@halofy/agent-connect 0.12.1 → 0.13.1

package/README.md

@@ -1,6 +1,6 @@
 # Halofy agent lifecycle installer
 
-Status: source for `@halofy/agent-connect@0.12.1`; publication and deployment
+Status: source for `@halofy/agent-connect@0.13.1`; publication and deployment
 require separate verification. The production console supplies the command for
 the verified published package pinned by the deployment workflow. Host loading
 requires separate verification.
@@ -24,14 +24,80 @@ conversations and serves the agent-invoked MCP memory tools, but does not push
 recalled memory into host sessions on session start or prompt submit. The
 bounded recall block formats stay in place and tested for when it returns.
 
+## Headless host limits and explicit refresh
+
+Codex `exec` lifecycle hooks are not verified. A local Codex CLI 0.154.0
+probe reached session/model dispatch without invoking configured SessionStart
+or UserPromptSubmit hooks. Do not infer startup delivery, capture or complete
+conversation coverage from the presence of `hooks.json`. This source adds an
+explicit refresh command for an existing installation:
+
+```bash
+node "/absolute/path/to/runtime/0.13.1/bin/halofy-agent.mjs" sync --connection <installation-id>
+```
+
+The installer prints `syncCommand` with the exact executable, argument array
+and `HALOFY_AGENT_HOME` environment for this installation. Use those values
+(the example path above is a placeholder); an `npx` installation does not put
+`halofy-agent` on your shell PATH. Run it before starting headless work. It
+refreshes instructions, policies, knowledge references and assigned skills through the same signed, authorized delivery path without creating a
+host session or capturing messages. It exits nonzero if instructions or
+acknowledged file delivery are unavailable. A successful refresh proves file
+delivery only; start a new host session to load changes. It does not add hooks
+to `codex exec` or enable headless capture. Existing 0.12.1 installations do
+not acquire this command until the new package is published and installed.
+
+Claude installation adds a read-only permission for the exact installation's
+`halofy-context-<hash>` directory, never the whole skills tree, runtime keys,
+shell commands or MCP tools. Existing ask/deny rules remain authoritative.
+Project allow rules require a trusted workspace; `claude -p` in an untrusted
+folder may ignore them. Assigned skill folders and MCP tools may still need
+separate host permission. No trust markers or permission-bypass flags are set.
+See [Claude permissions](https://code.claude.com/docs/en/permissions).
+
+Guarded Claude installations give managed skills immutable version aliases and
+check current eligibility before native `Skill` expansion. Approved calls keep
+normal host permissions; retired, replaced or unverifiable managed versions are
+denied, including bodies Claude cached before its startup sync. Unrelated
+employee skills outside reserved `halofy-managed-*` aliases and legacy tombstone
+names remain unchanged when ownership history is intact. This requires
+the installed trusted hook to execute and a reachable Halofy server. It cannot
+recall earlier conversation content, downloaded copies or arbitrary file reads.
+Other trusted hooks that rewrite `Skill` input are incompatible with this guard:
+Claude can apply their rewritten input after Halofy's check.
+Installer compatibility diagnostics inspect project, project-local and user
+settings. An empty overlap list does not verify plugin, managed or command-line
+hooks, or hooks introduced after installation.
+
+If ownership history is missing or corrupt, all native Skill calls pause because
+the runtime cannot safely distinguish employee skills from legacy managed names.
+An administrator must restore verified `claude-skill-guard` ownership state or
+review a reconnect migration that preserves legacy tombstones. Do not delete or
+recreate an empty history to bypass the pause. Ordinary reinstall does not reset
+initialized history.
+
+The isolated real-host regression is opt-in (no global configuration or real
+credentials): `HALOFY_CLAUDE_HOST_TEST=1 node --test test/claude-host-skills.test.mjs`.
+Set `HALOFY_CLAUDE_BINARY` if `claude` is not on PATH. It verifies current managed
+and employee skill expansion, native deny preservation and cached retired-body
+denial, including whitespace around legacy names. It also reproduces the trusted
+input-rewrite limitation in both hook registration orders.
+
+For Codex, `HALOFY_CODEX_HOST_TEST=1 node --test test/codex-host-skills.test.mjs`
+verifies signed explicit synchronization removes a retired skill's catalog and
+explicitly requested body from the first fresh host request while preserving an
+employee skill. Set `HALOFY_CODEX_BINARY` if needed. A running conversation can
+retain already-loaded content; publication alone does not refresh installed
+runtimes or their managed copies.
