@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/hooks/lean-ctx/handler.ts

@@ -0,0 +1,22 @@
+/**
+ * `main.ts`-facing entry point for the `lean-ctx` hook kind's
+ * `pre-tool-use` / `post-tool-use` subcommands.
+ *
+ * Thin wiring only, mirroring `../briefing/handler.ts` and `../crg/handler.ts`:
+ * the actual logic lives in `./index.ts`, built against an injectable
+ * `Runner` so it can be unit-tested without a real `lean-ctx` binary. This
+ * file wires that logic to the production, timeout-enforcing `bunRunner`.
+ *
+ * `main.ts` never routes a `subcommand: 'mcp'` invocation here — see
+ * `../../lean-ctx/mcp.ts`'s header for why that subcommand is dispatched
+ * entirely separately, before `main.ts`'s standard JSON-payload flow.
+ */
+
+import type { HookInvocation, HookResult } from '../contract.ts'
+import { bunRunner, createLeanCtxHandler } from './index.ts'
+
+const leanCtxHandler = createLeanCtxHandler({ run: bunRunner })
+
+export async function handleLeanCtx(inv: HookInvocation): Promise<HookResult> {
+  return leanCtxHandler(inv)
+}

package/packages/agent-hooks/src/hooks/lean-ctx/index.ts

@@ -0,0 +1,173 @@
+/**
+ * The `lean-ctx` hook kind's `pre-tool-use` / `post-tool-use` subcommands:
+ * `adl hook lean-ctx pre-tool-use --host=X` / `post-tool-use --host=X`
+ * (work item A.2). The `mcp` subcommand is NOT handled here — it is a true
+ * stdio-passthrough, long-running MCP server, dispatched straight out of
+ * `main.ts` (see `../../lean-ctx/mcp.ts`) before the standard
+ * read-stdin-as-one-JSON-payload / `HookHandler` machinery this file uses
+ * ever runs.
+ *
+ * Gating (managed repo + `[hooks] enabled`, silent no-op otherwise) is
+ * `main.ts`'s job, identical to every other kind — see its header. This
+ * handler only has to:
+ *
+ *  1. Read the invoking tool's name out of the payload (the same field every
+ *     host spells `tool_name` for a PreToolUse/PostToolUse call — see
+ *     `../../pre-tool-use/handler.ts`'s `toDecideInput` for the reference
+ *     this mirrors).
+ *  2. Map (host, direction, tool name) to a `lean-ctx hook <subcommand>` via
+ *     `./mapping.ts`. No match (kimi/opencode always; any host+tool this
+ *     task's mapping table does not name) is a SILENT no-op — exit 0, empty
+ *     stdout/stderr, no `lean-ctx` spawn at all.
+ *  3. Spawn `lean-ctx hook <subcommand>` with the payload JSON on stdin and
+ *     the shared `LEAN_CTX_*` env (`../../lean-ctx/env.ts`), and relay its
+ *     stdout/stderr/exit code VERBATIM — lean-ctx speaks each host's own
+ *     hook protocol (deny/rewrite/redirect envelopes) itself, so this must
+ *     not reinterpret or reshape what it returns.
+ *
+ * Two exceptions to "relay verbatim":
+ *
+ *  - A hung or missing `lean-ctx` (`status: null` — see `Runner`'s doc) must
+ *    never block the calling host's tool-call loop, so that degrades to exit 0
+ *    with a stderr note instead of whatever `lean-ctx` would have returned had
+ *    it run — same fail-open shape `../briefing/index.ts` and
+ *    `../crg/index.ts` already use for their own subprocess calls.
+ *  - A `rewrite` envelope's REPLACEMENT command is re-scoped by
+ *    `./scope-rewrite.ts` (G1). lean-ctx rewrites the host's command into one
+ *    that re-execs lean-ctx by absolute path, and the host runs that in the
+ *    HOST's env — which carries none of the four `LEAN_CTX_*` dir vars set for
+ *    the child above, so the process that actually ENFORCES silently falls back
+ *    to built-in defaults instead of the repo's `config.toml`. Prefixing the
+ *    four assignments onto that command is the narrowest place to fix it: the
+ *    envelope's shape, decision and every other field are untouched, and any
+ *    non-rewrite output is returned as the identical string.
