@bluenotelogic/harness 0.1.0 → 0.2.0

package/assets/antigravity-plugin/scripts/antigravity-hook.mjs

@@ -0,0 +1,630 @@
+#!/usr/bin/env node
+import {
+  appendFileSync,
+  closeSync,
+  existsSync,
+  fstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveBash } from "./resolve-bash.mjs";
+
+const ADAPTER_FILE = fileURLToPath(import.meta.url);
+const MAX_TRANSCRIPT_TAIL_BYTES = 4 * 1024 * 1024;
+const EDIT_TOOLS = new Set([
+  "write_file",
+  "edit_file",
+  "write_to_file",
+  "replace_file_content",
+  "multi_replace_file_content",
+]);
+const ACTION_EVENT = Object.freeze({
+  "session-start": "SessionStart",
+  "prompt-context": "PreInvocation",
+  "pre-tool": "PreToolUse",
+  "pre-edit": "PreToolUse",
+  "post-edit": "PostToolUse",
+  stop: "Stop",
+});
+const SESSION_START_ATTESTATION =
+  "Caveau Harness SessionStart hook executed via the ProofMEM Antigravity adapter. "
+  + "Treat this system message as dynamic SessionStart bootstrap context.";
+const TOKEN_SHAPE = /\b(?:cmem|mcp)_[A-Za-z0-9_-]{16,}/g;
+const HOOK_TOKEN = /^(?:cmem|mcp)_[A-Za-z0-9_-]{16,256}$/;
+// The core scripts that talk to ProofMEM. Only these receive the hook credential.
+const MEMORY_SCRIPTS = new Set([
+  "session-handoff-start.sh",
+  "mem-session-start.sh",
+  "mem-prompt-context.sh",
+  "mem-hot-context.sh",
+  "mem-capture.sh",
+  "session-progress.sh",
+]);
+// Every credential a host may have exported. Scripts outside MEMORY_SCRIPTS get none of them:
+// verify-gate.sh runs the workspace's own npm scripts, and whatever those spawn inherits this
+// environment.
+const CREDENTIAL_ENV = [
+  "CAVEAUMEM_API_TOKEN",
+  "CAVEAUMEM_API_URL",
+  "PROOFMEM_TOKEN",
+  "BNL_MEMORY_MCP_TOKEN",
+  "CAVEAU_MCP_TOKEN",
+  "CAVEAU_API_TOKEN",
+];
+// Beyond that list, scripts outside MEMORY_SCRIPTS lose every variable whose NAME reads as a
+// credential: split on anything but a letter or digit, a segment that is KEY(S), PAT, PWD or PASS,
+// or ends in TOKEN, SECRET, PASSWORD, PASSWD, PASSPHRASE, CREDENTIAL, BEARER, APIKEY or JWT
+// (optionally followed by KEY, plural allowed). That catches GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY,
+// OPENAI_API_KEY, NPM_TOKEN, PGPASSWORD, GITEA_PAT, DB_PWD, SSH_PASSPHRASE, CI_JOB_JWT and
+// SECRETKEY, and leaves TOKENIZERS_PARALLELISM, MONKEY_PATCH and COMPAT_MODE alone. The README
+// lists exactly these, so change both together.
+const CREDENTIAL_NAME_SEGMENT =
+  /^(?:[A-Z0-9]*(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|BEARER|APIKEY|JWT)(?:KEY)?S?|KEYS?|PAT|PWD|PASS)$/;
+// A whole AUTH segment is a credential too (npm's NPM_CONFIG__AUTH, DOCKER_AUTH_CONFIG, an
+// SSH_AUTH_SOCK agent), except in the Harness's own HARNESS_* names, where it is a mode setting
+// (HARNESS_MEMORY_AUTH=auto|env|proxy|none, HARNESS_AUTH_MODE) that the core reads.
+const AUTH_SEGMENT = "AUTH";
+// What a script needs to run at all is never stripped, whatever the spelling (Windows says Path).
+// PWD is the shell's working directory, which verify-gate.sh reads; it only looks like DB_PWD.