+
 ## Browser sign-in
 
 Users assigned to a team can run the installer without a manually copied badge.
-Use the production console’s verified command. After 0.12.1 is published and
+Use the production console’s verified command. After 0.13.1 is published and
 verified, the command for this source version is:
 
 ```bash
-npx @halofy/agent-connect@0.12.1 install claude-code --server https://app.halofy.ai
+npx @halofy/agent-connect@0.13.1 install claude-code --server https://app.halofy.ai
 ```
 
 `login <client-kind> --server <origin>` is an alias for the same installation
@@ -45,11 +111,11 @@ pending key survives retries. Installation still requires the terminal's
 explicit CONNECT disclosure before changing host configuration.
 
 Browser sign-in requires the matching server enrollment endpoints. The example
-above does not establish that 0.12.1 is published or enabled in production. The
-manual claim path remains supported; after publication, its 0.12.1 form is:
+above does not establish that 0.13.1 is published or enabled in production. The
+manual claim path remains supported; after publication, its 0.13.1 form is:
 
 ```bash
-npx --yes @halofy/agent-connect@0.12.1 install <client-kind> \
+npx --yes @halofy/agent-connect@0.13.1 install <client-kind> \
   --server https://app.halofy.ai \
   --claim '<one-time-claim>'
 ```
@@ -66,6 +132,7 @@ permits only these reviewed client kinds:
 | `codex` | partial | assistant responses, tool failures, session end, binary bodies |
 | `vscode` | partial | assistant responses, binary bodies, context-use evidence |
 | `cline` | partial | assistant responses, tool failures, subagents, compaction, session end, binary bodies |
+| `hermes-agents` | partial; Hermes 0.21.3 (2026.9.14) only | interrupted/intermediate assistant output, compaction, tokens/thinking, subagents, binary bodies, managed instructions/skills/context |
 
 Other catalog entries remain `Not supported yet` or `Not observed`; the
 installer refuses them before claim consumption. A knowledge connector,
@@ -126,16 +193,52 @@ npm test
 npm run check
 ```
 
-Content-free local queue/version evidence is available without decrypting or
-printing any pending event body:
+Content-free local queue/version evidence is available without printing any
+pending event body or proof key:
 
 ```bash
 node kernel/integrations/agent-runtime/bin/halofy-agent.mjs diagnostics
 ```
 
+Pass `--connection <installation-id>` to inspect a specific installation.
+Diagnostics shows installed and running runtime versions, local hook/pause
+health, frozen capture capabilities, queue depth, oldest pending time and expired
+batch count. It makes no server request, and neither active local hooks nor an
+empty queue proves that a particular conversation reached the archive.
+
+## Conversation return reliability (0.13.1 source)
+
+Append acknowledgement is now mandatory and bounded to the submitted batch.
+An empty, non-JSON or malformed success response cannot discard queued events.
+Only explicitly accepted or duplicate events advance the cursor; a server
+sequence ahead of an event conflict cannot acknowledge the rejected local body.
+An unchanged transcript retries its already durable queue, including after a
+lost append response, without requiring another user message. Hook messages
+without a native event id receive an id per invocation, so multiple prompts in
+one Cline task and repeated identical prompts remain separate events. Queue
+retries preserve that id; native event ids still deduplicate host retries.
+
+Retries run at supported hooks, explicit runtime replay and the existing MCP
+proxy's 60-second health tick. Each background tick attempts at most one pending
+batch, with the proxy's five-second request timeout and cancellation on exit.
+Heartbeat reporting continues when replay fails. Paused or replaced installations
+skip background replay; resume permits queued work to retry. The pause result
+reports an incomplete flush while any unacknowledged batch remains. No new monitoring
+process is installed. Abrupt host shutdown can leave pending data until the next
+proxy start or supported hook, subject to the existing seven-day queue limit.
+This release does not widen host capabilities or add assistant
+responses to the partial adapters listed above. Hosts without native event ids
+cannot distinguish two host invocations from a duplicated host callback.
