alegra-data-agent 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+PROPRIETARY — ALL RIGHTS RESERVED
+Copyright (c) Alegra. Uso interno corporativo.
+
+Este software y sus skills asociadas son propiedad exclusiva de Alegra y están
+destinados únicamente al uso interno de sus empleados y contratistas autorizados.
+
+Queda prohibido, sin autorización expresa y por escrito de Alegra:
+
+  1. Copiar, redistribuir, sublicenciar, vender o publicar este software
+     o cualquiera de sus skills, total o parcialmente.
+  2. Usarlo fuera del contexto laboral con Alegra.
+  3. Compartir su contenido con terceros, incluyendo otras IAs, modelos,
+     servicios o personas no autorizadas.
+  4. Derivar trabajos basados en este código o sus skills para uso externo.
+
+Las skills contenidas en `skills-registry/` pueden incluir información de
+negocio sensible (esquemas, métricas, lógica de KPIs, identificadores de
+sistemas internos). Su tratamiento debe regirse por las políticas de
+seguridad de la información de Alegra.
+
+Para consultas sobre uso, contactar a: data@alegra.com

package/README.md

@@ -0,0 +1,21 @@
+# alegra-data-agent
+
+Agente de Data interno de Alegra. Instala skills + MCPs en tu cliente de IA con un comando.
+
+## Instalación
+
+```sh
+pnpm dlx alegra-data-agent
+```
+
+Solo accesible para cuentas `@alegra.com` (OAuth Google). El CLI te abre el navegador para iniciar sesión.
+
+## Requisitos
+
+- Node ≥ 22.6.0
+- pnpm ≥ 11.1.2
+- Uno de: Claude Code, Cursor, OpenCode, Antigravity
+
+## Soporte
+
+Documentación y soporte para el equipo de Alegra: canal interno de BI Data.

