sapper-ai 0.7.0 → 0.8.1

package/dist/guard/hooks/guardScan.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardScan = guardScan;
+const promises_1 = require("node:fs/promises");
+const node_crypto_1 = require("node:crypto");
+const node_process_1 = require("node:process");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const ScanCache_1 = require("../ScanCache");
+const WarningStore_1 = require("../WarningStore");
+const scanSingleSkill_1 = require("../scanSingleSkill");
+function hashContent(content) {
+    return (0, node_crypto_1.createHash)('sha256').update(content).digest('hex');
+}
+function normalizeWatchPaths(options) {
+    if (Array.isArray(options.watchPaths) && options.watchPaths.length > 0) {
+        return Array.from(new Set(options.watchPaths.map((path) => (0, node_path_1.resolve)(path))));
+    }
+    const currentHomeDir = options.homeDir ?? (0, node_os_1.homedir)();
+    const currentWorkingDirectory = options.currentWorkingDirectory ?? (0, node_process_1.cwd)();
+    return [
+        (0, node_path_1.join)(currentHomeDir, '.claude', 'plugins'),
+        (0, node_path_1.join)(currentHomeDir, '.claude', 'skills'),
+        (0, node_path_1.join)(currentWorkingDirectory, '.claude', 'skills'),
+    ];
+}
+async function isDirectory(path, statFn) {
+    try {
+        const info = await statFn(path);
+        return info.isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function isSubpath(parent, candidate) {
+    const rel = (0, node_path_1.relative)(parent, candidate);
+    if (rel === '') {
+        return true;
+    }
+    if (rel === '..' || rel.startsWith(`..${node_path_1.sep}`)) {
+        return false;
+    }
+    if (rel.includes(':')) {
+        return false;
+    }
+    return true;
+}
+async function collectMarkdownFiles(rootPath, readDirFn, statFn, resolvePath) {
+    const files = new Set();
+    const seenDirectories = new Set();
+    const resolvedRootPath = await resolvePath(rootPath).catch(() => rootPath);
+    const stack = [rootPath];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (!current) {
+            continue;
+        }
+        let resolvedCurrent;
+        try {
+            resolvedCurrent = await resolvePath(current);
+        }
+        catch {
+            resolvedCurrent = current;
+        }
+        if (!isSubpath(resolvedRootPath, resolvedCurrent)) {
+            continue;
+        }
+        if (seenDirectories.has(resolvedCurrent)) {
+            continue;
+        }
+        seenDirectories.add(resolvedCurrent);
+        let entries;
+        try {
+            entries = await readDirFn(current, { withFileTypes: true, encoding: 'utf8' });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const fullPath = (0, node_path_1.join)(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(fullPath);
+                continue;
+            }
+            if (entry.isSymbolicLink()) {
+                try {
+                    const resolvedSymlinkPath = await resolvePath(fullPath);
+                    if (!isSubpath(resolvedRootPath, resolvedSymlinkPath)) {
+                        continue;
+                    }
+                    const info = await statFn(fullPath);
+                    if (info.isDirectory()) {
+                        stack.push(fullPath);
+                        continue;
+                    }
+                    if (info.isFile() && entry.name.toLowerCase().endsWith('.md')) {
+                        files.add(fullPath);
+                    }
+                }
+                catch {
+                    continue;
+                }
+                continue;
+            }
+            if (entry.isFile() && entry.name.toLowerCase().endsWith('.md')) {
+                files.add(fullPath);
+            }
+        }
+    }
+    return Array.from(files).sort();
+}
+function renderSummary(summary) {
+    if (summary.totalSkills === 0) {
+        return 'SapperAI: no skill files found.';
+    }
+    if (summary.scanned === 0 && summary.errors === 0) {
+        return `SapperAI: checked ${summary.totalSkills} skill files, no content changes.`;
+    }
+    const parts = [
+        `SapperAI: checked ${summary.totalSkills} skill files`,
+        `${summary.scanned} scanned`,
+        `${summary.cached} cached`,
+    ];
+    if (summary.suspicious > 0) {
+        parts.push(`${summary.suspicious} suspicious`);
+    }
+    if (summary.errors > 0) {
+        parts.push(`${summary.errors} errors`);
+    }
+    return parts.join(', ') + '.';
+}
+function writeJson(writer, payload) {
+    writer.write(`${JSON.stringify(payload)}\n`);
+}
+function writeError(stderr, message) {
+    stderr.write(`[sapper-ai] ${message}\n`);
+}
+async function guardScan(options = {}) {
+    const stdout = options.stdout ?? process.stdout;
+    const stderr = options.stderr ?? process.stderr;
+    const scanCache = options.scanCache ?? new ScanCache_1.ScanCache({ homeDir: options.homeDir });
+    const warningStore = options.warningStore ?? new WarningStore_1.WarningStore({ homeDir: options.homeDir });
+    const scanSkill = options.scanSkillFn ?? ((path) => (0, scanSingleSkill_1.scanSingleSkill)(path));
+    const read = options.readFileFn ?? promises_1.readFile;
+    const resolvePath = options.realpathFn ?? promises_1.realpath;
+    const readDir = options.readdirFn ??
