@agentpulselabs/cli-plugin-pulse 0.2.0 → 1.1.2

package/README.md

@@ -1,48 +1,131 @@
-# @agentpulselabs/cli-plugin-pulse
+# Pulse connector plugin
 
-An [oclif](https://oclif.io) plugin that adds the **`pulse`** topic — a portable, contract-enforced build
-discipline — to the `agentpulse` CLI. It is a thin `argv → core → stdout` seam over
-[`@agentpulselabs/pulse`](https://github.com/ashishcloud/agentpulse-pulse); all discipline lives in the core.
+`@agentpulselabs/cli-plugin-pulse` contributes the `agentpulse pulse` command group.
 
-> **Published to public npm** under the `@agentpulselabs` org (`publishConfig.access: "public"`). The CLI
-> (`@agentpulselabs/cli`) supports plugins via `@oclif/plugin-plugins`; this plugin installs through it.
+Commands:
 
-## Install
+```text
+agentpulse pulse install
+agentpulse pulse pair [--org <slug>] [--platform <url>] --root <rootId>=<path>
+agentpulse pulse login [--platform <url>]
+agentpulse pulse start
+agentpulse pulse status
+agentpulse pulse doctor
+agentpulse pulse stop
+agentpulse pulse restart
+agentpulse pulse mirror on|off|status
+agentpulse pulse hub-write on|off|status
+```
+
+## Replaces the deprecated build-discipline Pulse plugin
+
+Version 1.0.0 takes over the package name and the `pulse` topic from the deprecated build-discipline plugin (`@agentpulselabs/cli-plugin-pulse` 0.2.0, with `pulse gate|next|start|status|submit|verify`). Those commands are gone. The connector was previously developed as `@agentpulselabs/cli-plugin-hub`.
+
+Remove the old plugin first for a clean replace, then install or link the connector. Always use the full scoped name; a bare `pulse` resolves to an unrelated npm package.
 
 ```bash
-npm i -g @agentpulselabs/cli                              # the CLI (if not already installed)
-agentpulse plugins install @agentpulselabs/cli-plugin-pulse
-agentpulse pulse --help
+agentpulse plugins uninstall @agentpulselabs/cli-plugin-pulse
+agentpulse plugins install @agentpulselabs/cli-plugin-pulse   # once published
+agentpulse plugins link <path-to-this-repo>                   # local development instead of install
 ```
 
-This is the **user-installed** integration path (design decision): opt-in, decoupled release cadence, and the
-same mechanism any third party uses to add `agentpulse` commands.
+`agentpulse plugins update` does not move you to 1.0.0, because the old install is pinned to `0.2.0`; run `plugins install` explicitly. After `plugins unlink`, no `pulse` plugin is left, so install it again.
 
-## Commands
+A machine paired before the rename keeps its pairing, sign-in and state: the Keychain items, the `~/.config/agentpulse/hub` directory, the service label and the wire identifiers did not change. The installed launchd or systemd service still holds the absolute paths of the old install, though. If the daemon path changed, or the node binary it names was removed (for example by a node upgrade), `agentpulse pulse status`, `agentpulse pulse doctor` and `agentpulse pulse start` report `HUB_SERVICE_PATH_STALE`. Run `agentpulse pulse install` once, then `agentpulse pulse start`.
 
-| Command | What it does |
-|---|---|
-| `agentpulse pulse start --requirements "…" --name <name>` | Begin an engagement in the current repo (`.pulse/`). |
-| `agentpulse pulse next` | Emit the current phase work-list (prompts + JSON schema; contract injected). |
-| `agentpulse pulse submit --results-file r.json` | Validate your model's structured results vs schema + contract. |
-| `agentpulse pulse gate --approved [--decisions-file d.json]` | The human gate — advance the phase; lock product decisions. |
-| `agentpulse pulse verify` | Run the contract's gate command (`npm run check`); exits non-zero if red. |
-| `agentpulse pulse status` | Phase, contract, board progress. |
+## How it works
 
-The MCP server (`pulse-mcp`, shipped by `@agentpulselabs/pulse`) is the primary seam for interactive agents
-(Cursor/Codex/Claude). This CLI plugin is the universal shell fallback: same core, same `.pulse/` state.
+The plugin manages a separate launchd (macOS) or systemd-user (Linux) companion. The oclif command process is never the daemon. Local configuration and state are owner-only. The OAuth tokens and the local Ed25519 key live only in Keychain or libsecret; if neither is available the connector fails closed.
 
