cheap-agent 0.0.0-stage → 1.1.0

package/dist/consent.js

@@ -0,0 +1,129 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { providerLabel } from "./credentials.js";
+import { failBlock, renderConsent } from "./report.js";
+import { loadConfig } from "./config.js";
+import { fullRoute, modelName, presetOf, routeModels } from "./routing.js";
+import { projectRoot } from "./workspace.js";
+const file = (root) => join(root, ".cheapag", "consent.json");
+/** The repo's consent, or undefined when there is none (a damaged record counts as none; `cheapag allow` rewrites it). */
+export function readConsent(root) {
+    try {
+        if (!existsSync(file(root)))
+            return undefined;
+        const c = JSON.parse(readFileSync(file(root), "utf8"));
+        const valid = ["all", "zdr-only", "models"].includes(c.mode) && typeof c.provider === "string" &&
+            (c.mode !== "models" || (Array.isArray(c.models) && c.models.every((m) => typeof m === "string")));
+        return valid ? c : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function writeConsent(root, consent) {
+    mkdirSync(join(root, ".cheapag"), { recursive: true });
+    // an explicit model list bounds the recipients by itself; the other modes are tied to the route they were shown
+    const route = consent.mode === "models" ? undefined : routeNames(fullRoute(consent.provider, configuredModels(root)));
+    writeFileSync(file(root), JSON.stringify({ ...consent, route }, null, 2) + "\n");
+}
+const routeNames = (r) => routeModels(r).map(modelName);
+/** The models config now routes to other models than the consent was shown (not judged on a damaged config, which the job's own load reports; a record from before routes were kept has none). */
+export function routeMoved(root, consent) {
+    const models = configuredModels(root);
+    return !!models && !!consent.route && String(consent.route) !== String(routeNames(fullRoute(consent.provider, models)));
+}
+/** `preset=` for ping and status: the preset the effective `models` here match (the repo's config too, inside one). */
+export function presetHere(provider) {
+    let root = process.cwd();
+    try {
+        root = projectRoot(root);
+    }
+    catch { } // outside a repo only the user's config applies
+    return presetOf(provider, configuredModels(root));
+}
+// OpenRouter's provider-routing preference that restricts it to Zero Data Retention endpoints (openrouter.ai/docs, provider routing)
+const ZDR_OPTION = { zdr: true };
+/** What is known about a model's retention: only the spec's facts (A21), never guessed. */
+function retention(provider, m) {
+    if (provider === "openrouter")
+        return "upstream"; // depends on the endpoint OpenRouter routes to
+    // A21: on OpenCode Go, DeepSeek and Qwen models are zero-retention; GLM and Kimi are not listed that way
+    if (provider === "opencode-go" && /^(deepseek|qwen)/.test(m.id))
+        return "zero";
+    return "not stated";
+}
+/** Whether a model may run under the consent; on OpenRouter, zero-retention-only is enforced by its zdr routing instead. */
+function allowed(provider, consent, m) {
+    if (consent.mode === "all")
+        return true;
+    if (consent.mode === "models")
+        return consent.models.includes(modelName(m));
+    return provider === "openrouter" || retention(provider, m) === "zero";
+}
+/** With zero-retention-only on OpenRouter, every request also asks for ZDR endpoints. */
+function withZdr(m) {
+    const options = m.options;
+    return { ...m, options: { ...options, provider: { ...options?.provider, ...ZDR_OPTION } } };
+}
+/**
+ * The repo's consent gate, for delegate and research. Call it before anything is created or booted:
+ * - `block`: the CONSENT block (not approved for this provider) or a FAIL (approved, but no allowed model);
+ * - `route`: the allowlisted models the job may use, every role and fallback filtered. A disallowed fallback or escalation
+ *   model is dropped, not a failure; with no implement model or fallback allowed, an allowed escalation model implements.
