@cleocode/adapters 2026.10.6 → 2026.10.7

package/dist/heavy-command-hook.js

@@ -0,0 +1,979 @@
+// packages/adapters/src/providers/shared/heavy-command-hook-delivery.ts
+import { execFileSync as execFileSync2, spawnSync } from "node:child_process";
+import { existsSync as existsSync2, lstatSync, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, join as join2 } from "node:path";
+import { JsonConfigParseError } from "@cleocode/caamp";
+import { findOnPath } from "@cleocode/paths";
+
+// packages/adapters/src/providers/shared/heavy-command-hook-install.ts
+import { execFileSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { updateJsonConfigFile } from "@cleocode/caamp";
+
+// packages/adapters/src/providers/shared/hook-config.ts
+var CLEO_HOOK_MARKER = "# cleo-hook";
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hookMap(settings) {
+  const existing = settings.hooks;
+  if (existing === void 0) {
+    const created = {};
+    settings.hooks = created;
+    return created;
+  }
+  if (!isPlainObject(existing)) {
+    throw new Error('settings.json "hooks" is not an object; not modifying it');
+  }
+  return existing;
+}
+
+// packages/adapters/src/providers/shared/heavy-command-hook-install.ts
+var HEAVY_COMMAND_HOOK_ID = "cleo hook heavy-command";
+var HEAVY_COMMAND_HOOK_TIMEOUT_SEC = 20;
+var OPENCODE_HEAVY_COMMAND_PLUGIN = "cleo-heavy-command.js";
+var HEAVY_TOOL_WORDS = Object.freeze([
+  "vitest",
+  "jest",
+  "mocha",
+  "ava",
+  "tap",
+  "playwright",
+  "pytest",
+  "rspec",
+  "phpunit",
+  "tsc",
+  "tsup",
+  "turbo",
+  "vite",
+  "esbuild",
+  "webpack",
+  "rollup",
+  "next",
+  "nx",
+  "biome",
+  "eslint",
+  "svelte-check",
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  "npx",
+  "pnpx",
+  "bunx",
+  "cargo",
+  "go"
+]);
+function canonical(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return resolve(path);
+  }
+}
+var HeavyHookPathBlockedError = class extends Error {
+  /** The existing path that is not a directory. */
+  path;
+  /**
+   * @param path - the existing non-directory path.
+   * @param target - the config file that would have lived under it.
+   */
+  constructor(path, target) {
+    super(`${path} exists but is not a directory, so ${target} cannot be created under it`);
+    this.name = "HeavyHookPathBlockedError";
+    this.path = path;
+  }
+};
+function nonDirectoryAncestor(dir) {
+  let cur = resolve(dir);
+  for (; ; ) {
+    try {
+      return statSync(cur).isDirectory() ? null : cur;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+    }
+    const parent = dirname(cur);
+    if (parent === cur) return null;
+    cur = parent;
+  }
+}
+function ensureParentDir(target) {
+  const blocked = nonDirectoryAncestor(dirname(target));
+  if (blocked !== null) throw new HeavyHookPathBlockedError(blocked, target);
+  mkdirSync(dirname(target), { recursive: true });
+}
+function isUserHomeDir(projectDir, home = homedir()) {
+  return canonical(projectDir) === canonical(home);
+}
+var OLDER_CLEO_HOOK_ANSWER = JSON.stringify({
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse",
+    additionalContext: "[cleo] This may be a heavy command, but the cleo on PATH predates cleo hook and cleo run, so it runs outside the machine-wide resource budget. Upgrade CLEO to govern it."
+  }
+});
+var OLDER_CLEO_MARKER_PREFIX = "cleo-hook-unsupported-";
+function clearOlderCleoMarkers(dir = process.env.XDG_RUNTIME_DIR || tmpdir()) {
+  let removed = 0;
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return 0;
+  }
+  for (const name of names) {
+    if (!name.startsWith(OLDER_CLEO_MARKER_PREFIX)) continue;
+    try {
+      rmSync(join(dir, name), { force: true });
+      removed++;
+    } catch {
+    }
+  }
+  return removed;
+}
+function shellWord(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function heavyCommandGuardScript(provider) {
+  const words = HEAVY_TOOL_WORDS.join("|");
+  const old = `printf '%s\\n' '${OLDER_CLEO_HOOK_ANSWER}'`;
+  return [
+    "command -v cleo >/dev/null 2>&1 || exit 0",
+    'in="$(cat)"',
+    "set -f",
+    "hit=",
+    // `[\]` (not `\\`) matches a backslash: it survives fish's quoting under Codex.
+    `for w in $(printf '%s' "$in" | sed 's/[\\][nrt]/ /g; s/[^A-Za-z0-9_./@+-]/ /g'); do case "\${w##*/}" in ${words}) hit=1; break;; esac; done`,
+    '[ -n "$hit" ] || exit 0',
+    'p="$(command -v cleo)"',
+    `d="\${XDG_RUNTIME_DIR:-\${TMPDIR:-/tmp}}"`,
+    `k="$d/${OLDER_CLEO_MARKER_PREFIX}$(printf '%s|%s' "$p" "$PWD" | cksum | tr -c '0-9' '-')"`,
+    `if [ -f "$k" ] && [ ! -L "$k" ] && [ -O "$k" ] && ! [ "$p" -nt "$k" ] && [ -n "$(find "$k" -mmin -60 2>/dev/null)" ]; then ${old}; exit 0; fi`,
+    'e="$(mktemp 2>/dev/null)" || e=',
+    // Only the older-CLEO signature (exit 127, "Unknown command hook") writes the
+    // marker; a crash or kill of a current CLEO fails open and asks again next time.
