fullcourtdefense-cli 1.7.23 → 1.7.24

package/dist/commands/hook.js

@@ -108,6 +108,90 @@ function inferEvent(explicit, payload) {
     return 'unknown';
 }
 const str = (v) => (typeof v === 'string' ? v : '');
+/**
+ * Claude-format hooks (Claude Code, VS Code Copilot agent mode, GitHub Copilot
+ * CLI — all share the same schema) send `hook_event_name` + `tool_name` +
+ * `tool_input` on stdin. Normalize that payload into the field shapes the rest
+ * of this file already understands (command/file_path/tool_name/tool_input),
+ * and map the tool onto our event taxonomy.
+ *
+ * Returns null when the payload is not Claude-format.
+ */
+function normalizeClaudePayload(payload) {
+    const hookEventName = str(payload.hook_event_name);
+    if (!hookEventName)
+        return null;
+    if (hookEventName === 'UserPromptSubmit') {
+        return { event: 'prompt', payload };
+    }
+    if (hookEventName !== 'PreToolUse') {
+        // PostToolUse / Stop / SessionStart etc. — nothing to enforce pre-execution.
+        return { event: 'ignore', payload };
+    }
+    const toolName = str(payload.tool_name);
+    let toolInput = payload.tool_input;
+    if (typeof toolInput === 'string') {
+        const trimmed = toolInput.trim();
+        if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+            try {
+                toolInput = JSON.parse(trimmed);
+            }
+            catch { /* keep raw */ }
+        }
+    }
+    const input = (toolInput && typeof toolInput === 'object' ? toolInput : {});
+    // MCP tools arrive as `mcp__<server>__<tool>` (same in Claude Code and VS Code).
+    if (toolName.startsWith('mcp__')) {
+        const parts = toolName.split('__');
+        const server = parts[1] || 'mcp';
+        const shortTool = parts.slice(2).join('__') || toolName;
+        return {
+            event: 'mcp',
+            payload: { ...payload, tool_name: shortTool, mcp_server_name: server, tool_input: input },
+        };
+    }
+    // Claude Code, VS Code Copilot, and Copilot CLI each use their own tool names
+    // for the same operations — compare case/underscore-insensitively.
+    const canon = toolName.toLowerCase().replace(/[_-]/g, '');
+    const SHELL_TOOLS = new Set(['bash', 'shell', 'runterminalcommand', 'runinterminal', 'powershell', 'terminal']);
+    const READ_TOOLS = new Set(['read', 'readfile', 'view']);
+    const WRITE_TOOLS = new Set([
+        'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles',
+        'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile',
+    ]);
+    if (SHELL_TOOLS.has(canon)) {
+        return {
+            event: 'shell',
+            payload: { ...payload, command: str(input.command), cwd: str(input.cwd) || str(payload.cwd) || undefined },
+        };
+    }
+    if (READ_TOOLS.has(canon)) {
+        return { event: 'read', payload: { ...payload, file_path: str(input.file_path) || str(input.path) } };
+    }
+    if (WRITE_TOOLS.has(canon)) {
+        const content = str(input.content) || str(input.new_string) || str(input.new_source) || str(input.code)
+            || (Array.isArray(input.edits)
+                ? input.edits.map((e) => str(e?.new_string) || str(e?.content)).filter(Boolean).join('\n')
+                : '');
+        const filePath = str(input.file_path) || str(input.notebook_path) || str(input.path) || str(input.filePath)
+            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        return { event: 'file', payload: { ...payload, file_path: filePath, content } };
+    }
+    // Glob/Grep/Task/WebFetch/etc. — no enforcement surface; let the client's own
+    // permission flow handle them.
+    return { event: 'ignore', payload };
+}
+/**
+ * Which AI client invoked a Claude-format hook. Claude Code sets CLAUDECODE=1;
+ * VS Code Copilot runs hooks inside the VS Code process environment.
