@goondocks/myco 0.17.2 → 0.18.0

package/dist/chunk-JMOUFG6Y.js

@@ -0,0 +1,65 @@
+import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+
+// src/hooks/capture-rules.ts
+function evaluateUserPromptRules(manifests, detectedAgent, ctx) {
+  for (const manifest of manifests) {
+    const rules = manifest.capture?.rules ?? [];
+    for (const rule of rules) {
+      if (rule.event !== "user_prompt") continue;
+      if (!scopePermits(rule, manifest.name, detectedAgent)) continue;
+      if (!whenMatches(rule, ctx)) continue;
+      return applyAction(rule, ctx);
+    }
+  }
+  return { action: "pass", prompt: ctx.prompt };
+}
+function evaluateSessionStartRules(manifests, detectedAgent, ctx) {
+  for (const manifest of manifests) {
+    const rules = manifest.capture?.rules ?? [];
+    for (const rule of rules) {
+      if (rule.event !== "session_start") continue;
+      if (!scopePermits(rule, manifest.name, detectedAgent)) continue;
+      if (!whenMatches(rule, { prompt: "", transcriptPath: ctx.transcriptPath })) continue;
+      if (rule.action === "drop") {
+        return { action: "drop", reason: rule.reason };
+      }
+    }
+  }
+  return { action: "pass" };
+}
+function scopePermits(rule, owningAgent, detectedAgent) {
+  if (rule.scope === "any_agent") return true;
+  return owningAgent === detectedAgent;
+}
+function whenMatches(rule, ctx) {
+  const { prompt_starts_with, prompt_contains, transcript_path_missing } = rule.when;
+  const hasAnyCondition = prompt_starts_with !== void 0 || prompt_contains !== void 0 || transcript_path_missing !== void 0;
+  if (!hasAnyCondition) return false;
+  if (prompt_starts_with && !ctx.prompt.startsWith(prompt_starts_with)) return false;
+  if (prompt_contains && !ctx.prompt.includes(prompt_contains)) return false;
+  if (transcript_path_missing !== void 0) {
+    const missing = !ctx.transcriptPath || ctx.transcriptPath.length === 0;
+    if (transcript_path_missing && !missing) return false;
+    if (!transcript_path_missing && missing) return false;
+  }
+  return true;
+}
+function applyAction(rule, ctx) {
+  if (rule.action === "drop") {
+    return { action: "drop", reason: rule.reason };
+  }
+  const marker = rule.extract_after;
+  if (!marker) return { action: "pass", prompt: ctx.prompt };
+  const idx = ctx.prompt.indexOf(marker);
+  if (idx === -1) return { action: "pass", prompt: ctx.prompt };
+  const after = ctx.prompt.slice(idx + marker.length);
+  const next = rule.trim ? after.trim() : after;
+  if (!next) return { action: "pass", prompt: ctx.prompt };
+  return { action: "rewrite", prompt: next, reason: rule.reason };
+}
+
+export {
+  evaluateUserPromptRules,
+  evaluateSessionStartRules
+};
+//# sourceMappingURL=chunk-JMOUFG6Y.js.map

