@coworker-jp/aidr 0.1.318 → 0.1.321

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coworker-jp/aidr",
-  "version": "0.1.318",
+  "version": "0.1.321",
   "description": "AIDR setup CLI - installs ai-scanner hooks for 19+ AI coding agents",
   "type": "module",
   "bin": {

package/src/agents/claude.mjs

@@ -21,7 +21,10 @@ const SCRIPT_FILES = [
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 
 export const meta = {
   name: "claude",

package/src/agents/codex.mjs

@@ -35,7 +35,10 @@ const SCRIPT_FILES = [
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 const ROOT_FILES = ["AGENTS.md"];
 
 export const meta = {

package/src/agents/cursor.mjs

@@ -36,7 +36,10 @@ const SCRIPT_FILES = [
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 
 export const meta = {
   name: "cursor",

package/src/agents/gemini.mjs

@@ -13,7 +13,10 @@ const HOOK_FILES = ["aidr-pre.sh"];
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 
 export const meta = {
   name: "gemini",
@@ -26,11 +29,13 @@ export async function install(home, accessKey, opts = {}) {
   const { dryRun = false, scope = "project" } = opts;
   const base = meta.configDir(home);
   const hooks = path.join(base, "hooks");
-  const binary = path.join(home, meta.agentDir, "bin", "ai-scanner");
+  // #2366: hook が呼ぶのは `ai-harness` (8 コンテキスト)。`ai-scanner` は
+  // 定期インベントリ送信で、`scan read-input` 等のサブコマンドを持たない。
+  const binary = path.join(home, meta.agentDir, "bin", "ai-harness");
   const settingsPath = path.join(base, "settings.json");
   const preHookPath = path.join(hooks, "aidr-pre.sh");
   const [settingsRes, hookRes] = await Promise.all([
-    writeJsonMerge(settingsPath, buildGeminiSettings(accessKey, binary), mergeGeminiSettings, { dryRun, backup: scope !== "project" }),
+    writeJsonMerge(settingsPath, buildGeminiSettings(accessKey, hooks), mergeGeminiSettings, { dryRun, backup: scope !== "project" }),
     writeFileSafe(preHookPath, T.getGeminiPreHookSh(binary), { dryRun, force: true, mode: 0o755 }),
   ]);
   return {

package/src/agents/kiro.mjs

@@ -26,7 +26,10 @@ const SCRIPT_FILES = [
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 
 export const meta = {
   name: "kiro",

package/src/agents/standalone.mjs

@@ -10,7 +10,10 @@ import { pathExists, rmdirIfEmpty } from "../fs-utils.mjs";
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 
 export const meta = {
   name: "standalone",

package/src/agents/windsurf.mjs

@@ -33,7 +33,10 @@ const SCRIPT_FILES = [
 // `rmdirIfEmpty` が効かないので、アンインストール後にディレクトリと記録が居座る。
 // 7 エージェントすべて同じ表を持ち、`tests/bin-dir-artifacts.test.mjs` が
 // 「表 ⇔ テンプレートが実際に書く名前」を両方向で照合する。
-const BIN_FILES = ["ai-scanner", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
+// #2366: 配布物は 2 本。`ai-harness` が hook の 8 コンテキストを持ち、
+// `ai-scanner` が定期インベントリ送信を持つ。**両方を消す対象に入れる** ——
+// 片方だけ残すと bin ディレクトリが空にならず `rmdirIfEmpty` が効かない。
+const BIN_FILES = ["ai-scanner", "ai-harness", "opengrep", ".ai-scanner-unscanned", ".ai-scanner-last-pull"];
 
 export const meta = {
   name: "windsurf",

package/src/binary-fetcher.mjs

@@ -282,8 +282,18 @@ export async function fetchAsset(binUrl, destPath, { accessKey, checksumOpts } =
   return { path: destPath, sha256, verified };
 }
 
