calllint 1.6.0 → 1.7.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 import { execFileSync } from "node:child_process";
 
 // src/args.ts
@@ -71,11 +71,12 @@ COMMANDS
   inbox inspect <f>     Preflight a normalized agent inbox event
   evidence import <f>   Import a third-party scanner report as evidence (no re-scoring)
   trust prepare <target>  Read-only Trust Gateway preview: resolve to a digest-pinned identity
+  integrate          Install the CallLint preflight server into detected hosts (plan-only; --apply writes)
   diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
   approve            Record the repo-wide capability surface as approved state (L4)
   guard              Continuous Guard: re-decide on authority change; silent when unchanged
-  guard install --host <h>  Install a guard hook (git pre-commit, github workflow)
+  guard install --host <h>  Install a guard hook (git, git-pre-push, github, claude-code, copilot, gemini, vscode)
   guard status       Show baseline / disable / installed-hook state
   guard disable      Turn Continuous Guard off (.calllint/guard.json)
   receipt verify <f>    Validate a calllint.receipt.v0 (structure + signature if present)
@@ -127,7 +128,8 @@ VERIFY OPTIONS
   --json             Emit the drift report JSON
 
 GUARD OPTIONS
-  --host <h>         guard install target: git (pre-commit) | github (workflow)
+  --host <h>         guard install target: git | git-pre-push | github | claude-code | copilot | gemini | vscode
+                     (session-start hooks, non-blocking; shared-config hosts print a fragment to merge)
   --approved [file]  Approved baseline to diff against (default: .calllint/approved.json)
   --json             Emit the guard assessment / status JSON
   (exit) silent/note=0, REVIEW=10, UNKNOWN=20, BLOCK=30; guard self-failure is non-zero
@@ -895,6 +897,228 @@ function resolveArtifactIdentity(input) {
   return identity;
 }
 
+// ../../packages/evidence/src/types.ts
+var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
+
+// ../../packages/evidence/src/providers/skillspector.ts
+function pinnedVersion(raw) {
+  const tool = raw.tool;
+  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
+  if (commit) return `git:${commit}`;
+  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
+  return version || void 0;
+}
+function parseSkillSpectorJson(parsed) {
+  const raw = asObject(parsed, "SkillSpector JSON root");
+  const degradedReasons = [];
+  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
+  const scanMode = usedLlm ? "llm" : "static";
+  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
+  const findings = rawFindings.map((f) => {
+    const o = asObject(f, "SkillSpector finding");
+    return {
+      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
+      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
+      message: typeof o.message === "string" ? o.message : void 0,
+      locations: extractLocations(o)
+    };
+  });
+  let completenessHint;
+  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
+  if (status && status !== "complete" && status !== "completed" && status !== "success") {
+    degradedReasons.push(`SkillSpector reported status "${status}"`);
+    completenessHint = status === "partial" ? "partial" : "degraded";
+  }
+  if (raw.partial === true) {
+    degradedReasons.push("SkillSpector reported a partial scan");
+    completenessHint = completenessHint ?? "partial";
+  }
+  if (raw.degraded === true) {
+    degradedReasons.push("SkillSpector reported a degraded scan");
+    completenessHint = "degraded";
+  }
+  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
+  return {
+    provider: "skillspector",
+    providerVersion: pinnedVersion(raw),
+    scanMode,
+    coverage,
+    findings,
+    degradedReasons,
+    completenessHint
+  };
+}
+function parseSkillSpectorSarif(parsed) {
+  const raw = asObject(parsed, "SARIF root");
+  const runs = arrayOf(raw.runs) ?? [];
+  if (runs.length === 0) {
+    return {
+      provider: "skillspector",
+      findings: [],
+      degradedReasons: ["SARIF had no runs"]
+    };
+  }
+  const degradedReasons = [];
+  const findings = [];
+  let providerVersion;
+  const coverage = [];
+  for (const runUnknown of runs) {
+    const run2 = asObject(runUnknown, "SARIF run");
+    const tool = asObject(run2.tool ?? {}, "SARIF tool");
+    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
+    if (!providerVersion) {
+      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
+      if (v) providerVersion = v;
+    }
+    const results = arrayOf(run2.results) ?? [];
+    for (const resUnknown of results) {
+      const res = asObject(resUnknown, "SARIF result");
+      findings.push({
+        providerRuleId: String(res.ruleId ?? "unknown"),
+        providerSeverity: String(res.level ?? "warning"),
+        message: extractSarifMessage(res),
+        locations: extractSarifLocations(res)
+      });
+    }
+  }
+  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
+  return {
+    provider: "skillspector",
+    providerVersion,
+    scanMode: "static",
+    coverage,
+    findings,
+    degradedReasons
+  };
+}
+function asObject(v, what) {
+  if (v && typeof v === "object" && !Array.isArray(v)) return v;
+  throw new Error(`expected object for ${what}`);
+}
+function arrayOf(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function extractLocations(o) {
+  const loc = o.location ?? o.locations ?? o.path;
+  if (typeof loc === "string") return [loc];
+  if (Array.isArray(loc)) return loc.map((x) => String(x));
+  return void 0;
+}
+function extractSarifMessage(res) {
+  const msg = res.message;
