@r1z4x/tezgah 1.0.0

package/hosts/cursor/hook.py

@@ -0,0 +1,461 @@
+#!/usr/bin/env python3
+"""Cursor lifecycle hook. Cursor uses its own event names and output schemas,
+so this adapter translates them onto the shared tezgah core:
+
+  sessionStart        -> {"additional_context": <shared context>}
+  preToolUse          -> {"permission": "allow"|"deny", "agent_message": ...}
+                         (the shared gate: grep-only explorer, first identifier
+                         grep nudge, attribution and test-skip on the write tools)
+  beforeMCPExecution  -> {"permission": "allow"} for the code graph, a deny
+                         from the gate's content rules on an MCP effect, else {}
+  subagentStart       -> {"additional_context": <short contract brief>} for the
+                         delegate, or deny for a grep-only explorer
+  subagentStop        -> record orch and a record-only `subagent_end` verdict
+                         on its `summary`, no followup
+  postToolUse         -> {"additional_context": <provenance | reinforce>}: the
+                         untrusted-content label on a result that came from
+                         outside the user, the taint notice on an effect made in
+                         a turn that read one, and the once-per-session code-graph
+                         reinforcement on a graph/consult call
+  postToolUseFailure  -> record usage; one-line recovery hint
+  after*Execution/Edit-> record usage, no output (observers)
+  afterAgentResponse  -> remember the reply for the stop decision, no output
+  stop                -> block a done/tested claim no check backs
+                         ({"decision": "block", "reason": ...}, which Cursor
+                         documents as an automatic follow-up - the native
+                         spelling is {"followup_message": ...})
+  beforeSubmitPrompt  -> {"continue": true}
+Everything else answers "{}" and never blocks.
+
+Cursor names its own tools, so `hooks.json` has to name them too: the matcher on
+`preToolUse` is a regex over the tool type, and Cursor's edit path is the `Write`
+tool (its docs map Claude's `Edit` onto `Write`). The matcher therefore lists
+`Write` plus the other spellings an edit tool is known by (`Edit`, `MultiEdit`,
+`NotebookEdit`); without them the platform never runs this hook for a file write
+and the gate's write branches - a test-skip marker added to a test file, a credit
+line inside file content - cannot fire at all. Exactly which name a given Cursor
+build sends is not verifiable from this repo, which is why the list is explicit
+rather than a wildcard: a miss costs only that half of the gate, and an extra
+alternative costs nothing because an unknown name passes the gate untouched.
+"""
+import json
+import os
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
+sys.path.insert(0, os.path.join(ROOT, "hooks"))
+from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
+try:
+    from tezgah_context import (  # noqa: E402
+        command_text, context_for, record, shell_kind, slug, under)
+    from tezgah_gate import decision, explored  # noqa: E402
+    from tezgah_integrity import (  # noqa: E402
+        SUBAGENT_CHANNEL, bind_session, note, note_tool, ran_nothing, report_bytes,
+        stop_reason)
+    from tezgah_paths import cache_dir, off  # noqa: E402
+    from tezgah_untrusted import marks  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# How many times one stop chain may be refused (hooks/projects-stop.py names the
+# same constant): one, deliberately; raising it is owner decision 11. Cursor's
+# `stop` payload carries `loop_count` (the follow-ups already sent in this chain)
+# and no `stop_hook_active` (cursor-agent 2026.10.01, captured 2026-10-07); the
+# flag is still read for a build that sends it.
+STOP_REASKS = 1
+
+
+def asked(payload):
+    """How many follow-ups tezgah's Stop refusals already started in this chain."""
+    try:
+        count = int(payload.get("loop_count") or 0)
+    except (TypeError, ValueError):
+        count = 0
+    return max(count, 1 if payload.get("stop_hook_active") else 0)
+
+
+ALLOW = {"permission": "allow"}
+# MCP tool names that are a code graph call: codegraph serves every tool as
+# `mcp__codegraph__<tool>`, so the server name in the blob is what identifies
+# one, whatever the tool is called.
