@cleocode/adapters 2026.10.3 → 2026.10.4

package/dist/index.js

@@ -18088,8 +18088,15 @@ var init_nexus_cloud = __esm({
     nexusCloudProjectListItemSchema = z26.object({
       ...projectFields,
       role: z26.string(),
+      /**
+       * The project name sealed with the project data key (`Project.encryptedName`), base64;
+       * only a holder of the account key can open it (T13102).
+       */
+      encryptedName: z26.string().nullable().optional(),
       streamId: z26.string().optional(),
       headSeq: z26.number().int().nonnegative().nullable().optional(),
+      /** The stream's head snapshot; null when nothing was ever pushed (T13102: restorable or not). */
+      headCheckpointId: z26.string().nullable().optional(),
       openConflicts: z26.number().int().nonnegative().optional(),
       replicas: z26.array(nexusCloudReplicaSchema).default([]),
       devices: nexusCloudDeviceCountsSchema.optional(),
@@ -18235,6 +18242,13 @@ var init_nexus_cloud = __esm({
   }
 });
 
+// packages/contracts/src/nexus-first-run.ts
+var init_nexus_first_run = __esm({
+  "packages/contracts/src/nexus-first-run.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/nexus-vault.ts
 import { z as z27 } from "zod";
 var isoTime2, uuid, nexusUserKeysSchema, nexusProjectKeysSchema, nexusLeaseSchema, nexusLeaseAcquireSchema, nexusStreamHeadSchema, nexusActivityEventSchema, nexusActivityPageSchema;
@@ -18380,6 +18394,7 @@ var init_src = __esm({
     init_decide_sites();
     init_nexus_account();
     init_nexus_cloud();
+    init_nexus_first_run();
     init_nexus_vault();
     init_sync_schema();
     init_task_id();
@@ -44960,6 +44975,7 @@ import {
   readFileSync as readFileSync4,
   realpathSync,
   rmSync,
+  statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { homedir as homedir4, tmpdir } from "node:os";
@@ -44972,6 +44988,25 @@ function canonical(path) {
     return resolve2(path);
   }
 }
+function nonDirectoryAncestor(dir) {
+  let cur = resolve2(dir);
+  for (; ; ) {
+    try {
+      return statSync(cur).isDirectory() ? null : cur;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+    }
+    const parent = dirname2(cur);
+    if (parent === cur) return null;
+    cur = parent;
+  }
+}
+function ensureParentDir(target) {
+  const blocked = nonDirectoryAncestor(dirname2(target));
+  if (blocked !== null) throw new HeavyHookPathBlockedError(blocked, target);
+  mkdirSync(dirname2(target), { recursive: true });
+}
 function isUserHomeDir(projectDir, home = homedir4()) {
   return canonical(projectDir) === canonical(home);
 }
@@ -45083,7 +45118,7 @@ async function syncJsonHeavyCommandHook(configPath, provider, mode) {
     });
     return removed ? "removed" : "unchanged";
   }
-  mkdirSync(dirname2(configPath), { recursive: true });
+  ensureParentDir(configPath);
   clearOlderCleoMarkers();
   let result = "unchanged";
   await updateJsonConfigFile2(configPath, (config2) => {
@@ -45120,18 +45155,19 @@ function excludeFile(projectDir) {
   if (path === null || path === "") return null;
   return isAbsolute(path) ? path : join6(projectDir, path);
 }
-function excludeLine(projectDir) {
+function excludeLine(projectDir, relPath) {
   const prefix = gitOutput(projectDir, ["rev-parse", "--show-prefix"]) ?? "";
-  return `/${prefix}${CLAUDE_LOCAL_SETTINGS}`;
+  return `/${prefix}${relPath}`;
 }
-function excludeLocalSettingsFromGit(projectDir) {
+function excludeHookFileFromGit(projectDir, relPath, marker16 = HOOK_FILE_EXCLUDE_MARKER) {
   const exclude = excludeFile(projectDir);
   if (exclude === null) return false;
-  if (gitOutput(projectDir, ["check-ignore", CLAUDE_LOCAL_SETTINGS]) !== null) return false;
-  const line = excludeLine(projectDir);
+  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) !== null) return false;
+  const line = excludeLine(projectDir, relPath);
   const text = existsSync5(exclude) ? readFileSync4(exclude, "utf-8") : "";
   if (text.split("\n").includes(line)) return false;
-  const block = `${LOCAL_SETTINGS_EXCLUDE_MARKER}
+  const block = `${marker16}
 ${line}
 `;
   mkdirSync(dirname2(exclude), { recursive: true });
@@ -45139,16 +45175,150 @@ ${line}
 ${block}`);
   return true;
 }
-function unexcludeLocalSettingsFromGit(projectDir) {
+function unexcludeHookFileFromGit(projectDir, relPath) {
   const exclude = excludeFile(projectDir);
   if (exclude === null || !existsSync5(exclude)) return false;
   const lines = readFileSync4(exclude, "utf-8").split("\n");
-  const at = lines.indexOf(excludeLine(projectDir));
-  if (at < 1 || lines[at - 1] !== LOCAL_SETTINGS_EXCLUDE_MARKER) return false;
+  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const above = lines[at - 1];
