@codyswann/lisa 2.124.1 → 2.124.3

package/plugins/src/base/hooks/block-no-verify.agy.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Antigravity (agy) PreToolUse hook: blocks shell commands that bypass Lisa's
+# git quality gates via `--no-verify` (exact parity with the Claude
+# block-no-verify.sh — only the long flag, to avoid `-n` false positives).
+#
+# agy protocol (distinct from the Claude block-no-verify.sh exit-code protocol):
+#   - stdin  = JSON: { "toolCall": { "name": "run_command",
+#                      "args": { "CommandLine": "<shell command>" } }, ... }
+#   - stdout = JSON decision: {"decision":"deny","reason":"..."} | {"decision":"allow"}
+#
+# Shipped as a GLOBAL agy plugin hook (hooks.json at the plugin root, installed
+# to ~/.gemini/config/plugins/<variant>/). Matches agy's shell tool `run_command`
+# on PreToolUse. jq parses the JSON envelope (per project rule: never grep/sed
+# JSON); the command string itself is matched with grep (it is a plain string,
+# not JSON). Malformed/empty stdin → allow (fail open, never crash the tool).
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"decision":"allow"}'
+  exit 0
+}
+
+deny() {
+  printf '%s\n' '{"decision":"deny","reason":"--no-verify bypasses Lisa pre-commit/pre-push quality gates. Fix the underlying issue (lint, tests, formatting) or ask the user before bypassing."}'
+  exit 0
+}
+
+input="$(cat 2>/dev/null || true)"
+[ -z "$input" ] && allow
+
+command_str="$(printf '%s' "$input" | jq -r '.toolCall.args.CommandLine // empty' 2>/dev/null || true)"
+[ -z "$command_str" ] && allow
+
+# Bounded --no-verify (catches `git commit`/`git push --no-verify` in any
+# position, incl. subshells) while excluding longer flags like --no-verify-ssl.
+# Exact parity with the Claude block-no-verify.sh: only --no-verify is matched.
+# The short `-n` form is intentionally NOT matched — `-n` appears in commit
+# message prose (`git commit -m "fix -n flag"`) and unrelated piped commands
+# (`sort -n x; git commit`), so guarding it false-positives on valid work.
+if printf '%s' "$command_str" |
+  grep -Eq '(^|[^[:alnum:]_-])--no-verify($|[^[:alnum:]_-])'; then
+  deny
+fi
+
+allow

