oathbound 0.16.0 → 0.17.1

package/README.md

@@ -1,53 +1,80 @@
 # oathbound
 
-Install and verify Claude Code skills from the [Oath Bound](https://oathbound.ai) registry.
+Install, verify, and publish Claude Code skills and agents from the [Oath Bound](https://oathbound.ai) registry.
 
-Skills are downloaded as tarballs from the registry and verified using SHA-256 content hashing. Every session start and every tool invocation can be checked against the registry to detect tampering.
+Skills and agents are downloaded as tarballs from the registry and verified using SHA-256 content hashing. Every session start and every tool invocation can be checked against the registry to detect tampering.
 
 ## Installation
 
-Requires the [Bun](https://bun.sh) runtime.
+```sh
+npm install -g oathbound
+```
+
+Or via npx (no install required):
 
 ```sh
-bun add -g oathbound
+npx oathbound <command>
 ```
 
-Or via npm:
+## Quick start
 
 ```sh
-npm install -g oathbound
+oathbound init
 ```
 
-## Usage
+The `init` wizard sets up Claude Code hooks (globally and in the current project) so that skills are verified on every session start and tool invocation.
+
+## Commands
 
-### Install a skill
+### Skills
 
 ```sh
-oathbound pull <namespace/skill-name>
-oathbound install <namespace/skill-name>
+oathbound pull <namespace/skill[@version]> [--global]   # Download & verify a skill
+oathbound push [path] [--private]                        # Publish a skill to the registry
+oathbound search [query]                                 # Search skills in the registry
+oathbound list                                           # List all public skills
 ```
 
-Downloads the latest version of a skill from the registry, verifies the tarball hash, and extracts it into your `.claude/skills/` directory.
+`pull` (aliases: `install`, `i`) downloads the latest version of a skill from the registry, verifies the tarball hash, and extracts it into `.claude/skills/`. Pin a specific version with `@1.2.3`. Use `--global` to install into `~/.claude/skills/` instead of the project directory.
+
+### Agents
 
-### Verify all installed skills (SessionStart hook)
+```sh
+oathbound agent pull <namespace/name[@version]>   # Download an agent
+oathbound agent push [path] [--private]            # Publish an agent .md file
+oathbound agent search [query]                     # Search agents in the registry
+oathbound agent list                               # List all public agents
+```
+
+### Verification (hooks)
 
 ```sh
-oathbound verify
+oathbound verify          # SessionStart hook — verify all installed skills
+oathbound verify --check  # PreToolUse hook — check skill integrity mid-session
 ```
 
-Reads session context from stdin, hashes every skill directory under `.claude/skills/`, and compares each hash against the registry. Writes a session state file so subsequent checks are fast. Exits non-zero if any skill fails verification.
+### Auth
 
-### Check a skill before tool execution (PreToolUse hook)
+```sh
+oathbound login    # Authenticate with oathbound.ai
+oathbound logout   # Clear stored credentials
+oathbound whoami   # Show current user
+```
+
+### Setup
 
 ```sh
-oathbound verify --check
+oathbound init [--global|--local]   # Interactive setup wizard
+oathbound setup                     # Non-interactive (runs via npm prepare hook)
 ```
 
-Reads tool invocation context from stdin, re-hashes the relevant skill directory, and compares it against the hash recorded at session start. If the skill was modified after verification, the hook denies execution.
+`init` configures Claude Code hooks in your settings. By default it sets up both global (`~/.claude/settings.json`) and local (`.claude/settings.json`) hooks. Pass `--global` or `--local` to configure only one scope.
+
+`setup` is meant to run automatically via the `prepare` script when someone installs your project's dependencies. It reads `.oathbound.jsonc` and merges hooks into `.claude/settings.json` without prompts.
 
