@ken-jo/agent-connector 0.4.61 → 0.4.75

package/dist/chunk-ECSRTK4M.js

@@ -0,0 +1,386 @@
+#!/usr/bin/env node
+import {
+  compileMatcher,
+  eventMatcherSubject
+} from "./chunk-24K6JOKV.js";
+import {
+  SURFACE_PREDICATES,
+  hostCanFireEvent
+} from "./chunk-MDZG5QHB.js";
+import {
+  allAdapters,
+  loadAdapter
+} from "./chunk-Q5LECKZL.js";
+
+// src/sdk/test-harness.ts
+function declaredGlobalSurfaces(connector) {
+  const out = [];
+  if (connector.server) out.push("server");
+  if (Object.keys(connector.hooks).length > 0) out.push("hooks");
+  if (connector.commands.length > 0) out.push("commands");
+  if (connector.skills.length > 0) out.push("skills");
+  if (connector.subagents.length > 0) out.push("subagents");
+  if (connector.memory.length > 0) out.push("memory");
+  if (connector.statusline) out.push("statusline");
+  if (connector.actions.length > 0) out.push("actions");
+  return out;
+}
+function platformScopedSurfacesFor(override) {
+  const out = [];
+  if (!override) return out;
+  if ((override.configPatch?.length ?? 0) > 0) out.push("configPatch");
+  if (override.nativeHooks != null && Object.keys(override.nativeHooks).length > 0) {
+    out.push("nativeHooks");
+  }
+  return out;
+}
+function isDisabledForHost(connector, host, surface) {
+  const override = connector.platforms[host];
+  if (!override) return false;
+  switch (surface) {
+    case "server":
+      return override.server === false;
+    case "hooks":
+      return override.hooks === false;
+    case "commands":
+      return override.commands === false;
+    case "skills":
+      return override.skills === false;
+    case "subagents":
+      return override.subagents === false;
+    case "memory":
+      return override.memory === false;
+    case "statusline":
+      return override.statusline === false;
+    case "actions":
+    case "configPatch":
+    case "nativeHooks":
+      return false;
+  }
+}
+async function explain(connector) {
+  const globalSurfaces = declaredGlobalSurfaces(connector);
+  const adapters = await allAdapters();
+  const rows = [];
+  for (const adapter of adapters) {
+    const override = connector.platforms[adapter.id];
+    const surfaces = [
+      ...globalSurfaces,
+      ...platformScopedSurfacesFor(override)
+    ];
+    for (const surface of surfaces) {
+      if (isDisabledForHost(connector, adapter.id, surface)) {
+        rows.push({
+          host: adapter.id,
+          surface,
+          support: "disabled",
+          reason: `connector opted out for ${adapter.id} (platforms.${adapter.id}.${surface} = false)`
+        });
+        continue;
+      }
+      if (surface === "hooks") {
+        rows.push(hooksRow(connector, adapter.id, adapter.capabilities));
+        continue;
+      }
+      const native = SURFACE_PREDICATES[surface](adapter.capabilities);
+      rows.push({
+        host: adapter.id,
+        surface,
+        support: native ? "native" : "skip-warn",
+        reason: explainReason(adapter.id, surface, native)
+      });
+    }
+  }
+  rows.sort(
+    (a, b) => a.host === b.host ? a.surface.localeCompare(b.surface) : a.host.localeCompare(b.host)
+  );
+  return rows;
+}
+function hooksRow(connector, host, capabilities) {
+  const declared = connector.hookEvents;
+  const dead = declared.filter((e) => !hostCanFireEvent(capabilities, e));
+  if (dead.length === 0) {
+    return {
+      host,
+      surface: "hooks",
+      support: "native",
+      reason: `${host} can fire every declared hook event (${declared.join(", ")})`
+    };
+  }
+  const fireable = declared.filter((e) => hostCanFireEvent(capabilities, e));
+  const reason = fireable.length === 0 ? `${host} cannot fire any declared hook event (${dead.join(", ")}); install skip-warns each` : `${host} cannot fire ${dead.join(", ")} (install skip-warns these); honors ${fireable.join(", ")}`;
+  return { host, surface: "hooks", support: "skip-warn", reason };
+}
+function explainReason(host, surface, native) {
+  if (surface === "server") {
+    return native ? `${host} advertises an MCP transport (capability-based; registration may be host-managed)` : `${host} advertises no MCP transport; install skip-warns`;
+  }
+  return native ? `${host} natively supports ${surface}` : `${host} cannot honor ${surface}; install skip-warns`;
+}
+function coerceInput(input) {
+  if (input == null) return {};
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (trimmed === "") return {};
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+      return {};
+    }
+  }
+  return input;
+}
+function normalizeResponse(value) {
+  if (value == null || typeof value !== "object") return {};
+  return value;
+}
+function parseReplyStdout(stdout) {
+  if (stdout == null || stdout.trim() === "") return void 0;
+  try {
+    const value = JSON.parse(stdout);
+    return value != null && typeof value === "object" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b || a == null || b == null) return false;
+  if (typeof a !== "object") return false;
+  const aArr = Array.isArray(a);
+  if (aArr !== Array.isArray(b)) return false;
+  if (aArr) {
+    const x2 = a;
+    const y2 = b;
+    return x2.length === y2.length && x2.every((v, i) => deepEqual(v, y2[i]));
+  }
+  const x = a;
+  const y = b;
+  const xk = Object.keys(x);
+  const yk = Object.keys(y);
+  return xk.length === yk.length && xk.every((k) => deepEqual(x[k], y[k]));
+}
+function judgeHookHonor(host, event, response, stdout) {
+  const decision = response.decision;
+  if (decision === void 0 || decision === "allow") {
+    return { honored: true, reason: "pass-through allow" };
+  }
+  const reply = parseReplyStdout(stdout);
+  const hso = reply?.hookSpecificOutput;
+  if (decision === "context") {
+    const want = response.additionalContext;
+    const got = hso?.additionalContext ?? reply?.systemMessage;
+    if (reply && got === want) {
+      return { honored: true, reason: `${host} injects context on ${event}` };
+    }
+    return {
+      honored: false,
+      reason: `${host} drops context on ${event} (no stdout path)`
+    };
+  }
+  if (decision === "deny") {
+    if (!reply) {
+      return {
+        honored: false,
+        reason: `${host} drops deny on ${event} (deny not honored; fails open to allow)`
+      };
+    }
+    if (hso?.permissionDecision === "deny" || hso?.decision?.behavior === "deny") {
+      return { honored: true, reason: `${host} blocks ${event}` };
+    }
+    if (reply.decision === "block") {
+      return {
+        honored: true,
+        reason: `${host} continues the session/subagent on ${event} (persistence) \u2014 NOT a block`
+      };
+    }
+    if (hso?.additionalContext != null) {
+      return {
+        honored: false,
+        reason: `${host} degrades deny to a context note on ${event}; spawn/failure not blocked`
+      };
+    }
+    return {
+      honored: false,
+      reason: `${host} drops deny on ${event} (deny not honored; fails open to allow)`
+    };
+  }
+  if (decision === "ask") {
+    if (hso?.permissionDecision === "ask") {
+      return { honored: true, reason: `${host} asks on ${event}` };
+    }
+    if (event === "PermissionRequest" && !reply) {