+        ((filePath, readOptions) => (0, promises_1.readdir)(filePath, readOptions));
+    const statPath = options.statFn ?? promises_1.stat;
+    const now = options.now ?? Date.now;
+    const summary = {
+        watchPathCount: 0,
+        totalSkills: 0,
+        scanned: 0,
+        cached: 0,
+        suspicious: 0,
+        errors: 0,
+        cacheValid: true,
+    };
+    try {
+        const verifyResult = await scanCache.verify();
+        summary.cacheValid = verifyResult.valid;
+        const watchPaths = normalizeWatchPaths(options);
+        const seenSkills = new Set();
+        for (const watchPath of watchPaths) {
+            const exists = await isDirectory(watchPath, statPath);
+            if (!exists) {
+                continue;
+            }
+            summary.watchPathCount += 1;
+            const files = await collectMarkdownFiles(watchPath, readDir, statPath, resolvePath);
+            for (const filePath of files) {
+                let resolvedFilePath = filePath;
+                try {
+                    resolvedFilePath = await resolvePath(filePath);
+                }
+                catch {
+                    resolvedFilePath = filePath;
+                }
+                if (seenSkills.has(resolvedFilePath)) {
+                    continue;
+                }
+                seenSkills.add(resolvedFilePath);
+                summary.totalSkills += 1;
+                try {
+                    const content = await read(resolvedFilePath, 'utf8');
+                    const contentHash = hashContent(content);
+                    if (await scanCache.has(contentHash)) {
+                        summary.cached += 1;
+                        continue;
+                    }
+                    const scanResult = await scanSkill(resolvedFilePath);
+                    summary.scanned += 1;
+                    await scanCache.set(scanResult.contentHash, {
+                        path: scanResult.skillPath,
+                        skillName: scanResult.skillName,
+                        decision: scanResult.decision,
+                        risk: scanResult.risk,
+                        reasons: [...scanResult.reasons],
+                        scannedAt: new Date(now()).toISOString(),
+                    });
+                    if (scanResult.decision === 'suspicious') {
+                        summary.suspicious += 1;
+                        await warningStore.addPending({
+                            skillName: scanResult.skillName,
+                            skillPath: scanResult.skillPath,
+                            contentHash: scanResult.contentHash,
+                            risk: scanResult.risk,
+                            reasons: [...scanResult.reasons],
+                            detectedAt: new Date(now()).toISOString(),
+                        });
+                    }
+                }
+                catch (error) {
+                    summary.errors += 1;
+                    const reason = error instanceof Error ? error.message : String(error);
+                    writeError(stderr, `guard scan failed for ${resolvedFilePath}: ${reason}`);
+                }
+            }
+        }
+    }
+    catch (error) {
+        summary.errors += 1;
+        const reason = error instanceof Error ? error.message : String(error);
+        writeError(stderr, `guard scan failed: ${reason}`);
+    }
+    const payload = {
+        suppressPrompt: false,
+        message: renderSummary(summary),
+        summary: {
+            watchPathCount: summary.watchPathCount,
+            totalSkills: summary.totalSkills,
+            scanned: summary.scanned,
+            cached: summary.cached,
+            suspicious: summary.suspicious,
+            errors: summary.errors,
+            cacheValid: summary.cacheValid,
+        },
+    };
+    writeJson(stdout, payload);
+    return payload;
+}

package/dist/guard/scanSingleSkill.d.ts

@@ -0,0 +1,11 @@
+import type { Policy } from '@sapper-ai/types';
+import type { SingleSkillScanResult } from './types';
+export interface ScanSingleSkillOptions {
+    policy?: Policy;
+    suspiciousThreshold?: number;
