@event4u/agent-config 14.18.0 → 14.19.0

package/src/scripts/hook_manifest.json

@@ -1 +1 @@
-{"fingerprint":"40918412:83446","manifest":{"schema_version":1,"concerns":{"chat-history":{"script":"src/scripts/chat_history.ts","args":["hook-dispatch"],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["result"]},"hot-context":{"script":"src/scripts/hot_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"handoff-context":{"script":"src/scripts/handoff_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"roadmap-progress":{"script":"src/scripts/roadmap_progress_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"onboarding-gate":{"script":"src/scripts/onboarding_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"context-hygiene":{"script":"src/scripts/context_hygiene_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"verify-before-complete":{"script":"src/scripts/before_complete_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"ship-diff-volume":{"script":"src/scripts/hooks/ship_diff_volume_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"minimal-safe-diff":{"script":"src/scripts/minimal_safe_diff_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"injection-scan":{"script":"src/scripts/injection_scan_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"block-no-verify":{"script":"src/scripts/hooks/block_no_verify.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-kernel-rule-writes":{"script":"src/scripts/hooks/block_kernel_rule_writes.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-speaking-inbox-dir":{"script":"src/scripts/hooks/block_speaking_inbox_dir.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"block-config-weakening":{"script":"src/scripts/hooks/block_config_weakening.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"rtk-wrap":{"script":"src/scripts/hooks/rtk_wrap_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-slop":{"script":"src/scripts/hooks/design_slop_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass":{"script":"src/scripts/hooks/design_pass_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass-stop":{"script":"src/scripts/hooks/design_pass_hook.ts","args":["--slot","stop"],"fail_closed":false,"severity":"advisory"},"ui-route-nudge":{"script":"src/scripts/hooks/ui_route_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"suggestion-capture":{"script":"src/scripts/hooks/suggestion_capture_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"code-graph-nudge":{"script":"src/scripts/hooks/code_graph_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Grep","Glob","Read"],"needs_payload_bodies":["input"]},"memory-learn":{"script":"src/scripts/memory_learn_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"first-run-gate":{"script":"src/scripts/first_run_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"profile-staleness":{"script":"src/scripts/profile_staleness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"wrapper-freshness":{"script":"src/scripts/wrapper_freshness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"surface-probe":{"script":"src/scripts/surface_probe_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"team-review-gate":{"script":"src/scripts/team_review_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"pr-url-reminder":{"script":"src/scripts/pr_url_reminder_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"push-settle":{"script":"src/scripts/hooks/push_settle_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"language-mirror":{"script":"src/scripts/language_mirror_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"git-authorization":{"script":"src/scripts/git_authorization_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"evidence-independence":{"script":"src/scripts/hooks/evidence_independence.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"session-canary":{"script":"src/scripts/session_canary_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"council-availability":{"script":"src/scripts/council_availability_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-disclosure":{"script":"src/scripts/telemetry_disclosure_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-flush":{"script":"src/scripts/hooks/telemetry_flush_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"self-repair":{"script":"src/scripts/self_repair_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"session-register":{"script":"src/scripts/session_register_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"orchestration-record":{"script":"src/scripts/hooks/orchestration_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"],"needs_payload_bodies":["input","result"]},"telemetry-usage":{"script":"src/scripts/hooks/telemetry_usage_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Skill"],"needs_payload_bodies":["input"]},"delegation-nudge":{"script":"src/scripts/hooks/delegation_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":1},"skill-route":{"script":"src/scripts/hooks/skill_route_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":2},"rule-inject":{"script":"src/scripts/hooks/rule_inject_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"end-review-nudge":{"script":"src/scripts/hooks/end_review_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"turn-end-gate":{"script":"src/scripts/hooks/turn_end_gate_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"comment-discipline":{"script":"src/scripts/hooks/comment_discipline_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write","Edit"],"needs_payload_bodies":["input"]},"edit-shape":{"script":"src/scripts/hooks/edit_shape_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write"],"needs_payload_bodies":["input"]},"reread-guard":{"script":"src/scripts/hooks/reread_guard_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Read","Edit","Write"],"needs_payload_bodies":["input"]},"session-eol":{"script":"src/scripts/hooks/session_eol_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"run-continuation":{"script":"src/scripts/hooks/run_continuation_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"interruption-ledger":{"script":"src/scripts/hooks/interruption_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"subagent-ledger":{"script":"src/scripts/hooks/subagent_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"tool-result-bytes":{"script":"src/scripts/hooks/