prae-cli 0.10.0 → 0.10.2

package/lib/docs/pilot-claude-code.md

@@ -26,23 +26,21 @@ guide in a temporary project:
   `claude -p` refused them. Nothing protected changed on disk.
 - **Record.** `prae verify` passed the chain, with 25 of 25 signatures.
 
-## 1. Install (one command)
+## 1. Install
 
-You need Node 22.19 or later and pnpm 10 (`corepack enable`). Until the
-release that carries this hook is on npm (`prae-cli` 0.9.2 does not have it),
-run it from a checkout of this repository, built once:
+You need Node 22.19 or later. Install the CLI globally, then preview the
+change and apply it:
 
 ```bash
-git clone https://github.com/taltara/prae-harness && cd prae-harness && pnpm install && pnpm --filter prae-cli build
-PRAE="node $PWD/packages/cli/lib/bin.js"     # used below; after the npm release this is just `prae`
+npm install -g prae-cli                       # prae-cli 0.10.0 or later carries the hook
+prae init claude-code --scope user            # prints the settings diff, writes nothing
+prae init claude-code --scope user --apply    # installs, shadow mode
 ```
 
-Then preview the change, and apply it:
-
-```bash
-$PRAE init claude-code --scope user            # prints the settings diff, writes nothing
-$PRAE init claude-code --scope user --apply    # installs, shadow mode
-```
+Install globally rather than with `npx prae-cli init …`: the settings entry
+runs the `prae` it was installed from, and an `npx` copy lives in npm's
+temporary cache, which npm may clear — the hook would then stop running, and
+Claude Code 2.1.233 lets every call through when a hook cannot start.
 
 You must name a target. `--scope user` is `~/.claude/settings.json`, which
 covers every project. `--scope project` is `./.claude/settings.json`.
@@ -55,19 +53,22 @@ hand-formatted file shows layout changes in the diff. Its values do not change.
 
 ```json
 "PreToolUse": [{ "matcher": "*", "hooks": [{ "type": "command", "timeout": 10,
-  "command": "'/opt/homebrew/bin/node' '…/packages/cli/lib/bin.js' hook claude-code --shadow --pack '~/.prae/claude-code/prae-baseline.prae.json' --ledger '~/.prae/claude-code/ledger.jsonl' --key '~/.prae/claude-code/prae-signing.pem' --settings '~/.claude/settings.json'" }] }]
+  "command": "'/opt/homebrew/bin/node' '…/lib/node_modules/prae-cli/lib/bin.js' hook claude-code --shadow --pack '~/.prae/claude-code/prae-baseline.prae.json' --ledger '~/.prae/claude-code/ledger.jsonl' --key '~/.prae/claude-code/prae-signing.pem' --settings '~/.claude/settings.json'" }] }]
 ```
 
 The real file holds absolute paths. The command names the node binary and
 PRAE's own script by absolute path, so it does not depend on `PATH`. If you
-move the checkout, run `init` again. Claude Code reloads settings on its own,
+upgrade or reinstall prae-cli, or switch Node versions, run `init` again. Claude Code reloads settings on its own,
 so new tool calls go through PRAE without a restart.
 
 Options:
 
 - `--pack <file>`: use your own pack. The default copies the built-in baseline
-  (8 rules: download-and-execute, `rm -rf`, privilege escalation, block devices,
-  credential files, writes outside the workspace, force-push, publishes).
+  (13 rules: download-and-execute, `rm -rf`, privilege escalation, block devices,
+  credential files, writes outside the workspace, force-push, publishes, and
+  credential stores — the macOS Keychain through `security` and its files,
+  `.netrc`, `.git-credentials`, `.npmrc`, Docker, kube, GnuPG, gh and gcloud
+  config — read directly or named in a shell command).
   `prae check <file>` summarises a pack.
 - `--ledger <file>`: write the ledger somewhere else.
 - `--dir <dir>`: keep PRAE's state somewhere other than `~/.prae/claude-code/`.
@@ -95,9 +96,9 @@ Read the record:
 
 ```bash
 P=~/.prae/claude-code
-$PRAE verify  $P/ledger.jsonl --key $P/prae-signing.pub.pem
-$PRAE report  $P/ledger.jsonl --pack $P/prae-baseline.prae.json --out report.html
-$PRAE console $P/ledger.jsonl --pack $P/prae-baseline.prae.json --out console/
+prae verify  $P/ledger.jsonl --key $P/prae-signing.pub.pem
+prae report  $P/ledger.jsonl --pack $P/prae-baseline.prae.json --out report.html
+prae console $P/ledger.jsonl --pack $P/prae-baseline.prae.json --out console/
 ```
 
