@westbayberry/dg 2.1.0 → 2.3.0

package/README.md

@@ -1,8 +1,14 @@
 # @westbayberry/dg
 
-Dependency Guardian's command-line scanner. It checks the packages you are
-about to install or publish and tells you whether Dependency Guardian
-verified them, flagged them, or blocked them before they reach your machine.
+[![npm version](https://img.shields.io/npm/v/@westbayberry/dg)](https://www.npmjs.com/package/@westbayberry/dg)
+[![CI](https://github.com/WestBayBerry/DG_CLI/actions/workflows/ci.yml/badge.svg)](https://github.com/WestBayBerry/DG_CLI/actions/workflows/ci.yml)
+[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)
+
+Dependency Guardian is a supply-chain firewall for npm and PyPI. The `dg` CLI
+checks a package against the scanner before its code can run, so a malicious
+install is blocked before its install scripts execute, not flagged afterward.
+It scans published package artifacts from the registry; your source code stays
+on your machine.
 
 ## Install
 
@@ -10,289 +16,273 @@ verified them, flagged them, or blocked them before they reach your machine.
 npm install -g @westbayberry/dg
 ```
 
-Requires Node.js >= 22.14. The npm package is zero-footprint on install: it
-adds only the `dg` binary and runs no install lifecycle scripts. Persistent
-shell/shim changes happen only when you run `dg setup` explicitly.
+Requires Node.js >= 22.14. Installing the package adds only the `dg` binary and
+runs no install lifecycle scripts of its own. The published tarball ships an
+`npm-shrinkwrap.json`, so every install resolves the exact dependency tree the
+release was audited with. Nothing touches your shell until you run `dg setup`.
 
 ## Quickstart
 
-Scan the project in the current directory:
+Audit the project in the current directory:
 
 ```bash
 dg scan
 ```
 
-`dg scan` shows a full-screen results browser in an interactive terminal and
-prints plain text or machine output otherwise. Exit code 0 means DG verified
-the project, 2 means DG blocked it.
-
-## Core concepts
+`dg scan` reads your lockfiles, asks the scanner for a verdict on each
+dependency, and opens a full-screen results browser in an interactive terminal
+(plain text or machine output otherwise). It installs nothing and runs no
+package scripts. Exit code 0 means the project is clean, 2 means a block-level
+package was found.
 
-**Verdicts.** Every result is one of three states: **PASS** (DG verified),
-**WARN** (DG flagged, review advised), or **BLOCK** (DG blocked, do not
-install). The exit code follows the verdict.
+## Verdicts
 
-**The server is the verdict source.** For authenticated registry checks and the
-install firewall, the Dependency Guardian scanner returns the verdict and the
-CLI displays it; the CLI never derives a verdict from a local score. If the
-server is unreachable, `dg scan` falls back to local heuristics and marks the
-report as such (`scannerUnavailable` in JSON output) rather than failing
-silently.
+Every result is one of three states the scanner returns: **PASS** (verified),
+**WARN** (flagged, review advised), or **BLOCK** (refused). The exit code
+follows the verdict.
 
-**The install firewall.** Prefix a package-manager command with `dg`
-(`dg npm install left-pad`) to route the install through Dependency Guardian.
-The CLI streams the package manager's live output, computes each artifact's
-SHA-256, asks the scanner for a verdict, and blocks the bytes before delivery
-on a BLOCK verdict. A block exits 2 and prints the override command; a warn
-prompts `Proceed? [y/N]` (default No) in a TTY. Passthrough commands (those
-that fetch nothing) run without a proxy.
+**The server is the verdict source.** For registry checks and the install
+firewall the scanner returns the verdict and the CLI displays it; the CLI never
+derives a verdict from a local score. If the scanner is unreachable, `dg scan`
+falls back to local heuristics and marks the report (`scannerUnavailable` in
+JSON output) rather than passing silently.
 
-## Common examples
+## The install firewall
 
-Scan only staged files in a pre-commit context:
+Prefix any install command with `dg` and the package is checked before its
+bytes reach your package manager:
 
 ```bash
-dg scan --staged
+dg npm install lodash
+dg pnpm add react
+dg pip install requests
+dg cargo add serde
 ```
 
-Verify a specific published package against the scanner:
+The prefix starts a local proxy for just that command, hashes each artifact as
+it downloads, asks the scanner for a verdict, and refuses a blocked package
+before delivery. Supported prefixes include npm, npx, pnpm, pnpx, Yarn classic,
+pip, pipx, uv, uvx, and cargo. A block exits 2 and prints the override command;
+a warn prompts `Proceed? [y/N]` (default No) in a terminal.
