@fusengine/harness 0.1.79 → 0.1.81

package/README.md

@@ -130,6 +130,7 @@ also works elsewhere.
 | **gemini-cli** | `BeforeTool` denies via `{decision:"deny",reason}` (`gemini/index.ts:22-36`) | none | Thin stateless adapter — no session track, no APEX gates wired through it. |
 | **cline** | `PreToolUse` only; block → `{cancel:true}`, non-block → `contextModification` (`cline/index.ts:24-36`) | none | Same as gemini-cli: stateless guard only. |
 | **hermes** | `pre_tool_call` proven: reuses the Claude stdin reader, blocks via `{decision:"block",reason}` (`hermes/index.ts:12-36`) | untested — no lifecycle dispatch wired for Hermes in this repo | `ask`/`inform` degrade to non-blocking `{context}` — Hermes "has no interactive ask state" (`hermes/index.ts:27-28`). |
+| **kimi** | `PreToolUse` denies via the camelCase JSON channel `{"hookSpecificOutput":{"permissionDecision":"deny","permissionDecisionReason":"…"}}` on stdout at **exit 0** (verified live against kimi-code v0.27.0 — exit 2 with stderr = reason also blocks, but is not required) — only `deny` is documented. `ask` is **downgraded to deny** prefixed `[downgraded from ask — Kimi Code has no interactive approval]`; `inform` rides plain stdout text at exit 0, never wrapped in JSON. Blocking events: `UserPromptSubmit`, `PreToolUse`, `Stop` (`kimi/index.ts`). | Observation only: `PostToolUse`, `PostToolUseFailure`, `PermissionRequest`, `PermissionResult`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `StopFailure`, `Interrupt`, `PreCompact`, `PostCompact`, `Notification` — Kimi delivers them but **ignores any response**, so no verdict can be returned from them. | A **hook** cannot request approval — Kimi's `ask` lives in a parallel, hook-unreachable system (`[[permission.rules]] decision = "ask"` in `config.toml`), hence the ask→deny downgrade. Hooks are configured **only** in the global `~/.kimi-code/config.toml` (no project-local hooks file), so `harness init` writes no kimi wiring — copy the TOML snippet from [docs/adapters.md](docs/adapters.md#kimi-code--manual-wiring), and emit **no field** beyond `event`/`matcher`/`command`/`timeout` or the whole config fails to load. **Fail-open by design**: any exit code other than 0/2, a timeout, or a crash lets the call through. Stdin payload is snake_case and carries only `hook_event_name`, `session_id`, `cwd`, `tool_name`, `tool_input.command` and an undocumented `tool_call_id` (unused here) — no `transcript_path`, no `permission_mode`, no `tool_response`. Verified live against kimi-code v0.27.0 for `PreToolUse`/`Bash`; validate hand-written config with `kimi doctor`. Instructions file is `AGENTS.md`, not `CLAUDE.md`. |
 
 ## What it enforces
 
@@ -191,6 +192,14 @@ Features shipped since 0.1.44, each with its own test:
   version + drift vs. npm, `.claude/BOARD.md`, and the one-shot summary, each
   collector isolated so one failure can't blank the rest
   (`src/runtime/lifecycle/snapshot/index.ts`, `test/snapshot.test.ts`).
+- **Target-aware root-doc injection** — `SessionStart` and `UserPromptSubmit`
+  inject the target's own root instructions doc, not a hardcoded `CLAUDE.md`:
+  `apexDocName(id)` + `harnessHomeSegment(id)` (`src/policy/apex-target.ts`)
+  resolve `AGENTS.md` under `.codex`/`.kimi-code` for Codex/Kimi, `CLAUDE.md`
+  under `.claude` for every other target (byte-identical to the pre-target-aware
+  default). The `systemMessage` label follows suit (`"AGENTS.md injected"`
+  under Codex/Kimi) (`src/runtime/lifecycle/session-start.ts`,
+  `src/runtime/inject-context.ts`).
 - **Injection budget cap** — harness-produced context fragments (lessons,
   snapshot, APEX task context) are capped at ~8000 chars each; owner-authored
   content (CLAUDE.md/rules) is never capped
@@ -202,7 +211,11 @@ Features shipped since 0.1.44, each with its own test:
   carrying `tool_input.agent_type` is recorded as `subagent-<agent_type>` in the
   same SessionTrack as Claude Task evidence, so a Codex explore-codebase/sniper
   satisfies the APEX freshness gates exactly like a Claude subagent
-  (`src/tracking/session-state.ts`, sim scenario 32b).
+  (`src/tracking/session-state.ts`, sim scenario 32b). Recognized
+  agent-launcher tools across targets: `Task` (Claude), `Agent`/`AgentSwarm`
+  (Kimi Code) — each credits its `subagent_type`/`agent_type` toward the same
+  freshness evidence (`src/runtime/activity.ts`,
+  `src/freshness/agent-evidence-record.ts`).
 - **File-size gate judges the real Edit outcome, not the on-disk count** — an
   Edit on a file already over `FUSE_SOLID_MAX_LINES` used to be denied
   unconditionally (the on-disk count always won); the gate now computes the

package/dist/adapters/claude/index.d.mts

@@ -1,2 +1,2 @@
-import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-DGxNjXW7.mjs";
+import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-D4C2-IIc.mjs";
 export { ClaudeHookInput, attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-51RSspJ1.mjs";
+import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-D93HY8dq.mjs";
 export { attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-ClfbCDiY.mjs";
+import { t as evaluate } from "../../evaluate-B4-MhOy_.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.d.mts

