@gethmy/mcp 3.2.0 → 3.4.0

package/dist/run-hook-cli.js

@@ -0,0 +1,742 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// src/run-state.ts
+var exports_run_state = {};
+__export(exports_run_state, {
+  writeSpoolBatch: () => writeSpoolBatch,
+  writeRouteMemo: () => writeRouteMemo,
+  trimSpool: () => trimSpool,
+  spoolDir: () => spoolDir,
+  sessionsDir: () => sessionsDir,
+  runStateExists: () => runStateExists,
+  runStateDir: () => runStateDir,
+  removeSpoolBatches: () => removeSpoolBatches,
+  readSpoolBatches: () => readSpoolBatches,
+  readRouteMemo: () => readRouteMemo,
+  readPublishedSessions: () => readPublishedSessions,
+  publishRunSession: () => publishRunSession,
+  pidIsAlive: () => pidIsAlive,
+  clearRunSession: () => clearRunSession,
+  chooseRunSessionForHook: () => chooseRunSessionForHook,
+  ancestorPids: () => ancestorPids,
+  RUN_STATE_DIR_ENV: () => RUN_STATE_DIR_ENV,
+  MAX_POINTER_AGE_MS: () => MAX_POINTER_AGE_MS
+});
+import { execFileSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function runStateDir(env = process.env) {
+  const override = env[RUN_STATE_DIR_ENV]?.trim();
+  if (override)
+    return override;
+  return join(homedir(), ".harmony", "runs");
+}
+function sessionsDir(stateDir) {
+  return join(stateDir, "sessions");
+}
+function spoolDir(stateDir, agentSessionId) {
+  return join(stateDir, "spool", sanitizeIdForPath(agentSessionId));
+}
+function sanitizeIdForPath(id) {
+  return id.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 100);
+}
+function pointerFileName(publisherPid, cardId) {
+  return `${publisherPid}.${sanitizeIdForPath(cardId)}.json`;
+}
+function pidIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+function readProcParent(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf-8");
+    const tail = stat.slice(stat.lastIndexOf(")") + 1).trim().split(/\s+/);
+    const ppid = Number.parseInt(tail[1] ?? "", 10);
+    return Number.isInteger(ppid) && ppid > 0 ? ppid : null;
+  } catch {
+    return null;
+  }
+}
+function psParentTable() {
+  if (psTableCache)
+    return psTableCache;
+  const table = new Map;
+  try {
+    const out = execFileSync("ps", ["-Ao", "pid=,ppid="], {
+      encoding: "utf-8",
+      timeout: 2000,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    for (const line of out.split(`
+`)) {
+      const match = line.trim().match(/^(\d+)\s+(\d+)$/);
+      if (!match)
+        continue;
+      table.set(Number(match[1]), Number(match[2]));
+    }
+  } catch {}
+  psTableCache = table;
+  return table;
+}
+function ancestorPids(pid, readParent) {
+  const parentOf = readParent ?? ((child) => {
+    const viaProc = readProcParent(child);
+    if (viaProc !== null)
+      return viaProc;
+    return psParentTable().get(child) ?? null;
+  });
+  const chain = [];
+  const seen = new Set([pid]);
+  let current = pid;
+  if (!readParent && pid === process.pid) {
+    const ppid = process.ppid;
+    if (Number.isInteger(ppid) && ppid > 1) {
+      chain.push(ppid);
+      seen.add(ppid);
+      current = ppid;
+    }
+  }
+  for (let depth = chain.length;depth < MAX_ANCESTOR_DEPTH; depth++) {
+    const parent = parentOf(current);
+    if (parent === null || parent <= 1 || seen.has(parent))
+      break;
+    chain.push(parent);
+    seen.add(parent);
+    current = parent;
+  }
+  return chain;
+}
+function publishRunSession(session, options) {
+  const stateDir = options?.stateDir ?? runStateDir();
+  const pid = options?.pid ?? process.pid;
+  const record = {
+    cardId: session.cardId,
+    agentSessionId: session.agentSessionId,
+    publisherPid: pid,
+    ancestorPids: options?.ancestors ?? ancestorPids(pid),
+    cwd: options?.cwd ?? process.cwd(),
+    updatedAt: new Date().toISOString()
+  };
+  try {
+    const dir = sessionsDir(stateDir);
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    const target = join(dir, pointerFileName(pid, session.cardId));
+    const temp = `${target}.${process.pid}.tmp`;