tool_result_bytes_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"spawn-guard-shadow":{"script":"src/scripts/hooks/spawn_guard_shadow_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"]},"source-first-gate":{"script":"src/scripts/hooks/source_first_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"journal-record":{"script":"src/scripts/hooks/journal_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory"}},"roles":{"worker":{"drop":["delegation-nudge","skill-route","end-review-nudge","council-availability","team-review-gate","self-repair","session-eol","interruption-ledger"]}},"platforms":{"augment":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"claude":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register","journal-record"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush","journal-record"],"stop":["chat-history","hot-context","verify-before-complete","team-review-gate","end-review-nudge","turn-end-gate","self-repair","session-register","session-eol","interruption-ledger","roadmap-progress","design-pass-stop","suggestion-capture","journal-record","run-continuation"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","delegation-nudge","skill-route","git-authorization","session-canary","self-repair","session-register","rule-inject","suggestion-capture","journal-record"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate","rule-inject"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","language-mirror","design-pass","journal-record"],"pre_compact":["language-mirror","hot-context","rule-inject","journal-record"],"subagent_start":["subagent-ledger","journal-record"],"subagent_stop":["subagent-ledger","journal-record"]},"cowork":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"],"subagent_start":["subagent-ledger"],"subagent_stop":["subagent-ledger"]},"cursor":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"cline":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"windsurf":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","profile-staleness","wrapper-freshness","surface-probe","session-register"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","language-mirror","git-authorization","session-canary","self-repair","session-register"]},"gemini":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"copilot":{"fallback_only":true}},"native_event_aliases":{"augment":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use"},"claude":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cowork":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cursor":{"sessionStart":"session_start","sessionEnd":"session_end","stop":"stop","beforeSubmitPrompt":"user_prompt_submit","postToolUse":"post_tool_use","preToolUse":"pre_tool_use","preCompact":"pre_compact"},"cline":{"TaskStart":"session_start","TaskResume":"session_start","TaskComplete":"session_end","TaskCancel":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact"},"windsurf":{"pre_user_prompt":"user_prompt_submit","post_cascade_response":"stop","post_setup_worktree":"session_start"},"gemini":{"SessionStart":"session_start","SessionEnd":"session_end","BeforeAgent":"user_prompt_submit","AfterAgent":"stop","BeforeTool":"pre_tool_use","AfterTool":"post_tool_use"}}}}
+{"fingerprint":"8ca65564:83643","manifest":{"schema_version":1,"concerns":{"chat-history":{"script":"src/scripts/chat_history.ts","args":["hook-dispatch"],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["result"]},"hot-context":{"script":"src/scripts/hot_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"handoff-context":{"script":"src/scripts/handoff_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"roadmap-progress":{"script":"src/scripts/roadmap_progress_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"onboarding-gate":{"script":"src/scripts/onboarding_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"context-hygiene":{"script":"src/scripts/context_hygiene_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"verify-before-complete":{"script":"src/scripts/before_complete_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"ship-diff-volume":{"script":"src/scripts/hooks/ship_diff_volume_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"minimal-safe-diff":{"script":"src/scripts/minimal_safe_diff_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"injection-scan":{"script":"src/scripts/injection_scan_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"block-no-verify":{"script":"src/scripts/hooks/block_no_verify.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-kernel-rule-writes":{"script":"src/scripts/hooks/block_kernel_rule_writes.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-speaking-inbox-dir":{"script":"src/scripts/hooks/block_speaking_inbox_dir.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"block-config-weakening":{"script":"src/scripts/hooks/block_config_weakening.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"rtk-wrap":{"script":"src/scripts/hooks/rtk_wrap_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-slop":{"script":"src/scripts/hooks/design_slop_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass":{"script":"src/scripts/hooks/design_pass_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass-stop":{"script":"src/scripts/hooks/design_pass_hook.ts","args":["--slot","stop"],"fail_closed":false,"severity":"advisory"},"ui-route-nudge":{"script":"src/scripts/hooks/ui_route_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"suggestion-capture":{"script":"src/scripts/hooks/suggestion_capture_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"code-graph-nudge":{"script":"src/scripts/hooks/code_graph_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Grep","Glob","Read"],"needs_payload_bodies":["input"]},"memory-learn":{"script":"src/scripts/memory_learn_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"first-run-gate":{"script":"src/scripts/first_run_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"profile-staleness":{"script":"src/scripts/profile_staleness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"wrapper-freshness":{"script":"src/scripts/wrapper_freshness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"surface-probe":{"script":"src/scripts/surface_probe_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"team-review-gate":{"script":"src/scripts/team_review_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"pr-url-reminder":{"script":"src/scripts/pr_url_reminder_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"push-settle":{"script":"src/scripts/hooks/push_settle_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"language-mirror":{"script":"src/scripts/language_mirror_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"git-authorization":{"script":"src/scripts/git_authorization_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"evidence-independence":{"script":"src/scripts/hooks/evidence_independence.