@kylecheng3146/agent-ops 0.1.1 → 0.1.3

package/README.md

@@ -94,8 +94,17 @@ node dist/packages/cli/src/bin.js update --dry-run --json
 node dist/packages/cli/src/bin.js uninstall --dry-run --json
 ```
 
-The commands after `init --yes` are post-apply operations; `doctor` may report
-an unknown probe status until a repository-specific verification setup exists.
+The commands after `init --yes` are post-apply operations. `doctor` reports
+`UNKNOWN` for a probe that has nothing to verify yet: `repository-trust` until
+`trust grant` runs, and `smoke-availability` until the configuration declares a
+verification command.
+
+Installing the `advisory` or `guardrails` profile also registers lifecycle
+hooks in `.claude/settings.json` and `.codex/hooks.json`. Only agent-ops owned
+handlers are added, foreign settings in those files are preserved, and
+`uninstall` removes exactly the handlers it registered. The hooks call
+`agent-ops hook <harness> <event>`, which always exits 0 so a toolkit failure
+can never block the harness.
 
 For a full command reference, run `agent-ops --help`. The `task`, `verify`, and
 `review` commands support acceptance tracking and independent verification when

package/dist/packages/cli/src/bin.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
+import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { createInterface } from "node:readline/promises";
 import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import { commonHarnessAdapters } from "../../../runtime/src/install/harness.js";
+import { hookRegistrationSatisfied, repositoryTrustStatus, smokeAvailabilityStatus } from "../../../runtime/src/install/probes.js";
+import { parseInstallManifest } from "../../../runtime/src/fs/manifest.js";
 import { NpmRegistryClient } from "../../../runtime/src/registry/npm.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
-import { mergeConfigLayers } from "../../../runtime/src/config/merge.js";
-import { loadConfigFile } from "../../../runtime/src/config/load.js";
-import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { FileTrustStore, calculateTrustBinding } from "../../../runtime/src/security/trust.js";
 import { localStatePaths } from "../../../runtime/src/security/permissions.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
@@ -17,6 +17,10 @@ import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
 import { VerificationService } from "../../../runtime/src/verify/service.js";
 import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
 import { runCli } from "./cli.js";
+import { loadEffectiveConfig, repositoryTrust } from "./context.js";
+import { runHookProcess } from "./hook-process.js";
+import { selectYesNo, writeBanner } from "./ui.js";
+import { CLI_VERSION } from "./version.js";
 import { createCommandRegistry } from "./commands/index.js";
 import { explainConfigCommand } from "./commands/config.js";
 import { runDoctorCommand } from "./commands/doctor.js";
@@ -28,263 +32,207 @@ import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
 import { formatUpdatePlan, runUpdateCommand } from "./commands/update.js";
 import { errorEnvelope } from "./output.js";
-const CLI_VERSION = "0.1.0";
-const DEFAULT_CONFIG = {
-    schemaVersion: 1,
-    profiles: [],
-    verification: { commands: [] },
-    pathMappings: [],
-    securityExceptions: []
-};
-function defaultConfigLayer() {
-    return {
-        source: "default",
-        sourcePath: "built-in defaults",
-        config: DEFAULT_CONFIG
-    };
-}
-async function loadOptionalConfig(path) {
+const HOOK_RUNTIME_PATH = fileURLToPath(new URL("./hook-entry.js", import.meta.url));
+async function readOptionalJson(path) {
     try {
-        return await loadConfigFile(path);
-    }
-    catch (error) {
-        if (error instanceof AgentOpsError &&
-            error.code === "CONFIG_READ_FAILED" &&
-            typeof error.cause === "object" &&
-            error.cause !== null &&
-            "code" in error.cause &&
-            error.cause.code === "ENOENT") {
-            return null;
-        }
-        throw error;
-    }
-}
-async function loadEffectiveConfig(root, scope) {
-    const home = process.env.AGENT_OPS_HOME ?? homedir();
-    const userPath = join(home, ".agent-ops", "config.json");
-    const projectPath = join(root, ".agent-ops", "config.json");
-    const layers = [defaultConfigLayer()];
-    if (scope === "user") {
-        const user = await loadOptionalConfig(userPath);
-        if (user !== null) {
-            layers.push({
-                source: "user",
-                sourcePath: user.sourcePath,
-                config: user.config
-            });
-        }
-        return mergeConfigLayers(layers);
-    }
-    if (projectPath !== userPath) {
-        const user = await loadOptionalConfig(userPath);
-        if (user !== null) {
-            layers.push({
-                source: "user",
-                sourcePath: user.sourcePath,
-                config: user.config
-            });
-        }