+      return {
+        honored: true,
+        reason: `${host} shows the native confirmation dialog on ${event} (the ask)`
+      };
+    }
+    return {
+      honored: false,
+      reason: `${host} drops ask on ${event} (no ask path)`
+    };
+  }
+  const wrote = hso?.updatedInput ?? hso?.decision?.updatedInput;
+  if (reply && wrote !== void 0 && deepEqual(wrote, response.updatedInput)) {
+    return { honored: true, reason: `${host} rewrites tool input on ${event}` };
+  }
+  return {
+    honored: false,
+    reason: `${host} drops modify on ${event} (modify not honored)`
+  };
+}
+async function simulate(connector, opts) {
+  try {
+    const adapter = await loadAdapter(opts.host);
+    if (!adapter) {
+      return { honored: false, reason: `unknown host "${opts.host}"` };
+    }
+    if (opts.surface === "statusline") {
+      if (!(adapter.capabilities.supportsStatusline ?? false) || !adapter.parseStatusInput || !adapter.formatStatusOutput) {
+        return { honored: false, reason: `${opts.host} has no statusline surface` };
+      }
+      if (!connector.statusline || typeof connector.statusline.render !== "function") {
+        return { honored: false, reason: "connector declares no statusline" };
+      }
+      const ctx = adapter.parseStatusInput(coerceInput(opts.input));
+      ctx.connectorId = connector.id;
+      if (ctx.capabilities == null) ctx.capabilities = adapter.capabilities;
+      const perHost2 = connector.statusline.hosts?.[opts.host]?.render;
+      const render = typeof perHost2 === "function" ? perHost2 : connector.statusline.render;
+      const rendered = await render(ctx);
+      const line = rendered == null ? "" : String(rendered);
+      const reply2 = adapter.formatStatusOutput(line);
+      return {
+        honored: true,
+        ...reply2.stdout !== void 0 ? { hostReply: reply2.stdout } : {},
+        reason: "rendered"
+      };
+    }
+    const event = opts.event;
+    if (!event) {
+      return { honored: false, reason: 'event is required when surface === "hooks"' };
+    }
+    if (!adapter.parseEvent || !adapter.formatReply) {
+      return { honored: false, reason: `${opts.host} has no hook runtime (mcp-only)` };
+    }
+    const evt = adapter.parseEvent(event, coerceInput(opts.input));
+    evt.connectorId = connector.id;
+    evt.capabilities = adapter.capabilities;
+    const definition = connector.hooks[event];
+    if (!definition || typeof definition.handler !== "function") {
+      return { honored: false, reason: `connector declares no ${event} handler` };
+    }
+    const subject = eventMatcherSubject(evt);
+    if (subject !== void 0) {
+      const re = compileMatcher(definition.matcher);
+      if (re && !re.test(subject)) {
+        return {
+          honored: true,
+          reason: `matcher excludes ${subject} (handler not run)`
+        };
+      }
+    }
+    const perHost = definition.hosts?.[opts.host]?.handler;
+    const handler = typeof perHost === "function" ? perHost : definition.handler;
+    const response = normalizeResponse(
+      await handler(evt)
+    );
+    const reply = adapter.formatReply(event, response);
+    const verdict = judgeHookHonor(String(opts.host), event, response, reply.stdout);
+    return {
+      honored: verdict.honored,
+      ...reply.stdout !== void 0 ? { hostReply: reply.stdout } : {},
+      reason: verdict.reason
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const verb = opts.surface === "statusline" ? "render" : "handler";
+    return { honored: false, reason: `${verb} threw: ${message}` };
+  }
+}
+function matchingSubject(matcher, fallback) {
+  if (!matcher || matcher === "") return fallback;
+  return /^[\w.-]+$/.test(matcher) ? matcher : fallback;
+}
+function syntheticPayloadFor(event, matcher) {
+  switch (event) {
+    case "PreToolUse":
+    case "PostToolUse":
+    case "PostToolUseFailure":
+    case "PermissionRequest": {
+      const tool = matchingSubject(matcher, "Bash");
+      return { tool_name: tool, tool_input: { command: "echo hi" } };
+    }
+    case "SubagentStart":
+    case "SubagentStop": {
+      const agent = matchingSubject(matcher, "general");
+      return { agent_type: agent, subagent_type: agent };
+    }
+    case "UserPromptSubmit":
+      return { prompt: "hello" };
+    default:
+      return {};
+  }
+}
+async function explainHooks(connector, hosts) {
+  const events = connector.hookEvents;
+  const rows = [];
+  for (const host of hosts) {
+    const adapter = await loadAdapter(host);
+    if (!adapter) {
+      for (const event of events) {
+        rows.push({
+          host,
+          event,
+          verdict: "dropped",
+          reason: `unknown host "${host}"`
+        });
+      }
+      continue;
+    }
+    const hasHookRuntime = !!adapter.parseEvent && !!adapter.formatReply;
+    for (const event of events) {
+      if (!hasHookRuntime) {
+        rows.push({
+          host: adapter.id,
+          event,
+          verdict: "dropped",
+          reason: `${adapter.id} has no hook runtime (mcp-only) \u2014 ${event} never fires`
+        });
+        continue;
+      }
+      if (!hostCanFireEvent(adapter.capabilities, event)) {
+        rows.push({
+          host: adapter.id,
+          event,
+          verdict: "dropped",
+          reason: `${adapter.id} has no ${event} equivalent \u2014 install skip-warns it; never fires`
+        });
+        continue;
+      }
+      const sim = await simulate(connector, {
+        surface: "hooks",
+        host: adapter.id,
+        event,
+        input: syntheticPayloadFor(event, connector.hooks[event]?.matcher)
+      });
+      rows.push({
+        host: adapter.id,
+        event,
+        verdict: sim.honored ? "honored" : "degraded",
+        reason: sim.reason
+      });
+    }
+  }
+  rows.sort(
+    (a, b) => a.host === b.host ? a.event.localeCompare(b.event) : a.host.localeCompare(b.host)
+  );
+  return rows;
+}
+
+export {
+  explain,
+  simulate,
+  explainHooks
+};
+//# sourceMappingURL=chunk-ECSRTK4M.js.map

package/dist/chunk-ECSRTK4M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/test-harness.ts"],"sourcesContent":["/**\n * sdk/test-harness — the SHIPPED, OFFLINE behavioral harness.\n *\n * Two read-only tools a connector author runs WITHOUT installing anything or\n * touching the host's filesystem:\n *\n *   • `explain(connector)` — the static per-host × per-DECLARED-surface matrix:\n *     for every registered host and every surface the connector actually ships,\n *     is it `native` (the host can honor it), `disabled` (the connector opted\n *     out for that host via `platforms[host].<surface> === false`), or\n *     `skip-warn` (the host cannot honor it → install would skip-warn)?\n *\n *   • `simulate(connector, opts)` — runs the REAL adapter parse → handler →\n *     format chain INLINE against a host-shaped raw payload and reports whether\n *     the host actually HONORS the connector's response (the trustworthy part:\n *     it surfaces the documented degradations, e.g. Codex silently dropping a\n *     UserPromptSubmit \"context\" injection that has no stdout path).