package/dist/chunk-JMOUFG6Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/capture-rules.ts"],"sourcesContent":["/**\n * Generic capture-rule evaluator.\n *\n * Each symbiont manifest declares `capture.rules` — a list of `{ event,\n * when, action }` records that describe how Myco should filter captured\n * events for that agent. This module loads rules from every manifest\n * in one place and exposes a pure evaluator the hook handlers call\n * without knowing anything symbiont-specific.\n *\n * Adding a new symbiont's capture behavior is a YAML-only change: edit\n * that agent's manifest file, no hook or evaluator changes needed.\n *\n * Rule scope (`this_agent` vs `any_agent`) lets rules opt into running\n * even when agent detection itself fails — useful for ephemeral\n * sub-invocations that legitimately lack the signals we key on.\n *\n * Conditions should prefer structural signals (e.g.,\n * `transcript_path_missing`) over text matching so rules stay robust\n * across upstream agent updates.\n */\n\nimport type { CaptureRule, SymbiontManifest } from '../symbionts/manifest-schema.js';\n\n/** Structured context a rule can match against at UserPromptSubmit time. */\nexport interface UserPromptRuleContext {\n  /** The user prompt text as received from the hook. */\n  prompt: string;\n  /** Transcript path from the hook payload, if any. Empty/undefined signals an ephemeral session. */\n  transcriptPath?: string;\n}\n\n/** Structured context a rule can match against at SessionStart time. */\nexport interface SessionStartRuleContext {\n  /** Transcript path from the hook payload, if any. Empty/undefined signals an ephemeral session. */\n  transcriptPath?: string;\n}\n\n/** Outcome of evaluating user_prompt rules. */\nexport type UserPromptDecision =\n  | { action: 'pass'; prompt: string }\n  | { action: 'rewrite'; prompt: string; reason?: string }\n  | { action: 'drop'; reason?: string };\n\n/** Outcome of evaluating session_start rules. No rewrite — there's no prompt text yet. */\nexport type SessionStartDecision =\n  | { action: 'pass' }\n  | { action: 'drop'; reason?: string };\n\n/**\n * Evaluate all user_prompt rules from every manifest against one context.\n *\n * Rules are checked in declaration order, first-match-wins. A rule only\n * fires when:\n *   1. its `event` is `user_prompt`,\n *   2. its scope permits it (see scope semantics in manifest-schema.ts),\n *   3. every condition in its `when` block matches the context.\n *\n * If no rule matches, the prompt passes through unchanged.\n */\nexport function evaluateUserPromptRules(\n  manifests: SymbiontManifest[],\n  detectedAgent: string,\n  ctx: UserPromptRuleContext,\n): UserPromptDecision {\n  for (const manifest of manifests) {\n    const rules = manifest.capture?.rules ?? [];\n    for (const rule of rules) {\n      if (rule.event !== 'user_prompt') continue;\n      if (!scopePermits(rule, manifest.name, detectedAgent)) continue;\n      if (!whenMatches(rule, ctx)) continue;\n      return applyAction(rule, ctx);\n    }\n  }\n  return { action: 'pass', prompt: ctx.prompt };\n}\n\n/**\n * Evaluate all session_start rules from every manifest.\n *\n * Same first-match-wins semantics as user_prompt rules. The only action\n * session_start rules can take is `drop` — text rewriting doesn't apply\n * because there's no prompt text at SessionStart time. Rules that\n * specify prompt-based conditions (prompt_starts_with / prompt_contains)\n * match against an empty prompt here, so they'll never fire on the\n * session_start pass.\n *\n * Callers should skip session registration when the result is `drop`.\n */\nexport function evaluateSessionStartRules(\n  manifests: SymbiontManifest[],\n  detectedAgent: string,\n  ctx: SessionStartRuleContext,\n): SessionStartDecision {\n  for (const manifest of manifests) {\n    const rules = manifest.capture?.rules ?? [];\n    for (const rule of rules) {\n      if (rule.event !== 'session_start') continue;\n      if (!scopePermits(rule, manifest.name, detectedAgent)) continue;\n      if (!whenMatches(rule, { prompt: '', transcriptPath: ctx.transcriptPath })) continue;\n      if (rule.action === 'drop') {\n        return { action: 'drop', reason: rule.reason };\n      }\n      // rewrite_prompt is meaningless at session_start — skip and let\n      // later rules have a chance to match.\n    }\n  }\n  return { action: 'pass' };\n}\n\nfunction scopePermits(rule: CaptureRule, owningAgent: string, detectedAgent: string): boolean {\n  if (rule.scope === 'any_agent') return true;\n  return owningAgent === detectedAgent;\n}\n\nfunction whenMatches(rule: CaptureRule, ctx: UserPromptRuleContext): boolean {\n  const { prompt_starts_with, prompt_contains, transcript_path_missing } = rule.when;\n\n  // Refuse rules with no conditions — prevents a mistyped YAML file from\n  // accidentally creating a blanket \"drop everything\" rule.\n  const hasAnyCondition =\n    prompt_starts_with !== undefined ||\n    prompt_contains !== undefined ||\n    transcript_path_missing !== undefined;\n  if (!hasAnyCondition) return false;\n\n  if (prompt_starts_with && !ctx.prompt.startsWith(prompt_starts_with)) return false;\n  if (prompt_contains && !ctx.prompt.includes(prompt_contains)) return false;\n\n  if (transcript_path_missing !== undefined) {\n    const missing = !ctx.transcriptPath || ctx.transcriptPath.length === 0;\n    if (transcript_path_missing && !missing) return false;\n    if (!transcript_path_missing && missing) return false;\n  }\n\n  return true;\n}\n\nfunction applyAction(rule: CaptureRule, ctx: UserPromptRuleContext): UserPromptDecision {\n  if (rule.action === 'drop') {\n    return { action: 'drop', reason: rule.reason };\n  }\n  // rewrite_prompt — keep only the substring after the extract_after marker.\n  // If the marker isn't in the prompt, fall through to `pass` so we don't\n  // accidentally blank out a prompt that turned out not to match after all.\n  const marker = rule.extract_after;\n  if (!marker) return { action: 'pass', prompt: ctx.prompt };\n  const idx = ctx.prompt.indexOf(marker);\n  if (idx === -1) return { action: 'pass', prompt: ctx.prompt };\n  const after = ctx.prompt.slice(idx + marker.length);\n  const next = rule.trim ? after.trim() : after;\n  if (!next) return { action: 'pass', prompt: ctx.prompt };\n  return { action: 'rewrite', prompt: next, reason: rule.reason };\n}\n"],"mappings":";;;AA2DO,SAAS,wBACd,WACA,eACA,KACoB;AACpB,aAAW,YAAY,WAAW;AAChC,UAAM,QAAQ,SAAS,SAAS,SAAS,CAAC;AAC1C,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,UAAU,cAAe;AAClC,UAAI,CAAC,aAAa,MAAM,SAAS,MAAM,aAAa,EAAG;AACvD,UAAI,CAAC,YAAY,MAAM,GAAG,EAAG;AAC7B,aAAO,YAAY,MAAM,GAAG;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,QAAQ,QAAQ,IAAI,OAAO;AAC9C;AAcO,SAAS,0BACd,WACA,eACA,KACsB;AACtB,aAAW,YAAY,WAAW;AAChC,UAAM,QAAQ,SAAS,SAAS,SAAS,CAAC;AAC1C,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,UAAU,gBAAiB;AACpC,UAAI,CAAC,aAAa,MAAM,SAAS,MAAM,aAAa,EAAG;AACvD,UAAI,CAAC,YAAY,MAAM,EAAE,QAAQ,IAAI,gBAAgB,IAAI,eAAe,CAAC,EAAG;AAC5E,UAAI,KAAK,WAAW,QAAQ;AAC1B,eAAO,EAAE,QAAQ,QAAQ,QAAQ,KAAK,OAAO;AAAA,MAC/C;AAAA,IAGF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,OAAO;AAC1B;AAEA,SAAS,aAAa,MAAmB,aAAqB,eAAgC;AAC5F,MAAI,KAAK,UAAU,YAAa,QAAO;AACvC,SAAO,gBAAgB;AACzB;AAEA,SAAS,YAAY,MAAmB,KAAqC;AAC3E,QAAM,EAAE,oBAAoB,iBAAiB,wBAAwB,IAAI,KAAK;AAI9E,QAAM,kBACJ,uBAAuB,UACvB,oBAAoB,UACpB,4BAA4B;AAC9B,MAAI,CAAC,gBAAiB,QAAO;AAE7B,MAAI,sBAAsB,CAAC,IAAI,OAAO,WAAW,kBAAkB,EAAG,QAAO;AAC7E,MAAI,mBAAmB,CAAC,IAAI,OAAO,SAAS,eAAe,EAAG,QAAO;AAErE,MAAI,4BAA4B,QAAW;AACzC,UAAM,UAAU,CAAC,IAAI,kBAAkB,IAAI,eAAe,WAAW;AACrE,QAAI,2BAA2B,CAAC,QAAS,QAAO;AAChD,QAAI,CAAC,2BAA2B,QAAS,QAAO;AAAA,EAClD;AAEA,SAAO;AACT;AAEA,SAAS,YAAY,MAAmB,KAAgD;AACtF,MAAI,KAAK,WAAW,QAAQ;AAC1B,WAAO,EAAE,QAAQ,QAAQ,QAAQ,KAAK,OAAO;AAAA,EAC/C;AAIA,QAAM,SAAS,KAAK;AACpB,MAAI,CAAC,OAAQ,QAAO,EAAE,QAAQ,QAAQ,QAAQ,IAAI,OAAO;AACzD,QAAM,MAAM,IAAI,OAAO,QAAQ,MAAM;AACrC,MAAI,QAAQ,GAAI,QAAO,EAAE,QAAQ,QAAQ,QAAQ,IAAI,OAAO;AAC5D,QAAM,QAAQ,IAAI,OAAO,MAAM,MAAM,OAAO,MAAM;AAClD,QAAM,OAAO,KAAK,OAAO,MAAM,KAAK,IAAI;AACxC,MAAI,CAAC,KAAM,QAAO,EAAE,QAAQ,QAAQ,QAAQ,IAAI,OAAO;AACvD,SAAO,EAAE,QAAQ,WAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO;AAChE;","names":[]}

