0xray 3.3.1 → 3.4.2

package/dist/integrations/grok/grok-cli.js

@@ -18,9 +18,44 @@ import { frameworkLogger } from '../../core/framework-logger.js';
 import fs from 'fs';
 import path from 'path';
 import { execSync } from 'child_process';
+import { createRequire } from 'module';
 import { syncBuiltinSkills } from '../../cli/commands/skill-install.js';
 // ESM-compatible __dirname (this file is compiled to ESM)
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
+const packageRoot = path.resolve(__dirname, '..', '..', '..');
+const requireCjs = createRequire(import.meta.url);
+const { resolveConsumerTargetDir } = requireCjs(path.join(packageRoot, 'scripts/node/install-bridges.cjs'));
+/** Canonical 7-server MCP surface — matches install-bridges.cjs and package .mcp.json */
+const XRAY_MCP_SERVERS = [
+    { name: 'xray-governance', mcpCmd: 'governance', env: { XRAY_FORCE_MCP_GOVERNANCE: 'true' } },
+    { name: 'xray-skills', mcpCmd: 'skills', env: {} },
+    { name: 'xray-orchestrator', mcpCmd: 'orchestrator', env: {} },
+    { name: 'xray-enforcer', mcpCmd: 'enforcer', env: {} },
+    { name: 'xray-researcher', mcpCmd: 'researcher', env: {} },
+    { name: 'xray-code-review', mcpCmd: 'code-review', env: {} },
+    { name: 'xray-architect-tools', mcpCmd: 'architect-tools', env: {} },
+];
+function registerGrokMcpServers(targetDir) {
+    try {
+        execSync('which grok', { stdio: 'ignore' });
+    }
+    catch {
+        console.log('[Grok] grok CLI not on PATH — plugin .mcp.json still configured');
+        return;
+    }
+    for (const s of XRAY_MCP_SERVERS) {
+        try {
+            const envEntries = { ...s.env, XRAY_ROOT: targetDir };
+            const envFlags = Object.entries(envEntries)
+                .map(([k, v]) => `--env "${k}=${v}"`)
+                .join(' ');
+            execSync(`grok mcp add ${s.name} --command npx --args "-y" "0xray" "mcp" "${s.mcpCmd}" ${envFlags}`, { stdio: 'pipe' });
+        }
+        catch {
+            // already registered or grok config conflict — non-blocking
+        }
+    }
+}
 export async function installForGrokCLI(options = {}) {
     frameworkLogger.log('grok-integration', 'install-start', 'info', { options });
     const home = process.env.HOME || process.env.USERPROFILE || '';
@@ -39,15 +74,18 @@ export async function installForGrokCLI(options = {}) {
         console.log(`[Grok] Dry run: Would copy plugin from ${sourceDir} → ${targetPluginDir}`);
         return;
     }
+    const targetDir = resolveConsumerTargetDir(packageRoot, process.cwd());
     try {
-        if (fs.existsSync(targetPluginDir) && !options.force) {
+        const pluginExists = fs.existsSync(targetPluginDir);
+        if (pluginExists && !options.force) {
             console.log('[Grok] 0xray Grok plugin is already installed.');
-            console.log('Use --force to reinstall.');
-            return;
+            console.log('Use --force to reinstall plugin files.');
+        }
+        else {
+            fs.cpSync(sourceDir, targetPluginDir, { recursive: true, force: true });