+    readFileFn?: (filePath: string, encoding: BufferEncoding) => Promise<string>;
+    realpathFn?: (filePath: string) => Promise<string>;
+    now?: () => number;
+}
+export declare function scanSingleSkill(filePath: string, options?: ScanSingleSkillOptions): Promise<SingleSkillScanResult>;
+//# sourceMappingURL=scanSingleSkill.d.ts.map

package/dist/guard/scanSingleSkill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanSingleSkill.d.ts","sourceRoot":"","sources":["../../src/guard/scanSingleSkill.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAqB,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAIpD,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5E,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AA+CD,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAoDhC"}

package/dist/guard/scanSingleSkill.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanSingleSkill = scanSingleSkill;
+const promises_1 = require("node:fs/promises");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+const core_1 = require("@sapper-ai/core");
+const getDefaultPolicy_1 = require("./getDefaultPolicy");
+const DEFAULT_SUSPICIOUS_THRESHOLD = 0.7;
+function sha256(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+}
+function fallbackSkillName(filePath) {
+    const fileName = (0, node_path_1.basename)(filePath);
+    return fileName.toLowerCase().endsWith('.md') ? fileName.slice(0, -3) : fileName;
+}
+function resolveThreshold(policy, override) {
+    if (typeof override === 'number') {
+        return override;
+    }
+    const threshold = policy.thresholds?.riskThreshold;
+    return typeof threshold === 'number' ? threshold : DEFAULT_SUSPICIOUS_THRESHOLD;
+}
+function toAssessmentContext(skillName, skillPath, policy, body, metadata, now) {
+    return {
+        kind: 'install_scan',
+        policy,
+        toolCall: {
+            toolName: `skill:${skillName}`,
+            arguments: {
+                content: body,
+                metadata,
+            },
+        },
+        meta: {
+            source: 'skill-guard',
+            sourcePath: skillPath,
+            sourceType: 'skill',
+            timestamp: now,
+        },
+    };
+}
+async function scanSingleSkill(filePath, options = {}) {
+    const resolvePath = options.realpathFn ?? promises_1.realpath;
+    const read = options.readFileFn ?? promises_1.readFile;
+    const now = options.now ?? Date.now;
+    const resolvedPath = await resolvePath(filePath);
+    const content = await read(resolvedPath, 'utf8');
+    const contentHash = sha256(content);
+    const policy = options.policy ?? (0, getDefaultPolicy_1.getDefaultPolicy)();
+    const suspiciousThreshold = resolveThreshold(policy, options.suspiciousThreshold);
+    let parsed;
+    try {
+        parsed = core_1.SkillParser.parse(content);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return {
+            skillName: fallbackSkillName(resolvedPath),
+            skillPath: resolvedPath,
+            contentHash,
+            decision: 'suspicious',
+            risk: 1,
+            reasons: [`Parse error: ${reason}`],
+        };
+    }
+    const skillName = typeof parsed.metadata.name === 'string' && parsed.metadata.name.length > 0
+        ? parsed.metadata.name
+        : fallbackSkillName(resolvedPath);
+    const context = toAssessmentContext(skillName, resolvedPath, policy, parsed.body, parsed.metadata, now());
+    const detectors = (0, core_1.createDetectors)({ policy, preferredDetectors: ['rules'] });
+    const engine = new core_1.DecisionEngine(detectors);
+    const decision = await engine.assess(context);
+    return {
+        skillName,
+        skillPath: resolvedPath,
+        contentHash,
+        decision: decision.risk >= suspiciousThreshold ? 'suspicious' : 'safe',
+        risk: decision.risk,
+        reasons: [...decision.reasons],
+    };
+}

package/dist/guard/setup.d.ts

@@ -0,0 +1,44 @@
+export declare const SESSION_START_COMMAND = "sapper-ai guard scan";
+export declare const USER_PROMPT_SUBMIT_COMMAND = "sapper-ai guard check";
+type HookEvent = 'SessionStart' | 'UserPromptSubmit';
+type SetupAction = 'registered' | 'already_registered' | 'removed' | 'not_registered' | 'missing_claude_dir';
