@winding-labs/glow 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,16 @@
+MIT License
+
+Copyright (c) 2026 Winding Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
+Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,45 @@
-# Temporary Holding Version
+# Glow for coding agents
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+```
+npx @winding-labs/glow
+```
+
+Run it once on your computer. It finds the coding agents you use (Claude Code, Codex), pairs the computer with your
+Glow workspace (you approve it in Glow with your passkey, then type the 6-digit code Glow shows you back into the
+terminal), and adds a small hook to each agent. From then on, every
+session in a repo that's linked to one of your products keeps one post in that product's channel: what it did, its
+branch, commits and pull request. From that post in Glow you can send the session a message, and the agent gets it.
+
+## What it sends, and where
+
+- **Only to Glow** (`https://app.meetglow.ai`). The address is fixed when you set up and can't be changed by a repo or
+  an environment variable (the hook runs with an empty environment but `HOME` and `PATH`).
+- **Only from linked repos.** A session in any other repo sends nothing. You link repos to products in Glow.
+- **Only the agent's last reply**, with keys and tokens masked, plus the branch, the titles of the branch's commits and
+  a pull request link on the same repo. Never your code, files, prompts or the transcript.
+- Glow turns the reply into a short summary right away and **doesn't keep the reply itself**.
+- This computer's key can do three things: send a report, read which repos are linked, and fetch messages you sent to
+  its sessions. It can't read anything else in your workspace. It stops working after 90 days unused.
+
+## Messages back
+
+Only the person who paired the computer can message its sessions, and Glow asks them for Face ID or their passkey
+first. Claude Code picks a message up while it's idle (for 25 minutes after its last reply); Codex picks it up when its
+current turn ends. Don't want that? `npx @winding-labs/glow messages off` on the computer.
+
+## Commands
+
+```
+npx @winding-labs/glow                 set up (or add an agent you installed later)
+npx @winding-labs/glow status          what's set up and which repos report
+npx @winding-labs/glow off | on        stop or start sending from this computer
+npx @winding-labs/glow messages off    messages from Glow no longer reach your agents here (messages on: again)
+npx @winding-labs/glow uninstall       remove the hooks, revoke the key, delete ~/.glow
+```
+
+Codex asks before it runs any new hook: open Codex and run `/hooks` once to trust Glow's.
+
+Files: `~/.glow/` (the key, owner-only), a `Stop` hook in `~/.claude/settings.json` and `~/.codex/hooks.json` (a
+symlinked settings file stays a link). The first time, the originals are copied to `*.before-glow`.
+
+Security: [SECURITY.md](SECURITY.md).

package/SECURITY.md

@@ -0,0 +1,27 @@
+# Security
+
+Report a vulnerability to **security@meetglow.ai**. Please don't open a public issue for it.
+
+## What this package can do on your computer
+
+- **Talk to one host:** `https://app.meetglow.ai`, fixed at setup in `~/.glow/config.json` (owner-only) and checked on
+  every call. Redirects are refused. The hook runs with an empty environment except `HOME` and `PATH`, so no proxy, TLS
+  or `NODE_*` setting can send it anywhere else.
+- **Send only from repos you linked** to a product in Glow: the agent's last reply (keys and tokens masked), the branch,
+  up to five commit titles on it, and a pull request link on the same repo. Never code, files, prompts or transcripts.
+- **Run git read-only** (the origin URL, the branch, commit titles), with no shell, hooks, fsmonitor, pager, signature
+  checks or `GIT_*` variables, so a repo's `.git/config` can't make it run a program.
+- **Edit two settings files:** add one `Stop` hook to `~/.claude/settings.json` and `~/.codex/hooks.json`, keep
+  everything else, back up the originals once (`*.before-glow`), and never overwrite a file that isn't valid JSON.
+
+## What the key can do in Glow
+
+Pairing is a device flow: you approve the computer in Glow with a fresh second factor, then type the 6-digit code Glow
+shows you into the terminal. A code someone else approves gets nothing.
+
+The key (`glowc_…`, stored in Glow only as a hash) can send a session report, read which repos are linked, fetch the
+messages you sent to this computer's sessions, and revoke itself. It can't read anything else in your workspace. It
+stops working when you remove the computer, leave the workspace, or don't use it for 90 days.
+
+Messages back: only the person who paired the computer can message its sessions, with a fresh second factor each time.
+`npx @winding-labs/glow messages off` turns them off on the computer.

package/bin/glow.mjs

@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+// npx @winding-labs/glow — pair this computer with Glow and hook the coding agents on it (Claude Code, Codex), so each
+// session in a repo linked to a product posts what it did to that product's channel, and Glow can message it back.
+//
+//   npx @winding-labs/glow                 set up: find the agents, pair (approve in Glow, type the code it shows), add the hooks
+//   npx @winding-labs/glow status          what's set up, and the repos that report
+//   npx @winding-labs/glow off | on        stop / start sending from this computer
+//   npx @winding-labs/glow messages off    stop messages from Glow reaching this computer's agents (on: again)
+//   npx @winding-labs/glow uninstall       remove the hooks, revoke this computer's key, delete ~/.glow
+import { execFile } from 'node:child_process';
+import readline from 'node:readline';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { AGENTS, detect, install, installed, shimPath, shq, uninstall } from '../lib/agents.mjs';
+import { api, apiBase, apiOk, computerName, DEFAULT_API, dir, printable, readConfig, repoOf, VERSION, writeConfig } from '../lib/core.mjs';
+
+const LIB = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'lib');
+const tty = process.stdout.isTTY;
+const c = (code, s) => (tty ? `\x1b[${code}m${s}\x1b[0m` : s);
+const bold = (s) => c(1, s);
+const dim = (s) => c(2, s);
+const ok = (s) => console.log(`${c(32, '✓')} ${s}`);
+const warn = (s) => console.log(`${c(33, '!')} ${s}`);
+const fail = (s) => {
+  console.error(`${c(31, '✗')} ${s}`);
+  process.exit(1);
+};
+
+const HELP = `Glow ${VERSION}: send what your coding agents do to your Glow channels.
