fix: Prompt before global npm install during installer

The installer previously ran `npm install -g` silently without user
consent. Now it asks for confirmation first, explains why the global
install is needed (hooks & MCP server), and gracefully skips if declined.
README updated to document this step.

Closes #69

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -162,6 +162,7 @@ npx @colbymchenry/codegraph
 ```
 
 The interactive installer will:
+- Prompt to install `codegraph` globally (needed for hooks & MCP server to work)
 - Configure the MCP server in `~/.claude.json`
 - Set up auto-allow permissions for CodeGraph tools
 - Add global instructions to `~/.claude/CLAUDE.md` (teaches Claude how to use CodeGraph)
@@ -306,12 +307,13 @@ npx @colbymchenry/codegraph       # Run via npx (no global install needed)
 ```
 
 The installer will:
-1. Ask for installation location (global `~/.claude` or local `./.claude`)
-2. Configure the MCP server in `claude.json`
-3. Optionally set up auto-allow permissions
-4. Add global instructions to `~/.claude/CLAUDE.md` (teaches Claude how to use CodeGraph)
-5. Install Claude Code hooks for automatic index syncing
-6. For local installs: initialize and index the current project
+1. Prompt to install `codegraph` globally (needed for hooks & MCP server)
+2. Ask for installation location (global `~/.claude` or local `./.claude`)
+3. Configure the MCP server in `claude.json`
+4. Optionally set up auto-allow permissions
+5. Add global instructions to `~/.claude/CLAUDE.md` (teaches Claude how to use CodeGraph)
+6. Install Claude Code hooks for automatic index syncing
+7. For local installs: initialize and index the current project
 
 ### `codegraph init [path]`
 

src/installer/index.ts

@@ -7,7 +7,7 @@
 
 import { execSync } from 'child_process';
 import { showBanner, showNextSteps, success, error, info, chalk } from './banner';
-import { promptInstallLocation, promptAutoAllow, InstallLocation } from './prompts';
+import { promptInstallLocation, promptAutoAllow, promptConfirm, InstallLocation } from './prompts';
 import { writeMcpConfig, writePermissions, writeClaudeMd, writeHooks, hasMcpConfig, hasPermissions, hasHooks } from './config-writer';
 
 /**
@@ -25,16 +25,25 @@ export async function runInstaller(): Promise<void> {
   showBanner();
 
   try {
-    // Step 1: Install codegraph globally.
-    // Always run npm install -g — we can't use `command -v codegraph` to check
-    // because npx puts a temporary binary in PATH that vanishes when npx exits.
-    console.log(chalk.dim('  Installing codegraph globally...'));
-    try {
-      execSync('npm install -g @colbymchenry/codegraph', { stdio: 'pipe' });
-      success('Installed codegraph command globally');
-    } catch {
-      info('Could not install globally (permission denied)');
-      info('Try: sudo npm install -g @colbymchenry/codegraph');
+    // Step 1: Install codegraph globally (with user consent).
+    // The global install is needed because Claude Code hooks and the MCP server
+    // invoke `codegraph` by name — the temporary npx binary vanishes when npx exits.
+    console.log(chalk.bold('  Install codegraph globally?') + chalk.dim(' (Required for hooks & MCP server)'));
+    console.log();
+    const shouldInstallGlobally = await promptConfirm('Install globally via npm', true);
+
+    if (shouldInstallGlobally) {
+      console.log(chalk.dim('  Installing codegraph globally...'));
+      try {
+        execSync('npm install -g @colbymchenry/codegraph', { stdio: 'pipe' });
+        success('Installed codegraph command globally');
+      } catch {
+        info('Could not install globally (permission denied)');
+        info('Try: sudo npm install -g @colbymchenry/codegraph');
+      }
+    } else {
+      info('Skipped global install — hooks and MCP server may not work without it');
+      info('You can install later: npm install -g @colbymchenry/codegraph');
     }
     console.log();