@r1z4x/tezgah 1.9.2 → 1.13.0

package/hosts/droid/hook.py

@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""Factory Droid lifecycle hook. Reads Droid's JSON on stdin and answers in
+Droid's own output shape, onto the shared tezgah core (hooks/).
+
+Droid 0.251.0 fires SessionStart, UserPromptSubmit, PreToolUse, PostToolUse,
+SubagentStop and Stop here (`bin/tezgah-setup::DROID_HOOK_EVENTS`); anything
+else is ignored. Inert outside the roots.
+
+The always-on core is the managed block in `~/.factory/AGENTS.md`, which Droid
+loads as coding guidelines in every session, so SessionStart repeats it only
+when that block is missing. PreToolUse translates Droid's tool ids into the
+gate's vocabulary and denies with `hookSpecificOutput.permissionDecision` on
+exit 0 - never exit 2, whose stderr channel carries no reason the ledger and the
+probe can read. Droid has no failure event: PostToolUse fires for every
+finished call, so a shell call's outcome is read off its result
+(`call_failed`).
+
+Droid's Stop event carries no reply text (`stop_hook_active`,
+`tool_execution_count`, `elapsed_time`), so Stop reads the last assistant text
+from `transcript_path` (`last_reply`). When that read yields nothing, the turn
+end is recorded as a `reply_unread` row and not judged: judging an empty reply
+would let any claim through as "no claim". SubagentStop carries the sub-droid's
+`task_result` and is judged record-only. Droid has no SubagentStart, so a
+delegate gets no brief. The status line is `tezgah-statusline --droid`, Droid's
+`statusLine` command, so no event here carries it.
+"""
+import json
+import os
+import re
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
+sys.path.insert(0, os.path.join(ROOT, "hooks"))
+from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
+try:
+    from tezgah_context import (  # noqa: E402
+        _tail_lines, command_text, context_for, record, shell_kind)
+    from tezgah_gate import cross_project_note, decision, graph_advice  # noqa: E402
+    from tezgah_integrity import (  # noqa: E402
+        SUBAGENT_CHANNEL, bind_session, note, note_tool, ran_nothing, report_bytes,
+        stop_reason, untrusted_source)
+    from tezgah_paths import HOST_DIRS, off, root_for  # noqa: E402
+    from tezgah_taste import write_note  # noqa: E402
+    from tezgah_untrusted import marks  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# Droid's tool ids (harness/hooks "Common tool matchers", harness/subagents tool
+# categories) -> the shared gate's vocabulary. Read, LS, Glob, Grep, Task,
+# TodoWrite and WebSearch already carry the gate's names; MCP tools arrive as
+# `mcp__<server>__<tool>`, the shared shape, and pass through.
+GATE_TOOLS = {
+    "Execute": "Bash",
+    "Create": "Write",
+    "ApplyPatch": "apply_patch",
+    "FetchUrl": "WebFetch",
+}
+# How Droid ends a shell result: the text its transcripts store for an Execute
+# call (`[Process exited with code 1]`). The PostToolUse `tool_response` shape is
+# undocumented, so this is read wherever the result carries text.
+EXIT_LINE = re.compile(r"\[Process exited with code (-?\d+)\]")
+
+
+def gate_name(name):
+    """The tool name the gate denies under and the ledger row records.
+
+    `call_id` hashes the name it is handed, so both halves map through here: a
+    PostToolUse row under the raw id would never match the PreToolUse call and
+    the loop guard would never deny (`hosts/codex/hook.py::gate_name`)."""
+    return GATE_TOOLS.get(name, name)
+
+
+def gate_input(name, inp):
+    """The tool input in the gate's fields. Droid's ApplyPatch sends its patch as
+    `input` (the 0.251.0 bundle reads `o.input` as the patch text); the gate
+    reads `patch`."""
+    inp = inp if isinstance(inp, dict) else {}
+    if name == "ApplyPatch" and isinstance(inp.get("input"), str) and "patch" not in inp:
+        return dict(inp, patch=inp["input"])
+    return inp
+
+
+def classify(payload):
+    """The used-tool kind for a tool payload, or None."""
