigApp } from '../tui/App.js';
+function Wizard({ initialScope, onExit }) {
+    const [s, setS] = useState({
+        step: 'scope',
+        scope: initialScope,
+        mode: 'apply',
+        result: null,
+        error: null,
+    });
+    useInput((input, key) => {
+        if (s.step === 'done') {
+            if (key.return)
+                onExit(false);
+            else if (input === 'y')
+                onExit(true);
+            else if (input === 'n')
+                onExit(false);
+        }
+    });
+    if (s.step === 'scope') {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Install scope" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectList, { items: [
+                            { key: 'user', label: 'User (~/.claude/settings.json)', description: 'Recommended — applies to all projects' },
+                            { key: 'project', label: 'Project (./.claude/settings.json)', description: 'Only this project' },
+                        ], initialIndex: initialScope === 'user' ? 0 : 1, onSelect: (k) => setS({ ...s, scope: k, step: 'mode' }) }) })] }));
+    }
+    if (s.step === 'mode') {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Install mode" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectList, { items: [
+                            { key: 'apply', label: 'Apply', description: 'Write hooks to settings.json' },
+                            { key: 'dry-run', label: 'Dry run', description: 'Preview changes without writing' },
+                        ], onSelect: (k) => {
+                            const next = { ...s, mode: k, step: 'running' };
+                            setS(next);
+                            setTimeout(() => {
+                                try {
+                                    const r = runInstallHeadless({ scope: next.scope, mode: next.mode });
+                                    setS({ ...next, step: 'done', result: r });
+                                }
+                                catch (e) {
+                                    setS({ ...next, step: 'done', error: e instanceof Error ? e.message : String(e) });
+                                }
+                            }, 0);
+                        } }) })] }));
+    }
+    if (s.step === 'running') {
+        return _jsx(Text, { children: "Installing\u2026" });
+    }
+    // step === 'done'
+    if (s.error) {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { color: "red", children: ["\u2717 Install failed: ", s.error] }), _jsx(Text, { dimColor: true, children: "Enter to exit" })] }));
+    }
+    const r = s.result;
+    if (r.mode === 'dry-run') {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Dry run \u2014 no files written" }), r.added.length === 0 ? (_jsx(Text, { children: "(already installed \u2014 no changes needed)" })) : (r.added.map((ev) => _jsx(Text, { children: `  + ${ev}` }, ev))), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Enter to exit" }) })] }));
+    }
+    if (r.alreadyInstalled) {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "vge-cc-guard hooks already installed." }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Enter to exit" }) })] }));
+    }
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { color: "green", children: ["\u2713 Hooks installed to ", r.settingsPath] }), _jsx(Text, { children: "Restart Claude Code to activate." }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "Configure API key now? (y / n)" }) })] }));
+}
+export async function runInstallWizard(initialScope) {
+    let offerConfig = false;
+    await new Promise((resolve) => {
+        const Mount = () => {
+            const { exit } = useApp();
+            return (_jsx(Wizard, { initialScope: initialScope, onExit: (oc) => {
+                    offerConfig = oc;
+                    exit();
+                } }));
+        };
+        const inst = render(_jsx(Mount, {}));
+        inst.waitUntilExit().then(() => resolve());
+    });
+    if (offerConfig) {
+        await new Promise((resolve) => {
+            const inst = render(_jsx(ConfigApp, {}));
+            inst.waitUntilExit().then(() => resolve());
+        });
+    }
+}
+//# sourceMappingURL=install-wizard.js.map

