@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.37 → 0.1.47

package/packages/agent-hooks/src/hooks/lean-ctx/handler.ts

@@ -1,22 +0,0 @@
-/**
- * `main.ts`-facing entry point for the `lean-ctx` hook kind's
- * `pre-tool-use` / `post-tool-use` subcommands.
- *
- * Thin wiring only, mirroring `../briefing/handler.ts` and `../crg/handler.ts`:
- * the actual logic lives in `./index.ts`, built against an injectable
- * `Runner` so it can be unit-tested without a real `lean-ctx` binary. This
- * file wires that logic to the production, timeout-enforcing `bunRunner`.
- *
- * `main.ts` never routes a `subcommand: 'mcp'` invocation here — see
- * `../../lean-ctx/mcp.ts`'s header for why that subcommand is dispatched
- * entirely separately, before `main.ts`'s standard JSON-payload flow.
- */
-
-import type { HookInvocation, HookResult } from '../contract.ts'
-import { bunRunner, createLeanCtxHandler } from './index.ts'
-
-const leanCtxHandler = createLeanCtxHandler({ run: bunRunner })
-
-export async function handleLeanCtx(inv: HookInvocation): Promise<HookResult> {
-  return leanCtxHandler(inv)
-}

package/packages/agent-hooks/src/hooks/lean-ctx/index.ts

@@ -1,173 +0,0 @@
-/**
- * The `lean-ctx` hook kind's `pre-tool-use` / `post-tool-use` subcommands:
- * `adl hook lean-ctx pre-tool-use --host=X` / `post-tool-use --host=X`
- * (work item A.2). The `mcp` subcommand is NOT handled here — it is a true
- * stdio-passthrough, long-running MCP server, dispatched straight out of
- * `main.ts` (see `../../lean-ctx/mcp.ts`) before the standard
- * read-stdin-as-one-JSON-payload / `HookHandler` machinery this file uses
- * ever runs.
- *
- * Gating (managed repo + `[hooks] enabled`, silent no-op otherwise) is
- * `main.ts`'s job, identical to every other kind — see its header. This
- * handler only has to:
- *
- *  1. Read the invoking tool's name out of the payload (the same field every
- *     host spells `tool_name` for a PreToolUse/PostToolUse call — see
- *     `../../pre-tool-use/handler.ts`'s `toDecideInput` for the reference
- *     this mirrors).
- *  2. Map (host, direction, tool name) to a `lean-ctx hook <subcommand>` via
- *     `./mapping.ts`. No match (kimi/opencode always; any host+tool this
- *     task's mapping table does not name) is a SILENT no-op — exit 0, empty
- *     stdout/stderr, no `lean-ctx` spawn at all.
- *  3. Spawn `lean-ctx hook <subcommand>` with the payload JSON on stdin and
- *     the shared `LEAN_CTX_*` env (`../../lean-ctx/env.ts`), and relay its
- *     stdout/stderr/exit code VERBATIM — lean-ctx speaks each host's own
- *     hook protocol (deny/rewrite/redirect envelopes) itself, so this must
- *     not reinterpret or reshape what it returns.
- *
- * Two exceptions to "relay verbatim":
- *
- *  - A hung or missing `lean-ctx` (`status: null` — see `Runner`'s doc) must
- *    never block the calling host's tool-call loop, so that degrades to exit 0
- *    with a stderr note instead of whatever `lean-ctx` would have returned had
- *    it run — same fail-open shape `../briefing/index.ts` and
- *    `../crg/index.ts` already use for their own subprocess calls.
- *  - A `rewrite` envelope's REPLACEMENT command is re-scoped by
- *    `./scope-rewrite.ts` (G1). lean-ctx rewrites the host's command into one
- *    that re-execs lean-ctx by absolute path, and the host runs that in the
- *    HOST's env — which carries none of the four `LEAN_CTX_*` dir vars set for
- *    the child above, so the process that actually ENFORCES silently falls back
- *    to built-in defaults instead of the repo's `config.toml`. Prefixing the
- *    four assignments onto that command is the narrowest place to fix it: the
- *    envelope's shape, decision and every other field are untouched, and any
- *    non-rewrite output is returned as the identical string.