+    `if out="$(printf '%s' "$in" | ${HEAVY_COMMAND_HOOK_ID} --provider ${provider} 2>"\${e:-/dev/null}")"; then case "$out" in "{"*) printf '%s\\n' "$out";; esac; else rc=$?; if [ "$rc" = 127 ] && [ -n "$e" ] && grep -q 'Unknown command' "$e" 2>/dev/null; then t="$(mktemp "$k.XXXXXX" 2>/dev/null)" && mv -f "$t" "$k"; ${old}; fi; fi`,
+    '[ -z "$e" ] || rm -f "$e"',
+    "exit 0"
+  ].join("; ");
+}
+function heavyCommandHookCommand(provider) {
+  const script = heavyCommandGuardScript(provider);
+  const line = provider === "codex" ? `/bin/sh -c ${shellWord(script)}` : script;
+  return `${line} ${CLEO_HOOK_MARKER}`;
+}
+function heavyCommandHookObject(provider) {
+  return {
+    type: "command",
+    command: heavyCommandHookCommand(provider),
+    timeout: HEAVY_COMMAND_HOOK_TIMEOUT_SEC
+  };
+}
+function heavyCommandHookEntry(provider) {
+  return { matcher: "Bash", hooks: [heavyCommandHookObject(provider)] };
+}
+function isHeavyHookObject(hook) {
+  return isPlainObject(hook) && typeof hook.command === "string" && hook.command.includes(CLEO_HOOK_MARKER) && hook.command.includes(HEAVY_COMMAND_HOOK_ID);
+}
+function placeHeavyHook(hooks, desired, event = "PreToolUse", isMine = isHeavyHookObject) {
+  const groups = hooks[event];
+  if (groups === void 0) return { changed: false, found: false };
+  if (!Array.isArray(groups)) {
+    throw new Error(`hooks "${event}" is not an array; not modifying it`);
+  }
+  let changed = false;
+  let found = false;
+  const next = [];
+  for (const group of groups) {
+    if (!isPlainObject(group) || !Array.isArray(group.hooks)) {
+      next.push(group);
+      continue;
+    }
+    const kept = [];
+    let groupChanged = false;
+    for (const hook of group.hooks) {
+      if (!isMine(hook)) {
+        kept.push(hook);
+      } else if (desired !== null && !found) {
+        found = true;
+        if (JSON.stringify(hook) !== JSON.stringify(desired)) groupChanged = true;
+        kept.push(desired);
+      } else {
+        groupChanged = true;
+      }
+    }
+    if (!groupChanged) {
+      next.push(group);
+      continue;
+    }
+    changed = true;
+    if (kept.length > 0) next.push({ ...group, hooks: kept });
+  }
+  if (changed) hooks[event] = next;
+  return { changed, found };
+}
+async function syncJsonHeavyCommandHook(configPath, provider, mode) {
+  if (mode === "off") {
+    if (!existsSync(configPath)) return "unchanged";
+    const removed = await updateJsonConfigFile(configPath, (config) => {
+      if (config.hooks === void 0) return false;
+      return placeHeavyHook(hookMap(config), null).changed;
+    });
+    return removed ? "removed" : "unchanged";
+  }
+  ensureParentDir(configPath);
+  clearOlderCleoMarkers();
+  let result = "unchanged";
+  await updateJsonConfigFile(configPath, (config) => {
+    const hooks = hookMap(config);
+    const placed = placeHeavyHook(hooks, heavyCommandHookObject(provider));
+    if (placed.found) {
+      if (placed.changed) result = "updated";
+      return placed.changed;
+    }
+    const existing = hooks.PreToolUse;
+    hooks.PreToolUse = [
+      ...Array.isArray(existing) ? existing : [],
+      heavyCommandHookEntry(provider)
+    ];
+    result = "installed";
+    return true;
+  });
+  return result;
+}
+var ASK_ENFORCE_HOOK_ID = "cleo hook ask-enforce";
+function askEnforceHookObject(provider) {
+  const script = `command -v cleo >/dev/null 2>&1 || exit 0; out="$(${ASK_ENFORCE_HOOK_ID} --provider ${provider} 2>/dev/null)"; case "$out" in "{"*) printf '%s\\n' "$out";; esac; exit 0`;
+  const line = provider === "codex" ? `/bin/sh -c ${shellWord(script)}` : script;
+  return {
+    type: "command",
+    command: `${line} ${CLEO_HOOK_MARKER}`,
+    timeout: HEAVY_COMMAND_HOOK_TIMEOUT_SEC
+  };
+}
+function isAskEnforceHookObject(hook) {
+  return isPlainObject(hook) && typeof hook.command === "string" && hook.command.includes(CLEO_HOOK_MARKER) && hook.command.includes(ASK_ENFORCE_HOOK_ID);
+}
