@fusengine/harness 0.1.89 → 0.1.91

package/dist/{handle-DHhukRdh.mjs → handle-C43gA-Pr.mjs}

@@ -3,21 +3,23 @@ import { a as harnessHome, c as resolveTtlSec } from "./dotenv-BLBkBTww.mjs";
 import { r as projectLayout } from "./layout-KWoE_Mqn.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { t as detectHarness } from "./harness-BMuLJ9lm.mjs";
-import { $ as matchPatterns, D as isVendorPath, G as isFileSizeScoped, J as GIT_BLOCKED, K as resolveSolidRefFramework, W as computeEditResultLines, b as interfaceDeclLevel, et as detectFramework, g as conventionsMode, lt as requiredArchSkill, n as FAIL_CLOSED, ot as detectModularArchitecture, rt as maskCommentsAndStrings, st as detectProjectType$1, t as evaluate } from "./evaluate-C1VSI5pb.mjs";
+import { D as isVendorPath, G as computeEditResultLines, K as isFileSizeScoped, V as shellOutputRedirects, Y as GIT_BLOCKED, b as interfaceDeclLevel, ct as detectProjectType$1, et as matchPatterns, g as conventionsMode, it as maskCommentsAndStrings, n as FAIL_CLOSED, q as resolveSolidRefFramework, st as detectModularArchitecture, t as evaluate, tt as detectFramework, ut as requiredArchSkill } from "./evaluate-CMiIqHeH.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, p as evaluateFileSize, r as fusengineCache, t as claudeHome } from "./home-state-oUGFB4ds.mjs";
 import { a as writeJsonFile, i as readJsonFile, r as hashText, t as atomicWrite } from "./json-io-DisYd2fb.mjs";
 import { r as isDocConsulted } from "./doc-helpers-CWZegVdR.mjs";
-import { D as frameworkSolidGate, F as isExcludedSwiftPath, G as evaluateApex, H as PRE_AUTH_GATES, P as isExcludedJsPath, R as capVerbosity, S as parseField, T as usesTailwindUtilities, V as POST_AUTH_GATES, W as docConsultedGate, b as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, g as buildClaudeMdContext, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, p as apexAgentSteps, r as descFromText, s as parseEntry, t as isHtmlLike, v as apexDocName, w as skillTriggerGate, y as harnessHomeSegment, z as detectCreationIntent } from "./validate-DZFtAbLP.mjs";
+import { D as frameworkSolidGate, F as isExcludedSwiftPath, G as evaluateApex, H as PRE_AUTH_GATES, P as isExcludedJsPath, R as capVerbosity, S as parseField, T as usesTailwindUtilities, V as POST_AUTH_GATES, W as docConsultedGate, b as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, g as buildClaudeMdContext, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, p as apexAgentSteps, r as descFromText, s as parseEntry, t as isHtmlLike, v as apexDocName, w as skillTriggerGate, y as harnessHomeSegment, z as detectCreationIntent } from "./validate-KjZ1X9tH.mjs";
 import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DVML3zfp.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as setStateField, t as addRoot } from "./registry-IhHk2KlT.mjs";
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { C as apexAuthorizationGate, S as trivialCount, _ as recordBrainstormRequired, a as journalLogPath, b as recordTarget, c as appendEvent, d as signTrack, f as verifyTrack, g as recordAgent, h as emptyTrack, i as withTrack, l as withTrackLockSync, m as agentsFresh, o as readTrackSync, p as writeLastNonce, r as trackJournalEnabled, s as diffTrackEvents, t as loadTrack, u as LOCK_FAILED, v as recordDoc, x as recordTrivialEdit, y as recordRefRead } from "./store-5-ZPKb0u.mjs";
-import { n as canonicalizeCodexShellTool, r as parseApplyPatch, t as isBypassPermissions } from "./permission-mode-B0MUl7FT.mjs";
-import { _ as commandToString, d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-5bC8TDAz.mjs";
-import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-D6X7b8wF.mjs";
-import { r as toHermesResponse } from "./hermes-kP6NUQlG.mjs";
+import { i as parseApplyPatch, n as canonicalizeMcpToolName, r as canonicalizeCodexShellTool, t as isBypassPermissions } from "./permission-mode-B-SFyR0X.mjs";
+import { t as commandToString } from "./command-string-CALMTnwN.mjs";
+import { n as cursorProjectCwd, r as cursorEventContract, t as extractCursorEvent } from "./normalize-BjG6unTj.mjs";
+import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-Ckv2_TgP.mjs";
+import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-G2wcSh5-.mjs";
+import { r as toHermesResponse } from "./hermes-B9-p_3IF.mjs";
 import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -69,9 +71,7 @@ function str(v) {
 	return typeof v === "string" ? v : void 0;
 }
 /**
-* Normalize a harness hook payload into a uniform event. Handles Cline's nested
-* `preToolUse`/`postToolUse` shape and the top-level `tool_name`/`tool_input`
-* shape used by Claude, Codex, Gemini, and Cursor.
+* Normalize a hook payload, including Cline nesting and native Cursor events.
 */
 function normalizeEvent(id, payload) {
 	if (id === "cline") {
@@ -88,16 +88,24 @@ function normalizeEvent(id, payload) {
 			command: str(params.command)
 		};
 	}
+	if (id === "cursor") return {
+		...extractCursorEvent(payload),
+		sessionId: str(payload.session_id) ?? str(payload.conversation_id) ?? "",
+		agentType: str(payload.agent_type),
+		permissionMode: str(payload.permission_mode)
+	};
 	const event = str(payload.hook_event_name) ?? "";
 	const input = payload.tool_input ?? payload;
-	const tool = canonicalizeCodexShellTool(id, str(payload.tool_name) ?? "");
+	const tool = canonicalizeCodexShellTool(id, canonicalizeMcpToolName(id, str(payload.tool_name) ?? ""));
 	const base = {
 		phase: /post|after/i.test(event) ? "post" : "pre",
 		tool,
 		input,
 		sessionId: str(payload.session_id) ?? str(payload.conversation_id) ?? "",
 		agentType: str(payload.agent_type) ?? str(input.subagent_type),
-		permissionMode: str(payload.permission_mode)
+		permissionMode: str(payload.permission_mode),
+		toolUseId: str(payload.tool_use_id),
+		cwd: str(payload.cwd)
 	};
 	if (tool === "apply_patch") {
 		const files = parseApplyPatch(str(input.command) ?? str(payload.command) ?? "").map((f) => ({
@@ -3064,7 +3072,7 @@ function lessonsStateFileFor(root) {
 //#endregion
 //#region src/tracking/one-shot-store.ts
 /** A fresh, empty state — always spread (`{ ...EMPTY }`) so the const is never shared. */
-const EMPTY = {
+const EMPTY$1 = {
 	gates: {},
 	firstTry: 0,
 	corrected: 0,
@@ -3076,7 +3084,7 @@ const EMPTY = {
 * gates/pending older than `windowMs`. Keeps the "7d" window honest, bounds size.