+            frameworkLogger.log('grok-integration', 'plugin-copied', 'info', { destination: targetPluginDir });
+            console.log(`\x1b[32m✓ Copied Grok plugin to ${targetPluginDir}\x1b[0m`);
         }
-        fs.cpSync(sourceDir, targetPluginDir, { recursive: true, force: true });
-        frameworkLogger.log('grok-integration', 'plugin-copied', 'info', { destination: targetPluginDir });
-        console.log(`\x1b[32m✓ Copied Grok plugin to ${targetPluginDir}\x1b[0m`);
         // Sync builtin skills to Grok plugin skills dir
         const grokSkillsDir = path.join(targetPluginDir, 'skills');
         const skillsCopied = syncBuiltinSkills(grokSkillsDir);
@@ -70,25 +108,9 @@ export async function installForGrokCLI(options = {}) {
             console.log('\nPlease run this command to fully trust the plugin:');
             console.log(`  grok plugins trust "${targetPluginDir}"`);
         }
-        // Register MCP servers via grok mcp add (most reliable mechanism)
-        const govMcpPath = path.resolve(__dirname, '..', '..', '..', 'dist/mcps/governance.server.js');
-        const skillsMcpPath = path.resolve(__dirname, '..', '..', '..', 'dist/mcps/knowledge-skills/skill-invocation.server.js');
-        const orchMcpPath = path.resolve(__dirname, '..', '..', '..', 'dist/mcps/orchestrator.server.js');
-        const enforcerMcpPath = path.resolve(__dirname, '..', '..', '..', 'dist/mcps/enforcer-tools.server.js');
-        try {
-            execSync(`grok mcp add xray-governance --command node --args "${govMcpPath}" --env "XRAY_FORCE_MCP_GOVERNANCE=true" --env "XRAY_ROOT=${process.cwd()}"`, { stdio: 'pipe' });
-            execSync(`grok mcp add xray-skills --command node --args "${skillsMcpPath}" --env "XRAY_ROOT=${process.cwd()}"`, { stdio: 'pipe' });
-            execSync(`grok mcp add xray-orchestrator --command node --args "${orchMcpPath}" --env "XRAY_ROOT=${process.cwd()}"`, { stdio: 'pipe' });
-            execSync(`grok mcp add xray-enforcer --command node --args "${enforcerMcpPath}" --env "XRAY_ROOT=${process.cwd()}"`, { stdio: 'pipe' });
-            console.log('\x1b[32m✓ Registered xray MCP servers with Grok CLI\x1b[0m');
-        }
-        catch {
-            console.log('\nCould not auto-register MCP servers. Run manually:');
-            console.log(`  grok mcp add xray-governance --command node --args "${govMcpPath}"`);
-            console.log(`  grok mcp add xray-skills --command node --args "${skillsMcpPath}"`);
-            console.log(`  grok mcp add xray-orchestrator --command node --args "${orchMcpPath}"`);
-            console.log(`  grok mcp add xray-enforcer --command node --args "${enforcerMcpPath}"`);
-        }
+        // Register MCP servers via grok mcp add (npx -y 0xray mcp — matches install-bridges)
+        registerGrokMcpServers(targetDir);
+        console.log('\x1b[32m✓ Registered 7 xray MCP servers with Grok CLI (npx)\x1b[0m');
         console.log('\n✅ 0xRay is now installed as a first-class Grok CLI plugin!');
         console.log('Restart Grok or run `grok` to load the new hooks and MCP servers.');
     }