+
+  npx @winding-labs/glow                 set up this computer (finds Claude Code and Codex, pairs with Glow, adds hooks)
+  npx @winding-labs/glow status          what's set up and which repos report
+  npx @winding-labs/glow off | on        stop or start sending from this computer
+  npx @winding-labs/glow messages off    stop messages from Glow reaching your agents here (messages on: again)
+  npx @winding-labs/glow uninstall       remove the hooks and revoke this computer's key
+
+Options for setup:
+  --claude, --codex   only these agents (default: every one found)
+  --new               pair again, as a new computer
+  --name <name>       what Glow calls this computer (default: its name)
+  --no-open           don't open the browser; print the link
+`;
+
+function parse(argv) {
+  const o = { cmd: 'install', agents: [], api: DEFAULT_API, dev: false, open: true, fresh: false, name: '', messages: null };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--help' || a === '-h' || a === 'help') o.cmd = 'help';
+    else if (a === '--version' || a === '-v') o.cmd = 'version';
+    else if (a === '--claude') o.agents.push('claude_code');
+    else if (a === '--codex') o.agents.push('codex');
+    else if (a === '--new') o.fresh = true;
+    else if (a === '--no-open') o.open = false;
+    else if (a === '--dev') o.dev = true;
+    else if (a === '--api') o.api = argv[++i] ?? '';
+    else if (a === '--name') o.name = argv[++i] ?? '';
+    else if (a === 'messages' && ['on', 'off'].includes(argv[i + 1])) {
+      o.cmd = 'messages';
+      o.messages = argv[++i] === 'on';
+    } else if (['install', 'setup', 'status', 'off', 'on', 'uninstall'].includes(a)) o.cmd = a === 'setup' ? 'install' : a;
+    else fail(`Unknown option ${a}. Run npx @winding-labs/glow --help`);
+  }
+  if (!apiOk(o.api, o.dev)) fail(`${printable(o.api)} isn’t Glow. The API must be https://app.meetglow.ai (or localhost with --dev).`);
+  return o;
+}
+
+async function main() {
+  if (process.platform === 'win32') fail('Glow’s agent hook runs on macOS and Linux for now.');
+  const major = Number(process.versions.node.split('.')[0]);
+  if (major < 18) fail(`Glow needs Node 18 or newer (this is ${process.version}).`);
+  const o = parse(process.argv.slice(2));
+  if (o.cmd === 'help') return console.log(HELP);
+  if (o.cmd === 'version') return console.log(VERSION);
+  if (o.cmd === 'status') return status();
+  if (o.cmd === 'off' || o.cmd === 'on') return toggle(o.cmd === 'off');
+  if (o.cmd === 'messages') return messages(o.messages);
+  if (o.cmd === 'uninstall') return remove();
+  return setup(o);
+}
+
+// ---------- set up ----------
+
+async function setup(o) {
+  console.log(`${bold('Glow')} ${dim(VERSION)}: your coding agents → your Glow channels\n`);
+  const found = detect();
+  const agents = o.agents.length ? o.agents : found;
+  for (const a of o.agents) if (!found.includes(a)) warn(`${AGENTS[a].label} isn’t installed here; adding its hook anyway.`);
+  if (!agents.length) fail('No coding agent found (Claude Code or Codex). Install one, then run this again.');
+  console.log(`Found: ${agents.map((a) => AGENTS[a].label).join(', ')}`);
+
+  let cfg = readConfig();
+  if (cfg && (o.fresh || apiBase(cfg.api) !== apiBase(o.api))) {
+    await api(cfg, 'DELETE', '/api/v1/agent/computer', undefined, 5_000);
+    cfg = null;
+  }
+  let info = null;
+  if (cfg) {
+    const res = await api(cfg, 'GET', '/api/v1/agent/config', undefined, 10_000);
+    if (res.status === 200) info = res.json;
+    else if (res.status === 401) {
+      warn('This computer’s key no longer works (it was removed in Glow). Pairing again.');
+      cfg = null;
+    } else if (res.status === 403) warn('This computer is paused in Glow. Resume it there (Connections › Coding agents).');
+    else if (res.status === 0) fail(`Couldn’t reach ${apiBase(cfg.api)}. Check your connection and try again.`);
+  }
+
+  if (!cfg) {
+    const paired = await pair(o, agents);
+    cfg = { api: apiBase(o.api), ...(o.dev ? { dev: true } : {}), key: paired.key, computer: paired.computer, workspace: paired.workspace, repos: paired.repos, repos_at: Date.now(), agents, version: VERSION };
+    writeConfig(cfg);
+    info = { computer: { ...paired.computer, paused: false }, workspace: paired.workspace, repos: paired.repos };
+    console.log('');
+    ok(`Paired ${bold(printable(paired.computer.name))} with ${bold(printable(paired.workspace.name))}`);
+  } else {
+    ok(`Already paired: ${bold(printable(cfg.computer?.name) || 'this computer')} with ${bold(printable(info?.workspace?.name ?? cfg.workspace?.name) || 'your workspace')}`);
+    writeConfig({ ...cfg, agents: [...new Set([...(cfg.agents ?? []), ...agents])], ...(info?.repos ? { repos: info.repos, repos_at: Date.now() } : {}), version: VERSION });
+  }
+
+  copyHook();
+  for (const a of agents) {
+    try {
+      const file = install(a);
+      ok(`${AGENTS[a].label}: hook added to ${tilde(file)}`);
+    } catch (e) {
+      warn(`${AGENTS[a].label}: couldn’t update ${tilde(path.join(os.homedir(), ...AGENTS[a].file))} (${e.message}). Fix it, then run this again.`);
+    }
+  }
+
+  const repos = (info?.repos ?? []).map((r) => printable(r, 160));
+  console.log('');
+  console.log(repos.length ? `Repos that report to Glow: ${repos.join(', ')}` : 'No repos are linked to a product yet.');
+  const here = repoOf(process.cwd());
