attestari 2.9.3 → 2.9.4

package/dist/hook.js

@@ -2,72 +2,134 @@
 "use strict";
 
 // src/main.ts
-var import_node_fs11 = require("node:fs");
-
-// src/adapters/claude-code.ts
-var import_node_path6 = require("node:path");
+var import_node_fs12 = require("node:fs");
 
-// src/call.ts
-var import_node_crypto2 = require("node:crypto");
+// src/adapters/antigravity.ts
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
 
-// src/cache.ts
-var import_node_crypto = require("node:crypto");
+// src/denies.ts
 var import_node_fs = require("node:fs");
-var import_node_path2 = require("node:path");
-
-// src/paths.ts
-var import_node_os = require("node:os");
 var import_node_path = require("node:path");
-function home() {
-  return process.env.HOME || process.env.USERPROFILE || (0, import_node_os.homedir)();
+
+// src/decide.ts
+var STALE_MS = 7 * 24 * 60 * 60 * 1e3;
+var NOT_CHECKED = "not_checked";
+var PACKAGES = /* @__PURE__ */ new Set(["npm", "pypi", "remote"]);
+var BY_KEY = /* @__PURE__ */ new Set(["local", "skill"]);
+var REPORTS = /* @__PURE__ */ new Set(["npm", "pypi"]);
+var STRICTEST = { block: 0, warn: 1, allow: 2 };
+function reducedKey(key) {
+  return Array.from(key, (c) => /^[A-Za-z0-9@/._-]$/.test(c) ? c : "_").join("").slice(0, 214);
 }
-function attestariDir() {
-  return (0, import_node_path.join)(home(), ".attestari");
+function suffixedKey(reduced, folder) {
+  return `${reduced.slice(0, 214 - folder.length - 1)}/${folder}`;
 }
-function agentDir(agent) {
-  return (0, import_node_path.join)(attestariDir(), agent);
+function oneLine(text) {
+  return text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
+}
+function named(name, version) {
+  return version === null ? name : `${name} ${version}`;
+}
+function report(source, name, version) {
+  if (!REPORTS.has(source)) return "app.attestari.ai/tools";
+  const path = name.split("/").map(encodeURIComponent).join("/");
+  return `app.attestari.ai/tools/${source}/${path}${version === null ? "" : `/${encodeURIComponent(version)}`}`;
+}
+var BLOCKED = "Blocked by your organization's policy:";
+var REASONS = /* @__PURE__ */ new Map([
+  ["below_minimum_grade", (e, p) => `${BLOCKED} ${named(e.name, e.version)} is graded ${e.grade === null ? "" : `${e.grade}, `}below the minimum ${p.policy.minimum_grade}.`],
+  ["not_examined", (e) => `${BLOCKED} ${named(e.name, e.version)} has not been examined by Attestari yet.`],
+  ["under_re_examination", (e) => `${BLOCKED} ${named(e.name, e.version)} is being re-examined by Attestari.`],
+  ["not_gradeable", (e) => `${BLOCKED} ${named(e.name, e.version)} was examined and could not be graded.`]
+]);
+function blocked(entry, policy) {
+  const words = REASONS.get(entry.rule);
+  const said = words ? words(entry, policy) : `${BLOCKED} ${named(entry.name, entry.version)} (${entry.rule}).`;
+  return `${said} ${report(entry.source, entry.name, entry.version)}`;
+}
+function matches(entry, resolved) {
+  if (entry.source !== resolved.source) return false;
+  if (BY_KEY.has(resolved.source)) {
+    const reduced = reducedKey(resolved.key);
+    return entry.key === reduced || resolved.folder !== void 0 && entry.key === suffixedKey(reduced, resolved.folder);
+  }
+  if (PACKAGES.has(resolved.source)) return entry.name === resolved.name && (resolved.version === null || entry.version === resolved.version);
+  return false;
+}
+function entryFor(policy, resolved) {
+  return policy.servers.filter((e) => matches(e, resolved)).sort((a, b) => STRICTEST[a.decision] - STRICTEST[b.decision])[0];
+}
+function deny(rule, reason) {
+  return { allow: false, reason: oneLine(reason), rule };
+}
+function decide(policy, ageMs, resolved, key = resolved?.key) {
+  const tool = resolved !== null ? named(resolved.name, resolved.version) : key !== void 0 ? `the server "${reducedKey(key)}"` : "this server";
+  if (policy === null) {
+    return deny(NOT_CHECKED, `Not checked by Attestari: this agent holds no Attestari policy, so ${tool} is blocked. Pair it at app.attestari.ai/agents`);
+  }
+  if (ageMs > STALE_MS) {
+    return deny(NOT_CHECKED, `Attestari blocked ${tool}: not checked in for 7 days: open app.attestari.ai`);
+  }
+  const entry = resolved === null ? void 0 : entryFor(policy, resolved);
+  if (entry === void 0) {
+    return deny(policy.unlisted.rule, `Not yet checked by Attestari: ${tool} is not in your organization's policy yet. app.attestari.ai/agents`);
+  }
+  if (entry.decision === "allow") return { allow: true };
+  if (entry.decision === "warn") return { allow: true, warn: { rule: entry.rule } };
+  return deny(entry.rule, blocked(entry, policy));
 }
 