+async function syncJsonAskEnforceHook(configPath, provider, install) {
+  const mine = (hook) => isAskEnforceHookObject(hook);
+  if (!install) {
+    if (!existsSync(configPath)) return "unchanged";
+    const removed = await updateJsonConfigFile(configPath, (config) => {
+      if (config.hooks === void 0) return false;
+      return placeHeavyHook(hookMap(config), null, "Stop", mine).changed;
+    });
+    return removed ? "removed" : "unchanged";
+  }
+  ensureParentDir(configPath);
+  let result = "unchanged";
+  await updateJsonConfigFile(configPath, (config) => {
+    const hooks = hookMap(config);
+    const placed = placeHeavyHook(hooks, askEnforceHookObject(provider), "Stop", mine);
+    if (placed.found) {
+      if (placed.changed) result = "updated";
+      return placed.changed;
+    }
+    const existing = hooks.Stop;
+    hooks.Stop = [
+      ...Array.isArray(existing) ? existing : [],
+      { hooks: [askEnforceHookObject(provider)] }
+    ];
+    result = "installed";
+    return true;
+  });
+  return result;
+}
+var CLAUDE_LOCAL_SETTINGS = ".claude/settings.local.json";
+var LOCAL_SETTINGS_EXCLUDE_MARKER = "# cleo-hook: keep the per-machine heavy-command hook settings out of git (T12983)";
+var HOOK_FILE_EXCLUDE_MARKER = "# cleo-hook: keep a per-machine heavy-command hook file out of git (T13124)";
+var CODEX_HOOKS_FILE = ".codex/hooks.json";
+var OPENCODE_PLUGIN_FILE = `.opencode/plugins/${OPENCODE_HEAVY_COMMAND_PLUGIN}`;
+function gitOutput(projectDir, args) {
+  try {
+    return execFileSync("git", ["-C", projectDir, ...args], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function excludeFile(projectDir) {
+  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return null;
+  const path = gitOutput(projectDir, ["rev-parse", "--git-path", "info/exclude"]);
+  if (path === null || path === "") return null;
+  return isAbsolute(path) ? path : join(projectDir, path);
+}
+function excludeLine(projectDir, relPath) {
+  const prefix = gitOutput(projectDir, ["rev-parse", "--show-prefix"]) ?? "";
+  return `/${prefix}${relPath}`;
+}
+function excludeHookFileFromGit(projectDir, relPath, marker = HOOK_FILE_EXCLUDE_MARKER) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null) return false;
+  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) !== null) return false;
+  const line = excludeLine(projectDir, relPath);
+  const text = existsSync(exclude) ? readFileSync(exclude, "utf-8") : "";
+  if (text.split("\n").includes(line)) return false;
+  const block = `${marker}
+${line}
+`;
+  mkdirSync(dirname(exclude), { recursive: true });
+  writeFileSync(exclude, text === "" || text.endsWith("\n") ? text + block : `${text}
+${block}`);
+  return true;
+}
+function unexcludeHookFileFromGit(projectDir, relPath) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null || !existsSync(exclude)) return false;
+  const lines = readFileSync(exclude, "utf-8").split("\n");
+  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const above = lines[at - 1];
+  if (at < 1 || above !== LOCAL_SETTINGS_EXCLUDE_MARKER && above !== HOOK_FILE_EXCLUDE_MARKER) {
+    return false;
+  }
+  lines.splice(at - 1, 2);
+  writeFileSync(exclude, lines.join("\n"));
+  return true;
+}
+function hookFileVisibleToGit(projectDir, relPath) {
+  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return false;
+  if (gitOutput(projectDir, ["check-ignore", relPath]) !== null) return false;
+  return gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null;
+}
+function excludeLocalSettingsFromGit(projectDir) {
+  return excludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER);
+}
+function unexcludeLocalSettingsFromGit(projectDir) {
+  return unexcludeHookFileFromGit(projectDir, CLAUDE_LOCAL_SETTINGS);
+}
+var HeavyHookSharedConfigError = class extends Error {
+  /** The project's own config file. */
+  path;
+  /**
+   * @param path - the config file.
+   * @param why - what makes it the project's own.