+//: The product served at the BARE platform key. Every other product is
+//: addressed as `<product>/<platform>`; see `fetchBinary` for why this one is
+//: not, and why that asymmetry is deliberate rather than an oversight.
+export const DEFAULT_PRODUCT = "ai-scanner";
+
+//: The hook binary (issue #2348 split, wired up in #2366). This is what every
+//: hook adapter invokes — the eight tool-call scan contexts live here, NOT in
+//: `ai-scanner`, which is the periodic endpoint-inventory collector.
+export const HARNESS_PRODUCT = "ai-harness";
+
 /**
- * Download ai-scanner for the current platform into `destPath`.
+ * Download one scanner-family binary for the current platform into `destPath`.
  *
  * TWO KEYS, ONE FALLBACK (issue #1687)
  * ------------------------------------
@@ -312,19 +322,28 @@ export async function fetchAsset(binUrl, destPath, { accessKey, checksumOpts } =
  * `servedUnpinned: true` means the caller must NOT claim the pinned version was
  * installed — what landed is whatever the endpoint currently publishes.
  */
-export async function fetchBinary(destPath, { env = "prod", accessKey, version, baseUrl } = {}) {
+export async function fetchBinary(destPath, { env = "prod", accessKey, version, baseUrl, product = DEFAULT_PRODUCT } = {}) {
   const platform = detectPlatform();
   const base = baseUrl || downloadBase(env);
-  const unpinnedUrl = `${base}/${platform}`;
+  // ONE ROUTE, TWO PRODUCTS (issue #2366)
+  // ------------------------------------
+  // `ai-scanner` keeps the BARE platform key it has always had — that key is a
+  // wire contract with every endpoint already in the field, and the binary's own
+  // self-updater composes it. Everything else is addressed under its own name.
+  // Composing `ai-scanner/<platform>` "for symmetry" would ask a Lambda that
+  // predates the split for a path it rejects, and the endpoints that would hit
+  // it are exactly the ones with no other way in.
+  const seg = product === DEFAULT_PRODUCT ? "" : `${product}/`;
+  const unpinnedUrl = `${base}/${seg}${platform}`;
 
   if (!version) {
     const result = await fetchAsset(unpinnedUrl, destPath, { accessKey });
-    return { ...result, platform, requestedVersion: null, servedUnpinned: false };
+    return { ...result, platform, product, requestedVersion: null, servedUnpinned: false };
   }
 
   try {
-    const result = await fetchAsset(`${base}/v${version}/${platform}`, destPath, { accessKey });
-    return { ...result, platform, requestedVersion: version, servedUnpinned: false };
+    const result = await fetchAsset(`${base}/v${version}/${seg}${platform}`, destPath, { accessKey });
+    return { ...result, platform, product, requestedVersion: version, servedUnpinned: false };
   } catch (e) {
     // A pinned release whose CHECKSUM is a definite 404 is incomplete in exactly
     // the same way as one whose binary is (#1773): half a release is not a
@@ -333,7 +352,7 @@ export async function fetchBinary(destPath, { env = "prod", accessKey, version,
     // unverified install, because `fetchAsset` refuses that on both keys.
     if (e?.status !== 404) throw e;
     const result = await fetchAsset(unpinnedUrl, destPath, { accessKey });
-    return { ...result, platform, requestedVersion: version, servedUnpinned: true };
+    return { ...result, platform, product, requestedVersion: version, servedUnpinned: true };
   }
 }
 

package/src/cli.mjs

@@ -10,7 +10,7 @@ import { Command } from "commander";
 const execFileP = promisify(execFile);
 import { AGENT_ORDER, AGENT_REGISTRY, loadAgent } from "./agents/index.mjs";
 import { verifyKey, maskKey } from "./verify.mjs";
-import { fetchBinary, fetchOpengrep, assertVerified } from "./binary-fetcher.mjs";
+import { fetchBinary, fetchOpengrep, assertVerified, HARNESS_PRODUCT } from "./binary-fetcher.mjs";
 import { detectInstalled } from "./detect.mjs";
 import { evaluateInstallGate, formatLocalPcGuidance } from "./env-gate.mjs";
 import { resolveCallerHome, isRunningUnderSudo, chownToCaller } from "./sudo-user.mjs";
@@ -201,15 +201,33 @@ async function cmdInstall(opts) {
           version: PINNED_VERSION,
         };
 
-        // ai-scanner + bundled Opengrep (LGPL-2.1). Both land in the same bin
-        // dir so ai-scanner's sibling-lookup finds opengrep without relying on
-        // PATH. Users can point AI_SCANNER_OPENGREP elsewhere to substitute
-        // their own LGPL-2.1 build.
+        // THREE files, one bin dir (issue #2366).
+        //
+        //   ai-harness  the hook binary — the eight tool-call scan contexts.
+        //               Every adapter this installer writes invokes THIS one,
+        //               so it is fetched first: it is what "this machine is
+        //               being scanned" means.
+        //   ai-scanner  the periodic endpoint-inventory collector, and the
+        //               self-update vehicle start_scanner.sh drives.
+        //   opengrep    bundled Opengrep (LGPL-2.1), a sibling so the scanner's
+        //               sibling-lookup finds it without relying on PATH. Users
+        //               can point AI_SCANNER_OPENGREP elsewhere to substitute
+        //               their own LGPL-2.1 build.
+        const harnessRes = assertVerified(
+          await fetchBinary(path.join(primaryDir, "ai-harness"),
+            { ...fetchOpts, product: HARNESS_PRODUCT }),
+          "the ai-harness binary",
+        );
+        // Set by the HOOK binary, not the periodic one: this flag is what
+        // decides between "nothing on this machine scans" and "scanning is in
+        // place, one piece is missing". Tying it to ai-scanner would report the
+        // reassuring half of that pair while every tool call ran unscanned.
+        binaryOutcome.scannerInstalled = true;
+        console.log(`binary: ${harnessRes.path} (${harnessRes.platform}, sha256 verified)`);
         const scannerRes = assertVerified(
           await fetchBinary(path.join(primaryDir, "ai-scanner"), fetchOpts),
           "the ai-scanner binary",
         );
-        binaryOutcome.scannerInstalled = true;
         // Stated unconditionally, because it is now a condition of getting here
         // rather than a caption on a file that may or may not have been checked
         // (#1773): `fetchAsset` throws unless the bytes matched the published
@@ -231,7 +249,7 @@ async function cmdInstall(opts) {
         console.log(`binary: ${opengrepRes.path} (opengrep ${opengrepRes.platform}, sha256 verified)`);
 