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"session-canary":{"script":"src/scripts/session_canary_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"council-availability":{"script":"src/scripts/council_availability_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-disclosure":{"script":"src/scripts/telemetry_disclosure_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-flush":{"script":"src/scripts/hooks/telemetry_flush_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"self-repair":{"script":"src/scripts/self_repair_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"session-register":{"script":"src/scripts/session_register_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"orchestration-record":{"script":"src/scripts/hooks/orchestration_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"],"needs_payload_bodies":["input","result"]},"telemetry-usage":{"script":"src/scripts/hooks/telemetry_usage_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Skill"],"needs_payload_bodies":["input"]},"delegation-nudge":{"script":"src/scripts/hooks/delegation_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":1},"skill-route":{"script":"src/scripts/hooks/skill_route_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":2},"rule-inject":{"script":"src/scripts/hooks/rule_inject_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"end-review-nudge":{"script":"src/scripts/hooks/end_review_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"turn-end-gate":{"script":"src/scripts/hooks/turn_end_gate_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"comment-discipline":{"script":"src/scripts/hooks/comment_discipline_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write","Edit"],"needs_payload_bodies":["input"]},"edit-shape":{"script":"src/scripts/hooks/edit_shape_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write"],"needs_payload_bodies":["input"]},"reread-guard":{"script":"src/scripts/hooks/reread_guard_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Read","Edit","Write"],"needs_payload_bodies":["input"]},"session-eol":{"script":"src/scripts/hooks/session_eol_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"run-continuation":{"script":"src/scripts/hooks/run_continuation_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"interruption-ledger":{"script":"src/scripts/hooks/interruption_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"subagent-ledger":{"script":"src/scripts/hooks/subagent_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"tool-result-bytes":{"script":"src/scripts/hooks/tool_result_bytes_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"spawn-guard-shadow":{"script":"src/scripts/hooks/spawn_guard_shadow_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"]},"source-first-gate":{"script":"src/scripts/hooks/source_first_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"journal-record":{"script":"src/scripts/hooks/journal_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory"}},"roles":{"worker":{"drop":["delegation-nudge","skill-route","end-review-nudge","council-availability","team-review-gate","self-repair","session-eol","interruption-ledger"]}},"platforms":{"augment":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"claude":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register","journal-record"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush","journal-record"],"stop":["chat-history","hot-context","verify-before-complete","team-review-gate","end-review-nudge","turn-end-gate","self-repair","session-register","session-eol","interruption-ledger","roadmap-progress","design-pass-stop","suggestion-capture","journal-record","run-continuation"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","delegation-nudge","skill-route","git-authorization","session-canary","self-repair","session-register","rule-inject","suggestion-capture","journal-record"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate","rule-inject"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","language-mirror","design-pass","journal-record"],"pre_compact":["language-mirror","hot-context","rule-inject","journal-record"],"subagent_start":["subagent-ledger","journal-record"],"subagent_stop":["subagent-ledger","journal-record"]},"cowork":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"],"subagent_start":["subagent-ledger"],"subagent_stop":["subagent-ledger"]},"cursor":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"cline":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"windsurf":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","profile-staleness","wrapper-freshness","surface-probe","session-register"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","language-mirror","git-authorization","session-canary","self-repair","session-register"]},"gemini":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"copilot":{"fallback_only":true}},"native_event_aliases":{"augment":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use"},"claude":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cowork":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cursor":{"sessionStart":"session_start","sessionEnd":"session_end","stop":"stop","beforeSubmitPrompt":"user_prompt_submit","postToolUse":"post_tool_use","preToolUse":"pre_tool_use","preCompact":"pre_compact"},"cline":{"TaskStart":"session_start","TaskResume":"session_start","TaskComplete":"session_end","TaskCancel":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact"},"windsurf":{"pre_user_prompt":"user_prompt_submit","post_cascade_response":"stop","post_setup_worktree":"session_start"},"gemini":{"SessionStart":"session_start","SessionEnd":"session_end","BeforeAgent":"user_prompt_submit","AfterAgent":"stop","BeforeTool":"pre_tool_use","AfterTool":"post_tool_use"}}}}

