@event4u/agent-config 14.18.0 → 14.19.0

package/src/scripts/hooks/git_command_classifier.ts

@@ -116,6 +116,22 @@ export const BLOCK_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
   "worktree-remove",
   /** `-x` is the flag that takes `.env` and local certificates. */
   "clean-ignored",
+
+  // ── The consequence vocabulary, added 2026-09-06. Every one is already
+  // never-autonomous in the `non-destructive-by-default` prose.
+  //
+  // MEMBERSHIP HERE IS A COUNTING DECISION, NOT A REFUSAL. The set's name
+  // predates ADR-254, which deleted the reader that blocked: the one consumer
+  // that acts on it now is `conformance_scan`'s after-the-fact tally, so
+  // "blocked" describes what the Hard Floor requires of the model, never what
+  // this package does at tool-call time.
+  "prod-deploy",
+  "prod-data-destroy",
+  "prod-infra-change",
+  "external-send",
+  "money-movement",
+  "trunk-force-push",
+  "out-of-scope-destruction",
 ]);
 
 /** Recoverable operations — warned without a this-turn authorization. */
@@ -154,6 +170,17 @@ const G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
 /** Optional absolute/relative path in front of the tool word: `/usr/bin/npm`. */
 const P = "^(?:\\S*\\/)?";
 
+/**
+ * Tool words the consequence rows classify, as a head anchor.
+ *
+ * Kept as one constant rather than folded into each row: `commandOp` filters
+ * segments by head BEFORE consulting the table, so a row whose tool word is
+ * missing here never runs — a silent no-op that looks exactly like a pattern
+ * that did not match.
+ */
+const CONSEQUENCE_TOOL_HEAD =
+  /^(?:\S*\/)?(terraform|pulumi|kubectl|helm|aws|gcloud|az|vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku|cap|psql|mysql|mariadb|sqlite3|mongosh|mongo|redis-cli|sendmail|msmtp|mail|mailx|curl|stripe|braintree|paypal|rm)\b/i;
+
 /**
  * A `gh api` call that WRITES. Read-only `gh api` is the standard way to inspect
  * GitHub state and must never be refused.
@@ -267,6 +294,13 @@ const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
   // "safe force" is in the same class here because what it is safe against is a
   // stale local view, not a collaborator who pushed after your fetch.
+  {
+    op: "trunk-force-push",
+    re: new RegExp(
+      `${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)[^\\n;|&]*\\b(main|master|trunk|production|prod)\\b`,
+      "i",
+    ),
+  },
   {
     op: "force-push",
     re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i"),
@@ -296,6 +330,73 @@ const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   },
   { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
 
+  // ── Consequence operations, added 2026-09-06
+  // (`road-to-authorization-that-reaches-further` 2.1).
+  //
+  // ORDER: above the generic `push`/`commit` fallbacks, because
+  // `trunk-force-push` is a `git push` and the most specific pattern must win —
+  // the rule this table states at its head.
+  //
+  // These classify commands the count could not see before. They add NOTHING to
+  // any refusal path: `commandOp` and `BLOCK_OPS` have exactly one consumer
+  // that acts on them, the after-the-fact tally in `conformance_scan`, and this
+  // change does not add a second.
