@skillfm/local 2.0.3 → 2.0.5

package/README.md

@@ -11,9 +11,14 @@ This package sidesteps the problem: instead of asking the agent to install a new
 ## Install and run
 
 ```bash
-npx -y @skillfm/local@latest start
+npx --yes --package @skillfm/local@latest skillfm-local start
 ```
 
+> Why the verbose `--package` form? This npm package ships two CLI entry points
+> (`skillfm-local` + `skillfm-guard` for hook-based harness enforcement). Since
+> the package name's tail `local` is a shell reserved word, we cannot expose it
+> as a bin shortcut. The above `--package` form tells npx exactly which bin to run.
+
 Output is a single line of JSON the agent can parse:
 
 ```json
@@ -57,7 +62,7 @@ On successful `/activate/verify`, the brain_key is persisted to `~/.skillfm/conf
 
 ## Agent-native flow in plain words
 
-1. Agent spawns the sidecar: `npx -y @skillfm/local@latest start &`
+1. Agent spawns the sidecar: `npx --yes --package @skillfm/local@latest skillfm-local start &`
 2. Agent reads `~/.skillfm/local.json` to get the URL.
 3. Agent asks the user for their email and POSTs `/activate/request`.
 4. The backend emails a 6-digit code. Agent asks the user for the code.

package/dist/harness/kernels/deny-pipeline.d.ts

@@ -0,0 +1,21 @@
+/**
+ * BSO M9 v0.3 — KernelB: deny-pipeline
+ *
+ * Refs:
+ *   - docs/prd/PRD-BSO-M9-HARNESS-HOOKS.md §3.4.2 KernelB
+ *   - docs/research/OPENCLAW-DEEP-CAPABILITY-2026-04-19.md
+ *
+ * 覆盖：OpenClaw（唯一）
+ *
+ * OpenClaw `before_tool_call` Issue #5943/#60943 OPEN，PreToolUse 不可用。
+ * 退化方案三件套：
+ *   1. MCP stdio 注册：所有 SkillFM tool 调用必经 sidecar bridge
+ *   2. tools.deny 黑名单：禁用 OpenClaw 内置 Write/Edit/Bash，强制走 SkillFM MCP
+ *   3. agent_bootstrap.sh lifecycle hook：session 启动校验 sidecar
+ * + AGENTS.md priming（已由 priming.ts + writers.writePrimingBlock 实现）
+ *
+ * 等 OpenClaw 接通 PreToolUse 后 → 切到 hook-file kernel；本 kernel 退役。
+ */
+import type { KernelAdapter } from './types.js';
+export declare const denyPipelineAdapter: KernelAdapter;
+//# sourceMappingURL=deny-pipeline.d.ts.map

package/dist/harness/kernels/deny-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-pipeline.d.ts","sourceRoot":"","sources":["../../../src/harness/kernels/deny-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH,OAAO,KAAK,EAMV,aAAa,EACd,MAAM,YAAY,CAAC;AAgHpB,eAAO,MAAM,mBAAmB,EAAE,aAyHjC,CAAC"}

package/dist/harness/kernels/deny-pipeline.js

@@ -0,0 +1,225 @@
+/**
+ * BSO M9 v0.3 — KernelB: deny-pipeline
+ *
+ * Refs:
+ *   - docs/prd/PRD-BSO-M9-HARNESS-HOOKS.md §3.4.2 KernelB
+ *   - docs/research/OPENCLAW-DEEP-CAPABILITY-2026-04-19.md
+ *
+ * 覆盖：OpenClaw（唯一）
+ *
+ * OpenClaw `before_tool_call` Issue #5943/#60943 OPEN，PreToolUse 不可用。
+ * 退化方案三件套：
+ *   1. MCP stdio 注册：所有 SkillFM tool 调用必经 sidecar bridge
+ *   2. tools.deny 黑名单：禁用 OpenClaw 内置 Write/Edit/Bash，强制走 SkillFM MCP
+ *   3. agent_bootstrap.sh lifecycle hook：session 启动校验 sidecar
+ * + AGENTS.md priming（已由 priming.ts + writers.writePrimingBlock 实现）
+ *
+ * 等 OpenClaw 接通 PreToolUse 后 → 切到 hook-file kernel；本 kernel 退役。
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { SKILLFM_GUARD_COMMAND } from '../templates.js';
+import { arrayHasMarker, ensureObjectPath, mergeJsonFile, } from './json-merge.js';
+// ============================================================================
+// 路径
+// ============================================================================