 ## Hook integration
 
-oathbound is designed to run as [Claude Code hooks](https://docs.anthropic.com/en/docs/claude-code/hooks). Add it to your `.claude/settings.json`:
+oathbound is designed to run as [Claude Code hooks](https://docs.anthropic.com/en/docs/claude-code/hooks). The easiest way to set this up is `oathbound init`, which adds the hooks to your `.claude/settings.json`:
 
 ```json
 {
@@ -70,14 +97,14 @@ oathbound is designed to run as [Claude Code hooks](https://docs.anthropic.com/e
 
 ## How it works
 
-1. **Pull**: Downloads a skill tarball from Supabase storage, verifies the SHA-256 hash of the tarball against the registry, and extracts the skill into `.claude/skills/`.
+1. **Pull**: Downloads a skill tarball from the registry, verifies the SHA-256 hash of the tarball, and extracts the skill into `.claude/skills/`.
 
 2. **SessionStart verification**: Walks each subdirectory in `.claude/skills/`, collects all files (excluding `node_modules`, lockfiles, and `.DS_Store`), sorts them by path, hashes each file with SHA-256, then hashes the combined manifest. The resulting content hash is compared against the registry. Verified hashes are written to a temporary session state file.
 
 3. **PreToolUse verification**: Re-hashes the skill directory on disk and compares it against the hash saved at session start. If the content has changed since verification, the tool invocation is denied. This detects mid-session tampering.
 
-The content hash algorithm is deterministic: files are sorted lexicographically by relative path, each file is individually hashed, and the concatenated `path\0hash` lines are hashed together. The same algorithm runs on both the registry (frontend) and the CLI to guarantee parity.
+The content hash algorithm is deterministic: files are sorted lexicographically by relative path, each file is individually hashed, and the concatenated `path\0hash` lines are hashed together. The same algorithm runs on both the registry and the CLI to guarantee parity.
 
 ## License
 
-Business Source License 1.1 (BUSL-1.1). The Change Date is 2028-03-04, after which the code is available under Apache 2.0.
+MIT

package/dist/cli.cjs

@@ -11518,12 +11518,12 @@ var require_resolve_flow_scalar = __commonJS((exports2) => {
         };
     }
     const valueEnd = offset + source.length;
-    const re = resolveEnd.resolveEnd(end, valueEnd, strict, onError);
+    const re2 = resolveEnd.resolveEnd(end, valueEnd, strict, onError);
     return {
       value,
       type: _type,
-      comment: re.comment,
-      range: [offset, valueEnd, re.offset]
+      comment: re2.comment,
+      range: [offset, valueEnd, re2.offset]
     };
   }
   function plainValue(source, onError) {
@@ -11895,10 +11895,10 @@ var require_compose_node = __commonJS((exports2) => {
     if (alias.source.endsWith(":"))
       onError(offset + source.length - 1, "BAD_ALIAS", "Alias ending in : is ambiguous", true);
     const valueEnd = offset + source.length;
-    const re = resolveEnd.resolveEnd(end, valueEnd, options.strict, onError);
-    alias.range = [offset, valueEnd, re.offset];
-    if (re.comment)
-      alias.comment = re.comment;
+    const re2 = resolveEnd.resolveEnd(end, valueEnd, options.strict, onError);
+    alias.range = [offset, valueEnd, re2.offset];
+    if (re2.comment)
+      alias.comment = re2.comment;
     return alias;
   }
   exports2.composeEmptyNode = composeEmptyNode;
@@ -11936,10 +11936,10 @@ var require_compose_doc = __commonJS((exports2) => {
     }
     doc.contents = value ? composeNode.composeNode(ctx, value, props, onError) : composeNode.composeEmptyNode(ctx, props.end, start, null, props, onError);
     const contentEnd = doc.contents.range[2];
-    const re = resolveEnd.resolveEnd(end, contentEnd, false, onError);
-    if (re.comment)
-      doc.comment = re.comment;
-    doc.range = [offset, contentEnd, re.offset];
+    const re2 = resolveEnd.resolveEnd(end, contentEnd, false, onError);
+    if (re2.comment)
+      doc.comment = re2.comment;
+    doc.range = [offset, contentEnd, re2.offset];
     return doc;
   }
   exports2.composeDoc = composeDoc;
@@ -16704,7 +16704,15 @@ function W(t, e) {
   const s = t;
   s.isTTY && s.setRawMode(e);
 }
+var rt = (t) => ("columns" in t) && typeof t.columns == "number" ? t.columns : 80;
 var nt = (t) => ("rows" in t) && typeof t.rows == "number" ? t.rows : 20;
+function Bt(t, e, s, i = s) {
+  const r = rt(t ?? import_node_process.stdout);
+  return K(e, r - s.length, { hard: true, trim: false }).split(`
+`).map((n, u) => `${u === 0 ? i : s}${n}`).join(`
+`);
+}
+
 class B {
   input;
   output;
@@ -16973,6 +16981,33 @@ class yt extends B {
     });
   }
 }
+class Tt extends B {
+  options;
+  cursor = 0;
+  get _selectedValue() {
+    return this.options[this.cursor];
+  }
+  changeValue() {
+    this.value = this._selectedValue.value;
+  }
+  constructor(e) {
+    super(e, false), this.options = e.options;
+    const s = this.options.findIndex(({ value: r }) => r === e.initialValue), i = s === -1 ? 0 : s;
+    this.cursor = this.options[i].disabled ? x(i, 1, this.options) : i, this.changeValue(), this.on("cursor", (r) => {
+      switch (r) {
+        case "left":
+        case "up":
+          this.cursor = x(this.cursor, -1, this.options);
+          break;
+        case "down":
+        case "right":
+          this.cursor = x(this.cursor, 1, this.options);