+
+The npm `0.12.1` tarball was downloaded and matched the deployment workflow's
+SHA-256 pin on 2026-09-17. These `0.13.1` fixes require a new reviewed publication,
+server pin promotion and a recipient-confirmed reinstall. Existing runtimes do
+not auto-upgrade. Public health responses and package integrity do not verify
+authenticated production conversation capture.
+
 Version 0.8.0 additionally refreshes authorized organization and team policy and
-knowledge-base references at installation and SessionStart for all seven hosts
-above. Each installation gets a private `halofy-context-*` skill folder containing
+knowledge-base references at installation and SessionStart for the seven pre-Hermes hosts
+above. Hermes does not support this managed delivery. Each installation gets a private `halofy-context-*` skill folder containing
 `SKILL.md` and canonical content references. The content is extracted directives
 and ingested knowledge, not original uploaded files or live backend rows. Host
 skill discovery makes the references available; copying files is not evidence
@@ -251,6 +354,91 @@ precedence, context limits, project configuration and exclusion settings still
 apply. Receipts say `pending_restart`, never loaded or obeyed. Other local OS
 accounts, containers and remote/cloud profiles require their own installation.
 
+### Codex instruction delivery verification
+
+On 2026-09-17, source runtime 0.12.2 was tested against Codex CLI 0.154.0 on
+Linux with disposable profiles and a loopback model endpoint. The actual host's
+outgoing request contained the published instruction after signed prelaunch
+sync, then its replacement, then no managed instruction after authorized
+removal. Personal instruction bytes survived. This verifies that tested host's
+loading path, not model obedience or delivery to an existing employee device.
+The protocol server in this test is synthetic; it does not replace the kernel's
+signed HTTP, scope, publication, or receipt tests.
+
+The probe also runs the actual installer in a second fresh disposable profile:
+organization disclosure and fixture confirmation, claim exchange, generated
+installation proof, signed heartbeat, profile configuration, instruction write,
+ownership manifest, and receipt. The first real Codex request loads that
+instruction. Executing the returned `syncCommand` from the installed runtime
+then replaces it in the first following fresh session. This uses synthetic
+claim authority and confirmation; it is not production enrollment or employee
+consent evidence.
+
+The same probe established two independent startup limits:
+
+- With trusted hooks, `SessionStart` refreshed the file and sent a receipt,
+  but Codex had already discovered the instructions for that session. The new
+  text appeared on the following fresh launch. `pending_restart` is accurate
+  even when the startup fetch succeeded.
+- Without trust for the hook definition, Codex skipped the hook and made no
+  instruction request. Installing hook configuration does not establish that
+  the host executes it. Review and trust the installed hooks through Codex's
+  own workflow; do not disable the host's trust checks as a production remedy.
+
+For a published instruction with no verified host delivery:
+
+1. Where authorized evidence is available, correlate the device, OS account,
+   Codex profile (`CODEX_HOME`), badge namespace, active installation, and
+   executable runtime version. A newer staged package or a different signed-in
+   console workspace proves none of
+   these. Never share private keys, claims, or complete connection files.
+2. If the installation predates instruction support or lacks the consented
+   `instructionProfile`, have its recipient complete the currently verified
+   setup/reconnect command for that host and badge. Do not manufacture a
+   profile by editing the connection JSON. A release must publish and activate
+   a reviewed runtime before using capabilities absent from the current pin.
+3. For a reviewed installed version that provides `syncCommand` (0.12.2 source
+   and later), run its exact executable, arguments, and `HALOFY_AGENT_HOME`
+   environment **before** starting Codex. Check successful exit and `ready:true`.
+   This performs signed file refresh; it neither starts capture nor upgrades
+   an older installed runtime. Source 0.12.2 alone is not publication evidence.
+4. Start a fresh session in the intended profile and workspace. Correlate the
+   effective instruction digest, owned-file manifest, server receipt, and host
+   load evidence. A receipt alone does not establish that the model loaded or
+   followed the instruction. Keep representative workflow verification separate
+   from claims about an affected installation that has not been inspected.
+
+Release acceptance requires the coordinator to verify the reviewed package's
+published version and integrity, the deployed installer pin, and the exact
+installed version. In an authorized disposable installation, use normal scoped
+publication and enrollment to repeat the first-fresh-session check, then the
+replacement and removal checks through the installed `syncCommand`. Retain only
+the installation/version/scope identifiers, effective bundle digest, owned-file
+manifest metadata, receipt outcome, and host-load assertion. Personal content
+must survive each change. A content SHA is not the effective bundle digest.