+ */
+
+import type { HookHandler, HookInvocation, HookResult } from '../contract.ts'
+import { leanCtxEnvFor } from '../../lean-ctx/env.ts'
+import { spawnWithTimeout } from '../../lib/spawn-with-timeout.ts'
+import { leanCtxSubcommand, type LeanCtxDirection } from './mapping.ts'
+import { scopeRewrittenCommand, sessionIdentityOf } from './scope-rewrite.ts'
+
+export interface RunResult {
+  readonly status: number | null
+  readonly stdout: string
+  readonly stderr: string
+  /** `true` only when the spawn was killed for exceeding `timeoutMs`. */
+  readonly timedOut?: boolean
+}
+
+export interface RunOptions {
+  readonly cwd: string
+  readonly env: Readonly<Record<string, string | undefined>>
+  readonly input?: string
+  readonly timeoutMs?: number
+}
+
+/** Process spawning, injected so tests never need a real `lean-ctx` binary. */
+export type Runner = (cmd: string, args: readonly string[], opts: RunOptions) => Promise<RunResult>
+
+const BIN = 'lean-ctx'
+
+/**
+ * lean-ctx's own PreToolUse/PostToolUse hook subcommands (rewrite, redirect,
+ * deny, read-dedup, codex-pretooluse) are simple synchronous lookups/string
+ * transforms in the real binary — generous, but well under the host's own
+ * tool-call timeout, matching `../crg/index.ts`'s reasoning for its own
+ * default.
+ */
+const DEFAULT_TIMEOUT_MS = 10_000
+
+/** The tool-name field every host's PreToolUse/PostToolUse payload carries — see `../../pre-tool-use/handler.ts`'s `toDecideInput`. */
+function toolNameOf(payload: Record<string, unknown>): string | null {
+  const name = payload.tool_name
+  return typeof name === 'string' && name.length > 0 ? name : null
+}
+
+function directionOf(subcommand: string | undefined): LeanCtxDirection | null {
+  if (subcommand === 'pre-tool-use') return 'pre'
+  if (subcommand === 'post-tool-use') return 'post'
+  return null
+}
+
+function silentNoop(): HookResult {
+  return { stdout: '', stderr: '', exitCode: 0 }
+}
+
+export function createLeanCtxHandler(deps: { run: Runner }): HookHandler {
+  return async (inv: HookInvocation): Promise<HookResult> => {
+    const direction = directionOf(inv.subcommand)
+    if (direction === null) {
+      return {
+        stdout: '',
+        stderr: `adl hook: lean-ctx: unknown subcommand: ${String(inv.subcommand)} (expected mcp | pre-tool-use | post-tool-use)\n`,
+        exitCode: 1,
+      }
+    }
+
+    const toolName = toolNameOf(inv.payload)
+    if (toolName === null) {
+      inv.record?.({ reason: 'SKIP no tool_name in payload' })
+      return silentNoop()
+    }
+
+    const subcommand = leanCtxSubcommand(inv.host, direction, toolName)
+    if (subcommand === null) {
+      inv.record?.({ reason: `SKIP no lean-ctx hook for ${toolName}` })
+      return silentNoop()
+    }
+    const downstream = `${BIN} hook ${subcommand}`
+
+    const result = await deps.run(BIN, ['hook', subcommand], {
+      cwd: inv.root,
+      env: leanCtxEnvFor(inv.root, inv.env),
+      input: JSON.stringify(inv.payload),
+      timeoutMs: DEFAULT_TIMEOUT_MS,
+    })
+
+    if (result.status === null) {
+      const reason = result.stderr.trim() || (result.timedOut ? `${BIN} timed out after ${DEFAULT_TIMEOUT_MS}ms` : `${BIN} not found on PATH`)
+      const stderr = `lean-ctx ${inv.subcommand} (${subcommand}): ${reason}\n`
+      inv.record?.({ reason: `${result.timedOut ? 'TIMEOUT' : 'ERROR'} ${downstream}`, message: stderr.trim(), downstream })
+      return { stdout: '', stderr, exitCode: 0 }
+    }
+
+    inv.record?.({ reason: result.status === 0 ? 'PASS' : `ERROR exit=${result.status}`, message: result.stderr.trim(), downstream })
+    // 2026-09-28: the session identity rides into the rewrite envelope too —
+    // see `./scope-rewrite.ts`'s header for the two-envelope race this closes.
+    return { stdout: scopeRewrittenCommand(result.stdout, inv.root, sessionIdentityOf(inv.env)), stderr: result.stderr, exitCode: result.status }
+  }
+}
+
+/**
+ * The production `Runner`: a real, timeout-enforcing subprocess via
+ * `spawnWithTimeout` (see `../../lib/spawn-with-timeout.ts`), resolving
+ * `lean-ctx` off `PATH` — the same shape `../briefing/index.ts` and
+ * `../crg/index.ts` already use for their own production runners.
