@geravant/sinain 1.15.5 → 1.18.1

package/cli.js

@@ -4,7 +4,6 @@ import net from "net";
 import os from "os";
 import fs from "fs";
 import path from "path";
-import { writeAgentsConfig } from "./config-shared.js";
 import { checkForUpdate } from "./self-update.js";
 
 const cmd = process.argv[2];
@@ -95,176 +94,6 @@ switch (cmd) {
     break;
 }
 
-// ── Setup wizard (standalone) ─────────────────────────────────────────────────
-
-async function runSetupWizard() {
-  // Force-run the wizard even if .env exists (re-configure)
-  const { setupWizard } = await import("./launcher.js?setup-only");
-  // The wizard is embedded in launcher.js; we import the module dynamically.
-  // Since launcher.js runs main() on import, we instead inline a lightweight version.
-
-  const readline = await import("readline");
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
-
-  const HOME = os.homedir();
-  const SINAIN_DIR = path.join(HOME, ".sinain");
-  const envPath = path.join(SINAIN_DIR, ".env");
-
-  const BOLD = "\x1b[1m";
-  const DIM = "\x1b[2m";
-  const GREEN = "\x1b[32m";
-  const YELLOW = "\x1b[33m";
-  const RESET = "\x1b[0m";
-  const IS_WIN = os.platform() === "win32";
-
-  const cmdExists = (cmd) => {
-    try { import("child_process").then(cp => cp.execSync(`which ${cmd}`, { stdio: "pipe" })); return true; }
-    catch { return false; }
-  };
-  // Synchronous version
-  const { execSync } = await import("child_process");
-  const cmdExistsSync = (cmd) => {
-    try { execSync(`which ${cmd}`, { stdio: "pipe" }); return true; }
-    catch { return false; }
-  };
-
-  if (fs.existsSync(envPath)) {
-    const overwrite = await ask(`  ${envPath} already exists. Overwrite? [y/N]: `);
-    if (overwrite.trim().toLowerCase() !== "y") {
-      console.log("  Aborted.");
-      rl.close();
-      return;
-    }
-  }
-
-  console.log();
-  console.log(`${BOLD}── Sinain Setup Wizard ─────────────────${RESET}`);
-  console.log(`  Configuring ${DIM}~/.sinain/.env${RESET}`);
-  console.log();
-
-  const vars = {};
-
-  // Transcription backend
-  let transcriptionBackend = "openrouter";
-  const hasWhisper = !IS_WIN && cmdExistsSync("whisper-cli");
-
-  if (IS_WIN) {
-    console.log(`  ${DIM}(Local whisper not available on Windows — using OpenRouter)${RESET}`);
-  } else if (hasWhisper) {
-    const choice = await ask(`  Transcription backend? [${BOLD}local${RESET}/cloud]: `);
-    transcriptionBackend = choice.trim().toLowerCase() === "cloud" ? "openrouter" : "local";
-  } else {
-    const install = await ask(`  whisper-cli not found. Install via Homebrew? [Y/n]: `);
-    if (!install.trim() || install.trim().toLowerCase() === "y") {
-      try {
-        execSync("brew install whisper-cpp", { stdio: "inherit" });
-        const modelDir = path.join(HOME, "models");
-        const modelPath = path.join(modelDir, "ggml-large-v3-turbo.bin");
-        if (!fs.existsSync(modelPath)) {
-          console.log(`  ${DIM}Downloading model (~1.5 GB)...${RESET}`);
-          fs.mkdirSync(modelDir, { recursive: true });
-          execSync(`curl -L --progress-bar -o "${modelPath}" "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin"`, { stdio: "inherit" });
-        }
-        transcriptionBackend = "local";
-        vars.LOCAL_WHISPER_MODEL = modelPath;
-      } catch {
-        console.log(`  ${YELLOW}Install failed — falling back to OpenRouter${RESET}`);
-      }
-    }
-  }
-  vars.TRANSCRIPTION_BACKEND = transcriptionBackend;
-
-  // API key
-  if (transcriptionBackend === "openrouter") {
-    const key = await ask(`  OpenRouter API key (sk-or-...): `);