+These checks can establish a supported delivery remedy without access to an
+end user's device; historical incident repair remains unconfirmed until that
+device's delivery is observed.
+
+The opt-in smoke test requires a local Codex executable, uses no model API key,
+and leaves user profiles untouched. It exercises the real source hook and
+explicit CLI `sync`, fresh installer, and installed runtime with synthetic signed
+responses. The hook-trust bypass is limited to the disposable fixture; a separate
+run verifies untrusted hooks
+are skipped. No raw model requests or private fixture keys are retained.
+
+```sh
+cd kernel/integrations/agent-runtime
+HALOFY_CODEX_HOST_TEST=1 node --test test/codex-host-instructions.test.mjs
+```
+
+Set `HALOFY_CODEX_BINARY` to select another executable. The test reports its
+version and observed startup timing; it is skipped in the default hermetic
+suite. See the official [Codex instruction discovery](https://learn.chatgpt.com/docs/agent-configuration/agents-md),
+[hook trust](https://learn.chatgpt.com/docs/hooks), and
+[provider configuration](https://learn.chatgpt.com/docs/config-file/config-reference)
+references for the host mechanisms used by the fixture.
+
 Sync validates exact content and bundle digests, scope ancestry/order and size
 before writing. Personal bytes outside a managed block are preserved exactly.
 An isolated ownership manifest, exclusive profile lock, no-follow reads,
@@ -271,3 +459,54 @@ selected profile. Local filesystem errors and receipt failures do not interrupt
 capture or MCP. Neither instruction text, filesystem paths nor backups are sent
 in status receipts. Existing policy/knowledge/skill operations and runtime queue
 files are not changed by instruction sync.
+
+
+## Hermes pinned adapter (since 0.13.0)
+
+This source supports [Hermes Agent v2026.9.14](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.9.14),
+package version `0.21.3`, upstream commit
+`345cd2b057a452236de401d3534b8502a7465e8d`. The installer executes
+`hermes --version` and rejects other versions before consuming a claim. The
+server offers Hermes only with a verified stable installer at least `0.13.0`.
+Publication, server activation and each employee installation require separate
+verification. Existing runtimes do not upgrade automatically.
+
+Installation targets the selected `HERMES_HOME`, otherwise `~/.hermes`, after
+explicit CONNECT consent. One owned `plugins/halofy-lifecycle` directory contains
+a native Python observer (`capture`) and a portable MCP plugin (`memory`).
+Both exact discovery keys are enabled. Unrelated YAML/comments/plugins remain;
+ambiguous YAML, symlinks, disabled plugins, namespace collisions and edited owned
+files stop installation. A known conflict is checked before claim consumption.
+The portable plugin uses the native namespaced server key, not a generic
+`mcp_servers.halofy` command. No credentials are stored in either plugin.
+
+The capture plugin records submitted user text, final uninterrupted assistant
+text and native tool call/results. Native end-of-turn commits a checkpoint;
+only finalize closes the session. Missing, multimodal, oversized or interrupted
+content produces explicit gaps. No transcript files are read. Recall remains
+agent-invoked through signed MCP tools; no recalled context is injected. Managed
+instructions, skills and knowledge references remain unsupported.
+
+Before starting a new MCP proxy, the runtime validates native portable
+`PLUGIN_ROOT`, independently profile-derived `PLUGIN_DATA`, the working
+directory, the exact host version and owned configuration. Config-only copies
+have no executable memory plugin. Profile clones, moves and symlinked plugin
+subtrees must reconnect explicitly. A whole-home alias to the same canonical
+directory is the same profile, not a newly enrolled profile. These checks prevent
+accidental authority inheritance; they are not attestation against a process
+that deliberately forges its environment and command under the same OS account
+that can already read the installation proof.
+
+The package bundles `yaml@2.9.1` under its original ISC license. Release CI installs
+locked dependencies with scripts disabled; the durable runtime copy includes the
+bundled dependency and license so it works after the transient package directory
+is removed. `test/hermes-package.test.mjs` packs the real artifact and verifies
+that offline copy. Setting `HALOFY_HERMES_PYTHON` to an isolated pinned Hermes
+interpreter additionally runs native discovery and synthetic local-model turns,
+checks signed lifecycle/MCP requests, and exercises rejected profile copies.