+ */
+function claudeFormatClient() {
+    if (process.env.CLAUDECODE || process.env.CLAUDE_PROJECT_DIR)
+        return 'claude-code';
+    if (process.env.VSCODE_PID || process.env.TERM_PROGRAM === 'vscode')
+        return 'vscode';
+    return 'claude-code';
+}
 function collectPromptStrings(value, out = [], depth = 0) {
     if (depth > 5 || value === null || value === undefined)
         return out;
@@ -240,6 +324,22 @@ function safeJson(v) {
 function degradedAllowMessage(event, detail) {
     return `FullCourtDefense policy gate unavailable; allowed ${event} in degraded mode. ${detail}`.trim();
 }
+/**
+ * The policy gate could not be reached (or errored). Apply the machine's
+ * configured offline stance: fail-closed blocks the action, fail-open allows it
+ * in degraded mode. Either way the decision is spooled (`offlineEnforced`) and
+ * replayed to the backend when connectivity returns, so nothing is invisible.
+ */
+function respondDegraded(ctx, detail, toolName) {
+    if (ctx.failClosed && !ctx.shadow) {
+        (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, reason: `fail-closed: ${detail}`, offlineEnforced: true });
+        (0, telemetry_1.triggerFlush)(true);
+        ctx.respond(true, `Blocked by FullCourtDefense — policy service unreachable and this machine is set to fail-closed. ${detail}`, `FullCourtDefense could not verify this ${ctx.event} against your org policies (${detail}) and fail-closed mode is on. Do not retry until the connection is restored.`);
+    }
+    (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, reason: `degraded: ${detail}`, offlineEnforced: true });
+    (0, telemetry_1.triggerFlush)(false);
+    ctx.respond(false, undefined, degradedAllowMessage(ctx.event, detail));
+}
 /** Per-event attribution that maps onto the existing Shield runtime headers (prompt path). */
 function attributionFor(event, p) {
     const h = {};
@@ -294,13 +394,13 @@ function mcpServerName(p) {
  * The client is still reported separately as `agentClient` metadata for optional per-runtime
  * constraints. Non-MCP events keep the collapsed per-developer IDE-runtime identity.
  */
-function agentNameForCall(event, p) {
+function agentNameForCall(event, p, client = 'cursor') {
     if (event === 'mcp') {
         const server = mcpServerName(p);
         if (server)
             return `${safeIdentityPart(developerId())}-${safeIdentityPart(server)}`;
     }
-    return `cursor-${developerId()}`;
+    return `${client}-${developerId()}`;
 }
 /** Cursor conversation/session id when present, else a stable per-machine id. */
 function sessionId(p) {
@@ -309,7 +409,7 @@ function sessionId(p) {
         return fromPayload;
     return `cursor-${os.hostname()}`;
 }
-function machineMetadata() {
+function machineMetadata(client = 'cursor') {
     let username = 'unknown';
     try {
         username = os.userInfo().username;
@@ -322,7 +422,7 @@ function machineMetadata() {
         username,
         cwd: process.cwd(),
         workspacePath: process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd(),
-        agentClient: 'cursor',
+        agentClient: client,
     };
 }
 function spoolLocalFinding(input) {
@@ -405,28 +505,79 @@ async function hookCommand(args, config) {
             payload = {};
         }
     }
-    const event = inferEvent(args.event, payload);
-    dbg({ phase: 'invoke', event, argEvent: args.event, pid: process.pid,
+    // Claude-format hooks (Claude Code / VS Code Copilot / Copilot CLI) are
+    // detected from the payload itself, so ONE installed command serves every
+    // client that reads ~/.claude/settings.json.
+    const claudeNormalized = normalizeClaudePayload(payload);
+    const hookFormat = claudeNormalized ? 'claude' : 'cursor';
+    const client = claudeNormalized ? claudeFormatClient() : 'cursor';
+    let event;
+    let ignoreEvent = false;
+    if (claudeNormalized) {
+        payload = claudeNormalized.payload;
+        if (claudeNormalized.event === 'ignore') {
+            event = 'unknown';
+            ignoreEvent = true;
+        }
+        else {
+            event = claudeNormalized.event;
+        }
+    }
+    else {
+        event = inferEvent(args.event, payload);
+    }
+    dbg({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid,
         isTTY, rawLen: raw.length, rawPreview: raw.slice(0, 300), stdinErr, parseErr,
         argv: process.argv.slice(2), payloadKeys: Object.keys(payload) });
-    // Emit the verdict in the shape Cursor expects for THIS event, then exit.