 */
 function pruneState(s, now, windowMs) {
-	if (now - s.updatedAt >= windowMs) return { ...EMPTY };
+	if (now - s.updatedAt >= windowMs) return { ...EMPTY$1 };
 	const gates = {};
 	for (const [k, g] of Object.entries(s.gates)) if (now - g.lastTs < windowMs) gates[k] = g;
 	const pending = {};
@@ -3309,16 +3317,16 @@ const SIDECAR$1 = "one-shot.json";
 /** Retention window: 7 days. Aggregates and pending denies older than this are pruned. */
 const WINDOW_MS = 10080 * 60 * 1e3;
 /** Load the state, or a fresh copy when missing/corrupt. */
-function loadState(path) {
+function loadState$1(path) {
 	try {
-		if (!existsSync(path)) return { ...EMPTY };
+		if (!existsSync(path)) return { ...EMPTY$1 };
 		const d = JSON.parse(readFileSync(path, "utf8"));
 		return d && typeof d === "object" && !Array.isArray(d) ? {
-			...EMPTY,
+			...EMPTY$1,
 			...d
-		} : { ...EMPTY };
+		} : { ...EMPTY$1 };
 	} catch {
-		return { ...EMPTY };
+		return { ...EMPTY$1 };
 	}
 }
 /**
@@ -3341,7 +3349,7 @@ function recordOneShot(prompt, input, opts) {
 		});
 		if (!burstFirst(op, prompt ? `deny:${prompt.title}` : "allow", opts)) return;
 		const path = join(opts.dir, SIDECAR$1);
-		let s = pruneState(loadState(path), opts.now, WINDOW_MS);
+		let s = pruneState(loadState$1(path), opts.now, WINDOW_MS);
 		s = prompt ? applyDeny(s, prompt.title, op, opts.now) : applyAllow(s, op, opts.now, input.content != null || input.command != null);
 		atomicWrite(path, JSON.stringify(s));
 	} catch {}
@@ -3356,7 +3364,7 @@ function recordOneShot(prompt, input, opts) {
 */
 function oneShotSummary(cwd) {
 	try {
-		return formatSummary(pruneState(loadState(join(defaultStateDir(cwd), SIDECAR$1)), Date.now(), WINDOW_MS));
+		return formatSummary(pruneState(loadState$1(join(defaultStateDir(cwd), SIDECAR$1)), Date.now(), WINDOW_MS));
 	} catch {
 		return "";
 	}
@@ -3401,7 +3409,7 @@ function recordFailure(tool, opts) {
 	try {
 		if (!burstFirst(`fail:${tool}`, "failure", opts)) return;
 		const path = join(opts.dir, SIDECAR$1);
-		const next = applyFailure(pruneState(loadState(path), opts.now, WINDOW_MS), tool, opts.now);
+		const next = applyFailure(pruneState(loadState$1(path), opts.now, WINDOW_MS), tool, opts.now);
 		atomicWrite(path, JSON.stringify(next));
 	} catch {}
 }
@@ -5326,8 +5334,13 @@ const RETRY_DELAYS = [
 	1e3,
 	2e3
 ];
-/** Extract the longest assistant synthesis + queried library ids from a transcript. */
-async function extractSynthesis(path) {
+/**
+* Extract the longest assistant synthesis + queried library ids from a transcript.
+* @param id - Harness adapter id, used to canonicalize `block.name` (Codex-mangled
+*   underscore tool names) before the {@link TOOL_PATTERN} match — see
+*   {@link cacheDocFromTranscript} for why this is a defensive, unconfirmed-case cover.
+*/
+async function extractSynthesis(path, id) {
 	const lines = readText$1(path).split("\n").filter(Boolean);
 	const libraries = [];
 	let synthesis = "";
@@ -5337,7 +5350,7 @@ async function extractSynthesis(path) {
 		const contents = entry?.message?.content;
 		if (!Array.isArray(contents)) continue;
 		for (const block of contents) {
-			if (block.type === "tool_use" && TOOL_PATTERN.test(block.name ?? "")) {
+			if (block.type === "tool_use" && TOOL_PATTERN.test(canonicalizeMcpToolName(id, block.name ?? ""))) {
 				const lib = block.input?.libraryId ?? block.input?.query ?? "";
 				if (lib && !libraries.includes(lib)) libraries.push(lib);
 			}
@@ -5354,17 +5367,28 @@ async function extractSynthesis(path) {
 * @param transcript - Path to the agent JSONL transcript.
 * @param cwd - Fallback project root.
 * @param home - Home dir (defaults to `~`).
-*/
-async function cacheDocFromTranscript(transcript, cwd, home = homedir()) {
+* @param id - Harness adapter id (defaults to "claude-code"). On `"codex"`,
+*   every `tool_use.name` read from the transcript is canonicalized before the
+*   {@link TOOL_PATTERN} match, defensively covering the SAME Codex-mangled
+*   underscore form as `doc-cache-gate.ts`'s `docCacheGate`. UNLIKE that gate,
+*   this is NOT a confirmed-reproduced bug: the proof that Codex emits the
+*   underscore form (`sanitize_responses_api_tool_name()`, openai/codex#14605,
+*   `SCENARIO_DASH_TOOL` in #18385) is about the live PreToolUse HOOK payload,
+*   never observed here against transcript `tool_use.name` content. The
+*   canonicalization is a no-op when the transcript already carries the dash
+*   form (idempotence proven in `test/mcp-tool-name.test.ts`, test 2), so this
+*   costs nothing if the hypothesis turns out false.
+*/
+async function cacheDocFromTranscript(transcript, cwd, home = homedir(), id = "claude-code") {
 	if (!transcript || !pathExists(transcript)) return;
 	const projPath = projectRootFromPaths(await transcriptFilePaths(transcript)) ?? process.env.CLAUDE_PROJECT_DIR ?? cwd;
 	const cacheDir = cacheDirFor("doc", projPath, home);
 	const docsDir = join(cacheDir, "docs");
-	let result = await extractSynthesis(transcript);
+	let result = await extractSynthesis(transcript, id);
 	for (const delay of RETRY_DELAYS) {
 		if (result.text.length >= MIN_TEXT_SIZE && result.libraries.length > 0) break;
 		await sleep(delay);
-		result = await extractSynthesis(transcript);
+		result = await extractSynthesis(transcript, id);
 	}
 	const { text, libraries } = result;
 	if (text.length < MIN_TEXT_SIZE || libraries.length === 0) return;
@@ -5762,10 +5786,14 @@ function libraryOf(payload) {
 * @param cwd - Fallback project root (uses `CLAUDE_PROJECT_DIR` first).
 * @param now - Clock (defaults to `Date.now()`).
 * @param home - Home dir (defaults to `~`).
+* @param id - Harness adapter id (defaults to "claude-code"); on `"codex"`,
+*   `payload.tool_name` is canonicalized before the {@link GATED_TOOLS} match
+*   so the Codex-mangled underscore form (`mcp__context7__query_docs`) gates
+*   exactly like the dash form does on every other harness.
 * @returns A native deny response, or `null` to fall through to the live call.
 */
-async function docCacheGate(payload, cwd, now = Date.now(), home = homedir()) {
-	const tool = String(payload.tool_name ?? "");
+async function docCacheGate(payload, cwd, now = Date.now(), home = homedir(), id = "claude-code") {
+	const tool = canonicalizeMcpToolName(id, String(payload.tool_name ?? ""));
 	if (!GATED_TOOLS.test(tool)) return null;
 	const library = libraryOf(payload);
 	if (!library) return null;
@@ -5981,11 +6009,11 @@ async function onSubagentStart(payload, cwd, now, home, id) {
 	const agent = agentTypeOf(payload);
 	return combineContext(await injectApexSubagentContext(cwd, home, id), await injectLessonsCache(cwd, home, now), await typeSpecificCache(agent, cwd, now, home));
 }
-/** SubagentStop routing: transcript-driven cache writers, then the universal SOLID check. */
-async function onSubagentStop(payload, cwd, home) {
+/** SubagentStop routing: transcript-driven cache writers, then the universal SOLID check. `id` selects the harness target (defaults to "claude-code"), threaded into `cacheDocFromTranscript`. */
+async function onSubagentStop(payload, cwd, home, id) {
 	const agent = agentTypeOf(payload);
 	const transcript = transcriptOf(payload);
-	if (agent.includes("research-expert")) await cacheDocFromTranscript(transcript, cwd, home);
+	if (agent.includes("research-expert")) await cacheDocFromTranscript(transcript, cwd, home, id);
 	if (agent.includes("sniper")) {
 		await cacheSniperLessons(transcript, cwd, home);
 		await cacheTestResults(transcript, cwd, home);
@@ -5999,12 +6027,12 @@ async function onSubagentStop(payload, cwd, home) {
 */
 async function dispatchAipilot(event, payload, cwd, now, home = homedir(), id = "claude-code") {
 	if (event === "SubagentStart") return onSubagentStart(payload, cwd, now, home, id);