package/dist/api.js

@@ -0,0 +1,185 @@
+import { readAuth } from "./auth.js";
+import { COMMAND_NAME, GATEWAY_URL, getPackageVersion } from "./lib.js";
+import { verifyManifestSignature } from "./signature.js";
+export class ManifestSignatureError extends Error {
+    constructor(reason) {
+        super(`Firma del manifest inválida: ${reason}. Posible compromiso del gateway.`);
+        this.name = "ManifestSignatureError";
+    }
+}
+export class AuthRequiredError extends Error {
+    constructor(message = `Necesitas autenticarte con: ${COMMAND_NAME} login`) {
+        super(message);
+        this.name = "AuthRequiredError";
+    }
+}
+export class GatewayError extends Error {
+    status;
+    path;
+    constructor(status, path, message) {
+        super(message);
+        this.status = status;
+        this.path = path;
+        this.name = "GatewayError";
+    }
+}
+function newRequestId() {
+    const bytes = new Uint8Array(8);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function userAgent() {
+    return `${COMMAND_NAME}/${getPackageVersion()} (+https://github.com/alegradev/alegra-data-agent)`;
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+async function authedFetch(path, opts = {}) {
+    const auth = readAuth();
+    if (!auth) {
+        if (opts.requireAuth === false) {
+            return new Response(null, { status: 401 });
+        }
+        throw new AuthRequiredError();
+    }
+    const url = `${GATEWAY_URL}${path}`;
+    const timeoutMs = opts.timeoutMs ?? 30_000;
+    const maxRetries = opts.maxRetries ?? 2;
+    const reqId = newRequestId();
+    let attempt = 0;
+    const delays = [250, 750, 2250];
+    while (true) {
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(url, {
+                headers: {
+                    Authorization: `Bearer ${auth.token}`,
+                    Accept: "application/json,application/octet-stream",
+                    "User-Agent": userAgent(),
+                    "X-Request-Id": reqId,
+                },
+                signal: ac.signal,
+            });
+        }
+        catch (err) {
+            clearTimeout(timer);
+            const retryable = isRetryableNetworkError(err);
+            if (retryable && attempt < maxRetries) {
+                await sleep(delays[Math.min(attempt, delays.length - 1)]);
+                attempt++;
+                continue;
+            }
+            throw mapNetworkError(err, path, timeoutMs);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (res.status === 401) {
+            if (opts.requireAuth === false)
+                return res;
+            throw new AuthRequiredError(`Token expirado o inválido. Corre: ${COMMAND_NAME} login`);
+        }
+        if (res.status === 403) {
+            throw new GatewayError(403, path, "Forbidden — tu cuenta no es @alegra.com o tu acceso fue revocado. " +
+                "Si saliste de Alegra, esto es esperado. Si no, contacta a #data.");
+        }
+        if (res.status === 429) {
+            const ra = parseRetryAfter(res.headers.get("retry-after"));
+            if (ra !== null && ra <= 5_000 && attempt < maxRetries) {
+                await sleep(ra);
+                attempt++;
+                continue;
+            }
+            throw new GatewayError(429, path, "Rate limit excedido. Espera un minuto y vuelve a intentar.");
+        }
+        if (res.status >= 500 && res.status < 600) {
+            if (attempt < maxRetries) {
+                await sleep(delays[Math.min(attempt, delays.length - 1)]);
+                attempt++;
+                continue;
+            }
+            throw new GatewayError(res.status, path, `Gateway con error ${res.status}. Reintenta en unos segundos. Si persiste, reporta a #data (request-id ${reqId}).`);
+        }
+        if (!res.ok) {
+            throw new GatewayError(res.status, path, `Gateway respondió ${res.status} en ${path}`);
+        }
+        return res;
+    }
+}
+function isRetryableNetworkError(err) {
+    if (!(err instanceof Error))
+        return false;
+    if (err.name === "AbortError")
+        return false;
+    const m = err.message.toLowerCase();
+    return (m.includes("econnreset") ||
+        m.includes("eai_again") ||
+        m.includes("socket hang up") ||
+        m.includes("network") ||
+        m.includes("etimedout"));
+}
+function parseRetryAfter(value) {
+    if (!value)
+        return null;
+    const secs = Number(value);
+    if (Number.isFinite(secs) && secs >= 0)
+        return Math.min(secs * 1000, 30_000);
+    const date = Date.parse(value);
+    if (Number.isFinite(date)) {
+        const diff = date - Date.now();
+        return diff > 0 ? Math.min(diff, 30_000) : 0;
+    }
+    return null;
+}
+function mapNetworkError(err, path, timeoutMs) {
+    if (!(err instanceof Error))
+        return err;
+    const m = err.message.toLowerCase();
+    if (err.name === "AbortError" || m.includes("timeout")) {
+        return new GatewayError(0, path, `Timeout (${Math.round(timeoutMs / 1000)}s) hablando con el gateway. Verifica tu conexión.`);
+    }
+    if (m.includes("enotfound") || m.includes("getaddrinfo") || m.includes("dns")) {
+        return new GatewayError(0, path, `No se pudo resolver el dominio del gateway (${GATEWAY_URL}). ¿Sin internet?`);
+    }
+    if (m.includes("econnrefused")) {
+        return new GatewayError(0, path, `El gateway rechazó la conexión. ¿Está caído? Verifica ${GATEWAY_URL}`);
+    }
+    if (m.includes("cert") || m.includes("ssl") || m.includes("tls")) {
+        return new GatewayError(0, path, "Error TLS al hablar con el gateway. ¿Hay un proxy corporativo interceptando HTTPS?");
+    }
+    return new GatewayError(0, path, `Error de red al hablar con el gateway: ${err.message}`);
+}
+export async function fetchManifest(opts = {}) {
+    try {
+        const res = await authedFetch("/api/manifest", opts);
+        if (!res.ok)
+            return null;
+        const manifest = (await res.json());
+        const check = verifyManifestSignature(manifest, { softFail: false });
+        if (!check.ok) {
+            throw new ManifestSignatureError(check.reason);
+        }
+        return manifest;
+    }
+    catch (err) {
+        if (opts.requireAuth === false && err instanceof AuthRequiredError)
+            return null;
+        if (opts.requireAuth === false && err instanceof ManifestSignatureError) {
+            return null;
+        }
+        throw err;
+    }
+}
+export async function fetchSkillFile(skillName, relPath) {
+    const enc = relPath.split("/").map(encodeURIComponent).join("/");
+    const res = await authedFetch(`/api/skills/${encodeURIComponent(skillName)}/${enc}`);
+    const buffer = await res.arrayBuffer();
+    return new Uint8Array(buffer);
+}
+export async function fetchMcps(opts = {}) {
+    const res = await authedFetch("/api/mcps", opts);
+    const body = (await res.json());
+    return body.mcps ?? {};
+}