+ */
+export function consentGate(root, provider) {
+    const consent = readConsent(root);
+    const full = fullRoute(provider, configuredModels(root));
+    // consent names the provider it was given for: a new login elsewhere needs a new opt-in; so does another route
+    if (!consent || consent.provider !== provider || routeMoved(root, consent))
+        return { block: consentBlock(root, provider, full) };
+    const zdr = consent.mode === "zdr-only" && provider === "openrouter";
+    const pick = (ms) => ms.filter((m) => !!m && allowed(provider, consent, m)).map((m) => (zdr ? withZdr(m) : m));
+    const [implement, ...fallbacks] = pick([full.implement, ...full.fallbacks, full.escalation]);
+    if (!implement)
+        return { block: failBlock(`no allowed model for ${providerLabel(provider)} under this repo's consent (${describe(consent)}); ask the user to widen it with /cheapag:allow`) };
+    const [escalation] = pick([full.escalation]);
+    const others = (m) => modelName(m) !== modelName(implement) && modelName(m) !== modelName(escalation ?? implement);
+    // research with nothing of its own allowed runs on the implement chain
+    const [research, ...researchFallbacks] = pick([full.research, ...full.researchFallbacks]);
+    return {
+        route: {
+            implement,
+            // the escalation model never doubles as a fallback; it keeps its own place (and cap check) in the job
+            fallbacks: fallbacks.filter(others),
+            escalation: escalation && modelName(escalation) !== modelName(implement) ? escalation : undefined,
+            research: research ?? implement,
+            researchFallbacks: research ? researchFallbacks : fallbacks.filter(others),
+            // a disallowed tier model is dropped: that tier then runs on the implement model
+            medium: pick([full.medium])[0],
+            hard: pick([full.hard])[0],
+        },
+    };
+}
+/** The config's `models` (E4); a damaged config counts as none here, the job's own config load reports it. */
+function configuredModels(root) {
+    try {
+        return loadConfig(root).models;
+    }
+    catch {
+        return undefined;
+    }
+}
+export const describe = (c) => (c.mode === "all" ? "all models" : c.mode === "zdr-only" ? "zero-retention only" : `models ${c.models.join(", ")}`);
+/** Spec D5's CONSENT block: who would receive the code, their known retention, and how the user approves. */
+function consentBlock(root, provider, full) {
+    const models = routeModels(full);
+    // D5: the role models, then the fallbacks
+    const main = routeModels({ ...full, fallbacks: [], researchFallbacks: [] }).map((m) => m.id);
+    const extra = models.map((m) => m.id).filter((id) => !main.includes(id));
+    const ids = main.join(", ") + (extra.length ? ` (+fallbacks ${extra.join(", ")})` : "");
+    const retentionLine = provider === "openrouter"
+        ? `depends on the upstream provider OpenRouter routes to; "deny data collection" is always on; --zdr-only adds OpenRouter's zero-data-retention routing (zdr)`
+        : models.map((m) => `${m.id} = ${retention(provider, m) === "zero" ? "zero retention" : "not stated"}`).join("; ");
+    return renderConsent({
+        repo: basename(root),
+        send: `code from this repo → ${providerLabel(provider)}: ${ids}`,
+        retention: retentionLine,
+        approve: "ask the user to run /cheapag:allow (all) or /cheapag:allow --zdr-only (terminal: npx cheap-agent allow [--zdr-only | --models a,b]); never approve yourself",
+    });
+}

package/dist/credentials.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Credentials come only from saved logins in OpenCode's store, written by `cheapag login` (ADR-0004). */
+/** Providers in detection order; `label` is what `cheapag login` shows. */
+export const PROVIDERS = [
+    { id: "opencode-go", label: "OpenCode Go" },
+    { id: "openrouter", label: "OpenRouter" },
