@lh8ppl/claude-memory-kit 0.3.5 → 0.4.0

package/src/kiro-hook-bin.mjs

@@ -0,0 +1,105 @@
+// kiro-hook-bin.mjs — the Kiro hook ADAPTER (Task 50.J/50.L).
+//
+// Bridges Kiro's runCommand hook input model to the kit's inject/capture cores.
+// Kiro's model (LIVE-VERIFIED via probe, P-CJYGTQYR — and there is NO published
+// runCommand prior art; every real Kiro hook is askAgent, so the probe is ground
+// truth):
+//   - EVENT  → argv          (`cmk hook stop` → argv[0] = 'stop')
+//   - PROJECT→ process.cwd()  (Kiro runs the hook in the project root)
+//   - PROMPT → process.env.USER_PROMPT  (set on promptSubmit; empty on stop)
+//   - TURN   → Kiro's transcript file (.history), NOT a stdin payload
+//   - TOOL   → (preToolUse) the about-to-run tool command; passed via env/argv
+//             (exact field flagged for the cut-gate-kiro live test, D-192)
+//
+// This is the per-agent adapter the cross-agent seam needs: Claude Code reads a
+// stdin JSON payload; Kiro reads argv+env+cwd+transcript. The dispatcher (50.J)
+// owns the routing + the always-exit-0 invariant; this adapter owns the
+// input translation. `deps` is the injection seam (tests pass fakes; the bin
+// wires the real readKiroTurn / injectContext / captureTurn).
+//
+// Public surface:
+//   runKiroHook({ argv, cwd, env, deps }) → { action, exitCode: 0, stdout?, stderr? }
+
+import { dispatchKiroHook } from './kiro-hook-dispatch.mjs';
+
+// 50.N.2 — Kiro's file-write tool names → Claude's PostToolUse-eligible names, so
+// the shared observeEdit core (keyed on Write/Edit/MultiEdit) recognizes a Kiro
+// file edit. `fs_write` is Kiro's create-or-edit-a-file tool (kiro.dev tool list);
+// it covers both the create + edit cases, mapping to Claude's Write/Edit class
+// (observeEdit treats Write/Edit/MultiEdit identically — the target name only
+// appears in the summary line, so the map is behavior-neutral).
+// NOTE: if a real kiro-cli turns out to have a SEPARATE append/patch tool (e.g.
+// `fs_append`), add it here AND to the agent-config `matcher` (today scoped to the
+// literal `fs_write`). Flagged for the cut-gate to confirm `fs_write` is the only
+// file-mutation tool — no Kiro tool enumeration is captured in the research yet.
+const KIRO_EDIT_TOOL_MAP = Object.freeze({
+  fs_write: 'Write',
+  fsWrite: 'Write', // camelCase spelling tolerance
+});
+
+export function runKiroHook({ argv = [], cwd = process.cwd(), env = process.env, payload = {}, deps = {} } = {}) {
+  const event = argv[0];
+  const { readKiroTurn, inject, capture, capturePrompt, observe, guard } = deps;
+
+  // Wrap the kit cores so the dispatcher's generic inject/capture contract is fed
+  // Kiro's actual inputs.
+  const wrappedInject = (args) => inject({ ...args, userPrompt: env.USER_PROMPT || '' });
+
+  const wrappedCapture = (args) => {
+    // Kiro has no stdin payload — read the turn from Kiro's transcript instead,
+    // then build the {assistant_message} payload captureTurn's extractTurnText
+    // understands. A failed read must NOT crash (dispatcher catches + exits 0).
+    const turn = readKiroTurn({ projectRoot: args.projectRoot, env }) || {};
+    const payload = {
+      assistant_message: turn.assistantText || '',
+      // carry the user prompt too (capture-prompt pairing analog)
+      ...(turn.userText ? { user_message: turn.userText } : {}),
+    };
+    return capture({ ...args, payload });
+  };
+
+  // 50.N.1 — prompt-capture on the prompt-submit events. The prompt text comes
+  // from the stdin payload (kiro-cli `userPromptSubmit` carries `prompt`) OR env
+  // USER_PROMPT (the IDE legacy surface). capturePrompt reads `payload.prompt`,
+  // so build a payload that carries whichever is present.