package/dist/integrations/grok/hooks/grok-hook-activity.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * Sync activity.log writer for Grok hooks (hooks exit before frameworkLogger flush).
+ * Format matches frameworkLogger.bufferEntry output.
+ */
+
+import fs from 'fs';
+import path from 'path';
+
+function formatLine(component, action, status, details, jobId) {
+  const ts = new Date().toISOString();
+  const jobPart = jobId ? `[${jobId}] ` : '';
+  const detailsPart = details
+    ? ` | ${(() => {
+        try {
+          return JSON.stringify(details);
+        } catch {
+          return String(details);
+        }
+      })()}`
+    : '';
+  return `${ts} ${jobPart}[${component}] ${action} - ${status.toUpperCase()}${detailsPart}\n`;
+}
+
+export function appendHookActivity(root, component, action, status, details = {}) {
+  const workspace = root || process.cwd();
+  const logDir = path.join(workspace, 'logs', 'framework');
+  const logFile = path.join(logDir, 'activity.log');
+  try {
+    fs.mkdirSync(logDir, { recursive: true });
+    const jobId = `hook-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    fs.appendFileSync(logFile, formatLine(component, action, status, details, jobId));
+    return jobId;
+  } catch {
+    return null;
+  }
+}
+
+export function activityLogHasPattern(root, pattern, tailBytes = 65536) {
+  const logFile = path.join(root, 'logs', 'framework', 'activity.log');
+  if (!fs.existsSync(logFile)) return false;
+  try {
+    const stat = fs.statSync(logFile);
+    const start = Math.max(0, stat.size - tailBytes);
+    const fd = fs.openSync(logFile, 'r');
+    const buf = Buffer.alloc(stat.size - start);
+    fs.readSync(fd, buf, 0, buf.length, start);
+    fs.closeSync(fd);
+    return pattern.test(buf.toString('utf8'));
+  } catch {
+    return false;
+  }
+}

