@fusengine/harness 0.1.89 → 0.1.91

package/dist/adapters/claude/index.d.mts

@@ -1,2 +1,2 @@
-import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-D4C2-IIc.mjs";
+import { a as denyResponse, c as informResponse, d as toClaudeResponse, i as contextResponse, l as readClaudeInput, n as attachSystemMessage, o as fileSizeGuard, r as blockResponse, s as guard, t as ClaudeHookInput, u as systemMessage } from "../../index-SmKYkk2N.mjs";
 export { ClaudeHookInput, attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-5bC8TDAz.mjs";
+import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-Ckv2_TgP.mjs";
 export { attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
+import { t as evaluate } from "../../evaluate-CMiIqHeH.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.d.mts

@@ -1,5 +1,5 @@
-import { t as Prompt } from "../../types-C0-igRKr.mjs";
-import { a as denyResponse, c as informResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-D4C2-IIc.mjs";
+import { t as Prompt } from "../../types-Bh0jEF3_.mjs";
+import { a as denyResponse, c as informResponse, i as contextResponse, l as readClaudeInput, t as ClaudeHookInput } from "../../index-SmKYkk2N.mjs";
 //#region src/adapters/codex/index.d.ts
 /**
  * Render a portable {@link Prompt} as a Codex hook response, `ask` → explicit deny.

package/dist/adapters/codex/index.mjs

@@ -1,8 +1,9 @@
-import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
+import { t as evaluate } from "../../evaluate-CMiIqHeH.mjs";
 import { f as countLines } from "../../home-state-oUGFB4ds.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
-import { n as canonicalizeCodexShellTool, r as parseApplyPatch, t as isBypassPermissions } from "../../permission-mode-B0MUl7FT.mjs";
-import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse } from "../../claude-5bC8TDAz.mjs";
+import { i as parseApplyPatch, n as canonicalizeMcpToolName, r as canonicalizeCodexShellTool, t as isBypassPermissions } from "../../permission-mode-B-SFyR0X.mjs";
+import { t as commandToString } from "../../command-string-CALMTnwN.mjs";
+import { c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse } from "../../claude-Ckv2_TgP.mjs";
 //#region src/adapters/codex/index.ts
 /**
 * OpenAI Codex CLI adapter (hook-mode). Codex's `PreToolUse` hook (since 2026)
@@ -51,7 +52,7 @@ function applyPatchPrompt(command) {
 function resolvePrompt(input) {
 	const i = input.tool_input;
 	const r = evaluate({
-		tool: canonicalizeCodexShellTool("codex", input.tool_name ?? "Write"),
+		tool: canonicalizeCodexShellTool("codex", canonicalizeMcpToolName("codex", input.tool_name ?? "Write")),
 		filePath: i?.file_path,
 		content: i?.content ?? i?.new_string,
 		command: commandToString(i?.command),