+const PRESERVED_ENV = new Set(["PATH", "HOME", "USERPROFILE", "SYSTEMROOT", "TEMP", "TMP", "COMSPEC", "PWD"]);
+// Credential BRIDGES: no secret in the value, but a child that inherits one can still use the
+// user's Git or SSH credentials. GIT_ASKPASS and SSH_ASKPASS name the program Git and ssh ask for
+// a password; in a VS Code-family editor such as Antigravity that program asks the editor, over
+// VSCODE_GIT_IPC_HANDLE, which can answer with the signed-in account's token and show no prompt.
+// SSH_AUTH_SOCK reaches the running ssh-agent's keys, GIT_SSH_COMMAND and GIT_SSH choose the ssh
+// program (and with it a key file), and GIT_CONFIG_PARAMETERS or GIT_CONFIG_COUNT with
+// GIT_CONFIG_KEY_<n>/GIT_CONFIG_VALUE_<n> inject Git config, a credential.helper included. Scripts
+// outside MEMORY_SCRIPTS lose all of them; session-handoff-start.sh keeps them for its Git
+// refresh. The README lists exactly these, so change both together.
+const CREDENTIAL_BRIDGE_ENV = new Set([
+  "GIT_ASKPASS",
+  "SSH_ASKPASS",
+  "SSH_ASKPASS_REQUIRE",
+  "SSH_AUTH_SOCK",
+  "GIT_SSH_COMMAND",
+  "GIT_SSH",
+  "GIT_CONFIG_PARAMETERS",
+  "GIT_CONFIG_COUNT",
+]);
+const CREDENTIAL_BRIDGE_PREFIX = /^(?:VSCODE_GIT_|GIT_CONFIG_KEY_|GIT_CONFIG_VALUE_)/;
+const RENEW_HINT = "Renew it by re-running `npx @bluenotelogic/harness init --antigravity --harness-home "
+  + "<your caveau-harness-v2 path>`; do not export a token in the environment instead.";
+const EXPIRY_WARNING_MS = 14 * 24 * 60 * 60 * 1000;
+
+function redactCredentials(text) {
+  return String(text).replace(TOKEN_SHAPE, "[redacted credential]");
+}
+
+function cleanMessage(value, fallback) {
+  const text = redactCredentials(String(value || fallback || "").replace(/[\u0000-\u001f]+/g, " ")).trim();
+  return text.slice(0, 1400) || String(fallback || "Hook failed.");
+}
+
+export function isHarnessV2Home(candidate) {
+  if (!candidate) return false;
+  try {
+    return readFileSync(path.join(candidate, ".harness-generation"), "utf8").trim() === "caveau-harness-v2";
+  } catch {
+    return false;
+  }
+}
+
+export function readPluginConfig(adapterFile = ADAPTER_FILE) {
+  const pluginRoot = path.resolve(path.dirname(adapterFile), "..");
+  try {
+    const config = JSON.parse(readFileSync(path.join(pluginRoot, "harness-home.json"), "utf8"));
+    return config && typeof config === "object" && !Array.isArray(config) ? config : {};
+  } catch {
+    return {};
+  }
+}
+
+function ancestorCandidates(adapterFile) {
+  const candidates = [];
+  let current = path.dirname(adapterFile);
+  for (let depth = 0; depth < 6; depth += 1) {
+    candidates.push(current);
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return candidates;
+}
+
+export function resolveHarnessHome(env = process.env, adapterFile = ADAPTER_FILE) {
+  if (typeof env.HARNESS_HOME === "string" && env.HARNESS_HOME.trim()) {
+    const explicit = path.resolve(env.HARNESS_HOME.trim());
+    return isHarnessV2Home(explicit) ? explicit : null;
+  }
+
+  const candidates = [...ancestorCandidates(adapterFile)];
+  const config = readPluginConfig(adapterFile);
+  if (typeof config.harnessHome === "string" && config.harnessHome.trim()) {
+    candidates.unshift(path.resolve(config.harnessHome.trim()));
+  }
+
+  candidates.push(path.join(homedir(), ".caveau", "harness"), path.join(homedir(), "caveau-harness-v2"));