-	if (event === "SubagentStop") return onSubagentStop(payload, cwd, home);
+	if (event === "SubagentStop") return onSubagentStop(payload, cwd, home, id);
 	if (event === "SessionEnd" || event === "Stop") {
 		await cacheAnalyticsSave(home, now);
 		return "";
 	}
-	if (event === "PreToolUse") return docCacheGate(payload, cwd, now, home);
+	if (event === "PreToolUse") return docCacheGate(payload, cwd, now, home, id);
 	return null;
 }
 /** PostToolUse (Write/Edit SOLID check, else TaskCreate/TaskUpdate sync) for the ai-pilot scope; `id` selects the harness target (defaults to "claude-code"). */
@@ -6626,13 +6654,281 @@ async function autoDocumentRead(filePath, now = Date.now(), id = "claude-code")
 	return systemMessage(`📖 [${docType}] ${fname} logged`);
 }
 //#endregion
+//#region src/adapters/cursor/native-response.ts
+const stringValue = (value) => typeof value === "string";
+const booleanValue = (value) => typeof value === "boolean";
+const plainRecord = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	try {
+		const prototype = Object.getPrototypeOf(value);
+		return prototype === Object.prototype || prototype === null;
+	} catch {
+		return false;
+	}
+};
+function jsonChildren(value) {
+	const keys = Reflect.ownKeys(value);
+	const descriptors = Object.getOwnPropertyDescriptors(value);
+	if (Array.isArray(value)) {
+		if (Object.getPrototypeOf(value) !== Array.prototype) return null;
+		const length = descriptors.length;
+		if (!length || !("value" in length) || !Number.isSafeInteger(length.value) || length.value < 0) return null;
+		if (keys.length !== length.value + 1 || keys.some((key) => typeof key === "symbol")) return null;
+		const children = [];
+		for (let index = 0; index < length.value; index += 1) {
+			const descriptor = descriptors[String(index)];
+			if (!descriptor?.enumerable || !("value" in descriptor)) return null;
+			children.push(descriptor.value);
+		}
+		return children;
+	}
+	if (!plainRecord(value) || keys.some((key) => typeof key === "symbol")) return null;
+	const children = [];
+	for (const key of keys) {
+		const descriptor = descriptors[key];
+		if (!descriptor?.enumerable || !("value" in descriptor)) return null;
+		children.push(descriptor.value);
+	}
+	return children;
+}
+function jsonValue(root) {
+	const active = /* @__PURE__ */ new WeakSet();
+	const stack = [{ value: root }];
+	while (stack.length > 0) {
+		const frame = stack.pop();
+		if (frame.leave) {
+			active.delete(frame.value);
+			continue;
+		}
+		const { value } = frame;
+		if (value === null || typeof value === "string" || typeof value === "boolean") continue;
+		if (typeof value === "number") {
+			if (!Number.isFinite(value)) return false;
+			continue;
+		}
+		if (typeof value !== "object" || active.has(value)) return false;
+		let children;
+		try {
+			children = jsonChildren(value);
+		} catch {
+			return false;
+		}
+		if (!children) return false;
+		active.add(value);
+		stack.push({
+			value,
+			leave: true
+		});
+		for (let index = children.length - 1; index >= 0; index -= 1) stack.push({ value: children[index] });
+	}
+	return true;
+}
+const recordValue = (value) => plainRecord(value) && jsonValue(value);
+const stringRecord = (value) => {
+	if (!recordValue(value)) return false;
+	try {
+		return Object.values(Object.getOwnPropertyDescriptors(value)).every((descriptor) => "value" in descriptor && typeof descriptor.value === "string");
+	} catch {
+		return false;
+	}
+};
+const stringArray = (value) => Array.isArray(value) && value.every(stringValue);
+const permission = (...values) => (value) => typeof value === "string" && values.includes(value);
+const EMPTY = { fields: {} };
+const FOLLOWUP = { fields: { followup_message: stringValue } };
+const PERMISSION_ASK = {
+	fields: {
+		permission: permission("allow", "deny", "ask"),
+		user_message: stringValue,
+		agent_message: stringValue
+	},
+	required: ["permission"]
+};
+const NATIVE_SCHEMAS = {
+	sessionStart: { fields: {
+		env: stringRecord,
+		additional_context: stringValue,
+		continue: booleanValue,
+		user_message: stringValue
+	} },
+	sessionEnd: EMPTY,
+	beforeSubmitPrompt: {
+		fields: {
+			continue: booleanValue,
+			user_message: stringValue
+		},
+		required: ["continue"]
+	},
+	preCompact: { fields: { user_message: stringValue } },
+	subagentStart: {
+		fields: {
+			permission: permission("allow", "deny"),
+			user_message: stringValue
+		},
+		required: ["permission"]
+	},
+	subagentStop: FOLLOWUP,
+	preToolUse: {
+		fields: {
+			...PERMISSION_ASK.fields,
+			updated_input: recordValue
+		},
+		required: ["permission"]
+	},
+	postToolUse: { fields: {
+		updated_mcp_tool_output: recordValue,
+		additional_context: stringValue
+	} },
+	postToolUseFailure: EMPTY,
+	beforeShellExecution: PERMISSION_ASK,
+	afterShellExecution: EMPTY,
+	beforeMCPExecution: PERMISSION_ASK,
+	afterMCPExecution: EMPTY,
+	beforeReadFile: {
+		fields: {
+			permission: permission("allow", "deny"),
+			user_message: stringValue
+		},
+		required: ["permission"]
+	},
+	afterFileEdit: EMPTY,
+	beforeTabFileRead: {
+		fields: { permission: permission("allow", "deny") },
+		required: ["permission"]
+	},
+	afterTabFileEdit: EMPTY,
+	afterAgentResponse: EMPTY,
+	afterAgentThought: EMPTY,
+	stop: FOLLOWUP,
+	workspaceOpen: { fields: { pluginPaths: stringArray } }
+};
+function isNativeCursorResponse(value, eventName) {
+	try {
+		if (!recordValue(value)) return false;
+		const schema = NATIVE_SCHEMAS[eventName];
+		if (!schema) return false;
+		const descriptors = Object.getOwnPropertyDescriptors(value);
+		if (schema.required?.some((field) => !Object.hasOwn(descriptors, field))) return false;
+		return Reflect.ownKeys(descriptors).every((field) => {
+			if (typeof field !== "string") return false;
+			const descriptor = descriptors[field];
+			if (!Object.hasOwn(schema.fields, field)) return false;
+			const validate = schema.fields[field];
+			return descriptor?.enumerable === true && "value" in descriptor && validate !== void 0 && validate(descriptor.value);
+		});
+	} catch {
+		return false;
+	}
+}
+/** Preserve raw stdout only when JSON.parse proves a documented native Cursor response. */
+function parseNativeCursorStdout(stdout, eventName) {
+	if (typeof stdout !== "string") return null;
+	try {
+		return isNativeCursorResponse(JSON.parse(stdout), eventName) ? stdout : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/adapters/cursor/respond.ts
+const AGENT_MESSAGE_EVENTS = /* @__PURE__ */ new Set([
+	"preToolUse",
+	"beforeShellExecution",
+	"beforeMCPExecution"
+]);
+const USER_MESSAGE_EVENTS = /* @__PURE__ */ new Set([
+	"preToolUse",
+	"beforeShellExecution",
+	"beforeMCPExecution",
+	"beforeReadFile",
+	"subagentStart"
+]);
+function permissionMessages(eventName, userMessage, agentMessage) {
+	return {
+		...userMessage && USER_MESSAGE_EVENTS.has(eventName) ? { user_message: userMessage } : {},
+		...agentMessage && AGENT_MESSAGE_EVENTS.has(eventName) ? { agent_message: agentMessage } : {}
+	};
+}
+function joinMessages(...values) {
+	return values.filter((value) => typeof value === "string" && value.length > 0).join("\n");
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Render a portable policy prompt using the native Cursor event contract. */
+function toCursorResponse(prompt, eventName) {
+	const contract = cursorEventContract(eventName);
+	const message = formatPrompt(prompt);
+	if (!contract.known || contract.response === "neutral" || contract.response === "plugin-paths") return "{}";
+	if (contract.response === "post-context" || contract.response === "session-context") return JSON.stringify({ additional_context: message });
+	if (contract.response === "followup") return JSON.stringify({ followup_message: message });