package/src/scripts/hook_manifest.yaml

@@ -1,8 +1,8 @@
 # Hook manifest — single source of truth for which concerns fire on which
 # (platform, event) tuples. Consumed by:
-#   - scripts/hooks/dispatch_hook.py   (runtime resolver)
-#   - scripts/lint_hook_manifest.py    (CI gate; Phase 7.10)
-#   - scripts/install.py               (per-platform config writer)
+#   - src/scripts/hooks/dispatch_hook.ts   (runtime resolver)
+#   - src/scripts/lint_hook_manifest.ts    (CI gate; Phase 7.10)
+#   - src/scripts/install.ts               (per-platform config writer)
 #
 # Schema and event vocabulary: docs/contracts/hook-architecture-v1.md.
 # Per-platform event-name mapping: agents/settings/contexts/chat-history-platform-hooks.md.
@@ -626,8 +626,9 @@ concerns:
   #
   # Correctness rests on heartbeat + TTL alone; deregistration only frees a claim
   # sooner. So Windsurf's missing session_end costs latency, not correctness.
-  # Declared non-carriers: copilot (no hook surface), cursor CLI (per-turn slots
-  # are IDE-only), cowork (slots wired, lifecycle events inert) — a session there
+  # Declared non-carriers: copilot (this package binds nothing there and has
+  # measured nothing there), cursor (per-turn reachability unestablished), cowork
+  # (slots wired, lifecycle events inert) — a session there
   # registers but expires by TTL rather than heartbeating, and the concern says so
   # on stderr rather than letting the coverage join read green.
   # Never blocks. fail_closed: false.
@@ -1256,11 +1257,12 @@ platforms:
 
   # Phase 7.5 — Cursor. `.cursor/hooks.json` (project) is read by the
   # IDE and CLI; `~/.cursor/hooks.json` (user) is opt-in via
-  # `install.py --cursor-user-hooks` and uses scripts/hooks/cursor-dispatcher.sh
+  # `agent-config install --cursor-user-hooks` and uses scripts/hooks/cursor-dispatcher.sh
   # to route into the active workspace. UserPromptSubmit maps to
-  # `beforeSubmitPrompt` (Cursor third-party-hooks table). Stop is
-  # IDE-only — CLI-only users fall back to /checkpoint per
-  # agents/settings/contexts/chat-history-platform-hooks.md.
+  # `beforeSubmitPrompt` (Cursor third-party-hooks table). Whether the CLI
+  # surface fires `stop` is not established here; the /checkpoint fallback
+  # covers a session where it does not. See
+  # agents/settings/contexts/chat-history-platform-hooks.md § Cursor.
   cursor:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
@@ -1319,8 +1321,9 @@ platforms:
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
-  # Phase 7.9 — Copilot has no hook surface. Concerns route through
-  # rule-only fallback; the dispatcher silently no-ops on --platform copilot.
+  # Phase 7.9 — this package binds no hook on Copilot and has measured none
+  # there. Concerns route through rule-only fallback; the dispatcher silently
+  # no-ops on --platform copilot.
   copilot:
     fallback_only: true
 

package/src/scripts/hooks/augment-dispatcher.sh

@@ -4,7 +4,7 @@
 # Replaces the four per-concern trampolines (augment-chat-history.sh,
 # augment-roadmap-progress.sh, augment-onboarding-gate.sh,
 # augment-context-hygiene.sh). One script, dispatched per (platform, event)
-# tuple via scripts/hooks/dispatch_hook.py reading scripts/hook_manifest.yaml.
+# tuple via src/scripts/hooks/dispatch_hook.ts reading src/scripts/hook_manifest.yaml.
 #
 # Augment requires hook scripts to use the .sh extension and live at user
 # scope (~/.augment/hooks/) — same constraint as the legacy trampolines.