+        return JSON.parse(await readFile(path, "utf8"));
     }
-    const project = await loadOptionalConfig(projectPath);
-    if (project !== null) {
-        layers.push({
-            source: "project",
-            sourcePath: project.sourcePath,
-            config: project.config
-        });
+    catch {
+        return null;
     }
-    return mergeConfigLayers(layers);
 }
-async function repositoryTrust(root, config) {
-    const home = process.env.AGENT_OPS_HOME ?? homedir();
-    const state = localStatePaths(home);
-    const remote = (() => {
-        try {
-            return execFileSync("git", ["config", "--get", "remote.origin.url"], {
-                cwd: root,
-                encoding: "utf8"
-            }).trim();
-        }
-        catch {
-            return `local:${root}`;
-        }
-    })();
+async function installedHarness(root) {
     try {
-        const binding = await calculateTrustBinding({
-            repositoryPath: root,
-            remoteUrl: remote,
-            configHash: sha256(JSON.stringify(config)),
-            runtimeHash: sha256(CLI_VERSION)
-        });
-        return (await new FileTrustStore(state.trustStore, state.anchorDirectory).status(binding)).status;
+        return parseInstallManifest(await readFile(join(root, ".agent-ops", "manifest.json"), "utf8")).harness;
     }
     catch {
-        return "UNTRUSTED";
+        // ponytail: no readable manifest means demand hooks for both harnesses.
+        return "both";
     }
 }
 async function confirmInit(plan) {
+    writeBanner({
+        isTTY: process.stdout.isTTY === true,
+        columns: process.stdout.columns,
+        write: (value) => process.stdout.write(value)
+    });
     return await confirmPlan(formatInstallPlan(plan));
 }
 async function confirmPlan(text) {
     process.stdout.write(text);
-    const prompt = createInterface({
-        input: process.stdin,
-        output: process.stdout
-    });
-    try {
-        const answer = await prompt.question("Apply this installation plan? [y/N]: ");
-        return ["y", "yes"].includes(answer.trim().toLowerCase());
-    }
-    finally {
-        prompt.close();
-    }
+    return await selectYesNo("Apply this installation plan?", { input: process.stdin, output: process.stdout }, false);
+}
+const argv = process.argv.slice(2);
+if (argv[0] === "hook") {
+    process.exitCode = await runHookProcess(argv.slice(1), {
+        stdin: process.stdin,
+        writeStdout: (value) => process.stdout.write(value),
+        writeStderr: (value) => process.stderr.write(value)
+    }, CLI_VERSION);
 }
-process.exitCode = await runCli(process.argv.slice(2), {
-    isTTY: process.stdin.isTTY === true && process.stdout.isTTY === true,
-    input: process.stdin,
-    output: process.stdout,
-    writeStdout: (value) => process.stdout.write(value),
-    writeStderr: (value) => process.stderr.write(value)
-}, {
-    version: CLI_VERSION,
-    registry: createCommandRegistry(Object.fromEntries([
-        "init",
-        "config",
-        "trust",
-        "doctor",
-        "update",
-        "uninstall",
-        "task",
-        "verify",
-        "review"
-    ].map((command) => [command, async (args) => {
-            const root = args.scope === "user"
-                ? process.env.AGENT_OPS_HOME ?? homedir()
-                : process.cwd();
-            const isTTY = !args.json &&
-                process.stdin.isTTY === true &&
-                process.stdout.isTTY === true;
-            if (args.command === "init") {
-                return await runInitCommand({
-                    args,
-                    root,
-                    adapters: commonHarnessAdapters(),
-                    isTTY,
-                    toolkitVersion: CLI_VERSION,
-                    confirm: async (plan) => await confirmInit(plan)
-                });
-            }
-            if (args.command === "doctor") {
-                return await runDoctorCommand({ root });
-            }
-            if (args.command === "uninstall") {
-                return await runUninstallCommand({
-                    args,
-                    root,
-                    isTTY,
-                    confirm: async (plan) => await confirmPlan(formatUninstallPlan(plan))
-                });
-            }
-            if (args.command === "update") {
-                return await runUpdateCommand({
-                    args,
-                    root,
-                    adapters: commonHarnessAdapters(),
-                    registry: new NpmRegistryClient(),
-                    isTTY,
-                    confirm: async (plan) => await confirmPlan(formatUpdatePlan(plan)),
-                    ...(args.targetVersion === undefined
-                        ? {}
-                        : { targetVersion: args.targetVersion })
-                });
-            }
-            const taskService = new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root));
-            if (args.command === "task") {
