expandai 0.0.2 → 0.0.3

package/src/Init/Status.ts

@@ -0,0 +1,253 @@
+import { DateTime, Effect, Option, Schema } from 'effect'
+import {
+	CLI_AUTHORIZATION_CLIENT_ID,
+	PendingInitCorrupt,
+	type PendingInitKey,
+	PendingInitRecord,
+} from '../Auth/Domain.js'
+import { PendingInitStore } from '../Auth/PendingInit.js'
+import { authMethodState } from '../Authentication.js'
+import { ConfigManager, ConfigParseError, CredentialStoreInsecure, NotAuthenticated } from '../Config.js'
+import { CLI_VERSION } from '../Version.js'
+import { CLAUDE_POLICY_READ_ONLY } from './ClaudeProfile.js'
+import { InitHarness, InitScope } from './Domain.js'
+import type { HarnessInspection } from './HarnessAdapter.js'
+import { HarnessRegistry } from './HarnessRegistry.js'
+
+const VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u
+const BoundedVersion = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(64), Schema.pattern(VERSION_PATTERN))
+
+export class StatusRequest extends Schema.Class<StatusRequest>('StatusRequest')({
+	harness: InitHarness,
+	scope: InitScope,
+}) {}
+
+const StatusAuth = Schema.Struct({
+	// `healthy` means a call would authenticate right now. An expired access
+	// token with a refresh token on disk reports `refresh_required`, because the
+	// renewal has not happened and can fail.
+	state: Schema.Literal('absent', 'unusable', 'refresh_required', 'healthy'),
+	healthy: Schema.Boolean,
+})
+
+const PendingAuthorization = Schema.Union(
+	Schema.Struct({ state: Schema.Literal('none'), count: Schema.Literal(0) }),
+	Schema.Struct({
+		state: Schema.Literal('approval_pending'),
+		count: Schema.Literal(1),
+		approvalExpiresAt: Schema.DateTimeUtc,
+	}),
+)
+
+const StatusInstallation = Schema.Struct({
+	configured: Schema.Boolean,
+	integrationVersion: Schema.optional(BoundedVersion),
+	components: Schema.Struct({
+		webfetchHook: Schema.Boolean,
+		runtimeSkill: Schema.Boolean,
+		mcp: Schema.Boolean,
+	}),
+	runtimeState: Schema.Literal('unverified', 'reload_required', 'blocked'),
+	reloadState: Schema.Literal('not_required', 'required'),
+	consentState: Schema.Literal('not_required', 'may_be_required'),
+	policyState: Schema.Literal('unverified', 'blocked'),
+	policyCodes: Schema.Array(Schema.Literal('managed_policy_blocked', 'target_read_only')).pipe(Schema.maxItems(1)),
+})
+
+export class StatusResult extends Schema.Class<StatusResult>('StatusResult')({
+	schemaVersion: Schema.Literal(1),
+	status: Schema.Literal('ok'),
+	harness: InitHarness,
+	scope: InitScope,
+	cli: Schema.Struct({ version: BoundedVersion }),
+	auth: StatusAuth,
+	pendingAuthorization: PendingAuthorization,
+	installation: StatusInstallation,
+}) {}
+
+export const StatusServiceErrorCode = Schema.Literal(
+	'credential_config_malformed',
+	'credential_storage_insecure',
+	'credential_health_failed',
+	'pending_state_malformed',
+	'pending_state_unavailable',
+	'harness_inspection_failed',
+	'invalid_status_result',
+)
+
+export class StatusServiceError extends Schema.TaggedError<StatusServiceError>()('StatusServiceError', {
+	code: StatusServiceErrorCode,
+	recoverable: Schema.Boolean,
+}) {
+	get message() {
+		switch (this.code) {
+			case 'credential_config_malformed':
+				return 'Stored credential configuration is malformed.'
+			case 'credential_storage_insecure':
+				return 'Credential storage is not secure enough to inspect.'
+			case 'credential_health_failed':
+				return 'Stored credentials could not be inspected safely.'
+			case 'pending_state_malformed':
+				return 'Pending authorization state is malformed.'
+			case 'pending_state_unavailable':
+				return 'Pending authorization state could not be inspected safely.'
+			case 'harness_inspection_failed':
+				return 'The harness configuration could not be inspected safely.'
+			case 'invalid_status_result':
+				return 'Local diagnostics returned an invalid result.'
+		}
+	}
+}
+
+function statusError(code: typeof StatusServiceErrorCode.Type, recoverable: boolean): StatusServiceError {
+	return new StatusServiceError({ code, recoverable })
+}
+
+function mapCredentialError(error: unknown): StatusServiceError {
+	if (error instanceof ConfigParseError) return statusError('credential_config_malformed', false)
+	if (error instanceof CredentialStoreInsecure) return statusError('credential_storage_insecure', false)
+	return statusError('credential_health_failed', false)
+}
+
+function mapPendingError(error: unknown): StatusServiceError {
+	if (error instanceof CredentialStoreInsecure) return statusError('credential_storage_insecure', false)
+	return error instanceof PendingInitCorrupt
+		? statusError('pending_state_malformed', true)
+		: statusError('pending_state_unavailable', true)
+}
+
+function authStatus(configManager: ConfigManager) {
+	return Effect.gen(function* () {
+		const loaded = yield* Effect.either(configManager.loadConfig())
+		if (loaded._tag === 'Left') {
+			if (loaded.left instanceof NotAuthenticated) return { state: 'absent' as const, healthy: false }
+			return yield* mapCredentialError(loaded.left)
+		}
+		const now = yield* DateTime.now
+		const state = authMethodState(loaded.right.authMethod, now)
+		return { state, healthy: state === 'healthy' }
+	})
+}
+
+function pendingStatus(record: Option.Option<PendingInitRecord>) {