package/dist/integrations/grok/hooks/grok-hook-utils.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+/**
+ * Shared utilities for Grok CLI hooks — codex load, features, surface checks.
+ * Pure JS (no TS build) so hooks run from dist/ without compilation surprises.
+ */
+
+import fs from 'fs';
+import path from 'path';
+
+export const LEAD_DEV_RULES = [
+  'Phased plan + todos; assign best subagent; monitor output',
+  'Lead dev loops test→fix until green; no permission pings',
+  'Per-suite test triage; full suite last',
+  'Lead stays main; subagents execute; update todos',
+  'Read all output; triage fix rerun',
+  'No buck-passing — resolve every error',
+  'Zero open errors at phase completion',
+];
+
+/** Blocking codex patterns detectable in proposed edits (term → regex + message) */
+export const CODEX_BLOCK_PATTERNS = [
+  { terms: [11], pattern: /:\s*any\b|as\s+any\b/g, message: 'Codex 11 Type Safety: no `any` types' },
+  { terms: [11], pattern: /@ts-ignore|@ts-expect-error/g, message: 'Codex 11 Type Safety: no @ts-ignore / @ts-expect-error' },
+  { terms: [29], pattern: /\beval\s*\(/g, message: 'Codex 29 Security: eval() prohibited' },
+  { terms: [2], pattern: /\bTODO\b|\bFIXME\b|\bSTUB\b/g, message: 'Codex 2: no TODO/FIXME/STUB in production code' },
+  { terms: [7], pattern: /console\.log\s*\(/g, message: 'Codex 7: no console.log debugging' },
+];
+
+/** New-surface paths blocked when no_new_surface is on (codex 69) */
+export const SURFACE_DENY_PATTERNS = [
+  { pattern: /(?:^|\/)src\/mcps\/[^/]+\.server\.(ts|js)$/i, message: 'Codex 69: new MCP server — rewire existing mcps/' },
+  { pattern: /(?:^|\/)src\/skills\/[^/]+\/SKILL\.md$/i, message: 'Codex 69: new skill — extend orchestrator skill or existing mcps' },
+  { pattern: /(?:^|\/)src\/mcps\/orchestrator\/handlers\/[^/]+-handler\.(ts|js)$/i, message: 'Codex 69: new orchestrator handler — merge into complexity-handler' },
+  { pattern: /(?:^|\/)src\/nucleus\/autonomy-kernel\.(ts|js)$/i, message: 'Codex 69: parallel autonomy kernel — use existing nucleus' },
+  { pattern: /(?:^|\/)src\/mcps\/[^/]+\/handlers\/autonomy-handler\.(ts|js)$/i, message: 'Codex 69: autonomy-handler removed — use complexity-handler' },
+];
+
+const SUBAGENT_TOOLS = new Set([
+  'spawn_subagent',
+  'task',
+  'Task',
+]);
+
+const WRITE_TOOLS = new Set([
+  'search_replace',
+  'write',
+  'Write',
+  'Edit',
+  'MultiEdit',
+  'edit_notebook',
+  'EditNotebook',
+]);
+
+export function workspaceRoot() {
+  return (
+    process.env.GROK_WORKSPACE_ROOT ||
+    process.env.CLAUDE_PROJECT_DIR ||
+    process.env.XRAY_ROOT ||
+    process.cwd()
+  );
+}
+
+export function resolveFeaturesPath(root = workspaceRoot()) {
+  for (const p of [
+    path.join(root, '.xray', 'features.json'),
+    path.join(process.cwd(), '.xray', 'features.json'),
+  ]) {
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+export function resolveCodexPath(root = workspaceRoot()) {
+  for (const p of [
+    path.join(root, '.xray', 'codex.json'),
+    path.join(process.cwd(), '.xray', 'codex.json'),
+  ]) {
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+export function loadFeatures() {
+  const featuresPath = resolveFeaturesPath();
+  if (!featuresPath) return { lead_dev_mode: true, no_new_surface: true, per_suite_triage: true };
+  try {
+    const data = JSON.parse(fs.readFileSync(featuresPath, 'utf8'));
+    const orch = data.multi_agent_orchestration ?? {};
+    return {
+      lead_dev_mode: orch.enabled !== false && orch.lead_dev_mode !== false,
+      no_new_surface: orch.no_new_surface !== false,
+      per_suite_test_triage: orch.per_suite_test_triage !== false,
+    };
+  } catch {
+    return { lead_dev_mode: true, no_new_surface: true, per_suite_triage: true };
+  }
+}
+
+export function loadBlockingCodexTerms() {
+  const codexPath = resolveCodexPath();
+  if (!codexPath) return [];
+  try {
+    const data = JSON.parse(fs.readFileSync(codexPath, 'utf8'));
+    const terms = data.terms ?? {};
+    return Object.values(terms).filter(
+      (t) => t.enforcementLevel === 'blocking' || t.zeroTolerance === true,
+    );
+  } catch {
+    return [];
+  }
+}
+
+export function leadDevPlanPath(root = workspaceRoot()) {
+  return path.join(root, '.xray', 'state', 'lead-dev-plan.json');
+}
+
+export function hasFreshLeadDevPlan(maxAgeMs = 4 * 60 * 60 * 1000) {
+  const planPath = leadDevPlanPath();
+  if (!fs.existsSync(planPath)) return false;
+  try {
+    const stat = fs.statSync(planPath);
+    if (Date.now() - stat.mtimeMs > maxAgeMs) return false;
+    const plan = JSON.parse(fs.readFileSync(planPath, 'utf8'));
+    return plan.active === true;
+  } catch {
