@cleocode/adapters 2026.10.6 → 2026.10.7

package/dist/providers/shared/heavy-command-hook-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heavy-command-hook-delivery.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/heavy-command-hook-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AA0B7B,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B,EAAE,SAAS,wBAAwB,EAK3E,CAAC;AAEH,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAE7E,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAgBxD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,wBAAwB,EAClC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,GAAiB,GACrB,MAAM,CAWR;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,wBAAwB,EAClC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,GAAiB,GACrB,kBAAkB,CAgDpB;AAgED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,EAC1B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAwB9C;AA2MD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,EAC1B,OAAO,GAAE,wBAA6B,GACrC,SAAS,mBAAmB,EAAE,CAchC;AAwCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CA6CnB;AAED,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,EAAE,oBAIjC,CAAC"}
+{"version":3,"file":"heavy-command-hook-delivery.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/heavy-command-hook-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AA2B7B,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B,EAAE,SAAS,wBAAwB,EAK3E,CAAC;AAEH,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAE7E,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAgBxD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,wBAAwB,EAClC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,GAAiB,GACrB,MAAM,CAWR;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,wBAAwB,EAClC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,GAAiB,GACrB,kBAAkB,CAgDpB;AAsFD;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,EAC1B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAwB9C;AA2MD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,EAC1B,OAAO,GAAE,wBAA6B,GACrC,SAAS,mBAAmB,EAAE,CAchC;AAwCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CA6CnB;AAED,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,EAAE,oBAIjC,CAAC"}

package/dist/providers/shared/heavy-command-hook-install.d.ts

@@ -145,6 +145,29 @@ export declare function isHeavyHookObject(hook: unknown): boolean;
  * @returns what changed.
  */
 export declare function syncJsonHeavyCommandHook(configPath: string, provider: 'claude-code' | 'codex', mode: HeavyCommandHookMode): Promise<HeavyHookSyncResult>;
+/** The command CLEO's ask-enforce Stop hook runs (T13420); also its marker. */
+export declare const ASK_ENFORCE_HOOK_ID = "cleo hook ask-enforce";
+/**
+ * CLEO's ask-enforce Stop hook object (T13420). The script prints the hook's
+ * answer only when it is a JSON object and always exits 0, so a machine
+ * without `cleo`, or an older `cleo` that lacks the subcommand, never blocks.
+ *
+ * @param provider - `claude-code` or `codex` (Codex runs hooks through the login shell).
+ */
+export declare function askEnforceHookObject(provider: 'claude-code' | 'codex'): Record<string, unknown>;
+/** Whether one hook object is CLEO's ask-enforce Stop hook. */
+export declare function isAskEnforceHookObject(hook: unknown): boolean;
+/**
+ * Add, refresh or (`install: false`) remove CLEO's ask-enforce Stop hook in a
+ * JSON hook config (`hooks.Stop`), through CAAMP's locked atomic writer. Only
+ * CLEO's own hook object is touched; a malformed file throws untouched.
+ *
+ * @param configPath - the config file (created when missing, unless removing).
+ * @param provider - `claude-code` or `codex`.
+ * @param install - `false` removes the hook.
+ * @returns what changed.
+ */
+export declare function syncJsonAskEnforceHook(configPath: string, provider: 'claude-code' | 'codex', install: boolean): Promise<HeavyHookSyncResult>;
 /** Claude Code's per-machine settings file, relative to the project. */
 export declare const CLAUDE_LOCAL_SETTINGS = ".claude/settings.local.json";
 /** First line of the `info/exclude` block CLEO adds for `settings.local.json` (and alone may remove). */

