pqcheck 0.16.14 → 0.16.16

package/README.md

@@ -8,7 +8,7 @@
 [![npm downloads](https://img.shields.io/npm/dm/pqcheck.svg?style=flat-square&color=06b6d4)](https://www.npmjs.com/package/pqcheck)
 [![license](https://img.shields.io/npm/l/pqcheck.svg?style=flat-square&color=06b6d4)](./LICENSE)
 
-> **Latest: v0.16.12** — ⚠️ **Existing GitHub Action users:** one-line fix required in `.github/workflows/cipherwake.yml` (`uses: cipherwakelabs/pqcheck@v3` → `cipherwakelabs/pqcheck/action@v3`). The old ref was broken since v0.15 and silently failed every CI run; today's end-to-end test caught it. Re-running `pqcheck onboard` also regenerates the workflow correctly. Plus: README rewritten to advertise both `pqcheck <domain>` and `pqcheck deploy-check --ai` equally, rate limits corrected. [Full changelog →](./CHANGELOG.md)
+> **Latest: v0.16.16** — `pqcheck setup` now defaults to per-project install of the Claude Code statusLine + hooks (`./.claude/settings.json` instead of `~/.claude/settings.json`). The Cipherwake badge will only fire in projects where you ran setup, not across every Claude Code session on the machine. Pass `--scope global` to opt back into machine-wide install. [Full changelog →](./CHANGELOG.md)
 
 ## Two ways to use it
 

package/bin/pqcheck.js

@@ -24,7 +24,25 @@
 })();
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://cipherwake.io";
-const VERSION = "0.16.14";
+const VERSION = "0.16.15";
+
+// v0.16.15 — attribution suffix. When the CLI runs inside GitHub Actions
+// (GH sets GITHUB_ACTIONS=true automatically in every step) we append
+// "(pqcheck-action)" to the User-Agent so the server-side classifier
+// (lib/events.ts) buckets the call as `action` rather than `cli`. Lets
+// the analytics dashboard split humans/CI invocations cleanly.
+//
+// No new data is collected — the User-Agent string was already being
+// sent on every call; this is a labeling change.
+//
+// Opt out via PQCHECK_DISABLE_ACTION_ATTRIBUTION=1 (UA stays plain
+// `pqcheck-cli/X.Y.Z` even under GitHub Actions). The env var is only
+// honored when GITHUB_ACTIONS=true — it does nothing in other contexts.
+const CI_ACTION_SUFFIX =
+  process.env.GITHUB_ACTIONS === "true" &&
+  process.env.PQCHECK_DISABLE_ACTION_ATTRIBUTION !== "1"
+    ? " (pqcheck-action)"
+    : "";
 