 
-```bash
-dg verify npm:left-pad@1.3.0
-```
+To protect bare commands too, run `dg setup`. It shows one consent screen
+listing exactly what it writes, then installs reversible, user-local shims so
+plain `npm install` and `pip install` are scanned automatically, plus a native
+hook in each AI coding agent it detects. Undo all of it with `dg uninstall`.
 
-Install a package through the firewall:
+## Command reference
 
-```bash
-dg npm install is-number@7.0.0
-```
+Run `dg <command> --help` for full flags and examples, or `dg --help-all` for
+the complete list. The exhaustive reference lives at
+[westbayberry.com/docs/cli-reference](https://westbayberry.com/docs/cli-reference).
 
-Check what you are about to publish for leaked secrets and risky lifecycle
-scripts, fully locally:
+### dg scan [path]
 
-```bash
-dg audit . --local
-```
+Audits the project's lockfiles for the path (current directory by default).
+Read-only: it never installs, runs package scripts, or changes setup state.
+Reads `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`,
+`pnpm-lock.yaml`, `requirements.txt`, `poetry.lock`, `Pipfile.lock`, and
+`uv.lock`, including nested projects in a monorepo.
 
-Produce CI-friendly machine output:
+- Flags: `--staged`, `--json`, `--sarif`, `--output <file>`, `--no-decisions`.
+- Exit codes: 0 pass, 1 warn (strict mode upgrades warn to 2), 2 block,
+  4 analysis incomplete, 10 nothing to scan. JSON output carries a
+  `schemaVersion` field and sets `scannerUnavailable` when the scanner could
+  not be reached.
 
-```bash
-dg scan --sarif --output dg-scan.sarif
-```
+### dg sbom [path]
 
-Protect every commit in a repository:
+Inventories the resolved dependency tree as a CycloneDX 1.5 software bill of
+materials, with purl, license, and integrity hash per component. Reads the same
+lockfiles as `dg scan` plus `Cargo.lock`. In a terminal it streams
+BLOCK/WARN/PASS verdicts for npm and PyPI components when signed in; cargo stays
+inventory only. Piped, with `--output` (alias `-o`), or with `--json` it stays
+offline and prints the raw CycloneDX document.
 
-```bash
-dg guard-commit install
-```
+- Flags: `--output <path>` / `-o`, `--json`, `--reproducible` (byte-stable
+  output; honors `SOURCE_DATE_EPOCH`).
 
-## Command reference
+### dg verify &lt;registry:package[@version] | path | lockfile&gt;
 
-### dg scan [path]
+Runs a real scanner check on a published package before you install it. Name
+the registry, `npm:react` or `pypi:requests`, with an optional `@version`
+(latest by default). Works signed out with a free verdict summary (the verdict,
+top reasons, provenance, and the package page link); signing in unlocks the
+full reason list, license info, `--json`, and `--output`. Verifying a local
+path, lockfile, or tarball stays free and offline.
 
-Scans package manifests and supported lockfiles for the project at `path` (the
-current directory by default). Reads manifests only; it never runs package
-scripts, installs dependencies, loads project-local config, or changes setup
-state.
+### dg licenses [path]
 
-- Flags: `--staged`, `--json`, `--sarif`, `--output <file>`.
-- Output: TUI in a rich TTY, text or machine output otherwise.
-- Exit codes: 0 PASS, 1 WARN (strict mode upgrades WARN to 2), 2 BLOCK,
-  4 analysis incomplete, 10 nothing to scan. Server unreachable falls back to
-  local heuristics and sets `scannerUnavailable` in JSON.
+SPDX license report for the dependency tree, grouped by risk. Use `--csv` or
+`--markdown` for CI artifacts and `--fail-on <risk>[,<risk>]` to exit non-zero
+when a dependency carries a named license-risk tier.
 
-### dg verify <spec | path | lockfile>
+### dg audit [path]
 
-Two paths, one exit-code contract.