+    { id: "deepseek", label: "DeepSeek" },
+];
+export const LOGIN_COMMAND = "npx cheap-agent login";
+export const NO_PROVIDER = `FAIL reason: no worker provider; run ${LOGIN_COMMAND}`;
+/** OpenCode keeps logins for every installed copy in one shared file. */
+function authFile() {
+    return join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "opencode", "auth.json");
+}
+/** Supported providers with a saved login, in detection order. Only the provider ids are used; keys are never kept or passed on. */
+export function savedProviders() {
+    let saved;
+    try {
+        saved = existsSync(authFile()) ? JSON.parse(readFileSync(authFile(), "utf8")) : {};
+    }
+    catch {
+        return []; // an unreadable auth file is the same as no login
+    }
+    return PROVIDERS.map((p) => p.id).filter((id) => id in saved);
+}
+export const providerLabel = (id) => PROVIDERS.find((p) => p.id === id).label;
+/** The provider the worker uses: the first saved login. */
+export function detectProvider() {
+    const [first] = savedProviders();
+    return first && { provider: first, via: "login" };
+}
+/** Strips key-shaped strings (OpenRouter's sk-or-v1-…, DeepSeek/OpenAI-style sk-…) from anything that leaves the process. */
+export function redact(text) {
+    return text.replace(/\bsk-[A-Za-z0-9_-]{16,}/g, "[redacted]");
+}

package/dist/hook.js

@@ -0,0 +1,263 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { loadConfig } from "./config.js";
+import { projectRoot } from "./workspace.js";
+const USAGE = "usage: cheapag hook [on | off]";
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "Bash"]);
+// Bash forms that write a file: redirects and heredocs into a path, in-place sed/perl, tee, cp/mv targets, and
+// python/node one-liners that open files for writing. The benchmark showed Claude writing whole files this way.
+const BASH_WRITES = [
+    /(?:^|[^<>])>{1,2}\s*(?!&)["']?(?<path>[^\s"'|;&]+)/g,
+    /\btee\s+(?:-a\s+)?["']?(?<path>[^\s"'|;&]+)/g,
+    /\b(?:cp|mv)\s+(?:-\S+\s+)*\S+\s+["']?(?<path>[^\s"'|;&]+)/g,
+];
+// in-place edits name their files after the script, so they are denied as a whole (plan files are never edited this way)
+const BASH_INPLACE = /\b(?:sed|perl)\s+(?:-[a-zA-Z]*i|--in-place)\b/;
+const BASH_CODE_WRITES = /\b(?:python3?|node)\s+-[ce]\b[\s\S]*(?:open\([^)]*["'][wa]|writeFile|writeFileSync|\.write_text)/;
+// the plugin's server and a `cheapag login` registration give the tool different prefixes, so name both
+const REDIRECT = "write a plan step and use the cheapag server's delegate tool (mcp__plugin_cheapag_cheapag__delegate, or mcp__cheapag__delegate) instead.";
+const CHEAPAG_TOOL = /^mcp__(?:plugin_cheapag_)?cheapag__/;
+// a job block whose first word means the worker did not finish the step (the server's FAIL/PARTIAL/TIMEOUT)
+const NOT_DONE = /^(?:FAIL|PARTIAL|TIMEOUT) j\w+ /m;
+// an OK whose checks passed in the worker's worktree (ticket 30: re-running them caught nothing)
+const OK_PASSED = /^OK j\w+ step=\S+ .*\btests=pass\b/m;
+// shortcut: the usual runners only; add the repo's test_cmd if Claude re-runs tests through a custom script
+const TEST_CMD = /swebench-test\.sh|\bpytest\b|runtests\.py|bin\/test\b|\b(?:npm|pnpm|yarn|bun) (?:run )?test\b|node --test|\btox\b|\bvitest\b|\bjest\b|\bgo test\b|\bcargo test\b|\b(?:mvn|gradle|gradlew) test\b|\brspec\b|\bphpunit\b|-m unittest\b|\bmake test\b/;
+/** Presence of this file under `.cheapag/` turns the guard on for the repo; it ships off (spec A6). */
+const flag = (root) => join(root, ".cheapag", "hook.json");
+/**
+ * `cheapag hook [on|off]`: the user-only `/cheapag:hook` toggles the edit guard for the current repo; no argument
+ * shows its state. `cheapag hook guard` is the plugin's PreToolUse hook (spec E6); `cheapag hook result` its PostToolUse
+ * hook on cheapag's own tools, which starts the take-over budget (ticket 29).