package/scripts/generate-agy-plugin-artifacts.mjs

@@ -4,12 +4,33 @@
  * Claude artifact.
  *
  * agy's plugin manifest is a bare `plugin.json` at the plugin root (NOT
- * `.claude-plugin/plugin.json`). The Wave 1 audit also established that agy
- * plugin-bundled hooks DO NOT FIRE in `-p` headless mode, so the agy variant
- * ships no hooks at all — the manifest's `hooks` field is dropped and the
- * `hooks/` directory is omitted. Rules-injection for agy uses the AGENTS.md
- * bake-in alternative implemented in `src/agy/rules-bake.ts` (per the parity
- * research artifact's Cluster 4-agy / Option α).
+ * `.claude-plugin/plugin.json`). This generator copies + reshapes the artifact
+ * AND emits a plugin-bundled hooks config.
+ *
+ * HOOKS (plugin-bundled, ROOT-level): a runtime probe of agy 1.0.3 (ticket-1054)
+ * proved agy loads a plugin's hooks ONLY from a `hooks.json` at the plugin ROOT
+ * of an installed global plugin (`~/.gemini/config/plugins/<variant>/hooks.json`)
+ * — a `hooks/` SUBDIR hooks.json (the earlier attempt) is NOT scanned. Lisa
+ * already `agy plugin install`s these variants there, so this generator emits a
+ * root `hooks.json` in agy's schema (top-level HOOK NAME → event → handlers),
+ * matcher `run_command` (agy's shell tool), and ships the agy-protocol script
+ * into the variant's `hooks/` subdir (scripts in a subdir are fine — only
+ * hooks.json must be at root; the command points at the absolute installed path
+ * via `$HOME`). Only events agy supports map: PreToolUse / PostToolUse /
+ * PreInvocation / PostInvocation / Stop. SessionStart is NOT supported, so
+ * install-pkgs / setup-jira-cli CANNOT ship as agy hooks — only block-no-verify
+ * (PreToolUse) maps. Only the BASE plugin manifest carries the universal hooks,
+ * so only `lisa-agy` gets a hooks.json; stack variants emit none.
+ *
+ * MCP (user-global, NOT plugin-bundled): agy ignores plugin-bundled MCP and only
+ * reads the user-global `~/.gemini/config/mcp_config.json`, so MCP is delivered
+ * by the runtime installer (`src/agy/mcp-installer.ts`), and this generator
+ * drops `.mcp.json`. Rules use the AGENTS.md bake (rules-once invariant).
+ *
+ * Net: the agy variant ships a root `hooks.json` (base only) + its agy-protocol
+ * script under `hooks/`, but NO `mcp_config.json`, NO `.mcp.json`, NO `rules/`,
+ * and NO `hooks/hooks.json` subdir. The manifest carries neither `hooks` nor
+ * `mcpServers`.
  *
  * Usage: node scripts/generate-agy-plugin-artifacts.mjs <source-plugin-dir> <out-dir> <version>
  *
@@ -74,12 +95,16 @@ function copyDir(src, dst, keep = () => true) {
 /**
  * Generate the agy variant.
  *
- * Transformation steps (from Wave 2 pattern-b-fan-out-spec.md):
+ * Transformation steps:
  *   0. Filter skills/ against scripts/internal-agy-skill-policy.json.
- *   1. Copy source to outDir minus filtered skills, .codex-plugin/, hooks/, and rules/.
+ *   1. Copy source to outDir minus filtered skills, .codex-plugin/, hooks/,
+ *      rules/, and the untranslated .mcp.json.
  *   2. Move .claude-plugin/plugin.json to bare plugin.json at root; drop .claude-plugin/.
- *   3. Drop the hooks field from the manifest (agy plugin hooks don't fire in -p).
+ *   3. Drop the hooks + mcpServers fields from the manifest (delivered by the
+ *      root hooks.json / runtime MCP installer, not as manifest components).
  *   4. Inject the version.
+ *   5. Emit the plugin-bundled root hooks.json (base variant only) + copy the
+ *      agy-protocol script(s) into the variant's hooks/ subdir.
  *
  * @param {string} srcDir Built Claude plugin directory (input).
  * @param {string} outDir agy variant output directory.
@@ -101,8 +126,14 @@ export function generateAgyVariant(srcDir, outDir, version) {
     if (relPath.startsWith(".codex-plugin/") || relPath === ".codex-plugin") {
       return false;
     }
-    if (relPath.startsWith("hooks/") || relPath === "hooks") return false; // hooks don't fire on agy
-    if (relPath.startsWith("rules/") || relPath === "rules") return false; // rules not a plugin component on agy
+    // Drop the source hooks/ (Claude scripts + stale codex hooks.json). The agy
+    // hooks.json (root) + the agy-protocol script are re-emitted by
+    // emitAgyPluginHooks below.
+    if (relPath.startsWith("hooks/") || relPath === "hooks") return false;
+    if (relPath.startsWith("rules/") || relPath === "rules") return false; // rules delivered via AGENTS.md bake
+    // Drop the untranslated Claude .mcp.json — agy ignores it (and the agy
+    // MCP shape differs); MCP is delivered by the user-global runtime MCP installer.
+    if (relPath === ".mcp.json") return false;
     // Drop Codex-specific per-skill openai.yaml artifacts.
     if (/^skills\/[^/]+\/agents\/openai\.ya?ml$/.test(relPath)) return false;
     // Apply skill denylist.
@@ -132,26 +163,134 @@ export function generateAgyVariant(srcDir, outDir, version) {
     }
   }
 