+   */
+  constructor(path, why) {
+    super(`${path} ${why}, so CLEO does not write or hide it`);
+    this.name = "HeavyHookSharedConfigError";
+    this.path = path;
+  }
+};
+function cleoCreatedConfig(config) {
+  if (!isPlainObject(config) || Object.keys(config).some((k) => k !== "hooks")) return false;
+  if (!isPlainObject(config.hooks)) return false;
+  let mine = 0;
+  for (const groups of Object.values(config.hooks)) {
+    if (!Array.isArray(groups)) return false;
+    for (const group of groups) {
+      if (!isPlainObject(group) || !Array.isArray(group.hooks)) return false;
+      for (const hook of group.hooks) {
+        if (!isPlainObject(hook) || typeof hook.command !== "string" || !hook.command.includes(CLEO_HOOK_MARKER)) {
+          return false;
+        }
+        mine++;
+      }
+    }
+  }
+  return mine > 0;
+}
+function codexHooksSharedReason(projectDir, checkGit = true) {
+  const file = join(projectDir, CODEX_HOOKS_FILE);
+  if (checkGit && gitOutput(projectDir, ["ls-files", "--error-unmatch", CODEX_HOOKS_FILE]) !== null) {
+    return "is tracked by git (a shared team config)";
+  }
+  if (!existsSync(file)) return null;
+  let config;
+  try {
+    config = JSON.parse(readFileSync(file, "utf-8"));
+  } catch {
+    return "is the project's own Codex hook config (empty or not valid JSON)";
+  }
+  return cleoCreatedConfig(config) ? null : "is the project's own Codex hook config";
+}
+function committedCodexHookHoldsCleo(projectDir) {
+  const committed = gitOutput(projectDir, ["show", `HEAD:./${CODEX_HOOKS_FILE}`]);
+  if (committed === null || committed === "") return false;
+  try {
+    const config = JSON.parse(committed);
+    if (!isPlainObject(config)) return false;
+    const groups = isPlainObject(config.hooks) ? config.hooks.PreToolUse : void 0;
+    return Array.isArray(groups) && groups.some(
+      (g) => isPlainObject(g) && Array.isArray(g.hooks) && g.hooks.some(isHeavyHookObject)
+    );
+  } catch {
+    return false;
+  }
+}
+function jsonEqual(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => jsonEqual(v, b[i]));
+  }
+  if (isPlainObject(a) && isPlainObject(b)) {
+    const keys = Object.keys(a);
+    return keys.length === Object.keys(b).length && keys.every((k) => Object.hasOwn(b, k) && jsonEqual(a[k], b[k]));
+  }
+  return a === b;
+}
+function restoreCommittedCodexHooks(projectDir) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", CODEX_HOOKS_FILE]) === null)
+    return false;
+  const file = join(projectDir, CODEX_HOOKS_FILE);
+  let committed;
+  let working;
+  try {
+    committed = execFileSync("git", ["-C", projectDir, "show", `HEAD:./${CODEX_HOOKS_FILE}`], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    working = JSON.parse(readFileSync(file, "utf-8"));
+  } catch {
+    return false;
+  }
+  if (!isPlainObject(working)) return false;
+  const hooks = hookMap(working);
+  if (!placeHeavyHook(hooks, null).changed) return false;
+  try {
+    if (!jsonEqual(working, JSON.parse(committed))) return false;
+  } catch {
+    return false;
+  }
+  writeFileSync(file, committed);
+  return true;
+}
+function excludedByCleo(projectDir, relPath) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null || !existsSync(exclude)) return false;
+  const lines = readFileSync(exclude, "utf-8").split("\n");
+  const at = lines.indexOf(excludeLine(projectDir, relPath));
+  const above = lines[at - 1];
+  return at >= 1 && (above === LOCAL_SETTINGS_EXCLUDE_MARKER || above === HOOK_FILE_EXCLUDE_MARKER);
+}
+function codexHookSnippet() {
+  return JSON.stringify(heavyCommandHookEntry("codex"));
+}
+function trackedFileModified(projectDir, relPath) {
+  if (gitOutput(projectDir, ["ls-files", "--error-unmatch", relPath]) === null) return false;
+  return (gitOutput(projectDir, ["diff", "--name-only", "HEAD", "--", relPath]) ?? "") !== "";
+}
+async function syncCodexHeavyCommandHook(projectDir, mode) {
+  const file = join(projectDir, CODEX_HOOKS_FILE);
+  if (mode !== "off") {
+    const shared = codexHooksSharedReason(projectDir);
+    if (shared !== null) {
+      unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+      throw new HeavyHookSharedConfigError(file, shared);
+    }
+  } else if (committedCodexHookHoldsCleo(projectDir)) {
+    throw new HeavyHookSharedConfigError(
+      file,
+      "holds CLEO's hook as the team committed it (removing it is a team change)"
+    );
+  } else if (restoreCommittedCodexHooks(projectDir)) {
+    unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+    return "removed";
+  }
+  const result = await syncJsonHeavyCommandHook(file, "codex", mode);
+  if (mode === "off") unexcludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+  else excludeHookFileFromGit(projectDir, CODEX_HOOKS_FILE);
+  return result;
+}
+async function syncClaudeCodeHeavyCommandHook(projectDir, mode) {
+  const result = await syncJsonHeavyCommandHook(
+    join(projectDir, CLAUDE_LOCAL_SETTINGS),
+    "claude-code",
