@aria_asi/cli 0.2.25 → 0.2.29

package/src/connectors/codex.ts

@@ -0,0 +1,274 @@
+// ARIA_ALLOW_STUB: doctrine strings only; this source generates enforcement copy and is not a production stub implementation.
+
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  statSync,
+  copyFileSync,
+  chmodSync,
+  writeFileSync,
+} from 'fs';
+import { homedir } from 'os';
+import * as path from 'path';
+import { fileURLToPath } from 'node:url';
+import type { AriaConfig } from '../config.js';
+import { connectShell } from './shell.js';
+import { installAriaCognitionSkills } from './cognitive-skills.js';
+
+function packageSdkDir(): string {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(here, '..', '..', '..', 'sdk');
+}
+
+function installSdk(codexDir: string, logs: string[]): void {
+  const sdkSrc = packageSdkDir();
+  if (!existsSync(sdkSrc)) {
+    logs.push(`⚠ SDK bundle missing: ${sdkSrc} (run npm run build)`);
+    return;
+  }
+
+  const sdkDst = path.join(codexDir, 'aria-sdk');
+  if (!existsSync(sdkDst)) {
+    mkdirSync(sdkDst, { recursive: true, mode: 0o700 });
+  }
+
+  let copied = 0;
+  for (const name of readdirSync(sdkSrc)) {
+    const src = path.join(sdkSrc, name);
+    if (!statSync(src).isFile()) continue;
+    copyFileSync(src, path.join(sdkDst, name));
+    copied++;
+  }
+  logs.push(`Installed Aria SDK (${copied} files) → ${sdkDst}`);
+}
+
+function installNodePackage(codexDir: string, logs: string[]): void {
+  const sdkSrc = packageSdkDir();
+  if (!existsSync(sdkSrc)) return;
+
+  const pkgRoot = path.join(codexDir, 'node_modules', '@aria_asi', 'harness-http-client');
+  const distRoot = path.join(pkgRoot, 'dist');
+  mkdirSync(distRoot, { recursive: true, mode: 0o755 });
+
+  for (const name of readdirSync(sdkSrc)) {
+    const src = path.join(sdkSrc, name);
+    if (!statSync(src).isFile()) continue;
+    if (name === 'package.json' || name === 'BUNDLED.json') continue;
+    copyFileSync(src, path.join(distRoot, name));
+  }
+
+  writeFileSync(
+    path.join(pkgRoot, 'package.json'),
+    JSON.stringify({
+      name: '@aria_asi/harness-http-client',
+      version: '0.1.1',
+      description: 'Bundled Aria harness HTTP client for Codex installs',
+      type: 'module',
+      main: './dist/index.js',
+      types: './dist/index.d.ts',
+      exports: {
+        '.': {
+          types: './dist/index.d.ts',
+          import: './dist/index.js',
+        },
+      },
+      private: false,
+    }, null, 2) + '\n',
+    { mode: 0o644 },
+  );
+
+  logs.push(`Installed Codex Node package → ${pkgRoot}`);
+}
+
+function buildCodexSkill(_config: AriaConfig): string {
+  return `---
+name: aria-http-harness-client
+description: "Use when the task needs Aria's canonical HTTP harness client from Codex, including HTTPHarnessClient imports, harness packet fetch and injection, consult calls, output validation, claim verification, discovery recording, garden turns, or harness-bound worker handoff. Trigger on \\"$aria-http-harness-client\\", \\"HTTPHarnessClient\\", \\"@aria_asi/harness-http-client\\", \\"harness client\\", \\"Aria harness SDK\\", \\"consult via harness\\", \\"verify claim\\", or \\"garden turn\\"."
+---
+
+# Aria HTTP Harness Client
+
+Use this skill when Codex should route through Aria's canonical harness control plane instead of inventing an ad hoc wrapper.