+ */
+export const bunRunner: Runner = async (cmd, args, opts) => {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  try {
+    const result = await spawnWithTimeout(cmd, args, {
+      cwd: opts.cwd,
+      env: opts.env,
+      timeoutMs,
+      ...(opts.input !== undefined ? { stdin: opts.input } : {}),
+    })
+    if (result.timedOut) {
+      return {
+        status: null,
+        stdout: result.stdout,
+        stderr: result.stderr.trim() || `${cmd} timed out after ${timeoutMs}ms`,
+        timedOut: true,
+      }
+    }
+    return { status: result.exitCode, stdout: result.stdout, stderr: result.stderr }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    return { status: null, stdout: '', stderr: message }
+  }
+}
+
+export const handleLeanCtx: HookHandler = createLeanCtxHandler({ run: bunRunner })
+export default handleLeanCtx

package/packages/agent-hooks/src/hooks/lean-ctx/mapping.ts

@@ -0,0 +1,121 @@
+/**
+ * (host, direction, tool name) → `lean-ctx hook <subcommand>` mapping.
+ *
+ * Ported 1:1 from enact-m5's real wiring — the source of truth is each
+ * host's own hooks config, read directly (this session, 2026-09-14):
+ *
+ *  - `.claude/settings.json`: `PreToolUse` matcher `"Bash|bash"` →
+ *    `lean-ctx-local hook rewrite`; matcher
+ *    `"Read|read|ReadFile|read_file|View|view|Grep|grep|Search|search|
+ *    ListFiles|list_files|ListDirectory|list_directory|Glob|glob"` →
+ *    `hook redirect`. `PostToolUse` matcher `"Read"` → `hook read-dedup`.
+ *  - `.cursor/hooks.json`: see the CURSOR CORRECTION note below — the
+ *    original port's matcher strings here were wrong; this describes the
+ *    corrected mapping actually implemented in `CURSOR` below.
+ *    `preToolUse` matcher `"Shell"` → `hook rewrite`; matcher `"Grep"` →
+ *    `hook deny`; matcher `"Read"` → `hook redirect`; matcher `"Write"` →
+ *    `hook deny`. No `postToolUse` bucket at all.
+ *  - `.codex/hooks.json`: `PreToolUse` matcher `"Bash|Read|Grep|Glob"` →
+ *    `lean-ctx-local hook codex-pretooluse`. No `PostToolUse` lean-ctx entry.
+ *  - kimi, opencode: no lean-ctx wiring in either host's config at all — a
+ *    lean-ctx pre/post-tool-use invocation for these hosts is always a
+ *    no-op.
+ *
+ * Each host's matcher is a regex tested against the payload's tool name; the
+ * task's own wording ("match anchored as those hosts do") reflects that
+ * every one of these host matchers is an untagged alternation with no
+ * partial-match intent (`Bash|bash`, not `.*Bash.*`) — every spelling below
+ * is therefore matched as an exact, case-sensitive string against the tool
+ * name, never a substring or prefix test.
+ *
+ * CURSOR CORRECTION (this session, 2026-09-14, verified against
+ * https://cursor.com/docs/agent/hooks): the `CURSOR` table below used to
+ * carry Claude-vocabulary tool names — `Glob` alongside `Grep`, and
+ * `StrReplace`/`Write`/`Edit`/`EditNotebook`/`MultiEdit` all denied — none of
+ * which are real Cursor tool names. The docs' "Matcher Patterns" section
+ * states verbatim: "preToolUse / postToolUse / postToolUseFailure: Filter by
+ * tool type. Values include Shell, Read, Write, Grep, Delete, Task, and MCP
+ * tools using the MCP:<tool_name> format." That is Cursor's *complete*
+ * `tool_name` vocabulary for these two events — there is no `Glob`,
+ * `StrReplace`, `Edit`, `EditNotebook`, or `MultiEdit` in it. `CURSOR` below
+ * is corrected to that vocabulary: `Shell` → rewrite, `Grep` → deny (no
+ * separate glob-like tool exists to also deny), `Read` → redirect, `Write` →
+ * deny (the one edit-like tool Cursor actually has). `Delete`, `Task`, and
+ * any `MCP:<tool_name>` call are intentionally left unmapped (no-op, same as
+ * any tool name absent from a route's set) — enact-m5's real wiring never
+ * named them for lean-ctx.
