aegis-devops 0.1.2__tar.gz → 0.1.3__tar.gz

{aegis_devops-0.1.2/src/aegis_devops.egg-info → aegis_devops-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aegis-devops
-Version: 0.1.2
+Version: 0.1.3
 Summary: Provenance-backed, authority-aware policy verifier for agentic DevOps actions.
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/moneytool/aegis-devops
@@ -81,7 +81,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=21 quarantined=0 principals=3
+STORE: loaded=29 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -92,6 +92,20 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
+### In your coding agent
+
+Aegis can check every shell command Claude Code, Codex, GitHub Copilot (CLI and VS Code) or
+Cursor wants to run, before it runs. In Claude Code:
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+For the others, `aegis install codex|copilot|vscode|cursor`. It only acts in projects with a
+`.aegis/` policy, and only blocks what that policy blocks. See [Coding agents](docs/agents.md).
+
 ### From a clone
 
 ```bash
@@ -207,13 +221,13 @@ v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonn
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
-What is *not* done is the part the threat model leans on hardest. See `PLAN.md §8`, but in
+What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: sources are verified against files on disk rather than real Git/Slack/Jira connectors,
 signing uses a shared secret rather than per-principal public keys, and a `principal` is a
 signed name rather than an identity bound to a commit signature or an SSO group. Until those
 land, Aegis demonstrates that the *decision procedure* is sound; it does not yet prove the
 identities feeding it are. Resource matching is also case-sensitive on names. It is not
-production-ready: read `PLAN.md §8` for the full list of open gaps before putting it in front
+production-ready: read `docs/dev/PLAN.md §8` for the full list of open gaps before putting it in front
 of anything you care about.
 
 ## Documentation
@@ -225,10 +239,10 @@ of anything you care about.
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |
 | [`docs/benchmark.md`](docs/benchmark.md) | Benchmark methodology, full results table, real LLM baselines, agent-harness baselines, corpus, adversarial suite |
 | [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) | Adding a new parser or tool |
-| [`PLAN.md`](PLAN.md) | Design plan and open gaps |
+| [`docs/dev/PLAN.md`](docs/dev/PLAN.md) | Design plan and open gaps |
 | [`SECURITY.md`](SECURITY.md) | Reporting a bypass |
 | [`CHANGELOG.md`](CHANGELOG.md) | Release history |
-| [`REVIEW-4.md`](REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
+| [`docs/dev/REVIEW-4.md`](docs/dev/REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
 
 ## Development
 

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/README.md

@@ -49,7 +49,7 @@ BLOCK: kubernetes scale deployment/api-server
   citations: no-scale-prod-peak
   covered: True  latency_ms: 0.20
 PLAN BLOCK: 1 intent(s)
-STORE: loaded=21 quarantined=0 principals=3
+STORE: loaded=29 quarantined=0 principals=3
   warning: using example signing key
 ```
 
@@ -60,6 +60,20 @@ a key everyone has. `aegis init` prints the two commands that replace it with yo
 replace `constraints.example.yaml` with your own `constraints.yaml` (a real file wins over the
 `.example` one when both exist).
 
+### In your coding agent
+
+Aegis can check every shell command Claude Code, Codex, GitHub Copilot (CLI and VS Code) or
+Cursor wants to run, before it runs. In Claude Code:
+
+```bash
+pip install aegis-devops && aegis init .aegis
+claude plugin marketplace add moneytool/aegis-devops
+claude plugin install aegis-devops@aegis-devops
+```
+
+For the others, `aegis install codex|copilot|vscode|cursor`. It only acts in projects with a
+`.aegis/` policy, and only blocks what that policy blocks. See [Coding agents](docs/agents.md).
+
 ### From a clone
 
 ```bash
@@ -175,13 +189,13 @@ v0.1.0 is on PyPI as an **alpha**. Real LLM baselines have been run: Claude Sonn
 the API (cached in `results/llm-external.md`), Haiku through the Claude Code CLI, `gpt-6-astra`
 through the Codex CLI, and a local `mistral:latest`.
 
-What is *not* done is the part the threat model leans on hardest. See `PLAN.md §8`, but in
+What is *not* done is the part the threat model leans on hardest. See `docs/dev/PLAN.md §8`, but in
 short: sources are verified against files on disk rather than real Git/Slack/Jira connectors,
 signing uses a shared secret rather than per-principal public keys, and a `principal` is a
 signed name rather than an identity bound to a commit signature or an SSO group. Until those
 land, Aegis demonstrates that the *decision procedure* is sound; it does not yet prove the
 identities feeding it are. Resource matching is also case-sensitive on names. It is not
-production-ready: read `PLAN.md §8` for the full list of open gaps before putting it in front
+production-ready: read `docs/dev/PLAN.md §8` for the full list of open gaps before putting it in front
 of anything you care about.