+
+## Installed Paths
+
+- Shared runtime bundle: \`${path.join(homedir(), '.aria', 'sdk')}\`
+- Codex local bundle: \`${path.join(homedir(), '.codex', 'aria-sdk')}\`
+- Node import package: \`${path.join(homedir(), '.codex', 'node_modules', '@aria_asi', 'harness-http-client')}\`
+- Smoke script: \`${path.join(homedir(), '.codex', 'skills', 'aria-http-harness-client', 'scripts', 'smoke.mjs')}\`
+- Mounted runtime: \`http://127.0.0.1:4319\`
+
+## Core Rule
+
+Do not hardcode Aria tokens into code or the skill. Read them from environment variables such as \`ARIA_API_KEY\` or \`ARIA_MASTER_TOKEN\`, or retrieve them at runtime from the live environment.
+
+## Reality Check
+
+Codex should prefer the mounted runtime first, then the shared SDK, then the Codex-local SDK bundle.
+
+That means:
+
+- the mounted runtime is the universal control plane
+- the shared SDK at \`~/.aria/sdk\` is the universal client substrate
+- Codex still does not expose Claude-style native user hook interception, so explicit runtime or SDK calls are still required for hard guarantees on this platform
+
+## Preferred Call Paths
+
+Use the mounted runtime whenever possible:
+
+\`\`\`bash
+curl -s http://127.0.0.1:4319/health
+\`\`\`
+
+or from Node:
+
+\`\`\`js
+import { HTTPHarnessClient } from '@aria_asi/harness-http-client';
+\`\`\`
+
+## Fast Verification
+
+Run:
+
+\`\`\`bash
+node ${path.join(homedir(), '.codex', 'skills', 'aria-http-harness-client', 'scripts', 'smoke.mjs')}
+\`\`\`
+
+For a live packet fetch, set \`ARIA_API_KEY\` or \`ARIA_MASTER_TOKEN\`, then run:
+
+\`\`\`bash
+node ${path.join(homedir(), '.codex', 'skills', 'aria-http-harness-client', 'scripts', 'smoke.mjs')} --packet
+\`\`\`
+`;
+}
+
+function buildCodexAgentsMd(config: AriaConfig): string {
+  const repoList = config.repositories.map((r) => `- ${r.name} (${r.path})`).join('\n');
+  const schemaText = Object.entries(config.schemaImages)
+    .map(([name, image]) => `### ${name}\n${image}`)
+    .join('\n\n');
+
+  return `# Aria Harness — AGENTS.md
+
+Automatically injected by @aria_asi/cli. These instructions are always on for Codex sessions.
+
+## Connected Repositories
+${repoList || '(none linked yet)'}
+
+## Schema Images
+${schemaText || '(no schema images yet — run \`aria repo scan\`)'}
+
+## Self-Gate Protocol
+1. Truth over deception — always.
+2. No harm supersedes any advantage.
+3. Sacred trust — never betray.
+4. Power obligates service.
+5. Reflection before action.
+
+## Repo Doctrine
+- Treat any repo edit, hook, runtime change, smoke script, migration, scaffold, or quick fix as production-intent unless it is clearly isolated under tests, specs, fixtures, examples, demos, or mocks.
+- Never introduce stub, mock, fake, placeholder, "implementation pending", "not implemented", "coming soon", or "will be wired" semantics into doctrine-bound production paths.
+- If verification needs a script, hit the real runtime, real endpoint, real handler, or real diff. Do not author fake validation just to satisfy a step.
+- If a fix only works by weakening the contract, the mechanism is still broken. Debug the mechanism.
+
+## 8-Lens Cognition
+Apply multi-perspective analysis for every decision:
+- Truth lens: Is this factually correct?
+- Harm lens: Could this cause damage?
+- Trust lens: Does this maintain sacred trust?