-  // 2. Read the Claude manifest, drop hooks, rename to bare plugin.json.
+  // 2. Read the Claude manifest, drop hooks + mcpServers, write bare plugin.json.
+  // agy reads hooks from a root hooks.json (emitted below), not the manifest;
+  // MCP is user-global. So the bare manifest carries neither field.
   const manifest = JSON.parse(fs.readFileSync(claudeManifest, "utf8"));
   manifest.version = version;
+  const sourceHooks = manifest.hooks ?? {};
   delete manifest.hooks;
-
-  // 3. Drop any pointer fields that agy doesn't understand.
-  // agy reads bare plugin.json with components: skills, agents, commands,
-  // mcpServers, hooks. We omit hooks above. MCP is not a plugin component on
-  // agy, so drop any `mcpServers` if present (Lisa's base today does not
-  // emit one, but be defensive).
   delete manifest.mcpServers;
 
   const bareManifestPath = path.join(outDir, "plugin.json");
   fs.writeFileSync(bareManifestPath, JSON.stringify(manifest, null, 2) + "\n");
 
-  // 4. Ensure no .claude-plugin/ directory survives.
+  // 3. Ensure no .claude-plugin/ directory survives.
   const ghostDir = path.join(outDir, ".claude-plugin");
   if (fs.existsSync(ghostDir)) {
     fs.rmSync(ghostDir, { recursive: true, force: true });
   }
+
+  // 4. Emit the plugin-bundled root hooks.json + agy-protocol script (base only).
+  // `agy plugin install` names the install dir by the manifest `name`
+  // (`~/.gemini/config/plugins/<name>/`, verified-by-run per
+  // reference_agy_plugin_capabilities), NOT the source dir basename — so the
+  // hook command path must use manifest.name (e.g. "lisa"), falling back to the
+  // dir basename only if a manifest somehow omits name.
+  const installDirName = manifest.name ?? path.basename(outDir);
+  emitAgyPluginHooks(srcDir, outDir, sourceHooks, installDirName);
+}
+
+/**
+ * agy-portable hook map. Only events agy supports + scripts whose protocol has
+ * an agy variant. Each entry emits one top-level hook-name key in the root
+ * hooks.json. `sourceScript` is what the BASE Claude manifest references (used
+ * to detect whether this variant should carry the hook); `agyScript` is the
+ * agy-protocol script copied into the variant's hooks/ and referenced by the
+ * command. NOTE: install-pkgs / setup-jira-cli are SessionStart-only, which agy
+ * hooks don't support, so they are intentionally absent. inject-rules is absent
+ * too (rules-once via the AGENTS.md bake).
+ */
+const AGY_PLUGIN_HOOKS = [
+  {
+    sourceScript: "block-no-verify.sh",
+    hookName: "lisa-block-no-verify",
+    event: "PreToolUse",
+    matcher: "run_command",
+    agyScript: "block-no-verify.agy.sh",
+  },
+];
+
+/**
+ * Whether the source manifest hook block references `scriptName` anywhere. Used
+ * to ship a hook only for the variant whose manifest carries it (the base
+ * plugin); stack variants have empty manifest hooks and emit no hooks.json.
+ * @param {Record<string, Array<{ hooks?: Array<{ command?: string }> }>>} sourceHooks
+ * @param {string} scriptName
+ * @returns {boolean}
+ */
+function sourceReferencesScript(sourceHooks, scriptName) {
+  return Object.values(sourceHooks ?? {}).some(
+    entries =>
+      Array.isArray(entries) &&
+      entries.some(
+        e =>
+          Array.isArray(e?.hooks) &&
+          e.hooks.some(
+            h =>
+              typeof h?.command === "string" && h.command.includes(scriptName)
+          )
+      )
+  );
+}
+
+/**
+ * Emit the plugin-bundled root `hooks.json` (agy schema) and copy the
+ * agy-protocol script(s) into the variant's `hooks/` subdir. No-op for variants
+ * whose source manifest carries none of the mapped hooks (e.g. stack variants).
+ * @param {string} srcDir Built Claude plugin directory (input).
+ * @param {string} outDir agy variant output directory.
+ * @param {Record<string, unknown>} sourceHooks Source manifest hook block.
+ * @param {string} installDirName Name agy installs the plugin under in
+ *   `~/.gemini/config/plugins/<installDirName>/` (the manifest `name`); baked
+ *   into the hook command path so it resolves to the installed script.
+ * @returns {void}
+ */
+function emitAgyPluginHooks(srcDir, outDir, sourceHooks, installDirName) {
+  const applicable = AGY_PLUGIN_HOOKS.filter(h => {
+    if (!sourceReferencesScript(sourceHooks, h.sourceScript)) return false;
+    const scriptSource = path.join(srcDir, "hooks", h.agyScript);
+    if (!fs.existsSync(scriptSource)) {
+      throw new Error(
+        `Missing agy hook script for ${h.sourceScript}: ${scriptSource}`
+      );
+    }
+    return true;
+  });
+  if (applicable.length === 0) return;
+
+  const hooksConfig = Object.fromEntries(
+    applicable.map(h => [
+      h.hookName,
+      {
+        [h.event]: [
+          {
+            matcher: h.matcher,
+            hooks: [
+              {
+                type: "command",
+                command: `bash "$HOME/.gemini/config/plugins/${installDirName}/hooks/${h.agyScript}"`,
+              },
+            ],
+          },
+        ],
+      },
+    ])
+  );
+  fs.writeFileSync(
+    path.join(outDir, "hooks.json"),
+    JSON.stringify(hooksConfig, null, 2) + "\n"
+  );
+
+  // Copy the agy-protocol scripts into the variant's hooks/ subdir.
+  const hooksDir = path.join(outDir, "hooks");
+  fs.mkdirSync(hooksDir, { recursive: true });
+  for (const h of applicable) {
+    const scriptSource = path.join(srcDir, "hooks", h.agyScript);
+    const scriptDest = path.join(hooksDir, h.agyScript);
+    fs.copyFileSync(scriptSource, scriptDest);
+    fs.chmodSync(scriptDest, 0o755);
+  }
 }
 