- */
-
-import type { HookHandler, HookInvocation, HookResult } from '../contract.ts'
-import { leanCtxEnvFor } from '../../lean-ctx/env.ts'
-import { spawnWithTimeout } from '../../lib/spawn-with-timeout.ts'
-import { leanCtxSubcommand, type LeanCtxDirection } from './mapping.ts'
-import { scopeRewrittenCommand, sessionIdentityOf } from './scope-rewrite.ts'
-
-export interface RunResult {
-  readonly status: number | null
-  readonly stdout: string
-  readonly stderr: string
-  /** `true` only when the spawn was killed for exceeding `timeoutMs`. */
-  readonly timedOut?: boolean
-}
-
-export interface RunOptions {
-  readonly cwd: string
-  readonly env: Readonly<Record<string, string | undefined>>
-  readonly input?: string
-  readonly timeoutMs?: number
-}
-
-/** Process spawning, injected so tests never need a real `lean-ctx` binary. */
-export type Runner = (cmd: string, args: readonly string[], opts: RunOptions) => Promise<RunResult>
-
-const BIN = 'lean-ctx'
-
-/**
- * lean-ctx's own PreToolUse/PostToolUse hook subcommands (rewrite, redirect,
- * deny, read-dedup, codex-pretooluse) are simple synchronous lookups/string
- * transforms in the real binary — generous, but well under the host's own
- * tool-call timeout, matching `../crg/index.ts`'s reasoning for its own
- * default.
- */
-const DEFAULT_TIMEOUT_MS = 10_000
-
-/** The tool-name field every host's PreToolUse/PostToolUse payload carries — see `../../pre-tool-use/handler.ts`'s `toDecideInput`. */
-function toolNameOf(payload: Record<string, unknown>): string | null {
-  const name = payload.tool_name
-  return typeof name === 'string' && name.length > 0 ? name : null
-}
-
-function directionOf(subcommand: string | undefined): LeanCtxDirection | null {
-  if (subcommand === 'pre-tool-use') return 'pre'
-  if (subcommand === 'post-tool-use') return 'post'
-  return null
-}
-
-function silentNoop(): HookResult {
-  return { stdout: '', stderr: '', exitCode: 0 }
-}
-
-export function createLeanCtxHandler(deps: { run: Runner }): HookHandler {
-  return async (inv: HookInvocation): Promise<HookResult> => {
-    const direction = directionOf(inv.subcommand)
-    if (direction === null) {
-      return {
-        stdout: '',
-        stderr: `adl hook: lean-ctx: unknown subcommand: ${String(inv.subcommand)} (expected mcp | pre-tool-use | post-tool-use)\n`,
-        exitCode: 1,
-      }
-    }
-
-    const toolName = toolNameOf(inv.payload)
-    if (toolName === null) {
-      inv.record?.({ reason: 'SKIP no tool_name in payload' })
-      return silentNoop()
-    }
-
-    const subcommand = leanCtxSubcommand(inv.host, direction, toolName)
-    if (subcommand === null) {
-      inv.record?.({ reason: `SKIP no lean-ctx hook for ${toolName}` })
-      return silentNoop()
-    }
-    const downstream = `${BIN} hook ${subcommand}`
-
-    const result = await deps.run(BIN, ['hook', subcommand], {
-      cwd: inv.root,
-      env: leanCtxEnvFor(inv.root, inv.env),
-      input: JSON.stringify(inv.payload),
-      timeoutMs: DEFAULT_TIMEOUT_MS,
-    })
-
-    if (result.status === null) {
-      const reason = result.stderr.trim() || (result.timedOut ? `${BIN} timed out after ${DEFAULT_TIMEOUT_MS}ms` : `${BIN} not found on PATH`)
-      const stderr = `lean-ctx ${inv.subcommand} (${subcommand}): ${reason}\n`
-      inv.record?.({ reason: `${result.timedOut ? 'TIMEOUT' : 'ERROR'} ${downstream}`, message: stderr.trim(), downstream })
-      return { stdout: '', stderr, exitCode: 0 }
-    }
-
-    inv.record?.({ reason: result.status === 0 ? 'PASS' : `ERROR exit=${result.status}`, message: result.stderr.trim(), downstream })
-    // 2026-09-28: the session identity rides into the rewrite envelope too —
-    // see `./scope-rewrite.ts`'s header for the two-envelope race this closes.