+  if (msg && typeof msg.text === "string") return msg.text;
+  return void 0;
+}
+function extractSarifLocations(res) {
+  const locs = arrayOf(res.locations);
+  if (!locs) return void 0;
+  const out = [];
+  for (const l of locs) {
+    const lo = l;
+    const phys = lo?.physicalLocation;
+    const art = phys?.artifactLocation;
+    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
+    const region = phys?.region;
+    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
+    if (uri) out.push(line ? `${uri}:${line}` : uri);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
+// ../../packages/evidence/src/importEvidence.ts
+var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
+function detectProvider(raw, explicit) {
+  if (explicit) return explicit;
+  const r = raw;
+  if (!r) return "unknown";
+  const topTool = r.tool;
+  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
+  let sarifName = "";
+  const runs = r.runs;
+  if (Array.isArray(runs) && runs.length > 0) {
+    const run2 = runs[0];
+    const tool = run2?.tool;
+    const driver = tool?.driver;
+    if (driver && typeof driver.name === "string") sarifName = driver.name;
+  }
+  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
+    return "skillspector";
+  }
+  return "unknown";
+}
+function importEvidence(rawText, opts = {}) {
+  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
+  const rawReportDigest = sha256(rawText);
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch {
+    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
+      `report is not valid JSON (format=${format})`
+    ]);
+  }
+  const provider = detectProvider(parsed, opts.provider);
+  let result;
+  try {
+    if (provider === "skillspector") {
+      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
+    } else {
+      return failClosed(provider, rawReportDigest, [
+        `no adapter for provider "${provider}"; evidence not interpreted`
+      ]);
+    }
+  } catch (err2) {
+    return failClosed(provider, rawReportDigest, [
+      `adapter error: ${err2.message}`
+    ]);
+  }
+  return finalizeEnvelope(result, rawReportDigest);
+}
+function failClosed(provider, rawReportDigest, reasons) {
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: provider || "unknown",
+    providerVersion: "unknown",
+    artifactDigest: ZERO_DIGEST,
+    scanMode: "static",
+    coverage: [],
+    completeness: "failed",
+    findings: [],
+    rawReportDigest,
+    degradedReasons: reasons
+  };
+}
+function finalizeEnvelope(r, rawReportDigest) {
+  const degradedReasons = [...r.degradedReasons ?? []];
+  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
+  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
+  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
+  let providerVersion = r.providerVersion?.trim() || "";
+  if (!providerVersion) {
+    providerVersion = "unknown";
+    degradedReasons.push("provider version not pinned (no release/commit reported)");
+    level = Math.max(level, rank.degraded);
+  }
+  const completeness = rankToCompleteness[level];
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: r.provider,
+    providerVersion,
+    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
+    scanMode: r.scanMode ?? "static",
+    coverage: r.coverage ?? [],
+    completeness,
+    findings: r.findings,
+    rawReportDigest,
+    startedAt: r.startedAt,
+    finishedAt: r.finishedAt,
+    degradedReasons
+  };
+}
+function looksLikeSarif(text) {
+  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
+}
+
 // ../../packages/static-analyzer/src/detectors/unpinnedPackage.ts
 function detectUnpinnedPackage(ctx) {
   const { binding } = ctx;
@@ -4610,274 +4834,52 @@ function renderHtml(summary) {
 </body>
 </html>`;
 }
-
-// ../../packages/report-renderer/src/renderTrustPacket.ts
-var COMPLETENESS_HINT = {
-  complete: "complete",
-  partial: "partial (incomplete \u2014 treat as inconclusive)",
-  degraded: "degraded (not a pass)",
-  failed: "failed (not a pass)"
-};
-function topProviderSeverity(ev) {
-  const sevs = ev.findings.map(
-    (f) => f && typeof f === "object" && "providerSeverity" in f ? String(f.providerSeverity) : void 0
-  ).filter((s) => Boolean(s));
-  return sevs[0];
-}
-function whyTheyDiffer(ev, authorityVerdict) {
-  if (ev.completeness === "failed" || ev.completeness === "degraded") {
-    return "Why they differ: the content scan is " + COMPLETENESS_HINT[ev.completeness] + ", so it carries no weight here; CallLint's authority verdict stands on its own evidence.";
-  }
-  if (ev.findings.length === 0 && authorityVerdict !== "SAFE") {
-    return "Why they differ: the content scan found nothing malicious, but CallLint judges the granted authority itself too broad \u2014 clean code can still request unsafe capabilities.";
-  }
-  return "Why they differ: the two tools answer different questions \u2014 content risk (the scanner) vs. whether the requested authority is acceptable (CallLint). Neither overrides the other.";
-}
-function renderTrustPacket(summary, toolVersion, style = DEFAULT_STYLE) {
-  const evidence = summary.evidence;
-  if (!evidence || evidence.length === 0) return "";
-  const lines = ["", "Joint Trust Packet", "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"];
-  lines.push("Content scan");
-  for (const ev of evidence) {
-    const sev = topProviderSeverity(ev);
-    const findingsLabel = ev.findings.length === 0 ? "no findings" : `${ev.findings.length} finding${ev.findings.length === 1 ? "" : "s"}` + (sev ? ` (top severity: ${sev})` : "");
-    lines.push(
-      `  ${ev.provider} ${ev.providerVersion}  scanMode: ${ev.scanMode}  completeness: ${COMPLETENESS_HINT[ev.completeness]}`