package/dist/adapters/cursor/index.d.mts

@@ -3,9 +3,15 @@
 interface CursorShellPayload {
   command?: string;
   cwd?: string;
+  sandbox?: boolean;
   workspace_roots?: string[];
   hook_event_name?: string;
 }
+/** `preToolUse` stdin payload subset consumed by the adapter. */
+interface CursorToolPayload {
+  tool_name?: string;
+  tool_input?: Record<string, unknown>;
+}
 /** `afterFileEdit` stdin payload (subset). */
 interface CursorEditPayload {
   file_path?: string;
@@ -15,18 +21,10 @@ interface CursorEditPayload {
   }[];
 }
 /**
- * `afterFileEdit` stdout response. Its schema (cursor.com/docs/hooks#afterFileEdit)
- * is DELIBERATELY narrower than the "before" hooks: `permission` + `user_message`
- * only — there is NO `agent_message` and NO `updated_input`. Since the edit is
- * already on disk when this "after" hook fires, `deny` cannot revert it and the
- * correction reaches only the HUMAN (`user_message`), never the model — so this
- * path is strictly ADVISORY, not an enforceable gate.
+ * Empty afterFileEdit callback. Cursor documents no output fields for this
+ * post hook, so pre-execution permission fields are intentionally impossible.
  */
-interface CursorEditResponse {
-  permission: "allow" | "deny";
-  /** User-visible correction — snake_case (#141516); the only channel afterFileEdit exposes. */
-  user_message?: string;
-}
+type CursorEditResponse = Record<string, never>;
 /**
  * `beforeShellExecution` stdout response. Message keys are snake_case:
  * Cursor silently ignores camelCase `userMessage`/`agentMessage` (#141516,
@@ -35,7 +33,6 @@ interface CursorEditResponse {
  */
 interface CursorResponse {
   permission: "allow" | "deny" | "ask";
-  continue?: boolean;
   /** User-visible message — snake_case required (#141516, #142589). */
   user_message?: string;
   /** Agent-visible message — snake_case required (#141516, #142589). */
@@ -45,24 +42,14 @@ interface CursorResponse {
 //#region src/adapters/cursor/index.d.ts
 /** Guard a shell command (git/install policies). */
 declare function beforeShellExecution(payload: CursorShellPayload): CursorResponse;
+/** Guard a generic Cursor tool call using the same extraction as the runtime. */
+declare function preToolUse(payload: CursorToolPayload): CursorResponse;
 /**
- * Advise on a file edit AFTER Cursor has written it — a HUMAN-VISIBLE audit note,
- * never a gate. This is an "after" hook: the edit is already on disk. On a
- * SOLID/DRY violation we surface the correction through `user_message` (the only
- * channel afterFileEdit exposes — no `agent_message`, so the model is never
- * re-informed) while ALWAYS returning `permission: "allow"`.
- *
- * We deliberately never emit `permission: "deny"` here, for two distinct reasons:
- * (1) structural — afterFileEdit was "informational only" at launch (Chacon,
- * Cursor hooks beta 1.7, 2025-09: no channel to stop the agent), and a post-write
- * deny has no documented rollback; (2) empirical — Cursor staff confirm the
- * deny-enforcement path is broken for file operations (forum.cursor.com/t/154377,
- * v2.6.18, 2026-03, open) — proven for file READS, plausibly the same for writes.
- * So a `deny` would be a false blocking signal; `allow` + `user_message` is the
- * only proven-safe shape.
+ * Complete an observed file edit without emitting pre-execution permission
+ * fields. Cursor does not define a callback schema for this post hook.
  * @param payload - The `afterFileEdit` stdin payload.
- * @returns Always an allow; carries the user-visible correction on a violation.
+ * @returns An empty successful response.
  */
 declare function afterFileEdit(payload: CursorEditPayload): CursorEditResponse;
 //#endregion
-export { type CursorEditPayload, type CursorEditResponse, type CursorResponse, type CursorShellPayload, afterFileEdit, beforeShellExecution };
+export { type CursorEditPayload, type CursorEditResponse, type CursorResponse, type CursorShellPayload, type CursorToolPayload, afterFileEdit, beforeShellExecution, preToolUse };

