@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/core/harnesses/codex/hooks/user-prompt-submit.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Codex front door: reuse the canonical context policy with the Codex output envelope.
-# The shared policy selects Codex's hookSpecificOutput shape from this attribution.
-set -euo pipefail
+# Codex front door: user-prompt-submit through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/user-prompt-submit.sh"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+doflow_bridge codex UserPromptSubmit user-prompt-submit
+exit $?

package/core/harnesses/copilot/hooks/doflow-lib.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Copilot CLI front-door helpers: translate a camelCase Copilot hook payload into the canonical
+# Claude-style payload the shared lifecycle bridge and policies read, and render nothing else.
+# Installed by the doflow CLI and overwritten on update; do not edit an installed copy.
+#
+# Payload facts are from the live capture of 2026-10-27 (Copilot CLI 1.0.103), not the docs alone:
+#   - camelCase fields: sessionId, toolName, toolArgs, transcriptPath, agentId, agentType, parentAgentId
+#   - toolArgs arrives as a JSON OBJECT for bash/skill/task and as a raw STRING for apply_patch (the
+#     freeform patch text). The docs type it `unknown`; this accepts an object, a JSON string and a
+#     raw string.
+#   - tool names are lowercase: bash, apply_patch, edit, task, skill
+
+# copilot_bridge_payload <event>: native payload on stdin, canonical payload on stdout. <event> is
+# the PascalCase name the bridge and policies know (PreToolUse, Stop, SessionStart, ...). When jq is
+# missing or rejects the payload the original payload is printed unchanged.
+#   - tool_name: bash|powershell -> Bash, edit -> Edit, create -> Write, apply_patch stays; any
+#     other name passes through unchanged, so an unmapped tool fails open as it does without a bridge
+#   - tool_input: toolArgs as an object (a JSON string is parsed; any other string becomes
+#     {command: <string>}, which is where the shared policies read an apply_patch body); for Edit
+#     and Write tool_input.file_path is copied from path, filePath, filename or target_file when
+#     absent (only path and file_path are captured; an edit whose target is still undecodable is
+#     denied by the bridge, not allowed)
+#   - response (subagentStop) -> last_assistant_message
+copilot_bridge_payload() {
+  local event="${1:-}" payload rewritten
+  payload=$(cat)
+  if command -v jq >/dev/null 2>&1 \
+    && rewritten=$(printf '%s' "$payload" | jq -c --arg event "$event" '
+      (.toolName // .tool_name // "") as $raw
+      | ($raw | ascii_downcase) as $t
+      | (if $t == "bash" or $t == "powershell" then "Bash"
+         elif $t == "edit" then "Edit"
+         elif $t == "create" then "Write"
+         else $raw end) as $name
+      | ((.toolArgs // .tool_input) as $a
+         | if $a == null then null
+           elif ($a | type) == "object" then $a
+           elif ($a | type) == "string" then ((try ($a | fromjson) catch $a) | if type == "object" then . else {command: $a} end)
+           else {command: ($a | tostring)} end) as $input
+      | (if ($name == "Edit" or $name == "Write") and ($input | type) == "object" and ($input.file_path == null) and (($input.path // $input.filePath // $input.filename // $input.target_file) != null)
+         then $input + {file_path: ($input.path // $input.filePath // $input.filename // $input.target_file)} else $input end) as $input
+      | {
+          hook_event_name: $event,
+          session_id: (.sessionId // .session_id),
+          cwd: .cwd,
+          transcript_path: (.transcriptPath // .transcript_path),
+          stop_hook_active: .stop_hook_active,
+          stop_reason: (.stopReason // .stop_reason),
+          source: .source,
+          reason: .reason,
+          prompt: .prompt,
+          initial_prompt: (.initialPrompt // .initial_prompt),
+          agent_id: (.agentId // .agent_id),
+          agent_type: (.agentType // .agent_type),
+          agent_name: (.agentName // .agent_name),
+          parent_agent_id: (.parentAgentId // .parent_agent_id),
+          last_assistant_message: (.response // .last_assistant_message),
+          tool_name: (if $raw == "" then null else $name end),
+          tool_input: $input,
+          tool_result: (.toolResult // .tool_result)
+        }
+      | with_entries(select(.value != null))
+    ' 2>/dev/null) \
+    && [ -n "$rewritten" ]; then
+    printf '%s\n' "$rewritten"
+  else
+    printf '%s\n' "$payload"
+  fi
+}
+
+# copilot_front_door <script-dir> <event> <policy> <fail>: run one shared policy through the bridge.
+# <fail> is `deny` for a pre-tool policy (a missing bridge denies the tool call, as Copilot's
+# preToolUse hooks are fail-closed on a non-zero exit anyway) or `open` for every other event.
+copilot_front_door() {
+  local dir="$1" event="$2" policy="$3" fail="${4:-open}" raw payload bridge status=0
+  raw=$(cat)
+  if [ "$event" = Stop ] && command -v jq >/dev/null 2>&1 \
+    && [ -n "$(printf '%s' "$raw" | jq -r '.agentId // .agent_id // empty' 2>/dev/null)" ]; then
+    return 0   # a subagent's own stop; SubagentStop covers it, as it does for Claude
+  fi
+  payload=$(copilot_bridge_payload "$event" <<<"$raw")
+  bridge="$dir/../../.doflow/shared/hooks/bridge/bridge.sh"
+  # User hooks under a custom $COPILOT_HOME sit beside no .doflow; the bridge is then in $HOME/.doflow.
+  [ -f "$bridge" ] || bridge="${HOME:-}/.doflow/shared/hooks/bridge/bridge.sh"
+  if [ ! -f "$bridge" ] || ! . "$bridge" 2>/dev/null; then
+    if [ "$fail" = deny ]; then
+      printf '%s\n' '{"permissionDecision":"deny","permissionDecisionReason":"[doflow] shared hooks lack the bridge; run: doflow update -t copilot"}'
+    fi
+    return 0
+  fi
+  doflow_bridge copilot "$event" "$policy" <<<"$payload" || status=$?
+  return "$status"
+}