 
 ## Documentation
@@ -193,10 +207,10 @@ of anything you care about.
 | [`docs/configuration.md`](docs/configuration.md) | Configuration/config-dir discovery, signing, source verification, rate limits & ledger |
 | [`docs/benchmark.md`](docs/benchmark.md) | Benchmark methodology, full results table, real LLM baselines, agent-harness baselines, corpus, adversarial suite |
 | [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) | Adding a new parser or tool |
-| [`PLAN.md`](PLAN.md) | Design plan and open gaps |
+| [`docs/dev/PLAN.md`](docs/dev/PLAN.md) | Design plan and open gaps |
 | [`SECURITY.md`](SECURITY.md) | Reporting a bypass |
 | [`CHANGELOG.md`](CHANGELOG.md) | Release history |
-| [`REVIEW-4.md`](REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
+| [`docs/dev/REVIEW-4.md`](docs/dev/REVIEW-4.md) | Corpus/oracle rewrite (independent oracle, intent-level holdout) |
 
 ## Development
 

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/__init__.py

@@ -4,4 +4,4 @@ infrastructure actions of AI agents.
 See the README for what this does and, importantly, what it does not yet do.
 """
 
-__version__ = "0.1.2"
+__version__ = "0.1.3"

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/_examples/constraints.example.yaml

@@ -336,3 +336,118 @@ constraints:
   rule_text: Block deleting Helm releases in any production environment (resolved
     from the kube context), whatever the namespace; use the decommission runbook instead.
   provenance_hash: 747653b3b34300a18e4773a0784706fcb0147fb10507e88ce93f2fb5cdcd4df8
+- id: block-terraform-destroy
+  provider: terraform
+  resource_pattern: workspace/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6001
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block ''terraform destroy'' and ''tofu destroy'' (and apply -destroy):
+    tearing down a whole configuration needs a reviewed plan, not an agent''s command.'
+  provenance_hash: 48bd0974d281efa45af89240c0ffc997a4ee7323d07471bb97a4a047081c4178
+- id: block-pulumi-destroy
+  provider: pulumi
+  resource_pattern: stack/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6002
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block ''pulumi destroy'' and ''pulumi stack rm'': removing a whole stack
+    needs a human.'
+  provenance_hash: 41428597dfe6a997f0797c3c700db953399d515447b2857552cbf4635d3e1782
+- id: block-namespace-delete
+  provider: kubernetes
+  resource_pattern: namespace/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6003
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block deleting Kubernetes namespaces: it deletes everything inside them.'
+  provenance_hash: 44ee6f6790b2e4996f1fa03bc8d79782e876d1aae27dca7630b81a88206de572
+- id: block-s3-bucket-delete
+  provider: aws
+  resource_pattern: s3/bucket/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6004
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Block deleting S3 buckets (aws s3 rb, s3api delete-bucket).
+  provenance_hash: 27e8b1723128c747f4780969cf2b44f639235bc1e83e4188686618cb23d42125
+- id: block-rds-delete
+  provider: aws
+  resource_pattern: rds/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6005
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Block deleting RDS databases, clusters and snapshots.
+  provenance_hash: e44c7617a771c4f53260e751bf23b1bf6c1df648e1b0aa6a6629a2a344b60b0d
+- id: block-gcp-project-delete
+  provider: gcp
+  resource_pattern: project/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6006
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Block deleting GCP projects.
+  provenance_hash: 7e6fe5ce1001c1c8849af9bbbc66ce4c9f4c2303772f77dcbf9fef0d58f2b4a0
+- id: block-azure-resource-group-delete
+  provider: azure
+  resource_pattern: resource/group/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: BLOCK
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6007
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: 'Block deleting Azure resource groups: it deletes every resource in them.'
+  provenance_hash: 733126d10190f8cdcde09cbbcd6a6aef719b97e9dc8bd070cf3b84aa381029b9
+- id: escalate-argocd-app-delete
+  provider: argocd
+  resource_pattern: app/*
+  actions:
+  - delete
+  scope: {}
+  time_window: null
+  effect: ESCALATE
+  constraint_class: deletion
+  principal: admin
+  source_ref: git-6008
+  source_timestamp: '2026-09-27T12:00:00+00:00'
+  rule_text: Escalate deleting Argo CD applications (with cascade this deletes the
+    deployed resources) for human review.