+    writeFileSync(temp, JSON.stringify(record), { mode: 384 });
+    renameSync(temp, target);
+    return record;
+  } catch {
+    return null;
+  }
+}
+function clearRunSession(cardId, options) {
+  const stateDir = options?.stateDir ?? runStateDir();
+  const pid = options?.pid ?? process.pid;
+  if (!options?.keepPointer) {
+    try {
+      unlinkSync(join(sessionsDir(stateDir), pointerFileName(pid, cardId)));
+    } catch {}
+  }
+  if (options?.agentSessionId) {
+    try {
+      rmSync(spoolDir(stateDir, options.agentSessionId), {
+        recursive: true,
+        force: true
+      });
+    } catch {}
+  }
+}
+function readPublishedSessions(options) {
+  const stateDir = options?.stateDir ?? runStateDir();
+  const now = options?.now ?? Date.now();
+  const dir = sessionsDir(stateDir);
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const live = [];
+  for (const name of names) {
+    if (!name.endsWith(".json"))
+      continue;
+    const path = join(dir, name);
+    let record;
+    try {
+      record = JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+      safeUnlink(path);
+      continue;
+    }
+    if (typeof record?.cardId !== "string" || typeof record?.agentSessionId !== "string" || !record.cardId || !record.agentSessionId) {
+      safeUnlink(path);
+      continue;
+    }
+    const age = now - Date.parse(record.updatedAt ?? "");
+    if (!Number.isFinite(age) || age > MAX_POINTER_AGE_MS) {
+      safeUnlink(path);
+      continue;
+    }
+    if (!pidIsAlive(record.publisherPid)) {
+      safeUnlink(path);
+      continue;
+    }
+    live.push({ ...record, ancestorPids: record.ancestorPids ?? [] });
+  }
+  return live;
+}
+function safeUnlink(path) {
+  try {
+    unlinkSync(path);
+  } catch {}
+}
+function chooseRunSessionForHook(args) {
+  const { candidates, hookAncestorPids } = args;
+  if (candidates.length === 0)
+    return null;
+  const hasCwd = typeof args.cwd === "string" && args.cwd.length > 0;
+  const pool = hasCwd ? candidates.filter((candidate) => candidate.cwd === args.cwd) : candidates;
+  if (pool.length === 0)
+    return null;
+  let best = null;
+  let bestScore = Number.POSITIVE_INFINITY;
+  for (const candidate of pool) {
+    const claimed = new Set([
+      candidate.publisherPid,
+      ...candidate.ancestorPids ?? []
+    ]);
+    let score = Number.POSITIVE_INFINITY;
+    for (let i = 0;i < hookAncestorPids.length; i++) {
+      if (claimed.has(hookAncestorPids[i])) {
+        score = i;
+        break;
+      }
+    }
+    if (score === Number.POSITIVE_INFINITY)
+      continue;
+    if (score < bestScore || score === bestScore && best !== null && Date.parse(candidate.updatedAt) > Date.parse(best.updatedAt)) {
+      best = candidate;
+      bestScore = score;
+    }
+  }
+  if (best)
+    return best;
+  if (hasCwd && pool.length === 1)
+    return pool[0];
+  return null;
+}
+function writeSpoolBatch(dir, events, options) {
+  if (events.length === 0)
+    return null;
+  const now = options?.now ?? Date.now();
+  const pid = options?.pid ?? process.pid;
+  const nonce = options?.nonce ?? Math.random().toString(36).slice(2, 8).padEnd(6, "0");
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    const name = `${String(now).padStart(14, "0")}-${pid}-${nonce}.json`;
+    const target = join(dir, name);
+    const temp = `${target}.tmp`;
+    writeFileSync(temp, JSON.stringify(events), { mode: 384 });
+    renameSync(temp, target);
+    return target;
+  } catch {
+    return null;
+  }
+}
+function readSpoolBatches(dir, limit = 200) {
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const batches = [];
+  for (const name of names.filter((n) => n.endsWith(".json")).sort()) {
+    if (batches.length >= limit)
+      break;
+    const path = join(dir, name);
+    try {
+      const parsed = JSON.parse(readFileSync(path, "utf-8"));
+      if (!Array.isArray(parsed)) {
+        safeUnlink(path);
+        continue;
+      }