+  {
+    op: "prod-data-destroy",
+    re: new RegExp(
+      `${P}(psql|mysql|mariadb|sqlite3|mongosh?)\\b[^\\n]*\\b(drop\\s+(table|database|schema)|truncate|delete\\s+from)\\b` +
+        `|${P}aws\\s+s3\\s+(rm|rb)\\b` +
+        `|${P}aws\\s+(dynamodb|rds)\\s+delete-\\S+` +
+        `|${P}redis-cli\\b[^\\n]*\\bflush(all|db)\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "prod-infra-change",
+    re: new RegExp(
+      `${P}terraform\\s+(apply|destroy)\\b` +
+        `|${P}pulumi\\s+(up|destroy)\\b` +
+        `|${P}kubectl\\s+(apply|delete|scale|drain)\\b` +
+        `|${P}helm\\s+(install|upgrade|uninstall|rollback)\\b` +
+        `|${P}aws\\s+(iam|ec2|route53|elbv2)\\s+(create|delete|put|update|modify|attach|detach)-\\S+` +
+        `|${P}(gcloud|az)\\s+\\S+\\s+(create|delete|update)\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "prod-deploy",
+    re: new RegExp(
+      `${P}(vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku)\\s+${G}deploy\\b` +
+        `|${P}(vercel|netlify)\\b[^\\n]*--prod\\b` +
+        `|${P}(npm|pnpm|yarn)\\s+run\\s+deploy\\b` +
+        `|${P}cap\\s+production\\s+deploy\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "external-send",
+    re: new RegExp(
+      `${P}(sendmail|msmtp|mailx?)\\b` +
+        `|${P}curl\\b(?=[^\\n]*(?:-X|--request)\\s+(?:POST|PUT|PATCH)\\b)(?=[^\\n]*https?:\\/\\/)`,
+      "i",
+    ),
+  },
+  {
+    op: "money-movement",
+    re: new RegExp(
+      `${P}(stripe|braintree|paypal)\\s+\\S*(charge|refund|payout|transfer|payment)\\S*\\b`,
+      "i",
+    ),
+  },
+  {
+    // `rm -rf` on an ABSOLUTE path or a home-relative one. Deliberately not
+    // "outside the working tree" — this function receives a command string and
+    // no cwd, so that reading is not decidable here and a classifier that
+    // guesses is worse than one that under-reports.
+    op: "out-of-scope-destruction",
+    re: new RegExp(`${P}rm\\s+(-\\S+\\s+)*-\\S*[rR]\\S*\\s+(-\\S+\\s+)*(~|/)\\S*`, "i"),
+  },
+
   { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
   { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
   { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") },
@@ -592,7 +693,14 @@ export function commandOp(command: string): GitOp | null {
   // unchecked once `publish` was authorized.
   let found: GitOp | null = null;
   for (const seg of invokedSegments(command)) {
-    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg)) {
+    // Widened 2026-09-06 for the consequence vocabulary. Before this the gate
+    // admitted five tool words, so `terraform apply` and `aws s3 rm` were not
+    // merely unclassified — they could not reach the table at all, and the
+    // count read them as nothing rather than as unmeasured.
+    if (
+      !/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg) &&
+      !CONSEQUENCE_TOOL_HEAD.test(seg)
+    ) {
       continue;
     }
     for (const { op, re } of COMMAND_OPS) {
@@ -634,6 +742,53 @@ export function mergeTargetOf(command: string): number | null {
   return api ? _boundedTarget(api[1] as string) : null;
 }
 
+/**
+ * The object a consequence command acts on, or `null` when the command does not
+ * name one.
+ *
+ * The sibling of `mergeTargetOf`, generalised past pull-request numbers, and it
+ * inherits that function's fail-closed stance verbatim: a command that names no
+ * object matches no record, so the caller reports nothing rather than guessing.
+ * Under-reporting is the safe direction for a measurement; a guessed object
+ * would manufacture a violation out of a parse failure.
+ *
+ * Normalised to lower case with quotes stripped, so it compares against the
+ * prose side's `extractObjects` without either end re-deriving the rule.
+ */
+export function commandObject(op: GitOp, command: string): string | null {
+  const patterns = COMMAND_OBJECTS[op];
+  if (!patterns) return null;
+  for (const re of patterns) {
+    const m = new RegExp(re.source, re.flags.replace("g", "")).exec(command);
+    const raw = m?.[1];
+    if (raw) {
+      const value = raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+      if (value) return value;
+    }
+  }
+  return null;
+}
+
+/** Per-operation object patterns on the COMMAND side. */
+const COMMAND_OBJECTS: Readonly<Record<string, readonly RegExp[]>> = {
+  "prod-data-destroy": [
+    /\bdrop\s+(?:table|database|schema|collection)\s+(?:if\s+exists\s+)?["'`]?([\w.$-]+)/i,
+    /\btruncate\s+(?:table\s+)?["'`]?([\w.$-]+)/i,
+    /\bdelete\s+from\s+["'`]?([\w.$-]+)/i,
+    /\bs3:\/\/([\w.-]+)/i,
+    /--table-name[= ]["'`]?([\w.-]+)/i,
+  ],
+  "external-send": [
+    /\bhttps?:\/\/([^\s/"'`]+)/i,
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/,
+  ],
+  "money-movement": [
+    /--customer[= ]["'`]?([\w.-]+)/i,
+    /--amount[= ]["'`]?([\d.,]+)/i,
+    /\b(\d[\d.,]*)\s*(?:eur|usd)\b/i,
+  ],
+};
+
 /** A target only counts inside the API's own range; anything else is no target. */
 function _boundedTarget(digits: string): number | null {
   const n = Number.parseInt(digits, 10);

package/src/scripts/hooks/host_lowering.ts

@@ -0,0 +1,215 @@
+/**
+ * host_lowering — the reader for `host_lowering.yaml`.