+  if (here && !repos.includes(here)) console.log(`This repo (${here}) isn’t linked. Link it to a product: ${apiBase(cfg.api)}/app/pair?repo=${encodeURIComponent(here)}`);
+  console.log('');
+  if (agents.includes('claude_code')) console.log(`${bold('Claude Code')}: new sessions in those repos post to Glow when they finish a reply. Restart open sessions to pick it up.`);
+  if (agents.includes('codex')) console.log(`${bold('Codex')}: open Codex and run ${bold('/hooks')} once to trust the Glow hook (Codex asks before running any new hook).`);
+  console.log(`Messages you send a session from its post in Glow reach that agent${readConfig()?.messages === false ? ' (off here: npx @winding-labs/glow messages on)' : ' (npx @winding-labs/glow messages off to stop that)'}.`);
+  console.log(dim('\nOnly sessions in linked repos send anything, and only to Glow. Off: npx @winding-labs/glow off · Remove: npx @winding-labs/glow uninstall'));
+}
+
+/** The device flow: show a code, open Glow to approve it, then type the confirmation Glow shows to get the key. */
+async function pair(o, agents) {
+  const name = (o.name || computerName()).slice(0, 60);
+  const repo = repoOf(process.cwd());
+  const start = await api({ api: o.api, dev: o.dev }, 'POST', '/api/v1/agent/pairings', { name, agents, ...(repo ? { repo } : {}) }, 15_000);
+  if (start.status === 429) fail('Too many pairings from this network. Wait 10 minutes and try again.');
+  if (start.status !== 201 || !/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(start.json?.code ?? '') || typeof start.json?.secret !== 'string') {
+    fail(start.status ? `Glow didn’t start the pairing (${start.status}). Try again in a minute.` : `Couldn’t reach ${apiBase(o.api)}. Check your connection and try again.`);
+  }
+  const { code, secret } = start.json;
+  const url = `${apiBase(o.api)}/app/pair?code=${code}`;
+  console.log(`\nPair ${bold(name)} with Glow:`);
+  console.log(`  1. Open ${c(36, url)}`);
+  console.log(`  2. Check it shows ${bold(code)}`);
+  console.log('  3. Pick the workspace and approve');
+  console.log('  4. Type the 6-digit code Glow then shows you here\n');
+  if (o.open) openUrl(url);
+  process.stdout.write(dim('Waiting for you to approve in Glow… (Ctrl-C to cancel)'));
+  const until = Date.now() + 10 * 60_000;
+  const every = Math.min(10, Math.max(2, Number(start.json.interval_s) || 3)) * 1000;
+  const claim = (confirm) => api({ api: o.api, dev: o.dev }, 'POST', '/api/v1/agent/pairings/claim', { secret, ...(confirm ? { confirm } : {}) }, 15_000);
+  for (;;) {
+    if (Date.now() > until) {
+      process.stdout.write('\n');
+      fail('The code expired. Run npx @winding-labs/glow again for a new one.');
+    }
+    await new Promise((r) => setTimeout(r, every));
+    const res = await claim();
+    if (res.status === 202 && res.json?.status === 'confirm') break;
+    if (res.status === 404) {
+      process.stdout.write('\n');
+      fail('The code expired or was turned down. Run npx @winding-labs/glow again for a new one.');
+    }
+    if (tty) process.stdout.write('.');
+  }
+  process.stdout.write('\n\n');
+  // Only the person who approved sees the confirmation, so a code someone else approved goes nowhere.
+  console.log(`Approved in Glow. It now shows a ${bold('6-digit code')}: type it here.`);
+  console.log(dim('Didn’t approve it yourself just now? Press Ctrl-C: someone else may have used your code.'));
+  // Lines are queued as they come (typed, or piped), so none is lost between one question and the next.
+  const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity, terminal: false });
+  const lines = rl[Symbol.asyncIterator]();
+  const ask = async (q) => {
+    process.stdout.write(q);
+    const r = await lines.next();
+    return r.done ? null : String(r.value);
+  };
+  try {
+    for (let asked = 0; asked < 8; asked++) {
+      const a = await ask('Code: ');
+      if (a === null) fail('No code typed. Run npx @winding-labs/glow again.');
+      const digits = a.replace(/\s/g, '');
+      if (!/^\d{6}$/.test(digits)) {
+        warn('Six digits, as Glow shows them.');
+        continue;
+      }
+      const res = await claim(digits);
+      if (res.status === 200 && res.json?.status === 'approved' && typeof res.json.key === 'string') return res.json;
+      if (res.status === 400) {
+        warn(printable(res.json?.error, 120) || 'That isn’t the code Glow showed.');
+        continue;
+      }
+      if (res.status === 404) fail('Too many wrong codes, or it expired. Run npx @winding-labs/glow again for a new one.');
+      if (res.status === 403 || res.status === 409) fail(printable(res.json?.error, 160) || `Glow refused (${res.status}).`);
+      fail(`Couldn’t reach ${apiBase(o.api)} (${res.status}). Run npx @winding-labs/glow again.`);
+    }
+    return fail('No valid code. Run npx @winding-labs/glow again.');
+  } finally {
+    rl.close();
+  }
+}
+
+
+/** ~/.glow/{core,hook}.mjs and the shim the agents run, which uses the Node that ran this (or the one on PATH). */
+function copyHook() {
+  fs.mkdirSync(dir(), { recursive: true, mode: 0o700 });
+  fs.chmodSync(dir(), 0o700);
+  for (const f of ['core.mjs', 'hook.mjs']) fs.copyFileSync(path.join(LIB, f), path.join(dir(), f));
+  for (const f of ['core.mjs', 'hook.mjs']) fs.chmodSync(path.join(dir(), f), 0o600);
+  // An empty environment but HOME and PATH: no NODE_OPTIONS, proxy, TLS or GIT_* variable from the agent's settings
+  // can change where the hook sends or what it runs. (GLOW_POLL_MS only speeds up the tests.)