-    if (key.trim()) vars.OPENROUTER_API_KEY = key.trim();
-  } else {
-    const key = await ask(`  OpenRouter API key for vision/OCR (optional): `);
-    if (key.trim()) vars.OPENROUTER_API_KEY = key.trim();
-  }
-
-  // Agent + escalation + gateway → agents.json (not .env). Tokens stay in
-  // .env as secrets, referenced from agents.json via ${VAR} indirection.
-  const agentsPatch = {};
-
-  // Default agent — overlay's chip selector lets the user switch at runtime;
-  // this just sets the boot-time default.
-  const agent = await ask(`  Default agent? [${BOLD}claude${RESET}/openclaude/codex/goose/junie/aider]: `);
-  agentsPatch.default = agent.trim().toLowerCase() || "claude";
-
-  // Escalation mode
-  console.log(`\n  ${DIM}Escalation: off | selective | focus | rich${RESET}`);
-  const esc = await ask(`  Escalation mode? [${BOLD}selective${RESET}]: `);
-  agentsPatch.escalationMode = esc.trim().toLowerCase() || "selective";
-
-  // Gateway — when enabled, writes the openclaw profile to agents.json
-  // (URLs + session) and tokens to .env. There's no transport choice
-  // anymore; picking openclaw vs a local agent in the overlay determines
-  // dispatch (WS vs HTTP).
-  const gw = await ask(`  OpenClaw gateway? [y/N]: `);
-  if (gw.trim().toLowerCase() === "y") {
-    const url = await ask(`  Gateway WS URL [ws://localhost:18789]: `);
-    const wsUrl = url.trim() || "ws://localhost:18789";
-    const token = await ask(`  Auth token (48-char hex): `);
-    if (token.trim()) {
-      vars.OPENCLAW_WS_TOKEN = token.trim();
-      vars.OPENCLAW_HTTP_TOKEN = token.trim();
-    }
-    agentsPatch.openclawProfile = {
-      wsUrl,
-      httpUrl: wsUrl.replace(/^ws/, "http") + "/hooks/agent",
-      wsToken: "${OPENCLAW_WS_TOKEN}",
-      httpToken: "${OPENCLAW_HTTP_TOKEN}",
-      sessionKey: "agent:main:sinain",
-    };
-  } else {
-    // Skip / disable: drop the openclaw profile entirely.
-    agentsPatch.openclawProfile = null;
-    agentsPatch.escalationMode = "off";
-  }
-
-  vars.SINAIN_HEARTBEAT_INTERVAL = "900";
-  vars.PRIVACY_MODE = "standard";
-
-  // Write — start from .env.example template, patch wizard values in
-  fs.mkdirSync(SINAIN_DIR, { recursive: true });
-
-  const PKG_DIR = path.dirname(new URL(import.meta.url).pathname);
-  const examplePath = path.join(PKG_DIR, ".env.example");
-  const siblingExample = path.join(PKG_DIR, "..", ".env.example");
-  let template = "";
-  if (fs.existsSync(examplePath)) {
-    template = fs.readFileSync(examplePath, "utf-8");
-  } else if (fs.existsSync(siblingExample)) {
-    template = fs.readFileSync(siblingExample, "utf-8");
-  }
-
-  if (template) {
-    for (const [k, v] of Object.entries(vars)) {
-      const regex = new RegExp(`^#?\\s*${k}=.*$`, "m");
-      if (regex.test(template)) {
-        template = template.replace(regex, `${k}=${v}`);
-      } else {
-        template += `\n${k}=${v}`;
-      }
-    }
-    template = `# Generated by sinain setup wizard — ${new Date().toISOString()}\n${template}`;
-    fs.writeFileSync(envPath, template);
-  } else {
-    const lines = ["# sinain configuration — generated by setup wizard", `# ${new Date().toISOString()}`, ""];
-    for (const [k, v] of Object.entries(vars)) lines.push(`${k}=${v}`);
-    lines.push("");
-    fs.writeFileSync(envPath, lines.join("\n"));
-  }
-
-  // Patch ~/.sinain/agents.json with the wizard's agent + gateway choices.
-  writeAgentsConfig(agentsPatch);
-
-  rl.close();
-  console.log(`\n  ${GREEN}✓${RESET} Config written to ${envPath} + ~/.sinain/agents.json\n`);
-}
-
 // ── Stop ──────────────────────────────────────────────────────────────────────
 