 // API-key support — paid tier (Founder Pro $19.99/mo launch pricing, locked while sub active) gets
 // per-account monthly quotas instead of the per-IP rate limit. Set via:
@@ -38,7 +56,7 @@ const QP_API_KEY = (process.env.CIPHERWAKE_API_KEY || "").trim();
 // Builds headers with optional Authorization. Use for every CLI → API call
 // so a single env-var toggle authenticates every endpoint at once.
 function apiHeaders(extra = {}) {
-  const h = { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}`, ...extra };
+  const h = { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`, ...extra };
   if (QP_API_KEY) h.authorization = `Bearer ${QP_API_KEY}`;
   return h;
 }
@@ -274,7 +292,7 @@ async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi,
     const qs = fresh ? `?domain=${encodeURIComponent(domain)}&force=1` : `?domain=${encodeURIComponent(domain)}`;
     const resp = await fetch(`${API_BASE}/api/scan${qs}`, {
       method: "GET",
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (scan)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (scan)` }),
     });
     if (!quiet && format === "text") process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
@@ -321,7 +339,7 @@ async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi,
   if (webhookUrl) {
     fetch(webhookUrl, {
       method: "POST",
-      headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+      headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}` },
       body: JSON.stringify({ domain, report, source: "pqcheck-cli", at: new Date().toISOString() }),
     }).catch(() => { /* best-effort — never fail the scan on webhook delivery */ });
   }
@@ -543,7 +561,7 @@ async function runWatch({ domains, format, quiet, threshold, webhookUrl, interva
       try {
         const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
           method: "GET",
-          headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (watch)` }),
+          headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (watch)` }),
         });
         if (!resp.ok) continue;
         const report = await resp.json();
@@ -554,7 +572,7 @@ async function runWatch({ domains, format, quiet, threshold, webhookUrl, interva
         if (changed && webhookUrl) {
           fetch(webhookUrl, {
             method: "POST",
-            headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+            headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}` },
             body: JSON.stringify({
               type: "score_changed",
               domain,
@@ -899,7 +917,7 @@ async function refreshVersionCacheInBackground(cachePath) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 2500);
     const resp = await fetch(VERSION_REGISTRY_URL, {
-      headers: { "Accept": "application/json", "User-Agent": `pqcheck-cli/${VERSION}` },
+      headers: { "Accept": "application/json", "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}` },
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -1829,7 +1847,7 @@ async function runLockCommand(args) {
   try {
     const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (lock)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (lock)` }),
     });
     if (!stdout) process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
@@ -1909,7 +1927,7 @@ function buildQxmManifest(report, crypto) {
   return {
     schema: "https://cipherwake.io/schemas/qxm/v1",
     schemaVersion: 1,
-    generator: `pqcheck-cli/${VERSION}`,
+    generator: `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
     generatedAt: report.generatedAt || new Date().toISOString(),
     domain: report.domain,
     reachable: !!report.reachable,
@@ -2152,7 +2170,7 @@ async function runDepsCommand(args) {
       batch.map(async (h) => {
         try {
           const r = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(h.host)}&source=cli-deps`, {
-            headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (deps)` }),
+            headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (deps)` }),
           });
           if (!r.ok) return { ...h, types: Array.from(h.types), scan: null, error: `${r.status}` };
           const body = await r.json();
@@ -2391,7 +2409,7 @@ async function fetchPageHTML(domain) {
       method: "GET",
       redirect: "follow",
       signal: ctrl.signal,
-      headers: { "User-Agent": `pqcheck-cli/${VERSION} (deps; +https://cipherwake.io)` },
+      headers: { "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (deps; +https://cipherwake.io)` },
     });
     clearTimeout(t);
     if (!resp.ok) return null;
@@ -2848,7 +2866,7 @@ async function runHistoryCommand(args) {
   let h;
   try {
     const r = await fetch(`${API_BASE}/api/history?domain=${encodeURIComponent(domain)}&days=${days}`, {
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (history)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (history)` }),
     });
     if (!r.ok) {
       console.error(color("red", `error: ${r.status} ${r.statusText}`));
@@ -2931,7 +2949,7 @@ async function runChangesCommand(args) {
   let summary;
   try {
     const r = await fetch(`${API_BASE}/api/changes-summary?domain=${encodeURIComponent(domain)}`, {
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (changes)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (changes)` }),
     });
     if (!r.ok) {
       console.error(color("red", `error: ${r.status} ${r.statusText}`));
@@ -3025,7 +3043,7 @@ async function runChangesCommand(args) {
 async function runScanBasedDeployCheck(domain, args) {
   const headers = {
     "Content-Type": "application/json",
-    "User-Agent": `pqcheck-cli/${VERSION}`,
+    "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
   };
   if (QP_API_KEY) headers["Authorization"] = `Bearer ${QP_API_KEY}`;
 