\n *\n * It deliberately does NOT import the runtime entrypoints (runHook /\n * runStatusline) — those load the REGISTERED connector from disk and record\n * telemetry. The harness instead re-implements the tiny parse→handler→format\n * chain against the in-memory connector + the adapter, mirroring the runtime's\n * input tolerance (empty/malformed payload → `{}`) and its fail-safe envelope.\n */\n\nimport type {\n  HookEventName,\n  HookResponse,\n  PlatformCapabilities,\n  PlatformId,\n  PlatformOverride,\n  ResolvedConnector,\n} from \"../core/types.js\";\nimport { allAdapters, loadAdapter } from \"../adapters/registry.js\";\nimport type { NormalizedEvent } from \"../adapters/spi.js\";\nimport {\n  compileMatcher,\n  eventMatcherSubject,\n} from \"../runtime/hook-entrypoint.js\";\nimport type { SurfaceName } from \"./introspect.js\";\nimport { hostCanFireEvent, SURFACE_PREDICATES } from \"./introspect.js\";\n\n// ─────────────────────────────────────────────────────────────────────────\n// explain — the static per-host × per-declared-surface matrix\n// ─────────────────────────────────────────────────────────────────────────\n\n/** One cell of the {@link explain} matrix: a host × a declared surface. */\nexport interface ExplainRow {\n  host: PlatformId;\n  surface: SurfaceName;\n  /**\n   *  - \"native\"    — the host's capabilities pass the surface predicate.\n   *  - \"disabled\"  — the connector opted out for this host\n   *                  (`platforms[host].<surface> === false`).\n   *  - \"skip-warn\" — the host cannot honor it; install would skip-warn.\n   */\n  support: \"native\" | \"skip-warn\" | \"disabled\";\n  reason: string;\n}\n\n/**\n * The GLOBAL surfaces a connector declares (these apply to every host — only\n * declared surfaces get a matrix row). The two platform-scoped surfaces\n * (`configPatch` / `nativeHooks`) are deliberately EXCLUDED here: they are\n * declared under one specific `platforms[host]`, so each is added PER HOST in\n * {@link explain} (see {@link platformScopedSurfacesFor}) — adding them globally\n * would falsely promise a configPatch row on hosts that never declared it.\n */\nfunction declaredGlobalSurfaces(connector: ResolvedConnector): SurfaceName[] {\n  const out: SurfaceName[] = [];\n  if (connector.server) out.push(\"server\");\n  if (Object.keys(connector.hooks).length > 0) out.push(\"hooks\");\n  if (connector.commands.length > 0) out.push(\"commands\");\n  if (connector.skills.length > 0) out.push(\"skills\");\n  if (connector.subagents.length > 0) out.push(\"subagents\");\n  if (connector.memory.length > 0) out.push(\"memory\");\n  if (connector.statusline) out.push(\"statusline\");\n  if (connector.actions.length > 0) out.push(\"actions\");\n  return out;\n}\n\n/**\n * The platform-scoped surfaces (`configPatch` / `nativeHooks`) THIS host\n * actually declares — keyed off the host's own `platforms[host]` override, so a\n * configPatch declared under claude-code never shows up as a row for codex.\n */\nfunction platformScopedSurfacesFor(\n  override: PlatformOverride | undefined,\n): SurfaceName[] {\n  const out: SurfaceName[] = [];\n  if (!override) return out;\n  if ((override.configPatch?.length ?? 0) > 0) out.push(\"configPatch\");\n  if (override.nativeHooks != null && Object.keys(override.nativeHooks).length > 0) {\n    out.push(\"nativeHooks\");\n  }\n  return out;\n}\n\n/**\n * Is the surface explicitly DISABLED for this host? Mirrors the per-host opt-out\n * the installer honors: a boolean-or-object surface override is \"disabled\" only\n * when set to the literal `false` (the object form is a tuning, not an opt-out).\n * `configPatch` / `nativeHooks` have no boolean opt-out form — declaring them is\n * the opt-in, so they are never \"disabled\".\n */\nfunction isDisabledForHost(\n  connector: ResolvedConnector,\n  host: PlatformId,\n  surface: SurfaceName,\n): boolean {\n  const override = connector.platforms[host];\n  if (!override) return false;\n  switch (surface) {\n    case \"server\":\n      return override.server === false;\n    case \"hooks\":\n      return override.hooks === false;\n    case \"commands\":\n      return override.commands === false;\n    case \"skills\":\n      return override.skills === false;\n    case \"subagents\":\n      return override.subagents === false;\n    case \"memory\":\n      return override.memory === false;\n    case \"statusline\":\n      return override.statusline === false;\n    case \"actions\":\n    case \"configPatch\":\n    case \"nativeHooks\":\n      // No per-host boolean opt-out form (declaring them is the opt-in).\n      return false;\n  }\n}\n\n/**\n * The static support matrix: every registered host × every surface the\n * connector declares. Rows are sorted by host then surface for stable output.\n * Pure read of the adapter capabilities — installs nothing, writes nothing.\n */\nexport async function explain(connector: ResolvedConnector): Promise<ExplainRow[]> {\n  const globalSurfaces = declaredGlobalSurfaces(connector);\n  const adapters = await allAdapters();\n  const rows: ExplainRow[] = [];\n\n  for (const adapter of adapters) {\n    // Per-host surface set = the global surfaces every host gets a row for, plus\n    // the platform-scoped surfaces THIS host actually declares (configPatch /\n    // nativeHooks live under platforms[host], so they are host-local).\n    const override = connector.platforms[adapter.id];\n    const surfaces = [\n      ...globalSurfaces,\n      ...platformScopedSurfacesFor(override),\n    ];\n    for (const surface of surfaces) {\n      if (isDisabledForHost(connector, adapter.id, surface)) {\n        rows.push({\n          host: adapter.id,\n          surface,\n          support: \"disabled\",\n          reason: `connector opted out for ${adapter.id} (platforms.${adapter.id}.${surface} = false)`,\n        });\n        continue;\n      }\n      // The hooks surface is judged against the connector's SPECIFIC declared\n      // events, not the coarse \"host has a hook runtime\" predicate — otherwise a\n      // Stop-only connector falsely shows `native` on a PreToolUse-only host\n      // (the host CAN fire a hook, just not the one this connector declared).\n      if (surface === \"hooks\") {\n        rows.push(hooksRow(connector, adapter.id, adapter.capabilities));\n        continue;\n      }\n      const native = SURFACE_PREDICATES[surface](adapter.capabilities);\n      rows.push({\n        host: adapter.id,\n        surface,\n        support: native ? \"native\" : \"skip-warn\",\n        reason: explainReason(adapter.id, surface, native),\n      });\n    }\n  }\n\n  rows.sort((a, b) =>\n    a.host === b.host ? a.surface.localeCompare(b.surface) : a.host.localeCompare(b.host),\n  );\n  return rows;\n}\n\n/**\n * The per-DECLARED-event hooks verdict for one host. A connector's hooks surface\n * is `native` only when EVERY event it declares can fire on the host; if any\n * declared event has no native equivalent the row is `skip-warn` and the reason\n * names the specific dead events (the same events install skip-warns). This is\n * the fix for the OR-across-all-events false green: a Stop-only connector on a\n * host that cannot fire Stop now reports skip-warn, not native.