+    return false;
+  }
+}
+
+export function extractToolContext(event) {
+  const toolName = event.toolName || process.env.TOOL_NAME || 'unknown';
+  const toolInput = event.toolInput ?? {};
+  const paths = [];
+  let content = '';
+
+  if (toolInput.path) paths.push(String(toolInput.path));
+  if (toolInput.file_path) paths.push(String(toolInput.file_path));
+  if (toolInput.target_notebook) paths.push(String(toolInput.target_notebook));
+  if (Array.isArray(toolInput.paths)) paths.push(...toolInput.paths.map(String));
+
+  if (toolInput.new_string) content += String(toolInput.new_string);
+  if (toolInput.contents) content += String(toolInput.contents);
+  if (toolInput.command) content += String(toolInput.command);
+  if (toolInput.prompt) content += String(toolInput.prompt);
+
+  return { toolName, toolInput, paths, content, cmd: String(toolInput.command || '') };
+}
+
+export function checkCodexPatterns(content) {
+  if (!content) return null;
+  for (const { message, pattern } of CODEX_BLOCK_PATTERNS) {
+    if (pattern.test(content)) return message;
+    pattern.lastIndex = 0;
+  }
+  return null;
+}
+
+export function checkSurfaceArea(paths, root = workspaceRoot()) {
+  for (const rel of paths) {
+    const normalized = rel.replace(/\\/g, '/');
+    const abs = path.isAbsolute(rel) ? rel : path.join(root, rel);
+    if (fs.existsSync(abs)) continue;
+    for (const { pattern, message } of SURFACE_DENY_PATTERNS) {
+      if (pattern.test(normalized)) return `${message} (blocked: ${normalized})`;
+    }
+  }
+  return null;
+}
+
+export function checkSubagentGate(toolName, features) {
+  if (!features.lead_dev_mode) return null;
+  if (!SUBAGENT_TOOLS.has(toolName)) return null;
+  if (hasFreshLeadDevPlan()) return null;
+  return (
+    'Codex 59/67: call xray-orchestrator analyze-complexity first — ' +
+    'writes .xray/state/lead-dev-plan.json required before spawn_subagent'
+  );
+}
+
+export function checkFullTestSuite(cmd, features) {
+  if (!features.per_suite_test_triage) return null;
+  const cmdText = cmd.toLowerCase();
+  const isFullTestSuite =
+    /\b(npm\s+(run\s+)?test|vitest\s+run|pnpm\s+test|yarn\s+test)\b/.test(cmdText) &&
+    !/--\s+\S+\.test/.test(cmdText) &&
+    !/vitest\s+run\s+\S+\.test/.test(cmdText);
+  if (!isFullTestSuite) return null;
+  return (
+    'Lead-dev test protocol: run individual test files first; ' +
+    'full suite only after per-suite passes (override with focused test path)'
+  );
+}
+
+export function isWriteTool(toolName) {
+  return WRITE_TOOLS.has(toolName) || /write|edit|replace/i.test(toolName);
+}
+
+export function isShellTool(toolName) {
+  return /terminal|bash|shell|run_terminal/i.test(toolName);
+}
+
+export async function readStdinJson() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const raw = Buffer.concat(chunks).toString('utf8').trim();
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+
+export function sessionBootPath(root = workspaceRoot()) {
+  return path.join(root, '.xray', 'state', 'session-boot.json');
+}
+
+export function buildSessionBootPayload(root, source = '0xray/grok-session-start', extra = {}) {
+  const features = loadFeatures();
+  const blockingTerms = loadBlockingCodexTerms();
+  return {
+    hook: source,
+    lead_dev_mode: features.lead_dev_mode,
+    no_new_surface: features.no_new_surface,
+    codexBlockingTermCount: blockingTerms.length,
+    codexTerms: [59, 67, 68, 69],
+    rules: features.lead_dev_mode ? LEAD_DEV_RULES : [],
+    mcpIntake: 'xray-orchestrator → analyze-complexity (required before spawn_subagent)',
+    enforcement: 'PreToolUse hook — codex patterns + surface area + spawn gate',
+    workspaceRoot: root,
+    sessionId: process.env.GROK_SESSION_ID || null,
+    timestamp: new Date().toISOString(),
+    source,
+    ...extra,
+  };
+}
+
+export function writeSessionBoot(root, payload) {
+  try {
+    const stateDir = path.join(root, '.xray', 'state');
+    fs.mkdirSync(stateDir, { recursive: true });
+    fs.writeFileSync(sessionBootPath(root), JSON.stringify(payload, null, 2));
+    return sessionBootPath(root);
+  } catch {
+    return null;
+  }
+}
+
+/** Boot on SessionStart, UserPromptSubmit, or first PreToolUse if missing. */
+export function ensureSessionBoot(root = workspaceRoot(), source = '0xray/grok-boot') {
+  const bootPath = sessionBootPath(root);
+  if (fs.existsSync(bootPath)) {
+    try {
+      const existing = JSON.parse(fs.readFileSync(bootPath, 'utf8'));
+      if (existing.lead_dev_mode !== undefined) return bootPath;
+    } catch {
+      /* rewrite corrupt boot */
+    }
+  }
+  return writeSessionBoot(root, buildSessionBootPayload(root, source));
+}