package/dist/providers/shared/heavy-command-hook-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heavy-command-hook-install.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/heavy-command-hook-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAgBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,iFAAiF;AACjF,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,kDAAkD;AAClD,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EA+B5C,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAehG;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;gBACS,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAKzC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/D;AASD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CAEnF;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAOjC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AAEjE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAgD,GACpD,MAAM,CAkBR;AAqDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAIjF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMjG;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhG;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAOxD;AAkDD;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GAAG,OAAO,EACjC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AAEnE,yGAAyG;AACzG,eAAO,MAAM,6BAA6B,sFAC2C,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,gFAC0C,CAAC;AAEhF,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,4CAAuD,CAAC;AA6BzF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAiC,GACxC,OAAO,CAYT;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAIjF;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;gBACS,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAKtC;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,MAAM,GAAG,IAAI,CAmBzF;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAgBvE;AAsBD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CA0BtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAmDzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,GACzB,mBAAmB,CAkBrB"}
+{"version":3,"file":"heavy-command-hook-install.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/heavy-command-hook-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAgBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,iFAAiF;AACjF,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,kDAAkD;AAClD,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EA+B5C,CAAC;AAEH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAehG;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;gBACS,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAKzC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/D;AASD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CAEnF;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAOjC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AAEjE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAgD,GACpD,MAAM,CAkBR;AAqDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAIjF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMjG;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhG;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAOxD;AAsDD;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GAAG,OAAO,EACjC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ/F;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAO7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GAAG,OAAO,EACjC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,mBAAmB,CAAC,CA4B9B;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AAEnE,yGAAyG;AACzG,eAAO,MAAM,6BAA6B,sFAC2C,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,gFAC0C,CAAC;AAEhF,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,4CAAuD,CAAC;AA6BzF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAiC,GACxC,OAAO,CAYT;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAIjF;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;gBACS,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAKtC;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,MAAM,GAAG,IAAI,CAmBzF;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAgBvE;AAsBD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CA0BtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAuB9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAmDzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,GACzB,mBAAmB,CAkBrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/adapters",
-  "version": "2026.10.6",
+  "version": "2026.10.7",
   "description": "Unified provider adapters for CLEO (Claude Code, OpenCode, Cursor)",
   "type": "module",
   "main": "dist/index.js",
@@ -19,9 +19,9 @@
     "@ai-sdk/anthropic": "^3.0.69",
     "@ai-sdk/openai": "^2.0.53",
     "ai": "^6.0.168",
-    "@cleocode/caamp": "2026.10.6",
-    "@cleocode/contracts": "2026.10.6",
-    "@cleocode/paths": "2026.10.6"
+    "@cleocode/contracts": "2026.10.7",
+    "@cleocode/paths": "2026.10.7",
+    "@cleocode/caamp": "2026.10.7"
   },
   "license": "MIT",
   "engines": {
@@ -34,7 +34,7 @@
   "devDependencies": {
     "@types/node": "^24.3.0",
     "vitest": "^4.1.4",
-    "@cleocode/playbooks": "2026.10.6"
+    "@cleocode/playbooks": "2026.10.7"
   },
   "repository": {
     "type": "git",

package/src/providers/shared/__tests__/heavy-command-hook-delivery.test.ts

@@ -96,6 +96,22 @@ describe('syncProjectHeavyCommandHooks', () => {
     });
   });
 
+  it('installs the ask-enforce Stop hook beside it for Claude Code and Codex (T13420)', async () => {
+    useAll();
+    await syncProjectHeavyCommandHooks(project, 'rewrite', { env });
+    const stop = (file: string) =>
+      JSON.stringify(JSON.parse(readFileSync(file, 'utf-8')).hooks.Stop ?? []);
+    const claude = join(project, '.claude', 'settings.local.json');
+    const codex = join(project, '.codex', 'hooks.json');
+    expect(stop(claude)).toContain('cleo hook ask-enforce --provider claude-code');
+    expect(stop(codex)).toContain('cleo hook ask-enforce --provider codex');
+    await syncProjectHeavyCommandHooks(project, 'rewrite', {
+      env: { ...env, CLEO_ASK_ENFORCE: 'off' },
+    });
+    expect(stop(claude)).not.toContain('ask-enforce');
+    expect(stop(codex)).not.toContain('ask-enforce');
+  });
+
   it('a .codex FILE blocks only Codex, with the reason and remedy; the others install', async () => {
     useAll();
     writeFileSync(join(project, '.codex'), '');