+	if (contract.response === "compact-notice") return JSON.stringify({ user_message: prompt.userMessage ?? message });
+	if (contract.response === "submit-control") return JSON.stringify({
+		continue: prompt.kind !== "block",
+		user_message: prompt.userMessage ?? message
+	});
+	if (prompt.kind === "inform") return JSON.stringify({
+		permission: "allow",
+		...permissionMessages(eventName, prompt.userMessage, prompt.reason ? message : void 0)
+	});
+	const userMessage = prompt.kind === "ask" ? `[downgraded from ask — Cursor does not enforce approval for this event]\n${message}` : message;
+	return JSON.stringify({
+		permission: "deny",
+		...permissionMessages(eventName, userMessage, userMessage)
+	});
+}
+/** Convert a shared lifecycle handler's output to the native Cursor envelope. */
+function toCursorLifecycleResponse(stdout, eventName) {
+	const contract = cursorEventContract(eventName);
+	const native = parseNativeCursorStdout(stdout, eventName);
+	if (native !== null) return native;
+	let text = stdout;
+	let decision;
+	let userMessage = "";
+	let agentMessage = "";
+	let decisionMessage = "";
+	let structured = false;
+	try {
+		const parsed = JSON.parse(stdout);
+		const subagentAsk = eventName === "subagentStart" && isRecord(parsed) && Object.hasOwn(parsed, "permission") && parsed.permission === "ask";
+		const shared = isRecord(parsed) ? parsed : {};
+		structured = true;
+		decision = shared.hookSpecificOutput?.permissionDecision ?? (subagentAsk ? "ask" : void 0);
+		userMessage = shared.systemMessage ?? (subagentAsk && Object.hasOwn(shared, "user_message") && typeof shared.user_message === "string" ? shared.user_message : "");
+		decisionMessage = joinMessages(shared.hookSpecificOutput?.permissionDecisionReason, shared.reason);
+		agentMessage = joinMessages(shared.hookSpecificOutput?.additionalContext, decisionMessage);
+		text = joinMessages(agentMessage, userMessage, shared.followup_message);
+	} catch {
+		text = stdout;
+	}
+	if (contract.response === "neutral") return "{}";
+	if (!text) return contract.response === "permission" ? "{\"permission\":\"allow\"}" : "{}";
+	if (contract.response === "session-context" || contract.response === "post-context") return JSON.stringify({ additional_context: text });
+	if (contract.response === "permission") {
+		const permission = decision === "deny" || decision === "ask" ? "deny" : "allow";
+		const denied = permission === "deny";
+		if (eventName === "subagentStart" && !denied) return "{\"permission\":\"allow\"}";
+		return JSON.stringify({
+			permission,
+			...permissionMessages(eventName, userMessage || (denied ? decisionMessage || agentMessage : ""), agentMessage || (denied ? decisionMessage || userMessage : structured ? "" : text))
+		});
+	}
+	if (contract.response === "followup") return JSON.stringify({ followup_message: text });
+	if (contract.response === "compact-notice") return JSON.stringify({ user_message: text });
+	if (contract.response === "submit-control") return JSON.stringify({
+		continue: true,
+		user_message: text
+	});
+	return "{}";
+}
+//#endregion
 //#region src/runtime/lifecycle-bridge.ts
 /** Raw event name from a payload (Cline lacks one; lifecycle is Claude-only). */
 function rawEvent(payload) {
 	return typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
 }
 /** Extract the `additionalContext` body from a `contextResponse(...)` stdout string ("" when empty/unparseable). */
-function additionalContextOf(stdout) {
+function additionalContextOf$1(stdout) {
 	if (!stdout) return "";
 	try {
 		return JSON.parse(stdout).hookSpecificOutput?.additionalContext ?? "";
@@ -6653,14 +6949,30 @@ function additionalContextOf(stdout) {
 * @returns The native stdout, or `null` when unhandled.
 */
 function lifecycleStdout(payload, cwd, scope, now, id = "claude-code") {
-	return dispatchLifecycle({
-		event: rawEvent(payload),
+	const wireEvent = rawEvent(payload);
+	if (id !== "cursor") return dispatchLifecycle({
+		event: wireEvent,
 		payload,
 		cwd,
 		scope,
 		now,
 		id
 	});
+	const lifecycleEvent = cursorEventContract(wireEvent).lifecycle;
+	if (lifecycleEvent === null) return null;
+	const sessionId = typeof payload.session_id === "string" ? payload.session_id : payload.conversation_id;
+	const stdout = dispatchLifecycle({
+		event: lifecycleEvent,
+		payload: {
+			...payload,
+			session_id: sessionId
+		},
+		cwd,
+		scope,
+		now,
+		id
+	});
+	return stdout === null ? null : toCursorLifecycleResponse(stdout, wireEvent);
 }
 /**
 * Post-edit additions for core-scope PostToolUse: auto-document a Read of a
@@ -6682,7 +6994,7 @@ async function postEditContext(scope, event, now, id = "claude-code") {
 	const sniper = trackSessionChanges(event.sessionId, event.filePath, void 0, now);
 	const lint = postEditTypescript(event.filePath);
 	if (!sniper || !lint) return sniper || lint;
-	return contextResponse("PostToolUse", `${additionalContextOf(sniper)}\n\n${additionalContextOf(lint)}`);
+	return contextResponse("PostToolUse", `${additionalContextOf$1(sniper)}\n\n${additionalContextOf$1(lint)}`);
 }
 //#endregion
 //#region src/policy/trivial-edits.ts
@@ -7674,11 +7986,37 @@ const TRIVIAL_BUDGET = 4;
 * {@link withDenyLoop} rewrite an identical retried deny (decision unchanged).
 */
 async function gate(input) {
-	const prompt = await runGates(input);
+	return finalizeGate(input, await runGates(input), input.command);
+}
+/**
+* Gate independent Cursor command candidates without merging their shell syntax.
+* Stateful outcome bookkeeping runs once, against the command that decided the
+* aggregate result. A single distinct candidate follows {@link gate} verbatim.
+*/
+async function gateCommandCandidates(input, candidates) {
+	const distinct = [...new Set(candidates)];
+	if (distinct.length <= 1) return gate(input);
+	let decisive;
+	for (const command of distinct) {
+		const prompt = await runGates({
+			...input,
+			command
+		});
+		if (!prompt) continue;
+		if (!decisive || promptRank(prompt) > promptRank(decisive.prompt)) decisive = {
+			prompt,
+			command
+		};
+		if (prompt.kind === "block") break;
+	}
+	return finalizeGate(input, decisive?.prompt ?? null, decisive?.command ?? input.command);
+}
+/** Persist one final gate outcome and apply deny-loop enrichment exactly once. */
+function finalizeGate(input, prompt, command) {
 	const op = {
 		filePath: input.filePath,
 		content: input.content,
-		command: input.command
+		command
 	};
 	const dir = dirname(input.trackFile);
 	recordOneShot(prompt, op, {
@@ -7693,6 +8031,10 @@ async function gate(input) {
 		sessionId: input.sessionId
 	});
 }
+/** Higher numeric values dominate while equal values preserve wire order. */
+function promptRank(prompt) {
+	return prompt.kind === "block" ? 3 : prompt.kind === "ask" ? 2 : 1;
+}
 /** Stateless guards, then the trivial fast path, then the stateful APEX gates. */
 async function runGates(input) {
 	const precommit = preCommitGate(input.tool, input.command, input.cwd);
@@ -7880,8 +8222,8 @@ async function recordActivity(file, activity) {
 * - gemini-cli/cline: their real hook schemas have no interactive "ask"
 *   state (deny is the only blocking outcome), so `ask` and `inform` already
 *   both resolve to non-blocking context injection — unchanged.
-* - cursor: `ask` keeps its current best-effort `permission:"ask"` shape;
-*   only `inform` is fixed to a non-blocking `permission:"allow"` note.
+* - cursor: `ask` degrades to a native `permission:"deny"` because Cursor does
+*   not reliably apply `ask` on `preToolUse`; `inform` stays non-blocking.
 * - hermes: delegated to the adapter's `toHermesResponse` — `block` ->
 *   `{decision:"block",reason}`; `ask`/`inform` degrade to non-blocking
 *   `{context}` (Hermes has no interactive "ask" state).