+This is host/protocol verification, not real-provider inference or production
+connection evidence.
+
+Manual bearer MCP remains a separate existing memory-tools-only alternative;
+see the [official Hermes MCP configuration reference](https://hermes-agent.nousresearch.com/docs/reference/mcp-config-reference).
+A manual MCP connection is not lifecycle capture evidence.

package/bin/halofy-agent.mjs

@@ -1,13 +1,32 @@
 #!/usr/bin/env node
+import { skillInvocationDenial } from "../src/skill-guard.mjs";
 import { ConnectionStore, defaultRuntimeDirectory } from "../src/storage.mjs";
 import { loadActiveConnection } from "../src/active.mjs";
 import { runStdioMcpProxy } from "../src/mcp-proxy.mjs";
 import { BoundedEncryptedQueue } from "../src/queue.mjs";
 import { runClaudeLifecycleHook } from "../src/claude-hook.mjs";
 import { HOST_HOOK_EVENTS, runHostLifecycleHook } from "../src/host-hook.mjs";
+import { HERMES_HOOK_EVENTS, runHermesLifecycleHook } from "../src/hermes-hook.mjs";
 import { LifecycleRuntime } from "../src/runtime.mjs";
-import { setCapturePaused } from "../src/health.mjs";
-import { join } from "node:path";
+import { inspectCaptureHealth, setCapturePaused } from "../src/health.mjs";
+import { refreshManagedConfiguration } from "../src/delivery-sync.mjs";
+import { RUNTIME_VERSION } from "../src/version.mjs";
+import { join, resolve } from "node:path";
+import { realpath } from "node:fs/promises";
+import { readJson, safeDirectory } from "../src/storage.mjs";
+import { createHash } from "node:crypto";
+import { readPrivateJson } from "../src/context-sync.mjs";
+
+async function loadGuardConnection(installationId) {
+  const root = defaultRuntimeDirectory();
+  const id = installationId || process.env.HALOFY_INSTALLATION_ID
+    || (await readPrivateJson(join(root, "active-claude-code.json")))?.installationId;
+  const connection = await readPrivateJson(new ConnectionStore(root).path(id));
+  if (connection?.clientKind !== "claude-code" || connection.installationId !== id) {
+    throw new Error("Claude skill guard connection identity is unavailable");
+  }
+  return connection;
+}
 
 function option(name) {
   const index = process.argv.indexOf(name);
@@ -15,44 +34,110 @@ function option(name) {
 }
 
 const command = process.argv[2];
-const hookEvent = command === "hook" ? process.argv[3] : null;
+const hookEvent = command === "hook" || command === "hermes-hook" ? process.argv[3] : null;
+// Bound connection/input loading as well as the guard itself below Claude's
+// eight-second timeout. Fail closed with a flushed native decision.
+const guardDeadline = command === "hook" && hookEvent === "PreToolUse" ? setTimeout(() => {
+  process.stdout.write(`${JSON.stringify(skillInvocationDenial())}\n`, () => process.exit(0));
+}, 6000) : null;
 const claudeHookEvents = new Set([
-  "SessionStart", "UserPromptSubmit", "Stop", "PreCompact", "SessionEnd",
+  "PreToolUse", "SessionStart", "UserPromptSubmit", "Stop", "PreCompact", "SessionEnd",
   "SubagentStart", "SubagentStop", "PostToolUse", "PostToolUseFailure", "PostToolBatch",
 ]);
-if (!["mcp", "diagnostics", "hook", "pause", "resume"].includes(command) ||
+if (!["mcp", "hermes-mcp", "diagnostics", "hook", "hermes-hook", "pause", "resume", "sync"].includes(command) ||
+    (command === "hermes-hook" && !HERMES_HOOK_EVENTS.has(hookEvent)) ||
     (command === "hook" && !claudeHookEvents.has(hookEvent) && !HOST_HOOK_EVENTS.has(hookEvent))) {
-  process.stderr.write("Usage: halofy-agent <mcp|diagnostics|hook EVENT|pause|resume> [--connection <installation-id>]\n");
+  process.stderr.write("Usage: halofy-agent <mcp|diagnostics|hook EVENT|pause|resume|sync> [--connection <installation-id>]\n");
   process.exitCode = 2;
 } else {
   try {
+    if (command === "hermes-mcp") {
+      const expected = option("--hermes-home");
+      const actual = process.env.PLUGIN_ROOT;
+      const enrolledPlugin = expected && join(resolve(expected), "plugins", "halofy-lifecycle", "memory");
+      const namespace = `agent-plugin-halofy-lifecycle-memory-${createHash("sha256").update("halofy-lifecycle/memory").digest("hex").slice(0, 8)}`;
+      const enrolledData = expected && join(resolve(expected), "plugin-data", namespace);
+      const actualData = process.env.PLUGIN_DATA;
+      // The pinned native portable loader supplies PLUGIN_ROOT and defaults cwd
+      // to the discovered package. HERMES_HOME is intentionally stripped from
+      // MCP children; a copied descriptor must not authenticate its old profile.