+	return Effect.gen(function* () {
+		if (Option.isNone(record)) return { state: 'none' as const, count: 0 as const }
+		const now = DateTime.toEpochMillis(yield* DateTime.now)
+		if (DateTime.toEpochMillis(record.value.approvalExpiresAt) <= now) {
+			return { state: 'none' as const, count: 0 as const }
+		}
+		return {
+			state: 'approval_pending' as const,
+			count: 1 as const,
+			approvalExpiresAt: DateTime.formatIso(record.value.approvalExpiresAt),
+		}
+	})
+}
+
+function validateInspection(
+	harness: typeof InitHarness.Type,
+	inspection: HarnessInspection,
+): Effect.Effect<HarnessInspection, StatusServiceError> {
+	const componentSet = new Set(inspection.components)
+	// Only the harnesses with a web-fetch hook install three components; cursor
+	// and codex are complete with two. Demanding three of them reported a
+	// correctly configured machine as an invalid result.
+	const expectsHook = harness === 'claude-code' || harness === 'opencode'
+	const allComponents =
+		componentSet.has('runtime-skill') &&
+		componentSet.has('mcp') &&
+		(expectsHook ? componentSet.has('webfetch-hook') && componentSet.size === 3 : componentSet.size === 2)
+	const versionValid =
+		inspection.integrationVersion === undefined ||
+		(inspection.integrationVersion.length <= 64 && VERSION_PATTERN.test(inspection.integrationVersion))
+	const configuredValid = inspection.configured === allComponents
+	const runtimeValid = inspection.runtimeState !== 'observed'
+	return componentSet.size === inspection.components.length && versionValid && configuredValid && runtimeValid
+		? Effect.succeed(inspection)
+		: statusError('invalid_status_result', false)
+}
+
+function installationStatus(inspection: HarnessInspection, scope: typeof InitScope.Type) {
+	const components = new Set(inspection.components)
+	const policyBlocked = inspection.policyBlock !== undefined || inspection.runtimeState === 'blocked'
+	const policyCodes =
+		inspection.policyBlock === CLAUDE_POLICY_READ_ONLY
+			? (['target_read_only'] as const)
+			: policyBlocked
+				? (['managed_policy_blocked'] as const)
+				: []
+	const reloadRequired = !policyBlocked && inspection.runtimeState === 'reload_required'
+	return {
+		configured: inspection.configured,
+		...(inspection.integrationVersion === undefined ? {} : { integrationVersion: inspection.integrationVersion }),
+		components: {
+			webfetchHook: components.has('webfetch-hook'),
+			runtimeSkill: components.has('runtime-skill'),
+			mcp: components.has('mcp'),
+		},
+		runtimeState: policyBlocked
+			? ('blocked' as const)
+			: reloadRequired
+				? ('reload_required' as const)
+				: ('unverified' as const),
+		reloadState: reloadRequired ? ('required' as const) : ('not_required' as const),
+		consentState: scope === 'project' ? ('may_be_required' as const) : ('not_required' as const),
+		policyState: policyBlocked ? ('blocked' as const) : ('unverified' as const),
+		policyCodes,
+	}
+}
+
+export class StatusService extends Effect.Service<StatusService>()('@expandai/cli/Init/StatusService', {
+	dependencies: [ConfigManager.Default, PendingInitStore.Default, HarnessRegistry.Default],
+	effect: Effect.gen(function* () {
+		const configManager = yield* ConfigManager
+		const pendingStore = yield* PendingInitStore
+		const registry = yield* HarnessRegistry
+
+		const run = Effect.fn('StatusService.run')(function* (request: StatusRequest) {
+			yield* Effect.annotateCurrentSpan({ harness: request.harness, scope: request.scope })
+			return yield* Effect.gen(function* () {
+				yield* configManager
+					.inspectSecureStorage()
+					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapCredentialError))
+				const auth = yield* authStatus(configManager).pipe(Effect.withTracerEnabled(false))
+				const apiUrl = yield* configManager
+					.getApiUrl()
+					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapCredentialError))
+				const canonicalScopeRoot = yield* pendingStore
+					.canonicalScopeRoot(request.scope)
+					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapPendingError))
+				const key: PendingInitKey = {
+					apiOrigin: apiUrl.origin,
+					clientId: CLI_AUTHORIZATION_CLIENT_ID,
+					harness: 'agent-harnesses',
+					scope: request.scope,
+					canonicalScopeRoot,
+				}
+				const pending = yield* pendingStore
+					.peek(key)
+					.pipe(Effect.withTracerEnabled(false), Effect.mapError(mapPendingError))
+				const inspection = yield* registry.inspect(request.harness, request.scope).pipe(
+					Effect.withTracerEnabled(false),
+					Effect.mapError(() => statusError('harness_inspection_failed', true)),
+					Effect.flatMap((inspection) => validateInspection(request.harness, inspection)),
+				)
+				const candidate = {
+					schemaVersion: 1 as const,
+					status: 'ok' as const,
+					harness: request.harness,
+					scope: request.scope,
+					cli: { version: CLI_VERSION },
+					auth,
+					pendingAuthorization: yield* pendingStatus(pending),
+					installation: installationStatus(inspection, request.scope),
+				}
+				return yield* Schema.decodeUnknown(StatusResult)(candidate).pipe(
+					Effect.mapError(() => statusError('invalid_status_result', false)),
+				)
+			})
+		})
+
+		return { run } as const
+	}),
+}) {}