+  const wrappedCapturePrompt = capturePrompt
+    ? (args) => {
+        const prompt =
+          (payload && typeof payload.prompt === 'string' && payload.prompt) ||
+          env.USER_PROMPT ||
+          '';
+        return capturePrompt({ ...args, payload: { ...payload, prompt } });
+      }
+    : undefined;
+
+  // 50.N.2 — observe-edit on postToolUse. Kiro's file-write tool is `fs_write`
+  // (not Claude's Write/Edit/MultiEdit), so map the Kiro tool name to an eligible
+  // one before observeEdit's eligibility check. observeEdit's path-extractor
+  // already probes `path` (which Kiro's fs_write tool_input uses) alongside
+  // file_path/filePath. The stdin payload (postToolUse → {tool_name, tool_input,
+  // tool_response}) carries everything observeEdit needs.
+  const wrappedObserve = observe
+    ? (args) => {
+        const mapped = KIRO_EDIT_TOOL_MAP[payload?.tool_name] ?? payload?.tool_name;
+        return observe({ ...args, payload: { ...payload, tool_name: mapped } });
+      }
+    : undefined;
+
+  // preToolUse guard (forward-compat path — the production Kiro install calls the
+  // cmk-guard-memory bin directly, which reads the stdin payload). If a guard dep
+  // is wired, pass the stdin payload through so it can read tool_input.command.
+  const wrappedGuard = guard ? (args) => guard({ ...args, payload }) : undefined;
+
+  return dispatchKiroHook({
+    event,
+    payload,
+    cwd,
+    deps: {
+      inject: wrappedInject,
+      capture: wrappedCapture,
+      ...(wrappedCapturePrompt ? { capturePrompt: wrappedCapturePrompt } : {}),
+      ...(wrappedObserve ? { observe: wrappedObserve } : {}),
+      ...(wrappedGuard ? { guard: wrappedGuard } : {}),
+    },
+  });
+}

package/src/kiro-hook-command.mjs

@@ -0,0 +1,67 @@
+// kiro-hook-command.mjs — the platform-correct `cmk hook <event>` command string.
+//
+// Shared by BOTH Kiro hook surfaces (the IDE .kiro.hook writer + the CLI
+// agent-config writer) so the platform logic lives in ONE place (the
+// shared-module discipline).
+//
+// LIVE-VERIFIED 2026-06-21 (P-PM2CD6CB): Kiro runs a hook command through WSL on
+// Windows, and WSL has no node, so a bare `cmk hook stop` fails ("node: not
+// found"). Forcing the Windows-native shell with `cmd.exe /c` reaches the real
+// node+cmk (proven: `cmd.exe /c cmk --version` → 0.3.5 in the Kiro chat). On
+// macOS/Linux there's no WSL hop, so the native `cmk` runs directly.
+//   Windows → `cmd.exe /c cmk hook <event>`
+//   macOS/Linux → `cmk hook <event>`
+//
+// platform-commands: ignore (the Kiro-hook command runs in KIRO's shell, not the
+//   kit's — this is the deliberate cmd.exe form; it keys on the INSTALL host's
+//   process.platform, the right signal for "which OS will run these hooks").
+
+const IS_WINDOWS = process.platform === 'win32';
+
+/** Build the `cmk hook <event>` command, platform-wrapped. */
+export function kiroHookCommand(event, cmkCmd = 'cmk') {
+  const inner = `${cmkCmd} hook ${event}`;
+  return IS_WINDOWS ? `cmd.exe /c ${inner}` : inner;
+}
+
+/**
+ * Build the memory delete-guardrail command (D-192), platform-wrapped. Kiro's
+ * `preToolUse` delivers `{ tool_name, tool_input: { command } }` on STDIN — the
+ * SAME shape as Claude Code (verified from the real oh-my-kiro + vibekit
+ * preToolUse hooks). So the `cmk-guard-memory` bin (which reads that stdin and
+ * exits 2 to BLOCK) guards BOTH agents — no Kiro-specific adapter needed.