+GRAPH = ("codegraph",)
+# Cursor tool names -> the shared gate's vocabulary. Keyed lowercase so a build
+# that spells a tool either way maps to the same name; the write tools
+# (`Write` and the other edit spellings) pass through unchanged, as the gate
+# knows them already.
+GATE_TOOLS = {"shell": "Bash", "read": "Read", "grep": "Grep"}
+# The shell tool spellings the `preToolUse` matcher names: their outcome is the
+# exit code, not the event.
+SHELLS = ("shell", "bash", "powershell", "pwsh")
+
+
+def gate_name(name):
+    """The tool name the gate denies under and the ledger row records.
+
+    `call_id` hashes the name it is handed, so mapping Cursor's `Shell` onto the
+    gate's `Bash` on the PreToolUse side alone gives one call two ids: the
+    PostToolUse row keeps the raw name, the loop guard reads a history that never
+    matches, and it never denies. Both halves map through here."""
+    return GATE_TOOLS.get(str(name or "").lower(), name)
+
+
+REINFORCE = ("tezgah contract active: keep using the code graph "
+             "(codegraph_explore/codegraph_callers) for structure and consult "
+             "for a second opinion.")
+RECOVERY = ("tezgah: tool call failed. Read the error, fix the cause, then "
+            "re-run; prefer codegraph_explore/codegraph_callers over guessing "
+            "at code.")
+
+
+def cwd_of(payload):
+    return (payload.get("cwd") or (payload.get("workspace_roots") or [None])[0]
+            or os.getcwd())
+
+
+def source_tool(payload):
+    """The tool name the provenance test (`untrusted_source`) reads.
+
+    Cursor names an MCP tool by its server (`mcp_server_name`) plus the raw tool
+    name, while the shared vocabulary's shape is `mcp__<server>__<tool>` - the
+    same translation `gate_name` does for the gate, so the prefix test stays in
+    one place."""
+    name = payload.get("tool_name", "") or ""
+    server = payload.get("mcp_server_name") or ""
+    return "mcp__%s__%s" % (server, name) if server else name
+
+
+def classify(payload, event=""):
+    """The used-tool kind for a tool/observer payload, or None when
+    undetectable. Reads every field shape Cursor sends: tool_input, command,
+    mcp_server_name.
+
+    A shell call is the kind whose program actually ran (shell_kind), never a
+    substring of the payload: naming `consult` in an argument is not using it,
+    and the status mark turns green only on a real call."""
+    name = payload.get("tool_name", "") or ""
+    server = payload.get("mcp_server_name", "") or ""
+    blob = " ".join((str(name), str(server),
+                     json.dumps(payload.get("tool_input") or {}),
+                     str(payload.get("command") or "")))
+    low = blob.lower()
+    if any(k in low for k in GRAPH):
+        return "graph"
+    if name in ("Task", "task"):
+        return "orch"
+    shell = name.lower() in ("shell", "bash") or event == "afterShellExecution"
+    if shell:
+        # `afterShellExecution` carries the command on the event itself, a
+        # postToolUse payload inside tool_input.
+        return shell_kind(command_text(payload.get("command"))
+                          or command_text(payload.get("tool_input")))
+    return None
+
+
+def gate_input(inp):
+    """The tool input in the shared gate's vocabulary.
+
+    Cursor's `Write` tool describes its change the way its `afterFileEdit`
+    payload does - `edits: [{old_string, new_string}]` - while the gate reads the
+    old_string/new_string pair, so fold the list into that shape. Every other
+    field is passed through untouched."""
+    edits = inp.get("edits")
+    if not isinstance(edits, list):
+        return inp
+    out = dict(inp)
+    for key in ("old_string", "new_string"):
+        if not out.get(key):
+            out[key] = "\n".join(str(e.get(key, "")) for e in edits
+                                 if isinstance(e, dict))
+    return out
+
+
+def result_size(result):
+    """The size of the result this event reported, or None when it carries none.
+
+    A size, never the body: the ledger records that a call returned something,
+    never what it returned, and the one reader asks only whether it is non-zero.
