lurqrun 0.1.7 → 0.1.9

package/dist/bin/lurq.js

@@ -9,27 +9,30 @@ import {
 import "../chunk-WHX2ZFCG.js";
 import {
   withSetupOnMissingKey
-} from "../chunk-EA3DP5HG.js";
-import "../chunk-4ZYCIMY4.js";
-import "../chunk-TNTXWSYA.js";
+} from "../chunk-PZZU3FQY.js";
 import {
   yellow
 } from "../chunk-4KCPOMG6.js";
 import {
   SUPPORTED_AGENTS
-} from "../chunk-UDVNA7EA.js";
+} from "../chunk-ETY4FSOW.js";
 import "../chunk-LUAKDHLZ.js";
 import {
   logger
 } from "../chunk-MYGSLK44.js";
-import "../chunk-Y5GI7RL3.js";
+import "../chunk-SFY5MPJE.js";
+import {
+  readUserConfig,
+  resolveApiKey
+} from "../chunk-J6XQ7OPZ.js";
+import "../chunk-TNTXWSYA.js";
 import {
   KEYS_URL,
   PACKAGE_NAME,
   SERVER_NAME,
   VERSION,
   package_default
-} from "../chunk-GPTKSNR6.js";
+} from "../chunk-L3V7AVM6.js";
 import {
   __commonJS,
   __require,
@@ -1804,12 +1807,12 @@ Expecting one of '${allowedValues.join("', '")}'`);
        *
        * @private
        */
-      _prepareUserArgs(argv, parseOptions) {
-        if (argv !== void 0 && !Array.isArray(argv)) {
+      _prepareUserArgs(argv2, parseOptions) {
+        if (argv2 !== void 0 && !Array.isArray(argv2)) {
           throw new Error("first parameter to parse must be array or undefined");
         }
         parseOptions = parseOptions || {};
-        if (argv === void 0 && parseOptions.from === void 0) {
+        if (argv2 === void 0 && parseOptions.from === void 0) {
           if (process2.versions?.electron) {
             parseOptions.from = "electron";
           }
@@ -1818,30 +1821,30 @@ Expecting one of '${allowedValues.join("', '")}'`);
             parseOptions.from = "eval";
           }
         }
-        if (argv === void 0) {
-          argv = process2.argv;
+        if (argv2 === void 0) {
+          argv2 = process2.argv;
         }
-        this.rawArgs = argv.slice();
+        this.rawArgs = argv2.slice();
         let userArgs;
         switch (parseOptions.from) {
           case void 0:
           case "node":
-            this._scriptPath = argv[1];
-            userArgs = argv.slice(2);
+            this._scriptPath = argv2[1];
+            userArgs = argv2.slice(2);
             break;
           case "electron":
             if (process2.defaultApp) {
-              this._scriptPath = argv[1];
-              userArgs = argv.slice(2);
+              this._scriptPath = argv2[1];
+              userArgs = argv2.slice(2);
             } else {
-              userArgs = argv.slice(1);
+              userArgs = argv2.slice(1);
             }
             break;
           case "user":
-            userArgs = argv.slice(0);
+            userArgs = argv2.slice(0);
             break;
           case "eval":
-            userArgs = argv.slice(1);
+            userArgs = argv2.slice(1);
             break;
           default:
             throw new Error(
@@ -1875,8 +1878,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [parseOptions.from] - where the args are from: 'node', 'user', 'electron'
        * @return {Command} `this` command for chaining
        */
-      parse(argv, parseOptions) {
-        const userArgs = this._prepareUserArgs(argv, parseOptions);
+      parse(argv2, parseOptions) {
+        const userArgs = this._prepareUserArgs(argv2, parseOptions);
         this._parseCommand([], userArgs);
         return this;
       }
@@ -1900,8 +1903,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} parseOptions.from - where the args are from: 'node', 'user', 'electron'
        * @return {Promise}
        */
-      async parseAsync(argv, parseOptions) {
-        const userArgs = this._prepareUserArgs(argv, parseOptions);
+      async parseAsync(argv2, parseOptions) {
+        const userArgs = this._prepareUserArgs(argv2, parseOptions);
         await this._parseCommand([], userArgs);
         return this;
       }
@@ -2350,11 +2353,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string[]} argv
        * @return {{operands: string[], unknown: string[]}}
        */
-      parseOptions(argv) {
+      parseOptions(argv2) {
         const operands = [];
         const unknown = [];
         let dest = operands;
-        const args = argv.slice();
+        const args = argv2.slice();
         function maybeOption(arg) {
           return arg.length > 1 && arg[0] === "-";
         }
@@ -3047,6 +3050,76 @@ var require_commander = __commonJS({
 // src/bin/lurq.ts
 init_esm_shims();
 
+// src/cli/autoHooks.ts
+init_esm_shims();
+import { mkdirSync, statSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var SKIP = /* @__PURE__ */ new Set(["setup", "uninstall", "logout", "install-skill", "serve-http"]);
+function planHookMaintenance(states) {
+  return states.flatMap((s) => {
+    if (!s.hasEntry) return [];
+    if (s.recorded === void 0)
+      return [{ agent: s.agent, kind: s.hooksPresent ? "refresh" : "install" }];
+    if (!s.hooksPresent) return [];
+    return s.recorded === s.current ? [] : [{ agent: s.agent, kind: "refresh" }];
+  });
+}
+function stampPath() {
+  return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "lurq", "hooks-check");
+}
