@r1z4x/tezgah 1.11.0 → 1.14.0

package/hooks/tezgah_attest.py

@@ -11,8 +11,9 @@ One store, not two: the install record is the per-artifact sha file the contract
 artifacts already use (`contract.sha256`, `bin/tezgah-setup::record_contract`),
 one line per entry under a `hook:<host>:<entry>` key. An entry is one hook event's
 tezgah-owned groups (Claude, dsh, Codex, Cursor - so a removed PreToolUse is named
-while PostToolUse stays), opencode's plugin links, and nothing for omp: its bridge
-is compared to a fresh render, the way `rules_current` compares a rules file. The
+while PostToolUse stays), opencode's plugin links, and nothing for omp and Amp:
+their bridge or plugin is compared to a fresh render, the way `rules_current`
+compares a rules file. The
 code an entry runs is hashed only on a packaged install (a tree with no `.git`):
 a checkout install points into a tree its owner edits on purpose. A hook file
 any user can write (0666) is drift too; group write is left alone, because a
@@ -43,10 +44,22 @@ CODE_TARGETS = {
     "cursor": (os.path.join("hosts", "cursor", "hook.py"),),
     "opencode": (os.path.join("hosts", "opencode", "plugins", "tezgah.js"),),
     "omp": (os.path.join("hosts", "omp", "hook.py"),),
+    "qwen": (os.path.join("hosts", "qwen", "hook.py"),),
+    "droid": (os.path.join("hosts", "droid", "hook.py"),),
+    "commandcode": (os.path.join("hosts", "commandcode", "hook.py"),),
+    "copilot": (os.path.join("hosts", "copilot", "hook.py"),),
+    "gemini": (os.path.join("hosts", "gemini", "hook.py"),),
+    "antigravity": (os.path.join("hosts", "antigravity", "hook.py"),),
+    "goose": (os.path.join("hosts", "goose", "hook.py"),),
+    "amp": (os.path.join("hosts", "amp", "hook.py"),
+            os.path.join("hosts", "amp", "tezgah-plugin.ts.in")),
 }
 OPENCODE_DIRS = ("plugins", "plugin")
 OMP_BRIDGE = os.path.join(tp.HOST_DIRS["omp"], "agent", "hooks", "pre",
                           "tezgah-hook.ts")
+# The first line of every Amp plugin tezgah renders: an uninstall removes a
+# file at AMP_PLUGIN only when it equals a fresh render or starts with this.
+AMP_HEADER = "// tezgah: Amp plugin rendered by tezgah-setup"
 
 
 def sha(text):
@@ -82,10 +95,15 @@ def own_groups(data, own=False):
     return out
 
 
-def _manifest(path, own):
+def _manifest(path, own, bare=False, key=None):
+    """`bare`: the file is keyed by event at the top, as Droid's hooks.json is;
+    `key`: the events sit under that top-level name, as Antigravity's do."""
     try:
         with open(path, encoding="utf-8") as fh:
-            return own_groups(json.load(fh), own)
+            data = json.load(fh)
+        if key:
+            data, bare = (data.get(key) if isinstance(data, dict) else None) or {}, True
+        return own_groups({"hooks": data} if bare else data, own)
     except (OSError, ValueError):
         return None
 
@@ -97,11 +115,31 @@ def omp_bridge(root=ROOT):
         with open(os.path.join(root, "hosts", "omp", "tezgah-hook.ts.in"),
                   encoding="utf-8") as fh:
             return fh.read().replace(
-                "@HOOK@", os.path.join(root, "hosts", "omp", "hook.py"))
+                "@HOOK@", js_string(os.path.join(root, "hosts", "omp", "hook.py")))
     except OSError:
         return ""
 