package/src/Install/Claude/Hook.ts

@@ -1,43 +1,213 @@
 import { homedir } from 'node:os'
 import { Array, Config, Console, Effect, Match, Schema } from 'effect'
-import { ConfigIo } from '../Domain.js'
-import type { Scope } from '../Mcp.js'
+import { CLI_VERSION } from '../../Version.js'
+import { type CliCommand, ConfigIo, cliShellCommand, DIRECT_CLI } from '../Domain.js'
+import type { InstallScope } from '../Mcp.js'
+
+/** Claude Code WebFetch hook invocation persisted in harness settings. */
+export const HOOK_INVOCATION = 'expandai hook claude-code'
+export const HOOK_COMMAND = HOOK_INVOCATION
+const HOOK_ARGS = ['hook', 'claude-code'] as const
 
 /**
- * Claude Code hook config — `~/.claude/settings.json` (global) or
- * `<cwd>/.claude/settings.json` (project). PreToolUse hooks fire on built-in
- * tools; we register the WebFetch matcher to route to `expandai hook claude-code`.
+ * The hook line for a resolved CLI. Defaults to the bare `expandai` command;
+ * when the CLI is not on PATH — an `npx expandai init` with no global install —
+ * `CliInvocation` resolves to the npx form and the written hook stays runnable.
  */
-
-export const HOOK_COMMAND = 'expandai hook claude-code'
+export function hookCommandFor(cli: CliCommand = DIRECT_CLI): string {
+	return cliShellCommand(cli, HOOK_ARGS)
+}
 export const WEBFETCH_MATCHER = 'WebFetch'
 
-export const HookCommandEntry = Schema.Struct({
-	type: Schema.Literal('command'),
-	command: Schema.String,
-})
+export const HookCommandEntry = Schema.Struct(
+	{
+		type: Schema.Literal('command'),
+		command: Schema.String,
+		expandaiProfileVersion: Schema.optional(Schema.String),
+		/** Whether this install added the `WebFetch` deny rule — see `makeExpandaiMatcher`. */
+		expandaiManagedDeny: Schema.optional(Schema.Boolean),
+	},
+	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
+)
 
-export const HookMatcher = Schema.Struct({
-	matcher: Schema.optional(Schema.String),
-	hooks: Schema.Array(HookCommandEntry),
-})
+export const HookMatcher = Schema.Struct(
+	{
+		matcher: Schema.optional(Schema.String),
+		hooks: Schema.Array(HookCommandEntry),
+	},
+	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
+)
 
 const HooksSection = Schema.Struct(
 	{ PreToolUse: Schema.optional(Schema.Array(HookMatcher)) },
 	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
 )
 
+const PermissionsSection = Schema.Struct(
+	{ deny: Schema.optional(Schema.Array(Schema.String)) },
+	Schema.Record({ key: Schema.String, value: Schema.Unknown }),
+)
+
 export const SettingsSchema = Schema.parseJson(
 	Schema.Struct(
-		{ hooks: Schema.optionalWith(HooksSection, { default: () => ({}) as typeof HooksSection.Type }) },
+		{
+			hooks: Schema.optionalWith(HooksSection, { default: () => ({}) as typeof HooksSection.Type }),
+			permissions: Schema.optional(PermissionsSection),
+		},
 		Schema.Record({ key: Schema.String, value: Schema.Unknown }),
 	),
 	{ space: 2 },
 )
 