+  const shim = `#!/bin/sh
+# Glow agent hook (npx @winding-labs/glow ${VERSION}). Sends coding agent replies in linked repos to Glow.
+NODE=${shq(process.execPath)}
+[ -x "$NODE" ] || NODE=$(command -v node) || exit 0
+exec env -i HOME="$HOME" PATH="$PATH" \${GLOW_POLL_MS:+GLOW_POLL_MS="$GLOW_POLL_MS"} "$NODE" ${shq(path.join(dir(), 'hook.mjs'))} "$@"
+`;
+  fs.writeFileSync(shimPath(), shim, { mode: 0o700 });
+  fs.chmodSync(shimPath(), 0o700);
+}
+
+function openUrl(url) {
+  const cmd = process.platform === 'darwin' ? 'open' : 'xdg-open';
+  try {
+    execFile(cmd, [url], { stdio: 'ignore' }, () => undefined).unref();
+  } catch {
+    // the link is printed anyway
+  }
+}
+
+const tilde = (p) => (p.startsWith(os.homedir()) ? `~${p.slice(os.homedir().length)}` : p);
+
+// ---------- status, off/on, uninstall ----------
+
+async function status() {
+  const cfg = readConfig();
+  if (!cfg) return console.log('Not set up. Run npx @winding-labs/glow');
+  const res = await api(cfg, 'GET', '/api/v1/agent/config', undefined, 10_000);
+  console.log(`${bold('Glow')} ${dim(VERSION)} · ${apiBase(cfg.api)}`);
+  console.log(`Computer: ${printable(cfg.computer?.name) || '?'} · workspace: ${printable(res.json?.workspace?.name ?? cfg.workspace?.name) || '?'}`);
+  console.log(`Key: ${res.status === 200 ? 'works' : res.status === 401 ? 'revoked (run setup again)' : res.status === 403 ? 'paused in Glow' : `unreachable (${res.status})`}${cfg.off ? ' · sending is OFF here' : ''}`);
+  console.log(`Messages from Glow: ${cfg.messages === false ? 'off' : 'on'}`);
+  for (const a of Object.keys(AGENTS)) console.log(`${AGENTS[a].label}: ${installed(a) ? 'hooked' : 'not hooked'}`);
+  const repos = (res.json?.repos ?? cfg.repos ?? []).map((r) => printable(r, 160));
+  console.log(`Repos that report: ${repos.length ? repos.join(', ') : 'none yet'}`);
+}
+
+function toggle(off) {
+  const cfg = readConfig();
+  if (!cfg) fail('Not set up. Run npx @winding-labs/glow');
+  writeConfig({ ...cfg, off });
+  ok(off ? 'Off: nothing is sent from this computer until you run npx @winding-labs/glow on' : 'On: sessions in linked repos report to Glow again');
+}
+
+function messages(on) {
+  const cfg = readConfig();
+  if (!cfg) fail('Not set up. Run npx @winding-labs/glow');
+  writeConfig({ ...cfg, messages: on });
+  ok(on ? 'Messages on: what you send a session from Glow reaches its agent' : 'Messages off: Glow holds nothing for this computer’s agents (npx @winding-labs/glow messages on to undo)');
+}
+
+async function remove() {
+  const cfg = readConfig();
+  for (const a of Object.keys(AGENTS)) {
+    try {
+      const file = uninstall(a);
+      if (file) ok(`${AGENTS[a].label}: hook removed from ${tilde(file)}`);
+    } catch (e) {
+      warn(`${AGENTS[a].label}: couldn’t update its settings (${e.message}); remove the Glow hook by hand.`);
+    }
+  }
+  if (cfg) {
+    const res = await api(cfg, 'DELETE', '/api/v1/agent/computer', undefined, 10_000);
+    if (res.status === 204 || res.status === 401) ok('This computer’s key is revoked');
+    else warn(`Couldn’t reach Glow to revoke the key (${res.status}). Remove the computer in Glow › Connections.`);
+  }
+  fs.rmSync(dir(), { recursive: true, force: true });
+  ok(`Deleted ${tilde(dir())}`);
+}
+
+main().catch((e) => fail(e?.message ?? String(e)));

package/lib/agents.mjs

@@ -0,0 +1,122 @@
+// Which coding agents are on this computer, and adding or removing the Glow hook in each one's own settings:
+//   Claude Code  ~/.claude/settings.json  hooks.Stop: the hook in the background (asyncRewake), so it can wake an idle
+//                session when a message arrives
+//   Codex        ~/.codex/hooks.json      hooks.Stop: the hook before the turn ends (≤ 15 s; it takes about a second)
+// Every other key in those files is kept as it was. A file that isn't valid JSON is never overwritten.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { dir, writeFileAtomic } from './core.mjs';
+
+export const AGENTS = {
+  claude_code: { label: 'Claude Code', bin: 'claude', home: '.claude', file: ['.claude', 'settings.json'], mode: 'claude-stop' },
+  codex: { label: 'Codex', bin: 'codex', home: '.codex', file: ['.codex', 'hooks.json'], mode: 'codex-stop' },
+};
+
+export const settingsFile = (id) => path.join(os.homedir(), ...AGENTS[id].file);
+export const shimPath = () => path.join(dir(), 'hook');
+
+/** On PATH, or its settings folder exists. */
+export function detect() {
+  const dirs = String(process.env.PATH ?? '').split(path.delimiter).filter(Boolean);
+  const onPath = (bin) => dirs.some((d) => {
+    try {
+      fs.accessSync(path.join(d, bin), fs.constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  return Object.keys(AGENTS).filter((id) => onPath(AGENTS[id].bin) || fs.existsSync(path.join(os.homedir(), AGENTS[id].home)));
