@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/README.md

@@ -0,0 +1,411 @@
+# adl hook
+
+Agent hook runtime — pre-tool-use guard, user-prompt-submit skill suggestions,
+briefing, and crg (code-review-graph) hooks — for Claude Code, Codex, Cursor,
+Kimi, and OpenCode. Built as a single compiled `bun build --compile` binary
+and installed fleet-wide at `/usr/local/bin/adl` by the
+[`global-tools`](../global-tools) reconciler's `bun-compile` manager
+(manifest entry `adl hook` under `mac.common.tools` and `linux.common.tools`).
+
+Agent identity/role rules (`adl.*`, `src/rules/impl/adl-*.ts`) implement
+[`docs/operations/agent-permissions.md`](../../docs/operations/agent-permissions.md) — the one
+source for who may do what; a row changes there first, not here.
+
+Host hook configuration points at the global binary directly, e.g.:
+
+```json
+{ "command": "adl hook", "args": ["pre-tool-use", "--host=claude"] }
+```
+
+## CLI contract
+
+```
+adl hook <kind> [subcommand] --host=<claude|codex|cursor|kimi|opencode>
+```
+
+- `kind`: `pre-tool-use`, `user-prompt-submit`, `briefing`, or `crg`
+- `crg` requires a `subcommand`: `after-file-edit`, `pre-commit`, or `session-stop`
+- `--host` accepts either `--host X` or `--host=X`; `vscode` is refused
+  (a valid host id elsewhere in the fleet, but audit-only — it has no hook
+  mechanism, so accepting it here would let a blocked decision silently
+  render as nothing)
+- the host's JSON payload is read from stdin
+- `--version` prints the package version and exits 0
+
+## Operator commands: `rules` and `doctor`
+
+These are for people, not hosts: no `--host`, no stdin payload, and never a
+silent no-op. The repo is resolved exactly like the hooks resolve it (walk up
+to the git root, read `adl-config.toml` there), starting from
+`--repo <path>` (or `--repo=<path>`, relative to cwd) or else cwd.
+
+```
+adl hook rules list [--repo <path>] [--json]
+adl hook rules show <id> [--repo <path>] [--json]
+adl hook doctor [--repo <path>]
+```
+
+- `rules list` — every registered rule: id, category, severity, enabled
+  (effective), summary. "Effective" is the engine's own resolution
+  (`buildEngineContext`: explicit `[rules."<id>"]` wins, then
+  `rules.default`, then the rule's default) behind the `[hooks] enabled`
+  gate — with hooks disabled nothing is enforced, so every rule shows `no`.
+  Outside a managed repo the built-in defaults are shown and the header says
+  so. `--json` adds `repo` (`start`/`root`/`managed`/`configPath`), `source`
+  (`config`|`defaults`), `hooksEnabled` and `enabledByDefault`.
+- `rules show <id>` — the same fields plus the full `corpus.deny` /
+  `corpus.allow` command lists. Unknown id: exit 1.
+- Both exit 1 with the exact decode error for an invalid config, for a config
+  that switches off an `uncertain` rule without `unsafeAllowUncertain`, or
+  for a `--repo` that is not a directory.
+
+`doctor` prints one `[ok]`/`[warn]`/`[FAIL]`/`[skip]` line per check and a
+`doctor: N ok, N warn, N fail` summary; it exits 1 iff any check FAILs.
+
+| check | FAIL (hard requirement) | warn |
+| --- | --- | --- |
+| repo | — | not managed (no git root / no `adl-config.toml`) |
+| config | decode error (exact pointer + message), or rules fail to resolve | — |
+| hooks | — | `[hooks] enabled = false` |
+| skills | hooks enabled and `skills_dir` (default `.agents/skills`) missing or without a valid `SKILL.md` | same, with hooks disabled |
+| embedding model | — | location unresolved, missing, or corrupt (loader reason); matching is BM25-only |
+| vector half | — | `SKILL_MATCH_VECTOR=0`; model not usable; or **effectively disabled by `cosineFloor`** — a floor above 1 (`SKILL_MATCH_COSINE_FLOOR`), which no cosine similarity can reach |
+| lean-ctx | not on PATH, or `lean-ctx --version` fails | — |
+| lean-ctx allowlist | — | count unreadable from `lean-ctx doctor --json` (run with the repo's `LEAN_CTX_*` dirs in a managed repo, lean-ctx defaults otherwise) |
+| code-review-graph | not on PATH | — |
+| logs (`[info]`, not tallied) | — | a log file that exists but cannot be read |
+
+In a managed repo doctor also prints both hook-log paths with their row
+counts and echoes the last 5 deny-log rows.