+          break;
+      }
+      this.changeValue();
+    });
+  }
+}
 
 // node_modules/@clack/prompts/dist/index.mjs
 var import_node_util2 = require("node:util");
@@ -17021,13 +17056,234 @@ var W2 = (e) => {
       return import_node_util2.styleText("green", V);
   }
 };
+var ve = (e) => {
+  switch (e) {
+    case "initial":
+    case "active":
+      return import_node_util2.styleText("cyan", h);
+    case "cancel":
+      return import_node_util2.styleText("red", h);
+    case "error":
+      return import_node_util2.styleText("yellow", h);
+    case "submit":
+      return import_node_util2.styleText("green", h);
+  }
+};
+var mt2 = (e) => e === 161 || e === 164 || e === 167 || e === 168 || e === 170 || e === 173 || e === 174 || e >= 176 && e <= 180 || e >= 182 && e <= 186 || e >= 188 && e <= 191 || e === 198 || e === 208 || e === 215 || e === 216 || e >= 222 && e <= 225 || e === 230 || e >= 232 && e <= 234 || e === 236 || e === 237 || e === 240 || e === 242 || e === 243 || e >= 247 && e <= 250 || e === 252 || e === 254 || e === 257 || e === 273 || e === 275 || e === 283 || e === 294 || e === 295 || e === 299 || e >= 305 && e <= 307 || e === 312 || e >= 319 && e <= 322 || e === 324 || e >= 328 && e <= 331 || e === 333 || e === 338 || e === 339 || e === 358 || e === 359 || e === 363 || e === 462 || e === 464 || e === 466 || e === 468 || e === 470 || e === 472 || e === 474 || e === 476 || e === 593 || e === 609 || e === 708 || e === 711 || e >= 713 && e <= 715 || e === 717 || e === 720 || e >= 728 && e <= 731 || e === 733 || e === 735 || e >= 768 && e <= 879 || e >= 913 && e <= 929 || e >= 931 && e <= 937 || e >= 945 && e <= 961 || e >= 963 && e <= 969 || e === 1025 || e >= 1040 && e <= 1103 || e === 1105 || e === 8208 || e >= 8211 && e <= 8214 || e === 8216 || e === 8217 || e === 8220 || e === 8221 || e >= 8224 && e <= 8226 || e >= 8228 && e <= 8231 || e === 8240 || e === 8242 || e === 8243 || e === 8245 || e === 8251 || e === 8254 || e === 8308 || e === 8319 || e >= 8321 && e <= 8324 || e === 8364 || e === 8451 || e === 8453 || e === 8457 || e === 8467 || e === 8470 || e === 8481 || e === 8482 || e === 8486 || e === 8491 || e === 8531 || e === 8532 || e >= 8539 && e <= 8542 || e >= 8544 && e <= 8555 || e >= 8560 && e <= 8569 || e === 8585 || e >= 8592 && e <= 8601 || e === 8632 || e === 8633 || e === 8658 || e === 8660 || e === 8679 || e === 8704 || e === 8706 || e === 8707 || e === 8711 || e === 8712 || e === 8715 || e === 8719 || e === 8721 || e === 8725 || e === 8730 || e >= 8733 && e <= 8736 || e === 8739 || e === 8741 || e >= 8743 && e <= 8748 || e === 8750 || e >= 8756 && e <= 8759 || e === 8764 || e === 8765 || e === 8776 || e === 8780 || e === 8786 || e === 8800 || e === 8801 || e >= 8804 && e <= 8807 || e === 8810 || e === 8811 || e === 8814 || e === 8815 || e === 8834 || e === 8835 || e === 8838 || e === 8839 || e === 8853 || e === 8857 || e === 8869 || e === 8895 || e === 8978 || e >= 9312 && e <= 9449 || e >= 9451 && e <= 9547 || e >= 9552 && e <= 9587 || e >= 9600 && e <= 9615 || e >= 9618 && e <= 9621 || e === 9632 || e === 9633 || e >= 9635 && e <= 9641 || e === 9650 || e === 9651 || e === 9654 || e === 9655 || e === 9660 || e === 9661 || e === 9664 || e === 9665 || e >= 9670 && e <= 9672 || e === 9675 || e >= 9678 && e <= 9681 || e >= 9698 && e <= 9701 || e === 9711 || e === 9733 || e === 9734 || e === 9737 || e === 9742 || e === 9743 || e === 9756 || e === 9758 || e === 9792 || e === 9794 || e === 9824 || e === 9825 || e >= 9827 && e <= 9829 || e >= 9831 && e <= 9834 || e === 9836 || e === 9837 || e === 9839 || e === 9886 || e === 9887 || e === 9919 || e >= 9926 && e <= 9933 || e >= 9935 && e <= 9939 || e >= 9941 && e <= 9953 || e === 9955 || e === 9960 || e === 9961 || e >= 9963 && e <= 9969 || e === 9972 || e >= 9974 && e <= 9977 || e === 9979 || e === 9980 || e === 9982 || e === 9983 || e === 10045 || e >= 10102 && e <= 10111 || e >= 11094 && e <= 11097 || e >= 12872 && e <= 12879 || e >= 57344 && e <= 63743 || e >= 65024 && e <= 65039 || e === 65533 || e >= 127232 && e <= 127242 || e >= 127248 && e <= 127277 || e >= 127280 && e <= 127337 || e >= 127344 && e <= 127373 || e === 127375 || e === 127376 || e >= 127387 && e <= 127404 || e >= 917760 && e <= 917999 || e >= 983040 && e <= 1048573 || e >= 1048576 && e <= 1114109;
+var gt2 = (e) => e === 12288 || e >= 65281 && e <= 65376 || e >= 65504 && e <= 65510;
+var ft2 = (e) => e >= 4352 && e <= 4447 || e === 8986 || e === 8987 || e === 9001 || e === 9002 || e >= 9193 && e <= 9196 || e === 9200 || e === 9203 || e === 9725 || e === 9726 || e === 9748 || e === 9749 || e >= 9800 && e <= 9811 || e === 9855 || e === 9875 || e === 9889 || e === 9898 || e === 9899 || e === 9917 || e === 9918 || e === 9924 || e === 9925 || e === 9934 || e === 9940 || e === 9962 || e === 9970 || e === 9971 || e === 9973 || e === 9978 || e === 9981 || e === 9989 || e === 9994 || e === 9995 || e === 10024 || e === 10060 || e === 10062 || e >= 10067 && e <= 10069 || e === 10071 || e >= 10133 && e <= 10135 || e === 10160 || e === 10175 || e === 11035 || e === 11036 || e === 11088 || e === 11093 || e >= 11904 && e <= 11929 || e >= 11931 && e <= 12019 || e >= 12032 && e <= 12245 || e >= 12272 && e <= 12287 || e >= 12289 && e <= 12350 || e >= 12353 && e <= 12438 || e >= 12441 && e <= 12543 || e >= 12549 && e <= 12591 || e >= 