@fusengine/harness 0.1.57 → 0.1.59

package/README.md

@@ -125,8 +125,8 @@ also works elsewhere.
 | Harness | PreToolUse coverage | Lifecycle (Session/Subagent/Stop/Compact/…) | Known limit |
 |---|---|---|---|
 | **claude-code** | Full: `evaluate` + APEX gates via `handleHook` (`src/adapters/claude/index.ts`) | 14 event types implemented (`dispatch.ts`) — fires once wired into `.claude/settings.json` beyond the `init` default | None found; richer lifecycle needs manual/marketplace wiring (see Quickstart) |
-| **codex** | Reuses the Claude reader/response shape — Codex's hook wire format matches Claude's (`src/adapters/codex/index.ts:1-8`). Bash is gated reliably. | Not wired by `harness init codex` (PreToolUse `Bash\|apply_patch` + PostToolUse only, `src/init/templates.ts:29-38`) | The SOLID/file-size gate covers `apply_patch` edits at **0%** — it keys off `tool_input.file_path` (Write/Edit shape), which Codex's diff-carrying `apply_patch` call never supplies (`codex/index.ts:6-8`). Codex also **parses but does not honor** `permissionDecision:"ask"` — deny-only (`codex/index.ts:6`). |
-| **cursor** | `beforeShellExecution` can deny/ask (shell only, `cursor/index.ts:16-21`) | none | `afterFileEdit` is **observe-only** — "Cursor cannot block here" (`cursor/index.ts:23-24`); a file-edit violation is logged, never prevented (platform limit, not a bug here). |
+| **codex** | Bash gated reliably; **`apply_patch` edits are now gated too** — the patch text is parsed per file (`adapters/codex/apply-patch.ts`), each hunk runs the file gates and ONE violating hunk denies the whole patch (`runtime/apply-patch-gate.ts`, sim scenario 22 incl. the multi-file smuggling case). `ask` prompts are **downgraded to explicit deny** (`respond.ts`, sim scenario 23) because Codex fails open on unsupported shapes. | Not wired by `harness init codex` (PreToolUse `Bash\|apply_patch` + PostToolUse only, `src/init/templates.ts:29-38`) | Upstream caveat: Codex itself does not always enforce a correct `apply_patch` deny (openai/codex#27833) — we emit the right verdict; enforcement is theirs. No interactive `ask`. |
+| **cursor** | `beforeShellExecution` can deny/ask (shell only, `cursor/index.ts:16-21`) | none | File edits are **advisory only**: `afterFileEdit` always returns `allow` + a `user_message` correction on violation — a `deny` there has no proven effect (hook was "informational only" at launch, and Cursor's deny-enforcement for file ops is confirmed broken upstream, forum.cursor.com/t/154377). Human sees the message; the model is never re-informed. Platform ceiling, documented in `cursor/index.ts`. |
 | **gemini-cli** | `BeforeTool` denies via `{decision:"deny",reason}` (`gemini/index.ts:22-36`) | none | Thin stateless adapter — no session track, no APEX gates wired through it. |
 | **cline** | `PreToolUse` only; block → `{cancel:true}`, non-block → `contextModification` (`cline/index.ts:24-36`) | none | Same as gemini-cli: stateless guard only. |
 | **hermes** | `pre_tool_call` proven: reuses the Claude stdin reader, blocks via `{decision:"block",reason}` (`hermes/index.ts:12-36`) | untested — no lifecycle dispatch wired for Hermes in this repo | `ask`/`inform` degrade to non-blocking `{context}` — Hermes "has no interactive ask state" (`hermes/index.ts:27-28`). |

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-BxC9semG.mjs";
+import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-BLuab-tR.mjs";
 export { attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-CNAzgxnN.mjs";
+import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.d.mts

@@ -1,2 +1,14 @@
-import { a as denyResponse, i as contextResponse, l as readClaudeInput, s as guard, t as ClaudeHookInput } from "../../index-DZCLmSoO.mjs";
-export { type ClaudeHookInput as CodexHookInput, contextResponse, denyResponse, guard, readClaudeInput as readCodexInput };
+import { t as Prompt } from "../../types-DVbIl9md.mjs";
+import { a as denyResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-DZCLmSoO.mjs";
+
+//#region src/adapters/codex/index.d.ts
+/** Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny. */
+declare function toCodexResponse(prompt: Prompt): string;
+/**
+* Run the bundled policy over a Codex payload and return the native response
+* string (deny/additionalContext), or null to allow. `apply_patch` is fanned
+* into per-file checks; every other tool routes through the portable policy.
+*/
+declare function guard(input: ClaudeHookInput): string | null;
+//#endregion
+export { type ClaudeHookInput as CodexHookInput, contextResponse, denyResponse, guard, readClaudeInput as readCodexInput, toCodexResponse };

package/dist/adapters/codex/index.mjs

@@ -1,2 +1,66 @@
-import { c as readClaudeInput, i as denyResponse, o as guard, r as contextResponse } from "../../claude-BxC9semG.mjs";
-export { contextResponse, denyResponse, guard, readClaudeInput as readCodexInput };
+import { f as countLines } from "../../home-state-D0RLWP8J.mjs";
+import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
+import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
+import { t as parseApplyPatch } from "../../apply-patch-CIS2EZ_q.mjs";
+import { c as readClaudeInput, i as denyResponse, r as contextResponse } from "../../claude-BLuab-tR.mjs";
+//#region src/adapters/codex/index.ts
+/**
+* OpenAI Codex CLI adapter (hook-mode). Codex's `PreToolUse` hook (since 2026)
+* uses the SAME envelope as Claude Code — `tool_name`/`tool_input` in,
+* `hookSpecificOutput.permissionDecision` out — so it shares Claude's readers.
+* Config lives at `.codex/hooks.json`.
+*
+* Two Codex-specific quirks this adapter closes (audit 2026-07-06):
+* 1. `apply_patch` is Codex's PRIMARY edit primitive; its payload is a freeform
+*    patch in `tool_input.command`, with NO `file_path`/`content`. Claude's guard
+*    keyed off those fields, so the SOLID/DRY gates saw NOTHING (enforcement 0%).
+*    Here the patch is parsed and each file is judged (one violating hunk denies).
+* 2. Codex parses but NEVER honors `permissionDecision: "ask"` (deny-only) — an
+*    `ask` silently fails open (verified: `pre_tool_use.rs` test
+*    `unsupported_permission_decision_fails_open`). Every `ask` is downgraded to
+*    an explicit deny.
+*/
+const ASK_PREFIX = "[downgraded from ask — Codex has no interactive approval]";
+/** Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny. */
+function toCodexResponse(prompt) {
+	const message = formatPrompt(prompt);
+	if (prompt.kind === "inform") return contextResponse("PreToolUse", message);
+	if (prompt.kind === "ask") return denyResponse("PreToolUse", `${ASK_PREFIX}\n${message}`);
+	return denyResponse("PreToolUse", message);
+}
+/** OR the per-file SOLID verdict of an `apply_patch` payload — first block wins. */
+function applyPatchPrompt(command) {
+	for (const f of parseApplyPatch(command)) {
+		if (f.op === "delete") continue;
+		const r = evaluate({
+			tool: f.op === "add" ? "Write" : "Edit",
+			filePath: f.path,
+			content: f.content,
+			existingLines: countLines(f.content)
+		});
+		if (r.decision !== "allow" && r.prompt) return r.prompt;
+	}
+	return null;
+}
+/** Portable single-tool verdict for non-`apply_patch` Codex tools. */
+function resolvePrompt(input) {
+	const i = input.tool_input;
+	const r = evaluate({
+		tool: input.tool_name ?? "Write",
+		filePath: i?.file_path,
+		content: i?.content ?? i?.new_string,
+		command: i?.command
+	});
+	return r.decision === "allow" || !r.prompt ? null : r.prompt;
+}
+/**
+* Run the bundled policy over a Codex payload and return the native response
+* string (deny/additionalContext), or null to allow. `apply_patch` is fanned
+* into per-file checks; every other tool routes through the portable policy.
+*/
+function guard(input) {
+	const prompt = input.tool_name === "apply_patch" ? applyPatchPrompt(input.tool_input?.command ?? "") : resolvePrompt(input);
+	return prompt ? toCodexResponse(prompt) : null;
+}
+//#endregion
+export { contextResponse, denyResponse, guard, readClaudeInput as readCodexInput, toCodexResponse };