+  if (at < 1 || above !== LOCAL_SETTINGS_EXCLUDE_MARKER && above !== HOOK_FILE_EXCLUDE_MARKER) {
+    return false;
+  }
   lines.splice(at - 1, 2);
   writeFileSync2(exclude, lines.join("\n"));
   return true;
 }
+function hookFileVisibleToGit(projectDir, relPath) {
+  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return false;
+  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
+  return gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null;
+}
+function excludeLocalSettingsFromGit(projectDir) {
+  return excludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER);
+}
+function unexcludeLocalSettingsFromGit(projectDir) {
+  return unexcludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS);
+}
+function cleoCreatedConfig(config2) {
+  if (!isPlainObject2(config2) || Object.keys(config2).some((k) => k !== "hooks")) return false;
+  if (!isPlainObject2(config2.hooks)) return false;
+  let mine = 0;
+  for (const groups of Object.values(config2.hooks)) {
+    if (!Array.isArray(groups)) return false;
+    for (const group of groups) {
+      if (!isPlainObject2(group) || !Array.isArray(group.hooks)) return false;
+      for (const hook of group.hooks) {
+        if (!isPlainObject2(hook) || typeof hook.command !== "string" || !hook.command.includes(CLEO_HOOK_MARKER)) {
+          return false;
+        }
+        mine++;
+      }
+    }
+  }
+  return mine > 0;
+}
+function codexHooksSharedReason(projectDir, checkGit = true) {
+  const file2 = join6(projectDir, CODEX_HOOKS_FILE);
+  if (checkGit && gitOutput(projectDir, ["ls-files", "--error-unmatch", CODEX_HOOKS_FILE]) !== null) {
+    return "is tracked by git (a shared team config)";
+  }
+  if (!existsSync5(file2)) return null;
+  let config2;
+  try {
+    config2 = JSON.parse(readFileSync4(file2, "utf-8"));
+  } catch {
+    return "is the project's own Codex hook config (empty or not valid JSON)";
+  }
+  return cleoCreatedConfig(config2) ? null : "is the project's own Codex hook config";
+}
+function committedCodexHookHoldsCleo(projectDir) {
+  const committed = gitOutput(projectDir, ["show", `HEAD:./${CODEX_HOOKS_FILE}`]);
+  if (committed === null || committed === "") return false;
+  try {
+    const config2 = JSON.parse(committed);
+    if (!isPlainObject2(config2)) return false;
+    const groups = isPlainObject2(config2.hooks) ? config2.hooks.PreToolUse : void 0;
+    return Array.isArray(groups) && groups.some(
+      (g) => isPlainObject2(g) && Array.isArray(g.hooks) && g.hooks.some(isHeavyHookObject)
+    );
+  } catch {
+    return false;
+  }
+}
+function jsonEqual(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => jsonEqual(v, b[i]));
+  }
+  if (isPlainObject2(a) && isPlainObject2(b)) {
+    const keys = Object.keys(a);
+    return keys.length === Object.keys(b).length && keys.every((k) => Object.hasOwn(b, k) && jsonEqual(a[k], b[k]));
+  }
+  return a === b;
+}
+function restoreCommittedCodexHooks(projectDir) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", CODEX_HOOKS_FILE]) === null)
+    return false;
+  const file2 = join6(projectDir, CODEX_HOOKS_FILE);
+  let committed;
+  let working;
+  try {
+    committed = execFileSync("git", ["-C", projectDir, "show", `HEAD:./${CODEX_HOOKS_FILE}`], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    working = JSON.parse(readFileSync4(file2, "utf-8"));
+  } catch {
+    return false;
+  }
+  if (!isPlainObject2(working)) return false;
+  const hooks = hookMap(working);
+  if (!placeHeavyHook(hooks, null).changed) return false;
+  try {
+    if (!jsonEqual(working, JSON.parse(committed))) return false;
+  } catch {
+    return false;
+  }
+  writeFileSync2(file2, committed);
+  return true;
+}
+function excludedByCleo(projectDir, relPath) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null || !existsSync5(exclude)) return false;
+  const lines = readFileSync4(exclude, "utf-8").split("\n");
+  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const above = lines[at - 1];
+  return at >= 1 && (above === LOCAL_SETTINGS_EXCLUDE_MARKER || above === HOOK_FILE_EXCLUDE_MARKER);
+}
+function codexHookSnippet() {
+  return JSON.stringify(heavyCommandHookEntry("codex"));
+}
+function trackedFileModified(projectDir, relPath) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null) return false;
+  return (gitOutput(projectDir, ["diff", "--name-only", "HEAD", "--", relPath]) ?? "") !== "";
+}
+async function syncCodexHeavyCommandHook(projectDir, mode) {
+  const file2 = join6(projectDir, CODEX_HOOKS_FILE);
+  if (mode !== "off") {
+    const shared = codexHooksSharedReason(projectDir);
+    if (shared !== null) {