package/src/providers/shared/__tests__/heavy-command-hook-install.test.ts

@@ -46,6 +46,8 @@ import { CodexInstallProvider } from '../../codex/install.js';
 import { CursorInstallProvider } from '../../cursor/install.js';
 import { OpenCodeInstallProvider } from '../../opencode/install.js';
 import {
+  ASK_ENFORCE_HOOK_ID,
+  askEnforceHookObject,
   clearOlderCleoMarkers,
   excludeLocalSettingsFromGit,
   HEAVY_COMMAND_HOOK_TIMEOUT_SEC,
@@ -57,6 +59,7 @@ import {
   OLDER_CLEO_HOOK_ANSWER,
   OLDER_CLEO_MARKER_PREFIX,
   OPENCODE_HEAVY_COMMAND_PLUGIN,
+  syncJsonAskEnforceHook,
   syncJsonHeavyCommandHook,
   syncOpencodeHeavyCommandPlugin,
 } from '../heavy-command-hook-install.js';
@@ -327,6 +330,43 @@ describe.each(SHELLS)('heavyCommandHookCommand under %s', (shell) => {
   });
 });
 
+describe('syncJsonAskEnforceHook (T13420)', () => {
+  const read = (p: string) => JSON.parse(readFileSync(p, 'utf-8'));
+
+  it('adds one Stop entry beside the heavy-command hook, then is idempotent', async () => {
+    const path = join(dir, 'project', '.claude', 'settings.local.json');
+    await syncJsonHeavyCommandHook(path, 'claude-code', 'rewrite');
+    expect(await syncJsonAskEnforceHook(path, 'claude-code', true)).toBe('installed');
+    expect(read(path).hooks).toEqual({
+      PreToolUse: [heavyCommandHookEntry('claude-code')],
+      Stop: [{ hooks: [askEnforceHookObject('claude-code')] }],
+    });
+    expect(await syncJsonAskEnforceHook(path, 'claude-code', true)).toBe('unchanged');
+  });
+
+  it('keeps user Stop hooks, refreshes a stale CLEO one, and removes only its own', async () => {
+    const path = join(dir, 'hooks.json');
+    const user = { hooks: [{ type: 'command', command: './notify.sh' }] };
+    const stale = { hooks: [{ type: 'command', command: `${ASK_ENFORCE_HOOK_ID} # cleo-hook` }] };
+    writeFileSync(path, JSON.stringify({ hooks: { Stop: [user, stale] } }));
+    expect(await syncJsonAskEnforceHook(path, 'codex', true)).toBe('updated');
+    expect(read(path).hooks.Stop).toEqual([user, { hooks: [askEnforceHookObject('codex')] }]);
+    expect(await syncJsonAskEnforceHook(path, 'codex', false)).toBe('removed');
+    expect(read(path).hooks.Stop).toEqual([user]);
+    expect(await syncJsonAskEnforceHook(join(dir, 'missing.json'), 'codex', false)).toBe(
+      'unchanged',
+    );
+  });
+
+  it('runs a fail-open script: exits 0 and prints only a JSON answer', () => {
+    const claude = String(askEnforceHookObject('claude-code').command);
+    expect(claude).toContain('command -v cleo >/dev/null 2>&1 || exit 0');
+    expect(claude).toContain(`${ASK_ENFORCE_HOOK_ID} --provider claude-code 2>/dev/null`);
+    expect(claude.endsWith('exit 0 # cleo-hook')).toBe(true);
+    expect(String(askEnforceHookObject('codex').command)).toMatch(/^\/bin\/sh -c '/);
+  });
+});
+
 describe('syncJsonHeavyCommandHook', () => {
   const read = (p: string) => JSON.parse(readFileSync(p, 'utf-8'));
 

package/src/providers/shared/heavy-command-hook-delivery.ts

@@ -56,6 +56,7 @@ import {
   opencodeHeavyCommandPluginSource,
   syncClaudeCodeHeavyCommandHook,
   syncCodexHeavyCommandHook,
+  syncJsonAskEnforceHook,
   syncOpencodeHeavyCommandPlugin,
   trackedFileModified,
 } from './heavy-command-hook-install.js';
@@ -191,6 +192,27 @@ function errorText(err: unknown): string {
 }
 