+ *
+ * A `preToolUse` payload's `tool_name` field (matched above) is documented
+ * alongside `tool_input`, e.g. `{"tool_name": "Shell", "tool_input":
+ * {"command": "npm install", "working_directory": "/project"}, ...}` — see
+ * `../../pre-tool-use/handler.ts`'s `toDecideInput` for where the sibling
+ * `tool_input.command` field (and `beforeShellExecution`'s top-level
+ * `command`) get read.
+ */
+
+import type { HostId } from '../contract.ts'
+
+export type LeanCtxDirection = 'pre' | 'post'
+
+interface ToolRoute {
+  readonly subcommand: string
+  readonly tools: ReadonlySet<string>
+}
+
+type HostRoutes = Readonly<Record<LeanCtxDirection, readonly ToolRoute[]>>
+
+const CLAUDE: HostRoutes = {
+  pre: [
+    { subcommand: 'rewrite', tools: new Set(['Bash', 'bash']) },
+    {
+      subcommand: 'redirect',
+      tools: new Set([
+        'Read', 'read', 'ReadFile', 'read_file', 'View', 'view',
+        'Grep', 'grep', 'Search', 'search',
+        'ListFiles', 'list_files', 'ListDirectory', 'list_directory',
+        'Glob', 'glob',
+      ]),
+    },
+  ],
+  post: [{ subcommand: 'read-dedup', tools: new Set(['Read']) }],
+}
+
+const CURSOR: HostRoutes = {
+  pre: [
+    { subcommand: 'rewrite', tools: new Set(['Shell']) },
+    { subcommand: 'deny', tools: new Set(['Grep']) },
+    { subcommand: 'redirect', tools: new Set(['Read']) },
+    { subcommand: 'deny', tools: new Set(['Write']) },
+  ],
+  post: [],
+}
+
+const CODEX: HostRoutes = {
+  pre: [{ subcommand: 'codex-pretooluse', tools: new Set(['Bash', 'Read', 'Grep', 'Glob']) }],
+  post: [],
+}
+
+const NONE: HostRoutes = { pre: [], post: [] }
+
+const ROUTES: Readonly<Record<HostId, HostRoutes>> = {
+  claude: CLAUDE,
+  cursor: CURSOR,
+  codex: CODEX,
+  kimi: NONE,
+  opencode: NONE,
+}
+
+/**
+ * Resolve which `lean-ctx hook <subcommand>` a (host, direction, tool name)
+ * triple maps to, or `null` when nothing matches — the caller's no-op case
+ * (kimi/opencode always, and any tool name not named in the host's own
+ * matcher above, e.g. an Edit under Claude, which has no lean-ctx PreToolUse
+ * entry at all).
+ */
+export function leanCtxSubcommand(host: HostId, direction: LeanCtxDirection, toolName: string): string | null {
+  const routes = ROUTES[host][direction]
+  for (const route of routes) {
+    if (route.tools.has(toolName)) return route.subcommand
+  }
+  return null
+}

package/packages/agent-hooks/src/hooks/lean-ctx/scope-rewrite.ts

@@ -0,0 +1,207 @@
+/**
+ * G1 — carry this package's `LEAN_CTX_*` scope across lean-ctx's own rewrite.
+ *
+ * `lean-ctx hook rewrite` does not return a decision about the host's command;
+ * it returns a REPLACEMENT command that re-execs lean-ctx by its own absolute
+ * path, e.g. `/usr/local/bin/lean-ctx -c 'trash /tmp/x'` or
+ * `/usr/local/bin/lean-ctx read README.md`. The host then runs that string in
+ * the HOST's environment.
+ *
+ * That is the whole bug. `./index.ts` spawns its own child with the four dir
+ * vars from `../../lean-ctx/env.ts`, so the child that makes the DECISION sees
+ * the repo's `config.toml` (249 commands). But the replacement command is
+ * executed by the host, whose environment carries only `LEAN_CTX_ACTIVE=1` and
+ * `LEAN_CTX_WRAPPED=1` — the two the wrapper sets for itself, measured on this
+ * machine — and never the four dir vars. So the process that ENFORCES resolves
+ * the global XDG path, finds no `config.toml`, and silently falls back to
+ * lean-ctx's 223 built-in defaults.