12593 && e <= 12686 || e >= 12688 && e <= 12771 || e >= 12783 && e <= 12830 || e >= 12832 && e <= 12871 || e >= 12880 && e <= 19903 || e >= 19968 && e <= 42124 || e >= 42128 && e <= 42182 || e >= 43360 && e <= 43388 || e >= 44032 && e <= 55203 || e >= 63744 && e <= 64255 || e >= 65040 && e <= 65049 || e >= 65072 && e <= 65106 || e >= 65108 && e <= 65126 || e >= 65128 && e <= 65131 || e >= 94176 && e <= 94180 || e === 94192 || e === 94193 || e >= 94208 && e <= 100343 || e >= 100352 && e <= 101589 || e >= 101632 && e <= 101640 || e >= 110576 && e <= 110579 || e >= 110581 && e <= 110587 || e === 110589 || e === 110590 || e >= 110592 && e <= 110882 || e === 110898 || e >= 110928 && e <= 110930 || e === 110933 || e >= 110948 && e <= 110951 || e >= 110960 && e <= 111355 || e === 126980 || e === 127183 || e === 127374 || e >= 127377 && e <= 127386 || e >= 127488 && e <= 127490 || e >= 127504 && e <= 127547 || e >= 127552 && e <= 127560 || e === 127568 || e === 127569 || e >= 127584 && e <= 127589 || e >= 127744 && e <= 127776 || e >= 127789 && e <= 127797 || e >= 127799 && e <= 127868 || e >= 127870 && e <= 127891 || e >= 127904 && e <= 127946 || e >= 127951 && e <= 127955 || e >= 127968 && e <= 127984 || e === 127988 || e >= 127992 && e <= 128062 || e === 128064 || e >= 128066 && e <= 128252 || e >= 128255 && e <= 128317 || e >= 128331 && e <= 128334 || e >= 128336 && e <= 128359 || e === 128378 || e === 128405 || e === 128406 || e === 128420 || e >= 128507 && e <= 128591 || e >= 128640 && e <= 128709 || e === 128716 || e >= 128720 && e <= 128722 || e >= 128725 && e <= 128727 || e >= 128732 && e <= 128735 || e === 128747 || e === 128748 || e >= 128756 && e <= 128764 || e >= 128992 && e <= 129003 || e === 129008 || e >= 129292 && e <= 129338 || e >= 129340 && e <= 129349 || e >= 129351 && e <= 129535 || e >= 129648 && e <= 129660 || e >= 129664 && e <= 129672 || e >= 129680 && e <= 129725 || e >= 129727 && e <= 129733 || e >= 129742 && e <= 129755 || e >= 129760 && e <= 129768 || e >= 129776 && e <= 129784 || e >= 131072 && e <= 196605 || e >= 196608 && e <= 262141;
+var we = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/y;
+var re = /[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y;
+var ie = /\t{1,1000}/y;
+var Ae = /[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu;
+var ne = /(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y;
+var Ft2 = /\p{M}+/gu;
 var yt2 = { limit: 1 / 0, ellipsis: "" };
+var Le = (e, r = {}, s = {}) => {
+  const i = r.limit ?? 1 / 0, a = r.ellipsis ?? "", o = r?.ellipsisWidth ?? (a ? Le(a, yt2, s).width : 0), u = s.ansiWidth ?? 0, l = s.controlWidth ?? 0, n = s.tabWidth ?? 8, c = s.ambiguousWidth ?? 1, p = s.emojiWidth ?? 2, f = s.fullWidthWidth ?? 2, g = s.regularWidth ?? 1, E = s.wideWidth ?? 2;
+  let $ = 0, m = 0, d = e.length, F = 0, y2 = false, v = d, C = Math.max(0, i - o), A = 0, b = 0, w = 0, S2 = 0;
+  e:
+    for (;; ) {
+      if (b > A || m >= d && m > $) {
+        const T2 = e.slice(A, b) || e.slice($, m);
+        F = 0;
+        for (const M2 of T2.replaceAll(Ft2, "")) {
+          const O2 = M2.codePointAt(0) || 0;
+          if (gt2(O2) ? S2 = f : ft2(O2) ? S2 = E : c !== g && mt2(O2) ? S2 = c : S2 = g, w + S2 > C && (v = Math.min(v, Math.max(A, $) + F)), w + S2 > i) {
+            y2 = true;
+            break e;
+          }
+          F += M2.length, w += S2;
+        }
+        A = b = 0;
+      }
+      if (m >= d)
+        break;
+      if (ne.lastIndex = m, ne.test(e)) {
+        if (F = ne.lastIndex - m, S2 = F * g, w + S2 > C && (v = Math.min(v, m + Math.floor((C - w) / g))), w + S2 > i) {
+          y2 = true;
+          break;
+        }
+        w += S2, A = $, b = m, m = $ = ne.lastIndex;
+        continue;
+      }
+      if (we.lastIndex = m, we.test(e)) {
+        if (w + u > C && (v = Math.min(v, m)), w + u > i) {
+          y2 = true;
+          break;
+        }
+        w += u, A = $, b = m, m = $ = we.lastIndex;
+        continue;
+      }
+      if (re.lastIndex = m, re.test(e)) {
+        if (F = re.lastIndex - m, S2 = F * l, w + S2 > C && (v = Math.min(v, m + Math.floor((C - w) / l))), w + S2 > i) {
+          y2 = true;
+          break;
+        }
+        w += S2, A = $, b = m, m = $ = re.lastIndex;
+        continue;
+      }
+      if (ie.lastIndex = m, ie.test(e)) {
+        if (F = ie.lastIndex - m, S2 = F * n, w + S2 > C && (v = Math.min(v, m + Math.floor((C - w) / n))), w + S2 > i) {
+          y2 = true;
+          break;
+        }
+        w += S2, A = $, b = m, m = $ = ie.lastIndex;
+        continue;
+      }
+      if (Ae.lastIndex = m, Ae.test(e)) {
+        if (w + p > C && (v = Math.min(v, m)), w + p > i) {
+          y2 = true;
+          break;
+        }
+        w += p, A = $, b = m, m = $ = Ae.lastIndex;
+        continue;
+      }
+      m += 1;
+    }
+  return { width: y2 ? C : w, index: y2 ? v : d, truncated: y2, ellipsed: y2 && i >= o };
+};
 var Et2 = { limit: 1 / 0, ellipsis: "", ellipsisWidth: 0 };
+var D2 = (e, r = {}) => Le(e, Et2, r).width;
+var ae = "\x1B";
+var je = "›";
+var vt2 = 39;
 var Ce = "\x07";
 var ke = "[";
 var wt2 = "]";
+var Ve = "m";
 var Se = `${wt2}8;;`;
 var He = new RegExp(`(?:\\${ke}(?<code>\\d+)m|\\${Se}(?<uri>.*)${Ce})`, "y");
+var At2 = (e) => {
+  if (e >= 30 && e <= 37 || e >= 90 && e <= 97)
+    return 39;
+  if (e >= 40 && e <= 47 || e >= 100 && e <= 107)