@@ -7935,25 +8277,7 @@ function respond(id, prompt, event = "PreToolUse") {
 				systemMessage: userMessage
 			});
 			return JSON.stringify({ hookSpecificOutput: { additionalContext: message } });
-		case "cursor":
-			if (kind === "inform") {
-				if (userMessage) return JSON.stringify({
-					permission: "allow",
-					user_message: userMessage,
-					...reason ? { agent_message: message } : {}
-				});
-				return JSON.stringify({
-					permission: "allow",
-					user_message: message,
-					agent_message: message
-				});
-			}
-			return JSON.stringify({
-				permission: kind === "block" ? "deny" : "ask",
-				continue: false,
-				user_message: message,
-				agent_message: message
-			});
+		case "cursor": return toCursorResponse(prompt, event === "PreToolUse" ? "preToolUse" : event);
 		case "hermes": return toHermesResponse(prompt);
 		case "kimi": return toKimiResponse(prompt);
 		case "cline":
@@ -8638,8 +8962,8 @@ function segments(command) {
 }
 /** Strip a redirection (`>`, `>>`, `<`, `2>`, `&>`, …) and everything after — its target is WRITTEN, not read. */
 function beforeRedirect(segment) {
-	const m = segment.match(/\s(?:\d*>{1,2}|<|&>)\s*\S/);
-	return m ? segment.slice(0, m.index) : segment;
+	const first = shellOutputRedirects(segment)[0];
+	return first ? segment.slice(0, first.start) : segment;
 }
 /** Naive shell tokenizer: whitespace-split, stripping one matching layer of quotes per token. */
 function tokenize(segment) {
@@ -9135,7 +9459,7 @@ async function allowOutcome(id, event, payload, mcpDir, cwd, evidence, corpusRoo
 			stdout: respond(id, userMessage ? {
 				...lesson,
 				userMessage
-			} : lesson),
+			} : lesson, event.eventName ?? "PreToolUse"),
 			exit: 0
 		};
 	}
@@ -9150,12 +9474,12 @@ async function allowOutcome(id, event, payload, mcpDir, cwd, evidence, corpusRoo
 				title: "APEX freshness",
 				reason: "",
 				userMessage
-			}),
+			}, event.eventName ?? "PreToolUse"),
 			exit: 0
 		};
 	}
 	return {
-		stdout: notice ? respond(id, notice) : "",
+		stdout: notice ? respond(id, notice, event.eventName ?? "PreToolUse") : "",
 		exit: 0
 	};
 }
@@ -9296,7 +9620,7 @@ function getPendingDeny(sessionIdRaw, home = homedir()) {
 //#endregion
 //#region src/runtime/confirm/confirm-state.ts
 /** Confirmation freshness window (G2) — 5 minutes, matches the validated prototype. */
-const TTL_MS = 300 * 1e3;
+const TTL_MS$1 = 300 * 1e3;
 /**
 * Pose a confirmation token for this session's pending action. No-op while
 * {@link isSubagentActive} (G0, confirm-subagent.ts) — the sole gate that
@@ -9336,7 +9660,7 @@ function consumeConfirmToken(sessionIdRaw, hash, now, home = homedir()) {
 	if (!sid) return false;
 	const tok = loadSessionState(sid, home).confirmToken;
 	if (!tok || tok.hash !== hash) return false;
-	if (now - tok.ts > TTL_MS) {
+	if (now - tok.ts > TTL_MS$1) {
 		dropConfirmToken(sid, home);
 		return false;
 	}
@@ -9344,6 +9668,141 @@ function consumeConfirmToken(sessionIdRaw, hash, now, home = homedir()) {
 	return true;
 }
 //#endregion
+//#region src/runtime/confirm/codex-confirm.ts
+const TTL_MS = 300 * 1e3;
+const STATE_VERSION = 1;
+function statePath(sid, home) {
+	return join(sessionsDir(home), `codex-confirm-${sid}.json`);
+}
+function lockDir(sid, home) {
+	return join(sessionsDir(home), ".confirm-locks", sid);
+}
+function loadState(sid, home) {
+	const path = statePath(sid, home);
+	if (!existsSync(path)) return {};
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+function saveState(sid, state, home) {
+	mkdirSync(sessionsDir(home), {
+		recursive: true,
+		mode: 448
+	});
+	atomicWrite(statePath(sid, home), JSON.stringify(state, null, 2));
+}
+/** Canonical identity of one Codex shell action and its display token. */
+function codexAction(tool, cwd, command, now) {
+	const canonicalCommand = commandToString(command);
+	if (!canonicalCommand) return null;
+	const identity = JSON.stringify({
+		version: STATE_VERSION,
+		harness: "codex",
+		tool,
+		cwd: resolve(cwd),
+		command: canonicalCommand
+	});
+	return {
+		hash: hashForAction(identity),
+		code: displayCodeForAction(identity),
+		command: canonicalCommand,
+		ts: now
+	};
+}
+/** Atomically authorize or reject a Codex action, recording the current denial when needed. */
+function authorizeCodexAction(sessionIdRaw, action, toolUseId, now, home = homedir()) {
+	const sid = sanitizeSessionId(sessionIdRaw);
+	if (!sid) return {
+		allow: false,
+		reason: "state-io"
+	};
+	try {
+		const result = withTrackLockSync(lockDir(sid, home), () => {
+			const state = loadState(sid, home);
+			const token = state.codexConfirmToken;
+			const receipt = state.codexConfirmReceipt;
+			const receiptExpired = receipt !== void 0 && now - receipt.ts > TTL_MS;
+			if (!receiptExpired && receipt?.hash === action.hash && receipt.toolUseId === toolUseId && toolUseId) return { allow: true };
+			let reason = "no-token";
+			if (token) if (token.hash !== action.hash) reason = "mismatch";
+			else if (now - token.ts > TTL_MS) reason = "expired";
+			else if (!toolUseId) reason = "missing-tool-use-id";
+			else {
+				const { codexConfirmToken: _token, codexConfirmPending: _pending, ...rest } = state;
+				saveState(sid, {
+					...rest,
+					codexConfirmReceipt: {
+						...action,
+						toolUseId
+					}
+				}, home);
+				return { allow: true };
+			}
+			else if (receipt?.hash === action.hash) reason = receiptExpired ? "expired" : "already-consumed";
+			if (reason === "missing-tool-use-id") return {
+				allow: false,
+				reason
+			};
+			const pending = state.codexConfirmPending;
+			const stablePending = pending?.hash === action.hash ? pending : action;
+			const { codexConfirmToken: _token, codexConfirmReceipt: _receipt, ...withoutReceipt } = state;
+			const rest = receiptExpired ? withoutReceipt : {
+				...withoutReceipt,
+				codexConfirmReceipt: receipt
+			};
+			saveState(sid, {
+				...rest,
+				codexConfirmPending: stablePending
+			}, home);
+			return {
+				allow: false,
+				reason
+			};
+		});
+		return result === LOCK_FAILED ? {
+			allow: false,
+			reason: "state-io"
+		} : result;
+	} catch {
+		return {
+			allow: false,
+			reason: "state-io"
+		};
+	}
+}
+/**
+* Atomically arm the last Codex denial, consuming its pending record exactly once.
+* A classified root prompt may bypass G0; classified subagent/unknown prompts fail closed.
+*/
+function submitCodexConfirmation(sessionIdRaw, text, now, home = homedir(), origin) {
+	const sid = sanitizeSessionId(sessionIdRaw);
+	if (!sid) return;
+	const refusal = /\b(non|no|stop|annule|cancel|abort|nope|laisse tomber|pas maintenant)\b/i.test(text);
+	const typedCode = text.trim().match(/^confirm[ _-]*([0-9a-f]{4})$/i)?.[1];
+	try {
+		withTrackLockSync(lockDir(sid, home), () => {
+			const state = loadState(sid, home);
+			if (origin !== void 0 && origin !== "root") return;
+			if (refusal) {
+				const { codexConfirmPending: _pending, codexConfirmToken: _token, ...rest } = state;
+				saveState(sid, rest, home);
+				return;
+			}
+			if (!typedCode) return;
+			if (origin === void 0 && isSubagentActive(sid, now, home)) return;
+			const pending = state.codexConfirmPending;
+			if (!pending || pending.code.toLowerCase() !== typedCode.toLowerCase()) return;
+			const { codexConfirmPending: _pending, ...rest } = state;
+			saveState(sid, {
+				...rest,
+				codexConfirmToken: {
+					...pending,
+					ts: now
+				}
+			}, home);
+		});
+	} catch {}
+}
+//#endregion
 //#region src/runtime/confirm/confirm-gate.ts
 /**
 * Harnesses where `respond.ts` silently downgrades `kind: "ask"` to a hard
@@ -9367,9 +9826,23 @@ const DEGRADES_ASK_TO_DENY = /* @__PURE__ */ new Set(["codex", "kimi"]);
 * @param now - Epoch ms.