@@ -3198,7 +3216,7 @@ async function runTrustDiffCommand(args) {
   // anonymous per-IP rate limit path (just like /api/scan).
   const headers = {
     "Content-Type": "application/json",
-    "User-Agent": `pqcheck-cli/${VERSION}`,
+    "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
   };
   if (QP_API_KEY) {
     headers["Authorization"] = `Bearer ${QP_API_KEY}`;
@@ -3696,7 +3714,7 @@ async function runPreviewDiffCommand(args) {
 
   const headers = {
     "Content-Type": "application/json",
-    "User-Agent": `pqcheck-cli/${VERSION}`,
+    "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
   };
   if (QP_API_KEY) {
     headers["Authorization"] = `Bearer ${QP_API_KEY}`;
@@ -4423,7 +4441,7 @@ function renderReleaseChecklist(domain, opts = {}) {
 // `pqcheck init` — interactive workflow scaffold (habit-loop #4, locked 2026-05-16)
 // =============================================================================
 // Writes a ready-to-commit .github/workflows/cipherwake.yml that calls
-// cipherwakelabs/pqcheck/action@v3 in trust-diff mode. Zero copy-paste docs friction.
+// cipherwakelabs/pqcheck@v4 in trust-diff mode. Zero copy-paste docs friction.
 //
 // Flags:
 //   --domain <d>       Skip the domain prompt
@@ -4600,7 +4618,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run Cipherwake Trust Diff
-        uses: cipherwakelabs/pqcheck/action@v3
+        uses: cipherwakelabs/pqcheck@v4
         with:
           mode: trust-diff
           domain: ${domain}
@@ -4766,7 +4784,7 @@ async function fetchVendorOrigins(domain) {
   try {
     resp = await fetch(`${API_BASE}/api/deps?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (vendors)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (vendors)` }),
       signal: ac.signal,
     });
   } catch (err) {
@@ -4814,7 +4832,7 @@ function normalizeObservedOrigin(value) {
 function buildVendorLockfile(domain, origins) {
   return {
     schema_version: 1,
-    generator: `pqcheck-cli/${VERSION}`,
+    generator: `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
     domain,
     generated_at: new Date().toISOString(),
     approved_script_origins: origins,
@@ -4930,7 +4948,7 @@ async function runVendorsSync(domain, outPath) {
     resp = await fetch(`${API_BASE}/api/vendor-allowlist?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
       headers: {
-        "user-agent": `pqcheck-cli/${VERSION} (vendors-sync)`,
+        "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (vendors-sync)`,
         "authorization": "Bearer " + QP_API_KEY,
       },
     });
@@ -5084,7 +5102,7 @@ async function runOnboardCommand(args) {
     try {
       const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}&source=onboard`, {
         method: "GET",
-        headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (onboard)` }),
+        headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (onboard)` }),
       });
       if (resp.ok) {
         const report = await resp.json();
@@ -5595,9 +5613,23 @@ async function runProtocolCommand(args) {
   console.log("Here's what would be added:");
   console.log("");
   if (detected.length === 0) {
+    // Default to creating project-local ./CLAUDE.md rather than global
+    // ~/.claude/CLAUDE.md. Mirrors the cli/setup --scope=project default
+    // (commit 4450e77): don't pollute global config when no signal exists
+    // that the user wants machine-wide installation. Pass --scope=global
+    // to override and create ~/.claude/CLAUDE.md instead.
+    const scopeRaw = (parseFlag(args, "--scope") || "project").toLowerCase();
+    const useGlobal = scopeRaw === "global";
+    const fallbackPath = useGlobal
+      ? path.join(os.homedir(), ".claude", "CLAUDE.md")
+      : path.join(process.cwd(), "CLAUDE.md");
+    const fallbackDisplay = fallbackPath.replace(os.homedir(), "~");
     console.log(color("dim", "  No existing CLAUDE.md / .cursorrules / .aider.conf.yml found."));
-    console.log(color("dim", "  Creating ~/.claude/CLAUDE.md with the protocol."));
-    detected.push({ label: "Claude Code (will create)", path: path.join(os.homedir(), ".claude", "CLAUDE.md") });
+    console.log(color("dim", `  Creating ${fallbackDisplay} with the protocol.`));
+    if (!useGlobal) {
+      console.log(color("dim", "  (pass --scope global to create ~/.claude/CLAUDE.md instead)"));
+    }
+    detected.push({ label: useGlobal ? "Claude Code (will create global)" : "Claude Code (will create project)", path: fallbackPath });
   }
   for (const d of detected) {
     console.log(`  • Append a ~30-line "## Pre-deploy verification with Cipherwake" section to ${color("bold", d.path)}`);
@@ -5909,11 +5941,21 @@ async function runSetupCommand(args) {
   const skipHook = args.includes("--skip-hook");
   const skipStatusline = args.includes("--skip-statusline");
   const skipVscode = args.includes("--skip-vscode");
+  // Where to install Claude Code statusLine + hooks. Default 'project' keeps
+  // Cipherwake scoped to the current repo (avoids the "Cipherwake badge
+  // follows me into unrelated projects" UX bug). 'global' is opt-in for
+  // power users who want one canonical domain badge across every project.
+  const settingsScope = (parseFlag(args, "--scope") || "project").toLowerCase();
+  if (!["project", "global"].includes(settingsScope)) {
+    console.error(color("red", `error: --scope must be 'project' or 'global' (got '${settingsScope}')`));
+    process.exit(3);
+  }
 