-    return { stdout: scopeRewrittenCommand(result.stdout, inv.root, sessionIdentityOf(inv.env)), stderr: result.stderr, exitCode: result.status }
-  }
-}
-
-/**
- * The production `Runner`: a real, timeout-enforcing subprocess via
- * `spawnWithTimeout` (see `../../lib/spawn-with-timeout.ts`), resolving
- * `lean-ctx` off `PATH` — the same shape `../briefing/index.ts` and
- * `../crg/index.ts` already use for their own production runners.
- */
-export const bunRunner: Runner = async (cmd, args, opts) => {
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS
-  try {
-    const result = await spawnWithTimeout(cmd, args, {
-      cwd: opts.cwd,
-      env: opts.env,
-      timeoutMs,
-      ...(opts.input !== undefined ? { stdin: opts.input } : {}),
-    })
-    if (result.timedOut) {
-      return {
-        status: null,
-        stdout: result.stdout,
-        stderr: result.stderr.trim() || `${cmd} timed out after ${timeoutMs}ms`,
-        timedOut: true,
-      }
-    }
-    return { status: result.exitCode, stdout: result.stdout, stderr: result.stderr }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
-    return { status: null, stdout: '', stderr: message }
-  }
-}
-
-export const handleLeanCtx: HookHandler = createLeanCtxHandler({ run: bunRunner })
-export default handleLeanCtx

package/packages/agent-hooks/src/hooks/lean-ctx/mapping.ts

@@ -1,121 +0,0 @@
-/**
- * (host, direction, tool name) → `lean-ctx hook <subcommand>` mapping.
- *
- * Ported 1:1 from enact-m5's real wiring — the source of truth is each
- * host's own hooks config, read directly (this session, 2026-09-14):
- *
- *  - `.claude/settings.json`: `PreToolUse` matcher `"Bash|bash"` →
- *    `lean-ctx-local hook rewrite`; matcher
- *    `"Read|read|ReadFile|read_file|View|view|Grep|grep|Search|search|
- *    ListFiles|list_files|ListDirectory|list_directory|Glob|glob"` →
- *    `hook redirect`. `PostToolUse` matcher `"Read"` → `hook read-dedup`.
- *  - `.cursor/hooks.json`: see the CURSOR CORRECTION note below — the
- *    original port's matcher strings here were wrong; this describes the
- *    corrected mapping actually implemented in `CURSOR` below.
- *    `preToolUse` matcher `"Shell"` → `hook rewrite`; matcher `"Grep"` →
- *    `hook deny`; matcher `"Read"` → `hook redirect`; matcher `"Write"` →
- *    `hook deny`. No `postToolUse` bucket at all.
- *  - `.codex/hooks.json`: `PreToolUse` matcher `"Bash|Read|Grep|Glob"` →
- *    `lean-ctx-local hook codex-pretooluse`. No `PostToolUse` lean-ctx entry.
- *  - kimi, opencode: no lean-ctx wiring in either host's config at all — a
- *    lean-ctx pre/post-tool-use invocation for these hosts is always a
- *    no-op.
- *
- * Each host's matcher is a regex tested against the payload's tool name; the
- * task's own wording ("match anchored as those hosts do") reflects that
- * every one of these host matchers is an untagged alternation with no
- * partial-match intent (`Bash|bash`, not `.*Bash.*`) — every spelling below
- * is therefore matched as an exact, case-sensitive string against the tool
- * name, never a substring or prefix test.