+      unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+      throw new HeavyHookSharedConfigError(file2, shared);
+    }
+  } else if (committedCodexHookHoldsCleo(projectDir)) {
+    throw new HeavyHookSharedConfigError(
+      file2,
+      "holds CLEO's hook as the team committed it (removing it is a team change)"
+    );
+  } else if (restoreCommittedCodexHooks(projectDir)) {
+    unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+    return "removed";
+  }
+  const result = await syncJsonHeavyCommandHook(file2, "codex", mode);
+  if (mode === "off") unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+  else excludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+  return result;
+}
 async function syncClaudeCodeHeavyCommandHook(projectDir, mode) {
   const result = await syncJsonHeavyCommandHook(
     join6(projectDir, CLAUDE_LOCAL_SETTINGS),
@@ -45157,11 +45327,14 @@ async function syncClaudeCodeHeavyCommandHook(projectDir, mode) {
   );
   if (mode === "off") unexcludeLocalSettingsFromGit(projectDir);
   else excludeLocalSettingsFromGit(projectDir);
-  await syncJsonHeavyCommandHook(
-    join6(projectDir, ".claude", "settings.json"),
-    "claude-code",
-    "off"
-  );
+  try {
+    await syncJsonHeavyCommandHook(
+      join6(projectDir, ".claude", "settings.json"),
+      "claude-code",
+      "off"
+    );
+  } catch {
+  }
   return result;
 }
 function opencodeHeavyCommandPluginSource() {
@@ -45217,20 +45390,24 @@ function opencodeHeavyCommandPluginSource() {
   ].join("\n");
 }
 function syncOpencodeHeavyCommandPlugin(projectDir, mode) {
-  const pluginPath = join6(projectDir, ".opencode", "plugins", OPENCODE_HEAVY_COMMAND_PLUGIN);
+  const pluginPath = join6(projectDir, OPENCODE_PLUGIN_FILE);
   const exists = existsSync5(pluginPath);
   if (mode === "off") {
+    unexcludeHookFileFromGit(projectDir, OPENCODE_PLUGIN_FILE);
     if (!exists) return "unchanged";
     rmSync(pluginPath, { force: true });
     return "removed";
   }
   const source = opencodeHeavyCommandPluginSource();
-  if (exists && readFileSync4(pluginPath, "utf-8") === source) return "unchanged";
-  mkdirSync(dirname2(pluginPath), { recursive: true });
-  writeFileSync2(pluginPath, source, "utf-8");
-  return exists ? "updated" : "installed";
+  const current = exists && readFileSync4(pluginPath, "utf-8") === source;
+  if (!current) {
+    ensureParentDir(pluginPath);
+    writeFileSync2(pluginPath, source, "utf-8");
+  }
+  excludeHookFileFromGit(projectDir, OPENCODE_PLUGIN_FILE);
+  return current ? "unchanged" : exists ? "updated" : "installed";
 }
-var HEAVY_COMMAND_HOOK_ID, HEAVY_COMMAND_HOOK_TIMEOUT_SEC, OPENCODE_HEAVY_COMMAND_PLUGIN, HEAVY_TOOL_WORDS, OLDER_CLEO_HOOK_ANSWER, OLDER_CLEO_MARKER_PREFIX, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER;
+var HEAVY_COMMAND_HOOK_ID, HEAVY_COMMAND_HOOK_TIMEOUT_SEC, OPENCODE_HEAVY_COMMAND_PLUGIN, HEAVY_TOOL_WORDS, HeavyHookPathBlockedError, OLDER_CLEO_HOOK_ANSWER, OLDER_CLEO_MARKER_PREFIX, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER, HOOK_FILE_EXCLUDE_MARKER, CODEX_HOOKS_FILE, OPENCODE_PLUGIN_FILE, HeavyHookSharedConfigError;
 var init_heavy_command_hook_install = __esm({
   "packages/adapters/src/providers/shared/heavy-command-hook-install.ts"() {
     "use strict";
@@ -45270,6 +45447,19 @@ var init_heavy_command_hook_install = __esm({
       "cargo",
       "go"
     ]);
+    HeavyHookPathBlockedError = class extends Error {
+      /** The existing path that is not a directory. */
+      path;
+      /**
+       * @param path - the existing non-directory path.
+       * @param target - the config file that would have lived under it.
+       */
+      constructor(path, target) {
+        super(`${path} exists but is not a directory, so ${target} cannot be created under it`);
+        this.name = "HeavyHookPathBlockedError";
+        this.path = path;
+      }
+    };
     OLDER_CLEO_HOOK_ANSWER = JSON.stringify({
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
@@ -45279,11 +45469,27 @@ var init_heavy_command_hook_install = __esm({
     OLDER_CLEO_MARKER_PREFIX = "cleo-hook-unsupported-";
     CLAUDE_LOCAL_SETTINGS = ".claude/settings.local.json";
     LOCAL_SETTINGS_EXCLUDE_MARKER = "# cleo-hook: keep the per-machine heavy-command hook settings out of git (T12983)";
+    HOOK_FILE_EXCLUDE_MARKER = "# cleo-hook: keep a per-machine heavy-command hook file out of git (T13124)";
+    CODEX_HOOKS_FILE = ".codex/hooks.json";
+    OPENCODE_PLUGIN_FILE = `.opencode/plugins/${OPENCODE_HEAVY_COMMAND_PLUGIN}`;
+    HeavyHookSharedConfigError = class extends Error {
+      /** The project's own config file. */
+      path;
+      /**
+       * @param path - the config file.