 In the report and the console, a shadow verdict is marked `· SHADOW`. It is
@@ -106,7 +107,7 @@ never counted as vetoed or held.
 ## 3. From shadow to enforce
 
 ```bash
-$PRAE init claude-code --scope user --enforce --apply
+prae init claude-code --scope user --enforce --apply
 ```
 
 This replaces PRAE's entry. It does not add a second one. In enforce mode:
@@ -124,7 +125,7 @@ warning and records a `PRAE-ERROR` row marked `shadow`.
 ## 4. Uninstall
 
 ```bash
-$PRAE init claude-code --scope user --remove --apply
+prae init claude-code --scope user --remove --apply
 ```
 
 This removes PRAE's hook entry and nothing else. The ledger and the key stay

package/lib/facts-DkTRO2p0.js

@@ -0,0 +1,89 @@
+import { a as PATH_ARGS, s as relativeTo } from "./src-CZYvvEn5.js";
+import { capabilityForTool } from "capmark";
+
+//#region ../dsh/src/facts.ts
+function resolveArgs(args, resolvePath, cwd) {
+	if (resolvePath === void 0 && cwd === void 0) return args;
+	const out = { ...args };
+	for (const key of PATH_ARGS) {
+		const value = out[key];
+		if (typeof value !== "string") continue;
+		let path = value;
+		if (resolvePath !== void 0) try {
+			path = resolvePath(path);
+		} catch {}
+		out[key] = cwd === void 0 ? path : relativeTo(path, cwd);
+	}
+	return out;
+}
+/**
+* Claude Code names its built-in tools in PascalCase (`Read`, `Bash`, …),
+* which capmark's catalogue does not list. Each takes the capability of its
+* lowercase counterpart; without this a Claude Code call carries no
+* capability, and the rules scoped by one (paths, egress, the shell) never
+* see it. An MCP tool, `mcp__<server>__<tool>`, takes its tool's.
+*/
+const CLAUDE_CODE = {
+	Read: "read",
+	Write: "write",
+	Edit: "edit",
+	MultiEdit: "edit",
+	NotebookEdit: "edit",
+	Bash: "bash",
+	PowerShell: "bash",
+	Grep: "grep",
+	Glob: "glob",
+	LS: "glob",
+	WebFetch: "web_fetch",
+	WebSearch: "web_search"
+};
+/**
+* MCP tools whose names capmark's catalogue does not list, from the
+* reference servers an agent most often mounts (modelcontextprotocol
+* `filesystem` and `fetch`) and `prae mcp`'s own. Applied only after an
+* `mcp__<server>__` prefix: without it, a Claude Code session reading
+* `.env` through `mcp__filesystem__read_file` carries no capability, and
+* no `fs:read` rule sees it.
+*/
+const MCP_TOOLS = {
+	read_file: "read",
+	read_text_file: "read",
+	read_media_file: "read",
+	list_directory: "glob",
+	list_dir: "glob",
+	directory_tree: "glob",
+	search_files: "glob",
+	get_file_info: "glob",
+	write_file: "write",
+	edit_file: "edit",
+	create_directory: "write",
+	fetch: "web_fetch"
+};
+function capabilityOf(tool) {
+	const direct = capabilityForTool(tool)?.id;
+	if (direct !== void 0) return direct;
+	const alias = CLAUDE_CODE[tool];
+	if (alias !== void 0) return capabilityForTool(alias)?.id;
+	const mcp = tool.startsWith("mcp__") ? tool.lastIndexOf("__") : -1;
+	if (mcp <= 5) return void 0;
+	const name = tool.slice(mcp + 2);
+	return capabilityOf(MCP_TOOLS[name] ?? name);
+}
+function factsFor(exec, options = {}) {
+	const args = exec.arguments ?? {};
+	const capability = capabilityOf(exec.name);
+	const plugin = options.owners?.get(exec.name);
+	const id = exec.agent?.id;
+	const agent = typeof id === "string" ? id : void 0;
+	return {
+		tool: exec.name,
+		...capability === void 0 ? {} : { capability },
+		...plugin === void 0 ? {} : { plugin },
+		...agent === void 0 ? {} : { agent },
+		args: resolveArgs(args, options.resolvePath, options.cwd),
+		...options.counts === void 0 ? {} : { counts: options.counts }
+	};
+}
+
+//#endregion
+export { factsFor as n, capabilityOf as t };