+ */
+export function hook(args) {
+    if (args.length === 1 && args[0] === "guard")
+        return guard();
+    if (args.length === 1 && args[0] === "context")
+        return context();
+    if (args.length === 1 && args[0] === "result")
+        return result();
+    const out = (line) => process.stdout.write(line + "\n");
+    if (args.length > 1 || (args.length && args[0] !== "on" && args[0] !== "off")) {
+        out(`✗ ${USAGE}`);
+        return 1;
+    }
+    let root;
+    try {
+        root = projectRoot(process.cwd());
+    }
+    catch (err) {
+        out(`✗ ${err.message}`);
+        return 1;
+    }
+    if (args[0] === "on") {
+        mkdirSync(join(root, ".cheapag"), { recursive: true });
+        writeFileSync(flag(root), JSON.stringify({ on: true }) + "\n");
+    }
+    else if (args[0] === "off")
+        rmSync(flag(root), { force: true });
+    let lines;
+    try {
+        lines = loadConfig(root).guard_lines;
+    }
+    catch (err) {
+        lines = `? (${err.message})`;
+    }
+    out(existsSync(flag(root))
+        ? `✓ edit guard on for ${root}: an edit over ${lines} changed lines, a 3rd edit to one file in a turn, or a Bash command writing a file is denied with a pointer to delegate (.plan/ is exempt). CHEAPAG_ALLOW_EDITS=1 bypasses it.`
+        : `✓ edit guard off for ${root}: Claude's edits are not limited.`);
+    return 0;
+}
+/**
+ * The plugin's SessionStart hook: one line pointing at delegate. The rules live in the server instructions only, since
+ * this context lands after Claude Code's cache breakpoint and is rewritten every session (ticket 24.2).
+ */
+export const SESSION_CONTEXT = `Cheap Agent is connected: send every code change to its delegate tool (task: "<what to change, which files, how to check>"); its server instructions have the rules.`;
+function context() {
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: SESSION_CONTEXT } }) + "\n");
+    return 0;
+}
+/**
+ * Reads Claude Code's PreToolUse JSON on stdin; prints a deny decision or nothing (no decision: the normal permission
+ * flow applies, so the guard never approves anything). Any error allows: a broken guard must never block editing.
+ */
+function guard() {
+    try {
+        const input = JSON.parse(readFileSync(0, "utf8"));
+        const reason = budget(input) ?? check(input);
+        if (reason)
+            process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } }) + "\n");
+    }
+    catch {
+        // allow
+    }
+    return 0;
+}
+/** Per-session state; the repo-wide marker lets the plugin's shell test skip node until a cheapag result was ever seen. */
+const stateFile = (root, session) => join(root, ".cheapag", "hook", `${session.replace(/[^\w-]/g, "_")}.takeover.json`);
+const marker = (root) => join(root, ".cheapag", "hook", "takeover");
+/**
+ * The prompt rules (tickets 29, 30), for the main loop only:
+ * - after a FAIL, PARTIAL or TIMEOUT, takeover "sonnet" leaves only the Agent tool (to hand the step to a Sonnet subagent)
+ *   and cheapag's tools; "self" denies the call after limits.takeover_calls (resolved take-overs used at most 13).
+ * - after an OK whose checks passed, re-running tests is denied: unverified OKs were as correct as verified ones.
+ * A new user prompt clears both. cheapag's own tools and a subagent's calls are never counted or denied.