 * @param home - Test-only OS home override.
 */
-function confirmGate(id, prompt, command, sessionId, now, home) {
+function confirmGate(id, prompt, command, sessionId, now, home, codex) {
 	if (prompt.kind !== "ask" || !DEGRADES_ASK_TO_DENY.has(id) || !command || isIrreversible(command)) return null;
 	try {
+		if (id === "codex" && codex) {
+			const action = codexAction(codex.tool, codex.cwd, command, now);
+			if (!action) return null;
+			const verdict = authorizeCodexAction(sessionId, action, codex.toolUseId, now, home);
+			if (verdict.allow) return verdict;
+			const diagnostic = `rule ID: ${prompt.ruleId ?? "policy:ask"}\ncanonical command: ${action.command}\nexpected token: CONFIRM ${action.code}\nrejection: ${verdict.reason}`;
+			return {
+				allow: false,
+				prompt: {
+					...prompt,
+					reason: `${prompt.reason}\nPour autoriser, réponds : CONFIRM ${action.code}\n${diagnostic}`
+				}
+			};
+		}
 		const hash = hashForAction(command);
 		if (consumeConfirmToken(sessionId, hash, now, home)) return { allow: true };
 		const code = displayCodeForAction(command);
@@ -9410,9 +9883,19 @@ async function handlePre(ctx) {
 	}
 	const designBlock = designGate(payload, event, designCacheDir, opts.cwd, opts.corpusRoot);
 	if (designBlock) return {
-		stdout: withDenyNotice(id, respond(id, designBlock), designBlock, event.sessionId, dirname(file), opts.now),
+		stdout: withDenyNotice(id, respond(id, designBlock, event.eventName ?? "PreToolUse"), designBlock, event.sessionId, dirname(file), opts.now),
 		exit: 0
 	};
+	if (id === "cursor" && (event.eventName === "beforeReadFile" || event.eventName === "beforeTabFileRead")) {
+		const readPolicy = evaluate({
+			tool: event.tool,
+			filePath: event.filePath
+		});
+		return {
+			stdout: readPolicy.prompt ? respond(id, readPolicy.prompt, event.eventName) : JSON.stringify({ permission: "allow" }),
+			exit: 0
+		};
+	}
 	if (opts.scope === "security") return {
 		stdout: event.files?.length ? securityAdvisoryForPatch(event.files, opts.now) : securityAdvisory(event.tool, event.filePath ?? "", opts.now),
 		exit: 0
@@ -9428,11 +9911,12 @@ async function handlePre(ctx) {
 	if (event.files && event.files.length > 0) {
 		const patchPrompt = applyPatchGate(event.files, opts.cwd);
 		if (patchPrompt) return {
-			stdout: withDenyNotice(id, respond(id, patchPrompt), patchPrompt, event.sessionId, dirname(file), opts.now),
+			stdout: withDenyNotice(id, respond(id, patchPrompt, event.eventName ?? "PreToolUse"), patchPrompt, event.sessionId, dirname(file), opts.now),
 			exit: 0
 		};
 	}
-	const prompt = await gate({
+	const refs = opts.refsDir ? await loadRefs(opts.refsDir) : void 0;
+	const gateInput = {
 		sessionId: event.sessionId,
 		framework,
 		tool: event.tool,
@@ -9440,7 +9924,7 @@ async function handlePre(ctx) {
 		content: event.content,
 		command: event.command,
 		cwd: opts.cwd,
-		refs: opts.refsDir ? await loadRefs(opts.refsDir) : void 0,
+		refs,
 		isReplaceAll: event.input.replace_all === true,
 		oldString: event.oldString,
 		agentType: event.agentType,
@@ -9450,9 +9934,14 @@ async function handlePre(ctx) {
 		trackFile: file,
 		transcriptPath: typeof payload.transcript_path === "string" ? payload.transcript_path : void 0,
 		neverApproval: id === "codex" && isBypassPermissions(event.permissionMode)
-	});
+	};
+	const prompt = id === "cursor" && (event.commandCandidates?.length ?? 0) > 1 ? await gateCommandCandidates(gateInput, event.commandCandidates) : await gate(gateInput);
 	if (prompt) {
-		const confirm = confirmGate(id, prompt, event.command, event.sessionId, opts.now, opts.home);
+		const confirm = confirmGate(id, prompt, event.command, event.sessionId, opts.now, opts.home, id === "codex" ? {
+			tool: event.tool,
+			cwd: event.cwd ?? opts.cwd,
+			toolUseId: event.toolUseId
+		} : void 0);
 		if (confirm?.allow) return allowOutcome(id, event, payload, designCacheDir, opts.cwd, {
 			trackFile: file,
 			windowMs: opts.windowMs,
@@ -9460,7 +9949,7 @@ async function handlePre(ctx) {
 		}, opts.corpusRoot);
 		const finalPrompt = confirm ? confirm.prompt : prompt;
 		return {
-			stdout: withDenyNotice(id, respond(id, finalPrompt), finalPrompt, event.sessionId, dirname(file), opts.now),
+			stdout: withDenyNotice(id, respond(id, finalPrompt, event.eventName ?? "PreToolUse"), finalPrompt, event.sessionId, dirname(file), opts.now),
 			exit: 0
 		};
 	}
@@ -9827,14 +10316,14 @@ function recordCodexPostFailure(tool, result, opts) {
 //#endregion
 //#region src/runtime/post-fanout.ts
 /**
-* Fan a Codex `apply_patch` envelope's `event.files` into one synthetic
+* Fan Codex `apply_patch` or Cursor `afterFileEdit` `event.files` into one
 * per-file event per touched file, so the per-file PostToolUse gates (SOLID
 * size, Tailwind, tracking, post-edit context) see EACH file instead of the
 * whole patch (whose own `filePath`/`content` are always undefined). `add`
 * maps to `Write`, `update` to `Edit` (mirrors the Pre-phase `applyPatchGate`'s
 * tool mapping); `delete`/`move` map to a tool none of those Write|Edit-gated
 * checks recognize, so they no-op on it without special-casing each gate.
-* Returns `[event]` unchanged for every non-`apply_patch` tool/harness.
+* Returns `[event]` unchanged when no per-file changes are present.
 * @param event - The normalized PostToolUse event.
 * @returns One event per touched file, or the original event.
 */
@@ -9844,7 +10333,8 @@ function fanOutFiles(event) {
 		...event,
 		tool: f.op === "add" ? "Write" : f.op === "update" ? "Edit" : "apply_patch:delete",
 		filePath: f.filePath,
-		content: f.op === "delete" ? void 0 : f.content
+		content: f.op === "delete" ? void 0 : f.content,
+		oldString: f.oldString
 	}));
 }
 /**
@@ -9864,7 +10354,106 @@ function firstFileMatch(files, check) {
 	return "";
 }
 //#endregion
+//#region src/runtime/post-outcome.ts
+/** Extract the additional-context body from a Claude-shaped post response. */
+function additionalContextOf(stdout) {
+	if (!stdout) return "";
+	try {
+		return JSON.parse(stdout).hookSpecificOutput?.additionalContext ?? "";
+	} catch {
+		return "";
+	}
+}
+function cursorPostToolOutput(eventName, designWarn, userMessage, extra) {
+	if (!/^postToolUse$/i.test(eventName)) return "";
+	const context = [
+		designWarn ? formatPrompt(designWarn) : "",
+		designWarn?.userMessage,
+		userMessage,
+		additionalContextOf(extra)
+	].filter(Boolean).join("\n");
+	return context ? JSON.stringify({ additional_context: context }) : "";
+}
+/**
+* Assemble the final PostToolUse response after all side effects and deny paths.
+* @param input - Final assembly values captured at their original evaluation times.
+* @returns The native hook outcome.