+    The measure is the Claude-family writer's (`hooks/projects-posttooluse.py`):
+    a container is measured by its top-level length - O(1), no re-serialization -
+    and Cursor reports the result as a string (`tool_output`, `output`), so its
+    length is the size. A value with no length is recorded as a non-empty result,
+    exactly as the writer records one, and only a missing result leaves the field
+    out - an absent field is never written as 0."""
+    if isinstance(result, (str, bytes, bytearray, list, tuple, dict, set,
+                           frozenset)):
+        return len(result)
+    return 1 if result is not None else None
+
+
+def call_failed(payload):
+    """The outcome a `postToolUse` payload reports, as `note_tool`'s `failed`.
+
+    A failure the tool itself raised arrives on `postToolUseFailure`, so this
+    event is a success of the call - the split Claude's adapter reads. A shell
+    call is the exception: a non-zero exit is still a call that ran, and Cursor
+    carries the status inside `tool_output` (documented as the JSON-stringified
+    result, `{"exitCode": 0, "stdout": ...}`), so a shell row is a pass or a
+    failure only by that `exitCode`. A shell result with no integer exitCode is
+    recorded as a check that RAN (`None`), never as a fabricated exit 0."""
+    out = payload.get("tool_output")
+    if isinstance(out, str):
+        try:
+            out = json.loads(out)
+        except ValueError:
+            out = None
+    code = out.get("exitCode") if isinstance(out, dict) else None
+    if isinstance(code, int) and not isinstance(code, bool):
+        return code != 0
+    if str(payload.get("tool_name") or "").lower() in SHELLS:
+        return None
+    return False
+
+
+def first_time(session_id, tag):
+    """True the first time a tag is seen for a session; fail-open when unwritable."""
+    if not session_id:
+        return True
+    mark = os.path.join(cache_dir(), "reinforced", slug(str(session_id)), tag)
+    if os.path.exists(mark):
+        return False
+    try:
+        os.makedirs(os.path.dirname(mark), exist_ok=True)
+        open(mark, "w", encoding="utf-8").close()
+    except OSError:
+        pass
+    return True
+
+
+def answer_path(session_id):
+    """Where the last assistant text of a conversation is kept.
+
+    Cursor's `stop` payload carries only `status`/`loop_count`, so the reply the
+    Stop rule has to read arrives on the earlier `afterAgentResponse`, which
+    documents `{"text": "<assistant final text>"}`. One file per conversation,
+    overwritten."""
+    return os.path.join(cache_dir(), "answer", slug(str(session_id or "nosession")))
+
+
+# A long reply is kept by its two ends rather than by one slice: the Stop rule's
+# placating-opener check anchors at the very start of the reply
+# (`tezgah_integrity.SYCOPHANT`), so a tail-only cut handed that rule text it
+# never reads and the rule could not fire on any reply longer than the budget;
+# the tail is what keeps a closing line - and the `doğrulanmadı` an honest reply
+# ends on - visible to the rest of the rule. Same total budget as the single
+# slice it replaces.
+ANSWER_HEAD, ANSWER_TAIL = 3000, 1000
+ANSWER_CUT = "\n\n[... %d characters dropped ...]\n\n"
+
+
+def remember_answer(session_id, text):
+    """Keep the reply `afterAgentResponse` handed over, best effort.
+
+    A reply that fits in `ANSWER_HEAD + ANSWER_TAIL` is stored whole. A longer
+    one is stored as that many characters of its head, `ANSWER_CUT` with the
+    count of what was dropped, then `ANSWER_TAIL` characters of its tail - so
+    both the opener the Stop rule reads and the closing marker it must not lose
+    survive the round trip. A reply with no `conversation_id` is not stored; a
+    file that cannot be written is not fatal."""
+    if not session_id or not text:
+        return
+    path = answer_path(session_id)
+    try:
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        text = str(text)
+        dropped = len(text) - ANSWER_HEAD - ANSWER_TAIL
+        if dropped > 0:
+            text = text[:ANSWER_HEAD] + ANSWER_CUT % dropped + text[-ANSWER_TAIL:]
+        with open(path, "w", encoding="utf-8") as fh:
+            fh.write(text)
+    except OSError:
+        pass
+
+
+def last_answer(session_id):
+    """The reply remembered for this conversation, or ""."""