-## Architecture
+Authentication is the platform's OAuth (Phase 1). `agentpulse pulse pair` and `agentpulse pulse login` run the same browser PKCE flow as `agentpulse login` (public client `agentpulse-cli`, loopback `127.0.0.1`), but keep their own token store and never write the CLI's `config.json`. The CLI config is only read for the default platform URL and dev-org slug.
 
-```
-argv → src/commands/pulse/<verb>.js  (thin oclif Command, parses flags)
-          → src/runPulse.js           (pure: verb → engine method; no oclif, testable)
-             → @agentpulselabs/pulse       (the brain: state machine + contract + validator + gates)
-                → .pulse/ in the repo  (durable, git-tracked truth)
-```
+Pairing resolves the dev-org through `/api/team/dev-orgs`, mints a dev-org token through `/api/team/dev-orgs/:id/cli-token`, and registers the machine with `POST /api/agent-hub/user/machines` and a frozen least-authority grant. Every connector request carries `Authorization: Bearer`, `X-Serverless-Authorization` on Cloud Run dev-orgs, and the machine, session and policy-version headers.
+
+If the platform can't be reached to refresh the sign-in, the daemon reports `reconnecting`, claims nothing and retries with backoff. When a refresh is refused (`invalid_grant`), it stops claiming work and `agentpulse pulse status` prints the commands to run. Today that refusal is expected about every 12 hours, until the platform fixes refresh for the `agentpulse-cli` client. A revoked machine stops for good; signing in again never revives it. The Ed25519 identity is kept locally for Phase 2 (DPoP) and is not used for authentication.
+
+The daemon restarts itself by exiting with code 75; launchd (`KeepAlive.SuccessfulExit=false`) and systemd (`Restart=on-failure`) start it again. It does so when any file under its own `src/` (data files such as `mirror-contract.json` included, dotfiles not) or its `package.json` changes (2 s after the last write, and only if the contents differ), when `restart.request` appears in its config directory, or when the cycle or a mirror pass makes no progress for 3 minutes (`cycle_stalled` in `daemon-error.log`). A code or request restart drains first: it claims no new job, lets running jobs finish and settle (health shows `restarting` with the job ids), and only aborts them, as `HUB_DAEMON_RESTARTING`, after 15 minutes. A stall aborts at once. A request older than the running process is dropped, since the restart it asked for already happened. `agentpulse pulse restart` writes that file and waits up to 60 s for a new process, so it needs no `launchctl` or `systemctl`; it refuses when the daemon has no fresh heartbeat. After more than 5 restarts in 5 minutes the daemon stays up instead, `agentpulse pulse status` reports `restart_loop`, and a pending restart is deferred until the window clears. `pulse stop` and SIGTERM always win and exit 0.
+
+The connector accepts only registered intents:
+
+- `workspace.read` and `workspace.write`
+- `git.read` and `git.write`
+- `worktree.create`
+- `agent.cursor.invoke` and `agent.claude.invoke`
+- `hub.write`, only after `agentpulse pulse hub-write on`
+
+It does not accept shell commands, absolute cloud paths, package installation, secret reads, permission changes, push, release, production actions, or remote grant expansion.
+
+## Acting on the local Agent Hub from Pulse
+
+`agentpulse pulse hub-write on` lets Pulse post to the local Agent Hub as you: a chat message, a NUDGE or STATUS? to agents, a decision or change request on a stream, accepting a delivery, or a reply to a bus ask. It is off on a new pairing. `on` and `off` replace this machine's cloud grant with `hub.write` added or removed (nothing else changes) and store the new policy version in the daemon config; the daemon adopts it on its next heartbeat. `status` reads the grant from Pulse.
+
+Each action arrives as a typed `hub.*` job and becomes exactly one POST to the hub on `127.0.0.1` with the hub token, as the principal `user`, to `/api/chat/post`, `/api/message`, `/api/decision`, `/api/accept` or `/bus/ack`, and nothing else. If the hub may have taken a write whose result was never recorded (the daemon stopped mid-request, or the hub did not answer), the action ends as `hub_write_unconfirmed` instead of being sent twice; check the hub before sending it again. A hub that is not running gives `hub_unreachable`; a write the hub rejects gives `hub_refused` with its reason.
+
+## Mirroring the local Agent Hub
+
+`agentpulse pulse mirror on` lets the paired daemon mirror your local Agent Hub into Pulse, so its deliveries, streams, agents, graph, chat (task, project, one-to-one and bus threads), inbox and Cursor rule packs show there read-only. It is off on a new install. `on` and `off` change only `mirror.localHub` in the daemon config, and the daemon picks the change up within a heartbeat. `off` stops pushing; items already mirrored stay in Pulse. `status` shows the last sync, how many items are mirrored, and how many were not mirrored, by kind and reason.