+*/
+function postOutcome(input) {
+	const { id, agentId, sessionId, now, cwd, activities, files, designCacheDir, designWarn, extra, cursorAfterFileEdit, cursorEventName } = input;
+	const noticeLines = [];
+	for (const f of files) {
+		const notice = designPassNotice({
+			agentId,
+			tool: f.tool,
+			filePath: f.filePath ?? "",
+			content: f.content ?? "",
+			url: "",
+			phase: "post"
+		}, designCacheDir);
+		if (notice?.userMessage) noticeLines.push(notice.userMessage);
+	}
+	const notice = noticeLines.length ? {
+		kind: "inform",
+		title: "Design pipeline",
+		reason: "",
+		userMessage: noticeLines.join("\n")
+	} : null;
+	const refNotice = refCreditNoticeFor(activities, sessionId, now, defaultStateDir(cwd));
+	const userMessage = [notice?.userMessage, refNotice].filter(Boolean).join("\n") || void 0;
+	if (cursorAfterFileEdit) return {
+		stdout: "{}",
+		exit: 0
+	};
+	if (id === "cursor") return {
+		stdout: cursorPostToolOutput(cursorEventName, designWarn, userMessage, extra),
+		exit: 0
+	};
+	if (designWarn) return {
+		stdout: respond(id, userMessage ? {
+			...designWarn,
+			userMessage
+		} : designWarn, "PostToolUse"),
+		exit: 0
+	};
+	if (!userMessage) return {
+		stdout: extra,
+		exit: 0
+	};
+	const withUserMessage = notice ? {
+		...notice,
+		userMessage
+	} : {
+		kind: "inform",
+		title: "Compliance",
+		reason: "",
+		userMessage
+	};
+	if (!extra) return {
+		stdout: respond(id, withUserMessage, "PostToolUse"),
+		exit: 0
+	};
+	if (id === "claude-code" || id === "codex") return {
+		stdout: attachSystemMessage(extra, userMessage),
+		exit: 0
+	};
+	if (id === "kimi") return {
+		stdout: respond(id, withUserMessage, "PostToolUse"),
+		exit: 0
+	};
+	return {
+		stdout: respond(id, withUserMessage, "PostToolUse") || extra,
+		exit: 0
+	};
+}
+//#endregion
 //#region src/runtime/handle-post.ts
+function isCursorAfterFileEdit(id, payload) {
+	if (id !== "cursor") return false;
+	const hookEvent = typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
+	if (hookEvent) return /^afterFileEdit$/i.test(hookEvent);
+	return typeof payload.file_path === "string" && Array.isArray(payload.edits);
+}
 /**
 * Run the PostToolUse pipeline: store the MCP response, emit a design warning,
 * record the activity into the session track, apply per-scope side-effects (SEO
@@ -9887,8 +10476,14 @@ function firstFileMatch(files, check) {
 */
 async function handlePost(ctx) {
 	const { id, payload, event, framework, mcpDir, file, opts } = ctx;
+	const cursorAfterFileEdit = isCursorAfterFileEdit(id, payload);
 	const designCacheDir = ctx.designCacheDir ?? mcpDir;
-	const response = payload.tool_response ?? payload.tool_output;
+	let response = payload.tool_response ?? payload.tool_output;
+	if (id === "cursor" && /^afterMCPExecution$/i.test(event.eventName ?? "")) try {
+		response = typeof payload.result_json === "string" ? JSON.parse(payload.result_json) : payload.result_json;
+	} catch {
+		response = void 0;
+	}
 	mcpPostStore(event.tool, event.input, response, mcpDir);
 	const designWarn = designGate(payload, event, designCacheDir, opts.cwd, opts.corpusRoot);
 	const activities = activityFor({
@@ -9912,27 +10507,27 @@ async function handlePost(ctx) {
 	const files = fanOutFiles(event);
 	for (const f of files) postTrackingSideEffects(opts.scope ?? "core", f, f.input, opts.now, payload, opts.cwd);
 	const seoDeny = opts.scope === "seo" ? seoPostToolUseResponse(payload) : null;
-	if (seoDeny) return {
+	if (seoDeny && !cursorAfterFileEdit) return {
 		stdout: seoDeny,
 		exit: 0
 	};
 	if (opts.scope === "solid") {
 		const solidWarn = firstFileMatch(files, checkFileSize);
-		if (solidWarn) return {
+		if (solidWarn && !cursorAfterFileEdit) return {
 			stdout: solidWarn,
 			exit: 0
 		};
 	}
 	if (opts.scope === "tailwindcss") {
 		const tailwindWarn = firstFileMatch(files, validateTailwind);
-		if (tailwindWarn) return {
+		if (tailwindWarn && !cursorAfterFileEdit) return {
 			stdout: tailwindWarn,
 			exit: 0
 		};
 	}
 	if (opts.scope === "aipilot" && (event.tool === "TaskCreate" || event.tool === "TaskUpdate" || event.tool === "Write" || event.tool === "Edit")) {
 		const out = await aipilotPostToolUse(payload, opts.cwd, id);
-		if (out) return {
+		if (out && !cursorAfterFileEdit) return {
 			stdout: out,
 			exit: 0
 		};
@@ -9942,63 +10537,20 @@ async function handlePost(ctx) {
 		extra = await postEditContext(opts.scope ?? "core", f, opts.now, id);
 		if (extra) break;
 	}
-	const agentId = typeof payload.agent_id === "string" ? payload.agent_id : "";
-	const noticeLines = [];
-	for (const f of files) {
-		const n = designPassNotice({
-			agentId,
-			tool: f.tool,
-			filePath: f.filePath ?? "",
-			content: f.content ?? "",
-			url: "",
-			phase: "post"
-		}, designCacheDir);
-		if (n?.userMessage) noticeLines.push(n.userMessage);
-	}
-	const notice = noticeLines.length ? {
-		kind: "inform",
-		title: "Design pipeline",
-		reason: "",
-		userMessage: noticeLines.join("\n")
-	} : null;
-	const refNotice = refCreditNoticeFor(activities, event.sessionId, opts.now, defaultStateDir(opts.cwd));
-	const userMessage = [notice?.userMessage, refNotice].filter(Boolean).join("\n") || void 0;
-	if (designWarn) return {
-		stdout: respond(id, userMessage ? {
-			...designWarn,
-			userMessage
-		} : designWarn, "PostToolUse"),
-		exit: 0
-	};
-	if (!userMessage) return {
-		stdout: extra,
-		exit: 0
-	};
-	const withUserMessage = notice ? {
-		...notice,
-		userMessage
-	} : {
-		kind: "inform",
-		title: "Compliance",
-		reason: "",
-		userMessage
-	};
-	if (!extra) return {
-		stdout: respond(id, withUserMessage, "PostToolUse"),
-		exit: 0
-	};
-	if (id === "claude-code" || id === "codex") return {
-		stdout: attachSystemMessage(extra, userMessage),
-		exit: 0
-	};
-	if (id === "kimi") return {
-		stdout: respond(id, withUserMessage, "PostToolUse"),
-		exit: 0
-	};
-	return {
-		stdout: respond(id, withUserMessage, "PostToolUse") || extra,
-		exit: 0
-	};
+	return postOutcome({
+		id,
+		agentId: typeof payload.agent_id === "string" ? payload.agent_id : "",
+		sessionId: event.sessionId,
+		now: opts.now,
+		cwd: opts.cwd,
+		activities,
+		files,
+		designCacheDir,
+		designWarn,
+		extra,
+		cursorAfterFileEdit,
+		cursorEventName: typeof payload.hook_event_name === "string" ? payload.hook_event_name : ""
+	});
 }
 //#endregion
 //#region src/runtime/handle-scope-async.ts
@@ -10018,9 +10570,12 @@ async function handlePost(ctx) {
 * @returns The native stdout when intercepted, or `null` to fall through.
 */
 async function asyncScopeStdout(scope, event, payload, cwd, now, id = "claude-code") {
-	if (scope === "aipilot") return dispatchAipilot(event, payload, cwd, now, void 0, id);
-	if (scope === "memory") return dispatchMemory(event, payload, cwd, now);
-	return null;
+	const dispatchedEvent = id === "cursor" ? cursorEventContract(event).lifecycle : event;
+	if (dispatchedEvent === null) return null;
+	let stdout = null;
+	if (scope === "aipilot") stdout = await dispatchAipilot(dispatchedEvent, payload, cwd, now, void 0, id);
+	if (scope === "memory") stdout = await dispatchMemory(dispatchedEvent, payload, cwd, now);
+	return id === "cursor" && stdout !== null ? toCursorLifecycleResponse(stdout, event) : stdout;
 }
 //#endregion
 //#region src/runtime/design-cache-resolve.ts
@@ -10489,6 +11044,18 @@ function handleConfirmSubmit(sessionId, text, now, home) {
 	} catch {}
 }
 //#endregion
+//#region src/runtime/confirm/codex-prompt-origin.ts
+const AGENT_FIELDS = ["agent_id", "agent_type"];
+/**
+* Classify Codex prompt provenance from its optional agent metadata.
