@lore-co/cli 0.1.19 → 0.1.22

package/dist/runtime.js

@@ -12,6 +12,7 @@ import { writeInvocationAttemptBounded, writeInvocationCompletionBounded, } from
 import { SignedSnapshotError, verifySignedSnapshot, } from "./signed-snapshot.js";
 import { CONTEXT_CACHE_MAX_STALE_MS, isContextTransportFailure, selectCachedContext, } from "./context-fallback.js";
 import { RUNTIME_VERSION } from "./runtime-version.js";
+import { guardRuleConflict, guardToolTrigger, supportedGuardRule, guardEmergencyCommand, emergencyOverrideApplies } from "@lore-co/core/guard-evaluation";
 const IS_STANDALONE_RUNTIME = typeof __LORE_STANDALONE__ === "boolean" && __LORE_STANDALONE__;
 export const COMMAND_HOOK_AGENT_NAMES = [
     "codex",
@@ -143,6 +144,14 @@ function normalizeHookInput(input, agent, environment) {
         };
     }
     if (agent === "copilot-cli") {
+        // CLI command hooks encode toolArgs as JSON; SDK-style inputs are objects.
+        let toolArgs = input.toolArgs;
+        if (typeof toolArgs === "string") {
+            try {
+                toolArgs = JSON.parse(toolArgs);
+            }
+            catch { /* Invalid input stays invalid. */ }
+        }
         const eventName = rawEventName === "userPromptTransformed"
             ? "UserPromptSubmit"
             : rawEventName === "preToolUse"
@@ -164,7 +173,7 @@ function normalizeHookInput(input, agent, environment) {
                 ...(eventName === "PreToolUse"
                     ? {
                         tool_name: input.toolName,
-                        tool_input: input.toolArgs,
+                        tool_input: toolArgs,
                     }
                     : {}),
                 ...(eventName === "Stop"
@@ -180,9 +189,11 @@ function normalizeHookInput(input, agent, environment) {
             ? "UserPromptSubmit"
             : rawEventName === "post_model_turn"
                 ? "AssistantResponse"
-                : rawEventName === "session_start"
-                    ? "SessionStart"
-                    : rawEventName;
+                : rawEventName === "pre_tool_use"
+                    ? "PreToolUse"
+                    : rawEventName === "session_start"
+                        ? "SessionStart"
+                        : rawEventName;
         const sessionId = stringField(input.session_id) ??
             stringField(environment.POLYTOKEN_SESSION_ID);
         const cwd = stringField(input.cwd) ??
@@ -205,6 +216,7 @@ function normalizeHookInput(input, agent, environment) {
                 ...input,
                 ...(sessionId === undefined ? {} : { session_id: sessionId }),
                 ...(cwd === undefined ? {} : { cwd }),
+                ...(eventName === "PreToolUse" ? { tool_input: input.input ?? input.tool_input } : {}),
                 ...(prompt === undefined ? {} : { prompt }),
                 ...(assistantMessage === undefined
                     ? {}
@@ -223,15 +235,17 @@ function normalizeHookInput(input, agent, environment) {
         : [];
     const cwd = stringField(input.cwd) ??
         (workspaceRoots.length === 1 ? workspaceRoots[0] : undefined);
-    const eventName = rawEventName === "beforeSubmitPrompt"
-        ? "UserPromptSubmit"
-        : rawEventName === "afterAgentResponse"
-            ? "AssistantResponse"
-            : rawEventName === "sessionEnd"
-                ? "SessionEnd"
-                : rawEventName === "beforeShellExecution"
-                    ? "PreToolUse"
-                    : rawEventName;
+    const eventName = rawEventName === "sessionStart"
+        ? "SessionStart"
+        : rawEventName === "beforeSubmitPrompt"
+            ? "UserPromptSubmit"
+            : rawEventName === "afterAgentResponse"
+                ? "AssistantResponse"
+                : rawEventName === "sessionEnd"
+                    ? "SessionEnd"
+                    : rawEventName === "beforeShellExecution"
+                        ? "PreToolUse"
+                        : rawEventName;
     return {
         input: {
             ...input,
@@ -265,9 +279,10 @@ class InvalidHookInputError extends Error {
 }
 function validHookInput(input, agent, eventName) {
     const recognized = agent === "polytoken"
-        ? eventName === "UserPromptSubmit" || eventName === "AssistantResponse"
+        ? eventName === "UserPromptSubmit" || eventName === "AssistantResponse" || eventName === "PreToolUse"
         : agent === "cursor"
-            ? eventName === "UserPromptSubmit" ||
+            ? eventName === "SessionStart" ||
+                eventName === "UserPromptSubmit" ||
                 eventName === "AssistantResponse" ||
                 eventName === "PreToolUse" ||
                 eventName === "SessionEnd"
@@ -282,6 +297,10 @@ function validHookInput(input, agent, eventName) {
         return stringField(input.prompt) !== undefined;
     }
     if (eventName === "Stop" || eventName === "AssistantResponse") {
+        // Copilot agentStop may carry only transcript metadata. Never parse that
+        // transcript or invent assistant text; standalone prompt capture still works.