- *
- * CURSOR CORRECTION (this session, 2026-09-14, verified against
- * https://cursor.com/docs/agent/hooks): the `CURSOR` table below used to
- * carry Claude-vocabulary tool names — `Glob` alongside `Grep`, and
- * `StrReplace`/`Write`/`Edit`/`EditNotebook`/`MultiEdit` all denied — none of
- * which are real Cursor tool names. The docs' "Matcher Patterns" section
- * states verbatim: "preToolUse / postToolUse / postToolUseFailure: Filter by
- * tool type. Values include Shell, Read, Write, Grep, Delete, Task, and MCP
- * tools using the MCP:<tool_name> format." That is Cursor's *complete*
- * `tool_name` vocabulary for these two events — there is no `Glob`,
- * `StrReplace`, `Edit`, `EditNotebook`, or `MultiEdit` in it. `CURSOR` below
- * is corrected to that vocabulary: `Shell` → rewrite, `Grep` → deny (no
- * separate glob-like tool exists to also deny), `Read` → redirect, `Write` →
- * deny (the one edit-like tool Cursor actually has). `Delete`, `Task`, and
- * any `MCP:<tool_name>` call are intentionally left unmapped (no-op, same as
- * any tool name absent from a route's set) — enact-m5's real wiring never
- * named them for lean-ctx.
- *
- * A `preToolUse` payload's `tool_name` field (matched above) is documented
- * alongside `tool_input`, e.g. `{"tool_name": "Shell", "tool_input":
- * {"command": "npm install", "working_directory": "/project"}, ...}` — see
- * `../../pre-tool-use/handler.ts`'s `toDecideInput` for where the sibling
- * `tool_input.command` field (and `beforeShellExecution`'s top-level
- * `command`) get read.
- */
-
-import type { HostId } from '../contract.ts'
-
-export type LeanCtxDirection = 'pre' | 'post'
-
-interface ToolRoute {
-  readonly subcommand: string
-  readonly tools: ReadonlySet<string>
-}
-
-type HostRoutes = Readonly<Record<LeanCtxDirection, readonly ToolRoute[]>>
-
-const CLAUDE: HostRoutes = {
-  pre: [
-    { subcommand: 'rewrite', tools: new Set(['Bash', 'bash']) },
-    {
-      subcommand: 'redirect',
-      tools: new Set([
-        'Read', 'read', 'ReadFile', 'read_file', 'View', 'view',
-        'Grep', 'grep', 'Search', 'search',
-        'ListFiles', 'list_files', 'ListDirectory', 'list_directory',
-        'Glob', 'glob',
-      ]),
-    },
-  ],
-  post: [{ subcommand: 'read-dedup', tools: new Set(['Read']) }],
-}
-
-const CURSOR: HostRoutes = {
-  pre: [
-    { subcommand: 'rewrite', tools: new Set(['Shell']) },
-    { subcommand: 'deny', tools: new Set(['Grep']) },
-    { subcommand: 'redirect', tools: new Set(['Read']) },
-    { subcommand: 'deny', tools: new Set(['Write']) },
-  ],
-  post: [],
-}
-
-const CODEX: HostRoutes = {
-  pre: [{ subcommand: 'codex-pretooluse', tools: new Set(['Bash', 'Read', 'Grep', 'Glob']) }],
-  post: [],
-}
-
-const NONE: HostRoutes = { pre: [], post: [] }
-
-const ROUTES: Readonly<Record<HostId, HostRoutes>> = {
-  claude: CLAUDE,
-  cursor: CURSOR,
-  codex: CODEX,
-  kimi: NONE,
-  opencode: NONE,
-}
-
-/**
- * Resolve which `lean-ctx hook <subcommand>` a (host, direction, tool name)
- * triple maps to, or `null` when nothing matches — the caller's no-op case
- * (kimi/opencode always, and any tool name not named in the host's own
- * matcher above, e.g. an Edit under Claude, which has no lean-ctx PreToolUse
- * entry at all).
- */
-export function leanCtxSubcommand(host: HostId, direction: LeanCtxDirection, toolName: string): string | null {
-  const routes = ROUTES[host][direction]
-  for (const route of routes) {
-    if (route.tools.has(toolName)) return route.subcommand
-  }
-  return null
-}

package/packages/agent-hooks/src/hooks/lean-ctx/scope-rewrite.ts

@@ -1,207 +0,0 @@
-/**
- * G1 — carry this package's `LEAN_CTX_*` scope across lean-ctx's own rewrite.