 // CLI entrypoint.

package/scripts/generate-codex-plugin-artifacts.mjs

@@ -7,17 +7,31 @@
  *
  * HOOKS: as of Codex 0.125.0 (verified via codex features list showing
  * codex_hooks as `stable`), the plugin manifest accepts a `hooks` field
- * pointing at a sibling `hooks.json`. `emitCodexHooks` below derives the
- * Codex-shape hooks block from the Claude manifest by applying the Wave 1
- * per-agent ship-list audit
+ * pointing at a `hooks.json`. Per the official docs + the structural analogy to
+ * the working `skills`/`mcpServers` pointers, that pointer resolves RELATIVE TO
+ * THE PLUGIN ROOT — but end-to-end firing is trust-gated (interactive `/hooks`,
+ * no headless bypass in 0.125.0), so this is verified by docs + structure, not
+ * by an automated run; the per-project installer (src/codex/hooks-installer.ts)
+ * remains the verified-working Codex delivery path. `emitCodexHooks` below
+ * derives the Codex-shape hooks block from the Claude manifest by applying the
+ * Wave 1 per-agent ship-list audit
  * (wiki/architecture/lisa-hook-per-agent-ship-list.md):
  *   - Drop every `entire hooks claude-code *` command (Claude-only analytics).
  *   - Drop every reference to `enforce-team-first.sh` (Claude-team-specific).
  *   - Drop `inject-flow-context.sh` ONLY when targeting an agent without
  *     SubagentStart (Codex 0.125.0 has SubagentStart, so we ship it).
- *   - Rewrite ${CLAUDE_PLUGIN_ROOT}/hooks/<n>.sh to ./hooks/<n>.sh so the
- *     hooks.json sibling can resolve the script path relative to itself.
- *   - Copy the surviving scripts into .codex-plugin/hooks/.
+ *   - Rewrite ${CLAUDE_PLUGIN_ROOT}/hooks/<n>.sh to ${PLUGIN_ROOT}/hooks/<n>.sh
+ *     (the env var Codex exposes to hook commands), which still resolves to the
+ *     shared scripts at <plugin-root>/hooks/*.sh.
+ *
+ * The derived hooks.json is written to <plugin-root>/.codex-plugin/hooks.json,
+ * NOT <plugin-root>/hooks/hooks.json. The latter is where Claude Code (and the
+ * cursor/copilot Claude-protocol variants) AUTO-DISCOVER plugin hooks, so a
+ * Codex-shaped file there gets run by Claude too — and because it uses
+ * ${PLUGIN_ROOT} (undefined in Claude), the path expands to an empty prefix
+ * (`/hooks/<n>.sh: No such file`). Keeping the Codex file under .codex-plugin/
+ * (which Claude never scans) is what lets Claude, Codex, cursor, copilot, and
+ * agy each load exactly their own hooks. See issue #1058.
  *
  * SessionEnd is documented as unsupported by Codex; the `entire hooks
  * claude-code session-end` hook is stripped per the Claude-only rule above
@@ -459,27 +473,33 @@ function main() {
 