+       * @param why - what makes it the project's own.
+       */
+      constructor(path, why) {
+        super(`${path} ${why}, so CLEO does not write or hide it`);
+        this.name = "HeavyHookSharedConfigError";
+        this.path = path;
+      }
+    };
   }
 });
 
 // packages/adapters/src/providers/shared/hook-template-installer.ts
-import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, statSync } from "node:fs";
+import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, statSync as statSync2 } from "node:fs";
 import { dirname as dirname3, join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveProviderCandidates() {
@@ -45311,8 +45517,8 @@ function copyTemplate(src, dest, force) {
     throw new Error(`CLEO hook template missing at source: ${src}`);
   }
   if (!force && existsSync6(dest)) {
-    const srcStat = statSync(src);
-    const destStat = statSync(dest);
+    const srcStat = statSync2(src);
+    const destStat = statSync2(dest);
     if (srcStat.size === destStat.size && srcStat.mtimeMs <= destStat.mtimeMs) {
       return { wrote: false };
     }
@@ -47781,7 +47987,7 @@ var init_hooks4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/install.ts
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile7 } from "@cleocode/caamp";
 function getCleoReferences() {
   return [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"];
@@ -47808,7 +48014,7 @@ var init_install4 = __esm({
         });
         const projectUpdated = projectResult.action !== "intact";
         if (projectUpdated) {
-          details.instructionFile = join28(projectDir, projectResult.instructFile);
+          details.instructionFile = join29(projectDir, projectResult.instructFile);
         }
         let globalUpdated = false;
         try {
@@ -47879,7 +48085,7 @@ var init_install4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/spawn.ts
-import { findOnPath as findOnPath11 } from "@cleocode/paths";
+import { findOnPath as findOnPath12 } from "@cleocode/paths";
 function getPiCliPath() {
   return process.env["PI_CLI_PATH"] ?? "pi";
 }
@@ -47902,7 +48108,7 @@ var init_spawn4 = __esm({
        */
       async canSpawn() {
         const cliPath = getPiCliPath();
-        return findOnPath11(cliPath) !== null;
+        return findOnPath12(cliPath) !== null;
       }
       /**
        * Spawn a subagent via Pi CLI.
@@ -48013,22 +48219,22 @@ var init_spawn4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/adapter.ts
-import { existsSync as existsSync20 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join29 } from "node:path";
-import { findOnPath as findOnPath12 } from "@cleocode/paths";
+import { existsSync as existsSync21 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import { join as join30 } from "node:path";
+import { findOnPath as findOnPath13 } from "@cleocode/paths";
 function getPiAgentDir() {
   const env = process.env["PI_CODING_AGENT_DIR"];
   if (env !== void 0 && env.length > 0) {
-    if (env === "~") return homedir13();
-    if (env.startsWith("~/")) return join29(homedir13(), env.slice(2));
+    if (env === "~") return homedir14();
+    if (env.startsWith("~/")) return join30(homedir14(), env.slice(2));
     return env;
   }
   const piHome = process.env["PI_HOME"];
   if (piHome !== void 0 && piHome.length > 0) {
-    return join29(piHome, "agent");
+    return join30(piHome, "agent");
   }
-  return join29(homedir13(), ".pi", "agent");
+  return join30(homedir14(), ".pi", "agent");
 }
 var PiAdapter;
 var init_adapter4 = __esm({
@@ -48131,17 +48337,17 @@ var init_adapter4 = __esm({
         }
         let cliAvailable = false;
         const cliPath = process.env["PI_CLI_PATH"] ?? "pi";
-        const resolvedCli = findOnPath12(cliPath);
+        const resolvedCli = findOnPath13(cliPath);
         cliAvailable = resolvedCli !== null;
         if (resolvedCli) details.cliPath = cliPath === "pi" ? resolvedCli : cliPath;
         else details.cliAvailable = false;
         const agentDir = getPiAgentDir();
-        const agentDirExists = existsSync20(agentDir);
+        const agentDirExists = existsSync21(agentDir);
         details.agentDirExists = agentDirExists;
         details.agentDir = agentDir;
         if (this.projectDir) {
-          const projectPiDir = join29(this.projectDir, ".pi");
-          details.projectPiDirExists = existsSync20(projectPiDir);
+          const projectPiDir = join30(this.projectDir, ".pi");
+          details.projectPiDirExists = existsSync21(projectPiDir);
         }
         details.piCodingAgentDirSet = process.env["PI_CODING_AGENT_DIR"] !== void 0;
         details.piHomeSet = process.env["PI_HOME"] !== void 0;