+
+The mirror needs the `agent-hub:connector:mirror` scope. A sign-in from before this version lacks it; run `agentpulse pulse login` once.
+
+How it reads and what it sends:
+
+- It finds the hub from the `com.agentpulse.agents-hub` launch agent (or `mirror.hub.dir` and `mirror.hub.port` in the daemon config) and only sends GETs to an allow-list of endpoints on `127.0.0.1`, with the hub's `state/hub.token`. It never writes to the hub, never runs `hub.mjs`, and never opens `state/` files other than the token.
+- It follows the hub's `/api/stream` feed, re-reads only the affected endpoints about 300 ms after a change, runs a full reconcile 60 seconds after the last one ended, and reconnects with backoff.
+- The four graph windows (which also carry edges and bus messages) are the hub's slowest read. After a change they are re-read in a pass of their own, at most once every 3 seconds counted from the end of the last one. The hub announces each of the connector's own graph reads as a change, so a hub change that arrives during one of those reads or within 1.5 seconds after it is most likely an echo, so it re-reads the windows only after 10 seconds; any other change brings the 3 second gap back. Task briefs follow in the next pass, four at a time and for at most 3 seconds. `agentpulse pulse mirror status` shows how long the last pass took.
+- Only new or changed items are sent, in batches of at most 500 items and 2 MiB. Items that disappear are deleted in Pulse on the full reconcile, and only for sources that were read completely.
+- Absolute paths are rewritten before upload: paths in a known repo become repo-relative, workspace and home paths lose their prefix, and any other path keeps only its last segment. A home folder never shows its user name. An item that still carries a path, a token-looking string or the hub token is withheld and counted, never sent.
+- Rule packs include only `*.mdc` under `.cursor/rules/`, plus `AGENTS.md` and `CLAUDE.md`, from the workspace, each repo and your user folder. Files named like `.env*`, `*secret*` or `*token*`, symlinks that leave the pack, and oversized files are skipped.
+- Transcripts, diffs, raw provider output, the hub token, Keychain and OAuth material are never read for the mirror or sent.
+
+## Import and shadow into the Pulse log (cloud-first preview)
+
+These need your team's Pulse cloud-first flag on, set by a team owner or admin, and Node 24 or later.
+
+- `agentpulse pulse import --dry-run` reads the local Agent Hub without changing anything and prints, for each source, the rows it read and what it would send, skip or refuse.
+- `agentpulse pulse import` snapshots the hub's sources (`hub.db`, personas, chat files and every channel file) into the connector's folder, then brings the snapshot into the Pulse log. `--reuse-snapshot` imports the same snapshot again, which writes nothing new. A later `pulse import` takes a new snapshot and sends only what changed since, so the final catch-up at cutover is an import, not the shadow tail.
+- `agentpulse pulse import --reconcile` rescans the last snapshot from scratch and compares it with what Pulse holds for this machine: every channel's posts, every conversation's messages and receipts, actors, personas, agent rows and facts, by count and hash, plus every withheld or cut item by key. Each differing channel or conversation is classified. `retired` means a channel whose `channel.md` is gone from disk under every root. `redacted` means Pulse holds the same text redacted with a root deleted since; a rescan with that root must give exactly Pulse's hash, and the root is then kept. `drift`, `missing` and `unexplained` are mismatches. It exits 1 on any mismatch, never sends anything, and keeps the report, with the counts per class, in `reconcile-last.json`. `pulse cutover` records the classes, the retired channels and the redacted items in `cutover.json`.
+- `agentpulse pulse shadow on` makes the daemon tail the live hub into the log after an import. It is meant for cutover only.
+- `agentpulse pulse parity` shows how the Pulse log and this machine's mirror agree while the shadow runs. `--now` asks the daemon for a fresh check.
+
+Everything sent goes through the same secret and path filter as the mirror, and the cloud filters it again.
+
+## Bus identity and delivery states (1.1.1)
+
+After cutover the runner hosts the bus, and `hub.mjs bus` works as before with these additions:
+
+- **One identity per session.** A session's bus address is its Cursor conversation id, which for a subagent is its Task agent id. `bus register --as <nickname>`, run as a Shell command inside the session, binds the nickname to it, and the hook says whether the binding took. Mail to the nickname then reaches that session.