-// src/validate.ts
+// src/denies.ts
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isString(value) {
-  return typeof value === "string";
+function denyOf(r) {
+  const launch = r.launch;
+  if (!isObject(launch)) return null;
+  const command = launch.command;
+  if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string")) return { serverCommand: command };
+  if (typeof launch.url === "string" && launch.url !== "") return { serverUrl: launch.url };
+  return null;
 }
-function isEntry(value) {
-  return isObject(value) && isString(value.key) && isString(value.source) && isString(value.name) && (value.version === null || isString(value.version)) && (value.decision === "allow" || value.decision === "block" || value.decision === "warn") && isString(value.rule) && (value.grade === null || isString(value.grade));
+function blockedForms(resolved, policy) {
+  const forms = resolved.filter((r) => entryFor(policy, r)?.decision === "block").map(denyOf).filter((e) => e !== null);
+  return [...new Set(forms.map((e) => JSON.stringify(e)))];
 }
-function isCompiled(value) {
-  if (!isObject(value) || value.format !== 1) return false;
-  const policy = value.policy;
-  if (!isObject(policy) || typeof policy.version !== "number" || !isString(policy.minimum_grade) || typeof policy.block_not_examined !== "boolean" || typeof policy.block_not_gradeable !== "boolean") {
-    return false;
-  }
-  const unlisted = value.unlisted;
-  if (!isObject(unlisted) || unlisted.decision !== "block" || unlisted.rule !== "not_checked") return false;
-  return isString(value.etag) && value.etag !== "" && isString(value.compiled_at) && Array.isArray(value.not_enforced) && value.not_enforced.every(isString) && Array.isArray(value.servers) && value.servers.every(isEntry);
+function indentOf(text) {
+  const first = /\n([ \t]+)\S/.exec(text);
+  if (first === null) return 2;
+  return first[1].startsWith("	") ? "	" : Math.min(first[1].length, 8);
 }
-
-// src/cache.ts
-var MAX_EVENTS = 1e3;
-function cacheDir(agent) {
-  return agentDir(agent);
+function bytesOf(file) {
+  try {
+    return (0, import_node_fs.readFileSync)(file);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
 }
-function ensureDir(agent) {
-  const dir = cacheDir(agent);
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
-  return dir;
+function same(a, b) {
+  return a === null || b === null ? a === b : a.equals(b);
 }
-function writeAtomic(file, data, mode) {
-  const temporary = `${file}.${process.pid}.tmp`;
+var beforeRename = null;
+function writeBeside(file, data, mode, read) {
+  const temporary = `${file}.${process.pid}.attestari.tmp`;
   try {
-    (0, import_node_fs.writeFileSync)(temporary, data, { mode });
-    try {
-      (0, import_node_fs.chmodSync)(temporary, mode);
-    } catch {
+    (0, import_node_fs.writeFileSync)(temporary, data, mode === void 0 ? {} : { mode });
+    if (mode !== void 0) {
+      try {
+        (0, import_node_fs.chmodSync)(temporary, mode);
+      } catch {
+      }
+    }
+    beforeRename?.();
+    if (!same(bytesOf(file), read)) {
+      (0, import_node_fs.unlinkSync)(temporary);
+      return false;
     }
     (0, import_node_fs.renameSync)(temporary, file);
+    return true;
   } catch (error) {
     try {
       (0, import_node_fs.unlinkSync)(temporary);
@@ -76,1025 +138,1082 @@ function writeAtomic(file, data, mode) {
     throw error;
   }
 }
-function readText(file) {
+function formatLike(text, value) {
+  const bom = text !== null && text.startsWith("\uFEFF");
+  const crlf = text !== null && text.includes("\r\n");
+  const newline = text === null || /\n$/.test(text);
+  let out = JSON.stringify(value, null, text === null ? 2 : indentOf(text)) + (newline ? "\n" : "");
+  if (crlf) out = out.replace(/\n/g, "\r\n");
+  if (bom) out = `\uFEFF${out}`;
+  return out;
+}
+function modeOf(file, text) {
   try {
-    return (0, import_node_fs.readFileSync)(file, "utf8");
+    return text === null ? void 0 : (0, import_node_fs.statSync)(file).mode & 511;
   } catch {
-    return null;
+    return void 0;
   }
 }
-function readPolicy(agent) {
-  const file = (0, import_node_path2.join)(cacheDir(agent), "policy.json");
-  const text = readText(file);
-  if (text === null) return null;
-  let document;
+function say(line) {
+  process.stderr.write(`attestari-hook: ${line}
+`);
+}
+function writeDenies(agent, settingsPath, resolved, policy, written, takeBack = true, elsewhere = /* @__PURE__ */ new Set()) {
+  void agent;
+  const wanted = blockedForms(resolved, policy);
+  let read;
   try {
-    document = JSON.parse(text);
+    read = bytesOf(settingsPath);
   } catch {
-    return null;
+    say(`${settingsPath} could not be read; its deny entries are left as they were`);
+    return written;
   }
-  if (!isCompiled(document)) return null;
-  let modified;
+  const text = read === null ? null : read.toString("utf8");
+  if (text === null) {
+    if (wanted.length === 0) return [];
+    if (!(0, import_node_fs.existsSync)((0, import_node_path.dirname)(settingsPath))) {
+      say(`${(0, import_node_path.dirname)(settingsPath)} does not exist; no deny entry is written`);
+      return written;
+    }
+  }
+  const bom = text !== null && text.startsWith("\uFEFF");
+  let settings;
   try {
-    modified = (0, import_node_fs.statSync)(file).mtimeMs;
+    settings = text === null ? {} : JSON.parse(bom ? text.slice(1) : text);
   } catch {
-    return null;
+    settings = void 0;
   }
-  return { policy: document, ageMs: Math.max(0, Date.now() - modified) };
-}
-function isResolved(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const r = value;
-  return typeof r.key === "string" && typeof r.source === "string" && typeof r.name === "string" && (r.version === null || typeof r.version === "string") && typeof r.local === "string";
-}
-function writePolicy(agent, policy, etag) {
-  const dir = ensureDir(agent);
-  writeAtomic((0, import_node_path2.join)(dir, "policy.json"), `${JSON.stringify(policy, null, 2)}
-`, 384);
-  writeAtomic((0, import_node_path2.join)(dir, "policy.etag"), etag, 384);
-}
-function readEtag(agent) {
-  const etag = readText((0, import_node_path2.join)(cacheDir(agent), "policy.etag"))?.trim();
-  return etag ? etag : null;
-}
-function readToken(agent) {
-  const text = readText((0, import_node_path2.join)(cacheDir(agent), "token"));
-  const token = text?.trim();
-  return token ? token : null;
-}
-function writeToken(agent, token) {
-  writeAtomic((0, import_node_path2.join)(ensureDir(agent), "token"), token, 384);
-}
-function appendEvent(agent, event) {
-  const file = (0, import_node_path2.join)(ensureDir(agent), "events.jsonl");
-  (0, import_node_fs.appendFileSync)(file, `${JSON.stringify(event)}
-`, { mode: 384 });
-  const lines = (readText(file) ?? "").split("\n").filter((line) => line !== "");
-  if (lines.length > MAX_EVENTS) {
-    writeAtomic(file, `${lines.slice(-MAX_EVENTS).join("\n")}
-`, 384);
+  if (!isObject(settings) || settings.deniedMcpServers !== void 0 && !Array.isArray(settings.deniedMcpServers)) {
+    say(`${settingsPath} is not a settings file the hook can read; its deny entries are left as they were`);
+    return written;
+  }
+  const existing = settings.deniedMcpServers ?? [];
+  const mine = new Set(written);
+  const want = new Set(wanted);
+  const applies = (form) => want.has(form) || elsewhere.has(form);
+  const kept = existing.filter((e) => {
+    const form = JSON.stringify(e);
+    return !(takeBack && mine.has(form) && !applies(form));
+  });
+  const present = new Set(kept.map((e) => JSON.stringify(e)));
+  const added = wanted.filter((form) => !present.has(form));
+  const now = takeBack ? [...wanted.filter((form) => mine.has(form) || added.includes(form)), ...written.filter((form) => !want.has(form) && elsewhere.has(form))] : [...written, ...added.filter((form) => !mine.has(form))];
+  if (added.length === 0 && kept.length === existing.length) return now;
+  const next = { ...settings, deniedMcpServers: [...kept, ...added.map((form) => JSON.parse(form))] };
+  const crlf = text !== null && text.includes("\r\n");
+  const newline = text === null || /\n$/.test(text);
+  let out = JSON.stringify(next, null, text === null ? 2 : indentOf(text)) + (newline ? "\n" : "");
+  if (crlf) out = out.replace(/\n/g, "\r\n");
+  if (bom) out = `\uFEFF${out}`;
+  let mode;
+  try {
+    mode = text === null ? void 0 : (0, import_node_fs.statSync)(settingsPath).mode & 511;
+  } catch {
+    mode = void 0;
+  }
+  if (!writeBeside(settingsPath, out, mode, read)) {
+    say(`${settingsPath} changed while the hook wrote its deny entries; they are left as they were until the next check-in`);
+    return written;
   }
+  return now;
 }
-function readEvents(agent) {
-  const events = [];
-  for (const line of (readText((0, import_node_path2.join)(cacheDir(agent), "events.jsonl")) ?? "").split("\n")) {
-    if (line === "") continue;
-    try {
-      events.push(JSON.parse(line));
-    } catch {
+function writeDenyList(file, get, put, wanted, written, takeBack = true, elsewhere = /* @__PURE__ */ new Set()) {
+  let read;
+  try {
+    read = bytesOf(file);
+  } catch {
+    say(`${file} could not be read; its deny entries are left as they were`);
+    return written;
+  }
+  const text = read === null ? null : read.toString("utf8");
+  if (text === null) {
+    if (wanted.length === 0) return [];
+    if (!(0, import_node_fs.existsSync)((0, import_node_path.dirname)(file))) {
+      say(`${(0, import_node_path.dirname)(file)} does not exist; no deny entry is written`);
+      return written;
     }
   }
-  return events;
-}
-function removeEvents(agent, ids) {
-  const file = (0, import_node_path2.join)(cacheDir(agent), "events.jsonl");
-  const text = readText(file);
-  if (text === null) return;
-  const sent2 = new Set(ids);
-  const keep = readEvents(agent).filter((event) => !sent2.has(event.id));
-  if (keep.length === 0) {
-    try {
-      (0, import_node_fs.unlinkSync)(file);
-    } catch {
-    }
-    return;
-  }
-  writeAtomic(file, `${keep.map((event) => JSON.stringify(event)).join("\n")}
-`, 384);
-}
-function folderId(cwd) {
-  return (0, import_node_crypto.createHash)("sha256").update(cwd, "utf8").digest("hex").slice(0, 16);
-}
-var FOLDER_FILE = /^([0-9a-f]{16})\.json$/;
-function parseResolution(id, text, modifiedMs) {
-  if (text === null) return null;
-  let document;
+  const bom = text !== null && text.startsWith("\uFEFF");
+  let settings;
   try {
-    document = JSON.parse(text);
+    settings = text === null ? {} : JSON.parse(bom ? text.slice(1) : text);
   } catch {
-    return null;
+    settings = void 0;
   }
-  if (typeof document !== "object" || document === null || Array.isArray(document)) return null;
-  const { complete, servers, cwd } = document;
-  if (typeof complete !== "boolean" || !Array.isArray(servers) || !servers.every(isResolved)) return null;
-  const path = typeof cwd === "string" && cwd !== "" && folderId(cwd) === id ? { cwd } : {};
-  const when = modifiedMs === void 0 ? {} : { modifiedMs };
-  return { id, complete, servers: servers.map((r) => ({ ...r, folder: id.slice(0, 8) })), ...path, ...when };
-}
-function readResolution(agent, cwd) {
-  return readResolutionOf(agent, folderId(cwd));
-}
-function readResolutionOf(agent, id) {
-  if (!/^[0-9a-f]{16}$/.test(id)) return null;
-  return parseResolution(id, readText((0, import_node_path2.join)(cacheDir(agent), "resolved", `${id}.json`)));
+  const existing = isObject(settings) ? get(settings) : null;
+  if (!isObject(settings) || existing === null) {
+    say(`${file} is not a settings file the hook can read; its deny entries are left as they were`);
+    return written;
+  }
+  const current = existing ?? [];
+  const mine = new Set(written);
+  const want = new Set(wanted);
+  const applies = (form) => want.has(form) || elsewhere.has(form);
+  const kept = current.filter((e) => {
+    const form = JSON.stringify(e);
+    return !(takeBack && mine.has(form) && !applies(form));
+  });
+  const present = new Set(kept.map((e) => JSON.stringify(e)));
+  const added = wanted.filter((form) => !present.has(form));
+  const now = takeBack ? [...wanted.filter((form) => mine.has(form) || added.includes(form)), ...written.filter((form) => !want.has(form) && elsewhere.has(form))] : [...written, ...added.filter((form) => !mine.has(form))];
+  if (added.length === 0 && kept.length === current.length) return now;
+  const next = put(settings, [...kept, ...added.map((form) => JSON.parse(form))]);
+  const out = formatLike(text, next);
+  if (!writeBeside(file, bom ? `\uFEFF${out}` : out, modeOf(file, text), read)) {
+    say(`${file} changed while the hook wrote its deny entries; they are left as they were until the next check-in`);
+    return written;
+  }
+  return now;
 }
-function sessionFile(agent, sessionId) {
-  const name = /^[A-Za-z0-9_-]{1,128}$/.test(sessionId) ? sessionId : (0, import_node_crypto.createHash)("sha256").update(sessionId, "utf8").digest("hex");
-  return (0, import_node_path2.join)(cacheDir(agent), "sessions", name);
+
+// src/resolve.ts
+var import_node_crypto = require("node:crypto");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+var SERVERS_AT_MOST = 200;
+var NPM_NAME = /^(?:@[A-Za-z0-9~-][A-Za-z0-9._~-]*\/)?[A-Za-z0-9~-][A-Za-z0-9._~-]*$/;
+var PYPI_NAME = /^(?:[A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9._-]*[A-Za-z0-9])$/;
+var CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+var SOURCES = /* @__PURE__ */ new Set(["npm", "pypi", "local", "remote"]);
+var NPM_EXACT = /^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/;
+var PYPI_EXACT = /^[0-9][0-9A-Za-z.+!-]*$/;
+function isStrings(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
-function writeSession(agent, sessionId, cwd) {
-  (0, import_node_fs.mkdirSync)((0, import_node_path2.join)(ensureDir(agent), "sessions"), { recursive: true, mode: 448 });
-  writeAtomic(sessionFile(agent, sessionId), `${JSON.stringify({ folder: folderId(cwd), cwd })}
-`, 384);
+function runner(command) {
+  const file = command.split(/[\\/]/).pop() ?? command;
+  return file.toLowerCase().replace(/\.(cmd|exe|bat|ps1)$/, "");
 }
-function readSession(agent, sessionId) {
-  const text = readText(sessionFile(agent, sessionId));
-  if (text === null) return null;
-  try {
-    const value = JSON.parse(text);
-    if (typeof value !== "object" || value === null) return null;
-    const { folder, cwd } = value;
-    return typeof folder === "string" && typeof cwd === "string" && cwd !== "" && folderId(cwd) === folder ? { folder, cwd } : null;
-  } catch {
-    return null;
-  }
+var NPM_WANTED = /^[0-9A-Za-z.^~<>=|*+ -]*$/;
+function npmSpec(spec) {
+  const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
+  const name = at > 0 ? spec.slice(0, at) : spec;
+  const wanted = at > 0 ? spec.slice(at + 1) : "";
+  if (!NPM_NAME.test(name) || name.length > 214 || !NPM_WANTED.test(wanted)) return null;
+  const exact = NPM_EXACT.exec(wanted);
+  return { source: "npm", name, version: exact ? exact[1] : null };
 }
-function pruneSessions(agent, maxAgeMs, now = Date.now()) {
-  const dir = (0, import_node_path2.join)(cacheDir(agent), "sessions");
-  let names;
-  try {
-    names = (0, import_node_fs.readdirSync)(dir);
-  } catch {
-    return 0;
-  }
-  let removed = 0;
-  for (const name of names) {
-    try {
-      const file = (0, import_node_path2.join)(dir, name);
-      if (now - (0, import_node_fs.statSync)(file).mtimeMs > maxAgeMs) {
-        (0, import_node_fs.unlinkSync)(file);
-        removed += 1;
-      }
-    } catch {
+var RUNNER_NO_VALUE = /* @__PURE__ */ new Set(["-y", "--yes", "-q", "--quiet"]);
+function npmRunner(args) {
+  const packages = [];
+  let i = 0;
+  for (; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") {
+      i++;
+      break;
     }
-  }
-  return removed;
-}
-function readResolutions(agent) {
-  let names;
-  try {
-    names = (0, import_node_fs.readdirSync)((0, import_node_path2.join)(cacheDir(agent), "resolved")).sort();
-  } catch {
-    return [];
-  }
-  const out = [];
-  for (const name of names) {
-    const id = FOLDER_FILE.exec(name)?.[1];
-    if (id === void 0) continue;
-    const file = (0, import_node_path2.join)(cacheDir(agent), "resolved", name);
-    let modifiedMs;
-    try {
-      modifiedMs = (0, import_node_fs.statSync)(file).mtimeMs;
-    } catch {
-      modifiedMs = void 0;
+    if (a === "-p" || a === "--package") {
+      if (i + 1 >= args.length) return null;
+      packages.push(args[++i]);
+      continue;
     }
-    const resolution = parseResolution(id, readText(file), modifiedMs);
-    if (resolution !== null) out.push(resolution);
-  }
-  return out;
-}
-function writeResolution(agent, cwd, servers, complete) {
-  const dir = (0, import_node_path2.join)(ensureDir(agent), "resolved");
-  const file = (0, import_node_path2.join)(dir, `${folderId(cwd)}.json`);
-  try {
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
-    const kept = servers.map(({ folder: _folder, ...r }) => r);
-    writeAtomic(file, `${JSON.stringify({ complete, cwd, servers: kept }, null, 2)}
-`, 384);
-  } catch (error) {
-    try {
-      (0, import_node_fs.rmSync)(file, { force: true });
-    } catch {
+    if (a.startsWith("--package=")) {
+      packages.push(a.slice("--package=".length));
+      continue;
     }
-    throw error;
+    if (RUNNER_NO_VALUE.has(a)) continue;
+    if (a.startsWith("-")) return null;
+    break;
   }
+  if (packages.length > 1) return null;
+  const spec = packages[0] ?? args[i];
+  return spec === void 0 ? null : npmSpec(spec);
 }
-function readWritten(agent, id) {
-  const text = readText((0, import_node_path2.join)(cacheDir(agent), "written", `${id}.json`));
-  if (text === null) return [];
-  try {
-    const value = JSON.parse(text);
-    return Array.isArray(value) && value.every((v) => typeof v === "string") ? value : [];
-  } catch {
-    return [];
+function pypiSpec(spec) {
+  const match = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?(.*)$/.exec(spec.trim());
+  if (match === null || !PYPI_NAME.test(match[1]) || match[1].length > 214) return null;
+  const rest = match[2].trim();
+  if (/[:/]/.test(rest)) return null;
+  const exact = /^(?:==|@)\s*([^\s,;<>=!~*@]+)$/.exec(rest);
+  if (rest !== "" && exact === null && !/^[<>=!~]/.test(rest)) return null;
+  return { source: "pypi", name: match[1], version: exact && PYPI_EXACT.test(exact[1]) ? exact[1] : null };
+}
+function pypiRunner(args, from) {
+  let chosen = null;
+  let i = 0;
+  for (; i < args.length; i++) {
+    const a = args[i];
+    if (a === from || a.startsWith(`${from}=`)) {
+      const value = a === from ? args[++i] : a.slice(from.length + 1);
+      if (value === void 0 || chosen !== null) return null;
+      chosen = value;
+      continue;
+    }
+    if (RUNNER_NO_VALUE.has(a)) continue;
+    if (from === "--from" && (a === "--python" || a === "-p")) {
+      if (i + 1 >= args.length) return null;
+      i++;
+      continue;
+    }
+    if (from === "--from" && a.startsWith("--python=")) continue;
+    if (a.startsWith("-")) return null;
+    break;
   }
+  const spec = chosen ?? args[i];
+  return spec === void 0 ? null : pypiSpec(spec);
 }
-function dropResolution(agent, id) {
-  if (!/^[0-9a-f]{16}$/.test(id)) return;
-  (0, import_node_fs.rmSync)((0, import_node_path2.join)(cacheDir(agent), "resolved", `${id}.json`), { force: true });
-  (0, import_node_fs.rmSync)((0, import_node_path2.join)(cacheDir(agent), "written", `${id}.json`), { force: true });
+function unwrapped(command, args) {
+  if (runner(command) === "cmd" && args.length >= 2 && /^\/[ck]$/i.test(args[0])) return unwrapped(args[1], args.slice(2));
+  return [command, args];
 }
-function writeWritten(agent, id, written) {
-  const dir = (0, import_node_path2.join)(ensureDir(agent), "written");
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
-  writeAtomic((0, import_node_path2.join)(dir, `${id}.json`), `${JSON.stringify(written, null, 2)}
-`, 384);
+function registryRunner(configuredCommand, configuredArgs) {
+  const [command, args] = unwrapped(configuredCommand, configuredArgs);
+  const run3 = runner(command);
+  if (run3 === "npx" || run3 === "bunx" || run3 === "pnpx" || run3 === "uvx") return true;
+  if ((run3 === "pnpm" || run3 === "yarn") && args[0] === "dlx") return true;
+  return run3 === "pipx" && args[0] === "run";
 }
-function deleteToken(agent) {
-  try {
-    (0, import_node_fs.unlinkSync)((0, import_node_path2.join)(cacheDir(agent), "token"));
-  } catch {
-  }
+function packageOf(configuredCommand, configuredArgs) {
+  const [command, args] = unwrapped(configuredCommand, configuredArgs);
+  const run3 = runner(command);
+  if (run3 === "npx" || run3 === "bunx" || run3 === "pnpx") return npmRunner(args);
+  if ((run3 === "pnpm" || run3 === "yarn") && args[0] === "dlx") return npmRunner(args.slice(1));
+  if (run3 === "uvx") return pypiRunner(args, "--from");
+  if (run3 === "pipx" && args[0] === "run") return pypiRunner(args.slice(1), "--spec");
+  return null;
 }
-function deletePolicy(agent) {
-  for (const name of ["policy.json", "policy.etag"]) {
-    try {
-      (0, import_node_fs.unlinkSync)((0, import_node_path2.join)(cacheDir(agent), name));
-    } catch {
-    }
-  }
+function secretLike(segment) {
+  return /[%@=+]/.test(segment) || segment.length >= 16 && /[0-9]/.test(segment) && /[A-Za-z]/.test(segment);
 }
-function deleteStamp(agent, name) {
+function remoteName(address) {
+  let url2;
   try {
-    (0, import_node_fs.unlinkSync)((0, import_node_path2.join)(cacheDir(agent), name));
+    url2 = new URL(address.trim());
   } catch {
+    return null;
   }
+  if (!["http:", "https:", "ws:", "wss:"].includes(url2.protocol) || url2.hostname === "") return null;
+  const port = url2.port === "" ? "" : `:${url2.port}`;
+  const path = url2.pathname.replace(/\/+$/, "").split("/").map((segment) => secretLike(segment) ? "*" : segment).join("/");
+  return `${url2.hostname.toLowerCase()}${port}${path}`;
 }
-function writeStamp(agent, name, at = /* @__PURE__ */ new Date(), word) {
-  writeAtomic((0, import_node_path2.join)(ensureDir(agent), name), `${at.toISOString()}${word === void 0 ? "" : ` ${word}`}
-`, 384);
-}
-function readStamp(agent, name) {
-  const parts = (readText((0, import_node_path2.join)(cacheDir(agent), name)) ?? "").trim().split(/\s+/);
-  const at = Date.parse(parts[0]);
-  if (parts[0] === "" || Number.isNaN(at)) return null;
-  return { at, word: parts[1] ?? null };
+function pathLike(arg) {
+  if (arg.startsWith("-") || /^\/[A-Za-z?]$/.test(arg)) return false;
+  if (/[=?#@]/.test(arg) || arg.replace(/^[A-Za-z]:(?=[\\/])/, "").includes(":")) return false;
+  return /[\\/]/.test(arg) || arg.startsWith("~") || /\.(?:[cm]?[jt]s|py)$/i.test(arg);
 }
-function stampAge(agent, name, now = Date.now()) {
-  const stamp = readStamp(agent, name);
-  if (stamp === null || stamp.at > now) return null;
-  return now - stamp.at;
-}
-var SECRET_BYTES = 32;
-function readSecret(agent) {
-  const file = (0, import_node_path2.join)(ensureDir(agent), "secret");
-  const held = () => {
-    try {
-      const bytes = (0, import_node_fs.readFileSync)(file);
-      return bytes.length === SECRET_BYTES ? bytes : null;
-    } catch {
-      return null;
-    }
-  };
-  const existing = held();
-  if (existing !== null) return existing;
-  const fresh = (0, import_node_crypto.randomBytes)(SECRET_BYTES);
-  const temporary = `${file}.${process.pid}.tmp`;
-  (0, import_node_fs.writeFileSync)(temporary, fresh, { mode: 384 });
-  try {
-    try {
-      (0, import_node_fs.chmodSync)(temporary, 384);
-    } catch {
-    }
-    try {
-      (0, import_node_fs.linkSync)(temporary, file);
-      return fresh;
-    } catch {
-      const other = held();
-      if (other !== null) return other;
-      (0, import_node_fs.renameSync)(temporary, file);
-      return fresh;
-    }
-  } finally {
-    try {
-      (0, import_node_fs.unlinkSync)(temporary);
-    } catch {
-    }
-  }
-}
-
-// src/decide.ts
-var STALE_MS = 7 * 24 * 60 * 60 * 1e3;
-var NOT_CHECKED = "not_checked";
-var PACKAGES = /* @__PURE__ */ new Set(["npm", "pypi", "remote"]);
-var BY_KEY = /* @__PURE__ */ new Set(["local", "skill"]);
-var REPORTS = /* @__PURE__ */ new Set(["npm", "pypi"]);
-var STRICTEST = { block: 0, warn: 1, allow: 2 };
-function reducedKey(key) {
-  return Array.from(key, (c) => /^[A-Za-z0-9@/._-]$/.test(c) ? c : "_").join("").slice(0, 214);
+var FILE_NAME = /^[A-Za-z0-9._-]{1,200}$/;
+function fileName(file) {
+  if (!FILE_NAME.test(file) || secretLike(file)) return false;
+  return !(file.length >= 16 && !file.includes(".") && /[a-z]/.test(file) && /[A-Z]/.test(file));
 }
-function suffixedKey(reduced, folder) {
-  return `${reduced.slice(0, 214 - folder.length - 1)}/${folder}`;
+function fileAndFolder(path, home2) {
+  const expanded = path === "~" || path.startsWith("~/") || path.startsWith("~\\") ? `${home2}${path.slice(1)}` : path;
+  const parts = expanded.split(/[\\/]/);
+  const file = parts.pop() ?? "";
+  return { file, folder: parts.join("/") };
 }
-function oneLine(text) {
-  return text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
+function labelOf(folder, home2) {
+  const slashed = folder.replace(/\\/g, "/");
+  const root = home2.replace(/\\/g, "/").replace(/\/+$/, "");
+  const fold = (s) => process.platform === "win32" ? s.toLowerCase() : s;
+  if (root !== "" && (fold(slashed) === fold(root) || fold(slashed).startsWith(`${fold(root)}/`))) return `~${slashed.slice(root.length)}`;
+  return slashed;
 }
-function named(name, version) {
-  return version === null ? name : `${name} ${version}`;
+function localName(configuredCommand, configuredArgs, home2, secret) {
+  const [command, args] = unwrapped(configuredCommand, configuredArgs);
+  const path = args.find(pathLike);
+  const fromArg = path === void 0 ? null : fileAndFolder(path, home2);
+  const chosen = fromArg !== null && fileName(fromArg.file) ? fromArg : fileAndFolder(command, home2);
+  const file = fileName(chosen.file) ? chosen.file : "local";
+  const hash = (0, import_node_crypto.createHmac)("sha256", secret).update(labelOf(chosen.folder, home2), "utf8").digest("hex").slice(0, 12);
+  return `${file}#${hash}`;
 }
-function report(source, name, version) {
-  if (!REPORTS.has(source)) return "app.attestari.ai/tools";
-  const path = name.split("/").map(encodeURIComponent).join("/");
-  return `app.attestari.ai/tools/${source}/${path}${version === null ? "" : `/${encodeURIComponent(version)}`}`;
+function resolve(key, entry, home2, secret) {
+  const type = entry.type;
+  const command = entry.command;
+  const remote = type === "http" || type === "sse" || type === "ws" || type === void 0 && typeof command !== "string";
+  if (remote) {
+    const url2 = entry.url;
+    if (typeof url2 !== "string") return null;
+    const name = remoteName(url2);
+    if (name === null) return null;
+    const launch2 = { url: url2 };
+    return { key, source: "remote", name, version: null, local: url2, launch: launch2 };
+  }
+  if (type !== void 0 && type !== "stdio") return null;
+  const args = entry.args === void 0 ? [] : entry.args;
+  if (typeof command !== "string" || command === "" || !isStrings(args)) return null;
+  const launch = { command: [command, ...args] };
+  const local = [command, ...args].join(" ");
+  const found = packageOf(command, args);
+  if (found !== null) return { key, ...found, local, launch };
+  if (registryRunner(command, args)) return null;
+  return { key, source: "local", name: localName(command, args, home2, secret), version: null, local, launch };
 }
-var BLOCKED = "Blocked by your organization's policy:";
-var REASONS = /* @__PURE__ */ new Map([
-  ["below_minimum_grade", (e, p) => `${BLOCKED} ${named(e.name, e.version)} is graded ${e.grade === null ? "" : `${e.grade}, `}below the minimum ${p.policy.minimum_grade}.`],
-  ["not_examined", (e) => `${BLOCKED} ${named(e.name, e.version)} has not been examined by Attestari yet.`],
-  ["under_re_examination", (e) => `${BLOCKED} ${named(e.name, e.version)} is being re-examined by Attestari.`],
-  ["not_gradeable", (e) => `${BLOCKED} ${named(e.name, e.version)} was examined and could not be graded.`]
-]);
-function blocked(entry, policy) {
-  const words = REASONS.get(entry.rule);
-  const said = words ? words(entry, policy) : `${BLOCKED} ${named(entry.name, entry.version)} (${entry.rule}).`;
-  return `${said} ${report(entry.source, entry.name, entry.version)}`;
+function oneLineName(value) {
+  return value.length >= 1 && value.length <= 214 && !/\s/.test(value) && !CONTROL.test(value);
 }
-function matches(entry, resolved) {
-  if (entry.source !== resolved.source) return false;
-  if (BY_KEY.has(resolved.source)) {
-    const reduced = reducedKey(resolved.key);
-    return entry.key === reduced || resolved.folder !== void 0 && entry.key === suffixedKey(reduced, resolved.folder);
-  }
-  if (PACKAGES.has(resolved.source)) return entry.name === resolved.name && (resolved.version === null || entry.version === resolved.version);
-  return false;
+function reportable(r) {
+  if (!SOURCES.has(r.source) || !oneLineName(r.name)) return false;
+  if (r.version !== null && (r.version.length < 1 || r.version.length > 64 || /\s/.test(r.version) || CONTROL.test(r.version))) return false;
+  if (r.source === "remote" && (/[?#@]/.test(r.name) || r.name.includes("://"))) return false;
+  if (r.source === "npm" && !NPM_NAME.test(r.name)) return false;
+  if (r.source === "pypi" && !PYPI_NAME.test(r.name)) return false;
+  if (r.source === "local" && !LOCAL_NAME.test(r.name)) return false;
+  return reducedKey(r.key) !== "";
 }
-function entryFor(policy, resolved) {
-  return policy.servers.filter((e) => matches(e, resolved)).sort((a, b) => STRICTEST[a.decision] - STRICTEST[b.decision])[0];
+var LOCAL_NAME = /^[A-Za-z0-9._-]{1,200}#[0-9a-f]{12}$/;
+function byKey(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
 }
-function deny(rule, reason) {
-  return { allow: false, reason: oneLine(reason), rule };
+function finished(servers) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const s of servers) counts.set(s.key, (counts.get(s.key) ?? 0) + 1);
+  return servers.filter((s) => counts.get(s.key) === 1).sort((a, b) => byKey(a.key, b.key)).slice(0, SERVERS_AT_MOST);
 }
-function decide(policy, ageMs, resolved, key = resolved?.key) {
-  const tool = resolved !== null ? named(resolved.name, resolved.version) : key !== void 0 ? `the server "${reducedKey(key)}"` : "this server";
-  if (policy === null) {
-    return deny(NOT_CHECKED, `Not checked by Attestari: this agent holds no Attestari policy, so ${tool} is blocked. Pair it at app.attestari.ai/agents`);
-  }
-  if (ageMs > STALE_MS) {
-    return deny(NOT_CHECKED, `Attestari blocked ${tool}: not checked in for 7 days: open app.attestari.ai`);
+var sent = (r, key) => ({ key, source: r.source, name: r.name, version: r.version });
+function reportedAll(folders) {
+  const byReduced = /* @__PURE__ */ new Map();
+  for (const { folder, servers } of folders) {
+    for (const r of servers.filter(reportable)) {
+      const key = reducedKey(r.key);
+      byReduced.set(key, [...byReduced.get(key) ?? [], { folder, r }]);
+    }
   }
-  const entry = resolved === null ? void 0 : entryFor(policy, resolved);
-  if (entry === void 0) {
-    return deny(policy.unlisted.rule, `Not yet checked by Attestari: ${tool} is not in your organization's policy yet. app.attestari.ai/agents`);
+  const out = [];
+  for (const [key, held] of byReduced) {
+    const [first] = held;
+    const same2 = held.every(({ r }) => r.source === first.r.source && r.name === first.r.name && r.version === first.r.version);
+    if (same2) out.push(sent(first.r, key));
+    else for (const { folder, r } of held) out.push(sent(r, suffixedKey(key, folder)));
   }
-  if (entry.decision === "allow") return { allow: true };
-  if (entry.decision === "warn") return { allow: true, warn: { rule: entry.rule } };
-  return deny(entry.rule, blocked(entry, policy));
-}
-
-// src/refresh.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs2 = require("node:fs");
-var HOUR_MS = 60 * 60 * 1e3;
-var DAY_MS = 24 * HOUR_MS;
-var CHECKED_IN = "checked_in";
-var LOOKUP_UNAVAILABLE = "lookup_unavailable";
-var REFUSED = "refused";
-function say(line) {
-  process.stderr.write(`attestari-hook: ${line.replace(/\s+/g, " ").trim()}
-`);
+  return finished(out);
 }
-function message(error) {
-  return error instanceof Error ? error.message : String(error);
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function attempt(what, fn) {
+function readJson(file) {
+  let text;
   try {
-    fn();
+    text = (0, import_node_fs2.readFileSync)(file, "utf8");
   } catch (error) {
-    say(`${what}: ${message(error)}`);
+    return error.code === "ENOENT" ? void 0 : null;
   }
-}
-function usableFolder(folder) {
   try {
-    return typeof folder === "string" && folder !== "" && (0, import_node_fs2.statSync)(folder).isDirectory() ? folder : void 0;
+    const value = JSON.parse(text.replace(/^\ufeff/, ""));
+    return isObject2(value) ? value : null;
   } catch {
-    return void 0;
-  }
-}
-function spawnRefresh(agent, cwd) {
-  const at = /* @__PURE__ */ new Date();
-  attempt("refresh_started_at was not written", () => writeStamp(agent, "refresh_started_at", at));
-  const folder = usableFolder(cwd);
-  let pid;
-  try {
-    const child = (0, import_node_child_process.spawn)(process.execPath, [__filename, agent, "refresh", ...cwd !== void 0 && cwd !== "" ? ["--cwd", cwd] : []], {
-      cwd: folder,
-      detached: true,
-      stdio: "ignore",
-      windowsHide: true
-    });
-    child.on("error", () => {
-    });
-    child.unref();
-    pid = child.pid;
-  } catch (error) {
-    say(`the refresh could not be started: ${message(error)}`);
-  }
-  if (pid === void 0) {
-    attempt("refresh_started_at was not removed", () => deleteStamp(agent, "refresh_started_at"));
-    return;
+    return null;
   }
-  const started = pid;
-  attempt("refresh_started_at was not written", () => writeStamp(agent, "refresh_started_at", at, started));
 }
-function heldBack(agent, now, onlyAfterRefusal) {
-  const next = readStamp(agent, "next_refresh_at");
-  if (next === null || next.at <= now) return false;
-  return !onlyAfterRefusal || next.word !== CHECKED_IN;
-}
-function refreshDue(agent, now = Date.now()) {
-  if (readToken(agent) === null) return false;
-  const checked = stampAge(agent, "checked_in_at", now);
-  if (checked !== null && checked < HOUR_MS) return false;
-  const started = stampAge(agent, "refresh_started_at", now);
-  if (started !== null && started < HOUR_MS) return false;
-  return !heldBack(agent, now, false);
+function serversOf(holder) {
+  if (holder === null) return null;
+  if (holder === void 0 || holder.mcpServers === void 0) return void 0;
+  return isObject2(holder.mcpServers) ? holder.mcpServers : null;
 }
-
-// src/call.ts
-var UNREADABLE = "Attestari could not read the tool call";
-var UNREADABLE_VERDICT = { allow: false, reason: UNREADABLE, rule: "unreadable" };
-function record(adapter, decision, rule, tool) {
-  try {
-    appendEvent(adapter.name, { id: (0, import_node_crypto2.randomUUID)(), at: (/* @__PURE__ */ new Date()).toISOString(), decision, rule, tool, agent_client: adapter.client });
-  } catch {
+function claudeCodeScopes(home2, cwd) {
+  const claude = readJson((0, import_node_path2.join)(home2, ".claude.json"));
+  let project;
+  if (claude === null) project = null;
+  else if (claude !== void 0 && claude.projects !== void 0) {
+    const projects = claude.projects;
+    if (!isObject2(projects)) project = null;
+    else {
+      const trimmed = cwd.replace(/[\\/]+$/, "");
+      const forms = [cwd, cwd.replace(/\\/g, "/"), ...trimmed === "" ? [] : [trimmed, trimmed.replace(/\\/g, "/")]];
+      const held = forms.map((form) => projects[form]).find((value) => value !== void 0);
+      project = held === void 0 ? void 0 : isObject2(held) ? held : null;
+    }
   }
+  return [
+    { label: "~/.claude.json (this project)", servers: serversOf(project) },
+    { label: ".mcp.json", servers: serversOf(readJson((0, import_node_path2.join)(cwd, ".mcp.json"))) },
+    { label: "~/.claude.json", servers: serversOf(claude) }
+  ];
 }
-function refreshWhenDue(agent, cwd) {
-  try {
-    if (refreshDue(agent)) spawnRefresh(agent, cwd);
-  } catch {
-  }
+function unnameable(entry) {
+  if (!isObject2(entry) || entry.type !== void 0 && entry.type !== "stdio") return false;
+  const args = entry.args === void 0 ? [] : entry.args;
+  return typeof entry.command === "string" && entry.command !== "" && isStrings(args) && registryRunner(entry.command, args);
 }
-function decideCall(adapter, event, stdinText) {
-  const parsed = adapter.parse(event, stdinText);
-  if (parsed.kind === "unreadable") return adapter.deny(event, UNREADABLE_VERDICT);
-  if (parsed.kind === "other") return adapter.allow(event);
-  const agent = adapter.name;
-  const session = parsed.sessionId !== void 0 && parsed.sessionId !== "" ? readSession(agent, parsed.sessionId) : null;
-  const cwd = session?.cwd ?? (parsed.cwd !== void 0 && parsed.cwd !== "" ? parsed.cwd : void 0);
-  refreshWhenDue(agent, cwd);
-  const resolution = session !== null ? readResolutionOf(agent, session.folder) : cwd !== void 0 ? readResolution(agent, cwd) : null;
-  const same2 = adapter.matches ?? ((a, b) => a === b);
-  const held = parsed.plugin ? [] : (resolution?.servers ?? []).filter((r) => same2(parsed.key, r.key));
-  const resolved = held.length === 1 ? held[0] : null;
-  const cached = readPolicy(agent);
-  const verdict = decide(cached?.policy ?? null, cached?.ageMs ?? 0, resolved, parsed.shown ?? parsed.key);
-  const tool = resolved && { source: resolved.source, name: resolved.name, version: resolved.version };
-  if (!verdict.allow) {
-    if (tool) record(adapter, "blocked", verdict.rule, tool);
-    return adapter.deny(event, verdict);
+function resolveConfiguration(home2, cwd, secret, scopes5 = claudeCodeScopes(home2, cwd)) {
+  const notes = [];
+  const entries = /* @__PURE__ */ new Map();
+  let complete = true;
+  for (const scope of scopes5) {
+    if (scope.servers === null) {
+      notes.push(`${scope.label} could not be read: its servers, and those of every scope below it, are not checked`);
+      complete = false;
+      break;
+    }
+    for (const [key, entry] of Object.entries(scope.servers ?? {})) if (!entries.has(key)) entries.set(key, entry);
   }
-  if (verdict.warn && tool) record(adapter, "warned", verdict.warn.rule, tool);
-  return adapter.allow(event);
+  const resolved = [];
+  for (const [key, entry] of entries) {
+    const shown = reducedKey(key) || "(empty)";
+    if (key.includes("__") || reducedKey(key) === "") {
+      notes.push(`the server "${shown}" is not checked: its key cannot name one server`);
+      continue;
+    }
+    const r = isObject2(entry) ? resolve(key, entry, home2, secret) : null;
+    if (r === null && unnameable(entry)) notes.push(`the server is not checked: its package could not be named: ${shown}`);
+    else if (r === null) notes.push(`the server "${shown}" is not checked: neither a command nor an address`);
+    else if (!reportable(r)) notes.push(`the server "${shown}" is not checked: its name is not one the device API takes`);
+    else resolved.push(r);
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const r of resolved) counts.set(reducedKey(r.key), (counts.get(reducedKey(r.key)) ?? 0) + 1);
+  const unique = resolved.filter((r) => {
+    if (counts.get(reducedKey(r.key)) === 1) return true;
+    notes.push(`the server "${reducedKey(r.key)}" is not checked: two keys reduce to the same string`);
+    return false;
+  });
+  unique.sort((a, b) => byKey(reducedKey(a.key), reducedKey(b.key)));
+  if (unique.length > SERVERS_AT_MOST) {
+    notes.push(`${unique.length} servers: the first ${SERVERS_AT_MOST} by key are checked, the rest are not`);
+  }
+  return { resolved: unique.slice(0, SERVERS_AT_MOST), notes, complete };
 }
 