+      if (!expected || !actual || !actualData || !process.env.HALOFY_AGENT_HOME ||
+          resolve(actual) !== enrolledPlugin || await realpath(actual) !== enrolledPlugin ||
+          resolve(actualData) !== enrolledData || await realpath(actualData) !== enrolledData ||
+          process.cwd() !== enrolledPlugin) {
+        throw new Error("this Hermes profile is not enrolled; connect it explicitly");
+      }
+      await safeDirectory(enrolledPlugin);
+      await safeDirectory(enrolledData);
+      // A host upgrade can make Hermes skip the plugin while retaining its
+      // MCP config. Verify the reviewed host before any new proxy heartbeat.
+      const { detectHermes } = await import("../src/hermes-config.mjs");
+      detectHermes();
+      const id = option("--connection");
+      if (!id || !/^[A-Za-z0-9_-]{1,160}$/.test(id)) throw new Error("invalid Hermes installation");
+      const metadata = await readJson(join(defaultRuntimeDirectory(), id, "health-targets.json"));
+      const target = metadata?.targets?.find((entry) => entry.kind === "hermes");
+      const { inspectHermesCaptureHealth } = await import("../src/hermes-health.mjs");
+      if (!target || target.configPath !== join(resolve(expected), "config.yaml") ||
+          target.pluginPath !== join(resolve(expected), "plugins", "halofy-lifecycle") ||
+          (await inspectHermesCaptureHealth(target)).captureState !== "active") {
+        throw new Error("managed Hermes profile configuration changed; reconnect explicitly");
+      }
+    }
     const installationId = option("--connection");
-    const connection = installationId
+    const connection = hookEvent === "PreToolUse" ? await loadGuardConnection(installationId) : installationId
       ? await new ConnectionStore(defaultRuntimeDirectory()).load(installationId)
       : await loadActiveConnection("claude-code");
     if (!connection) throw new Error("no active installation-bound connection");
-    if (command === "mcp") {
+    if (command === "mcp" || command === "hermes-mcp") {
+      if (command === "hermes-mcp" && connection.clientKind !== "hermes-agents") {
+        throw new Error("Hermes profile requires a Hermes installation");
+      }
       await runStdioMcpProxy(connection);
+    } else if (command === "sync") {
+      const root = defaultRuntimeDirectory();
+      const result = await refreshManagedConfiguration(new LifecycleRuntime(connection, { root }), connection, root);
+      process.stdout.write(`${JSON.stringify(result)}\n`);
+      if (!result.ready) process.exitCode = 1;
     } else if (command === "pause" || command === "resume") {
       const root = defaultRuntimeDirectory();
       const runtime = new LifecycleRuntime(connection, { root });
       process.stdout.write(`${JSON.stringify(await setCapturePaused(runtime, root, command === "pause"))}\n`);
+    } else if (command === "hermes-hook") {
+      const result = await runHermesLifecycleHook(connection, hookEvent);
+      if (result.degraded || result.unavailable) process.exitCode = 1;
     } else if (command === "hook") {
       if (connection.clientKind === "claude-code") await runClaudeLifecycleHook(connection, hookEvent);
       else await runHostLifecycleHook(connection, hookEvent);
+      if (hookEvent === "PreToolUse") {
+        await new Promise(resolve => process.stdout.write("", resolve));
+        process.exit(0);
+      }
     } else {
-      const queue = new BoundedEncryptedQueue(join(defaultRuntimeDirectory(), connection.installationId));
+      const root = defaultRuntimeDirectory();
+      const queue = new BoundedEncryptedQueue(join(root, connection.installationId));
       process.stdout.write(`${JSON.stringify({
         installationId: connection.installationId,
         clientKind: connection.clientKind,
         protocolVersion: connection.protocolVersion,