+      batches.push({ path, events: parsed });
+    } catch {
+      safeUnlink(path);
+    }
+  }
+  return batches;
+}
+function removeSpoolBatches(paths) {
+  for (const path of paths)
+    safeUnlink(path);
+}
+function trimSpool(dir, max) {
+  let names;
+  try {
+    names = readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+  } catch {
+    return 0;
+  }
+  if (names.length <= max)
+    return 0;
+  const excess = names.slice(0, names.length - max);
+  for (const name of excess)
+    safeUnlink(join(dir, name));
+  return excess.length;
+}
+function routeMemoPath(stateDir, harnessSessionId) {
+  return join(stateDir, "routes", `${sanitizeIdForPath(harnessSessionId)}.json`);
+}
+function readRouteMemo(stateDir, harnessSessionId) {
+  try {
+    const raw = JSON.parse(readFileSync(routeMemoPath(stateDir, harnessSessionId), "utf-8"));
+    const pid = raw?.publisherPid;
+    const cardId = raw?.cardId;
+    const agentSessionId = raw?.agentSessionId;
+    if (typeof pid !== "number" || !Number.isInteger(pid))
+      return null;
+    if (typeof cardId !== "string" || cardId.length === 0)
+      return null;
+    if (typeof agentSessionId !== "string" || agentSessionId.length === 0) {
+      return null;
+    }
+    return { publisherPid: pid, cardId, agentSessionId };
+  } catch {
+    return null;
+  }
+}
+function writeRouteMemo(stateDir, harnessSessionId, memo) {
+  try {
+    const path = routeMemoPath(stateDir, harnessSessionId);
+    mkdirSync(join(stateDir, "routes"), { recursive: true, mode: 448 });
+    writeFileSync(path, JSON.stringify({
+      publisherPid: memo.publisherPid,
+      cardId: memo.cardId,
+      agentSessionId: memo.agentSessionId
+    }), { mode: 384 });
+  } catch {}
+}
+function runStateExists(stateDir = runStateDir()) {
+  try {
+    return existsSync(sessionsDir(stateDir)) && statSync(sessionsDir(stateDir)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var RUN_STATE_DIR_ENV = "HARMONY_RUN_STATE_DIR", MAX_POINTER_AGE_MS, MAX_ANCESTOR_DEPTH = 12, psTableCache = null;
+var init_run_state = __esm(() => {
+  MAX_POINTER_AGE_MS = 10 * 60000;
+});
+
+// src/run-redaction.ts
+var MAX_INPUT_CHARS = 2000;
+var MAX_OUTPUT_CHARS = 4000;
+var MAX_INPUT_STRING_CHARS = 600;
+var REDACTION_MARK = "«redacted»";
+var SENSITIVE_SEGMENTS = [
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".codex",
+  ".gemini",
+  ".docker",
+  ".kube",
+  ".harmony-mcp",
+  ".password-store",
+  ".claude",
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+];
+var CONFIG_SCOPED_SEGMENTS = new Set([
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+]);
+var SENSITIVE_BASENAMES = new Set([
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".pgpass",
+  ".git-credentials",
+  ".htpasswd",
+  ".claude.json",
+  "credentials",
+  ".credentials",
+  "credentials.json",
+  ".credentials.json",
+  "credentials.yml",
+  "credentials.yaml",
+  "auth.json",
+  ".auth.json",
+  "secrets",
+  "secrets.json",
+  "secrets.yaml",
+  "secrets.yml",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  "known_hosts"
+]);
+var SENSITIVE_EXTENSIONS = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".keystore",
+  ".jks",
+  ".asc",
+  ".gpg"
+];
+function isSensitivePath(rawPath) {
+  if (typeof rawPath !== "string" || rawPath.length === 0)
+    return false;
+  const path = rawPath.trim().toLowerCase();
+  const segments = path.split(/[\\/]+/).filter((s) => s.length > 0);
+  if (segments.length === 0)
+    return false;
+  for (let i = 0;i < segments.length; i++) {
+    const segment = segments[i];
+    if (!SENSITIVE_SEGMENTS.includes(segment))
+      continue;
+    if (CONFIG_SCOPED_SEGMENTS.has(segment)) {
+      if (i > 0 && segments[i - 1] === ".config")
+        return true;
+      continue;
+    }
+    return true;
+  }
+  const basename = segments[segments.length - 1];
+  if (SENSITIVE_BASENAMES.has(basename))
+    return true;
+  if (basename === ".env" || basename.startsWith(".env."))