+async function maintainHooks(argv2, now = Date.now()) {
+  try {
+    if (SKIP.has(argv2[0] ?? "") || process.env.LURQ_NO_AUTO_HOOKS === "1") return;
+    const stamp = stampPath();
+    try {
+      if (now - statSync(stamp).mtimeMs < DAY_MS) return;
+    } catch {
+    }
+    const config = readUserConfig();
+    if (config.autoHooks === false || !resolveApiKey()) return;
+    mkdirSync(join(stamp, ".."), { recursive: true });
+    writeFileSync(stamp, "");
+    const skill = await import("../installSkill-A7KKPDMS.js");
+    const invocation = skill.lurqInvocation();
+    if (!invocation.onPath) return;
+    const states = skill.agentSpecs().flatMap((spec) => {
+      const agent = skill.hookAgentFor(spec.id);
+      if (!agent) return [];
+      try {
+        return [
+          {
+            agent,
+            hasEntry: skill.hasLurqEntry(spec),
+            hooksPresent: skill.hasLurqHooks(skill.readJsonObject(skill.hooksPath(agent))),
+            recorded: config.hooks?.[agent]?.command,
+            current: skill.lurqCommandFor(agent, invocation)
+          }
+        ];
+      } catch {
+        return [];
+      }
+    });
+    const added = [];
+    for (const action of planHookMaintenance(states)) {
+      try {
+        if (skill.installHooks(action.agent, void 0, invocation) && action.kind === "install")
+          added.push(action.agent);
+      } catch {
+      }
+    }
+    if (added.length && process.stderr.isTTY) {
+      const names = added.map((a) => skill.hooksLabel(a).replace(/ hooks$/, "")).join(", ");
+      process.stderr.write(
+        `lurq: turned on install checks for ${names}.${added.includes("codex") ? " In Codex, run /hooks once to trust them." : ""} Turn this off with LURQ_NO_AUTO_HOOKS=1.
+`
+      );
+    }
+  } catch {
+  }
+}
+
 // src/cli/index.ts
 init_esm_shims();
 
@@ -3083,64 +3156,70 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     if (cmd.args.length > 0) {
       program2.unknownCommand();
     }
-    const { resolveApiKey } = await import("../userConfig-Z3GQE776.js");
-    if (resolveApiKey()) {
+    const { resolveApiKey: resolveApiKey2 } = await import("../userConfig-ICASHI47.js");
+    if (resolveApiKey2()) {
       program2.outputHelp();
       return;
     }
-    const { runSetup } = await import("../install-EK3W2COX.js");
+    const { runSetup } = await import("../install-55EPX34C.js");
     await runSetup({});
   });
-  program2.command("setup").aliases(["install", "login"]).description("one-time setup: store your API key, wire up your assistants and skills").option("--api-key <key>", "hosted API key (skips the prompt)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--agent <agent>", AGENT_CHOICES).option("--yes", "non-interactive: use flags/env and detected agents without prompting").option("--no-open", "don't launch a browser (headless boxes, SSH, CI)").action(
+  program2.command("setup").aliases(["install", "login"]).description("one-time setup: store your API key, wire up your assistants and skills").option("--api-key <key>", "hosted API key (skips the prompt)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--agent <agent>", AGENT_CHOICES).option("--yes", "non-interactive: use flags/env and detected agents without prompting").option("--no-open", "don't launch a browser (headless boxes, SSH, CI)").addOption(new Option("--wait-for-signin").hideHelp()).action(
     async (opts) => {
-      const { runSetup } = await import("../install-EK3W2COX.js");
+      const { runSetup } = await import("../install-55EPX34C.js");
       await runSetup({ ...opts, noOpen: opts.open === false });
     }
   );
+  const autopilot = program2.command("autopilot").description("set up and inspect the upgrade autopilot for a repository");
+  autopilot.command("init").description("turn the autopilot on for one or many repositories: secret, workflow, first run").option("--repo <owner/name...>", "one or more repositories (default: this checkout's origin)").option("--mode <mode>", "comment, fix, or pr (default: fix \u2014 opens PRs, needs no model)").option("--api-key <key>", "lurq API key (defaults to the stored one, then $LURQ_API_KEY)").option("--no-credential", "skip the Anthropic credential step in pr mode").option("--force", "replace a workflow that is already committed").option(
+    "--pr",
+    "open a pull request in each repository instead of committing to the default branch"
+  ).option("--json", "machine-readable summary").action(async (opts) => {
+    const { runAutopilotInit } = await import("../autopilotInit-JO2SH5K3.js");
+    await runAutopilotInit(opts);
+  });
   program2.command("logout").description("remove the stored API key from this machine").action(async () => {
-    const { clearUserConfig, userConfigPath } = await import("../userConfig-Z3GQE776.js");
+    const { clearUserConfig, userConfigPath } = await import("../userConfig-ICASHI47.js");
     const path = userConfigPath();
     console.log(
       clearUserConfig() ? `Removed ${path}. Your agents' MCP configs still hold the key: \`lurq uninstall\` removes those too.` : "No stored API key on this machine. To remove lurq from your agents, run `lurq uninstall`."