-// src/denies.ts
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
-function isObject2(value) {
+// src/adapters/antigravity.ts
+var MCP_TOOL = "call_mcp_tool";
+var TIMEOUT_S = 10;
+var COPY = (0, import_node_path3.join)(".attestari", "hook.js");
+var GROUP = "attestari";
+function isObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function denyOf(r) {
-  const launch = r.launch;
-  if (!isObject2(launch)) return null;
-  const command = launch.command;
-  if (Array.isArray(command) && command.length > 0 && command.every((c) => typeof c === "string")) return { serverCommand: command };
-  if (typeof launch.url === "string" && launch.url !== "") return { serverUrl: launch.url };
-  return null;
+function isStrings2(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
-function blockedForms(resolved, policy) {
-  const forms = resolved.filter((r) => entryFor(policy, r)?.decision === "block").map(denyOf).filter((e) => e !== null);
-  return [...new Set(forms.map((e) => JSON.stringify(e)))];
+function parse(_event, stdinText) {
+  let input;
+  try {
+    input = JSON.parse(stdinText);
+  } catch {
+    return { kind: "unreadable" };
+  }
+  if (!isObject3(input)) return { kind: "unreadable" };
+  const call = input.toolCall;
+  if (!isObject3(call) || typeof call.name !== "string") return { kind: "unreadable" };
+  if (call.name !== MCP_TOOL) return { kind: "other" };
+  const args = isObject3(call.args) ? call.args : null;
+  const key = args?.ServerName;
+  if (typeof key !== "string" || key === "") return { kind: "unreadable" };
+  const roots = isStrings2(input.workspacePaths) ? input.workspacePaths : [];
+  return {
+    kind: "mcp",
+    key,
+    plugin: false,
+    sessionId: typeof input.conversationId === "string" ? input.conversationId : void 0,
+    cwd: roots.length > 0 && roots[0] !== "" ? roots[0] : void 0
+  };
 }
-function indentOf(text) {
-  const first = /\n([ \t]+)\S/.exec(text);
-  if (first === null) return 2;
-  return first[1].startsWith("	") ? "	" : Math.min(first[1].length, 8);
+function deny2(_event, verdict) {
+  return { stdout: `${JSON.stringify({ decision: "deny", reason: verdict.reason })}
+`, exitCode: 0 };
 }
-function bytesOf(file) {
-  try {
-    return (0, import_node_fs3.readFileSync)(file);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
+var allow = () => ({ stdout: `${JSON.stringify({ decision: "allow" })}
+`, exitCode: 0 });
+function antigravityEntry(entry) {
+  if (!isObject3(entry)) return entry;
+  if (entry.disabled === true) return void 0;
+  if (typeof entry.serverUrl !== "string") return entry;
+  const { command: _c, args: _a, serverUrl, type: _t, ...rest } = entry;
+  return { ...rest, type: "http", url: serverUrl };
+}
+function serversOf2(holder) {
+  if (holder === null) return null;
+  if (holder === void 0 || holder.mcpServers === void 0) return void 0;
+  if (!isObject3(holder.mcpServers)) return null;
+  const kept = Object.entries(holder.mcpServers).map(([key, entry]) => [key, antigravityEntry(entry)]).filter(([, entry]) => entry !== void 0);
+  return Object.fromEntries(kept);
+}
+function scopes(home2, cwd) {
+  return [
+    { label: ".agents/mcp_config.json", servers: serversOf2(readJson((0, import_node_path3.join)(cwd, ".agents", "mcp_config.json"))) },
+    { label: "~/.gemini/config/mcp_config.json", servers: serversOf2(readJson((0, import_node_path3.join)(home2, ".gemini", "config", "mcp_config.json"))) }
+  ];
+}
+function quoted(path) {
+  return /[\s"]/.test(path) ? `"${path.replace(/"/g, '\\"')}"` : path;
+}
+function hookCommands(hook2) {
+  return {
+    preToolUse: `node ${quoted(hook2)} antigravity pre-tool-use`,
+    sessionStart: `node ${quoted(hook2)} antigravity session-start`
+  };
+}
+function install(home2, hookFile = __filename) {
+  const copy = (0, import_node_path3.join)(home2, COPY);
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.join)(home2, ".attestari"), { recursive: true });
+  (0, import_node_fs3.copyFileSync)(hookFile, copy);
+  const commands = hookCommands(copy);
+  const file = (0, import_node_path3.join)(home2, ".gemini", "config", "hooks.json");
+  const read = bytesOf(file);
+  const text = read === null ? null : read.toString("utf8");
+  let groups = {};
+  if (text !== null) {
+    try {
+      groups = JSON.parse(text.replace(/^\ufeff/, ""));
+    } catch {
+      throw new Error(`${file} could not be read as Antigravity's hooks file; the hook was not installed`);
+    }
+  }
+  if (!isObject3(groups)) throw new Error(`${file} is not Antigravity's hooks file; the hook was not installed`);
+  const next = {
+    ...groups,
+    [GROUP]: {
+      PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: commands.preToolUse, timeout: TIMEOUT_S }] }],
+      SessionStart: [{ hooks: [{ type: "command", command: commands.sessionStart, timeout: TIMEOUT_S }] }]
+    }
+  };
+  const after = formatLike(text, next);
+  if (text !== after) {
+    (0, import_node_fs3.mkdirSync)((0, import_node_path3.join)(home2, ".gemini", "config"), { recursive: true });
+    if (!writeBeside(file, after, modeOf(file, text), read)) throw new Error(`${file} changed while the hook was installed; run the install again`);
   }
+  return { path: file, before: text, after };
 }
-function same(a, b) {
-  return a === null || b === null ? a === b : a.equals(b);
+var antigravity = {
+  name: "antigravity",
+  client: "Antigravity CLI",
+  events: ["PreToolUse", "SessionStart"],
+  parse,
+  deny: deny2,
+  allow,
+  scopes,
+  // Antigravity's own deny form is `permissions.deny` (`mcp(<server>/*)`) in ~/.gemini/antigravity-cli/settings.json:
+  // not written; the hook decides, and that file holds the CLI's other state.
+  install
+};
+
+// src/adapters/claude-code.ts
+var import_node_path7 = require("node:path");
+
+// src/call.ts
+var import_node_crypto3 = require("node:crypto");
+
+// src/cache.ts
+var import_node_crypto2 = require("node:crypto");
+var import_node_fs4 = require("node:fs");
+var import_node_path5 = require("node:path");
+
+// src/paths.ts
+var import_node_os = require("node:os");
+var import_node_path4 = require("node:path");
+function home() {
+  return process.env.HOME || process.env.USERPROFILE || (0, import_node_os.homedir)();
 }
-var beforeRename = null;
-function writeBeside(file, data, mode, read) {
-  const temporary = `${file}.${process.pid}.attestari.tmp`;
+function attestariDir() {
+  return (0, import_node_path4.join)(home(), ".attestari");
+}
+function agentDir(agent) {
+  return (0, import_node_path4.join)(attestariDir(), agent);
+}
+
+// src/validate.ts
+function isObject4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isString(value) {
+  return typeof value === "string";
+}
+function isEntry(value) {
+  return isObject4(value) && isString(value.key) && isString(value.source) && isString(value.name) && (value.version === null || isString(value.version)) && (value.decision === "allow" || value.decision === "block" || value.decision === "warn") && isString(value.rule) && (value.grade === null || isString(value.grade));
+}
+function isCompiled(value) {
+  if (!isObject4(value) || value.format !== 1) return false;
+  const policy = value.policy;
+  if (!isObject4(policy) || typeof policy.version !== "number" || !isString(policy.minimum_grade) || typeof policy.block_not_examined !== "boolean" || typeof policy.block_not_gradeable !== "boolean") {
+    return false;
+  }
+  const unlisted = value.unlisted;
+  if (!isObject4(unlisted) || unlisted.decision !== "block" || unlisted.rule !== "not_checked") return false;
+  return isString(value.etag) && value.etag !== "" && isString(value.compiled_at) && Array.isArray(value.not_enforced) && value.not_enforced.every(isString) && Array.isArray(value.servers) && value.servers.every(isEntry);
+}
+
+// src/cache.ts
+var MAX_EVENTS = 1e3;
+function cacheDir(agent) {
+  return agentDir(agent);
+}
+function ensureDir(agent) {
+  const dir = cacheDir(agent);
+  (0, import_node_fs4.mkdirSync)(dir, { recursive: true, mode: 448 });
+  return dir;
+}
+function writeAtomic(file, data, mode) {
+  const temporary = `${file}.${process.pid}.tmp`;
   try {
-    (0, import_node_fs3.writeFileSync)(temporary, data, mode === void 0 ? {} : { mode });
-    if (mode !== void 0) {
-      try {
-        (0, import_node_fs3.chmodSync)(temporary, mode);
-      } catch {
-      }
-    }
-    beforeRename?.();
-    if (!same(bytesOf(file), read)) {
-      (0, import_node_fs3.unlinkSync)(temporary);
-      return false;
+    (0, import_node_fs4.writeFileSync)(temporary, data, { mode });
+    try {
+      (0, import_node_fs4.chmodSync)(temporary, mode);
+    } catch {
     }
-    (0, import_node_fs3.renameSync)(temporary, file);
-    return true;
+    (0, import_node_fs4.renameSync)(temporary, file);
   } catch (error) {
     try {
-      (0, import_node_fs3.unlinkSync)(temporary);
+      (0, import_node_fs4.unlinkSync)(temporary);
     } catch {
     }
     throw error;
   }
 }
-function formatLike(text, value) {
-  const bom = text !== null && text.startsWith("\uFEFF");
-  const crlf = text !== null && text.includes("\r\n");
-  const newline = text === null || /\n$/.test(text);
-  let out = JSON.stringify(value, null, text === null ? 2 : indentOf(text)) + (newline ? "\n" : "");
-  if (crlf) out = out.replace(/\n/g, "\r\n");
-  if (bom) out = `\uFEFF${out}`;
-  return out;
-}
-function modeOf(file, text) {
+function readText(file) {
   try {
-    return text === null ? void 0 : (0, import_node_fs3.statSync)(file).mode & 511;
+    return (0, import_node_fs4.readFileSync)(file, "utf8");
   } catch {
-    return void 0;
+    return null;
   }
 }
-function say2(line) {
-  process.stderr.write(`attestari-hook: ${line}
-`);
-}
-function writeDenies(agent, settingsPath, resolved, policy, written, takeBack = true, elsewhere = /* @__PURE__ */ new Set()) {
-  void agent;
-  const wanted = blockedForms(resolved, policy);
-  let read;
+function readPolicy(agent) {
+  const file = (0, import_node_path5.join)(cacheDir(agent), "policy.json");
+  const text = readText(file);
+  if (text === null) return null;
+  let document;
   try {
-    read = bytesOf(settingsPath);
+    document = JSON.parse(text);
   } catch {
-    say2(`${settingsPath} could not be read; its deny entries are left as they were`);
-    return written;
-  }
-  const text = read === null ? null : read.toString("utf8");
-  if (text === null) {
-    if (wanted.length === 0) return [];
-    if (!(0, import_node_fs3.existsSync)((0, import_node_path3.dirname)(settingsPath))) {
-      say2(`${(0, import_node_path3.dirname)(settingsPath)} does not exist; no deny entry is written`);
-      return written;
-    }
+    return null;
   }
-  const bom = text !== null && text.startsWith("\uFEFF");
-  let settings;
+  if (!isCompiled(document)) return null;
+  let modified;
   try {
-    settings = text === null ? {} : JSON.parse(bom ? text.slice(1) : text);
+    modified = (0, import_node_fs4.statSync)(file).mtimeMs;
   } catch {
-    settings = void 0;
-  }
-  if (!isObject2(settings) || settings.deniedMcpServers !== void 0 && !Array.isArray(settings.deniedMcpServers)) {
-    say2(`${settingsPath} is not a settings file the hook can read; its deny entries are left as they were`);
-    return written;
+    return null;
   }
-  const existing = settings.deniedMcpServers ?? [];
-  const mine = new Set(written);
-  const want = new Set(wanted);
-  const applies = (form) => want.has(form) || elsewhere.has(form);
-  const kept = existing.filter((e) => {
-    const form = JSON.stringify(e);
-    return !(takeBack && mine.has(form) && !applies(form));
-  });
-  const present = new Set(kept.map((e) => JSON.stringify(e)));
-  const added = wanted.filter((form) => !present.has(form));
-  const now = takeBack ? [...wanted.filter((form) => mine.has(form) || added.includes(form)), ...written.filter((form) => !want.has(form) && elsewhere.has(form))] : [...written, ...added.filter((form) => !mine.has(form))];
-  if (added.length === 0 && kept.length === existing.length) return now;
-  const next = { ...settings, deniedMcpServers: [...kept, ...added.map((form) => JSON.parse(form))] };
-  const crlf = text !== null && text.includes("\r\n");
-  const newline = text === null || /\n$/.test(text);
-  let out = JSON.stringify(next, null, text === null ? 2 : indentOf(text)) + (newline ? "\n" : "");
-  if (crlf) out = out.replace(/\n/g, "\r\n");
-  if (bom) out = `\uFEFF${out}`;
-  let mode;
-  try {
-    mode = text === null ? void 0 : (0, import_node_fs3.statSync)(settingsPath).mode & 511;
-  } catch {
-    mode = void 0;
-  }
-  if (!writeBeside(settingsPath, out, mode, read)) {
-    say2(`${settingsPath} changed while the hook wrote its deny entries; they are left as they were until the next check-in`);
-    return written;
-  }
-  return now;
+  return { policy: document, ageMs: Math.max(0, Date.now() - modified) };
 }
-function writeDenyList(file, get, put, wanted, written, takeBack = true, elsewhere = /* @__PURE__ */ new Set()) {
-  let read;
-  try {
-    read = bytesOf(file);
-  } catch {
-    say2(`${file} could not be read; its deny entries are left as they were`);
-    return written;
-  }
-  const text = read === null ? null : read.toString("utf8");
-  if (text === null) {
-    if (wanted.length === 0) return [];
-    if (!(0, import_node_fs3.existsSync)((0, import_node_path3.dirname)(file))) {
-      say2(`${(0, import_node_path3.dirname)(file)} does not exist; no deny entry is written`);
-      return written;
-    }
-  }
-  const bom = text !== null && text.startsWith("\uFEFF");
-  let settings;
-  try {
-    settings = text === null ? {} : JSON.parse(bom ? text.slice(1) : text);
-  } catch {
-    settings = void 0;
-  }
-  const existing = isObject2(settings) ? get(settings) : null;
-  if (!isObject2(settings) || existing === null) {
-    say2(`${file} is not a settings file the hook can read; its deny entries are left as they were`);
-    return written;
-  }
-  const current = existing ?? [];
-  const mine = new Set(written);
-  const want = new Set(wanted);
-  const applies = (form) => want.has(form) || elsewhere.has(form);
-  const kept = current.filter((e) => {
-    const form = JSON.stringify(e);
-    return !(takeBack && mine.has(form) && !applies(form));
-  });
-  const present = new Set(kept.map((e) => JSON.stringify(e)));
-  const added = wanted.filter((form) => !present.has(form));
-  const now = takeBack ? [...wanted.filter((form) => mine.has(form) || added.includes(form)), ...written.filter((form) => !want.has(form) && elsewhere.has(form))] : [...written, ...added.filter((form) => !mine.has(form))];
-  if (added.length === 0 && kept.length === current.length) return now;
-  const next = put(settings, [...kept, ...added.map((form) => JSON.parse(form))]);
-  const out = formatLike(text, next);
-  if (!writeBeside(file, bom ? `\uFEFF${out}` : out, modeOf(file, text), read)) {
-    say2(`${file} changed while the hook wrote its deny entries; they are left as they were until the next check-in`);
-    return written;
-  }
-  return now;
+function isResolved(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const r = value;
+  return typeof r.key === "string" && typeof r.source === "string" && typeof r.name === "string" && (r.version === null || typeof r.version === "string") && typeof r.local === "string";
 }
-
-// src/plugin.ts
-var import_node_child_process2 = require("node:child_process");
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
-var DEFAULT_MARKETPLACE = "https://attestari.ai/plugins/marketplace.json";
-var PLUGIN = "attestari@attestari";
-var TIMEOUT_MS = 6e4;
-var WINDOWS_EXTENSIONS = [".com", ".exe", ".bat", ".cmd"];
-var CMD_UNSAFE = /["%^&|<>!\r\n]/;
-function marketplace() {
-  return process.env.ATTESTARI_MARKETPLACE || DEFAULT_MARKETPLACE;
+function writePolicy(agent, policy, etag) {
+  const dir = ensureDir(agent);
+  writeAtomic((0, import_node_path5.join)(dir, "policy.json"), `${JSON.stringify(policy, null, 2)}
+`, 384);
+  writeAtomic((0, import_node_path5.join)(dir, "policy.etag"), etag, 384);
 }
-function steps(market) {
-  return [
-    ["plugin", "marketplace", "add", market],
-    ["plugin", "install", PLUGIN, "--scope", "user"]
-  ];
+function readEtag(agent) {
+  const etag = readText((0, import_node_path5.join)(cacheDir(agent), "policy.etag"))?.trim();
+  return etag ? etag : null;
 }
-function runnable(file, windows) {
-  try {
-    if (!(0, import_node_fs4.statSync)(file).isFile()) return false;
-    if (!windows) (0, import_node_fs4.accessSync)(file, import_node_fs4.constants.X_OK);
-    return true;
-  } catch {
-    return false;
+function readToken(agent) {
+  const text = readText((0, import_node_path5.join)(cacheDir(agent), "token"));
+  const token = text?.trim();
+  return token ? token : null;
+}
+function writeToken(agent, token) {
+  writeAtomic((0, import_node_path5.join)(ensureDir(agent), "token"), token, 384);
+}
+function appendEvent(agent, event) {
+  const file = (0, import_node_path5.join)(ensureDir(agent), "events.jsonl");
+  (0, import_node_fs4.appendFileSync)(file, `${JSON.stringify(event)}
+`, { mode: 384 });
+  const lines = (readText(file) ?? "").split("\n").filter((line) => line !== "");
+  if (lines.length > MAX_EVENTS) {
+    writeAtomic(file, `${lines.slice(-MAX_EVENTS).join("\n")}
+`, 384);
   }
 }
-function findOnPath(name, path = process.env.PATH ?? "", windows = process.platform === "win32") {
-  const named2 = (process.env.PATHEXT ?? "").split(";").map((e) => e.trim().toLowerCase()).filter((e) => WINDOWS_EXTENSIONS.includes(e));
-  const extensions = named2.length > 0 ? named2 : WINDOWS_EXTENSIONS;
-  for (const folder of path.split(import_node_path4.delimiter)) {
-    if (folder.trim() === "") continue;
-    const candidates = windows ? extensions.map((e) => (0, import_node_path4.join)(folder, `${name}${e}`)) : [(0, import_node_path4.join)(folder, name)];
-    for (const candidate of candidates) if (runnable(candidate, windows)) return candidate;
+function readEvents(agent) {
+  const events = [];
+  for (const line of (readText((0, import_node_path5.join)(cacheDir(agent), "events.jsonl")) ?? "").split("\n")) {
+    if (line === "") continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
   }
-  return null;
+  return events;
 }
-function run(file, args) {
-  const options = { timeout: TIMEOUT_MS, stdio: "pipe", windowsHide: true };
-  let result;
-  if (process.platform === "win32" && /\.(cmd|bat)$/i.test(file)) {
-    const all = [file, ...args];
-    if (all.some((a) => CMD_UNSAFE.test(a))) return "a character cmd.exe would read";
-    const line = all.map((a) => `"${a}"`).join(" ");
-    result = (0, import_node_child_process2.spawnSync)(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${line}"`], { ...options, windowsVerbatimArguments: true });
-  } else {
-    result = (0, import_node_child_process2.spawnSync)(file, args, options);
+function removeEvents(agent, ids) {
+  const file = (0, import_node_path5.join)(cacheDir(agent), "events.jsonl");
+  const text = readText(file);
+  if (text === null) return;
+  const sent2 = new Set(ids);
+  const keep = readEvents(agent).filter((event) => !sent2.has(event.id));
+  if (keep.length === 0) {
+    try {
+      (0, import_node_fs4.unlinkSync)(file);
+    } catch {
+    }
+    return;
   }
-  const code = result.error?.code;
-  if (code === "ETIMEDOUT") return "timed out";
-  if (result.error) return code ?? "did not run";
-  if (result.status === 0) return null;
-  return result.status !== null ? `exit ${result.status}` : result.signal ?? "did not run";
+  writeAtomic(file, `${keep.map((event) => JSON.stringify(event)).join("\n")}
+`, 384);
 }
-function installPlugin() {
-  const claude = findOnPath("claude");
-  if (claude === null) return { installed: false, why: "Claude Code (claude) is not on the PATH" };
-  for (const args of steps(marketplace())) {
-    const failed2 = run(claude, args);
-    if (failed2 !== null) return { installed: false, why: `\`claude ${args.slice(0, args[1] === "marketplace" ? 3 : 2).join(" ")}\` failed (${failed2})` };
+function folderId(cwd) {
+  return (0, import_node_crypto2.createHash)("sha256").update(cwd, "utf8").digest("hex").slice(0, 16);
+}
+var FOLDER_FILE = /^([0-9a-f]{16})\.json$/;
+function parseResolution(id, text, modifiedMs) {
+  if (text === null) return null;
+  let document;
+  try {
+    document = JSON.parse(text);
+  } catch {
+    return null;
   }
-  return { installed: true };
+  if (typeof document !== "object" || document === null || Array.isArray(document)) return null;
+  const { complete, servers, cwd } = document;
+  if (typeof complete !== "boolean" || !Array.isArray(servers) || !servers.every(isResolved)) return null;
+  const path = typeof cwd === "string" && cwd !== "" && folderId(cwd) === id ? { cwd } : {};
+  const when = modifiedMs === void 0 ? {} : { modifiedMs };
+  return { id, complete, servers: servers.map((r) => ({ ...r, folder: id.slice(0, 8) })), ...path, ...when };
 }
-function installCommands() {
-  const market = marketplace().replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
-  const shown = /\s/.test(market) ? `"${market}"` : market;
-  return steps(shown).map((args) => `  claude ${args.join(" ")}
-`).join("");
+function readResolution(agent, cwd) {
+  return readResolutionOf(agent, folderId(cwd));
 }
-
-// src/resolve.ts
-var import_node_crypto3 = require("node:crypto");
-var import_node_fs5 = require("node:fs");
-var import_node_path5 = require("node:path");
-var SERVERS_AT_MOST = 200;
-var NPM_NAME = /^(?:@[A-Za-z0-9~-][A-Za-z0-9._~-]*\/)?[A-Za-z0-9~-][A-Za-z0-9._~-]*$/;
-var PYPI_NAME = /^(?:[A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9._-]*[A-Za-z0-9])$/;
-var CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
-var SOURCES = /* @__PURE__ */ new Set(["npm", "pypi", "local", "remote"]);
-var NPM_EXACT = /^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/;
-var PYPI_EXACT = /^[0-9][0-9A-Za-z.+!-]*$/;
-function isStrings(value) {
-  return Array.isArray(value) && value.every((v) => typeof v === "string");
+function readResolutionOf(agent, id) {
+  if (!/^[0-9a-f]{16}$/.test(id)) return null;
+  return parseResolution(id, readText((0, import_node_path5.join)(cacheDir(agent), "resolved", `${id}.json`)));
 }
-function runner(command) {
-  const file = command.split(/[\\/]/).pop() ?? command;
-  return file.toLowerCase().replace(/\.(cmd|exe|bat|ps1)$/, "");
+function sessionFile(agent, sessionId) {
+  const name = /^[A-Za-z0-9_-]{1,128}$/.test(sessionId) ? sessionId : (0, import_node_crypto2.createHash)("sha256").update(sessionId, "utf8").digest("hex");
+  return (0, import_node_path5.join)(cacheDir(agent), "sessions", name);
 }
-var NPM_WANTED = /^[0-9A-Za-z.^~<>=|*+ -]*$/;
-function npmSpec(spec) {
-  const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
-  const name = at > 0 ? spec.slice(0, at) : spec;
-  const wanted = at > 0 ? spec.slice(at + 1) : "";
-  if (!NPM_NAME.test(name) || name.length > 214 || !NPM_WANTED.test(wanted)) return null;
-  const exact = NPM_EXACT.exec(wanted);
-  return { source: "npm", name, version: exact ? exact[1] : null };
+function writeSession(agent, sessionId, cwd) {
+  (0, import_node_fs4.mkdirSync)((0, import_node_path5.join)(ensureDir(agent), "sessions"), { recursive: true, mode: 448 });
+  writeAtomic(sessionFile(agent, sessionId), `${JSON.stringify({ folder: folderId(cwd), cwd })}
+`, 384);
 }
-var RUNNER_NO_VALUE = /* @__PURE__ */ new Set(["-y", "--yes", "-q", "--quiet"]);
-function npmRunner(args) {
-  const packages = [];
-  let i = 0;
-  for (; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--") {
-      i++;
-      break;
-    }
-    if (a === "-p" || a === "--package") {
-      if (i + 1 >= args.length) return null;
-      packages.push(args[++i]);
-      continue;
-    }
-    if (a.startsWith("--package=")) {
-      packages.push(a.slice("--package=".length));
-      continue;
-    }
-    if (RUNNER_NO_VALUE.has(a)) continue;
-    if (a.startsWith("-")) return null;
-    break;
+function readSession(agent, sessionId) {
+  const text = readText(sessionFile(agent, sessionId));
+  if (text === null) return null;
+  try {
+    const value = JSON.parse(text);
+    if (typeof value !== "object" || value === null) return null;