+- Power lens: Am I using capability responsibly?
+- Reflection lens: Have I thought deeply enough?
+- Context lens: Do I have full context?
+- Impact lens: What are second-order effects?
+- Beauty lens: Is this elegant and sustainable?
+`;
+}
+
+function buildSmokeScript(): string {
+  return `#!/usr/bin/env node
+
+import { HTTPHarnessClient } from '@aria_asi/harness-http-client';
+
+const args = new Set(process.argv.slice(2));
+const wantsPacket = args.has('--packet');
+
+const runtimeUrl = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\\/+$/, '');
+let runtimeStatus = 'unreachable';
+try {
+  const health = await fetch(\`\${runtimeUrl}/health\`);
+  if (health.ok) runtimeStatus = 'ok';
+} catch {}
+
+const proto = HTTPHarnessClient.prototype;
+const methods = Object.getOwnPropertyNames(proto)
+  .filter((name) => name !== 'constructor' && typeof proto[name] === 'function')
+  .sort();
+
+console.log('module=@aria_asi/harness-http-client');
+console.log('class=HTTPHarnessClient');
+console.log(\`runtime=\${runtimeUrl}\`);
+console.log(\`runtime_status=\${runtimeStatus}\`);
+console.log(\`methods=\${methods.join(',')}\`);
+
+if (!wantsPacket) process.exit(0);
+
+const apiKey = process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN;
+if (!apiKey) {
+  console.error('missing ARIA_API_KEY or ARIA_MASTER_TOKEN');
+  process.exit(1);
+}
+
+const baseUrl =
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
+const client = new HTTPHarnessClient({ baseUrl, apiKey });
+const packet = await client.getHarnessPacket({
+  sessionId: process.env.ARIA_HARNESS_SESSION_ID || 'codex-harness-smoke',
+  platform: 'codex',
+  message: 'refresh',
+});
+
+console.log(\`packetVersion=\${packet.version || 'unknown'}\`);
+console.log(\`packetTimestamp=\${packet.timestamp || 'unknown'}\`);
+console.log(\`packetKeys=\${Object.keys(packet.packet || {}).join(',')}\`);
+`;
+}
+
+function installSkill(codexDir: string, config: AriaConfig, logs: string[]): void {
+  const skillDir = path.join(codexDir, 'skills', 'aria-http-harness-client');
+  const scriptDir = path.join(skillDir, 'scripts');
+  mkdirSync(scriptDir, { recursive: true, mode: 0o755 });
+
+  writeFileSync(path.join(skillDir, 'SKILL.md'), buildCodexSkill(config), { mode: 0o644 });
+  const smokePath = path.join(scriptDir, 'smoke.mjs');
+  writeFileSync(smokePath, buildSmokeScript(), { mode: 0o755 });
+  try { chmodSync(smokePath, 0o755); } catch {}
+
+  logs.push(`Installed Codex harness skill → ${skillDir}`);
+}
+
+function installAgentsMd(codexDir: string, config: AriaConfig, logs: string[]): void {
+  const agentsPath = path.join(codexDir, 'AGENTS.md');
+  writeFileSync(agentsPath, buildCodexAgentsMd(config), { mode: 0o644 });
+  logs.push(`Installed Codex AGENTS.md → ${agentsPath}`);
+}
+
+export async function connectCodex(config: AriaConfig): Promise<string[]> {
+  const logs: string[] = [];
+  const codexDir = path.join(homedir(), '.codex');
+
+  if (!existsSync(codexDir)) {
+    mkdirSync(codexDir, { recursive: true, mode: 0o700 });
+    logs.push(`Created ${codexDir}`);
+  }
+
+  installSdk(codexDir, logs);
+  installNodePackage(codexDir, logs);
+  installAgentsMd(codexDir, config, logs);
+  installSkill(codexDir, config, logs);
+  installAriaCognitionSkills(codexDir, logs);
+  logs.push(...await connectShell('codex', config));
+  return logs;
+}