     );
   });
   program2.command("uninstall").description("undo setup: remove lurq's MCP entries, agent instructions and the stored key").option("--agent <agent>", `only this agent: ${AGENT_CHOICES}`).option("--yes", "remove without asking").action(async (opts) => {
-    const { runUninstall } = await import("../uninstall-P7RGBX6G.js");
+    const { runUninstall } = await import("../uninstall-4E5YUDQO.js");
     await runUninstall(opts);
   });
   const policy = program2.command("policy").description("keep your selection policy in a file: pull it, review it, push it");
   policy.command("pull").argument("[file]", "write the policy here (default: stdout)").description("download the policy your agents are held to").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (file, opts) => {
-    const { runPolicyPull } = await import("../policy-3P6BGRDN.js");
+    const { runPolicyPull } = await import("../policy-EQT43P7S.js");
     await runPolicyPull(file, opts);
   });
-  policy.command("push").argument("<file>", "policy JSON, as written by `lurq policy pull`").description("replace the policy with this file (needs a policy:write key)").option("--check", "validate the file only; send nothing (for PR checks)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(
-    async (file, opts) => {
-      const { runPolicyPush } = await import("../policy-3P6BGRDN.js");
-      await runPolicyPush(file, opts);
-    }
-  );
+  policy.command("push").argument("<file>", "policy JSON, as written by `lurq policy pull`").description("replace the policy with this file (needs a policy:write key)").option("--check", "validate the file only; send nothing (for PR checks)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (file, opts) => {
+    const { runPolicyPush } = await import("../policy-EQT43P7S.js");
+    await runPolicyPush(file, opts);
+  });
   policy.command("history").description("who changed the policy, from where, and what changed").option("--json", "output the changes as JSON").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (opts) => {
-    const { runPolicyHistory } = await import("../policy-3P6BGRDN.js");
+    const { runPolicyHistory } = await import("../policy-EQT43P7S.js");
     await runPolicyHistory(opts);
   });
   policy.command("log").description("packages the policy refused, or warned about, grouped by rule").option("--days <n>", "look back this many days, 1 to 365 (default 30)").option("--json", "output the log as JSON").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").action(async (opts) => {
-    const { runPolicyLog } = await import("../policy-3P6BGRDN.js");
+    const { runPolicyLog } = await import("../policy-EQT43P7S.js");
     await runPolicyLog(opts);
   });
   program2.command("can").argument("[query...]", "what you are trying to do, in plain words").description("find the lurq capability for what you are trying to do").option("--json", "output matches as JSON").action(async (query, opts) => {
-    const { runCan } = await import("../commands-FIL5ET6P.js");
+    const { runCan } = await import("../commands-6BBLN5N5.js");
     runCan(query.join(" "), opts);
   });
   program2.command("evaluate").argument("<package>", "npm package name").description("full evidence read for one package (scores, signals, usage guide)").option("--json", "output JSON instead of a table").action(async (pkg, opts) => {
-    const { runEvaluate } = await import("../commands-FIL5ET6P.js");
+    const { runEvaluate } = await import("../commands-6BBLN5N5.js");
     await runEvaluate(pkg, opts);
   });
   program2.command("compare").argument("<packages...>", "2\u20135 npm package names").description("side-by-side comparison of packages, ranked by health").option("--json", "output JSON instead of a table").action(async (pkgs, opts) => {
-    const { runCompare } = await import("../commands-FIL5ET6P.js");
+    const { runCompare } = await import("../commands-6BBLN5N5.js");
     await runCompare(pkgs, opts);
   });
   program2.command("verify").argument("<package>", "npm package name").description("safety check: is this package real, healthy, and not risky?").option("--json", "output JSON instead of a table").action(async (pkg, opts) => {
-    const { runVerify } = await import("../commands-FIL5ET6P.js");
+    const { runVerify } = await import("../commands-6BBLN5N5.js");
     await runVerify(pkg, opts);
   });
   program2.command("usage").argument("<package>", "npm package name").description(
@@ -3151,7 +3230,7 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     (v) => Math.max(0, parseInt(v, 10) || 0)