         pluginVersion: connection.pluginVersion,
+        runtimeVersion: RUNTIME_VERSION,
         proofStorage: connection.proofStorage,
+        health: await inspectCaptureHealth(connection, root),
+        declaredCapabilities: Object.fromEntries([
+          "userMessages", "assistantMessages", "toolInputs", "toolOutputs", "toolFailures",
+          "sessionEnd", "tokenUsage", "sessionMetadata", "images", "artifactBodies",
+        ].map((name) => [name, connection.capabilities?.[name] === true])),
+        serverCheck: "not_performed",
         queue: await queue.diagnostics(),
       }, null, 2)}\n`);
     }
   } catch (error) {
-    process.stderr.write(`${error?.message || "Halofy MCP proxy unavailable"}\n`);
-    process.exitCode = 1;
+    if (hookEvent === "PreToolUse") process.stdout.write(`${JSON.stringify(skillInvocationDenial())}\n`);
+    process.stderr.write(`${command === "diagnostics" ? "Halofy diagnostics unavailable" :
+      error?.message || "Halofy MCP proxy unavailable"}\n`);
+    process.exitCode = hookEvent === "PreToolUse" ? 0 : 1;
   }
 }
+
+if (guardDeadline) clearTimeout(guardDeadline);

package/node_modules/yaml/LICENSE

@@ -0,0 +1,13 @@
+Copyright Eemeli Aro <eemeli@gmail.com>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.

package/node_modules/yaml/README.md

@@ -0,0 +1,172 @@
+# YAML <a href="https://www.npmjs.com/package/yaml"><img align="right" src="https://badge.fury.io/js/yaml.svg" title="npm package" /></a>
+
+`yaml` is a definitive library for [YAML](https://yaml.org/), the human friendly data serialization standard.
+This library:
+
+- Supports both YAML 1.1 and YAML 1.2 and all common data schemas,
+- Passes all of the [yaml-test-suite](https://github.com/yaml/yaml-test-suite) tests,
+- Can accept any string as input without throwing, parsing as much YAML out of it as it can, and
+- Supports parsing, modifying, and writing YAML comments and blank lines.
+
+The library is released under the ISC open source license, and the code is [available on GitHub](https://github.com/eemeli/yaml/).
+It has no external dependencies and runs on Node.js as well as modern browsers.
+
+For the purposes of versioning, any changes that break any of the documented endpoints or APIs will be considered semver-major breaking changes.
+Undocumented library internals may change between minor versions, and previous APIs may be deprecated (but not removed).
+
+The minimum supported TypeScript version of the included typings is 3.9;
+for use in earlier versions you may need to set `skipLibCheck: true` in your config.
+This requirement may be updated between minor versions of the library.
+
+For more information, see the project's documentation site: [**eemeli.org/yaml**](https://eemeli.org/yaml/)
+
+For build instructions and contribution guidelines, see [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md).
+
+To install:
+
+```sh
+npm install yaml
+# or
+deno add jsr:@eemeli/yaml
+```
+
+**Note:** These docs are for `yaml@2`. For v1, see the [v1.10.0 tag](https://github.com/eemeli/yaml/tree/v1.10.0) for the source and [eemeli.org/yaml/v1](https://eemeli.org/yaml/v1/) for the documentation.
+
+## API Overview
+
+The API provided by `yaml` has three layers, depending on how deep you need to go: [Parse & Stringify](https://eemeli.org/yaml/#parse-amp-stringify), [Documents](https://eemeli.org/yaml/#documents), and the underlying [Lexer/Parser/Composer](https://eemeli.org/yaml/#parsing-yaml).
+The first has the simplest API and "just works", the second gets you all the bells and whistles supported by the library along with a decent [AST](https://eemeli.org/yaml/#content-nodes), and the third lets you get progressively closer to YAML source, if that's your thing.
+
+A [command-line tool](https://eemeli.org/yaml/#command-line-tool) is also included.