\n *\n * Reuses {@link hostCanFireEvent} — the single per-event source of truth shared\n * with {@link SURFACE_PREDICATES} and simulate's runtime verdict — so explain\n * never re-derives the per-event rules.\n */\nfunction hooksRow(\n  connector: ResolvedConnector,\n  host: PlatformId,\n  capabilities: PlatformCapabilities,\n): ExplainRow {\n  const declared = connector.hookEvents;\n  const dead = declared.filter((e) => !hostCanFireEvent(capabilities, e));\n  if (dead.length === 0) {\n    return {\n      host,\n      surface: \"hooks\",\n      support: \"native\",\n      reason: `${host} can fire every declared hook event (${declared.join(\", \")})`,\n    };\n  }\n  const fireable = declared.filter((e) => hostCanFireEvent(capabilities, e));\n  const reason =\n    fireable.length === 0\n      ? `${host} cannot fire any declared hook event (${dead.join(\", \")}); install skip-warns each`\n      : `${host} cannot fire ${dead.join(\", \")} (install skip-warns these); honors ${fireable.join(\", \")}`;\n  return { host, surface: \"hooks\", support: \"skip-warn\", reason };\n}\n\n/**\n * The human-readable reason for a native/skip-warn cell. `server` is a special\n * case: the predicate is CAPABILITY-based (the host advertises ≥1 MCP\n * transport), but advertising a transport does NOT guarantee a writable\n * registration — e.g. jetbrains-copilot advertises stdio yet its installServer\n * skip-warns because MCP is managed in IDE settings. So the server reason states\n * the verdict is capability-based and registration may be host-managed, rather\n * than promising a write. (A precise per-adapter installServer dry-run is a\n * Phase-2 enhancement — until then this avoids over-promising.)\n */\nfunction explainReason(host: PlatformId, surface: SurfaceName, native: boolean): string {\n  if (surface === \"server\") {\n    return native\n      ? `${host} advertises an MCP transport (capability-based; registration may be host-managed)`\n      : `${host} advertises no MCP transport; install skip-warns`;\n  }\n  return native\n    ? `${host} natively supports ${surface}`\n    : `${host} cannot honor ${surface}; install skip-warns`;\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// simulate — the real adapter parse → handler → format chain, inline\n// ─────────────────────────────────────────────────────────────────────────\n\n/** What to drive through the harness: one host, one surface, one raw payload. */\nexport interface SimulateOptions {\n  surface: \"hooks\" | \"statusline\";\n  host: PlatformId | string;\n  /** REQUIRED when `surface === \"hooks\"`: which normalized lifecycle event. */\n  event?: HookEventName;\n  /** The host-shaped RAW payload (what the host would pipe in on stdin). */\n  input: unknown;\n}\n\n/** The harness verdict: did the host actually honor the connector's response? */\nexport interface SimulateResult {\n  /** True when the host's native reply carries the connector's intent. */\n  honored: boolean;\n  /** The host-native stdout the adapter would emit (when there is one). */\n  hostReply?: string;\n  /** Human-readable why — names the documented degradation when honored:false. */\n  reason: string;\n}\n\n/**\n * Tolerantly coerce the raw payload, mirroring the runtime's parseStdin: a\n * string is JSON-parsed (empty/malformed → `{}`); a nullish value → `{}`; any\n * other value (already-parsed object) is passed through untouched.\n */\nfunction coerceInput(input: unknown): unknown {\n  if (input == null) return {};\n  if (typeof input === \"string\") {\n    const trimmed = input.trim();\n    if (trimmed === \"\") return {};\n    try {\n      return JSON.parse(trimmed);\n    } catch {\n      return {};\n    }\n  }\n  return input;\n}\n\n/** Normalize a handler's return into a concrete response (void/non-object → `{}`). */\nfunction normalizeResponse(value: HookResponse | void): HookResponse {\n  if (value == null || typeof value !== \"object\") return {};\n  return value;\n}\n\n/**\n * The decoded shape of a host's native hook reply on stdout. Every json-stdio\n * adapter writes a SUBSET of these fields (claude-code / codex share the\n * `hookSpecificOutput` envelope; Stop-class continuation uses the TOP-LEVEL\n * `decision:\"block\"`). We read the DECODED fields — never substring-match the\n * serialized JSON, which a path/newline/quote in the payload would break.\n */\ninterface ParsedReply {\n  /** Top-level Stop-class continuation: {\"decision\":\"block\",\"reason\"}. */\n  decision?: unknown;\n  reason?: unknown;\n  /** Top-level Claude context channel (no adapter emits it yet; future-proofing). */\n  systemMessage?: unknown;\n  hookSpecificOutput?: {\n    hookEventName?: unknown;\n    additionalContext?: unknown;\n    permissionDecision?: unknown;\n    permissionDecisionReason?: unknown;\n    updatedInput?: unknown;\n    /** PermissionRequest nested envelope: decision:{behavior:\"allow\"|\"deny\", updatedInput?}. */\n    decision?: { behavior?: unknown; updatedInput?: unknown };\n  };\n}\n\n/**\n * Tolerantly decode a reply's stdout into {@link ParsedReply}. Empty / absent /\n * unparseable stdout is a legitimate \"no payload\" signal (the adapter wrote a\n * bare exit-0) → `undefined`, the honest \"this decision had no stdout path\"\n * verdict input.\n */\nfunction parseReplyStdout(stdout: string | undefined): ParsedReply | undefined {\n  if (stdout == null || stdout.trim() === \"\") return undefined;\n  try {\n    const value = JSON.parse(stdout);\n    return value != null && typeof value === \"object\"\n      ? (value as ParsedReply)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Structural deep-equal for plain JSON values (objects/arrays/primitives). */\nfunction deepEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (typeof a !== typeof b || a == null || b == null) return false;\n  if (typeof a !== \"object\") return false;\n  const aArr = Array.isArray(a);\n  if (aArr !== Array.isArray(b)) return false;\n  if (aArr) {\n    const x = a as unknown[];\n    const y = b as unknown[];\n    return x.length === y.length && x.every((v, i) => deepEqual(v, y[i]));\n  }\n  const x = a as Record<string, unknown>;\n  const y = b as Record<string, unknown>;\n  const xk = Object.keys(x);\n  const yk = Object.keys(y);\n  return xk.length === yk.length && xk.every((k) => deepEqual(x[k], y[k]));\n}\n\n/**\n * Decide whether the host HONORED a decision-bearing response, judging the\n * PARSED reply against each adapter's ACTUAL (event, decision) contract — never\n * by substring-matching the serialized JSON. `allow`/no-decision is always\n * pass-through honored; every other decision is honored only when the decoded\n * reply carries that exact intent, and the verdict names the documented\n * degradation when it does not.