package/dist/adapters/cursor/index.d.mts

@@ -15,6 +15,19 @@ interface CursorEditPayload {
   }[];
 }
 /**
+* `afterFileEdit` stdout response. Its schema (cursor.com/docs/hooks#afterFileEdit)
+* is DELIBERATELY narrower than the "before" hooks: `permission` + `user_message`
+* only — there is NO `agent_message` and NO `updated_input`. Since the edit is
+* already on disk when this "after" hook fires, `deny` cannot revert it and the
+* correction reaches only the HUMAN (`user_message`), never the model — so this
+* path is strictly ADVISORY, not an enforceable gate.
+*/
+interface CursorEditResponse {
+  permission: "allow" | "deny";
+  /** User-visible correction — snake_case (#141516); the only channel afterFileEdit exposes. */
+  user_message?: string;
+}
+/**
 * `beforeShellExecution` stdout response. Message keys are snake_case:
 * Cursor silently ignores camelCase `userMessage`/`agentMessage` (#141516,
 * regression persists through v2.0.77+ — forum #142589), matching the
@@ -32,9 +45,24 @@ interface CursorResponse {
 //#region src/adapters/cursor/index.d.ts
 /** Guard a shell command (git/install policies). */
 declare function beforeShellExecution(payload: CursorShellPayload): CursorResponse;
-/** Observe a file edit (Cursor cannot block here). Returns the verdict for logging. */
-declare function afterFileEdit(payload: CursorEditPayload): {
-  violation: string | null;
-};
+/**
+* Advise on a file edit AFTER Cursor has written it — a HUMAN-VISIBLE audit note,
+* never a gate. This is an "after" hook: the edit is already on disk. On a
+* SOLID/DRY violation we surface the correction through `user_message` (the only
+* channel afterFileEdit exposes — no `agent_message`, so the model is never
+* re-informed) while ALWAYS returning `permission: "allow"`.
+*
+* We deliberately never emit `permission: "deny"` here, for two distinct reasons:
+* (1) structural — afterFileEdit was "informational only" at launch (Chacon,
+* Cursor hooks beta 1.7, 2025-09: no channel to stop the agent), and a post-write
+* deny has no documented rollback; (2) empirical — Cursor staff confirm the
+* deny-enforcement path is broken for file operations (forum.cursor.com/t/154377,
+* v2.6.18, 2026-03, open) — proven for file READS, plausibly the same for writes.
+* So a `deny` would be a false blocking signal; `allow` + `user_message` is the
+* only proven-safe shape.
+* @param payload - The `afterFileEdit` stdin payload.
+* @returns Always an allow; carries the user-visible correction on a violation.
+*/
+declare function afterFileEdit(payload: CursorEditPayload): CursorEditResponse;
 //#endregion
-export { type CursorEditPayload, type CursorResponse, type CursorShellPayload, afterFileEdit, beforeShellExecution };
+export { type CursorEditPayload, type CursorEditResponse, type CursorResponse, type CursorShellPayload, afterFileEdit, beforeShellExecution };

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-CNAzgxnN.mjs";
+import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**
@@ -23,7 +23,24 @@ function beforeShellExecution(payload) {
 		agent_message: msg
 	};
 }
-/** Observe a file edit (Cursor cannot block here). Returns the verdict for logging. */
+/**
+* Advise on a file edit AFTER Cursor has written it — a HUMAN-VISIBLE audit note,
+* never a gate. This is an "after" hook: the edit is already on disk. On a
+* SOLID/DRY violation we surface the correction through `user_message` (the only
+* channel afterFileEdit exposes — no `agent_message`, so the model is never
+* re-informed) while ALWAYS returning `permission: "allow"`.
+*
+* We deliberately never emit `permission: "deny"` here, for two distinct reasons:
+* (1) structural — afterFileEdit was "informational only" at launch (Chacon,
+* Cursor hooks beta 1.7, 2025-09: no channel to stop the agent), and a post-write
+* deny has no documented rollback; (2) empirical — Cursor staff confirm the
+* deny-enforcement path is broken for file operations (forum.cursor.com/t/154377,
+* v2.6.18, 2026-03, open) — proven for file READS, plausibly the same for writes.
+* So a `deny` would be a false blocking signal; `allow` + `user_message` is the
+* only proven-safe shape.
+* @param payload - The `afterFileEdit` stdin payload.
+* @returns Always an allow; carries the user-visible correction on a violation.
+*/
 function afterFileEdit(payload) {
 	const content = payload.edits?.map((e) => e.new_string).join("\n") ?? "";
 	const r = evaluate({
@@ -31,7 +48,11 @@ function afterFileEdit(payload) {
 		filePath: payload.file_path,
 		content
 	});
-	return { violation: r.decision === "deny" ? r.message : null };
+	if (r.decision !== "deny" || !r.prompt) return { permission: "allow" };
+	return {
+		permission: "allow",
+		user_message: formatPrompt(r.prompt)
+	};
 }
 //#endregion
 export { afterFileEdit, beforeShellExecution };

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-CNAzgxnN.mjs";
+import { t as evaluate } from "../../evaluate-BgFLlqrs.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/adapters/hermes/index.mjs

@@ -1,2 +1,2 @@
-import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-DWXCRFZU.mjs";
+import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-CyhCYqD7.mjs";
 export { guard, readHermesInput, toHermesResponse };

package/dist/apply-patch-CIS2EZ_q.mjs

@@ -0,0 +1,81 @@
+//#region src/adapters/codex/apply-patch.ts
+const BEGIN = "*** Begin Patch";
+const END = "*** End Patch";
+const ADD = "*** Add File: ";
+const DEL = "*** Delete File: ";
+const UPD = "*** Update File: ";
+const MOVE = "*** Move to: ";
+const EOF = "*** End of File";
+const ENV = "*** Environment ID: ";
+/**
+* Parse a Codex freeform patch into its per-file changes. Lenient on whitespace
+* around structural markers (as Codex's own parser is); returns `[]` when no
+* recognizable hunk is present (malformed input fails open, not closed).
+* @param text - Raw patch body from `tool_input.command`.
+* @returns One {@link PatchedFile} per Add/Update/Delete hunk, in order.
+*/
+function parseApplyPatch(text) {
+	const files = [];
+	let cur = null;
+	let buf = [];
+	const flush = () => {
+		if (cur) {
+			cur.content = buf.join("\n");
+			files.push(cur);
+		}
+		cur = null;
+		buf = [];
+	};
+	for (const line of text.split("\n")) {
+		const marker = line.trimStart();
+		if (marker === BEGIN || marker.startsWith(ENV)) continue;
+		if (marker === END) {
+			flush();
+			continue;
+		}
+		if (marker.startsWith(ADD)) {
+			flush();
+			cur = {
+				path: marker.slice(14).trim(),
+				content: "",
+				op: "add"
+			};
+			continue;
+		}
+		if (marker.startsWith(DEL)) {
+			flush();
+			files.push({
+				path: marker.slice(17).trim(),
+				content: "",
+				op: "delete"
+			});
+			continue;
+		}
+		if (marker.startsWith(UPD)) {
+			flush();
+			cur = {
+				path: marker.slice(17).trim(),
+				content: "",
+				op: "update"
+			};
+			continue;
+		}
+		if (marker.startsWith(MOVE)) {
+			if (cur) cur.path = marker.slice(13).trim();
+			continue;
+		}
+		if (marker === EOF || !cur) continue;
+		if (cur.op === "add") {
+			if (line.startsWith("+")) buf.push(line.slice(1));
+			continue;
+		}
+		if (line.startsWith("@@")) continue;
+		if (line.startsWith("+")) buf.push(line.slice(1));
+		else if (line.startsWith("-")) continue;
+		else buf.push(line.startsWith(" ") ? line.slice(1) : line);
+	}
+	flush();
+	return files;
+}
+//#endregion
+export { parseApplyPatch as t };