-export const expandaiMatcher = {
-	matcher: WEBFETCH_MATCHER,
-	hooks: [{ type: 'command' as const, command: HOOK_COMMAND }],
+export interface ClaudeHookPlan {
+	readonly changed: boolean
+	readonly settings: typeof SettingsSchema.Type
+}
+
+export function isExpandaiHookCommand(command: string): boolean {
+	const value = command.trim()
+	const invocation = String.raw`expandai(?:\.exe)?\s+hook\s+(?:claude-code|claude)`
+	const direct = new RegExp(String.raw`^(?:npx\s+-y\s+)?${invocation}$`, 'u')
+	const absolute = new RegExp(
+		String.raw`^(?:"(?:[A-Za-z]:\\|/)[^"]*[\\/]expandai(?:\.exe)?"|'(?:[A-Za-z]:\\|/)[^']*[\\/]expandai(?:\.exe)?'|(?:[A-Za-z]:\\|/)[^\s]*[\\/]expandai(?:\.exe)?)\s+hook\s+(?:claude-code|claude)$`,
+		'u',
+	)
+	const shellFallback =
+		/^if\s+command\s+-v\s+expandai\s+>\/dev\/null\s+2>&1;\s*then\s+expandai\s+hook\s+(?:claude-code|claude);\s*else\s+npx\s+-y\s+expandai\s+hook\s+(?:claude-code|claude);\s*fi$/u
+	return direct.test(value) || absolute.test(value) || shellFallback.test(value)
+}
+
+/**
+ * `expandaiManagedDeny` records whether *we* added `WebFetch` to
+ * `permissions.deny`, so uninstall can tell our entry from an identical one the
+ * user set first. A deny entry is a bare string with nowhere to carry that, and
+ * "our hook is present" is not the same claim: installing over a settings file
+ * that already denied `WebFetch` leaves the hook without us having written the
+ * rule, and removing it then revokes a control its owner chose.
+ */
+export function makeExpandaiMatcher(
+	profileVersion: string,
+	cli: CliCommand = DIRECT_CLI,
+	managedDeny = true,
+): typeof HookMatcher.Type {
+	return {
+		matcher: WEBFETCH_MATCHER,
+		hooks: [
+			{
+				type: 'command',
+				command: hookCommandFor(cli),
+				expandaiProfileVersion: profileVersion,
+				expandaiManagedDeny: managedDeny,
+			},
+		],
+	}
+}
+
+/** True only when our own hook entry says we wrote the deny rule. */
+export function expandaiOwnsWebFetchDeny(settings: typeof SettingsSchema.Type): boolean {
+	return (settings.hooks.PreToolUse ?? []).some((entry) =>
+		entry.hooks.some((hook) => isExpandaiHookCommand(hook.command) && hook.expandaiManagedDeny === true),
+	)
+}
+
+function webFetchAlreadyDenied(settings: typeof SettingsSchema.Type): boolean {
+	return (settings.permissions?.deny ?? []).includes(WEBFETCH_MATCHER)
+}
+
+export const expandaiMatcher = makeExpandaiMatcher(CLI_VERSION)
+
+function stripExpandaiHooks(entries: ReadonlyArray<typeof HookMatcher.Type>): Array<typeof HookMatcher.Type> {
+	return Array.flatMap(entries, (entry) => {
+		const hooks = Array.filter(entry.hooks, (hook) => !isExpandaiHookCommand(hook.command))
+		return hooks.length === 0 && hooks.length !== entry.hooks.length ? [] : [{ ...entry, hooks }]
+	})
+}
+
+/**
+ * Denying `WebFetch` removes it from the toolset rather than blocking it per call,
+ * so the agent reaches for Expand's tool instead of being refused. That difference
+ * is the whole point: a hook can only answer a WebFetch call with `deny`, which
+ * Claude Code renders to the user as `Error:` on every single fetch.
+ *
+ * The hook stays installed as the fallback. With the deny rule in force WebFetch is