+const OPENCLAW_HOME = (home) => join(home, '.openclaw');
+const OPENCLAW_GLOBAL_CONFIG = (home) => join(OPENCLAW_HOME(home), 'openclaw.json');
+const OPENCLAW_WORKSPACE_CONFIG = (home) => join(OPENCLAW_HOME(home), 'workspace', 'openclaw.json');
+const OPENCLAW_BOOTSTRAP_HOOK = (home) => join(OPENCLAW_HOME(home), 'hooks', 'agent_bootstrap.sh');
+// ============================================================================
+// MCP server registration（OpenClaw 只支持 stdio MCP）
+// ============================================================================
+const SKILLFM_MCP_BRIDGE_BIN = 'skillfm-mcp-bridge';
+function buildMcpRegistrationPatch(filePath) {
+    return {
+        filePath,
+        emptyJson: () => ({}),
+        isAlreadyRegistered: (data) => {
+            const mcp = data?.mcp;
+            const direct = data?.mcpServers;
+            return Boolean(mcp?.servers?.skillfm) || Boolean(direct?.skillfm);
+        },
+        mergePatch: (data) => {
+            // OpenClaw 接受两种 schema（mcp.servers 或顶层 mcpServers）；优先 mcp.servers
+            const mcp = ensureObjectPath(data, 'mcp');
+            const servers = ensureObjectPath(mcp, 'servers');
+            servers.skillfm = {
+                type: 'stdio',
+                command: SKILLFM_MCP_BRIDGE_BIN,
+                args: [],
+            };
+        },
+    };
+}
+// ============================================================================
+// tools.deny 黑名单（写到 workspace 级 openclaw.json）
+// ============================================================================
+const DEFAULT_DENY_TOOLS = ['Write', 'Edit', 'Bash'];
+function buildDenyPipelinePatch(filePath) {
+    return {
+        filePath,
+        emptyJson: () => ({}),
+        isAlreadyRegistered: (data) => {
+            const tools = data?.tools;
+            return arrayHasMarker(tools?.deny, 'Write');
+        },
+        mergePatch: (data) => {
+            const tools = ensureObjectPath(data, 'tools');
+            const existing = Array.isArray(tools.deny) ? tools.deny : [];
+            const merged = Array.from(new Set([...existing, ...DEFAULT_DENY_TOOLS]));
+            tools.deny = merged;
+        },
+    };
+}
+// ============================================================================
+// agent_bootstrap.sh lifecycle hook
+// ============================================================================
+const BOOTSTRAP_SCRIPT = `#!/usr/bin/env bash
+# SkillFM M9 — OpenClaw lifecycle bootstrap hook
+# Managed by @skillfm/local. Edit via \`skillfm init\`.
+#
+# 在 OpenClaw session 启动时校验 sidecar 是否在跑。
+# 失败 → exit 1 阻断 session 启动（强制用户先 \`skillfm start\`）。
+
+set -euo pipefail
+
+if ! command -v ${SKILLFM_GUARD_COMMAND} >/dev/null 2>&1; then
+  echo "⚠️  [skillfm-bootstrap] ${SKILLFM_GUARD_COMMAND} 未安装，跳过校验" >&2
+  exit 0
+fi
+
+if ! ${SKILLFM_GUARD_COMMAND} session-start --harness=openclaw; then
+  echo "⛔ [skillfm-bootstrap] sidecar 未运行；请先执行 \\\`skillfm start\\\`" >&2
+  exit 1
+fi
+`;
+function writeBootstrapHook(filePath) {
+    if (existsSync(filePath)) {
+        const existing = readFileSync(filePath, 'utf-8');
+        if (existing.includes('SkillFM M9 — OpenClaw lifecycle bootstrap')) {
+            return { created: false, path: filePath };
+        }
+    }
+    mkdirSync(dirname(filePath), { recursive: true });
+    writeFileSync(filePath, BOOTSTRAP_SCRIPT, { encoding: 'utf-8', mode: 0o755 });