package/dist/commands/install-wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-wizard.js","sourceRoot":"","sources":["../../src/commands/install-wizard.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAsB,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAiBjD,SAAS,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,EAAS;IAC7C,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAQ;QAChC,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,QAAQ,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,MAAM;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACzB,IAAI,KAAK,KAAK,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;iBAChC,IAAI,KAAK,KAAK,GAAG;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,KAAC,IAAI,IAAC,IAAI,oCAAqB,EAC/B,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,UAAU,IACT,KAAK,EAAE;4BACL,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,EAAE,WAAW,EAAE,uCAAuC,EAAE;4BAC9G,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,mCAAmC,EAAE,WAAW,EAAE,mBAAmB,EAAE;yBACjG,EACD,YAAY,EAAE,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC7C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAC7E,GACE,IACF,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,KAAC,IAAI,IAAC,IAAI,mCAAoB,EAC9B,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,UAAU,IACT,KAAK,EAAE;4BACL,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,8BAA8B,EAAE;4BAC7E,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,iCAAiC,EAAE;yBACrF,EACD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;4BACd,MAAM,IAAI,GAAU,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;4BAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;4BACX,UAAU,CAAC,GAAG,EAAE;gCACd,IAAI,CAAC;oCACH,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oCACrE,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gCAC7C,CAAC;gCAAC,OAAO,CAAC,EAAE,CAAC;oCACX,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gCACrF,CAAC;4BACH,CAAC,EAAE,CAAC,CAAC,CAAC;wBACR,CAAC,GACD,GACE,IACF,CACP,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAC,IAAI,mCAAmB,CAAC;IAClC,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,MAAC,IAAI,IAAC,KAAK,EAAC,KAAK,wCAAoB,CAAC,CAAC,KAAK,IAAQ,EACpD,KAAC,IAAI,IAAC,QAAQ,oCAAqB,IAC/B,CACP,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAO,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,KAAC,IAAI,IAAC,IAAI,sDAAkC,EAC3C,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACtB,KAAC,IAAI,+DAA+C,CACrD,CAAC,CAAC,CAAC,CACF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAC,IAAI,cAAW,OAAO,EAAE,EAAE,IAAhB,EAAE,CAAsB,CAAC,CACzD,EACD,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YAAE,KAAC,IAAI,IAAC,QAAQ,oCAAqB,GAAM,IACxD,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,KAAC,IAAI,wDAA6C,EAClD,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YAAE,KAAC,IAAI,IAAC,QAAQ,oCAAqB,GAAM,IACxD,CACP,CAAC;IACJ,CAAC;IACD,OAAO,CACL,MAAC,GAAG,IAAC,aAAa,EAAC,QAAQ,aACzB,MAAC,IAAI,IAAC,KAAK,EAAC,OAAO,2CAAuB,CAAC,CAAC,YAAY,IAAQ,EAChE,KAAC,IAAI,mDAAwC,EAC7C,KAAC,GAAG,IAAC,SAAS,EAAE,CAAC,YACf,KAAC,IAAI,iDAAsC,GACvC,IACF,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,YAAgC;IACrE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,GAAuB,EAAE;YACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YAC1B,OAAO,CACL,KAAC,MAAM,IACL,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE;oBACb,WAAW,GAAG,EAAE,CAAC;oBACjB,IAAI,EAAE,CAAC;gBACT,CAAC,GACD,CACH,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAC,KAAK,KAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAC,SAAS,KAAG,CAAC,CAAC;YACnC,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/commands/install.d.ts

@@ -0,0 +1,15 @@
+import { type InstallScope } from './_lib/install-paths.js';
+export interface InstallResult {
+    scope: InstallScope;
+    mode: 'apply' | 'dry-run';
+    alreadyInstalled: boolean;
+    settingsPath: string;
+    added: readonly string[];
+    applied: boolean;
+}
+export declare function runInstallHeadless(opts: {
+    scope: InstallScope;
+    mode: 'apply' | 'dry-run';
+}): InstallResult;
+export declare function runInstall(args: string[]): Promise<void>;
+//# sourceMappingURL=install.d.ts.map

package/dist/commands/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAKA,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAkEjC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAAG,aAAa,CAqC1G;AAwBD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D"}