-    );
-    lines.push(`    ${findingsLabel}`);
-    lines.push(`    raw report digest: ${ev.rawReportDigest}`);
-    for (const reason of ev.degradedReasons) {
-      lines.push(`    degraded: ${reason}`);
-    }
-  }
-  lines.push("Authority scan");
-  lines.push(
-    `  CallLint ${toolVersion}  ${verdictTag(summary.verdict, style)}  (${summary.publicVerdictLabel})`
-  );
-  lines.push(whyTheyDiffer(evidence[0], summary.verdict));
-  return lines.join("\n");
-}
-
-// ../../packages/evidence/src/types.ts
-var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
-
-// ../../packages/evidence/src/providers/skillspector.ts
-function pinnedVersion(raw) {
-  const tool = raw.tool;
-  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
-  if (commit) return `git:${commit}`;
-  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
-  return version || void 0;
-}
-function parseSkillSpectorJson(parsed) {
-  const raw = asObject(parsed, "SkillSpector JSON root");
-  const degradedReasons = [];
-  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
-  const scanMode = usedLlm ? "llm" : "static";
-  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
-  const findings = rawFindings.map((f) => {
-    const o = asObject(f, "SkillSpector finding");
-    return {
-      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
-      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
-      message: typeof o.message === "string" ? o.message : void 0,
-      locations: extractLocations(o)
-    };
-  });
-  let completenessHint;
-  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
-  if (status && status !== "complete" && status !== "completed" && status !== "success") {
-    degradedReasons.push(`SkillSpector reported status "${status}"`);
-    completenessHint = status === "partial" ? "partial" : "degraded";
-  }
-  if (raw.partial === true) {
-    degradedReasons.push("SkillSpector reported a partial scan");
-    completenessHint = completenessHint ?? "partial";
-  }
-  if (raw.degraded === true) {
-    degradedReasons.push("SkillSpector reported a degraded scan");
-    completenessHint = "degraded";
-  }
-  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
-  return {
-    provider: "skillspector",
-    providerVersion: pinnedVersion(raw),
-    scanMode,
-    coverage,
-    findings,
-    degradedReasons,
-    completenessHint
-  };
-}
-function parseSkillSpectorSarif(parsed) {
-  const raw = asObject(parsed, "SARIF root");
-  const runs = arrayOf(raw.runs) ?? [];
-  if (runs.length === 0) {
-    return {
-      provider: "skillspector",
-      findings: [],
-      degradedReasons: ["SARIF had no runs"]
-    };
-  }
-  const degradedReasons = [];
-  const findings = [];
-  let providerVersion;
-  const coverage = [];
-  for (const runUnknown of runs) {
-    const run2 = asObject(runUnknown, "SARIF run");
-    const tool = asObject(run2.tool ?? {}, "SARIF tool");
-    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
-    if (!providerVersion) {
-      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
-      if (v) providerVersion = v;
-    }
-    const results = arrayOf(run2.results) ?? [];
-    for (const resUnknown of results) {
-      const res = asObject(resUnknown, "SARIF result");
-      findings.push({
-        providerRuleId: String(res.ruleId ?? "unknown"),
-        providerSeverity: String(res.level ?? "warning"),
-        message: extractSarifMessage(res),
-        locations: extractSarifLocations(res)
-      });
-    }
-  }
-  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
-  return {
-    provider: "skillspector",
-    providerVersion,
-    scanMode: "static",
-    coverage,
-    findings,
-    degradedReasons
-  };
-}
-function asObject(v, what) {
-  if (v && typeof v === "object" && !Array.isArray(v)) return v;
-  throw new Error(`expected object for ${what}`);
-}
-function arrayOf(v) {
-  return Array.isArray(v) ? v : void 0;
-}
-function extractLocations(o) {
-  const loc = o.location ?? o.locations ?? o.path;
-  if (typeof loc === "string") return [loc];
-  if (Array.isArray(loc)) return loc.map((x) => String(x));
-  return void 0;
-}
-function extractSarifMessage(res) {
-  const msg = res.message;
-  if (msg && typeof msg.text === "string") return msg.text;
-  return void 0;
-}
-function extractSarifLocations(res) {
-  const locs = arrayOf(res.locations);
-  if (!locs) return void 0;
-  const out = [];
-  for (const l of locs) {
-    const lo = l;
-    const phys = lo?.physicalLocation;
-    const art = phys?.artifactLocation;
-    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
-    const region = phys?.region;
-    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
-    if (uri) out.push(line ? `${uri}:${line}` : uri);
-  }
-  return out.length > 0 ? out : void 0;
-}
-
-// ../../packages/evidence/src/importEvidence.ts
-var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
-function detectProvider(raw, explicit) {
-  if (explicit) return explicit;
-  const r = raw;
-  if (!r) return "unknown";
-  const topTool = r.tool;
-  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
-  let sarifName = "";
-  const runs = r.runs;
-  if (Array.isArray(runs) && runs.length > 0) {
-    const run2 = runs[0];
-    const tool = run2?.tool;
-    const driver = tool?.driver;
-    if (driver && typeof driver.name === "string") sarifName = driver.name;
-  }
-  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
-    return "skillspector";
-  }
-  return "unknown";
-}
-function importEvidence(rawText, opts = {}) {
-  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