+    name = payload.get("tool_name", "") or ""
+    if name.startswith("mcp__") and "codegraph" in name:
+        return "graph"
+    if name == "Task":
+        return "orch"
+    if name == "Execute":
+        return shell_kind(command_text(payload.get("tool_input")))
+    return None
+
+
+def _texts(value):
+    """Every string in a result, depth first."""
+    if isinstance(value, str):
+        yield value
+    elif isinstance(value, dict):
+        for v in value.values():
+            yield from _texts(v)
+    elif isinstance(value, list):
+        for v in value:
+            yield from _texts(v)
+
+
+def call_failed(payload):
+    """The outcome a PostToolUse reports, as `note_tool`'s `failed`: True/False
+    from an Execute result's exit code - an integer `exit_code`/`exitCode`, else
+    the last `[Process exited with code N]` line - and None when no code is
+    read. A call with no code is recorded as one that RAN, never as a pass."""
+    if payload.get("tool_name") != "Execute":
+        return None
+    resp = payload.get("tool_response")
+    if isinstance(resp, dict):
+        for key in ("exit_code", "exitCode"):
+            code = resp.get(key)
+            if isinstance(code, int) and not isinstance(code, bool):
+                return code != 0
+    codes = [m for text in _texts(resp) for m in EXIT_LINE.findall(text)]
+    return int(codes[-1]) != 0 if codes else None
+
+
+def last_reply(path):
+    """The text of the assistant reply that ends the transcript, or "".
+
+    Droid writes one JSON row per message: `{"type": "message", "message":
+    {"role": "assistant", "content": [{"type": "text", "text": ...}]}}` (the
+    shape its session files carry). The reply is the text of the trailing
+    assistant rows; a transcript whose last message is the user's - a tool result
+    or a prompt - has no reply written yet, so it answers ""."""
+    parts = []
+    for raw in reversed(_tail_lines(path)):
+        try:
+            row = json.loads(raw)
+        except ValueError:
+            continue
+        msg = row.get("message") if isinstance(row, dict) else None
+        if not isinstance(msg, dict) or row.get("type") != "message":
+            continue
+        if msg.get("role") != "assistant":
+            break
+        content = msg.get("content")
+        texts = [b.get("text") for b in content if isinstance(b, dict)
+                 and b.get("type") == "text" and isinstance(b.get("text"), str)] \
+            if isinstance(content, list) else []
+        parts[:0] = texts
+    return "\n".join(t for t in parts if t.strip())
+
+
+def rules_carry_core():
+    """True when `AGENTS.md` in Droid's home holds tezgah-setup's managed block."""
+    try:
+        with open(os.path.join(HOST_DIRS["droid"], "AGENTS.md"), encoding="utf-8") as fh:
+            return "<!-- tezgah:start" in fh.read()
+    except OSError:
+        return False
+
+
+def result_size(result):
+    """The result's top-level length, the Claude-family writer's measure; a value
+    with no length counts as non-empty and only a missing result is None."""
+    if isinstance(result, (str, bytes, bytearray, list, tuple, dict, set, frozenset)):
+        return len(result)
+    return 1 if result is not None else None
+
+
+def post_tool(payload, cwd, session_id):
+    """The ledger row for one finished call, and the notice for the model."""