+Pre-publish check of a package of your own.
+Inspects exactly the resolved publish set of one package, never the whole repo.
+Basic checks run 100% locally and upload nothing: leaked secrets and keys,
+credential files, source maps, `.git`, terraform state, risky lifecycle
+scripts, and a missing `files` allowlist. On a paid plan, and if your org allows
+it, it also runs a deep behavioral scan: a packed copy is uploaded with no
+lifecycle scripts run, raw bytes are never retained, and only the verdict and
+redacted findings reach your dashboard.
 
-- `dg verify npm:<pkg>` / `dg verify pypi:<pkg>` runs an authenticated scanner
-  check and nudges you to sign in when logged out. Flags: `--json`, `--output`,
-  `--verbose`.
-- `dg verify <path | lockfile>` runs a local advisory check on a package
-  directory, workspace, lockfile, or `.tgz`/`.tar.gz`/`.zip`/`.whl` archive.
-  Archive verification computes SHA-256 and checks archive paths before reading;
-  it never extracts to disk or runs package code. Flags: `--json`, `--sarif`,
-  `--output`.
-- Exit codes (both paths): 0 PASS, 1 WARN (or scan error on the advisory path),
-  2 BLOCK, 4 analysis incomplete (registry path).
+- Flags: `--local` (skip the upload), `--require-deep` (fail when deep can't
+  run), `--fail-on warn`.
+- Exit codes: 0 clean, 1 warn (with `--fail-on warn`), 2 block, 3 deep required
+  but unavailable, 4 analysis incomplete.
 
-### dg audit [path]
+### dg setup
 
-Inspects exactly the resolved publish set of one package, never the whole
-repo, for leaked secrets, private keys, source-control and build-artifact
-leakage, and suspicious lifecycle-script strings. Basic checks run 100% locally
-and upload nothing. On a paid plan, with org policy allowing it and only after
-explicit consent, the deep audit uploads a packed copy of an npm package to the
-scanner for a behavioral scan: no lifecycle scripts are run, raw bytes are never
-retained, and only the verdict plus redacted findings reach your dashboard.
-
-- Flags: `--json`, `--output`/`-o`, `--local` (skip the deep upload),
-  `--require-deep` (fail if the deep audit could not run), `--fail-on
-  <warn | block>`.
-- Exit codes: 0 clean (WARN counts as clean under the default `--fail-on
-  block`), 1 WARN with `--fail-on warn`, 2 BLOCK, 3 deep audit required but
-  unavailable, 4 analysis incomplete.
+Installs the shell shims so bare `npm install` / `pip install` are scanned, and
+the agent hooks, behind one consent screen. `--print` previews the exact write
+plan and changes nothing; `--yes` applies just the shell shims non-interactively
+(add `--agents` or `--guard-commit` for the others). Everything it writes is
+dg-owned and reversible with `dg uninstall`.
 
-### dg licenses [path]
+### dg guard-commit
 
-Reports license metadata from local manifests and supported lockfiles without
-calling package managers or loading project-local config.
+Installs a per-repo git pre-commit hook that scans the staged lockfile changes
+and blocks a commit that would add a malicious dependency. It chains any
+existing pre-commit hook and self-checks that git will fire it. Reverse with
+`dg guard-commit off`. `git commit --no-verify` is the override.
 
-- Flags: `--json`, `--csv`, `--output <file>`, `--fail-on <risk[,risk...]>`,
-  `--deny-license <id>`.
-- Exit codes: 0 clean, 1 when a license gate trips.
+### dg agents
 
-### Package-manager prefixes (the install firewall)
+Routes AI coding agents' installs through the firewall with a native
+pre-command hook in each agent's own config, so a malicious or unresolvable
+package is blocked before it is fetched. Supported: Claude Code, Codex CLI,
+Cursor, Gemini CLI, GitHub Copilot CLI, and Windsurf. Bare `dg agents` lists
+each agent and whether it is protected; `dg agents on` hooks every detected
+agent (or one, `dg agents on claude-code`); `dg agents --check` verifies the
+wiring; `dg agents off` removes it. `dg hook claude-code` keeps working as an
+alias.