+ *
+ * The table is the single place a host's block-exit, emission shape, fail
+ * policy and bridge bindings are written. Before it, those five facts lived in
+ * `host_semantics.ts`, in five private per-host binding constants in
+ * `install.ts`, and in prose; three rounds of prose corrections did not stop
+ * the drift, because prose has no single reader.
+ *
+ * LOADING IS STRICT. A missing or malformed table throws rather than
+ * degrading to an empty one. An empty table would resolve `VERIFIED_PLATFORMS`
+ * to the empty set, which silently downgrades the one host that actually
+ * enforces from blocking to advisory — the exact failure this roadmap's risk
+ * register ranks first. A throw is loud; a silent downgrade is not. The
+ * dispatcher already reads `hook_manifest.yaml` unconditionally from the same
+ * tree, so this adds no new class of failure.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { parse as parseYaml } from 'yaml';
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+const _IN_BUNDLE = typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__;
+const _REPO_ROOT = path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    ...(_IN_BUNDLE ? ['..', '..'] : ['..', '..', '..']),
+);
+
+export const HOST_LOWERING_PATH = path.join(_REPO_ROOT, 'src', 'scripts', 'hooks', 'host_lowering.yaml');
+
+/** Provenance of a row. Every field may be null; `expires` may not. */
+export interface VerifiedBlock {
+    docs_at: string | null;
+    docs_url: string | null;
+    probe_at: string | null;
+    host_version: string | null;
+    expires: string;
+}
+
+export interface SlotRow {
+    /** Host-native event name(s) for this slot, in emission order. */
+    native: string[];
+    /** Exit code the host honours as a refusal here, or null if unestablished. */
+    block_exit: number | null;
+    /** Entry-shape-specific extra (gemini's per-binding matcher). */
+    matcher?: string;
+}
+
+export interface SurfaceRow {
+    entry_shape: string;
+    json_shape: string;
+    fail_policy: string;
+    timeout_unit: string;
+    timeout_default: number | null;
+    verified: VerifiedBlock | null;
+    /** Insertion-ordered: bridge entries are written in this order. */
+    slots: Map<string, SlotRow>;
+}
+
+export type HostLowering = Map<string, Map<string, SurfaceRow>>;
+
+/** The surface every row carries today — see the table header. */
+export const DEFAULT_SURFACE = 'any';
+
+function _asString(v: unknown): string | null {
+    if (v === null || v === undefined) return null;
+    // A bare `2027-09-06` parses as a Date under YAML 1.1 timestamp rules.