 async function stopServices() {

package/launcher.js

@@ -8,7 +8,6 @@ import path from "path";
 import os from "os";
 import net from "net";
 import readline from "readline";
-import { writeAgentsConfig, readAgentsConfig } from "./config-shared.js";
 
 // ── Colors ──────────────────────────────────────────────────────────────────
 
@@ -417,303 +416,6 @@ async function ensureOllama() {
   }
 }
 
-// ── Setup wizard ─────────────────────────────────────────────────────────────
-
-async function setupWizard(envPath) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
-
-  // Load existing .env values as defaults (for re-configuration)
-  const existing = {};
-  if (fs.existsSync(envPath)) {
-    for (const line of fs.readFileSync(envPath, "utf-8").split("\n")) {
-      const m = line.match(/^([A-Z_]+)=(.*)$/);
-      if (m) existing[m[1]] = m[2];
-    }
-  }
-  const hasExisting = Object.keys(existing).length > 0;
-
-  console.log();
-  console.log(`${BOLD}── ${hasExisting ? "Re-configure" : "First-time setup"} ────────────────────${RESET}`);
-  console.log(`  Configuring ${DIM}~/.sinain/.env${RESET}`);
-  if (hasExisting) console.log(`  ${DIM}Press Enter to keep current values shown in [brackets]${RESET}`);
-  console.log();
-
-  const vars = {};
-
-  // 1. Transcription backend — auto-detect whisper-cli
-  let transcriptionBackend = "openrouter";
-  const hasWhisper = !IS_WINDOWS && commandExists("whisper-cli");
-
-  if (IS_WINDOWS) {
-    console.log(`  ${DIM}(Local whisper not available on Windows — using OpenRouter)${RESET}`);
-  } else if (hasWhisper) {
-    const choice = await ask(`  Transcription backend? [${BOLD}local${RESET}/cloud] (local = whisper-cli, no API key): `);
-    if (choice.trim().toLowerCase() === "cloud") {
-      transcriptionBackend = "openrouter";
-    } else {
-      transcriptionBackend = "local";
-    }
-  } else {
-    const installWhisper = await ask(`  whisper-cli not found. Install via Homebrew? [Y/n]: `);
-    if (!installWhisper.trim() || installWhisper.trim().toLowerCase() === "y") {
-      try {
-        console.log(`  ${DIM}Installing whisper-cpp...${RESET}`);
-        execSync("brew install whisper-cpp", { stdio: "inherit" });
-
-        // Download model
-        const modelDir = path.join(HOME, "models");
-        const modelPath = path.join(modelDir, "ggml-large-v3-turbo.bin");
-        if (!fs.existsSync(modelPath)) {
-          console.log(`  ${DIM}Downloading ggml-large-v3-turbo (~1.5 GB)...${RESET}`);
-          fs.mkdirSync(modelDir, { recursive: true });
-          execSync(
-            `curl -L --progress-bar -o "${modelPath}" "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin"`,
-            { stdio: "inherit" }
-          );
-        }
-
-        transcriptionBackend = "local";
-        vars.LOCAL_WHISPER_MODEL = modelPath;
-        ok("whisper-cpp installed");
-      } catch {
-        warn("whisper-cpp install failed — falling back to OpenRouter");
-        transcriptionBackend = "openrouter";
-      }
-    } else {
-      transcriptionBackend = "openrouter";
-    }
-  }
-  vars.TRANSCRIPTION_BACKEND = transcriptionBackend;
-
-  // 2. OpenRouter API key (if cloud backend or for vision/OCR)
-  if (transcriptionBackend === "openrouter") {
-    const existingKey = existing.OPENROUTER_API_KEY;