+ * never called, so the hook never fires; if the rule is ever absent or overridden,
+ * the hook still intercepts — with the red line, but correctly.
+ */
+export function planClaudeWebFetchDeny(settings: typeof SettingsSchema.Type): ClaudeHookPlan {
+	const deny = settings.permissions?.deny ?? []
+	if (deny.includes(WEBFETCH_MATCHER)) return { changed: false, settings }
+	return {
+		changed: true,
+		settings: {
+			...settings,
+			permissions: { ...(settings.permissions ?? {}), deny: [...deny, WEBFETCH_MATCHER] },
+		},
+	}
+}
+
+/**
+ * Drops the `WebFetch` entry; anything else the user denied is left alone.
+ *
+ * A deny entry is a bare string with nowhere to record who wrote it, so this
+ * cannot tell our rule from an identical one the user added themselves. The
+ * caller supplies that evidence — see `uninstall`.
+ */
+export function planClaudeWebFetchDenyRemoval(settings: typeof SettingsSchema.Type): ClaudeHookPlan {
+	const deny = settings.permissions?.deny
+	if (deny === undefined || !deny.includes(WEBFETCH_MATCHER)) return { changed: false, settings }
+	const remaining = deny.filter((entry) => entry !== WEBFETCH_MATCHER)
+	const permissions = { ...settings.permissions, deny: remaining }
+	return { changed: true, settings: { ...settings, permissions } }
+}
+
+export function planClaudeHook(
+	settings: typeof SettingsSchema.Type,
+	profileVersion: string = CLI_VERSION,
+	cli: CliCommand = DIRECT_CLI,
+): ClaudeHookPlan {
+	const preToolUse = settings.hooks.PreToolUse ?? []
+	const owned = preToolUse.flatMap((entry) =>
+		entry.hooks.filter((hook) => isExpandaiHookCommand(hook.command)).map((hook) => ({ entry, hook })),
+	)
+	// The marker records history — did *this* install add the rule — so once it is
+	// written it must be preserved, not recomputed. Recomputing it from present
+	// state makes the plan disagree with what it just wrote: after we add the deny
+	// rule, `webFetchAlreadyDenied` is true, so a second plan would decide the rule
+	// was never ours and rewrite the hook forever.
+	const existingMarker = owned[0]?.hook.expandaiManagedDeny
+	const managedDeny = existingMarker ?? !webFetchAlreadyDenied(settings)
+	const current =
+		owned.length === 1 &&
+		owned[0]?.entry.matcher === WEBFETCH_MATCHER &&
+		owned[0]?.hook.command === hookCommandFor(cli) &&
+		owned[0]?.hook.expandaiProfileVersion === profileVersion &&
+		owned[0]?.hook.expandaiManagedDeny === managedDeny
+	if (current) return { changed: false, settings }
+
+	return {
+		changed: true,
+		settings: {
+			...settings,
+			hooks: {
+				...settings.hooks,
+				PreToolUse: [...stripExpandaiHooks(preToolUse), makeExpandaiMatcher(profileVersion, cli, managedDeny)],
+			},
+		},
+	}
+}
+
+export function planClaudeHookRemoval(settings: typeof SettingsSchema.Type): ClaudeHookPlan {
+	const preToolUse = settings.hooks.PreToolUse ?? []
+	const changed = preToolUse.some((entry) => entry.hooks.some((hook) => isExpandaiHookCommand(hook.command)))
+	return changed
+		? {
+				changed,
+				settings: {
+					...settings,
+					hooks: { ...settings.hooks, PreToolUse: stripExpandaiHooks(preToolUse) },
+				},
+			}
+		: { changed, settings }
 }
 