   if (!domain) {
     console.error(color("red", "error: pqcheck setup requires --domain"));
     console.error(color("dim", "Usage: npx pqcheck setup --auto --domain example.com"));
-    console.error(color("dim", "  --plan         Print the install plan without writing any files"));
+    console.error(color("dim", "  --plan                     Print the install plan without writing any files"));
+    console.error(color("dim", "  --scope project|global     Where to install Claude Code hooks (default: project — this repo only)"));
     console.error(color("dim", "  --invoked-by=\"<name>\" --consent-phrase=\"<words>\"   (audit trail)"));
     console.error(color("dim", "Skip flags: --skip-workflow --skip-protocol --skip-hook --skip-statusline --skip-vscode"));
     process.exit(3);
@@ -5959,11 +6001,17 @@ async function runSetupCommand(args) {
     }
     if (!skipHook) planEntries.push({ what: "git pre-push hook", to: path.join(process.cwd(), ".git", "hooks", "pre-push"), op: "create (if git repo)" });
     if (!skipStatusline) {
-      const settingsPath = path.join(os.homedir(), ".claude", "settings.json");
+      const settingsPath = settingsScope === "global"
+        ? path.join(os.homedir(), ".claude", "settings.json")
+        : path.join(process.cwd(), ".claude", "settings.json");
       let exists = false;
       try { await fs.access(settingsPath); exists = true; } catch { /* */ }
-      planEntries.push({ what: "Claude Code statusLine", to: settingsPath, op: exists ? "deep-merge (backup first)" : "create" });
+      const scopeNote = settingsScope === "global"
+        ? " [GLOBAL — fires in every project on this machine]"
+        : " [PROJECT-LOCAL — fires only when Claude Code runs in this directory]";
+      planEntries.push({ what: `Claude Code statusLine${scopeNote}`, to: settingsPath, op: exists ? "deep-merge (backup first)" : "create" });
       planEntries.push({ what: "Claude Code chat-hook (PostToolUse Bash)", to: settingsPath, op: exists ? "deep-merge into hooks.PostToolUse" : "create" });
+      planEntries.push({ what: "Claude Code prompt-hook (UserPromptSubmit)", to: settingsPath, op: exists ? "deep-merge into hooks.UserPromptSubmit" : "create" });
     }
     if (!skipVscode) planEntries.push({ what: "VS Code / Cursor extension", to: "via `code --install-extension cipherwakelabs.cipherwake-statusbar`", op: "attempt (soft-fail if Marketplace listing missing)" });
     for (const e of planEntries) {
@@ -5994,6 +6042,48 @@ async function runSetupCommand(args) {
     console.log("");
   }
 