package/dist/{claude-BxC9semG.mjs → claude-BLuab-tR.mjs}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CNAzgxnN.mjs";
+import { t as evaluate } from "./evaluate-BgFLlqrs.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

package/dist/cli/bin.mjs

@@ -2,9 +2,9 @@
 import { r as loadDotenv, s as resolveTtlSec } from "../dotenv-Jj8aL1FL.mjs";
 import { t as detectHarness } from "../harness-Cb9xR8dC.mjs";
 import { t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DZvP_9xB.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-B4b2_7Qm.mjs";
 import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { J as runningVersion, Lt as todayUtc, Y as versionBanner, q as runDoctor, t as handleHook } from "../handle-DY79I4a8.mjs";
+import { J as runningVersion, Lt as todayUtc, Y as versionBanner, q as runDoctor, t as handleHook } from "../handle-B6yL03we.mjs";
 import { delimiter, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DZvP_9xB.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-B4b2_7Qm.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/{evaluate-CNAzgxnN.mjs → evaluate-BgFLlqrs.mjs}

@@ -436,7 +436,7 @@ const CODE_MUTATORS = [
 		desc: "awk in-place edit"
 	},
 	{
-		re: /\bpatch\b/,
+		re: /(?:^|[\n;&|(])\s*patch(?=\s|<|[;&|)>]|$)/,
 		desc: "patch file modification"
 	},
 	{