+    mode
+  );
+  if (mode === "off") unexcludeLocalSettingsFromGit(projectDir);
+  else excludeLocalSettingsFromGit(projectDir);
+  try {
+    await syncJsonHeavyCommandHook(
+      join(projectDir, ".claude", "settings.json"),
+      "claude-code",
+      "off"
+    );
+  } catch {
+  }
+  return result;
+}
+function opencodeHeavyCommandPluginSource() {
+  return [
+    "// CLEO heavy-command plugin for OpenCode (generated by @cleocode/adapters, T12983).",
+    "// Routes heavy shell commands (tests, builds, typechecks, installs) through",
+    "// `cleo run`, the machine-wide resource budget. Opt out with",
+    '// CLEO_HEAVY_COMMAND_HOOK=off, or set resources.heavyCommandHook to "off" and',
+    "// run `cleo upgrade` (which deletes this file). Fails open: on any error the",
+    "// command runs unchanged.",
+    "",
+    "import { execFile } from 'node:child_process';",
+    "",
+    `const HEAVY = /(?:^|[^A-Za-z0-9_.@+-])(?:${HEAVY_TOOL_WORDS.join("|")})(?=$|[^A-Za-z0-9_.@+-])/;`,
+    "const contexts = new Map();",
+    "",
+    "function ask(payload) {",
+    "  return new Promise((done) => {",
+    "    const child = execFile(",
+    "      'cleo',",
+    "      ['hook', 'heavy-command', '--provider', 'opencode'],",
+    `      { timeout: ${HEAVY_COMMAND_HOOK_TIMEOUT_SEC * 1e3} },`,
+    "      (err, stdout) => done(err ? '' : stdout),",
+    "    );",
+    "    child.on('error', () => done(''));",
+    "    child.stdin?.end(JSON.stringify(payload));",
+    "  });",
+    "}",
+    "",
+    "export const CleoHeavyCommand = async ({ directory }) => ({",
+    "  'tool.execute.before': async (input, output) => {",
+    "    if (input?.tool !== 'bash' || typeof output?.args?.command !== 'string') return;",
+    "    if (process.env.CLEO_HEAVY_COMMAND_HOOK === 'off') return;",
+    "    if (!HEAVY.test(output.args.command)) return;",
+    "    try {",
+    "      const text = await ask({ tool_name: 'bash', tool_input: output.args, cwd: directory });",
+    "      const answer = JSON.parse(text || '{}');",
+    "      if (typeof answer.command === 'string') output.args.command = answer.command;",
+    "      if (typeof answer.timeout === 'number') output.args.timeout = answer.timeout;",
+    "      if (typeof answer.context === 'string' && input.callID) contexts.set(input.callID, answer.context);",
+    "    } catch {",
+    "      // Fail open.",
+    "    }",
+    "  },",
+    "  'tool.execute.after': async (input, output) => {",
+    "    const context = input?.callID ? contexts.get(input.callID) : undefined;",
+    "    if (context === undefined) return;",
+    "    contexts.delete(input.callID);",
+    "    if (typeof output?.output === 'string') output.output += '\\n\\n' + context;",
+    "  },",
+    "});",
+    ""
+  ].join("\n");
+}
+function syncOpencodeHeavyCommandPlugin(projectDir, mode) {
+  const pluginPath = join(projectDir, OPENCODE_PLUGIN_FILE);
+  const exists = existsSync(pluginPath);
+  if (mode === "off") {
+    unexcludeHookFileFromGit(projectDir, OPENCODE_PLUGIN_FILE);
+    if (!exists) return "unchanged";
+    rmSync(pluginPath, { force: true });
+    return "removed";
+  }
+  const source = opencodeHeavyCommandPluginSource();
+  const current = exists && readFileSync(pluginPath, "utf-8") === source;
+  if (!current) {
+    ensureParentDir(pluginPath);
+    writeFileSync(pluginPath, source, "utf-8");
+  }
+  excludeHookFileFromGit(projectDir, OPENCODE_PLUGIN_FILE);
+  return current ? "unchanged" : exists ? "updated" : "installed";
+}
+
+// packages/adapters/src/providers/shared/heavy-command-hook-delivery.ts
+var HEAVY_HOOK_DELIVERY_PROVIDERS = Object.freeze([
+  "claude-code",
+  "codex",
+  "opencode",
+  "kimi"
+]);
+var HEAVY_HOOK_FIX_COMMAND = "cleo doctor heavy-command-hook --fix";
+var CODEX_SHARED_REMEDY = "if the team wants Codex governed here, add CLEO's PreToolUse entry (the snippet) to .codex/hooks.json yourself and commit it deliberately; CLEO never writes or hides a project's own hook config";
+var KIMI_REASON = "Kimi reads hooks only from its global ~/.kimi/config.toml, and CLEO never writes user-global configs";
+var KIMI_REMEDY = "add a [[hooks]] entry for PreToolUse that runs `cleo hook heavy-command --provider kimi` to ~/.kimi/config.toml yourself";
+function homeOf(env) {
+  return env.HOME || homedir2();
+}
+function heavyHookTarget(provider, projectDir, env = process.env) {
+  switch (provider) {
+    case "claude-code":
+      return join2(projectDir, CLAUDE_LOCAL_SETTINGS);
+    case "codex":
+      return join2(projectDir, CODEX_HOOKS_FILE);
+    case "opencode":
+      return join2(projectDir, OPENCODE_PLUGIN_FILE);
+    case "kimi":
+      return join2(homeOf(env), ".kimi", "config.toml");
+  }
+}
+function detectHeavyHookProvider(provider, projectDir, env = process.env) {
+  const home = homeOf(env);
+  const signals = provider === "claude-code" ? [
+    [
+      env.CLAUDECODE === "1" || Boolean(env.CLAUDE_CODE_ENTRYPOINT),