@@ -48512,9 +48718,8 @@ var CodexInstallProvider = class {
       details.heavyCommandHook = "skipped";
     } else if (options.heavyCommandHook !== void 0) {
       try {
-        details.heavyCommandHook = await syncJsonHeavyCommandHook(
-          join16(projectDir, ".codex", "hooks.json"),
-          "codex",
+        details.heavyCommandHook = await syncCodexHeavyCommandHook(
+          projectDir,
           options.heavyCommandHook
         );
       } catch (err) {
@@ -49244,20 +49449,405 @@ function createAdapter6() {
 
 // packages/adapters/src/index.ts
 init_opencode();
+
+// packages/adapters/src/providers/shared/heavy-command-hook-delivery.ts
+init_heavy_command_hook_install();
+init_hook_config();
+import { execFileSync as execFileSync2, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync20, lstatSync, readFileSync as readFileSync12, statSync as statSync3 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
+import { dirname as dirname6, join as join28 } from "node:path";
+import { JsonConfigParseError } from "@cleocode/caamp";
+import { findOnPath as findOnPath11 } from "@cleocode/paths";
+var HEAVY_HOOK_DELIVERY_PROVIDERS = Object.freeze([
+  "claude-code",
+  "codex",
+  "opencode",
+  "kimi"
+]);
+var HEAVY_HOOK_FIX_COMMAND = "cleo doctor heavy-command-hook --fix";
+var CODEX_SHARED_REMEDY = "if the team wants Codex governed here, add CLEO's PreToolUse entry (the snippet) to .codex/hooks.json yourself and commit it deliberately; CLEO never writes or hides a project's own hook config";
+var KIMI_REASON = "Kimi reads hooks only from its global ~/.kimi/config.toml, and CLEO never writes user-global configs";
+var KIMI_REMEDY = "add a [[hooks]] entry for PreToolUse that runs `cleo hook heavy-command --provider kimi` to ~/.kimi/config.toml yourself";
+function homeOf(env) {
+  return env.HOME || homedir13();
+}
+function heavyHookTarget(provider, projectDir, env = process.env) {
+  switch (provider) {
+    case "claude-code":
+      return join28(projectDir, CLAUDE_LOCAL_SETTINGS);
+    case "codex":
+      return join28(projectDir, CODEX_HOOKS_FILE);
+    case "opencode":
+      return join28(projectDir, OPENCODE_PLUGIN_FILE);
+    case "kimi":
+      return join28(homeOf(env), ".kimi", "config.toml");
+  }
+}
+function detectHeavyHookProvider(provider, projectDir, env = process.env) {
+  const home = homeOf(env);
+  const signals = provider === "claude-code" ? [
+    [
+      env.CLAUDECODE === "1" || Boolean(env.CLAUDE_CODE_ENTRYPOINT),
+      "running inside Claude Code"
+    ],
+    [() => existsSync20(join28(projectDir, ".claude")), "the project has .claude/"],
+    [() => findOnPath11("claude", { env }) !== null, "`claude` is on PATH"],
+    [() => existsSync20(env.CLAUDE_CONFIG_DIR || join28(home, ".claude")), "~/.claude exists"]
+  ] : provider === "codex" ? [
+    [() => existsSync20(join28(projectDir, ".codex")), "the project has .codex"],
+    [() => findOnPath11("codex", { env }) !== null, "`codex` is on PATH"],
+    [() => existsSync20(env.CODEX_HOME || join28(home, ".codex")), "~/.codex exists"]
+  ] : provider === "opencode" ? [
+    [() => existsSync20(join28(projectDir, ".opencode")), "the project has .opencode/"],
+    [
+      () => existsSync20(join28(projectDir, "opencode.json")) || existsSync20(join28(projectDir, "opencode.jsonc")),
+      "the project has opencode.json"
+    ],
+    [() => findOnPath11("opencode", { env }) !== null, "`opencode` is on PATH"],
+    [
+      () => existsSync20(join28(env.XDG_CONFIG_HOME || join28(home, ".config"), "opencode")),
+      "~/.config/opencode exists"
+    ]
+  ] : [
+    [() => findOnPath11("kimi", { env }) !== null, "`kimi` is on PATH"],
+    [() => existsSync20(join28(home, ".kimi")), "~/.kimi exists"]
+  ];
+  for (const [test, why] of signals) {
+    if (typeof test === "boolean" ? test : test()) return { detected: true, why };
+  }
+  if (provider !== "kimi" && existsSync20(heavyHookTarget(provider, projectDir, env))) {
+    return { detected: true, why: "its hook config exists" };
+  }
+  return {
+    detected: false,
+    why: `${provider} is not in use here (no config directory or CLI found)`
+  };
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function syncProvider(provider, projectDir, mode, env) {
+  const target = heavyHookTarget(provider, projectDir, env);
+  if (provider === "kimi") {
+    return mode === "off" ? { provider, status: "unchanged", target } : { provider, status: "unsupported", target, reason: KIMI_REASON, remedy: KIMI_REMEDY };
+  }
+  try {
+    const result = provider === "claude-code" ? await syncClaudeCodeHeavyCommandHook(projectDir, mode) : provider === "codex" ? await syncCodexHeavyCommandHook(projectDir, mode) : syncOpencodeHeavyCommandPlugin(projectDir, mode);