+* Missing metadata is the observed root shape; malformed metadata fails closed.
+*/
+function codexPromptOrigin(payload) {
+	const present = AGENT_FIELDS.filter((field) => Object.hasOwn(payload, field));
+	if (present.length === 0) return "root";
+	return present.every((field) => typeof payload[field] === "string" && payload[field].trim().length > 0) ? "subagent" : "unknown";
+}
+//#endregion
 //#region src/runtime/handle.ts
 /** Raw Claude hook event name from a payload (empty when absent). */
 function rawEventName(payload) {
@@ -10500,8 +11067,18 @@ function rawEventName(payload) {
 * POST event it records the activity into the track. The loop that makes the
 * package behave like the Claude plugin, on any harness.
 */
-async function handleHook(id, payload, opts) {
+async function handleHookCore(id, payload, opts) {
 	const event = normalizeEvent(id, payload);
+	if (id === "cursor") {
+		const cursorCwd = cursorProjectCwd(event.cwd, event.workspaceRoots ?? [], event.filePath, opts.cwd);
+		if (cursorCwd !== opts.cwd) opts = {
+			...opts,
+			cwd: cursorCwd
+		};
+	}
+	const rawPrompt = payload.prompt;
+	const userPrompt = typeof rawPrompt === "string" || Array.isArray(rawPrompt) ? promptText(rawPrompt) : void 0;
+	if (id === "codex" && rawEventName(payload) === "UserPromptSubmit" && userPrompt !== void 0) submitCodexConfirmation(event.sessionId, userPrompt, opts.now, opts.home, codexPromptOrigin(payload));
 	resetFragmentRegistry();
 	const layout = projectLayout(opts.cwd);
 	const file = trackFile(event.sessionId, defaultStateDir(opts.cwd));
@@ -10523,10 +11100,8 @@ async function handleHook(id, payload, opts) {
 		stdout: id === "claude-code" ? attachBudgetRecap(life, rawEventName(payload), event.sessionId, opts.cwd, opts.now) : life,
 		exit: 0
 	};
-	const rawPrompt = payload.prompt;
-	const userPrompt = typeof rawPrompt === "string" || Array.isArray(rawPrompt) ? promptText(rawPrompt) : void 0;
 	if (userPrompt !== void 0) {
-		handleConfirmSubmit(event.sessionId, userPrompt, opts.now, opts.home);
+		if (id !== "codex") handleConfirmSubmit(event.sessionId, userPrompt, opts.now, opts.home);
 		await withTrack(file, (track) => recordBrainstormRequired(track, detectCreationIntent(userPrompt)));
 		return {
 			stdout: promptSubmitContext(userPrompt, opts.cwd, id),
@@ -10554,5 +11129,17 @@ async function handleHook(id, payload, opts) {
 		opts
 	});
 }
+/**
+* Run one hook and adapt every Cursor scope outcome at the common runtime exit.
+* Other harnesses retain the core handler's stdout and exit status unchanged.
+*/
+async function handleHook(id, payload, opts) {
+	const outcome = await handleHookCore(id, payload, opts);
+	if (id !== "cursor") return outcome;
+	return {
+		...outcome,
+		stdout: toCursorLifecycleResponse(outcome.stdout, rawEventName(payload))
+	};
+}
 //#endregion
-export { runningVersion as $, trackMcpResearch as A, defaultStateDir as At, generateProjectMap as B, seoPostToolUse as C, trimLogFile as Ct, securityAdvisoryForPatch as D, claudeMdKey as Dt, securityAdvisory as E, projectContext as Et, dispatchAipilot as F, loadSecurityState as Ft, countFiles as G, writeTree as H, dispatchLessons as I, saveSecurityState as It, lessonsArchiveFileFor as J, getFileDesc as K, cartoSessionStart as L, securityStateDir as Lt, trackEnrichment as M, trackFile as Mt, dispatchLifecycle as N, normalizeEvent as Nt, postTrackingSideEffects as O, promptSubmitContext as Ot, aipilotPostToolUse as P, isoUtc as Pt, runDoctor as Q, generateEcosystemMap as R, securityStatePath as Rt, postEditContext as S, removeOldFiles as St, dispatchMemory as T, gitContext as Tt, loadEnriched as U, isProject as V, mergeLines as W, lessonsStateFileFor as X, lessonsFileFor as Y, notify as Z, preCommitGate as _, readRules as _t, recordActivity as a, saveApexState as at, extractSymbols as b, pruneEmptyDirs as bt, MCP_TTL_MS as c, trackAgentMemory as ct, isMcpTool as d, validateSolidGate as dt, versionBanner as et, queryOf as f, checkFileSize as ft, gate as g, injectRules as gt, TRIVIAL_BUDGET as h, solidDetectStart as ht, respond as i, cleanupSession as it, trackSkillRead as j, projectHash$1 as jt, trackWatchResearch as k, taskContext as kt, WEBFETCH_TTL_MS as l, subagentCacheContext as lt, REQUIRED_AGENTS as m, detectSolidProfile as mt, activityFor as n, trackSessionChanges as nt, mcpPostStore as o, logToolFailure as ot, DEFAULT_WINDOW_MS as p, countLoc as pt, listChildren as q, handlePre as r, validateRulesLoaded as rt, mcpPreIntercept as s, validateTeammateOutput as st, handleHook as t, postEditTypescript as tt, cacheQueryOf as u, validateTailwind as ut, detectDuplication as v, runSessionStartCleanups as vt, seoPostToolUseResponse as w, devContext as wt, lifecycleStdout as x, purgeTtlTree as xt, dryGate as y, sessionStartCore as yt, writePluginMap as z, todayUtc as zt };
+export { runDoctor as $, trackWatchResearch as A, taskContext as At, writePluginMap as B, todayUtc as Bt, postEditContext as C, removeOldFiles as Ct, securityAdvisory as D, projectContext as Dt, dispatchMemory as E, gitContext as Et, aipilotPostToolUse as F, isoUtc as Ft, mergeLines as G, isProject as H, dispatchAipilot as I, loadSecurityState as It, listChildren as J, countFiles as K, dispatchLessons as L, saveSecurityState as Lt, trackSkillRead as M, projectHash$1 as Mt, trackEnrichment as N, trackFile as Nt, securityAdvisoryForPatch as O, claudeMdKey as Ot, dispatchLifecycle as P, normalizeEvent as Pt, notify as Q, cartoSessionStart as R, securityStateDir as Rt, lifecycleStdout as S, purgeTtlTree as St, seoPostToolUseResponse as T, devContext as Tt, writeTree as U, generateProjectMap as V, loadEnriched as W, lessonsFileFor as X, lessonsArchiveFileFor as Y, lessonsStateFileFor as Z, gateCommandCandidates as _, injectRules as _t, recordActivity as a, cleanupSession as at, dryGate as b, sessionStartCore as bt, MCP_TTL_MS as c, validateTeammateOutput as ct, isMcpTool as d, validateTailwind as dt, runningVersion as et, queryOf as f, validateSolidGate as ft, gate as g, solidDetectStart as gt, TRIVIAL_BUDGET as h, detectSolidProfile as ht, respond as i, validateRulesLoaded as it, trackMcpResearch as j, defaultStateDir as jt, postTrackingSideEffects as k, promptSubmitContext as kt, WEBFETCH_TTL_MS as l, trackAgentMemory as lt, REQUIRED_AGENTS as m, countLoc as mt, activityFor as n, postEditTypescript as nt, mcpPostStore as o, saveApexState as ot, DEFAULT_WINDOW_MS as p, checkFileSize as pt, getFileDesc as q, handlePre as r, trackSessionChanges as rt, mcpPreIntercept as s, logToolFailure as st, handleHook as t, versionBanner as tt, cacheQueryOf as u, subagentCacheContext as ut, preCommitGate as v, readRules as vt, seoPostToolUse as w, trimLogFile as wt, extractSymbols as x, pruneEmptyDirs as xt, detectDuplication as y, runSessionStartCleanups as yt, generateEcosystemMap as z, securityStatePath as zt };