 /** Sync one provider; never throws. */
+/**
+ * Install (or remove) CLEO's ask-enforce Stop hook (T13420) in the same JSON
+ * config as the heavy-command hook, after that hook synced. It rides the
+ * heavy-command delivery: removed when that hook's mode is `off` or when
+ * `CLEO_ASK_ENFORCE=off`. Never fails the heavy-command outcome.
+ * shortcut: no separate outcome or doctor row yet; add one when a config key replaces the env switch.
+ */
+async function syncAskEnforceHook(
+  provider: 'claude-code' | 'codex',
+  target: string,
+  mode: HeavyCommandHookMode,
+  env: Env,
+): Promise<void> {
+  const install = mode !== 'off' && env.CLEO_ASK_ENFORCE?.trim().toLowerCase() !== 'off';
+  try {
+    await syncJsonAskEnforceHook(target, provider, install);
+  } catch {
+    // Fail open: a config the Stop hook cannot be written to keeps the heavy-command result.
+  }
+}
+
 async function syncProvider(
   provider: HeavyCommandHookProvider,
   projectDir: string,
@@ -210,6 +232,7 @@ async function syncProvider(
         : provider === 'codex'
           ? await syncCodexHeavyCommandHook(projectDir, mode)
           : syncOpencodeHeavyCommandPlugin(projectDir, mode);
+    if (provider !== 'opencode') await syncAskEnforceHook(provider, target, mode, env);
     return { provider, status: result, target };
   } catch (err) {
     if (err instanceof HeavyHookSharedConfigError) {

package/src/providers/shared/heavy-command-hook-install.ts

@@ -335,20 +335,24 @@ export function isHeavyHookObject(hook: unknown): boolean {
 }
 
 /**
- * Put `desired` in place of CLEO's first heavy-command hook object, drop any
- * other copies, and drop a matcher group only when CLEO's hook was all it
- * held. `desired: null` removes CLEO's hook everywhere.
+ * Put `desired` in place of CLEO's first hook object of one kind under
+ * `hooks.<event>`, drop any other copies, and drop a matcher group only when
+ * CLEO's hook was all it held. `desired: null` removes CLEO's hook everywhere.
  *
+ * @param event - the hook event (`PreToolUse` for heavy-command, `Stop` for ask-enforce).
+ * @param isMine - recognises CLEO's hook object of this kind.
  * @returns whether the groups changed, and whether CLEO's hook was found.
  */
 function placeHeavyHook(
   hooks: Record<string, unknown>,
   desired: Record<string, unknown> | null,
+  event = 'PreToolUse',
+  isMine: (hook: unknown) => boolean = isHeavyHookObject,
 ): { readonly changed: boolean; readonly found: boolean } {
-  const groups = hooks.PreToolUse;
+  const groups = hooks[event];
   if (groups === undefined) return { changed: false, found: false };
   if (!Array.isArray(groups)) {
-    throw new Error('hooks "PreToolUse" is not an array; not modifying it');
+    throw new Error(`hooks "${event}" is not an array; not modifying it`);
   }
   let changed = false;
   let found = false;
@@ -361,7 +365,7 @@ function placeHeavyHook(
     const kept: unknown[] = [];
     let groupChanged = false;
     for (const hook of group.hooks) {
-      if (!isHeavyHookObject(hook)) {
+      if (!isMine(hook)) {
         kept.push(hook);
       } else if (desired !== null && !found) {
         found = true;
@@ -378,7 +382,7 @@ function placeHeavyHook(
     changed = true;
     if (kept.length > 0) next.push({ ...group, hooks: kept });
   }
-  if (changed) hooks.PreToolUse = next;
+  if (changed) hooks[event] = next;
   return { changed, found };
 }
 