- *
- * `lean-ctx hook rewrite` does not return a decision about the host's command;
- * it returns a REPLACEMENT command that re-execs lean-ctx by its own absolute
- * path, e.g. `/usr/local/bin/lean-ctx -c 'trash /tmp/x'` or
- * `/usr/local/bin/lean-ctx read README.md`. The host then runs that string in
- * the HOST's environment.
- *
- * That is the whole bug. `./index.ts` spawns its own child with the four dir
- * vars from `../../lean-ctx/env.ts`, so the child that makes the DECISION sees
- * the repo's `config.toml` (249 commands). But the replacement command is
- * executed by the host, whose environment carries only `LEAN_CTX_ACTIVE=1` and
- * `LEAN_CTX_WRAPPED=1` — the two the wrapper sets for itself, measured on this
- * machine — and never the four dir vars. So the process that ENFORCES resolves
- * the global XDG path, finds no `config.toml`, and silently falls back to
- * lean-ctx's 223 built-in defaults.
- *
- * The visible symptom is a deadlock between the two guards: `../../rules/` denies
- * `rm` and directs the caller to `trash`, and `trash` is in the repo allowlist —
- * but the unscoped re-exec answers "[BLOCKED — DO NOT RETRY] 'trash' is not in
- * the shell allowlist", so neither verb works. Both halves were measured
- * directly, 2026-09-15.
- *
- * Rooted at the caller's resolved git root, never `$PWD`. A `$PWD`-derived
- * scope reports 249 at the repo root and 223 from `<repo>/.agents` with no
- * error — one `cd` and the gate reverts to built-ins.
- *
- * Deliberately NOT solved with an env carrier in host config
- * (`.claude/settings.local.json` and friends): Cursor's project config is
- * permissions-only, Kimi reads a single user-level file, and Codex ignores
- * `[shell_environment_policy] set` for untrusted projects — so a carrier
- * cannot cover the hosts that need it. Rewriting the command reaches every
- * host that honours the rewrite, which is exactly the set that has the bug.
- */
-
-import { basename } from 'node:path'
-import { leanCtxEnvFor } from '../../lean-ctx/env.ts'
-import { resolveFromEnvOrFile } from '../../rules/impl/adl-identity.ts'
-import { rewriteGitNetworkCommands } from '../../rules/shell/git-identity.ts'
-
-/** The four dir vars, in the order they are prefixed. See `../../lean-ctx/env.ts`. */
-const SCOPED_VARS = [
-  'LEAN_CTX_CONFIG_DIR',
-  'LEAN_CTX_DATA_DIR',
-  'LEAN_CTX_STATE_DIR',
-  'LEAN_CTX_CACHE_DIR',
-] as const
-
-/** Basename the replacement command must invoke for it to be lean-ctx's own re-exec. */
-const WRAPPER = 'lean-ctx'
-
-/**
- * The three keys lean-ctx emits the replacement input under — one per host
- * protocol dialect, all three in every rewrite envelope. Captured verbatim
- * from the real v3.9.20 binary; all three must be scoped or a host reading
- * the shape we skipped would run the command unscoped.
- */
-const INPUT_PATHS: readonly (readonly string[])[] = [
-  ['hookSpecificOutput', 'updatedInput'],
-  ['modifiedArgs'],
-  ['updated_input'],
-]
-
-/** POSIX single-quoting: wrap in `'…'`, and close/escape/reopen around any embedded `'`. */
-function shellQuote(value: string): string {
-  return `'${value.replaceAll("'", "'\\''")}'`
-}
-
-/** `VAR='…' VAR='…' …` for `root`, derived from the one shared env helper so there is a single source of truth. */
-function scopePrefix(root: string): string {
-  const env = leanCtxEnvFor(root, {})
-  return SCOPED_VARS.map((name) => `${name}=${shellQuote(env[name] ?? '')}`).join(' ')
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-/**
- * Whether `command` is lean-ctx re-execing itself, and so ours to scope.
- *
- * Matched on the first token's BASENAME, not a fixed `/usr/local/bin` path, so
- * a non-standard install location still scopes. An already-scoped command
- * fails this test — its first token is a `VAR=…` assignment — which is what
- * makes this function idempotent; the explicit guard in `scopeRewrittenCommand`
- * does not rely on that, so this can be relaxed without silently double-scoping.