-  const rawReportDigest = sha256(rawText);
-  let parsed;
-  try {
-    parsed = JSON.parse(rawText);
-  } catch {
-    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
-      `report is not valid JSON (format=${format})`
-    ]);
+
+// ../../packages/report-renderer/src/renderTrustPacket.ts
+var COMPLETENESS_HINT = {
+  complete: "complete",
+  partial: "partial (incomplete \u2014 treat as inconclusive)",
+  degraded: "degraded (not a pass)",
+  failed: "failed (not a pass)"
+};
+function topProviderSeverity(ev) {
+  const sevs = ev.findings.map(
+    (f) => f && typeof f === "object" && "providerSeverity" in f ? String(f.providerSeverity) : void 0
+  ).filter((s) => Boolean(s));
+  return sevs[0];
+}
+function whyTheyDiffer(ev, authorityVerdict) {
+  if (ev.completeness === "failed" || ev.completeness === "degraded") {
+    return "Why they differ: the content scan is " + COMPLETENESS_HINT[ev.completeness] + ", so it carries no weight here; CallLint's authority verdict stands on its own evidence.";
   }
-  const provider = detectProvider(parsed, opts.provider);
-  let result;
-  try {
-    if (provider === "skillspector") {
-      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
-    } else {
-      return failClosed(provider, rawReportDigest, [
-        `no adapter for provider "${provider}"; evidence not interpreted`
-      ]);
-    }
-  } catch (err2) {
-    return failClosed(provider, rawReportDigest, [
-      `adapter error: ${err2.message}`
-    ]);
+  if (ev.findings.length === 0 && authorityVerdict !== "SAFE") {
+    return "Why they differ: the content scan found nothing malicious, but CallLint judges the granted authority itself too broad \u2014 clean code can still request unsafe capabilities.";
   }
-  return finalizeEnvelope(result, rawReportDigest);
-}
-function failClosed(provider, rawReportDigest, reasons) {
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: provider || "unknown",
-    providerVersion: "unknown",
-    artifactDigest: ZERO_DIGEST,
-    scanMode: "static",
-    coverage: [],
-    completeness: "failed",
-    findings: [],
-    rawReportDigest,
-    degradedReasons: reasons
-  };
+  return "Why they differ: the two tools answer different questions \u2014 content risk (the scanner) vs. whether the requested authority is acceptable (CallLint). Neither overrides the other.";
 }
-function finalizeEnvelope(r, rawReportDigest) {
-  const degradedReasons = [...r.degradedReasons ?? []];
-  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
-  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
-  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
-  let providerVersion = r.providerVersion?.trim() || "";
-  if (!providerVersion) {
-    providerVersion = "unknown";
-    degradedReasons.push("provider version not pinned (no release/commit reported)");
-    level = Math.max(level, rank.degraded);
+function renderTrustPacket(summary, toolVersion, style = DEFAULT_STYLE) {
+  const evidence = summary.evidence;
+  if (!evidence || evidence.length === 0) return "";
+  const lines = ["", "Joint Trust Packet", "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"];
+  lines.push("Content scan");
+  for (const ev of evidence) {
+    const sev = topProviderSeverity(ev);
+    const findingsLabel = ev.findings.length === 0 ? "no findings" : `${ev.findings.length} finding${ev.findings.length === 1 ? "" : "s"}` + (sev ? ` (top severity: ${sev})` : "");
+    lines.push(
+      `  ${ev.provider} ${ev.providerVersion}  scanMode: ${ev.scanMode}  completeness: ${COMPLETENESS_HINT[ev.completeness]}`
+    );
+    lines.push(`    ${findingsLabel}`);
+    lines.push(`    raw report digest: ${ev.rawReportDigest}`);
+    for (const reason of ev.degradedReasons) {
+      lines.push(`    degraded: ${reason}`);
+    }
   }
-  const completeness = rankToCompleteness[level];
-  return {
-    schema_version: EVIDENCE_SCHEMA_VERSION,
-    provider: r.provider,
-    providerVersion,
-    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
-    scanMode: r.scanMode ?? "static",
-    coverage: r.coverage ?? [],
-    completeness,
-    findings: r.findings,
-    rawReportDigest,
-    startedAt: r.startedAt,
-    finishedAt: r.finishedAt,
-    degradedReasons
-  };
-}
-function looksLikeSarif(text) {
-  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
+  lines.push("Authority scan");
+  lines.push(
+    `  CallLint ${toolVersion}  ${verdictTag(summary.verdict, style)}  (${summary.publicVerdictLabel})`
+  );
+  lines.push(whyTheyDiffer(evidence[0], summary.verdict));
+  return lines.join("\n");
 }
 
 // src/exitCode.ts
@@ -9893,7 +9895,15 @@ SEE ALSO
 // src/commands/guard.ts
 import { existsSync as existsSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync11, mkdirSync as mkdirSync6 } from "node:fs";
 import { dirname as dirname6, join as join17, resolve as resolve10 } from "node:path";
-var GUARD_HOSTS = ["git", "github"];
+var GUARD_HOSTS = [
+  "git",
+  "git-pre-push",
+  "github",
+  "claude-code",
+  "copilot",
+  "gemini",
+  "vscode"
+];
 function guardConfigPath(cwd) {
   return join17(cwd, ".calllint", "guard.json");
 }
@@ -9989,31 +9999,86 @@ function guardRun(args, deps, env) {
 function isGuardHost(v) {
   return v !== void 0 && GUARD_HOSTS.includes(v);
 }
-var GIT_HOOK = `#!/usr/bin/env bash
+var GUARD_CMD = "npx -y calllint guard --no-emoji";
+function gitHookBody(when) {
+  return `#!/usr/bin/env bash
 # CallLint Continuous Guard (ADR 0045). Re-decides the agent-tool authority
-# surface on commit; silent when nothing changed. Generated by \`calllint guard install\`.
+# surface ${when}; silent when nothing changed. Generated by \`calllint guard install\`.