         const copyOps = restDirs.flatMap(restDir =>
-          ["ai-scanner", "opengrep"].map(async (file) => {
+          ["ai-harness", "ai-scanner", "opengrep"].map(async (file) => {
             const src = path.join(primaryDir, file);
             const dest = path.join(restDir, file);
             await fs.mkdir(restDir, { recursive: true });
@@ -366,7 +384,10 @@ async function cmdInstall(opts) {
     const stranded = needBinary.filter((r) => !r.selfHeals).map((r) => r.displayName);
     const binPaths = (await Promise.all(needBinary.map(async (r) => {
       const mod = await loadAgent(r.name);
-      return mod.meta.agentDir ? path.join(home, mod.meta.agentDir, "bin", "ai-scanner") : null;
+      // The hook binary: this list is read out to someone checking whether the
+      // machine is scanned, and `ai-scanner` sitting there would answer "yes"
+      // to a question about a file that runs no hooks (#2366).
+      return mod.meta.agentDir ? path.join(home, mod.meta.agentDir, "bin", "ai-harness") : null;
     }))).filter(Boolean);
     console.error(formatMissingBinaryStatus({
       reason, selfHealing, stranded, binPaths, installCommand: INSTALL_COMMAND_HINT,
@@ -599,13 +620,24 @@ async function cmdDoctor() {
     const mod = await loadAgent(name);
     const agentDir = mod.meta.agentDir;
     if (!agentDir) return null;
-    const bin = path.join(home, agentDir, "bin", "ai-scanner");
-    let present = false;
-    try {
-      await fs.access(bin, fs.constants.F_OK);
-      present = true;
-    } catch {}
-    const out = [`binary: ${bin} ${present ? "[present]" : "[missing]"}`];
+    // TWO binaries since the split (issue #2366), and only ONE of them decides
+    // whether tool calls are scanned. `ai-harness` carries the eight hook
+    // contexts; `ai-scanner` is the periodic collector. Reporting only the
+    // latter would print "[present]" on a machine whose every hook fail-opens.
+    const bin = path.join(home, agentDir, "bin", "ai-harness");
+    const periodicBin = path.join(home, agentDir, "bin", "ai-scanner");
+    const exists = async (p) => {
+      try { await fs.access(p, fs.constants.F_OK); return true; } catch { return false; }
+    };
+    const present = await exists(bin);
+    const periodicPresent = await exists(periodicBin);
+    const out = [
+      `tool-call scanner: ${bin} ${present ? "[present]" : "[missing]"}`,
+      `periodic collector: ${periodicBin} ${periodicPresent ? "[present]" : "[missing]"}`,
+    ];
+    if (!present) {
+      out.push(`  Tool calls on this machine are NOT being scanned. Re-run the installer (${INSTALL_COMMAND_HINT}), or contact your IT administrator.`);
+    }
     // What the hooks recorded while there was no binary (#1774). Without this,
     // "[missing]" was the only trace, and it said nothing about how long the
     // machine had been unscanned or how much had gone through unscanned —

package/src/install-status.mjs

@@ -41,7 +41,10 @@ export function formatMissingBinaryStatus({
   const lines = [
     "",
     RULE,
-    "This machine is NOT being scanned yet — the ai-scanner binary is not in place.",
+    // Names `ai-harness`, because that is the binary that scans a tool call
+    // (issue #2366). Saying "ai-scanner" here would send the reader to check a
+    // file that can be perfectly present on a machine where nothing is scanned.
+    "This machine is NOT being scanned yet — the ai-harness binary is not in place.",
     "",
     `  what stopped it: ${reason}`,
     "",

package/src/merge.mjs

@@ -24,8 +24,17 @@
 export const CLAUDE_OUR_COMMAND_RE =
   /^(?:"\$(?:CLAUDE_PROJECT_DIR|HOME)"|\$(?:CLAUDE_PROJECT_DIR|HOME))\/\.claude\/coworker-ai\/(?:start_scanner|stop_scanner|scan_[a-z_]+|log_web_urls)\.sh(?:\s|$|"|')/;
 