-    const keyHint = existingKey ? ` [${existingKey.slice(0, 8)}...${existingKey.slice(-4)}]` : "";
-    let key = "";
-    while (!key) {
-      key = await ask(`  OpenRouter API key (sk-or-...)${keyHint}: `);
-      key = key.trim();
-      if (!key && existingKey) { key = existingKey; break; }
-      if (key && !key.startsWith("sk-or-")) {
-        console.log(`  ${YELLOW}⚠${RESET} Key should start with sk-or-. Try again or press Enter to skip.`);
-        const retry = await ask(`  Use this key anyway? [y/N]: `);
-        if (retry.trim().toLowerCase() !== "y") { key = ""; continue; }
-      }
-      if (!key) {
-        console.log(`  ${DIM}You can set OPENROUTER_API_KEY later in ~/.sinain/.env${RESET}`);
-        break;
-      }
-    }
-    if (key) vars.OPENROUTER_API_KEY = key;
-  } else {
-    // Still ask for OpenRouter key (needed for vision/OCR)
-    const existingKey = existing.OPENROUTER_API_KEY;
-    const keyHint = existingKey ? ` [${existingKey.slice(0, 8)}...${existingKey.slice(-4)}]` : "";
-    const key = await ask(`  OpenRouter API key for vision/OCR (optional, Enter to skip)${keyHint}: `);
-    if (key.trim()) vars.OPENROUTER_API_KEY = key.trim();
-    else if (existingKey) vars.OPENROUTER_API_KEY = existingKey;
-  }
-
-  // 3. Agent selection — written to agents.json `default` field. Existing
-  // value is read from agents.json first, falling back to .env for users
-  // mid-migration.
-  const existingAgentsCfg = readAgentsConfig();
-  const agentsPatch = {};
-  const defaultAgent = existingAgentsCfg?.default || existing.SINAIN_AGENT || "claude";
-  const agentChoice = await ask(`  Default agent? [${BOLD}${defaultAgent}${RESET}/claude/openclaude/codex/goose/junie/aider]: `);
-  agentsPatch.default = agentChoice.trim().toLowerCase() || defaultAgent;
-
-  // 3b. Local vision (Ollama)
-  const IS_MACOS = os.platform() === "darwin";
-  const hasOllama = commandExists("ollama");
-  if (hasOllama) {
-    const useVision = await ask(`  Enable local vision AI? [Y/n] (Ollama — screen understanding without cloud API): `);
-    if (!useVision.trim() || useVision.trim().toLowerCase() === "y") {
-      vars.LOCAL_VISION_ENABLED = "true";
-      // Ensure ollama serve is running before list/pull
-      const ollamaReady = await ensureOllama();
-      if (ollamaReady) {
-        try {
-          const models = execSync("ollama list 2>/dev/null", { encoding: "utf-8" });
-          if (!models.includes("llava")) {
-            const pull = await ask(`  Pull llava vision model (~4GB)? [Y/n]: `);
-            if (!pull.trim() || pull.trim().toLowerCase() === "y") {
-              console.log(`  ${DIM}Pulling llava...${RESET}`);
-              execSync("ollama pull llava", { stdio: "inherit" });
-              ok("llava model pulled");
-            }
-          } else {
-            ok("llava model already available");
-          }
-        } catch {
-          warn("Could not check Ollama models");
-        }
-      }
-      vars.LOCAL_VISION_MODEL = "llava";
-    }
-  } else {
-    const installOllama = await ask(`  Install Ollama for local vision AI? [y/N]: `);
-    if (installOllama.trim().toLowerCase() === "y") {
-      try {
-        if (IS_MACOS) {
-          console.log(`  ${DIM}Installing Ollama via Homebrew...${RESET}`);