package/core/harnesses/copilot/hooks/doflow-mcp-tool-guard.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: mcp-tool-guard through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" PreToolUse mcp-tool-guard deny
+exit $?

package/core/harnesses/copilot/hooks/doflow-pre-bash-guard.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: pre-bash-guard through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" PreToolUse pre-bash-guard deny
+exit $?

package/core/harnesses/copilot/hooks/doflow-pre-implement-gate.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: pre-implementation-gate through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" PreToolUse pre-implementation-gate deny
+exit $?

package/core/harnesses/copilot/hooks/doflow-session-start.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: session-context through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" SessionStart session-context open
+exit $?

package/core/harnesses/copilot/hooks/doflow-stop-check.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: stop-check through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" Stop stop-check open
+exit $?

package/core/harnesses/copilot/hooks/doflow-subagent-start.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: subagent-audit (start) through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" SubagentStart subagent-audit open
+exit $?

package/core/harnesses/copilot/hooks/doflow-subagent-stop.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Copilot CLI front door: subagent-audit (stop) through the shared lifecycle bridge.
+set -uo pipefail
+export DOFLOW_AGENT="${DOFLOW_AGENT:-copilot}"
+here="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=doflow-lib.sh
+. "$here/doflow-lib.sh"
+copilot_front_door "$here" SubagentStop subagent-audit open
+exit $?

package/core/harnesses/copilot/hooks/doflow.json

@@ -0,0 +1,57 @@
+{
+  "version": 1,
+  "hooks": {
+    "sessionStart": [
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-session-start.sh\" ] && printf '%s/.github/hooks/doflow-session-start.sh' \"$root\" || printf '%s/hooks/doflow-session-start.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 10
+      }
+    ],
+    "preToolUse": [
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-pre-implement-gate.sh\" ] && printf '%s/.github/hooks/doflow-pre-implement-gate.sh' \"$root\" || printf '%s/hooks/doflow-pre-implement-gate.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 20
+      },
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-pre-bash-guard.sh\" ] && printf '%s/.github/hooks/doflow-pre-bash-guard.sh' \"$root\" || printf '%s/hooks/doflow-pre-bash-guard.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 20
+      },
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-mcp-tool-guard.sh\" ] && printf '%s/.github/hooks/doflow-mcp-tool-guard.sh' \"$root\" || printf '%s/hooks/doflow-mcp-tool-guard.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 20
+      }
+    ],
+    "agentStop": [
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-stop-check.sh\" ] && printf '%s/.github/hooks/doflow-stop-check.sh' \"$root\" || printf '%s/hooks/doflow-stop-check.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 30
+      }
+    ],
+    "subagentStart": [
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-subagent-start.sh\" ] && printf '%s/.github/hooks/doflow-subagent-start.sh' \"$root\" || printf '%s/hooks/doflow-subagent-start.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 10
+      }
+    ],
+    "subagentStop": [
+      {
+        "type": "command",
+        "bash": "bash \"$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f \"$root/.github/hooks/doflow-subagent-stop.sh\" ] && printf '%s/.github/hooks/doflow-subagent-stop.sh' \"$root\" || printf '%s/hooks/doflow-subagent-stop.sh' \"${COPILOT_HOME:-$HOME/.copilot}\")\"",
+        "cwd": ".",
+        "timeoutSec": 10
+      }
+    ]
+  }
+}