+    if (v instanceof Date) return v.toISOString().slice(0, 10);
+    return String(v);
+}
+
+function _parse(text: string): HostLowering {
+    const raw = parseYaml(text) as Record<string, unknown> | null;
+    const hostsRaw = raw?.['hosts'];
+    if (typeof hostsRaw !== 'object' || hostsRaw === null) {
+        throw new Error('host_lowering.yaml: missing `hosts:` map');
+    }
+    const out: HostLowering = new Map();
+    for (const [host, hv] of Object.entries(hostsRaw as Record<string, unknown>)) {
+        const surfacesRaw = (hv as Record<string, unknown> | null)?.['surfaces'];
+        if (typeof surfacesRaw !== 'object' || surfacesRaw === null) {
+            throw new Error(`host_lowering.yaml: ${host} has no \`surfaces:\` map`);
+        }
+        const surfaces = new Map<string, SurfaceRow>();
+        for (const [surface, sv] of Object.entries(surfacesRaw as Record<string, unknown>)) {
+            const s = sv as Record<string, unknown>;
+            const verifiedRaw = s['verified'] as Record<string, unknown> | null | undefined;
+            let verified: VerifiedBlock | null = null;
+            if (verifiedRaw) {
+                const expires = _asString(verifiedRaw['expires']);
+                if (!expires) {
+                    throw new Error(`host_lowering.yaml: ${host}/${surface} verified block has no \`expires\``);
+                }
+                verified = {
+                    docs_at: _asString(verifiedRaw['docs_at']),
+                    docs_url: _asString(verifiedRaw['docs_url']),
+                    probe_at: _asString(verifiedRaw['probe_at']),
+                    host_version: _asString(verifiedRaw['host_version']),
+                    expires,
+                };
+            }
+            const slots = new Map<string, SlotRow>();
+            for (const [slot, rvRaw] of Object.entries((s['slots'] ?? {}) as Record<string, unknown>)) {
+                const rv = rvRaw as Record<string, unknown>;
+                const nativeRaw = rv['native'];
+                const native = Array.isArray(nativeRaw) ? nativeRaw.map(String) : [String(nativeRaw)];
+                const be = rv['block_exit'];
+                const row: SlotRow = {
+                    native,
+                    block_exit: typeof be === 'number' ? be : null,
+                };
+                if (typeof rv['matcher'] === 'string') row.matcher = rv['matcher'];
+                slots.set(slot, row);
+            }
+            surfaces.set(surface, {
+                entry_shape: String(s['entry_shape'] ?? 'none'),
+                json_shape: String(s['json_shape'] ?? 'none'),
+                fail_policy: String(s['fail_policy'] ?? 'discard'),
+                timeout_unit: String(s['timeout_unit'] ?? 'unknown'),
+                timeout_default: typeof s['timeout_default'] === 'number' ? s['timeout_default'] : null,
+                verified,
+                slots,
+            });
+        }
+        out.set(host, surfaces);
+    }
+    return out;
+}
+
+let _cache: HostLowering | null = null;
+
+/** Parse the table once per process. Throws on a missing or malformed file. */
+export function loadHostLowering(): HostLowering {
+    if (_cache === null) _cache = _parse(fs.readFileSync(HOST_LOWERING_PATH, 'utf-8'));
+    return _cache;
+}
+
+/** Test seam — drop the memoized table so a fixture can be loaded instead. */
+export function _resetHostLoweringCache(table?: HostLowering): void {
+    _cache = table ?? null;
+}
+
+/** Parse a fixture table without touching the committed file. */
+export function parseHostLowering(text: string): HostLowering {
+    return _parse(text);
+}
+
+export function surfaceRow(
+    host: string,
+    surface: string = DEFAULT_SURFACE,
+    table: HostLowering = loadHostLowering(),
+): SurfaceRow | null {
+    return table.get(host)?.get(surface) ?? table.get(host)?.get(DEFAULT_SURFACE) ?? null;
+}
+
+/**
+ * Is the row's provenance still current?
+ *
+ * A row past `expires` is treated exactly as `verified: null` — it cannot
+ * carry a blocking binding. Comparison is on the calendar date so the answer
+ * does not depend on the runner's clock time of day.
+ */
+export function isVerifiedNow(row: SurfaceRow | null, today: string = new Date().toISOString().slice(0, 10)): boolean {
+    if (row?.verified == null) return false;
+    return row.verified.expires >= today;
+}
+
+/** Hosts carrying an unexpired `verified` block. */
+export function verifiedPlatforms(table: HostLowering = loadHostLowering()): ReadonlySet<string> {
+    const out = new Set<string>();
+    for (const [host, surfaces] of table) {
+        for (const row of surfaces.values()) {
+            if (isVerifiedNow(row)) {
+                out.add(host);
+                break;
+            }
+        }
+    }
+    return out;
+}
+
+/** Exit code this host honours as a refusal on `slot`, or null. */
+export function blockExitFor(host: string, slot: string, table: HostLowering = loadHostLowering()): number | null {
+    const row = surfaceRow(host, DEFAULT_SURFACE, table);
+    if (!isVerifiedNow(row)) return null;
+    return row?.slots.get(slot)?.block_exit ?? null;
+}
+
+/** One bridge binding: an agent-config slot lowered onto one native event. */
+export interface HostBinding {
+    slot: string;
+    native: string;
+    matcher: string;
+}
+
+/**
+ * Ordered bridge bindings for a host.