+    try:
+        with open(answer_path(session_id), encoding="utf-8") as fh:
+            return fh.read()
+    except OSError:
+        return ""
+
+
+def dispatch(payload):
+    """The event handling: everything main does but the envelope."""
+    event = payload.get("hook_event_name", "")
+    cwd = cwd_of(payload)
+    session_id = (payload.get("conversation_id") or payload.get("session_id")
+                  or payload.get("parent_conversation_id"))
+    bind_session(session_id)  # the switch latch (tezgah_paths.off); dispatch runs in safe()
+    kind = classify(payload, event)
+    quiet = off("reminder-off")
+
+    if event == "sessionStart":
+        safe(session_id, attest_session, "cursor", session_id, cwd)
+        text = context_for("session_start", cwd, payload)
+        out = {"additional_context": text} if text else {}
+    elif event == "postToolUse":
+        if kind:
+            record(session_id, kind)
+        inp = gate_input(payload.get("tool_input") or {})
+        # read before this call's row lands: `source` on the row is the taint's
+        # own mark, and `marks` answers about the turn the call arrived in. Like
+        # every other tezgah surface but the status line, both halves are armed
+        # only inside a configured root.
+        source, notice = (marks(source_tool(payload), inp, session_id,
+                                payload.get("tool_output"))
+                          if under(cwd) else (None, None))
+        # A ledger row only inside a root, like Claude's PostToolUse, which
+        # returns early off-root; this row and the failure, shell and edit rows
+        # below used to record for any cwd (audit L-4, INT-07).
+        if under(cwd):
+            note_tool(session_id, gate_name(payload.get("tool_name", "")), inp,
+                      failed=call_failed(payload), source=source, cwd=cwd,
+                      out_bytes=(report_bytes(payload.get("tool_output"))
+                                 if source == SUBAGENT_CHANNEL
+                                 else result_size(payload.get("tool_output"))),
+                      empty_run=ran_nothing(payload.get("tool_output")))
+        reinforce = None
+        if (kind in ("graph", "consult") and under(cwd) and not quiet
+                and first_time(session_id, "graph")):
+            reinforce = REINFORCE
+        # both are one line for the model, on the result they belong to; a turn
+        # that earns both reads them together rather than one replacing the other
+        text = "\n".join(t for t in (notice, reinforce) if t)
+        out = {"additional_context": text} if text else {}
+    elif event == "postToolUseFailure":
+        if kind:
+            record(session_id, kind)
+        # Cursor documents this event's `is_interrupt` ("whether this failure was
+        # caused by a user interrupt/cancellation") and `failure_type`
+        # ("error" | "timeout" | "permission_denied"). A cancellation, and a call
+        # the user's policy denied before it ran, are both the host reporting no
+        # outcome for the call - recording either as a hardcoded failure made a
+        # stopped `pytest` a `verify_fail` that armed the Stop rule's
+        # partial-failure branch and counted an exit 1 in the error rate. What
+        # stays `failed=True` is the third shape, a genuine `error`/`timeout` the
+        # tool reported, exactly as before. `is True` rather than truthiness: a
+        # host that sends the string "false" would otherwise turn a real failure
+        # into an interruption.
+        ftype = str(payload.get("failure_type") or "")
+        if under(cwd):
+            note_tool(session_id, gate_name(payload.get("tool_name", "")),
+                      gate_input(payload.get("tool_input") or {}), failed=True,
+                      interrupted=(payload.get("is_interrupt") is True
+                                   or ftype == "permission_denied"), cwd=cwd)
+        out = {"additional_context": RECOVERY} if under(cwd) and not quiet else {}
+    elif event in ("afterShellExecution", "afterMCPExecution", "afterFileEdit"):
+        if kind:
+            record(session_id, kind)
+        if event == "afterFileEdit" and under(cwd):
+            note(session_id, "edit",
+                 payload.get("file_path") or payload.get("path") or "")
+        elif event == "afterShellExecution" and under(cwd):
+            # the command rides the event, not tool_input; the name is mapped so
+            # this observer's row lands on the same id as the gated call, and
+            # failed=None because the event carries no outcome. Cursor names
+            # `output` the terminal text: only its size is kept, never the text.