@@ -1,19 +1,18 @@
-import { t as Prompt } from "../../types-DVbIl9md.mjs";
-import { a as denyResponse, c as informResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-DGxNjXW7.mjs";
-
+import { t as Prompt } from "../../types-C0-igRKr.mjs";
+import { a as denyResponse, c as informResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-D4C2-IIc.mjs";
 //#region src/adapters/codex/index.d.ts
 /**
-* Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny.
-* NOTE: the REAL wired route is `harness hook codex` → handleHook → respond.ts
-* (source of truth for the ask→deny downgrade); this thin export exists for
-* direct package consumers and is kept aligned so it never silently diverges.
-*/
+ * Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny.
+ * NOTE: the REAL wired route is `harness hook codex` → handleHook → respond.ts
+ * (source of truth for the ask→deny downgrade); this thin export exists for
+ * direct package consumers and is kept aligned so it never silently diverges.
+ */
 declare function toCodexResponse(prompt: Prompt): string;
 /**
-* Run the bundled policy over a Codex payload and return the native response
-* string (deny/additionalContext), or null to allow. `apply_patch` is fanned
-* into per-file checks; every other tool routes through the portable policy.
-*/
+ * Run the bundled policy over a Codex payload and return the native response
+ * string (deny/additionalContext), or null to allow. `apply_patch` is fanned
+ * into per-file checks; every other tool routes through the portable policy.
+ */
 declare function guard(input: ClaudeHookInput): string | null;
 //#endregion
 export { type ClaudeHookInput as CodexHookInput, contextResponse, denyResponse, guard, informResponse, readClaudeInput as readCodexInput, toCodexResponse };

package/dist/adapters/codex/index.mjs

@@ -1,8 +1,8 @@
-import { t as evaluate } from "../../evaluate-ClfbCDiY.mjs";
-import { f as countLines } from "../../home-state-BXf38Zi1.mjs";
+import { t as evaluate } from "../../evaluate-B4-MhOy_.mjs";
+import { f as countLines } from "../../home-state-oUGFB4ds.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 import { n as parseApplyPatch, t as isBypassPermissions } from "../../permission-mode-BN3MNgbm.mjs";
-import { c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse, v as commandToString } from "../../claude-51RSspJ1.mjs";
+import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse } from "../../claude-D93HY8dq.mjs";
 //#region src/adapters/codex/index.ts
 /**
 * OpenAI Codex CLI adapter (hook-mode). Codex's `PreToolUse` hook (since 2026)