 # CallLint is static and NEVER executes a scanned server.
-npx -y calllint guard --no-emoji
+${GUARD_CMD}
 `;
+}
+var CLAUDE_CODE_HOOK = JSON.stringify(
+  { hooks: { SessionStart: [{ hooks: [{ type: "command", command: GUARD_CMD }] }] } },
+  null,
+  2
+) + "\n";
+var GEMINI_HOOK = JSON.stringify(
+  {
+    hooks: {
+      SessionStart: [
+        { hooks: [{ type: "command", command: GUARD_CMD, name: "calllint-guard" }] }
+      ]
+    }
+  },
+  null,
+  2
+) + "\n";
+var COPILOT_HOOK = JSON.stringify(
+  { version: 1, hooks: { sessionStart: [{ type: "command", command: GUARD_CMD }] } },
+  null,
+  2
+) + "\n";
+var VSCODE_TASK = JSON.stringify(
+  {
+    version: "2.0.0",
+    tasks: [
+      {
+        label: "CallLint Continuous Guard",
+        type: "shell",
+        command: GUARD_CMD,
+        runOptions: { runOn: "folderOpen" },
+        presentation: { reveal: "silent", panel: "shared" },
+        problemMatcher: []
+      }
+    ]
+  },
+  null,
+  2
+) + "\n";
 function guardArtifact(host) {
-  if (host === "git") {
-    return { path: join17(".git", "hooks", "pre-commit"), content: GIT_HOOK, label: "git pre-commit hook" };
+  switch (host) {
+    case "git":
+      return { path: join17(".git", "hooks", "pre-commit"), content: gitHookBody("on commit"), label: "git pre-commit hook", posture: "dedicated" };
+    case "git-pre-push":
+      return { path: join17(".git", "hooks", "pre-push"), content: gitHookBody("on push"), label: "git pre-push hook", posture: "dedicated" };
+    case "github":
+      return { path: join17(".github", "workflows", "calllint.yml"), content: renderCiGate({ mode: "drift" }), label: "GitHub Actions drift-gate workflow", posture: "dedicated" };
+    case "copilot":
+      return { path: join17(".github", "hooks", "calllint.json"), content: COPILOT_HOOK, label: "Copilot CLI sessionStart hook", posture: "dedicated" };
+    case "claude-code":
+      return { path: join17(".claude", "settings.json"), content: CLAUDE_CODE_HOOK, label: "Claude Code SessionStart hook", posture: "shared" };
+    case "gemini":
+      return { path: join17(".gemini", "settings.json"), content: GEMINI_HOOK, label: "Gemini CLI SessionStart hook", posture: "shared" };
+    case "vscode":
+      return { path: join17(".vscode", "tasks.json"), content: VSCODE_TASK, label: "VS Code folderOpen guard task", posture: "shared" };
   }
-  return {
-    path: join17(".github", "workflows", "calllint.yml"),
-    content: renderCiGate({ mode: "drift" }),
-    label: "GitHub Actions drift-gate workflow"
-  };
 }
 function guardInstall(args, deps) {
   const host = flagStr(args.flags, "host");
   if (!host) {
-    const list = GUARD_HOSTS.map((h2) => `  ${h2.padEnd(8)} \u2192 ${guardArtifact(h2).label}`).join("\n");
+    const list = GUARD_HOSTS.map((h2) => {
+      const a = guardArtifact(h2);
+      const tag = a.posture === "shared" ? " (fragment)" : "";
+      return `  ${h2.padEnd(13)} \u2192 ${a.label}${tag}`;
+    }).join("\n");
     return {
       stdout: `Usage: calllint guard install --host <host>
 
 Hosts:
-${list}`,
+${list}
+
+(fragment) hosts live inside a shared config file; install prints a snippet to merge and never overwrites it.`,
       exitCode: EXIT.OK
     };
   }
@@ -10026,7 +10091,39 @@ Run \`calllint guard install\` to list hosts.`,
     };
   }
   const art = guardArtifact(host);
-  const rel = flagStr(args.flags, "out") ?? art.path;
+  const outFlag = flagStr(args.flags, "out");
+  const rel = outFlag ?? art.path;
+  if (art.posture === "shared") {
+    if (outFlag) {
+      const abs2 = resolve10(deps.cwd, rel);
+      if (existsSync12(abs2)) {
+        return {
+          stdout: "",
+          stderr: `Refusing to overwrite ${rel} \u2014 CallLint will not clobber a shared config file.
+Merge this fragment into it instead:
+
+${art.content}`,
+          exitCode: EXIT.USAGE
+        };
+      }
+      if (deps.writeFile === false) {
+        return { stdout: `Would write ${rel} (${art.label})`, exitCode: EXIT.OK };
+      }
+      try {
+        mkdirSync6(dirname6(abs2), { recursive: true });
+        writeFileSync11(abs2, art.content, "utf8");
+      } catch (e) {
+        return { stdout: "", stderr: `Failed to write ${rel}: ${e instanceof Error ? e.message : String(e)}`, exitCode: EXIT.ERROR };
+      }
+      return { stdout: `Wrote ${rel} (${art.label})`, exitCode: EXIT.OK };
+    }
+    return {
+      stdout: `${art.label} \u2014 merge this into ${rel} (a shared config file CallLint will not overwrite):
+
+${art.content}`,
+      exitCode: EXIT.OK
+    };
+  }
   if (deps.writeFile === false) {
     return { stdout: `Would write ${rel} (${art.label})`, exitCode: EXIT.OK };
   }
@@ -10041,7 +10138,7 @@ Run \`calllint guard install\` to list hosts.`,
       exitCode: EXIT.ERROR
     };
   }
-  const note = host === "git" ? `
+  const note = host === "git" || host === "git-pre-push" ? `
 Make it executable: chmod +x ${rel}` : "";
   return { stdout: `Wrote ${rel} (${art.label})${note}`, exitCode: EXIT.OK };
 }
@@ -10049,16 +10146,26 @@ function guardStatus(args, deps, env) {
   const approvedPath = flagStr(args.flags, "approved") ?? defaultApprovedPath(deps.cwd);
   const hasBaseline = existsSync12(approvedPath);