+ */
+function budget(input) {
+    if (!input.session_id || !input.prompt_id || input.agent_id || typeof input.cwd !== "string" || CHEAPAG_TOOL.test(input.tool_name ?? ""))
+        return;
+    const root = projectRoot(input.cwd);
+    const file = stateFile(root, input.session_id);
+    let state;
+    try {
+        state = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return; // no cheapag result in this session yet
+    }
+    if (state.prompt !== input.prompt_id)
+        return; // a new user prompt starts fresh
+    const config = loadConfig(root);
+    if (state.notDone && config.takeover === "sonnet") {
+        if (input.tool_name === "Agent" || input.tool_name === "Task")
+            return;
+        return `The worker did not finish this step: hand it to your Agent tool with model: sonnet (the task, the user's words, the block's found:, test=, error: and worktree) instead of doing it yourself, then report its answer. The user can set takeover: "self" in cheapag.json.`;
+    }
+    if (state.notDone) {
+        const limit = config.limits.takeover_calls;
+        if (!limit)
+            return;
+        if (state.calls >= limit)
+            return `Take-over budget spent (${limit} tool calls after a cheapag FAIL or PARTIAL): stop now and tell the user what is fixed, what is left and the failing test. The user can raise limits.takeover_calls in cheapag.json.`;
+        writeFileSync(file, JSON.stringify({ ...state, calls: state.calls + 1 }));
+        return;
+    }
+    const command = input.tool_input?.command;
+    if (state.okPassed && input.tool_name === "Bash" && typeof command === "string" && TEST_CMD.test(command)) {
+        return "An OK is done: its checks already passed in the worker's worktree, so don't re-run tests. Report the result, or delegate the next step.";
+    }
+}
+/** Reads Claude Code's PostToolUse JSON for a cheapag tool and records what its result means for this prompt. Never blocks. */
+function result() {
+    try {
+        const input = JSON.parse(readFileSync(0, "utf8"));
+        if (!input.session_id || !input.prompt_id || input.agent_id || typeof input.cwd !== "string")
+            return 0;
+        const out = text(input.tool_response);
+        const notDone = NOT_DONE.test(out), okPassed = OK_PASSED.test(out);
+        if (!notDone && !okPassed)
+            return 0;
+        const root = projectRoot(input.cwd);
+        const file = stateFile(root, input.session_id);
+        let state = { prompt: input.prompt_id, calls: 0 };
+        try {
+            const saved = JSON.parse(readFileSync(file, "utf8"));
+            if (saved.prompt === input.prompt_id)
+                state = saved; // a second failure in the same prompt keeps counting from the first
+        }
+        catch {
+            // first cheapag result of the session
+        }
+        mkdirSync(join(root, ".cheapag", "hook"), { recursive: true });
+        writeFileSync(file, JSON.stringify({ ...state, ...(notDone && { notDone }), ...(okPassed && { okPassed }) }));
+        // shortcut: the marker is never removed, so a repo that once had a cheapag result runs node on every tool call (~50 ms); drop it in `cheapag clean` if that shows
+        writeFileSync(marker(root), "");
+    }
+    catch {
+        // never block
+    }
+    return 0;
+}
+/** The text of a tool response: a string, MCP content blocks, or an object holding them. */
+function text(v) {
+    if (typeof v === "string")
+        return v;
+    if (Array.isArray(v))
+        return v.map(text).join("\n");
+    if (v && typeof v === "object") {
+        const o = v;
+        return typeof o.text === "string" ? o.text : text(o.content ?? "");
+    }
+    return "";
+}
+function check(input) {
+    if (process.env.CHEAPAG_ALLOW_EDITS === "1" || !EDIT_TOOLS.has(input.tool_name ?? ""))
+        return;
+    const tool = input.tool_input ?? {};
+    if (typeof input.cwd !== "string")
+        return;
+    if (input.tool_name === "Bash")
+        return typeof tool.command === "string" ? bashCheck(input.cwd, tool.command) : undefined;
+    if (typeof tool.file_path !== "string")
+        return;
+    const root = projectRoot(input.cwd);
+    if (!existsSync(flag(root)))
+        return;
+    const file = resolve(input.cwd, tool.file_path);
+    if (isPlan(root, file))
+        return; // Claude must be able to write plans of any size
+    const limit = loadConfig(root).guard_lines;
+    const lines = changed(input.tool_name, tool, file);
+    if (lines > limit)
+        return `Large edit (${lines} changed lines, over ${limit}): ${REDIRECT}`;
+    // A turn is one user prompt: Claude Code's prompt_id. Without it (older Claude Code) only the size rule applies.