package/dist/adapters/cursor/index.d.mts

@@ -15,24 +15,24 @@ interface CursorEditPayload {
   }[];
 }
 /**
-* `afterFileEdit` stdout response. Its schema (cursor.com/docs/hooks#afterFileEdit)
-* is DELIBERATELY narrower than the "before" hooks: `permission` + `user_message`
-* only — there is NO `agent_message` and NO `updated_input`. Since the edit is
-* already on disk when this "after" hook fires, `deny` cannot revert it and the
-* correction reaches only the HUMAN (`user_message`), never the model — so this
-* path is strictly ADVISORY, not an enforceable gate.
-*/
+ * `afterFileEdit` stdout response. Its schema (cursor.com/docs/hooks#afterFileEdit)
+ * is DELIBERATELY narrower than the "before" hooks: `permission` + `user_message`
+ * only — there is NO `agent_message` and NO `updated_input`. Since the edit is
+ * already on disk when this "after" hook fires, `deny` cannot revert it and the
+ * correction reaches only the HUMAN (`user_message`), never the model — so this
+ * path is strictly ADVISORY, not an enforceable gate.
+ */
 interface CursorEditResponse {
   permission: "allow" | "deny";
   /** User-visible correction — snake_case (#141516); the only channel afterFileEdit exposes. */
   user_message?: string;
 }
 /**
-* `beforeShellExecution` stdout response. Message keys are snake_case:
-* Cursor silently ignores camelCase `userMessage`/`agentMessage` (#141516,
-* regression persists through v2.0.77+ — forum #142589), matching the
-* schema respond.ts emits for the cursor harness.
-*/
+ * `beforeShellExecution` stdout response. Message keys are snake_case:
+ * Cursor silently ignores camelCase `userMessage`/`agentMessage` (#141516,
+ * regression persists through v2.0.77+ — forum #142589), matching the
+ * schema respond.ts emits for the cursor harness.
+ */
 interface CursorResponse {
   permission: "allow" | "deny" | "ask";
   continue?: boolean;
@@ -46,23 +46,23 @@ interface CursorResponse {
 /** Guard a shell command (git/install policies). */
 declare function beforeShellExecution(payload: CursorShellPayload): CursorResponse;
 /**
-* Advise on a file edit AFTER Cursor has written it — a HUMAN-VISIBLE audit note,
-* never a gate. This is an "after" hook: the edit is already on disk. On a
-* SOLID/DRY violation we surface the correction through `user_message` (the only
-* channel afterFileEdit exposes — no `agent_message`, so the model is never
-* re-informed) while ALWAYS returning `permission: "allow"`.
-*
-* We deliberately never emit `permission: "deny"` here, for two distinct reasons:
-* (1) structural — afterFileEdit was "informational only" at launch (Chacon,
-* Cursor hooks beta 1.7, 2025-09: no channel to stop the agent), and a post-write
-* deny has no documented rollback; (2) empirical — Cursor staff confirm the
-* deny-enforcement path is broken for file operations (forum.cursor.com/t/154377,
-* v2.6.18, 2026-03, open) — proven for file READS, plausibly the same for writes.
-* So a `deny` would be a false blocking signal; `allow` + `user_message` is the
-* only proven-safe shape.
-* @param payload - The `afterFileEdit` stdin payload.
-* @returns Always an allow; carries the user-visible correction on a violation.
-*/
+ * Advise on a file edit AFTER Cursor has written it — a HUMAN-VISIBLE audit note,
+ * never a gate. This is an "after" hook: the edit is already on disk. On a
+ * SOLID/DRY violation we surface the correction through `user_message` (the only
+ * channel afterFileEdit exposes — no `agent_message`, so the model is never
+ * re-informed) while ALWAYS returning `permission: "allow"`.
+ *
+ * We deliberately never emit `permission: "deny"` here, for two distinct reasons:
+ * (1) structural — afterFileEdit was "informational only" at launch (Chacon,
+ * Cursor hooks beta 1.7, 2025-09: no channel to stop the agent), and a post-write
+ * deny has no documented rollback; (2) empirical — Cursor staff confirm the
+ * deny-enforcement path is broken for file operations (forum.cursor.com/t/154377,
+ * v2.6.18, 2026-03, open) — proven for file READS, plausibly the same for writes.
+ * So a `deny` would be a false blocking signal; `allow` + `user_message` is the
+ * only proven-safe shape.
+ * @param payload - The `afterFileEdit` stdin payload.
+ * @returns Always an allow; carries the user-visible correction on a violation.
+ */
 declare function afterFileEdit(payload: CursorEditPayload): CursorEditResponse;
 //#endregion
 export { type CursorEditPayload, type CursorEditResponse, type CursorResponse, type CursorShellPayload, afterFileEdit, beforeShellExecution };

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-ClfbCDiY.mjs";
+import { t as evaluate } from "../../evaluate-B4-MhOy_.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-ClfbCDiY.mjs";
+import { t as evaluate } from "../../evaluate-B4-MhOy_.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/adapters/hermes/index.d.mts

@@ -1,12 +1,11 @@
-import { t as Prompt } from "../../types-DVbIl9md.mjs";
-
+import { t as Prompt } from "../../types-C0-igRKr.mjs";
 //#region src/adapters/hermes/interfaces/types.d.ts
 /**
-* Hermes Agent (NousResearch/hermes-agent) shell-hook wire types. Verified 2026
-* against hermes-agent.nousresearch.com/docs/user-guide/features/hooks: hooks
-* are configured in `~/.hermes/config.yaml` under `hooks:`, receive a JSON
-* payload on stdin, and answer with JSON on stdout.
-*/
+ * Hermes Agent (NousResearch/hermes-agent) shell-hook wire types. Verified 2026
+ * against hermes-agent.nousresearch.com/docs/user-guide/features/hooks: hooks
+ * are configured in `~/.hermes/config.yaml` under `hooks:`, receive a JSON
+ * payload on stdin, and answer with JSON on stdout.
+ */
 /** `pre_tool_call` stdin payload (subset). Same wire shape as Claude Code. */
 interface HermesHookInput {
   hook_event_name?: string;
@@ -21,10 +20,10 @@ interface HermesHookInput {
   cwd?: string;
 }
 /**
-* Hook stdout response. `{}` allows; `{ decision: "block", reason }` cancels
-* the tool call; `{ context }` injects LLM context (honored on `pre_llm_call`).
-* Hermes has NO Claude-style `permissionDecision` and no interactive "ask".
-*/
+ * Hook stdout response. `{}` allows; `{ decision: "block", reason }` cancels
+ * the tool call; `{ context }` injects LLM context (honored on `pre_llm_call`).
+ * Hermes has NO Claude-style `permissionDecision` and no interactive "ask".
+ */
 interface HermesResponse {
   decision?: "block";
   reason?: string;
@@ -35,20 +34,20 @@ interface HermesResponse {
 /** Read & parse the Hermes hook stdin payload (same wire shape as Claude). */
 declare function readHermesInput(): Promise<HermesHookInput>;
 /**
-* Render a portable {@link Prompt} as a Hermes hook response string:
-* `block` -> `{decision:"block",reason}`; `ask`/`inform` -> non-blocking
-* `{context}` — Hermes has no interactive "ask" state, so both degrade to
-* context injection, mirroring the gemini-cli/cline routing in `respond()`.
-* @param prompt - The portable policy prompt.
-* @returns The native Hermes JSON response string.
-*/
+ * Render a portable {@link Prompt} as a Hermes hook response string:
+ * `block` -> `{decision:"block",reason}`; `ask`/`inform` -> non-blocking
+ * `{context}` — Hermes has no interactive "ask" state, so both degrade to
+ * context injection, mirroring the gemini-cli/cline routing in `respond()`.
+ * @param prompt - The portable policy prompt.
+ * @returns The native Hermes JSON response string.
+ */
 declare function toHermesResponse(prompt: Prompt): string;
 /**
-* Run the bundled policy over a Hermes `pre_tool_call` payload and return the
-* native response string, or null to allow (the hook then prints `{}`).
-* @param input - Parsed `pre_tool_call` stdin payload.
-* @returns Native response JSON, or null when the tool use is allowed.
-*/
+ * Run the bundled policy over a Hermes `pre_tool_call` payload and return the
+ * native response string, or null to allow (the hook then prints `{}`).
+ * @param input - Parsed `pre_tool_call` stdin payload.
+ * @returns Native response JSON, or null when the tool use is allowed.
+ */
 declare function guard(input: HermesHookInput): string | null;
 //#endregion
 export { type HermesHookInput, type HermesResponse, guard, readHermesInput, toHermesResponse };