+        if (agent === "copilot-cli" && eventName === "Stop")
+            return true;
         return stringField(input.last_assistant_message) !== undefined;
     }
     if (eventName === "PreToolUse") {
@@ -289,11 +308,8 @@ function validHookInput(input, agent, eventName) {
         if (toolName === undefined || !isObject(input.tool_input)) {
             return false;
         }
-        if (GUARD_EDIT_TOOLS.has(toolName)) {
-            return true;
-        }
-        if (GUARD_SHELL_TOOLS.has(toolName)) {
-            return stringField(input.tool_input.command) !== undefined;
+        if (GUARD_SHELL_TOOLS.has(toolName.split(".").at(-1))) {
+            return stringField(input.tool_input.command ?? input.tool_input.cmd) !== undefined;
         }
         return true;
     }
@@ -627,7 +643,7 @@ function createPromptObservationRequest(input, agent, sessionId, now, gitContext
         connector: "lore-cli",
         agent,
         sessionId,
-        eventId: deterministicUuid(`lore-prompt\0${agent}\0${sessionId}\0${promptId ?? "first"}`),
+        eventId: deterministicUuid(`lore-prompt\0${agent}\0${sessionId}\0${promptId ?? idempotencyKey}`),
         prompt: redactSecrets(prompt),
         ...(promptId === undefined ? {} : { promptId }),
         timestamp: now.toISOString(),
@@ -947,12 +963,12 @@ function runtimeAccept(config) {
 }
 async function runtimeStore(config, home) {
     const store = new ReliabilityStore(reliabilityWorkspaceKey(config), {
-        ...(home === undefined ? {} : { home }),
+        home: homeDirectory(home),
     });
     await store.initialize();
     await store.migrateLegacyQueue(queueDirectory(home));
     if (config.workspaceId !== undefined) {
-        const credentialStore = new ReliabilityStore(credentialReliabilityWorkspaceKey(config), { ...(home === undefined ? {} : { home }) });
+        const credentialStore = new ReliabilityStore(credentialReliabilityWorkspaceKey(config), { home: homeDirectory(home) });
         await credentialStore.transferPendingTo(store).catch(() => undefined);
     }
     return store;
@@ -1465,12 +1481,25 @@ function queuedRequest(value) {
 async function flushOne(config, fetchImplementation, store) {
     const claimed = await store.claimNext({
         workerId: `native-hook:${process.pid}`,
-        kinds: ["turn", "prompt"],
+        kinds: ["turn", "prompt", "guard_override"],
     });
     if (claimed === null || claimed.claim === undefined) {
         return null;
     }
     try {
+        if (claimed.kind === "guard_override") {
+            const response = await fetchImplementation(`${config.apiUrl.replace(/\/+$/u, "")}/v1/guard/overrides`, {
+                method: "POST", headers: { authorization: `Bearer ${config.token}`, "content-type": "application/json" },
+                body: JSON.stringify(claimed.payload), signal: AbortSignal.timeout(config.timeoutMs ?? 2_500),
+            });
+            if (!response.ok)
+                throw new RuntimeHttpError("Override audit upload failed", response.status);
+            const acknowledgement = await protocolResponseJson(response);
+            if (!isObject(acknowledgement) || acknowledgement.overrideId !== claimed.idempotencyKey)
+                throw new IncompatibleReliabilityError("Override acknowledgement is invalid");
+            await store.acknowledgeClaim(claimed.claim.id);
+            return { idempotencyKey: claimed.idempotencyKey, state: "acknowledged" };
+        }
         const queued = queuedRequest(claimed.payload);
         if (queued === null) {
             const failed = await store.failClaim({
@@ -1555,8 +1584,8 @@ function receiptMessage(config, agent, delivery) {
 }
 // ---------------------------------------------------------------------------
 // Context Guard: proactive checks at tool boundaries (PreToolUse and Cursor
-// beforeShellExecution). Fail-open by design — a slow or unreachable hub must
-// never stall an agent's tool call.
+// beforeShellExecution). Assist degrades on outages; known Enforce uses a
+// verified saved policy or denies actions whose policy cannot be verified.