 
+def amp_plugin(root=ROOT):
+    """The Amp plugin as an install writes it: the template with this tree's
+    hook path, or "" when the template is unreadable. The install, the report
+    row, the live probe and the attestation all compare against this."""
+    try:
+        with open(os.path.join(root, "hosts", "amp", "tezgah-plugin.ts.in"),
+                  encoding="utf-8") as fh:
+            return fh.read().replace(
+                "@HOOK@", js_string(os.path.join(root, "hosts", "amp", "hook.py")))
+    except OSError:
+        return ""
+
+
+def js_string(path):
+    """`path` as the inside of a JS double-quoted string: a Windows checkout's
+    `\\t`, `\\u` or `\\x` would otherwise become a control character or a
+    SyntaxError, and the bridge would not load (review of plan 140)."""
+    return json.dumps(path)[1:-1]
+
+
 def registration(host, root=ROOT):
     """({entry: text}, [files]) for the tezgah-owned hook entries this host has
     on disk; the dict is None when the host's file cannot be read."""
@@ -109,9 +147,30 @@ def registration(host, root=ROOT):
         path = os.path.join(root, *(("hooks",) if host == "claude"
                                     else ("hosts", "dsh")), "hooks.json")
         return _manifest(path, own=True), [path]
-    if host in ("codex", "cursor"):
-        path = os.path.join(tp.HOST_DIRS[host], "hooks.json")
-        return _manifest(path, own=False), [path]
+    if host in ("codex", "cursor", "qwen", "droid", "commandcode"):
+        # Qwen's and Command Code's hooks live in a shared settings.json
+        path = os.path.join(tp.HOST_DIRS[host], "settings.json"
+                            if host in ("qwen", "commandcode") else "hooks.json")
+        return _manifest(path, own=False, bare=host == "droid"), [path]
+    if host == "copilot":
+        # tezgah's own file in Copilot's user hooks dir: every entry is ours
+        path = os.path.join(tp.HOST_DIRS["copilot"], "hooks", "tezgah.json")
+        return _manifest(path, own=True), [path]
+    if host == "gemini":
+        # tezgah's own extension: every entry in its hooks.json is ours
+        path = os.path.join(tp.HOST_DIRS["gemini"], "extensions", "tezgah", "hooks",
+                            "hooks.json")
+        return _manifest(path, own=True), [path]
+    if host == "antigravity":
+        # the shared ~/.gemini/config/hooks.json: every entry under its
+        # top-level `tezgah` name is ours
+        path = os.path.join(os.path.dirname(tp.HOST_DIRS["antigravity"]), "config",
+                            "hooks.json")
+        return _manifest(path, own=True, key="tezgah"), [path]
+    if host == "goose":
+        # tezgah's own plugin: every entry in its hooks.json is ours
+        path = os.path.join(tp.GOOSE_PLUGIN, "hooks", "hooks.json")
+        return _manifest(path, own=True), [path]
     if host == "opencode":
         links = (os.path.join(tp.HOST_DIRS["opencode"], d, "tezgah.js")
                  for d in OPENCODE_DIRS)
@@ -124,6 +183,12 @@ def registration(host, root=ROOT):
                 return {"bridge": fh.read()}, [OMP_BRIDGE]
         except OSError:
             return None, [OMP_BRIDGE]
+    if host == "amp":
+        try:
+            with open(tp.AMP_PLUGIN, encoding="utf-8") as fh:
+                return {"plugin": fh.read()}, [tp.AMP_PLUGIN]
+        except OSError:
+            return None, [tp.AMP_PLUGIN]
     return None, []
 
 
@@ -148,7 +213,7 @@ def record_texts(host, root=ROOT):
     """{key: text} an install records for one host (`bin/tezgah-setup::record_hooks`)."""
     entries, _files = registration(host, root)
     out = {}
-    if host != "omp":
+    if host not in ("omp", "amp"):
         out.update((KEY % (host, name), text)
                    for name, text in (entries or {}).items())
     code = code_text(host, root) if packaged(root) else None
@@ -173,10 +238,14 @@ def drift(host, root=ROOT, shas=None):
         if mode & 0o002:
             found.append("%s mode %04o" % (path, mode))
     if entries is None:
-        found.append("%s unreadable or missing" % files[0])
+        # a host `registration` does not know names no file: say so, never IndexError
+        found.append("%s unreadable or missing" % (files[0] if files else host))
     elif host == "omp":
         if entries["bridge"] != omp_bridge(root):
             found.append("omp bridge %s differs from a fresh render" % OMP_BRIDGE)
+    elif host == "amp":
+        if entries["plugin"] != amp_plugin(root):
+            found.append("amp plugin %s differs from a fresh render" % tp.AMP_PLUGIN)
     else:
         names = set(recorded) - {"code"}
         if not names:

package/hooks/tezgah_context.py

@@ -335,9 +335,10 @@ def skill_read_kind(tool, inp):
 