package/dist/adapters/hermes/index.mjs

@@ -1,2 +1,2 @@
-import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-rTmVdhUL.mjs";
+import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-1PUEoY8q.mjs";
 export { guard, readHermesInput, toHermesResponse };

package/dist/adapters/kimi/index.d.mts

@@ -0,0 +1,87 @@
+import { t as Prompt } from "../../types-C0-igRKr.mjs";
+//#region src/adapters/kimi/interfaces/types.d.ts
+/**
+ * Kimi Code CLI shell-hook wire types. Verified 2026 against
+ * kimi.com/code/docs/en/kimi-code-cli/customization/hooks.html (v0.27.0):
+ * hooks are configured in `~/.kimi-code/config.toml` under `[[hooks]]`,
+ * receive a snake_case JSON payload on stdin, and answer with a camelCase
+ * JSON envelope on stdout (a real, documented casing inconsistency).
+ */
+/**
+ * `PreToolUse`/`UserPromptSubmit`/`Stop` stdin payload (subset). Same base
+ * wire shape as Claude Code (`hook_event_name`/`tool_name`/`tool_input`/
+ * `cwd`); `tool_input.command` is confirmed for `Bash` by the docs' example
+ * script (`payload.tool_input?.command`). Verified live against kimi-code
+ * v0.27.0 on `PreToolUse`/`Bash`: `tool_name` is present at top level (the
+ * docs never name it as a stdin key) and `tool_input.command` carries the
+ * shell string. The live payload also carries an UNDOCUMENTED `tool_call_id`
+ * (e.g. `"tool_LsTnl0gBxM62XuWvKw0GFGHs"`); the harness does not consume it,
+ * so it is deliberately absent from this interface. `cwd` is the
+ * symlink-resolved path (macOS: `/private/tmp/…` for a shell in `/tmp/…`).
+ */
+interface KimiHookInput {
+  hook_event_name?: string;
+  tool_name?: string;
+  /**
+   * Verified against the official tool reference (`docs/en/reference/tools.md`,
+   * moonshotai/kimi-code) AND live against kimi-code v0.27.0: `Write` sends
+   * `{ path, content, mode? }`, `Edit` sends
+   * `{ path, old_string, new_string, replace_all? }` — the path key is `path`,
+   * NOT Claude's `file_path`. `file_path` is kept as a tolerated alias (read
+   * second) for Claude-shaped replay payloads, mirroring
+   * `runtime/normalize.ts` which resolves both on the CLI path.
+   */
+  tool_input?: {
+    path?: string;
+    file_path?: string;
+    content?: string;
+    new_string?: string;
+    command?: string | string[];
+  };
+  session_id?: string;
+  cwd?: string;
+}
+/**
+ * Hook stdout response. Only `"deny"` is documented for `permissionDecision`
+ * — no `"ask"`/`"allow"` value, and no `additionalContext` field exists on
+ * this envelope. Blocking events are `UserPromptSubmit`, `PreToolUse`, and
+ * `Stop` only; every other event's return value is ignored.
+ */
+interface KimiResponse {
+  hookSpecificOutput?: {
+    permissionDecision?: "deny";
+    permissionDecisionReason?: string;
+  };
+}
+//#endregion
+//#region src/adapters/kimi/index.d.ts
+/** Read & parse the Kimi hook stdin payload (same wire shape as Claude for the fields we consume). */
+declare function readKimiInput(): Promise<KimiHookInput>;
+/**
+ * Render a portable {@link Prompt} as a Kimi hook response string:
+ * `block`/`ask` -> `{hookSpecificOutput:{permissionDecision:"deny",...}}`
+ * (only `"deny"` is documented; `ask` is downgraded with {@link ASK_PREFIX});
+ * `inform` -> raw text (Kimi appends stdout to context on exit 0 — no
+ * documented JSON envelope for non-blocking context injection).
+ * @param prompt - The portable policy prompt.
+ * @returns The native Kimi response string.
+ */
+declare function toKimiResponse(prompt: Prompt): string;
+/**
+ * Render a raw deny reason as a Kimi hook response — for callers that already
+ * hold a fully-formatted message (e.g. the MCP cache-hit notice) rather than a
+ * portable {@link Prompt}. Same envelope as {@link toKimiResponse}, minus the
+ * `[BLOCKED]` prompt framing and without `hookEventName` (undocumented upstream).
+ * @param reason - The fully-formatted deny message.
+ * @returns The native Kimi response string.
+ */
+declare function kimiDenyResponse(reason: string): string;
+/**
+ * Run the bundled policy over a Kimi hook payload and return the native
+ * response string, or null to allow (the hook then exits 0 with empty stdout).
+ * @param input - Parsed hook stdin payload.
+ * @returns Native response string, or null when the tool use is allowed.
+ */
+declare function guard(input: KimiHookInput): string | null;
+//#endregion
+export { type KimiHookInput, type KimiResponse, guard, kimiDenyResponse, readKimiInput, toKimiResponse };