package/core/harnesses/kiro/agents/doflow.json

@@ -1,7 +1,7 @@
 {
   "name": "doflow",
   "description": "DoFlow main session: spec-driven delivery with lifecycle hooks and specialist dispatch",
-  "prompt": "You are the DoFlow main session. Follow the DoFlow steering files under .kiro/steering (principles, rules, the spec-driven chain) and the skills under .kiro/skills. Dispatch specialist work by role to core-implementer, quality-guardian, spec-analyst, system-architect or research-writer, and keep decisions, verification and records in this session.\n",
+  "prompt": "You are the DoFlow main session. Follow the DoFlow steering files under .kiro/steering (principles, rules, the spec-driven chain) and the skills under .kiro/skills. Dispatch specialist work by role to core-implementer, delivery-lead, quality-guardian, reviewer, spec-analyst, system-architect or research-writer, and keep decisions, verification and records in this session.\n",
   "tools": [
     "*"
   ],

package/core/harnesses/kiro/hooks/lib.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # lib.sh — shared constants and helpers for session lifecycle hooks
 #
 # Usage: source "$(dirname "$0")/lib.sh"
@@ -17,13 +18,30 @@ set -euo pipefail
 
 # ── State directories ────────────────────────────────────────────────────────
 
-# XDG-compliant, agent-agnostic store shared by Claude Code, Codex, Gemini, etc.
-DOFLOW_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/doflow"
-STATE_DIR="$DOFLOW_HOME/session-env"
-SESSION_DIR="$STATE_DIR/sessions"
-PROJECTS_DIR="$STATE_DIR/projects"
+# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports, under the config home
+# (doflow_config_home: an absolute XDG_CONFIG_HOME, else an absolute HOME + /.config, else none). With
+# no config home every state path below is empty, sourcing this file still never exits, and each state
+# function returns 0 at once: session work is skipped and a guard reaches its own decision (086 IC-010).
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+doflow_config_home
+STATE_DIR="${DOFLOW_HOME:+$DOFLOW_HOME/session-env}"
+SESSION_DIR="${STATE_DIR:+$STATE_DIR/sessions}"
+PROJECTS_DIR="${STATE_DIR:+$STATE_DIR/projects}"
 # shellcheck disable=SC2034  # used by session-start.sh and session-end.sh which source this file
-SESSIONS_LOG="$DOFLOW_HOME/sessions.log"
+SESSIONS_LOG="${DOFLOW_HOME:+$DOFLOW_HOME/sessions.log}"
 
 # Identifies which agent is running. Override via env var for non-Claude agents.
 export DOFLOW_AGENT="${DOFLOW_AGENT:-unknown}"
@@ -246,6 +264,7 @@ cwd_hash() {
 # Safe to call multiple times (mkdir -p is idempotent).
 ensure_session_dir() {
   local session_id="$1"
+  [ -n "$SESSION_DIR" ] || return 0
   mkdir -p "$SESSION_DIR/$session_id"
   echo "$SESSION_DIR/$session_id"
 }
@@ -255,6 +274,7 @@ ensure_session_dir() {
 ensure_project_dir() {
   local cwd="$1"
   local hash
+  [ -n "$PROJECTS_DIR" ] || return 0
   hash=$(cwd_hash "$cwd")
   mkdir -p "$PROJECTS_DIR/$hash"
   echo "$PROJECTS_DIR/$hash"