+    return 49;
+  if (e === 1 || e === 2)
+    return 22;
+  if (e === 3)
+    return 23;
+  if (e === 4)
+    return 24;
+  if (e === 7)
+    return 27;
+  if (e === 8)
+    return 28;
+  if (e === 9)
+    return 29;
+  if (e === 0)
+    return 0;
+};
+var Ue = (e) => `${ae}${ke}${e}${Ve}`;
+var Ke = (e) => `${ae}${Se}${e}${Ce}`;
+var Ct2 = (e) => e.map((r) => D2(r));
+var Ie = (e, r, s) => {
+  const i = r[Symbol.iterator]();
+  let a = false, o = false, u = e.at(-1), l = u === undefined ? 0 : D2(u), n = i.next(), c = i.next(), p = 0;
+  for (;!n.done; ) {
+    const f = n.value, g = D2(f);
+    l + g <= s ? e[e.length - 1] += f : (e.push(f), l = 0), (f === ae || f === je) && (a = true, o = r.startsWith(Se, p + 1)), a ? o ? f === Ce && (a = false, o = false) : f === Ve && (a = false) : (l += g, l === s && !c.done && (e.push(""), l = 0)), n = c, c = i.next(), p += f.length;
+  }
+  u = e.at(-1), !l && u !== undefined && u.length > 0 && e.length > 1 && (e[e.length - 2] += e.pop());
+};
+var St2 = (e) => {
+  const r = e.split(" ");
+  let s = r.length;
+  for (;s > 0 && !(D2(r[s - 1]) > 0); )
+    s--;
+  return s === r.length ? e : r.slice(0, s).join(" ") + r.slice(s).join("");
+};
+var It2 = (e, r, s = {}) => {
+  if (s.trim !== false && e.trim() === "")
+    return "";
+  let i = "", a, o;
+  const u = e.split(" "), l = Ct2(u);
+  let n = [""];
+  for (const [$, m] of u.entries()) {
+    s.trim !== false && (n[n.length - 1] = (n.at(-1) ?? "").trimStart());
+    let d = D2(n.at(-1) ?? "");
+    if ($ !== 0 && (d >= r && (s.wordWrap === false || s.trim === false) && (n.push(""), d = 0), (d > 0 || s.trim === false) && (n[n.length - 1] += " ", d++)), s.hard && l[$] > r) {
+      const F = r - d, y2 = 1 + Math.floor((l[$] - F - 1) / r);
+      Math.floor((l[$] - 1) / r) < y2 && n.push(""), Ie(n, m, r);
+      continue;
+    }
+    if (d + l[$] > r && d > 0 && l[$] > 0) {
+      if (s.wordWrap === false && d < r) {
+        Ie(n, m, r);
+        continue;
+      }
+      n.push("");
+    }
+    if (d + l[$] > r && s.wordWrap === false) {
+      Ie(n, m, r);
+      continue;
+    }
+    n[n.length - 1] += m;
+  }
+  s.trim !== false && (n = n.map(($) => St2($)));
+  const c = n.join(`
+`), p = c[Symbol.iterator]();
+  let f = p.next(), g = p.next(), E = 0;
+  for (;!f.done; ) {
+    const $ = f.value, m = g.value;
+    if (i += $, $ === ae || $ === je) {
+      He.lastIndex = E + 1;
+      const y2 = He.exec(c)?.groups;
+      if (y2?.code !== undefined) {
+        const v = Number.parseFloat(y2.code);
+        a = v === vt2 ? undefined : v;
+      } else
+        y2?.uri !== undefined && (o = y2.uri.length === 0 ? undefined : y2.uri);
+    }
+    const d = a ? At2(a) : undefined;
+    m === `
+` ? (o && (i += Ke("")), a && d && (i += Ue(d))) : $ === `
+` && (a && d && (i += Ue(a)), o && (i += Ke(o))), E += $.length, f = g, g = p.next();
+  }
+  return i;
+};
+function J(e, r, s) {
+  return String(e).normalize().replaceAll(`\r
+`, `
+`).split(`
+`).map((i) => It2(i, r, s)).join(`
+`);
+}
+var bt2 = (e, r, s, i, a) => {
+  let o = r, u = 0;
+  for (let l = s;l < i; l++) {
+    const n = e[l];
+    if (o = o - n.length, u++, o <= a)
+      break;
+  }
+  return { lineCount: o, removals: u };
+};
+var X2 = ({ cursor: e, options: r, style: s, output: i = process.stdout, maxItems: a = Number.POSITIVE_INFINITY, columnPadding: o = 0, rowPadding: u = 4 }) => {
+  const l = rt(i) - o, n = nt(i), c = import_node_util2.styleText("dim", "..."), p = Math.max(n - u, 0), f = Math.max(Math.min(a, p), 5);
+  let g = 0;
+  e >= f - 3 && (g = Math.max(Math.min(e - f + 3, r.length - f), 0));
+  let E = f < r.length && g > 0, $ = f < r.length && g + f < r.length;
+  const m = Math.min(g + f, r.length), d = [];
+  let F = 0;
+  E && F++, $ && F++;
+  const y2 = g + (E ? 1 : 0), v = m - ($ ? 1 : 0);
+  for (let A = y2;A < v; A++) {
+    const b = J(s(r[A], A === e), l, { hard: true, trim: false }).split(`
+`);
+    d.push(b), F += b.length;
+  }
+  if (F > p) {
+    let A = 0, b = 0, w = F;
+    const S2 = e - y2, T2 = (M2, O2) => bt2(d, w, M2, O2, p);
+    E ? ({ lineCount: w, removals: A } = T2(0, S2), w > p && ({ lineCount: w, removals: b } = T2(S2 + 1, d.length))) : ({ lineCount: w, removals: b } = T2(S2 + 1, d.length), w > p && ({ lineCount: w, removals: A } = T2(0, S2))), A > 0 && (E = true, d.splice(0, A)), b > 0 && ($ = true, d.splice(d.length - b, b));
+  }
+  const C = [];
+  E && C.push(c);
+  for (const A of d)
+    for (const b of A)
+      C.push(b);
+  return $ && C.push(c), C;
+};
 var Rt = (e) => {
   const r = e.active ?? "Yes", s = e.inactive ?? "No";
   return new kt({ active: r, inactive: s, signal: e.signal, input: e.input, output: e.output, initialValue: e.initialValue ?? true, render() {
@@ -17074,6 +17330,51 @@ ${import_node_util2.styleText("gray", x2)}  ` : "";
 `);
 };
 var ze = { light: I2("─", "-"), heavy: I2("━", "="), block: I2("█", "#") };
+var oe = (e, r) => e.includes(`
+`) ? e.split(`
+`).map((s) => r(s)).join(`
+`) : r(e);
+var Jt = (e) => {
+  const r = (s, i) => {
+    const a = s.label ?? String(s.value);
+    switch (i) {
+      case "disabled":
+        return `${import_node_util2.styleText("gray", H2)} ${oe(a, (o) => import_node_util2.styleText("gray", o))}${s.hint ? ` ${import_node_util2.styleText("dim", `(${s.hint ?? "disabled"})`)}` : ""}`;
+      case "selected":