- */
-function isWrapperReexec(command: string): boolean {
-  const first = command.trimStart().split(/\s+/, 1)[0]
-  return first !== undefined && first.length > 0 && basename(first) === WRAPPER
-}
-
-/**
- * The EFFECTIVE identity to carry into git network commands inside a
- * rewritten command — L3 (STATUS.md 12p): steps
- * 2-3 of the standard, `../../rules/impl/adl-identity.ts`'s
- * `resolveFromEnvOrFile` (the session env `ADL_AGENT_ID_AGENT`, else the
- * machine default-agent file), not the session env var alone. This used to
- * read only `currentAgent` — the raw env var — which meant a session whose
- * identity resolved from the machine default-agent file (no
- * `ADL_AGENT_ID_AGENT` in the environment at all, e.g. a surface without an
- * `adl run --as` session) never got its lean-ctx `-c` re-exec's git network
- * commands carried, even though every OTHER identity-bearing surface in
- * this package (`../../pre-tool-use/handler.ts`'s rewrite, `../../rules/engine.ts`'s
- * own rewrite stage) already falls back to that file. The lean-ctx hook
- * kind runs in the same process the host spawned for `adl hook`, so
- * `inv.env` is the session env `adl run` set — the same environment the
- * rule engine resolves from.
- */
-export function sessionIdentityOf(env: Readonly<Record<string, string | undefined>>): string | null {
-  const resolution = resolveFromEnvOrFile({ get: (name) => env[name] })
-  return resolution.ok ? resolution.agent : null
-}
-
-/**
- * The machine-generated re-exec shapes lean-ctx emits for shell commands:
- * `<binary> -c '<script>'` (single- or double-quoted, `-c` or `--command`,
- * `=` or space separated). A non-shell rewrite (`lean-ctx read <path>`) has
- * no script and is not matched.
- */
-const REEXEC_SCRIPT_SINGLE = /^(\S+)\s+(?:-c|--command)(?:=|\s+)'((?:\\'|[^'])*)'\s*$/
-const REEXEC_SCRIPT_DOUBLE = /^(\S+)\s+(?:-c|--command)(?:=|\s+)"((?:\\"|[^"])*)"\s*$/
-
-/**
- * Carry `identity` into the git network commands of the script inside a
- * lean-ctx `-c` re-exec — one scanner (`rewriteGitNetworkCommands`), so the
- * prefix is byte-identical to the one `adl hook pre-tool-use` puts on the
- * native command. Returns the rebuilt command, or null when there is nothing
- * to carry (no script, non-git script, already-carried idempotently, or a
- * DENY outcome — a conflicting/unsafe inline identity is the pre-tool-use
- * guard's deny, never rewritten over here).
- */
-function carryIdentityIntoReexec(command: string, identity: string): string | null {
-  const match = REEXEC_SCRIPT_SINGLE.exec(command) ?? REEXEC_SCRIPT_DOUBLE.exec(command)
-  if (match === null) return null
-  const binary = match[1] as string
-  const script = match[2] as string
-  const outcome = rewriteGitNetworkCommands(script, identity)
-  if (outcome.kind !== 'rewrite') return null
-  return `${binary} -c ${shellQuote(outcome.command)}`
-}
-
-/**
- * Prefix the four dir vars onto every replacement command in a `lean-ctx hook`
- * stdout envelope, so the re-exec'd lean-ctx resolves the same `config.toml`
- * its parent did.
- *
- * Fail-open by construction: anything that is not a rewrite envelope carrying a
- * lean-ctx re-exec — a deny, a plain allow, a non-JSON line, empty output — is
- * returned as the IDENTICAL string. This sits in the hook's verbatim relay
- * path, so it must never be the reason a host's tool call breaks.
- *
- * 2026-09-28 — the two-envelope race: on Claude/Codex/Cursor a native shell
- * call gets TWO PreToolUse rewrites (this scope rewrite and the git-identity
- * rewrite in `../../pre-tool-use`), and the host applies only one of them
- * (Claude's hooks guide: "the last one to finish takes effect … the order is
- * non-deterministic"; Codex/Cursor specify no arbitration). So when the
- * session has an identity, the git network commands inside the `-c` script
- * are prefixed here too — whichever envelope the host picks authenticates
- * the push. Everything else about the envelope is unchanged.