 // ---------------------------------------------------------------------------
 /** How long a locally cached "guard is off" verdict suppresses network calls. */
 const GUARD_MODE_TTL_MS = 5 * 60_000;
@@ -1564,51 +1593,14 @@ const GUARD_MODE_TTL_MS = 5 * 60_000;
 const GUARD_KEY_COOLDOWN_MS = 15 * 60_000;
 const GUARD_MAX_CACHED_KEYS = 200;
 const GUARD_TIMEOUT_MS = 4_000;
-const GUARD_EDIT_TOOLS = new Set([
-    "Edit",
-    "Write",
-    "MultiEdit",
-    "NotebookEdit",
-    "ApplyPatch",
-    "apply_patch",
-    "edit",
-    "write",
-    "patch",
-    "str_replace_editor",
-]);
-const GUARD_SHELL_TOOLS = new Set(["Bash", "bash", "Shell", "shell"]);
-const GUARD_COMMIT_COMMAND = /\bgit\s+(?:commit|push)\b/iu;
-const GUARD_DEPLOY_COMMAND = /\b(?:terraform\s+(?:apply|destroy)|pulumi\s+up|kubectl\s+(?:apply|delete|rollout)|helm\s+(?:install|upgrade|uninstall)|docker\s+push|fly(?:ctl)?\s+deploy|vercel(?:\s+deploy|\s+--prod)|railway\s+up|serverless\s+deploy|sls\s+deploy|cdk\s+deploy|eb\s+deploy|gcloud\s+(?:app|run|functions)\s+deploy|az\s+webapp\s+(?:up|deploy)|(?:npm|pnpm|yarn)\s+publish|prisma\s+migrate\s+deploy|drizzle-kit\s+(?:push|migrate))\b/iu;
-const GUARD_DESTRUCTIVE_COMMAND = /\b(?:rm\s+(?:-[a-z]*\s+)*-[a-z]*r[a-z]*f|drop\s+(?:table|database)|truncate\s+table)\b/iu;
+const GUARD_SHELL_TOOLS = new Set(["Bash", "bash", "Shell", "shell", "exec_command", "shell_command", "run_terminal_cmd", "shell_exec", "shell_monitor"]);
 /**
  * Decides whether a tool call is a meaningful action boundary. File edits
  * always qualify; shell commands qualify only when they look high-impact
  * (commit, push, deploy, publish, destructive) to keep the guard quiet.
  */
 export function guardTrigger(toolName, toolInput) {
-    if (GUARD_EDIT_TOOLS.has(toolName)) {
-        const files = [toolInput.file_path, toolInput.notebook_path, toolInput.path]
-            .map((value) => stringField(value))
-            .filter((value) => value !== undefined);
-        return { action: "edit", ...(files.length === 0 ? {} : { files }) };
-    }
-    if (GUARD_SHELL_TOOLS.has(toolName)) {
-        const command = stringField(toolInput.command);
-        if (command === undefined) {
-            return null;
-        }
-        if (GUARD_COMMIT_COMMAND.test(command)) {
-            return { action: "commit", command };
-        }
-        if (GUARD_DEPLOY_COMMAND.test(command)) {
-            return { action: "deploy", command };
-        }
-        if (GUARD_DESTRUCTIVE_COMMAND.test(command)) {
-            return { action: "command", command };
-        }
-        return null;
-    }
-    return null;
+    return guardToolTrigger(toolName, toolInput);
 }
 function guardStatePath(agent, sessionId, home) {
     return resolve(loreDirectory(home), "state", "guard", `${sha256(`${agent}\0${sessionId}`)}.json`);
@@ -1689,6 +1681,7 @@ function guardResultFromResponse(value) {
     return {
         ...(typeof value.checkId === "string" ? { checkId: value.checkId } : {}),
         mode: value.mode,
+        ...(value.policyIssue === "unsupported_required_rules" ? { policyUnavailable: true } : {}),
         requiresConfirmation: value.requiresConfirmation === true,
         ...(typeof confirm.command === "string"
             ? { confirmCommand: confirm.command }
@@ -1741,7 +1734,7 @@ function guardAssistContext(result) {
         lines.push(`  ${item.explanation ?? `Source: ${guardItemSource(item)}.`}`);
     }
     if (result.conflictSummaries.length > 0) {
-        lines.push("", "Conflicting Lore context (do not silently pick a winner):");
+        lines.push("", "Lore policy notes:");
         for (const summary of result.conflictSummaries) {
             lines.push(`- ${summary}`);
         }
@@ -1749,18 +1742,23 @@ function guardAssistContext(result) {
     return boundedContext(lines.join("\n"));
 }
 function guardConfirmationReason(result) {
+    if (result.policyUnavailable)
+        return "Lore Guard cannot evaluate an existing required rule. An owner or admin must rewrite it using a supported prohibition or change it to advisory before retrying.";
     const required = result.items.filter((item) => item.enforcement === "required");
     const shown = required.length > 0 ? required : result.items;
     const lines = [
-        "Lore Guard: this action conflicts with a required rule.",
+        result.items.length === 0 ? "Lore Guard cannot verify the enforcement policy." : "Lore Guard: this action conflicts with a required rule.",
+        ...result.conflictSummaries,
         ...shown.flatMap((item) => [
             `- ${item.content}`,
             `  ${item.explanation ?? `Source: ${guardItemSource(item)}.`}`,
         ]),
     ];
-    lines.push(result.confirmCommand === undefined
-        ? "Ask the user to confirm before proceeding."