+ *
+ * Order is the table's `slots:` insertion order and is part of the generated
+ * output — the emitted bridge JSON is keyed by native event, so re-ordering
+ * changes bytes. Never sort this.
+ */
+export function hostBindings(host: string, table: HostLowering = loadHostLowering()): HostBinding[] {
+    const row = surfaceRow(host, DEFAULT_SURFACE, table);
+    if (!row) return [];
+    const out: HostBinding[] = [];
+    for (const [slot, sr] of row.slots) {
+        for (const native of sr.native) {
+            out.push({ slot, native, matcher: sr.matcher ?? '' });
+        }
+    }
+    return out;
+}

package/src/scripts/hooks/host_lowering.yaml

@@ -0,0 +1,185 @@
+# host_lowering — how each host lowers a dispatcher verdict into its own hook
+# contract, and what this tree has actually established about that lowering.
+#
+# WHY THIS FILE EXISTS. Before it, five facts about a host lived in five
+# places: `VERIFIED_PLATFORMS` and the block-capable event set in
+# `hooks/host_semantics.ts`, five private per-host binding constants in
+# `install.ts`, and prose in half a dozen docs. Three rounds of corrections to
+# that prose did not stop it drifting, because prose has no single reader. This
+# table is the single reader.
+#
+# WHAT A ROW IS. A row is keyed `(host, surface, slot)`. It describes what this
+# package does and what this package has established — never what the host is
+# capable of. `verified: null` means nobody established anything; it does NOT
+# mean the host cannot enforce.
+#
+# THE `surface` AXIS IS PRESENT AND DEGENERATE, DELIBERATELY. Every row today
+# is `any`, because nothing in this tree has measured an IDE-versus-CLI
+# difference in hook lowering on any host. The key carries the dimension so a
+# future measurement lands as a new row rather than as a rewrite; inventing
+# `ide:`/`cli:` rows nobody measured is the defect this roadmap exists to stop.
+#
+# CONSUMED BY:
+#   - src/scripts/hooks/host_semantics.ts   (VERIFIED_PLATFORMS, isBlockCapable, emission shape)
+#   - src/scripts/_lib/host_bindings.ts     (per-host bridge bindings + the install smoke probe)
+#   - src/scripts/lint_hook_manifest.ts     (schema + expiry gate)
+#
+# COLUMNS
+#   block_exit       exit code this host honours as a refusal on that slot;
+#                    `null` = this tree has not established that it honours one.
+#   json_shape       structured-output envelope the dispatcher may emit.
+#   entry_shape      shape of the bridge entry the installer writes.
+#   fail_policy      `propagate` = the dispatcher's exit code reaches the host;
+#                    `discard`   = the trampoline exits 0 regardless.
+#   timeout_unit     unit the host's own hook-timeout setting is expressed in.
+#   timeout_default  host default for that timeout. `null` = not established here.
+#   verified         provenance of the row, or `null`. `expires` is mandatory
+#                    when the block is present — see lint_hook_manifest.
+#   slots            ORDERED. Bridge entries are written in this order, so the
+#                    order is part of the generated output and must not be
+#                    sorted. `native` may be a list where one slot has two
+#                    native events (cline session_start).
+schema_version: 1
+
+hosts:
+  claude:
+    surfaces:
+      any:
+        entry_shape: claude-settings-hooks
+        json_shape: hook-specific-output
+        fail_policy: propagate
+        timeout_unit: seconds
+        timeout_default: null
+        # Transcribed from the behaviour host_semantics.ts already implements —
+        # this row is a description of the status quo, not a new claim.
+        # docs_at/host_version are null because the original read was never
+        # dated; that absence is the record, and the lint reports it.
+        verified:
+          docs_at: null
+          docs_url: https://docs.claude.com/en/docs/claude-code/hooks
+          probe_at: null
+          host_version: null
+          expires: 2027-09-06
+        slots:
+          session_start:      { native: SessionStart,      block_exit: null }
+          session_end:        { native: SessionEnd,        block_exit: null }
+          stop:               { native: Stop,              block_exit: 2 }
+          user_prompt_submit: { native: UserPromptSubmit,  block_exit: 2 }
+          pre_tool_use:       { native: PreToolUse,        block_exit: 2 }
+          post_tool_use:      { native: PostToolUse,       block_exit: null }
+          pre_compact:        { native: PreCompact,        block_exit: null }
+          subagent_start:     { native: SubagentStart,     block_exit: null }
+          subagent_stop:      { native: SubagentStop,      block_exit: null }
+
+  augment:
+    surfaces:
+      any:
+        entry_shape: augment-settings-hooks
+        json_shape: none
+        # augment-dispatcher.sh exits 0 unconditionally: a verdict reaches the
+        # trampoline and stops there.