+ */
+export function kiroGuardCommand(binCmd = 'cmk-guard-memory') {
+  return IS_WINDOWS ? `cmd.exe /c ${binCmd}` : binCmd;
+}
+
+/**
+ * The kit's hook commands as CLI agent-config `toolsSettings.shell.allowedCommands`
+ * REGEX patterns (D-194). Distinct from the IDE `kiroAgent.trustedCommands` shape:
+ * the CLI agent-config uses REGEX (per the Kiro agent config reference —
+ * `deniedCommands: ["git commit .*"]`), the IDE uses wildcard PREFIX. Without these,
+ * the kiro-cli default agent prompts to approve its OWN inject/capture/guard hooks.
+ * We escape the `cmd.exe` dot and anchor each to the kit's own commands only —
+ * never a blanket `.*`.
+ */
+export function kiroCliAllowedCommands() {
+  // Regex, START-ANCHORED (`^`) to mirror the IDE side's prefix-from-start
+  // semantics (skill-review M2 — an unanchored `cmk hook .*` could match a
+  // command that merely CONTAINS the phrase mid-string). `.` in cmd.exe is
+  // escaped; `.*` matches the hook event / guard tail / command args.
+  //
+  // `cmk remember` + `cmk search` are pre-trusted because kiro-cli uses the CLI
+  // commands (not the MCP tools) for explicit capture/recall — kiro-cli does not
+  // wire MCP tools to a custom agent's LLM (Kiro #5873), so the shell commands are
+  // the working path. Pre-trusting them means they run WITHOUT a Run/Reject prompt
+  // (the same posture as the hook commands). Scoped to the kit's own verbs only.
+  const base = IS_WINDOWS
+    ? [
+        '^cmd\\.exe /c cmk hook .*',
+        '^cmd\\.exe /c cmk-guard-memory',
+        '^cmk remember .*',
+        '^cmk search .*',
+      ]
+    : ['^cmk hook .*', '^cmk-guard-memory', '^cmk remember .*', '^cmk search .*'];
+  return base;
+}

package/src/kiro-hook-dispatch.mjs

@@ -0,0 +1,115 @@
+// kiro-hook-dispatch.mjs — the `cmk hook <event>` Kiro dispatcher (Task 50.J).
+//
+// ONE entrypoint that both Kiro hook surfaces (IDE .kiro.hook + CLI agent-config)
+// call: `cmk hook <event>` with the Kiro hook payload on stdin. It fans out by
+// event to the kit's EXISTING inject/capture logic (injectContext / captureTurn —
+// the same cores the Claude-Code cmk-inject-context / cmk-capture-turn bins use),
+// so memory logic is shared cross-agent and only the per-agent payload adapter
+// differs.
+//
+// Kiro lifecycle events → kit operation:
+//   agentSpawn               → inject  (runs once, cached whole-conversation = SessionStart)
+//   promptSubmit /           → inject  (per-prompt recall). The IDE .kiro.hook surface
+//     userPromptSubmit                  emits `promptSubmit`; the Amazon-Q/CLI Rust contract
+//                                       names the same trigger `userPromptSubmit`. BOTH are
+//                                       recognized so the dispatcher is vocabulary-agnostic
+//                                       across the two hook surfaces (the I-1 composition fix:
+//                                       the CLI agent-config currently wires only
+//                                       agentSpawn+stop by design — inject-once is sufficient
+//                                       since agentSpawn caches the whole-conversation inject —
+//                                       but if a future CLI agent wires the contract's
+//                                       userPromptSubmit trigger, it routes to inject, not no-op).
+//   stop                     → capture (turn-end, the deterministic capture spine)
+//   <anything else>          → no-op   (forward-compatible: a new Kiro event never crashes)
+//
+// CRITICAL INVARIANT: always exit 0. A non-zero exit from a Kiro hook can break
+// the session (the PILOT caveat — aws-bash-hooks §6). Every error is caught,
+// reported on stderr, and the exit code stays 0. Memory capture is best-effort;
+// a failed capture must never take the user's Kiro session down with it.
+//
+// Public surface:
+//   dispatchKiroHook({ event, payload, cwd, userDir?, deps }) →
+//     { action: 'inject'|'capture'|'noop'|'error', exitCode: 0, stdout?, stderr? }
+//   `deps.inject` / `deps.capture` are REQUIRED — this is a pure router. The
+//   cmk-hook bin wires the real injectContext / captureTurn (top-level await
+//   import); tests pass fakes. Keeping the router dep-free makes it trivially
+//   testable and keeps the inject/capture cores out of the no-op event path.