+
+### Parse & Stringify
+
+```js
+import { parse, stringify } from 'yaml'
+```
+
+- [`parse(str, reviver?, options?): value`](https://eemeli.org/yaml/#yaml-parse)
+- [`stringify(value, replacer?, options?): string`](https://eemeli.org/yaml/#yaml-stringify)
+
+### Documents
+
+<!-- prettier-ignore -->
+```js
+import {
+  Document,
+  isDocument,
+  parseAllDocuments,
+  parseDocument
+} from 'yaml'
+```
+
+- [`Document`](https://eemeli.org/yaml/#documents)
+  - [`constructor(value, replacer?, options?)`](https://eemeli.org/yaml/#creating-documents)
+  - [`#contents`](https://eemeli.org/yaml/#content-nodes)
+  - [`#directives`](https://eemeli.org/yaml/#stream-directives)
+  - [`#errors`](https://eemeli.org/yaml/#errors)
+  - [`#warnings`](https://eemeli.org/yaml/#errors)
+- [`isDocument(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`parseAllDocuments(str, options?): Document[]`](https://eemeli.org/yaml/#parsing-documents)
+- [`parseDocument(str, options?): Document`](https://eemeli.org/yaml/#parsing-documents)
+
+### Content Nodes
+
+<!-- prettier-ignore -->
+```js
+import {
+  isAlias, isCollection, isMap, isNode,
+  isPair, isScalar, isSeq, Scalar,
+  visit, visitAsync, YAMLMap, YAMLSeq
+} from 'yaml'
+```
+
+- [`isAlias(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`isCollection(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`isMap(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`isNode(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`isPair(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`isScalar(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`isSeq(foo): boolean`](https://eemeli.org/yaml/#identifying-node-types)
+- [`new Scalar(value)`](https://eemeli.org/yaml/#scalar-values)
+- [`new YAMLMap()`](https://eemeli.org/yaml/#collections)
+- [`new YAMLSeq()`](https://eemeli.org/yaml/#collections)
+- [`doc.createAlias(node, name?): Alias`](https://eemeli.org/yaml/#creating-nodes)
+- [`doc.createNode(value, options?): Node`](https://eemeli.org/yaml/#creating-nodes)
+- [`doc.createPair(key, value): Pair`](https://eemeli.org/yaml/#creating-nodes)
+- [`visit(node, visitor)`](https://eemeli.org/yaml/#finding-and-modifying-nodes)
+- [`visitAsync(node, visitor)`](https://eemeli.org/yaml/#finding-and-modifying-nodes)
+
+### Parsing YAML
+
+```js
+import { Composer, Lexer, Parser } from 'yaml'
+```
+
+- [`new Lexer().lex(src)`](https://eemeli.org/yaml/#lexer)
+- [`new Parser(onNewLine?).parse(src)`](https://eemeli.org/yaml/#parser)
+- [`new Composer(options?).compose(tokens)`](https://eemeli.org/yaml/#composer)
+
+## YAML.parse
+
+```yaml
+# file.yml
+YAML:
+  - A human-readable data serialization language
+  - https://en.wikipedia.org/wiki/YAML
+yaml:
+  - A complete JavaScript implementation
+  - https://www.npmjs.com/package/yaml
+```
+
+```js
+import fs from 'fs'
+import YAML from 'yaml'
+
+YAML.parse('3.14159')
+// 3.14159
+
+YAML.parse('[ true, false, maybe, null ]\n')
+// [ true, false, 'maybe', null ]
+
+const file = fs.readFileSync('./file.yml', 'utf8')
+YAML.parse(file)
+// { YAML:
+//   [ 'A human-readable data serialization language',
+//     'https://en.wikipedia.org/wiki/YAML' ],
+//   yaml:
+//   [ 'A complete JavaScript implementation',
+//     'https://www.npmjs.com/package/yaml' ] }
+```
+
+## YAML.stringify
+
+```js
+import YAML from 'yaml'
+
+YAML.stringify(3.14159)
+// '3.14159\n'
+
+YAML.stringify([true, false, 'maybe', null])
+// `- true
+// - false
+// - maybe
+// - null
+// `
+
+YAML.stringify({ number: 3, plain: 'string', block: 'two\nlines\n' })
+// `number: 3
+// plain: string
+// block: |
+//   two
+//   lines
+// `
+```
+
+---
+
+Browser testing provided by:
+
+<a href="https://www.browserstack.com/open-source">
+<img width=200 src="https://eemeli.org/yaml/images/browserstack.svg" alt="BrowserStack" />
+</a>