-                const sessionId = process.env.AGENT_OPS_SESSION_ID;
-                return await runTaskCommand({
-                    args,
-                    service: taskService,
-                    ...(sessionId === undefined ? {} : { sessionId })
-                });
-            }
-            if (args.command === "review") {
-                return await runReviewCommand({
-                    args,
-                    authorized: args.yes
-                });
-            }
-            if (args.command === "config") {
-                return explainConfigCommand(await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project"));
-            }
-            if (args.command === "verify") {
-                const merged = await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project");
-                const config = merged.config;
-                const trustStatus = await repositoryTrust(root, config);
-                return await runVerifyCommand({
-                    args,
-                    taskService,
-                    service: new VerificationService({
+else {
+    process.exitCode = await runCli(argv, {
+        isTTY: process.stdin.isTTY === true && process.stdout.isTTY === true,
+        input: process.stdin,
+        output: process.stdout,
+        writeStdout: (value) => process.stdout.write(value),
+        writeStderr: (value) => process.stderr.write(value)
+    }, {
+        version: CLI_VERSION,
+        registry: createCommandRegistry(Object.fromEntries([
+            "init",
+            "config",
+            "trust",
+            "doctor",
+            "update",
+            "uninstall",
+            "task",
+            "verify",
+            "review"
+        ].map((command) => [command, async (args) => {
+                const root = args.scope === "user"
+                    ? process.env.AGENT_OPS_HOME ?? homedir()
+                    : process.cwd();
+                const isTTY = !args.json &&
+                    process.stdin.isTTY === true &&
+                    process.stdout.isTTY === true;
+                if (args.command === "init") {
+                    return await runInitCommand({
+                        args,
                         root,
-                        scope: args.scope === "user" ? "user" : "project",
-                        config,
-                        gitRunner: {
-                            run: async (gitArgs) => {
-                                try {
-                                    return {
-                                        exitCode: 0,
-                                        stdout: execFileSync("git", [...gitArgs], {
-                                            cwd: root,
-                                            encoding: "buffer",
-                                            stdio: ["ignore", "pipe", "ignore"]
-                                        })
-                                    };
-                                }
-                                catch (error) {
-                                    const failure = error;
-                                    return {
-                                        exitCode: failure.status ?? 1,
-                                        stdout: failure.stdout ?? new Uint8Array()
-                                    };
-                                }
-                            }
-                        },
-                        processRunner: new NodeVerificationProcessRunner(),
+                        adapters: commonHarnessAdapters(),
+                        isTTY,
+                        toolkitVersion: CLI_VERSION,
+                        hookRuntimePath: HOOK_RUNTIME_PATH,
+                        confirm: async (plan) => await confirmInit(plan)
+                    });
+                }
+                if (args.command === "doctor") {
+                    const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
+                    return await runDoctorCommand({
+                        root,
+                        probes: {
+                            hookRegistration: async () => hookRegistrationSatisfied({
+                                harness: await installedHarness(root),
+                                profiles: config.profiles,
+                                claudeSettings: await readOptionalJson(join(root, ".claude", "settings.json")),
+                                codexHooks: await readOptionalJson(join(root, ".codex", "hooks.json"))
+                            }),
+                            repositoryTrust: async () => repositoryTrustStatus(await repositoryTrust(root, config, CLI_VERSION)),
+                            smokeAvailability: () => smokeAvailabilityStatus(config)
+                        }
+                    });
+                }
+                if (args.command === "uninstall") {
+                    return await runUninstallCommand({
+                        args,
+                        root,
+                        isTTY,