+// Matches BOTH the adapter we install today AND the broken pre-#2354 command.
+// **The legacy alternative is load-bearing, not tidiness**: an endpoint that
+// already ran the old installer has the broken command sitting in its
+// `settings.json`. `mergeGeminiSettings` / `unmergeGeminiSettings` use this
+// predicate to recognise our own entries — if it stopped matching the old form,
+// an upgrade would **leave the broken hook in place and add the new one beside
+// it**, so every tool call would still hit a command that exits 2, and
+// uninstall would leave it behind forever. Drop the legacy branch only once no
+// endpoint in the field can still carry it.
 export const GEMINI_OUR_COMMAND_RE =
-  /ai-scanner["']?\s+scan\s+hook-gemini\b/;
+  /(?:\/\.gemini\/hooks\/aidr-(?:pre|post)\.sh|ai-scanner["']?\s+scan\s+hook-gemini\b)/;
 
 // Matches our Codex hook wrappers whether installed at the repo root
 // (.codex/coworker-ai/pre_shell.sh) or absolute user-scope path
@@ -229,7 +238,27 @@ export function buildWindsurfHooksJson(scope = "project", absHome = "") {
   };
 }
 
-export function buildGeminiSettings(accessKey, binary) {
+// **2026-09-08 (issue #2354): this pointed at a subcommand that does not exist.**
+// It emitted `<binary> scan hook-gemini --stage pre|post`; the scanner has no
+// `hook-gemini` subcommand, so every invocation died with
+// `error: unrecognized subcommand` and **exit code 2**. Install reported
+// success, `settings.json` filled with hooks, and **not one tool call was ever
+// scanned** — while the working adapter (`~/.gemini/hooks/aidr-pre.sh`) was
+// written to disk on every install and referenced by nothing.
+//
+// Two things were wrong, not one. Exit 2 is also the *block* code, and this was
+// the **only** agent calling the binary directly rather than through a shell
+// wrapper — so it sat outside the fail-open invariant that every other agent
+// gets from `run_scanner` (which maps a timeout's 124 to 0). Pointing at the
+// adapter fixes both at once: the scan actually runs, **and** it runs inside
+// the wrapper.
+//
+// `AfterTool` is gone rather than re-pointed: **there is no post adapter.**
+// `agents/gemini.mjs` installs `aidr-pre.sh` only, and inventing post coverage
+// here would be new agent coverage (#2350's scope), not a defect fix. Declaring
+// only what exists is the point — the previous declaration is exactly how a
+// hook that never ran looked installed.
+export function buildGeminiSettings(accessKey, hooksDir) {
   // timeout is in milliseconds (Gemini convention). Default 60000 (1 min)
   // is too long for an inline hook — cap at 15000 so the editor kills a
   // hung scanner cleanly. The shell-side run_scanner cap fires first under
@@ -241,10 +270,7 @@ export function buildGeminiSettings(accessKey, binary) {
     },
     hooks: {
       BeforeTool: [
-        { hooks: [{ type: "command", command: `"${binary}" scan hook-gemini --stage pre`, timeout: 15000 }] },
-      ],
-      AfterTool: [
-        { hooks: [{ type: "command", command: `"${binary}" scan hook-gemini --stage post`, timeout: 15000 }] },
+        { hooks: [{ type: "command", command: `"${hooksDir}/aidr-pre.sh"`, timeout: 15000 }] },
       ],
     },
   };

package/src/templates.mjs

@@ -32,6 +32,16 @@ export function getStartScannerSh(downloadBase = "https://pytd2jd5p7.execute-api
 # - Fail-open: never block Claude Code startup
 BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
 BIN_DIR="$(dirname "$BIN")"
+# TWO binaries since the split (issue #2366). \`ai-harness\` runs the eight
+# tool-call scan contexts — it is the one every hook adapter invokes, so it is
+# the one whose absence means "this session is not being scanned". \`ai-scanner\`
+# is the periodic inventory collector and the self-update vehicle. They are
+# built from one crate and therefore must stay on ONE version; the skew check
+# further down is what enforces that.
+#
+# Two env names, never one shared: pointing a single override at one product
+# would silently leave the other pointing at a file that is not it.
+HARNESS="\${AI_HARNESS_BIN:-$BIN_DIR/ai-harness}"
 # The self-update throttle belongs to the binary it throttles, so it is derived
 # from \$BIN — the one source this script already trusts for "where is my copy"
 # (\`.ai-scanner-unscanned\` is placed the same way). It used to be pinned to
@@ -132,7 +142,8 @@ sha256_of() {
 # \`$UNVERIFIED_REASON\` carries WHY, so the message can name it.
 download_binary() {
     local url="$1"
-    local tmp=$(mktemp "\${BIN_DIR}/ai-scanner.XXXXXX")
+    local dest="$2"
+    local tmp=$(mktemp "\${BIN_DIR}/.download.XXXXXX")
     local auth_args=()
     if [ -n "\${AI_SCANNER_ACCESS_KEY:-}" ]; then
         auth_args=(-H "x-access-key: \${AI_SCANNER_ACCESS_KEY}")
@@ -166,10 +177,33 @@ download_binary() {
     # macOS: strip Gatekeeper quarantine so unsigned binary can execute
     # (no-op on Linux where xattr isn't typically present)
     xattr -d com.apple.quarantine "$tmp" 2>/dev/null || true
-    mv -f "$tmp" "$BIN"
+    mv -f "$tmp" "$dest"
     return 0
 }
 