package/dist/{chunk-HPZ7YAMA.js → chunk-KWTOCJLB.js}

@@ -2,12 +2,12 @@ import { createRequire as __cr } from 'node:module'; const require = __cr(import
 import {
   LmStudioBackend,
   OllamaBackend
-} from "./chunk-ML6GTPZU.js";
+} from "./chunk-CML4MCYF.js";
 import {
   EMBEDDING_REQUEST_TIMEOUT_MS,
   LLM_REQUEST_TIMEOUT_MS,
   PROVIDER_DETECT_TIMEOUT_MS
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 
 // node_modules/@anthropic-ai/sdk/internal/tslib.mjs
 function __classPrivateFieldSet(receiver, state, value, kind, f) {
@@ -5018,4 +5018,4 @@ export {
   createLlmProvider,
   createEmbeddingProvider
 };
-//# sourceMappingURL=chunk-HPZ7YAMA.js.map
+//# sourceMappingURL=chunk-KWTOCJLB.js.map

package/dist/{chunk-F6C4IC6R.js → chunk-NI23QCHB.js}

@@ -11,7 +11,7 @@ import {
   SCHEDULABLE_POWER_STATES,
   USER_TASK_SOURCE,
   epochSeconds
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 import {
   require_dist
 } from "./chunk-D7TYRPRM.js";
@@ -464,7 +464,7 @@ async function registerBuiltInAgentsAndTasks(definitionsDir, vaultDir) {
     ).run(BUILT_IN_SOURCE, definition.name, ...validTaskIds);
   }
   if (vaultDir) {
-    const { loadAllTasks } = await import("./registry-TFQ22Z7N.js");
+    const { loadAllTasks } = await import("./registry-O2NZLO3V.js");
     const allTasks = loadAllTasks(definitionsDir, vaultDir);
     for (const [name, task] of allTasks) {
       if (task.source === USER_TASK_SOURCE) {
@@ -505,4 +505,4 @@ export {
   resolveEffectiveConfig,
   registerBuiltInAgentsAndTasks
 };
-//# sourceMappingURL=chunk-F6C4IC6R.js.map
+//# sourceMappingURL=chunk-NI23QCHB.js.map

package/dist/{chunk-IGBHLFV5.js → chunk-NZI7WBZI.js}

@@ -5,7 +5,7 @@ import {
 import {
   SEARCH_PREVIEW_CHARS,
   SEARCH_RESULTS_DEFAULT_LIMIT
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 
 // src/db/queries/search.ts
 function fullTextSearch(query, options = {}) {
@@ -203,4 +203,4 @@ export {
   fullTextSearch,
   hydrateSearchResults
 };
-//# sourceMappingURL=chunk-IGBHLFV5.js.map
+//# sourceMappingURL=chunk-NZI7WBZI.js.map

package/dist/{chunk-C3C5QVLK.js → chunk-O3TRN3RC.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-MYX5NCRH.js";
 import {
   DEFAULT_MACHINE_ID
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 
 // src/daemon/team-context.ts
 var teamSyncEnabled = false;
@@ -224,4 +224,4 @@ export {
   markSourceRowsSynced,
   backfillUnsynced
 };
-//# sourceMappingURL=chunk-C3C5QVLK.js.map
+//# sourceMappingURL=chunk-O3TRN3RC.js.map

package/dist/{chunk-UTLWSKDV.js → chunk-OW433Q4C.js}

@@ -2,7 +2,7 @@ import { createRequire as __cr } from 'node:module'; const require = __cr(import
 import {
   DEFAULT_MACHINE_ID,
   epochSeconds
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 
 // src/db/schema-ddl.ts
 var SCHEMA_VERSION_TABLE = `
@@ -1014,4 +1014,4 @@ export {
   EMBEDDING_DIMENSIONS,
   createSchema
 };
-//# sourceMappingURL=chunk-UTLWSKDV.js.map
+//# sourceMappingURL=chunk-OW433Q4C.js.map