 /**
  * Per Wave 1 audit + Codex 0.125.0 supporting plugin-bundled hooks: derive
- * a Codex-shaped hooks.json from the Claude manifest's hooks block and copy
- * the surviving scripts into .codex-plugin/hooks/.
+ * a Codex-shaped hooks.json from the Claude manifest's hooks block and write it
+ * to <plugin-root>/.codex-plugin/hooks.json (advertised via the manifest `hooks`
+ * pointer in componentPointers).
+ *
+ * The file deliberately does NOT go to <plugin-root>/hooks/hooks.json: Claude
+ * Code and the cursor/copilot Claude-protocol variants auto-discover hooks
+ * there, and the Codex file's ${PLUGIN_ROOT} (undefined in Claude) would expand
+ * to an empty prefix and fail at startup (issue #1058). The hook SCRIPTS stay
+ * at <plugin-root>/hooks/*.sh — shared, copied from plugins/src by the Claude
+ * build — and ${PLUGIN_ROOT}/hooks/<n>.sh resolves to them regardless of where
+ * hooks.json itself lives.
  *
  * No-op when the input has no hooks block or every entry is stripped.
  *
  * @param {string} pluginDir Built Claude plugin directory.
  * @param {object} claudeManifest Parsed contents of .claude-plugin/plugin.json.
  */
-function emitCodexHooks(pluginDir, claudeManifest) {
-  // Codex auto-discovers a plugin's hooks at <plugin-root>/hooks/hooks.json and
-  // resolves the manifest hooks pointer + ${PLUGIN_ROOT} relative to the plugin
-  // root (developers.openai.com/codex/plugins/build). The hook scripts already
-  // ship at <plugin-root>/hooks/ (copied from plugins/src by the Claude build),
-  // so the Codex hooks.json lives alongside them and no script copy is needed.
-  const hooksDir = path.join(pluginDir, "hooks");
-  const hooksJsonPath = path.join(hooksDir, "hooks.json");
-  // Clean up the pre-2.121 layout (hooks.json + copied scripts under
-  // .codex-plugin/) so a rebuilt plugin never ships both.
-  const legacyCodexPluginDir = path.join(pluginDir, ".codex-plugin");
-  fs.rmSync(path.join(legacyCodexPluginDir, "hooks.json"), { force: true });
-  fs.rmSync(path.join(legacyCodexPluginDir, "hooks"), {
+export function emitCodexHooks(pluginDir, claudeManifest) {
+  const codexPluginDir = path.join(pluginDir, ".codex-plugin");
+  const hooksJsonPath = path.join(codexPluginDir, "hooks.json");
+  // Purge the older layouts so a rebuilt plugin never ships a stale/duplicate
+  // file:
+  //   - <plugin-root>/hooks/hooks.json     (2.121–2.124; broke Claude startup)
+  //   - <plugin-root>/.codex-plugin/hooks/ (pre-2.121 copied-scripts dir)
+  // The shared .sh scripts at <plugin-root>/hooks/ are left untouched.
+  fs.rmSync(path.join(pluginDir, "hooks", "hooks.json"), { force: true });
+  fs.rmSync(path.join(codexPluginDir, "hooks"), {
     force: true,
     recursive: true,
   });
@@ -490,7 +510,7 @@ function emitCodexHooks(pluginDir, claudeManifest) {
     fs.rmSync(hooksJsonPath, { force: true });
     return;
   }
-  fs.mkdirSync(hooksDir, { recursive: true });
+  fs.mkdirSync(codexPluginDir, { recursive: true });
   fs.writeFileSync(
     hooksJsonPath,
     `${JSON.stringify(buildCodexHooksDocument(filtered), null, 2)}\n`
@@ -541,7 +561,7 @@ function writeCodexManifest(pluginDir, claudeManifest, pluginName, version) {
   );
 }
 