+
+## Hook logs: `.adl/logs/hooks.log` and `.adl/logs/hooks-deny.log`
+
+Written only for a managed repo with hooks enabled (same gate as every hook;
+unmanaged or `[hooks] enabled = false` writes nothing). Only agent hook
+invocations are logged. Logging is strictly best-effort: the directory is
+created lazily with the first row, one append per file per invocation, and a
+write failure (read-only dir, full disk) never changes a hook's stdout,
+stderr, or exit code. Environment variables are never logged.
+
+This is a hard cut: legacy `.agents/hooks/hooks.log` and
+`.agents/hooks/hooks-activity.log` files are neither read, copied, appended,
+nor removed — and so is `.enact/logs/enact-hook-{deny,activity}.log`, the
+CSV files this format replaces (docs/architecture/cli-design.md §5a, Tarun 2026-09-27):
+`.enact/logs/` is no longer written at all.
+
+Both files are **JSON Lines** — one JSON object per line, written by the one
+shared logger every `.adl/logs/*.log` file uses
+(`src/log/writer.ts`'s `writeLogEntry`, moved here from `apps/cli` so
+agent-hooks "holds logs"; `apps/cli/src/log.ts` re-exports it unchanged).
+Fields are written in a fixed order and an absent field is OMITTED, never
+null-filled: `ts, session_id, agent, human, host, event, tool, decision,
+rule, target, command, result, duration_ms`. `command` is truncated at 2000
+characters (`...<truncated>`, unchanged from the CSV era) and then redacted
+(`redact()`: bearer tokens, `Authorization:` headers, JWTs, `*_TOKEN=`/
+`*_SECRET=`/… name=value pairs, `--password`-style flags, URL userinfo).
+Files live at `0600`, the directory at `0700`; a file that would exceed 10 MiB
+is rotated to `.1`…`.5`, dropping `.5`.
+
+**`hooks.log`** — one row per hook invocation of every kind (allow, deny,
+route). **`hooks-deny.log`** — the same row, additionally, only when the
+invocation was a blocked pre-tool-use decision.
+
+`src/hooks/log.ts`'s field mapping (the shared schema has no dedicated
+"surface", "message", or "downstream" field, the old CSV activity log's last
+three columns):
+
+- `target`: what the CSV format called "surface" — `agent:<host>:<kind>[:<sub>]`
+- `decision`: `PASS`, `DENY <rule>`, `ERROR <what>` (e.g. `ERROR exit=2`,
+  `ERROR code-review-graph status`), `TIMEOUT <what>`, or `SKIP <why>`, with
+  ` → <downstream>` appended when the handler named one (`lean-ctx hook
+  <sub>`, `code-review-graph <args>`, `skills: <names|(none)> (hybrid|bm25)`,
+  the briefing's lean-ctx calls, or `advice <rule>` for an advisory match)
+- `rule`: the blocked rule id, set only alongside a `DENY` decision
+- `command`: compact input summary — shell command; Grep/Glob pattern
+  (`<pattern> in <path>`); Read/Edit/Write file path; URL/query; otherwise the
+  tool input as JSON; for prompt hooks, the prompt
+- `result`: the agent-facing hint (`ActivityNote.message`) when the handler
+  set one, else the hook's own exit code as a string
+- `host`, `event` (the payload's `hook_event_name`, else the dispatch event,
+  else `<kind>[:<sub>]`), `tool` (`tool_name`), `session_id` (`session_id` /
+  `conversation_id`), `agent` (best-effort `ADL_AGENT_ID_AGENT`), `duration_ms`
+  (handler wall time)
+
+## `git.worktree`: routes worktree reconciliation, denies `add`/mutation, caps native tool calls
+
+`src/rules/impl/git-worktree.ts`'s `git.worktree` rule stopped being a flat
+deny-everything policy on 2026-09-27 (Tarun, via the coordinator, on top of
+the 2026-09-27 `adl-m3-items` item 2 tool-call hardcut described below). It
+now routes by `git worktree` subcommand, statically classified through every
+shell indirection this rule has always covered (aliases, `GIT_CONFIG_*` env
+injection, `$(git --exec-path)/git-worktree`, `sudo`/`env`/`nohup` wrapping,
+chaining, piping — see `tests/unit/rules-git-worktree.test.ts`):
+
+- `list` / `remove` / `prune` / `repair` — **ALLOWED outright.** These
+  reconcile toward the checkout cap and create no new checkout.