   ).option("--json", "output JSON").action(
     async (pkg, opts) => {
-      const { runUsage } = await import("../commands-FIL5ET6P.js");
+      const { runUsage } = await import("../commands-6BBLN5N5.js");
       await runUsage(pkg, {
         version: opts.target ?? opts.version,
         known: opts.known,
@@ -3162,18 +3241,18 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     }
   );
   program2.command("versions").argument("<package>", "npm package name").description("show the stored version timeline for a package").option("--json", "output JSON instead of a table").option("-n, --limit <n>", "how many versions to show (default 30)").action(async (pkg, opts) => {
-    const { runVersions } = await import("../commands-FIL5ET6P.js");
+    const { runVersions } = await import("../commands-6BBLN5N5.js");
     await runVersions(pkg, opts);
   });
   program2.command("compat").argument("<packages...>", "npm package names to check together").description(
     "check whether a set of packages forms a coherent stack (peer/engine + recorded evidence)"
   ).option("--pin <name=version...>", "evaluate an exact version, e.g. --pin next=15").option("--json", "output JSON").action(async (pkgs, opts) => {
-    const { runCompat } = await import("../commands-FIL5ET6P.js");
+    const { runCompat } = await import("../commands-6BBLN5N5.js");
     await runCompat(pkgs, opts);
   });
   program2.command("upgrade-plan").argument("[dir]", "project directory (default: current)", ".").description("what is behind in this project, and what each upgrade removes from its API").option("--json", "output the plan as JSON (feed to `check-upgrade --plan`)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--repo <owner/name>", "apply this repo's policy (defaults to $GITHUB_REPOSITORY)").action(
     async (dir, opts) => {
-      const { buildUpgradePlan, formatUpgradePlan } = await import("../upgradePlan-A4LRKLEG.js");
+      const { buildUpgradePlan, formatUpgradePlan } = await import("../upgradePlan-F3OUNL3E.js");
       const plan = await buildUpgradePlan(dir, {
         url: opts.url,
         apiKey: opts.apiKey,
@@ -3184,20 +3263,40 @@ coding agent on this machine. Get a key at ${KEYS_URL}
   );
   program2.command("check-upgrade").argument("[dir]", "project directory to scan (default: current)", ".").description("do these upgrades remove symbols your code actually references?").option("--plan <file>", "targets from `upgrade-plan --json`").option("--upgrade <spec...>", "pkg@from..to (repeatable), e.g. commander@11.1.0..12.1.0").option("--json", "output the report as JSON").option("--exit-code", "exit 1 when the report is not safe (for CI)").option("--report", "send the result to your lurq dashboard (CI; needs an API key)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--no-types", "skip the type check (runtime surface only; faster)").action(
     async (dir, opts) => {
-      const { runCheckUpgrade } = await import("../checkUpgrade-F2WESBPM.js");
+      const { runCheckUpgrade } = await import("../checkUpgrade-Q4CV7GXG.js");
       await runCheckUpgrade(dir, opts);
     }
   );
+  program2.command("fix").argument("[dir]", "project directory to scan (default: current)", ".").description(
+    "write the changes that need no judgement \u2014 a rename an upgrade proves, a model id the provider retired \u2014 and brief the agent on the rest"
+  ).option("--plan <file>", "targets from `upgrade-plan --json`").option(
+    "--upgrade <spec...>",
+    "pkg@from..to (repeatable), e.g. cookie@1.1.1..2.0.1 \u2014 needs no API key"
+  ).option("--apply", "write the files (default: print the diff and change nothing)").option("--json", "output the result as JSON").option("--exit-code", "exit 1 when something is left for a human or an agent to do").option("--max <n>", "most packages to fix in one run (blast radius)", (v) => parseInt(v, 10)).option(
+    "--sarif <file>",
+    "write SARIF for GitHub code scanning (upload with codeql-action/upload-sarif)"
+  ).option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--api-key <key>", "hosted API key (defaults to $LURQ_API_KEY)").option("--repo <owner/name>", "apply this repo's policy (defaults to $GITHUB_REPOSITORY)").action(
+    async (dir, opts) => {
+      const { runFix } = await import("../fix-Z7ZY55HB.js");
+      await runFix(dir, opts);
+    }
+  );