-    // beforeSubmitPrompt blocks via { continue: false }; the execution hooks
-    // (shell/mcp/read) block via { permission: "deny" }.
+    // Emit the verdict in the shape THIS client expects, then exit.
+    //   Cursor: beforeSubmitPrompt blocks via { continue: false }; execution hooks
+    //           block via { permission: "deny" }.
+    //   Claude format (Claude Code / VS Code / Copilot CLI):
+    //           UserPromptSubmit blocks via { decision: "block" }; PreToolUse blocks
+    //           via hookSpecificOutput.permissionDecision "deny". On allow we emit
+    //           NO permission decision so the client's own approval flow still runs
+    //           (an explicit "allow" would silently bypass its permission prompts).
     const respond = (blocked, userMsg, agentMsg) => {
-        const decision = event === 'prompt'
-            ? (blocked ? { continue: false } : { continue: true })
-            : { permission: blocked ? 'deny' : 'allow' };
-        if (userMsg)
-            decision.user_message = userMsg;
-        if (agentMsg)
-            decision.agent_message = agentMsg;
-        dbg({ phase: 'verdict', event, blocked, decision });
+        let decision;
+        if (hookFormat === 'claude') {
+            if (event === 'prompt') {
+                decision = blocked ? { decision: 'block', reason: userMsg || agentMsg || 'Blocked by FullCourtDefense.' } : {};
+            }
+            else if (blocked) {
+                decision = {
+                    hookSpecificOutput: {
+                        hookEventName: 'PreToolUse',
+                        permissionDecision: 'deny',
+                        permissionDecisionReason: userMsg || agentMsg || 'Blocked by FullCourtDefense.',
+                    },
+                };
+            }
+            else {
+                decision = {};
+            }
+            if (!blocked && agentMsg)
+                decision.systemMessage = agentMsg;
+        }
+        else {
+            decision = event === 'prompt'
+                ? (blocked ? { continue: false } : { continue: true })
+                : { permission: blocked ? 'deny' : 'allow' };
+            if (userMsg)
+                decision.user_message = userMsg;
+            if (agentMsg)
+                decision.agent_message = agentMsg;
+        }
+        dbg({ phase: 'verdict', event, format: hookFormat, blocked, decision });
         process.stdout.write(JSON.stringify(decision));
-        // ALWAYS exit 0 so Cursor uses our JSON verdict. Exit 2 is interpreted as
+        // ALWAYS exit 0 so the client uses our JSON verdict. Exit 2 is interpreted as
         // `permission: "deny"`, which beforeSubmitPrompt ignores (it uses `continue`),
         // so exiting 2 would silently let blocked prompts through.
         process.exit(0);
     };
+    // Claude-format lifecycle events with no pre-execution surface (PostToolUse,
+    // SessionStart, ...) and tools we don't police (Glob/Grep/Task/...) — no opinion.
+    if (ignoreEvent)
+        respond(false);
     // No Shield configured → allow (fail-open by design: a misconfigured machine
     // must not brick the developer's IDE).
     if (!shieldId) {
@@ -437,7 +588,7 @@ async function hookCommand(args, config) {
         await enforceActionPolicy({
             event, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
             shadow, failClosed, timeoutMs, approvalMode, approvalTimeoutMs, approvalPollMs, respond,
-            effectivePolicyHash,
+            effectivePolicyHash, client,
         });
         return;
     }
@@ -472,7 +623,7 @@ async function hookCommand(args, config) {
         }
         await enforceShieldText({
             event, text, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
-            shadow, failClosed, timeoutMs, respond,
+            shadow, failClosed, timeoutMs, respond, client,
         });
         return;
     }
@@ -544,37 +695,34 @@ async function enforceActionPolicy(ctx) {
                 // For MCP calls this mirrors the gateway's runtime-agnostic per-server identity
                 // (`<developer>-<server>`), so ONE per-agent policy matches the same server on the
                 // gateway path AND this in-IDE hook path, across every client/runtime.