 
-`dg npm`, `dg npx`, `dg pnpm`, `dg pnpx`, `dg yarn`, `dg pip`, `dg pipx`,
-`dg uv`, `dg uvx`, `dg cargo` route protected install/fetch commands through
-the per-invocation proxy. `dg yarn` claims Yarn classic only; `dg bun`,
-`dg conda`, and `dg mamba` and Yarn Berry remain gated and fail visibly before
-spawning.
+### dg decisions &lt;list | revoke&gt;
 
-- Live output and stdin pass through; the install decision renders after the
-  child exits.
-- A BLOCK exits 2 with an override hint. Override with `--dg-force-install`,
-  which is gated by `policy.allowForceOverride` and audited.
-- A WARN prompts `Proceed? [y/N]` (default No) in a TTY.
-- Signal deaths exit `128 + n`.
+Warn-level findings you accept at an install prompt or commit guard can be
+remembered in a committable `dg.json` at the project root, so repeat runs only
+surface new problems. A new finding category, a severity escalation, or a block
+always resurfaces; blocks can never be acknowledged away. `dg decisions list`
+shows what the project accepted; `dg decisions revoke` removes an entry.
 
-### dg guard-commit
+### dg cooldown [&lt;age&gt; | off]
+
+Quarantines new installs of a registry release younger than `cooldown.age`
+(default `24h`), since most malicious releases are caught within their first
+day. Change it with `dg cooldown 7d` or disable it with `dg cooldown off`.
+Lockfile scans are never failed by cooldown; packages you already depend on get
+a display annotation only. `dg cooldown exempt <name>` records a shareable
+exemption in `dg.json`.
+
+### dg config &lt;get | set | unset | list&gt;
 
-Installs a per-repo, reversible git pre-commit hook that scans staged changes.
+Views or edits user-global configuration in `~/.dg/config.json`. The everyday
+key is `policy.mode` (`off`, `warn`, `block` the default, or `strict`), which
+sets how a flagged package is handled. There is no detection-tuning knob;
+`policy.mode` changes only how a flagged package is handled, not what the
+scanner looks for.
 
-- Subcommands/flags: `install`, `off` (`remove`/`uninstall`), `--check`,
-  `--print`, `--yes`.
-- Chains any pre-existing pre-commit hook; `dg guard-commit off` removes only
-  the dg-owned hook.
+### dg login / dg logout --yes
 
-### dg setup / dg uninstall / dg doctor
+`dg login` signs in via your browser and links this machine to your account;
+`dg login --token dg_live_...` authenticates CI without the browser flow.
+Scanning works without an account. `dg logout --yes` removes the saved token
+from this machine (the token stays valid until you revoke it from the
+dashboard).
 
-- `dg setup` (POSIX only; `win32` exits 69) writes dg-owned package-manager
-  shims under `~/.dg/shims` and a sentinel block in your shell rc, recording
-  every write in the cleanup registry. `--print` shows the plan without
-  changing files; `--yes` applies it; `--service` opts into service mode.
-- `dg uninstall` reverses dg-owned writes and leaves user content untouched.
-  Flags: `--yes`, `--keep-config`, `--all`, `--service`. `--all` conflicts
-  with `--keep-config`.
-- `dg doctor` reports local setup health and prints concrete unavailable
-  status for optional gates (Windows, Python `.pth` hook, git hooks, Bun, Yarn
-  Berry, conda, mamba) instead of claiming them. `--json` for machine output.
+### dg doctor
+
+Checks runtime, auth, API, policy, setup shims, PATH precedence, real-binary
+resolution, stale state, and service state. Every non-pass line ends with the
+exact fix command. `--json` for machine output.
 
 ### dg service
 
-Explicit, reversible service mode: `dg service start | stop | restart | status
-| doctor | uninstall`, plus consent-gated `dg service trust install |
-uninstall`. Trust records store only public certificate fingerprints, provider,
-target, and timestamps, never private keys. `dg service status`/`doctor`
-detect stale runtime state and `dg service restart` clears it.
+Service mode runs a persistent local proxy plus a managed certificate authority
+so installs are scanned continuously, for CI runners and private registries
+where a per-command proxy is not enough. A paid feature; run `dg login` first,
+then `dg service start`. Fully reversible with `dg uninstall --service`.
+
+### dg update
 
-### dg login / dg logout
+Checks whether a newer CLI version is published and prints the exact
+`npm install -g` command to run. It never installs anything and never mutates
+the installed package; you run the printed command yourself. Alias: `dg upgrade`.