   const disabled = isDisabled(deps.cwd, env);
-  const gitHook = existsSync12(join17(deps.cwd, ".git", "hooks", "pre-commit"));
-  const ghWorkflow = existsSync12(join17(deps.cwd, ".github", "workflows", "calllint.yml"));
+  const HOST_STATUS_KEY = {
+    git: "git:pre-commit",
+    "git-pre-push": "git:pre-push",
+    github: "github:workflow",
+    copilot: "copilot:sessionStart",
+    "claude-code": "claude-code:sessionStart",
+    gemini: "gemini:sessionStart",
+    vscode: "vscode:folderOpen"
+  };
+  const installedHooks = {};
+  for (const host of GUARD_HOSTS) {
+    const art = guardArtifact(host);
+    const abs = join17(deps.cwd, art.path);
+    installedHooks[HOST_STATUS_KEY[host]] = hookInstalled(abs, art.posture);
+  }
   const status = {
     enabled: !disabled,
     disabledBy: disabled ? env["CALLLINT_GUARD"] === "0" ? "env:CALLLINT_GUARD=0" : "flag:.calllint/guard.json" : null,
     approvedBaseline: hasBaseline ? approvedPath : null,
-    installedHooks: {
-      "git:pre-commit": gitHook,
-      "github:workflow": ghWorkflow
-    }
+    installedHooks
   };
   if (flagBool(args.flags, "json")) {
     return { stdout: JSON.stringify(status), exitCode: EXIT.OK };
@@ -10066,11 +10173,21 @@ function guardStatus(args, deps, env) {
   const lines = [
     `Continuous Guard: ${status.enabled ? "enabled" : `disabled (${status.disabledBy})`}`,
     `Approved baseline: ${hasBaseline ? approvedPath : "none \u2014 run `calllint approve`"}`,
-    `git pre-commit hook: ${gitHook ? "installed" : "not installed"}`,
-    `GitHub workflow: ${ghWorkflow ? "installed" : "not installed"}`
+    ...GUARD_HOSTS.map(
+      (h2) => `${HOST_STATUS_KEY[h2]}: ${installedHooks[HOST_STATUS_KEY[h2]] ? "installed" : "not installed"}`
+    )
   ];
   return { stdout: lines.join("\n"), exitCode: EXIT.OK };
 }
+function hookInstalled(abs, posture) {
+  if (!existsSync12(abs)) return false;
+  if (posture === "dedicated") return true;
+  try {
+    return readFileSync19(abs, "utf8").includes("calllint guard");
+  } catch {
+    return false;
+  }
+}
 function guardSetEnabled(deps, enabled) {
   const cfg = { schemaVersion: "calllint.guard-config.v0", enabled };
   if (deps.writeFile === false) {
@@ -10093,6 +10210,291 @@ function guardSetEnabled(deps, enabled) {
   };
 }
 
+// src/commands/integrate.ts
+import { existsSync as existsSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync12, mkdirSync as mkdirSync7 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join18, resolve as resolve11 } from "node:path";
+
+// ../../packages/agent-triggers/src/overlays.ts
+var PLATFORM_OVERLAYS = {
+  "claude-code": {
+    host: "claude-code",
+    displayName: "Claude Code",
+    channels: ["plugin-hook", "cli-recommend"],
+    supportsRuntimeHook: true
+  },
+  cursor: {
+    host: "cursor",
+    displayName: "Cursor",
+    channels: ["cli-recommend", "ide-diagnostic"],
+    supportsRuntimeHook: false
+  },
+  windsurf: {
+    host: "windsurf",
+    displayName: "Windsurf",
+    channels: ["cli-recommend", "ide-diagnostic"],
+    supportsRuntimeHook: false
+  },
+  "claude-desktop": {
+    host: "claude-desktop",
+    displayName: "Claude Desktop",
+    channels: ["cli-recommend"],
+    supportsRuntimeHook: false
+  },
+  vscode: {
+    host: "vscode",
+    displayName: "VS Code",
+    channels: ["cli-recommend", "ide-diagnostic"],
+    supportsRuntimeHook: false
+  }
+};
+function overlayForHost(host) {
+  return PLATFORM_OVERLAYS[host] ?? null;
+}
+
+// src/commands/integrate.ts
+var CALLLINT_MCP_SERVER_NAME = "calllint";
+function calllintMcpEntry() {
+  return { command: "npx", args: ["-y", "calllint-mcp"] };
+}
+function integrableHosts() {
+  return Object.values(HOST_ADAPTERS).filter((a) => typeof a.applyPlan === "function").map((a) => a.id).sort();
+}
+function decideForIntegrate(authority) {
+  const policy = loadPolicyOrDefault();
+  const flows = buildFlows([authority]);
+  const flowReasons = foldFlowsIntoReasons(flows);
+  return decideOverAuthority({ authority, policy, flowReasons });
+}
+function integrateCommand(args, deps) {
+  const sub = args.positionals[0];
+  if (sub === "help") return integrateHelp();
+  if (sub !== void 0) {
+    return usage(`Unexpected argument "${sub}". Run \`calllint integrate help\`.`);
+  }
+  const apply = flagBool(args.flags, "apply");
+  return apply ? integrateApply(args, deps) : integratePlan(args, deps);
+}
+function integratePlan(args, deps) {
+  const only = flagStr(args.flags, "host");
+  const hosts = only ? [only] : integrableHosts();
+  const detected = detectHosts(deps.cwd, hosts);
+  const hostPlans = hosts.map((h2) => planForHost(h2, detected, deps));
+  const written = /* @__PURE__ */ new Map();
+  if (flagBool(args.flags, "write-plan") && deps.write !== false) {
+    for (const hp of hostPlans) {
+      if (hp.plan) written.set(hp.host, writePlanFile2(hp.plan, deps.cwd));
+    }
+  }
+  if (flagBool(args.flags, "json")) {
+    const payload = {
+      schema: "calllint.integrate-plan.v0",
+      generatedAt: deps.generatedAt,
+      hosts: hostPlans.map((hp) => ({
+        host: hp.host,
+        configPath: hp.configPath,
+        planDigest: hp.plan?.planDigest ?? null,