+                        confirm: async (plan) => await confirmPlan(formatUninstallPlan(plan))
+                    });
+                }
+                if (args.command === "update") {
+                    return await runUpdateCommand({
+                        args,
+                        root,
+                        adapters: commonHarnessAdapters(),
+                        registry: new NpmRegistryClient(),
+                        isTTY,
+                        hookRuntimePath: HOOK_RUNTIME_PATH,
+                        confirm: async (plan) => await confirmPlan(formatUpdatePlan(plan)),
+                        ...(args.targetVersion === undefined
+                            ? {}
+                            : { targetVersion: args.targetVersion })
+                    });
+                }
+                const taskService = new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root));
+                if (args.command === "task") {
+                    const sessionId = process.env.AGENT_OPS_SESSION_ID;
+                    return await runTaskCommand({
+                        args,
+                        service: taskService,
+                        ...(sessionId === undefined ? {} : { sessionId })
+                    });
+                }
+                if (args.command === "review") {
+                    return await runReviewCommand({
+                        args,
+                        authorized: args.yes
+                    });
+                }
+                if (args.command === "config") {
+                    return explainConfigCommand(await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project"));
+                }
+                if (args.command === "verify") {
+                    const merged = await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project");
+                    const config = merged.config;
+                    const trustStatus = await repositoryTrust(root, config, CLI_VERSION);
+                    return await runVerifyCommand({
+                        args,
                         taskService,
-                        evidenceStore: new FileEvidenceStore(root, root),
-                        trusted: trustStatus === "TRUSTED"
-                    })
-                });
-            }
-            if (args.command === "trust") {
-                const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
-                const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
-                const remote = (() => {
-                    try {
-                        return execFileSync("git", ["config", "--get", "remote.origin.url"], {
-                            cwd: root,
-                            encoding: "utf8"
-                        }).trim();
-                    }
-                    catch {
-                        return `local:${root}`;
-                    }
-                })();
-                const binding = await calculateTrustBinding({
-                    repositoryPath: root,
-                    remoteUrl: remote,
-                    configHash: sha256(JSON.stringify(config)),
-                    runtimeHash: sha256(CLI_VERSION)
-                });
-                return await runTrustCommand({
-                    action: args.action,
-                    yes: args.yes,
-                    isTTY,
-                    calculateBinding: async () => binding,
-                    presentBinding: async () => undefined,
-                    confirmGrant: async () => await confirmPlan(JSON.stringify(binding, null, 2)),
-                    store: new FileTrustStore(state.trustStore, state.anchorDirectory)
-                });
-            }
-            return errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`);
-        }])))
-});
+                        service: new VerificationService({
+                            root,
+                            scope: args.scope === "user" ? "user" : "project",
+                            config,
+                            gitRunner: {
+                                run: async (gitArgs) => {
+                                    try {
+                                        return {
+                                            exitCode: 0,
+                                            stdout: execFileSync("git", [...gitArgs], {
+                                                cwd: root,
+                                                encoding: "buffer",
+                                                stdio: ["ignore", "pipe", "ignore"]
+                                            })
+                                        };
+                                    }
+                                    catch (error) {
+                                        const failure = error;
+                                        return {
+                                            exitCode: failure.status ?? 1,
+                                            stdout: failure.stdout ?? new Uint8Array()