package/dist/adapters/kimi/index.mjs

@@ -0,0 +1,2 @@
+import { i as toKimiResponse, n as kimiDenyResponse, r as readKimiInput, t as guard } from "../../kimi-ChbcU2uI.mjs";
+export { guard, kimiDenyResponse, readKimiInput, toKimiResponse };

package/dist/cache/index.d.mts

@@ -1,2 +1,2 @@
-import { _ as queryHash, a as cacheLookupSubstringMeta, c as mcpCacheKey, d as extractText, f as IndexSummary, g as jaccardSimilar, h as compactMarkdown, i as cacheLookupSubstring, l as mcpCacheWrite, m as summarizeIndex, n as cacheLookup, o as cachePath, p as loadIndex, r as cacheLookupMeta, s as cacheStore, t as CacheHit, u as webfetchCacheWrite } from "../index-BUwEmIK-.mjs";
+import { _ as queryHash, a as cacheLookupSubstringMeta, c as mcpCacheKey, d as extractText, f as IndexSummary, g as jaccardSimilar, h as compactMarkdown, i as cacheLookupSubstring, l as mcpCacheWrite, m as summarizeIndex, n as cacheLookup, o as cachePath, p as loadIndex, r as cacheLookupMeta, s as cacheStore, t as CacheHit, u as webfetchCacheWrite } from "../index-DhmV2MPh.mjs";
 export { CacheHit, IndexSummary, cacheLookup, cacheLookupMeta, cacheLookupSubstring, cacheLookupSubstringMeta, cachePath, cacheStore, compactMarkdown, extractText, jaccardSimilar, loadIndex, mcpCacheKey, mcpCacheWrite, queryHash, summarizeIndex, webfetchCacheWrite };

package/dist/{claude-51RSspJ1.mjs → claude-D93HY8dq.mjs}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-ClfbCDiY.mjs";
+import { t as evaluate } from "./evaluate-B4-MhOy_.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
@@ -216,4 +216,4 @@ function guard(input) {
 /** @deprecated use {@link guard}. Kept for back-compat. */
 const fileSizeGuard = guard;
 //#endregion
-export { writeText as _, fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, spawnCapture as g, sleep as h, denyResponse as i, systemMessage as l, readText as m, blockResponse as n, guard as o, readStdin as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u, commandToString as v };
+export { commandToString as _, fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, writeText as g, spawnCapture as h, denyResponse as i, systemMessage as l, sleep as m, blockResponse as n, guard as o, readText as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u };