+# Fetch one product into place if it is not already there. The download route
+# serves \`ai-scanner\` at the bare platform key (unchanged wire contract) and
+# every other product under its own name.
+#
+# Says "installed" only when it actually installed something. Printing it on
+# every session start for a file that was already there turns the line into
+# noise, and the next reader stops distinguishing it from the one that matters.
+#   $1 = absolute destination, $2 = product name
+ensure_binary() {
+    local dest="$1" product="$2" url
+    [ -x "$dest" ] && return 0
+    if [ "$product" = "ai-scanner" ]; then
+        url="\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}"
+    else
+        url="\${DOWNLOAD_BASE}/\${product}/\${PLATFORM_SLUG}"
+    fi
+    if download_binary "$url" "$dest"; then
+        echo "$product binary installed (\${PLATFORM_SLUG}, checksum verified)" >&2
+        return 0
+    fi
+    return 1
+}
+
 # What has already run unscanned on this machine, if anything (#1774). The scan
 # hooks append to this file every time they exit without a binary; this is the
 # first moment anyone can say it out loud, and it is deleted the moment a binary
@@ -234,26 +268,42 @@ case "$OS" in
         ;;
 esac
 
-# Binary missing → fetch it
-if [ ! -x "$BIN" ]; then
-    if download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}"; then
-        echo "ai-scanner binary installed (\${PLATFORM_SLUG}, checksum verified)" >&2
-        rm -f "$UNSCANNED_STAMP"
+# The HOOK binary first: tool-call scanning depends on this one, so its absence
+# is what the session-level message is about.
+#
+# docs/product/UI_COPY.md 【非交渉】: the fact, stated so it cannot be read as
+# harmless, and then the next action. The old single line ("Warning: Failed to
+# download …") said neither what it meant for the session nor what to do, and it
+# was the ONLY trace anywhere (#1774).
+SCANNING=0
+if ensure_binary "$HARNESS" ai-harness; then
+    SCANNING=1
+    # A binary IS in place. Clear any record of having run unscanned, so the
+    # record only ever describes the machine's CURRENT state.
+    rm -f "$UNSCANNED_STAMP"
+else
+    echo "ai-scanner: this session is NOT being scanned — the tool-call scanner (ai-harness) is not installed on this machine and could not be installed now: \${UNVERIFIED_REASON:-the download failed}." >&2
+    report_unscanned_history
+    echo "ai-scanner: tool calls keep working, and they run unscanned until it is in place. Re-run the installer (${installCommand}), or contact your IT administrator with this message." >&2
+fi
+
+# The PERIODIC binary. Its absence does NOT stop tool-call scanning, so it gets
+# its own, narrower sentence rather than borrowing the one above — saying "this
+# session is NOT being scanned" when it IS would train the reader to ignore the
+# line that means it.
+if ! ensure_binary "$BIN" ai-scanner; then
+    # Only claims scanning is unaffected when it actually is — the harness may
+    # have failed too, and the line above is the one that says so.
+    if [ "$SCANNING" = 1 ]; then
+        echo "ai-scanner: tool calls are still being scanned, but the periodic endpoint-inventory collector could not be installed: \${UNVERIFIED_REASON:-the download failed}. Re-run the installer (${installCommand}) if this endpoint stops appearing in the portal." >&2
     else
-        # docs/product/UI_COPY.md 【非交渉】: the fact, stated so it cannot be
-        # read as harmless, and then the next action. The old single line
-        # ("Warning: Failed to download …") said neither what it meant for the
-        # session nor what to do, and it was the ONLY trace anywhere (#1774).
-        echo "ai-scanner: this session is NOT being scanned — the scanner is not installed on this machine and could not be installed now: \${UNVERIFIED_REASON:-the download failed}." >&2
-        report_unscanned_history
-        echo "ai-scanner: tool calls keep working, and they run unscanned until it is in place. Re-run the installer (${installCommand}), or contact your IT administrator with this message." >&2
+        echo "ai-scanner: the periodic endpoint-inventory collector could not be installed either: \${UNVERIFIED_REASON:-the download failed}. Re-run the installer (${installCommand}), or contact your IT administrator with this message." >&2
     fi
-    exit 0
 fi
 