+    return { provider, status: result, target };
+  } catch (err) {
+    if (err instanceof HeavyHookSharedConfigError) {
+      return {
+        provider,
+        status: "needs-consent",
+        target,
+        reason: err.message,
+        ...mode === "off" ? {
+          remedy: "the team committed CLEO's hook in .codex/hooks.json; remove it there in a team change if the team agrees"
+        } : { remedy: CODEX_SHARED_REMEDY, snippet: codexHookSnippet() }
+      };
+    }
+    if (err instanceof HeavyHookPathBlockedError) {
+      return {
+        provider,
+        status: "blocked",
+        target,
+        reason: err.message,
+        remedy: `remove or rename ${err.path} (it is not a directory), then run: ${HEAVY_HOOK_FIX_COMMAND}`
+      };
+    }
+    return {
+      provider,
+      status: "failed",
+      target,
+      reason: errorText(err),
+      remedy: err instanceof JsonConfigParseError ? `fix the JSON in ${err.filePath} (it was left untouched), then run: ${HEAVY_HOOK_FIX_COMMAND}` : `run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+}
+async function syncProjectHeavyCommandHooks(projectDir, mode, options = {}) {
+  const env = options.env ?? process.env;
+  const providers = options.providers ?? HEAVY_HOOK_DELIVERY_PROVIDERS;
+  const home = isUserHomeDir(projectDir, homeOf(env));
+  const outcomes = [];
+  for (const provider of providers) {
+    const target = heavyHookTarget(provider, projectDir, env);
+    if (home) {
+      outcomes.push({
+        provider,
+        status: "skipped",
+        target,
+        reason: "the project is your home directory, whose provider configs are user-global"
+      });
+      continue;
+    }
+    const detection = detectHeavyHookProvider(provider, projectDir, env);
+    if (mode !== "off" && !detection.detected) {
+      outcomes.push({ provider, status: "skipped", target, reason: detection.why });
+      continue;
+    }
+    outcomes.push(await syncProvider(provider, projectDir, mode, env));
+  }
+  return outcomes;
+}
+function jsonHookPresence(file2, provider) {
+  let raw;
+  try {
+    raw = readFileSync12(file2, "utf-8");
+  } catch (err) {
+    const code = err.code;
+    return code === "ENOENT" || code === "ENOTDIR" ? { kind: "absent" } : { kind: "unreadable", error: errorText(err) };
+  }
+  if (raw.trim() === "") return { kind: "absent" };
+  let config2;
+  try {
+    config2 = JSON.parse(raw);
+  } catch (err) {
+    return { kind: "unreadable", error: errorText(err) };
+  }
+  if (!isPlainObject2(config2))
+    return { kind: "unreadable", error: "top-level value is not an object" };
+  const hooks = config2.hooks;
+  const groups = isPlainObject2(hooks) ? hooks.PreToolUse : void 0;
+  if (!Array.isArray(groups)) return { kind: "absent" };
+  const expected = JSON.stringify(heavyCommandHookObject(provider));
+  let found = { kind: "absent" };
+  for (const group of groups) {
+    if (!isPlainObject2(group) || !Array.isArray(group.hooks)) continue;
+    for (const hook of group.hooks) {
+      if (!isHeavyHookObject(hook)) continue;
+      if (JSON.stringify(hook) === expected) return { kind: "present", current: true };
+      found = { kind: "present", current: false };
+    }
+  }
+  return found;
+}
+function presenceOf(provider, projectDir, target) {
+  if (provider !== "opencode") {
+    const local = jsonHookPresence(target, provider);
+    if (provider !== "claude-code" || local.kind !== "absent") return local;
+    const legacy = jsonHookPresence(join28(projectDir, ".claude", "settings.json"), provider);
+    return legacy.kind === "present" ? { kind: "present", current: false } : { kind: "absent" };
+  }
+  if (!existsSync20(target)) return { kind: "absent" };
+  try {
+    return {
+      kind: "present",
+      current: readFileSync12(target, "utf-8") === opencodeHeavyCommandPluginSource()
+    };
+  } catch (err) {
+    return { kind: "unreadable", error: errorText(err) };
+  }
+}
+var HOOK_FILES = {
+  "claude-code": CLAUDE_LOCAL_SETTINGS,
+  codex: CODEX_HOOKS_FILE,
+  opencode: OPENCODE_PLUGIN_FILE
+};
+function inspectProvider(provider, projectDir, mode, env, gitChecks) {
+  const target = heavyHookTarget(provider, projectDir, env);
+  const { detected, why } = detectHeavyHookProvider(provider, projectDir, env);
+  const base = { provider, detected, target };
+  if (provider === "kimi") {
+    if (!detected || mode === "off") return { ...base, state: "not-detected", detail: why };
+    let manual = false;
+    try {
+      manual = readFileSync12(target, "utf-8").includes(HEAVY_COMMAND_HOOK_ID);
+    } catch {
+    }