-function componentPointers(pluginDir) {
+export function componentPointers(pluginDir) {
   return {
     ...(fs.existsSync(path.join(pluginDir, "skills"))
       ? { skills: "./skills/" }
@@ -549,8 +569,8 @@ function componentPointers(pluginDir) {
     ...(fs.existsSync(path.join(pluginDir, ".mcp.json"))
       ? { mcpServers: "./.mcp.json" }
       : {}),
-    ...(fs.existsSync(path.join(pluginDir, "hooks", "hooks.json"))
-      ? { hooks: "./hooks/hooks.json" }
+    ...(fs.existsSync(path.join(pluginDir, ".codex-plugin", "hooks.json"))
+      ? { hooks: "./.codex-plugin/hooks.json" }
       : {}),
   };
 }

package/scripts/generate-copilot-plugin-artifacts.mjs

@@ -12,7 +12,7 @@
  *
  * Per the Wave 1 audit, Copilot ships:
  *   block-no-verify.sh, inject-rules.sh (conservative default — conditional on
- *   the rules-auto-load probe), notify-ntfy.sh, install-pkgs.sh, setup-jira-cli.sh.
+ *   the rules-auto-load probe), install-pkgs.sh, setup-jira-cli.sh.
  *
  * Per the Wave 2 pattern-b-fan-out-spec.md, this generator runs four pre-flight
  * probes when `copilot` is on PATH and caches the results. When `copilot` is
@@ -139,10 +139,11 @@ export function generateCopilotVariant(srcDir, outDir, version) {
   copyDir(srcDir, outDir, relPath => {
     if (relPath.startsWith(".codex-plugin/") || relPath === ".codex-plugin")
       return false;
-    // Drop the Codex hooks manifest the base build emits at hooks/hooks.json —
-    // Copilot reads its (camelCase) hooks from .claude-plugin/plugin.json, not
-    // this Codex-shaped (PascalCase, ${PLUGIN_ROOT}) file. Keeping it would ship
-    // a spurious, wrong-shaped hooks manifest in the Copilot variant.
+    // Defensively drop any hooks/hooks.json. The base build now emits the Codex
+    // hooks manifest under .codex-plugin/ (stripped above), not here (issue
+    // #1058), but guard against a regression reintroducing it: Copilot reads its
+    // (camelCase) hooks from .claude-plugin/plugin.json, not a Codex-shaped
+    // (PascalCase, ${PLUGIN_ROOT}) file.
     if (relPath === path.join("hooks", "hooks.json")) return false;
     // Drop Codex-specific per-skill openai.yaml artifacts — Copilot does not use them.
     if (/^skills\/[^/]+\/agents\/openai\.ya?ml$/.test(relPath)) return false;