+      "running inside Claude Code"
+    ],
+    [() => existsSync2(join2(projectDir, ".claude")), "the project has .claude/"],
+    [() => findOnPath("claude", { env }) !== null, "`claude` is on PATH"],
+    [() => existsSync2(env.CLAUDE_CONFIG_DIR || join2(home, ".claude")), "~/.claude exists"]
+  ] : provider === "codex" ? [
+    [() => existsSync2(join2(projectDir, ".codex")), "the project has .codex"],
+    [() => findOnPath("codex", { env }) !== null, "`codex` is on PATH"],
+    [() => existsSync2(env.CODEX_HOME || join2(home, ".codex")), "~/.codex exists"]
+  ] : provider === "opencode" ? [
+    [() => existsSync2(join2(projectDir, ".opencode")), "the project has .opencode/"],
+    [
+      () => existsSync2(join2(projectDir, "opencode.json")) || existsSync2(join2(projectDir, "opencode.jsonc")),
+      "the project has opencode.json"
+    ],
+    [() => findOnPath("opencode", { env }) !== null, "`opencode` is on PATH"],
+    [
+      () => existsSync2(join2(env.XDG_CONFIG_HOME || join2(home, ".config"), "opencode")),
+      "~/.config/opencode exists"
+    ]
+  ] : [
+    [() => findOnPath("kimi", { env }) !== null, "`kimi` is on PATH"],
+    [() => existsSync2(join2(home, ".kimi")), "~/.kimi exists"]
+  ];
+  for (const [test, why] of signals) {
+    if (typeof test === "boolean" ? test : test()) return { detected: true, why };
+  }
+  if (provider !== "kimi" && existsSync2(heavyHookTarget(provider, projectDir, env))) {
+    return { detected: true, why: "its hook config exists" };
+  }
+  return {
+    detected: false,
+    why: `${provider} is not in use here (no config directory or CLI found)`
+  };
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function syncAskEnforceHook(provider, target, mode, env) {
+  const install = mode !== "off" && env.CLEO_ASK_ENFORCE?.trim().toLowerCase() !== "off";
+  try {
+    await syncJsonAskEnforceHook(target, provider, install);
+  } catch {
+  }
+}
+async function syncProvider(provider, projectDir, mode, env) {
+  const target = heavyHookTarget(provider, projectDir, env);
+  if (provider === "kimi") {
+    return mode === "off" ? { provider, status: "unchanged", target } : { provider, status: "unsupported", target, reason: KIMI_REASON, remedy: KIMI_REMEDY };
+  }
+  try {
+    const result = provider === "claude-code" ? await syncClaudeCodeHeavyCommandHook(projectDir, mode) : provider === "codex" ? await syncCodexHeavyCommandHook(projectDir, mode) : syncOpencodeHeavyCommandPlugin(projectDir, mode);
+    if (provider !== "opencode") await syncAskEnforceHook(provider, target, mode, env);
+    return { provider, status: result, target };
+  } catch (err) {
+    if (err instanceof HeavyHookSharedConfigError) {
+      return {
+        provider,
+        status: "needs-consent",
+        target,
+        reason: err.message,
+        ...mode === "off" ? {
+          remedy: "the team committed CLEO's hook in .codex/hooks.json; remove it there in a team change if the team agrees"
+        } : { remedy: CODEX_SHARED_REMEDY, snippet: codexHookSnippet() }
+      };
+    }
+    if (err instanceof HeavyHookPathBlockedError) {
+      return {
+        provider,
+        status: "blocked",
+        target,
+        reason: err.message,
+        remedy: `remove or rename ${err.path} (it is not a directory), then run: ${HEAVY_HOOK_FIX_COMMAND}`
+      };
+    }
+    return {
+      provider,
+      status: "failed",
+      target,
+      reason: errorText(err),
+      remedy: err instanceof JsonConfigParseError ? `fix the JSON in ${err.filePath} (it was left untouched), then run: ${HEAVY_HOOK_FIX_COMMAND}` : `run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+}
+async function syncProjectHeavyCommandHooks(projectDir, mode, options = {}) {
+  const env = options.env ?? process.env;
+  const providers = options.providers ?? HEAVY_HOOK_DELIVERY_PROVIDERS;
+  const home = isUserHomeDir(projectDir, homeOf(env));
+  const outcomes = [];
+  for (const provider of providers) {
+    const target = heavyHookTarget(provider, projectDir, env);
+    if (home) {
+      outcomes.push({
+        provider,
+        status: "skipped",
+        target,
+        reason: "the project is your home directory, whose provider configs are user-global"
+      });
+      continue;
+    }
+    const detection = detectHeavyHookProvider(provider, projectDir, env);
+    if (mode !== "off" && !detection.detected) {
+      outcomes.push({ provider, status: "skipped", target, reason: detection.why });
+      continue;
+    }
+    outcomes.push(await syncProvider(provider, projectDir, mode, env));
+  }
+  return outcomes;
+}
+function jsonHookPresence(file, provider) {
+  let raw;
+  try {
+    raw = readFileSync2(file, "utf-8");
+  } catch (err) {
+    const code = err.code;
+    return code === "ENOENT" || code === "ENOTDIR" ? { kind: "absent" } : { kind: "unreadable", error: errorText(err) };
+  }
+  if (raw.trim() === "") return { kind: "absent" };
+  let config;
+  try {
+    config = JSON.parse(raw);