+}
+
+/** POSIX single-quoting for a path in a hook command. */
+export const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+export function hookEntry(id, shim = shimPath()) {
+  const command = `${shq(shim)} ${AGENTS[id].mode}`;
+  return id === 'claude_code' ? { type: 'command', command, asyncRewake: true, timeout: 1800 } : { type: 'command', command, timeout: 15 };
+}
+
+/** One of ours: a command that runs ~/.glow/hook. */
+export const isOurs = (h) => !!h && typeof h === 'object' && typeof h.command === 'string' && /[/\\]\.glow[/\\]hook['"]?\s/.test(`${h.command} `);
+
+/** The settings with our Stop hook (replacing any older one of ours); everything else untouched. */
+export function withHook(settings, entry) {
+  const s = { ...settings };
+  if (s.hooks !== undefined && (typeof s.hooks !== 'object' || s.hooks === null || Array.isArray(s.hooks))) throw new Error('its "hooks" isn’t an object');
+  const hooks = { ...(s.hooks ?? {}) };
+  if (hooks.Stop !== undefined && !Array.isArray(hooks.Stop)) throw new Error('its "hooks.Stop" isn’t a list');
+  const groups = stripOurs(hooks.Stop ?? []);
+  hooks.Stop = [...groups, { hooks: [entry] }];
+  s.hooks = hooks;
+  return s;
+}
+
+/** The settings without our hook; empty groups and an empty "hooks" go too. */
+export function withoutHook(settings) {
+  if (!settings?.hooks || typeof settings.hooks !== 'object' || !Array.isArray(settings.hooks.Stop)) return settings;
+  const s = { ...settings, hooks: { ...settings.hooks } };
+  const groups = stripOurs(s.hooks.Stop);
+  if (groups.length) s.hooks.Stop = groups;
+  else delete s.hooks.Stop;
+  if (!Object.keys(s.hooks).length) delete s.hooks;
+  return s;
+}
+
+function stripOurs(groups) {
+  return groups
+    .map((g) => (g && typeof g === 'object' && Array.isArray(g.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isOurs(h)) } : g))
+    .filter((g) => !(g && typeof g === 'object' && Array.isArray(g.hooks) && g.hooks.length === 0));
+}
+
+export const hasHook = (settings) => Array.isArray(settings?.hooks?.Stop) && settings.hooks.Stop.some((g) => Array.isArray(g?.hooks) && g.hooks.some(isOurs));
+
+/** The file's JSON ({} when missing). Throws when it exists but isn't a JSON object, so it's never clobbered. */
+export function readJson(file) {
+  if (!fs.existsSync(file)) return {};
+  const text = fs.readFileSync(file, 'utf8');
+  if (!text.trim()) return {};
+  const v = JSON.parse(text);
+  if (!v || typeof v !== 'object' || Array.isArray(v)) throw new Error('it isn’t a JSON object');
+  return v;
+}
+
+/**
+ * Write next to the original with its mode kept; the first time, the original is copied to <file>.before-glow. A
+ * symlinked settings file (dotfiles) is written through to its target, so the link stays a link.
+ */
+export function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const target = fs.existsSync(file) ? fs.realpathSync(file) : file;
+  let mode = 0o644;
+  if (fs.existsSync(target)) {
+    mode = fs.statSync(target).mode & 0o777;
+    const backup = `${file}.before-glow`;
+    if (!fs.existsSync(backup)) fs.copyFileSync(target, backup);
+  }
+  writeFileAtomic(target, `${JSON.stringify(value, null, 2)}\n`, mode);
+}
+
+export function install(id) {
+  const file = settingsFile(id);
+  writeJson(file, withHook(readJson(file), hookEntry(id)));
+  return file;
+}
+
+export function uninstall(id) {
+  const file = settingsFile(id);
+  if (!fs.existsSync(file)) return null;
+  const before = readJson(file);
+  if (!hasHook(before)) return null;
+  writeJson(file, withoutHook(before));
+  return file;
+}
+
+export const installed = (id) => {
+  try {
+    return hasHook(readJson(settingsFile(id)));
+  } catch {
+    return false;
+  }
+};

package/lib/core.mjs

@@ -0,0 +1,204 @@
+// Shared by the installer (bin/glow.mjs) and the hook (~/.glow/hook.mjs). Plain Node 18+, no dependencies.
+//
+// Safety (docs/security/review-2026-11-02-agent-reports.md):
+//  - The only host this ever talks to is Glow's API: https://app.meetglow.ai (or staging.meetglow.ai), read from
+//    ~/.glow/config.json (written at install, mode 0600) and checked again on every use. Never from an environment
+//    variable (the hook runs with an empty environment but HOME and PATH). A local API (http://localhost) only when
+//    installed with --dev. Redirects are refused, so the key never follows one.
+//  - The key (glowc_…) can only report sessions, read the linked repo names, and fetch messages for this computer.
+//  - Nothing is sent from a repo that isn't linked to a product in Glow; the reply is masked for keys before it leaves.
+//  - git runs without a shell, with hooks, fsmonitor and signature checks off and none of the caller's GIT_* variables,
+//    so a repo (or its .git/config) can't make it run anything.