+        fail_policy: discard
+        timeout_unit: unknown
+        timeout_default: null
+        verified: null
+        slots:
+          session_start:  { native: SessionStart,  block_exit: null }
+          session_end:    { native: SessionEnd,    block_exit: null }
+          stop:           { native: Stop,          block_exit: null }
+          pre_tool_use:   { native: PreToolUse,    block_exit: null }
+          post_tool_use:  { native: PostToolUse,   block_exit: null }
+
+  cursor:
+    surfaces:
+      any:
+        entry_shape: cursor-hooks-json
+        json_shape: none
+        fail_policy: propagate
+        timeout_unit: unknown
+        timeout_default: null
+        verified: null
+        slots:
+          session_start:      { native: sessionStart,        block_exit: null }
+          session_end:        { native: sessionEnd,          block_exit: null }
+          stop:               { native: stop,                block_exit: null }
+          user_prompt_submit: { native: beforeSubmitPrompt,  block_exit: null }
+          post_tool_use:      { native: postToolUse,         block_exit: null }
+
+  cline:
+    surfaces:
+      any:
+        entry_shape: cline-per-event-script
+        json_shape: none
+        # The generated per-event script swallows the dispatcher's exit code
+        # and prints `{}`.
+        fail_policy: discard
+        timeout_unit: unknown
+        timeout_default: null
+        verified: null
+        slots:
+          session_start:      { native: [TaskStart, TaskResume], block_exit: null }
+          session_end:        { native: TaskComplete,            block_exit: null }
+          stop:               { native: TaskCancel,              block_exit: null }
+          user_prompt_submit: { native: UserPromptSubmit,        block_exit: null }
+          post_tool_use:      { native: PostToolUse,             block_exit: null }
+
+  windsurf:
+    surfaces:
+      any:
+        entry_shape: windsurf-hooks-json
+        json_shape: none
+        fail_policy: propagate
+        timeout_unit: unknown
+        timeout_default: null
+        verified: null
+        slots:
+          session_start:      { native: post_setup_worktree,   block_exit: null }
+          user_prompt_submit: { native: pre_user_prompt,       block_exit: null }
+          stop:               { native: post_cascade_response, block_exit: null }
+
+  gemini:
+    surfaces:
+      any:
+        entry_shape: gemini-settings-hooks
+        json_shape: none
+        fail_policy: propagate
+        timeout_unit: unknown
+        timeout_default: null
+        # A live deny probe was attempted on 2026-09-06 against Gemini CLI
+        # 0.50.0 in an isolated scratch workspace and could not run: the CLI
+        # aborts with IneligibleTierError before any turn begins, so no tool
+        # call and therefore no BeforeTool hook is reachable. An unrunnable
+        # probe establishes nothing, so this stays null.
+        verified: null
+        slots:
+          session_start:      { native: SessionStart, block_exit: null, matcher: "" }
+          session_end:        { native: SessionEnd,   block_exit: null, matcher: "" }
+          stop:               { native: AfterAgent,   block_exit: null, matcher: "" }
+          user_prompt_submit: { native: BeforeAgent,  block_exit: null, matcher: "" }
+          post_tool_use:      { native: AfterTool,    block_exit: null, matcher: ".*" }
+
+  cowork:
+    surfaces:
+      any:
+        entry_shape: none
+        json_shape: none
+        # cowork-dispatcher.sh exits 0 unconditionally, and the host is
+        # upstream-blocked from reading any settings source this package writes.
+        fail_policy: discard
+        timeout_unit: unknown
+        timeout_default: null
+        verified: null
+        slots: {}
+
+  copilot:
+    surfaces:
+      any:
+        entry_shape: none
+        json_shape: none
+        fail_policy: discard
+        timeout_unit: unknown
+        timeout_default: null
+        # `fallback_only: true` in hook_manifest.yaml. This package binds
+        # nothing here and has measured nothing here.
+        verified: null
+        slots: {}