+    return manual ? { ...base, state: "installed", detail: `a manual entry in ${target} runs the hook` } : { ...base, state: "unsupported", detail: `${why}; ${KIMI_REASON}`, remedy: KIMI_REMEDY };
+  }
+  const presence = presenceOf(provider, projectDir, target);
+  if (presence.kind === "unreadable") {
+    return {
+      ...base,
+      state: "unreadable",
+      detail: `${target} cannot be read or parsed (${presence.error})`,
+      remedy: `fix ${target}, then run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+  if (mode === "off") {
+    return presence.kind === "present" ? {
+      ...base,
+      state: "outdated",
+      detail: "resources.heavyCommandHook is off, but the hook is still installed",
+      remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes it)`
+    } : { ...base, state: "disabled", detail: "resources.heavyCommandHook is off" };
+  }
+  if (presence.kind === "present") {
+    if (!presence.current) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `the hook in ${target} (or a legacy location) was written by another CLEO build`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND}`
+      };
+    }
+    if (!gitChecks) return { ...base, state: "installed", detail: `installed in ${target}` };
+    const shared2 = provider === "codex" ? codexHooksSharedReason(projectDir, true) : null;
+    if (shared2 !== null && excludedByCleo(projectDir, CODEX_HOOKS_FILE)) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `CLEO's info/exclude line hides ${target}, which ${shared2}`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes CLEO's exclude line)`
+      };
+    }
+    if (shared2 !== null) {
+      const modified = trackedFileModified(projectDir, CODEX_HOOKS_FILE);
+      if (modified || hookFileVisibleToGit(projectDir, CODEX_HOOKS_FILE)) {
+        return {
+          ...base,
+          state: "outdated",
+          detail: `CLEO's per-machine hook sits in ${target}, which ${shared2}, as ${modified ? "an uncommitted change" : "an untracked file"}: one \`git commit -a\` ships it to the team, and it widens evidence scope`,
+          remedy: "remove CLEO's entry from .codex/hooks.json, or commit it deliberately if the team wants Codex governed"
+        };
+      }
+      return { ...base, state: "installed", detail: `installed in ${target}, which ${shared2}` };
+    }
+    if (hookFileVisibleToGit(projectDir, HOOK_FILES[provider])) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `${target} is installed but git sees it as an untracked file (it widens evidence scope)`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (adds it to the repository's info/exclude)`
+      };
+    }
+    return { ...base, state: "installed", detail: `installed in ${target}` };
+  }
+  if (!detected) return { ...base, state: "not-detected", detail: why };
+  const shared = provider === "codex" ? codexHooksSharedReason(projectDir, gitChecks) : null;
+  if (shared !== null && gitChecks && excludedByCleo(projectDir, CODEX_HOOKS_FILE)) {
+    return {
+      ...base,
+      state: "outdated",
+      detail: `CLEO's info/exclude line hides ${target}, which ${shared}`,
+      remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes CLEO's exclude line)`
+    };
+  }
+  if (shared !== null) {
+    return {
+      ...base,
+      state: "needs-consent",
+      detail: `${target} ${shared}, so CLEO does not write or hide it; Codex runs ungoverned here until the team adds the entry (${why})`,
+      remedy: CODEX_SHARED_REMEDY,
+      snippet: codexHookSnippet()
+    };
+  }
+  const blocked = nonDirectoryAncestor(dirname6(target));
+  if (blocked !== null) {
+    return {
+      ...base,
+      state: "blocked",
+      detail: `${blocked} exists but is not a directory, so the hook cannot be installed (${why})`,
+      remedy: `remove or rename ${blocked}, then run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+  return {
+    ...base,
+    state: "missing",
+    detail: `${why}, but ${target} has no heavy-command hook: agent-run tests and builds bypass the machine-wide budget`,
+    remedy: `run: ${HEAVY_HOOK_FIX_COMMAND}`
+  };
+}
+function inspectProjectHeavyCommandHooks(projectDir, mode, options = {}) {
+  const env = options.env ?? process.env;
+  const providers = options.providers ?? HEAVY_HOOK_DELIVERY_PROVIDERS;
+  if (isUserHomeDir(projectDir, homeOf(env))) {
+    return providers.map((provider) => ({
+      provider,
+      detected: false,
+      state: "not-detected",
+      target: heavyHookTarget(provider, projectDir, env),
+      detail: "the project is your home directory; CLEO installs this hook per project only"
+    }));
+  }
+  const gitChecks = options.gitChecks ?? true;