+ *
+ * The visible symptom is a deadlock between the two guards: `../../rules/` denies
+ * `rm` and directs the caller to `trash`, and `trash` is in the repo allowlist —
+ * but the unscoped re-exec answers "[BLOCKED — DO NOT RETRY] 'trash' is not in
+ * the shell allowlist", so neither verb works. Both halves were measured
+ * directly, 2026-09-15.
+ *
+ * Rooted at the caller's resolved git root, never `$PWD`. A `$PWD`-derived
+ * scope reports 249 at the repo root and 223 from `<repo>/.agents` with no
+ * error — one `cd` and the gate reverts to built-ins.
+ *
+ * Deliberately NOT solved with an env carrier in host config
+ * (`.claude/settings.local.json` and friends): Cursor's project config is
+ * permissions-only, Kimi reads a single user-level file, and Codex ignores
+ * `[shell_environment_policy] set` for untrusted projects — so a carrier
+ * cannot cover the hosts that need it. Rewriting the command reaches every
+ * host that honours the rewrite, which is exactly the set that has the bug.
+ */
+
+import { basename } from 'node:path'
+import { leanCtxEnvFor } from '../../lean-ctx/env.ts'
+import { resolveFromEnvOrFile } from '../../rules/impl/adl-identity.ts'
+import { rewriteGitNetworkCommands } from '../../rules/shell/git-identity.ts'
+
+/** The four dir vars, in the order they are prefixed. See `../../lean-ctx/env.ts`. */
+const SCOPED_VARS = [
+  'LEAN_CTX_CONFIG_DIR',
+  'LEAN_CTX_DATA_DIR',
+  'LEAN_CTX_STATE_DIR',
+  'LEAN_CTX_CACHE_DIR',
+] as const
+
+/** Basename the replacement command must invoke for it to be lean-ctx's own re-exec. */
+const WRAPPER = 'lean-ctx'
+
+/**
+ * The three keys lean-ctx emits the replacement input under — one per host
+ * protocol dialect, all three in every rewrite envelope. Captured verbatim
+ * from the real v3.9.20 binary; all three must be scoped or a host reading
+ * the shape we skipped would run the command unscoped.
+ */
+const INPUT_PATHS: readonly (readonly string[])[] = [
+  ['hookSpecificOutput', 'updatedInput'],
+  ['modifiedArgs'],
+  ['updated_input'],
+]
+
+/** POSIX single-quoting: wrap in `'…'`, and close/escape/reopen around any embedded `'`. */
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`
+}
+
+/** `VAR='…' VAR='…' …` for `root`, derived from the one shared env helper so there is a single source of truth. */
+function scopePrefix(root: string): string {
+  const env = leanCtxEnvFor(root, {})
+  return SCOPED_VARS.map((name) => `${name}=${shellQuote(env[name] ?? '')}`).join(' ')
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/**
+ * Whether `command` is lean-ctx re-execing itself, and so ours to scope.
+ *
+ * Matched on the first token's BASENAME, not a fixed `/usr/local/bin` path, so
+ * a non-standard install location still scopes. An already-scoped command
+ * fails this test — its first token is a `VAR=…` assignment — which is what
+ * makes this function idempotent; the explicit guard in `scopeRewrittenCommand`
+ * does not rely on that, so this can be relaxed without silently double-scoping.
+ */
+function isWrapperReexec(command: string): boolean {
+  const first = command.trimStart().split(/\s+/, 1)[0]
+  return first !== undefined && first.length > 0 && basename(first) === WRAPPER
+}
+
+/**
+ * The EFFECTIVE identity to carry into git network commands inside a
+ * rewritten command — L3 (STATUS.md 12p): steps
+ * 2-3 of the standard, `../../rules/impl/adl-identity.ts`'s
+ * `resolveFromEnvOrFile` (the session env `ADL_AGENT_ID_AGENT`, else the
+ * machine default-agent file), not the session env var alone. This used to
+ * read only `currentAgent` — the raw env var — which meant a session whose
+ * identity resolved from the machine default-agent file (no
+ * `ADL_AGENT_ID_AGENT` in the environment at all, e.g. a surface without an
+ * `adl run --as` session) never got its lean-ctx `-c` re-exec's git network
+ * commands carried, even though every OTHER identity-bearing surface in
+ * this package (`../../pre-tool-use/handler.ts`'s rewrite, `../../rules/engine.ts`'s
+ * own rewrite stage) already falls back to that file. The lean-ctx hook
+ * kind runs in the same process the host spawned for `adl hook`, so
+ * `inv.env` is the session env `adl run` set — the same environment the
+ * rule engine resolves from.