package/dist/cli/bin.d.mts

@@ -1 +1 @@
-export { };
+export {}

package/dist/cli/bin.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { r as loadDotenv, s as resolveTtlSec } from "../dotenv-Jj8aL1FL.mjs";
-import { t as detectHarness } from "../harness-Cb9xR8dC.mjs";
-import { t as claudeHome } from "../home-state-BXf38Zi1.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-3tyTW9Ud.mjs";
-import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, t as handleHook, zt as todayUtc } from "../handle-Dthtlp7Z.mjs";
-import { p as readStdin$1 } from "../claude-51RSspJ1.mjs";
+import { o as resolveStdinMaxBytes } from "../limits-DG5pl-5s.mjs";
+import { r as loadDotenv, s as resolveTtlSec } from "../dotenv-DoqNlALG.mjs";
+import { t as detectHarness } from "../harness-BMuLJ9lm.mjs";
+import { t as claudeHome } from "../home-state-oUGFB4ds.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-D_WchZ3R.mjs";
+import { n as writeInitFile, t as initFor } from "../run-TAXNRSpD.mjs";
+import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, i as respond, t as handleHook, zt as todayUtc } from "../handle-J5r2f_O_.mjs";
 import { delimiter, join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 //#region src/changelog/fetch.ts
 /**
@@ -908,7 +908,9 @@ function renderPrefixRules(rules) {
 const HEADER = "# Codex execpolicy rules — generated from @fusengine/harness src/policy/guards/security.ts\n# DO NOT hand-edit: regenerate via `harness codex-rules`.\n#\n# security.ts is the source of truth for dangerous-command detection; every\n# CRITICAL_PATTERNS label maps to decision = \"forbidden\", every ASK_PATTERNS\n# label maps to decision = \"prompt\". Strictest decision wins across matches.\n# The harness remains the AUTHORITATIVE enforcement layer — this file is a\n# complementary defense layer on the Codex side, not a replacement.\n#\n# IRREDUCIBLE gaps (shell syntax, invisible to argv-prefix matching, no\n# prefix_rule can express them) — compensated by sandbox_mode +\n# approval_policy.granular.sandbox_approval, not by this file:\n#   - fork bomb: `:(){ :|:& };:`\n#   - redirect to a raw disk device: `> /dev/sda`\n#   - write to /etc via redirection: `> /etc/...`\n#\n# ASSUMED over-width (intentionally broader than security.ts, chosen to\n# avoid a silent gap rather than an exact-but-brittle translation):\n#   - dd: prompts on every dd invocation; security.ts only fires on of=/dev/*\n#   - rm: prompts even on paths security.ts exempts via a 'trash' substring\n#   - rm/eval/unlink: prompts even on a bare token with no trailing argument;\n#     security.ts requires a space (i.e. an argument) after the command\n#   - chmod 777: prompts on relative paths too, not only absolute ones\n#   - sudo (/usr/bin/sudo alias): forbids the absolute-path form too;\n#     security.ts's word-boundary regex does not match a preceding '/'\n#   - curl/wget: prompts on EVERY curl/wget invocation, not only when piped\n#     into a shell; security.ts's \"remote script piped to a shell\" label\n#     only fires on `curl|wget ... | sh`. A simple plain-word pipe IS split\n#     by Codex into separate argv commands (a bare-shell rule would also\n#     catch that case), but this rule additionally targets the download\n#     half for compound chains and non-shell payload execution where\n#     sh/bash never appears as argv[0] (curl -o x && chmod +x x && ./x,\n#     curl ... | python3); it replaces a former bare sh/bash/zsh heuristic\n#     that prompted on ~50% of Codex's own `bash -lc \"...\"` command\n#     wrapping and rarely caught the actual download\n#\n# NOT covered (out of scope, not an over-width — a purely local pipe with no\n# network fetch is invisible to this rule AND to security.ts, which only\n# matches curl/wget as the left-hand side of the pipe):\n#   - `cat file | sh`: local pipe, no curl/wget involved\n#   - quoted-variable/redirection installer one-liners, e.g.\n#     `curl -fsSL \"$URL\" | sh`: variable substitution disables Codex's\n#     pipe-splitting, collapsing the whole invocation to a single\n#     ['bash', '-lc', '<script>'] where curl is not argv[0] — this exact\n#     form was covered by the removed bare sh/bash heuristic and is no\n#     longer covered by any rule here\n#\n# The following labels have NO argv-prefix equivalent at all (shell syntax\n# not visible to execpolicy's argv matching) and are intentionally NOT\n# expressed as prefix_rule() below — covered instead by sandbox_mode/approval_policy:";
 /** Render the full Codex execpolicy `.rules` Starlark file as a string. */
 function buildCodexRules() {
-	return `${HEADER}\n${SKIP_LIST.map((s) => `#   - ${sanitizeComment(s.sourceLabel)}: ${sanitizeComment(s.reason)}`).join("\n")}\n\n${renderPrefixRules(ALL_RULES)}\n`;
+	const skipComment = SKIP_LIST.map((s) => `#   - ${sanitizeComment(s.sourceLabel)}: ${sanitizeComment(s.reason)}`).join("\n");
+	const body = renderPrefixRules(ALL_RULES);
+	return `${HEADER}\n${skipComment}\n\n${body}\n`;
 }
 //#endregion
 //#region src/refs/discover.ts
@@ -972,6 +974,117 @@ function discoverRefs(home, cwd, marketplaces) {
 	return [...bySkill.values()].join(delimiter);
 }
 //#endregion
+//#region src/cli/scope.ts
+/** Closed set of plugin scopes accepted after `harness hook <id>`. */
+const VALID_SCOPES = /* @__PURE__ */ new Set([
+	"solid",
+	"rules",
+	"carto",
+	"security",
+	"changelog",
+	"aipilot",
+	"lessons",
+	"seo",
+	"memory",
+	"tailwindcss"
+]);
+/**
+* Parse the optional scope argument.
+* @param scopeArg - `process.argv[4]`, when present.
+* @param err - Warning sink (defaults to stderr; injectable for tests).
+* @returns The valid scope, or `"core"` (with a warning) otherwise.
+*/
+function parseScope(scopeArg, err = (m) => process.stderr.write(m)) {
+	if (scopeArg !== void 0 && scopeArg !== "core" && !VALID_SCOPES.has(scopeArg)) err(`harness: unknown scope "${scopeArg}", falling back to "core"\n`);