+
+// `promptSubmit` (IDE .kiro.hook) and `userPromptSubmit` (Amazon-Q Rust contract)
+// are the SAME trigger under two surface vocabularies — both map to inject.
+const INJECT_EVENTS = new Set(['agentSpawn', 'promptSubmit', 'userPromptSubmit']);
+const CAPTURE_EVENTS = new Set(['stop']);
+// 50.N.1 — the prompt-submit events that ALSO capture the prompt (the <private>
+// -strip + transcript-append half of Claude Code's UserPromptSubmit). An explicit
+// ALLOW-set (not "INJECT minus agentSpawn") so a future inject-only event added to
+// INJECT_EVENTS never silently starts calling capturePrompt with no prompt.
+const PROMPT_CAPTURE_EVENTS = new Set(['promptSubmit', 'userPromptSubmit']);
+// preToolUse → the memory delete-guardrail (D-192). The ONE event that may exit
+// NON-zero: a non-zero preToolUse exit BLOCKS the Kiro tool (verified — the same
+// mechanism the always-exit-0 invariant exists for). The guard exits 2 ONLY on a
+// deliberate block; everything else (incl. a crashed guard via the catch) exits 0.
+const GUARD_EVENTS = new Set(['preToolUse']);
+// 50.N.2 — postToolUse → observe (the file-edit observation leg, matching Claude
+// Code's PostToolUse → cmk-observe-edit). Kiro's file-write tool is `fs_write`
+// (not Write/Edit); the runHook adapter maps the Kiro tool name + reads the path.
+const OBSERVE_EVENTS = new Set(['postToolUse']);
+
+export function dispatchKiroHook({ event, payload = {}, cwd, userDir, deps = {} } = {}) {
+  const { inject, capture, capturePrompt, observe, guard } = deps;
+
+  try {
+    if (INJECT_EVENTS.has(event)) {
+      // The prompt-submit events (promptSubmit / userPromptSubmit) do BOTH inject
+      // (recall) AND capturePrompt — the <private>-strip + transcript-append half,
+      // matching Claude Code's UserPromptSubmit (cmk-capture-prompt). agentSpawn is
+      // inject-only (no prompt to capture). capturePrompt is BEST-EFFORT: a throw
+      // must never break inject or the session (50.N.1). Older installs without
+      // the dep skip it cleanly.
+      if (PROMPT_CAPTURE_EVENTS.has(event) && typeof capturePrompt === 'function') {
+        try {
+          capturePrompt({ payload, projectRoot: cwd, ...(userDir ? { userDir } : {}) });
+        } catch (err) {
+          // swallow — capture is best-effort; inject below still runs.
+          process.stderr.write(`cmk hook ${event}: capturePrompt failed: ${err?.message ?? err}\n`);
+        }
+      }
+      const r = inject({ cwd, ...(userDir ? { userDir } : {}) });
+      // injectContext returns the text to surface as context; print on stdout so
+      // Kiro adds it to the agent's context (the runCommand→stdout→context path).
+      const stdout = r && typeof r.text === 'string' ? r.text : '';
+      return { action: 'inject', exitCode: 0, stdout };
+    }
+    if (OBSERVE_EVENTS.has(event)) {
+      // postToolUse → observe (the file-edit observation leg). Best-effort like
+      // capture; a throw must never wedge the tool/session. Older installs (no
+      // observe dep) skip cleanly → noop. The runHook adapter maps Kiro's tool
+      // name (fs_write → Write) before observeEdit's eligibility check.
+      if (typeof observe === 'function') {
+        observe({ payload, projectRoot: cwd, ...(userDir ? { userDir } : {}) });
+        return { action: 'observe', exitCode: 0 };
+      }
+      return { action: 'noop', exitCode: 0 };
+    }
+    if (CAPTURE_EVENTS.has(event)) {
+      capture({ payload, projectRoot: cwd, ...(userDir ? { userDir } : {}) });
+      return { action: 'capture', exitCode: 0 };
+    }
+    if (GUARD_EVENTS.has(event)) {
+      // guard() inspects the about-to-run tool command (from the Kiro payload)
+      // and returns { block, reason? }. A block → exit 2 (BLOCK the tool) with
+      // the reason on stderr; otherwise exit 0 (allow). If guard is not wired
+      // (older install), default to allow — fail-open, never block by accident.