+                                        };
+                                    }
+                                }
+                            },
+                            processRunner: new NodeVerificationProcessRunner(),
+                            taskService,
+                            evidenceStore: new FileEvidenceStore(root, root),
+                            trusted: trustStatus === "TRUSTED"
+                        })
+                    });
+                }
+                if (args.command === "trust") {
+                    const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
+                    const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
+                    const remote = (() => {
+                        try {
+                            return execFileSync("git", ["config", "--get", "remote.origin.url"], {
+                                cwd: root,
+                                encoding: "utf8"
+                            }).trim();
+                        }
+                        catch {
+                            return `local:${root}`;
+                        }
+                    })();
+                    const binding = await calculateTrustBinding({
+                        repositoryPath: root,
+                        remoteUrl: remote,
+                        configHash: sha256(JSON.stringify(config)),
+                        runtimeHash: sha256(CLI_VERSION)
+                    });
+                    return await runTrustCommand({
+                        action: args.action,
+                        yes: args.yes,
+                        isTTY,
+                        calculateBinding: async () => binding,
+                        presentBinding: async () => undefined,
+                        confirmGrant: async () => await confirmPlan(JSON.stringify(binding, null, 2)),
+                        store: new FileTrustStore(state.trustStore, state.anchorDirectory)
+                    });
+                }
+                return errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`);
+            }])))
+    });
+}

package/dist/packages/cli/src/commands/hook.js

@@ -0,0 +1,42 @@
+import { normalizeClaudeHookInput } from "../../../../runtime/src/adapters/claude/input.js";
+import { claudeHookOutput } from "../../../../runtime/src/adapters/claude/output.js";
+import { normalizeCodexHookInput } from "../../../../runtime/src/adapters/codex/input.js";
+import { codexHookOutput } from "../../../../runtime/src/adapters/codex/output.js";
+import { dispatchHookEvent } from "../../../../runtime/src/hooks/dispatch.js";
+import { resolveProfiles } from "../../../../runtime/src/install/profiles.js";
+export const HOOK_EVENTS = [
+    "SessionStart",
+    "PreToolUse",
+    "Stop"
+];
+/**
+ * Hooks are advisory infrastructure: every failure path stays fail-open with
+ * exit code 0 so a broken toolkit can never wedge the harness.
+ */
+export async function runHookCommand(options) {
+    try {
+        const { capabilities } = resolveProfiles(options.config.profiles);
+        let input;
+        try {
+            input = JSON.parse(options.stdin);
+        }
+        catch {
+            return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        const event = options.harness === "claude"
+            ? normalizeClaudeHookInput(input)
+            : normalizeCodexHookInput(input);
+        const result = await dispatchHookEvent(event, {
+            capabilities,
+            trusted: options.trusted
+        });
+        if (options.harness === "claude") {
+            return claudeHookOutput(options.event, result);
+        }
+        const codex = codexHookOutput(options.event, result);
+        return { exitCode: 0, stdout: codex.stdout, stderr: "" };
+    }
+    catch {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
+}

package/dist/packages/cli/src/commands/init.js

@@ -38,7 +38,10 @@ export async function runInitCommand(options) {
         adapters: options.adapters,
         ...(options.toolkitVersion === undefined
             ? {}
-            : { toolkitVersion: options.toolkitVersion })
+            : { toolkitVersion: options.toolkitVersion }),
+        ...(options.hookRuntimePath === undefined
+            ? {}
+            : { hookRuntimePath: options.hookRuntimePath })
     });
     if (args.dryRun) {
         return okEnvelope("INIT_PLAN_READY", {

package/dist/packages/cli/src/commands/update.js

@@ -32,7 +32,10 @@ export async function runUpdateCommand(options) {
             : { registry: options.registry }),
         ...(options.targetVersion === undefined
             ? {}
-            : { targetVersion: options.targetVersion })
+            : { targetVersion: options.targetVersion }),
+        ...(options.hookRuntimePath === undefined
+            ? {}
+            : { hookRuntimePath: options.hookRuntimePath })
     });
     if (options.args.dryRun) {
         return okEnvelope("UPDATE_PLAN_READY", {