+  return candidates.find(isHarnessV2Home) || null;
+}
+
+function workspacePath(payload) {
+  const candidate = payload?.toolCall?.args?.Cwd
+    || payload?.toolCall?.args?.cwd
+    || payload?.workspacePaths?.[0]
+    || process.cwd();
+  if (typeof candidate !== "string" || !candidate.trim()) return process.cwd();
+  if (!candidate.startsWith("file:")) return candidate;
+  try {
+    return fileURLToPath(candidate);
+  } catch {
+    return candidate.replace(/^file:\/\/?/, "");
+  }
+}
+
+function promptText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((item) => {
+      if (typeof item === "string") return item;
+      return typeof item?.text === "string" ? item.text : "";
+    }).filter(Boolean).join("\n");
+  }
+  if (content && typeof content === "object") {
+    if (typeof content.text === "string") return content.text;
+    if (typeof content.content === "string") return content.content;
+  }
+  return "";
+}
+
+export function latestUserInput(transcriptPath) {
+  if (typeof transcriptPath !== "string" || !transcriptPath || !existsSync(transcriptPath)) return null;
+  let fd;
+  try {
+    fd = openSync(transcriptPath, "r");
+    const size = fstatSync(fd).size;
+    const length = Math.min(size, MAX_TRANSCRIPT_TAIL_BYTES);
+    const buffer = Buffer.alloc(length);
+    readSync(fd, buffer, 0, length, size - length);
+    let text = buffer.toString("utf8");
+    if (size > length) text = text.slice(text.indexOf("\n") + 1);
+    const lines = text.split(/\r?\n/);
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      if (!lines[index].trim()) continue;
+      let row;
+      try {
+        row = JSON.parse(lines[index]);
+      } catch {
+        continue;
+      }
+      if (row?.type !== "USER_INPUT") continue;
+      const prompt = promptText(row.content).trim();
+      if (!prompt) continue;
+      const digest = createHash("sha256").update(prompt).digest("hex");
+      return { key: `${row.step_index ?? "unknown"}:${digest}`, prompt: prompt.slice(0, 24_000) };
+    }
+  } catch {
+    return null;
+  } finally {
+    if (typeof fd === "number") closeSync(fd);
+  }
+  return null;
+}
+
+function statePath(payload) {
+  const root = payload?.artifactDirectoryPath;
+  return typeof root === "string" && root.trim()
+    ? path.join(root, ".caveau-harness-antigravity.json")
+    : null;
+}
+
+function readState(payload) {
+  const file = statePath(payload);
+  if (!file) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeState(payload, state) {
+  const file = statePath(payload);
+  if (!file) return;
+  try {
+    mkdirSync(path.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(state, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    renameSync(temp, file);
+  } catch {
+    // State is advisory: hooks remain fail-open when the artifact directory is unavailable.
+  }
+}
+
+function recordAdapterEvent(payload, message) {
+  const root = payload?.artifactDirectoryPath;
+  if (typeof root !== "string" || !root.trim()) return;
+  try {
+    mkdirSync(root, { recursive: true });
+    appendFileSync(
+      path.join(root, ".caveau-harness-antigravity.log"),
+      `${new Date().toISOString()} ${message}\n`,
+      { encoding: "utf8", mode: 0o600 },
+    );
+  } catch {
+    // Lifecycle evidence is advisory and contains no prompt or credential content.