\n */\nfunction judgeHookHonor(\n  host: string,\n  event: HookEventName,\n  response: HookResponse,\n  stdout: string | undefined,\n): { honored: boolean; reason: string } {\n  const decision = response.decision;\n  if (decision === undefined || decision === \"allow\") {\n    return { honored: true, reason: \"pass-through allow\" };\n  }\n\n  const reply = parseReplyStdout(stdout);\n  const hso = reply?.hookSpecificOutput;\n\n  if (decision === \"context\") {\n    // Honored only when the DECODED additionalContext equals what the handler\n    // asked to inject (claude-code's hookSpecificOutput.additionalContext, or a\n    // future top-level systemMessage). codex only emits this on\n    // SessionStart/PostToolUse — every other event silently drops it.\n    const want = response.additionalContext;\n    const got = hso?.additionalContext ?? reply?.systemMessage;\n    if (reply && got === want) {\n      return { honored: true, reason: `${host} injects context on ${event}` };\n    }\n    return {\n      honored: false,\n      reason: `${host} drops context on ${event} (no stdout path)`,\n    };\n  }\n\n  if (decision === \"deny\") {\n    if (!reply) {\n      return {\n        honored: false,\n        reason: `${host} drops deny on ${event} (deny not honored; fails open to allow)`,\n      };\n    }\n    // A real block: PreToolUse's permissionDecision:\"deny\", or the\n    // PermissionRequest nested decision.behavior:\"deny\".\n    if (hso?.permissionDecision === \"deny\" || hso?.decision?.behavior === \"deny\") {\n      return { honored: true, reason: `${host} blocks ${event}` };\n    }\n    // Stop-class continuation: top-level decision:\"block\" KEEPS the session /\n    // subagent running (persistence) — the SEMANTIC OPPOSITE of a block. Honored\n    // (the reply carried the intent), but the reason must not say \"blocks\".\n    if (reply.decision === \"block\") {\n      return {\n        honored: true,\n        reason: `${host} continues the session/subagent on ${event} (persistence) — NOT a block`,\n      };\n    }\n    // SubagentStart / PostToolUseFailure DEGRADE a deny to a context note — the\n    // spawn/failure is not actually blocked.\n    if (hso?.additionalContext != null) {\n      return {\n        honored: false,\n        reason: `${host} degrades deny to a context note on ${event}; spawn/failure not blocked`,\n      };\n    }\n    return {\n      honored: false,\n      reason: `${host} drops deny on ${event} (deny not honored; fails open to allow)`,\n    };\n  }\n\n  if (decision === \"ask\") {\n    if (hso?.permissionDecision === \"ask\") {\n      return { honored: true, reason: `${host} asks on ${event}` };\n    }\n    // On PermissionRequest, ask/void falls through to the host's NATIVE dialog\n    // (the dialog IS the ask), which the adapter expresses as a bare exit-0.\n    if (event === \"PermissionRequest\" && !reply) {\n      return {\n        honored: true,\n        reason: `${host} shows the native confirmation dialog on ${event} (the ask)`,\n      };\n    }\n    return {\n      honored: false,\n      reason: `${host} drops ask on ${event} (no ask path)`,\n    };\n  }\n\n  // decision === \"modify\": honored only when the decoded updatedInput deep-equals\n  // what the handler asked to write (hookSpecificOutput.updatedInput, or the\n  // PermissionRequest nested decision.updatedInput).\n  const wrote = hso?.updatedInput ?? hso?.decision?.updatedInput;\n  if (reply && wrote !== undefined && deepEqual(wrote, response.updatedInput)) {\n    return { honored: true, reason: `${host} rewrites tool input on ${event}` };\n  }\n  return {\n    honored: false,\n    reason: `${host} drops modify on ${event} (modify not honored)`,\n  };\n}\n\n/**\n * Run the connector against ONE host-shaped payload through the REAL adapter\n * path and report whether the host honors the response. Self-contained (does not\n * touch the registered-connector loader or telemetry) and fail-safe: any throw\n * in the chain degrades to `honored:false` with the error message, never rejects.\n */\nexport async function simulate(\n  connector: ResolvedConnector,\n  opts: SimulateOptions,\n): Promise<SimulateResult> {\n  try {\n    const adapter = await loadAdapter(opts.host);\n    if (!adapter) {\n      return { honored: false, reason: `unknown host \"${opts.host}\"` };\n    }\n\n    if (opts.surface === \"statusline\") {\n      if (\n        !(adapter.capabilities.supportsStatusline ?? false) ||\n        !adapter.parseStatusInput ||\n        !adapter.formatStatusOutput\n      ) {\n        return { honored: false, reason: `${opts.host} has no statusline surface` };\n      }\n      // Guarding on the TOP-LEVEL render is sufficient: a `hosts`-only statusline\n      // (a hosts: map with no top-level render) is rejected at defineConnector, so\n      // a connector that targets `opts.host` only via hosts[] still has a top-level\n      // render here. (If that author-time invariant ever relaxes, revisit this.)\n      if (!connector.statusline || typeof connector.statusline.render !== \"function\") {\n        return { honored: false, reason: \"connector declares no statusline\" };\n      }\n      const ctx = adapter.parseStatusInput(coerceInput(opts.input));\n      ctx.connectorId = connector.id;\n      // Defensive: parseStatusInput now sets ctx.capabilities (it is required on\n      // StatuslineContext), but a future adapter could omit it — backfill from\n      // the adapter so render() can always read ctx.capabilities.\n      if (ctx.capabilities == null) ctx.capabilities = adapter.capabilities;\n      // Per-host render override, mirroring the runtime: hosts[host].render wins\n      // over the top-level render; an unlisted host falls back to top-level.\n      const perHost = connector.statusline.hosts?.[opts.host as PlatformId]?.render;\n      const render =\n        typeof perHost === \"function\" ? perHost : connector.statusline.render;\n      const rendered = await render(ctx);\n      const line = rendered == null ? \"\" : String(rendered);\n      const reply = adapter.formatStatusOutput(line);\n      return {\n        honored: true,\n        ...(reply.stdout !== undefined ? { hostReply: reply.stdout } : {}),\n        reason: \"rendered\",\n      };\n    }\n\n    // surface === \"hooks\"\n    const event = opts.event;\n    if (!event) {\n      return { honored: false, reason: \"event is required when surface === \\\"hooks\\\"\" };\n    }\n    if (!adapter.parseEvent || !adapter.formatReply) {\n      return { honored: false, reason: `${opts.host} has no hook runtime (mcp-only)` };\n    }\n\n    const evt = adapter.parseEvent(event, coerceInput(opts.input));\n    evt.connectorId = connector.id;\n    // Mirror the runtime: runHook backfills evt.capabilities from the adapter so\n    // a handler reading evt.capabilities behaves the same here. (scope/telemetry\n    // are runtime-only — recovered from the registered meta / store, which the\n    // offline harness deliberately never touches — so they stay undefined.)\n    evt.capabilities = adapter.capabilities;\n\n    // Guarding on the TOP-LEVEL handler is sufficient: a `hosts`-only hook (a\n    // hosts: map with no top-level handler) is rejected at defineConnector, so a\n    // host targeted only via hosts[] still has a top-level handler here. (If that\n    // author-time invariant ever relaxes, revisit this.)\n    const definition = connector.hooks[event];\n    if (!definition || typeof definition.handler !