-                agentName: agentNameForCall(event, payload),
+                agentName: agentNameForCall(event, payload, ctx.client),
                 toolName: call.toolName,
                 toolArgs: call.toolArgs,
                 argsSummary: call.toolArgs,
                 sessionId: sessionId(payload),
                 source: 'cursor_hook',
                 ...(event === 'mcp' && mcpServerName(payload) ? { mcpServer: mcpServerName(payload) } : {}),
-                ...machineMetadata(),
+                ...machineMetadata(ctx.client),
             }),
             signal: controller.signal,
         });
         clearTimeout(timer);
         if (!resp.ok) {
-            dbg({ phase: 'policy_http_error', event, status: resp.status });
-            (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `degraded: backend HTTP ${resp.status}`, offlineEnforced: true });
-            respond(false, undefined, degradedAllowMessage(event, `Backend returned HTTP ${resp.status}.`));
+            dbg({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
+            respondDegraded(ctx, `Backend returned HTTP ${resp.status}.`, call.toolName);
             return;
         }
         const body = await resp.json().catch(() => ({}));
         if (!body.success || !body.data) {
-            dbg({ phase: 'policy_no_data', event, error: body.error });
-            respond(false, undefined, degradedAllowMessage(event, body.error ? `Backend error: ${body.error}` : 'Backend returned no policy data.'));
+            dbg({ phase: 'policy_no_data', event, error: body.error, failClosed: ctx.failClosed });
+            respondDegraded(ctx, body.error ? `Backend error: ${body.error}` : 'Backend returned no policy data.', call.toolName);
             return;
         }
         result = body.data;
     }
     catch (err) {
-        dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err) });
-        (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `degraded: ${err instanceof Error ? err.message : String(err)}`, offlineEnforced: true });
-        (0, telemetry_1.triggerFlush)(false);
-        respond(false, undefined, degradedAllowMessage(event, `Hook error: ${err instanceof Error ? err.message : String(err)}.`));
+        dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err), failClosed: ctx.failClosed });
+        respondDegraded(ctx, `Hook error: ${err instanceof Error ? err.message : String(err)}.`, call.toolName);
         return;
     }
     const reason = result.actionPolicy?.reason
@@ -646,7 +794,7 @@ async function waitForApproval(input) {
     return { status: 'timeout', message: 'approval timed out — still waiting for human review.' };
 }
 async function enforceShieldText(ctx) {
-    const { event, text, payload, apiUrl, shieldId, shieldKey, shadow, failClosed, timeoutMs, respond } = ctx;
+    const { event, text, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond } = ctx;
     try {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -667,7 +815,7 @@ async function enforceShieldText(ctx) {
         });
         clearTimeout(timer);
         if (!resp.ok) {
-            respond(false, undefined, degradedAllowMessage(event, `Backend returned HTTP ${resp.status}.`));
+            respondDegraded(ctx, `Backend returned HTTP ${resp.status}.`, 'prompt');
             return;
         }
         const data = await resp.json().catch(() => ({}));
@@ -683,6 +831,6 @@ async function enforceShieldText(ctx) {
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
-        respond(false, undefined, degradedAllowMessage(event, `Hook error: ${err instanceof Error ? err.message : String(err)}.`));
+        respondDegraded(ctx, `Hook error: ${err instanceof Error ? err.message : String(err)}.`, 'prompt');
     }
 }

package/dist/commands/installAll.d.ts

@@ -6,6 +6,8 @@ export interface InstallAllArgs extends ProtectAllArgs {
     upload?: string;
     hooks?: string;
     discover?: string;
+    schedule?: string;
+    scheduleHour?: string;
     autoProtect?: string;
     intervalMinutes?: string;
 }

package/dist/commands/installAll.js

@@ -4,6 +4,8 @@ exports.installAllCommand = installAllCommand;
 const config_1 = require("../config");
 const discover_1 = require("./discover");
 const installCursorHook_1 = require("./installCursorHook");
+const installClaudeHook_1 = require("./installClaudeHook");
+const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const autoProtect_1 = require("./autoProtect");
 const restartNotice_1 = require("./restartNotice");
@@ -45,6 +47,23 @@ async function installAllCommand(args, config) {
         catch (error) {
             console.log(`Cursor hooks skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
+        // ONE Claude-format hook file (~/.claude/settings.json) covers Claude Code,
+        // VS Code Copilot agent mode, and GitHub Copilot CLI.