-# A binary IS in place. Clear any record of having run unscanned, so the record
-# only ever describes the machine's CURRENT state.
-rm -f "$UNSCANNED_STAMP"
+# Neither is in place: nothing below can run, and the message above already said
+# so with its next action.
+[ -x "$BIN" ] || exit 0
 
 # Binary exists — throttled self-update check.
 #
@@ -276,13 +326,38 @@ if should_check_update; then
     have_host=$(timeout "$VERSION_TIMEOUT" "$BIN" version 2>/dev/null | sed -n 's#^server: [a-z]*://\\([^/]*\\).*#\\1#p' | head -1)
     if [ -n "$have_host" ] && [ -n "$want_host" ] && [ "$have_host" != "$want_host" ]; then
         echo "ai-scanner: the installed binary talks to $have_host, but this installation provisions from $want_host, so its access key can never be accepted (detection logs are refused and discarded). Re-downloading the matching binary." >&2
-        download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" || \\
+        download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" "$BIN" || \\
             echo "ai-scanner: could not replace the mismatched binary: \${UNVERIFIED_REASON:-the download failed}. Scanning continues locally, but detection logs will keep being refused. Re-run the installer, or contact your IT administrator with this message." >&2
     elif [ -z "$have_host" ]; then
         echo "ai-scanner: could not read which license server the installed binary uses, so the environment match was NOT checked. If detection logs are being refused, re-run the installer." >&2
     fi
     timeout "$UPDATE_TIMEOUT" "$BIN" update 2>/dev/null || \\
         echo "ai-scanner: the scanner could not update itself just now. It keeps scanning with the rules it already has; if this repeats, re-run the installer or contact your IT administrator." >&2
+
+    # Keep the hook binary on the SAME build as the periodic one (issue #2366).
+    # They come from one crate and share one version, so a skew means an update
+    # moved only ai-scanner and left the harness behind.
+    #
+    # \`"$HARNESS" update\` is deliberately NOT used (issue #2368): that
+    # self-update resolves the bare platform key, which serves ai-scanner —
+    # running it would overwrite the harness with the periodic binary and take
+    # every hook down with it. Refreshing through the same checksum-verified
+    # download path avoids that. **Do not "simplify" this into an update call.**
+    #
+    # \`GAP-UNOBSERVED-OVERWRITE\`: the overwrite itself has NOT been observed.
+    # Reproducing it needs \`/verify\` to advertise a newer version, and v0.1.319
+    # has zero keys in S3, so the precondition does not exist yet. What is
+    # written above is the mechanism read off \`cli/mod.rs::cmd_update\` — which is
+    # enough to route around, and NOT enough to call measured.
+    if [ -x "$HARNESS" ]; then
+        scanner_ver=$(timeout "$VERSION_TIMEOUT" "$BIN" version 2>/dev/null | awk 'NR==1{print $2}')
+        harness_ver=$(timeout "$VERSION_TIMEOUT" "$HARNESS" version 2>/dev/null | awk 'NR==1{print $2}')
+        if [ -n "$scanner_ver" ] && [ -n "$harness_ver" ] && [ "$scanner_ver" != "$harness_ver" ]; then
+            echo "ai-scanner: the tool-call scanner is on $harness_ver while this endpoint is on $scanner_ver. Refreshing it so both run one build." >&2
+            download_binary "\${DOWNLOAD_BASE}/ai-harness/\${PLATFORM_SLUG}" "$HARNESS" || \\
+                echo "ai-scanner: could not refresh the tool-call scanner: \${UNVERIFIED_REASON:-the download failed}. Scanning continues on $harness_ver; re-run the installer (${installCommand}) if this repeats." >&2
+        fi
+    fi
     date +%s > "$PULL_STAMP"
 fi
 