package/core/harnesses/kiro/hooks/mcp-tool-guard.sh

@@ -1,9 +1,25 @@
 #!/usr/bin/env bash
-# Kiro adapter: reuse the canonical mcp-tool-guard policy with Kiro attribution.
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Kiro front door: mcp-tool-guard through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"
+here="$(dirname "$0")"
 # shellcheck source=lib.sh
-source "$(dirname "$0")/lib.sh"
-# Translate Kiro's payload (tool names, KIRO_SESSION_ID, assistant_response) to the canonical one.
-payload=$(kiro_bridge_payload)
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/mcp-tool-guard.sh" <<<"$payload"
+source "$here/lib.sh"
+raw=$(cat)
+payload=$(kiro_bridge_payload <<<"$raw")
+event="PreToolUse"
+if command -v jq >/dev/null 2>&1; then event=$(printf '%s' "$raw" | jq -r '.hook_event_name // "PreToolUse"' 2>/dev/null) || event="PreToolUse"; fi
+bridge="$here/../../.doflow/shared/hooks/bridge/bridge.sh"
+if [ ! -f "$bridge" ]; then
+  printf '%s\n' '[doflow] shared hooks lack the bridge; run: doflow update -t kiro' >&2
+  exit 2
+fi
+. "$bridge" 2>/dev/null || { printf '%s\n' '[doflow] shared hooks lack the bridge; run: doflow update -t kiro' >&2; exit 2; }
+if doflow_bridge kiro "$event" mcp-tool-guard <<<"$payload"; then
+  status=0
+else
+  status=$?
+fi
+if [ "$status" -eq 2 ]; then printf '\n' >&2; fi
+exit "$status"

package/core/harnesses/kiro/hooks/pre-bash-guard.sh

@@ -1,9 +1,25 @@
 #!/usr/bin/env bash
-# Kiro adapter: reuse the canonical pre-bash-guard policy with Kiro attribution.
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Kiro front door: pre-bash-guard through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"
+here="$(dirname "$0")"
 # shellcheck source=lib.sh
-source "$(dirname "$0")/lib.sh"
-# Translate Kiro's payload (tool names, KIRO_SESSION_ID, assistant_response) to the canonical one.
-payload=$(kiro_bridge_payload)
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/pre-bash-guard.sh" <<<"$payload"
+source "$here/lib.sh"
+raw=$(cat)
+payload=$(kiro_bridge_payload <<<"$raw")
+event="PreToolUse"
+if command -v jq >/dev/null 2>&1; then event=$(printf '%s' "$raw" | jq -r '.hook_event_name // "PreToolUse"' 2>/dev/null) || event="PreToolUse"; fi
+bridge="$here/../../.doflow/shared/hooks/bridge/bridge.sh"
+if [ ! -f "$bridge" ]; then
+  printf '%s\n' '[doflow] shared hooks lack the bridge; run: doflow update -t kiro' >&2
+  exit 2
+fi
+. "$bridge" 2>/dev/null || { printf '%s\n' '[doflow] shared hooks lack the bridge; run: doflow update -t kiro' >&2; exit 2; }
+if doflow_bridge kiro "$event" pre-bash-guard <<<"$payload"; then
+  status=0
+else
+  status=$?
+fi
+if [ "$status" -eq 2 ]; then printf '\n' >&2; fi
+exit "$status"

package/core/harnesses/kiro/hooks/pre-implement-gate.sh

@@ -1,9 +1,25 @@
 #!/usr/bin/env bash
-# Kiro adapter: reuse the canonical pre-implementation-gate policy with Kiro attribution.
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Kiro front door: pre-implementation-gate through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"
+here="$(dirname "$0")"
 # shellcheck source=lib.sh
-source "$(dirname "$0")/lib.sh"
-# Translate Kiro's payload (tool names, KIRO_SESSION_ID, assistant_response) to the canonical one.
-payload=$(kiro_bridge_payload)
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/pre-implementation-gate.sh" <<<"$payload"
+source "$here/lib.sh"
+raw=$(cat)
+payload=$(kiro_bridge_payload <<<"$raw")
+event="PreToolUse"
+if command -v jq >/dev/null 2>&1; then event=$(printf '%s' "$raw" | jq -r '.hook_event_name // "PreToolUse"' 2>/dev/null) || event="PreToolUse"; fi
+bridge="$here/../../.doflow/shared/hooks/bridge/bridge.sh"
+if [ ! -f "$bridge" ]; then
+  printf '%s\n' '[doflow] shared hooks lack the bridge; run: doflow update -t kiro' >&2
+  exit 2
+fi
+. "$bridge" 2>/dev/null || { printf '%s\n' '[doflow] shared hooks lack the bridge; run: doflow update -t kiro' >&2; exit 2; }
+if doflow_bridge kiro "$event" pre-implementation-gate <<<"$payload"; then
+  status=0
+else
+  status=$?
+fi
+if [ "$status" -eq 2 ]; then printf '\n' >&2; fi
+exit "$status"