-        : `Approve here to proceed, or the user can run: ${result.confirmCommand}`);
+    lines.push(result.offline && result.confirmCommand !== undefined
+        ? `Restore Lore or run: ${result.confirmCommand}`
+        : result.confirmCommand === undefined
+            ? "Ask the user to confirm before proceeding."
+            : `Approve here to proceed, or the user can run: ${result.confirmCommand}`);
     return boundedContext(lines.join("\n"));
 }
 async function postGuardCheck(config, request, fetchImplementation, store) {
@@ -1795,13 +1793,65 @@ async function postGuardCheck(config, request, fetchImplementation, store) {
         throw new IncompatibleReliabilityError("Lore Guard snapshot does not bind the returned policy");
     }
     await store.writePolicySnapshot("current", value.policySnapshot);
+    await store.writeState("guard-policy-state", { mode: payload.mode, overrides: payload.overrides, policyVersion: payload.policyVersion });
     return guardResultFromResponse(value.check);
 }
-async function handleGuardEvent(input, agent, config, sessionId, options, now) {
-    if (agent === "polytoken") {
-        // Polytoken has no tool boundary; its guard runs at prompt injection.
-        return undefined;
+async function offlineGuard(config, store, request, now, previouslyEnforced, allowCachedPolicy) {
+    const remembered = await store.readState("guard-policy-state");
+    const emergency = await store.readState("guard-emergency-override");
+    if (emergencyOverrideApplies(emergency, String(request.sessionId), typeof request.repo === "string" ? request.repo : undefined, now)) {
+        return { offline: true, mode: "enforce", requiresConfirmation: false, items: [], conflictSummaries: ["An audited, time-limited emergency override is active for this session and repository."] };
+    }
+    const overrides = isObject(remembered) && Array.isArray(remembered.overrides) ? remembered.overrides : [];
+    const override = overrides.find((item) => isObject(item) && item.repo === request.repo);
+    const knownEnforce = previouslyEnforced || (isObject(override) ? override.mode : isObject(remembered) ? remembered.mode : undefined) === "enforce";
+    try {
+        if (!allowCachedPolicy)
+            throw new Error("A live policy could not be authenticated");
+        const compactJws = await store.readPolicySnapshot("current");
+        const keys = await cachedSnapshotKeys(config, store, now);
+        if (compactJws === null || keys === null)
+            throw new Error("Policy unavailable");
+        const payload = verifySignedSnapshot(compactJws, {
+            workspaceId: store.workspaceId, keys, kind: "guard_policy", now,
+        }).payload;
+        const cachedOverride = Array.isArray(payload.overrides) ? payload.overrides.find((item) => isObject(item) && item.repo === request.repo) : undefined;
+        const mode = isObject(cachedOverride) ? cachedOverride.mode : payload.mode;
+        if (isObject(remembered) && remembered.policyVersion !== payload.policyVersion)
+            throw new Error("Policy has changed");
+        if (knownEnforce && mode !== "enforce")
+            throw new Error("Cached policy cannot loosen known enforcement");
+        if (mode !== "enforce")
+            return null;
+        if (!Array.isArray(payload.requiredRules) || payload.requiredRules.some((rule) => !isObject(rule) || !isObject(rule.scope) || typeof rule.content !== "string" || !supportedGuardRule(rule))) {
+            throw new Error("Policy contains unsupported required rules");
+        }
+        const rules = Array.isArray(payload.requiredRules) ? payload.requiredRules.filter((rule) => isObject(rule) && isObject(rule.scope) && typeof rule.content === "string" &&
+            guardRuleConflict(rule, {
+                action: String(request.action),
+                ...(typeof request.repo === "string" ? { repo: request.repo } : {}),
+                ...(typeof request.path === "string" ? { path: request.path } : {}),
+                ...(typeof request.command === "string" ? { command: request.command } : {}),
+                ...(Array.isArray(request.files) ? { files: request.files.filter((file) => typeof file === "string") } : {}),
+            }) !== null) : [];
+        return {
+            offline: true, mode: "enforce", requiresConfirmation: rules.length > 0,
+            items: rules.map((rule) => ({ content: String(rule.content), enforcement: "required" })),
+            conflictSummaries: ["Lore is offline; this action was checked against its verified, unexpired saved policy."],
+            confirmCommand: guardEmergencyCommand(String(request.sessionId), String(request.repo ?? "")),
+        };
+    }
+    catch {
+        if (!knownEnforce)