+    const { folder, cwd } = value;
+    return typeof folder === "string" && typeof cwd === "string" && cwd !== "" && folderId(cwd) === folder ? { folder, cwd } : null;
+  } catch {
+    return null;
   }
-  if (packages.length > 1) return null;
-  const spec = packages[0] ?? args[i];
-  return spec === void 0 ? null : npmSpec(spec);
-}
-function pypiSpec(spec) {
-  const match = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?(.*)$/.exec(spec.trim());
-  if (match === null || !PYPI_NAME.test(match[1]) || match[1].length > 214) return null;
-  const rest = match[2].trim();
-  if (/[:/]/.test(rest)) return null;
-  const exact = /^(?:==|@)\s*([^\s,;<>=!~*@]+)$/.exec(rest);
-  if (rest !== "" && exact === null && !/^[<>=!~]/.test(rest)) return null;
-  return { source: "pypi", name: match[1], version: exact && PYPI_EXACT.test(exact[1]) ? exact[1] : null };
 }
-function pypiRunner(args, from) {
-  let chosen = null;
-  let i = 0;
-  for (; i < args.length; i++) {
-    const a = args[i];
-    if (a === from || a.startsWith(`${from}=`)) {
-      const value = a === from ? args[++i] : a.slice(from.length + 1);
-      if (value === void 0 || chosen !== null) return null;
-      chosen = value;
-      continue;
+function pruneSessions(agent, maxAgeMs, now = Date.now()) {
+  const dir = (0, import_node_path5.join)(cacheDir(agent), "sessions");
+  let names;
+  try {
+    names = (0, import_node_fs4.readdirSync)(dir);
+  } catch {
+    return 0;
+  }
+  let removed = 0;
+  for (const name of names) {
+    try {
+      const file = (0, import_node_path5.join)(dir, name);
+      if (now - (0, import_node_fs4.statSync)(file).mtimeMs > maxAgeMs) {
+        (0, import_node_fs4.unlinkSync)(file);
+        removed += 1;
+      }
+    } catch {
     }
-    if (RUNNER_NO_VALUE.has(a)) continue;
-    if (from === "--from" && (a === "--python" || a === "-p")) {
-      if (i + 1 >= args.length) return null;
-      i++;
-      continue;
+  }
+  return removed;
+}
+function readResolutions(agent) {
+  let names;
+  try {
+    names = (0, import_node_fs4.readdirSync)((0, import_node_path5.join)(cacheDir(agent), "resolved")).sort();
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names) {
+    const id = FOLDER_FILE.exec(name)?.[1];
+    if (id === void 0) continue;
+    const file = (0, import_node_path5.join)(cacheDir(agent), "resolved", name);
+    let modifiedMs;
+    try {
+      modifiedMs = (0, import_node_fs4.statSync)(file).mtimeMs;
+    } catch {
+      modifiedMs = void 0;
     }
-    if (from === "--from" && a.startsWith("--python=")) continue;
-    if (a.startsWith("-")) return null;
-    break;
+    const resolution = parseResolution(id, readText(file), modifiedMs);
+    if (resolution !== null) out.push(resolution);
   }
-  const spec = chosen ?? args[i];
-  return spec === void 0 ? null : pypiSpec(spec);
+  return out;
 }
-function unwrapped(command, args) {
-  if (runner(command) === "cmd" && args.length >= 2 && /^\/[ck]$/i.test(args[0])) return unwrapped(args[1], args.slice(2));
-  return [command, args];
+function writeResolution(agent, cwd, servers, complete) {
+  const dir = (0, import_node_path5.join)(ensureDir(agent), "resolved");
+  const file = (0, import_node_path5.join)(dir, `${folderId(cwd)}.json`);
+  try {
+    (0, import_node_fs4.mkdirSync)(dir, { recursive: true, mode: 448 });
+    const kept = servers.map(({ folder: _folder, ...r }) => r);
+    writeAtomic(file, `${JSON.stringify({ complete, cwd, servers: kept }, null, 2)}
+`, 384);
+  } catch (error) {
+    try {
+      (0, import_node_fs4.rmSync)(file, { force: true });
+    } catch {
+    }
+    throw error;
+  }
 }
-function registryRunner(configuredCommand, configuredArgs) {
-  const [command, args] = unwrapped(configuredCommand, configuredArgs);
-  const run3 = runner(command);
-  if (run3 === "npx" || run3 === "bunx" || run3 === "pnpx" || run3 === "uvx") return true;
-  if ((run3 === "pnpm" || run3 === "yarn") && args[0] === "dlx") return true;
-  return run3 === "pipx" && args[0] === "run";
+function readWritten(agent, id) {
+  const text = readText((0, import_node_path5.join)(cacheDir(agent), "written", `${id}.json`));
+  if (text === null) return [];
+  try {
+    const value = JSON.parse(text);
+    return Array.isArray(value) && value.every((v) => typeof v === "string") ? value : [];
+  } catch {
+    return [];
+  }
 }
-function packageOf(configuredCommand, configuredArgs) {
-  const [command, args] = unwrapped(configuredCommand, configuredArgs);
-  const run3 = runner(command);
-  if (run3 === "npx" || run3 === "bunx" || run3 === "pnpx") return npmRunner(args);
-  if ((run3 === "pnpm" || run3 === "yarn") && args[0] === "dlx") return npmRunner(args.slice(1));
-  if (run3 === "uvx") return pypiRunner(args, "--from");
-  if (run3 === "pipx" && args[0] === "run") return pypiRunner(args.slice(1), "--spec");
-  return null;
+function dropResolution(agent, id) {
+  if (!/^[0-9a-f]{16}$/.test(id)) return;
+  (0, import_node_fs4.rmSync)((0, import_node_path5.join)(cacheDir(agent), "resolved", `${id}.json`), { force: true });
+  (0, import_node_fs4.rmSync)((0, import_node_path5.join)(cacheDir(agent), "written", `${id}.json`), { force: true });
 }
-function secretLike(segment) {
-  return /[%@=+]/.test(segment) || segment.length >= 16 && /[0-9]/.test(segment) && /[A-Za-z]/.test(segment);
+function writeWritten(agent, id, written) {
+  const dir = (0, import_node_path5.join)(ensureDir(agent), "written");
+  (0, import_node_fs4.mkdirSync)(dir, { recursive: true, mode: 448 });
+  writeAtomic((0, import_node_path5.join)(dir, `${id}.json`), `${JSON.stringify(written, null, 2)}
+`, 384);
 }
-function remoteName(address) {
-  let url2;
+function deleteToken(agent) {
   try {
-    url2 = new URL(address.trim());
+    (0, import_node_fs4.unlinkSync)((0, import_node_path5.join)(cacheDir(agent), "token"));
   } catch {
-    return null;
   }
-  if (!["http:", "https:", "ws:", "wss:"].includes(url2.protocol) || url2.hostname === "") return null;
-  const port = url2.port === "" ? "" : `:${url2.port}`;
-  const path = url2.pathname.replace(/\/+$/, "").split("/").map((segment) => secretLike(segment) ? "*" : segment).join("/");
-  return `${url2.hostname.toLowerCase()}${port}${path}`;
 }
-function pathLike(arg) {
-  if (arg.startsWith("-") || /^\/[A-Za-z?]$/.test(arg)) return false;
-  if (/[=?#@]/.test(arg) || arg.replace(/^[A-Za-z]:(?=[\\/])/, "").includes(":")) return false;
-  return /[\\/]/.test(arg) || arg.startsWith("~") || /\.(?:[cm]?[jt]s|py)$/i.test(arg);
+function deletePolicy(agent) {
+  for (const name of ["policy.json", "policy.etag"]) {
+    try {
+      (0, import_node_fs4.unlinkSync)((0, import_node_path5.join)(cacheDir(agent), name));
+    } catch {
+    }
+  }
 }
-var FILE_NAME = /^[A-Za-z0-9._-]{1,200}$/;
-function fileName(file) {
-  if (!FILE_NAME.test(file) || secretLike(file)) return false;
-  return !(file.length >= 16 && !file.includes(".") && /[a-z]/.test(file) && /[A-Z]/.test(file));
+function deleteStamp(agent, name) {
+  try {
+    (0, import_node_fs4.unlinkSync)((0, import_node_path5.join)(cacheDir(agent), name));
+  } catch {
+  }
 }
-function fileAndFolder(path, home2) {
-  const expanded = path === "~" || path.startsWith("~/") || path.startsWith("~\\") ? `${home2}${path.slice(1)}` : path;
-  const parts = expanded.split(/[\\/]/);
-  const file = parts.pop() ?? "";
-  return { file, folder: parts.join("/") };
+function writeStamp(agent, name, at = /* @__PURE__ */ new Date(), word) {
+  writeAtomic((0, import_node_path5.join)(ensureDir(agent), name), `${at.toISOString()}${word === void 0 ? "" : ` ${word}`}
+`, 384);
 }
-function labelOf(folder, home2) {
-  const slashed = folder.replace(/\\/g, "/");
-  const root = home2.replace(/\\/g, "/").replace(/\/+$/, "");
-  const fold = (s) => process.platform === "win32" ? s.toLowerCase() : s;
-  if (root !== "" && (fold(slashed) === fold(root) || fold(slashed).startsWith(`${fold(root)}/`))) return `~${slashed.slice(root.length)}`;
-  return slashed;
+function readStamp(agent, name) {
+  const parts = (readText((0, import_node_path5.join)(cacheDir(agent), name)) ?? "").trim().split(/\s+/);
+  const at = Date.parse(parts[0]);
+  if (parts[0] === "" || Number.isNaN(at)) return null;
+  return { at, word: parts[1] ?? null };
 }
-function localName(configuredCommand, configuredArgs, home2, secret) {
-  const [command, args] = unwrapped(configuredCommand, configuredArgs);
-  const path = args.find(pathLike);
-  const fromArg = path === void 0 ? null : fileAndFolder(path, home2);
-  const chosen = fromArg !== null && fileName(fromArg.file) ? fromArg : fileAndFolder(command, home2);
-  const file = fileName(chosen.file) ? chosen.file : "local";
-  const hash = (0, import_node_crypto3.createHmac)("sha256", secret).update(labelOf(chosen.folder, home2), "utf8").digest("hex").slice(0, 12);
-  return `${file}#${hash}`;
+function stampAge(agent, name, now = Date.now()) {
+  const stamp = readStamp(agent, name);
+  if (stamp === null || stamp.at > now) return null;
+  return now - stamp.at;
 }
-function resolve(key, entry, home2, secret) {
-  const type = entry.type;
-  const command = entry.command;
-  const remote = type === "http" || type === "sse" || type === "ws" || type === void 0 && typeof command !== "string";
-  if (remote) {
-    const url2 = entry.url;
-    if (typeof url2 !== "string") return null;
-    const name = remoteName(url2);
-    if (name === null) return null;
-    const launch2 = { url: url2 };
-    return { key, source: "remote", name, version: null, local: url2, launch: launch2 };
+var SECRET_BYTES = 32;
+function readSecret(agent) {
+  const file = (0, import_node_path5.join)(ensureDir(agent), "secret");
+  const held = () => {
+    try {
+      const bytes = (0, import_node_fs4.readFileSync)(file);
+      return bytes.length === SECRET_BYTES ? bytes : null;
+    } catch {
+      return null;
+    }
+  };
+  const existing = held();
+  if (existing !== null) return existing;
+  const fresh = (0, import_node_crypto2.randomBytes)(SECRET_BYTES);
+  const temporary = `${file}.${process.pid}.tmp`;
+  (0, import_node_fs4.writeFileSync)(temporary, fresh, { mode: 384 });
+  try {
+    try {
+      (0, import_node_fs4.chmodSync)(temporary, 384);
+    } catch {
+    }
+    try {
+      (0, import_node_fs4.linkSync)(temporary, file);
+      return fresh;
+    } catch {
+      const other = held();
+      if (other !== null) return other;
+      (0, import_node_fs4.renameSync)(temporary, file);
+      return fresh;
+    }
+  } finally {
+    try {
+      (0, import_node_fs4.unlinkSync)(temporary);
+    } catch {
+    }
   }
-  if (type !== void 0 && type !== "stdio") return null;
-  const args = entry.args === void 0 ? [] : entry.args;
-  if (typeof command !== "string" || command === "" || !isStrings(args)) return null;
-  const launch = { command: [command, ...args] };
-  const local = [command, ...args].join(" ");
-  const found = packageOf(command, args);
-  if (found !== null) return { key, ...found, local, launch };
-  if (registryRunner(command, args)) return null;
-  return { key, source: "local", name: localName(command, args, home2, secret), version: null, local, launch };
 }
-function oneLineName(value) {
-  return value.length >= 1 && value.length <= 214 && !/\s/.test(value) && !CONTROL.test(value);
+
+// src/refresh.ts
+var import_node_child_process = require("node:child_process");
+var import_node_fs5 = require("node:fs");
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var CHECKED_IN = "checked_in";
+var LOOKUP_UNAVAILABLE = "lookup_unavailable";
+var REFUSED = "refused";
+function say2(line) {
+  process.stderr.write(`attestari-hook: ${line.replace(/\s+/g, " ").trim()}
+`);
 }
-function reportable(r) {
-  if (!SOURCES.has(r.source) || !oneLineName(r.name)) return false;
-  if (r.version !== null && (r.version.length < 1 || r.version.length > 64 || /\s/.test(r.version) || CONTROL.test(r.version))) return false;
-  if (r.source === "remote" && (/[?#@]/.test(r.name) || r.name.includes("://"))) return false;
-  if (r.source === "npm" && !NPM_NAME.test(r.name)) return false;
-  if (r.source === "pypi" && !PYPI_NAME.test(r.name)) return false;
-  if (r.source === "local" && !LOCAL_NAME.test(r.name)) return false;
-  return reducedKey(r.key) !== "";
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
 }
-var LOCAL_NAME = /^[A-Za-z0-9._-]{1,200}#[0-9a-f]{12}$/;
-function byKey(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
+function attempt(what, fn) {
+  try {
+    fn();
+  } catch (error) {
+    say2(`${what}: ${message(error)}`);
+  }
 }
-function finished(servers) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const s of servers) counts.set(s.key, (counts.get(s.key) ?? 0) + 1);
-  return servers.filter((s) => counts.get(s.key) === 1).sort((a, b) => byKey(a.key, b.key)).slice(0, SERVERS_AT_MOST);
+function usableFolder(folder) {
+  try {
+    return typeof folder === "string" && folder !== "" && (0, import_node_fs5.statSync)(folder).isDirectory() ? folder : void 0;
+  } catch {
+    return void 0;
+  }
 }
-var sent = (r, key) => ({ key, source: r.source, name: r.name, version: r.version });
-function reportedAll(folders) {
-  const byReduced = /* @__PURE__ */ new Map();
-  for (const { folder, servers } of folders) {
-    for (const r of servers.filter(reportable)) {
-      const key = reducedKey(r.key);
-      byReduced.set(key, [...byReduced.get(key) ?? [], { folder, r }]);
-    }
+function spawnRefresh(agent, cwd) {
+  const at = /* @__PURE__ */ new Date();
+  attempt("refresh_started_at was not written", () => writeStamp(agent, "refresh_started_at", at));
+  const folder = usableFolder(cwd);
+  let pid;
+  try {
+    const child = (0, import_node_child_process.spawn)(process.execPath, [__filename, agent, "refresh", ...cwd !== void 0 && cwd !== "" ? ["--cwd", cwd] : []], {
+      cwd: folder,
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true
+    });
+    child.on("error", () => {
+    });
+    child.unref();
+    pid = child.pid;
+  } catch (error) {
+    say2(`the refresh could not be started: ${message(error)}`);
   }
-  const out = [];
-  for (const [key, held] of byReduced) {
-    const [first] = held;
-    const same2 = held.every(({ r }) => r.source === first.r.source && r.name === first.r.name && r.version === first.r.version);
-    if (same2) out.push(sent(first.r, key));
-    else for (const { folder, r } of held) out.push(sent(r, suffixedKey(key, folder)));
+  if (pid === void 0) {
+    attempt("refresh_started_at was not removed", () => deleteStamp(agent, "refresh_started_at"));
+    return;
   }
-  return finished(out);
+  const started = pid;
+  attempt("refresh_started_at was not written", () => writeStamp(agent, "refresh_started_at", at, started));
 }
-function isObject3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function heldBack(agent, now, onlyAfterRefusal) {
+  const next = readStamp(agent, "next_refresh_at");
+  if (next === null || next.at <= now) return false;
+  return !onlyAfterRefusal || next.word !== CHECKED_IN;
 }
-function readJson(file) {
-  let text;
+function refreshDue(agent, now = Date.now()) {
+  if (readToken(agent) === null) return false;
+  const checked = stampAge(agent, "checked_in_at", now);
+  if (checked !== null && checked < HOUR_MS) return false;
+  const started = stampAge(agent, "refresh_started_at", now);
+  if (started !== null && started < HOUR_MS) return false;
+  return !heldBack(agent, now, false);
+}
+
+// src/call.ts
+var UNREADABLE = "Attestari could not read the tool call";
+var UNREADABLE_VERDICT = { allow: false, reason: UNREADABLE, rule: "unreadable" };
+function record(adapter, decision, rule, tool) {
   try {
-    text = (0, import_node_fs5.readFileSync)(file, "utf8");
-  } catch (error) {
-    return error.code === "ENOENT" ? void 0 : null;
+    appendEvent(adapter.name, { id: (0, import_node_crypto3.randomUUID)(), at: (/* @__PURE__ */ new Date()).toISOString(), decision, rule, tool, agent_client: adapter.client });
+  } catch {
   }
+}
+function refreshWhenDue(agent, cwd) {
   try {
-    const value = JSON.parse(text.replace(/^\ufeff/, ""));
-    return isObject3(value) ? value : null;
+    if (refreshDue(agent)) spawnRefresh(agent, cwd);
   } catch {
-    return null;
   }
 }
-function serversOf(holder) {
-  if (holder === null) return null;
-  if (holder === void 0 || holder.mcpServers === void 0) return void 0;
-  return isObject3(holder.mcpServers) ? holder.mcpServers : null;
-}
-function claudeCodeScopes(home2, cwd) {
-  const claude = readJson((0, import_node_path5.join)(home2, ".claude.json"));
-  let project;
-  if (claude === null) project = null;
-  else if (claude !== void 0 && claude.projects !== void 0) {
-    const projects = claude.projects;
-    if (!isObject3(projects)) project = null;
-    else {
-      const trimmed = cwd.replace(/[\\/]+$/, "");
-      const forms = [cwd, cwd.replace(/\\/g, "/"), ...trimmed === "" ? [] : [trimmed, trimmed.replace(/\\/g, "/")]];
-      const held = forms.map((form) => projects[form]).find((value) => value !== void 0);
-      project = held === void 0 ? void 0 : isObject3(held) ? held : null;
-    }
+function decideCall(adapter, event, stdinText) {
+  const parsed = adapter.parse(event, stdinText);
+  if (parsed.kind === "unreadable") return adapter.deny(event, UNREADABLE_VERDICT);
+  if (parsed.kind === "other") return adapter.allow(event);
+  const agent = adapter.name;
+  const session = parsed.sessionId !== void 0 && parsed.sessionId !== "" ? readSession(agent, parsed.sessionId) : null;
+  const cwd = session?.cwd ?? (parsed.cwd !== void 0 && parsed.cwd !== "" ? parsed.cwd : void 0);
+  refreshWhenDue(agent, cwd);
+  const resolution = session !== null ? readResolutionOf(agent, session.folder) : cwd !== void 0 ? readResolution(agent, cwd) : null;
+  const same2 = adapter.matches ?? ((a, b) => a === b);
+  const held = parsed.plugin ? [] : (resolution?.servers ?? []).filter((r) => same2(parsed.key, r.key));
+  const resolved = held.length === 1 ? held[0] : null;
+  const cached = readPolicy(agent);
+  const verdict = decide(cached?.policy ?? null, cached?.ageMs ?? 0, resolved, parsed.shown ?? parsed.key);
+  const tool = resolved && { source: resolved.source, name: resolved.name, version: resolved.version };
+  if (!verdict.allow) {
+    if (tool) record(adapter, "blocked", verdict.rule, tool);
+    return adapter.deny(event, verdict);
   }
+  if (verdict.warn && tool) record(adapter, "warned", verdict.warn.rule, tool);
+  return adapter.allow(event);
+}
+
+// src/plugin.ts
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs6 = require("node:fs");
+var import_node_path6 = require("node:path");
+var DEFAULT_MARKETPLACE = "https://attestari.ai/plugins/marketplace.json";
+var PLUGIN = "attestari@attestari";
+var TIMEOUT_MS = 6e4;
+var WINDOWS_EXTENSIONS = [".com", ".exe", ".bat", ".cmd"];
+var CMD_UNSAFE = /["%^&|<>!\r\n]/;
+function marketplace() {
+  return process.env.ATTESTARI_MARKETPLACE || DEFAULT_MARKETPLACE;
+}
+function steps(market) {
   return [
-    { label: "~/.claude.json (this project)", servers: serversOf(project) },
-    { label: ".mcp.json", servers: serversOf(readJson((0, import_node_path5.join)(cwd, ".mcp.json"))) },
-    { label: "~/.claude.json", servers: serversOf(claude) }
+    ["plugin", "marketplace", "add", market],
+    ["plugin", "install", PLUGIN, "--scope", "user"]
   ];
 }
-function unnameable(entry) {
-  if (!isObject3(entry) || entry.type !== void 0 && entry.type !== "stdio") return false;
-  const args = entry.args === void 0 ? [] : entry.args;
-  return typeof entry.command === "string" && entry.command !== "" && isStrings(args) && registryRunner(entry.command, args);
+function runnable(file, windows) {
+  try {
+    if (!(0, import_node_fs6.statSync)(file).isFile()) return false;
+    if (!windows) (0, import_node_fs6.accessSync)(file, import_node_fs6.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
 }
-function resolveConfiguration(home2, cwd, secret, scopes4 = claudeCodeScopes(home2, cwd)) {
-  const notes = [];
-  const entries = /* @__PURE__ */ new Map();
-  let complete = true;
-  for (const scope of scopes4) {
-    if (scope.servers === null) {
-      notes.push(`${scope.label} could not be read: its servers, and those of every scope below it, are not checked`);
-      complete = false;
-      break;
-    }
-    for (const [key, entry] of Object.entries(scope.servers ?? {})) if (!entries.has(key)) entries.set(key, entry);
+function findOnPath(name, path = process.env.PATH ?? "", windows = process.platform === "win32") {
+  const named2 = (process.env.PATHEXT ?? "").split(";").map((e) => e.trim().toLowerCase()).filter((e) => WINDOWS_EXTENSIONS.includes(e));
+  const extensions = named2.length > 0 ? named2 : WINDOWS_EXTENSIONS;
+  for (const folder of path.split(import_node_path6.delimiter)) {
+    if (folder.trim() === "") continue;
+    const candidates = windows ? extensions.map((e) => (0, import_node_path6.join)(folder, `${name}${e}`)) : [(0, import_node_path6.join)(folder, name)];
+    for (const candidate of candidates) if (runnable(candidate, windows)) return candidate;
   }
-  const resolved = [];
-  for (const [key, entry] of entries) {
-    const shown = reducedKey(key) || "(empty)";
-    if (key.includes("__") || reducedKey(key) === "") {
-      notes.push(`the server "${shown}" is not checked: its key cannot name one server`);
-      continue;
-    }
-    const r = isObject3(entry) ? resolve(key, entry, home2, secret) : null;
-    if (r === null && unnameable(entry)) notes.push(`the server is not checked: its package could not be named: ${shown}`);
-    else if (r === null) notes.push(`the server "${shown}" is not checked: neither a command nor an address`);
-    else if (!reportable(r)) notes.push(`the server "${shown}" is not checked: its name is not one the device API takes`);
-    else resolved.push(r);
+  return null;
+}
+function run(file, args) {
+  const options = { timeout: TIMEOUT_MS, stdio: "pipe", windowsHide: true };
+  let result;
+  if (process.platform === "win32" && /\.(cmd|bat)$/i.test(file)) {
+    const all = [file, ...args];
+    if (all.some((a) => CMD_UNSAFE.test(a))) return "a character cmd.exe would read";
+    const line = all.map((a) => `"${a}"`).join(" ");
+    result = (0, import_node_child_process2.spawnSync)(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", `"${line}"`], { ...options, windowsVerbatimArguments: true });
+  } else {
+    result = (0, import_node_child_process2.spawnSync)(file, args, options);
   }
-  const counts = /* @__PURE__ */ new Map();
-  for (const r of resolved) counts.set(reducedKey(r.key), (counts.get(reducedKey(r.key)) ?? 0) + 1);
-  const unique = resolved.filter((r) => {
-    if (counts.get(reducedKey(r.key)) === 1) return true;
-    notes.push(`the server "${reducedKey(r.key)}" is not checked: two keys reduce to the same string`);
-    return false;
-  });
-  unique.sort((a, b) => byKey(reducedKey(a.key), reducedKey(b.key)));
-  if (unique.length > SERVERS_AT_MOST) {
-    notes.push(`${unique.length} servers: the first ${SERVERS_AT_MOST} by key are checked, the rest are not`);
+  const code = result.error?.code;
+  if (code === "ETIMEDOUT") return "timed out";
+  if (result.error) return code ?? "did not run";
+  if (result.status === 0) return null;
+  return result.status !== null ? `exit ${result.status}` : result.signal ?? "did not run";
+}
+function installPlugin() {
+  const claude = findOnPath("claude");
+  if (claude === null) return { installed: false, why: "Claude Code (claude) is not on the PATH" };
+  for (const args of steps(marketplace())) {
+    const failed2 = run(claude, args);
+    if (failed2 !== null) return { installed: false, why: `\`claude ${args.slice(0, args[1] === "marketplace" ? 3 : 2).join(" ")}\` failed (${failed2})` };
   }
-  return { resolved: unique.slice(0, SERVERS_AT_MOST), notes, complete };
+  return { installed: true };
+}
+function installCommands() {
+  const market = marketplace().replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ");
+  const shown = /\s/.test(market) ? `"${market}"` : market;
+  return steps(shown).map((args) => `  claude ${args.join(" ")}
+`).join("");
 }
 