+        console.log('\n\x1b[1mInstalling Claude Code / VS Code / Copilot CLI runtime hooks…\x1b[0m');
+        const claudeHookArgs = {
+            shieldId: creds.shieldId,
+            shieldKey: creds.shieldKey,
+            apiUrl: creds.apiUrl,
+            // Tool actions only by default — same scope as the Cursor hooks. Prompt
+            // scanning stays opt-in (`install-claude-hook --events tools,prompt`).
+            events: 'tools',
+        };
+        try {
+            await (0, installClaudeHook_1.installClaudeHookCommand)(claudeHookArgs, config);
+        }
+        catch (error) {
+            console.log(`Claude-format hooks skipped: ${error instanceof Error ? error.message : String(error)}`);
+        }
     }
     if (args.autoProtect === 'true') {
         console.log('\n\x1b[1mScheduling self-healing MCP protection…\x1b[0m');
@@ -70,6 +89,26 @@ async function installAllCommand(args, config) {
         };
         await (0, discover_1.discoverCommand)(discoverArgs, config);
     }
+    // Keep the fleet view fresh without any manual step: register a recurring
+    // discovery run (posture + inventory upload) once a day. Opt out with
+    // `--schedule false`.
+    if (args.schedule !== 'false') {
+        console.log('\n\x1b[1mScheduling daily desktop discovery…\x1b[0m');
+        try {
+            const hour = args.scheduleHour ? Number.parseInt(args.scheduleHour, 10) : 9;
+            (0, discoverSchedule_1.installDailyDiscoverSchedule)({
+                userEmail: args.developerName,
+                hour: Number.isFinite(hour) ? hour : 9,
+                surface: 'all',
+                trigger: 'daily',
+            });
+            console.log(`Desktop discovery scheduled daily at ${String(Number.isFinite(hour) ? hour : 9).padStart(2, '0')}:00 (posture + inventory upload).`);
+        }
+        catch (error) {
+            console.log(`Daily discovery schedule skipped: ${error instanceof Error ? error.message : String(error)}`);
+            console.log('You can retry with: fullcourtdefense discover --schedule daily');
+        }
+    }
     console.log('\n\x1b[32mDone.\x1b[0m Run \x1b[1mfullcourtdefense protect-all --dry-run true\x1b[0m to verify gateways.');
     await (0, restartNotice_1.promptRestartNotice)();
 }

package/dist/commands/installClaudeHook.d.ts

@@ -0,0 +1,27 @@
+import { BotGuardConfig } from '../config';
+/**
+ * `fullcourtdefense install-claude-hook` — Claude-format hook installer.
+ *
+ * Writes PreToolUse + UserPromptSubmit hooks into ~/.claude/settings.json.
+ * That ONE file is read by THREE clients:
+ *   - Claude Code (CLI + desktop)
+ *   - VS Code Copilot agent mode (user-scope Claude-format hooks)
+ *   - GitHub Copilot CLI
+ *
+ * The hook command is the same `fullcourtdefense hook` bridge used for Cursor —
+ * it detects the Claude payload format from stdin (`hook_event_name`), so no
+ * per-client configuration is needed. VS Code ignores `matcher` values (hooks
+ * run on every tool), so the bridge self-filters by tool name and returns an
+ * empty verdict for tools we don't police.