+      const v = guard ? guard({ payload, cwd }) : { block: false };
+      if (v && v.block) {
+        return { action: 'blocked', exitCode: 2, stderr: v.reason ?? 'blocked by the memory delete-guardrail' };
+      }
+      return { action: 'allow', exitCode: 0 };
+    }
+    // unknown / not-yet-handled event — no-op, forward-compatible.
+    return { action: 'noop', exitCode: 0 };
+  } catch (err) {
+    // NEVER propagate — exit 0 with the error on stderr so the Kiro session lives.
+    // (A CRASHED guard fails OPEN here: a broken guardrail must not wedge the tool.)
+    return { action: 'error', exitCode: 0, stderr: `cmk hook ${event}: ${err?.message ?? err}` };
+  }
+}

package/src/kiro-ide-hooks.mjs

@@ -0,0 +1,219 @@
+// kiro-ide-hooks.mjs — write Kiro IDE hook files (Task 50.K + 50.N.3 v1 migration).
+//
+// TWO formats, DUAL-EMITTED for back-compat (D-203):
+//
+//   LEGACY (Kiro 0.x) — individual `.kiro/hooks/<name>.kiro.hook` files:
+//     { "version": "1.0.0", "enabled", "name", "description",
+//       "when": { "type": "agentStop" },
+//       "then": { "type": "runCommand", "command", "timeout" } }
+//   Verified from a real GUI-created 0.x hook (P-WJRUQVSW).
+//
+//   v1 (Kiro IDE 1.0+) — clean per-hook `.kiro/hooks/<name>.json` files that
+//   REPLACE the .kiro.hook format (which 1.0 no longer loads — D-203). Schema
+//   GROUND-TRUTH-VERIFIED against Kiro IDE 1.0's OWN migration output (D-203d —
+//   it migrated our `cmk-capture.kiro.hook` → `cmk-capture.json`):
+//     { "version": "v1", "hooks": [ { "name", "description", "trigger",
+//       "matcher"?, "action": { "type": "command", "command" }, "timeout",
+//       "enabled" } ] }   — PascalCase triggers; `action.type:'command'` is the
+//   deterministic-shell action (no LLM). We write `cmk-capture.json`/
+//   `cmk-inject.json`/`cmk-guard.json`/`cmk-observe.json` — Kiro's exact filename
+//   convention, one hook per file (full isolation).
+//
+// v1 lets the IDE do the FULL Claude-Code hook set (one clean .json file PER
+// hook): inject (UserPromptSubmit) + capture (Stop) + delete-guard (PreToolUse —
+// CAN BLOCK on non-zero exit) + observe-edit (PostToolUse).
+//
+// We emit BOTH so a 0.x user keeps the legacy hooks and a 1.0 user gets v1 (a
+// 1.0 IDE runs the .json + shows the .kiro.hook as inert "legacy"; a 0.x IDE
+// runs the .kiro.hook + ignores the .json — no double-fire, verified D-203d).
+//
+// ⚠️ v1 behaviors LIVE-PROBED at the cut-gate (D-203 — `Stop` + the schema are
+// CONFIRMED by Kiro 1.0's own migration D-203d; the rest flagged, NOT asserted):
+// (1) auto-load of an installer-written json; (2) what a PreToolUse command
+// receives (the path to inspect); (3) exit-code 1-vs-2 to
+// block; (4) the matcher tool-name tokens; (5) the real session-end trigger
+// name (v1's type list has SessionStart but no obvious Stop — we use `Stop`,
+// the dispatcher's capture key, pending the probe).
+//
+// Public surface:
+//   installKiroIdeHooks({ projectRoot, command? }) → { action, changed, hooks }
+//   uninstallKiroIdeHooks({ projectRoot }) → { action, changed, hooks }
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { kiroHookCommand, kiroGuardCommand } from './kiro-hook-command.mjs';
+
+const CMK = 'cmk';
+const MANAGED = 'Managed by `cmk install` — do not hand-edit.';
+
+// The platform-correct `cmk hook <event>` command (cmd.exe /c on Windows where
+// Kiro routes hooks through WSL) is shared from kiro-hook-command.mjs.