package/dist/commands/install.js

@@ -0,0 +1,136 @@
+import fs from 'fs';
+import * as path from 'path';
+import { DEFAULT_CONFIG } from '../shared/config-schema.js';
+import { chmodPrivateSync, writePrivateFileSync } from '../shared/private-file.js';
+import { parseInstallFlags } from './_lib/parse-install-flags.js';
+import { backupPath, installsDir, metaPath, resolveClaudeDir, resolveSettingsPath, resolveVgeDir, } from './_lib/install-paths.js';
+const HOOK_EVENTS = ['UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'SessionStart', 'SessionEnd', 'SubagentStart', 'SubagentStop'];
+const HOOK_COMMANDS = {
+    UserPromptSubmit: 'vge-cc-guard hook userprompt',
+    PreToolUse: 'vge-cc-guard hook pretool',
+    PostToolUse: 'vge-cc-guard hook posttool',
+    SessionStart: 'vge-cc-guard hook sessionstart',
+    SessionEnd: 'vge-cc-guard hook sessionend',
+    SubagentStart: 'vge-cc-guard hook subagentstart',
+    SubagentStop: 'vge-cc-guard hook subagentstop',
+};
+function readSettings(settingsPath) {
+    if (!fs.existsSync(settingsPath))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+    }
+    catch {
+        throw new Error(`settings.json at ${settingsPath} is not valid JSON — aborting to avoid data loss.`);
+    }
+}
+function isHookPresent(settings, event) {
+    const hooks = settings['hooks'];
+    if (!hooks?.[event])
+        return false;
+    const entries = hooks[event];
+    return entries.some((e) => e.hooks?.some((h) => h.command?.includes('vge-cc-guard hook')));
+}
+function mergeHooks(settings) {
+    const merged = { ...settings };
+    const existingHooks = settings['hooks'] ?? {};
+    const newHooks = { ...existingHooks };
+    for (const event of HOOK_EVENTS) {
+        if (isHookPresent(settings, event))
+            continue;
+        const existing = newHooks[event] ?? [];
+        newHooks[event] = [
+            ...existing,
+            { matcher: '*', hooks: [{ type: 'command', command: HOOK_COMMANDS[event] }] },
+        ];
+    }
+    return { ...merged, hooks: newHooks };
+}
+// PR-review S2: crash-safe atomic write — fsync before rename so a power-loss
+// between rename and the next OS flush can't leave a zero-length settings.json.
+function writeAtomic(filePath, content) {
+    const tmp = filePath + '.tmp';
+    try {
+        writePrivateFileSync(tmp, content);
+        fs.renameSync(tmp, filePath);
+        chmodPrivateSync(filePath);
+    }
+    catch (error) {
+        fs.rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+function writeDefaultConfig(configPath) {
+    if (!fs.existsSync(configPath)) {
+        writePrivateFileSync(configPath, JSON.stringify(DEFAULT_CONFIG, null, 2));
+    }
+}
+export function runInstallHeadless(opts) {
+    const claudeDir = resolveClaudeDir(opts.scope);
+    const settingsPath = resolveSettingsPath(opts.scope);
+    const vgeDir = resolveVgeDir();
+    const current = readSettings(settingsPath);
+    const updated = mergeHooks(current);
+    const alreadyInstalled = HOOK_EVENTS.every((e) => isHookPresent(current, e));
+    const added = HOOK_EVENTS.filter((e) => !isHookPresent(current, e));
+    if (opts.mode === 'dry-run') {
+        return { scope: opts.scope, mode: 'dry-run', alreadyInstalled, settingsPath, added, applied: false };
+    }
+    fs.mkdirSync(vgeDir, { recursive: true });
+    fs.mkdirSync(path.join(vgeDir, 'sessions'), { recursive: true });
+    const configPath = path.join(vgeDir, 'config.json');
+    writeDefaultConfig(configPath);
+    if (alreadyInstalled) {
+        return { scope: opts.scope, mode: 'apply', alreadyInstalled: true, settingsPath, added: [], applied: false };
+    }
+    fs.mkdirSync(installsDir(), { recursive: true });
+    writePrivateFileSync(backupPath(settingsPath), JSON.stringify(current, null, 2));
+    const backupMeta = {
+        scope: opts.scope,
+        settingsPath,
+        installedAt: new Date().toISOString(),
+    };
+    writePrivateFileSync(metaPath(settingsPath), JSON.stringify(backupMeta, null, 2));
+    fs.mkdirSync(claudeDir, { recursive: true });
+    writeAtomic(settingsPath, JSON.stringify(updated, null, 2));
+    return { scope: opts.scope, mode: 'apply', alreadyInstalled: false, settingsPath, added, applied: true };
+}
+function printResult(r) {
+    if (r.mode === 'dry-run') {
+        console.log('\n[dry-run] Changes that would be applied to settings.json:');
+        if (r.added.length === 0)
+            console.log('  (already installed — no changes needed)');
+        else
+            for (const ev of r.added)
+                console.log(`  + ${ev}: ${HOOK_COMMANDS[ev]}`);
+        console.log('\nRun with --apply to apply changes.\n');
+        return;
+    }
+    if (r.alreadyInstalled) {
+        console.log('vge-cc-guard hooks already installed. Nothing to do.');
+        return;
+    }
+    if (r.applied) {
+        console.log(`vge-cc-guard hooks installed to ${r.settingsPath}`);
+        console.log('Restart Claude Code to activate. Run `vge-cc-guard config` to set your API key.');
+        console.log('');
+        // PR-review W5: Write/Edit ship as gate=block by design (PRD §7.5).
+        console.log('NOTE: Write and Edit are gated as `block` by default for safety.');
+        console.log('      Run `vge-cc-guard config` (Tools Policy) to flip them per project.');
+    }
+}
+export async function runInstall(args) {
+    const flags = parseInstallFlags(args);
+    if (flags.mode === 'wizard') {
+        if (!process.stdin.isTTY) {
+            console.log('Use --apply to apply changes or --dry-run to preview.');
+            return;
+        }
+        const { runInstallWizard } = await import('./install-wizard.js');
+        await runInstallWizard(flags.scope);
+        return;
+    }
+    const result = runInstallHeadless({ scope: flags.scope, mode: flags.mode });
+    printResult(result);
+}
+//# sourceMappingURL=install.js.map