+            return null;
+        return {
+            offline: true, mode: "enforce", requiresConfirmation: true, items: [],
+            conflictSummaries: ["Lore cannot verify the current enforcement policy. Restore the connection or use an audited emergency override."],
+            confirmCommand: guardEmergencyCommand(String(request.sessionId), String(request.repo ?? "")),
+        };
     }
+}
+async function handleGuardEvent(input, agent, config, sessionId, options, now) {
     const toolName = stringField(input.tool_name);
     if (toolName === undefined) {
         return undefined;
@@ -1812,7 +1862,11 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
     }
     const store = await runtimeStore(config, options.home);
     const state = await readGuardState(agent, sessionId, options.home);
-    if (state.mode === "off" &&
+    const rememberedPolicy = await store.readState("guard-policy-state");
+    const enforcementMayHaveChanged = isObject(rememberedPolicy) && (rememberedPolicy.mode === "enforce" ||
+        (Array.isArray(rememberedPolicy.overrides) && rememberedPolicy.overrides.some((entry) => isObject(entry) && entry.mode === "enforce")));
+    if (!enforcementMayHaveChanged &&
+        state.mode === "off" &&
         state.modeCheckedAt !== undefined &&
         now.getTime() - Date.parse(state.modeCheckedAt) < GUARD_MODE_TTL_MS) {
         await recordLocalGuardMetric(store, { outcome: "reused_decision" }, now).catch(() => undefined);
@@ -1832,8 +1886,7 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
             ? normalizedRepositoryPath(file)
             : normalizedRepositoryPath(relativePath);
     })
-        .filter((file) => file !== "")
-        .slice(0, 100);
+        .filter((file) => file !== "");
     const key = sha256([
         "guard",
         trigger.action,
@@ -1842,53 +1895,66 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
     ].join("\0"));
     const cachedAt = state.keys[key];
     if (cachedAt !== undefined &&
+        !enforcementMayHaveChanged &&
+        state.mode !== "enforce" &&
         now.getTime() - Date.parse(cachedAt) < GUARD_KEY_COOLDOWN_MS) {
         await recordLocalGuardMetric(store, { outcome: "reused_decision" }, now).catch(() => undefined);
         return undefined;
     }
     const startedAt = Date.now();
     let result;
+    const guardRequest = {
+        connector: "lore-cli",
+        agent,
+        sessionId,
+        action: trigger.action,
+        tool: toolName,
+        ...(scope?.repo === undefined ? {} : { repo: scope.repo }),
+        ...(scope?.path === undefined ? {} : { path: scope.path }),
+        ...(files.length === 0 ? {} : { files }),
+        ...(trigger.command === undefined
+            ? {}
+            : { command: redactSecrets(trigger.command) }),
+    };
     try {
-        result = await postGuardCheck(config, {
-            connector: "lore-cli",
-            agent,
-            sessionId,
-            action: trigger.action,
-            tool: toolName,
-            ...(scope?.repo === undefined ? {} : { repo: scope.repo }),
-            ...(scope?.path === undefined ? {} : { path: scope.path }),
-            ...(files.length === 0 ? {} : { files }),
-            ...(trigger.command === undefined
-                ? {}
-                : { command: redactSecrets(trigger.command).slice(0, 10_000) }),
-        }, options.fetch ?? globalThis.fetch, store);
+        result = await postGuardCheck(config, guardRequest, options.fetch ?? globalThis.fetch, store);
     }
     catch (error) {
         await recordLocalGuardMetric(store, { outcome: "failed" }, now).catch(() => undefined);
-        throw error;
+        result = await offlineGuard(config, store, guardRequest, now, state.mode === "enforce", isContextTransportFailure(error));
+        if (result === null)
+            throw error;
     }
     if (result === null) {
         await recordLocalGuardMetric(store, { outcome: "failed" }, now).catch(() => undefined);
         throw new IncompatibleReliabilityError("Lore Guard response is invalid");
     }
-    await recordLocalGuardMetric(store, {
-        outcome: "live_check",
-        durationMs: Math.max(0, Date.now() - startedAt),
-    }, now).catch(() => undefined);
+    if (!result.offline)
+        await recordLocalGuardMetric(store, {
+            outcome: "live_check",
+            durationMs: Math.max(0, Date.now() - startedAt),
+        }, now).catch(() => undefined);
     state.mode = result.mode;
     state.modeCheckedAt = now.toISOString();
-    if (!result.requiresConfirmation) {
+    // A policy-blocked action (unsupported required rule) must not be cached as
+    // an allow: the row has to be re-checked until an owner repairs the policy.