+- `add` — **DENIED**, with the exact `adl worktree add` command to run
+  instead (same arguments). This is a deny-with-instruction, not a true
+  rewrite: no mechanism in this engine can substitute a replacement command
+  for an agent's shell invocation (`Severity` is `'deny' | 'advise'` only;
+  no `Finding`/`Decision`/`HostSpec` type anywhere in `src/rules/engine.ts`
+  or `src/hosts/impl/*.ts` carries a replacement command — verified by
+  reading them, not assumed). `docs/operations/agent-permissions.md`'s own principle
+  covers exactly this case: "An inexact rewrite is a deny with the `adl`
+  command to use."
+- `move` / `lock` / `unlock` — **DENIED.** These mutate a worktree's
+  registration or lock state without reconciling anything toward the cap.
+- Bare `git worktree`, `--help`, or an unrecognized subcommand — **DENIED**
+  (unchanged fail-closed default).
+
+Added 2026-09-27 (adl-m3-items item 2): that shell-side policy is not the
+only way an agent host can create a worktree. The same rule also inspects,
+as a `tool-call` Invocation (no shell command involved at all):
+
+- Claude Code's own `EnterWorktree` tool.
+- Claude Code's `Task`/`Agent` subagent-launch tool called with `isolation:
+  "worktree"` in its input (`isolation: "remote"` is a different, non-worktree
+  sandbox and is left alone). Both `Task` (the historical hook-payload
+  `tool_name`) and `Agent` (the name this environment's own tool surface
+  reports) are matched defensively.
+
+Neither of these can be rewritten to a shell command either, so instead of a
+flat deny this rule counts the CURRENT PROCESS's cwd repo's worktrees itself
+(`git worktree list --porcelain`, real git, no shared port — see the source
+file's header for why) and **ALLOWS below the 3-checkout cap, DENIES at or
+above it** with the same limit wording `adl worktree add` and `bin/git`
+(the L1 front controller) use. A count that cannot be determined (not a
+repo, git missing, …) fails CLOSED — denied, never assumed safe.
+
+No host-adapter change was needed: `toDecideInput`
+(`src/pre-tool-use/handler.ts`) and `decideToolCall` (`src/rules/engine.ts`)
+are host-agnostic — they key off whatever `tool_name`/`tool_input` a host's
+own payload carries. Confirmed only for Claude Code today; codex/cursor/kimi/
+opencode are not known to expose an equivalent native worktree-isolation
+tool, but if any of them ever does, this same rule already covers it the
+moment that host sends a matching `tool_name`/`tool_input` — nothing here
+would need to change.
+
+The repository-side, human-facing *limit* (at most 3 checkouts including the
+main folder) is also enforced by two independent backstops: the CLI
+(`adl worktree add`/`adl worktree list` — `apps/cli/src/commands/
+worktree.ts`), the L1 git front controller (`bin/git`), and a separate git
+`post-checkout` hook — see
+[`../repo-controls/README.md`](../repo-controls/README.md#worktree-count-backstop-post-checkout).
+
+## Per-repo gating: `adl-config.toml`
+
+`adl hook` is installed once, globally. Whether it does anything in a given
+invocation is decided per-repository by walking up from the host payload's
+cwd (or Cursor's `workspace_roots[0]`) to the git root (the nearest ancestor
+directory containing a `.git` entry) and checking for
+`<git root>/adl-config.toml`:
+
+- **No git root found, or no `adl-config.toml` at the git root**:
+  unmanaged repository — silent no-op (exit 0, empty stdout/stderr). This is
+  deliberate: every host hook command (Kimi's especially, which has no
+  repo-local hook configuration at all) can be registered once, globally,
+  and safely do nothing outside repositories that have opted in.