     Only the hosts that can see a read without paying a process per read call
     this (Claude parses its transcript, opencode classifies in-process, omp's
-    embedded runner filters before it asks python). On codex, cursor and dsh a
-    read is not observable at that price, so those marks stay at their armed
-    state and the legend says so.
+    embedded runner filters before it asks python). On codex, commandcode,
+    gemini, cursor, qwen, droid, copilot, antigravity and dsh a read is not
+    observable at that price, so those marks stay at their armed state and the
+    legend says so.
 
     A read of one of the two marked skills earns its mark (`SKILL_MARKS`); a read
     of any OTHER shipped skill earns `skill:<name>`. That second kind lights
@@ -1354,11 +1355,17 @@ def session_of(payload):
 # again on 2026-10-22 (plan 126, second pass): a research ask arms the Research
 # and Product paragraphs (6239 B on Claude, S4Remeasure p08) and the skill hint
 # that names the research skill (about 330 B with its path) was the block given
-# up, so the prompt budget moves to 7000 B. A
+# up, so the prompt budget moves to 7000 B. Moved again on 2026-10-28 (plan
+# 136): the subagent pointer says an owner-only question goes back as
+# `ESCALATE: owner` (+330 B), the fixture's subagent_start reached 5958 B and
+# gave up `consult` (205 B), so subagent_start moves to 6100 B. Moved again on
+# 2026-10-29 (plan 142): the output-shape paragraph says what the host's plan
+# mode changes (+168 B), and the worktree fixture's session_start gave up its
+# worktrees line again, so the session budgets move to 16200 B. A
 # budget in bytes, not tokens: this file has no tokenizer and a wrong estimate
 # would be worse than a bound.
-CONTEXT_BUDGET = {"session_start": 16000, "post_compact": 16000,
-                  "subagent_start": 5800, "user_prompt": 7000}
+CONTEXT_BUDGET = {"session_start": 16200, "post_compact": 16200,
+                  "subagent_start": 6100, "user_prompt": 7000}
 DEFAULT_BUDGET = 13000
 # The blocks in the order they are given up when the budget is exceeded, lowest
 # value first: text another surface already carries (the plan table lives in the
@@ -1520,12 +1527,13 @@ GATE_MIN_CALLS = 3
 # The tool names whose every call leaves a PreToolUse row (`began`,
 # tezgah_gate.decision's write and shell branch) and every refused one a `deny`:
 # Claude's write and shell tools, omp's `bash`/`edit`/`write` and Codex's
-# `exec_command`/`apply_patch`. A
+# `exec_command`/`apply_patch`, Droid's `Execute`/`Create`/`ApplyPatch`. A
 # tool the gate may pass without a row (Read, Grep, Task, WebFetch, an MCP
 # call) is not counted, so its absence from the ledger is never read as a
 # disarmed gate.
 GATED_TOOLS = re.compile(r"(?i)^(?:bash|powershell|pwsh|edit|write|multiedit|"
-                         r"notebookedit|exec_command|shell|apply_patch)$")
+                         r"notebookedit|exec_command|shell|apply_patch|"
+                         r"execute|create|applypatch)$")
 GATE_INACTIVE = (
     "tezgah gate inactive on this host: %d gated tool call(s) since this "
     "session's first turn and not one row from the gate, so the shortcut "
@@ -1651,7 +1659,8 @@ def context_nudge(payload, session_id):
 # The ledger kinds a hook other than the tool hooks writes: the prompt hook's
 # turn marker, judge row, lesson rows and disarm row, the Stop hook's claim,
 # refusal, after_block and shape rows and the stop_spec rows of plan 063's shadow
-# (old ledgers only), the subagent-end hook's subagent_end row,
+# (old ledgers only), the subagent-end hook's subagent_end row, Droid's Stop
+# `reply_unread` row (a turn end whose reply the transcript did not yield),
 # compaction, the subagent mark and the `subagent_start` lineage row (both from
 # SubagentStart), the omp fork's `forked` row, the guard's crash
 # row (any hook), the damage row any reader writes and the session start's
@@ -1664,7 +1673,7 @@ NOT_TOOL_HOOK = frozenset((b"turn", b"judge", b"claim", b"refusal",
                            b"after_block", b"subagent_end", b"stop_spec",
                            b"shape", b"compact", b"orch", b"crash", b"route",
                            b"spawned", b"forked", b"lesson", b"disarm", b"ledger_damage",