+            note_tool(session_id, gate_name("shell"),
+                      {"command": payload.get("command")
+                       or (payload.get("tool_input") or {}).get("command", "")},
+                      failed=None, out_bytes=result_size(payload.get("output")),
+                      cwd=cwd, empty_run=ran_nothing(payload.get("output")))
+        out = {}
+    elif event == "beforeMCPExecution":
+        if kind:
+            record(session_id, kind)
+        # allow the code graph explicitly; every other server's call meets the
+        # gate's content rules under the shared `mcp__<server>__<tool>` name (a
+        # deny), else no decision, so a user policy is never overridden.
+        # Cursor sends `tool_input` as a JSON string.
+        inp = payload.get("tool_input") or {}
+        if isinstance(inp, str):
+            try:
+                inp = json.loads(inp)
+            except ValueError:
+                inp = {}
+        reason = None if kind == "graph" else decision(
+            "mcp__%s__%s" % (payload.get("mcp_server_name") or "",
+                             payload.get("tool_name") or ""),
+            inp if isinstance(inp, dict) else {}, cwd, session_id)
+        if reason:
+            out = {"permission": "deny", "agent_message": reason}
+        else:
+            out = dict(ALLOW) if kind == "graph" else {}
+    elif event == "subagentStart":
+        if explored(payload.get("subagent_type")):
+            out = {"permission": "deny", "user_message": "grep-only explorer blocked; use general-purpose with the code graph tools"}
+        else:
+            record(session_id, "orch")
+            out = {"permission": "allow"}
+            # The delegate is a fresh context that must know the rules exist, so
+            # it gets the same short brief every other host hands a subagent.
+            # Cursor documents no context field on subagentStart (its output is
+            # permission + user_message, which is user-facing and deny-only), so
+            # the brief rides `additional_context` - the key Cursor uses for
+            # "context to add to the conversation" on sessionStart and
+            # postToolUse. Unverified for this event: a build that drops the
+            # unknown key leaves the delegate with the session context it already
+            # inherits, and the deny path above stays untouched either way.
+            brief = context_for("subagent_start", cwd, payload)
+            if brief:
+                out["additional_context"] = brief
+    elif event == "subagentStop":
+        record(session_id, "orch")
+        # A subagent's end, judged record-only (ADR 011): one `subagent_end`
+        # row from its `summary`, never a follow-up. Under its own guard, so a
+        # record that fails still leaves this event's empty answer.
+        if (payload.get("status") in (None, "completed")
+                and not off("verify-off") and under(cwd)):
+            safe(session_id, stop_reason, payload.get("summary") or "",
+                 session_id, cwd=cwd, subagent=True)
+        out = {}
+    elif event == "preToolUse":
+        tool = payload.get("tool_name", "")
+        inp = payload.get("tool_input") or {}
+        reason = decision(gate_name(tool), gate_input(inp), cwd, session_id)
+        out = ({"permission": "deny", "agent_message": reason}
+               if reason else dict(ALLOW))
+    elif event == "afterAgentResponse":
+        # the reply is only available here; `stop` reads it back
+        remember_answer(session_id, payload.get("text") or "")
+        out = {}
+    elif event == "stop":
+        # Cursor's Stop surface: the platform treats a "block" decision as an
+        # automatic follow-up, and the native spelling is `followup_message`.
+        # Only a finished turn is nudged - an aborted or errored one has no claim
+        # to check - and `loop_count` is the platform's own cap on follow-ups.