+- **Delivery states.** `bus publish` and `bus ask` add `delivery` (`queued` or `undeliverable`, and why) and print one stderr line for each recipient nobody can read. `bus status --id m-…` shows each recipient as `undeliverable`, `queued`, `delivered`, `read`, `skipped`, `acked` or `expired`.
+  - `read` means a step of the recipient's session ran after the message was shown, or the manager recorded a DONE or STATUS.
+  - `acked` comes only from `bus ack`, `bus reply`, a captured answer to your message, or a manager answer.
+- **`bus who`** lists active sessions by default; `--all` lists history.
+
+**Known limits:**
+
+- A binding is recorded on the machine whose hook saw the register. Other machines learn that the alias is live from presence within about 30 seconds (beats are coalesced), and then report it `queued`. A send from another machine inside that window is reported `undeliverable`, though it is still queued and delivered. From 1.1.2 it is refused as unknown instead (see below).
+- A `bus register` chained to a failing command binds only if `~/.cursor/hooks.json` sends `postToolUseFailure` to the hub hook; `pulse doctor` says which events are missing.
+- `bus listen`, `bus ack` and `bus reply` send the Cursor session they run in (`CURSOR_CONVERSATION_ID`).
+  - The session holding an alias acts for its whole inbox, whether it names itself or the alias.
+  - Another Cursor session is refused on an alias a live session holds ("held by S", exit 2), before anything is claimed.
+  - A command run outside Cursor sends no session. It gets the mail sent literally to the address it names, as before 1.1.1, and never the holder's own mail.
+- **Threat model.** The session field guards agents against each other's mistakes: a subagent listening as a nickname it shouldn't, or a stale script left running. It is not a security boundary. Any local process that can read `state/hub.token` can set the field, or do anything else the hub allows, exactly as before 1.1.1.
+- The binding parser matches only `node <path>/hub.mjs bus register|listen … --as X`, with the path written out. A command such as `node "$HUB" …` does not bind.
+
+**Release note:** from this version the plugin needs **Node 24 or later**: `runner.db` and the read-only `hub.db` reader use `node:sqlite`, and on Node 22 and older `fetch` can lose an abort on a long-lived stream. On older Node, `agentpulse pulse start`, `agentpulse pulse doctor` and the daemon refuse with a clear message.
+
+## Delivery discipline checks (1.1.2)
+
+The runner checks the delivery-discipline rules itself, from the Cursor hook and the manager lease holder's sweep:
+
+- **Unknown addresses (E1).** Mail to an `agent/<x>` that is neither a known session nor a bound alias is refused (`E_UNKNOWN_ADDRESS`, exit 2), with the closest addresses. Known means: a session a hook has shown (here or on another machine), a bound alias, an address that has listened, or a session or Task id (UUID-shaped) that ran `bus register` itself. That last case takes no proof, so a Task id can be mailed as soon as it registers. A nickname nobody bound is refused. Mail to an address idle more than 2 h is kept, and the sender sees `undeliverable: <x> offline since <t>`.
+- **Channels (E2, E3, E4).** Which posts a session wrote is learned from its own tool calls: the channel they name and the header lines they write. A session that ends with a non-terminal newest post gets an automatic `STOPPED`. A channel whose newest post isn't terminal gets `STATUS?` to its owner at 30 minutes, and one escalation to its architect and to you at 60 minutes. A header stamped more than 5 minutes ahead of the clock is flagged to its writer and on the Board.
+- **Subagents (E5).** A Task launch in this workspace is denied unless its brief names a `.agents/<task>/channel.md` with a KICKOFF. Read-only subagents (`explore` and the like, or `readonly: true`) and resumes are exempt.
+- **Permission prompts (E6).** A Shell call with `required_permissions` posts a BLOCKER to its session's channel and to you, and the call's end clears it. It fires on every such call, including ones Cursor approves on its own.
+
+**Known limits:** another machine learns of an alias bound here only from presence, within about 30 seconds (beats are coalesced). Until then it doesn't know the alias at all and refuses a send to it with `E_UNKNOWN_ADDRESS` (1.1.1 queued it as undeliverable); a retry after that window goes through. A subagent's end reaches its parent as `subagentStop`, which carries no subagent id, so E2 covers subagents only through E3's 30- and 60-minute checks. Whether Cursor sends `required_permissions` in `preToolUse`, before its prompt, is unverified live; the runner records each event's field names in `state/hook-shapes.jsonl`.
 