+	return scopeArg !== void 0 && VALID_SCOPES.has(scopeArg) ? scopeArg : "core";
+}
+//#endregion
+//#region src/cli/hook-io.ts
+/**
+* Hook stdin reading + debug tracing for `harness hook` — extracted from
+* `bin.ts` so the command dispatcher stays under the SOLID line ceiling.
+* Tracing is stderr-only and active only when FUSE_HARNESS_DEBUG=1 AND
+* CI=true (both set by test/sim/exec.ts; never in an interactive session).
+*
+* Stdin is read BOUNDED (`resolveStdinMaxBytes`, default 16 MiB): the reader
+* never buffers past the cap, so an oversized payload cannot exhaust memory
+* nor slip an uninspected tool call through (fail-closed — see `bin.ts`).
+*/
+const hookDebug = process.env.FUSE_HARNESS_DEBUG === "1" && process.env.CI === "true";
+/** stderr-only trace, no-op outside the debug flag combination above. */
+function traceHook(label, data) {
+	if (hookDebug) process.stderr.write(`[hook-debug] ${label}: ${typeof data === "string" ? data : JSON.stringify(data)}\n`);
+}
+/** Type guard for the oversize variant (narrows the readStdin union). */
+function isOversize(x) {
+	return typeof x === "object" && x !== null && x.kind === "oversize";
+}
+/** First 4 KiB are kept on oversize for event-name sniffing downstream. */
+const HEAD_BYTES = 4096;
+const CHUNK = 64 * 1024;
+/**
+* Read a file descriptor to EOF, bounded at `maxBytes` (+1 byte to detect
+* the overflow). Injectable fd so tests never touch process stdin.
+* @param fd - The descriptor to read (0 in production).
+* @param maxBytes - Cap from {@link resolveStdinMaxBytes}.
+*/
+function readBounded(fd, maxBytes) {
+	const buf = Buffer.alloc(CHUNK);
+	const parts = [];
+	let total = 0;
+	for (;;) {
+		const n = readSync(fd, buf, 0, CHUNK, null);
+		if (n === 0) break;
+		total += n;
+		parts.push(Buffer.from(buf.subarray(0, n)));
+		if (total > maxBytes) return {
+			kind: "oversize",
+			head: Buffer.concat(parts).subarray(0, HEAD_BYTES).toString("utf8")
+		};
+	}
+	traceHook("stdin-text-length", total);
+	return {
+		kind: "ok",
+		text: Buffer.concat(parts).toString("utf8")
+	};
+}
+/** Read the hook payload from stdin; `{}` on empty or invalid JSON (fail-open parity). */
+async function readStdin() {
+	const read = readBounded(0, resolveStdinMaxBytes());
+	if (read.kind === "oversize") return read;
+	const text = read.text.trim();
+	if (!text) return {};
+	try {
+		const parsed = JSON.parse(text);
+		return typeof parsed === "object" && parsed !== null ? parsed : {};
+	} catch (e) {
+		traceHook("stdin-parse-error", e instanceof Error ? e.message : String(e));
+		return {};
+	}
+}
+/** Blockable hook events (fail-closed on oversize); others are observation-only. */
+const BLOCKABLE = /* @__PURE__ */ new Set([
+	"PreToolUse",
+	"UserPromptSubmit",
+	"Stop"
+]);
+/**
+* Native stdout for an oversize payload: a deny on blockable (or
+* undeterminable) events — never an uninspected passthrough — and a neutral
+* empty string on observation-only events (no crash, no noise).
+* @param id - Harness id (selects the native deny shape via `respond`).
+* @param head - The first bytes of the payload (event-name sniffing).
+*/
+function oversizeStdout(id, head) {
+	const event = /"hook_event_name"\s*:\s*"([^"]+)"/.exec(head)?.[1] ?? "";
+	if (event && !BLOCKABLE.has(event)) return "";
+	return respond(id, {
+		kind: "block",
+		title: "Oversize hook payload",
+		reason: `stdin payload exceeds ${resolveStdinMaxBytes()} bytes — denied uninspected`
+	});
+}
+//#endregion
 //#region src/cli/hook-sound.ts
 /**
 * @module hook-sound
@@ -1032,22 +1145,6 @@ function maybePlaySound(argv) {
 *   harness changelog      fetch + diff the Claude Code changelog, print a JSON summary (changelog-watcher)
 *   harness codex-rules    generate a Codex execpolicy .rules (Starlark) file from security.ts; stdout or --out <path>
 */
-const hookDebug = process.env.FUSE_HARNESS_DEBUG === "1";
-function traceHook(label, data) {
-	if (hookDebug) process.stderr.write(`[hook-debug] ${label}: ${typeof data === "string" ? data : JSON.stringify(data)}\n`);
-}
-async function readStdin() {
-	const text = (await readStdin$1()).trim();
-	traceHook("stdin-text-length", text.length);
-	if (!text) return {};
-	try {
-		const parsed = JSON.parse(text);
-		return typeof parsed === "object" && parsed !== null ? parsed : {};
-	} catch (e) {
-		traceHook("stdin-parse-error", e instanceof Error ? e.message : String(e));
-		return {};
-	}
-}
 const cmd = process.argv[2];
 if (cmd === "--version" || cmd === "-v") {
 	process.stderr.write(versionBanner(import.meta.url) + "\n");
@@ -1059,19 +1156,7 @@ if (cmd === "--version" || cmd === "-v") {
 } else if (cmd === "hook") {
 	const id = process.argv[3] ?? detectHarness().id;
 	loadDotenv(id);
-	const scopeArg = process.argv[4];
-	const scope = scopeArg !== void 0 && (/* @__PURE__ */ new Set([
-		"solid",
-		"rules",
-		"carto",
-		"security",
-		"changelog",
-		"aipilot",
-		"lessons",
-		"seo",
-		"memory",
-		"tailwindcss"
-	])).has(scopeArg) ? scopeArg : "core";
+	const scope = parseScope(process.argv[4]);
 	if (maybePlaySound(process.argv)) process.exit(0);
 	const marketplaces = (process.env.FUSE_HARNESS_MARKETPLACES ?? "fusengine-plugins").split(",").map((s) => s.trim()).filter(Boolean);
 	const refsDir = process.env.FUSE_HARNESS_REFS || discoverRefs(homedir(), process.cwd(), marketplaces) || void 0;
@@ -1081,7 +1166,13 @@ if (cmd === "--version" || cmd === "-v") {
 	});
 	let outcome;
 	try {
-		outcome = await handleHook(id, await readStdin(), {
+		const stdin = await readStdin();
+		if (isOversize(stdin)) {
+			const stdout = oversizeStdout(id, stdin.head);
+			if (stdout) process.stdout.write(stdout);
+			process.exit(0);
+		}
+		outcome = await handleHook(id, stdin, {
 			now: Date.now(),
 			cwd: process.cwd(),
 			refsDir,