 // src/adapters/claude-code.ts
@@ -1106,19 +1225,19 @@ function serverKeyOf(toolName) {
   if (end <= 0 || end + 2 >= rest.length) return null;
   return rest.slice(0, end);
 }
-function isObject4(value) {
+function isObject5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function parse(_event, stdinText) {
+function parse2(_event, stdinText) {
   let input;
   try {
     input = JSON.parse(stdinText);
   } catch {
     return { kind: "unreadable" };
   }
-  if (!isObject4(input) || typeof input.tool_name !== "string") return { kind: "unreadable" };
+  if (!isObject5(input) || typeof input.tool_name !== "string") return { kind: "unreadable" };
   if (typeof input.cursor_version === "string") return { kind: "other" };
-  const server = isObject4(input.mcp_server) ? input.mcp_server : null;
+  const server = isObject5(input.mcp_server) ? input.mcp_server : null;
   const parsed = serverKeyOf(input.tool_name);
   if (parsed === null) return server === null ? { kind: "other" } : { kind: "unreadable" };
   const key = typeof server?.name === "string" && server.name !== "" ? server.name : parsed;
@@ -1131,32 +1250,32 @@ function parse(_event, stdinText) {
     cwd: typeof input.cwd === "string" ? input.cwd : void 0
   };
 }
-function deny2(_event, verdict) {
+function deny3(_event, verdict) {
   const output = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: verdict.reason } };
   return { stdout: `${JSON.stringify(output)}
 `, exitCode: 0 };
 }
-var allow = () => ({ stdout: "", exitCode: 0 });
+var allow2 = () => ({ stdout: "", exitCode: 0 });
 var claudeCode = {
   name: "claude-code",
   client: "Claude Code",
   events: ["PreToolUse", "SessionStart"],
-  parse,
-  deny: deny2,
-  allow,
+  parse: parse2,
+  deny: deny3,
+  allow: allow2,
   scopes: claudeCodeScopes,
   // Claude Code's own deny form: deniedMcpServers in ~/.claude/settings.json (denies.ts).
-  writeDenies: (resolved, policy, written, takeBack, elsewhere) => writeDenies("claude-code", (0, import_node_path6.join)(home(), ".claude", "settings.json"), resolved, policy, written, takeBack, elsewhere),
+  writeDenies: (resolved, policy, written, takeBack, elsewhere) => writeDenies("claude-code", (0, import_node_path7.join)(home(), ".claude", "settings.json"), resolved, policy, written, takeBack, elsewhere),
   // Installed by plugin (D8), not by a file the hook writes.
   install: () => ({ commands: installCommands().split("\n").map((line) => line.trim()).filter((line) => line !== "") })
 };
 