package/dist/adapters/cursor/index.mjs

@@ -1,58 +1,47 @@
-import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
+import { t as evaluate } from "../../evaluate-CMiIqHeH.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
+import { t as extractCursorEvent } from "../../normalize-BjG6unTj.mjs";
 //#region src/adapters/cursor/index.ts
-/**
-* Cursor adapter (hook-mode). Schemas per cursor.com/docs/hooks (2026):
-* `beforeShellExecution` can block; `afterFileEdit` is observe-only.
-*/
-function toPermission(kind) {
-	return kind === "block" ? "deny" : kind === "ask" ? "ask" : "allow";
-}
-/** Guard a shell command (git/install policies). */
-function beforeShellExecution(payload) {
-	const r = evaluate({
-		tool: "Bash",
-		command: payload.command
+/** Cursor hook adapter; post-edit handling remains observe-only. */
+function guardCursor(payload) {
+	const event = extractCursorEvent(payload);
+	const result = evaluate({
+		tool: event.tool,
+		filePath: event.filePath,
+		content: event.content,
+		oldString: event.oldString,
+		command: event.command
 	});
-	if (r.decision === "allow" || !r.prompt) return { permission: "allow" };
-	const msg = formatPrompt(r.prompt);
+	if (result.decision === "allow" || !result.prompt) return { permission: "allow" };
+	const message = formatPrompt(result.prompt);
 	return {
-		permission: toPermission(r.prompt.kind),
-		continue: false,
-		user_message: msg,
-		agent_message: msg
+		permission: "deny",
+		user_message: result.prompt.kind === "ask" ? `[downgraded from ask — Cursor preToolUse does not reliably enforce ask]\n${message}` : message,
+		agent_message: message
+	};
+}
+function namedPayload(payload, eventName) {
+	return Object.hasOwn(payload, "hook_event_name") ? payload : {
+		...payload,
+		hook_event_name: eventName
 	};
 }
+/** Guard a shell command (git/install policies). */
+function beforeShellExecution(payload) {
+	return guardCursor(namedPayload(payload, "beforeShellExecution"));
+}
+/** Guard a generic Cursor tool call using the same extraction as the runtime. */
+function preToolUse(payload) {
+	return guardCursor(namedPayload(payload, "preToolUse"));
+}
 /**
-* Advise on a file edit AFTER Cursor has written it — a HUMAN-VISIBLE audit note,
-* never a gate. This is an "after" hook: the edit is already on disk. On a
-* SOLID/DRY violation we surface the correction through `user_message` (the only
-* channel afterFileEdit exposes — no `agent_message`, so the model is never
-* re-informed) while ALWAYS returning `permission: "allow"`.
-*
-* We deliberately never emit `permission: "deny"` here, for two distinct reasons:
-* (1) structural — afterFileEdit was "informational only" at launch (Chacon,
-* Cursor hooks beta 1.7, 2025-09: no channel to stop the agent), and a post-write
-* deny has no documented rollback; (2) empirical — Cursor staff confirm the
-* deny-enforcement path is broken for file operations (forum.cursor.com/t/154377,
-* v2.6.18, 2026-03, open) — proven for file READS, plausibly the same for writes.
-* So a `deny` would be a false blocking signal; `allow` + `user_message` is the
-* only proven-safe shape.
+* Complete an observed file edit without emitting pre-execution permission
+* fields. Cursor does not define a callback schema for this post hook.
 * @param payload - The `afterFileEdit` stdin payload.
-* @returns Always an allow; carries the user-visible correction on a violation.
+* @returns An empty successful response.
 */
 function afterFileEdit(payload) {
-	const content = payload.edits?.map((e) => e.new_string).join("\n") ?? "";
-	const r = evaluate({
-		tool: "Edit",
-		filePath: payload.file_path,
-		content
-	});
-	if (r.decision !== "deny" || !r.prompt) return { permission: "allow" };
-	return {
-		permission: "allow",
-		user_message: formatPrompt(r.prompt)
-	};
+	return {};
 }
 //#endregion
-export { afterFileEdit, beforeShellExecution };
+export { afterFileEdit, beforeShellExecution, preToolUse };

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
+import { t as evaluate } from "../../evaluate-CMiIqHeH.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/adapters/hermes/index.d.mts

@@ -1,4 +1,4 @@
-import { t as Prompt } from "../../types-C0-igRKr.mjs";
+import { t as Prompt } from "../../types-Bh0jEF3_.mjs";
 //#region src/adapters/hermes/interfaces/types.d.ts
 /**
  * Hermes Agent (NousResearch/hermes-agent) shell-hook wire types. Verified 2026

package/dist/adapters/hermes/index.mjs

@@ -1,2 +1,2 @@
-import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-kP6NUQlG.mjs";
+import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-B9-p_3IF.mjs";
 export { guard, readHermesInput, toHermesResponse };