+export interface SetupPathOptions {
+    homeDir?: string;
+    claudeDirPath?: string;
+    settingsPath?: string;
+}
+export interface SetupCommandStatus {
+    event: HookEvent;
+    command: string;
+    timeoutSeconds: number;
+    registered: boolean;
+    matchCount: number;
+}
+export interface SetupStatusResult {
+    claudeDirPath: string;
+    settingsPath: string;
+    claudeDirExists: boolean;
+    settingsExists: boolean;
+    fullyRegistered: boolean;
+    commands: SetupCommandStatus[];
+}
+export interface RegisterHooksResult {
+    ok: boolean;
+    action: Extract<SetupAction, 'registered' | 'already_registered' | 'missing_claude_dir'>;
+    changed: boolean;
+    added: HookEvent[];
+    status: SetupStatusResult;
+}
+export interface RemoveHooksResult {
+    ok: boolean;
+    action: Extract<SetupAction, 'removed' | 'not_registered' | 'missing_claude_dir'>;
+    changed: boolean;
+    removedCount: number;
+    removedByEvent: Record<HookEvent, number>;
+    status: SetupStatusResult;
+}
+export declare function getStatus(options?: SetupPathOptions): SetupStatusResult;
+export declare function registerHooks(options?: SetupPathOptions): RegisterHooksResult;
+export declare function removeHooks(options?: SetupPathOptions): RemoveHooksResult;
+export {};
+//# sourceMappingURL=setup.d.ts.map

package/dist/guard/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/guard/setup.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qBAAqB,yBAAyB,CAAA;AAC3D,eAAO,MAAM,0BAA0B,0BAA0B,CAAA;AAKjE,KAAK,SAAS,GAAG,cAAc,GAAG,kBAAkB,CAAA;AAmBpD,KAAK,WAAW,GAAG,YAAY,GAAG,oBAAoB,GAAG,SAAS,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAE5G,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,SAAS,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,eAAe,EAAE,OAAO,CAAA;IACxB,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,CAAC,CAAA;IACxF,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,GAAG,gBAAgB,GAAG,oBAAoB,CAAC,CAAA;IACjF,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACzC,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAwQD,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAUvE;AAED,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,CA+B7E;AAED,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAyCzE"}

package/dist/guard/setup.js

@@ -0,0 +1,296 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_PROMPT_SUBMIT_COMMAND = exports.SESSION_START_COMMAND = void 0;
+exports.getStatus = getStatus;
+exports.registerHooks = registerHooks;
+exports.removeHooks = removeHooks;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+exports.SESSION_START_COMMAND = 'sapper-ai guard scan';
+exports.USER_PROMPT_SUBMIT_COMMAND = 'sapper-ai guard check';
+const SESSION_START_TIMEOUT_SECONDS = 30;
+const USER_PROMPT_SUBMIT_TIMEOUT_SECONDS = 5;
+const MANAGED_HOOKS = [
+    {
+        event: 'SessionStart',
+        command: exports.SESSION_START_COMMAND,
+        timeoutSeconds: SESSION_START_TIMEOUT_SECONDS,
+    },
+    {
+        event: 'UserPromptSubmit',
+        command: exports.USER_PROMPT_SUBMIT_COMMAND,
+        timeoutSeconds: USER_PROMPT_SUBMIT_TIMEOUT_SECONDS,
+    },
+];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function resolvePaths(options) {
+    const homePath = options?.homeDir ?? (0, node_os_1.homedir)();
+    const claudeDirPath = options?.claudeDirPath ?? (0, node_path_1.join)(homePath, '.claude');
+    const settingsPath = options?.settingsPath ?? (0, node_path_1.join)(claudeDirPath, 'settings.json');
+    return { claudeDirPath, settingsPath };
+}
+function readSettings(settingsPath) {
+    if (!(0, node_fs_1.existsSync)(settingsPath)) {
+        return { settings: {}, settingsExists: false };
+    }
+    const raw = (0, node_fs_1.readFileSync)(settingsPath, 'utf8');
+    if (raw.trim().length === 0) {
+        return { settings: {}, settingsExists: true };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Failed to parse ${settingsPath}: invalid JSON`);
+    }
+    if (!isRecord(parsed)) {
+        throw new Error(`${settingsPath} must contain a JSON object`);
+    }
+    return { settings: parsed, settingsExists: true };
+}