 
-`dg login` stores a user-local auth token under the dg config directory and
-prints only a redacted preview. `dg logout --yes` removes that auth file
-without touching setup state or user config.
+### dg uninstall
 
-### dg config
+Removes registered dg-owned setup and service writes, state, cache, sessions,
+shims, and shell-rc sentinel blocks while preserving unrelated user content.
+Run it before `npm uninstall -g @westbayberry/dg`.
 
-`dg config set <key> <value>`, `dg config get <key>`, `dg config list`
-(`--json`). Keys: `api.baseUrl`, `org.id`, `policy.mode`,
-`policy.trustProjectAllowlists`, `policy.allowForceOverride`,
-`policy.scriptHardening`, `telemetry.enabled`, `webhooks.enabled`.
+## Exit codes
 
-### dg update / dg upgrade
+Stable, so CI and shells can read them directly:
 
-Check the latest published version when registry metadata is available and
-print the exact `npm install -g @westbayberry/dg@<version>` command. They never
-run the package manager themselves. `upgrade` is an alias of `update`; `--json`
-for machine output.
+| Code | Meaning |
+| --- | --- |
+| `0` | Clean. The requested action is allowed. |
+| `1` | Warn-level result (strict policy upgrades this to `2`). |
+| `2` | Block: a block-level package, a denied install, or an unknown command. |
+| `3` | `dg audit --require-deep` ran but the deep scan was unavailable. |
+| `4` | Analysis incomplete; not a clean pass. |
+| `10` | `dg scan` found nothing to scan. |
+| `64` | A usage error (bad flags or arguments). |
+| `69` | A command unavailable or gated on this platform, or a signed-out `dg verify` asking for `--json`/`--output`. |
+| `70` | Internal tool error (for example, a report file could not be written). |
+| `130` / `143` | Interrupted by SIGINT (Ctrl-C) or SIGTERM. |
+
+## What dg sends to the API
+
+The CLI sends no telemetry: no crash reporter and no analytics endpoint. It
+talks to the network only when a command needs it.
+
+- **Scanning** sends package names and pinned versions from your lockfiles to
+  the scan API, which pulls the actual package artifacts from the public
+  registry on its side. Your source never leaves your machine.
+- **The install firewall** asks the server for a verdict on each artifact as it
+  downloads: name, version, ecosystem, registry host, download URL, and the
+  artifact's SHA-256.
+- **Deep audit** (`dg audit`, opt-in, paid) uploads a packed copy of your own
+  package to `/v1/scan-tarball`; raw bytes are never retained.
+- **Version check** queries the public npm registry for `@westbayberry/dg` at
+  most once a day in an interactive terminal. Set `CI=1` to skip it.
+
+Authenticate CI with `DG_API_KEY` (a `dg_live_*` or `dg_test_*` key;
+`DG_API_TOKEN` is an accepted alias). Full detail:
+[westbayberry.com/docs/telemetry](https://westbayberry.com/docs/telemetry).
+
+## Use in CI
 
-### dg status / dg explain / dg completion
+```bash
+npm install -g @westbayberry/dg
+export DG_API_KEY="dg_live_..."   # from Settings -> CI keys
+dg scan
+```
 
-- `dg status` reports auth, API, and prefix-mode state for the current machine.
-- `dg explain <id>` returns the explanation and next step for a firewall cause
-  or local scan finding.
-- `dg completion <bash | zsh | fish>` prints a shell completion script.
+A non-zero exit means a block-level finding; wire that into your pipeline's
+pass/fail. The CLI auto-detects CI and switches to non-interactive output; pass
+`--json` or `--sarif` when a parser reads stdout. On GitHub, the
+[GitHub App](https://westbayberry.com/docs#github-app) is the simpler path and
+posts a required PR status check.
 
-## Configuration
+## Documentation
 
-Config lives in `~/.dg/config.json` (mode 0600). Set values with `dg config
-set`.