 // src/adapters/codex.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = require("node:path");
 
 // src/toml.ts
-function isObject5(value) {
+function isObject6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var Fail = class extends Error {
@@ -1300,7 +1419,7 @@ function assign(table, parts, value) {
       const made = {};
       here[part] = made;
       here = made;
-    } else if (isObject5(next)) here = next;
+    } else if (isObject6(next)) here = next;
     else throw new Fail("key reused");
   }
   const last = parts[parts.length - 1];
@@ -1315,7 +1434,7 @@ function tableAt(root, parts) {
       const made = {};
       here[part] = made;
       here = made;
-    } else if (isObject5(next)) here = next;
+    } else if (isObject6(next)) here = next;
     else throw new Fail("table reused");
   }
   return here;
@@ -1368,23 +1487,23 @@ function parseToml(input) {
 
 // src/adapters/codex.ts
 var PREFIX2 = "mcp__";
-var TIMEOUT_S = 10;
-var COPY = (0, import_node_path7.join)(".attestari", "hook.js");
+var TIMEOUT_S2 = 10;
+var COPY2 = (0, import_node_path8.join)(".attestari", "hook.js");
 var STATUS = "Attestari is checking this MCP call";
-function isObject6(value) {
+function isObject7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sanitized(key) {
   return key.replace(/[^A-Za-z0-9_]/g, "_");
 }
-function parse2(_event, stdinText) {
+function parse3(_event, stdinText) {
   let input;
   try {
     input = JSON.parse(stdinText);
   } catch {
     return { kind: "unreadable" };
   }
-  if (!isObject6(input) || typeof input.tool_name !== "string") return { kind: "unreadable" };
+  if (!isObject7(input) || typeof input.tool_name !== "string") return { kind: "unreadable" };
   const name = input.tool_name;
   if (!name.startsWith(PREFIX2)) return { kind: "other" };
   const rest = name.slice(PREFIX2.length);
@@ -1402,16 +1521,16 @@ function matches2(parsedKey, configuredKey) {
   const head = `${sanitized(configuredKey)}__`;
   return parsedKey.startsWith(head) && parsedKey.length > head.length;
 }
-function deny3(_event, verdict) {
+function deny4(_event, verdict) {
   const output = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: verdict.reason } };
   return { stdout: `${JSON.stringify(output)}
 `, exitCode: 0 };
 }
-var allow2 = () => ({ stdout: "", exitCode: 0 });
+var allow3 = () => ({ stdout: "", exitCode: 0 });
 function serversOfToml(file) {
   let text;
   try {
-    text = (0, import_node_fs6.readFileSync)(file, "utf8");
+    text = (0, import_node_fs7.readFileSync)(file, "utf8");
   } catch (error) {
     return error.code === "ENOENT" ? void 0 : null;
   }
@@ -1419,26 +1538,26 @@ function serversOfToml(file) {
   if (table === null) return null;
   const servers = table.mcp_servers;
   if (servers === void 0) return void 0;
-  if (!isObject6(servers)) return null;
+  if (!isObject7(servers)) return null;
   const live = {};
-  for (const [key, entry] of Object.entries(servers)) if (!(isObject6(entry) && entry.enabled === false)) live[key] = entry;
+  for (const [key, entry] of Object.entries(servers)) if (!(isObject7(entry) && entry.enabled === false)) live[key] = entry;
   return live;
 }
-function scopes(home2, cwd) {
+function scopes2(home2, cwd) {
   return [
-    { label: "~/.codex/managed_config.toml", servers: serversOfToml((0, import_node_path7.join)(home2, ".codex", "managed_config.toml")) },
-    { label: ".codex/config.toml", servers: serversOfToml((0, import_node_path7.join)(cwd, ".codex", "config.toml")) },
-    { label: "~/.codex/config.toml", servers: serversOfToml((0, import_node_path7.join)(home2, ".codex", "config.toml")) }
+    { label: "~/.codex/managed_config.toml", servers: serversOfToml((0, import_node_path8.join)(home2, ".codex", "managed_config.toml")) },
+    { label: ".codex/config.toml", servers: serversOfToml((0, import_node_path8.join)(cwd, ".codex", "config.toml")) },
+    { label: "~/.codex/config.toml", servers: serversOfToml((0, import_node_path8.join)(home2, ".codex", "config.toml")) }
   ];
 }
-function quoted(path) {
+function quoted2(path) {
   return /[\s"]/.test(path) ? `"${path.replace(/"/g, '\\"')}"` : path;
 }
 function powershellQuoted(path) {
   return `'${path.replace(/'/g, "''")}'`;
 }
-function hookCommands(node, hook2, platform2 = process.platform) {
-  const program = platform2 === "win32" ? `& ${powershellQuoted(node)} ${powershellQuoted(hook2)}` : `${quoted(node)} ${quoted(hook2)}`;
+function hookCommands2(node, hook2, platform2 = process.platform) {
+  const program = platform2 === "win32" ? `& ${powershellQuoted(node)} ${powershellQuoted(hook2)}` : `${quoted2(node)} ${quoted2(hook2)}`;
   return {
     preToolUse: `${program} codex pre-tool-use`,
     sessionStart: `${program} codex session-start`
@@ -1446,23 +1565,23 @@ function hookCommands(node, hook2, platform2 = process.platform) {
 }
 var MINE = /attestari.*\bcodex (pre-tool-use|session-start)\b/;
 function isMine(handler) {
-  return isObject6(handler) && typeof handler.command === "string" && MINE.test(handler.command);
+  return isObject7(handler) && typeof handler.command === "string" && MINE.test(handler.command);
 }
 function withHandler(groups, matcher, handler) {
   const current = Array.isArray(groups) ? groups : [];
-  const cleaned = current.map((g) => isObject6(g) && Array.isArray(g.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isMine(h)) } : g).filter((g) => !(isObject6(g) && Array.isArray(g.hooks) && g.hooks.length === 0));
-  const at = cleaned.findIndex((g) => isObject6(g) && g.matcher === matcher && Array.isArray(g.hooks));
+  const cleaned = current.map((g) => isObject7(g) && Array.isArray(g.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isMine(h)) } : g).filter((g) => !(isObject7(g) && Array.isArray(g.hooks) && g.hooks.length === 0));
+  const at = cleaned.findIndex((g) => isObject7(g) && g.matcher === matcher && Array.isArray(g.hooks));
   if (at === -1) return [...cleaned, matcher === void 0 ? { hooks: [handler] } : { matcher, hooks: [handler] }];
   const group = cleaned[at];
   cleaned[at] = { ...group, hooks: [...group.hooks, handler] };
   return cleaned;
 }
-function install(home2, hookFile = __filename, node = process.execPath, platform2 = process.platform) {
-  const copy = (0, import_node_path7.join)(home2, COPY);
-  (0, import_node_fs6.mkdirSync)((0, import_node_path7.join)(home2, ".attestari"), { recursive: true });
-  (0, import_node_fs6.copyFileSync)(hookFile, copy);
-  const commands = hookCommands(node, copy, platform2);
-  const file = (0, import_node_path7.join)(home2, ".codex", "hooks.json");
+function install2(home2, hookFile = __filename, node = process.execPath, platform2 = process.platform) {
+  const copy = (0, import_node_path8.join)(home2, COPY2);
+  (0, import_node_fs7.mkdirSync)((0, import_node_path8.join)(home2, ".attestari"), { recursive: true });
+  (0, import_node_fs7.copyFileSync)(hookFile, copy);
+  const commands = hookCommands2(node, copy, platform2);
+  const file = (0, import_node_path8.join)(home2, ".codex", "hooks.json");
   const read = bytesOf(file);
   const text = read === null ? null : read.toString("utf8");
   let settings = {};
@@ -1473,21 +1592,21 @@ function install(home2, hookFile = __filename, node = process.execPath, platform
       throw new Error(`${file} could not be read as Codex's hooks file; the hook was not installed`);
     }
   }
-  if (!isObject6(settings) || settings.hooks !== void 0 && !isObject6(settings.hooks)) {
+  if (!isObject7(settings) || settings.hooks !== void 0 && !isObject7(settings.hooks)) {
     throw new Error(`${file} is not Codex's hooks file; the hook was not installed`);
   }
-  const hooks = isObject6(settings.hooks) ? settings.hooks : {};
+  const hooks = isObject7(settings.hooks) ? settings.hooks : {};
   const next = {
     ...settings,
     hooks: {
       ...hooks,
-      PreToolUse: withHandler(hooks.PreToolUse, "^mcp__", { type: "command", command: commands.preToolUse, timeout: TIMEOUT_S, statusMessage: STATUS }),
-      SessionStart: withHandler(hooks.SessionStart, void 0, { type: "command", command: commands.sessionStart, timeout: TIMEOUT_S })
+      PreToolUse: withHandler(hooks.PreToolUse, "^mcp__", { type: "command", command: commands.preToolUse, timeout: TIMEOUT_S2, statusMessage: STATUS }),
+      SessionStart: withHandler(hooks.SessionStart, void 0, { type: "command", command: commands.sessionStart, timeout: TIMEOUT_S2 })
     }
   };
   const after = formatLike(text, next);
   if (text !== after) {
-    (0, import_node_fs6.mkdirSync)((0, import_node_path7.join)(home2, ".codex"), { recursive: true });
+    (0, import_node_fs7.mkdirSync)((0, import_node_path8.join)(home2, ".codex"), { recursive: true });
     if (!writeBeside(file, after, modeOf(file, text), read)) throw new Error(`${file} changed while the hook was installed; run the install again`);
   }
   return { path: file, before: text, after };
@@ -1496,18 +1615,18 @@ var codex = {
   name: "codex",
   client: "Codex",
   events: ["PreToolUse", "SessionStart"],
-  parse: parse2,
+  parse: parse3,
   matches: matches2,
-  deny: deny3,
-  allow: allow2,
-  scopes,
+  deny: deny4,
+  allow: allow3,
+  scopes: scopes2,
   // Codex's own deny form would be `enabled = false` in the person's server table: not written. The hook decides.
-  install
+  install: install2
 };
 