+    return true;
+  if (basename.endsWith(".env"))
+    return true;
+  if (SENSITIVE_EXTENSIONS.some((ext) => basename.endsWith(ext)))
+    return true;
+  if (/service[-_]?account.*\.json$/.test(basename))
+    return true;
+  return false;
+}
+function sensitivePathsIn(input, depth = 0) {
+  if (depth > 6)
+    return [];
+  if (typeof input === "string") {
+    return isSensitivePath(input) ? [input] : [];
+  }
+  if (Array.isArray(input)) {
+    return input.flatMap((item) => sensitivePathsIn(item, depth + 1));
+  }
+  if (input !== null && typeof input === "object") {
+    return Object.values(input).flatMap((value) => sensitivePathsIn(value, depth + 1));
+  }
+  return [];
+}
+var SECRET_PATTERNS = [
+  {
+    pattern: /-----BEGIN[^-]*PRIVATE KEY-----[\s\S]*?-----END[^-]*-----/g,
+    replace: REDACTION_MARK
+  },
+  { pattern: /\bhmy_at_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bhmy_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, replace: REDACTION_MARK },
+  { pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, replace: REDACTION_MARK },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replace: REDACTION_MARK },
+  { pattern: /\bAIza[0-9A-Za-z_-]{20,}/g, replace: REDACTION_MARK },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    replace: REDACTION_MARK
+  },
+  {
+    pattern: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+    replace: `$1 ${REDACTION_MARK}`
+  },
+  {
+    pattern: /(\w+:\/\/)[^/\s:@]+:[^/\s@]+@/g,
+    replace: `$1${REDACTION_MARK}@`
+  },
+  {
+    pattern: /\b([A-Za-z0-9_]{0,40}(?:TOKEN|SECRET|PASSWORD|PASSWD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)[A-Za-z0-9_]{0,40})\s*[=:]\s*(?:"[^"]*"|'[^']*'|`[^`]*`|[^\s,;)}\]]+)/gi,
+    replace: `$1=${REDACTION_MARK}`
+  },
+  {
+    pattern: /(--?(?:password|passwd|token|api-?key|secret|auth)(?:=|\s+))(?:"[^"]*"|'[^']*'|[^\s]+)/gi,
+    replace: `$1${REDACTION_MARK}`
+  }
+];
+function redactSecrets(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return text;
+  let out = text;
+  for (const { pattern, replace } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    out = out.replace(pattern, replace);
+  }
+  return out;
+}
+function truncate(text, max, originalLength) {
+  const total = originalLength ?? text.length;
+  if (total <= max)
+    return text;
+  return `${text.slice(0, max)}… [+${total - max} chars]`;
+}
+function redactThenTruncate(text, max) {
+  const preCap = max * 4 + 64;
+  const scanned = text.length > preCap ? text.slice(0, preCap) : text;
+  return truncate(redactSecrets(scanned), max, text.length);
+}
+function redactStructure(value, depth = 0) {
+  if (depth > 6)
+    return REDACTION_MARK;
+  if (typeof value === "string") {
+    return redactThenTruncate(value, MAX_INPUT_STRING_CHARS);
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item) => redactStructure(item, depth + 1));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = redactStructure(item, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function redactToolCall(args) {
+  const sensitive = sensitivePathsIn(args.input);
+  if (sensitive.length > 0) {
+    return { withheld: "sensitive-path" };
+  }
+  const result = {};
+  if (args.input !== undefined) {
+    let input = redactStructure(args.input);
+    let serialized;
+    try {
+      serialized = JSON.stringify(input) ?? "";
+    } catch {
+      serialized = "";
+      input = REDACTION_MARK;
+    }
+    if (serialized.length > MAX_INPUT_CHARS) {
+      input = truncate(serialized, MAX_INPUT_CHARS);
+    }
+    result.input = input;
+  }
+  if (typeof args.output === "string" && args.output.length > 0) {
+    result.output = redactThenTruncate(args.output, MAX_OUTPUT_CHARS);
+  }
+  return result;
+}
+
+// src/run-hook.ts
+function extractOutputText(response, depth = 0) {
+  if (depth > 4)
+    return "";
+  if (response === null || response === undefined)
+    return "";
+  if (typeof response === "string")
+    return response;
+  if (typeof response === "number" || typeof response === "boolean") {
+    return String(response);
+  }
+  if (Array.isArray(response)) {
+    return response.map((item) => extractOutputText(item, depth + 1)).filter((part) => part.length > 0).join(`
+`);
+  }
+  if (typeof response === "object") {
+    const record = response;
+    if (typeof record.text === "string")
+      return record.text;
+    const parts = [];
+    for (const key of ["stdout", "stderr", "output", "content", "result"]) {
+      const value = record[key];