+        out = {}
+        if (payload.get("status") in (None, "completed")
+                and asked(payload) < STOP_REASKS
+                and not off("verify-off") and under(cwd)):
+            reason = stop_reason(last_answer(session_id), session_id, cwd=cwd)
+            if reason:
+                out = {"decision": "block", "reason": reason}
+    elif event == "beforeSubmitPrompt":
+        # per-turn: the reminder plus whichever conditional rule this prompt's
+        # task class arms (context_for classifies the submitted prompt)
+        text = context_for("user_prompt", cwd, payload)
+        out = {"continue": True}
+        if text:
+            out["additional_context"] = text
+    else:
+        out = {}
+    return out
+
+
+def main():
+    try:
+        payload = json.load(sys.stdin)
+    except Exception:
+        payload = {}
+    if not isinstance(payload, dict):
+        payload = {}
+    # one guard around the whole dispatch: a crash inside the event handling
+    # costs this envelope, never the session (hooks/tezgah_guard.safe), and the
+    # session id is the one the ledger row is filed under
+    session_id = (payload.get("conversation_id") or payload.get("session_id")
+                  or payload.get("parent_conversation_id"))
+    print(json.dumps(safe(session_id, dispatch, payload) or {}))
+
+
+main()

package/hosts/cursor/hooks.json

@@ -0,0 +1,44 @@
+{
+  "version": 1,
+  "hooks": {
+    "sessionStart": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "preToolUse": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 5, "matcher": "Shell|PowerShell|pwsh|Grep|Task|Write|Edit|MultiEdit|NotebookEdit" }
+    ],
+    "postToolUse": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "postToolUseFailure": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "beforeMCPExecution": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 5 }
+    ],
+    "afterShellExecution": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "afterMCPExecution": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "afterFileEdit": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "afterAgentResponse": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 5 }
+    ],
+    "subagentStart": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 5 }
+    ],
+    "subagentStop": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "beforeSubmitPrompt": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ],
+    "stop": [
+      { "command": "\"${TEZGAH_PYTHON:-python3}\" \"@CURSOR_HOOK@\"", "timeout": 10 }
+    ]
+  }
+}

package/hosts/dsh/hooks.json

@@ -0,0 +1,21 @@
+{
+  "hooks": {
+    "SessionStart": [
+      { "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-auto-init.py\"", "timeout": 10 } ] }
+    ],
+    "SubagentStart": [
+      { "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-auto-init.py\"", "timeout": 10 } ] }
+    ],
+    "UserPromptSubmit": [
+      { "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-auto-init.py\"", "timeout": 10 } ] }
+    ],
+    "PreToolUse": [
+      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|subagent|Edit|Write|MultiEdit|NotebookEdit", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
+      { "matcher": "^mcp__(?:.*[^A-Za-z0-9])?(?:append|cancel|clear|click|close|comment|commit|copy|create|delete|deploy|drag|edit|email|evaluate|exec|execute|fill|insert|install|kill|launch|merge|message|mkdir|move|navigate|notify|patch|pause|post|press|print|publish|push|put|release|remove|rename|replace|reply|resume|review|run|save|send|set|share|skip|start|stop|submit|swipe|tag|tap|terminate|type|uninstall|update|upload|write)(?:[^A-Za-z0-9].*)?$", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] }
+    ],
+    "PostToolUse": [
+      { "matcher": "Edit|edit|Write|write|MultiEdit|NotebookEdit|Bash|bash|PowerShell|pwsh|str_replace_editor|WebFetch|WebSearch|web_fetch|web_search|fetch|mcp__.*", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] },
+      { "matcher": "Agent|Task|Skill", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] }
+    ]
+  }
+}

package/hosts/dsh/statusline/lib/client.js

@@ -0,0 +1,138 @@
+// tezgah status line for the DeepSeek Harness Web UI, browser half.
+//
+// Renders the same marks `tezgah-status` prints on the other hosts, but colored
+// by state (green in force, yellow on-demand, red off). Hover shows the legend;
+// a click pins it open. Refresh is visibility-gated: it stops while the tab is
+// hidden and fires once on return, so an idle Web UI is not polling.