+    name = payload.get("tool_name", "") or ""
+    tool = gate_name(name)
+    inp = gate_input(name, payload.get("tool_input"))
+    safe(session_id, record, session_id, classify(payload))
+    if not root_for(cwd):
+        return None
+    result = payload.get("tool_response")
+    failed = call_failed(payload)
+    # read before this call's row lands: `source` is the taint's own mark
+    got = safe(session_id, marks, tool, inp, session_id, result)
+    source, notice = got or (None, None)
+    safe(session_id, note_tool, session_id, tool, inp, failed=failed,
+         source=source, cwd=cwd,
+         out_bytes=(report_bytes(result)
+                    if untrusted_source(tool, inp) == SUBAGENT_CHANNEL
+                    else result_size(result)),
+         empty_run=ran_nothing(result))
+    advice = safe(session_id, graph_advice, tool, inp, cwd, "droid")
+    taste = cross = None
+    if not failed:
+        taste = safe(session_id, write_note, session_id, inp, cwd, tool)
+        cross = safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+    return "\n".join(p for p in (notice, advice, taste, cross) if p)
+
+
+def context(event, text):
+    return {"hookSpecificOutput": {"hookEventName": event,
+                                   "additionalContext": text}} if text else {}
+
+
+def main():
+    try:
+        payload = json.load(sys.stdin)
+    except Exception:
+        return
+    if not isinstance(payload, dict):
+        return
+    event = payload.get("hook_event_name") or ""
+    cwd = payload.get("cwd") or os.getcwd()
+    session_id = payload.get("session_id")
+    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    out = {}
+    if event == "PreToolUse":
+        name = payload.get("tool_name", "") or ""
+        reason = safe(session_id, decision, gate_name(name),
+                      gate_input(name, payload.get("tool_input")), cwd, session_id)
+        if reason:
+            out = {"hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }}
+    elif event == "PostToolUse":
+        out = context(event, post_tool(payload, cwd, session_id))
+    elif event == "SessionStart":
+        safe(session_id, attest_session, "droid", session_id, cwd)
+        out = context(event, safe(session_id, context_for, "session_start", cwd,
+                                  payload, with_core=not rules_carry_core()))
+    elif event == "UserPromptSubmit":
+        out = context(event, safe(session_id, context_for, "user_prompt", cwd, payload))
+    elif event == "SubagentStop":
+        # a sub-droid's end is judged record-only (ADR 011): one `subagent_end`
+        # row from its `task_result`, never a block
+        safe(session_id, record, session_id, "orch")
+        if not off("verify-off") and root_for(cwd):
+            text = payload.get("task_result")
+            safe(session_id, stop_reason, text if isinstance(text, str) else "",
+                 session_id, cwd=cwd, subagent=True)
+    elif event == "Stop":
+        # Droid's Stop takes {"decision": "block", "reason": ...}. The reply
+        # after a block is judged again and refused at most once more
+        # (tezgah_integrity).
+        if not off("verify-off") and root_for(cwd):
+            path = payload.get("transcript_path")
+            text = safe(session_id, last_reply, path)
+            if text:
+                reason = safe(session_id, stop_reason, text, session_id, cwd=cwd,
+                              after_block=bool(payload.get("stop_hook_active")),
+                              mode=payload.get("permission_mode"))
+                if reason:
+                    out = {"decision": "block", "reason": reason}
+            else:
+                safe(session_id, note, session_id, "reply_unread",
+                     "no assistant text at the end of %s" % path if path
+                     else "no transcript_path")
+    if out:
+        print(json.dumps(out))
+
+
+main()

package/hosts/dsh/hooks.json

@@ -10,7 +10,7 @@
       { "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-auto-init.py\"", "timeout": 10 } ] }
     ],
     "PreToolUse": [
-      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|subagent|Edit|Write|MultiEdit|NotebookEdit|AskUserQuestion", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
+      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|Monitor|monitor|subagent|Edit|Write|MultiEdit|NotebookEdit|AskUserQuestion", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
       { "matcher": "^mcp__(?:.*[^A-Za-z0-9])?(?:append|cancel|clear|click|close|comment|commit|copy|create|delete|deploy|drag|edit|email|evaluate|exec|execute|fill|insert|install|kill|launch|merge|message|mkdir|move|navigate|notify|patch|pause|post|press|print|publish|push|put|release|remove|rename|replace|reply|resume|review|run|save|send|set|share|skip|start|stop|submit|swipe|tag|tap|terminate|type|uninstall|update|upload|write)(?:[^A-Za-z0-9].*)?$", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] }
     ],
     "PostToolUse": [

package/hosts/gemini/hook.py

@@ -0,0 +1,213 @@
+#!/usr/bin/env python3
+"""Gemini CLI lifecycle hook. Reads Gemini's JSON on stdin and answers in its own
+output shape, onto the shared tezgah core (hooks/).