 export class ClaudeHook extends Effect.Service<ClaudeHook>()('@expandai/cli/Install/Claude/Hook', {
@@ -47,7 +217,7 @@ export class ClaudeHook extends Effect.Service<ClaudeHook>()('@expandai/cli/Inst
 		const home = yield* Config.string('HOME').pipe(Config.withDefault(homedir()))
 		const cwd = yield* Config.string('PWD').pipe(Config.withDefault(process.cwd()))
 
-		const pathFor = Effect.fn(function* (scope: Scope) {
+		const pathFor = Effect.fn(function* (scope: InstallScope) {
 			return yield* Match.value(scope).pipe(
 				Match.when('global', () => Effect.succeed(`${home}/.claude/settings.json`)),
 				Match.when('project', () => Effect.succeed(`${cwd}/.claude/settings.json`)),
@@ -55,79 +225,62 @@ export class ClaudeHook extends Effect.Service<ClaudeHook>()('@expandai/cli/Inst
 			)
 		})
 
-		const install = Effect.fn('ClaudeHook.install')(function* (scope: Scope) {
+		const install = Effect.fn('ClaudeHook.install')(function* (scope: InstallScope) {
 			const target = yield* pathFor(scope)
 			const settings = yield* io.read(target, SettingsSchema)
-
-			const preToolUse = settings.hooks.PreToolUse ?? []
-			const alreadyInstalled = preToolUse.some(
-				(entry) => entry.matcher === WEBFETCH_MATCHER && entry.hooks.some((hook) => hook.command === HOOK_COMMAND),
-			)
-
-			if (alreadyInstalled) {
+			// Both halves, exactly as `init` writes them. This used to install the hook
+			// alone, which left the deny rule to `init` only — and made `uninstall`'s
+			// ownership rule false: it treats our hook as evidence that we wrote the
+			// deny entry, so a rule the user added after a bare `hook install` was
+			// deleted as if it were ours.
+			const hookPlan = planClaudeHook(settings)
+			const plan = planClaudeWebFetchDeny(hookPlan.settings)
+			if (!hookPlan.changed && !plan.changed) {
 				yield* Console.log(`expandai WebFetch hook already installed at ${target}`)
 				return
 			}
-
-			yield* io.write(
-				target,
-				{
-					...settings,
-					hooks: {
-						...settings.hooks,
-						PreToolUse: [...preToolUse, expandaiMatcher],
-					},
-				},
-				SettingsSchema,
-			)
-			yield* Console.log(`Installed expandai WebFetch hook at ${target}`)
+			yield* io.write(target, plan.settings, SettingsSchema)
+			yield* Console.log(`Installed expandai WebFetch hook and deny rule at ${target}`)
 		})
 