package/dist/auth.js

@@ -0,0 +1,262 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { dirname } from "node:path";
+import { spawn } from "node:child_process";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { GATEWAY_URL, getAuthFilePath } from "./lib.js";
+function decodeJwtEmail(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const json = Buffer.from(padded, "base64").toString("utf-8");
+        const payload = JSON.parse(json);
+        return typeof payload.email === "string" ? payload.email : null;
+    }
+    catch {
+        return null;
+    }
+}
+function constantTimeStringEq(a, b) {
+    const ab = Buffer.from(a, "utf-8");
+    const bb = Buffer.from(b, "utf-8");
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+export function readAuth() {
+    const path = getAuthFilePath();
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function writeAuth(record) {
+    const path = getAuthFilePath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(record, null, 2) + "\n", "utf-8");
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+    }
+}
+export function clearAuth() {
+    const path = getAuthFilePath();
+    if (existsSync(path))
+        rmSync(path, { force: true });
+}
+export function hasAuth() {
+    return readAuth() !== null;
+}
+export async function performBrowserLogin(timeoutMs = 5 * 60 * 1000) {
+    const state = randomBytes(24).toString("hex");
+    return new Promise((resolve, reject) => {
+        let server;
+        let timer;
+        let resolved = false;
+        const cleanup = () => {
+            if (timer)
+                clearTimeout(timer);
+            if (server) {
+                try {
+                    server.close(() => { });
+                }
+                catch {
+                }
+            }
+        };
+        const safeResolve = (r) => {
+            if (resolved)
+                return;
+            resolved = true;
+            cleanup();
+            resolve(r);
+        };
+        const safeReject = (e) => {
+            if (resolved)
+                return;
+            resolved = true;
+            cleanup();
+            reject(e);
+        };
+        server = createServer((req, res) => {
+            if (!req.url) {
+                res.writeHead(400);
+                res.end();
+                return;
+            }
+            const url = new URL(req.url, "http://localhost");
+            if (url.pathname !== "/callback") {
+                res.writeHead(404, { "Content-Type": "text/html" });
+                res.end("<h1>404</h1>");
+                return;
+            }
+            const token = url.searchParams.get("token");
+            const gotState = url.searchParams.get("state");
+            if (!token) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end(htmlPage("error", "Falta el token en el callback. Reintenta el login."));
+                safeReject(new Error("Callback sin token."));
+                return;
+            }
+            if (!gotState || !constantTimeStringEq(gotState, state)) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end(htmlPage("error", "State no coincide. Posible CSRF — descartado. Reintenta el login para refrescar el state."));
+                safeReject(new Error("State mismatch (posible CSRF)."));
+                return;
+            }
+            const emailFromJwt = decodeJwtEmail(token);
+            if (!emailFromJwt) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end(htmlPage("error", "Token sin claim de email. Reporta a #data-security."));
+                safeReject(new Error("JWT sin email."));
+                return;
+            }
+            const record = {
+                email: emailFromJwt,
+                token,
+                obtainedAt: new Date().toISOString(),
+            };
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(htmlPage("success", emailFromJwt));
+            safeResolve(record);
+        });
+        server.on("error", (err) => {
+            if (err.code === "EADDRINUSE") {
+                safeReject(new Error("Otro proceso está usando el puerto local. Cierra cualquier 'alegra-data-agent login' previo o reinicia el shell."));
+            }
+            else if (err.code === "EACCES") {
+                safeReject(new Error("Sin permisos para abrir un puerto local (necesita >= 1024)."));
+            }
+            else {
+                safeReject(new Error(`Error en el servidor local: ${err.message}`));
+            }
+        });
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (typeof address !== "object" || !address) {
+                cleanup();