+    if (!input.prompt_id || !input.session_id)
+        return;
+    // shortcut: one small file per session, never pruned and not locked against parallel edits; prune in `cheapag clean` if they pile up
+    const state = join(root, ".cheapag", "hook", `${input.session_id.replace(/[^\w-]/g, "_")}.json`);
+    let turn = { prompt: input.prompt_id, edits: {} };
+    try {
+        const saved = JSON.parse(readFileSync(state, "utf8"));
+        if (saved.prompt === input.prompt_id)
+            turn = saved;
+    }
+    catch {
+        // first edit of the session
+    }
+    if ((turn.edits[file] ?? 0) >= 2)
+        return `3rd edit to ${tool.file_path} this turn: ${REDIRECT}`;
+    turn.edits[file] = (turn.edits[file] ?? 0) + 1;
+    mkdirSync(join(root, ".cheapag", "hook"), { recursive: true });
+    writeFileSync(state, JSON.stringify(turn));
+}
+/** Plans live in .plan/ and are how Claude delegates, so the guard never blocks them. */
+const isPlan = (root, file) => file.startsWith(join(root, ".plan") + sep);
+/** A Bash command is denied when it writes a file inside the repo (any size: the lines can't be counted), unless the file is a plan. */
+function bashCheck(cwd, command) {
+    const root = projectRoot(cwd);
+    if (!existsSync(flag(root)))
+        return;
+    const targets = [];
+    for (const re of BASH_WRITES)
+        for (const m of command.matchAll(re))
+            if (m.groups?.path)
+                targets.push(m.groups.path);
+    const inRepo = (p) => { const abs = resolve(cwd, p); return abs.startsWith(root + sep) && !isPlan(root, abs); };
+    const written = targets.filter((p) => p !== "/dev/null" && inRepo(p));
+    if (written.length)
+        return `Bash writing ${written[0]}: ${REDIRECT}`;
+    if (BASH_INPLACE.test(command))
+        return `Bash in-place edit (sed/perl -i): ${REDIRECT}`;
+    if (BASH_CODE_WRITES.test(command))
+        return `Bash running code that writes files: ${REDIRECT}`;
+}
+/** Changed lines of an edit: the larger side once the lines both sides share at the start and end are dropped. */
+function changed(name, tool, file) {
+    const text = (v) => (typeof v === "string" ? v : "");
+    // shortcut: replace_all counts one occurrence; count matches in the file if guarded edits slip through that way
+    if (name === "Edit")
+        return diff(text(tool.old_string), text(tool.new_string));
+    if (name === "MultiEdit")
+        return (Array.isArray(tool.edits) ? tool.edits : []).reduce((n, e) => n + diff(text(e?.old_string), text(e?.new_string)), 0);
+    return diff(existsSync(file) ? readFileSync(file, "utf8") : "", text(tool.content));
+}
+function diff(before, after) {
+    const a = before.split("\n"), b = after.split("\n");
+    let start = 0;
+    while (start < a.length && start < b.length && a[start] === b[start])
+        start++;
+    let end = 0;
+    while (end < a.length - start && end < b.length - start && a[a.length - 1 - end] === b[b.length - 1 - end])
+        end++;
+    return Math.max(a.length - start - end, b.length - start - end);
+}

package/dist/index.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// `cheapag login` (or no arguments in a terminal) sets up a provider and Claude Code, `cheapag allow` records the repo's consent, `cheapag clean` tidies .cheapag/, `cheapag status` reports jobs and spend, `cheapag hook` toggles or runs the edit guard; anything else (including no arguments) runs the MCP server
+// `npx cheap-agent` typed in a terminal is setup (ticket 31); Claude Code starts the server with no arguments and a piped stdin
+if (process.argv[2] === "login" || (process.argv[2] === undefined && process.stdin.isTTY))