+  return providers.map((provider) => inspectProvider(provider, projectDir, mode, env, gitChecks));
+}
+var OLDER_CLEO_MARKER_TTL_MS = 60 * 60 * 1e3;
+function olderCleoMarkerPath(cleoPath, dir, env) {
+  try {
+    const key = execFileSync2(
+      "/bin/sh",
+      ["-c", `printf '%s|%s' "$1" "$2" | cksum | tr -c '0-9' '-'`, "sh", cleoPath, dir],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 }
+    );
+    const base = env.XDG_RUNTIME_DIR || env.TMPDIR || "/tmp";
+    return join28(base, `${OLDER_CLEO_MARKER_PREFIX}${key}`);
+  } catch {
+    return null;
+  }
+}
+function hasOlderCleoMarker(cleoPath, dir, env) {
+  const marker16 = olderCleoMarkerPath(cleoPath, dir, env);
+  if (marker16 === null) return false;
+  try {
+    const st = lstatSync(marker16);
+    if (!st.isFile()) return false;
+    if (Date.now() - st.mtimeMs > OLDER_CLEO_MARKER_TTL_MS) return false;
+    return statSync3(cleoPath).mtimeMs <= st.mtimeMs;
+  } catch {
+    return false;
+  }
+}
+function probeHeavyHookCli(projectDir, options = {}) {
+  const env = options.env ?? process.env;
+  const path = findOnPath11("cleo", { env });
+  if (path === null) {
+    return {
+      state: "missing",
+      path: null,
+      detail: "no `cleo` on PATH, so the hook lets every heavy command run ungoverned",
+      remedy: "install CLEO so `cleo` is on PATH: npm i -g @cleocode/cleo"
+    };
+  }
+  const older = {
+    state: "older",
+    path,
+    detail: `${path} predates \`cleo hook\` and \`cleo run\`, so the hook lets every heavy command run ungoverned`,
+    remedy: `upgrade the cleo at ${path} (npm i -g @cleocode/cleo, or your version manager), then run: ${HEAVY_HOOK_FIX_COMMAND}`
+  };
+  if (hasOlderCleoMarker(path, projectDir, env)) return older;
+  const probe = spawnSync3(path, ["hook", "heavy-command", "--provider", "claude-code"], {
+    cwd: projectDir,
+    env: { ...env },
+    input: "{}",
+    encoding: "utf-8",
+    timeout: 2e4
+  });
+  if (probe.status === 0) {
+    return { state: "current", path, detail: `${path} answers \`cleo hook heavy-command\`` };
+  }
+  if (probe.status === 127 && /Unknown command/.test(probe.stderr ?? "")) return older;
+  return {
+    state: "unknown",
+    path,
+    detail: `${path} did not answer \`cleo hook heavy-command\` (${probe.error?.message ?? `exit ${probe.status ?? "none"}`}); the hook fails open, so heavy commands run ungoverned while it does not`,
+    remedy: `run \`${path} hook heavy-command < /dev/null\` in ${projectDir} to see why it fails (a broken version-manager shim, say)`
+  };
+}
+var heavyHookDeliveryApi = Object.freeze({
+  syncProjectHeavyCommandHooks,
+  inspectProjectHeavyCommandHooks,
+  probeHeavyHookCli
+});
+
+// packages/adapters/src/index.ts
 init_hook_template_installer();
 
 // packages/adapters/src/registry.ts
-import { readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname6, join as join30, resolve as resolve4 } from "node:path";
+import { readFileSync as readFileSync13 } from "node:fs";
+import { dirname as dirname7, join as join31, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PROVIDER_IDS = ["claude-code", "opencode", "cursor", "pi"];
 function getProviderManifests() {
   const manifests = [];
-  const baseDir = resolve4(dirname6(fileURLToPath3(import.meta.url)), "providers");
+  const baseDir = resolve4(dirname7(fileURLToPath3(import.meta.url)), "providers");
   for (const providerId of PROVIDER_IDS) {
     try {
-      const manifestPath = join30(baseDir, providerId, "manifest.json");
-      const raw = readFileSync12(manifestPath, "utf-8");
+      const manifestPath = join31(baseDir, providerId, "manifest.json");
+      const raw = readFileSync13(manifestPath, "utf-8");
       manifests.push(JSON.parse(raw));
     } catch {
     }
@@ -49305,6 +49895,8 @@ export {
   GeminiCliAdapter,
   GeminiCliHookProvider,
   GeminiCliInstallProvider,
+  HEAVY_HOOK_DELIVERY_PROVIDERS,
+  HEAVY_HOOK_FIX_COMMAND,
   KimiAdapter,
   KimiHookProvider,
   KimiInstallProvider,
@@ -49325,6 +49917,7 @@ export {
   createAdapter5 as createGeminiCliAdapter,
   createAdapter6 as createKimiAdapter,
   createAdapter7 as createOpenCodeAdapter,
+  detectHeavyHookProvider,
   discoverProviders,
   extractSymbolsFromText,
   getProviderHookTemplatePath,
@@ -49333,8 +49926,13 @@ export {
   getSetupInstructions,
   getSharedHookCorePath,
   getStatuslineConfig,
+  heavyHookDeliveryApi,
+  heavyHookTarget,
+  inspectProjectHeavyCommandHooks,
   installProviderHookTemplates,
+  probeHeavyHookCli,
   resolveTools,
-  runNexusPostModificationCheck
+  runNexusPostModificationCheck,
+  syncProjectHeavyCommandHooks
 };
 //# sourceMappingURL=index.js.map