package/dist/{handle-DY79I4a8.mjs → handle-B6yL03we.mjs}

@@ -4,7 +4,7 @@ import { r as projectLayout } from "./layout-C0jaaCQC.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { A as detectCreationIntent, E as isExcludedSwiftPath, F as docConsultedGate, H as detectProjectType$1, I as evaluateApex, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, S as usesTailwindUtilities, T as isExcludedJsPath, V as detectModularArchitecture, W as requiredArchSkill, _ as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, h as buildClaudeMdContext, k as capVerbosity, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DCQ8dkdL.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, t as claudeHome } from "./home-state-D0RLWP8J.mjs";
-import { n as FAIL_CLOSED, t as evaluate } from "./evaluate-CNAzgxnN.mjs";
+import { n as FAIL_CLOSED, t as evaluate } from "./evaluate-BgFLlqrs.mjs";
 import { a as writeJsonFile, i as readJsonFile, r as hashText, t as atomicWrite } from "./json-io-DisYd2fb.mjs";
 import { r as isDocConsulted } from "./doc-helpers-CWZegVdR.mjs";
 import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DhItkBzk.mjs";
@@ -13,8 +13,9 @@ import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as se
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { a as writeLastNonce, c as recordAgent, d as recordRefRead, f as recordTarget, h as apexAuthorizationGate, i as verifyTrack, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, r as signTrack, s as emptyTrack, t as loadTrack, u as recordDoc } from "./store-CQ4roWrU.mjs";
-import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-BxC9semG.mjs";
-import { r as toHermesResponse } from "./hermes-DWXCRFZU.mjs";
+import { t as parseApplyPatch } from "./apply-patch-CIS2EZ_q.mjs";
+import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-BLuab-tR.mjs";
+import { r as toHermesResponse } from "./hermes-CyhCYqD7.mjs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -86,15 +87,31 @@ function normalizeEvent(id, payload) {
 	}
 	const event = str(payload.hook_event_name) ?? "";
 	const input = payload.tool_input ?? payload;
-	return {
+	const tool = str(payload.tool_name) ?? "";
+	const base = {
 		phase: /post|after/i.test(event) ? "post" : "pre",
-		tool: str(payload.tool_name) ?? "",
+		tool,
 		input,
 		sessionId: str(payload.session_id) ?? str(payload.conversation_id) ?? "",
+		agentType: str(payload.agent_type) ?? str(input.subagent_type)
+	};
+	if (tool === "apply_patch") {
+		const files = parseApplyPatch(str(input.command) ?? str(payload.command) ?? "").map((f) => ({
+			filePath: f.path,
+			content: f.content,
+			op: f.op
+		}));
+		return {
+			...base,
+			phase: "pre",
+			files: files.length > 0 ? files : void 0
+		};
+	}
+	return {
+		...base,
 		filePath: str(input.file_path) ?? str(input.path) ?? str(payload.file_path),
 		content: str(input.content) ?? str(input.new_string),
-		command: str(input.command) ?? str(payload.command),
-		agentType: str(payload.agent_type) ?? str(input.subagent_type)
+		command: str(input.command) ?? str(payload.command)
 	};
 }
 //#endregion
@@ -329,6 +346,95 @@ function designLifecycle(payload, cacheDir, cwd, stamp, now) {
 	}
 	return false;
 }
+//#endregion
+//#region src/runtime/inject-dedup-exclusive.ts
+/**
+* @module inject-dedup-exclusive
+* Cross-process-exact-once cooldown gate, via EXCLUSIVE file creation.
+*
+* {@link module:inject-dedup.oncePerWindow}'s shared-JSON read-modify-write is
+* best-effort under true concurrency: the ~11-process plugin hook fan-out for
+* one Claude event can lose an update and let 2-3 siblings all observe "not
+* seen yet" (lesson 2026-07-05 16:00 — the `saveTrack` lost-update race, same
+* shape). `writeFileSync(path, data, { flag: "wx" })` sidesteps this: the OS
+* guarantees exclusive creation is atomic, so of N concurrent siblings calling
+* this for the SAME key, exactly one observes success and the rest get
+* `EEXIST` — never a double-win, with no lock file or retry loop needed.
+*
+* One marker file per key (not a shared map) is the tradeoff for that
+* guarantee. A bounded sweep on every call deletes markers older than
+* `windowMs` so the directory never grows unbounded under many distinct keys.
+*
+* Reserve this for HIGH-CONCURRENCY callers on a short burst window (same
+* tool-use/lifecycle event fanned out to every installed plugin) — e.g. the
+* sniper reminder ({@link module:lifecycle/track-changes}) and compliance
+* notices ({@link module:notices}). Low-frequency, long-window callers (e.g.
+* the 30-min lessons Stop-reminder cooldown) are fine on the JSON mode: a
+* single real Stop event per session is not concurrent with itself the way
+* one PostToolUse's ~11 sibling hooks are within the same 2s burst.
+* @packageDocumentation
+*/
+/** Subdirectory (under the state dir) holding one marker file per dedup key. */
+const EXCLUSIVE_SUBDIR = "inject-dedup-locks";
+/**
+* Filesystem-safe, collision-resistant basename for `key`. Full MD5 hex
+* (unlike {@link module:util/json-io.hashText}'s 8-char truncation) — a
+* collision here would silently merge two unrelated keys' exclusivity.
+*/
+function lockFileName(key) {
+	return `${createHash("md5").update(key).digest("hex")}.lock`;
+}
+/**
+* Delete marker files older than `windowMs` in `dir` — O(n) per call, bounds
+* directory growth. Compares against the creation timestamp STORED IN the
+* marker's content (written by {@link onceExclusive} below), not the file's
+* fs `mtime`: callers may pass a fake logical `now` (tests), which would never
+* agree with the real OS clock backing `mtime`.
+*/
+function sweepExclusiveDir(dir, now, windowMs) {
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const path = join(dir, entry);
+		try {
+			const createdAt = Number(readFileSync(path, "utf8"));
+			if (!Number.isFinite(createdAt) || now - createdAt >= windowMs) unlinkSync(path);
+		} catch {}
+	}
+}
+/**
+* Cooldown gate via exclusive marker-file creation. Returns `true` exactly
+* once per `key` within `windowMs` across ALL concurrent processes sharing
+* `opts.dir` (the caller MAY emit), `false` for every other concurrent or
+* subsequent call inside the same window (the caller SHOULD suppress).
+*
+* Fails open on any unwritable state dir or unexpected fs error: the emission
+* is allowed rather than silently dropped.
+* @param key - Stable identity of the block (same semantics as {@link module:inject-dedup.oncePerWindow}).
+* @param windowMs - Suppression window in ms (also the sweep threshold).
+* @param opts - Optional clock + state-dir overrides (for tests).
+* @returns `true` to proceed/emit, `false` to suppress.
+*/
+function onceExclusive(key, windowMs, opts = {}) {
+	const now = opts.now ?? Date.now();
+	const dir = join(opts.dir ?? defaultStateDir(), EXCLUSIVE_SUBDIR);
+	try {
+		mkdirSync(dir, { recursive: true });
+	} catch {
+		return true;
+	}
+	sweepExclusiveDir(dir, now, windowMs);
+	try {
+		writeFileSync(join(dir, lockFileName(key)), String(now), { flag: "wx" });
+		return true;
+	} catch (err) {
+		return err.code !== "EEXIST";
+	}
+}
 /** Sidecar basename under the per-project state dir. */
 const SIDECAR$2 = "inject-dedup.json";
 /** Load the `{ key -> epochMs }` map, or `{}` when missing/corrupt. */
@@ -373,6 +479,24 @@ function oncePerWindow(key, windowMs, opts = {}) {
 	return true;
 }
 //#endregion
+//#region src/runtime/fragment-registry.ts
+let registry = [];
+/** Clear the registry. Call once before dispatching a hook event. */
+function resetFragmentRegistry() {
+	registry = [];
+}
+/** Record one fragment's post-cap size. Called by {@link module:inject-budget.capFragment}. */
+function recordFragment(label, chars) {
+	registry.push({
+		label,
+		chars
+	});
+}
+/** Snapshot of every fragment recorded since the last {@link resetFragmentRegistry}. */
+function fragmentRegistry() {
+	return [...registry];
+}
+//#endregion
 //#region src/runtime/inject-budget.ts
 /**
 * @module inject-budget
@@ -411,7 +535,10 @@ const FRAGMENT_CHAR_CAP = 8e3;
 * @returns `text` unchanged, or a truncated copy ending in the cut notice — always ≤ the cap.
 */
 function capFragment(label, text) {
-	if (text.length <= 8e3) return text;
+	if (text.length <= 8e3) {
+		recordFragment(label, text.length);
+		return text;
+	}
 	const totalLen = text.length;
 	const safeLabel = label.length <= 80 ? label : `${label.slice(0, 77)}...`;
 	const suffixFor = (keptLen) => `\n[truncated ${safeLabel}: kept ${keptLen} of ${totalLen} chars — source file unchanged]`;
@@ -420,7 +547,9 @@ function capFragment(label, text) {
 	const slice = text.slice(0, budget);
 	const lastNl = slice.lastIndexOf("\n");
 	const kept = (lastNl > 0 ? slice.slice(0, lastNl) : slice).trimEnd();
-	return kept + suffixFor(kept.length);
+	const result = kept + suffixFor(kept.length);
+	recordFragment(label, result.length);
+	return result;
 }
 /**
 * One-line numeric recap of what a batch of fragments actually injected —
@@ -1244,9 +1373,13 @@ function trackAgentMemory(data, home = homedir(), now = Date.now()) {
 					cumulativeCodeFiles: 0
 				}
 			}, home);
-			const windowMs = resolveTtlSec(process.env) * 1e3 * 5;
-			const note = freshReceiptFromFile(trackFile(sessionId, defaultStateDir(process.cwd())), windowMs, now) === null ? " NO VERIFICATION RECEIPT — run tsc + tests before reporting done." : "";
-			return contextResponse("SubagentStop", `SNIPER VALIDATION REQUIRED: Agent '${agentType}' modified ${owned.length} code file(s): ${owned.join(", ")}. Run sniper agent now.${note}`);
+			const hookCwd = typeof data.cwd === "string" ? data.cwd : process.cwd();
+			const present = owned.filter((f) => existsSync(resolve(hookCwd, f)));
+			if (present.length > 0) {
+				const windowMs = resolveTtlSec(process.env) * 1e3 * 5;
+				const note = freshReceiptFromFile(trackFile(sessionId, defaultStateDir(process.cwd())), windowMs, now) === null ? " NO VERIFICATION RECEIPT — run tsc + tests before reporting done." : "";
+				return contextResponse("SubagentStop", `SNIPER VALIDATION REQUIRED: Agent '${agentType}' modified ${present.length} code file(s): ${present.join(", ")}. Run sniper agent now.${note}`);
+			}
 		}
 	}
 	return JSON.stringify({ message: `Agent ${agentType} completed (no code changes)` });
@@ -1389,13 +1522,24 @@ const BURST_DEDUP_MS = 2e3;
 * nothing surfaced skill credits, freshness, or the sniper reminder to the human.
 *
 * The text builders are pure. `refCreditNoticeFor` is the one exception — like
-* `pre-allow.ts`/`track-changes.ts` already do, it calls the existing
-* {@link oncePerWindow} file-backed cooldown gate directly, so a caller can drop
-* it straight into a PostToolUse loop without re-deriving the dedup. Rendering
-* onto a harness's native stdout always goes through the existing adapter
-* helpers (`respond`/`attachSystemMessage`); a harness with no `systemMessage`
-* channel (e.g. cline) silently drops the notice there (documented no-op, never
-* a crash) — nothing in this module renders directly.
+* `pre-allow.ts` uses the JSON `oncePerWindow`, this one uses the exclusive
+* {@link onceExclusive} mode instead: it fires on the same short burst window
+* as `track-changes.ts`'s sniper reminder, fanned out across every installed
+* plugin's PostToolUse hook for ONE real edit, so the same lost-update race
+* applies (lesson 2026-07-05 16:00). Rendering onto a harness's native stdout
+* always goes through the existing adapter helpers (`respond`/
+* `attachSystemMessage`); a harness with no `systemMessage` channel (e.g.
+* cline) silently drops the notice there (documented no-op, never a crash) —
+* nothing in this module renders directly.
+*
+* CHANNEL CONTRACT — human-only, exactly once: the `userMessage`/`systemMessage`
+* these notices ride is a HUMAN channel by platform contract. It never reaches
+* the agent — `formatPrompt` (src/prompt/types.ts) excludes it — so the emitting
+* sub-agent does NOT see its own notice; only the human owner does, and exactly
+* ONCE even under the multi-plugin fan-out, because the emitter is gated by
+* {@link onceExclusive}. Verified live 2026-07-06: under the real ×11 fan-out a
+* single skill-ref Read surfaced one `✓ SOLID refs read` line in the owner's
+* terminal (not duplicated, and correctly invisible to the agent).
 */
 /** One compliance line: `✓ <gate> — <detail>` (detail omitted when empty). */
 function complianceNotice(gate, detail) {
@@ -1439,7 +1583,7 @@ function refCreditNoticeFor(activities, sessionId, now, dir) {