+    try {
+        chmodSync(filePath, 0o755);
+    }
+    catch {
+        // 部分 FS 不支持，忽略
+    }
+    return { created: true, path: filePath };
+}
+// ============================================================================
+// Adapter
+// ============================================================================
+const SUPPORTED = ['openclaw'];
+export const denyPipelineAdapter = {
+    kind: 'deny-pipeline',
+    supportedHosts: SUPPORTED,
+    matches(host) {
+        return host.host === 'openclaw';
+    },
+    async install(ctx) {
+        const home = homedir();
+        const files = [];
+        const warnings = [];
+        // 1. global openclaw.json — 注册 SkillFM MCP server
+        files.push(mergeJsonFile({
+            ...buildMcpRegistrationPatch(OPENCLAW_GLOBAL_CONFIG(home)),
+            dryRun: !ctx.apply,
+        }));
+        // 2. workspace openclaw.json — 写 tools.deny 黑名单
+        files.push(mergeJsonFile({
+            ...buildDenyPipelinePatch(OPENCLAW_WORKSPACE_CONFIG(home)),
+            dryRun: !ctx.apply,
+        }));
+        // 3. agent_bootstrap.sh
+        if (ctx.apply) {
+            const r = writeBootstrapHook(OPENCLAW_BOOTSTRAP_HOOK(home));
+            files.push({
+                path: r.path,
+                action: r.created ? 'created' : 'already-registered',
+            });
+        }
+        else {
+            files.push({
+                path: OPENCLAW_BOOTSTRAP_HOOK(home),
+                action: 'noop',
+                details: 'dry-run',
+            });
+        }
+        warnings.push('OpenClaw PreToolUse 未接通（Issue #5943/#60943），强制力等价 deny-pipeline + Layer 2 兜底');
+        return {
+            kernel: 'deny-pipeline',
+            host: 'openclaw',
+            files,
+            warnings,
+        };
+    },
+    async uninstall(ctx) {
+        return {
+            kernel: 'deny-pipeline',
+            host: 'openclaw',
+            files: [],
+            warnings: [
+                '完整 uninstall 未实现；请从 ~/.skillfm/backups/<最近 ts>/ 恢复 openclaw.json，并删除 ~/.openclaw/hooks/agent_bootstrap.sh',
+            ],
+        };
+    },
+    async diagnose(_ctx) {
+        const home = homedir();
+        const checks = [];
+        // MCP server registered?
+        const globalCfg = OPENCLAW_GLOBAL_CONFIG(home);
+        let mcpRegistered = false;
+        if (existsSync(globalCfg)) {
+            try {
+                const raw = readFileSync(globalCfg, 'utf-8');
+                mcpRegistered = raw.includes('skillfm-mcp-bridge') || raw.includes('skillfm');
+            }
+            catch {
+                // ignore
+            }
+        }
+        checks.push({
+            name: 'mcp-server-registered',
+            ok: mcpRegistered,
+            detail: globalCfg,
+        });
+        // workspace tools.deny present?
+        const wsCfg = OPENCLAW_WORKSPACE_CONFIG(home);
+        let denyPresent = false;
+        if (existsSync(wsCfg)) {
+            try {
+                const raw = readFileSync(wsCfg, 'utf-8');
+                denyPresent = raw.includes('"deny"') && raw.includes('Write');
+            }
+            catch {
+                // ignore
+            }
+        }
+        checks.push({
+            name: 'tools-deny-blacklist',
+            ok: denyPresent,
+            detail: wsCfg,
+        });
+        // bootstrap hook present?