package/dist/commands/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAqB,MAAM,+BAA+B,CAAC;AACrF,OAAO,EACL,UAAU,EACV,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,GAGd,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,GAAG,CAAC,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,CAAU,CAAC;AAC9I,MAAM,aAAa,GAA2B;IAC5C,gBAAgB,EAAE,8BAA8B;IAChD,UAAU,EAAE,2BAA2B;IACvC,WAAW,EAAE,4BAA4B;IACzC,YAAY,EAAE,gCAAgC;IAC9C,UAAU,EAAE,8BAA8B;IAC1C,aAAa,EAAE,iCAAiC;IAChD,YAAY,EAAE,gCAAgC;CAC/C,CAAC;AAEF,SAAS,YAAY,CAAC,YAAoB;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAA4B,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,YAAY,mDAAmD,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAiC,EAAE,KAAa;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAA0C,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAmD,CAAC;IAC/E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,UAAU,CAAC,QAAiC;IACnD,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAI,QAAQ,CAAC,OAAO,CAA2C,IAAI,EAAE,CAAC;IACzF,MAAM,QAAQ,GAA8B,EAAE,GAAG,aAAa,EAAE,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,SAAS;QAC7C,MAAM,QAAQ,GAAI,QAAQ,CAAC,KAAK,CAAe,IAAI,EAAE,CAAC;QACtD,QAAQ,CAAC,KAAK,CAAC,GAAG;YAChB,GAAG,QAAQ;YACX,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9B,IAAI,CAAC;QACH,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7B,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,kBAAkB,CAAC,IAAwD;IACzF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAEpE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE/B,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/G,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEjF,MAAM,UAAU,GAA0B;QACxC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY;QACZ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAElF,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAED,SAAS,WAAW,CAAC,CAAgB;IACnC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;;YAC9E,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,oEAAoE;QACpE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,KAAK,GAAiB,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAEpD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjE,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,WAAW,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}

package/dist/commands/reset-session.d.ts

@@ -0,0 +1,2 @@
+export declare function runResetSession(): Promise<void>;
+//# sourceMappingURL=reset-session.d.ts.map

package/dist/commands/reset-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-session.d.ts","sourceRoot":"","sources":["../../src/commands/reset-session.ts"],"names":[],"mappings":"AAyGA,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA0BrD"}