+                reject(new Error("No se pudo determinar el puerto."));
+                return;
+            }
+            const port = address.port;
+            const authUrl = new URL(`${GATEWAY_URL}/api/cli/auth`);
+            authUrl.searchParams.set("port", String(port));
+            authUrl.searchParams.set("state", state);
+            const u = authUrl.toString();
+            process.stdout.write("\n" +
+                "  ╭────────────────────────────────────────────────────────────╮\n" +
+                "  │  Inicia sesión con tu cuenta @alegra.com en el navegador   │\n" +
+                "  ╰────────────────────────────────────────────────────────────╯\n" +
+                "\n" +
+                "  Intento abrir tu navegador. Si no se abre solo, copia toda\n" +
+                "  esta URL (triple-click selecciona la línea completa) y\n" +
+                "  pégala en tu navegador:\n" +
+                "\n" +
+                "  ────────────────────────────────────────────────────────────\n" +
+                `${u}\n` +
+                "  ────────────────────────────────────────────────────────────\n" +
+                "\n" +
+                `  Esperando hasta ${Math.round(timeoutMs / 1000)}s a que completes el login…\n` +
+                "\n");
+            openBrowser(u);
+            timer = setTimeout(() => {
+                safeReject(new Error(`Timeout: pasaron ${Math.round(timeoutMs / 1000)}s sin recibir la auth. ` +
+                    "Si abriste el link en otra máquina sin conexión al CLI, debes correr el comando " +
+                    "desde la misma máquina donde abrirás el browser. Reintenta."));
+            }, timeoutMs);
+        });
+    });
+}
+function isWsl() {
+    return Boolean(process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP);
+}
+function openBrowser(url) {
+    const platform = process.platform;
+    const candidates = [];
+    if (platform === "darwin") {
+        candidates.push({ cmd: "open", args: [url] });
+    }
+    else if (platform === "win32") {
+        candidates.push({
+            cmd: "powershell.exe",
+            args: ["-NoProfile", "-Command", `Start-Process '${url.replace(/'/g, "''")}'`],
+        });
+        candidates.push({
+            cmd: "rundll32.exe",
+            args: ["url.dll,FileProtocolHandler", url],
+        });
+        candidates.push({ cmd: "cmd", args: ["/c", "start", '""', `"${url}"`] });
+    }
+    else if (isWsl()) {
+        candidates.push({
+            cmd: "powershell.exe",
+            args: ["-NoProfile", "-Command", `Start-Process '${url.replace(/'/g, "''")}'`],
+        });
+        candidates.push({
+            cmd: "rundll32.exe",
+            args: ["url.dll,FileProtocolHandler", url],
+        });
+        candidates.push({ cmd: "cmd.exe", args: ["/c", "start", '""', `"${url}"`] });
+        candidates.push({ cmd: "xdg-open", args: [url] });
+    }
+    else {
+        candidates.push({ cmd: "xdg-open", args: [url] });
+        candidates.push({ cmd: "gnome-open", args: [url] });
+        candidates.push({ cmd: "kde-open", args: [url] });
+    }
+    const tryNext = (i) => {
+        if (i >= candidates.length)
+            return;
+        const { cmd, args } = candidates[i];
+        try {
+            const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+            child.on("error", () => tryNext(i + 1));
+            child.unref();
+        }
+        catch {
+            tryNext(i + 1);
+        }
+    };
+    tryNext(0);
+}
+function htmlPage(kind, subject) {
+    const ok = kind === "success";
+    const color = ok ? "#10b981" : "#ef4444";
+    const title = ok ? "Autenticación exitosa" : "Error";
+    const body = ok
+        ? `Conectaste como <strong>${escapeHtml(subject)}</strong>.<br/>Ya puedes cerrar esta pestaña y volver al terminal.`
+        : `<strong>${escapeHtml(subject)}</strong><br/>Revisa el terminal e intenta de nuevo.`;
+    return `<!doctype html>
+<html lang="es">
+<head>
+  <meta charset="utf-8" />
+  <title>${title}</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+           background: #0b0d10; color: #e6e6e6; margin: 0;
+           display: grid; place-items: center; min-height: 100vh; }
+    .card { max-width: 480px; padding: 2.5rem; text-align: center; }
+    .icon { font-size: 3rem; color: ${color}; }
+    h1 { font-size: 1.5rem; margin: 1rem 0 .5rem; }
+    p { color: #9ca3af; line-height: 1.6; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon">${ok ? "✓" : "✗"}</div>
+    <h1>${title}</h1>
+    <p>${body}</p>
+  </div>
+</body>
+</html>`;
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}