+        const bootstrap = OPENCLAW_BOOTSTRAP_HOOK(home);
+        checks.push({
+            name: 'agent-bootstrap-hook',
+            ok: existsSync(bootstrap),
+            detail: bootstrap,
+        });
+        const allOk = checks.every((c) => c.ok);
+        return {
+            kernel: 'deny-pipeline',
+            host: 'openclaw',
+            level: allOk ? 'protocol-fallback' : 'absent',
+            checks,
+        };
+    },
+};
+//# sourceMappingURL=deny-pipeline.js.map

package/dist/harness/kernels/deny-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-pipeline.js","sourceRoot":"","sources":["../../../src/harness/kernels/deny-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,aAAa,GACd,MAAM,iBAAiB,CAAC;AAUzB,+EAA+E;AAC/E,KAAK;AACL,+EAA+E;AAE/E,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAChE,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAC7C,MAAM,yBAAyB,GAAG,CAAC,IAAY,EAAE,EAAE,CACjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AAC1D,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAE,EAAE,CAC/C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAE3D,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAE/E,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAEpD,SAAS,yBAAyB,CAAC,QAAgB;IACjD,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAI,IAAwD,EAAE,GAAG,CAAC;YAC3E,MAAM,MAAM,GAAI,IAAiD,EAAE,UAAU,CAAC;YAC9E,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,kEAAkE;YAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjD,OAAO,CAAC,OAAO,GAAG;gBAChB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,sBAAsB;gBAC/B,IAAI,EAAE,EAAE;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErD,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAI,IAAuC,EAAE,KAAK,CAAC;YAC9D,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAE/E,MAAM,gBAAgB,GAAG;;;;;;;;;kBASP,qBAAqB;kCACL,qBAAqB;;;;OAIhD,qBAAqB;;;;CAI3B,CAAC;AAEF,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,2CAA2C,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,SAAS,GAAsB,CAAC,UAAU,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,mBAAmB,GAAkB;IAChD,IAAI,EAAE,eAAe;IACrB,cAAc,EAAE,SAAS;IAEzB,OAAO,CAAC,IAAc;QACpB,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAmB;QAC/B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,kDAAkD;QAClD,KAAK,CAAC,IAAI,CACR,aAAa,CAAC;YACZ,GAAG,yBAAyB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK;SACnB,CAAC,CACH,CAAC;QAEF,gDAAgD;QAChD,KAAK,CAAC,IAAI,CACR,aAAa,CAAC;YACZ,GAAG,sBAAsB,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK;SACnB,CAAC,CACH,CAAC;QAEF,wBAAwB;QACxB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;aACrD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CACX,8EAA8E,CAC/E,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,UAAU;YAChB,KAAK;YACL,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAmB;QACjC,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE;gBACR,2GAA2G;aAC5G;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAoB;QACjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAA6B,EAAE,CAAC;QAE5C,yBAAyB;QACzB,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC7C,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,EAAE,EAAE,aAAa;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,gCAAgC;QAChC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACzC,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,EAAE,EAAE,WAAW;YACf,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;YACzB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ;YAC7C,MAAM;SACP,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/harness/kernels/hook-file.d.ts

@@ -0,0 +1,16 @@
+/**
+ * BSO M9 v0.3 — KernelA: hook-file
+ *
+ * Refs:
+ *   - docs/prd/PRD-BSO-M9-HARNESS-HOOKS.md §3.4.2 KernelA
+ *   - docs/research/HARNESS-HOOK-CAPABILITY-MATRIX-2026-04-19.md §1.1-1.3
+ *
+ * 覆盖：Claude Code / Cursor 1.7+ / Windsurf
+ * 共同模式：写配置文件（JSON）→ 注册 PreToolUse 风格 hook → exit 2 阻断
+ *
+ * Cursor / Windsurf schema 来自官方文档一手验证（feedback_verify_verbal_facts 教训）。
+ */
+import type { HostId, KernelAdapter } from './types.js';
+export declare const hookFileAdapter: KernelAdapter;
+export declare function userScopeHintFor(host: HostId): string | null;
+//# sourceMappingURL=hook-file.d.ts.map

package/dist/harness/kernels/hook-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-file.d.ts","sourceRoot":"","sources":["../../../src/harness/kernels/hook-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAEV,MAAM,EAIN,aAAa,EACd,MAAM,YAAY,CAAC;AAkIpB,eAAO,MAAM,eAAe,EAAE,aAsG7B,CAAC;AAOF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW5D"}

package/dist/harness/kernels/hook-file.js

@@ -0,0 +1,229 @@
+/**
+ * BSO M9 v0.3 — KernelA: hook-file
+ *
+ * Refs:
+ *   - docs/prd/PRD-BSO-M9-HARNESS-HOOKS.md §3.4.2 KernelA
+ *   - docs/research/HARNESS-HOOK-CAPABILITY-MATRIX-2026-04-19.md §1.1-1.3
+ *
+ * 覆盖：Claude Code / Cursor 1.7+ / Windsurf
+ * 共同模式：写配置文件（JSON）→ 注册 PreToolUse 风格 hook → exit 2 阻断
+ *
+ * Cursor / Windsurf schema 来自官方文档一手验证（feedback_verify_verbal_facts 教训）。
+ */
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { existsSync } from 'node:fs';
+import { SKILLFM_GUARD_COMMAND, claudeSettingsPatch, } from '../templates.js';
+import { mergeClaudeSettings } from '../writers.js';
+import { arrayHasMarker, ensureArrayPath, ensureObjectPath, mergeJsonFile, } from './json-merge.js';
+const TARGETS = [
+    // --------------------------------------------------------------------------
+    // Claude Code — .claude/settings.json
+    // --------------------------------------------------------------------------
+    {
+        host: 'claude-code',
+        configPath: (cwd) => join(cwd, '.claude', 'settings.json'),
+        patch: () => {
+            // Delegate 到现有 mergeClaudeSettings — 保留 v0.2 已 ship 行为
+            // 这里仅占位；install() 内特判 claude-code 走 mergeClaudeSettings。
+            throw new Error('claude-code uses dedicated mergeClaudeSettings');
+        },
+    },
+    // --------------------------------------------------------------------------
+    // Cursor 1.7+ — .cursor/hooks.json
+    // 官方 schema 来源：调研 §1.2
+    //   { version: 1, hooks: { sessionStart: [{command}], preToolUse: [{matcher, command}] } }
+    //   阻断方式：exit 2 OR stdout JSON {permission:"deny"}
+    // --------------------------------------------------------------------------
+    {
+        host: 'cursor',
+        configPath: (cwd) => join(cwd, '.cursor', 'hooks.json'),
+        patch: (cwd) => ({
+            filePath: join(cwd, '.cursor', 'hooks.json'),
+            emptyJson: () => ({ version: 1, hooks: {} }),
+            isAlreadyRegistered: (data) => {
+                const hooks = data?.hooks ?? {};
+                return arrayHasMarker(hooks.preToolUse, SKILLFM_GUARD_COMMAND);
+            },
+            mergePatch: (data) => {
+                const hooks = ensureObjectPath(data, 'hooks');
+                // sessionStart
+                const ss = ensureArrayPath(hooks, 'sessionStart');
+                if (!arrayHasMarker(ss, SKILLFM_GUARD_COMMAND)) {
+                    ss.push({ command: `${SKILLFM_GUARD_COMMAND} session-start` });
+                }
+                // preToolUse — Cursor 用单 entry 含 matcher 字段
+                const pre = ensureArrayPath(hooks, 'preToolUse');
+                pre.push({
+                    matcher: 'Write|Edit|run_terminal',
+                    command: `${SKILLFM_GUARD_COMMAND} pre-tool-use --harness=cursor`,
+                });
+                // postToolUse — 仅 audit
+                const post = ensureArrayPath(hooks, 'postToolUse');
+                post.push({
+                    matcher: 'Write|Edit|run_terminal',
+                    command: `${SKILLFM_GUARD_COMMAND} post-tool-use --harness=cursor`,
+                });
+                // failClosed: false（fail-open，避免 sidecar 故障锁死）
+                if (data.failClosed === undefined) {
+                    data.failClosed = false;
+                }
+            },
+        }),
+    },
+    // --------------------------------------------------------------------------
+    // Windsurf Cascade — .windsurf/hooks.json
+    // 官方 schema 来源：调研 §1.3
+    //   { hooks: { pre_write_code: [{command, show_output}], pre_run_command: [...], pre_mcp_tool_use: [...] } }
+    //   阻断方式：写 stderr + exit 2
+    // --------------------------------------------------------------------------
+    {
+        host: 'windsurf',
+        configPath: (cwd) => join(cwd, '.windsurf', 'hooks.json'),
+        patch: (cwd) => ({
+            filePath: join(cwd, '.windsurf', 'hooks.json'),
+            emptyJson: () => ({ hooks: {} }),
+            isAlreadyRegistered: (data) => {
+                const hooks = data?.hooks ?? {};
+                return (arrayHasMarker(hooks.pre_write_code, SKILLFM_GUARD_COMMAND) ||
+                    arrayHasMarker(hooks.pre_run_command, SKILLFM_GUARD_COMMAND));
+            },
+            mergePatch: (data) => {
+                const hooks = ensureObjectPath(data, 'hooks');
+                const preWrite = ensureArrayPath(hooks, 'pre_write_code');
+                preWrite.push({
+                    command: `${SKILLFM_GUARD_COMMAND} pre-tool-use --harness=windsurf --tool=Write`,
+                    show_output: true,
+                });
+                const preRun = ensureArrayPath(hooks, 'pre_run_command');
+                preRun.push({
+                    command: `${SKILLFM_GUARD_COMMAND} pre-tool-use --harness=windsurf --tool=Bash`,