+        operations: hp.plan?.operations.length ?? 0,
+        planFile: written.get(hp.host) ?? null,
+        note: hp.note
+      }))
+    };
+    return { stdout: JSON.stringify(payload, null, 2), stderr: "", exitCode: EXIT.OK };
+  }
+  return { stdout: renderPlans(hostPlans, written), stderr: "", exitCode: EXIT.OK };
+}
+function writePlanFile2(plan, cwd) {
+  const planDir = join18(cwd, ".calllint", "plans");
+  mkdirSync7(planDir, { recursive: true });
+  const file = join18(planDir, `${plan.planId}.json`);
+  writeFileSync12(file, JSON.stringify(plan, null, 2) + "\n", "utf8");
+  return file;
+}
+function detectHosts(cwd, hosts) {
+  const result = discoverConfigs({ cwd, agentTypes: hosts, includeMissing: true });
+  const cwdPrefix = resolve11(cwd);
+  const byHost = /* @__PURE__ */ new Map();
+  for (const d of result.discovered) {
+    if (!resolve11(d.configPath).startsWith(cwdPrefix)) continue;
+    const prior = byHost.get(d.agentType);
+    if (!prior || !prior.exists && d.exists) byHost.set(d.agentType, d);
+  }
+  return byHost;
+}
+function planForHost(host, detected, deps) {
+  const adapter = getHostAdapter(host);
+  const overlay = overlayForHost(host);
+  const discovered = detected.get(host);
+  const configFromDiscovery = discovered?.configPath;
+  const configPath = configFromDiscovery ?? "(no default config path)";
+  if (!adapter || !adapter.applyPlan) {
+    return { host, configPath, plan: null, note: `host "${host}" has no audited writer (plan-only elsewhere)` };
+  }
+  if (!configFromDiscovery || !discovered?.exists) {
+    return { host, configPath, plan: null, note: `host "${host}" not detected on this machine` };
+  }
+  let currentConfig = null;
+  let configDigest = "absent";
+  if (existsSync13(configFromDiscovery)) {
+    try {
+      const bytes = readFileSync20(configFromDiscovery, "utf8");
+      configDigest = hashJson(bytes);
+      currentConfig = JSON.parse(bytes);
+    } catch {
+      return { host, configPath, plan: null, note: `host config exists but is not valid JSON: ${configFromDiscovery}` };
+    }
+  }
+  if (serverAlreadyPresent(currentConfig)) {
+    return { host, configPath, plan: null, note: "already integrated (calllint server present) \u2014 no change" };
+  }
+  const calllintServer = {
+    name: CALLLINT_MCP_SERVER_NAME,
+    sourceConfigPath: configFromDiscovery,
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "calllint-mcp"],
+    envKeys: [],
+    env: {},
+    providedTools: [],
+    raw: calllintMcpEntry()
+  };
+  const authority = buildAuthorityManifest({ artifactDigest: null, servers: [calllintServer], surfaces: [] });
+  const decision = decideForIntegrate(authority);
+  const backupPath = `${configFromDiscovery}.calllint-backup`;
+  const expiresAt = planExpiry2(deps.generatedAt);
+  const ctx = {
+    host,
+    tier: adapter.tier,
+    configPath: configFromDiscovery,
+    configDigest,
+    currentConfig,
+    servers: [{ name: CALLLINT_MCP_SERVER_NAME, entry: calllintMcpEntry() }],
+    backupPath,
+    expiresAt
+  };
+  const plan = adapter.createPlan(ctx, { artifactDigest: null, authority, decision });
+  return { host, configPath, plan, note: null };
+}
+function serverAlreadyPresent(config) {
+  if (!config || typeof config !== "object") return false;
+  const servers = config.mcpServers;
+  if (!servers || typeof servers !== "object") return false;
+  return Object.prototype.hasOwnProperty.call(servers, CALLLINT_MCP_SERVER_NAME);
+}
+function integrateApply(args, deps) {
+  const planFile = flagStr(args.flags, "plan");
+  const approve = flagStr(args.flags, "approve");
+  if (!planFile) return usage("Missing --plan <file>\nUsage: calllint integrate --apply --plan <plan.json> --approve <plan-digest>");
+  if (!approve) return usage("Missing --approve <plan-digest>\nApproval must name the exact plan digest you reviewed.");
+  let plan;
+  try {
+    plan = JSON.parse(readFileSync20(resolve11(deps.cwd, planFile), "utf8"));
+  } catch (err2) {
+    const e = err2;
+    return { stdout: "", stderr: e.code === "ENOENT" ? `Plan file not found: ${planFile}` : `Plan file is not valid JSON: ${e.message}`, exitCode: EXIT.ERROR };
+  }
+  if (plan?.schema !== "calllint.install-plan.v1") {
+    return { stdout: "", stderr: `Not a calllint.install-plan.v1 document: ${planFile}`, exitCode: EXIT.ERROR };
+  }
+  if (!verifyPlanDigest(plan)) {
+    return { stdout: "", stderr: "Plan digest does not match its contents (tampered or hand-edited). Re-run `calllint integrate` to regenerate.", exitCode: EXIT.ERROR };
+  }
+  const adapter = getHostAdapter(plan.host);
+  if (!adapter) return usage(`Unknown host "${plan.host}".`);
+  if (!adapter.applyPlan) return usage(`Host "${plan.host}" is tier ${adapter.tier} \u2014 plan-only; cannot apply.`);
+  const rawTarget = plan.operations[0]?.target;
+  if (!rawTarget) return usage("Plan has no operations to apply.");
+  let configPath;
+  try {
+    configPath = safeConfigPath(rawTarget, { cwd: deps.cwd, home: homedir2() });
+  } catch (err2) {
+    if (err2 instanceof PathSafetyError) return { stdout: "", stderr: `Unsafe target path in plan: ${err2.message}`, exitCode: EXIT.ERROR };
+    throw err2;
+  }
+  const rid = shortReceiptId(plan.planDigest, deps.generatedAt);