package/dist/colors.js

@@ -0,0 +1,35 @@
+const SUPPORTS_COLOR = process.stdout.isTTY &&
+    process.env.TERM !== "dumb" &&
+    process.env.NO_COLOR === undefined;
+const wrap = (open, close) => (s) => (SUPPORTS_COLOR ? `${open}${s}${close}` : String(s));
+export const bold = wrap("\x1b[1m", "\x1b[22m");
+export const dim = wrap("\x1b[2m", "\x1b[22m");
+export const red = wrap("\x1b[31m", "\x1b[39m");
+export const green = wrap("\x1b[32m", "\x1b[39m");
+export const yellow = wrap("\x1b[33m", "\x1b[39m");
+export const blue = wrap("\x1b[34m", "\x1b[39m");
+export const magenta = wrap("\x1b[35m", "\x1b[39m");
+export const cyan = wrap("\x1b[36m", "\x1b[39m");
+export const gray = wrap("\x1b[90m", "\x1b[39m");
+export const HIDE_CURSOR = SUPPORTS_COLOR ? "\x1b[?25l" : "";
+export const SHOW_CURSOR = SUPPORTS_COLOR ? "\x1b[?25h" : "";
+export const CLEAR_LINE = SUPPORTS_COLOR ? "\r\x1b[K" : "\r";
+export const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+export function write(s) {
+    process.stdout.write(s);
+}
+export function log(s = "") {
+    process.stdout.write(s + "\n");
+}
+export function logError(s) {
+    process.stderr.write(red("✗ ") + s + "\n");
+}
+export function logWarn(s) {
+    process.stdout.write(yellow("⚠ ") + s + "\n");
+}
+export function logOk(s) {
+    process.stdout.write(green("✓ ") + s + "\n");
+}
+export function logInfo(s) {
+    process.stdout.write(cyan("ℹ ") + s + "\n");
+}

package/dist/commands/check.js

@@ -0,0 +1,35 @@
+import { fetchManifest } from "../api.js";
+import { detectDrift } from "../installer.js";
+import { hasAuth } from "../auth.js";
+import { bold, cyan, dim, yellow } from "../colors.js";
+import { COMMAND_NAME } from "../lib.js";
+export async function runCheck() {
+    try {
+        if (!hasAuth())
+            return 0;
+        const manifest = await fetchManifest({ requireAuth: false, timeoutMs: 5000 });
+        if (!manifest)
+            return 0;
+        const drift = detectDrift(manifest);
+        const total = drift.toInstall.length + drift.toUpdate.length;
+        if (total === 0)
+            return 0;
+        const lines = [];
+        lines.push("");
+        lines.push(yellow("🟡  Skills de Data Alegra: ") + bold(`${total} actualizaciones disponibles`));
+        for (const name of drift.toInstall) {
+            lines.push(`   ${cyan("+")} ${name} ${dim("(nueva)")}`);
+        }
+        for (const name of drift.toUpdate) {
+            lines.push(`   ${cyan("↻")} ${name} ${dim("(versión nueva)")}`);
+        }
+        lines.push("");
+        lines.push(`   ${dim("Actualiza con:")}  ${bold(`${COMMAND_NAME} update`)}`);
+        lines.push("");
+        process.stdout.write(lines.join("\n"));
+        return 0;
+    }
+    catch {
+        return 0;
+    }
+}