 		if (a.kind !== "ref" || !a.path) continue;
 		const notice = refCreditedNotice(a.path);
 		if (!notice) continue;
-		if (!oncePerWindow(`ref-credited:${sessionId}:${a.path}`, 2e3, {
+		if (!onceExclusive(`ref-credited:${sessionId}:${a.path}`, 2e3, {
 			now,
 			dir
 		})) continue;
@@ -1482,7 +1626,7 @@ function trackSessionChanges(sessionIdRaw, filePath, home = homedir(), now = Dat
 		lastCheck: new Date(now).toISOString().replace(/\.\d{3}Z$/, "Z")
 	};
 	saveSessionState(sid, state, home);
-	if (!oncePerWindow(`sniper:${sid}:${filePath}`, 2e3, {
+	if (!onceExclusive(`sniper:${sid}:${filePath}`, 2e3, {
 		now,
 		dir: sessionsDir(home)
 	})) return "";
@@ -6125,6 +6269,93 @@ function reconcileRefReadsFromTranscript(track, transcriptPath, now) {
 	return next;
 }
 //#endregion
+//#region src/freshness/ref-journal.ts
+/**
+* Append-only journal of `.md` reference reads — the FRESH, race-immune companion
+* to {@link reconcileRefReadsFromTranscript}.
+*
+* WHY a third source (track + transcript were not enough for teammates): the live
+* session track write is a non-atomic load→mutate→save, so under the multi-plugin
+* hook fan-out (one process per plugin, ×N) a lone `refsRead` write is clobbered
+* (lost update). The transcript reconcile recovers the LEAD's lost reads because,
+* by the time the lead edits, its Read has flushed to the platform transcript. But
+* the platform flushes that JSONL to disk with a MULTI-MINUTE lag (measured ~230s,
+* well past the 120s freshness TTL): a background TEAMMATE reads the exact listed
+* ref then edits within seconds — far faster than the flush — so the transcript on
+* disk does NOT yet contain the teammate's read, reconcile misses it, and (its live
+* track write having been lost to the fan-out) solidReadGate blocks despite a
+* genuine read. That is the "teammate solidRead" gap.
+*
+* This journal closes it: every credited `.md` read is appended (one JSON line) the
+* instant PostToolUse fires — O_APPEND is per-write atomic, so concurrent fan-out
+* processes each add their own line and none is lost, and there is no flush lag. The
+* gate folds it back BEFORE any refsRead consumer, alongside the transcript.
+*
+* ANTI-FORGERY: it lives in the out-of-tree state dir the protected-path guard
+* denies agents from writing (SAME boundary as the signed track); the only writer is
+* our PostToolUse on a real `.md` Read. COST: the gate reads it once per edit, bounded
+* by {@link appendRefRead}'s trim cap — cheaper than the multi-MB transcript parse.
+*/
+/** Journal filename inside the per-session state dir. */
+const JOURNAL = "refs-read.log";
+/**
+* Append a credited `.md` read to the state-dir journal (O_APPEND, atomic under
+* the fan-out). No-op for non-`.md` paths (parity with the reconcile filter).
+* Fully fail-open: a mkdir/append error is swallowed so recording never blocks the
+* PostToolUse path.
+* @param dir - Per-session state dir (`dirname(trackFile)`).
+* @param path - The read file's absolute path.
+* @param ts - The tool event's epoch-ms timestamp.
+*/
+function appendRefRead(dir, path, ts) {
+	if (!path.endsWith(".md")) return;
+	try {
+		mkdirSync(dir, { recursive: true });
+		const file = join(dir, JOURNAL);
+		appendFileSync(file, JSON.stringify({
+			p: path,
+			t: ts
+		}) + "\n", "utf-8");
+		trimLogFile(file, 128 * 1024, 1e3);
+	} catch {}
+}
+/**
+* Fold every `.md` read in the state-dir journal into `track` (immutably), each
+* stamped with its journalled timestamp and never rolling back a MORE-recent
+* existing stamp — identical merge semantics to
+* {@link reconcileRefReadsFromTranscript}, but from the fresh append-only journal
+* instead of the lagged transcript. Fail-open: an absent/unreadable journal returns
+* `track` unchanged (same reference).
+* @param track - The current (possibly race-damaged) session track.
+* @param dir - Per-session state dir (`dirname(trackFile)`).
+* @param now - Fallback epoch-ms for entries with an invalid timestamp.
+* @returns The track with journalled `.md` reads merged into `refsRead`/`refsReadAt`.
+*/
+function reconcileRefReadsFromJournal(track, dir, now) {
+	let text;
+	try {
+		text = readText(join(dir, JOURNAL));
+	} catch {
+		return track;
+	}
+	let next = track;
+	for (const line of text.split("\n")) {
+		if (!line.trim()) continue;
+		let entry;
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		const path = typeof entry.p === "string" ? entry.p : "";
+		if (!path.endsWith(".md")) continue;
+		const ts = typeof entry.t === "number" && Number.isFinite(entry.t) ? entry.t : now;
+		const prev = next.refsReadAt?.[path];
+		if (prev === void 0 || prev < ts) next = recordRefRead(next, path, ts);
+	}
+	return next;
+}
+//#endregion
 //#region src/policy/shadcn-skill-gate.ts
 /** File extensions the shadcn gate polices (source: `\.(tsx|jsx|css|scss|json)$`). */
 const SHADCN_FILE_RE = /\.(tsx|jsx|css|scss|json)$/;
@@ -6586,7 +6817,7 @@ async function runGates(input) {
 	if (modular) return modular;
 	if (!input.filePath) return null;
 	const filePath = input.filePath;
-	const track = reconcileRefReadsFromTranscript(await loadTrack(input.trackFile), input.transcriptPath, input.now);
+	const track = reconcileRefReadsFromJournal(reconcileRefReadsFromTranscript(await loadTrack(input.trackFile), input.transcriptPath, input.now), dirname(input.trackFile), input.now);
 	const solidOrSkill = frameworkSkillGate(input, track.refsRead, existingCodeLines);
 	if (solidOrSkill) return solidOrSkill;
 	if (isShadcnWrite(input.tool, filePath)) {
@@ -6729,6 +6960,7 @@ function mcpPostStore(tool, input, response, dir, now = Date.now()) {
 async function recordActivity(file, activity) {
 	const track = await loadTrack(file);
 	await saveTrack(file, activity.kind === "agent" ? recordAgent(track, activity.name, activity.ts, activity.quality) : activity.kind === "doc" ? recordDoc(track, activity.framework, activity.sessionId, activity.source, activity.ts) : recordRefRead(track, activity.path, activity.ts));
+	if (activity.kind === "ref") appendRefRead(dirname(file), activity.path, activity.ts ?? Date.now());
 }
 //#endregion
 //#region src/runtime/respond.ts
@@ -6769,6 +7001,7 @@ function respond(id, prompt) {
 		case "codex":
 			if (kind === "block") return denyResponse("PreToolUse", message);
 			if (kind === "inform") return userMessage ? informResponse("PreToolUse", userMessage, reason ? message : "") : contextResponse("PreToolUse", message);
+			if (id === "codex") return denyResponse("PreToolUse", `[downgraded from ask — Codex has no interactive approval]\n${message}`);
 			return JSON.stringify({ hookSpecificOutput: {
 				hookEventName: "PreToolUse",
 				permissionDecision: "ask",
@@ -7314,6 +7547,47 @@ async function allowOutcome(id, event, payload, mcpDir, cwd, evidence) {
 	};
 }
 //#endregion
+//#region src/runtime/apply-patch-gate.ts
+/**
+* OR the static per-file verdict for a Codex `apply_patch` envelope: run the
+* file-level gates (protected-path, SOLID file-size, DRY) that key off
+* `filePath`/`content` over EACH touched file and return the first blocking
+* {@link Prompt}. One violating hunk blocks the whole patch — the parity the
+* single-file `Write`/`Edit` path already has, extended to the multi-file
+* primitive.
+*
+* Only the read-only/pure gates run here (no session-state writes), so the
+* `~11×` hook fan-out stays idempotent — the stateful APEX freshness/skill
+* gates are tool-level and never policed `apply_patch` (its `filePath` was
+* always undefined), so they are intentionally out of scope.
+*
+* File-size tool mapping mirrors Claude: an `add` is judged like a `Write`
+* (full new content), an `update` like an `Edit` (partial content, compared
+* against the on-disk count so an already-oversized file still blocks).
+* @param files - Per-file changes from {@link NormalizedFile}.
+* @param cwd - Project root for the DRY codebase grep.
+* @returns The first blocking prompt, or null when every file passes.
+*/
+function applyPatchGate(files, cwd) {
+	for (const f of files) {
+		const tool = f.op === "add" ? "Write" : "Edit";
+		const protectedDeny = protectedPathGate(tool, f.filePath);
+		if (protectedDeny) return protectedDeny;
+		if (f.op === "delete") continue;
+		const { raw: existingLines } = existingLineCounts(f.filePath);
+		const quick = evaluate({
+			tool,
+			filePath: f.filePath,
+			content: f.content,
+			existingLines
+		});
+		if (quick.decision !== "allow" && quick.prompt) return quick.prompt;
+		const dry = dryGate(tool, f.filePath, f.content, cwd);
+		if (dry) return dry;
+	}
+	return null;
+}
+//#endregion
 //#region src/runtime/handle-pre.ts
 /**
 * Run the PreToolUse pipeline: MCP/WebFetch cache intercept, design gate, APEX
@@ -7357,6 +7631,13 @@ async function handlePre(ctx) {
 			exit: 0
 		};
 	}
+	if (event.files && event.files.length > 0) {
+		const patchPrompt = applyPatchGate(event.files, opts.cwd);
+		if (patchPrompt) return {
+			stdout: respond(id, patchPrompt),
+			exit: 0
+		};
+	}
 	const prompt = await gate({
 		sessionId: event.sessionId,
 		framework,
@@ -7670,6 +7951,51 @@ async function asyncScopeStdout(scope, event, payload, cwd, now) {
 	return null;
 }
 //#endregion
+//#region src/runtime/inject-budget-recap.ts
+/**
+* @module inject-budget-recap
+* ONE event-level recap of every {@link module:inject-budget.capFragment}
+* -tracked fragment injected for a SessionStart/SubagentStart event — the
+* aggregated view the per-fragment caps never gave: each injection point
+* (dev-context, snapshot sections, lessons, apex-subagent, ...) caps and
+* reports itself in ISOLATION, with no total across the whole event.
+*
+* Rides the user-visible `systemMessage` channel, Claude-Code-only (gate at
+* the call site — mirrors the existing `id === "claude-code"` pattern for
+* `designLifecycle` in handle.ts): other adapters do not all re-export
+* `attachSystemMessage`, and stamping a Claude-shaped envelope onto another
+* harness's stdout shape would be silently wrong there.
+*
+* Deduped via {@link module:inject-dedup.onceExclusive}, not the JSON
+* `oncePerWindow`: SessionStart/SubagentStart fan out across every installed
+* plugin exactly like PostToolUse does (see burst-window.ts) — a shared-JSON
+* read-modify-write here would risk the same lost-update race already fixed
+* for the sniper reminder (lesson 2026-07-05 16:00).
+* @packageDocumentation
+*/
+/**
+* Attach the aggregated recap onto `stdout` when 2+ fragments were recorded
+* for `rawEvent`. A lone fragment already carries its own visibility (its
+* producer's own per-fragment report, when it has one) — no recap is added
+* for that case, so the common single-fragment event stays noise-free.
+* @param stdout - The already-rendered hook stdout for this event.
+* @param rawEvent - The raw hook event name (only SessionStart/SubagentStart qualify; others pass through unchanged).
+* @param sessionId - Current session id (dedup scope).
+* @param cwd - Project root (state-dir scope for the dedup marker).
+* @param now - Clock.
+* @returns `stdout` with a `systemMessage` recap attached, or `stdout` unchanged.
+*/
+function attachBudgetRecap(stdout, rawEvent, sessionId, cwd, now) {
+	if (rawEvent !== "SessionStart" && rawEvent !== "SubagentStart") return stdout;
+	const fragments = fragmentRegistry();
+	if (fragments.length <= 1) return stdout;
+	if (!onceExclusive(`budget:${sessionId}:${rawEvent}`, 2e3, {
+		now,
+		dir: defaultStateDir(cwd)
+	})) return stdout;
+	return attachSystemMessage(stdout, budgetReport(fragments));
+}
+//#endregion
 //#region src/runtime/handle.ts
 /** Raw Claude hook event name from a payload (empty when absent). */
 function rawEventName(payload) {
@@ -7683,6 +8009,7 @@ function rawEventName(payload) {
 */
 async function handleHook(id, payload, opts) {
 	const event = normalizeEvent(id, payload);
+	resetFragmentRegistry();
 	const layout = projectLayout(opts.cwd);
 	const file = trackFile(event.sessionId, defaultStateDir(opts.cwd));
 	const mcpDir = layout.cacheDir;
@@ -7698,7 +8025,7 @@ async function handleHook(id, payload, opts) {
 	};
 	const life = lifecycleStdout(payload, opts.cwd, opts.scope ?? "core", opts.now);
 	if (life !== null) return {
-		stdout: life,
+		stdout: id === "claude-code" ? attachBudgetRecap(life, rawEventName(payload), event.sessionId, opts.cwd, opts.now) : life,
 		exit: 0
 	};
 	const userPrompt = typeof payload.prompt === "string" ? payload.prompt : void 0;