-          execSync("brew install ollama", { stdio: "inherit" });
-        } else {
-          console.log(`  ${DIM}Installing Ollama...${RESET}`);
-          execSync("curl -fsSL https://ollama.com/install.sh | sh", { stdio: "inherit" });
-        }
-        // Start ollama serve before pulling
-        await ensureOllama();
-        console.log(`  ${DIM}Pulling llava vision model...${RESET}`);
-        execSync("ollama pull llava", { stdio: "inherit" });
-        vars.LOCAL_VISION_ENABLED = "true";
-        vars.LOCAL_VISION_MODEL = "llava";
-        ok("Ollama + llava installed");
-      } catch {
-        warn("Ollama installation failed — local vision disabled");
-      }
-    }
-  }
-
-  // 4. Escalation mode — agents.json `escalation.mode`
-  console.log();
-  console.log(`  ${DIM}Escalation modes:${RESET}`);
-  console.log(`    off       — no escalation`);
-  console.log(`    selective — score-based (errors, questions trigger it)`);
-  console.log(`    focus     — always escalate every tick`);
-  console.log(`    rich      — always escalate with maximum context`);
-  const defaultEsc = existingAgentsCfg?.escalation?.mode || existing.ESCALATION_MODE || "selective";
-  const escMode = await ask(`  Escalation mode? [off/${BOLD}${defaultEsc}${RESET}/selective/focus/rich]: `);
-  agentsPatch.escalationMode = escMode.trim().toLowerCase() || defaultEsc;
-
-  // 5. OpenClaw gateway — URLs/session → agents.json (openclaw profile),
-  // tokens → .env. No transport question; agent identity (openclaw vs
-  // local) determines dispatch path.
-  const existingOpenclaw = existingAgentsCfg?.profiles?.openclaw;
-  const existingWsUrl = existingOpenclaw?.wsUrl || existing.OPENCLAW_WS_URL || "";
-  const hadGateway = !!existingWsUrl;
-  const gatewayDefault = hadGateway ? "Y" : "N";
-  const hasGateway = await ask(`  Do you have an OpenClaw gateway? [${gatewayDefault === "Y" ? "Y/n" : "y/N"}]: `);
-  const wantsGateway = hasGateway.trim()
-    ? hasGateway.trim().toLowerCase() === "y"
-    : hadGateway;
-  if (wantsGateway) {
-    const defaultWs = existingWsUrl || "ws://localhost:18789";
-    const wsUrl = await ask(`  Gateway WebSocket URL [${defaultWs}]: `);
-    const finalWsUrl = wsUrl.trim() || defaultWs;
-
-    const existingToken = existing.OPENCLAW_WS_TOKEN;
-    const tokenHint = existingToken ? ` [${existingToken.slice(0, 6)}...${existingToken.slice(-4)}]` : "";
-    const wsToken = await ask(`  Gateway auth token (48-char hex)${tokenHint}: `);
-    if (wsToken.trim()) {
-      vars.OPENCLAW_WS_TOKEN = wsToken.trim();
-      vars.OPENCLAW_HTTP_TOKEN = wsToken.trim();
-    } else if (existingToken) {
-      vars.OPENCLAW_WS_TOKEN = existingToken;
-      vars.OPENCLAW_HTTP_TOKEN = existing.OPENCLAW_HTTP_TOKEN || existingToken;
-    }
-
-    agentsPatch.openclawProfile = {
-      wsUrl: finalWsUrl,
-      httpUrl: finalWsUrl.replace(/^ws/, "http") + "/hooks/agent",
-      wsToken: "${OPENCLAW_WS_TOKEN}",
-      httpToken: "${OPENCLAW_HTTP_TOKEN}",
-      sessionKey: existingOpenclaw?.sessionKey || "agent:main:sinain",
-    };
-  } else {
-    // No gateway — drop the openclaw profile entirely.
-    agentsPatch.openclawProfile = null;
-  }
-
-  // 6. Knowledge import (for standalone machines)
-  console.log();
-  const wantImport = await ask(`  Import knowledge from another machine? [y/N]: `);