package/src/scripts/hooks/category_a.ts

@@ -0,0 +1,291 @@
+/**
+ * category_a — which `pre_tool_use` calls this package is willing to hand the
+ * host an explicit `permissionDecision: allow` for.
+ *
+ * WHY THIS EXISTS. `host_semantics` built exactly one envelope shape, so a
+ * call this package does not gate at all still cost the user a host
+ * confirmation. `permissionDecision` is offered by the host contract and was
+ * never emitted, so the prompt is ours to remove — but only for calls where
+ * "we do not gate this" is a fact about the call rather than about our
+ * coverage. That is what category A names: reads, navigation, build, test and
+ * lint inside the working tree with no consequence operation attached.
+ *
+ * THE CLASSIFIER IS AN ALLOWLIST AND MUST STAY ONE. A denylist answers "is
+ * this one of the bad shapes I thought of", so every shape nobody thought of
+ * would be auto-allowed. Everything below answers the opposite question, and an
+ * unrecognised call is not category A. The failure direction of a bug here is
+ * then a prompt that did not go away, never a confirmation that was skipped.
+ *
+ * WHAT AN ALLOW DOES NOT DO. It never overrides a verdict from this package:
+ * composition lives in `host_semantics.composePermissionDecision`, where one
+ * `ask` or `deny` beats every `allow`, and the dispatcher reaches the allow
+ * path only when the reduced severity is already `allow`. It is also not a
+ * grant — the host's own strings record `permissionDecision=allow ignored: a
+ * confined session takes grants only from its command line`.
+ */
+import * as path from "node:path";
+
+/** A JSON-ish tool input as it arrives in the dispatcher envelope. */
+export type ToolInput = Record<string, unknown>;
+
+/**
+ * Tools whose every documented effect is a read. `WebFetch` and `WebSearch`
+ * are deliberately absent — they reach the network, which is the egress leg of
+ * the lethal trifecta and not something to auto-allow.
+ */
+const READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+    "Read",
+    "Glob",
+    "Grep",
+    "NotebookRead",
+    "LS",
+    "TodoRead",
+]);
+
+/** Per-tool input keys that carry a filesystem path needing confinement. */
+const PATH_KEYS: readonly string[] = [
+    "file_path",
+    "notebook_path",
+    "path",
+    "directory",
+];
+
+/**
+ * Any of these in a Bash command string disqualifies it before the argv is
+ * looked at. Chaining, substitution, redirection and backgrounding all let a
+ * safe head token carry an arbitrary second command, and a classifier that
+ * tries to parse past them is a shell parser with a security boundary attached.
+ * Refusing the whole shape is both smaller and correct.
+ */
+const SHELL_METACHARACTERS = /[;&|`$><\n\r(){}\\]/;
+
+/**
+ * Words naming a consequence operation, matched as whole tokens anywhere in
+ * the command. Defence in depth: the metacharacter rule already prevents a
+ * second command, so a hit here means the FIRST command is consequential.
+ */
+const CONSEQUENCE_WORDS: ReadonlySet<string> = new Set([
+    "push", "publish", "deploy", "release", "merge", "rebase", "reset",
+    "revert", "restore", "checkout", "commit", "tag", "fetch", "pull", "clone",
+    "rm", "rmdir", "unlink", "mv", "cp", "chmod", "chown", "kill", "sudo",
+    "curl", "wget", "ssh", "scp", "rsync", "nc", "telnet",
+    "drop", "truncate", "delete", "insert", "migrate", "seed", "restore-db",
+    "install", "uninstall", "upgrade", "prune", "clean", "apply", "destroy",
+    "terraform", "kubectl", "helm", "aws", "gcloud", "az", "docker", "podman",
+    "systemctl", "launchctl", "crontab", "mail", "sendmail",
+]);
+
+/** Read-only `git` subcommands; every consequential one is absent by design. */
+const GIT_READ_SUBCOMMANDS: ReadonlySet<string> = new Set([
+    "status", "log", "diff", "show", "branch", "blame", "describe",
+    "shortlog", "rev-parse", "ls-files", "ls-tree", "cat-file", "whatchanged",
+]);
+
+/**
+ * Head tokens that cannot write outside their arguments and whose named
+ * operation is a read, a navigation, a build, a test or a lint.
+ *
+ * `node`, `python`, `ruby`, `php` and `sh` are deliberately absent: their named
+ * operation is "run this program", which establishes nothing about what the
+ * program does. A test runner is admitted by name because the name IS the
+ * operation.
+ */
+const SAFE_HEADS: ReadonlySet<string> = new Set([
+    "ls", "pwd", "cat", "head", "tail", "wc", "file", "stat", "find",
+    "grep", "rg", "tree", "du", "df", "which", "basename", "dirname",
+    "realpath", "sort", "uniq", "cut", "diff", "cmp", "date", "echo",
+    "tsc", "eslint", "prettier", "biome", "stylelint",
+    "vitest", "jest", "mocha", "pytest", "mypy", "ruff", "flake8", "black",
+    "phpstan", "phpunit", "psalm", "pest", "rspec", "rubocop",
+    "golangci-lint", "shellcheck", "markdownlint", "hadolint",
+]);
+
+/**
+ * Multi-purpose runners: the head token decides nothing, so the subcommand
+ * must be declared. `npm run <script>` executes whatever the manifest says,
+ * which is why the script name is checked separately below.
+ */
+const RUNNER_SUBCOMMANDS: Readonly<Record<string, ReadonlySet<string>>> = {
+    npm: new Set(["test", "run", "ls", "list", "why", "outdated", "view"]),
+    pnpm: new Set(["test", "run", "ls", "list", "why", "outdated"]),
+    yarn: new Set(["test", "run", "list", "why", "info"]),
+    npx: new Set(["tsc", "eslint", "prettier", "vitest", "jest"]),
+    composer: new Set(["test", "run-script", "show", "validate", "diagnose"]),
+    cargo: new Set(["test", "build", "check", "clippy", "fmt", "tree"]),
+    go: new Set(["test", "build", "vet", "list", "version"]),
+    make: new Set(["test", "build", "lint", "check", "typecheck"]),
+    task: new Set(["test", "build", "lint", "check", "typecheck", "--list"]),
+    just: new Set(["test", "build", "lint", "check"]),
+    bundle: new Set(["exec"]),
+    dotnet: new Set(["test", "build"]),
+    mvn: new Set(["test", "compile", "verify"]),
+    gradle: new Set(["test", "build", "check"]),
+};
+
+/** Script names a `run`-style subcommand may name and stay category A. */
+const SAFE_SCRIPT_NAMES: ReadonlySet<string> = new Set([