   program2.command("check-release").argument("[dir]", "package directory (default: current)", ".").description("is the version you are about to publish honest about what changed?").option("--against <version>", "compare with this published version (default: latest)").option("--json", "output the check as JSON").option("--exit-code", "exit 1 when the bump is understated (for CI / prepublish)").action(async (dir, opts) => {
-    const { checkRelease, formatReleaseCheck } = await import("../release-4U4ABNSJ.js");
+    const { checkRelease, formatReleaseCheck } = await import("../release-EUOM5I3R.js");
     const check = await checkRelease(dir, { against: opts.against });
     console.log(opts.json ? JSON.stringify(check, null, 2) : formatReleaseCheck(check));
     if (opts.exitCode && check.verdict !== "ok") process.exitCode = 1;
   });
+  program2.command("check-env").argument("[dir]", "project directory to scan (default: current)", ".").description("which environment variables does this project read that nothing declares?").option("--json", "output the result as JSON").option("--exit-code", "exit 1 when anything is undeclared (for CI)").option("--sarif <file>", "write SARIF for GitHub code scanning").option("--limit <n>", "source files to read before stopping (default 5000)").action(
+    async (dir, opts) => {
+      const { runEnvCheck } = await import("../envCheck-IL22OTSC.js");
+      await runEnvCheck(dir, opts);
+    }
+  );
   program2.command("check-api").argument("[spec]", "OpenAPI document (default: the first one found)").description("does this change break the callers of your own API?").option("--against <rev>", "git revision to compare with (default: HEAD)").option("-C, --dir <dir>", "repository directory (default: current)", ".").option("--json", "output the check as JSON").option("--exit-code", "exit 1 on a breaking change (for CI)").action(
     async (spec, opts) => {
-      const { runApiCheck } = await import("../check-2FDGUOV7.js");
-      const { formatApiCheck } = await import("../diff-GZA2774U.js");
+      const { runApiCheck } = await import("../check-PQSQ2MMA.js");
+      const { formatApiCheck } = await import("../diff-I4SNUHU3.js");
       const check = await runApiCheck(opts.dir ?? ".", { spec, against: opts.against });
       console.log(
         opts.json ? JSON.stringify(check, null, 2) : formatApiCheck(check, `api check (vs ${check.against})`)
@@ -3210,7 +3309,7 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "probe your MCP servers now instead of waiting for the worker (self-hosted index only)"
   ).option("--probe-budget <seconds>", "wall-clock ceiling for probing (default 90)").option("--json", "output JSON instead of a table").action(
     async (dir, opts) => {
-      const { runAudit } = await import("../commands-FIL5ET6P.js");
+      const { runAudit } = await import("../commands-6BBLN5N5.js");
       await runAudit(dir, opts);
     }
   );
@@ -3220,33 +3319,73 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     "--fail-on <severity>",
     "exit 1 when anything this severe is found: critical | high | moderate | low | none",
     "none"
-  ).option("--no-history", "do not compare with, or record, the previous scan").option("--no-upload", "keep this scan on this machine; do not record it to your account").option("--require-upload", "exit 1 if the scan could not be recorded to your account (for CI)").option("--github-issue", "keep a pinned 'lurq dashboard' issue current in this repository (in GitHub Actions)").option(
+  ).option("--no-history", "do not compare with, or record, the previous scan").option("--no-upload", "keep this scan on this machine; do not record it to your account").option("--require-upload", "exit 1 if the scan could not be recorded to your account (for CI)").option(
+    "--github-issue",
+    "keep a pinned 'lurq dashboard' issue current in this repository (in GitHub Actions)"
+  ).option(
     "--no-contribute",
     "do not offer published servers' contracts as corroboration for the public index"
-  ).option("--json", "output JSON instead of a report").action(async (dir, opts) => {
-    const { runMcpScan } = await import("../mcpScan-QZHWENIP.js");
+  ).option("--json", "output JSON instead of a report").option(
+    "--sarif <file>",
+    "write SARIF for GitHub code scanning (upload with codeql-action/upload-sarif)"
+  ).action(async (dir, opts) => {
+    const { runMcpScan } = await import("../mcpScan-CKBQNK5H.js");
     await runMcpScan(dir, opts);
   });