package/dist/commands/hook.js

@@ -0,0 +1,122 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { COMMAND_NAME, getClaudeSettingsPath, getPackageVersion, PRODUCT_NAME, } from "../lib.js";
+import { logError, logOk, logWarn } from "../colors.js";
+function hookCommandFor(mode) {
+    const v = getPackageVersion();
+    const parts = v.split(".");
+    const major = parts[0] ?? "0";
+    const minor = parts[1] ?? "0";
+    const range = `~${major}.${minor}.0`;
+    const verb = mode === "auto" ? "update --yes" : "check";
+    return `pnpm dlx ${COMMAND_NAME}@${range} ${verb}`;
+}
+const HOOK_SIGNATURE = COMMAND_NAME;
+function readSettings() {
+    const path = getClaudeSettingsPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        logError(`No se pudo parsear ${path}. Revisa el JSON manualmente.`);
+        return {};
+    }
+}
+function writeSettings(s) {
+    writeFileSync(getClaudeSettingsPath(), JSON.stringify(s, null, 2) + "\n", "utf-8");
+}
+function isOurMatcher(m) {
+    if (!m || typeof m !== "object")
+        return false;
+    const hooks = m.hooks;
+    if (!Array.isArray(hooks))
+        return false;
+    return hooks.some((h) => h &&
+        typeof h === "object" &&
+        h.type === "command" &&
+        typeof h.command === "string" &&
+        h.command.includes(HOOK_SIGNATURE));
+}
+function buildOurMatcher(command) {
+    return { hooks: [{ type: "command", command }] };
+}
+export function runHookInstall(mode = "check") {
+    const settings = readSettings();
+    settings.hooks = settings.hooks ?? {};
+    const command = hookCommandFor(mode);
+    const existing = settings.hooks.SessionStart;
+    const compact = process.env.CLAUDECODE === "1" || process.env.CLAUDE_CODE === "1";
+    if (typeof existing === "string") {
+        if (!existing.includes(HOOK_SIGNATURE)) {
+            logWarn(`Ya hay un SessionStart hook configurado (formato string legacy):\n   ${existing}\n` +
+                `   No lo sobrescribo. Conviértelo a formato array manualmente.`);
+            return 1;
+        }
+        settings.hooks.SessionStart = [buildOurMatcher(command)];
+        writeSettings(settings);
+        if (!compact)
+            logOk(`Hook migrado a formato array y configurado en modo '${mode}'.`);
+        return 0;
+    }
+    const matchers = Array.isArray(existing)
+        ? existing.filter((m) => !!m && typeof m === "object" && Array.isArray(m.hooks))
+        : [];
+    const previousOurs = matchers.find(isOurMatcher);
+    if (previousOurs) {
+        const sameCommand = previousOurs.hooks.some((h) => h.type === "command" && h.command === command);
+        if (sameCommand) {
+            if (!compact)
+                logOk(`El hook ya está instalado en modo '${mode}'.`);
+            return 0;
+        }
+    }
+    const others = matchers.filter((m) => !isOurMatcher(m));
+    others.push(buildOurMatcher(command));
+    settings.hooks.SessionStart = others;
+    writeSettings(settings);
+    if (!compact) {
+        const description = mode === "auto"
+            ? "actualizará automáticamente al abrir Claude Code"
+            : "avisará al iniciar Claude Code cuando haya updates";
+        logOk(`Hook instalado (modo '${mode}'). ${COMMAND_NAME} ${description}.`);
+    }
+    return 0;
+}
+export function runHookUninstall() {
+    const settings = readSettings();
+    const existing = settings.hooks?.SessionStart;
+    if (existing === undefined) {
+        logWarn("No había hook que desinstalar.");
+        return 0;
+    }
+    if (typeof existing === "string") {
+        if (!existing.includes(HOOK_SIGNATURE)) {
+            logWarn(`El SessionStart hook actual no es de ${PRODUCT_NAME}. No lo toco.`);
+            return 1;
+        }
+        delete settings.hooks.SessionStart;
+        writeSettings(settings);
+        logOk("Hook removido.");
+        return 0;
+    }
+    if (!Array.isArray(existing)) {
+        logWarn("No había hook que desinstalar.");
+        return 0;
+    }
+    const filtered = existing.filter((m) => !isOurMatcher(m));
+    if (filtered.length === existing.length) {
+        logWarn(`No encontré ningún SessionStart hook de ${PRODUCT_NAME}. No lo toco.`);
+        return 1;
+    }
+    if (filtered.length === 0) {
+        delete settings.hooks.SessionStart;
+    }
+    else {
+        settings.hooks.SessionStart = filtered;
+    }
+    writeSettings(settings);
+    logOk("Hook removido.");
+    return 0;
+}
+export { hookCommandFor };