package/src/connectors/cognitive-skills.ts

@@ -0,0 +1,51 @@
+import { existsSync, mkdirSync, readdirSync, statSync, copyFileSync } from 'fs';
+import { homedir } from 'os';
+import * as path from 'path';
+import { fileURLToPath } from 'node:url';
+
+function packageSkillsRoot(): string {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path.resolve(here, '..', '..', '..', '..', 'skills', 'aria-cognition'),
+    path.resolve(here, '..', '..', '..', 'runtime', 'discipline', 'skills', 'aria-cognition'),
+  ];
+  const found = candidates.find((candidate) => existsSync(candidate));
+  return found || candidates[0];
+}
+
+function copyTree(srcDir: string, dstDir: string): void {
+  mkdirSync(dstDir, { recursive: true, mode: 0o755 });
+  for (const name of readdirSync(srcDir)) {
+    const src = path.join(srcDir, name);
+    const dst = path.join(dstDir, name);
+    const stat = statSync(src);
+    if (stat.isDirectory()) {
+      copyTree(src, dst);
+      continue;
+    }
+    copyFileSync(src, dst);
+  }
+}
+
+export function installAriaCognitionSkills(codexDir: string, logs: string[]): void {
+  const skillsRoot = packageSkillsRoot();
+  if (!existsSync(skillsRoot)) {
+    logs.push(`⚠ Aria cognition skill pack missing: ${skillsRoot}`);
+    return;
+  }
+
+  const codexSkillsDir = path.join(codexDir, 'skills');
+  const agentSkillsDir = path.join(homedir(), '.agents', 'skills');
+  mkdirSync(codexSkillsDir, { recursive: true, mode: 0o755 });
+  mkdirSync(agentSkillsDir, { recursive: true, mode: 0o755 });
+
+  for (const skillName of readdirSync(skillsRoot)) {
+    const src = path.join(skillsRoot, skillName);
+    if (!statSync(src).isDirectory()) continue;
+    copyTree(src, path.join(codexSkillsDir, skillName));
+    copyTree(src, path.join(agentSkillsDir, skillName));
+  }
+
+  logs.push(`Installed Aria cognition skills → ${codexSkillsDir}`);
+  logs.push(`Installed Aria cognition skills → ${agentSkillsDir}`);
+}

package/src/connectors/opencode.ts

@@ -1,3 +1,5 @@
+// ARIA_ALLOW_STUB: doctrine strings only; this source generates enforcement copy and is not a production stub implementation.
+
 import {
   existsSync,
   mkdirSync,
@@ -13,14 +15,15 @@ import { homedir } from 'os';
 import * as path from 'path';
 import { fileURLToPath } from 'node:url';
 import type { AriaConfig } from '../config.js';
+import { connectShell } from './shell.js';
 
 // ── Bundled OpenCode plugins ────────────────────────────────────────────────
 //
 // Two plugins ship with the connector:
 //   - harness-context: spawns the bundled inject-context.mjs on session start
 //                      and prepends the resolved harness packet to OpenCode's
-//                      system prompt. Routes through the canonical SDK at
-//                      ~/.claude/aria-sdk/.
+//                      system prompt. Routes through the mounted runtime
+//                      first, then the shared SDK at ~/.aria/sdk/.
 //   - harness-role:    injects the active role profile (default
 //                      opencode_deepseek_engineer) — intro / continuity /
 //                      post-action governance rules.
@@ -33,11 +36,17 @@ import type { AriaConfig } from '../config.js';
 //   <pkg>/dist/aria-connector/src/connectors/opencode.js
 // Plugins ship at <pkg>/opencode-plugins/ → 4 dirs up + 'opencode-plugins'.
 
-const PLUGIN_NAMES = ['harness-context', 'harness-role'] as const;
+const PLUGIN_NAMES = ['harness-context', 'harness-role', 'harness-gate', 'harness-stop', 'harness-outcome'] as const;
+const LOCAL_RUNTIME_V1_URL = 'http://127.0.0.1:4319/v1';
 
 function packageOpenCodePluginsDir(): string {
   const here = path.dirname(fileURLToPath(import.meta.url));
-  return path.resolve(here, '..', '..', '..', '..', 'opencode-plugins');
+  const candidates = [
+    path.resolve(here, '..', '..', '..', '..', 'opencode-plugins'),
+    path.resolve(here, '..', '..', '..', 'assets', 'opencode-plugins'),
+  ];
+  const found = candidates.find((candidate) => existsSync(candidate));
+  return found || candidates[0];
 }
 
 function copyPluginDir(srcDir: string, dstDir: string, logs: string[]): void {
@@ -61,6 +70,30 @@ function copyPluginDir(srcDir: string, dstDir: string, logs: string[]): void {
   logs.push(`Installed plugin → ${dstDir}`);
 }
 