 // src/adapters/cursor.ts
-var import_node_fs7 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_fs8 = require("node:fs");
+var import_node_path9 = require("node:path");
 
 // src/jsonc.ts
 function stripJsonc(text) {
@@ -1550,62 +1669,67 @@ function parseJsonc(text) {
 }
 
 // src/adapters/cursor.ts
-var TIMEOUT_S2 = 10;
-var COPY2 = (0, import_node_path8.join)(".attestari", "hook.js");
-function isObject7(value) {
+var TIMEOUT_S3 = 10;
+var COPY3 = (0, import_node_path9.join)(".attestari", "hook.js");
+function isObject8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isStrings2(value) {
+function isStrings3(value) {
   return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
-function parse3(_event, stdinText) {
+function parse4(_event, stdinText) {
   let input;
   try {
     input = JSON.parse(stdinText);
   } catch {
     return { kind: "unreadable" };
   }
-  if (!isObject7(input)) return { kind: "unreadable" };
+  if (!isObject8(input)) return { kind: "unreadable" };
   const key = input.mcp_server_name;
   if (typeof key !== "string" || key === "") return { kind: "unreadable" };
-  const roots = isStrings2(input.workspace_roots) ? input.workspace_roots : [];
+  const roots = isStrings3(input.workspace_roots) ? input.workspace_roots : [];
   return {
     kind: "mcp",
     key,
     plugin: false,
     sessionId: typeof input.conversation_id === "string" ? input.conversation_id : void 0,
-    cwd: roots.length > 0 && roots[0] !== "" ? roots[0] : void 0
+    cwd: roots.length > 0 && roots[0] !== "" ? rootPath(roots[0]) : void 0
   };
 }
-function deny4(_event, verdict) {
+function rootPath(root) {
+  const drive = /^\/([A-Za-z]:)(\/.*)?$/.exec(root);
+  if (drive === null) return root;
+  return `${drive[1]}${(drive[2] ?? "\\").replace(/\//g, "\\")}`;
+}
+function deny5(_event, verdict) {
   return { stdout: `${JSON.stringify({ permission: "deny", user_message: verdict.reason, agent_message: verdict.reason })}
 `, exitCode: 0 };
 }
-var allow3 = () => ({ stdout: `${JSON.stringify({ permission: "allow" })}
+var allow4 = () => ({ stdout: `${JSON.stringify({ permission: "allow" })}
 `, exitCode: 0 });
 function readCursorJson(file) {
   let text;
   try {
-    text = (0, import_node_fs7.readFileSync)(file, "utf8");
+    text = (0, import_node_fs8.readFileSync)(file, "utf8");
   } catch (error) {
     return error.code === "ENOENT" ? void 0 : null;
   }
   try {
     const value = parseJsonc(text);
-    return isObject7(value) ? value : null;
+    return isObject8(value) ? value : null;
   } catch {
     return null;
   }
 }
-function serversOf2(holder) {
+function serversOf3(holder) {
   if (holder === null) return null;
   if (holder === void 0 || holder.mcpServers === void 0) return void 0;
-  return isObject7(holder.mcpServers) ? holder.mcpServers : null;
+  return isObject8(holder.mcpServers) ? holder.mcpServers : null;
 }
-function scopes2(home2, cwd) {
+function scopes3(home2, cwd) {
   return [
-    { label: ".cursor/mcp.json", servers: serversOf2(readCursorJson((0, import_node_path8.join)(cwd, ".cursor", "mcp.json"))) },
-    { label: "~/.cursor/mcp.json", servers: serversOf2(readCursorJson((0, import_node_path8.join)(home2, ".cursor", "mcp.json"))) }
+    { label: ".cursor/mcp.json", servers: serversOf3(readCursorJson((0, import_node_path9.join)(cwd, ".cursor", "mcp.json"))) },
+    { label: "~/.cursor/mcp.json", servers: serversOf3(readCursorJson((0, import_node_path9.join)(home2, ".cursor", "mcp.json"))) }
   ];
 }
 var denyToken = (key) => `Mcp(${key}:*)`;
@@ -1615,42 +1739,42 @@ function cursorDenyForms(resolved, policy) {
 }
 function writeDenies2(resolved, policy, written, takeBack, elsewhere) {
   return writeDenyList(
-    (0, import_node_path8.join)(home(), ".cursor", "cli-config.json"),
+    (0, import_node_path9.join)(home(), ".cursor", "cli-config.json"),
     (settings) => {
       const permissions = settings.permissions;
       if (permissions === void 0) return void 0;
-      if (!isObject7(permissions)) return null;
+      if (!isObject8(permissions)) return null;
       if (permissions.deny === void 0) return void 0;
       return Array.isArray(permissions.deny) ? permissions.deny : null;
     },
-    (settings, list) => ({ ...settings, permissions: { ...isObject7(settings.permissions) ? settings.permissions : {}, deny: list } }),
+    (settings, list) => ({ ...settings, permissions: { ...isObject8(settings.permissions) ? settings.permissions : {}, deny: list } }),
     cursorDenyForms(resolved, policy),
     written,
     takeBack,
     elsewhere
   );
 }
-function quoted2(path) {
+function quoted3(path) {
   return /[\s"]/.test(path) ? `"${path.replace(/"/g, '\\"')}"` : path;
 }
-function hookCommands2(node, hook2) {
+function hookCommands3(node, hook2) {
   return {
-    preToolUse: `${quoted2(node)} ${quoted2(hook2)} cursor pre-tool-use`,
-    sessionStart: `${quoted2(node)} ${quoted2(hook2)} cursor session-start`
+    preToolUse: `${quoted3(node)} ${quoted3(hook2)} cursor pre-tool-use`,
+    sessionStart: `${quoted3(node)} ${quoted3(hook2)} cursor session-start`
   };
 }
 var MINE2 = /attestari.*\bcursor (pre-tool-use|session-start)\b/;
 function withEntry(list, entry) {
   const current = Array.isArray(list) ? list : [];
-  const others = current.filter((e) => !(isObject7(e) && typeof e.command === "string" && MINE2.test(e.command)));
+  const others = current.filter((e) => !(isObject8(e) && typeof e.command === "string" && MINE2.test(e.command)));
   return [...others, entry];
 }
-function install2(home2, hookFile = __filename, node = process.execPath) {
-  const copy = (0, import_node_path8.join)(home2, COPY2);
-  (0, import_node_fs7.mkdirSync)((0, import_node_path8.join)(home2, ".attestari"), { recursive: true });
-  (0, import_node_fs7.copyFileSync)(hookFile, copy);
-  const commands = hookCommands2(node, copy);
-  const file = (0, import_node_path8.join)(home2, ".cursor", "hooks.json");
+function install3(home2, hookFile = __filename, node = process.execPath) {
+  const copy = (0, import_node_path9.join)(home2, COPY3);
+  (0, import_node_fs8.mkdirSync)((0, import_node_path9.join)(home2, ".attestari"), { recursive: true });
+  (0, import_node_fs8.copyFileSync)(hookFile, copy);
+  const commands = hookCommands3(node, copy);
+  const file = (0, import_node_path9.join)(home2, ".cursor", "hooks.json");
   const read = bytesOf(file);
   const text = read === null ? null : read.toString("utf8");
   let settings = {};
@@ -1661,20 +1785,20 @@ function install2(home2, hookFile = __filename, node = process.execPath) {
       throw new Error(`${file} could not be read as Cursor's hooks file; the hook was not installed`);
     }
   }
-  if (!isObject7(settings)) throw new Error(`${file} is not Cursor's hooks file; the hook was not installed`);
-  const hooks = isObject7(settings.hooks) ? settings.hooks : {};
+  if (!isObject8(settings)) throw new Error(`${file} is not Cursor's hooks file; the hook was not installed`);
+  const hooks = isObject8(settings.hooks) ? settings.hooks : {};
   const next = {
     ...settings,
     version: typeof settings.version === "number" ? settings.version : 1,
     hooks: {
       ...hooks,
-      beforeMCPExecution: withEntry(hooks.beforeMCPExecution, { command: commands.preToolUse, timeout: TIMEOUT_S2, failClosed: true }),
-      sessionStart: withEntry(hooks.sessionStart, { command: commands.sessionStart, timeout: TIMEOUT_S2 })
+      beforeMCPExecution: withEntry(hooks.beforeMCPExecution, { command: commands.preToolUse, timeout: TIMEOUT_S3, failClosed: true }),
+      sessionStart: withEntry(hooks.sessionStart, { command: commands.sessionStart, timeout: TIMEOUT_S3 })
     }
   };
   const after = formatLike(text, next);
   if (text !== after) {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path8.join)(home2, ".cursor"), { recursive: true });
+    (0, import_node_fs8.mkdirSync)((0, import_node_path9.join)(home2, ".cursor"), { recursive: true });
     if (!writeBeside(file, after, modeOf(file, text), read)) throw new Error(`${file} changed while the hook was installed; run the install again`);
   }
   return { path: file, before: text, after };
@@ -1683,34 +1807,34 @@ var cursor = {
   name: "cursor",
   client: "Cursor",
   events: ["beforeMCPExecution", "sessionStart"],
-  parse: parse3,
-  deny: deny4,
-  allow: allow3,
-  scopes: scopes2,
+  parse: parse4,
+  deny: deny5,
+  allow: allow4,
+  scopes: scopes3,
   writeDenies: writeDenies2,
-  install: install2
+  install: install3
 };
 