+
+tezgah's entries live in its own extension, `$GEMINI_CLI_HOME/.gemini/extensions/
+tezgah/hooks/hooks.json` (`bin/tezgah-setup::GEMINI_HOOK_EVENTS`): SessionStart,
+BeforeAgent, BeforeTool, AfterTool and AfterAgent (geminicli hooks reference);
+anything else is ignored. Inert outside the roots. A bad exit or bad stdout is a
+warning there and the call goes on (fail open).
+
+The always-on core is the managed block in `~/.gemini/GEMINI.md`, the global
+context file, so SessionStart repeats it only when that block is missing.
+BeforeAgent writes the turn row and carries the per-turn reminder as
+`hookSpecificOutput.additionalContext`. BeforeTool translates the tool names
+into the gate's vocabulary and denies with a top-level
+`{"decision": "deny", "reason": ...}` on exit 0. AfterTool's `tool_response`
+holds `llmContent` and an optional `error`; the outcome is read off both
+(`call_failed`). AfterAgent carries the reply as `prompt_response` and
+`stop_hook_active`, and its deny sends the reason back as a new prompt. Gemini
+has no command status line (`ui.footer` is a closed list), so the status
+segment rides `systemMessage` at SessionStart and AfterAgent.
+"""
+import json
+import os
+import re
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
+sys.path.insert(0, os.path.join(ROOT, "hooks"))
+from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
+try:
+    from tezgah_context import (  # noqa: E402
+        TOOL_USE_MEASURES, command_text, context_for, health_lines, record, shell_kind)
+    from tezgah_gate import cross_project_note, decision, graph_advice  # noqa: E402
+    from tezgah_integrity import (  # noqa: E402
+        SUBAGENT_CHANNEL, bind_session, note_tool, ran_nothing, report_bytes,
+        stop_reason, untrusted_source)
+    from tezgah_paths import HOST_DIRS, off, root_for  # noqa: E402
+    from tezgah_taste import write_note  # noqa: E402
+    from tezgah_untrusted import marks  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# Gemini's tool names (docs reference/tools.md, core/subagents.md) -> the gate's
+# vocabulary. A subagent is a tool of its own name; `invoke_agent` is the
+# generic one in the source's tool-names.ts. A user's own agents are not mapped.
+GATE_TOOLS = {
+    "run_shell_command": "Bash",
+    "write_file": "Write",
+    "replace": "Edit",
+    "grep_search": "Grep", "search_file_content": "Grep",
+    "codebase_investigator": "Task", "generalist": "Task", "invoke_agent": "Task",
+    "read_file": "Read",
+}
+# The shell tool writes `Output: ...` first, then `Exit Code: N` only for a
+# non-zero code, or `Signal: NAME` for a killed process
+# (packages/core/src/tools/shell.ts), inside an `<untrusted_context>` wrapper;
+# a background or cancelled run has no Output.
+RAN = re.compile(r"\A(?:<untrusted_context[^>]*>\n)?Output: ")
+EXIT_CODE = re.compile(r"(?m)^Exit Code: (-?\d+)$")
+SIGNAL = re.compile(r"(?m)^Signal: ")
+
+
+def gate_name(name):
+    """The tool name the gate denies under and the ledger row records; both
+    halves map through here so a call hashes to one id. An MCP tool arrives as
+    `mcp_<server>_<tool>`, where nothing marks the boundary, and leaves as
+    `mcp__<server>_<tool>`."""
+    if name in GATE_TOOLS:
+        return GATE_TOOLS[name]
+    if name.startswith("mcp_") and not name.startswith("mcp__"):
+        return "mcp__" + name[4:]
+    return name
+
+
+def inp_of(payload):
+    inp = payload.get("tool_input")
+    return inp if isinstance(inp, dict) else {}
+
+
+def classify(tool, inp):
+    """The used-tool kind for a mapped call, or None."""
+    if tool.startswith("mcp__") and "codegraph" in tool:
+        return "graph"
+    if tool == "Task":
+        return "orch"
+    if tool == "Bash":
+        return shell_kind(command_text(inp))
+    return None
+
+
+def result_text(resp):
+    """`tool_response.llmContent` as text: a string, or a list of parts."""