- */
-export function scopeRewrittenCommand(stdout: string, root: string, identity: string | null = null): string {
-  if (stdout.trim().length === 0) return stdout
-
-  let parsed: unknown
-  try {
-    parsed = JSON.parse(stdout)
-  } catch {
-    return stdout
-  }
-  if (!isRecord(parsed)) return stdout
-
-  const prefix = scopePrefix(root)
-  let changed = false
-
-  for (const path of INPUT_PATHS) {
-    let node: unknown = parsed
-    for (const segment of path) {
-      if (!isRecord(node)) {
-        node = undefined
-        break
-      }
-      node = node[segment]
-    }
-    if (!isRecord(node)) continue
-
-    const command = node.command
-    if (typeof command !== 'string' || command.length === 0) continue
-    if (command.startsWith(`${SCOPED_VARS[0]}=`)) continue
-    if (!isWrapperReexec(command)) continue
-
-    let next = command
-    if (identity !== null) {
-      const carried = carryIdentityIntoReexec(next, identity)
-      if (carried !== null) next = carried
-    }
-
-    node.command = `${prefix} ${next}`
-    changed = true
-  }
-
-  if (!changed) return stdout
-
-  const trailing = stdout.slice(stdout.trimEnd().length)
-  return `${JSON.stringify(parsed)}${trailing}`
-}

package/packages/agent-hooks/src/lean-ctx/env.ts

@@ -1,123 +0,0 @@
-/**
- * Shared `LEAN_CTX_*` environment for every subprocess this package spawns
- * into the global `lean-ctx` binary (installed fleet-wide on `PATH` by
- * global-tools — see `../hooks/briefing/index.ts`'s header for why the
- * binary itself is never repo-local here).
- *
- * `lean-ctx` reads four env vars to root its own config/data/state/cache
- * per-invocation (confirmed directly against the real v3.9.20 binary via
- * `strings` and `lean-ctx doctor --json`, this session, 2026-09-14 — they do
- * not appear in `lean-ctx --help`'s documented list, which only advertises
- * the unrelated `LEAN_CTX_DISABLED`/`LEAN_CTX_RAW`/... shell-hook toggles):
- *
- *   - `LEAN_CTX_CONFIG_DIR` — directly the app's own config dir (i.e. already
- *     including the trailing `lean-ctx` segment, mirroring
- *     `XDG_CONFIG_HOME/lean-ctx`'s resolved value, not `XDG_CONFIG_HOME`
- *     itself) — `lean-ctx doctor --json` reports `config.toml exists` at
- *     exactly `<this>/config.toml`.
- *   - `LEAN_CTX_DATA_DIR`, `LEAN_CTX_STATE_DIR`, `LEAN_CTX_CACHE_DIR` — same
- *     shape, for lean-ctx's data/state/cache.
- *
- * Verified end-to-end this session: pointing these four vars at
- * `enact-m5`'s real `.agents/lean-ctx/{config/lean-ctx,data,state,cache}`
- * (which carries a real `config.toml`) makes `lean-ctx doctor --json` report
- * "Shell allowlist 249 command(s) enforced"; the same binary with these vars
- * pointed at an empty scratch directory (no config.toml at all) reports 223 —
- * proof the binary actually reads these vars to resolve its per-repo config,
- * not just a coincidence of directory layout.
- *
- * HARDCUT (work item A.3): this replaces the plain `XDG_CONFIG_HOME`/
- * `XDG_DATA_HOME`/`XDG_STATE_HOME`/`XDG_CACHE_HOME` vars `../hooks/briefing/index.ts`
- * used to set for the same purpose — those are a generic Unix convention
- * lean-ctx does not actually key its own dir resolution on (its shell-hook
- * script derives ITS OWN unrelated `_LEAN_CTX_STATE_DIR` from
- * `XDG_STATE_HOME`, but the compiled binary invoked here never consults it).
- * Every call site that used to build its own `XDG_*` env now imports this
- * one helper instead, so config/data/state/cache resolution for lean-ctx
- * lives in exactly one place.