+function resolveLocalRuntimeToken(): string {
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  if (process.env.ARIA_MASTER_TOKEN) return process.env.ARIA_MASTER_TOKEN;
+
+  const ownerTokenPath = path.join(homedir(), '.aria', 'owner-token');
+  if (existsSync(ownerTokenPath)) {
+    try {
+      const token = readFileSync(ownerTokenPath, 'utf8').trim();
+      if (token) return token;
+    } catch {}
+  }
+
+  const licensePath = path.join(homedir(), '.aria', 'license.json');
+  if (existsSync(licensePath)) {
+    try {
+      const license = JSON.parse(readFileSync(licensePath, 'utf8'));
+      if (typeof license?.token === 'string' && license.token.trim()) return license.token.trim();
+    } catch {}
+  }
+
+  return '';
+}
+
 export async function connectOpenCode(config: AriaConfig): Promise<string[]> {
   const logs: string[] = [];
   const opencodeDir = path.join(homedir(), '.opencode');
@@ -161,6 +194,55 @@ export async function connectOpenCode(config: AriaConfig): Promise<string[]> {
         logs.push('Set OpenCode AGENTS.md path to ~/.aria/AGENTS.md');
       }
 
+      const providerMap = opencodeConfig.provider && typeof opencodeConfig.provider === 'object'
+        ? opencodeConfig.provider as Record<string, unknown>
+        : {};
+      const currentAriaProvider = providerMap.aria && typeof providerMap.aria === 'object'
+        ? providerMap.aria as Record<string, unknown>
+        : {};
+      const localToken = resolveLocalRuntimeToken();
+      const nextAriaProvider = {
+        npm: '@ai-sdk/openai-compatible',
+        name: 'Aria Runtime',
+        endpoint: LOCAL_RUNTIME_V1_URL,
+        apiKey: localToken || (typeof currentAriaProvider.apiKey === 'string' ? currentAriaProvider.apiKey : ''),
+      };
+      const currentEndpoint = typeof currentAriaProvider.endpoint === 'string' ? currentAriaProvider.endpoint : '';
+      const currentApiKey = typeof currentAriaProvider.apiKey === 'string' ? currentAriaProvider.apiKey : '';
+      const currentName = typeof currentAriaProvider.name === 'string' ? currentAriaProvider.name : '';
+      const currentNpm = typeof currentAriaProvider.npm === 'string' ? currentAriaProvider.npm : '';
+      if (
+        currentEndpoint !== nextAriaProvider.endpoint ||
+        currentApiKey !== nextAriaProvider.apiKey ||
+        currentName !== nextAriaProvider.name ||
+        currentNpm !== nextAriaProvider.npm
+      ) {
+        opencodeConfig.provider = {
+          ...providerMap,
+          aria: nextAriaProvider,
+        };
+        modified = true;
+        logs.push('Rewired OpenCode aria provider to the mounted local runtime');
+      }
+
+      const enabledProviders = Array.isArray(opencodeConfig.enabled_providers)
+        ? (opencodeConfig.enabled_providers as unknown[]).filter((entry): entry is string => typeof entry === 'string')
+        : [];
+      if (!enabledProviders.includes('aria')) {
+        opencodeConfig.enabled_providers = ['aria', ...enabledProviders];
+        modified = true;
+        logs.push('Enabled OpenCode aria provider');
+      }
+
+      if (Array.isArray(opencodeConfig.disabled_providers)) {
+        const nextDisabled = (opencodeConfig.disabled_providers as unknown[]).filter((entry) => entry !== 'aria');
+        if (nextDisabled.length !== (opencodeConfig.disabled_providers as unknown[]).length) {
+          opencodeConfig.disabled_providers = nextDisabled;
+          modified = true;
+          logs.push('Removed aria from OpenCode disabled providers');
+        }
+      }
+
       if (modified) {
         writeFileSync(configPath, JSON.stringify(opencodeConfig, null, 2));
       } else {
@@ -180,6 +262,7 @@ export async function connectOpenCode(config: AriaConfig): Promise<string[]> {
   const agentsContent = buildOpenCodeAgentsMd(config);
   writeFileSync(ariaAgentsPath, agentsContent);
   logs.push(`Wrote Aria harness AGENTS.md to ${ariaAgentsPath}`);
+  logs.push(...await connectShell('opencode', config));
 
   return logs;
 }
@@ -247,6 +330,12 @@ ${schemaText || '(no schema images yet — run \`aria repo scan\`)'}
 4. Power obligates service.
 5. Reflection before action.
 