package/dist/{hermes-DWXCRFZU.mjs → hermes-CyhCYqD7.mjs}

@@ -1,6 +1,6 @@
-import { t as evaluate } from "./evaluate-CNAzgxnN.mjs";
+import { t as evaluate } from "./evaluate-BgFLlqrs.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
-import { c as readClaudeInput } from "./claude-BxC9semG.mjs";
+import { c as readClaudeInput } from "./claude-BLuab-tR.mjs";
 //#region src/adapters/hermes/index.ts
 /**
 * Hermes Agent adapter (hook-mode). Nous Research's hermes-agent (2026) pipes a

package/dist/index.mjs

@@ -6,7 +6,7 @@ import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFi
 import { n as detectMode, r as modeFor, t as detectHarness } from "./harness-Cb9xR8dC.mjs";
 import { A as detectCreationIntent, B as DEV_KEYWORDS, C as SKILL_TRIGGERS, D as MAX_EXA_RESULTS, F as docConsultedGate, H as detectProjectType, I as evaluateApex, L as freshnessGate, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, O as MAX_TOKENS, P as brainstormGate, R as solidReadGate, S as usesTailwindUtilities, U as isApexCommand, V as detectModularArchitecture, W as requiredArchSkill, a as firstHeading, b as detectRequiredSkills, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as detectClaudeMdProjectType, h as buildClaudeMdContext, i as firstComment, j as APEX_GATES, k as capVerbosity, l as PROJECT_INDICATORS, m as buildApexInstruction, n as missingSeoElements, o as parseEnrichment, p as DEV_VERBS, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, v as parseBodyDesc, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DCQ8dkdL.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "./home-state-D0RLWP8J.mjs";
-import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "./evaluate-CNAzgxnN.mjs";
+import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "./evaluate-BgFLlqrs.mjs";
 import { i as resolveSessions, n as formatDocSatisfactionStatus, r as isDocConsulted, t as formatDocDeny } from "./doc-helpers-CWZegVdR.mjs";
 import { i as parseFrontmatter, n as scoreReferences, r as globToRe, t as routeReferences } from "./router-PKVNBHge.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";