+    "test", "tests", "lint", "typecheck", "types", "build", "check",
+    "format", "fmt", "unit", "e2e", "coverage", "compile",
+]);
+
+/** Subcommands that take a script name rather than acting themselves. */
+const SCRIPT_TAKING_SUBCOMMANDS: ReadonlySet<string> = new Set([
+    "run", "run-script", "exec",
+]);
+
+/**
+ * Is `candidate` inside `root`?
+ *
+ * Pure `path` arithmetic, no `fs`: the classifier must be decidable from the
+ * envelope alone, and a stat call would make it depend on what happens to
+ * exist on the machine that runs the hook.
+ */
+export function isInsideWorkingTree(candidate: string, root: string): boolean {
+    if (!candidate.trim() || !root.trim()) return false;
+    const abs = path.resolve(root, candidate);
+    const rel = path.relative(path.resolve(root), abs);
+    if (rel === "") return true;
+    return !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+/** Split a command on whitespace; the caller has already refused metacharacters. */
+function _argv(command: string): string[] {
+    return command.trim().split(/\s+/).filter((t) => t.length > 0);
+}
+
+/** Strip a leading `-`/`--` so a flag is never mistaken for a subcommand. */
+function _isFlag(token: string): boolean {
+    return token.startsWith("-");
+}
+
+/** First non-flag token after the head, or `""`. */
+function _firstSubcommand(argv: readonly string[]): string {
+    for (const token of argv.slice(1)) {
+        if (!_isFlag(token)) return token;
+    }
+    return "";
+}
+
+/**
+ * `git` global options that consume the NEXT token as their value.
+ *
+ * Without this, `git -C sub status` resolves its subcommand to `sub` and the
+ * whole directory-flag form — the shape the canon now teaches in place of
+ * `cd X && …` — falls out of category A. That defect was found by the friction
+ * corpus on its first run, which is the reason the corpus counts confirmations
+ * rather than gates: a gate count would have looked identical.
+ *
+ * The `--flag=value` spelling consumes no extra token and needs no entry.
+ */
+const GIT_VALUE_FLAGS: ReadonlySet<string> = new Set([
+    "-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path",
+]);
+
+/**
+ * The `git` subcommand, with global options skipped.
+ *
+ * Returns `""` when a global option's VALUE escapes the working tree — an
+ * absolute path or a `..` traversal. The check is textual rather than resolved
+ * against a root because this function is pure and receives no root; what it
+ * can decide is exactly the property that matters, and a relative path with no
+ * `..` cannot escape.
+ */
+function _gitSubcommand(argv: readonly string[]): string {
+    for (let i = 1; i < argv.length; i++) {
+        const token = argv[i] as string;
+        if (!_isFlag(token)) return token;
+        const [flag, inlineValue] = token.includes("=")
+            ? [token.slice(0, token.indexOf("=")), token.slice(token.indexOf("=") + 1)]
+            : [token, null];
+        const value = inlineValue ?? (GIT_VALUE_FLAGS.has(flag) ? argv[++i] : undefined);
+        if (value !== undefined && (path.isAbsolute(value) || value.split("/").includes(".."))) {
+            return "";
+        }
+    }
+    return "";
+}
+
+/** Non-flag token after the subcommand, or `""`. */
+function _secondSubcommand(argv: readonly string[]): string {
+    const nonFlags = argv.slice(1).filter((t) => !_isFlag(t));
+    return nonFlags[1] ?? "";
+}
+
+/**
+ * Does any token in the command name a consequence operation?
+ *
+ * Tokenised rather than substring-matched: a substring test would refuse
+ * `git log --format=…` for containing `mat`, and a classifier that refuses
+ * everything is indistinguishable from one that was never wired.
+ */
+export function namesConsequenceOperation(command: string): boolean {
+    for (const raw of _argv(command)) {
+        const token = raw.replace(/^-+/, "").toLowerCase();
+        if (CONSEQUENCE_WORDS.has(token)) return true;
+        // `npm:publish`, `db:seed`, `deploy:prod` — a namespaced script name
+        // hides the consequential half behind a separator.
+        for (const part of token.split(/[:/=,]/)) {
+            if (part && CONSEQUENCE_WORDS.has(part)) return true;
+        }
+    }
+    return false;
+}
+
+/** Is this Bash command string category A? */
+export function isCategoryABashCommand(command: string): boolean {
+    if (typeof command !== "string" || !command.trim()) return false;
+    if (SHELL_METACHARACTERS.test(command)) return false;
+    if (namesConsequenceOperation(command)) return false;
+
+    const argv = _argv(command);
+    const head = (argv[0] ?? "").toLowerCase();
+    if (!head) return false;
+
+    if (SAFE_HEADS.has(head)) return true;
+
+    if (head === "git") {
+        return GIT_READ_SUBCOMMANDS.has(_gitSubcommand(argv));
+    }
+
+    const allowed = RUNNER_SUBCOMMANDS[head];
+    if (!allowed) return false;
+    const sub = _firstSubcommand(argv);
+    if (!sub || !allowed.has(sub)) return false;
+    if (SCRIPT_TAKING_SUBCOMMANDS.has(sub)) {
+        const script = _secondSubcommand(argv);
+        return script !== "" && SAFE_SCRIPT_NAMES.has(script.toLowerCase());
+    }
+    return true;
+}
+
+/**
+ * Is this tool call category A?
+ *
+ * `workingTree` is the root every path argument must resolve inside. An empty
+ * root means the dispatcher could not establish one, and an unestablished
+ * boundary is not a boundary — the call is not category A.
+ */
+export function isCategoryA(
+    toolName: string,
+    toolInput: ToolInput,
+    workingTree: string,
+): boolean {
+    if (!workingTree.trim()) return false;
+    if (typeof toolName !== "string" || !toolName) return false;
+
+    if (READ_ONLY_TOOLS.has(toolName)) {
+        for (const key of PATH_KEYS) {
+            const value = toolInput?.[key];
+            if (typeof value !== "string") continue;
+            if (!isInsideWorkingTree(value, workingTree)) return false;
+        }
+        return true;
+    }
+
+    if (toolName === "Bash") {
+        const command = toolInput?.["command"];
+        return typeof command === "string" && isCategoryABashCommand(command);
+    }
+
+    return false;
+}