+- [Getting started](https://westbayberry.com/docs)
+- [CLI reference](https://westbayberry.com/docs/cli-reference)
+- [Blocking behavior](https://westbayberry.com/docs/blocking)
+- [Integrations](https://westbayberry.com/docs/integrations)
+- [Telemetry](https://westbayberry.com/docs/telemetry)
 
-| Key | Purpose |
-| --- | --- |
-| `api.baseUrl` | Dependency Guardian API endpoint |
-| `org.id` | Organization the CLI reports to |
-| `policy.mode` | `off`, `warn`, `block`, or `strict` |
-| `policy.trustProjectAllowlists` | Whether project-local allowlists are trusted |
-| `policy.allowForceOverride` | Whether `--dg-force-install` is permitted |
-| `policy.scriptHardening` | Preserve script-disabling flags; never re-enable scripts |
-| `telemetry.enabled` | Telemetry (off by default) |
-| `webhooks.enabled` | Webhook outbox delivery |
-
-Project-local allowlists never suppress an install firewall block unless
-user-global or org policy explicitly trusts them.
-
-Telemetry is disabled by default. When enabled, the CLI appends command and
-install-decision events to a local `telemetry.jsonl` file in the dg state
-directory, limited to a fixed attribute allowlist. Nothing is transmitted
-anywhere; the file never leaves your machine.
-
-### Environment variables
-
-- `DG_API_TOKEN`: auth token; overrides the token stored in the config file.
-- `DG_PRIVATE_REGISTRY_HOSTS`: comma-separated hosts whose URL-fallback
-  artifacts are eligible for private-registry scan upload.
-- `DG_SCAN_TARBALL_UPLOAD`: set to `1` to enable private-registry artifact
-  upload to `/v1/scan-tarball` (requires `DG_API_TOKEN`).
-- `DG_SERVICE_TRUST_STORE_BACKEND` / `DG_SERVICE_TRUST_STORE_DIR`: for
-  CI/Docker, set the backend to `file` and a directory to copy the active
-  public CA certificate into an image-local trust directory without touching
-  the host OS trust store.
-- `NO_COLOR` / `FORCE_COLOR`: disable or force ANSI color output.
+## Reporting a vulnerability
 
-## Exit codes
+Please report security issues privately through GitHub's
+[private vulnerability reporting](https://github.com/WestBayBerry/DG_CLI/security/advisories/new)
+rather than a public issue.
 
-Codes shared by every command:
+## License
 
-| Code | Meaning |
-| --- | --- |
-| 0 | PASS / clean |
-| 1 | WARN |
-| 2 | BLOCK, or a usage error |
-| 4 | analysis incomplete |
-| 69 | command unavailable or gated on this platform |
-| 70 | internal error |
-| 128 + n | child killed by signal n (firewall installs) |
-| 130 / 143 | interrupted (SIGINT / SIGTERM) |
-
-Per-command specifics:
-
-- `dg scan`: strict mode upgrades WARN (1) to BLOCK (2); 10 means nothing to
-  scan.
-- `dg audit`: 3 means a deep audit was required but unavailable; under the
-  default `--fail-on block`, WARN exits 0.
-- `dg verify` (registry path): 4 means analysis incomplete; the advisory path
-  reports a scan error as 1.
-
-## Troubleshooting
-
-Run `dg doctor` first; it reports Node version, package health, config
-readability, shim/PATH state, and which optional gates are unavailable.
-
-- "Scanner unavailable" / `scannerUnavailable` in JSON: the API was
-  unreachable and `dg scan` fell back to local heuristics. Check `api.baseUrl`
-  and network access.
-- A safe package was blocked: confirm `policy.mode`; `strict` upgrades WARN to
-  BLOCK. Use `dg explain <id>` to see the cause.
-- An install firewall block you need to override: rerun with
-  `--dg-force-install`, allowed only when `policy.allowForceOverride` is set;
-  the override is audited.
-- `dg setup` exits 69 on Windows: setup is POSIX-only.
-- An older `dg` runs instead of the installed one: run `which -a dg` and fix
-  PATH precedence.
-
-## Links
-
-- Documentation: https://westbayberry.com/docs
-- Pricing: https://westbayberry.com/pricing
+Apache-2.0. See [LICENSE](./LICENSE). Issues and pull requests are welcome at
+[github.com/WestBayBerry/DG_CLI](https://github.com/WestBayBerry/DG_CLI).