+  provenance_hash: dc24eb69ac5c8b66279284b6df19095e3f0096303f3ef18da712a53e5e339aeb

aegis_devops-0.1.3/src/aegis_core/_examples/constraints.example.yaml.sig

@@ -0,0 +1,2 @@
+aegis-sig-v1
+245908109e5e1ecf20ba80c41aa725c57dfbd5b2f185da1bc6708b3cbd3ce42d

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/_examples/sources/AEGIS-MANIFEST.sig

@@ -1,7 +1,15 @@
 {
   "files": {
-    "PRINCIPALS.yaml": "bdc9ca4ae562397b203242031e960dc4a45eae1bf1ba6d8951f7e17d819a7cfb",
+    "PRINCIPALS.yaml": "e2e7025a2092240acede6a88c7f1a4f22d3cdbf5821772fba9e0f91fbfcbcc8f",
     "git-4001.json": "8be2dd6c37ef643b3bc375b15d5d97889b00456285f594e21a3b4d52521e21de",
+    "git-6001.json": "6592ca4568f767d71a431490ff3cacdbc699ad92be966f57aed3b0a485844dc5",
+    "git-6002.json": "e6286c5fb8a0d2b3c34ca0c841ccede2a477a02f4781115caf4650f4f7c019b8",
+    "git-6003.json": "b077ac2d1119f9a90453e762f2186f3f37837d348822016c01a6f145f528b197",
+    "git-6004.json": "57d2dc91b3014c3cad329266f7ba57472b2d5053635827afc7ddeda02cd73ee3",
+    "git-6005.json": "3fe8ba5cc4cd123fe78f5f4e60f81f8ab38dc0da395d4dbf82634f1359f01803",
+    "git-6006.json": "3f6fbfeb34afb3bcb8075f0864047b3641f0016b8817f67288db7f64afd36b58",
+    "git-6007.json": "eb84394208274b79792e285c5143dde320a2f4755d9b2922ffb55df07e7c5b9e",
+    "git-6008.json": "34d29df94b55a3fa29521246fa17e0966eda93f718a6c41082e6c648569aafa5",
     "git-789abc.json": "48ac500e13d36240ec5c72bf90e96b433a5873d636e9e36f99a73468e7fb5757",
     "git-abc123.json": "ee3751fdcd64cf1dd374bf9f7b73cda723a4aced5053f32501ba9416de89afc7",
     "git-bcd234.json": "a0de7b32bde75735c91504aa7156e7b2ba2ef961d0f439218507e40d0bdfd89a",
@@ -28,5 +36,5 @@
     "slack-perma-1.json": "2c8945a68e413c300ef58fc6a6d3daa8e4d0029a26a454dfad983e2091a188d1"
   },
   "header": "aegis-manifest-v1",
-  "sig": "16b0f5f348626c74d6b40cfe21fe92d3e37703668fa51e9428fdc026cc297bc0"
+  "sig": "034812f78b7f502ebcbb9183bfcf88023324ffcd83e82e5d698aee252cd3b824"
 }

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/_examples/sources/PRINCIPALS.yaml

@@ -29,3 +29,11 @@ principals:
   plan-1004: admin
   plan-5005: admin
   slack-perma-1: admin
+  git-6001: admin
+  git-6002: admin
+  git-6003: admin
+  git-6004: admin
+  git-6005: admin
+  git-6006: admin
+  git-6007: admin
+  git-6008: admin

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6001.json

@@ -0,0 +1,15 @@
+{
+  "provider": "terraform",
+  "resource_pattern": "workspace/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6001",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block 'terraform destroy' and 'tofu destroy' (and apply -destroy): tearing down a whole configuration needs a reviewed plan, not an agent's command."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6002.json

@@ -0,0 +1,15 @@
+{
+  "provider": "pulumi",
+  "resource_pattern": "stack/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6002",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block 'pulumi destroy' and 'pulumi stack rm': removing a whole stack needs a human."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6003.json

@@ -0,0 +1,15 @@
+{
+  "provider": "kubernetes",
+  "resource_pattern": "namespace/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6003",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting Kubernetes namespaces: it deletes everything inside them."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6004.json

@@ -0,0 +1,15 @@
+{
+  "provider": "aws",
+  "resource_pattern": "s3/bucket/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6004",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting S3 buckets (aws s3 rb, s3api delete-bucket)."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6005.json

@@ -0,0 +1,15 @@
+{
+  "provider": "aws",
+  "resource_pattern": "rds/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6005",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting RDS databases, clusters and snapshots."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6006.json

@@ -0,0 +1,15 @@
+{
+  "provider": "gcp",
+  "resource_pattern": "project/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6006",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting GCP projects."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6007.json

@@ -0,0 +1,15 @@
+{
+  "provider": "azure",
+  "resource_pattern": "resource/group/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "BLOCK",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6007",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Block deleting Azure resource groups: it deletes every resource in them."
+}

aegis_devops-0.1.3/src/aegis_core/_examples/sources/git-6008.json

@@ -0,0 +1,15 @@
+{
+  "provider": "argocd",
+  "resource_pattern": "app/*",
+  "actions": [
+    "delete"
+  ],
+  "scope": {},
+  "time_window": null,
+  "effect": "ESCALATE",
+  "constraint_class": "deletion",
+  "principal": "admin",
+  "source_ref": "git-6008",
+  "source_timestamp": "2026-09-27T12:00:00+00:00",
+  "rule_text": "Escalate deleting Argo CD applications (with cascade this deletes the deployed resources) for human review."