+ */
+export function sessionIdentityOf(env: Readonly<Record<string, string | undefined>>): string | null {
+  const resolution = resolveFromEnvOrFile({ get: (name) => env[name] })
+  return resolution.ok ? resolution.agent : null
+}
+
+/**
+ * The machine-generated re-exec shapes lean-ctx emits for shell commands:
+ * `<binary> -c '<script>'` (single- or double-quoted, `-c` or `--command`,
+ * `=` or space separated). A non-shell rewrite (`lean-ctx read <path>`) has
+ * no script and is not matched.
+ */
+const REEXEC_SCRIPT_SINGLE = /^(\S+)\s+(?:-c|--command)(?:=|\s+)'((?:\\'|[^'])*)'\s*$/
+const REEXEC_SCRIPT_DOUBLE = /^(\S+)\s+(?:-c|--command)(?:=|\s+)"((?:\\"|[^"])*)"\s*$/
+
+/**
+ * Carry `identity` into the git network commands of the script inside a
+ * lean-ctx `-c` re-exec — one scanner (`rewriteGitNetworkCommands`), so the
+ * prefix is byte-identical to the one `adl hook pre-tool-use` puts on the
+ * native command. Returns the rebuilt command, or null when there is nothing
+ * to carry (no script, non-git script, already-carried idempotently, or a
+ * DENY outcome — a conflicting/unsafe inline identity is the pre-tool-use
+ * guard's deny, never rewritten over here).
+ */
+function carryIdentityIntoReexec(command: string, identity: string): string | null {
+  const match = REEXEC_SCRIPT_SINGLE.exec(command) ?? REEXEC_SCRIPT_DOUBLE.exec(command)
+  if (match === null) return null
+  const binary = match[1] as string
+  const script = match[2] as string
+  const outcome = rewriteGitNetworkCommands(script, identity)
+  if (outcome.kind !== 'rewrite') return null
+  return `${binary} -c ${shellQuote(outcome.command)}`
+}
+
+/**
+ * Prefix the four dir vars onto every replacement command in a `lean-ctx hook`
+ * stdout envelope, so the re-exec'd lean-ctx resolves the same `config.toml`
+ * its parent did.
+ *
+ * Fail-open by construction: anything that is not a rewrite envelope carrying a
+ * lean-ctx re-exec — a deny, a plain allow, a non-JSON line, empty output — is
+ * returned as the IDENTICAL string. This sits in the hook's verbatim relay
+ * path, so it must never be the reason a host's tool call breaks.
+ *
+ * 2026-09-28 — the two-envelope race: on Claude/Codex/Cursor a native shell
+ * call gets TWO PreToolUse rewrites (this scope rewrite and the git-identity
+ * rewrite in `../../pre-tool-use`), and the host applies only one of them
+ * (Claude's hooks guide: "the last one to finish takes effect … the order is
+ * non-deterministic"; Codex/Cursor specify no arbitration). So when the
+ * session has an identity, the git network commands inside the `-c` script
+ * are prefixed here too — whichever envelope the host picks authenticates
+ * the push. Everything else about the envelope is unchanged.
+ */
+export function scopeRewrittenCommand(stdout: string, root: string, identity: string | null = null): string {
+  if (stdout.trim().length === 0) return stdout
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(stdout)
+  } catch {
+    return stdout
+  }
+  if (!isRecord(parsed)) return stdout
+
+  const prefix = scopePrefix(root)
+  let changed = false
+
+  for (const path of INPUT_PATHS) {
+    let node: unknown = parsed
+    for (const segment of path) {
+      if (!isRecord(node)) {
+        node = undefined
+        break
+      }
+      node = node[segment]
+    }
+    if (!isRecord(node)) continue
+
+    const command = node.command
+    if (typeof command !== 'string' || command.length === 0) continue
+    if (command.startsWith(`${SCOPED_VARS[0]}=`)) continue
+    if (!isWrapperReexec(command)) continue
+
+    let next = command
+    if (identity !== null) {
+      const carried = carryIdentityIntoReexec(next, identity)
+      if (carried !== null) next = carried
+    }
+
+    node.command = `${prefix} ${next}`
+    changed = true
+  }
+
+  if (!changed) return stdout
+
+  const trailing = stdout.slice(stdout.trimEnd().length)
+  return `${JSON.stringify(parsed)}${trailing}`
+}