+    content = resp.get("llmContent") if isinstance(resp, dict) else None
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        return "\n".join(p.get("text") if isinstance(p, dict) and isinstance(p.get("text"), str)
+                         else p if isinstance(p, str) else "" for p in content)
+    return None
+
+
+def call_failed(tool, resp, text):
+    """`note_tool`'s `failed`: an `error` in the response is a failure; a shell
+    result names a non-zero exit code or a signal (a killed runner), or ran to
+    its end with neither (a pass). None when the response says none of these -
+    a call that RAN, never a pass."""
+    if isinstance(resp, dict) and resp.get("error"):
+        return True
+    if tool != "Bash" or not isinstance(text, str):
+        return None
+    # a signal first: the command's own output may hold an `Exit Code: 0` line
+    if SIGNAL.search(text):
+        return True
+    codes = EXIT_CODE.findall(text)
+    if codes:
+        return int(codes[-1]) != 0
+    return False if RAN.match(text) else None
+
+
+def rules_carry_core():
+    """True when Gemini's global GEMINI.md holds tezgah-setup's managed block."""
+    try:
+        with open(os.path.join(HOST_DIRS["gemini"], "GEMINI.md"), encoding="utf-8") as fh:
+            return "<!-- tezgah:start" in fh.read()
+    except OSError:
+        return False
+
+
+def post_tool(payload, cwd, session_id):
+    """The ledger row for one finished call, and the notice for the model."""
+    tool, inp = gate_name(payload.get("tool_name", "") or ""), inp_of(payload)
+    safe(session_id, record, session_id, classify(tool, inp))
+    if not root_for(cwd):
+        return None
+    resp = payload.get("tool_response")
+    result = result_text(resp)
+    failed = call_failed(tool, resp, result)
+    # read before this call's row lands: `source` is the taint's own mark
+    got = safe(session_id, marks, tool, inp, session_id, result)
+    source, notice = got or (None, None)
+    safe(session_id, note_tool, session_id, tool, inp, failed=failed,
+         source=source, cwd=cwd,
+         out_bytes=(report_bytes(result)
+                    if untrusted_source(tool, inp) == SUBAGENT_CHANNEL
+                    else len(result) if isinstance(result, str) else None),
+         empty_run=ran_nothing(result))
+    advice = safe(session_id, graph_advice, tool, inp, cwd, "gemini")
+    taste = cross = None
+    if not failed:
+        taste = safe(session_id, write_note, session_id, inp, cwd, tool)
+        cross = safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+    return "\n".join(p for p in (notice, advice, taste, cross) if p)
+
+
+def context(event, text):
+    return {"hookSpecificOutput": {"hookEventName": event,
+                                   "additionalContext": text}} if text else {}
+
+
+def status(out, cwd, session_id):
+    """Add the status segment as `systemMessage`, shown to the user only."""
+    seg = safe(session_id, health_lines, cwd, session_id, observable=TOOL_USE_MEASURES)
+    if seg:
+        out["systemMessage"] = "tezgah  " + seg
+    return out
+
+
+def main():
+    try:
+        payload = json.load(sys.stdin)
+    except Exception:
+        return
+    if not isinstance(payload, dict):
+        return
+    event = payload.get("hook_event_name") or ""
+    cwd = payload.get("cwd") or os.getcwd()
+    session_id = payload.get("session_id")
+    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    out = {}
+    if event == "BeforeTool":
+        reason = safe(session_id, decision, gate_name(payload.get("tool_name", "") or ""),
+                      inp_of(payload), cwd, session_id)
+        if reason:
+            # the reason reaches the agent as the tool's error; the turn goes on
+            out = {"decision": "deny", "reason": reason}
+    elif event == "AfterTool":
+        out = context(event, post_tool(payload, cwd, session_id))
+    elif event == "SessionStart":
+        safe(session_id, attest_session, "gemini", session_id, cwd)
+        out = status(context(event, safe(session_id, context_for, "session_start", cwd,
+                                         payload, with_core=not rules_carry_core())),
+                     cwd, session_id)
+    elif event == "BeforeAgent":
+        out = context(event, safe(session_id, context_for, "user_prompt", cwd, payload))
+    elif event == "AfterAgent":
+        # {"decision": "deny", "reason": ...} rejects the reply and sends the
+        # reason back as a new prompt; the reply after a block is judged again
+        # and refused at most once more (tezgah_integrity).