-  if (wantImport.trim().toLowerCase() === "y") {
-    const filePath = await ask(`  Path to knowledge export (.tar.gz): `);
-    const resolved = filePath.trim().replace(/^~/, HOME);
-    if (resolved && fs.existsSync(resolved)) {
-      const targetWorkspace = path.join(HOME, ".sinain/workspace");
-      fs.mkdirSync(targetWorkspace, { recursive: true });
-      try {
-        execSync(`tar xzf "${resolved}" -C "${targetWorkspace}"`, { stdio: "inherit" });
-        // Symlink sinain-memory scripts from npm package
-        const srcMemory = path.join(PKG_DIR, "sinain-memory");
-        const dstMemory = path.join(targetWorkspace, "sinain-memory");
-        try { fs.rmSync(dstMemory, { recursive: true }); } catch {}
-        fs.symlinkSync(srcMemory, dstMemory);
-        vars.SINAIN_WORKSPACE = targetWorkspace;
-        vars.OPENCLAW_WORKSPACE_DIR = targetWorkspace;
-        ok(`Knowledge imported to ${targetWorkspace}`);
-      } catch (e) {
-        warn(`Import failed: ${e.message}`);
-      }
-    } else if (resolved) {
-      warn(`File not found: ${resolved}`);
-    }
-  }
-
-  // 7. Agent-specific defaults
-  vars.SINAIN_POLL_INTERVAL = "5";
-  vars.SINAIN_HEARTBEAT_INTERVAL = "900";
-  vars.PRIVACY_MODE = "standard";
-
-  // Write .env — start from .env.example template, patch wizard values in
-  fs.mkdirSync(path.dirname(envPath), { recursive: true });
-
-  const examplePath = path.join(PKG_DIR, ".env.example");
-  let template = "";
-  if (fs.existsSync(examplePath)) {
-    template = fs.readFileSync(examplePath, "utf-8");
-  } else {
-    // Fallback: try sibling (running from cloned repo)
-    const siblingExample = path.join(PKG_DIR, "..", ".env.example");
-    if (fs.existsSync(siblingExample)) {
-      template = fs.readFileSync(siblingExample, "utf-8");
-    }
-  }
-
-  if (template) {
-    // Patch each wizard var into the template by replacing the KEY=... line
-    for (const [key, val] of Object.entries(vars)) {
-      // Match KEY=anything (possibly commented out with #)
-      const regex = new RegExp(`^#?\\s*${key}=.*$`, "m");
-      if (regex.test(template)) {
-        template = template.replace(regex, `${key}=${val}`);
-      } else {
-        // Key not in template — append it
-        template += `\n${key}=${val}`;
-      }
-    }
-    // Add wizard timestamp header
-    template = `# Generated by sinain setup wizard — ${new Date().toISOString()}\n${template}`;
-    fs.writeFileSync(envPath, template);
-  } else {
-    // No template found — write bare vars (fallback)
-    const lines = [];
-    lines.push("# sinain configuration — generated by setup wizard");
-    lines.push(`# ${new Date().toISOString()}`);
-    lines.push("");
-    for (const [key, val] of Object.entries(vars)) {
-      lines.push(`${key}=${val}`);
-    }
-    lines.push("");
-    fs.writeFileSync(envPath, lines.join("\n"));
-  }
-
-  // Flush agent + gateway answers to ~/.sinain/agents.json (separate file
-  // from .env after the profile-config refactor).
-  if (Object.keys(agentsPatch).length > 0) {
-    writeAgentsConfig(agentsPatch);
-  }
-
-  rl.close();
-
-  console.log();
-  ok(`Config written to ${envPath} + ~/.sinain/agents.json`);
-  console.log();
-}
-
 // ── User environment ────────────────────────────────────────────────────────
 