package/dist/{chunk-5ZISXCDC.js → chunk-PFWIPRF6.js}

@@ -1,10 +1,10 @@
 import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
 import {
   loadManifests
-} from "./chunk-EBIYONNZ.js";
+} from "./chunk-FABWUX5G.js";
 import {
   STDIN_TIMEOUT_MS
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 
 // src/hooks/read-stdin.ts
 function readStdin() {
@@ -30,9 +30,29 @@ var DEFAULT_HOOK_FIELDS = {
 };
 var DEFAULT_AGENT_NAME = "claude-code";
 var cachedManifest;
-function detectManifest() {
+function readSymbiontFlag(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--symbiont") {
+      const next = argv[i + 1];
+      if (next && !next.startsWith("-")) return next;
+    } else if (arg.startsWith("--symbiont=")) {
+      return arg.slice("--symbiont=".length);
+    }
+  }
+  return void 0;
+}
+function detectManifest(input) {
   if (cachedManifest !== void 0) return cachedManifest;
   const manifests = loadManifests();
+  const flagName = readSymbiontFlag(process.argv);
+  if (flagName) {
+    const m = manifests.find((x) => x.name === flagName);
+    if (m) {
+      cachedManifest = m;
+      return m;
+    }
+  }
   for (const m of manifests) {
     if (process.env[m.pluginRootEnvVar]) {
       cachedManifest = m;
@@ -45,6 +65,20 @@ function detectManifest() {
       return m;
     }
   }
+  if (input) {
+    const candidates = [];
+    const tp = input.transcript_path;
+    const cwd = input.cwd;
+    if (typeof tp === "string" && tp.length > 0) candidates.push(tp);
+    if (typeof cwd === "string" && cwd.length > 0) candidates.push(cwd);
+    for (const m of manifests) {
+      const marker = `/${m.configDir}/`;
+      if (candidates.some((c) => c.includes(marker))) {
+        cachedManifest = m;
+        return m;
+      }
+    }
+  }
   cachedManifest = null;
   return null;
 }
@@ -58,7 +92,7 @@ function resolveField(input, fieldPath) {
   return current;
 }
 function normalizeHookInput(input) {
-  const manifest = detectManifest();
+  const manifest = detectManifest(input);
   const fields = manifest?.hookFields ?? DEFAULT_HOOK_FIELDS;
   const sessionIdFromInput = resolveField(input, fields.sessionId);
   const sessionIdFromEnv = "sessionIdEnv" in fields && fields.sessionIdEnv ? process.env[fields.sessionIdEnv] : void 0;
@@ -80,4 +114,4 @@ export {
   readStdin,
   normalizeHookInput
 };
-//# sourceMappingURL=chunk-5ZISXCDC.js.map
+//# sourceMappingURL=chunk-PFWIPRF6.js.map