+## Repo Doctrine
+- Treat any repo edit, hook, runtime change, smoke script, migration, scaffold, or quick fix as production-intent unless it is clearly isolated under tests, specs, fixtures, examples, demos, or mocks.
+- Never introduce stub, mock, fake, placeholder, "implementation pending", "not implemented", "coming soon", or "will be wired" semantics into doctrine-bound production paths.
+- If verification needs a script, hit the real runtime, real endpoint, real handler, or real diff. Do not author fake validation just to satisfy a step.
+- If a fix only works by weakening the contract, the mechanism is still broken. Debug the mechanism.
+
 ## 8-Lens Cognition
 Apply multi-perspective analysis for every decision:
 - Truth lens: Is this factually correct?

package/src/connectors/repo-git-hooks.ts

@@ -0,0 +1,86 @@
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { execFileSync } from 'child_process';
+import * as path from 'path';
+import type { AriaConfig } from '../config.js';
+
+function resolveGitDir(repoPath: string): string | null {
+  try {
+    const raw = execFileSync('git', ['-C', repoPath, 'rev-parse', '--git-dir'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    return path.isAbsolute(raw) ? raw : path.join(repoPath, raw);
+  } catch {
+    return null;
+  }
+}
+
+function writeHook(hooksDir: string, hookName: 'pre-commit' | 'pre-push', logs: string[]): void {
+  const hookPath = path.join(hooksDir, hookName);
+  const prevPath = `${hookPath}.pre-aria`;
+  const marker = 'ARIA_REPO_DOCTRINE_GATE';
+
+  if (existsSync(hookPath)) {
+    try {
+      const existing = readFileSync(hookPath, 'utf8');
+      if (!existing.includes(marker) && !existsSync(prevPath)) {
+        renameSync(hookPath, prevPath);
+        logs.push(`Backed up existing ${hookName} hook → ${path.basename(prevPath)}`);
+      } else if (existing.includes(marker)) {
+        // We overwrite our own wrapper idempotently below.
+      }
+    } catch {}
+  }
+
+  const body = hookName === 'pre-push'
+    ? `#!/usr/bin/env bash
+set -euo pipefail
+# ${marker}
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+TMP_INPUT="$(mktemp)"
+cat > "$TMP_INPUT"
+cleanup() { rm -f "$TMP_INPUT"; }
+trap cleanup EXIT
+if [[ -x "$HOOK_DIR/${hookName}.pre-aria" ]]; then
+  "$HOOK_DIR/${hookName}.pre-aria" "$@" < "$TMP_INPUT"
+fi
+node "$HOME/.claude/hooks/aria-repo-doctrine-gate.mjs" --mode push --repo "$(git rev-parse --show-toplevel 2>/dev/null || pwd)" "$@" < "$TMP_INPUT"
+`
+    : `#!/usr/bin/env bash
+set -euo pipefail
+# ${marker}
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [[ -x "$HOOK_DIR/${hookName}.pre-aria" ]]; then
+  "$HOOK_DIR/${hookName}.pre-aria" "$@"
+fi
+exec node "$HOME/.claude/hooks/aria-repo-doctrine-gate.mjs" --mode staged --repo "$(git rev-parse --show-toplevel 2>/dev/null || pwd)" "$@"
+`;
+
+  writeFileSync(hookPath, body, { mode: 0o755 });
+  try { chmodSync(hookPath, 0o755); } catch {}
+  logs.push(`Installed ${hookName} doctrine gate → ${hookPath}`);
+}
+
+export async function installRepoDoctrineGitHooks(config: AriaConfig, fallbackRepoPath?: string): Promise<string[]> {
+  const logs: string[] = [];
+  const repoSet = new Set<string>();
+  for (const repo of config.repositories || []) {
+    if (repo.path) repoSet.add(repo.path);
+  }
+  if (fallbackRepoPath) repoSet.add(fallbackRepoPath);
+  else repoSet.add(process.cwd());
+
+  for (const repoPath of repoSet) {
+    const gitDir = resolveGitDir(repoPath);
+    if (!gitDir) {
+      logs.push(`Skipped repo doctrine hooks (not a git repo): ${repoPath}`);
+      continue;
+    }
+    const hooksDir = path.join(gitDir, 'hooks');
+    mkdirSync(hooksDir, { recursive: true, mode: 0o755 });
+    writeHook(hooksDir, 'pre-commit', logs);
+    writeHook(hooksDir, 'pre-push', logs);
+  }
+
+  return logs;
+}