+                    show_output: true,
+                });
+                const preMcp = ensureArrayPath(hooks, 'pre_mcp_tool_use');
+                preMcp.push({
+                    command: `${SKILLFM_GUARD_COMMAND} pre-tool-use --harness=windsurf --tool=MCP`,
+                    show_output: true,
+                });
+            },
+        }),
+    },
+];
+const SUPPORTED = ['claude-code', 'cursor', 'windsurf'];
+// ============================================================================
+// Adapter
+// ============================================================================
+export const hookFileAdapter = {
+    kind: 'hook-file',
+    supportedHosts: SUPPORTED,
+    matches(host) {
+        return SUPPORTED.includes(host.host);
+    },
+    async install(ctx) {
+        const tgt = TARGETS.find((t) => t.host === ctx.host.host);
+        if (!tgt) {
+            return {
+                kernel: 'hook-file',
+                host: ctx.host.host,
+                files: [],
+                warnings: [`hook-file: unsupported host ${ctx.host.host}`],
+            };
+        }
+        // claude-code 复用 v0.2 已 ship 的 mergeClaudeSettings（行为已验证）
+        if (ctx.host.host === 'claude-code') {
+            const filePath = tgt.configPath(ctx.cwd);
+            const r = mergeClaudeSettings(filePath, claudeSettingsPatch());
+            // mergeClaudeSettings 返回的 action 集合更宽（含 skipped-*），归一到 InstalledFile.action
+            const action = r.action === 'created' || r.action === 'merged' || r.action === 'already-registered'
+                ? r.action
+                : 'noop';
+            return {
+                kernel: 'hook-file',
+                host: 'claude-code',
+                files: [{ path: filePath, action, details: r.details }],
+                warnings: [],
+            };
+        }
+        // cursor / windsurf 走通用 mergeJsonFile
+        const installed = mergeJsonFile({
+            ...tgt.patch(ctx.cwd),
+            dryRun: !ctx.apply,
+        });
+        return {
+            kernel: 'hook-file',
+            host: ctx.host.host,
+            files: [installed],
+            warnings: [],
+        };
+    },
+    async uninstall(ctx) {
+        // M9 P0 不实现完整 uninstall — 提示用户走 .bak 恢复
+        return {
+            kernel: 'hook-file',
+            host: ctx.host.host,
+            files: [],
+            warnings: [
+                '完整 uninstall 未实现；请从 ~/.skillfm/backups/<最近 ts>/ 恢复原配置文件',
+            ],
+        };
+    },
+    async diagnose(ctx) {
+        const tgt = TARGETS.find((t) => t.host === ctx.host.host);
+        if (!tgt) {
+            return {
+                kernel: 'hook-file',
+                host: ctx.host.host,
+                level: 'absent',
+                checks: [{ name: 'host-supported', ok: false, detail: `${ctx.host.host} 不在 hook-file 内核范围` }],
+            };
+        }
+        const filePath = tgt.configPath(ctx.cwd);
+        const exists = existsSync(filePath);
+        if (!exists) {
+            return {
+                kernel: 'hook-file',
+                host: ctx.host.host,
+                level: 'absent',
+                checks: [
+                    { name: 'config-file-exists', ok: false, detail: filePath },
+                ],
+            };
+        }
+        // 简单读取检查 marker
+        let registered = false;
+        try {
+            const { readFileSync } = await import('node:fs');
+            const raw = readFileSync(filePath, 'utf-8');
+            registered = raw.includes(SKILLFM_GUARD_COMMAND);
+        }
+        catch {
+            // ignore
+        }
+        return {
+            kernel: 'hook-file',
+            host: ctx.host.host,
+            level: registered ? 'strong' : 'absent',
+            checks: [
+                { name: 'config-file-exists', ok: true, detail: filePath },
+                { name: 'skillfm-guard-registered', ok: registered },
+            ],
+        };
+    },
+};
+// ============================================================================
+// 用户级补充路径（Claude Code 用户可选 ~/.claude/settings.json fallback；
+// Windsurf 用户级 fallback ~/.codeium/windsurf/hooks.json — M9 P0 不强写）
+// ============================================================================
+export function userScopeHintFor(host) {
+    switch (host) {
+        case 'claude-code':
+            return join(homedir(), '.claude', 'settings.json');
+        case 'windsurf':
+            return join(homedir(), '.codeium', 'windsurf', 'hooks.json');
+        case 'cursor':
+            return join(homedir(), '.cursor', 'hooks.json');
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=hook-file.js.map