+    if (!result.requiresConfirmation && !result.policyUnavailable) {
         state.keys[key] = now.toISOString();
     }
-    await writeGuardState(agent, sessionId, state, options.home);
+    await writeGuardState(agent, sessionId, state, options.home).catch(() => undefined);
     if (result.mode === "off") {
         return undefined;
     }
-    if (result.requiresConfirmation) {
+    // `policyUnavailable` (an unsupported required rule) blocks the action
+    // independently of `requiresConfirmation`: the producer reports it via
+    // `policyIssue` rather than `confirm`, so it never sets `requiresConfirmation`.
+    if (result.requiresConfirmation || result.policyUnavailable) {
         const reason = guardConfirmationReason(result);
+        if (agent === "polytoken")
+            return { outcome: "deny", reason };
         if (agent === "copilot-cli") {
             return {
-                permissionDecision: "ask",
+                permissionDecision: result.offline || result.policyUnavailable ? "deny" : "ask",
                 permissionDecisionReason: reason,
             };
         }
@@ -1904,7 +1970,8 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
         return {
             hookSpecificOutput: {
                 hookEventName: "PreToolUse",
-                permissionDecision: "ask",
+                // Codex parses `ask` as unsupported and then continues the tool call.
+                permissionDecision: agent === "codex" || result.offline || result.policyUnavailable ? "deny" : "ask",
                 permissionDecisionReason: reason,
             },
         };
@@ -1917,6 +1984,8 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
         // context was already added by userPromptTransformed.
         return undefined;
     }
+    if (agent === "polytoken")
+        return { outcome: "allow" };
     if (agent === "cursor") {
         // Cursor cannot inject agent context at the shell boundary on allow.
         return undefined;
@@ -1946,6 +2015,20 @@ export async function handleHookEvent(value, agent, options = {}) {
         return undefined;
     }
     const now = (options.now ?? (() => new Date()))();
+    if (agent === "cursor" && eventName === "SessionStart") {
+        const cwd = stringField(input.cwd);
+        if (!cwd)
+            return { additional_context: "Lore needs a single repository workspace to provide shared context." };
+        const store = await runtimeStore(config, options.home);
+        await store.writeState(cursorSessionKey(sessionId), { sessionId, cwd, updatedAt: now.toISOString() });
+        return { additional_context: [
+                "Lore shared context is connected through the lore-native MCP server.",
+                `For this conversation use sessionId ${JSON.stringify(sessionId)}.`,
+                "Before answering each user request or using other tools, call lore_context with that sessionId and the full user message as prompt. This retrieves relevant shared knowledge and records durable teachings through Lore's normal capture pipeline.",
+                "Use the returned context when relevant. If retrieval fails, report that limitation; do not invent shared knowledge.",
+                "After completing each response, call lore_complete with the same sessionId and a concise response summary so the next user correction retains the prior attempt. These Lore calls are available through MCP and require no shell commands.",
+            ].join("\n") };
+    }
     if (eventName === "Stop" || eventName === "AssistantResponse") {
         await savePending(input, agent, sessionId, now, options.home);
         return undefined;
@@ -1961,6 +2044,20 @@ export async function handleHookEvent(value, agent, options = {}) {
             return await handleGuardEvent(input, agent, config, sessionId, options, now);
         }
         catch {
+            const prior = await readGuardState(agent, sessionId, options.home).catch(() => null);
+            const saved = await runtimeStore(config, options.home).then((store) => store.readState("guard-policy-state")).catch(() => null);
+            const scope = await repositoryScope(stringField(input.cwd)).catch(() => undefined);
+            const override = isObject(saved) && Array.isArray(saved.overrides) ? saved.overrides.find((entry) => isObject(entry) && entry.repo === scope?.repo) : undefined;
+            if (prior?.mode === "enforce" || (isObject(override) ? override.mode : isObject(saved) ? saved.mode : undefined) === "enforce") {
+                const reason = "Lore Guard cannot verify its enforcement policy. Restore Lore before retrying.";
+                if (agent === "cursor")
+                    return { permission: "deny", userMessage: reason, agentMessage: reason };
+                if (agent === "copilot-cli")
+                    return { permissionDecision: "deny", permissionDecisionReason: reason };
+                if (agent === "polytoken")
+                    return { outcome: "deny", reason };
+                return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } };
+            }
             const warning = "Lore Guard is unavailable; this action is proceeding without a live policy decision.";
             if (agent === "cursor") {
                 return {
@@ -1968,7 +2065,7 @@ export async function handleHookEvent(value, agent, options = {}) {
                     agentMessage: warning,
                 };
             }
-            if (agent === "copilot-cli") {
+            if (agent === "copilot-cli" || agent === "polytoken") {
                 return undefined;
             }
             return {
@@ -1979,6 +2076,57 @@ export async function handleHookEvent(value, agent, options = {}) {
             };
         }
     }
+    if (agent === "cursor") {
+        const store = await runtimeStore(config, options.home);
+        const existing = await store.readState(cursorSessionKey(sessionId));
+        const cwd = stringField(input.cwd);
+        if (cwd)
+            await store.writeState(cursorSessionKey(sessionId), {
+                ...(isObject(existing) ? existing : {}), sessionId, cwd,
+                ...(stringField(input.prompt) ? { prompt: redactSecrets(String(input.prompt)) } : {}),
+                ...(stringField(input.prompt_id) ? { promptId: input.prompt_id } : {}), updatedAt: now.toISOString(),
+            });
+        // Cursor's prompt hook supports submission control only. The MCP call
+        // delivers the context; capture here retains native editor event identity.