package/dist/integrations/grok/hooks/pre-tool-use.js

@@ -1,134 +1,104 @@
 #!/usr/bin/env node
 /**
- * Grok CLI PreToolUse Hook Handler for 0xRay — First Class Citizen
- *
- * Real governance enforcement hook.
- * When Grok is about to execute a tool (write_file, edit, terminal cmd, etc.),
- * this script is spawned and runs the Dynamo Solar SSOT decision matrix.
+ * Grok CLI PreToolUse — ironclad OS gate
+ * Contract: stdin JSON → stdout {"decision":"allow"} | {"decision":"deny","reason":"..."}
  */
 
-import fs from 'fs';
-import path from 'path';
+import {
+  checkCodexPatterns,
+  checkFullTestSuite,
+  checkSubagentGate,
+  checkSurfaceArea,
+  ensureSessionBoot,
+  isShellTool,
+  isWriteTool,
+  loadFeatures,
+  readStdinJson,
+  workspaceRoot,
+} from './grok-hook-utils.js';
+import { appendHookActivity } from './grok-hook-activity.js';
 
-const log = (msg) => { try { console.error(`[0xRay:GrokHook] ${msg}`); } catch { /* noop */ } };
+function finish(root, decision, reason, hint, toolName) {
+  const out = { decision };
+  if (reason) out.reason = reason;
+  if (hint) out.hint = hint;
+  console.log(JSON.stringify(out));
+  appendHookActivity(root, 'grok-pre-tool-use', decision, decision === 'deny' ? 'error' : 'info', {
+    tool: toolName,
+    reason: reason || hint || null,
+    livePath: true,
+  });
+  process.exit(0);
+}
 
-function findGovernanceCore() {
-  const here = path.dirname(new URL(import.meta.url).pathname);
+async function main() {
+  const root = workspaceRoot();
+  let toolName = 'unknown';
 
-  // Priority: explicit dev root
-  const devRoot = process.env.XRAY_ROOT;
-  if (devRoot) {
-    const devCandidate = path.resolve(devRoot, 'dist/governance/governance-core.js');
-    if (fs.existsSync(devCandidate)) return devCandidate;
-  }
+  try {
+    const event = await readStdinJson();
+    const eventRoot = event.workspaceRoot || event.cwd || root;
+    ensureSessionBoot(eventRoot, '0xray/grok-pre-tool-use-boot');
 
-  const candidates = [
-    // Published package layout
-    path.resolve(here, '../../../governance/governance-core.js'),
-    path.resolve(here, '../../../../governance/governance-core.js'),
-    // node_modules installed layout
-    path.resolve(process.cwd(), 'node_modules/0xray/dist/governance/governance-core.js'),
-    // Dev layout fallbacks (no extra dist/)
-    path.resolve(here, '../../../../../governance/governance-core.js'),
-    path.resolve(process.cwd(), 'dist/governance/governance-core.js'),
-    // Strong dev fallback: walk up looking for package.json
-    ...walkUpForCore(here),
-  ];
-
-  for (const c of candidates) {
-    if (fs.existsSync(c)) return c;
-  }
-  return null;
-}
+    const features = loadFeatures();
+    const ctx = extractFromEvent(event);
+    toolName = ctx.toolName;
+    const { paths, content, cmd } = ctx;
 
-function walkUpForCore(startDir, maxLevels = 8) {
-  const results = [];
-  let current = startDir;
-  for (let i = 0; i < maxLevels; i++) {
-    const pkgPath = path.resolve(current, 'package.json');
-    if (fs.existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-        if (pkg.name === '0xray') {
-          results.push(path.resolve(current, 'dist/governance/governance-core.js'));
-          results.push(path.resolve(current, 'governance/governance-core.js'));
-        }
-      } catch {}
+    const subagentBlock = checkSubagentGate(toolName, features);
+    if (subagentBlock) finish(eventRoot, 'deny', subagentBlock, null, toolName);
+
+    if (features.no_new_surface && isWriteTool(toolName) && paths.length) {
+      const surfaceBlock = checkSurfaceArea(paths, eventRoot);
+      if (surfaceBlock) finish(eventRoot, 'deny', surfaceBlock, null, toolName);
     }
-    const parent = path.dirname(current);
-    if (parent === current) break;
-    current = parent;
-  }
-  return results;
-}
 
-function deriveResonance(toolName, extra = '') {
-  const text = (toolName + ' ' + extra).toLowerCase();
-  let score = 0.85; // baseline good
-  const penalties = [
-    ['any', -0.25],
-    ['eval(', -0.35],
-    ['console.log', -0.15],
-    ['// @ts-ignore', -0.2],
-    ['require(', -0.1],
-  ];
-  for (const [pat, pen] of penalties) {
-    if (text.includes(pat)) score += pen;
-  }
-  return Math.max(0.1, Math.min(0.99, score));
-}
+    if (isWriteTool(toolName) && content) {
+      const codexBlock = checkCodexPatterns(content);
+      if (codexBlock) finish(eventRoot, 'deny', codexBlock, null, toolName);
+    }
 