package/core/harnesses/kiro/hooks/session-start.sh

@@ -1,9 +1,16 @@
 #!/usr/bin/env bash
-# Kiro adapter: reuse the canonical session-context policy with Kiro attribution.
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Kiro front door: session-context through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"
+here="$(dirname "$0")"
 # shellcheck source=lib.sh
-source "$(dirname "$0")/lib.sh"
-# Translate Kiro's payload (tool names, KIRO_SESSION_ID, assistant_response) to the canonical one.
-payload=$(kiro_bridge_payload)
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/session-context.sh" <<<"$payload"
+source "$here/lib.sh"
+raw=$(cat)
+payload=$(kiro_bridge_payload <<<"$raw")
+event="SessionStart"
+if command -v jq >/dev/null 2>&1; then event=$(printf '%s' "$raw" | jq -r '.hook_event_name // "SessionStart"' 2>/dev/null) || event="SessionStart"; fi
+bridge="$here/../../.doflow/shared/hooks/bridge/bridge.sh"
+if [ ! -f "$bridge" ]; then exit 0; fi
+. "$bridge" 2>/dev/null || exit 0
+doflow_bridge kiro "$event" session-context <<<"$payload"

package/core/harnesses/kiro/hooks/stop-check.sh

@@ -1,43 +1,35 @@
 #!/usr/bin/env bash
-# Kiro adapter: run the canonical stop-check policy and translate its verdict to the Kiro engine.
-#
-# The policy exits 2 to deny the stop. Kiro engines read a Stop hook differently:
-#   - Kiro CLI V3 / IDE (payload carries session_id): exit 0 finishes the turn; exit 0 with stdout
-#     JSON {"decision":"block","reason":"..."} starts another turn with that reason; exit 1 also
-#     starts another turn; other codes finish without forwarding output. Exit 2 does NOT block.
-#     So a policy deny becomes the JSON block on stdout with exit 0.
-#   - Kiro CLI 2.x (payload has no session_id): exit 0 succeeded, any other code shows stderr to the
-#     user as a warning. A policy deny is passed through as stderr with exit 2.
-# Every other policy outcome exits 0, never 1: V3 treats exit 1 as "continue another turn".
-# The policy blocks a given message once, so the continuation turn is not blocked again.
-# Docs: https://kiro.dev/docs/hooks/types/ , https://kiro.dev/docs/cli/v3/hooks-migration/
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Kiro Stop front door: translate the native payload, then render the bridge verdict for its engine.
 set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"
 here="$(dirname "$0")"
 # shellcheck source=lib.sh
 source "$here/lib.sh"
-set +e # lib.sh enables errexit; the policy exit code is handled explicitly below
-
 raw=$(cat)
-# Translate Kiro's payload (tool names, KIRO_SESSION_ID, assistant_response) to the canonical one.
 payload=$(kiro_bridge_payload <<<"$raw")
-
-# V3 and the IDE send session_id in the payload; 2.x does not (the bridge injects it from the env).
 raw_sid=""
+event="Stop"
 if command -v jq >/dev/null 2>&1; then
   raw_sid=$(printf '%s' "$raw" | jq -r '.session_id // empty' 2>/dev/null) || raw_sid=""
+  event=$(printf '%s' "$raw" | jq -r '.hook_event_name // "Stop"' 2>/dev/null) || event="Stop"
 fi
-
-# Capture the policy's stderr (stdout discarded) and its exit code without a temp file.
-errtext=$(bash "$here/../../.doflow/shared/hooks/policies/stop-check.sh" <<<"$payload" 2>&1 >/dev/null)
-rc=$?
-
-if [ "$rc" -eq 2 ]; then
-  if [ -n "$raw_sid" ] && command -v jq >/dev/null 2>&1; then
-    jq -n --arg reason "$errtext" '{decision: "block", reason: $reason}'
-    exit 0
-  fi
-  printf '%s\n' "$errtext" >&2
-  exit 2
+if [ -n "$raw_sid" ]; then
+  export DOFLOW_KIRO_ENGINE=v3
+else
+  export DOFLOW_KIRO_ENGINE=2x
 fi
-exit 0
+bridge="$here/../../.doflow/shared/hooks/bridge/bridge.sh"
+if [ ! -f "$bridge" ]; then exit 0; fi
+. "$bridge" 2>/dev/null || exit 0
+exec 4>&1
+if bridge_stderr=$(doflow_bridge kiro "$event" stop-check <<<"$payload" 2>&1 1>&4); then
+  status=0
+else
+  status=$?
+fi
+exec 4>&-
+if [ "$status" -eq 2 ] && [ "$DOFLOW_KIRO_ENGINE" = 2x ]; then
+  printf '%s\n' "$bridge_stderr" >&2
+fi
+exit "$status"