package/src/scripts/hooks/cline-dispatcher.sh

@@ -4,7 +4,7 @@
 # Routes user-scope `~/Documents/Cline/Hooks/<HookName>` events into
 # the active workspace's `./agent-config dispatch:hook`. Project-scope
 # `.clinerules/hooks/<HookName>` does NOT need this trampoline —
-# install.py `ensure_cline_bridge()` writes per-event scripts there
+# the installer's `ensure_cline_bridge()` writes per-event scripts there
 # that dispatch directly because Cline fires project hooks with the
 # workspace as cwd.
 #

package/src/scripts/hooks/cursor-dispatcher.sh

@@ -3,7 +3,7 @@
 #
 # Routes user-scope `~/.cursor/hooks.json` events into the active
 # workspace's `./agent-config dispatch:hook`. Project-scope
-# `.cursor/hooks.json` does NOT need this trampoline — install.py
+# `.cursor/hooks.json` does NOT need this trampoline — the installer
 # `ensure_cursor_bridge()` writes direct dispatch:hook commands there
 # because the project hooks fire with the workspace as cwd.
 #
@@ -20,10 +20,16 @@
 #   - Re-pipe the original JSON into
 #       ./agent-config dispatch:hook --platform cursor \
 #           --event $1 --native-event $2
-#   - Always exit 0 — Cursor's pre-hooks can block via exit code, but
-#     none of our concerns block; chat-history / roadmap-progress /
-#     context-hygiene are observe-only and onboarding-gate writes
-#     state without denying sessionStart.
+#   - Always exit 0 — Cursor's pre-hooks can block via exit code. The
+#     manifest declares 7 concerns at `severity: blocking`, and this host
+#     binds none of them: cursor's platform row carries session_start,
+#     session_end, stop, user_prompt_submit and post_tool_use, and every
+#     blocking concern sits in a slot or platform row outside that set.
+#     The count is a YAML parse of the concerns map, never `grep -c
+#     'severity: blocking'`, which returns 8 by also counting the prose
+#     line that quotes the key. What IS bound here — chat-history /
+#     roadmap-progress / context-hygiene — is observe-only, and
+#     onboarding-gate writes state without denying sessionStart.
 