+- **`adl-config.toml` present but fails to parse or decode**: fails
+  loud — non-zero exit, reason on stderr. A malformed config is never
+  silently treated as absent or as defaults.
+- **`[hooks] enabled = false`**: same as unmanaged — silent no-op for every
+  hook kind.
+
+### File format
+
+Six top-level keys are recognized: `version`, `[hooks]`, `[rules]`, `[repo]`,
+`[controls]`, and `[skills]`. `[controls]` and `[skills]` are reserved root
+tables owned by other tools (`enact-repo-controls` and `adl-extensions`,
+respectively) that share this same file; `adl hook` accepts and ignores
+them without ever reading their contents. Every other top-level key — and
+every unrecognized key inside `[hooks]` or `[repo]` — is a decode error
+(fails loud, non-zero exit, reason on stderr), never silently ignored; see
+"Unknown keys fail loud" below.
+
+```toml
+version = 1                     # optional; accepted for the marker file's
+                                 # own minimal "version = 1" convention. Not
+                                 # currently interpreted beyond "must be a
+                                 # number" — no schema migrations yet.
+
+[hooks]
+enabled = true                  # default true; false disables every hook kind
+skills_dir = ".agents/skills"   # optional, repo-root-relative; see below
+
+[rules]
+default = "on"                  # "on" | "off" — baseline for rules with no
+                                 # explicit [rules."<id>"] entry
+unsafeAllowUncertain = false    # required true to allow disabling an
+                                 # "uncertain" (fail-closed parse) rule
+
+[rules."rm-smoke"]
+enabled = false                 # explicit per-rule override; always wins
+
+[repo]
+protectedTrees = [".code-quality/", ".agents/"]
+                                 # trees `git commit` / `git mv` / `mv` must
+                                 # not touch or move out of the repository —
+                                 # see "[repo]" below. Shown here at its
+                                 # default value; omit [repo] entirely to
+                                 # keep it.
+trustedScriptPrefixes = ["workflows/scripts/", ".code-quality/", ".agents/hooks/"]
+                                 # repo-relative script path prefixes an agent
+                                 # may execute without inspection.
+```
+
+A complete, valid example — everything above in one file, as it would sit at
+`<git root>/adl-config.toml` — is also checked in at
+[`test/fixtures/adl-config.example.toml`](test/fixtures/adl-config.example.toml)
+and loaded directly by `test/unit/gating-config-example-file.test.ts`, so it
+can never silently drift out of sync with what `decodeConfig` actually
+accepts.
+
+Rule resolution mirrors `enact-repo-controls`'s `isRuleEnabled`
+(`src/kernel/config/effective.ts`) exactly, ported as semantics rather than
+code since this file carries only the `[hooks]`/`[rules]`/`[repo]` subset of
+that project's full config schema (no `paths`, `hosts`, `test`, or
+`surfacesAudit` sections — those belong to adl-extensions, not here):
+
+1. An explicit `[rules."<id>"] enabled` always wins.
+2. Failing that, `rules.default = "off"` disables every rule not explicitly
+   re-enabled; `"on"` (the default) leaves each rule at whatever default its
+   own built-in spec declares.
+3. A rule in the `uncertain` category (the shell parser could not classify
+   the command) that would resolve to disabled without
+   `rules.unsafeAllowUncertain = true` is a **config error** (fails loud),
+   not a silent override in either direction.
+
+### `[repo]`
+
+An additive extension beyond `enact-repo-controls`'s own scope for this
+module: the rule corpus ported from its `src/rules/impl/*.ts`
+(`git.protected-tree-commit`, `git.mv-escape`, `fs.mv` — see
+`src/rules/spec.ts`'s `RuleContext.repo`) needs two repo-specific settings to
+reproduce that behaviour:
+
+- `protectedTrees`: repo-relative directory prefixes `git commit`, `git mv`,
+  and `mv` must not touch or move a tracked path out of. Defaults to
+  `[".code-quality/", ".agents/"]` — `enact-repo-controls`'s own
+  `DEFAULT_CONFIG.repo` (`kernel/config/defaults.ts`) — so a repo that omits
+  `[repo]` entirely still gets the same protection the reference ships out of
+  the box. Set to `[]` to disable the protection entirely.