package/lib/{hook-Gll2spTP.js → hook-C7LGEIs2.js}

@@ -1,98 +1,11 @@
-import { i as relativeTo, n as PATH_ARGS, o as segments, t as evaluate } from "./evaluate-DhoGQw0Z.js";
-import "./frameworks-BgZHGKiH.js";
-import { t as parsePack } from "./pack-h5n43S0F.js";
-import { n as Ledger } from "./src-Cy-Acrgj.js";
-import { a as scan, n as MAX_SCAN_BYTES } from "./src-BuaOiL2v.js";
+import { a as PATH_ARGS, i as evaluate, l as segments, s as relativeTo, t as parsePack } from "./src-CZYvvEn5.js";
+import { n as Ledger } from "./src-CuiWC80o.js";
+import { n as factsFor, t as capabilityOf } from "./facts-DkTRO2p0.js";
+import { a as scan, n as MAX_SCAN_BYTES } from "./src-9phPLfAL.js";
 import { lstatSync, readFileSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHash } from "node:crypto";
-import { capabilityForTool } from "capmark";
 
-//#region ../dsh/src/facts.ts
-function resolveArgs(args, resolvePath, cwd) {
-	if (resolvePath === void 0 && cwd === void 0) return args;
-	const out = { ...args };
-	for (const key of PATH_ARGS) {
-		const value = out[key];
-		if (typeof value !== "string") continue;
-		let path = value;
-		if (resolvePath !== void 0) try {
-			path = resolvePath(path);
-		} catch {}
-		out[key] = cwd === void 0 ? path : relativeTo(path, cwd);
-	}
-	return out;
-}
-/**
-* Claude Code names its built-in tools in PascalCase (`Read`, `Bash`, …),
-* which capmark's catalogue does not list. Each takes the capability of its
-* lowercase counterpart; without this a Claude Code call carries no
-* capability, and the rules scoped by one (paths, egress, the shell) never
-* see it. An MCP tool, `mcp__<server>__<tool>`, takes its tool's.
-*/
-const CLAUDE_CODE = {
-	Read: "read",
-	Write: "write",
-	Edit: "edit",
-	MultiEdit: "edit",
-	NotebookEdit: "edit",
-	Bash: "bash",
-	PowerShell: "bash",
-	Grep: "grep",
-	Glob: "glob",
-	LS: "glob",
-	WebFetch: "web_fetch",
-	WebSearch: "web_search"
-};
-/**
-* MCP tools whose names capmark's catalogue does not list, from the
-* reference servers an agent most often mounts (modelcontextprotocol
-* `filesystem` and `fetch`) and `prae mcp`'s own. Applied only after an
-* `mcp__<server>__` prefix: without it, a Claude Code session reading
-* `.env` through `mcp__filesystem__read_file` carries no capability, and
-* no `fs:read` rule sees it.
-*/
-const MCP_TOOLS = {
-	read_file: "read",
-	read_text_file: "read",
-	read_media_file: "read",
-	list_directory: "glob",
-	list_dir: "glob",
-	directory_tree: "glob",
-	search_files: "glob",
-	get_file_info: "glob",
-	write_file: "write",
-	edit_file: "edit",
-	create_directory: "write",
-	fetch: "web_fetch"
-};
-function capabilityOf(tool) {
-	const direct = capabilityForTool(tool)?.id;
-	if (direct !== void 0) return direct;
-	const alias = CLAUDE_CODE[tool];
-	if (alias !== void 0) return capabilityForTool(alias)?.id;
-	const mcp = tool.startsWith("mcp__") ? tool.lastIndexOf("__") : -1;
-	if (mcp <= 5) return void 0;
-	const name = tool.slice(mcp + 2);
-	return capabilityOf(MCP_TOOLS[name] ?? name);
-}
-function factsFor(exec, options = {}) {
-	const args = exec.arguments ?? {};
-	const capability = capabilityOf(exec.name);
-	const plugin = options.owners?.get(exec.name);
-	const id = exec.agent?.id;
-	const agent = typeof id === "string" ? id : void 0;
-	return {
-		tool: exec.name,
-		...capability === void 0 ? {} : { capability },
-		...plugin === void 0 ? {} : { plugin },
-		...agent === void 0 ? {} : { agent },
-		args: resolveArgs(args, options.resolvePath, options.cwd),
-		...options.counts === void 0 ? {} : { counts: options.counts }
-	};
-}
-
-//#endregion
 //#region ../dsh/src/judge.ts
 /**
 * Judge one call against a pack, without a harness anywhere near it.