+        if not off("verify-off") and root_for(cwd):
+            text = payload.get("prompt_response")
+            reason = safe(session_id, stop_reason, text if isinstance(text, str) else "",
+                          session_id, cwd=cwd,
+                          after_block=bool(payload.get("stop_hook_active")),
+                          mode=payload.get("permission_mode"))
+            if reason:
+                out = {"decision": "deny", "reason": reason}
+        out = status(out, cwd, session_id)
+    if out:
+        print(json.dumps(out))
+
+
+main()

package/hosts/goose/hook.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""Goose lifecycle hook. Reads Goose's JSON on stdin and answers in its own
+output shape, onto the shared tezgah core (hooks/).
+
+tezgah's entries live in its own plugin, `~/.agents/plugins/tezgah/hooks/
+hooks.json` (`bin/tezgah-setup::GOOSE_HOOK_EVENTS`): SessionStart,
+UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure and Stop (goose
+docs guides/context-engineering/hooks); anything else is ignored. The event
+name is the payload's `event`, the directory its `working_dir` (sent on tool
+events only), else the hook's own cwd. Inert outside the roots. A hook fault is
+logged by Goose and the call goes on: `on_failure` is left at its default
+`allow`, so the gate fails open (X-D2).
+
+Only PreToolUse and Stop can block. Both deny with `{"decision": "block",
+"reason": ...}` on stdout, which must start with `{`, on exit 0. Every other
+event is observation only: SessionStart writes the attestation, and
+UserPromptSubmit the turn row; no output of theirs reaches the model, so the
+always-on core is the managed block in `~/.config/goose/.goosehints` alone.
+PostToolUse fires for a call that succeeded and PostToolUseFailure for one that
+failed; neither carries the tool's output, so the event is the outcome. Stop
+carries the reply as `last_assistant_message` and no count of earlier blocks,
+so the turn's own rows bound the re-asks. No status line and no subagent events
+(SubagentStart/SubagentStop are not emitted).
+"""
+import json
+import os
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
+sys.path.insert(0, os.path.join(ROOT, "hooks"))
+from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
+try:
+    from tezgah_context import command_text, context_for, record, shell_kind  # noqa: E402
+    from tezgah_gate import cross_project_note, decision, graph_advice  # noqa: E402
+    from tezgah_integrity import bind_session, note, note_tool, stop_reason  # noqa: E402
+    from tezgah_paths import off, root_for  # noqa: E402
+    from tezgah_taste import write_note  # noqa: E402
+    from tezgah_untrusted import marks  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# Goose's built-in developer tools arrive under their bare name (hooks "Tool
+# Input Keys"); a subagent tool is not mapped.
+GATE_TOOLS = {"shell": "Bash", "write": "Write", "edit": "Edit"}
+
+
+def gate_name(name):
+    """The tool name the gate denies under and the ledger row records; both
+    halves map through here so a call hashes to one id. An extension's tool
+    arrives as `<extension>__<tool>` and leaves in the shared
+    `mcp__<extension>__<tool>` form."""
+    if name in GATE_TOOLS:
+        return GATE_TOOLS[name]
+    if "__" in name.strip("_") and not name.startswith("mcp__"):
+        return "mcp__" + name
+    return name
+
+
+def gate_input(name, inp):
+    """The tool input in the gate's fields: `write` and `edit` name the file
+    `path`, and `edit` its strings `before`/`after`."""