+import { execFileSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export const VERSION = '0.1.0';
+export const DEFAULT_API = 'https://app.meetglow.ai';
+export const dir = () => path.join(os.homedir(), '.glow');
+export const configPath = () => path.join(dir(), 'config.json');
+
+export const KEY_RE = /^glowc_[A-Za-z0-9_-]{43}$/;
+export const SESSION_RE = /^[A-Za-z0-9._:-]{1,100}$/;
+export const REPO_RE = /^[a-z0-9](?:[a-z0-9-]{0,38})\/[a-z0-9._-]{1,100}$/;
+
+const HOSTS = new Set(['app.meetglow.ai', 'staging.meetglow.ai']);
+
+/** Glow's API only: https on app.meetglow.ai (or staging), no port, path, query or credentials; localhost with --dev. */
+export function apiOk(url, allowLocal = false) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.username || u.password || u.search || u.hash || (u.pathname !== '/' && u.pathname !== '')) return false;
+  if (u.protocol === 'https:' && !u.port && HOSTS.has(u.hostname)) return true;
+  return allowLocal && u.protocol === 'http:' && (u.hostname === 'localhost' || u.hostname === '127.0.0.1');
+}
+export const apiBase = (url) => new URL(url).origin;
+
+// ---------- config ----------
+
+/** ~/.glow/config.json, or null when missing, unreadable or not well-formed (then nothing is sent). */
+export function readConfig() {
+  try {
+    const c = JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+    if (!c || typeof c !== 'object' || !KEY_RE.test(c.key ?? '') || !apiOk(c.api, c.dev === true)) return null;
+    return c;
+  } catch {
+    return null;
+  }
+}
+
+/** Atomic, owner-only. */
+export function writeConfig(c) {
+  fs.mkdirSync(dir(), { recursive: true, mode: 0o700 });
+  fs.chmodSync(dir(), 0o700);
+  writeFileAtomic(configPath(), `${JSON.stringify(c, null, 2)}\n`, 0o600);
+}
+
+export function writeFileAtomic(file, text, mode) {
+  const tmp = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  fs.writeFileSync(tmp, text, { mode });
+  fs.renameSync(tmp, file);
+}
+
+// ---------- the API ----------
+
+/** One call to Glow's API with the computer's key. Never throws: { status, json } (status 0 when unreachable). */
+export async function api(c, method, p, body, timeoutMs = 10_000) {
+  if (!apiOk(c.api, c.dev === true)) return { status: 0, json: null };
+  try {
+    const res = await fetch(`${apiBase(c.api)}${p}`, {
+      method,
+      redirect: 'error',
+      headers: {
+        ...(c.key ? { authorization: `Bearer ${c.key}` } : {}),
+        ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+        'x-glow-client': `glow-cli/${VERSION}`,
+        'user-agent': `glow-cli/${VERSION} (${process.platform})`,
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const text = await res.text();
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    return { status: res.status, json };
+  } catch {
+    return { status: 0, json: null };
+  }
+}
+
+// ---------- git ----------
+
+function git(cwd, args) {
+  try {
+    const opts = ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-c', 'log.showSignature=false', '-c', 'core.pager=cat'];
+    return execFileSync('git', ['-C', cwd, ...opts, ...args], {
+      encoding: 'utf8',
+      timeout: 3000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      // Not the caller's GIT_* (GIT_CONFIG_PARAMETERS and friends can set any config, GIT_DIR another repo).
+      env: { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: os.homedir(), GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0', GIT_CONFIG_NOSYSTEM: '1' },
+      maxBuffer: 256 * 1024,
+    }).trim();
+  } catch {
+    return '';
+  }
+}
+
+/** A GitHub remote URL → "owner/name" (lower-case), else null. */
+export function parseRemote(url) {
+  const m = /^(?:git@github\.com:|ssh:\/\/git@github\.com(?::22)?\/|https:\/\/(?:[^@/\s]+@)?github\.com\/)([A-Za-z0-9-]+\/[A-Za-z0-9._-]+?)(?:\.git)?\/?$/.exec(String(url).trim());
+  const r = m?.[1]?.toLowerCase();
+  return r && REPO_RE.test(r) && !r.endsWith('/.') && !r.endsWith('/..') ? r : null;
+}
+
+/** The GitHub repo a directory is in (its origin), or null. */
+export const repoOf = (cwd) => (cwd && fs.existsSync(cwd) ? parseRemote(git(cwd, ['config', '--get', 'remote.origin.url'])) : null);
+
+/** Branch and the commits on it that aren't on the default branch yet (newest first, ≤ 5). */
+export function gitContext(cwd) {
+  const branch = git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD']);
+  const base = git(cwd, ['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD']) || 'origin/main';
+  const out = { ...(branch && branch !== 'HEAD' && branch.length <= 200 ? { branch } : {}), commits: [] };