package/dist/chunk-PFWIPRF6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/read-stdin.ts","../src/hooks/normalize.ts"],"sourcesContent":["import { STDIN_TIMEOUT_MS } from '../constants.js';\n\nexport function readStdin(): Promise<string> {\n  return new Promise((resolve) => {\n    let data = '';\n    process.stdin.on('data', (chunk: Buffer) => { data += chunk; });\n    process.stdin.on('end', () => resolve(data));\n    setTimeout(() => resolve(data || '{}'), STDIN_TIMEOUT_MS);\n  });\n}\n","/**\n * Hook payload normalization layer.\n *\n * Each agent sends different field names in hook stdin (e.g., Claude Code uses\n * `session_id`, VS Code uses `sessionId`, Windsurf uses `trajectory_id`).\n * This module detects the active agent, loads its manifest, and maps the\n * raw input to a canonical shape that all hooks can consume uniformly.\n */\n\nimport { loadManifests } from '../symbionts/detect.js';\nimport type { SymbiontManifest } from '../symbionts/manifest-schema.js';\n\n/** Default field mappings when no agent manifest is detected (Claude Code conventions). */\nconst DEFAULT_HOOK_FIELDS = {\n  sessionId: 'session_id',\n  transcriptPath: 'transcript_path',\n  lastResponse: 'last_assistant_message',\n  prompt: 'prompt',\n  toolName: 'tool_name',\n  toolInput: 'tool_input',\n  toolOutput: 'tool_output',\n} as const;\n\n/** Canonical hook input with normalized field names. */\nexport interface NormalizedHookInput {\n  /** Detected agent name from manifest (e.g., 'claude-code', 'codex', 'windsurf'). */\n  agent: string;\n  sessionId: string;\n  transcriptPath?: string;\n  lastResponse?: string;\n  prompt?: string;\n  toolName?: string;\n  toolInput?: unknown;\n  toolOutput?: unknown;\n  /** The full raw input for any fields not covered by the mapping. */\n  raw: Record<string, unknown>;\n}\n\n/** Default agent name when no manifest is detected. */\nconst DEFAULT_AGENT_NAME = 'claude-code';\n\n/** Cached manifest for the detected agent — resolved once per process. */\nlet cachedManifest: SymbiontManifest | null | undefined;\n\n/**\n * Parse `--symbiont <name>` from process argv.\n *\n * The hook command line rendered by the installer for every symbiont's\n * hooks.json looks like:\n *\n *     node .agents/myco-run.cjs hook session-start --symbiont codex\n *\n * `.agents/myco-run.cjs` resolves the myco binary via\n * `.myco/runtime.command` and execs it with all argv passed through, so\n * by the time the hook handler module loads, `process.argv` contains\n * the flag. This is the installer's explicit declaration of which\n * symbiont owns this invocation — strictly more reliable than any\n * runtime heuristic.\n *\n * Supports both `--symbiont codex` (two args) and `--symbiont=codex`\n * (one arg) to be forgiving about shell quoting on Windows.\n */\nexport function readSymbiontFlag(argv: readonly string[]): string | undefined {\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (arg === '--symbiont') {\n      const next = argv[i + 1];\n      if (next && !next.startsWith('-')) return next;\n    } else if (arg.startsWith('--symbiont=')) {\n      return arg.slice('--symbiont='.length);\n    }\n  }\n  return undefined;\n}\n\n/**\n * Detect which symbiont is driving this hook invocation.\n *\n * Detection strategies in order:\n *   1. **Primary** — `--symbiont <name>` argv flag rendered into each\n *      agent's hooks.json at install time. Dead simple and unambiguous:\n *      the installer knows which agent it's writing into, so we bake\n *      the identity into the hook command itself.\n *   2. `pluginRootEnvVar` (e.g., `CLAUDE_PLUGIN_ROOT`) — set natively by\n *      agents that cooperate with a plugin system. Fallback for older\n *      installs that predate the argv flag.\n *   3. `sessionIdEnv` fallback (e.g., `GEMINI_SESSION_ID`) — set by agents\n *      that expose the session via env var rather than payload field.\n *   4. Payload-driven heuristic: match the event's `transcript_path` /\n *      `cwd` against each manifest's `configDir`. Safety net for pre-\n *      flag installations that have somehow also lost their env-var\n *      signal. Generic — works for every manifest without per-agent\n *      branching.\n *\n * The cache is per-process, which is fine: each hook invocation is a\n * short-lived Node process. `input` is optional so callers that just\n * want env-based detection (e.g., at module import time) still work.\n */\nfunction detectManifest(input?: Record<string, unknown>): SymbiontManifest | null {\n  if (cachedManifest !== undefined) return cachedManifest;\n\n  const manifests = loadManifests();\n\n  // 1) Primary: explicit --symbiont flag from the installer-rendered\n  //    hook command. This is the source of truth when present.\n  const flagName = readSymbiontFlag(process.argv);\n  if (flagName) {\n    const m = manifests.find((x) => x.name === flagName);\n    if (m) {\n      cachedManifest = m;\n      return m;\n    }\n    // Flag specified an unknown manifest — fall through to heuristics\n    // rather than guessing. Logging happens at the handler level.\n  }\n\n  // 2) Env-var detection: check pluginRootEnvVar for each manifest.\n  for (const m of manifests) {\n    if (process.env[m.pluginRootEnvVar]) {\n      cachedManifest = m;\n      return m;\n    }\n  }\n\n  // 3) sessionIdEnv fallback (e.g., GEMINI_SESSION_ID).\n  for (const m of manifests) {\n    if (m.hookFields.sessionIdEnv && process.env[m.hookFields.sessionIdEnv]) {\n      cachedManifest = m;\n      return m;\n    }\n  }\n\n  // 4) Payload-driven heuristic: match configDir against transcript_path\n  //    / cwd. Kept as a safety net for pre-flag installations. Preferred\n  //    signals above always win when they're available.\n  if (input) {\n    const candidates: string[] = [];\n    const tp = input.transcript_path;\n    const cwd = input.cwd;\n    if (typeof tp === 'string' && tp.length > 0) candidates.push(tp);\n    if (typeof cwd === 'string' && cwd.length > 0) candidates.push(cwd);\n    for (const m of manifests) {\n      const marker = `/${m.configDir}/`;\n      if (candidates.some((c) => c.includes(marker))) {\n        cachedManifest = m;\n        return m;\n      }\n    }\n  }\n\n  cachedManifest = null;\n  return null;\n}\n\n/**\n * Resolve a potentially nested field path from the input.\n * Supports dot notation for nested objects (e.g., \"tool_info.command_line\").\n */\nfunction resolveField(input: Record<string, unknown>, fieldPath: string): unknown {\n  const parts = fieldPath.split('.');\n  let current: unknown = input;\n  for (const part of parts) {\n    if (current === null || current === undefined || typeof current !== 'object') return undefined;\n    current = (current as Record<string, unknown>)[part];\n  }\n  return current;\n}\n\n/**\n * Normalize a raw hook input using the active agent's manifest field mappings.\n * Falls back to Claude Code field names if no agent is detected.\n */\nexport function normalizeHookInput(input: Record<string, unknown>): NormalizedHookInput {\n  const manifest = detectManifest(input);\n  const fields = manifest?.hookFields ?? DEFAULT_HOOK_FIELDS;\n\n  // Resolve session ID: try the mapped field, then env var fallback, then MYCO_SESSION_ID\n  const sessionIdFromInput = resolveField(input, fields.sessionId) as string | undefined;\n  const sessionIdFromEnv = 'sessionIdEnv' in fields && fields.sessionIdEnv\n    ? process.env[fields.sessionIdEnv]\n    : undefined;\n  const sessionId = sessionIdFromInput\n    ?? sessionIdFromEnv\n    ?? process.env.MYCO_SESSION_ID\n    ?? `s-${Date.now()}`;\n\n  return {\n    agent: manifest?.name ?? DEFAULT_AGENT_NAME,\n    sessionId,\n    transcriptPath: resolveField(input, fields.transcriptPath) as string | undefined,\n    lastResponse: resolveField(input, fields.lastResponse) as string | undefined,\n    prompt: resolveField(input, fields.prompt) as string | undefined,\n    toolName: resolveField(input, fields.toolName) as string | undefined,\n    toolInput: resolveField(input, fields.toolInput),\n    toolOutput: resolveField(input, fields.toolOutput),\n    raw: input,\n  };\n}\n\n/** Reset cached manifest — exposed for testing only. */\nexport function _resetManifestCache(): void {\n  cachedManifest = undefined;\n}\n"],"mappings":";;;;;;;;;AAEO,SAAS,YAA6B;AAC3C,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,OAAO;AACX,YAAQ,MAAM,GAAG,QAAQ,CAAC,UAAkB;AAAE,cAAQ;AAAA,IAAO,CAAC;AAC9D,YAAQ,MAAM,GAAG,OAAO,MAAM,QAAQ,IAAI,CAAC;AAC3C,eAAW,MAAM,QAAQ,QAAQ,IAAI,GAAG,gBAAgB;AAAA,EAC1D,CAAC;AACH;;;ACIA,IAAM,sBAAsB;AAAA,EAC1B,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AAAA,EACX,YAAY;AACd;AAkBA,IAAM,qBAAqB;AAG3B,IAAI;AAoBG,SAAS,iBAAiB,MAA6C;AAC5E,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,QAAQ,cAAc;AACxB,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,QAAQ,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO;AAAA,IAC5C,WAAW,IAAI,WAAW,aAAa,GAAG;AACxC,aAAO,IAAI,MAAM,cAAc,MAAM;AAAA,IACvC;AAAA,EACF;AACA,SAAO;AACT;AAyBA,SAAS,eAAe,OAA0D;AAChF,MAAI,mBAAmB,OAAW,QAAO;AAEzC,QAAM,YAAY,cAAc;AAIhC,QAAM,WAAW,iBAAiB,QAAQ,IAAI;AAC9C,MAAI,UAAU;AACZ,UAAM,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AACnD,QAAI,GAAG;AACL,uBAAiB;AACjB,aAAO;AAAA,IACT;AAAA,EAGF;AAGA,aAAW,KAAK,WAAW;AACzB,QAAI,QAAQ,IAAI,EAAE,gBAAgB,GAAG;AACnC,uBAAiB;AACjB,aAAO;AAAA,IACT;AAAA,EACF;AAGA,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,WAAW,gBAAgB,QAAQ,IAAI,EAAE,WAAW,YAAY,GAAG;AACvE,uBAAiB;AACjB,aAAO;AAAA,IACT;AAAA,EACF;AAKA,MAAI,OAAO;AACT,UAAM,aAAuB,CAAC;AAC9B,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM;AAClB,QAAI,OAAO,OAAO,YAAY,GAAG,SAAS,EAAG,YAAW,KAAK,EAAE;AAC/D,QAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,EAAG,YAAW,KAAK,GAAG;AAClE,eAAW,KAAK,WAAW;AACzB,YAAM,SAAS,IAAI,EAAE,SAAS;AAC9B,UAAI,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,CAAC,GAAG;AAC9C,yBAAiB;AACjB,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,mBAAiB;AACjB,SAAO;AACT;AAMA,SAAS,aAAa,OAAgC,WAA4B;AAChF,QAAM,QAAQ,UAAU,MAAM,GAAG;AACjC,MAAI,UAAmB;AACvB,aAAW,QAAQ,OAAO;AACxB,QAAI,YAAY,QAAQ,YAAY,UAAa,OAAO,YAAY,SAAU,QAAO;AACrF,cAAW,QAAoC,IAAI;AAAA,EACrD;AACA,SAAO;AACT;AAMO,SAAS,mBAAmB,OAAqD;AACtF,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,SAAS,UAAU,cAAc;AAGvC,QAAM,qBAAqB,aAAa,OAAO,OAAO,SAAS;AAC/D,QAAM,mBAAmB,kBAAkB,UAAU,OAAO,eACxD,QAAQ,IAAI,OAAO,YAAY,IAC/B;AACJ,QAAM,YAAY,sBACb,oBACA,QAAQ,IAAI,mBACZ,KAAK,KAAK,IAAI,CAAC;AAEpB,SAAO;AAAA,IACL,OAAO,UAAU,QAAQ;AAAA,IACzB;AAAA,IACA,gBAAgB,aAAa,OAAO,OAAO,cAAc;AAAA,IACzD,cAAc,aAAa,OAAO,OAAO,YAAY;AAAA,IACrD,QAAQ,aAAa,OAAO,OAAO,MAAM;AAAA,IACzC,UAAU,aAAa,OAAO,OAAO,QAAQ;AAAA,IAC7C,WAAW,aAAa,OAAO,OAAO,SAAS;AAAA,IAC/C,YAAY,aAAa,OAAO,OAAO,UAAU;AAAA,IACjD,KAAK;AAAA,EACP;AACF;","names":[]}