+- `trustedScriptPrefixes`: repo-relative script path prefixes an agent may
+  execute without inspection. Defaults to `["workflows/scripts/",
+  ".code-quality/", ".agents/hooks/"]`, the same reference default.
+
+Both fields default independently: a `[repo]` table naming only one still
+gets the other's default, and an empty `[repo]` table is valid and equals
+the defaults for both.
+
+### Unknown keys fail loud
+
+A key this schema does not recognize — at the document root, or inside
+`[hooks]` or `[repo]` — is a decode error, exactly like a wrong-typed known
+key: `adl hook` exits non-zero with the offending key(s) and the pointer
+named on stderr, rather than silently accepting and ignoring it. This is
+deliberate: a typo like `[hooks] enable = true` (missing the `d`) would
+otherwise decode successfully and simply do nothing, which is far more
+dangerous than a config that fails to load at all. `[rules]` is the one
+section without a dedicated unknown-key check because every key besides
+`default`/`unsafeAllowUncertain` is already interpreted as a
+`[rules."<id>"]` per-rule table and validated as one — a stray key there
+already fails loud today (`expected a table` / `expected a boolean`), just
+via that path instead.
+
+### `skills_dir`
+
+`user-prompt-submit` suggests skills by searching a directory of installed
+skill definitions. That directory is `<git root>/<hooks.skills_dir>` when
+set, defaulting to `<git root>/.agents/skills` when absent.
+
+**HARDCUT (integration pass):** the migration source,
+`enact-repo-controls-m5`, declared `.agents/skill-catalog` as its default —
+a per-repo, hand-authored catalog. That is not `adl hook`'s world: the
+[`adl-extensions`](../../adl-extensions) installer places one *shared*
+copy of the skill corpus at `.agents/skills` in every repository it installs
+into, for every host. Claude additionally has plugin-bundled skills at
+`.claude-plugin/adl-repo/skills`, but that is a distribution detail of how
+the plugin ships its copy, not a second independent skill source — Claude
+resolves against `.agents/skills` like every other host, so there is one
+default for all five hosts, not a per-host one. There is no fallback to the
+old `.agents/skill-catalog` path: a repo that still only has that directory
+must set `hooks.skills_dir = ".agents/skill-catalog"` explicitly.
+
+## Known gaps fixed during migration from `enact-repo-controls`
+
+Migrated from `enact-repo-controls-m5`'s hook-relevant modules
+(`src/hooks/**`, `src/rules/**`, per-host `renderDecision`). Three gaps
+fixed in the process (see `src/lib/spawn-with-timeout.ts`,
+`src/hooks/user-prompt-submit/vector.ts`, `src/hooks/briefing/index.ts`):
+
+1. **Spawn timeouts.** The source used `Bun.spawnSync`, which has no
+   timeout — a hung `lean-ctx` or `code-review-graph` child could hang the
+   calling agent host forever. Replaced with `spawnWithTimeout` (async
+   `Bun.spawn` + a real wall-clock timeout that kills the child on expiry).
+2. **Specific embedding-model failure reasons.** A failed embedding-model
+   load now reports *why* (model directory missing vs. present-but-corrupt
+   vs. a load error) on stderr before falling back to BM25-only search,
+   instead of a generic failure note.
+3. **Global `lean-ctx`, repo-local XDG env.** The source's briefing hook
+   depended on a repo-local wrapper script
+   (`.agents/bin/lean-ctx-local`, see `enact-m5`). Binaries are global now:
+   the briefing hook calls `lean-ctx` on `PATH` directly, setting the same
+   `XDG_CONFIG_HOME` / `XDG_DATA_HOME` / `XDG_STATE_HOME` / `XDG_CACHE_HOME`
+   environment (rooted at `<repo root>/.agents/lean-ctx/`) that wrapper used
+   to set, so `lean-ctx`'s state stays per-repository even though the
+   binary itself is shared.