+  // Resolve where to write Claude Code statusLine + hook entries.
+  // Default 'project' = ./.claude/settings.json (this repo only). 'global' = ~/.claude/settings.json
+  // (fires in every Claude Code session on this machine). Project-local is the right default for
+  // anyone with multiple projects; global is the legacy behavior and now an opt-in for the
+  // "one canonical domain across everything" use case.
+  const claudeSettingsPath = settingsScope === "global"
+    ? path.join(os.homedir(), ".claude", "settings.json")
+    : path.join(process.cwd(), ".claude", "settings.json");
+
+  if (!skipStatusline) {
+    const displayPath = claudeSettingsPath.replace(os.homedir(), "~");
+    const scopeLabel = settingsScope === "global"
+      ? `global (${displayPath} — fires in EVERY project on this machine)`
+      : `project (${displayPath} — fires only when Claude Code runs in this directory)`;
+    console.log(color("dim", `Settings scope: ${scopeLabel}`));
+    console.log(color("dim", settingsScope === "global"
+      ? `  (omit --scope or pass --scope project to install for this repo only)`
+      : `  (pass --scope global to install for every project on this machine)`));
+    console.log("");
+
+    // Detect existing GLOBAL Cipherwake install while doing a project install.
+    // Warn so the user doesn't end up with two layers firing on top of each other.
+    if (settingsScope === "project") {
+      try {
+        const globalPath = path.join(os.homedir(), ".claude", "settings.json");
+        const raw = await fs.readFile(globalPath, "utf8");
+        const parsed = JSON.parse(raw);
+        const hasGlobalCipherwake =
+          (parsed.statusLine?.command && String(parsed.statusLine.command).includes("cipherwake")) ||
+          JSON.stringify(parsed.hooks || {}).includes("cipherwake");
+        if (hasGlobalCipherwake) {
+          console.log(color("yellow", `  ⚠ A GLOBAL Cipherwake install already exists at ~/.claude/settings.json`));
+          console.log(color("dim", `    It will continue firing across every project. To remove the global install,`));
+          console.log(color("dim", `    edit ~/.claude/settings.json and delete the statusLine entry and the`));
+          console.log(color("dim", `    cipherwake-chat-hook / cipherwake-prompt-hook commands. Backups are taken`));
+          console.log(color("dim", `    automatically before any write, so changes are reversible.`));
+          console.log("");
+        }
+      } catch { /* no global install — fine */ }
+    }
+  }
+
   const installSummary = [];
 
   // -------------------------------------------------------------------------
@@ -6158,7 +6248,8 @@ async function runSetupCommand(args) {
   }
 
   if (!skipStatusline) {
-    const settingsPath = path.join(os.homedir(), ".claude", "settings.json");
+    const settingsPath = claudeSettingsPath;
+    const displayPath = settingsPath.replace(os.homedir(), "~");
     try {
       let settings = {};
       let existed = false;
@@ -6169,7 +6260,7 @@ async function runSetupCommand(args) {
       } catch { /* will create */ }
       if (existed && settings.statusLine && typeof settings.statusLine === "object") {
         // Already has a statusLine config — don't overwrite.
-        console.log(color("dim", `  ⊝ ~/.claude/settings.json already has a statusLine entry — leaving alone`));
+        console.log(color("dim", `  ⊝ ${displayPath} already has a statusLine entry — leaving alone`));
         console.log(color("dim", `    To use the Cipherwake statusline instead, set: "command": "npx --package=pqcheck@latest cipherwake-statusline"`));
         installSummary.push({ component: "Claude Code statusLine", path: settingsPath, status: "skipped-existing-config" });
       } else {
@@ -6178,7 +6269,7 @@ async function runSetupCommand(args) {
         settings.statusLine = { type: "command", command: "npx --package=pqcheck@latest cipherwake-statusline" };
         await fs.mkdir(path.dirname(settingsPath), { recursive: true });
         await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
-        console.log(color("green", `  ✓ added statusLine config → ~/.claude/settings.json`));
+        console.log(color("green", `  ✓ added statusLine config → ${displayPath}`));
         installSummary.push({ component: "Claude Code statusLine", path: settingsPath, status: existed ? "installed-updated" : "installed-created", backup: backupPath });
       }
     } catch (err) {
@@ -6194,7 +6285,8 @@ async function runSetupCommand(args) {
   // doesn't clobber other hooks per CLAUDE.md Rule 17.
   // -------------------------------------------------------------------------
   if (!skipStatusline) {
-    const settingsPath = path.join(os.homedir(), ".claude", "settings.json");
+    const settingsPath = claudeSettingsPath;
+    const displayPath = settingsPath.replace(os.homedir(), "~");
     try {
       let settings = {};
       let existed = false;
@@ -6220,7 +6312,7 @@ async function runSetupCommand(args) {
       );
 