package/dist/cli/index.d.mts

@@ -4,9 +4,9 @@ declare function stagedFiles(): string[];
 /** Read a file's staged (index) content — not the working-tree version. */
 declare function stagedContent(path: string): string;
 /**
-* Evaluate staged code files against the policy core; return violation blocks.
-* `read` is injected (the real impl is {@link stagedContent}) so this is pure + testable.
-*/
+ * Evaluate staged code files against the policy core; return violation blocks.
+ * `read` is injected (the real impl is {@link stagedContent}) so this is pure + testable.
+ */
 declare function checkStaged(files: string[], read: (path: string) => string): string[];
 //#endregion
 export { checkStaged, stagedContent, stagedFiles };

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-3tyTW9Ud.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-D_WchZ3R.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/config/index.d.mts

@@ -1,2 +1,2 @@
-import { _ as parseEnvInt, a as ProjectLayout, c as projectLayout, d as resolveMaxLines, f as splitTarget, g as ttlLabel, h as resolveTtlSec, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as TTL_ENV_KEY, n as envCandidates, o as STATE_GITIGNORE, p as DEFAULT_TTL_SEC, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as MAX_LINES_ENV_KEY } from "../index-jj_EzZRv.mjs";
-export { DEFAULT_MAX_LINES, DEFAULT_TTL_SEC, HOME_DIR, MAX_LINES_ENV_KEY, ProjectLayout, STATE_GITIGNORE, STATE_ROOT, TTL_ENV_KEY, envCandidates, loadDotenv, parseEnvFile, parseEnvInt, projectLayout, resolveMaxLines, resolveTtlSec, splitTarget, ttlLabel };
+import { _ as DEFAULT_TTL_SEC, a as ProjectLayout, b as ttlLabel, c as projectLayout, d as MAX_LINES_ENV_KEY, f as hookBudget, g as storeBudget, h as splitTarget, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as resolveStdinMaxBytes, n as envCandidates, o as STATE_GITIGNORE, p as resolveMaxLines, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as DEFAULT_STDIN_MAX_BYTES, v as TTL_ENV_KEY, x as parseEnvInt, y as resolveTtlSec } from "../index-oXXPs2xl.mjs";
+export { DEFAULT_MAX_LINES, DEFAULT_STDIN_MAX_BYTES, DEFAULT_TTL_SEC, HOME_DIR, MAX_LINES_ENV_KEY, ProjectLayout, STATE_GITIGNORE, STATE_ROOT, TTL_ENV_KEY, envCandidates, hookBudget, loadDotenv, parseEnvFile, parseEnvInt, projectLayout, resolveMaxLines, resolveStdinMaxBytes, resolveTtlSec, splitTarget, storeBudget, ttlLabel };