-                           b"attest", b"subagent_start"))
+                           b"attest", b"subagent_start", b"reply_unread"))
 # The rows PostToolUse writes (`note_tool`): they prove the host ran the call,
 # not that the gate saw it - a PostToolUse hook keeps writing them while a
 # broken PreToolUse hook lets every call through - so they are no proof either.
@@ -2087,7 +2096,8 @@ def context_for(event, cwd, payload=None, with_core=True):
     # The switch latch: every off() below answers for this session, and a
     # prompt's turn marker (with its `authorized` row) is written first, so a
     # switch the user's prompt names is honored from this very turn.
-    bind_session(session_of(payload))
+    bind_session(session_of(payload),
+                 payload.get("parent") if isinstance(payload, dict) else None)
     if event == "user_prompt":
         # One marker per user turn, written before the reminder check: the loop
         # guard counts an identical call's failures in the current turn only, so
@@ -2095,13 +2105,16 @@ def context_for(event, cwd, payload=None, with_core=True):
         # guard state rather than part of the reminder. Only a hash of the prompt
         # is stored - note_turn keys the row on it so one submission cannot write
         # two markers and hide the failures the guard had just counted.
-        note_turn(session_of(payload), prompt_text(payload), workspace=root_for(cwd))
+        note_turn(session_of(payload), prompt_text(payload), workspace=root_for(cwd),
+                  subagent=isinstance(payload, dict) and bool(payload.get("subagent")))
     core, disabled = core_for(cwd)
     # A disabled rule is also removed from the on-demand skill's reach, because
     # the skill is loaded separately and would otherwise re-enable it.
+    # Claude's `tezgah` output style is a static copy of the core that no switch
+    # re-renders, so the note names it beside the skill (OQ-12).
     off_note = ("Kill switches active this session: %s. Those rules are OFF; "
-                "ignore the matching section in the `tezgah-contract` skill."
-                % ", ".join(disabled)) if disabled else ""
+                "ignore the matching section in the `tezgah-contract` skill and "
+                "the `tezgah` output style." % ", ".join(disabled)) if disabled else ""
     if event == "user_prompt":
         prompt = prompt_text(payload)
         session_id = session_of(payload)
@@ -2110,24 +2123,24 @@ def context_for(event, cwd, payload=None, with_core=True):
             host = (payload or {}).get("host") if isinstance(payload, dict) else None
             tezgah_taste.note_prompt(session_id, prompt, cwd,
                                      host=host if isinstance(host, str) else None)
-        # Before the reminder switch: the status mark follows the gate's state
-        # even when the per-turn text is off. Never in DROP_ORDER, so no budget
-        # gives it up - it says the rules below are not being enforced.
+        # The gate notice: never in DROP_ORDER, so no budget gives it up, and
+        # `reminder-off` keeps it - it says the rules below are not being
+        # enforced. Reading it also writes the status mark.
         gate = gate_inactive(session_id, payload)
-        # The user's grants and lifts (`user_grants`), before the reminder
-        # switch too: the Stop rule reads them whether or not this turn's text
-        # is shown. A subagent's prompt is its parent's brief, never the
-        # user's grant (omp's bridge sends `subagent`).
+        # The user's grants and lifts (`user_grants`): the Stop rule reads them
+        # whatever this turn's text shows. A subagent's prompt is its parent's
+        # brief, never the user's grant (omp's bridge sends `subagent`).
         for clause, target in ([] if isinstance(payload, dict) and payload.get("subagent")
                                else user_grants(prompt)):
             note(session_id, GRANT_KIND, clause, target=target)
         # per-turn nudge: openers decay over long sessions. Kept short because
         # it is paid every turn, and on Claude the output style already carries
         # the same rules on every response. The conditional rules ride along