+window.__ModuleLoader__.load({
+	id: "tezgah-dsh-statusline",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		let react = require("react");
+		let react_jsx_runtime = require("react/jsx-runtime");
+
+		const REFRESH_MS = 10000;
+		// Fixed, theme-agnostic colors: the marks must read on light and dark.
+		const STATE_COLOR = { on: "#3fb950", ready: "#d29922", off: "#f85149",
+			info: "var(--dsw-alias-label-tertiary)" };
+
+		/**
+		 * One status line for a session, polled from the host route only while the
+		 * tab is visible. The text and glyphs come from the host, so the component
+		 * owns layout and color, not the wording.
+		 * @param props - the slot's session id plus any injected services.
+		 */
+		function TezgahStatusLine({ sessionId }) {
+			const [data, setData] = react.useState({ segments: [], legend: "" });
+			const [open, setOpen] = react.useState(false);
+			react.useEffect(() => {
+				let alive = true;
+				let timer;
+				const load = async () => {
+					try {
+						if (typeof document !== "undefined" && document.hidden) return;
+						const query = sessionId ? `&sessionId=${encodeURIComponent(sessionId)}` : "";
+						const res = await fetch(`/api/tezgah.status?format=json${query}`, {
+							headers: { accept: "application/json" }
+						});
+						const body = res.ok ? await res.json() : null;
+						if (alive && body) {
+							setData({ segments: body.segments || [], legend: body.legend || "" });
+						}
+					} catch {
+						if (alive) setData({ segments: [], legend: "" });
+					} finally {
+						if (alive) timer = setTimeout(load, REFRESH_MS);
+					}
+				};
+				load();
+				const onVisibility = () => { if (!document.hidden) load(); };
+				document.addEventListener("visibilitychange", onVisibility);
+				return () => {
+					alive = false;
+					clearTimeout(timer);
+					document.removeEventListener("visibilitychange", onVisibility);
+				};
+			}, [sessionId]);
+
+			if (!data.segments.length) return null;
+			const legend = data.legend || "tezgah status";
+			return react_jsx_runtime.jsxs("span", {
+				title: legend,
+				onClick: () => setOpen((v) => !v),
+				style: {
+					position: "relative",
+					cursor: "pointer",
+					fontFamily: "var(--dsw-font-mono)",
+					fontSize: "12px",
+					whiteSpace: "nowrap",
+					overflow: "hidden",
+					textOverflow: "ellipsis",
+					maxWidth: "32ch"
+				},
+				children: [
+					data.segments.map((seg, i) =>
+						react_jsx_runtime.jsxs("span", {
+							key: `${seg.key}-${i}`,
+							children: [
+								react_jsx_runtime.jsx("span", {
+									// the whole name+glyph carries the state color, the
+									// same as the terminal hosts; `info` stays muted
+									style: { color: STATE_COLOR[seg.state] || "inherit" },
+									children: seg.text + (seg.glyph || "")
+								}),
+								i < data.segments.length - 1
+									? (data.segments[i + 1].group === seg.group
+										? " "
+										: "  ·  ")
+									: ""
+							]
+						})
+					),
+					open
+						? react_jsx_runtime.jsx("span", {
+							style: {
+								position: "absolute",
+								top: "1.4em",
+								right: 0,
+								zIndex: 50,
+								whiteSpace: "pre",
+								background: "var(--dsw-alias-bg-layer-1, #222)",
+								color: "var(--dsw-alias-label-secondary, #ddd)",
+								border: "1px solid var(--dsw-alias-border, #444)",
+								borderRadius: "6px",
+								padding: "6px 8px",
+								fontSize: "11px",
+								maxWidth: "46ch"
+							},
+							children: legend
+						})
+						: null
+				]
+			});
+		}
+
+		/** Required service: the UI slot registry. */
+		const inject = ["slots"];
+
+		/** Register the header status line. */
+		function apply(ctx) {
+			ctx.slots.inject("conversation.session.header.utilities", () =>
+				ctx.slots.register(
+					{
+						name: "conversation.session.header.utilities",
+						id: "tezgah-statusline",
+						order: 30
+					},
+					TezgahStatusLine
+				)
+			);
+		}
+
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});