package/dist/adapters/kimi/index.d.mts

@@ -1,4 +1,4 @@
-import { t as Prompt } from "../../types-C0-igRKr.mjs";
+import { t as Prompt } from "../../types-Bh0jEF3_.mjs";
 //#region src/adapters/kimi/interfaces/types.d.ts
 /**
  * Kimi Code CLI shell-hook wire types. Verified 2026 against

package/dist/adapters/kimi/index.mjs

@@ -1,2 +1,2 @@
-import { i as toKimiResponse, n as kimiDenyResponse, r as readKimiInput, t as guard } from "../../kimi-D6X7b8wF.mjs";
+import { i as toKimiResponse, n as kimiDenyResponse, r as readKimiInput, t as guard } from "../../kimi-G2wcSh5-.mjs";
 export { guard, kimiDenyResponse, readKimiInput, toKimiResponse };

package/dist/{claude-5bC8TDAz.mjs → claude-Ckv2_TgP.mjs}

@@ -1,49 +1,9 @@
-import { t as evaluate } from "./evaluate-C1VSI5pb.mjs";
+import { t as evaluate } from "./evaluate-CMiIqHeH.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
+import { t as commandToString } from "./command-string-CALMTnwN.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-//#region src/runtime/command-string.ts
-/** Shell basenames whose `-c`-style argv carries the real script in argv[2]. */
-const SHELLS = /* @__PURE__ */ new Set([
-	"bash",
-	"sh",
-	"zsh",
-	"dash"
-]);
-/** True when `arg` is (a path to) a POSIX shell we know wraps a `-c` script. */
-function isShell(arg) {
-	if (arg === void 0) return false;
-	const base = arg.slice(arg.lastIndexOf("/") + 1);
-	return SHELLS.has(base);
-}
-/** True for a shell command flag (`-c`, `-lc`, `-ic`, …) — anything ending in `c`. */
-function isCommandFlag(arg) {
-	return arg !== void 0 && /^-[a-z]*c$/.test(arg);
-}
-/**
-* Coerce a hook payload's `command` field to the shell string the guard chain
-* expects. Harnesses disagree on the wire shape: Claude Code, Cursor, and Hermes
-* send a plain string, but Codex CLI sends an argv ARRAY
-* (`["bash", "-lc", "git commit -m x"]`). A naive `typeof === "string"` check
-* dropped the array to `undefined`, blinding every `ctx.command` guard
-* (destructive-git, mutators, install…) into a silent fail-open. This restores
-* the script so the array and string payloads reach an identical verdict.
-*
-* @param v - Raw `command` value off the payload (string, argv array, or other).
-* @returns A string as-is; a `[shell, -c|-lc, script]` argv reduced to its
-*   script; any other all-string array joined with spaces; and `undefined` for
-*   empty arrays, arrays holding non-strings, or any other type.
-*/
-function commandToString(v) {
-	if (typeof v === "string") return v;
-	if (!Array.isArray(v)) return void 0;
-	if (v.length === 0 || !v.every((e) => typeof e === "string")) return void 0;
-	const argv = v;
-	if (argv.length >= 3 && isShell(argv[0]) && isCommandFlag(argv[1])) return argv[2];
-	return argv.join(" ");
-}
-//#endregion
 //#region src/util/runtime-io.ts
 /**
 * Cross-runtime I/O helpers (Node + Bun). The published CLI ships a `node`
@@ -216,4 +176,4 @@ function guard(input) {
 /** @deprecated use {@link guard}. Kept for back-compat. */
 const fileSizeGuard = guard;
 //#endregion
-export { commandToString as _, fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, writeText as g, spawnCapture as h, denyResponse as i, systemMessage as l, sleep as m, blockResponse as n, guard as o, readText as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u };
+export { fileSizeGuard as a, readClaudeInput as c, collectFiles as d, pathExists as f, writeText as g, spawnCapture as h, denyResponse as i, systemMessage as l, sleep as m, blockResponse as n, guard as o, readText as p, contextResponse as r, informResponse as s, attachSystemMessage as t, toClaudeResponse as u };