package/scripts/generate-cursor-plugin-artifacts.mjs

@@ -105,9 +105,11 @@ export function generateCursorVariant(srcDir, outDir, version) {
     // Drop the `.codex-plugin/` directory — Cursor does not consume it.
     if (relPath.startsWith(".codex-plugin/") || relPath === ".codex-plugin")
       return false;
-    // Drop the Codex hooks manifest the base build emits at hooks/hooks.json —
-    // Cursor reads its (filtered) hooks from .claude-plugin/plugin.json, not this
-    // Codex-shaped file. The surviving .sh scripts in hooks/ are kept below.
+    // Defensively drop any hooks/hooks.json. The base build now emits the Codex
+    // hooks manifest under .codex-plugin/ (stripped above), not here (issue
+    // #1058), but guard against a regression reintroducing it: Cursor reads its
+    // (filtered) hooks from .claude-plugin/plugin.json, not a Codex-shaped file.
+    // The surviving .sh scripts in hooks/ are kept below.
     if (relPath === path.join("hooks", "hooks.json")) return false;
     // Drop Codex-specific per-skill openai.yaml artifacts — Cursor does not use them.
     // These live at skills/<n>/agents/openai.yaml and are generated by the Codex

package/scripts/lib/per-agent-hook-filter.mjs

@@ -15,7 +15,15 @@
  *     generate-codex-plugin-artifacts.mjs path)
  *   - Cursor: strip inject-rules.sh (Cursor auto-loads rules/ natively), strip
  *     Claude-team-specific scripts and `entire hooks claude-code *` calls
- *   - agy: ship NOTHING (agy plugin hooks do not fire in -p mode per verified-by-run)
+ *   - agy: this filter is NOT consumed for agy. agy hooks ship as a
+ *     plugin-bundled ROOT hooks.json emitted by
+ *     generate-agy-plugin-artifacts.mjs (its own AGY_PLUGIN_HOOKS map is the
+ *     source of truth), and only `block-no-verify` (PreToolUse) is portable —
+ *     agy doesn't support SessionStart, so install-pkgs / setup-jira-cli can't
+ *     ship as agy hooks. The agy column below is retained only as conceptual
+ *     ship-list documentation (block-no-verify.sh, install-pkgs.sh,
+ *     setup-jira-cli.sh; strips inject-rules.sh — rules-once via AGENTS.md bake
+ *     — enforce-team-first.sh, inject-flow-context.sh, and `entire ...` calls).
  *   - Copilot: strip SubagentStart hooks (event missing), strip Claude-team-specific
  *     scripts, conditionally strip inject-rules.sh if the rules-auto-load probe is
  *     positive (caller passes copilotRulesAutoLoads via options)
@@ -29,7 +37,7 @@ const SCRIPT_RULES = {
     claude: true,
     codex: true,
     cursor: true,
-    agy: false,
+    agy: true,
     copilot: true,
   },
   "enforce-team-first.sh": {
@@ -43,35 +51,28 @@ const SCRIPT_RULES = {
     claude: true,
     codex: true,
     cursor: false, // collision: Cursor auto-loads rules/ natively
-    agy: false, // hooks don't fire in -p
+    agy: false, // rules delivered via AGENTS.md bake, not a hook (rules-once invariant)
     copilot: true, // conservative default; conditionally stripped if rules-auto-load probe positive
   },
   "inject-flow-context.sh": {
     claude: true,
     codex: true,
     cursor: false, // SubagentStart unverified on Cursor; conservative default
-    agy: false,
+    agy: false, // SubagentStart-only; not in agy's universal ship-list
     copilot: false, // Copilot lacks SubagentStart event
   },
   "install-pkgs.sh": {
     claude: true,
     codex: true,
     cursor: true,
-    agy: false,
-    copilot: true,
-  },
-  "notify-ntfy.sh": {
-    claude: true,
-    codex: true,
-    cursor: true,
-    agy: false,
+    agy: true,
     copilot: true,
   },
   "setup-jira-cli.sh": {
     claude: true,
     codex: true,
     cursor: true,
-    agy: false,
+    agy: true,
     copilot: true,
   },
   // Unregistered scripts — exclude by default until classified.
@@ -92,7 +93,11 @@ const SCRIPT_RULES = {
 };
 