 // src/adapters/gemini.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs9 = require("node:fs");
+var import_node_path10 = require("node:path");
 var PREFIX3 = "mcp_";
 var TIMEOUT_MS2 = 1e4;
-var COPY3 = (0, import_node_path9.join)(".attestari", "hook.js");
+var COPY4 = (0, import_node_path10.join)(".attestari", "hook.js");
 var HANDLER = "attestari";
 var SESSION_HANDLER = "attestari-session";
-function isObject8(value) {
+function isObject9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function parse4(_event, stdinText) {
+function parse5(_event, stdinText) {
   let input;
   try {
     input = JSON.parse(stdinText);
   } catch {
     return { kind: "unreadable" };
   }
-  if (!isObject8(input) || typeof input.tool_name !== "string") return { kind: "unreadable" };
-  const context = isObject8(input.mcp_context) ? input.mcp_context : null;
+  if (!isObject9(input) || typeof input.tool_name !== "string") return { kind: "unreadable" };
+  const context = isObject9(input.mcp_context) ? input.mcp_context : null;
   if (context === null) return input.tool_name.startsWith(PREFIX3) ? { kind: "unreadable" } : { kind: "other" };
   const key = context.server_name;
   if (typeof key !== "string" || key === "") return { kind: "unreadable" };
@@ -1722,35 +1846,35 @@ function parse4(_event, stdinText) {
     cwd: typeof input.cwd === "string" ? input.cwd : void 0
   };
 }
-function deny5(_event, verdict) {
+function deny6(_event, verdict) {
   return { stdout: `${JSON.stringify({ decision: "deny", reason: verdict.reason })}
 `, exitCode: 0 };
 }
-var allow4 = () => ({ stdout: "", exitCode: 0 });
+var allow5 = () => ({ stdout: "", exitCode: 0 });
 function geminiEntry(entry) {
-  if (!isObject8(entry)) return entry;
+  if (!isObject9(entry)) return entry;
   const address = typeof entry.httpUrl === "string" ? entry.httpUrl : typeof entry.url === "string" ? entry.url : null;
   if (address === null) return entry;
   const { command: _c, args: _a, httpUrl: _h, url: _u, type: _t, ...rest } = entry;
   return { ...rest, type: "http", url: address };
 }
-function serversOf3(holder) {
+function serversOf4(holder) {
   if (holder === null) return null;
   if (holder === void 0 || holder.mcpServers === void 0) return void 0;
-  if (!isObject8(holder.mcpServers)) return null;
+  if (!isObject9(holder.mcpServers)) return null;
   return Object.fromEntries(Object.entries(holder.mcpServers).map(([key, entry]) => [key, geminiEntry(entry)]));
 }
 function systemSettingsPath(platform2 = process.platform, env = process.env) {
   if (env.GEMINI_CLI_SYSTEM_SETTINGS_PATH) return env.GEMINI_CLI_SYSTEM_SETTINGS_PATH;
-  if (platform2 === "win32") return import_node_path9.win32.join(env.ProgramData ?? "C:\\ProgramData", "gemini-cli", "settings.json");
+  if (platform2 === "win32") return import_node_path10.win32.join(env.ProgramData ?? "C:\\ProgramData", "gemini-cli", "settings.json");
   if (platform2 === "darwin") return "/Library/Application Support/GeminiCli/settings.json";
   return "/etc/gemini-cli/settings.json";
 }
-function scopes3(home2, cwd) {
+function scopes4(home2, cwd) {
   return [
-    { label: "the system settings.json", servers: serversOf3(readJson(systemSettingsPath())) },
-    { label: ".gemini/settings.json", servers: serversOf3(readJson((0, import_node_path9.join)(cwd, ".gemini", "settings.json"))) },
-    { label: "~/.gemini/settings.json", servers: serversOf3(readJson((0, import_node_path9.join)(home2, ".gemini", "settings.json"))) }
+    { label: "the system settings.json", servers: serversOf4(readJson(systemSettingsPath())) },
+    { label: ".gemini/settings.json", servers: serversOf4(readJson((0, import_node_path10.join)(cwd, ".gemini", "settings.json"))) },
+    { label: "~/.gemini/settings.json", servers: serversOf4(readJson((0, import_node_path10.join)(home2, ".gemini", "settings.json"))) }
   ];
 }
 function geminiDenyForms(resolved, policy) {
@@ -1759,33 +1883,33 @@ function geminiDenyForms(resolved, policy) {
 }
 function writeDenies3(resolved, policy, written, takeBack, elsewhere) {
   return writeDenyList(
-    (0, import_node_path9.join)(home(), ".gemini", "settings.json"),
+    (0, import_node_path10.join)(home(), ".gemini", "settings.json"),
     (settings) => {
       const mcp = settings.mcp;
       if (mcp === void 0) return void 0;
-      if (!isObject8(mcp)) return null;
+      if (!isObject9(mcp)) return null;
       if (mcp.excluded === void 0) return void 0;
       return Array.isArray(mcp.excluded) ? mcp.excluded : null;
     },
-    (settings, list) => ({ ...settings, mcp: { ...isObject8(settings.mcp) ? settings.mcp : {}, excluded: list } }),
+    (settings, list) => ({ ...settings, mcp: { ...isObject9(settings.mcp) ? settings.mcp : {}, excluded: list } }),
     geminiDenyForms(resolved, policy),
     written,
     takeBack,
     elsewhere
   );
 }
-function quoted3(path) {
+function quoted4(path) {
   return /[\s"]/.test(path) ? `"${path}"` : path;
 }
-var LAUNCHER = (0, import_node_path9.join)(".attestari", "gemini-hook.cmd");
+var LAUNCHER = (0, import_node_path10.join)(".attestari", "gemini-hook.cmd");
 function geminiShell(platform2 = process.platform, env = process.env) {
   if (platform2 !== "win32") return "sh";
   const comSpec = (env.ComSpec ?? "").toLowerCase();
   if (comSpec.endsWith("powershell.exe") || comSpec.endsWith("pwsh.exe")) return "powershell";
   return findOnPath("pwsh", env.PATH ?? "", true) !== null ? "powershell" : "cmd";
 }
-function hookCommands3(node, hook2, shell, launcher) {
-  const program = shell === "sh" || launcher === void 0 ? `${quoted3(node)} ${quoted3(hook2)}` : quoted3(launcher);
+function hookCommands4(node, hook2, shell, launcher) {
+  const program = shell === "sh" || launcher === void 0 ? `${quoted4(node)} ${quoted4(hook2)}` : quoted4(launcher);
   const call = shell === "powershell" && program.startsWith('"') ? `& ${program}` : program;
   return { preToolUse: `${call} gemini pre-tool-use`, sessionStart: `${call} gemini session-start` };
 }
@@ -1794,29 +1918,29 @@ function launcherText(node, hook2) {
 `;
 }
 function isMine2(handler) {
-  return isObject8(handler) && (handler.name === HANDLER || handler.name === SESSION_HANDLER || typeof handler.command === "string" && /attestari.*\bgemini (pre-tool-use|session-start)\b/.test(handler.command));
+  return isObject9(handler) && (handler.name === HANDLER || handler.name === SESSION_HANDLER || typeof handler.command === "string" && /attestari.*\bgemini (pre-tool-use|session-start)\b/.test(handler.command));
 }
 function withHandler2(groups, matcher, handler) {
   const current = Array.isArray(groups) ? groups : [];
-  const cleaned = current.map((g) => isObject8(g) && Array.isArray(g.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isMine2(h)) } : g).filter((g) => !(isObject8(g) && Array.isArray(g.hooks) && g.hooks.length === 0));
-  const at = cleaned.findIndex((g) => isObject8(g) && g.matcher === matcher && Array.isArray(g.hooks));
+  const cleaned = current.map((g) => isObject9(g) && Array.isArray(g.hooks) ? { ...g, hooks: g.hooks.filter((h) => !isMine2(h)) } : g).filter((g) => !(isObject9(g) && Array.isArray(g.hooks) && g.hooks.length === 0));
+  const at = cleaned.findIndex((g) => isObject9(g) && g.matcher === matcher && Array.isArray(g.hooks));
   if (at === -1) return [...cleaned, matcher === void 0 ? { hooks: [handler] } : { matcher, hooks: [handler] }];
   const group = cleaned[at];
   cleaned[at] = { ...group, hooks: [...group.hooks, handler] };
   return cleaned;
 }
-function install3(home2, hookFile = __filename, node = process.execPath) {
-  const copy = (0, import_node_path9.join)(home2, COPY3);
-  (0, import_node_fs8.mkdirSync)((0, import_node_path9.join)(home2, ".attestari"), { recursive: true });
-  (0, import_node_fs8.copyFileSync)(hookFile, copy);
+function install4(home2, hookFile = __filename, node = process.execPath) {
+  const copy = (0, import_node_path10.join)(home2, COPY4);
+  (0, import_node_fs9.mkdirSync)((0, import_node_path10.join)(home2, ".attestari"), { recursive: true });
+  (0, import_node_fs9.copyFileSync)(hookFile, copy);
   const shell = geminiShell();
   let launcher;
   if (shell !== "sh") {
-    launcher = (0, import_node_path9.join)(home2, LAUNCHER);
-    (0, import_node_fs8.writeFileSync)(launcher, launcherText(node, copy));
+    launcher = (0, import_node_path10.join)(home2, LAUNCHER);
+    (0, import_node_fs9.writeFileSync)(launcher, launcherText(node, copy));
   }
-  const commands = hookCommands3(node, copy, shell, launcher);
-  const file = (0, import_node_path9.join)(home2, ".gemini", "settings.json");
+  const commands = hookCommands4(node, copy, shell, launcher);
+  const file = (0, import_node_path10.join)(home2, ".gemini", "settings.json");
   const read = bytesOf(file);
   const text = read === null ? null : read.toString("utf8");
   let settings = {};
@@ -1827,10 +1951,10 @@ function install3(home2, hookFile = __filename, node = process.execPath) {
       throw new Error(`${file} could not be read as Gemini CLI's settings file; the hook was not installed`);
     }
   }
-  if (!isObject8(settings) || settings.hooks !== void 0 && !isObject8(settings.hooks)) {
+  if (!isObject9(settings) || settings.hooks !== void 0 && !isObject9(settings.hooks)) {
     throw new Error(`${file} is not Gemini CLI's settings file; the hook was not installed`);
   }
-  const hooks = isObject8(settings.hooks) ? settings.hooks : {};
+  const hooks = isObject9(settings.hooks) ? settings.hooks : {};
   const next = {
     ...settings,
     hooks: {
@@ -1841,7 +1965,7 @@ function install3(home2, hookFile = __filename, node = process.execPath) {
   };
   const after = formatLike(text, next);
   if (text !== after) {
-    (0, import_node_fs8.mkdirSync)((0, import_node_path9.join)(home2, ".gemini"), { recursive: true });
+    (0, import_node_fs9.mkdirSync)((0, import_node_path10.join)(home2, ".gemini"), { recursive: true });
     if (!writeBeside(file, after, modeOf(file, text), read)) throw new Error(`${file} changed while the hook was installed; run the install again`);
   }
   return { path: file, before: text, after };
@@ -1850,12 +1974,12 @@ var gemini = {
   name: "gemini",
   client: "Gemini CLI",
   events: ["BeforeTool", "SessionStart"],
-  parse: parse4,
-  deny: deny5,
-  allow: allow4,
-  scopes: scopes3,
+  parse: parse5,
+  deny: deny6,
+  allow: allow5,
+  scopes: scopes4,
   writeDenies: writeDenies3,
-  install: install3
+  install: install4
 };
 
 // src/adapters/registry.ts
@@ -1863,14 +1987,15 @@ var ADAPTERS = /* @__PURE__ */ new Map([
   [claudeCode.name, claudeCode],
   [cursor.name, cursor],
   [codex.name, codex],
-  [gemini.name, gemini]
+  [gemini.name, gemini],
+  [antigravity.name, antigravity]
 ]);
 function adapterFor(name) {
   return ADAPTERS.get(name) ?? null;
 }
 
 // src/session.ts
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 var import_node_os2 = require("node:os");
 
 // src/api.ts
@@ -1878,7 +2003,7 @@ var import_node_http = require("node:http");
 var import_node_https = require("node:https");
 
 // src/version.ts
-var HOOK_VERSION = "2.9.3";
+var HOOK_VERSION = "2.9.4";
 
 // src/api.ts
 var timeoutMs = 1e4;
@@ -2011,8 +2136,8 @@ var FOLDER_MS = 30 * DAY_MS;
 var PAIRING_LINE = "Attestari: this agent is not protected. Run `npx -y attestari@2.9 pair --code <code from app.attestari.ai/agents>`";
 var INVALID_CODE = "That code is not valid or has expired. Make a new one at app.attestari.ai/agents.";
 var TOKEN_REFUSED = "Pairing did not complete: Attestari refused the new token. Make a new code at app.attestari.ai/agents.";
-var PAIR_USAGE = "usage: attestari-hook pair --code <code> [--agent claude-code|cursor|codex|gemini]";
-var INSTALL_USAGE = "usage: attestari-hook install --agent claude-code|cursor|codex|gemini";
+var PAIR_USAGE = "usage: attestari-hook pair --code <code> [--agent claude-code|cursor|codex|gemini|antigravity]";
+var INSTALL_USAGE = "usage: attestari-hook install --agent claude-code|cursor|codex|gemini|antigravity";
 var ACCOUNTS = "https://accounts.attestari.ai";
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "[::1]", "localhost"]);
 function accountsBase() {
@@ -2025,16 +2150,16 @@ function accountsBase() {
     host = null;
   }
   if (host !== null && LOOPBACK.has(host)) return wanted;
-  say("ATTESTARI_ACCOUNTS_URL is ignored: only a loopback address (127.0.0.1, ::1, localhost) may replace accounts.attestari.ai");
+  say2("ATTESTARI_ACCOUNTS_URL is ignored: only a loopback address (127.0.0.1, ::1, localhost) may replace accounts.attestari.ai");
   return ACCOUNTS;
 }
-function isObject9(value) {
+function isObject10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolveAndKeep(adapter, cwd) {
   const agent = adapter.name;
   const { resolved, notes, complete } = resolveConfiguration(home(), cwd, readSecret(agent), adapter.scopes(home(), cwd));
-  for (const note of notes) say(note);
+  for (const note of notes) say2(note);
   attempt("the resolution was not written", () => writeResolution(agent, cwd, resolved, complete));
 }
 function sessionStart(stdinText, adapter) {
@@ -2046,9 +2171,9 @@ function sessionStart(stdinText, adapter) {
     input = JSON.parse(stdinText);
   } catch {
   }
-  const cwd = isObject9(input) && typeof input.cwd === "string" && input.cwd !== "" ? input.cwd : process.cwd();
+  const cwd = isObject10(input) && typeof input.cwd === "string" && input.cwd !== "" ? input.cwd : process.cwd();
   attempt("the configuration was not resolved", () => resolveAndKeep(adapter, cwd));
-  if (isObject9(input) && typeof input.session_id === "string" && input.session_id !== "") {
+  if (isObject10(input) && typeof input.session_id === "string" && input.session_id !== "") {
     const sessionId = input.session_id;
     attempt("the session was not bound to its folder", () => writeSession(agent, sessionId, cwd));
   }
@@ -2068,7 +2193,7 @@ async function refresh(adapter, cwd) {
     try {
       resolveAndKeep(adapter, cwd);
     } catch (error) {
-      say(`the configuration was not resolved: ${message(error)}`);
+      say2(`the configuration was not resolved: ${message(error)}`);
     }
   }
   try {
@@ -2096,7 +2221,7 @@ async function refresh(adapter, cwd) {
       held !== null && etag === held.policy.etag ? etag : null
     );
   } catch (error) {
-    if (!(error instanceof ApiError)) say(`the check-in failed: ${message(error)}`);
+    if (!(error instanceof ApiError)) say2(`the check-in failed: ${message(error)}`);
     else if (error.status === 401) {
       if (error.said === "invalid_token") {
         deleteToken(agent);
@@ -2104,7 +2229,7 @@ async function refresh(adapter, cwd) {
       }
     } else if (error.status === 503) nextAt(agent, Math.min(Math.max((error.retryAfterSeconds ?? 0) * 1e3, HOUR_MS), DAY_MS), LOOKUP_UNAVAILABLE);
     else if (error.status === 403) nextAt(agent, HOUR_MS, REFUSED);
-    else if (error.status !== 0) say(`the check-in was refused: ${error.status} ${error.error}`);
+    else if (error.status !== 0) say2(`the check-in was refused: ${error.status} ${error.error}`);
     return null;
   }
   let policy = held?.policy ?? null;
@@ -2130,7 +2255,7 @@ async function refresh(adapter, cwd) {
 }
 function folderGone(folder) {
   try {
-    return !(0, import_node_fs9.statSync)(folder).isDirectory();
+    return !(0, import_node_fs10.statSync)(folder).isDirectory();
   } catch (error) {
     const code = error.code;
     return code === "ENOENT" || code === "ENOTDIR";
@@ -2227,7 +2352,7 @@ ${PAIR_USAGE}
     resolveAndKeep(adapter, cwd);
     refreshed = await refresh(adapter, cwd);
   } catch (error) {
-    say(`the first check-in failed: ${message(error)}`);
+    say2(`the first check-in failed: ${message(error)}`);
   }
   if (readToken(agent) === null) {
     process.stderr.write(`${TOKEN_REFUSED}
@@ -2253,6 +2378,8 @@ function afterInstall(agent) {
       return ["Codex runs no user hook until you trust it: in Codex, run /hooks and trust the Attestari handlers."];
     case "gemini":
       return ["Gemini CLI runs hooks in trusted folders only; the hook decides there."];
+    case "antigravity":
+      return ["Antigravity reads ~/.gemini/config/hooks.json itself; /hooks in agy lists the attestari group. Nothing to restart."];
     default:
       return [];
   }
@@ -2260,7 +2387,7 @@ function afterInstall(agent) {
 function installHook(adapter) {
   if (adapter.name === "claude-code") {
     if (process.env.CLAUDE_PLUGIN_ROOT) {
-      say("the Attestari plugin is installed in Claude Code already; the hook decides from the next session");
+      say2("the Attestari plugin is installed in Claude Code already; the hook decides from the next session");
       return true;
     }
     let plugin;
@@ -2269,15 +2396,15 @@ function installHook(adapter) {
     } catch (error) {
       plugin = { installed: false, why: `The install failed (${oneLine2(message(error))})` };
     }
-    if (plugin.installed) say("the Attestari plugin is installed in Claude Code; it runs from the next session");
+    if (plugin.installed) say2("the Attestari plugin is installed in Claude Code; it runs from the next session");
     else process.stderr.write(`${plugin.why}, so the Attestari plugin was not installed. Run:
 ${installCommands()}`);
     return plugin.installed;
   }
   try {
     const done = adapter.install(home());
-    if ("path" in done) say(`the hook is installed in ${done.path}${done.before === done.after ? " (it was already)" : ""}`);
-    for (const line of afterInstall(adapter.name)) say(line);
+    if ("path" in done) say2(`the hook is installed in ${done.path}${done.before === done.after ? " (it was already)" : ""}`);
+    for (const line of afterInstall(adapter.name)) say2(line);
     return true;
   } catch (error) {
     process.stderr.write(`The hook was not installed: ${oneLine2(message(error))}. Fix that and run: npx -y attestari@2.9 install --agent ${adapter.name}
@@ -2285,7 +2412,7 @@ ${installCommands()}`);
     return false;
   }
 }
-function install4(args) {
+function install5(args) {
   let agent;
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
@@ -2307,8 +2434,8 @@ function install4(args) {
 }
 
 // src/status.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path11 = require("node:path");
 function age(ms) {
   const minutes = Math.floor(ms / 6e4);
   if (minutes < 60) return `${Math.max(minutes, 0)} min`;
@@ -2317,27 +2444,27 @@ function age(ms) {
   return `${Math.floor(hours / 24)} days`;
 }
 function policyLine(dir) {
-  const file = (0, import_node_path10.join)(dir, "policy.json");
-  if (!(0, import_node_fs10.existsSync)(file)) return null;
+  const file = (0, import_node_path11.join)(dir, "policy.json");
+  if (!(0, import_node_fs11.existsSync)(file)) return null;
   let version = "unreadable";
   try {
-    const document = JSON.parse((0, import_node_fs10.readFileSync)(file, "utf8"));
+    const document = JSON.parse((0, import_node_fs11.readFileSync)(file, "utf8"));
     const v = document?.policy?.version;
     if (typeof v === "number") version = String(v);
   } catch {
   }
-  return `policy ${version}, ${age(Date.now() - (0, import_node_fs10.statSync)(file).mtimeMs)} old`;
+  return `policy ${version}, ${age(Date.now() - (0, import_node_fs11.statSync)(file).mtimeMs)} old`;
 }
 function status() {
   const root = attestariDir();
-  const agents = (0, import_node_fs10.existsSync)(root) ? (0, import_node_fs10.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort() : [];
+  const agents = (0, import_node_fs11.existsSync)(root) ? (0, import_node_fs11.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort() : [];
   if (agents.length === 0) {
     console.log("not paired");
     return 0;
   }
   for (const agent of agents) {
     const dir = agentDir(agent);
-    const token = (0, import_node_fs10.existsSync)((0, import_node_path10.join)(dir, "token")) ? "token present" : "no token";
+    const token = (0, import_node_fs11.existsSync)((0, import_node_path11.join)(dir, "token")) ? "token present" : "no token";
     const policy = policyLine(dir) ?? "no policy";
     console.log(`${agent}: ${token}; ${policy}`);
   }
@@ -2345,7 +2472,7 @@ function status() {
 }
 
 // src/main.ts
-var AGENTS = ["claude-code", "cursor", "codex", "gemini"];
+var AGENTS = ["claude-code", "cursor", "codex", "gemini", "antigravity"];
 var EVENTS = ["session-start", "pre-tool-use", "refresh"];
 var USAGE = [
   "usage: attestari-hook <agent> <event>",
@@ -2359,12 +2486,12 @@ function notBuilt(name) {
   return 2;
 }
 function stdin() {
-  return (0, import_node_fs11.readFileSync)(0, "utf8").replace(/^/, "");
+  return (0, import_node_fs12.readFileSync)(0, "utf8").replace(/^/, "");
 }
 var COMMANDS = {
   status: () => status(),
   pair: (args) => pair(args),
-  install: (args) => install4(args)
+  install: (args) => install5(args)
 };
 function hook(agent, event, args) {
   const adapter = adapterFor(agent);