package/dist/{chunk-3NCVCGUZ.js → chunk-RAV5YMRU.js}

@@ -3,14 +3,14 @@ import {
   AgentTaskSchema,
   loadAgentTasks,
   taskFromParsed
-} from "./chunk-F6C4IC6R.js";
+} from "./chunk-NI23QCHB.js";
 import {
   BUILT_IN_SOURCE,
   MAX_TASK_NAME_LENGTH,
   TASK_NAME_PATTERN,
   USER_TASKS_DIR,
   USER_TASK_SOURCE
-} from "./chunk-7DAH5GLC.js";
+} from "./chunk-CKJAWZQE.js";
 import {
   require_dist
 } from "./chunk-D7TYRPRM.js";
@@ -100,4 +100,4 @@ export {
   deleteUserTask,
   copyTaskToUser
 };
-//# sourceMappingURL=chunk-3NCVCGUZ.js.map
+//# sourceMappingURL=chunk-RAV5YMRU.js.map

package/dist/{chunk-RKPTMHED.js → chunk-U3J2DDSR.js}

@@ -2,7 +2,7 @@ import { createRequire as __cr } from 'node:module'; const require = __cr(import
 import {
   getTeamMachineId,
   syncRow
-} from "./chunk-C3C5QVLK.js";
+} from "./chunk-O3TRN3RC.js";
 import {
   getDatabase
 } from "./chunk-MYX5NCRH.js";
@@ -88,4 +88,4 @@ export {
   insertResolutionEvent,
   listResolutionEvents
 };
-//# sourceMappingURL=chunk-RKPTMHED.js.map
+//# sourceMappingURL=chunk-U3J2DDSR.js.map