+const hookCommand = kiroHookCommand;
+
+// One .kiro.hook spec. We intentionally do NOT put a `then` key on any JS object
+// here — Kiro's schema needs a top-level `then` (its "action" leg), but a JS
+// object with a `then` property is a "thenable" footgun (a static analyzer flags
+// it, and an accidental thenable can hijack a Promise chain). So we model the
+// action under a neutral `action` key and rename it to `then` ONLY at
+// serialization (serializeHook), where it's pure JSON data, never a live object.
+function hookSpecs(cmd) {
+  return [
+    {
+      file: 'cmk-capture.kiro.hook',
+      version: '1.0.0',
+      enabled: true,
+      name: 'claude-memory-kit: capture',
+      description: 'Capture durable memory at the end of each turn (claude-memory-kit). Managed by `cmk install` — do not hand-edit.',
+      when: { type: 'agentStop' },
+      action: { type: 'runCommand', command: hookCommand('stop', cmd), timeout: 60 },
+    },
+    {
+      file: 'cmk-inject.kiro.hook',
+      version: '1.0.0',
+      enabled: true,
+      name: 'claude-memory-kit: recall',
+      description: 'Inject recalled memory on each prompt (claude-memory-kit). Managed by `cmk install` — do not hand-edit.',
+      when: { type: 'promptSubmit' },
+      action: { type: 'runCommand', command: hookCommand('promptSubmit', cmd), timeout: 30 },
+    },
+  ];
+}
+
+// Serialize a spec to the Kiro .kiro.hook JSON, mapping our internal `action`
+// key to Kiro's required `then` field. We build the object with a placeholder
+// key, then rename it in the JSON STRING — so no JS object literal ever carries
+// a `then` property (the thenable footgun the static analyzer guards against).
+const THEN_PLACEHOLDER = '__kiro_then__';
+function serializeHook(spec) {
+  const { file, action, ...rest } = spec;
+  const obj = { ...rest, [THEN_PLACEHOLDER]: action };
+  return `${JSON.stringify(obj, null, 2).replace(`"${THEN_PLACEHOLDER}"`, '"then"')}\n`;
+}
+
+// The v1 hooks — ONE clean `<name>.json` file PER hook (Kiro IDE 1.0's own
+// convention — D-203d). One hook per file → every hook independently isolated (a
+// bad trigger can't dark the others). The full Claude-Code parity set:
+//   cmk-capture.json → Stop             → capture (turn-end)
+//   cmk-inject.json  → UserPromptSubmit → inject (recall)
+//   cmk-guard.json   → PreToolUse       → delete-guard (CAN BLOCK on non-zero exit)
+//   cmk-observe.json → PostToolUse      → observe-edit (record large edits)
+// Schema GROUND-TRUTH-verified against Kiro IDE 1.0's own migration output (D-203d):
+// {version:'v1', hooks:[{name, description, trigger, matcher?, action:{type:
+// 'command', command}, timeout, enabled}]}.
+//
+// SINGLE SOURCE: filename → hook-spec builder. V1_FILES is DERIVED from these keys
+// (no array/switch to keep in sync). `Stop` (capture) is CONFIRMED by Kiro's
+// migration; the other three triggers + the `fs_write` matcher are live-probed
+// (cut-gate KHv1-*).
+function v1HookFile(hook) {
+  return { version: 'v1', hooks: [hook] };
+}
+const V1_HOOK_BUILDERS = Object.freeze({
+  'cmk-capture.json': (cmd) =>
+    v1HookFile({
+      name: 'claude-memory-kit: capture',
+      description: `Capture durable memory at the end of each turn (claude-memory-kit). ${MANAGED}`,
+      trigger: 'Stop', // CONFIRMED by Kiro IDE 1.0's own migration (D-203d)
+      action: { type: 'command', command: hookCommand('stop', cmd) },
+      timeout: 60,
+      enabled: true,
+    }),
+  'cmk-inject.json': (cmd) =>
+    v1HookFile({
+      name: 'claude-memory-kit: recall',
+      description: `Inject recalled memory on each prompt (claude-memory-kit). ${MANAGED}`,
+      trigger: 'UserPromptSubmit',
+      action: { type: 'command', command: hookCommand('userPromptSubmit', cmd) },
+      timeout: 30,
+      enabled: true,
+    }),
+  'cmk-guard.json': () =>
+    v1HookFile({
+      name: 'claude-memory-kit: delete-guard',
+      description: `Block a destructive command aimed at a memory path (claude-memory-kit). ${MANAGED}`,
+      trigger: 'PreToolUse', // v1 PreToolUse can BLOCK (non-zero exit) — supersedes Task 165(b)
+      // `matcher` for PreToolUse is a TOOL-NAME glob (D-203 item 4 — exact tokens
+      // live-unverified). `'*'` is conservative; the guard itself filters to memory
+      // deletes, so an over-broad matcher costs nothing (allows all non-deletes).