+        return `${oe(a, (o) => import_node_util2.styleText("dim", o))}`;
+      case "active":
+        return `${import_node_util2.styleText("green", z2)} ${a}${s.hint ? ` ${import_node_util2.styleText("dim", `(${s.hint})`)}` : ""}`;
+      case "cancelled":
+        return `${oe(a, (o) => import_node_util2.styleText(["strikethrough", "dim"], o))}`;
+      default:
+        return `${import_node_util2.styleText("dim", H2)} ${oe(a, (o) => import_node_util2.styleText("dim", o))}`;
+    }
+  };
+  return new Tt({ options: e.options, signal: e.signal, input: e.input, output: e.output, initialValue: e.initialValue, render() {
+    const s = e.withGuide ?? _.withGuide, i = `${W2(this.state)}  `, a = `${ve(this.state)}  `, o = Bt(e.output, e.message, a, i), u = `${s ? `${import_node_util2.styleText("gray", h)}
+` : ""}${o}
+`;
+    switch (this.state) {
+      case "submit": {
+        const l = s ? `${import_node_util2.styleText("gray", h)}  ` : "", n = Bt(e.output, r(this.options[this.cursor], "selected"), l);
+        return `${u}${n}`;
+      }
+      case "cancel": {
+        const l = s ? `${import_node_util2.styleText("gray", h)}  ` : "", n = Bt(e.output, r(this.options[this.cursor], "cancelled"), l);
+        return `${u}${n}${s ? `
+${import_node_util2.styleText("gray", h)}` : ""}`;
+      }
+      default: {
+        const l = s ? `${import_node_util2.styleText("cyan", h)}  ` : "", n = s ? import_node_util2.styleText("cyan", x2) : "", c = u.split(`
+`).length, p = s ? 2 : 1;
+        return `${u}${l}${X2({ output: e.output, cursor: this.cursor, options: this.options, maxItems: e.maxItems, columnPadding: l.length, rowPadding: c + p, style: (f, g) => r(f, f.disabled ? "disabled" : g ? "active" : "inactive") }).join(`
+${l}`)}
+${n}
+`;
+      }
+    }
+  } }).prompt();
+};
 var Qe = `${import_node_util2.styleText("gray", h)}  `;
 
 // ui.ts
@@ -17285,6 +17586,16 @@ function mergeClaudeSettings(targetDir) {
 `);
   return "merged";
 }
+function settingsHaveOathboundHooks(settingsPath) {
+  if (!import_node_fs.existsSync(settingsPath))
+    return false;
+  try {
+    const settings = JSON.parse(import_node_fs.readFileSync(settingsPath, "utf-8"));
+    return hasOathboundHooks(settings);
+  } catch {
+    return false;
+  }
+}
 
 // update.ts
 var import_node_fs2 = require("node:fs");
@@ -17554,7 +17865,7 @@ function findSkillsDirs() {
   }
   return results;
 }
-function propagateToProject() {
+function propagateToProject(version3) {
   try {
     const cwd = process.cwd();
     const localSkills = import_node_path5.join(cwd, ".claude", "skills");
@@ -17571,7 +17882,7 @@ function propagateToProject() {
     const raw = import_node_fs5.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     if (!pkg.devDependencies?.oathbound && !pkg.dependencies?.oathbound) {
-      pkg.devDependencies = { ...pkg.devDependencies ?? {}, oathbound: "latest" };
+      pkg.devDependencies = { ...pkg.devDependencies ?? {}, oathbound: `^${version3}` };
       const indent = raw.match(/^(\s+)/m)?.[1]?.length ?? 2;
       import_node_fs5.writeFileSync(pkgPath, JSON.stringify(pkg, null, indent) + `
 `);
@@ -17643,6 +17954,13 @@ ${TEAL}${BOLD}⬡ oathbound${RESET} ${YELLOW}⚠ Warning:${RESET} skill ${BOLD}"
 `);
   process.exit(0);
 }
+function enforceSkill(skillName, reason, enforcement) {
+  if (enforcement === "warn") {
+    warnSkill(skillName, reason);
+  } else {
+    denySkill(skillName, reason, enforcement);
+  }
+}
 function isExternalSkillAccess(toolName, toolInput, knownDirs, baseName) {
   const resolvedDirs = knownDirs.map((d) => import_node_path5.resolve(d));
   const isUnderKnownDir = (p) => {
@@ -17685,7 +18003,7 @@ function parseSkillVersion(skillDir) {
     return null;
   }
 }
-async function verify(supabaseUrl, supabaseAnonKey) {
+async function verify(supabaseUrl, supabaseAnonKey, version3) {
   let input;
   try {
     input = JSON.parse(await readStdin());
@@ -17701,7 +18019,7 @@ async function verify(supabaseUrl, supabaseAnonKey) {
     process.exit(1);
   }
   const skillsDirs = findSkillsDirs();
-  propagateToProject();
+  propagateToProject(version3);
   if (skillsDirs.length === 0) {
     const state2 = { verified: {}, rejected: [], ok: true };
     import_node_fs5.writeFileSync(sessionStatePath(sessionId), JSON.stringify(state2));
@@ -17754,11 +18072,11 @@ async function verify(supabaseUrl, supabaseAnonKey) {
   const warnings = [];
   process.stderr.write(`${BRAND} ${TEAL}verifying skills...${RESET}
 `);
-  for (const [name, { hash: localHash, version: version3 }] of Object.entries(localSkills)) {
+  for (const [name, { hash: localHash, version: version4 }] of Object.entries(localSkills)) {
     const versionMap = registryMap.get(name);
-    const entry = versionMap?.get(version3);
+    const entry = versionMap?.get(version4);
     if (!entry) {
-      process.stderr.write(`${DIM}   ${name}@${version3}: ${localHash} (not in registry)${RESET}
+      process.stderr.write(`${DIM}   ${name}@${version4}: ${localHash} (not in registry)${RESET}
 `);
       if (enforcement === "warn") {
         warnings.push({ name, reason: "not in registry" });
@@ -17767,7 +18085,7 @@ async function verify(supabaseUrl, supabaseAnonKey) {
         rejected.push({ name, reason: "not in registry" });
       }
     } else if (localHash !== entry.hash) {