-  program2.command("mcp-ci").argument("[dir]", "repository directory (defaults to the current one)").description("write a GitHub Actions workflow that rescans this repository's MCP servers daily and when their config changes").option("--print", "print the workflow instead of writing it").option("--force", "replace an existing workflow file").option("--cron <expr>", "schedule (default: daily 06:23 UTC)").option("--fail-on <severity>", "fail the job at this severity: critical | high | moderate | low | none", "high").option("--no-issue", "do not maintain the pinned lurq dashboard issue").action(async (dir, opts) => {
-    const { runMcpCi } = await import("../mcpScan-QZHWENIP.js");
+  program2.command("mcp-ci").argument("[dir]", "repository directory (defaults to the current one)").description(
+    "write a GitHub Actions workflow that rescans this repository's MCP servers daily and when their config changes"
+  ).option("--print", "print the workflow instead of writing it").option("--force", "replace an existing workflow file").option("--cron <expr>", "schedule (default: daily 06:23 UTC)").option(
+    "--fail-on <severity>",
+    "fail the job at this severity: critical | high | moderate | low | none",
+    "high"
+  ).option(
+    "--sarif",
+    "also file findings as GitHub code scanning alerts (needs code scanning enabled; adds security-events: write)"
+  ).option("--no-issue", "do not maintain the pinned lurq dashboard issue").action(async (dir, opts) => {
+    const { runMcpCi } = await import("../mcpScan-CKBQNK5H.js");
     await runMcpCi(dir, opts);
   });
-  program2.command("mcp-stack").argument("[dir]", "project directory (defaults to the current one)").description("do your configured MCP servers coexist? checks tool-name collisions and shadowing, live").option("--project-only", "read only config files in the project").option("--trust-project", "launch servers committed to the repository without asking").option("--timeout <seconds>", "per-server connect deadline (default 60)").option("--json", "output JSON instead of a table").action(
+  program2.command("mcp-stack").argument("[dir]", "project directory (defaults to the current one)").description(
+    "do your configured MCP servers coexist? checks tool-name collisions and shadowing, live"
+  ).option("--project-only", "read only config files in the project").option("--trust-project", "launch servers committed to the repository without asking").option("--timeout <seconds>", "per-server connect deadline (default 60)").option("--json", "output JSON instead of a table").action(
     async (dir, opts) => {
-      const { runMcpStack } = await import("../commands-FIL5ET6P.js");
+      const { runMcpStack } = await import("../commands-6BBLN5N5.js");
       await runMcpStack(dir, opts);
     }
   );
   program2.command("mcp-surface").argument("<server>", "npm package name of the MCP server").description("an MCP server's real tool contract: params and behaviour annotations").option("--version <v>", "exact version (defaults to the latest probed)").option("--json", "output JSON instead of a table").action(async (server, opts) => {
-    const { runMcpSurface } = await import("../commands-FIL5ET6P.js");
+    const { runMcpSurface } = await import("../commands-6BBLN5N5.js");
     await runMcpSurface(server, opts);
   });
   program2.command("mcp-drift").argument("<server>", "npm package name of the MCP server").description("what an MCP server changed between two versions (incl. silent + privilege drift)").requiredOption("--from <v>", "version you are on").requiredOption("--to <v>", "version you are moving to").option("--json", "output JSON instead of a table").action(async (server, opts) => {
-    const { runMcpDrift } = await import("../commands-FIL5ET6P.js");
+    const { runMcpDrift } = await import("../commands-6BBLN5N5.js");
     await runMcpDrift(server, opts);
   });
+  program2.command("connect-check").argument("<server>", "endpoint URL, official registry name, or npm package name").description(
+    "will this MCP server work in your client, and what does it take? (per-client verdicts + config)"
+  ).option(
+    "--client <id>",
+    "one client: claude-code, claude-ai, chatgpt, cursor, vscode, codex, gemini-cli, \u2026"
+  ).option("--json", "output JSON instead of a table").action(async (server, opts) => {
+    const { runConnectCheck } = await import("../commands-6BBLN5N5.js");
+    await runConnectCheck(server, opts);
+  });
+  program2.command("mcp-pin").argument("<server>", "endpoint URL or official registry name of a remote MCP server").description(
+    "approve a remote MCP server as it is now; you are alerted when its tools or sign-in path change"
+  ).option("--note <text>", "why it was approved, shown with the pin").option("--json", "output JSON").action(async (server, opts) => {