@@ -368,7 +443,7 @@ const SCAN_HELPERS = `run_scanner() {
 export const SCAN_BASH_SH = `#!/bin/bash
 # PostToolUse hook for Bash: Scan command output.
 # Thin Claude Code adapter — Rust handles cap, detection log, actor resolution.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -385,7 +460,7 @@ jq -r '.tool_response // ""' <<<"$INPUT" \\
 export const SCAN_BASH_INPUT_SH = `#!/bin/bash
 # PreToolUse hook for Bash: Scan command before execution.
 # Thin Claude Code adapter — Rust handles cap, detection log, actor resolution.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -403,7 +478,7 @@ export const SCAN_EDIT_SH = `#!/bin/bash
 # PreToolUse hook for Edit/MultiEdit: Scan new content before write.
 # Thin Claude Code adapter — Rust handles cap, exclude dirs, detection log.
 # Only the Edit-vs-MultiEdit content extraction is Claude Code specific.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -429,7 +504,7 @@ printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
 export const SCAN_READ_SH = `#!/bin/bash
 # PostToolUse hook for Read: Scan file content Claude just read.
 # Thin Claude Code adapter — Rust handles cap, exclude dirs, detection log.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -449,7 +524,7 @@ jq -r '.tool_response.file.content // .tool_response // ""' <<<"$INPUT" \\
 export const SCAN_EDIT_OUTPUT_SH = `#!/bin/bash
 # PostToolUse hook for Edit/MultiEdit/Write: Scan final file content.
 # Thin Claude Code adapter — Rust handles cap, exclude dirs, detection log.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -470,7 +545,7 @@ export const SCAN_READ_INPUT_SH = `#!/bin/bash
 # This is a thin Claude Code adapter — all scanning logic lives in the Rust
 # binary, including actor resolution, exclude-dir filtering, content cap, and
 # detection-log writing.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -488,7 +563,7 @@ run_scanner scan read-input --file "$FILE_PATH" </dev/null
 export const SCAN_WEBFETCH_SH = `#!/bin/bash
 # PreToolUse hook for WebFetch: Scan URL before Claude fetches it.
 # Thin Claude Code adapter — Rust handles phishing scoring + YARA + detection log.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -505,7 +580,7 @@ run_scanner scan webfetch --url "$URL" </dev/null
 export const SCAN_WEBSEARCH_SH = `#!/bin/bash
 # PostToolUse hook for WebSearch: Scan search results for phishing URLs.
 # Thin Claude Code adapter — Rust handles cap, phishing scoring, detection log.
-BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN="\${AI_HARNESS_BIN:-$HOME/.claude/bin/ai-harness}"
 ${UNSCANNED_NOTE}
 [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 
@@ -551,6 +626,12 @@ export function agentEnvSh(accessKey, agentDir) {
   return `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
 export AI_SCANNER_BIN="\${AI_SCANNER_BIN:-$HOME/${agentDir}/bin/ai-scanner}"
+# The hook binary (issue #2366). Every adapter below scans through THIS one:
+# the eight tool-call contexts live in \`ai-harness\`, not in \`ai-scanner\`
+# (which is the periodic endpoint-inventory collector). Two names, never one
+# shared override — pointing a single variable at one product would leave the
+# other silently addressing a file that is not it.
+export AI_HARNESS_BIN="\${AI_HARNESS_BIN:-$HOME/${agentDir}/bin/ai-harness}"
 export AI_SCANNER_ACCESS_KEY="${accessKey}"
 export AI_SCANNER_LEVEL="\${AI_SCANNER_LEVEL:-high}"
 export AI_SCANNER_EXCLUDE_DIRS="\${AI_SCANNER_EXCLUDE_DIRS:-}"
@@ -569,11 +650,11 @@ ${UNSCANNED_NOTE}
 