package/lib/index.js

@@ -1,8 +1,7 @@
-import "./evaluate-DhoGQw0Z.js";
-import "./frameworks-BgZHGKiH.js";
-import "./pack-h5n43S0F.js";
-import "./src-Cy-Acrgj.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-DPldZ2ND.js";
-import "./views-CUcixte0.js";
+import "./src-CZYvvEn5.js";
+import "./src-CuiWC80o.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-BTVEk0Fh.js";
+import "./facts-DkTRO2p0.js";
+import "./views-endiZu1Z.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{init-DRd-IRR6.js → init-DvzCuemh.js}

@@ -1,6 +1,5 @@
-import "./frameworks-BgZHGKiH.js";
-import { t as parsePack } from "./pack-h5n43S0F.js";
-import { d as generateKeypair, u as fingerprint } from "./src-Cy-Acrgj.js";
+import { t as parsePack } from "./src-CZYvvEn5.js";
+import { d as generateKeypair, u as fingerprint } from "./src-CuiWC80o.js";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
@@ -228,10 +227,17 @@ function applyInit(plan) {
 	}
 	return print === void 0 ? {} : { fingerprint: print };
 }
+/** Whether a script path is inside npm's temporary npx cache (`…/_npx/<hash>/…`). */
+function fromNpxCache(bin) {
+	return /[\\/]_npx[\\/]/.test(bin);
+}
 /** `prae init claude-code …`: print the diff; with --apply, write it. */
 function initClaudeCode(argv, context) {
 	const plan = planInit(argv, context);
 	const removing = argv.includes("--remove");
+	if (!removing && fromNpxCache(context.bin)) console.error(`prae: warning: this prae runs from npm's temporary npx cache (${context.bin}).\n  The hook entry would point there, and npm may clear that cache: the hook would
+  stop running, and Claude Code lets a call through when its hook cannot start.
+  Install it to stay: npm install -g prae-cli, then run prae init claude-code again.`);
 	console.log(`settings    ${plan.settings}`);
 	if (!removing) {
 		console.log(`mode        ${argv.includes("--enforce") ? "enforce · deny and ask are returned to Claude Code; a gate error refuses the call" : "shadow · every verdict sealed, every call proceeds"}`);
@@ -263,4 +269,4 @@ function initClaudeCode(argv, context) {
 }
 
 //#endregion
-export { HOOK_TIMEOUT, MARKER, applyInit, initClaudeCode, lineDiff, planInit, quote, settingsTarget, stableNode, withPrae, withoutPrae };
+export { HOOK_TIMEOUT, MARKER, applyInit, fromNpxCache, initClaudeCode, lineDiff, planInit, quote, settingsTarget, stableNode, withPrae, withoutPrae };

package/lib/{instructions-DihPiiC2.js → instructions-Bcs2n2O6.js}

@@ -1,5 +1,5 @@
-import "./frameworks-BgZHGKiH.js";
-import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-CUcixte0.js";
+import "./src-CZYvvEn5.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-endiZu1Z.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{mcp-D521EoP6.js → mcp-C2gadkb2.js}

@@ -1,5 +1,5 @@
-import { t as evaluate } from "./evaluate-DhoGQw0Z.js";
-import { a as scan, n as MAX_SCAN_BYTES } from "./src-BuaOiL2v.js";
+import { i as evaluate } from "./src-CZYvvEn5.js";
+import { a as scan, n as MAX_SCAN_BYTES } from "./src-9phPLfAL.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";