       if (alreadyInstalled) {
-        console.log(color("dim", `  ⊝ chat-hook already configured in ~/.claude/settings.json PostToolUse — skipping`));
+        console.log(color("dim", `  ⊝ chat-hook already configured in ${displayPath} PostToolUse — skipping`));
         installSummary.push({ component: "Claude Code chat-hook", path: settingsPath, status: "skipped-already-present" });
       } else {
         const backupPath = existed ? await backupSettingsJson(settingsPath) : null;
@@ -6228,7 +6320,7 @@ async function runSetupCommand(args) {
         bashEntry.hooks.push({ type: "command", command: cipherwakeHookCmd });
         await fs.mkdir(path.dirname(settingsPath), { recursive: true });
         await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
-        console.log(color("green", `  ✓ added chat-hook (PostToolUse Bash) → ~/.claude/settings.json`));
+        console.log(color("green", `  ✓ added chat-hook (PostToolUse Bash) → ${displayPath}`));
         console.log(color("dim", `    Every \`pqcheck\` run will now push a live status message into Claude Code chat`));
         installSummary.push({ component: "Claude Code chat-hook", path: settingsPath, status: existed ? "installed-updated" : "installed-created", backup: backupPath });
       }
@@ -6247,7 +6339,8 @@ async function runSetupCommand(args) {
   // / ship_decision=pass (no spam).
   // -------------------------------------------------------------------------
   if (!skipStatusline) {
-    const settingsPath = path.join(os.homedir(), ".claude", "settings.json");
+    const settingsPath = claudeSettingsPath;
+    const displayPath = settingsPath.replace(os.homedir(), "~");
     try {
       let settings = {};
       let existed = false;
@@ -6267,7 +6360,7 @@ async function runSetupCommand(args) {
       );
 
       if (alreadyInstalled) {
-        console.log(color("dim", `  ⊝ prompt-hook already configured in ~/.claude/settings.json UserPromptSubmit — skipping`));
+        console.log(color("dim", `  ⊝ prompt-hook already configured in ${displayPath} UserPromptSubmit — skipping`));
         installSummary.push({ component: "Claude Code prompt-hook", path: settingsPath, status: "skipped-already-present" });
       } else {
         const backupPath = existed ? await backupSettingsJson(settingsPath) : null;
@@ -6275,7 +6368,7 @@ async function runSetupCommand(args) {
         settings.hooks.UserPromptSubmit.push({ hooks: [{ type: "command", command: cipherwakeHookCmd }] });
         await fs.mkdir(path.dirname(settingsPath), { recursive: true });
         await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
-        console.log(color("green", `  ✓ added prompt-hook (UserPromptSubmit) → ~/.claude/settings.json`));
+        console.log(color("green", `  ✓ added prompt-hook (UserPromptSubmit) → ${displayPath}`));
         console.log(color("dim", `    Claude will see latest ship_decision in context on every prompt (when REVIEW/BLOCK)`));
         installSummary.push({ component: "Claude Code prompt-hook", path: settingsPath, status: existed ? "installed-updated" : "installed-created", backup: backupPath });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.16.14",
+  "version": "0.16.16",
   "description": "Deploy gate for AI-coded web apps. `pqcheck deploy-check --ai` returns ship_decision=pass|review|block for Claude Code / Cursor / Copilot / Aider to gate deploys before they ship. Anonymous, no signup, free for first use.",
   "keywords": [
     "ai-coder",