+    const { runMcpPin } = await import("../commands-6BBLN5N5.js");
+    await runMcpPin(server, opts);
+  });
+  program2.command("mcp-unpin").argument("<server>", "endpoint URL or official registry name").description("stop watching a pinned remote MCP server").action(async (server) => {
+    const { runMcpUnpin } = await import("../commands-6BBLN5N5.js");
+    await runMcpUnpin(server);
+  });
+  program2.command("mcp-pins").description("your pinned remote MCP servers, and which changed since you pinned them").option("--json", "output JSON").action(async (opts) => {
+    const { runMcpPins } = await import("../commands-6BBLN5N5.js");
+    await runMcpPins(opts);
+  });
   program2.command("weights").description("show and explain the scoring weight model (health, quality, composite \u03BB)").option("--json", "output the weight model as JSON").action(async (opts) => {
-    const { runWeights } = await import("../commands-FIL5ET6P.js");
+    const { runWeights } = await import("../commands-6BBLN5N5.js");
     runWeights(opts);
   });
   program2.command("edit-weights").description("override, reset, or explain the scoring weights (layered over defaults)").option(
@@ -3256,20 +3395,33 @@ coding agent on this machine. Get a key at ${KEYS_URL}
     []
   ).option("--reset", "remove all overrides and restore defaults").option("--explain <component>", "explain a component (e.g. adoption, quality, lambda)").option("--project", "write to project-local .lurq/weights.json instead of the user config").action(
     async (opts) => {
-      const { runEditWeights } = await import("../commands-FIL5ET6P.js");
+      const { runEditWeights } = await import("../commands-6BBLN5N5.js");
       await runEditWeights(opts);
     }
   );
   program2.command("install-skill").description("register lurq as an MCP server in supported AI assistants (scriptable)").option("--agent <agent>", AGENT_CHOICES, "claude-code").option("--api-key <key>", "hosted API key (remote install; default mode)").option("--url <url>", "hosted endpoint URL (defaults to the lurq service)").option("--local", "self-host: write a local stdio entry using your own DATABASE_URL").action(async (opts) => {
-    const { runInstallSkill } = await import("../installSkill-VQJWJVCL.js");
+    const { runInstallSkill } = await import("../installSkill-A7KKPDMS.js");
     await runInstallSkill(opts);
   });
+  program2.command("hook").argument(
+    "<event>",
+    "the agent event being handled: session-start, prompt, pre-tool-use, post-tool-use"
+  ).option(
+    "--agent <agent>",
+    "whose hook format to read and write: claude, codex or cursor",
+    "claude"
+  ).description(
+    "run as an agent hook: verify installs and suggest lurq where it helps (set up by `lurq setup`)"
+  ).action(async (event, opts) => {
+    const { runHook } = await import("../hook-TWFLIDK3.js");
+    await runHook(event, opts.agent);
+  });
   program2.command("serve").description("start the MCP server over stdio (for agent integration)").action(async () => {
-    const { startMcpServer } = await import("../server-KFUD5X57.js");
+    const { startMcpServer } = await import("../server-LROMHS62.js");
     await startMcpServer();
   });
   program2.command("serve-http").description("start the hosted MCP server over HTTP with API-key auth").option("--port <n>", "port to listen on (default: $PORT or 8080)", (v) => parseInt(v, 10)).action(async (opts) => {
-    const { startHttpServer } = await import("../http-ETPYMBGD.js");
+    const { startHttpServer } = await import("../http-7VF2RE2D.js");
     await startHttpServer({ port: opts.port });
   });
   return program2;
@@ -3279,19 +3431,19 @@ coding agent on this machine. Get a key at ${KEYS_URL}
 init_esm_shims();
 var import_semver = __toESM(require_semver(), 1);
 import { spawn } from "child_process";
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-var DAY_MS = 24 * 60 * 60 * 1e3;
+import { mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function statePath() {
-  return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "lurq", "update-check.json");
+  return join2(process.env.XDG_CACHE_HOME || join2(homedir2(), ".cache"), "lurq", "update-check.json");
 }
 function planUpdateCheck(state, now, current = VERSION) {
   const latest = state?.latest;
   const newer = latest && import_semver.default.valid(latest) && import_semver.default.valid(current) && import_semver.default.gt(latest, current);
   return {
     message: newer ? `Update available: ${current} \u2192 ${latest}. Run: npm install -g ${PACKAGE_NAME}` : null,