- */
-
-import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-import { decodeConfig } from '../gating/config.ts'
-import { MARKER } from '../gating/root.ts'
-
-/**
- * Repo-relative root every lean-ctx call's config/data/state/cache lives
- * under, when `adl-config.toml`'s `[hooks] lean_ctx_dir` does not say
- * otherwise.
- */
-export const DEFAULT_LEAN_CTX_DIR = '.agents/lean-ctx'
-
-/**
- * Resolve `[hooks] lean_ctx_dir` for `root`.
- *
- * Mirrors `../hooks/user-prompt-submit/handler.ts`'s `resolveSkillsDir`: an
- * explicit key wins; a missing `adl-config.toml` falls back to the default
- * (handlers are callable directly from tests, without the gating `main.ts`
- * normally performs); a file that exists but fails to decode throws, so a
- * typo'd key is a loud error rather than a silent revert to the default.
- */
-export function resolveLeanCtxDir(root: string): string {
-  const configPath = join(root, MARKER)
-  if (!existsSync(configPath)) return DEFAULT_LEAN_CTX_DIR
-
-  const decoded = decodeConfig(readFileSync(configPath, 'utf8'))
-  if (!decoded.ok) {
-    throw new Error(`invalid ${configPath} at ${decoded.issue.pointer}: ${decoded.issue.message}`)
-  }
-
-  return decoded.value.hooks.leanCtxDir ?? DEFAULT_LEAN_CTX_DIR
-}
-
-/**
- * Set on EVERY `lean-ctx` child this package spawns, managed repo or not.
- *
- * lean-ctx 3.10.5's MCP `initialize` handler runs a startup maintenance
- * block that calls `refresh_installed_hooks()`, re-writing raw
- * `lean-ctx hook …` entries into the GLOBAL `~/.claude/settings.json`
- * (upstream `rust/src/server/server_handler.rs` ~L180-209, issue #1879).
- * `[setup] auto_inject_*` does not gate it; the only switch in that release
- * is `LEAN_CTX_HEADLESS` (any value), checked first in that block. Measured
- * 2026-09-30 on a real $HOME: unset → nine global hook entries re-appeared
- * seconds after start; set → none, and the same 12 MCP tools are served.
- * Those global hooks are what put lean-ctx's global shell allowlist in front
- * of agents in unrelated, unmanaged folders — lean-ctx stays repo-local only.
- */
-export const LEAN_CTX_HEADLESS_ENV: Readonly<Record<'LEAN_CTX_HEADLESS', string>> = { LEAN_CTX_HEADLESS: '1' }
-
-/**
- * Build the env for a `lean-ctx` subprocess rooted at repository `root`,
- * merged over `base` (normally `inv.env`/`process.env`) so every other
- * ambient var — `PATH` included — still reaches the child.
- */
-export function leanCtxEnv(
-  root: string,
-  base: Readonly<Record<string, string | undefined>>,
-  leanCtxDir: string = DEFAULT_LEAN_CTX_DIR,
-): Record<string, string | undefined> {
-  return {
-    ...base,
-    LEAN_CTX_CONFIG_DIR: join(root, leanCtxDir, 'config/lean-ctx'),
-    LEAN_CTX_DATA_DIR: join(root, leanCtxDir, 'data'),
-    LEAN_CTX_STATE_DIR: join(root, leanCtxDir, 'state'),
-    LEAN_CTX_CACHE_DIR: join(root, leanCtxDir, 'cache'),
-    ...LEAN_CTX_HEADLESS_ENV,
-  }
-}
-
-/**
- * `leanCtxEnv` with the dir root read from `root`'s own `adl-config.toml`.
- *
- * Every production call site uses THIS rather than the pure form above, so
- * the process that DECIDES and the process that ENFORCES derive their scope
- * from one configured value — the single source of truth this module exists
- * for, and the invariant G1 turned on.
- */
-export function leanCtxEnvFor(
-  root: string,
-  base: Readonly<Record<string, string | undefined>>,
-): Record<string, string | undefined> {
-  return leanCtxEnv(root, base, resolveLeanCtxDir(root))
-}