package/dist/policy/index.mjs

@@ -1,5 +1,5 @@
 import { A as detectCreationIntent, B as DEV_KEYWORDS, C as SKILL_TRIGGERS, D as MAX_EXA_RESULTS, F as docConsultedGate, H as detectProjectType, I as evaluateApex, L as freshnessGate, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, O as MAX_TOKENS, P as brainstormGate, R as solidReadGate, S as usesTailwindUtilities, U as isApexCommand, V as detectModularArchitecture, W as requiredArchSkill, a as firstHeading, b as detectRequiredSkills, c as EXCLUDE_DIRS, d as buildApexTaskInjection, f as loadApexTaskState, g as detectClaudeMdProjectType, h as buildClaudeMdContext, i as firstComment, j as APEX_GATES, k as capVerbosity, l as PROJECT_INDICATORS, m as buildApexInstruction, n as missingSeoElements, o as parseEnrichment, p as DEV_VERBS, r as descFromText, s as parseEntry, t as isHtmlLike, u as buildApexTaskContext, v as parseBodyDesc, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "../validate-DCQ8dkdL.mjs";
 import { d as countFrameworkCodeLines, f as countLines, l as PLUGINS_DIR, p as evaluateFileSize, u as SOLID_REF } from "../home-state-D0RLWP8J.mjs";
-import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "../evaluate-CNAzgxnN.mjs";
+import { A as PROJECT_INSTALL, C as PROTECTED_GIT_RE, D as securityGuard, E as CRITICAL_PATTERNS, M as SYSTEM_INSTALL, N as isRalphMode, O as GIT_ASK, P as matchPatterns, S as PROTECTED_FRAGMENTS, T as ASK_PATTERNS, _ as CODE_MUTATORS, a as registerGuard, b as SAFE_PREFIXES, c as GO_DECL_RE, d as PY_MODEL_RE, f as SWIFT_PROTO_RE, g as ASK_WRITERS, h as bashWriteGuard, i as clearUserGuards, j as RALPH_SAFE, k as GIT_BLOCKED, l as JAVA_DECL_RE, m as interfaceSeparationGuard, n as FAIL_CLOSED, o as runGuards, p as TS_DECL_RE, r as GUARDS, s as installGuard, t as evaluate, u as PHP_DECL_RE, v as CODE_REDIRECT, w as protectedPathGuard, x as SESSION_STATE_FRAGMENT, y as FILE_REDIRECT } from "../evaluate-BgFLlqrs.mjs";
 import "../policy-la_KkjCS.mjs";
 export { APEX_GATES, ASK_PATTERNS, ASK_WRITERS, CODE_MUTATORS, CODE_REDIRECT, CRITICAL_PATTERNS, DEV_KEYWORDS, DEV_VERBS, EXCLUDE_DIRS, FAIL_CLOSED, FILE_REDIRECT, GIT_ASK, GIT_BLOCKED, GO_DECL_RE, GUARDS, JAVA_DECL_RE, MAX_EXA_RESULTS, MAX_TOKENS, PHP_DECL_RE, PLUGINS_DIR, POST_AUTH_GATES, PRE_AUTH_GATES, PROJECT_INDICATORS, PROJECT_INSTALL, PROTECTED_FRAGMENTS, PROTECTED_GIT_RE, PY_MODEL_RE, RALPH_SAFE, SAFE_PREFIXES, SESSION_STATE_FRAGMENT, SKILL_TRIGGERS, SOLID_REF, SWIFT_PROTO_RE, SYSTEM_INSTALL, TS_DECL_RE, bashWriteGuard, brainstormGate, buildApexInstruction, buildApexTaskContext, buildApexTaskInjection, buildClaudeMdContext, capVerbosity, clearUserGuards, countFrameworkCodeLines, countLines, descFromText, detectClaudeMdProjectType, detectCreationIntent, detectFramework, detectModularArchitecture, detectProjectType, detectRequiredSkills, docConsultedGate, evaluate, evaluateApex, evaluateFileSize, firstComment, firstHeading, frameworkSolidGate, freshnessGate, installGuard, interfaceSeparationGuard, isApexCommand, isHtmlLike, isRalphMode, loadApexTaskState, matchPatterns, missingSeoElements, parseBodyDesc, parseEnrichment, parseEntry, parseField, protectedPathGuard, registerGuard, requiredArchSkill, runGuards, securityGuard, skillTriggerGate, solidReadGate, usesTailwindUtilities };

package/dist/{run-DZvP_9xB.mjs → run-B4b2_7Qm.mjs}

@@ -1,5 +1,5 @@
 import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
-import { t as evaluate } from "./evaluate-CNAzgxnN.mjs";
+import { t as evaluate } from "./evaluate-BgFLlqrs.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { execSync } from "node:child_process";
 //#region src/cli/run.ts

package/dist/runtime/index.d.mts

@@ -150,6 +150,12 @@ declare function dryGate(tool: string, filePath: string, content: string | undef
 declare function preCommitGate(tool: string, command: string | undefined, cwd: string | undefined): Prompt | null;
 //#endregion
 //#region src/runtime/normalize.d.ts
+/** One file fanned out of a multi-file edit primitive (Codex `apply_patch`). */
+interface NormalizedFile {
+  filePath: string;
+  content: string;
+  op: "add" | "update" | "delete";
+}
 /** A hook event normalized across harnesses. */
 interface NormalizedEvent {
   phase: "pre" | "post";
@@ -161,6 +167,13 @@ interface NormalizedEvent {
   command?: string;
   /** Subagent type, if the tool-use came from one (Explore/Plan are file-size-exempt). */
   agentType?: string;
+  /**
+  * Per-file changes when the tool is a multi-file edit primitive (Codex
+  * `apply_patch`). Present ONLY for `apply_patch`; the file gates OR each
+  * entry's verdict so one violating hunk blocks the whole envelope. Left
+  * undefined for every other tool/harness (single-file `filePath`/`content`).
+  */
+  files?: NormalizedFile[];
 }
 /**
 * Normalize a harness hook payload into a uniform event. Handles Cline's nested
@@ -830,4 +843,4 @@ interface PreContext {
 */
 declare function handlePre(ctx: PreContext): Promise<HandleOutcome>;
 //#endregion
-export { Activity, DEFAULT_WINDOW_MS, DuplicationVerdict, type GateInput, HandleOptions, HandleOutcome, LifecycleInput, MCP_TTL_MS, McpIntercept, NormalizedEvent, PluginScope, PreContext, REQUIRED_AGENTS, SolidProfile, TRIVIAL_BUDGET, ToolEvent, WEBFETCH_TTL_MS, activityFor, aipilotPostToolUse, cacheQueryOf, cartoSessionStart, checkFileSize, claudeHome, claudeMdKey, cleanupSession, countFiles, countLoc, defaultStateDir, detectDuplication, detectSolidProfile, devContext, dispatchAipilot, dispatchLessons, dispatchLifecycle, dispatchMemory, dryGate, extractSymbols, fuseHarnessHome, fusengineCache, gate, generateEcosystemMap, generateProjectMap, getFileDesc, gitContext, handleHook, handlePre, harnessStateDir, injectRules, isMcpTool, isProject, isoUtc, lessonsArchiveFileFor, lessonsFileFor, lessonsStateFileFor, lifecycleStdout, listChildren, loadEnriched, loadSecurityState, loadSessionState, logToolFailure, mcpPostStore, mcpPreIntercept, mergeLines, normalizeEvent, postEditContext, postEditTypescript, postTrackingSideEffects, preCommitGate, projectContext, projectHash, promptSubmitContext, pruneEmptyDirs, purgeTtlTree, queryOf, readRules, recordActivity, removeOldFiles, respond, runSessionStartCleanups, sanitizeSessionId, saveApexState, saveSecurityState, saveSessionState, securityAdvisory, securityStateDir, securityStatePath, seoPostToolUse, seoPostToolUseResponse, sessionStartCore, sessionStatePath, sessionsDir, solidDetectStart, subagentCacheContext, taskContext, todayUtc, trackAgentMemory, trackEnrichment, trackFile, trackMcpResearch, trackSessionChanges, trackSkillRead, trackWatchResearch, trimLogFile, validateRulesLoaded, validateSolidGate, validateTailwind, validateTeammateOutput, writePluginMap, writeTree };
+export { Activity, DEFAULT_WINDOW_MS, DuplicationVerdict, type GateInput, HandleOptions, HandleOutcome, LifecycleInput, MCP_TTL_MS, McpIntercept, NormalizedEvent, NormalizedFile, PluginScope, PreContext, REQUIRED_AGENTS, SolidProfile, TRIVIAL_BUDGET, ToolEvent, WEBFETCH_TTL_MS, activityFor, aipilotPostToolUse, cacheQueryOf, cartoSessionStart, checkFileSize, claudeHome, claudeMdKey, cleanupSession, countFiles, countLoc, defaultStateDir, detectDuplication, detectSolidProfile, devContext, dispatchAipilot, dispatchLessons, dispatchLifecycle, dispatchMemory, dryGate, extractSymbols, fuseHarnessHome, fusengineCache, gate, generateEcosystemMap, generateProjectMap, getFileDesc, gitContext, handleHook, handlePre, harnessStateDir, injectRules, isMcpTool, isProject, isoUtc, lessonsArchiveFileFor, lessonsFileFor, lessonsStateFileFor, lifecycleStdout, listChildren, loadEnriched, loadSecurityState, loadSessionState, logToolFailure, mcpPostStore, mcpPreIntercept, mergeLines, normalizeEvent, postEditContext, postEditTypescript, postTrackingSideEffects, preCommitGate, projectContext, projectHash, promptSubmitContext, pruneEmptyDirs, purgeTtlTree, queryOf, readRules, recordActivity, removeOldFiles, respond, runSessionStartCleanups, sanitizeSessionId, saveApexState, saveSecurityState, saveSessionState, securityAdvisory, securityStateDir, securityStatePath, seoPostToolUse, seoPostToolUseResponse, sessionStartCore, sessionStatePath, sessionsDir, solidDetectStart, subagentCacheContext, taskContext, todayUtc, trackAgentMemory, trackEnrichment, trackFile, trackMcpResearch, trackSessionChanges, trackSkillRead, trackWatchResearch, trimLogFile, validateRulesLoaded, validateSolidGate, validateTailwind, validateTeammateOutput, writePluginMap, writeTree };