+ */
+export interface InstallClaudeHookArgs {
+    project?: string;
+    shieldId?: string;
+    shieldKey?: string;
+    apiUrl?: string;
+    shadow?: string;
+    failClosed?: string;
+    events?: string;
+}
+export declare function installClaudeHookCommand(args: InstallClaudeHookArgs, config: BotGuardConfig): Promise<void>;
+export declare function uninstallClaudeHookCommand(args: InstallClaudeHookArgs): Promise<void>;

package/dist/commands/installClaudeHook.js

@@ -0,0 +1,201 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installClaudeHookCommand = installClaudeHookCommand;
+exports.uninstallClaudeHookCommand = uninstallClaudeHookCommand;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const restartNotice_1 = require("./restartNotice");
+const COLOR = {
+    reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
+    red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
+};
+// Stable marker embedded in every command we write, so uninstall/re-install can
+// find our entries regardless of the install path (npm global vs local dev).
+const MANAGED_MARKER = '--fcd-managed true';
+const MANAGED_TAG = 'fullcourtdefense';
+function settingsPath(projectScope) {
+    return projectScope
+        ? path.join(process.cwd(), '.claude', 'settings.json')
+        : path.join(os.homedir(), '.claude', 'settings.json');
+}
+function readSettings(file) {
+    if (!fs.existsSync(file))
+        return {};
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function isManagedCommand(cmd) {
+    return typeof cmd?.command === 'string'
+        && (cmd.command.includes(MANAGED_MARKER) || cmd.command.includes(MANAGED_TAG));
+}
+/** Remove FullCourtDefense-managed commands from every event's matcher entries. */
+function stripManaged(hooks) {
+    let removed = 0;
+    for (const eventName of Object.keys(hooks)) {
+        const entries = Array.isArray(hooks[eventName]) ? hooks[eventName] : [];
+        const kept = [];
+        for (const entry of entries) {
+            const cmds = Array.isArray(entry?.hooks) ? entry.hooks : [];
+            const keptCmds = cmds.filter((c) => !isManagedCommand(c));
+            removed += cmds.length - keptCmds.length;
+            if (keptCmds.length > 0 || cmds.length === 0) {
+                kept.push({ ...entry, hooks: keptCmds });
+            }
+        }
+        if (kept.length)
+            hooks[eventName] = kept;
+        else
+            delete hooks[eventName];
+    }
+    return removed;
+}
+/** Build the absolute, shell-agnostic command that invokes this CLI's `hook`. */
+function buildHookCommand(opts) {
+    const nodeExe = process.execPath;
+    const scriptPath = process.argv[1] || path.join(__dirname, '..', 'index.js');
+    const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
+    // No --event flag: the bridge detects the Claude payload (hook_event_name) itself.
+    let cmd = `${q(nodeExe)} ${q(scriptPath)} hook --approval-mode wait`;
+    if (opts.shadow)
+        cmd += ' --shadow true';
+    if (opts.failClosed)
+        cmd += ' --fail-closed true';
+    cmd += ` ${MANAGED_MARKER}`;
+    return cmd;
+}
+function ensureHomeShield(input) {
+    if (!input.shieldId && !input.shieldKey && !input.apiUrl)
+        return undefined;
+    return (0, config_1.saveSetupConfig)({
+        shieldId: input.shieldId,
+        shieldKey: input.shieldKey,
+        apiUrl: input.apiUrl,
+    });
+}
+async function installClaudeHookCommand(args, config) {
+    const projectScope = args.project === 'true';
+    const shadow = args.shadow === 'true';
+    // Default fail-OPEN: when the backend is unreachable the developer keeps working;
+    // the local deterministic guard (cached Local Safety policies) still blocks
+    // offline, and every degraded allow is spooled + replayed. `--fail-closed true`
+    // opts into blocking all agent actions while offline.