 function loadUserEnv() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geravant/sinain",
-  "version": "1.15.5",
+  "version": "1.18.1",
   "description": "Ambient intelligence that sees what you see, hears what you hear, and acts on your behalf",
   "type": "module",
   "bin": {
@@ -43,6 +43,9 @@
     "sinain-agent/agents.example.json",
     "sinain-agent/.env.example",
     "sinain-agent/CLAUDE.md",
+    "sinain-agent/openrouter-proxy.mjs",
+    "sinain-agent/.claude/settings.json",
+    "sinain-agent/hooks/approve-tool.sh",
     "sense_client",
     "HEARTBEAT.md",
     "SKILL.md"

package/sinain-agent/.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./hooks/approve-tool.sh",
+            "timeout": 130
+          }
+        ]
+      }
+    ]
+  }
+}

package/sinain-agent/hooks/approve-tool.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# PreToolUse hook for sinain-agent (escalation + spawn paths).
+#
+# Forwards every tool-invocation to sinain-core /spawn/approve which:
+#   - auto-approves safe read-only tools (Read, Glob, Grep, Ls, Cat)
+#   - auto-approves all mcp__sinain* tools
+#   - routes everything else to the overlay for Allow/Deny
+#
+# Scoped to sinain-agent via --settings in run.sh: regular openclaude/claude
+# sessions outside this directory don't load this settings.json and aren't
+# affected. Previously this hook early-exited unless SINAIN_SPAWN=1 was set,
+# which broke escalation-path write permissions (agent couldn't Bash/Edit).
+
+CORE_URL="${SINAIN_CORE_URL:-http://localhost:9500}"
+
+# Read hook input from stdin. Claude Code / openclaude typically include
+# session_id per the PreToolUse contract; if missing (or if we want a sinain-
+# native correlation), inject SINAIN_SPAWN_TASK_ID / SINAIN_ESC_TASK_ID as
+# sinainTaskId so the server can still key YOLO on a stable id per invocation.
+HOOK_STDIN=$(cat)
+SINAIN_TASK_ID="${SINAIN_SPAWN_TASK_ID:-${SINAIN_ESC_TASK_ID:-}}"
+if [ -n "$SINAIN_TASK_ID" ] && command -v python3 >/dev/null 2>&1; then
+  HOOK_STDIN=$(printf '%s' "$HOOK_STDIN" | SINAIN_TASK_ID="$SINAIN_TASK_ID" python3 -c '
+import json, os, sys
+try:
+    d = json.load(sys.stdin)
+    if isinstance(d, dict) and not d.get("sinainTaskId"):
+        d["sinainTaskId"] = os.environ["SINAIN_TASK_ID"]
+    print(json.dumps(d))
+except Exception:
+    # On any parse failure, pass original through — server can still work
+    sys.stdout.write(os.environ.get("HOOK_STDIN_FALLBACK", ""))
+')
+fi
+
+RESPONSE=$(printf '%s' "$HOOK_STDIN" | curl -sf -X POST "$CORE_URL/spawn/approve" \
+  -H 'Content-Type: application/json' \
+  --max-time 130 \
+  --data-binary @- 2>/dev/null)
+
+if [ -n "$RESPONSE" ]; then
+  echo "$RESPONSE"
+else
+  # If sinain-core is unreachable, allow by default (don't block the agent)
+  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"sinain-core unreachable, auto-allowing"}}'
+fi