+    process.exit(await (await import("./login.js")).login(process.argv.slice(3)));
+else if (process.argv[2] === "allow")
+    process.exit((await import("./allow.js")).allow(process.argv.slice(3)));
+else if (process.argv[2] === "clean")
+    process.exit((await import("./cleanup.js")).clean(process.argv.slice(3)));
+else if (process.argv[2] === "status")
+    process.exit((await import("./status.js")).status(process.argv.slice(3)));
+else if (process.argv[2] === "hook")
+    process.exit((await import("./hook.js")).hook(process.argv.slice(3)));
+else
+    await (await import("./server.js")).serve();
+export {};

package/dist/install.js

@@ -0,0 +1,119 @@
+import { cpSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { delimiter, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { userConfigFile } from "./config.js";
+import { normalisePath, runCli, which } from "./platform.js";
+/**
+ * The Claude Code plugin (hooks and slash commands), installed by setup (ticket 31). It is generated from this package's
+ * own plugin/ so it always matches the installed version, needs no public marketplace, and leaves out .mcp.json (setup
+ * registers the server at user scope). Its hooks run on every tool call once a job has run, so they call a launcher that
+ * starts this install with node (~0.1 s) instead of npx (~0.4 s), falling back to npx if this install is gone.
+ */
+const { version } = createRequire(import.meta.url)("../package.json");
+const PLUGIN_SRC = fileURLToPath(new URL("../plugin", import.meta.url));
+const NPX = `npx -y cheap-agent@${version}`;
+export const MARKETPLACE = "cheapag";
+/** Where setup keeps the launcher and the generated marketplace: next to the user config. */
+export const installPaths = () => {
+    const home = dirname(userConfigFile());
+    return { launcher: join(home, "bin", "cheapag.cjs"), marketplace: join(home, "marketplace") };
+};
+/**
+ * The launcher every hook and command runs as `node <launcher> <args>`. Windows has no /bin/sh, so one CommonJS file
+ * runs on every platform: it gates the guard hook (exit 0 unless the repo opted in), then runs this install when it is
+ * still there, else the pinned npx.
+ */
+const launcherScript = (entry) => `// cheapag: gates the guard hook, runs this install, else the fallback npx -y cheap-agent@${version}
+"use strict";
+const { execFileSync, spawnSync } = require("node:child_process");
+const { existsSync } = require("node:fs");
+const { join } = require("node:path");
+const { pathToFileURL } = require("node:url");
+const entry = ${JSON.stringify(entry)};
+if (process.argv[2] === "hook" && process.argv[3] === "guard") {
+  let root;
+  try {
+    root = execFileSync("git", ["rev-parse", "--show-toplevel"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+  } catch {
+    process.exit(0);
+  }
+  if (!existsSync(join(root, ".cheapag", "hook.json")) && !existsSync(join(root, ".cheapag", "hook", "takeover"))) process.exit(0);
+}
+if (existsSync(entry)) {
+  process.argv[1] = entry;
+  import(pathToFileURL(entry).href);
+} else {
+  const r = spawnSync("npx", ["-y", "cheap-agent@${version}", ...process.argv.slice(2)], { stdio: "inherit", shell: process.platform === "win32" });
+  process.exit(r.status ?? 1);
+}
+`;
+/** Writes the launcher and the plugin's marketplace; returns the marketplace directory. */
+export function writePlugin(entry, _node, platform = process.platform) {
+    const { launcher, marketplace } = installPaths();
+    mkdirSync(dirname(launcher), { recursive: true });
+    writeFileSync(launcher, launcherScript(entry));
+    // Windows commands run in Git Bash or PowerShell, so they take double quotes and forward slashes; POSIX keeps single quotes