+        // Retrieve is skipped so the notice cooldown is not primed by a discarded
+        // result: the MCP `lore_context` call surfaces the reliability notice.
+        await handlePromptEvent(input, agent, sessionId, config, options, now, true, false);
+        return { continue: true };
+    }
+    return handlePromptEvent(input, agent, sessionId, config, options, now);
+}
+function cursorSessionKey(sessionId) {
+    return `cursor-session-${sha256(sessionId)}`;
+}
+/** MCP requests are bound to a session/workspace observed by the native hook. */
+async function cursorSession(sessionId, options) {
+    const config = await readRuntimeConfig(options.home);
+    if (!config?.agents.includes("cursor"))
+        throw new Error("Reconnect Cursor to Lore before requesting context.");
+    const store = await runtimeStore(config, options.home);
+    const state = await store.readState(cursorSessionKey(sessionId));
+    if (!isObject(state) || state.sessionId !== sessionId || !stringField(state.cwd)) {
+        throw new Error("Start a new Cursor conversation to register this Lore session.");
+    }
+    return { config, store, state, cwd: stringField(state.cwd) };
+}
+export async function getCursorContext(sessionId, prompt, options = {}) {
+    const { config, state, cwd } = await cursorSession(sessionId, options);
+    const now = (options.now ?? (() => new Date()))();
+    const result = await handlePromptEvent({ session_id: sessionId, cwd,
+        prompt: stringField(state.prompt) ?? prompt,
+        ...(stringField(state.promptId) ? { prompt_id: state.promptId } : {}),
+    }, "cursor", sessionId, config, options, now, stringField(state.prompt) === undefined);
+    return result?.additional_context || "No relevant shared knowledge was found for this request.";
+}
+export async function completeCursorResponse(sessionId, response, options = {}) {
+    const { store, state, cwd } = await cursorSession(sessionId, options);
+    const now = (options.now ?? (() => new Date()))();
+    await savePending({ cwd, last_assistant_message: response }, "cursor", sessionId, now, options.home);
+    const { prompt: _prompt, promptId: _promptId, ...rest } = state;
+    await store.writeState(cursorSessionKey(sessionId), { ...rest, updatedAt: now.toISOString() });
+}
+async function handlePromptEvent(input, agent, sessionId, config, options, now, capture = true, retrieve = true) {
     const fetchImplementation = options.fetch ?? globalThis.fetch;
     const prompt = stringField(input.prompt);
     if (prompt === undefined) {
@@ -1999,13 +2147,7 @@ export async function handleHookEvent(value, agent, options = {}) {
         return agent === "polytoken"
             ? { outcome: "accept", additional_context: notice }
             : agent === "cursor"
-                ? {
-                    continue: true,
-                    hookSpecificOutput: {
-                        hookEventName: "UserPromptSubmit",
-                        additionalContext: notice,
-                    },
-                }
+                ? { additional_context: notice }
                 : agent === "copilot-cli"
                     ? {
                         modifiedTransformedPrompt: `${notice}\n\n${stringField(input.transformed_prompt) ?? prompt}`,
@@ -2026,7 +2168,7 @@ export async function handleHookEvent(value, agent, options = {}) {
     catch {
         notices.push("Lore retained queued captures locally, but replay could not run. Run lore doctor.");
     }
-    const pending = await readPending(agent, sessionId, options.home);
+    const pending = capture ? await readPending(agent, sessionId, options.home) : null;
     const lineage = await readLineageMetadata(options.home, options.environment ?? process.env);
     let delivery = emptyDelivery();
     if (pending !== null) {
@@ -2063,7 +2205,7 @@ export async function handleHookEvent(value, agent, options = {}) {
                 notices.push("Lore saved this capture locally; server upload is pending.");
             }
         }
-        if (delivery.context === "") {
+        if (retrieve && delivery.context === "") {
             try {
                 delivery = await getPromptContextWithFallback(config, agent, sessionId, request.eventId, prompt, {
                     ...(request.scope === undefined ? {} : { scope: request.scope }),
@@ -2100,8 +2242,10 @@ export async function handleHookEvent(value, agent, options = {}) {
         }
         let enqueued = false;
         try {
-            await enqueueCapture(store, { kind: "prompt", request: observation });
-            enqueued = true;
+            if (capture) {