-      process.stderr.write(`${RED}   ${name}@${version3}: ${localHash} ≠ ${entry.hash}${RESET}
+      process.stderr.write(`${RED}   ${name}@${version4}: ${localHash} ≠ ${entry.hash}${RESET}
 `);
       if (enforcement === "warn") {
         warnings.push({ name, reason: `content hash mismatch (local: ${localHash.slice(0, 8)}…, registry: ${entry.hash.slice(0, 8)}…)` });
@@ -17776,11 +18094,11 @@ async function verify(supabaseUrl, supabaseAnonKey) {
         rejected.push({ name, reason: `content hash mismatch (local: ${localHash.slice(0, 8)}…, registry: ${entry.hash.slice(0, 8)}…)` });
       }
     } else if (enforcement === "audited" && !entry.audited) {
-      process.stderr.write(`${YELLOW}   ${name}@${version3}: ${localHash} (registered but not audited)${RESET}
+      process.stderr.write(`${YELLOW}   ${name}@${version4}: ${localHash} (registered but not audited)${RESET}
 `);
       rejected.push({ name, reason: "no passed audit" });
     } else {
-      process.stderr.write(`${GREEN}   ${name}@${version3}: ${localHash} ✓${RESET}
+      process.stderr.write(`${GREEN}   ${name}@${version4}: ${localHash} ✓${RESET}
 `);
       verified[name] = localHash;
     }
@@ -17901,27 +18219,15 @@ async function verifyCheck() {
     process.exit(0);
   }
   if (!skillDir || !import_node_fs5.existsSync(skillDir) || !import_node_fs5.statSync(skillDir).isDirectory()) {
-    if (enforcement === "warn") {
-      warnSkill(baseName, "not installed locally");
-    } else {
-      denySkill(baseName, "not installed locally", enforcement);
-    }
+    enforceSkill(baseName, "not installed locally", enforcement);
   }
   const currentHash = hashSkillDir(skillDir);
   const sessionHash = state.verified[baseName];
   if (!sessionHash) {
-    if (enforcement === "warn") {
-      warnSkill(baseName, "not verified at session start");
-    } else {
-      denySkill(baseName, "not verified at session start", enforcement);
-    }
+    enforceSkill(baseName, "not verified at session start", enforcement);
   }
   if (currentHash !== sessionHash) {
-    if (enforcement === "warn") {
-      warnSkill(baseName, `modified since session start (${currentHash.slice(0, 8)}… ≠ ${sessionHash.slice(0, 8)}…)`);
-    } else {
-      denySkill(baseName, `modified since session start — tampering detected (${currentHash.slice(0, 8)}… ≠ ${sessionHash.slice(0, 8)}…)`, enforcement);
-    }
+    enforceSkill(baseName, `modified since session start (${currentHash.slice(0, 8)}… ≠ ${sessionHash.slice(0, 8)}…)`, enforcement);
   }
   process.stderr.write(`${GREEN}   ${baseName}: ${currentHash} ✓${RESET}
 `);
@@ -17934,9 +18240,13 @@ var import_node_fs6 = require("node:fs");
 var import_node_http = require("node:http");
 var import_node_path6 = require("node:path");
 var import_node_os3 = require("node:os");
+
+// constants.ts
 var SUPABASE_URL = "https://mjnfqagwuewhgwbtrdgs.supabase.co";
 var SUPABASE_ANON_KEY = "sb_publishable_T-rk0azNRqAMLLGCyadyhQ_ulk9685n";
 var API_BASE = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
+
+// auth.ts
 var AUTH_DIR = import_node_path6.join(import_node_os3.homedir(), ".oathbound");
 var AUTH_FILE = import_node_path6.join(AUTH_DIR, "auth.json");
 function saveSession(session) {
@@ -18072,7 +18382,7 @@ async function getAccessToken() {
   saveSession({
     access_token: data.session.access_token,
     refresh_token: data.session.refresh_token,
-    expires_at: data.session.expires_at
+    expires_at: data.session.expires_at ?? Math.floor(Date.now() / 1000) + 3600
   });
   return data.session.access_token;
 }
@@ -18097,7 +18407,6 @@ ${BRAND}`);
 var import_node_fs7 = require("node:fs");
 var import_node_path7 = require("node:path");
 var import_yaml2 = __toESM(require_dist(), 1);
-var API_BASE2 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
 async function push(pathArg, options) {
   Wt2(BRAND);
   const skillDir = resolveSkillDir(pathArg);
@@ -18141,7 +18450,7 @@ async function push(pathArg, options) {
   console.log(`${DIM}   ${files.length} file(s)${RESET}`);
   const token = await getAccessToken();
   const spin = spinner("Pushing...");
-  const response = await fetch(`${API_BASE2}/api/skills`, {
+  const response = await fetch(`${API_BASE}/api/skills`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -18195,7 +18504,6 @@ function parseFrontmatter(content) {
 }
 
 // search.ts
-var API_BASE3 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
 function parseSearchArgs(args) {
   const opts = {};
   let i = 0;
@@ -18234,7 +18542,7 @@ async function search(opts) {
     params.set("limit", String(opts.limit));
   if (opts.offset != null)
     params.set("offset", String(opts.offset));
-  const url = `${API_BASE3}/api/skills?${params}`;
+  const url = `${API_BASE}/api/skills?${params}`;
   const sp = spinner("Searching...");
   let res;
   try {
@@ -18307,7 +18615,6 @@ ${BRAND} ${TEAL}${showing}${RESET}
 var import_node_fs8 = require("node:fs");
 var import_node_path8 = require("node:path");
 var import_yaml3 = __toESM(require_dist(), 1);
-var API_BASE4 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
 function parseAgentFrontmatter(content) {
   const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
   if (!match)
@@ -18409,7 +18716,7 @@ async function agentPush(pathArg, options) {
     visibility
   };
   const spin = spinner("Pushing...");
-  const response = await fetch(`${API_BASE4}/api/agents`, {