+  } catch (err) {
+    return { kind: "unreadable", error: errorText(err) };
+  }
+  if (!isPlainObject(config))
+    return { kind: "unreadable", error: "top-level value is not an object" };
+  const hooks = config.hooks;
+  const groups = isPlainObject(hooks) ? hooks.PreToolUse : void 0;
+  if (!Array.isArray(groups)) return { kind: "absent" };
+  const expected = JSON.stringify(heavyCommandHookObject(provider));
+  let found = { kind: "absent" };
+  for (const group of groups) {
+    if (!isPlainObject(group) || !Array.isArray(group.hooks)) continue;
+    for (const hook of group.hooks) {
+      if (!isHeavyHookObject(hook)) continue;
+      if (JSON.stringify(hook) === expected) return { kind: "present", current: true };
+      found = { kind: "present", current: false };
+    }
+  }
+  return found;
+}
+function presenceOf(provider, projectDir, target) {
+  if (provider !== "opencode") {
+    const local = jsonHookPresence(target, provider);
+    if (provider !== "claude-code" || local.kind !== "absent") return local;
+    const legacy = jsonHookPresence(join2(projectDir, ".claude", "settings.json"), provider);
+    return legacy.kind === "present" ? { kind: "present", current: false } : { kind: "absent" };
+  }
+  if (!existsSync2(target)) return { kind: "absent" };
+  try {
+    return {
+      kind: "present",
+      current: readFileSync2(target, "utf-8") === opencodeHeavyCommandPluginSource()
+    };
+  } catch (err) {
+    return { kind: "unreadable", error: errorText(err) };
+  }
+}
+var HOOK_FILES = {
+  "claude-code": CLAUDE_LOCAL_SETTINGS,
+  codex: CODEX_HOOKS_FILE,
+  opencode: OPENCODE_PLUGIN_FILE
+};
+function inspectProvider(provider, projectDir, mode, env, gitChecks) {
+  const target = heavyHookTarget(provider, projectDir, env);
+  const { detected, why } = detectHeavyHookProvider(provider, projectDir, env);
+  const base = { provider, detected, target };
+  if (provider === "kimi") {
+    if (!detected || mode === "off") return { ...base, state: "not-detected", detail: why };
+    let manual = false;
+    try {
+      manual = readFileSync2(target, "utf-8").includes(HEAVY_COMMAND_HOOK_ID);
+    } catch {
+    }
+    return manual ? { ...base, state: "installed", detail: `a manual entry in ${target} runs the hook` } : { ...base, state: "unsupported", detail: `${why}; ${KIMI_REASON}`, remedy: KIMI_REMEDY };
+  }
+  const presence = presenceOf(provider, projectDir, target);
+  if (presence.kind === "unreadable") {
+    return {
+      ...base,
+      state: "unreadable",
+      detail: `${target} cannot be read or parsed (${presence.error})`,
+      remedy: `fix ${target}, then run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+  if (mode === "off") {
+    return presence.kind === "present" ? {
+      ...base,
+      state: "outdated",
+      detail: "resources.heavyCommandHook is off, but the hook is still installed",
+      remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes it)`
+    } : { ...base, state: "disabled", detail: "resources.heavyCommandHook is off" };
+  }
+  if (presence.kind === "present") {
+    if (!presence.current) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `the hook in ${target} (or a legacy location) was written by another CLEO build`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND}`
+      };
+    }
+    if (!gitChecks) return { ...base, state: "installed", detail: `installed in ${target}` };
+    const shared2 = provider === "codex" ? codexHooksSharedReason(projectDir, true) : null;
+    if (shared2 !== null && excludedByCleo(projectDir, CODEX_HOOKS_FILE)) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `CLEO's info/exclude line hides ${target}, which ${shared2}`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes CLEO's exclude line)`
+      };
+    }
+    if (shared2 !== null) {
+      const modified = trackedFileModified(projectDir, CODEX_HOOKS_FILE);
+      if (modified || hookFileVisibleToGit(projectDir, CODEX_HOOKS_FILE)) {
+        return {
+          ...base,
+          state: "outdated",
+          detail: `CLEO's per-machine hook sits in ${target}, which ${shared2}, as ${modified ? "an uncommitted change" : "an untracked file"}: one \`git commit -a\` ships it to the team, and it widens evidence scope`,
+          remedy: "remove CLEO's entry from .codex/hooks.json, or commit it deliberately if the team wants Codex governed"
+        };
+      }
+      return { ...base, state: "installed", detail: `installed in ${target}, which ${shared2}` };
+    }
+    if (hookFileVisibleToGit(projectDir, HOOK_FILES[provider])) {
+      return {
+        ...base,
+        state: "outdated",
+        detail: `${target} is installed but git sees it as an untracked file (it widens evidence scope)`,
+        remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (adds it to the repository's info/exclude)`
+      };
+    }
+    return { ...base, state: "installed", detail: `installed in ${target}` };
+  }