+  const backupPath = `${configPath}.calllint-backup-${rid}`;
+  const lockPath = join18(deps.cwd, ".calllint", "locks", `${hashJson(configPath).slice("sha256:".length, "sha256:".length + 16)}.lock`);
+  const result = adapter.applyPlan(plan, {
+    approvalDigest: approve,
+    configPath,
+    backupPath,
+    lockPath,
+    fs: nodeFsPort(),
+    now: deps.generatedAt
+  });
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(result, null, 2), stderr: "", exitCode: applyExitCode2(result) };
+  }
+  return { stdout: renderApply(result), stderr: "", exitCode: applyExitCode2(result) };
+}
+function planExpiry2(generatedAt) {
+  const ms = Date.parse(generatedAt);
+  if (Number.isNaN(ms)) return generatedAt;
+  return new Date(ms + 30 * 24 * 60 * 60 * 1e3).toISOString();
+}
+function shortReceiptId(planDigest, generatedAt) {
+  return hashJson({ planDigest, generatedAt }).slice("sha256:".length, "sha256:".length + 12);
+}
+function applyExitCode2(result) {
+  switch (result.outcome) {
+    case "applied":
+    case "already_applied":
+      return EXIT.OK;
+    case "stale":
+    case "conflict":
+      return EXIT.ERROR;
+    case "rolled_back":
+    case "rollback_failed":
+      return EXIT.ERROR;
+  }
+}
+function renderPlans(hostPlans, written) {
+  const lines = ["CallLint integrate \u2014 preflight install plan (read-only; nothing written)\n"];
+  for (const hp of hostPlans) {
+    if (hp.plan) {
+      lines.push(`  ${hp.host}: ${hp.plan.operations.length} op(s) \u2192 ${hp.configPath}`);
+      lines.push(`    plan digest: ${hp.plan.planDigest}`);
+      const planRef = written.get(hp.host) ?? "<saved-plan.json>";
+      lines.push(`    apply with:  calllint integrate --apply --plan ${planRef} --approve ${hp.plan.planDigest}`);
+    } else {
+      lines.push(`  ${hp.host}: no change \u2014 ${hp.note}`);
+    }
+  }
+  lines.push("\nInstalling the CallLint preflight server does not block your agent (ADR 0051); it recommends. CallLint never executes the servers it judges.");
+  return lines.join("\n") + "\n";
+}
+function renderApply(result) {
+  const head = `integrate apply: ${result.outcome} (${result.state}) \u2014 host ${result.host}`;
+  const trail = result.notes.map((n) => `  ${n}`).join("\n");
+  const rb = result.rolledBack ? "\n  rolled back to the original config (verify failed)." : "";
+  return `${head}
+${trail}${rb}
+`;
+}
+function integrateHelp() {
+  return {
+    stdout: [
+      "calllint integrate \u2014 install the CallLint preflight server into your agent hosts",
+      "",
+      "  calllint integrate                 detect hosts + print an install plan (read-only)",
+      "  calllint integrate --host cursor   plan for one host only",
+      "  calllint integrate --write-plan    persist each plan to .calllint/plans/<id>.json",
+      "  calllint integrate --json          machine-readable plan",
+      "  calllint integrate --apply --plan <p.json> --approve <digest>",
+      "                                     apply an approved plan (atomic, verified, auto-rollback)",
+      "",
+      "Idempotent: a host that already has the calllint server yields no change.",
+      "Plan-only by default; --apply is the only writer and reuses the audited",
+      "trust-apply engine. Installing the preflight does not block your agent (ADR 0051)."
+    ].join("\n") + "\n",
+    stderr: "",
+    exitCode: EXIT.OK
+  };
+}
+function usage(msg) {
+  return { stdout: "", stderr: msg, exitCode: EXIT.USAGE };
+}
+
 // src/run.ts
 function run(argv, deps) {
   const args = parseArgs(argv);
@@ -10171,6 +10573,8 @@ function run(argv, deps) {
       return evidenceCommand(args, { cwd: deps.cwd });
     case "trust":
       return trustCommand(args, { cwd: deps.cwd, generatedAt: deps.generatedAt, toolVersion: deps.toolVersion });
+    case "integrate":
+      return integrateCommand(args, { cwd: deps.cwd, generatedAt: deps.generatedAt, toolVersion: deps.toolVersion });
     case "guard":
       return guardCommand(args, {
         cwd: deps.cwd,
@@ -10451,13 +10855,13 @@ async function breathe(argv, deps = {}) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+import { readFileSync as readFileSync21 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname7, join as join18 } from "node:path";
+import { dirname as dirname7, join as join19 } from "node:path";
 function resolveToolVersion() {
   try {
-    const pkgPath = join18(dirname7(fileURLToPath(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync20(pkgPath, "utf8"));
+    const pkgPath = join19(dirname7(fileURLToPath(import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync21(pkgPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -10467,7 +10871,7 @@ function resolveToolVersion() {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync21(0, "utf8");
+    return readFileSync22(0, "utf8");
   } catch {
     return "";
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",
@@ -50,6 +50,7 @@
   "dependencies": {},
   "devDependencies": {
     "@calllint/action-analyzer": "workspace:*",
+    "@calllint/agent-triggers": "workspace:*",
     "@calllint/core": "workspace:*",
     "@calllint/discovery": "workspace:*",
     "@calllint/evidence": "workspace:*",