-        # only on the turn whose prompt matches their task class.
-        if off("reminder-off"):
-            return None
-        parts = [("reminder", render(prompt_reminder(dropped_switches(cwd))))]
+        # only on the turn whose prompt matches their task class. `reminder-off`
+        # mutes this one line: every other part has its own switch or none
+        # (OQ-10), and the gate notice must never be given up.
+        parts = ([] if off("reminder-off") else
+                 [("reminder", render(prompt_reminder(dropped_switches(cwd))))])
         if gate:
             parts.append(("gate", gate))
         # The previous turn's stamp, read before the armed paragraphs: they are
@@ -2250,8 +2263,8 @@ def context_for(event, cwd, payload=None, with_core=True):
         if stale:
             parts.append(("index", stale))
         if disabled:
-            parts.append(("offnote", "(off this session: %s)"
-                          % ", ".join(disabled)))
+            parts.append(("offnote", "(off this session: %s; ignore their sections "
+                          "in the `tezgah` output style)" % ", ".join(disabled)))
         text = budgeted(event, parts)
         # latched only when the budget kept it, so a dropped line comes back
         if heavy and heavy in text:
@@ -2450,7 +2463,12 @@ def context_for(event, cwd, payload=None, with_core=True):
                       "(each tagged DERIVED, you concluded it, or RETRIEVED, "
                       "you read it), Evidence (the path:line or command behind "
                       "each), Confidence, Unresolved, Disconfirming, Conflicts. "
-                      "Full rules: the `tezgah-contract` skill."))
+                      "A question only the owner can answer - choosing a variant "
+                      "or option a research, analysis or review recommends; a way "
+                      "around a tezgah refusal; deciding about another session's "
+                      "work (its line, plan or branch) - is never yours: return "
+                      "`ESCALATE: owner` with the options and a recommended "
+                      "default. Full rules: the `tezgah-contract` skill."))
     else:
         parts.append(("pointer", POINTER_LINE))
     text = budgeted(event, [(key, render(text.strip())) for key, text in parts])
@@ -2612,7 +2630,18 @@ def shell_kind(command):
     could light from `orx` alone and the layer's own commands stayed invisible to
     it. The absolute spelling needs no case of its own - this reader keeps
     basenames, so `<bin>/tezgah-research` and the bare name arrive as the same
-    word."""
+    word.
+
+    A python or node interpreter given a script file (`python3 bin/tezgah-docs
+    q`) runs that script, so the interpreter word is dropped before the line is
+    read; `-c`, `-m` and `-` (stdin) keep it, as their next word is code or a
+    module, not a file. The match stays on one line (spaces and tabs only), and a
+    shell interpreter needs none of this: the wrapper reader already looks past
+    `bash`/`sh`. `shell_programs` itself stays as it is: the gate reads it and
+    must keep the interpreter."""
+    command = re.sub(r"(?<![\w/.$=-])(?:[\w./-]*/)?(?:python[\d.]*|node)"
+                     r"(?:[ \t]+-(?![cm]\b)\w[\w-]*)*[ \t]+(?=[^\s-])", "",
+                     str(command or ""))
     ran = shell_programs(command)
     if "consult" in ran:
         return "consult"
@@ -2917,8 +2946,9 @@ colored, and the glyph carries the state on its own where color does not):
   name\u25cb  yellow  armed, on demand - not used yet this session
   name\u2717  red     turned off by a kill switch or a per-repo .no-* mark
   pony, adhd, dim   this surface cannot report that measure (a skill read
-                    needs a process per read to observe on codex, cursor and
-                    dsh, so those two marks state nothing there instead of
+                    needs a process per read to observe on codex, commandcode,
+                    gemini, cursor, qwen, droid, copilot, antigravity and dsh,
+                    so those two marks state nothing there instead of
                     claiming the skill was never opened)
   dim               no state to report: idx n/a or uncomparable, or no blocked
                     plan