+    inp = dict(inp) if isinstance(inp, dict) else {}
+    if name in ("write", "edit") and "path" in inp:
+        inp.setdefault("file_path", inp["path"])
+    if name == "edit":
+        for src, dst in (("before", "old_string"), ("after", "new_string")):
+            if src in inp:
+                inp.setdefault(dst, inp[src])
+    return inp
+
+
+def classify(tool, inp):
+    """The used-tool kind for a mapped call, or None."""
+    if tool.startswith("mcp__") and "codegraph" in tool:
+        return "graph"
+    if tool == "Bash":
+        return shell_kind(command_text(inp))
+    return None
+
+
+def post_tool(payload, cwd, session_id, failed):
+    """The ledger row for one finished call. Goose reads no output of this
+    event, so nothing is returned to the model."""
+    name = payload.get("tool_name", "") or ""
+    tool, inp = gate_name(name), gate_input(name, payload.get("tool_input"))
+    safe(session_id, record, session_id, classify(tool, inp))
+    if not root_for(cwd):
+        return
+    # read before this call's row lands: `source` is the taint's own mark
+    got = safe(session_id, marks, tool, inp, session_id, None)
+    source = (got or (None, None))[0]
+    safe(session_id, note_tool, session_id, tool, inp, failed=failed,
+         source=source, cwd=cwd)
+    safe(session_id, graph_advice, tool, inp, cwd, "goose")
+    if not failed:
+        safe(session_id, write_note, session_id, inp, cwd, tool)
+        safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+
+
+def main():
+    try:
+        payload = json.load(sys.stdin)
+    except Exception:
+        return
+    if not isinstance(payload, dict):
+        return
+    event = payload.get("event") or ""
+    cwd = payload.get("working_dir") or os.getcwd()
+    session_id = payload.get("session_id")
+    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    out = {}
+    if event == "PreToolUse":
+        name = payload.get("tool_name", "") or ""
+        reason = safe(session_id, decision, gate_name(name),
+                      gate_input(name, payload.get("tool_input")), cwd, session_id)
+        if reason:
+            # Goose returns the reason to the model as a policy denial
+            out = {"decision": "block", "reason": reason}
+    elif event in ("PostToolUse", "PostToolUseFailure"):
+        post_tool(payload, cwd, session_id, event == "PostToolUseFailure")
+    elif event == "SessionStart":
+        safe(session_id, attest_session, "goose", session_id, cwd)
+    elif event == "UserPromptSubmit":
+        # the turn row only: Goose ignores this event's output
+        safe(session_id, context_for, "user_prompt", cwd, payload)
+    elif event == "Stop":
+        # a block forces the turn to keep going; Goose caps consecutive blocks
+        # (GOOSE_STOP_HOOK_BLOCK_CAP). The payload counts no earlier block, so
+        # the turn's refusal rows decide whether the reply may be refused again.
+        # The reply is sent only when there is assistant output (X-D5).
+        if not off("verify-off") and root_for(cwd):
+            text = payload.get("last_assistant_message")
+            if isinstance(text, str) and text.strip():
+                reason = safe(session_id, stop_reason, text, session_id, cwd=cwd,
+                              mode=payload.get("permission_mode"))
+                if reason:
+                    out = {"decision": "block", "reason": reason}
+            else:
+                safe(session_id, note, session_id, "reply_unread",
+                     "no last_assistant_message")
+    if out:
+        print(json.dumps(out))
+
+
+main()

package/hosts/omp/hook.py

@@ -276,9 +276,12 @@ def handle(payload):
         # the reply after a block is judged again; the core decides from the
         # turn's ledger whether it may be refused once more (plan 083), and a
         # core that raises has refused nothing
+        # an older installed bridge still sends omp's message object here; the
+        # core reads the prose either way (tezgah_integrity.reply_prose, 143)
         reason = safe(session_id, stop_reason,
                       payload.get("last_assistant_message"), session_id,
-                      cwd=cwd, after_block=bool(payload.get("stop_hook_active")))
+                      cwd=cwd, after_block=bool(payload.get("stop_hook_active")),
+                      mode=payload.get("permission_mode"))
         return {"decision": "block", "reason": reason} if reason else {}
     if event == "subagent_stop":
         # record-only (ADR 011): judged on the child's own rows, the row lands