 run_scanner() {
   if command -v timeout >/dev/null 2>&1; then
-    timeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT}" "\${AI_SCANNER_BIN}" "$@"
+    timeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT}" "\${AI_HARNESS_BIN}" "$@"
   elif command -v gtimeout >/dev/null 2>&1; then
-    gtimeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT}" "\${AI_SCANNER_BIN}" "$@"
+    gtimeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT}" "\${AI_HARNESS_BIN}" "$@"
   else
-    "\${AI_SCANNER_BIN}" "$@"
+    "\${AI_HARNESS_BIN}" "$@"
   fi
   local rc=$?
   [ $rc -eq 124 ] && return 0
@@ -593,7 +674,7 @@ source "$SCRIPT_DIR/env.sh"
 cat > /dev/null
 bash "$SCRIPT_DIR/start_scanner.sh" 2>/dev/null || true
 cat <<EOF
-{"env":{"AI_SCANNER_BIN":"\${AI_SCANNER_BIN}","AI_SCANNER_ACCESS_KEY":"${accessKey}","AI_SCANNER_LEVEL":"high"}}
+{"env":{"AI_SCANNER_BIN":"\${AI_SCANNER_BIN}","AI_HARNESS_BIN":"\${AI_HARNESS_BIN}","AI_SCANNER_ACCESS_KEY":"${accessKey}","AI_SCANNER_LEVEL":"high"}}
 EOF
 `;
 }
@@ -601,7 +682,7 @@ EOF
 export const CURSOR_PRE_SHELL_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 jq -r '.tool_input.command // ""' | run_scanner scan bash-input
 `;
@@ -609,7 +690,7 @@ jq -r '.tool_input.command // ""' | run_scanner scan bash-input
 export const CURSOR_PRE_READ_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 FILE_PATH=$(jq -r '.tool_input.file_path // ""')
 [ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
@@ -619,7 +700,7 @@ run_scanner scan read-input --file "$FILE_PATH" </dev/null
 export const CURSOR_PRE_EDIT_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
@@ -636,7 +717,7 @@ printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
 export const CURSOR_POST_SHELL_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 COMMAND=$(jq -r '.tool_output // ""' <<<"$INPUT" | head -1 && jq -r '.tool_input.command // ""' <<<"$INPUT")
@@ -646,7 +727,7 @@ jq -r '.tool_output // ""' <<<"$INPUT" | run_scanner scan bash-output --command
 export const CURSOR_POST_READ_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
@@ -657,7 +738,7 @@ jq -r '.tool_output // ""' <<<"$INPUT" | run_scanner scan read-output --file "$F
 export const CURSOR_POST_WRITE_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
@@ -672,7 +753,7 @@ run_scanner scan edit-output --file "$FILE_PATH" < "$FILE_PATH"
 export const WINDSURF_ENSURE_SCANNER_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"
+BIN="$AI_HARNESS_BIN"
 LOCK_FILE="/tmp/.ai-scanner-ensure.lock"
 if [ -x "$BIN" ] && timeout 2 "$BIN" health >/dev/null 2>&1; then
     return 0 2>/dev/null || true
@@ -688,7 +769,7 @@ return 0 2>/dev/null || true
 export const WINDSURF_PRE_COMMAND_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/ensure_scanner.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 CONTENT=$(jq -r '.tool_info.command_line // ""')
 [ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
@@ -698,7 +779,7 @@ printf '%s' "$CONTENT" | run_scanner scan bash-input
 export const WINDSURF_PRE_READ_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/ensure_scanner.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 FILE_PATH=$(jq -r '.tool_info.file_path // ""')
 [ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
@@ -708,7 +789,7 @@ run_scanner scan read-input --file "$FILE_PATH" </dev/null
 export const WINDSURF_PRE_WRITE_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/ensure_scanner.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_info.file_path // ""' <<<"$INPUT")
@@ -720,7 +801,7 @@ printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
 export const WINDSURF_POST_READ_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/ensure_scanner.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 FILE_PATH=$(jq -r '.tool_info.file_path // ""')
 [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ] && exit 0
@@ -730,7 +811,7 @@ run_scanner scan read-output --file "$FILE_PATH" < "$FILE_PATH"
 export const WINDSURF_POST_WRITE_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/ensure_scanner.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 FILE_PATH=$(jq -r '.tool_info.file_path // ""')
 [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ] && exit 0
@@ -773,7 +854,7 @@ exec "$SCRIPT_DIR/start_scanner.sh"
 export const KIRO_PRE_SHELL_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 jq -r '.tool_input.command // ""' | run_scanner scan bash-input
 `;
@@ -781,7 +862,7 @@ jq -r '.tool_input.command // ""' | run_scanner scan bash-input
 export const KIRO_PRE_READ_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.operations[0].path // ""')
 [ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
@@ -791,7 +872,7 @@ run_scanner scan read-input --file "$FILE_PATH" </dev/null
 export const KIRO_PRE_WRITE_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.path // ""' <<<"$INPUT")
@@ -803,7 +884,7 @@ printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
 export const KIRO_POST_SHELL_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 COMMAND=$(jq -r '.tool_input.command // ""' <<<"$INPUT")
@@ -814,7 +895,7 @@ printf '%s' "$RESPONSE" | run_scanner scan bash-output --command "$COMMAND"
 export const KIRO_POST_READ_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.operations[0].path // ""' <<<"$INPUT")
@@ -826,7 +907,7 @@ printf '%s' "$RESPONSE" | run_scanner scan read-output --file "$FILE_PATH"
 export const KIRO_POST_WRITE_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.path // ""' <<<"$INPUT")
@@ -902,7 +983,7 @@ export const CODEX_SESSION_INIT_SH = `#!/bin/bash
 SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]:-$0}")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
 cat > /dev/null   # drain stdin so Codex doesn't block on a write
-BIN="$AI_SCANNER_BIN"
+BIN="$AI_HARNESS_BIN"
 LOCK_FILE="/tmp/.ai-scanner-codex-init.lock"
 if [ -x "$BIN" ] && timeout 2 "$BIN" health >/dev/null 2>&1; then
   exit 0
@@ -919,7 +1000,7 @@ export const CODEX_PRE_SHELL_SH = `#!/bin/bash
 # Codex PreToolUse Bash hook: scan command and return block JSON to Codex.
 SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]:-$0}")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 CMD=$(jq -r '.tool_input.command // ""' <<<"$INPUT" 2>/dev/null)
@@ -949,7 +1030,7 @@ export const CODEX_POST_SHELL_SH = `#!/bin/bash
 # Codex PostToolUse Bash hook: scan command output and return feedback JSON.
 SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]:-$0}")" && pwd)"
 source "$SCRIPT_DIR/env.sh"
-BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
+BIN="$AI_HARNESS_BIN"; [ ! -x "$BIN" ] && { note_unscanned; exit 0; }
 export AI_SCANNER_DETECTION_LOG
 INPUT=$(cat)
 CMD=$(jq -r '.tool_input.command // ""' <<<"$INPUT" 2>/dev/null)