package/dist/{chunk-25WHTV4N.js → chunk-U7GJTVSX.js}

@@ -2,7 +2,7 @@ import { createRequire as __cr } from 'node:module'; const require = __cr(import
 import {
   getTeamMachineId,
   syncRow
-} from "./chunk-C3C5QVLK.js";
+} from "./chunk-O3TRN3RC.js";
 import {
   getDatabase
 } from "./chunk-MYX5NCRH.js";
@@ -302,4 +302,4 @@ export {
   getSessionImpact,
   deleteSessionCascade
 };
-//# sourceMappingURL=chunk-25WHTV4N.js.map
+//# sourceMappingURL=chunk-U7GJTVSX.js.map

package/dist/{chunk-NUSTG3BH.js → chunk-VOCGURV7.js}

@@ -5,13 +5,13 @@ import {
 import {
   normalizeHookInput,
   readStdin
-} from "./chunk-5ZISXCDC.js";
+} from "./chunk-PFWIPRF6.js";
 import {
   resolveVaultDir
 } from "./chunk-5ZT2Q6P5.js";
 import {
   DaemonClient
-} from "./chunk-XZWFMMJR.js";
+} from "./chunk-BUIR3JWM.js";
 
 // src/hooks/send-event.ts
 import fs from "fs";
@@ -39,4 +39,4 @@ async function sendEvent(hookName, buildEvent) {
 export {
   sendEvent
 };
-//# sourceMappingURL=chunk-NUSTG3BH.js.map
+//# sourceMappingURL=chunk-VOCGURV7.js.map