-    refresh: !state || !(now - state.checkedAt < DAY_MS)
+    refresh: !state || !(now - state.checkedAt < DAY_MS2)
   };
 }
 var FETCH_LATEST = `
@@ -3301,8 +3453,8 @@ fetch(url, { signal: AbortSignal.timeout(10000) })
   .then((p) => require('fs').writeFileSync(file, JSON.stringify({ checkedAt: Date.now(), latest: p.version })))
   .catch(() => {});
 `;
-function notifyOnUpdate(argv) {
-  const quiet = argv[0] === "serve" || argv[0] === "serve-http" || argv.includes("--json") || !process.stdout.isTTY || !!process.env.CI || "NO_UPDATE_NOTIFIER" in process.env;
+function notifyOnUpdate(argv2) {
+  const quiet = argv2[0] === "serve" || argv2[0] === "serve-http" || argv2.includes("--json") || !process.stdout.isTTY || !!process.env.CI || "NO_UPDATE_NOTIFIER" in process.env;
   if (quiet) return;
   try {
     const path = statePath();
@@ -3316,8 +3468,8 @@ function notifyOnUpdate(argv) {
 ${yellow(message)}
 `));
     if (!refresh) return;
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, JSON.stringify({ ...state, checkedAt: Date.now() }));
+    mkdirSync2(dirname(path), { recursive: true });
+    writeFileSync2(path, JSON.stringify({ ...state, checkedAt: Date.now() }));
     spawn(
       process.execPath,
       ["-e", FETCH_LATEST, `https://registry.npmjs.org/${PACKAGE_NAME}/latest`, path],
@@ -3353,9 +3505,9 @@ function isOwner() {
   const want = Buffer.from(OWNER_HASH, "hex");
   return got.length === want.length && timingSafeEqual(got, want);
 }
-function enforceGate(argv) {
+function enforceGate(argv2) {
   if (!PRE_LAUNCH || isOwner()) return;
-  if (argv[0] && ALLOWED.has(argv[0])) return;
+  if (argv2[0] && ALLOWED.has(argv2[0])) return;
   printPlaceholder();
   process.exit(0);
 }
@@ -3391,7 +3543,9 @@ function selfHostHint(err) {
   if (err?.code !== "ERR_MODULE_NOT_FOUND") return null;
   const missing = /Cannot find package '([^']+)'/.exec(err.message ?? "")?.[1];
   if (!missing || !SELF_HOST_DEPENDENCIES.includes(missing)) return null;
-  const deps = SELF_HOST_DEPENDENCIES.map((name) => `${name}@${package_default.dependencies[name]}`);
+  const deps = SELF_HOST_DEPENDENCIES.map(
+    (name) => `${name}@${package_default.dependencies[name]}`
+  );
   return `This command runs lurq's server or a local index, which needs packages the CLI does not install ("${missing}" is missing). Hosted users never need them: run \`lurq setup\` instead.
 To self-host, install them next to lurq:
   npm install -g ${PACKAGE_NAME} ${deps.join(" ")}`;
@@ -3400,8 +3554,9 @@ To self-host, install them next to lurq:
 // src/bin/lurq.ts
 loadEnv();
 enforceGate(process.argv.slice(2));
-notifyOnUpdate(process.argv.slice(2));
-withSetupOnMissingKey(() => buildProgram().parseAsync(process.argv)).catch((err) => {
+var argv = process.argv.slice(2);
+notifyOnUpdate(argv);
+maintainHooks(argv).then(() => withSetupOnMissingKey(() => buildProgram().parseAsync(process.argv))).catch((err) => {
   logger.error(selfHostHint(err) ?? (err instanceof Error ? err.message : String(err)));
   process.exit(1);
 });

package/dist/{browserAuth-B6G27USY.js → browserAuth-PVYODBNR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-TNTXWSYA.js";
 import {
   API_KEY_PREFIX
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-L3V7AVM6.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";
@@ -74,13 +74,14 @@ function keyViaBrowser(opts) {
         finish({ key, label });
       });
     });
-    const timer = setTimeout(() => finish(null), DEADLINE_MS);
+    const timer = setTimeout(() => finish(null), opts.deadlineMs ?? DEADLINE_MS);
     timer.unref?.();
     server.on("error", () => finish(null));
     opts.signal?.addEventListener("abort", () => finish(null), { once: true });
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address();
-      const url = `${WEB_ORIGIN}/dashboard/cli?port=${port}&nonce=${encodeURIComponent(nonce)}`;
+      const via = opts.via ? `&via=${opts.via}` : "";
+      const url = `${WEB_ORIGIN}/dashboard/cli?port=${port}&nonce=${encodeURIComponent(nonce)}${via}`;
       opts.onUrl(url);
       if (!opts.noOpen) openInBrowser(url);
     });

package/dist/{cache-DKI34SVS.js → cache-ND4VOUVY.js}

@@ -2,9 +2,9 @@ import { createRequire as __lurqCreateRequire } from 'node:module'; const requir
 import {
   cached,
   invalidateCache
-} from "./chunk-HWBBVLOT.js";
+} from "./chunk-J3NUERU7.js";
 import "./chunk-MYGSLK44.js";
-import "./chunk-GPTKSNR6.js";
+import "./chunk-L3V7AVM6.js";
 import "./chunk-I3M2KJXB.js";
 export {
   cached,