+}

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/baselines/__init__.py

@@ -1,5 +1,5 @@
 """Baseline verifiers compared against Aegis in the Week 7-8 benchmark
-(PLAN.md §4).
+(docs/dev/PLAN.md §4).
 
 Every verifier here implements the same tiny protocol (see ``base.py``) so
 ``scripts/benchmark.py`` can run Aegis and the baselines through one loop

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/baselines/llm.py

@@ -1,4 +1,4 @@
-"""Baseline B — LLM Self-Check (PLAN.md §4).
+"""Baseline B — LLM Self-Check (docs/dev/PLAN.md §4).
 
 The model is handed the *same* 500 constraints Aegis loads into its store
 (constraint parity) as a YAML blob in the system prompt, and the intent as

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/baselines/metrics.py

@@ -1,4 +1,4 @@
-"""Benchmark metrics (PLAN.md §4): confusion matrix, over-block rate,
+"""Benchmark metrics (docs/dev/PLAN.md §4): confusion matrix, over-block rate,
 coverage, poison susceptibility (per attack kind) and latency percentiles.
 
 The harness consumes ``Decision`` objects duck-typed: only ``verdict``,

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/baselines/opa.py

@@ -1,10 +1,10 @@
-"""Baseline C — OPA/Rego (PLAN.md §4).
+"""Baseline C — OPA/Rego (docs/dev/PLAN.md §4).
 
 Like the LLM baseline, this one loads *every* constraint — tampered,
 unauthorized, and forged included — because OPA/Gatekeeper has no concept
 of provenance or authority. It evaluates structured input against
 hand-authored (here, generated) rules, which is exactly the "why not
-OPA/Gatekeeper" distinction PLAN.md §3 draws.
+OPA/Gatekeeper" distinction docs/dev/PLAN.md §3 draws.
 
 Known limitation: constraint ``time_window`` is NOT evaluated by the
 generated Rego (OPA has ``time.now_ns`` but wiring day-of-week + local-tz

{aegis_devops-0.1.2 → aegis_devops-0.1.3}/src/aegis_core/cli.py

@@ -87,6 +87,7 @@ from datetime import UTC, datetime, timedelta
 import yaml
 
 from aegis_core import config as config_module
+from aegis_core import hook as hook_module
 from aegis_core import signing
 from aegis_core.authority import load_authority_map
 from aegis_core.environments import (
@@ -449,6 +450,40 @@ def _build_parser() -> argparse.ArgumentParser:
         "--out", default="aegis-signing.key", help="path to write the key to"
     )
 
+    hook_parser = subparsers.add_parser(
+        "hook",
+        help="Run as a coding agent's pre-tool hook: read its JSON payload on stdin, answer "
+        "in its format (see 'aegis install')",
+    )
+    hook_parser.add_argument("agent", choices=hook_module.AGENTS)
+    hook_parser.add_argument(
+        "--escalate-as",
+        choices=("ask", "deny"),
+        default="ask",
+        help="what an ESCALATE verdict becomes: 'ask' the user (default, where the agent "
+        "supports it; Codex does not, so it always denies) or 'deny'",
+    )
+    hook_parser.add_argument(
+        "check_args",
+        nargs=argparse.REMAINDER,
+        help="extra 'aegis check command' options after --, e.g. -- --fail-closed",
+    )
+
+    install_parser = subparsers.add_parser(
+        "install", help="Register 'aegis hook' in a coding agent's hook config"
+    )
+    install_parser.add_argument("agent", choices=hook_module.AGENTS)
+    scope = install_parser.add_mutually_exclusive_group()
+    scope.add_argument(
+        "--user", action="store_true", help="install for every project (the user's config)"
+    )
+    scope.add_argument(
+        "--project", default=".", help="project directory to install into (default: .)"
+    )
+    install_parser.add_argument(
+        "--remove", action="store_true", help="remove the aegis hook instead"
+    )
+
     return parser
 
 
@@ -1000,6 +1035,16 @@ def _run(argv: list[str]) -> int:
         return _run_init(args)
     if args.command == "keygen":
         return _run_keygen(args)
+    if args.command == "hook":
+        return hook_module.main_hook(
+            args.agent,
+            escalate_as=args.escalate_as,
+            extra_args=_strip_leading_separator(args.check_args),
+        )
+    if args.command == "install":
+        return hook_module.main_install(
+            args.agent, user=args.user, project=args.project, remove=args.remove
+        )
     if args.command != "check":
         raise UsageError("unknown command")