 set -u
 

package/src/scripts/hooks/dispatch_hook.ts

@@ -9,12 +9,10 @@
  * stdout/stderr split, and exit codes. Helper names keep snake_case for
  * fidelity (concern authors rely on the documented surface).
  *
- * Per `docs/contracts/hook-architecture-v1.md`. Reads the manifest at
- * `scripts/hook_manifest.yaml`, resolves which concerns fire on the given
- * (platform, event) tuple, and runs each concern sequentially with the
- * stdin envelope contract. Reduces concern exit codes per the spec
- * (0=allow, 1=block, 2=warn, ≥3=error → fail-open unless concern is
- * fail_closed).
+ * Per `docs/contracts/hook-architecture-v1.md`. Reads `src/scripts/hook_manifest.yaml`,
+ * resolves which concerns fire on the given (platform, event) tuple, and runs each
+ * sequentially with the stdin envelope contract. Reduces concern exit codes per the
+ * spec (0=allow, 1=block, 2=warn, ≥3=error → fail-open unless concern is fail_closed).
  *
  * Invocation:
  *
@@ -50,13 +48,16 @@ import {
   setHookStdinOverride,
   clearHookStdinOverride,
 } from "./hook_stdin.js";
-import { emitFor, type Severity } from "./host_semantics.js";
+import { emitFor, type PermissionDecision, type Severity } from "./host_semantics.js";
+import { _concern_permission_verdict, _payload_tool_name, _permission_for } from "./permission_gate.js";
+export { _concern_permission_verdict, _payload_tool_input, _payload_tool_name, _permission_for, _working_tree_root } from "./permission_gate.js";
 import { _concern_body_classes, planPayloadShapes } from "./payload_stub.js";
 import { resolveSessionRole, type SessionRole } from "../_lib/session_role.js";
 import { stdinReadFailure, denyOnStdinFailure } from './stdin_failure_policy.js';
 export { stdinReadFailure, denyOnStdinFailure, _is_fail_closed_blocking } from './stdin_failure_policy.js';
 import { _py_json_dumps } from './py_json_dumps.js';
 import { _fallback_yaml } from './fallback_yaml.js';
+import { detectSurface } from '../_lib/surface.js';
 import { recordCapture, recordOpportunity } from "../_lib/collector_denominator.js";
 export { _fallback_yaml } from './fallback_yaml.js';
 
@@ -255,20 +256,6 @@ interface ConcernDef extends JsonObject {
   name: string;
 }
 
-/**
- * The tool name the host reported for this event, or `""`.
- *
- * Only tool events carry one. Read defensively: the payload is host-shaped and
- * a missing / non-string field must degrade to "unknown tool", never throw.
- */
-export function _payload_tool_name(envelope: JsonObject): string {
-  const payload = envelope["payload"];
-  if (!_isObject(payload)) {
-    return "";
-  }
-  const raw = payload["tool_name"];
-  return typeof raw === "string" ? raw : "";
-}
 
 /**
  * Per-concern tool filter — the `tools:` key.
@@ -290,7 +277,7 @@ export function _payload_tool_name(envelope: JsonObject): string {
  * - A host matcher would only help the two hosts that support one (Claude,
  *   Gemini). The in-process skip helps all eight platforms in the manifest.
  *
- * ## What this does NOT claim
+ * What this does NOT claim:
  *
  * It does not claim a latency win. The measured hook cost that was fixed was
  * the *invocation path* (~370 of ~450–500 ms was eager CLI imports); nothing in
@@ -509,6 +496,7 @@ export function _build_envelope(args: Args, payload_text: string): JsonObject {
       process.env["AGENT_SESSION_ID"] ||
       "",
     workspace_root: process.cwd(),
+    surface: detectSurface(payloadObj),
     payload: payloadObj,
     settings: {},
   };
@@ -1280,6 +1268,11 @@ export function main(argv?: string[]): number {
   // fixed-field schema (PII-exclusion-by-construction), and a concern's raw
   // stderr is free-form content. This array is in-memory only.
   const concern_messages: ConcernMessage[] = [];
+  // Per-concern permission verdicts for the host's `permissionDecision` field.
+  // Separate from `rcs` because the two ladders are not the same: an advisory
+  // concern can ask for a confirmation without blocking, and a reduced `allow`
+  // must not become a grant when one of them did.
+  const permission_verdicts: PermissionDecision[] = [];
   // Per-concern `tools:` filter (see _concern_matches_tool). Applied here so it
   // is one place, after the envelope exists and before any concern is spawned.
   const tool_name = _payload_tool_name(envelope);
@@ -1339,6 +1332,7 @@ export function main(argv?: string[]): number {
     }
     rcs.push(rc);
     const reply = _parse_concern_stdout(stdout_text);
+    permission_verdicts.push(_concern_permission_verdict(rc, reply));
     // A concern states its reason either as JSON {"reason": …} on stdout
     // (advisory concerns) or as a formatted stderr line (the block guards, e.g.
     // `block-no-verify: BLOCKED — …`). Both are captured here so the emission
@@ -1423,6 +1417,7 @@ export function main(argv?: string[]): number {
     _severity_for(final_rc) as Severity,
     decidingReasons,
     final_rc,
+    _permission_for(args.event, envelope, final_rc, permission_verdicts),
   );
   if (emission.stdout) {
     process.stdout.write(emission.stdout);