== \"function\") {\n      return { honored: false, reason: `connector declares no ${event} handler` };\n    }\n\n    // Matcher filtering, in lockstep with runHook: when the connector's matcher\n    // is set and the event's subject (tool name, or agent type for Subagent*\n    // events) does not match, the host never runs the handler — so the harness\n    // must NOT run it either, and reports the (honored) exclusion. Reuses the\n    // runtime helpers directly so the two stay byte-for-byte aligned.\n    const subject = eventMatcherSubject(evt as NormalizedEvent);\n    if (subject !== undefined) {\n      const re = compileMatcher(definition.matcher);\n      if (re && !re.test(subject)) {\n        return {\n          honored: true,\n          reason: `matcher excludes ${subject} (handler not run)`,\n        };\n      }\n    }\n\n    // Per-host handler override, mirroring runHook: hosts[host].handler wins\n    // over the top-level handler; an unlisted host falls back to top-level.\n    const perHost = definition.hosts?.[opts.host as PlatformId]?.handler;\n    const handler = typeof perHost === \"function\" ? perHost : definition.handler;\n    const response = normalizeResponse(\n      await handler(evt as never),\n    );\n    const reply = adapter.formatReply(event, response);\n    const verdict = judgeHookHonor(String(opts.host), event, response, reply.stdout);\n    return {\n      honored: verdict.honored,\n      ...(reply.stdout !== undefined ? { hostReply: reply.stdout } : {}),\n      reason: verdict.reason,\n    };\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    const verb = opts.surface === \"statusline\" ? \"render\" : \"handler\";\n    return { honored: false, reason: `${verb} threw: ${message}` };\n  }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// explainHooks — the per-(host, event) honor verdict (powers doctor --explain)\n// ─────────────────────────────────────────────────────────────────────────\n\n/**\n * One per-(host, event) cell of {@link explainHooks}.\n *\n *  - \"honored\"  — the host fires the event AND carries the connector's response\n *                 intent (simulate's runtime verdict, e.g. a real deny/block).\n *  - \"degraded\" — the host fires the event but silently DROPS the response's\n *                 decision (e.g. codex fires UserPromptSubmit but has no stdout\n *                 path for a context injection, so the injection vanishes).\n *  - \"dropped\"  — the host cannot fire the event at all (no native equivalent /\n *                 mcp-only host); install skip-warns it and it never runs.\n */\nexport interface HookEventVerdict {\n  host: PlatformId;\n  event: HookEventName;\n  verdict: \"honored\" | \"degraded\" | \"dropped\";\n  /** The simulate()-grade reason string (names the documented degradation). */\n  reason: string;\n}\n\n/**\n * A subject (tool name / agent type) that SATISFIES the connector's matcher for\n * this event, so a matcher-gated hook actually runs and the verdict reflects the\n * real honor — not a spurious \"matcher excludes my arbitrary synthetic tool\".\n * A plain-literal matcher (no regex metacharacters — the common case, e.g.\n * `acme_query`) IS the subject. A missing/empty matcher matches everything, and\n * a complex regex falls back to the generic subject (then an honest \"matcher\n * excludes\" verdict surfaces — the dev's matcher genuinely would not fire here).\n */\nfunction matchingSubject(matcher: string | undefined, fallback: string): string {\n  if (!matcher || matcher === \"\") return fallback;\n  return /^[\\w.-]+$/.test(matcher) ? matcher : fallback;\n}\n\n/**\n * A minimal host-shaped synthetic payload so the real parse→handler→format\n * chain has something to run on. The harness coerces a `{}` to a valid event,\n * but tool/subagent events read a subject (tool name / agent type) the connector\n * matcher may filter on — so we plant a subject that SATISFIES the connector's\n * declared matcher ({@link matchingSubject}) to exercise the honor path.\n */\nfunction syntheticPayloadFor(\n  event: HookEventName,\n  matcher: string | undefined,\n): Record<string, unknown> {\n  switch (event) {\n    case \"PreToolUse\":\n    case \"PostToolUse\":\n    case \"PostToolUseFailure\":\n    case \"PermissionRequest\": {\n      const tool = matchingSubject(matcher, \"Bash\");\n      return { tool_name: tool, tool_input: { command: \"echo hi\" } };\n    }\n    case \"SubagentStart\":\n    case \"SubagentStop\": {\n      const agent = matchingSubject(matcher, \"general\");\n      return { agent_type: agent, subagent_type: agent };\n    }\n    case \"UserPromptSubmit\":\n      return { prompt: \"hello\" };\n    default:\n      return {};\n  }\n}\n\n/**\n * The per-(host, event) hook honor matrix for the connector's DECLARED events\n * across `hosts` — the trustworthy detail behind `doctor --explain`.\n *\n * For each (host, declared event): when the host cannot fire the event\n * ({@link hostCanFireEvent} is false, OR the host has no hook runtime at all)\n * the cell is `dropped`; otherwise it RUNS the real chain via {@link simulate}\n * and reports `honored` (simulate honored the response) or `degraded` (the host\n * fired but dropped the decision). Reuses the per-event signal + simulate's\n * verdict — no per-event honor logic is re-derived here.\n */\nexport async function explainHooks(\n  connector: ResolvedConnector,\n  hosts: (PlatformId | string)[],\n): Promise<HookEventVerdict[]> {\n  const events = connector.hookEvents;\n  const rows: HookEventVerdict[] = [];\n\n  for (const host of hosts) {\n    const adapter = await loadAdapter(host);\n    if (!adapter) {\n      for (const event of events) {\n        rows.push({\n          host: host as PlatformId,\n          event,\n          verdict: \"dropped\",\n          reason: `unknown host \"${host}\"`,\n        });\n      }\n      continue;\n    }\n\n    // An mcp-only host (no hook runtime) drops every declared event.\n    const hasHookRuntime = !!adapter.parseEvent && !!adapter.formatReply;\n\n    for (const event of events) {\n      if (!hasHookRuntime) {\n        rows.push({\n          host: adapter.id,\n          event,\n          verdict: \"dropped\",\n          reason: `${adapter.id} has no hook runtime (mcp-only) — ${event} never fires`,\n        });\n        continue;\n      }\n      if (!hostCanFireEvent(adapter.capabilities, event)) {\n        rows.push({\n          host: adapter.id,\n          event,\n          verdict: \"dropped\",\n          reason: `${adapter.id} has no ${event} equivalent — install skip-warns it; never fires`,\n        });\n        continue;\n      }\n      const sim = await simulate(connector, {\n        surface: \"hooks\",\n        host: adapter.id,\n        event,\n        input: syntheticPayloadFor(event, connector.hooks[event]?.matcher),\n      });\n      rows.push({\n        host: adapter.id,\n        event,\n        verdict: sim.honored ? \"honored\" : \"degraded\",\n        reason: sim.reason,\n      });\n    }\n  }\n\n  rows.sort((a, b) =>\n    a.host === b.host ? a.event.localeCompare(b.event) : a.host.localeCompare(b.host),\n  );\n  return