-## Test
+## Local checks
 
 ```bash
-node --test "test/**/*.test.js"   # exercises runPulse over a real .pulse/, no @oclif/core needed
+npm test
+npm run check
 ```

package/package.json

@@ -1,20 +1,10 @@
 {
   "name": "@agentpulselabs/cli-plugin-pulse",
-  "version": "0.2.0",
-  "description": "oclif plugin that adds the `pulse` topic (portable, contract-enforced build discipline) to the agentpulse CLI. User-installed: `agentpulse plugins install @agentpulselabs/cli-plugin-pulse`. A thin argv→core seam over @agentpulselabs/pulse.",
+  "version": "1.1.2",
+  "description": "AgentPulse CLI plugin for installing and operating the Pulse local connector (replaces the deprecated build-discipline Pulse plugin).",
   "type": "module",
   "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ashishcloud/agentpulse-cli-plugin-pulse.git"
-  },
-  "homepage": "https://github.com/ashishcloud/agentpulse-cli-plugin-pulse#readme",
-  "bugs": {
-    "url": "https://github.com/ashishcloud/agentpulse-cli-plugin-pulse/issues"
-  },
+  "private": false,
   "files": [
     "src",
     "README.md"
@@ -24,26 +14,31 @@
     "topicSeparator": " ",
     "topics": {
       "pulse": {
-        "description": "Run a contract-enforced build discipline engagement (Discovery → Stories → Architecture → Build → Deliver)."
+        "description": "Install, pair, and operate the Pulse local connector."
       }
     }
   },
   "scripts": {
-    "test": "node --test \"test/**/*.test.js\""
+    "test": "node --import ./test/support/register-loader.mjs --test \"test/*.test.js\" \"test/hub/*.test.js\"",
+    "contract:check": "node scripts/sync-contract.mjs --local",
+    "check": "node --check src/commands/pulse/install.js && node --check src/commands/pulse/pair.js && node --check src/commands/pulse/login.js && node --check src/commands/pulse/start.js && node --check src/commands/pulse/status.js && node --check src/commands/pulse/doctor.js && node --check src/commands/pulse/stop.js && node --check src/commands/pulse/restart.js && node --check src/lib/selfRestart.js && node --check src/lib/subprocess.js && node --check src/lib/daemonProcess.js && node --check src/commands/pulse/mirror.js && node --check src/commands/pulse/hub-write.js && node --check src/lib/localHubWriter.js && node --check src/lib/hubActions.js && node --check src/lib/localHub.js && node --check src/lib/pathRedaction.js && node --check src/lib/rulePacks.js && node --check src/lib/mirrorContract.js && node --check src/lib/graphWindows.js && node --check src/lib/mirrorSource.js && node --check src/lib/mirrorSync.js && node --check src/lib/mirrorService.js && node --check src/lib/mirrorDaemon.js && node --check src/lib/daemonComposition.js && node --check src/lib/daemonRuntime.js && node --check src/lib/daemonLoop.js && node --check src/daemon/main.js && node --check src/lib/sqlite.js && node --check src/lib/nodeFloor.js && node --check src/lib/runnerStore.js && node --check src/lib/hubDbReader.js && node --check src/lib/channelScanner.js && node --check src/lib/uploadRedactor.js && node --check src/lib/hubScan.js && node --check src/lib/outboxFlusher.js && node --check src/lib/hubSnapshot.js && node --check src/lib/reconcileView.js && node --check src/lib/reconcile.js && node --check src/lib/shadowService.js && node --check src/lib/cloudFirstCommands.js && node --check src/commands/pulse/import.js && node --check src/commands/pulse/shadow.js && node --check src/commands/pulse/parity.js && node --check src/runner/main.js && node --check src/runner/runnerProcess.js && node --check src/runner/facade.js && node --check src/runner/bridge.js && node --check src/runner/runnerChild.js && node --check src/runner/applier.js && node --check src/runner/capture.js && node --check src/runner/hubCapture.js && node --check src/clients/hub.mjs && node --check src/clients/hub-bridge.mjs && node --check src/runner/busIdentity.js && node --check src/runner/deliveryStates.js && node --check src/lib/doctorWarnings.js && node --check src/hub/lib/closure.mjs && node --check src/runner/channelDiscipline.js",
+    "test:t2": "node --import ./test/support/register-loader.mjs --test --test-timeout=120000 \"test/t2/*.test.js\"",
+    "test:t3": "node --import ./test/support/register-loader.mjs --test --test-concurrency=1 --test-timeout=240000 \"test/t3/*.test.js\""
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "keywords": [
     "oclif-plugin",
     "agentpulse",
     "pulse",
+    "agent-hub",
     "cli"
   ],
-  "dependencies": {
-    "@agentpulselabs/pulse": "^0.1.0"
-  },
   "peerDependencies": {
     "@oclif/core": ">=3"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }

package/src/clients/hub-bridge.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+/**
+ * The Pulse runner's thin Cursor hook: forwards the hook input, cut to the fields the runner reads, to the runner on
+ * 127.0.0.1 (`POST /hook`, where handleHook runs unchanged) and prints its answer. It opens no database.
+ * Always fails open: any problem prints {} within 3.5 s, so the chat is never blocked.
+ */
+import fs from 'node:fs';
+
+const PULSE = /*PULSE_CLIENT_CONFIG*/ null;
+const config = PULSE || JSON.parse(process.env.PULSE_CLIENT_CONFIG || 'null');
+
+/**
+ * Hard stop, armed before anything else and counted from process start: well under Cursor's 5 s hook timeout even if
+ * stdin never closes and the runner is silent. The runner gives up on a hook after 1.5 s and rolls back, inside this
+ * client's 2 s call, so it never commits a delivery this client didn't see.
+ */
+const HARD_EXIT_MS = 2500;
+const STDIN_MS = 1000;
+const CALL_MS = 2000;
+
+let finished = false;
+const done = (o = {}) => {
+  if (finished) return;
+  finished = true;
+  process.stdout.write(JSON.stringify(o));
+  process.exit(0);
+};
+setTimeout(() => done(), Math.max(0, HARD_EXIT_MS - performance.now())).unref();
+
+/** The fields the runner reads, and the size each may take; a tool's output never goes (it can pass the runner's 64 KB cap). */
+const FIELDS = { hook_event_name: 100, conversation_id: 200, tool_name: 200, text: 32_000, status: 100, tool_use_id: 200, cwd: 1000, reason: 40 };
+const COMMAND_MAX = 4000;
+/** Pulse 1.1.2: a Task brief (E5), a Shell call's permissions and folder (E6), and its other short fields. */
+const TOOL_FIELDS = { prompt: 16_000, description: 1000, resume: 200, subagent_type: 60, cwd: 1000, working_directory: 1000 };
+const HEADER = /^## \[[A-Z][A-Z0-9 -]*\] \S+ /;
+const CHANNEL_LINE = /\.agents\/[A-Za-z0-9._-]+/;
+
+/**
+ * E2, E4: the post headers a call wrote and the lines naming the channel folder it wrote them to, from any string the
+ * tool took (a Shell heredoc, a Write's contents, a StrReplace's new text, a path). Only when something names channel.md.
+ */
+function channelWrites(tool) {
+  const texts = Object.values(tool).filter((v) => typeof v === 'string');
+  if (!texts.some((t) => t.includes('channel.md'))) return {};
+  const lines = texts.flatMap((t) => t.split('\n'));
+  const headers = lines.filter((l) => HEADER.test(l.trim())).slice(0, 20).map((l) => l.trim().slice(0, 300));
+  const channels = lines.filter((l) => CHANNEL_LINE.test(l)).slice(0, 10).map((l) => l.slice(0, 600));
+  return headers.length && channels.length ? { headers, channels } : {};
+}
+