+  }
+}
+
+function parseCoreJson(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function contextFrom(result) {
+  const parsed = parseCoreJson(result.stdout);
+  const value = parsed?.hookSpecificOutput?.additionalContext;
+  if (typeof value === "string" && value.trim()) return redactCredentials(value.trim());
+  return redactCredentials(result.stdout.trim());
+}
+
+/** True when a memory script reported that ProofMEM refused the hook credential. */
+function credentialRejected(...results) {
+  return results.some((result) => /answered 401\b/.test(`${result?.stdout || ""}\n${result?.stderr || ""}`));
+}
+
+/** A SessionStart warning when the installer-recorded expiry is past or under 14 days away. */
+export function hookCredentialExpiryNotice(pluginConfig, now = Date.now()) {
+  const raw = typeof pluginConfig?.hookTokenExpiresAt === "string" ? pluginConfig.hookTokenExpiresAt : "";
+  const at = Date.parse(raw);
+  if (!raw || Number.isNaN(at)) return "";
+  if (at <= now) return `The ProofMEM hook credential expired at ${raw}. ${RENEW_HINT}`;
+  if (at - now <= EXPIRY_WARNING_MS) return `The ProofMEM hook credential expires at ${raw}. ${RENEW_HINT}`;
+  return "";
+}
+
+/**
+ * The ProofMEM credential and API URL for memory scripts, always as a PAIR from one source. A
+ * complete pair exported in the environment is a deliberate override; otherwise the protected
+ * hook-token file travels with the plugin's own URL. Mixing sources could send this credential
+ * to whatever CAVEAUMEM_API_URL happened to be exported, or write into another tenant.
+ */
+export function hookCredential(env, pluginConfig) {
+  if (env.CAVEAUMEM_API_TOKEN && env.CAVEAUMEM_API_URL) {
+    return { token: env.CAVEAUMEM_API_TOKEN, url: env.CAVEAUMEM_API_URL.replace(/\/$/, "") };
+  }
+  const file = typeof pluginConfig?.hookTokenFile === "string" ? pluginConfig.hookTokenFile.trim() : "";
+  const url = typeof pluginConfig?.memoryApiUrl === "string" ? pluginConfig.memoryApiUrl.trim().replace(/\/$/, "") : "";
+  if (!file || !url) return null;
+  try {
+    const token = readFileSync(file, "utf8").trim();
+    return HOOK_TOKEN.test(token) ? { token, url } : null;
+  } catch {
+    return null;
+  }
+}
+
+/** True when an environment variable's NAME looks like it holds a credential. */
+export function isCredentialEnvName(name) {
+  const upper = String(name).toUpperCase();
+  if (PRESERVED_ENV.has(upper)) return false;
+  const segments = upper.split(/[^A-Z0-9]+/);
+  if (segments.some((segment) => CREDENTIAL_NAME_SEGMENT.test(segment))) return true;
+  return !upper.startsWith("HARNESS_") && segments.includes(AUTH_SEGMENT);
+}
+
+/** True when a variable lets a child use the user's Git or SSH credentials (CREDENTIAL_BRIDGE_ENV). */
+export function isCredentialBridgeEnvName(name) {
+  const upper = String(name).toUpperCase();
+  return CREDENTIAL_BRIDGE_ENV.has(upper) || CREDENTIAL_BRIDGE_PREFIX.test(upper);
+}
+
+/** A copy of `env` without any credential-shaped variable or credential bridge. */
+export function withoutCredentialEnv(env) {
+  return Object.fromEntries(
+    Object.entries(env).filter(([name]) => !isCredentialEnvName(name) && !isCredentialBridgeEnvName(name)),
+  );
+}
+
+/** The environment one core script runs with. Pure apart from reading the hook-token file. */
+export function scriptEnv(script, env, pluginConfig, home) {
+  const memoryScript = MEMORY_SCRIPTS.has(script);
+  const childEnv = {
+    // The guard, checkpoint, lint and verify scripts get no credential-shaped variable and no
+    // credential bridge at all: verify-gate.sh runs the workspace's own npm scripts, which would
+    // otherwise inherit the editor's cloud, registry and Git tokens, or its way of asking for them.
+    ...(memoryScript ? env : withoutCredentialEnv(env)),
+    HARNESS_HOME: home,
+    HARNESS_AGENT_HOST: "antigravity",
+    CAVEAU_HARNESS_PLUGIN_ROOT: path.resolve(path.dirname(ADAPTER_FILE), ".."),
+  };
+  for (const name of CREDENTIAL_ENV) delete childEnv[name];
+  // The harness core also reads a token from whichever variable HARNESS_MEMORY_TOKEN_VAR names.