+                await enqueueCapture(store, { kind: "prompt", request: observation });
+                enqueued = true;
+            }
         }
         catch (error) {
             notices.push(error instanceof ReliabilityStoreError &&
@@ -2122,45 +2266,49 @@ export async function handleHookEvent(value, agent, options = {}) {
                 notices.push("Lore saved this capture locally; server upload is pending.");
             }
         }
-        try {
-            delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, prompt, gitContext, fetchImplementation, store, now);
-        }
-        catch {
-            delivery = {
-                ...emptyDelivery(),
-                reliability: {
-                    status: "failed",
-                    source: "none",
-                    fallback: "none",
-                    reasons: ["invalid_response"],
-                    freshness: {
-                        state: "unknown",
-                        asOf: null,
-                        ageMs: null,
-                        validUntil: null,
+        if (retrieve) {
+            try {
+                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, prompt, gitContext, fetchImplementation, store, now);
+            }
+            catch {
+                delivery = {
+                    ...emptyDelivery(),
+                    reliability: {
+                        status: "failed",
+                        source: "none",
+                        fallback: "none",
+                        reasons: ["invalid_response"],
+                        freshness: {
+                            state: "unknown",
+                            asOf: null,
+                            ageMs: null,
+                            validUntil: null,
+                        },
+                        policyVersion: null,
                     },
-                    policyVersion: null,
-                },
-            };
+                };
+            }
         }
     }
-    const reliability = delivery.reliability;
-    await recordLocalRetrievalMetric(store, {
-        outcome: reliability?.fallback === "cached_context"
-            ? "cached_fallback"
-            : reliability?.fallback === "live_lexical"
-                ? "live_lexical_fallback"
-                : reliability?.status === "failed" ||
-                    reliability?.source === "none"
-                    ? "failed"
-                    : "live_primary",
-        ...(reliability?.freshness.ageMs === undefined
-            ? {}
-            : { cacheAgeMs: reliability.freshness.ageMs }),
-    }, now).catch(() => undefined);
-    const contextReliabilityNotice = await retrievalNotice(delivery, sessionId, store, now);
-    if (contextReliabilityNotice !== undefined) {
-        notices.push(contextReliabilityNotice);
+    if (retrieve) {
+        const reliability = delivery.reliability;
+        await recordLocalRetrievalMetric(store, {
+            outcome: reliability?.fallback === "cached_context"
+                ? "cached_fallback"
+                : reliability?.fallback === "live_lexical"
+                    ? "live_lexical_fallback"
+                    : reliability?.status === "failed" ||
+                        reliability?.source === "none"
+                        ? "failed"
+                        : "live_primary",
+            ...(reliability?.freshness.ageMs === undefined
+                ? {}
+                : { cacheAgeMs: reliability.freshness.ageMs }),
+        }, now).catch(() => undefined);
+        const contextReliabilityNotice = await retrievalNotice(delivery, sessionId, store, now);
+        if (contextReliabilityNotice !== undefined) {
+            notices.push(contextReliabilityNotice);
+        }
     }
     const uniqueNotices = [...new Set(notices)];
     const reliabilityNotice = uniqueNotices.length === 0 ? undefined : uniqueNotices.join(" ");
@@ -2182,6 +2330,8 @@ export async function handleHookEvent(value, agent, options = {}) {
             additional_context: injectedContext,
         };
     }
+    if (agent === "cursor")
+        return { additional_context: injectedContext };
     if (agent === "copilot-cli") {
         const copilotContext = [delivery.context, receipt, reliabilityNotice]
             .filter((entry) => entry !== undefined && entry !== "")
@@ -2194,7 +2344,6 @@ export async function handleHookEvent(value, agent, options = {}) {
         };
     }
     return {
-        ...(agent === "cursor" ? { continue: true } : {}),
         ...(systemMessage === undefined ? {} : { systemMessage }),
         ...(injectedContext === ""
             ? {}