+  if (!branch || `origin/${branch}` === base) return out;
+  for (const line of git(cwd, ['log', '--no-show-signature', '-n', '5', '--format=%H%x1f%s', `${base}..HEAD`]).split('\n')) {
+    const [sha, title] = line.split('\x1f');
+    if (sha && /^[0-9a-f]{40}$/.test(sha) && title) out.commits.push({ sha: sha.slice(0, 12), title: mask(title).slice(0, 300) });
+  }
+  return out;
+}
+
+/** A pull request link on this repo, from the reply (the last one wins). */
+export function prIn(text, repo) {
+  let found;
+  for (const m of String(text).matchAll(/https:\/\/github\.com\/([A-Za-z0-9-]+\/[A-Za-z0-9._-]+)\/pull\/(\d{1,7})\b/g)) {
+    if (m[1].toLowerCase() === repo) found = `https://github.com/${m[1]}/pull/${m[2]}`;
+  }
+  return found;
+}
+
+/** Text from the server, safe to print in a terminal: no control characters (escape sequences), one line, clipped. */
+export const printable = (s, max = 80) => String(s ?? '').replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff]/g, '').slice(0, max);
+
+// ---------- masking ----------
+
+const KEY_SHAPES = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+  /\b(?:sk|rk|pk)_(?:live|test)_[0-9A-Za-z]{8,}/g,
+  /\bwhsec_[0-9A-Za-z+/=]{16,}/g,
+  /\bsk-or-v1-[0-9a-f]{16,}/g,
+  /\bsk-(?:ant-|proj-)?[0-9A-Za-z_-]{20,}/g,
+  /\bgithub_pat_[0-9A-Za-z_]{20,}/g,
+  /\bgh[pousr]_[0-9A-Za-z]{20,}/g,
+  /\bglpat-[0-9A-Za-z_-]{20,}/g,
+  /\bphx_[0-9A-Za-z]{20,}/g,
+  /\bGOCSPX-[0-9A-Za-z_-]{20,}/g,
+  /\bAIza[0-9A-Za-z_-]{30,}/g,
+  /\bya29\.[0-9A-Za-z_.-]{20,}/g,
+  /\bEAA[0-9A-Za-z]{40,}/g,
+  /\bxox[abposr]-[0-9A-Za-z-]{10,}/g,
+  /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+  /\bSG\.[0-9A-Za-z_-]{16,}\.[0-9A-Za-z_-]{16,}/g,
+  /\bnpm_[0-9A-Za-z]{30,}/g,
+  /\bshp(?:at|ss|ca|pa)_[0-9a-fA-F]{20,}/g,
+  /\beyJ[0-9A-Za-z_-]{8,}\.[0-9A-Za-z_-]{8,}\.[0-9A-Za-z_-]{8,}/g,
+  /\bglowc?_[0-9A-Za-z_-]{40,}/g,
+];
+const LABELLED = /(\b(?:api[_ -]?key|secret|token|password|passwd|pwd|access[_ -]?key|client[_ -]?secret|private[_ -]?key|auth(?:orization)?)["']?\s*[:=]\s*["']?(?:bearer\s+|basic\s+)?)([^\s"',;&#[\]<>]{8,})/gi;
+const BEARER = /\b(bearer\s+)([0-9A-Za-z._~+/-]{16,}=*)/gi;
+const URL_CREDS = /\b(https?:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+
+/** Keys, tokens, passwords and credentials in URLs → [masked]. The server scrubs again before any model sees it. */
+export function mask(text) {
+  let s = String(text);
+  for (const re of KEY_SHAPES) s = s.replace(re, '[masked]');
+  return s.replace(LABELLED, '$1[masked]').replace(BEARER, '$1[masked]').replace(URL_CREDS, '$1[masked]@');
+}
+
+// ---------- this computer ----------
+
+/** "Ilya’s MacBook Pro": the computer's own name (macOS), else the host name. Letters, digits, spaces, ’'._- only. */
+export function computerName() {
+  let name = '';
+  if (process.platform === 'darwin') {
+    try {
+      name = execFileSync('scutil', ['--get', 'ComputerName'], { encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    } catch {
+      name = '';
+    }
+  }
+  if (!name) name = os.hostname().replace(/\.(local|lan|home)$/i, '').replace(/[-_]+/g, ' ');
+  return name.normalize('NFC').replace(/[^\p{L}\p{N} ’'._-]+/gu, ' ').replace(/\s+/g, ' ').trim().slice(0, 60) || 'My computer';
+}
+
+export const sha = (s) => createHash('sha256').update(s).digest('hex');

package/lib/hook.mjs

@@ -0,0 +1,173 @@
+// The Glow hook, run by the coding agent when it finishes a reply (installed to ~/.glow by `npx @winding-labs/glow`).
+//
+//   claude-stop  Claude Code's Stop hook, run in the background (asyncRewake). Reports the reply, then listens for a
+//                message from Glow for up to 25 minutes while the session is idle. A message wakes Claude: it is printed
+//                to stderr and the hook exits 2. A newer reply in the same session takes over the listening.
+//   codex-stop   Codex's Stop hook (runs before the turn ends; ~1 s). Reports the reply; a waiting message comes back as
+//                {"decision":"block","reason":…}, which Codex takes as the next prompt.
+//
+// `npx @winding-labs/glow messages off` stops both: Glow then holds no message for this computer's sessions.
+//
+// Quiet by design: whatever goes wrong, it exits 0 and the agent carries on. Nothing is written to a log.
+import fs from 'node:fs';
+import path from 'node:path';
+import { api, dir, gitContext, mask, prIn, printable, readConfig, repoOf, SESSION_RE, sha, writeConfig } from './core.mjs';
+
+const LISTEN_MS = 25 * 60_000;
+// GLOW_POLL_MS only speeds up the tests (timing, never where anything is sent).