+  const named = env.HARNESS_MEMORY_TOKEN_VAR;
+  if (typeof named === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(named)) delete childEnv[named];
+  // Antigravity keeps its OAuth bearer inside the editor, so memory scripts use the separate,
+  // bounded hook credential. Only its value enters the environment; it is never logged.
+  if (memoryScript) {
+    const credential = hookCredential(env, pluginConfig);
+    if (credential) {
+      childEnv.CAVEAUMEM_API_TOKEN = credential.token;
+      childEnv.CAVEAUMEM_API_URL = credential.url;
+      // This is a ProofMEM credential, so the core must talk to ProofMEM. An exported
+      // HARNESS_MEMORY_PROVIDER or HARNESS_COORDINATION_STORE (caveauai is the CaveauAI setting)
+      // would otherwise route this session's memory to a store the credential does not belong to.
+      childEnv.HARNESS_MEMORY_PROVIDER = "caveaumem";
+      childEnv.HARNESS_COORDINATION_STORE = "caveaumem";
+    }
+  }
+  return withAntigravityScriptDefaults(script, childEnv, pluginConfig);
+}
+
+function corePayload(action, payload, prompt = "") {
+  const args = payload?.toolCall?.args || {};
+  const toolName = payload?.toolCall?.name || "";
+  const cwd = workspacePath(payload);
+  const toolInput = {};
+  if (toolName === "run_command") toolInput.command = args.CommandLine || args.command || "";
+  if (EDIT_TOOLS.has(toolName)) toolInput.file_path = args.Path || args.TargetFile || args.file_path || "";
+  return {
+    session_id: payload?.conversationId || "unknown",
+    transcript_path: payload?.transcriptPath || "",
+    cwd,
+    source: action === "session-start" ? "startup" : undefined,
+    hook_event_name: ACTION_EVENT[action],
+    prompt,
+    tool_name: toolName,
+    tool_input: toolInput,
+    reason: payload?.terminationReason || "",
+    stop_hook_active: Number(payload?.executionNum || 0) > 0,
+  };
+}
+
+export function runCoreScript({ home, script, payload, timeoutMs, env = process.env, pluginConfig = readPluginConfig() }) {
+  if (!home) return { status: 0, stdout: "", stderr: "", missing: true };
+  const scriptPath = path.join(home, "scripts", script);
+  if (!existsSync(scriptPath)) return { status: 0, stdout: "", stderr: "", missing: true };
+  const cwd = typeof payload.cwd === "string" && existsSync(payload.cwd) ? payload.cwd : process.cwd();
+  // A missing or unreadable credential leaves memory scripts unauthenticated; the core then emits
+  // its own fail-open diagnostic.
+  const resolvedChildEnv = scriptEnv(script, env, pluginConfig, home);
+  let bashPath;
+  try {
+    bashPath = resolveBash();
+  } catch (error) {
+    return { status: 0, stdout: "", stderr: error.message, missing: true };
+  }
+  const result = spawnSync(bashPath, [scriptPath], {
+    cwd,
+    env: resolvedChildEnv,
+    input: JSON.stringify(payload),
+    encoding: "utf8",
+    timeout: timeoutMs,
+    windowsHide: true,
+    maxBuffer: 1024 * 1024,
+  });
+  return {
+    status: typeof result.status === "number" ? result.status : 1,
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    missing: false,
+    error: result.error,
+  };
+}
+
+export function withAntigravityScriptDefaults(script, env, pluginConfig = {}) {
+  const childEnv = { ...env };
+  // verify-gate.sh runs the open workspace's own build/test/lint scripts on every idle Stop,
+  // outside Antigravity's terminal approval, so opening an untrusted repo would run its code.
+  // Off unless the user opted in (`init --antigravity --verify-gate`); an exported
+  // HARNESS_VERIFY_GATE still wins, and a repo's harness.tenant cannot override a set value.