rows;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoEA,SAAS,uBAAuB,WAA6C;AAC3E,QAAM,MAAqB,CAAC;AAC5B,MAAI,UAAU,OAAQ,KAAI,KAAK,QAAQ;AACvC,MAAI,OAAO,KAAK,UAAU,KAAK,EAAE,SAAS,EAAG,KAAI,KAAK,OAAO;AAC7D,MAAI,UAAU,SAAS,SAAS,EAAG,KAAI,KAAK,UAAU;AACtD,MAAI,UAAU,OAAO,SAAS,EAAG,KAAI,KAAK,QAAQ;AAClD,MAAI,UAAU,UAAU,SAAS,EAAG,KAAI,KAAK,WAAW;AACxD,MAAI,UAAU,OAAO,SAAS,EAAG,KAAI,KAAK,QAAQ;AAClD,MAAI,UAAU,WAAY,KAAI,KAAK,YAAY;AAC/C,MAAI,UAAU,QAAQ,SAAS,EAAG,KAAI,KAAK,SAAS;AACpD,SAAO;AACT;AAOA,SAAS,0BACP,UACe;AACf,QAAM,MAAqB,CAAC;AAC5B,MAAI,CAAC,SAAU,QAAO;AACtB,OAAK,SAAS,aAAa,UAAU,KAAK,EAAG,KAAI,KAAK,aAAa;AACnE,MAAI,SAAS,eAAe,QAAQ,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,GAAG;AAChF,QAAI,KAAK,aAAa;AAAA,EACxB;AACA,SAAO;AACT;AASA,SAAS,kBACP,WACA,MACA,SACS;AACT,QAAM,WAAW,UAAU,UAAU,IAAI;AACzC,MAAI,CAAC,SAAU,QAAO;AACtB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,SAAS,WAAW;AAAA,IAC7B,KAAK;AACH,aAAO,SAAS,UAAU;AAAA,IAC5B,KAAK;AACH,aAAO,SAAS,aAAa;AAAA,IAC/B,KAAK;AACH,aAAO,SAAS,WAAW;AAAA,IAC7B,KAAK;AACH,aAAO,SAAS,cAAc;AAAA,IAChC,KAAK;AACH,aAAO,SAAS,WAAW;AAAA,IAC7B,KAAK;AACH,aAAO,SAAS,eAAe;AAAA,IACjC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAEH,aAAO;AAAA,EACX;AACF;AAOA,eAAsB,QAAQ,WAAqD;AACjF,QAAM,iBAAiB,uBAAuB,SAAS;AACvD,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,OAAqB,CAAC;AAE5B,aAAW,WAAW,UAAU;AAI9B,UAAM,WAAW,UAAU,UAAU,QAAQ,EAAE;AAC/C,UAAM,WAAW;AAAA,MACf,GAAG;AAAA,MACH,GAAG,0BAA0B,QAAQ;AAAA,IACvC;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI,kBAAkB,WAAW,QAAQ,IAAI,OAAO,GAAG;AACrD,aAAK,KAAK;AAAA,UACR,MAAM,QAAQ;AAAA,UACd;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,2BAA2B,QAAQ,EAAE,eAAe,QAAQ,EAAE,IAAI,OAAO;AAAA,QACnF,CAAC;AACD;AAAA,MACF;AAKA,UAAI,YAAY,SAAS;AACvB,aAAK,KAAK,SAAS,WAAW,QAAQ,IAAI,QAAQ,YAAY,CAAC;AAC/D;AAAA,MACF;AACA,YAAM,SAAS,mBAAmB,OAAO,EAAE,QAAQ,YAAY;AAC/D,WAAK,KAAK;AAAA,QACR,MAAM,QAAQ;AAAA,QACd;AAAA,QACA,SAAS,SAAS,WAAW;AAAA,QAC7B,QAAQ,cAAc,QAAQ,IAAI,SAAS,MAAM;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,OAAK;AAAA,IAAK,CAAC,GAAG,MACZ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,cAAc,EAAE,OAAO,IAAI,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EACtF;AACA,SAAO;AACT;AAcA,SAAS,SACP,WACA,MACA,cACY;AACZ,QAAM,WAAW,UAAU;AAC3B,QAAM,OAAO,SAAS,OAAO,CAAC,MAAM,CAAC,iBAAiB,cAAc,CAAC,CAAC;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO;AAAA,MACL;AAAA,MACA,SAAS;AAAA,MACT,SAAS;AAAA,MACT,QAAQ,GAAG,IAAI,wCAAwC,SAAS,KAAK,IAAI,CAAC;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,WAAW,SAAS,OAAO,CAAC,MAAM,iBAAiB,cAAc,CAAC,CAAC;AACzE,QAAM,SACJ,SAAS,WAAW,IAChB,GAAG,IAAI,yCAAyC,KAAK,KAAK,IAAI,CAAC,+BAC/D,GAAG,IAAI,gBAAgB,KAAK,KAAK,IAAI,CAAC,uCAAuC,SAAS,KAAK,IAAI,CAAC;AACtG,SAAO,EAAE,MAAM,SAAS,SAAS,SAAS,aAAa,OAAO;AAChE;AAYA,SAAS,cAAc,MAAkB,SAAsB,QAAyB;AACtF,MAAI,YAAY,UAAU;AACxB,WAAO,SACH,GAAG,IAAI,sFACP,GAAG,IAAI;AAAA,EACb;AACA,SAAO,SACH,GAAG,IAAI,sBAAsB,OAAO,KACpC,GAAG,IAAI,iBAAiB,OAAO;AACrC;AA+BA,SAAS,YAAY,OAAyB;AAC5C,MAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,YAAY,GAAI,QAAO,CAAC;AAC5B,QAAI;AACF,aAAO,KAAK,MAAM,OAAO;AAAA,IAC3B,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO,CAAC;AACxD,SAAO;AACT;AAgCA,SAAS,iBAAiB,QAAqD;AAC7E,MAAI,UAAU,QAAQ,OAAO,KAAK,MAAM,GAAI,QAAO;AACnD,MAAI;AACF,UAAM,QAAQ,KAAK,MAAM,MAAM;AAC/B,WAAO,SAAS,QAAQ,OAAO,UAAU,WACpC,QACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,UAAU,GAAY,GAAqB;AAClD,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,OAAO,MAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,KAAM,QAAO;AAC5D,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,OAAO,MAAM,QAAQ,CAAC;AAC5B,MAAI,SAAS,MAAM,QAAQ,CAAC,EAAG,QAAO;AACtC,MAAI,MAAM;AACR,UAAMA,KAAI;AACV,UAAMC,KAAI;AACV,WAAOD,GAAE,WAAWC,GAAE,UAAUD,GAAE,MAAM,CAAC,GAAG,MAAM,UAAU,GAAGC,GAAE,CAAC,CAAC,CAAC;AAAA,EACtE;AACA,QAAM,IAAI;AACV,QAAM,IAAI;AACV,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,SAAO,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACzE;AAUA,SAAS,eACP,MACA,OACA,UACA,QACsC;AACtC,QAAM,WAAW,SAAS;AAC1B,MAAI,aAAa,UAAa,aAAa,SAAS;AAClD,WAAO,EAAE,SAAS,MAAM,QAAQ,qBAAqB;AAAA,EACvD;AAEA,QAAM,QAAQ,iBAAiB,MAAM;AACrC,QAAM,MAAM,OAAO;AAEnB,MAAI,aAAa,WAAW;AAK1B,UAAM,OAAO,SAAS;AACtB,UAAM,MAAM,KAAK,qBAAqB,OAAO;AAC7C,QAAI,SAAS,QAAQ,MAAM;AACzB,aAAO,EAAE,SAAS,MAAM,QAAQ,GAAG,IAAI,uBAAuB,KAAK,GAAG;AAAA,IACxE;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,GAAG,IAAI,qBAAqB,KAAK;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,GAAG,IAAI,kBAAkB,KAAK;AAAA,MACxC;AAAA,IACF;AAGA,QAAI,KAAK,uBAAuB,UAAU,KAAK,UAAU,aAAa,QAAQ;AAC5E,aAAO,EAAE,SAAS,MAAM,QAAQ,GAAG,IAAI,WAAW,KAAK,GAAG;AAAA,IAC5D;AAIA,QAAI,MAAM,aAAa,SAAS;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,GAAG,IAAI,sCAAsC,KAAK;AAAA,MAC5D;AAAA,IACF;AAGA,QAAI,KAAK,qBAAqB,MAAM;AAClC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,GAAG,IAAI,uCAAuC,KAAK;AAAA,MAC7D;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,GAAG,IAAI,kBAAkB,KAAK;AAAA,IACxC;AAAA,EACF;AAEA,MAAI,aAAa,OAAO;AACtB,QAAI,KAAK,uBAAuB,OAAO;AACrC,aAAO,EAAE,SAAS,MAAM,QAAQ,GAAG,IAAI,YAAY,KAAK,GAAG;AAAA,IAC7D;AAGA,QAAI,UAAU,uBAAuB,CAAC,OAAO;AAC3C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,GAAG,IAAI,4CAA4C,KAAK;AAAA,MAClE;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ,GAAG,IAAI,iBAAiB,KAAK;AAAA,IACvC;AAAA,EACF;AAKA,QAAM,QAAQ,KAAK,gBAAgB,KAAK,UAAU;AAClD,MAAI,SAAS,UAAU,UAAa,UAAU,OAAO,SAAS,YAAY,GAAG;AAC3E,WAAO,EAAE,SAAS,MAAM,QAAQ,GAAG,IAAI,2BAA2B,KAAK,GAAG;AAAA,EAC5E;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ,GAAG,IAAI,oBAAoB,KAAK;AAAA,EAC1C;AACF;AAQA,eAAsB,SACpB,WACA,MACyB;AACzB,MAAI;AACF,UAAM,UAAU,MAAM,YAAY,KAAK,IAAI;AAC3C,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,SAAS,OAAO,QAAQ,iBAAiB,KAAK,IAAI,IAAI;AAAA,IACjE;AAEA,QAAI,KAAK,YAAY,cAAc;AACjC,UACE,EAAE,QAAQ,aAAa,sBAAsB,UAC7C,CAAC,QAAQ,oBACT,CAAC,QAAQ,oBACT;AACA,eAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,KAAK,IAAI,6BAA6B;AAAA,MAC5E;AAKA,UAAI,CAAC,UAAU,cAAc,OAAO,UAAU,WAAW,WAAW,YAAY;AAC9E,eAAO,EAAE,SAAS,OAAO,QAAQ,mCAAmC;AAAA,MACtE;AACA,YAAM,MAAM,QAAQ,iBAAiB,YAAY,KAAK,KAAK,CAAC;AAC5D,UAAI,cAAc,UAAU;AAI5B,UAAI,IAAI,gBAAgB,KAAM,KAAI,eAAe,QAAQ;AAGzD,YAAMC,WAAU,UAAU,WAAW,QAAQ,KAAK,IAAkB,GAAG;AACvE,YAAM,SACJ,OAAOA,aAAY,aAAaA,WAAU,UAAU,WAAW;AACjE,YAAM,WAAW,MAAM,OAAO,GAAG;AACjC,YAAM,OAAO,YAAY,OAAO,KAAK,OAAO,QAAQ;AACpD,YAAMC,SAAQ,QAAQ,mBAAmB,IAAI;AAC7C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,GAAIA,OAAM,WAAW,SAAY,EAAE,WAAWA,OAAM,OAAO,IAAI,CAAC;AAAA,QAChE,QAAQ;AAAA,MACV;AAAA,IACF;AAGA,UAAM,QAAQ,KAAK;AACnB,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,SAAS,OAAO,QAAQ,6CAA+C;AAAA,IAClF;AACA,QAAI,CAAC,QAAQ,cAAc,CAAC,QAAQ,aAAa;AAC/C,aAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,KAAK,IAAI,kCAAkC;AAAA,IACjF;AAEA,UAAM,MAAM,QAAQ,WAAW,OAAO,YAAY,KAAK,KAAK,CAAC;AAC7D,QAAI,cAAc,UAAU;AAK5B,QAAI,eAAe,QAAQ;AAM3B,UAAM,aAAa,UAAU,MAAM,KAAK;AACxC,QAAI,CAAC,cAAc,OAAO,WAAW,YAAY,YAAY;AAC3D,aAAO,EAAE,SAAS,OAAO,QAAQ,yBAAyB,KAAK,WAAW;AAAA,IAC5E;AAOA,UAAM,UAAU,oBAAoB,GAAsB;AAC1D,QAAI,YAAY,QAAW;AACzB,YAAM,KAAK,eAAe,WAAW,OAAO;AAC5C,UAAI,MAAM,CAAC,GAAG,KAAK,OAAO,GAAG;AAC3B,eAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ,oBAAoB,OAAO;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AAIA,UAAM,UAAU,WAAW,QAAQ,KAAK,IAAkB,GAAG;AAC7D,UAAM,UAAU,OAAO,YAAY,aAAa,UAAU,WAAW;AACrE,UAAM