+const POLL_MS = Math.max(50, Number(process.env.GLOW_POLL_MS) || 15_000);
+const REPOS_FRESH_MS = 2 * 60_000;
+const MESSAGE_MAX = 20_000;
+
+const mode = process.argv[2];
+const agent = mode === 'codex-stop' ? 'codex' : mode === 'claude-stop' ? 'claude_code' : null;
+
+main().then(
+  (code) => process.exit(code ?? 0),
+  () => process.exit(0),
+);
+
+async function main() {
+  if (!agent) return 0;
+  const input = await stdinJson();
+  const cfg = readConfig();
+  if (!cfg || cfg.off) return 0;
+  const session = typeof input.session_id === 'string' ? input.session_id : '';
+  if (!SESSION_RE.test(session)) return 0;
+  const cwd = typeof input.cwd === 'string' && path.isAbsolute(input.cwd) ? input.cwd : process.cwd();
+  const repo = repoOf(cwd);
+  if (!repo || !(await linked(cfg, repo))) return 0;
+
+  const reply = typeof input.last_assistant_message === 'string' ? input.last_assistant_message : '';
+  const inbox = cfg.messages !== false;
+  let messages = [];
+  if (reply.trim()) {
+    const ctx = gitContext(cwd);
+    const pr = prIn(reply, repo);
+    const res = await api(cfg, 'POST', '/api/v1/agent/reports', {
+      agent, session_id: session, repo, ...(ctx.branch ? { branch: ctx.branch } : {}), message: mask(reply).slice(0, MESSAGE_MAX), commits: ctx.commits, ...(pr ? { pr_url: pr } : {}), inbox,
+    }, agent === 'codex' ? 6_000 : 10_000);
+    if (res.status === 401 || res.status === 403) return 0;
+    if (res.json?.skipped === 'repo_not_linked' && Array.isArray(res.json.repos)) saveRepos(cfg, res.json.repos);
+    messages = inbox && Array.isArray(res.json?.messages) ? res.json.messages : [];
+  }
+  if (messages.length) return deliver(messages);
+  if (agent === 'claude_code' && inbox) return listen(cfg, session);
+  return 0;
+}
+
+/** Is this repo linked to a product? The list is cached in the config, refreshed when a repo isn't on it (≤ every 2 min). */
+async function linked(cfg, repo) {
+  const repos = Array.isArray(cfg.repos) ? cfg.repos : [];
+  if (repos.includes(repo)) return true;
+  if (Date.now() - Number(cfg.repos_at ?? 0) < REPOS_FRESH_MS) return false;
+  const res = await api(cfg, 'GET', '/api/v1/agent/config', undefined, 5_000);
+  if (res.status !== 200 || !Array.isArray(res.json?.repos)) return false;
+  saveRepos(cfg, res.json.repos);
+  return res.json.repos.includes(repo);
+}
+
+function saveRepos(cfg, repos) {
+  try {
+    const fresh = readConfig() ?? cfg;
+    writeConfig({ ...fresh, repos: repos.filter((r) => typeof r === 'string').slice(0, 200), repos_at: Date.now() });
+  } catch {
+    // a read-only home: the next run asks again
+  }
+}
+
+/** The messages, as the person who sent them, for the agent. Claude: stderr + exit 2. Codex: a block decision. */
+function deliver(messages) {
+  const text = messages
+    .filter((m) => m && typeof m.body === 'string')
+    .map((m) => `Message from ${printable(m.from) || 'a teammate'} in Glow (sent to this session at ${timeOf(m.sent_at)}):\n\n${m.body}`)
+    .join('\n\n---\n\n');
+  if (!text) return 0;
+  if (agent === 'codex') {
+    process.stdout.write(`${JSON.stringify({ decision: 'block', reason: text })}\n`);
+    return 0;
+  }
+  process.stderr.write(`${text}\n`);
+  return 2;
+}
+
+const timeOf = (iso) => {
+  const d = new Date(iso);
+  return Number.isNaN(+d) ? 'just now' : d.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+};
+
+/**
+ * Claude Code, idle: ask Glow for a message every 15 s for up to 25 minutes. One listener per session: a newer reply
+ * writes its own token to the lock and this one stops. Stops too when Claude Code itself has gone.
+ */
+async function listen(cfg, session) {
+  const locks = path.join(dir(), 'sessions');
+  fs.mkdirSync(locks, { recursive: true, mode: 0o700 });
+  const lock = path.join(locks, `${sha(`${agent}:${session}`).slice(0, 24)}.lock`);
+  const token = `${process.pid}:${Date.now()}`;
+  fs.writeFileSync(lock, token, { mode: 0o600 });
+  tidy(locks);
+  const parent = process.ppid;
+  const until = Date.now() + LISTEN_MS;
+  const q = `/api/v1/agent/inbox?agent=${agent}&session=${encodeURIComponent(session)}`;
+  try {
+    while (Date.now() < until) {
+      await new Promise((r) => setTimeout(r, POLL_MS));
+      if (!mine(lock, token) || !alive(parent)) return 0;
+      const now = readConfig();
+      if (!now || now.off || now.messages === false) return 0;
+      const res = await api(now, 'GET', q, undefined, 10_000);
+      if (res.status === 401 || res.status === 403 || res.status === 404) return 0;
+      const messages = Array.isArray(res.json?.messages) ? res.json.messages : [];
+      if (messages.length) return deliver(messages);
+    }
+    return 0;
+  } finally {
+    if (mine(lock, token)) fs.rmSync(lock, { force: true });
+  }
+}
+
+const mine = (lock, token) => {
+  try {
+    return fs.readFileSync(lock, 'utf8') === token;
+  } catch {
+    return false;
+  }
+};
+const alive = (pid) => {
+  if (process.ppid !== pid || pid <= 1) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e?.code === 'EPERM';
+  }
+};
+/** Locks older than a day go. */
+function tidy(locks) {
+  try {
+    for (const f of fs.readdirSync(locks)) {
+      const p = path.join(locks, f);
+      if (Date.now() - fs.statSync(p).mtimeMs > 86_400_000) fs.rmSync(p, { force: true });
+    }
+  } catch {
+    // best effort
+  }
+}
+
+/** The hook's input (≤ 4 MB of JSON on stdin), or {}. */
+async function stdinJson() {
+  const chunks = [];
+  let n = 0;
+  for await (const c of process.stdin) {
+    n += c.length;
+    if (n > 4 * 1024 * 1024) return {};
+    chunks.push(c);
+  }
+  try {
+    const v = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
+    return v && typeof v === 'object' ? v : {};
+  } catch {
+    return {};
+  }
+}

package/package.json

@@ -1,6 +1,16 @@
 {
   "name": "@winding-labs/glow",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Send what your coding agents (Claude Code, Codex) do to your Glow channels, and message them back from Glow.",
+  "type": "module",
+  "bin": { "glow": "bin/glow.mjs" },
+  "files": ["bin/", "lib/", "README.md", "SECURITY.md", "LICENSE"],
+  "engines": { "node": ">=18" },
+  "scripts": { "test": "bun test", "typecheck": "true" },
+  "license": "MIT",
+  "homepage": "https://meetglow.ai",
+  "repository": { "type": "git", "url": "git+https://github.com/Winding-Labs/glow-agent.git" },
+  "bugs": "https://github.com/Winding-Labs/glow-agent/issues",
+  "keywords": ["glow", "claude-code", "codex", "coding-agents", "hooks"],
+  "publishConfig": { "access": "public" }
+}