+  // An empty or blank export counts as unset: verify-gate.sh reads `${HARNESS_VERIFY_GATE:-1}`,
+  // so passing "" through switched the gate ON, and harness.tenant treats "" as unset too.
+  const gate = childEnv.HARNESS_VERIFY_GATE;
+  if (script === "verify-gate.sh" && (typeof gate !== "string" || gate.trim() === "")) {
+    childEnv.HARNESS_VERIFY_GATE = pluginConfig?.verifyGate === true ? "1" : "0";
+  }
+  if (!childEnv.HARNESS_MEMORY_PROVIDER) childEnv.HARNESS_MEMORY_PROVIDER = "caveaumem";
+  if (!childEnv.HARNESS_COORDINATION_STORE) childEnv.HARNESS_COORDINATION_STORE = "caveaumem";
+  if (!childEnv.HARNESS_CAVEAUAI_CONNECTOR) childEnv.HARNESS_CAVEAUAI_CONNECTOR = "disabled";
+  // session-handoff-start.sh permits its Git refresh to run for 8 seconds by default. Keep the
+  // editor adapter's refresh below its own subprocess deadline and the enclosing
+  // 40-second SessionStart handler while still refreshing the forge ref when it responds quickly.
+  if (script === "session-handoff-start.sh" && !childEnv.HARNESS_STALE_BRANCH_FETCH_SECS) {
+    childEnv.HARNESS_STALE_BRANCH_FETCH_SECS = "5";
+  }
+  // The canonical ProofMEM hooks speak its REST API. Native editor OAuth remains confined to the
+  // MCP connection and is never copied into this subprocess.
+  if (!childEnv.HARNESS_MEM_TRANSPORT) childEnv.HARNESS_MEM_TRANSPORT = "rest";
+  return childEnv;
+}
+
+function injectedSystemMessage(text) {
+  return {
+    // Keep this identical to Antigravity's documented SessionStart shape.
+    // Its Windows protobuf scrubber currently panics on string-valued metadata maps.
+    injectSteps: [{ systemMessage: { systemMessage: text } }],
+  };
+}
+
+function injectedEphemeralMessage(text) {
+  return { injectSteps: [{ ephemeralMessage: text }] };
+}
+
+function failOpenOutput(action, message) {
+  const reason = cleanMessage(message, "Caveau Harness hook skipped.");
+  if (action === "pre-tool" || action === "pre-edit") return { decision: "allow", reason };
+  if (action === "stop") return { decision: "allow", reason };
+  if (action === "post-edit") return {};
+  if (action === "session-start") return injectedSystemMessage(reason);
+  return injectedEphemeralMessage(reason);
+}
+
+export async function handleHook(action, payload, options = {}) {
+  const env = options.env || process.env;
+  const runner = options.runner || ((args) => runCoreScript({ ...args, env }));
+  if (!Object.hasOwn(ACTION_EVENT, action)) return failOpenOutput(action, `Unknown Caveau Harness hook action: ${action}`);
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return failOpenOutput(action, "Caveau Harness hook received malformed input and failed open.");
+  }
+  const home = resolveHarnessHome(env, options.adapterFile || ADAPTER_FILE);
+  const pluginConfig = options.pluginConfig || readPluginConfig(options.adapterFile || ADAPTER_FILE);
+  const run = (script, currentPayload, timeoutMs = 12_000) =>
+    runner({ home, script, payload: currentPayload, timeoutMs, env, pluginConfig });
+  const rejectedNotice = `ProofMEM rejected the Antigravity hook credential (expired or revoked). ${RENEW_HINT}`;
+  const missing = () => failOpenOutput(action, "Caveau Harness v2 core is unavailable; set HARNESS_HOME and run the doctor. Hook failed open.");
+
+  if (action === "session-start") {
+    const translated = corePayload(action, payload);
+    const handoff = run("session-handoff-start.sh", translated, 8_000);
+    const memory = run("mem-session-start.sh", translated, 30_000);
+    if (handoff.missing && memory.missing) return missing();
+    const contexts = [contextFrom(handoff), contextFrom(memory)].filter(Boolean);
+    const warnings = [handoff, memory]
+      .filter((item) => !item.missing && item.status !== 0)
+      .map((item) => cleanMessage(item.stderr, "bootstrap helper unavailable"));