package/dist/agents/claude-code.js

@@ -0,0 +1,123 @@
+import { join } from "node:path";
+import { formatScreenedNote } from "../launcher/agent-check.js";
+import { dirExists, mergedJsonHook, LEGACY_AGENT_HOOK_SENTINEL } from "./persistence.js";
+const SIGNATURE = "hook-exec claude-code";
+function configPath(home) {
+    return join(home, ".claude", "settings.json");
+}
+function isDgGroup(group) {
+    if (typeof group !== "object" || group === null) {
+        return false;
+    }
+    const hooks = group.hooks;
+    if (!Array.isArray(hooks)) {
+        return false;
+    }
+    return hooks.some((h) => typeof h === "object" &&
+        h !== null &&
+        typeof h.command === "string" &&
+        h.command.includes(SIGNATURE));
+}
+function dgGroup(dgCommand) {
+    return { matcher: "Bash", hooks: [{ type: "command", command: dgCommand, timeout: 60 }] };
+}
+// Idempotently insert the dg PreToolUse group, preserving every other key the
+// user has in their settings (round-trips unknown keys).
+export function insertDgHook(settings, dgCommand) {
+    const next = { ...settings };
+    const hooks = typeof next.hooks === "object" && next.hooks !== null ? { ...next.hooks } : {};
+    const pre = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+    hooks.PreToolUse = [...pre.filter((g) => !isDgGroup(g)), dgGroup(dgCommand)];
+    next.hooks = hooks;
+    return next;
+}
+export function removeDgHook(settings) {
+    const next = { ...settings };
+    if (typeof next.hooks !== "object" || next.hooks === null) {
+        return { settings: next, changed: false, empty: Object.keys(next).length === 0 };
+    }
+    const hooks = { ...next.hooks };
+    const pre = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+    const withoutDg = pre.filter((g) => !isDgGroup(g));
+    const changed = withoutDg.length !== pre.length;
+    if (withoutDg.length > 0) {
+        hooks.PreToolUse = withoutDg;
+    }
+    else {
+        delete hooks.PreToolUse;
+    }
+    if (Object.keys(hooks).length > 0) {
+        next.hooks = hooks;
+    }
+    else {
+        delete next.hooks;
+    }
+    return { settings: next, changed, empty: Object.keys(next).length === 0 };
+}
+function hasDgHook(settings) {
+    const hooks = settings.hooks?.PreToolUse;
+    return Array.isArray(hooks) && hooks.some((g) => isDgGroup(g));
+}
+function parseInput(stdin) {
+    try {
+        const obj = JSON.parse(stdin);
+        const command = obj.tool_input?.command;
+        if (typeof command !== "string") {
+            return null;
+        }
+        return typeof obj.cwd === "string" ? { command, cwd: obj.cwd } : { command };
+    }
+    catch {
+        return null;
+    }
+}
+// Claude Code PreToolUse contract: emit a decision only to deny/ask; stay
+// silent ({}) on allow so we never override the user's normal permission flow.
+function emitDecision(verdict) {
+    if (verdict.decision === "allow") {
+        const note = verdict.screened ? formatScreenedNote(verdict.screened) : "";
+        if (note) {
+            return {
+                stdout: JSON.stringify({
+                    hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: note },
+                }),
+                exitCode: 0,
+            };
+        }
+        return { stdout: "{}", exitCode: 0 };
+    }
+    return {
+        stdout: JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: verdict.decision,
+                ...(verdict.reason ? { permissionDecisionReason: verdict.reason } : {}),
+            },
+        }),
+        exitCode: 0,
+    };
+}
+export const claudeCodeIntegration = {
+    id: "claude-code",
+    label: "Claude Code",
+    kind: "merged-json",
+    maturity: "verified",
+    minVersion: null,
+    configPath,
+    detect: (home) => dirExists(join(home, ".claude")),
+    probeHookSupport: (home) => ({
+        supported: true,
+        detail: dirExists(join(home, ".claude"))
+            ? "Claude Code settings directory found"
+            : "settings hooks are supported by every Claude Code version; ~/.claude will be created",
+    }),
+    parseInput,
+    emitDecision,
+    ...mergedJsonHook({
+        checkName: "dg PreToolUse hook",
+        legacySentinels: [LEGACY_AGENT_HOOK_SENTINEL],
+        insert: insertDgHook,
+        remove: removeDgHook,
+        isInstalled: hasDgHook,
+    }),
+};