+      matcher: '*',
+      action: { type: 'command', command: kiroGuardCommand() },
+      timeout: 5,
+      enabled: true,
+    }),
+  'cmk-observe.json': (cmd) =>
+    v1HookFile({
+      name: 'claude-memory-kit: observe-edit',
+      description: `Record large file edits (claude-memory-kit). ${MANAGED}`,
+      // PostToolUse (NOT PostFileSave) — observe-edit needs a TOOL-USE payload
+      // ({tool_name:'fs_write', …}) that observeEdit reads; a file-SAVE event
+      // carries no tool_name → silent noop (skill-review I1). Sibling of the
+      // kiro-cli postToolUse leg (50.N.2), same payload shape.
+      trigger: 'PostToolUse',
+      matcher: 'fs_write', // tool-name glob (like PreToolUse), scoped to file-writes
+      action: { type: 'command', command: hookCommand('postToolUse', cmd) },
+      timeout: 30,
+      enabled: true,
+    }),
+});
+
+// V1_FILES is DERIVED from the builder keys — single source of truth, no array
+// to keep in sync (an unmapped filename is structurally impossible).
+const V1_FILES = Object.freeze(Object.keys(V1_HOOK_BUILDERS));
+
+function serializeV1(file, cmd) {
+  return `${JSON.stringify(V1_HOOK_BUILDERS[file](cmd), null, 2)}\n`;
+}
+
+export function installKiroIdeHooks({ projectRoot, command = CMK } = {}) {
+  if (!projectRoot) throw new Error('installKiroIdeHooks: projectRoot is required');
+  const hooksDir = join(projectRoot, '.kiro', 'hooks');
+
+  let changed = false;
+  const written = [];
+  // 1. Legacy .kiro.hook files (Kiro 0.x back-compat).
+  for (const spec of hookSpecs(command)) {
+    const path = join(hooksDir, spec.file);
+    const serialized = serializeHook(spec);
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
+    if (existing !== serialized) {
+      mkdirSync(hooksDir, { recursive: true });
+      writeFileSync(path, serialized, 'utf8');
+      changed = true;
+    }
+    written.push(spec.file);
+  }
+  // 2. The v1 files (Kiro IDE 1.0+ — D-203/D-203d). A 0.x IDE ignores them; a 1.0
+  //    IDE ignores the stale .kiro.hook files above (shows them "legacy", inert —
+  //    no double-fire, verified D-203d). ONE clean `<name>.json` PER hook (Kiro's
+  //    own migration convention), so every hook is isolated.
+  for (const file of V1_FILES) {
+    const path = join(hooksDir, file);
+    const serialized = serializeV1(file, command);
+    const existing = existsSync(path) ? readFileSync(path, 'utf8') : null;
+    if (existing !== serialized) {
+      mkdirSync(hooksDir, { recursive: true });
+      writeFileSync(path, serialized, 'utf8');
+      changed = true;
+    }
+    written.push(file);
+  }
+  return { action: 'installed', changed, hooks: written };
+}
+
+export function uninstallKiroIdeHooks({ projectRoot, command = CMK } = {}) {
+  if (!projectRoot) throw new Error('uninstallKiroIdeHooks: projectRoot is required');
+  const hooksDir = join(projectRoot, '.kiro', 'hooks');
+  let changed = false;
+  const removed = [];
+  // legacy .kiro.hook files + all the v1 files — remove all.
+  const ourFiles = [...hookSpecs(command).map((s) => s.file), ...V1_FILES];
+  for (const file of ourFiles) {
+    const path = join(hooksDir, file);
+    if (existsSync(path)) {
+      rmSync(path, { force: true });
+      changed = true;
+      removed.push(file);
+    }
+  }
+  return { action: 'uninstalled', changed, hooks: removed };
+}