+    if (warnings.length) contexts.push(`Caveau Harness bootstrap partially failed open: ${warnings.join("; ")}`);
+    if (credentialRejected(handoff, memory)) contexts.push(rejectedNotice);
+    else {
+      const expiry = hookCredentialExpiryNotice(pluginConfig);
+      if (expiry) contexts.push(expiry);
+    }
+    if (!contexts.length) {
+      contexts.push("The Harness core returned no handoff or memory content; continuing fail-open with an empty bootstrap.");
+    }
+    const context = [SESSION_START_ATTESTATION, ...contexts].join("\n\n").slice(0, 24_000);
+    recordAdapterEvent(
+      payload,
+      `session-start handoff=${handoff.status} memory=${memory.status} context_chars=${context.length} inject_steps=1`,
+    );
+    return injectedSystemMessage(context);
+  }
+
+  if (action === "prompt-context") {
+    const state = readState(payload);
+    const contexts = [];
+    if (typeof state.pendingContext === "string" && state.pendingContext.trim()) {
+      contexts.push(state.pendingContext.trim());
+      delete state.pendingContext;
+    }
+    const latest = latestUserInput(payload.transcriptPath);
+    if (latest && state.lastPromptKey !== latest.key) {
+      state.lastPromptKey = latest.key;
+      const result = run("mem-prompt-context.sh", corePayload(action, payload, latest.prompt), 25_000);
+      recordAdapterEvent(payload, `prompt-context status=${result.status} key=${latest.key.split(":", 1)[0]}`);
+      if (credentialRejected(result)) {
+        contexts.push(rejectedNotice);
+      } else if (!result.missing && result.status === 0) {
+        const context = contextFrom(result);
+        if (context) contexts.push(context.slice(0, 12_000));
+      } else if (result.missing) {
+        contexts.push("Caveau Harness v2 core is unavailable; set HARNESS_HOME and run the doctor.");
+      } else {
+        contexts.push(`Focused memory context failed open: ${cleanMessage(result.stderr, "provider unavailable")}`);
+      }
+    }
+    writeState(payload, state);
+    return contexts.length ? injectedEphemeralMessage(contexts.join("\n\n").slice(0, 14_000)) : {};
+  }
+
+  if (action === "pre-tool") {
+    const result = run("pre-bash-guard.sh", corePayload(action, payload), 12_000);
+    recordAdapterEvent(payload, `pre-tool status=${result.status}`);
+    if (result.missing) return missing();
+    if (result.status === 2) {
+      return { decision: "deny", reason: cleanMessage(result.stderr, "Command blocked by Caveau Harness policy.") };
+    }
+    if (result.status !== 0) {
+      return { decision: "allow", reason: `Destructive-command guard failed open: ${cleanMessage(result.stderr, "guard error")}` };
+    }
+    return { decision: "allow" };
+  }
+
+  if (action === "pre-edit") {
+    const result = run("checkpoint-snapshot.sh", corePayload(action, payload), 12_000);
+    recordAdapterEvent(payload, `pre-edit status=${result.status}`);
+    if (result.missing) return missing();
+    return result.status === 0
+      ? { decision: "allow" }
+      : { decision: "allow", reason: `Pre-edit checkpoint failed open: ${cleanMessage(result.stderr, "checkpoint error")}` };
+  }
+
+  if (action === "post-edit") {
+    const translated = corePayload(action, payload);
+    const lint = run("post-edit-lint.sh", translated, 45_000);
+    const hot = run("mem-hot-context.sh", translated, 4_000);
+    recordAdapterEvent(payload, `post-edit lint=${lint.status} hot=${hot.status}`);
+    if (lint.status === 2) {
+      const state = readState(payload);
+      state.pendingContext = cleanMessage(lint.stderr, "Edited-file verification failed.");
+      writeState(payload, state);
+    }
+    return {};
+  }
+
+  if (payload.fullyIdle === false) {
+    recordAdapterEvent(payload, "stop skipped: background work remains");