package/dist/commands/reset-session.js

@@ -0,0 +1,113 @@
+import * as fs from 'fs';
+import * as http from 'http';
+import * as os from 'os';
+import * as path from 'path';
+import { getIpcAddress } from '../shared/ipc-address.js';
+import { readDaemonToken, tokenHeader } from '../shared/daemon-token.js';
+import { writePrivateFileSync } from '../shared/private-file.js';
+function resolveVgeDir() {
+    return process.env['VGE_CC_GUARD_CONFIG_DIR'] ?? path.join(os.homedir(), '.vge-cc-guard');
+}
+function resolveSessionsDir() {
+    return path.join(resolveVgeDir(), 'sessions');
+}
+function resolveSocketPath() {
+    return getIpcAddress();
+}
+function loadSessions(sessionsDir) {
+    if (!fs.existsSync(sessionsDir))
+        return [];
+    const files = fs.readdirSync(sessionsDir).filter((f) => f.endsWith('.json'));
+    const sessions = [];
+    for (const file of files) {
+        const filePath = path.join(sessionsDir, file);
+        try {
+            const data = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+            sessions.push({
+                sessionId: data['sessionId'],
+                lastActivity: data['lastActivity'] ?? 0,
+                filePath,
+                data,
+            });
+        }
+        catch {
+            // skip malformed files
+        }
+    }
+    return sessions.sort((a, b) => b.lastActivity - a.lastActivity);
+}
+// PR-review C1: prefer the daemon's control endpoint so that in-memory state
+// (sessionStore) is reset alongside the disk file. Falls back to disk-only
+// mutation when the daemon isn't reachable.
+function tryDaemonReset(sessionId) {
+    return new Promise((resolve) => {
+        const body = JSON.stringify({ session_id: sessionId });
+        const token = readDaemonToken();
+        const req = http.request({
+            socketPath: resolveSocketPath(),
+            path: '/v1/control/reset-session',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(body),
+                ...(token ? tokenHeader(token) : {}),
+            },
+            timeout: 2_000,
+        }, (res) => {
+            res.on('data', () => undefined);
+            res.on('end', () => {
+                if (res.statusCode === 401) {
+                    resolve('unauthorized');
+                    return;
+                }
+                resolve((res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300 ? 'reset' : 'unreachable');
+            });
+        });
+        req.on('error', () => resolve('unreachable'));
+        req.on('timeout', () => {
+            req.destroy();
+            resolve('unreachable');
+        });
+        req.write(body);
+        req.end();
+    });
+}
+function resetOnDisk(target) {
+    const updated = {
+        ...target.data,
+        allowlist: [],
+        allowlistEscalationIds: {},
+        blocklist: [],
+        blocklistEscalationIds: {},
+        pendingEscalations: [],
+        escalationCount: 0,
+        urlAllowOnce: [],
+        state: 'clean',
+    };
+    writePrivateFileSync(target.filePath, JSON.stringify(updated, null, 2));
+}
+export async function runResetSession() {
+    const sessions = loadSessions(resolveSessionsDir());
+    if (sessions.length === 0) {
+        console.log('No active sessions found.');
+        return;
+    }
+    const target = sessions[0];
+    const daemonReset = await tryDaemonReset(target.sessionId);
+    if (daemonReset === 'reset') {
+        console.log(`Session reset (via daemon): ${target.sessionId}`);
+        console.log('The session will resume in clean state.');
+        return;
+    }
+    if (daemonReset === 'unauthorized') {
+        console.log('Session reset failed: daemon rejected the local authorization token.');
+        return;
+    }
+    // Daemon unreachable — disk-only fallback. Will be authoritative iff the
+    // daemon never starts back up; otherwise the daemon's next persistSession
+    // for this session would overwrite the reset.
+    resetOnDisk(target);
+    console.log(`Session reset (disk-only — daemon was not reachable): ${target.sessionId}`);
+    console.log('Restart Claude Code if the session looks stuck.');
+}
+//# sourceMappingURL=reset-session.js.map