+function getHooksSection(settings, createIfMissing) {
+    const existing = settings.hooks;
+    if (isRecord(existing)) {
+        return existing;
+    }
+    if (!createIfMissing) {
+        return undefined;
+    }
+    const created = {};
+    settings.hooks = created;
+    return created;
+}
+function toMutableEventEntries(hooksSection, event) {
+    const existing = hooksSection[event];
+    if (Array.isArray(existing)) {
+        return existing;
+    }
+    if (existing === undefined) {
+        const created = [];
+        hooksSection[event] = created;
+        return created;
+    }
+    const converted = [existing];
+    hooksSection[event] = converted;
+    return converted;
+}
+function countCommandMatches(entries, command) {
+    let matches = 0;
+    for (const entry of entries) {
+        if (!isRecord(entry))
+            continue;
+        const nestedHooks = entry.hooks;
+        if (!Array.isArray(nestedHooks))
+            continue;
+        for (const hook of nestedHooks) {
+            if (!isRecord(hook))
+                continue;
+            if (hook.type !== 'command')
+                continue;
+            if (hook.command === command) {
+                matches += 1;
+            }
+        }
+    }
+    return matches;
+}
+function countCommandInEvent(settings, event, command) {
+    const hooksSection = getHooksSection(settings, false);
+    if (!hooksSection)
+        return 0;
+    const eventEntries = hooksSection[event];
+    if (!Array.isArray(eventEntries))
+        return 0;
+    return countCommandMatches(eventEntries, command);
+}
+function getStatusFromSettings(settings, settingsExists, claudeDirPath, settingsPath, claudeDirExists) {
+    const commands = MANAGED_HOOKS.map((managedHook) => {
+        const matchCount = countCommandInEvent(settings, managedHook.event, managedHook.command);
+        return {
+            event: managedHook.event,
+            command: managedHook.command,
+            timeoutSeconds: managedHook.timeoutSeconds,
+            registered: matchCount > 0,
+            matchCount,
+        };
+    });
+    return {
+        claudeDirPath,
+        settingsPath,
+        claudeDirExists,
+        settingsExists,
+        fullyRegistered: commands.every((entry) => entry.registered),
+        commands,
+    };
+}
+function writeSettingsAtomic(settingsPath, settings) {
+    const directory = (0, node_path_1.dirname)(settingsPath);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true });
+    const temporaryPath = `${settingsPath}.tmp-${process.pid}-${Date.now()}`;
+    try {
+        (0, node_fs_1.writeFileSync)(temporaryPath, `${JSON.stringify(settings, null, 2)}\n`, 'utf8');
+        (0, node_fs_1.renameSync)(temporaryPath, settingsPath);
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(temporaryPath, { force: true });
+        throw error;
+    }
+}
+function addManagedHooks(settings) {
+    const hooksSection = getHooksSection(settings, true);
+    const addedEvents = [];
+    for (const managedHook of MANAGED_HOOKS) {
+        const eventEntries = toMutableEventEntries(hooksSection, managedHook.event);
+        const alreadyRegistered = countCommandMatches(eventEntries, managedHook.command) > 0;
+        if (alreadyRegistered) {
+            continue;
+        }
+        eventEntries.push({
+            matcher: '*',
+            hooks: [
+                {
+                    type: 'command',
+                    command: managedHook.command,
+                    timeout: managedHook.timeoutSeconds,
+                },
+            ],
+        });
+        addedEvents.push(managedHook.event);
+    }
+    return addedEvents;
+}
+function removeManagedHooks(settings) {
+    const hooksSection = getHooksSection(settings, false);
+    const removedByEvent = {
+        SessionStart: 0,
+        UserPromptSubmit: 0,
+    };
+    if (!hooksSection) {
+        return { changed: false, removedByEvent, removedCount: 0 };
+    }
+    let changed = false;
+    for (const managedHook of MANAGED_HOOKS) {
+        const eventEntries = hooksSection[managedHook.event];
+        if (!Array.isArray(eventEntries)) {
+            continue;
+        }
+        const nextEntries = [];