+    return { decision: "allow" };
+  }
+  const translated = corePayload(action, payload);
+  const progress = run("session-progress.sh", translated, 12_000);
+  const verify = run("verify-gate.sh", translated, 170_000);
+  const capture = run("mem-capture.sh", translated, 25_000);
+  recordAdapterEvent(payload, `stop progress=${progress.status} verify=${verify.status} capture=${capture.status}`);
+  if (verify.missing) return missing();
+  if (verify.status === 2) {
+    const reason = cleanMessage(verify.stderr, "Workspace verification failed.");
+    if (translated.stop_hook_active) {
+      return { decision: "allow", reason: `${reason} Continuation already ran; allowing stop to avoid a loop.` };
+    }
+    return { decision: "continue", reason };
+  }
+  if (verify.status !== 0) {
+    return { decision: "allow", reason: `Verification helper failed open: ${cleanMessage(verify.stderr, "verification error")}` };
+  }
+  return { decision: "allow" };
+}
+
+async function main() {
+  const action = process.argv[2] || "";
+  if (action === "probe-home") {
+    const home = resolveHarnessHome(process.env);
+    if (home) process.stdout.write(`${home}\n`);
+    else process.stderr.write("Caveau Harness v2 core cannot be resolved from this Antigravity plugin runtime.\n");
+    process.exitCode = home ? 0 : 2;
+    return;
+  }
+  let raw = "";
+  process.stdin.setEncoding("utf8");
+  for await (const chunk of process.stdin) raw += chunk;
+  let payload;
+  try {
+    payload = JSON.parse(raw || "{}");
+  } catch {
+    payload = null;
+  }
+  try {
+    const output = await handleHook(action, payload);
+    process.stdout.write(`${JSON.stringify(output || {})}\n`);
+  } catch (error) {
+    recordAdapterEvent(payload, `adapter exception: ${cleanMessage(error?.message, "unknown")}`);
+    process.stdout.write(`${JSON.stringify(failOpenOutput(action, `Caveau Harness adapter failed open: ${cleanMessage(error?.message, "unknown error")}`))}\n`);
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(ADAPTER_FILE)) {
+  await main();
+}

package/assets/antigravity-plugin/scripts/resolve-bash.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const WSL_REFUSAL =
+  "Git Bash was not found. Install Git for Windows; this launcher deliberately does not use WSL bash.";
+
+export function gitBashCandidates(env = process.env) {
+  const programFiles = env.ProgramFiles || "C:\\Program Files";
+  const programFilesX86 = env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
+  const candidates = [
+    path.join(programFiles, "Git", "bin", "bash.exe"),
+    path.join(programFiles, "Git", "usr", "bin", "bash.exe"),
+    path.join(programFilesX86, "Git", "bin", "bash.exe"),
+  ];
+  // Git for Windows' per-user ("only for me") installer location. Without it every hook silently
+  // failed open on such machines.
+  if (env.LOCALAPPDATA) candidates.push(path.join(env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe"));
+  return candidates;
+}
+
+export function resolveBash({ platform = process.platform, env = process.env, exists = existsSync } = {}) {
+  if (platform !== "win32") return "bash";
+  for (const candidate of gitBashCandidates(env)) {
+    if (exists(candidate)) return candidate;
+  }
+  throw new Error(WSL_REFUSAL);
+}
+
+export function runBash(args, options = {}) {
+  return spawnSync(resolveBash(), args, { stdio: "inherit", windowsHide: true, ...options });
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+  try {
+    const result = runBash(process.argv.slice(2));
+    if (result.error) {
+      console.error(result.error.message);
+      process.exit(1);
+    }
+    process.exit(typeof result.status === "number" ? result.status : 1);
+  } catch (error) {
+    console.error(error.message);
+    process.exit(1);
+  }
+}