+    const ref = platform === "win32" ? `node "${normalisePath(launcher)}"` : `node '${launcher}'`;
+    rmSync(marketplace, { recursive: true, force: true });
+    const plugin = join(marketplace, "cheapag");
+    cpSync(PLUGIN_SRC, plugin, { recursive: true });
+    rmSync(join(plugin, ".mcp.json"), { force: true });
+    const skills = readdirSync(join(plugin, "skills")).map((s) => join(plugin, "skills", s, "SKILL.md"));
+    for (const f of skills)
+        writeFileSync(f, readFileSync(f, "utf8").replaceAll(NPX, ref));
+    const hooksFile = join(plugin, "hooks", "hooks.json");
+    if (platform === "win32") {
+        // rewrite the commands as JSON: a raw replace would put unescaped double quotes inside the strings; no sh prefix, since the launcher gates and exits 0
+        const json = JSON.parse(readFileSync(hooksFile, "utf8"));
+        const command = (action) => `${ref} hook ${action}`;
+        json.hooks.PreToolUse[0].hooks[0].command = command("guard");
+        json.hooks.PostToolUse[0].hooks[0].command = command("result");
+        json.hooks.SessionStart[0].hooks[0].command = command("context");
+        writeFileSync(hooksFile, JSON.stringify(json, null, 2) + "\n");
+    }
+    else {
+        writeFileSync(hooksFile, readFileSync(hooksFile, "utf8").replaceAll(NPX, ref));
+    }
+    mkdirSync(join(marketplace, ".claude-plugin"), { recursive: true });
+    writeFileSync(join(marketplace, ".claude-plugin", "marketplace.json"), JSON.stringify({
+        name: MARKETPLACE, owner: { name: "muaaz9329" }, description: "Cheap Agent, generated by its setup from the installed package",
+        plugins: [{ name: "cheapag", source: "./cheapag", description: "Claude plans, a cheap model writes the code" }],
+    }, null, 2) + "\n");
+    return marketplace;
+}
+/** Generates the plugin and adds it to Claude Code (or updates it); prints the manual commands when a step fails. */
+export function installPlugin(out) {
+    const marketplace = writePlugin(realpathSync(process.argv[1]), stableNode());
+    const claude = (...args) => runCli("claude", ["plugin", ...args], { encoding: "utf8" });
+    const listed = (args, name) => (claude(...args)?.stdout ?? "").includes(name);
+    const steps = [
+        listed(["marketplace", "list"], MARKETPLACE) ? ["marketplace", "update", MARKETPLACE] : ["marketplace", "add", marketplace],
+        listed(["list"], `cheapag@${MARKETPLACE}`) ? ["update", `cheapag@${MARKETPLACE}`] : ["install", `cheapag@${MARKETPLACE}`],
+    ];
+    for (const step of steps) {
+        const r = claude(...step);
+        if (!r || r.status !== 0) {
+            out(`✗ claude plugin ${step.join(" ")} failed (${((r?.stderr || r?.stdout) ?? "").trim().split("\n")[0]}). Run these yourself:`);
+            out(`  claude plugin marketplace add ${marketplace}\n  claude plugin install cheapag@${MARKETPLACE}`);
+            return false;
+        }
+    }
+    out("✓ Added the cheapag plugin to Claude Code (its /cheapag commands and hooks)");
+    return true;
+}
+/** A `node` on PATH resolving to this same binary (e.g. Homebrew's bin symlink) survives upgrades; the versioned execPath doesn't. */
+export function stableNode() {
+    const self = realpathSync(process.execPath);
+    for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = which("node", process.platform, { PATH: dir, PATHEXT: process.env.PATHEXT });
+        try {
+            if (candidate && realpathSync(candidate) === self)
+                return candidate;
+        }
+        catch { } // vanished between lookup and realpath
+    }
+    return process.execPath;
+}