 /** Universal exclude pattern: development helpers. */
-const SCRIPT_EXCLUDE_PATTERNS = [/debug/i];
+// `.agy.sh` scripts are agy-protocol variants emitted into the agy plugin
+// artifact by generate-agy-plugin-artifacts.mjs (not via this filter); exclude
+// them from every other agent's ship-list so they never leak into cursor /
+// copilot / codex variants.
+const SCRIPT_EXCLUDE_PATTERNS = [/debug/i, /\.agy\.sh$/];
 
 /** Hook command shape: { type: "command", command: "..." } */
 const isEntireClaudeCodeCommand = cmd =>
@@ -178,6 +183,10 @@ export function shouldShipHook(hook, _eventName, agent, opts = {}) {
     // Cursor collision rule for rules + Copilot conditional rules strip
     if (scriptName === "inject-rules.sh") {
       if (agent === "cursor") return false;
+      // Belt-and-suspenders rules-once guard: agy gets rules via the AGENTS.md
+      // bake, not a hook (rules-once invariant). The SCRIPT_RULES table already
+      // sets agy:false, but keep this explicit so the invariant survives a
+      // future table edit.
       if (agent === "agy") return false;
       if (agent === "copilot" && opts.copilotRulesAutoLoads === true)
         return false;
@@ -195,8 +204,12 @@ export function shouldShipHook(hook, _eventName, agent, opts = {}) {
  * Returns the new hook block (or undefined when the block ends up empty after
  * filtering, which means the manifest should omit the hooks field entirely).
  *
- * For agy this function returns undefined regardless of input because agy
- * variants ship no hooks.
+ * This function is invoked only for cursor/copilot. The "agy" branch still
+ * works (3 universal scripts survive, PascalCase events) and is exercised by
+ * unit tests as conceptual ship-list documentation, but agy hooks are NOT
+ * emitted through this path — they ship as a plugin-bundled root hooks.json
+ * built by generate-agy-plugin-artifacts.mjs (only block-no-verify is portable;
+ * agy lacks SessionStart).
  *
  * @param {Record<string, Array<{ matcher?: string, hooks: Array<object> }>>} hookBlock
  *   The Claude-format hook block from .claude-plugin/plugin.json.
@@ -205,7 +218,6 @@ export function shouldShipHook(hook, _eventName, agent, opts = {}) {
  * @returns {Record<string, Array<{ matcher?: string, hooks: Array<object> }>> | undefined}
  */
 export function filterHooksForAgent(hookBlock, agent, opts = {}) {
-  if (agent === "agy") return undefined;
   if (!hookBlock || typeof hookBlock !== "object") return undefined;
 
   /** @type {Record<string, Array<{ matcher?: string, hooks: Array<object> }>>} */
@@ -244,6 +256,5 @@ export function filterHooksForAgent(hookBlock, agent, opts = {}) {
  * @returns {string[]}
  */
 export function filterScriptsForAgent(scriptFilenames, agent) {
-  if (agent === "agy") return [];
   return scriptFilenames.filter(name => shouldShipScript(name, agent));
 }

package/dist/codex/scripts/notify-ntfy.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-# Lisa-managed Codex hook script (Stop event).
-# Sends a desktop/push notification when a Codex session completes.
-# No-op if NTFY_TOPIC is not set or curl is unavailable.
-set -euo pipefail
-
-[ -n "${NTFY_TOPIC:-}" ] || exit 0
-command -v curl >/dev/null 2>&1 || exit 0
-
-TITLE="${NTFY_TITLE:-Codex session complete}"
-MESSAGE="${NTFY_MESSAGE:-Your Codex session has finished. Check the terminal for results.}"
-
-curl -s -m 5 \
-  -H "Title: ${TITLE}" \
-  -H "Priority: default" \
-  -d "${MESSAGE}" \
-  "https://ntfy.sh/${NTFY_TOPIC}" \
-  >/dev/null 2>&1 || true