+
+## Integration pass (three independently-migrated slices + foundation)
+
+The guard (`src/rules`, `src/hosts`, `src/pre-tool-use`), skill match
+(`src/hooks/user-prompt-submit`), and briefing/crg (`src/hooks/briefing`,
+`src/hooks/crg`) slices were migrated separately onto the shared foundation
+(`src/main.ts`, `src/gating/*`, `src/lib/spawn-with-timeout.ts`). Wiring them
+together as one binary surfaced a few issues fixed in that pass:
+
+- **`--version` crashed inside the compiled binary.** `readFileSync(join(import.meta.dir,
+  '..', 'package.json'))` resolves under `bun run src/main.ts`, but
+  `import.meta.dir` is a virtual `/$bunfs/...` path inside a `bun build
+  --compile` binary, and package.json is never embedded unless something
+  actually imports it — `--version` failed with ENOENT. Fixed with a real
+  static `import packageJson from '../package.json'`, which the bundler does
+  embed.
+- **OpenCode's rendered deny was invisible to the real plugin.**
+  `adl-extensions`'s generated OpenCode plugin (`src/create/opencode.ts`)
+  only recognizes a block via exit code 2 or `hookSpecificOutput.permissionDecision
+  === 'deny'`; `opencodeSpec.renderDecision` used to emit a flat
+  `{decision, reason}` shape at exit 0, which that plugin does not read at
+  all — silently letting every denial through, the same class of bug already
+  fixed for Kimi. `src/hosts/impl/opencode.ts` now renders the same
+  `hookSpecificOutput` envelope, and `src/pre-tool-use/handler.ts` exits 2
+  for a blocked opencode decision too.
+- **Invalid JSON on stdin exited 1, not fail-closed.** `enact-repo-controls`'s
+  own `runHook` fails closed (exit 2) on unparseable hook JSON, for every
+  hook kind uniformly (the payload has to parse before the repository root
+  can even be resolved). `src/main.ts` now matches: a malformed payload exits
+  `FAIL_CLOSED_EXIT_CODE` (2), not the generic failure code.
+- **`adl-config.toml` silently ignored unknown keys** — see "Unknown
+  keys fail loud" above.
+- **`src/hosts/*` carried unreachable deployment code** — `targets`, `mode`,
+  `renderContext`, `commandFor`, `briefing`, `liveProbe`, and each host's
+  shape-helper exports (`claudeHookGroup`, `codexHookGroup`/`codexMcpTable`,
+  `cursorHookEntry`, `kimiHookTable`, `opencodeMcpServer`) were carried over
+  from `enact-repo-controls`'s installer-era `HostSpec`, but installing hook
+  wiring into a host's config now belongs to `adl-extensions`. Removed;
+  `HostSpec` now carries only `id` and `renderDecision`, the only member the
+  runtime (`src/pre-tool-use/handler.ts`) ever calls.
+
+## Development
+
+```bash
+bun install
+bun run check      # typecheck + bun test --coverage (100% lines + functions gate)
+bun run build      # compiles via scripts/build-binary.ts (never raw `bun build --compile` in the checkout: bun#14020)
+```
+
+Coverage is a gate, not a report: `bunfig.toml` sets
+`[test.coverageThreshold] lines = 1.0, functions = 1.0` with no ignore
+patterns, and `test/unit/coverage-policy.test.ts` asserts that policy (and
+that a below-threshold run really exits non-zero — Bun ignores the singular
+`line`/`function` keys). `bun test <file>` without `--coverage` stays usable
+for targeted runs.

package/packages/agent-hooks/assets/hooks.json

@@ -0,0 +1,97 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook pre-tool-use",
+            "statusMessage": "adl-repo: destructive-command guard",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook crg pre-commit",
+            "statusMessage": "adl-repo: crg pre-commit",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook lean-ctx pre-tool-use",
+            "statusMessage": "adl-repo: lean-ctx pre-tool-use",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook user-prompt-submit",
+            "statusMessage": "adl-repo: matching skills",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook briefing",
+            "statusMessage": "adl-repo: session briefing",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit|StrReplace|str_replace_editor|edit_file|str_replace|replace_in_file|create_file|write_file",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook crg after-file-edit",
+            "statusMessage": "adl-repo: crg after-file-edit",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook lean-ctx post-tool-use",
+            "statusMessage": "adl-repo: lean-ctx post-tool-use",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "adl hook crg session-stop",
+            "statusMessage": "adl-repo: crg session-stop",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}