+    const failClosed = args.failClosed === 'true';
+    const file = settingsPath(projectScope);
+    const requested = (args.events || 'tools,prompt')
+        .split(/[\s,]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
+    const wantTools = requested.includes('tools') || requested.includes('shell') || requested.includes('mcp');
+    const wantPrompt = requested.includes('prompt');
+    if (!wantTools && !wantPrompt) {
+        console.error(`${COLOR.red}No valid events. Choose from: tools, prompt${COLOR.reset}`);
+        process.exit(1);
+    }
+    const creds = (0, config_1.resolveCliCredentials)(config, {
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+    });
+    const credFile = ensureHomeShield(creds);
+    const settings = readSettings(file);
+    const hooks = (settings.hooks && typeof settings.hooks === 'object'
+        ? settings.hooks : {});
+    settings.hooks = hooks;
+    stripManaged(hooks);
+    const command = buildHookCommand({ shadow, failClosed });
+    if (wantTools) {
+        const list = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+        // Long timeout: allow/block verdicts return in <1s; the timeout only matters
+        // while an action is paused waiting for a human approval in the console.
+        // (Claude hook timeouts are in seconds.)
+        list.push({ matcher: '*', hooks: [{ type: 'command', command, timeout: 300 }] });
+        hooks.PreToolUse = list;
+    }
+    if (wantPrompt) {
+        const list = Array.isArray(hooks.UserPromptSubmit) ? hooks.UserPromptSubmit : [];
+        list.push({ hooks: [{ type: 'command', command, timeout: 30 }] });
+        hooks.UserPromptSubmit = list;
+    }
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    console.log('');
+    console.log(`${COLOR.green}${COLOR.bold}FullCourtDefense Claude-format hook installed.${COLOR.reset}`);
+    console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
+    console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
+    console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
+    const parts = [];
+    if (wantTools)
+        parts.push('tool calls (shell / MCP / file writes / reads) checked against org Action Policies + Local Safety rules');
+    if (wantPrompt)
+        parts.push('prompts scanned by your Shield');
+    console.log(`${COLOR.gray}Enforcement:${COLOR.reset} ${parts.join('; ')}`);
+    if (shadow)
+        console.log(`${COLOR.yellow}Mode: SHADOW (monitor only — nothing is blocked).${COLOR.reset}`);
+    if (failClosed)
+        console.log(`${COLOR.yellow}Fail-closed: agent actions are BLOCKED while the policy service is unreachable.${COLOR.reset}`);
+    if (credFile)
+        console.log(`${COLOR.gray}Creds:${COLOR.reset} ${credFile}`);
+    if (!creds.shieldId) {
+        console.log('');
+        console.log(`${COLOR.yellow}No Shield ID set.${COLOR.reset} Run ${COLOR.bold}fullcourtdefense login --token <fleet-enrollment-token>${COLOR.reset} first, then re-run install.`);
+    }
+    console.log('');
+    (0, restartNotice_1.printRestartNotice)('Claude Code, VS Code, Copilot CLI');
+    console.log(`${COLOR.gray}Remove with:${COLOR.reset} fullcourtdefense uninstall-claude-hook${projectScope ? ' --project true' : ''}`);
+}
+async function uninstallClaudeHookCommand(args) {
+    const projectScope = args.project === 'true';
+    const file = settingsPath(projectScope);
+    if (!fs.existsSync(file)) {
+        console.log(`${COLOR.yellow}No settings.json found at ${file}. Nothing to remove.${COLOR.reset}`);
+        return;
+    }
+    const settings = readSettings(file);
+    const hooks = (settings.hooks && typeof settings.hooks === 'object'
+        ? settings.hooks : {});
+    const removed = stripManaged(hooks);
+    if (Object.keys(hooks).length === 0)
+        delete settings.hooks;
+    else
+        settings.hooks = hooks;
+    fs.writeFileSync(file, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    console.log(`${COLOR.green}Removed ${removed} FullCourtDefense hook entr${removed === 1 ? 'y' : 'ies'} from ${file}.${COLOR.reset}`);
+}