-		const uninstall = Effect.fn('ClaudeHook.uninstall')(function* (scope: Scope) {
+		const uninstall = Effect.fn('ClaudeHook.uninstall')(function* (scope: InstallScope) {
 			const target = yield* pathFor(scope)
-			const exists = yield* io.exists(target)
-			if (!exists) {
-				return
-			}
-
+			if (!(yield* io.exists(target))) return
 			const settings = yield* io.read(target, SettingsSchema)
-			const preToolUse = settings.hooks.PreToolUse ?? []
-			const updatedPreToolUse = Array.filter(
-				Array.map(preToolUse, (entry) => ({
-					...entry,
-					hooks: Array.filter(entry.hooks, (hook) => hook.command !== HOOK_COMMAND),
-				})),
-				(entry) => entry.matcher !== WEBFETCH_MATCHER || entry.hooks.length > 0,
+			// Uninstall has to undo both halves, or `WebFetch` stays denied with nothing
+			// left to serve the fetch — worse than never having installed us.
+			//
+			// But only the halves we wrote. `expandaiManagedDeny` on our hook records
+			// whether this install added the deny rule; without it, the rule is either
+			// the user's own or from an install predating the marker, and those are
+			// indistinguishable. Guessing "ours" revokes a control its owner chose;
+			// guessing "theirs" leaves `WebFetch` denied with nothing serving fetches.
+			// So leave it and say so — `uninstall` also fans out over both scopes, and
+			// would otherwise reach into a global settings file a project-scoped
+			// install never touched.
+			const hookPlan = planClaudeHookRemoval(settings)
+			if (!hookPlan.changed) return
+			// Read the marker off the hook before it is stripped.
+			const owned = expandaiOwnsWebFetchDeny(settings)
+			const denyPlan = owned ? planClaudeWebFetchDenyRemoval(hookPlan.settings) : hookPlan
+			const strandedDeny = !owned && (settings.permissions?.deny ?? []).includes(WEBFETCH_MATCHER)
+			yield* io.write(target, denyPlan.settings, SettingsSchema)
+			// `denyPlan` is the hook plan itself when we do not own the rule, so its
+			// `changed` flag reports the hook removal — not a deny removal that never
+			// happened.
+			const removedDeny = owned && denyPlan.changed
+			yield* Console.log(
+				removedDeny
+					? `Removed expandai WebFetch hook and deny rule from ${target}`
+					: `Removed expandai WebFetch hook from ${target}`,
 			)
-
-			// Compare total hook-command count rather than outer-array length:
-			// our HOOK_COMMAND can sit alongside other hooks in a shared matcher
-			// entry (e.g. a user merged it in by hand), in which case the entry
-			// stays after filtering but the inner hook count drops.
-			const countCommands = Effect.fn(function* (entries: typeof preToolUse) {
-				return Array.reduce(entries, 0, (n, entry) => n + entry.hooks.length)
-			})
-
-			const before = yield* countCommands(preToolUse)
-			const after = yield* countCommands(updatedPreToolUse)
-			if (before === after) {
-				return
+			if (strandedDeny) {
+				yield* Console.log(
+					`Left "WebFetch" in permissions.deny at ${target} — expandai could not confirm it added that rule. Remove it by hand if you want Claude Code's built-in WebFetch back.`,
+				)
 			}
-
-			yield* io.write(
-				target,
-				{
-					...settings,
-					hooks: {
-						...settings.hooks,
-						PreToolUse: updatedPreToolUse,
-					},
-				},
-				SettingsSchema,
-			)
-			yield* Console.log(`Removed expandai WebFetch hook from ${target}`)
 		})
 
-		return { install, uninstall } as const
+		return { install, uninstall, pathFor } as const
 	}),
 }) {}