+      if (value === undefined || value === null)
+        continue;
+      const text = extractOutputText(value, depth + 1);
+      if (text.length > 0)
+        parts.push(text);
+    }
+    if (parts.length > 0)
+      return parts.join(`
+`);
+    try {
+      const serialized = JSON.stringify(record) ?? "";
+      return serialized === "{}" || serialized === "[]" ? "" : serialized;
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+function extractIsError(response) {
+  if (response === null || typeof response !== "object")
+    return false;
+  const record = response;
+  if (record.is_error === true || record.isError === true)
+    return true;
+  if (record.interrupted === true)
+    return true;
+  if (typeof record.error === "string" && record.error.length > 0)
+    return true;
+  return false;
+}
+function correlationId(payload, nonce) {
+  const supplied = payload.tool_use_id;
+  if (typeof supplied === "string" && supplied.length > 0)
+    return supplied;
+  return `hook-${nonce()}`;
+}
+function buildHookEvents(payload, options) {
+  const toolName = typeof payload?.tool_name === "string" ? payload.tool_name.trim() : "";
+  if (!toolName)
+    return [];
+  if (typeof payload.hook_event_name === "string" && payload.hook_event_name !== "PostToolUse") {
+    return [];
+  }
+  const now = options?.now ?? Date.now();
+  const nonce = options?.nonce ?? (() => Math.random().toString(36).slice(2, 12));
+  const toolUseId = correlationId(payload, nonce);
+  const rawOutput = extractOutputText(payload.tool_response);
+  const isError = extractIsError(payload.tool_response);
+  const redacted = redactToolCall({
+    input: payload.tool_input,
+    output: rawOutput
+  });
+  const startPayload = { toolName, toolUseId };
+  const endPayload = { toolName, toolUseId };
+  if (redacted.withheld) {
+    startPayload.withheld = redacted.withheld;
+    endPayload.withheld = redacted.withheld;
+    endPayload.output = `[withheld: ${redacted.withheld}]`;
+  } else {
+    if (redacted.input !== undefined)
+      startPayload.input = redacted.input;
+    if (redacted.output !== undefined)
+      endPayload.output = redacted.output;
+  }
+  if (isError)
+    endPayload.isError = true;
+  return [
+    {
+      kind: "tool_started",
+      source: "agent",
+      payload: startPayload,
+      createdAt: new Date(now).toISOString()
+    },
+    {
+      kind: "tool_ended",
+      source: "agent",
+      payload: endPayload,
+      createdAt: new Date(now + 1).toISOString()
+    }
+  ];
+}
+
+// src/run-hook-main.ts
+init_run_state();
+var MAX_SPOOL_BATCHES = 1000;
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    if (chunks.reduce((n, c) => n + c.length, 0) > 4000000)
+      break;
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function runPostToolUseHook(runtime = {}) {
+  const stateDir = runtime.stateDir ?? runStateDir();
+  if (!runStateExists(stateDir))
+    return;
+  const raw = await (runtime.readInput ?? readStdin)();
+  if (!raw.trim())
+    return;
+  let payload;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    return;
+  }
+  const candidates = readPublishedSessions({ stateDir });
+  if (candidates.length === 0)
+    return;
+  const harnessSessionId = typeof payload.session_id === "string" ? payload.session_id : "";
+  const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : undefined;
+  let chosen = null;
+  if (harnessSessionId) {
+    const memo = readRouteMemo(stateDir, harnessSessionId);
+    if (memo !== null) {
+      chosen = candidates.find((c) => c.publisherPid === memo.publisherPid && c.cardId === memo.cardId && c.agentSessionId === memo.agentSessionId && (payloadCwd === undefined || c.cwd === payloadCwd)) ?? null;
+    }
+  }
+  if (!chosen) {
+    chosen = chooseRunSessionForHook({
+      candidates,
+      hookAncestorPids: (runtime.hookAncestorPids ?? (() => ancestorPids(process.pid)))(),
+      cwd: payloadCwd
+    });
+    if (chosen && harnessSessionId) {
+      writeRouteMemo(stateDir, harnessSessionId, {
+        publisherPid: chosen.publisherPid,
+        cardId: chosen.cardId,
+        agentSessionId: chosen.agentSessionId
+      });
+    }
+  }
+  if (!chosen)
+    return;
+  const events = buildHookEvents(payload);
+  if (events.length === 0)
+    return;
+  const dir = spoolDir(stateDir, chosen.agentSessionId);
+  trimSpool(dir, MAX_SPOOL_BATCHES);
+  writeSpoolBatch(dir, events);
+}
+
+// src/run-hook-cli.ts
+runPostToolUseHook().catch(() => {}).finally(() => {
+  process.exit(0);
+});