+        let removedForEvent = 0;
+        for (const entry of eventEntries) {
+            if (!isRecord(entry)) {
+                nextEntries.push(entry);
+                continue;
+            }
+            const nestedHooks = entry.hooks;
+            if (!Array.isArray(nestedHooks)) {
+                nextEntries.push(entry);
+                continue;
+            }
+            const retainedHooks = [];
+            for (const hook of nestedHooks) {
+                if (isRecord(hook) &&
+                    hook.type === 'command' &&
+                    hook.command === managedHook.command) {
+                    removedForEvent += 1;
+                    changed = true;
+                    continue;
+                }
+                retainedHooks.push(hook);
+            }
+            if (retainedHooks.length === 0) {
+                continue;
+            }
+            if (retainedHooks.length !== nestedHooks.length) {
+                nextEntries.push({ ...entry, hooks: retainedHooks });
+                continue;
+            }
+            nextEntries.push(entry);
+        }
+        removedByEvent[managedHook.event] = removedForEvent;
+        if (nextEntries.length === 0) {
+            delete hooksSection[managedHook.event];
+        }
+        else {
+            hooksSection[managedHook.event] = nextEntries;
+        }
+    }
+    if (Object.keys(hooksSection).length === 0) {
+        delete settings.hooks;
+    }
+    return {
+        changed,
+        removedByEvent,
+        removedCount: removedByEvent.SessionStart + removedByEvent.UserPromptSubmit,
+    };
+}
+function getStatus(options) {
+    const { claudeDirPath, settingsPath } = resolvePaths(options);
+    const claudeDirExists = (0, node_fs_1.existsSync)(claudeDirPath);
+    if (!claudeDirExists) {
+        return getStatusFromSettings({}, false, claudeDirPath, settingsPath, false);
+    }
+    const { settings, settingsExists } = readSettings(settingsPath);
+    return getStatusFromSettings(settings, settingsExists, claudeDirPath, settingsPath, true);
+}
+function registerHooks(options) {
+    const { claudeDirPath, settingsPath } = resolvePaths(options);
+    const claudeDirExists = (0, node_fs_1.existsSync)(claudeDirPath);
+    if (!claudeDirExists) {
+        return {
+            ok: false,
+            action: 'missing_claude_dir',
+            changed: false,
+            added: [],
+            status: getStatusFromSettings({}, false, claudeDirPath, settingsPath, false),
+        };
+    }
+    const { settings, settingsExists } = readSettings(settingsPath);
+    const added = addManagedHooks(settings);
+    const changed = added.length > 0;
+    if (changed) {
+        writeSettingsAtomic(settingsPath, settings);
+    }
+    const status = getStatusFromSettings(settings, settingsExists || changed, claudeDirPath, settingsPath, true);
+    return {
+        ok: true,
+        action: changed ? 'registered' : 'already_registered',
+        changed,
+        added,
+        status,
+    };
+}
+function removeHooks(options) {
+    const { claudeDirPath, settingsPath } = resolvePaths(options);
+    const claudeDirExists = (0, node_fs_1.existsSync)(claudeDirPath);
+    if (!claudeDirExists) {
+        return {
+            ok: false,
+            action: 'missing_claude_dir',
+            changed: false,
+            removedCount: 0,
+            removedByEvent: {
+                SessionStart: 0,
+                UserPromptSubmit: 0,
+            },
+            status: getStatusFromSettings({}, false, claudeDirPath, settingsPath, false),
+        };
+    }
+    const { settings, settingsExists } = readSettings(settingsPath);
+    const removal = removeManagedHooks(settings);
+    if (removal.changed) {
+        writeSettingsAtomic(settingsPath, settings);
+    }
+    const status = getStatusFromSettings(settings, settingsExists || removal.changed, claudeDirPath, settingsPath, true);
+    return {
+        ok: true,
+        action: removal.changed ? 'removed' : 'not_registered',
+        changed: removal.changed,
+        removedCount: removal.removedCount,
+        removedByEvent: removal.removedByEvent,
+        status,
+    };
+}