package/dist/{chunk-VVGZL2HX.js → chunk-WYOE4IAX.js}

@@ -208,9 +208,8 @@ function writeOrDeleteJsonFile(filePath, data) {
 // src/symbionts/install-helpers.ts
 import fs2 from "fs";
 import path2 from "path";
-var MYCO_HOOK_COMMAND_PREFIX = "myco-run";
 function isMycoHookCommand(command) {
-  return command.startsWith(MYCO_HOOK_COMMAND_PREFIX) || command.includes(".agents/myco-hook.cjs");
+  return command.includes(".agents/myco-run.cjs") || command.includes(".agents/myco-hook.cjs") || command.startsWith("myco-run");
 }
 function isMycoHookGroup(group) {
   if (Array.isArray(group.hooks) && group.hooks.some((h) => h.command && isMycoHookCommand(h.command))) return true;
@@ -250,9 +249,10 @@ var GITIGNORE_COMMENT = "# Myco managed (machine-specific)";
 var GITIGNORE_SKILLS_COMMENT_LEGACY = "# Myco skill symlinks (machine-specific)";
 var WRANGLER_CACHE_DIR = ".wrangler/";
 var TEMPLATES_SUBDIR = "src/symbionts/templates";
-var HOOK_GUARD_TEMPLATE_FILENAME = "hook-guard.cjs";
-var HOOK_GUARD_INSTALLED_FILENAME = "myco-hook.cjs";
+var HOOK_GUARD_TEMPLATE_FILENAME = "myco-run.cjs";
+var HOOK_GUARD_INSTALLED_FILENAME = "myco-run.cjs";
 var HOOK_GUARD_PROJECT_PATH = `.agents/${HOOK_GUARD_INSTALLED_FILENAME}`;
+var LEGACY_HOOK_GUARD_PATH = ".agents/myco-hook.cjs";
 var SKILLS_SUBDIR = "skills";
 var CANONICAL_SKILLS_DIR = ".agents/skills";
 var MYCO_MCP_SERVER_NAME = "myco";
@@ -306,33 +306,47 @@ var SymbiontInstaller = class {
     return true;
   }
   /**
-   * Copy the hook-guard script into .agents/myco-hook.cjs.
-   * Returns true if the file was written (or updated); false if skipped or N/A.
+   * Copy the hook guard script into .agents/myco-run.cjs and delete the
+   * legacy .agents/myco-hook.cjs if present.
+   *
+   * The guard is the cross-platform entry point for lifecycle hooks.
+   * Hook commands invoke `node .agents/myco-run.cjs …`, and the guard
+   * resolves which myco binary to exec via `.myco/runtime.command`.
+   * MCP server spawn continues to use the published `myco-run` binary.
+   * Returns true if the file was written (or updated); false if skipped
+   * or N/A.
    */
   installHookGuard() {
     const reg = this.manifest.registration;
     if (!reg?.hooksTarget) return false;
     const guardTemplate = this.readTemplateFile(HOOK_GUARD_TEMPLATE_FILENAME);
     if (!guardTemplate) return false;
+    try {
+      fs3.unlinkSync(path3.join(this.projectRoot, LEGACY_HOOK_GUARD_PATH));
+    } catch {
+    }
     return this.writeManagedFile(
       path3.join(this.projectRoot, HOOK_GUARD_PROJECT_PATH),
       guardTemplate
     );
   }
   /**
-   * Remove the hook-guard script from .agents/myco-hook.cjs.
-   * Returns true if the file was removed; false otherwise.
+   * Remove the hook guard script from .agents/myco-run.cjs.
+   * Also deletes the legacy .agents/myco-hook.cjs if present.
+   * Returns true if any file was removed; false otherwise.
    */
   uninstallHookGuard() {
     const reg = this.manifest.registration;
     if (!reg?.hooksTarget) return false;
-    const targetPath = path3.join(this.projectRoot, HOOK_GUARD_PROJECT_PATH);
-    try {
-      fs3.unlinkSync(targetPath);
-      return true;
-    } catch {
-      return false;
+    let removed = false;
+    for (const relPath of [HOOK_GUARD_PROJECT_PATH, LEGACY_HOOK_GUARD_PATH]) {
+      try {
+        fs3.unlinkSync(path3.join(this.projectRoot, relPath));
+        removed = true;
+      } catch {
+      }
     }
+    return removed;
   }
   /** Load a JSON template file for this symbiont. Returns null if not found. */
   loadTemplate(name) {
@@ -356,6 +370,7 @@ var SymbiontInstaller = class {
   install() {
     const reg = this.manifest.registration;
     this.installHookGuard();
+    this.cleanupLegacyMycoCmdEntries();
     const result = this.shouldBatchJsonTargets(reg) ? this.installBatchedJson(reg) : {
       hooks: this.installHooks(),
       mcp: this.installMcp(),
@@ -367,6 +382,129 @@ var SymbiontInstaller = class {
     this.updateGitignore();
     return result;
   }
+  /**
+   * Sweep legacy `MYCO_CMD` env-var writes and `myco-run` command-name
+   * entries from this symbiont's installed config files.
+   *
+   * Background: prior to the `.myco/runtime.command` refactor, `make
+   * dev-link` injected `MYCO_CMD=myco-dev` into each symbiont's env
+   * block (`.claude/settings.json` → `env`, `.cursor/mcp.json` →
+   * `mcp.myco.env`, `.codex/config.toml` →
+   * `[shell_environment_policy.set]`), and each symbiont's template
+   * permission allowlist listed `myco-run` as a callable command. The
+   * env-var pattern is now obsolete — `.myco/runtime.command` is the
+   * hook-side source of truth — while the old allowlist entries remain
+   * legacy noise after the permissions refactor.
+   *
+   * This cleanup runs automatically on every install/update pass so
+   * contributors upgrading across this refactor don't need to manually
+   * edit any config file. Idempotent: a second run after cleanup is a
+   * no-op. Safe to remove from the install pipeline once every known
+   * contributor has updated at least once.
+   */
+  cleanupLegacyMycoCmdEntries() {
+    const reg = this.manifest.registration;
+    if (!reg) return;
+    if (reg.settingsTarget) {
+      const settingsPath = path3.join(this.projectRoot, reg.settingsTarget);
+      const format = reg.settingsFormat ?? "json";
+      if (format === "toml") {
+        this.stripLegacyFromToml(settingsPath);
+      } else {
+        this.stripLegacyFromJson(settingsPath);
+      }
+    }
+    if (reg.mcpTarget && reg.mcpFormat !== "toml") {
+      this.stripLegacyFromJson(path3.join(this.projectRoot, reg.mcpTarget));
+    }
+  }
+  /**
+   * Walk a JSON settings/MCP file and delete legacy MYCO_CMD + myco-run
+   * entries. Writes back only if something changed.
+   *
+   * Removes:
+   * - `MYCO_CMD` key from any object named `env` anywhere in the tree
+   * - `myco-run` / `myco-run *` / `myco-run:*` / `Bash(myco-run *)` /
+   *   `Bash(myco-run:*)` / `ShellTool(myco-run *)` from string arrays
+   * - `myco-run` / `myco-run *` keys from object-boolean maps like
+   *   `chat.tools.terminal.autoApprove`
+   */
+  stripLegacyFromJson(filePath) {
+    let raw;
+    try {
+      raw = fs3.readFileSync(filePath, "utf-8");
+    } catch {
+      return;
+    }
+    let data;
+    try {
+      data = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    let changed = false;
+    const LEGACY_STRINGS = /* @__PURE__ */ new Set([
+      "myco-run",
+      "myco-run *",
+      "myco-run:*",
+      "Bash(myco-run *)",
+      "Bash(myco-run:*)",
+      "ShellTool(myco-run *)"
+    ]);
+    const LEGACY_OBJECT_KEYS = ["myco-run", "myco-run *"];
+    const EXEC_ARGV_KEYS = /* @__PURE__ */ new Set(["command", "args"]);
+    const walk = (node, parentKey) => {
+      if (node === null || typeof node !== "object") return;
+      if (Array.isArray(node)) {
+        if (parentKey !== void 0 && EXEC_ARGV_KEYS.has(parentKey)) return;
+        for (let i = node.length - 1; i >= 0; i--) {
+          if (typeof node[i] === "string" && LEGACY_STRINGS.has(node[i])) {
+            node.splice(i, 1);
+            changed = true;
+          } else {
+            walk(node[i]);
+          }
+        }
+        return;
+      }
+      const obj = node;
+      if (parentKey === "env" && "MYCO_CMD" in obj) {
+        delete obj.MYCO_CMD;
+        changed = true;
+      }
+      for (const key of LEGACY_OBJECT_KEYS) {
+        if (key in obj) {
+          delete obj[key];
+          changed = true;
+        }
+      }
+      for (const [k, v] of Object.entries(obj)) {
+        walk(v, k);
+      }
+    };
+    walk(data);
+    if (changed) {
+      fs3.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+    }
+  }
+  /**
+   * Strip `MYCO_CMD = "..."` from the `[shell_environment_policy.set]`
+   * section of a TOML settings file. Leaves the rest of the file
+   * untouched. Drops the `[shell_environment_policy.set]` header entirely
+   * when the section becomes empty.
+   */
+  stripLegacyFromToml(filePath) {
+    let raw;
+    try {
+      raw = fs3.readFileSync(filePath, "utf-8");
+    } catch {
+      return;
+    }
+    const next = removeTomlSectionKeys(raw, "shell_environment_policy.set", ["MYCO_CMD"]);
+    if (next !== raw) {
+      fs3.writeFileSync(filePath, next, "utf-8");
+    }
+  }
   /**
    * Check if ALL non-null JSON targets share the same file (e.g., Gemini).
    * Only batches when every target resolves to one path — partial overlaps
@@ -1102,4 +1240,4 @@ export {
   SymbiontInstaller,
   syncSkillSymlinks
 };
-//# sourceMappingURL=chunk-VVGZL2HX.js.map
+//# sourceMappingURL=chunk-WYOE4IAX.js.map