+  const response = await fetch(`${API_BASE}/api/agents`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -18433,7 +18740,6 @@ async function agentPush(pathArg, options) {
 }
 
 // agent-search.ts
-var API_BASE5 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
 function parseAgentSearchArgs(args) {
   const opts = {};
   let i = 0;
@@ -18472,7 +18778,7 @@ async function agentSearch(opts) {
     params.set("limit", String(opts.limit));
   if (opts.offset != null)
     params.set("offset", String(opts.offset));
-  const url = `${API_BASE5}/api/agents?${params}`;
+  const url = `${API_BASE}/api/agents?${params}`;
   const sp = spinner("Searching agents...");
   let res;
   try {
@@ -18544,10 +18850,7 @@ ${BRAND} ${TEAL}${showing}${RESET}
   }
 }
 // cli.ts
-var VERSION = "0.16.0";
-var SUPABASE_URL2 = "https://mjnfqagwuewhgwbtrdgs.supabase.co";
-var SUPABASE_ANON_KEY2 = "sb_publishable_T-rk0azNRqAMLLGCyadyhQ_ulk9685n";
-var API_BASE6 = process.env.OATHBOUND_API_URL ?? "https://www.oathbound.ai";
+var VERSION = "0.17.1";
 function parseSkillArg(arg) {
   const slash = arg.indexOf("/");
   if (slash < 1 || slash === arg.length - 1)
@@ -18686,15 +18989,49 @@ async function init(options = {}) {
   }
   Gt(`\uD83C\uDF89 Oath Bound set up complete!`);
 }
+async function ensureInitialized() {
+  const globalSettings = import_node_path9.join(import_node_os4.homedir(), ".claude", "settings.json");
+  const localSettings = import_node_path9.join(process.cwd(), ".claude", "settings.json");
+  if (settingsHaveOathboundHooks(globalSettings) || settingsHaveOathboundHooks(localSettings)) {
+    return;
+  }
+  if (!process.stdin.isTTY) {
+    process.stderr.write("oathbound: no hooks configured. Run `npx oathbound init` first.\n");
+    process.exit(1);
+  }
+  process.stderr.write(`
+${BRAND} ${YELLOW}No oathbound hooks detected.${RESET}
+`);
+  process.stderr.write(`${DIM}   Hooks verify skills on every Claude Code session.${RESET}
+
+`);
+  const scope = await Jt({
+    message: "Where should oathbound install hooks?",
+    options: [
+      { value: "both", label: "Global + this project", hint: "recommended" },
+      { value: "global", label: "Global only", hint: "~/.claude/settings.json" },
+      { value: "local", label: "This project only", hint: ".claude/settings.json" }
+    ]
+  });
+  if (Ct(scope)) {
+    Nt("Pull cancelled.");
+    process.exit(1);
+  }
+  if (scope === "both" || scope === "global")
+    initGlobal();
+  if (scope === "both" || scope === "local")
+    await initLocal();
+}
 async function pull(skillArg, options = {}) {
   const parsed = parseSkillArg(skillArg);
   if (!parsed)
     usage();
   const { namespace, name, version: version3 } = parsed;
   const fullName = `${namespace}/${name}`;
+  await ensureInitialized();
   console.log(`
 ${BRAND} ${TEAL}↓ Pulling ${fullName}${version3 ? `@${version3}` : ""}...${RESET}`);
-  const supabase = createClient(SUPABASE_URL2, SUPABASE_ANON_KEY2);
+  const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
   let skill;
   if (version3 !== null) {
     const { data, error } = await supabase.from("skills").select("id, name, namespace, version, tar_hash, storage_path").eq("namespace", namespace).eq("name", name).eq("version", version3).single();
@@ -18748,7 +19085,7 @@ ${BRAND} ${TEAL}↓ Pulling ${fullName}${version3 ? `@${version3}` : ""}...${RES
   }
   import_node_fs9.unlinkSync(tarFile);
   try {
-    const trackRes = await fetch(`${API_BASE6}/api/downloads`, {
+    const trackRes = await fetch(`${API_BASE}/api/downloads`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ skill_id: skill.id, version: skill.version })
@@ -18770,7 +19107,7 @@ async function agentPull(agentArg) {
   const fullName = `${namespace}/${name}`;
   console.log(`
 ${BRAND} ${TEAL}↓ Pulling agent ${fullName}${version3 ? `@${version3}` : ""}...${RESET}`);
-  const supabase = createClient(SUPABASE_URL2, SUPABASE_ANON_KEY2);
+  const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
   let agent;
   if (version3 !== null) {
     const { data, error } = await supabase.from("agents").select("id, name, namespace, version, content_hash, storage_path, config").eq("namespace", namespace).eq("name", name).eq("version", version3).single();
@@ -18833,7 +19170,7 @@ ${YELLOW}${BOLD} ⚠ This agent defines MCP servers (external connections):${RES
   }
   import_node_fs9.writeFileSync(targetPath, content);
   try {
-    const trackRes = await fetch(`${API_BASE6}/api/downloads`, {
+    const trackRes = await fetch(`${API_BASE}/api/downloads`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ agent_id: agent.id, version: agent.version })
@@ -18898,7 +19235,7 @@ if (require.main == module) {
       setup();
     } else if (subcommand === "verify") {
       const isCheck = args.includes("--check");
-      const run = isCheck ? verifyCheck : () => verify(SUPABASE_URL2, SUPABASE_ANON_KEY2);
+      const run = isCheck ? verifyCheck : () => verify(SUPABASE_URL, SUPABASE_ANON_KEY, VERSION);
       await run().catch((err) => {
         const msg = err instanceof Error ? err.message : "Unknown error";
         process.stderr.write(`oathbound verify: ${msg}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oathbound",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Install verified Claude Code skills and agents from the Oath Bound registry",
   "license": "MIT",
   "author": "Josh Anderson",