package/dist/runtime/index.mjs

@@ -1,6 +1,6 @@
 import { r as projectLayout } from "../layout-C0jaaCQC.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, i as loadSessionState, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, s as sessionStatePath, t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { $ as postEditTypescript, A as trackSkillRead, At as trackFile, B as isProject, C as seoPostToolUse, Ct as gitContext, D as postTrackingSideEffects, Dt as taskContext, E as securityAdvisory, Et as promptSubmitContext, F as dispatchLessons, Ft as securityStateDir, G as getFileDesc, H as loadEnriched, I as cartoSessionStart, It as securityStatePath, K as listChildren, L as generateEcosystemMap, Lt as todayUtc, M as dispatchLifecycle, Mt as isoUtc, N as aipilotPostToolUse, Nt as loadSecurityState, O as trackWatchResearch, Ot as defaultStateDir, P as dispatchAipilot, Pt as saveSecurityState, Q as lessonsStateFileFor, R as writePluginMap, S as postEditContext, St as devContext, T as dispatchMemory, Tt as claudeMdKey, U as mergeLines, V as writeTree, W as countFiles, X as lessonsArchiveFileFor, Z as lessonsFileFor, _ as preCommitGate, _t as sessionStartCore, a as recordActivity, at as validateTeammateOutput, b as extractSymbols, bt as removeOldFiles, c as MCP_TTL_MS, ct as validateTailwind, d as isMcpTool, dt as countLoc, et as trackSessionChanges, f as queryOf, ft as detectSolidProfile, g as gate, gt as runSessionStartCleanups, h as TRIVIAL_BUDGET, ht as readRules, i as respond, it as logToolFailure, j as trackEnrichment, jt as normalizeEvent, k as trackMcpResearch, kt as projectHash, l as WEBFETCH_TTL_MS, lt as validateSolidGate, m as REQUIRED_AGENTS, mt as injectRules, n as activityFor, nt as cleanupSession, o as mcpPostStore, ot as trackAgentMemory, p as DEFAULT_WINDOW_MS, pt as solidDetectStart, r as handlePre, rt as saveApexState, s as mcpPreIntercept, st as subagentCacheContext, t as handleHook, tt as validateRulesLoaded, u as cacheQueryOf, ut as checkFileSize, v as detectDuplication, vt as pruneEmptyDirs, w as seoPostToolUseResponse, wt as projectContext, x as lifecycleStdout, xt as trimLogFile, y as dryGate, yt as purgeTtlTree, z as generateProjectMap } from "../handle-DY79I4a8.mjs";
+import { $ as postEditTypescript, A as trackSkillRead, At as trackFile, B as isProject, C as seoPostToolUse, Ct as gitContext, D as postTrackingSideEffects, Dt as taskContext, E as securityAdvisory, Et as promptSubmitContext, F as dispatchLessons, Ft as securityStateDir, G as getFileDesc, H as loadEnriched, I as cartoSessionStart, It as securityStatePath, K as listChildren, L as generateEcosystemMap, Lt as todayUtc, M as dispatchLifecycle, Mt as isoUtc, N as aipilotPostToolUse, Nt as loadSecurityState, O as trackWatchResearch, Ot as defaultStateDir, P as dispatchAipilot, Pt as saveSecurityState, Q as lessonsStateFileFor, R as writePluginMap, S as postEditContext, St as devContext, T as dispatchMemory, Tt as claudeMdKey, U as mergeLines, V as writeTree, W as countFiles, X as lessonsArchiveFileFor, Z as lessonsFileFor, _ as preCommitGate, _t as sessionStartCore, a as recordActivity, at as validateTeammateOutput, b as extractSymbols, bt as removeOldFiles, c as MCP_TTL_MS, ct as validateTailwind, d as isMcpTool, dt as countLoc, et as trackSessionChanges, f as queryOf, ft as detectSolidProfile, g as gate, gt as runSessionStartCleanups, h as TRIVIAL_BUDGET, ht as readRules, i as respond, it as logToolFailure, j as trackEnrichment, jt as normalizeEvent, k as trackMcpResearch, kt as projectHash, l as WEBFETCH_TTL_MS, lt as validateSolidGate, m as REQUIRED_AGENTS, mt as injectRules, n as activityFor, nt as cleanupSession, o as mcpPostStore, ot as trackAgentMemory, p as DEFAULT_WINDOW_MS, pt as solidDetectStart, r as handlePre, rt as saveApexState, s as mcpPreIntercept, st as subagentCacheContext, t as handleHook, tt as validateRulesLoaded, u as cacheQueryOf, ut as checkFileSize, v as detectDuplication, vt as pruneEmptyDirs, w as seoPostToolUseResponse, wt as projectContext, x as lifecycleStdout, xt as trimLogFile, y as dryGate, yt as purgeTtlTree, z as generateProjectMap } from "../handle-B6yL03we.mjs";
 //#region src/runtime/storage.ts
 /**
 * The project's single state dir (`<root>/.harness`) — neutral + harness-agnostic,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",