+/** The hook input cut to what the runner uses: handleHook's fields, a Shell command (for bus binding), and key names only. */
+function trimmed(input) {
+  const out = {};
+  for (const [key, max] of Object.entries(FIELDS)) if (typeof input[key] === 'string') out[key] = input[key].slice(0, max);
+  if (!out.conversation_id && typeof input.session_id === 'string') out.conversation_id = input.session_id.slice(0, 200);
+  if (Number.isFinite(input.loop_count)) out.loop_count = input.loop_count;
+  if (Array.isArray(input.workspace_roots)) out.workspace_roots = input.workspace_roots.filter((r) => typeof r === 'string').slice(0, 20).map((r) => r.slice(0, 1000));
+  const tool = input.tool_input && typeof input.tool_input === 'object' && !Array.isArray(input.tool_input) ? input.tool_input : null;
+  if (tool) {
+    const kept = {};
+    if (typeof tool.command === 'string') kept.command = tool.command.slice(0, COMMAND_MAX);
+    for (const [key, max] of Object.entries(TOOL_FIELDS)) if (typeof tool[key] === 'string') kept[key] = tool[key].slice(0, max);
+    if (typeof tool.readonly === 'boolean') kept.readonly = tool.readonly;
+    if (Array.isArray(tool.required_permissions)) kept.required_permissions = tool.required_permissions.filter((p) => typeof p === 'string').slice(0, 10).map((p) => p.slice(0, 40));
+    Object.assign(kept, channelWrites(tool));
+    if (Object.keys(kept).length) out.tool_input = kept;
+  }
+  out._keys = { input: Object.keys(input).slice(0, 50), ...(tool ? { tool_input: Object.keys(tool).slice(0, 50) } : {}) };
+  return out;
+}
+
+async function forward(raw) {
+  let input;
+  try { input = JSON.parse(raw || '{}'); } catch { return {}; }
+  if (!input || typeof input !== 'object' || Array.isArray(input) || !config || config.offline) return {};
+  const token = fs.readFileSync(config.tokenFile, 'utf8').trim();
+  const res = await fetch(`http://127.0.0.1:${config.port}/hook`, {
+    method: 'POST',
+    headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+    body: JSON.stringify(trimmed(input)),
+    signal: AbortSignal.timeout(CALL_MS),
+  });
+  if (res.status !== 200) return {};
+  const answer = JSON.parse(await res.text());
+  return answer && typeof answer === 'object' && !Array.isArray(answer) ? answer : {};
+}
+
+let raw = '';
+let sent = false;
+const read = () => {
+  if (sent) return;
+  sent = true;
+  forward(raw).then(done, () => done());
+};
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (c) => { raw += c; });
+process.stdin.on('end', read);
+process.stdin.on('error', () => done());
+setTimeout(() => { process.stdin.pause(); read(); }, STDIN_MS).unref();