+  if (!detected) return { ...base, state: "not-detected", detail: why };
+  const shared = provider === "codex" ? codexHooksSharedReason(projectDir, gitChecks) : null;
+  if (shared !== null && gitChecks && excludedByCleo(projectDir, CODEX_HOOKS_FILE)) {
+    return {
+      ...base,
+      state: "outdated",
+      detail: `CLEO's info/exclude line hides ${target}, which ${shared}`,
+      remedy: `run: ${HEAVY_HOOK_FIX_COMMAND} (removes CLEO's exclude line)`
+    };
+  }
+  if (shared !== null) {
+    return {
+      ...base,
+      state: "needs-consent",
+      detail: `${target} ${shared}, so CLEO does not write or hide it; Codex runs ungoverned here until the team adds the entry (${why})`,
+      remedy: CODEX_SHARED_REMEDY,
+      snippet: codexHookSnippet()
+    };
+  }
+  const blocked = nonDirectoryAncestor(dirname2(target));
+  if (blocked !== null) {
+    return {
+      ...base,
+      state: "blocked",
+      detail: `${blocked} exists but is not a directory, so the hook cannot be installed (${why})`,
+      remedy: `remove or rename ${blocked}, then run: ${HEAVY_HOOK_FIX_COMMAND}`
+    };
+  }
+  return {
+    ...base,
+    state: "missing",
+    detail: `${why}, but ${target} has no heavy-command hook: agent-run tests and builds bypass the machine-wide budget`,
+    remedy: `run: ${HEAVY_HOOK_FIX_COMMAND}`
+  };
+}
+function inspectProjectHeavyCommandHooks(projectDir, mode, options = {}) {
+  const env = options.env ?? process.env;
+  const providers = options.providers ?? HEAVY_HOOK_DELIVERY_PROVIDERS;
+  if (isUserHomeDir(projectDir, homeOf(env))) {
+    return providers.map((provider) => ({
+      provider,
+      detected: false,
+      state: "not-detected",
+      target: heavyHookTarget(provider, projectDir, env),
+      detail: "the project is your home directory; CLEO installs this hook per project only"
+    }));
+  }
+  const gitChecks = options.gitChecks ?? true;
+  return providers.map((provider) => inspectProvider(provider, projectDir, mode, env, gitChecks));
+}
+var OLDER_CLEO_MARKER_TTL_MS = 60 * 60 * 1e3;
+function olderCleoMarkerPath(cleoPath, dir, env) {
+  try {
+    const key = execFileSync2(
+      "/bin/sh",
+      ["-c", `printf '%s|%s' "$1" "$2" | cksum | tr -c '0-9' '-'`, "sh", cleoPath, dir],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 }
+    );
+    const base = env.XDG_RUNTIME_DIR || env.TMPDIR || "/tmp";
+    return join2(base, `${OLDER_CLEO_MARKER_PREFIX}${key}`);
+  } catch {
+    return null;
+  }
+}
+function hasOlderCleoMarker(cleoPath, dir, env) {
+  const marker = olderCleoMarkerPath(cleoPath, dir, env);
+  if (marker === null) return false;
+  try {
+    const st = lstatSync(marker);
+    if (!st.isFile()) return false;
+    if (Date.now() - st.mtimeMs > OLDER_CLEO_MARKER_TTL_MS) return false;
+    return statSync2(cleoPath).mtimeMs <= st.mtimeMs;
+  } catch {
+    return false;
+  }
+}
+function probeHeavyHookCli(projectDir, options = {}) {
+  const env = options.env ?? process.env;
+  const path = findOnPath("cleo", { env });
+  if (path === null) {
+    return {
+      state: "missing",
+      path: null,
+      detail: "no `cleo` on PATH, so the hook lets every heavy command run ungoverned",
+      remedy: "install CLEO so `cleo` is on PATH: npm i -g @cleocode/cleo"
+    };
+  }
+  const older = {
+    state: "older",
+    path,
+    detail: `${path} predates \`cleo hook\` and \`cleo run\`, so the hook lets every heavy command run ungoverned`,
+    remedy: `upgrade the cleo at ${path} (npm i -g @cleocode/cleo, or your version manager), then run: ${HEAVY_HOOK_FIX_COMMAND}`
+  };
+  if (hasOlderCleoMarker(path, projectDir, env)) return older;
+  const probe = spawnSync(path, ["hook", "heavy-command", "--provider", "claude-code"], {
+    cwd: projectDir,
+    env: { ...env },
+    input: "{}",
+    encoding: "utf-8",
+    timeout: 2e4
+  });
+  if (probe.status === 0) {
+    return { state: "current", path, detail: `${path} answers \`cleo hook heavy-command\`` };
+  }
+  if (probe.status === 127 && /Unknown command/.test(probe.stderr ?? "")) return older;
+  const outcome = probe.status !== null ? `exit ${probe.status}` : probe.error?.message ?? `signal ${probe.signal ?? "none"}`;
+  return {
+    state: "unknown",
+    path,
+    detail: `${path} did not answer \`cleo hook heavy-command\` (${outcome}); the hook fails open, so heavy commands run ungoverned while it does not`,
+    remedy: `run \`${path} hook heavy-command < /dev/null\` in ${projectDir} to see why it fails (a broken version-manager shim, say)`
+  };
+}
+var heavyHookDeliveryApi = Object.freeze({
+  syncProjectHeavyCommandHooks,
+  inspectProjectHeavyCommandHooks,
+  probeHeavyHookCli
+});
+export {
+  HEAVY_HOOK_DELIVERY_PROVIDERS,
+  HEAVY_HOOK_FIX_COMMAND,
+  detectHeavyHookProvider,
+  heavyHookDeliveryApi,
+  heavyHookTarget,
+  inspectProjectHeavyCommandHooks,
+  probeHeavyHookCli,
+  syncProjectHeavyCommandHooks
+};
+//# sourceMappingURL=heavy-command-hook.js.map