@@ -426,6 +430,80 @@ export async function syncJsonHeavyCommandHook(
   return result;
 }
 
+/** The command CLEO's ask-enforce Stop hook runs (T13420); also its marker. */
+export const ASK_ENFORCE_HOOK_ID = 'cleo hook ask-enforce';
+
+/**
+ * CLEO's ask-enforce Stop hook object (T13420). The script prints the hook's
+ * answer only when it is a JSON object and always exits 0, so a machine
+ * without `cleo`, or an older `cleo` that lacks the subcommand, never blocks.
+ *
+ * @param provider - `claude-code` or `codex` (Codex runs hooks through the login shell).
+ */
+export function askEnforceHookObject(provider: 'claude-code' | 'codex'): Record<string, unknown> {
+  const script = `command -v cleo >/dev/null 2>&1 || exit 0; out="$(${ASK_ENFORCE_HOOK_ID} --provider ${provider} 2>/dev/null)"; case "$out" in "{"*) printf '%s\\n' "$out";; esac; exit 0`;
+  const line = provider === 'codex' ? `/bin/sh -c ${shellWord(script)}` : script;
+  return {
+    type: 'command',
+    command: `${line} ${CLEO_HOOK_MARKER}`,
+    timeout: HEAVY_COMMAND_HOOK_TIMEOUT_SEC,
+  };
+}
+
+/** Whether one hook object is CLEO's ask-enforce Stop hook. */
+export function isAskEnforceHookObject(hook: unknown): boolean {
+  return (
+    isPlainObject(hook) &&
+    typeof hook.command === 'string' &&
+    hook.command.includes(CLEO_HOOK_MARKER) &&
+    hook.command.includes(ASK_ENFORCE_HOOK_ID)
+  );
+}
+
+/**
+ * Add, refresh or (`install: false`) remove CLEO's ask-enforce Stop hook in a
+ * JSON hook config (`hooks.Stop`), through CAAMP's locked atomic writer. Only
+ * CLEO's own hook object is touched; a malformed file throws untouched.
+ *
+ * @param configPath - the config file (created when missing, unless removing).
+ * @param provider - `claude-code` or `codex`.
+ * @param install - `false` removes the hook.
+ * @returns what changed.
+ */
+export async function syncJsonAskEnforceHook(
+  configPath: string,
+  provider: 'claude-code' | 'codex',
+  install: boolean,
+): Promise<HeavyHookSyncResult> {
+  const mine = (hook: unknown) => isAskEnforceHookObject(hook);
+  if (!install) {
+    if (!existsSync(configPath)) return 'unchanged';
+    const removed = await updateJsonConfigFile(configPath, (config) => {
+      if (config.hooks === undefined) return false;
+      return placeHeavyHook(hookMap(config), null, 'Stop', mine).changed;
+    });
+    return removed ? 'removed' : 'unchanged';
+  }
+  ensureParentDir(configPath);
+  let result: HeavyHookSyncResult = 'unchanged';
+  await updateJsonConfigFile(configPath, (config) => {
+    const hooks = hookMap(config);
+    const placed = placeHeavyHook(hooks, askEnforceHookObject(provider), 'Stop', mine);
+    if (placed.found) {
+      if (placed.changed) result = 'updated';
+      return placed.changed;
+    }
+    const existing = hooks.Stop;
+    hooks.Stop = [
+      ...(Array.isArray(existing) ? existing : []),
+      { hooks: [askEnforceHookObject(provider)] },
+    ];
+    result = 'installed';
+    return true;
+  });
+  return result;
+}
+
 /** Claude Code's per-machine settings file, relative to the project. */
 export const CLAUDE_LOCAL_SETTINGS = '.claude/settings.local.json';