,WAAW;AAAA,MACf,MAAM,QAAQ,GAAY;AAAA,IAC5B;AACA,UAAM,QAAQ,QAAQ,YAAY,OAAO,QAAQ;AACjD,UAAM,UAAU,eAAe,OAAO,KAAK,IAAI,GAAG,OAAO,UAAU,MAAM,MAAM;AAC/E,WAAO;AAAA,MACL,SAAS,QAAQ;AAAA,MACjB,GAAI,MAAM,WAAW,SAAY,EAAE,WAAW,MAAM,OAAO,IAAI,CAAC;AAAA,MAChE,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAM,OAAO,KAAK,YAAY,eAAe,WAAW;AACxD,WAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,IAAI,WAAW,OAAO,GAAG;AAAA,EAC/D;AACF;AAkCA,SAAS,gBAAgB,SAA6B,UAA0B;AAC9E,MAAI,CAAC,WAAW,YAAY,GAAI,QAAO;AACvC,SAAO,YAAY,KAAK,OAAO,IAAI,UAAU;AAC/C;AASA,SAAS,oBACP,OACA,SACyB;AACzB,UAAQ,OAAO;AAAA,IACb,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,qBAAqB;AACxB,YAAM,OAAO,gBAAgB,SAAS,MAAM;AAC5C,aAAO,EAAE,WAAW,MAAM,YAAY,EAAE,SAAS,UAAU,EAAE;AAAA,IAC/D;AAAA,IACA,KAAK;AAAA,IACL,KAAK,gBAAgB;AACnB,YAAM,QAAQ,gBAAgB,SAAS,SAAS;AAChD,aAAO,EAAE,YAAY,OAAO,eAAe,MAAM;AAAA,IACnD;AAAA,IACA,KAAK;AACH,aAAO,EAAE,QAAQ,QAAQ;AAAA,IAC3B;AACE,aAAO,CAAC;AAAA,EACZ;AACF;AAaA,eAAsB,aACpB,WACA,OAC6B;AAC7B,QAAM,SAAS,UAAU;AACzB,QAAM,OAA2B,CAAC;AAElC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,MAAM,YAAY,IAAI;AACtC,QAAI,CAAC,SAAS;AACZ,iBAAW,SAAS,QAAQ;AAC1B,aAAK,KAAK;AAAA,UACR;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,iBAAiB,IAAI;AAAA,QAC/B,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAGA,UAAM,iBAAiB,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,QAAQ;AAEzD,eAAW,SAAS,QAAQ;AAC1B,UAAI,CAAC,gBAAgB;AACnB,aAAK,KAAK;AAAA,UACR,MAAM,QAAQ;AAAA,UACd;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,GAAG,QAAQ,EAAE,0CAAqC,KAAK;AAAA,QACjE,CAAC;AACD;AAAA,MACF;AACA,UAAI,CAAC,iBAAiB,QAAQ,cAAc,KAAK,GAAG;AAClD,aAAK,KAAK;AAAA,UACR,MAAM,QAAQ;AAAA,UACd;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,GAAG,QAAQ,EAAE,WAAW,KAAK;AAAA,QACvC,CAAC;AACD;AAAA,MACF;AACA,YAAM,MAAM,MAAM,SAAS,WAAW;AAAA,QACpC,SAAS;AAAA,QACT,MAAM,QAAQ;AAAA,QACd;AAAA,QACA,OAAO,oBAAoB,OAAO,UAAU,MAAM,KAAK,GAAG,OAAO;AAAA,MACnE,CAAC;AACD,WAAK,KAAK;AAAA,QACR,MAAM,QAAQ;AAAA,QACd;AAAA,QACA,SAAS,IAAI,UAAU,YAAY;AAAA,QACnC,QAAQ,IAAI;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAEA,OAAK;AAAA,IAAK,CAAC,GAAG,MACZ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,EAAE,KAAK,IAAI,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EAClF;AACA,SAAO;AACT;","names":["x","y","perHost","reply"]}

package/dist/{chunk-C3TFA4CJ.js → chunk-FUXUEXDP.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   resolveEnvRefsDeep
-} from "./chunk-DBQMX75U.js";
+} from "./chunk-BEFVJ2OE.js";
 import {
   BaseAdapter,
   parseJsonc,
   renderSkillMd
-} from "./chunk-GI4FDVWI.js";
+} from "./chunk-NUGMVVV2.js";
 import {
   buildWrappedStdio
 } from "./chunk-TO57WYBB.js";
@@ -1008,4 +1008,4 @@ export {
   adapter,
   openclaw_default
 };
-//# sourceMappingURL=chunk-C3TFA4CJ.js.map
+//# sourceMappingURL=chunk-FUXUEXDP.js.map

package/dist/{chunk-KAEYJGK7.js → chunk-HKM3HUOK.js}

@@ -73,36 +73,36 @@ function renderInstallResult(result, verb) {
   return lines.join("\n");
 }
 var COMMANDS = {
-  detect: () => import("./detect-LWZEM7SN.js"),
-  install: () => import("./install-F4OIDYAK.js"),
-  uninstall: () => import("./uninstall-QCROBR6A.js"),
+  detect: () => import("./detect-CWEIQCRC.js"),
+  install: () => import("./install-S6BYIJ62.js"),
+  uninstall: () => import("./uninstall-WGEKTCDZ.js"),
   // `upgrade` is the single "bring everything current" verb (re-render host
   // config + refresh the home pointer + managed channel guidance). `sync` and
   // `update` are kept as back-compat aliases that route to the same module so
   // existing scripts/docs keep working without a second concept to learn.
-  upgrade: () => import("./upgrade-KJ4QRZDZ.js"),
-  sync: () => import("./upgrade-KJ4QRZDZ.js"),
-  update: () => import("./upgrade-KJ4QRZDZ.js"),
-  package: () => import("./package-5FRMSWRT.js"),
-  doctor: () => import("./doctor-54P4JFA6.js"),
-  status: () => import("./status-5ZM6LXHV.js"),
-  telemetry: () => import("./telemetry-NO7UUUSJ.js"),
-  usage: () => import("./usage-UY6DCND6.js"),
-  leaderboard: () => import("./leaderboard-ZIAXBUWD.js"),
-  hook: () => import("./hook-UT3Q43AB.js"),
+  upgrade: () => import("./upgrade-IH7CKPTO.js"),
+  sync: () => import("./upgrade-IH7CKPTO.js"),
+  update: () => import("./upgrade-IH7CKPTO.js"),
+  package: () => import("./package-KOAAVKHH.js"),
+  doctor: () => import("./doctor-AC437ZAW.js"),
+  status: () => import("./status-N5LCQQ3R.js"),
+  telemetry: () => import("./telemetry-V4YQL2NU.js"),
+  usage: () => import("./usage-DI7XRCKM.js"),
+  leaderboard: () => import("./leaderboard-SUSUDKHR.js"),
+  hook: () => import("./hook-VYD3OCLM.js"),
   // Internal (omitted from USAGE): the statusline (HUD) entrypoint a host's
   // status line config points at. Fail-safe: always exits 0 with at most a
   // rendered line. See cli/commands/statusline.ts.
-  statusline: () => import("./statusline-O76BCBUK.js"),
+  statusline: () => import("./statusline-442XOF7R.js"),
   // Internal (omitted from USAGE): the user-invokable action entrypoint a future
   // host affordance points at. USER-TRIGGERED: surfaces errors (exit 1 + stderr),
   // unlike the fail-open hook / fail-safe statusline. See cli/commands/action.ts.
-  action: () => import("./action-AIB2W4DU.js"),
-  serve: () => import("./serve-NQBXN4FG.js"),
+  action: () => import("./action-TCKBTTZX.js"),
+  serve: () => import("./serve-BU23QUSJ.js"),
   // Hidden (omitted from USAGE): the opt-in host-native turn-usage entrypoint an
   // AfterModel / PostInvocation hook points at. Always exits 0; records a
   // distinct `model_turn` row. See cli/commands/usage-event.ts.
-  "usage-event": () => import("./usage-event-T4HWQDZF.js")
+  "usage-event": () => import("./usage-event-2FCU55AN.js")
 };
 var DEFAULT_PROGRAM_NAME = "agent-connector";
 var COMMAND_USAGE = {
@@ -113,7 +113,7 @@ var COMMAND_USAGE = {
   sync: "sync \u2014 alias of upgrade (see `upgrade --help`)",
   update: "update \u2014 alias of upgrade (see `upgrade --help`)",
   package: "package [--connector <path>] [--format <fmt>|all] [--out <dir>] [--project <dir>] [--dry-run]",
-  doctor: "doctor [--targets a,b] [--connector <path>] [--scope user|project] [--project <dir>] [--probe] [--json] [--heal] [--dry-run]",
+  doctor: "doctor [--targets a,b] [--connector <path>] [--scope user|project] [--project <dir>] [--probe] [--explain] [--json] [--heal] [--dry-run]\n  --explain   per-(host,event) hook honor matrix (honored/degraded/dropped). Exit non-zero ONLY when an explicitly-targeted host DEGRADES a declared event (fires it but silently won't honor the reply); dropped/mcp-only hosts and fleet-wide (targets:auto) gaps are informational (exit 0).",
   status: "status [--connector <path>] [--scope user|project] [--project <dir>] [--json]",
   telemetry: "telemetry report|export|leaderboard [--by <dim>] [--since <dur>] [--connector <id>] [--scope <slice>] [--format csv|json] [--out <file>] [--json]",
   usage: "usage report|export|leaderboard [--by <dim>] [--since <dur>] [--platform <id>] [--format csv|json] [--out <file>] [--json]",
@@ -198,4 +198,4 @@ export {
   renderInstallResult,
   main
 };
-//# sourceMappingURL=chunk-KAEYJGK7.js.map
+//# sourceMappingURL=chunk-HKM3HUOK.js.map