-async function main() {
-  try {
-    const toolName = process.env.TOOL_NAME || process.env.HOOK_TOOL || 'unknown_tool';
-    const cwd = process.env.PWD || process.cwd();
-    const extraContext = process.env.HOOK_ARGS || process.env.TOOL_ARGS || '';
-
-    log(`PreToolUse: ${toolName}`);
-
-    const corePath = findGovernanceCore();
-    let recommendation = 'ALLOW';
-    let resonance = deriveResonance(toolName, extraContext);
-    let govDetails = null;
-
-    if (corePath) {
-      try {
-        const core = await import(`file://${corePath}`);
-        if (typeof core.applyDecisionMatrix === 'function') {
-          const result = core.applyDecisionMatrix({
-            resonance,
-            isotopicRatio: resonance > 0.8 ? 0.96 : 0.7,
-            vortexVolume: 1_000_000,
-            historicalCoherence: 0.82,
-            solarActivity: 'active',
-          });
-          govDetails = result;
-          recommendation = result.recommendation || 'NEEDS_REVISION';
-          log(`Solar decision: ${recommendation} (resonance=${resonance.toFixed(2)})`);
-        }
-      } catch (e) {
-        log(`Governance core error: ${e.message}`);
-      }
-    } else {
-      log('Governance core not located — using safe default');
+    if (isShellTool(toolName) && cmd) {
+      const destructive =
+        /\brm\s+-rf\s+\/\b|\bmkfs\b|\bdd\s+if=|:()\s*\{\s*:\|&\s*\}\s*;:/i.test(cmd);
+      if (destructive) finish(eventRoot, 'deny', 'Blocked destructive shell command', null, toolName);
+
+      const testHint = checkFullTestSuite(cmd, features);
+      if (testHint) finish(eventRoot, 'allow', null, testHint, toolName);
     }
 
-    const decision = {
-      tool: toolName,
-      decision: recommendation === 'PASS' ? 'allow' : 'allow_with_governance_note',
-      resonance: Number(resonance.toFixed(3)),
-      solar_recommendation: recommendation,
-      gov: govDetails,
-      timestamp: new Date().toISOString(),
-      source: '0xray/grok-pre-tool-use',
-    };
-
-    console.log(JSON.stringify(decision));
-    process.exit(0); // non-blocking rollout; future versions can exit(1) on strong reject
+    finish(eventRoot, 'allow', null, null, toolName);
   } catch (err) {
-    log(`Hook failure (non-fatal): ${err.message}`);
-    process.exit(0);
+    appendHookActivity(root, 'grok-pre-tool-use', 'hook-error', 'error', {
+      tool: toolName,
+      error: err.message,
+    });
+    finish(root, 'allow', null, null, toolName);
   }
 }
 
+function extractFromEvent(event) {
+  const toolName = event.toolName || process.env.TOOL_NAME || 'unknown';
+  const toolInput = event.toolInput ?? {};
+  const paths = [];
+  let content = '';
+
+  if (toolInput.path) paths.push(String(toolInput.path));
+  if (toolInput.file_path) paths.push(String(toolInput.file_path));
+  if (toolInput.target_notebook) paths.push(String(toolInput.target_notebook));
+  if (Array.isArray(toolInput.paths)) paths.push(...toolInput.paths.map(String));
+
+  if (toolInput.new_string) content += String(toolInput.new_string);
+  if (toolInput.contents) content += String(toolInput.contents);
+  if (toolInput.command) content += String(toolInput.command);
+  if (toolInput.prompt) content += String(toolInput.prompt);
+
+  return {
+    toolName,
+    paths,
+    content,
+    cmd: String(toolInput.command || ''),
+  };
+}
+
 main();