package/dist/harness/kernels/hook-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-file.js","sourceRoot":"","sources":["../../../src/harness/kernels/hook-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,iBAAiB,CAAC;AAsBzB,MAAM,OAAO,GAAqB;IAChC,6EAA6E;IAC7E,sCAAsC;IACtC,6EAA6E;IAC7E;QACE,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC;QAC1D,KAAK,EAAE,GAAG,EAAE;YACV,uDAAuD;YACvD,yDAAyD;YACzD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;KACF;IAED,6EAA6E;IAC7E,mCAAmC;IACnC,uBAAuB;IACvB,2FAA2F;IAC3F,mDAAmD;IACnD,6EAA6E;IAC7E;QACE,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC;QACvD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC;YAC5C,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC5C,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,MAAM,KAAK,GAAI,IAA4C,EAAE,KAAK,IAAI,EAAE,CAAC;gBACzE,OAAO,cAAc,CAClB,KAAiC,CAAC,UAAU,EAC7C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;gBACnB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9C,eAAe;gBACf,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAClD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,qBAAqB,CAAC,EAAE,CAAC;oBAC/C,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,qBAAqB,gBAAgB,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,4CAA4C;gBAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC;oBACP,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,GAAG,qBAAqB,gCAAgC;iBAClE,CAAC,CAAC;gBACH,wBAAwB;gBACxB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC;oBACR,OAAO,EAAE,yBAAyB;oBAClC,OAAO,EAAE,GAAG,qBAAqB,iCAAiC;iBACnE,CAAC,CAAC;gBACH,+CAA+C;gBAC/C,IAAK,IAAgC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC9D,IAAgC,CAAC,UAAU,GAAG,KAAK,CAAC;gBACvD,CAAC;YACH,CAAC;SACF,CAAC;KACH;IAED,6EAA6E;IAC7E,0CAA0C;IAC1C,uBAAuB;IACvB,6GAA6G;IAC7G,2BAA2B;IAC3B,6EAA6E;IAC7E;QACE,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC;QACzD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC;YAC9C,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAChC,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,MAAM,KAAK,GAAI,IAA4C,EAAE,KAAK,IAAI,EAAE,CAAC;gBACzE,OAAO,CACL,cAAc,CACX,KAAiC,CAAC,cAAc,EACjD,qBAAqB,CACtB;oBACD,cAAc,CACX,KAAiC,CAAC,eAAe,EAClD,qBAAqB,CACtB,CACF,CAAC;YACJ,CAAC;YACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;gBACnB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAE9C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,GAAG,qBAAqB,+CAA+C;oBAChF,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;gBACzD,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,GAAG,qBAAqB,8CAA8C;oBAC/E,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,GAAG,qBAAqB,6CAA6C;oBAC9E,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;SACF,CAAC;KACH;CACF,CAAC;AAEF,MAAM,SAAS,GAAsB,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAE3E,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,IAAI,EAAE,WAAW;IACjB,cAAc,EAAE,SAAS;IAEzB,OAAO,CAAC,IAAc;QACpB,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAmB;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,EAAE;gBACT,QAAQ,EAAE,CAAC,+BAA+B,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,4EAA4E;YAC5E,MAAM,MAAM,GACV,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB;gBAClF,CAAC,CAAC,CAAC,CAAC,MAAM;gBACV,CAAC,CAAC,MAAM,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACvD,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK;SACnB,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;YACnB,KAAK,EAAE,CAAC,SAAS,CAAC;YAClB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAmB;QACjC,wCAAwC;QACxC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;YACnB,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE;gBACR,yDAAyD;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAmB;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,CAAC;aAC9F,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;iBAC5D;aACF,CAAC;QACJ,CAAC;QACD,gBAAgB;QAChB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5C,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;YACnB,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvC,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAC1D,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,UAAU,EAAE;aACrD;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,+EAA+E;AAC/E,6DAA6D;AAC7D,oEAAoE;AACpE,+EAA+E;AAE/E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QACrD,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAC/D,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAClD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/harness/kernels/json-merge.d.ts

@@ -0,0 +1,45 @@
+/**
+ * BSO M9 v0.3 — Layer 3 共用工具：JSON 文件 idempotent merge + backup
+ *
+ * 抽出原 writers.ts mergeClaudeSettings 中的通用模式，让 hook-file /
+ * deny-pipeline / mcp-only 三个 kernel 共享一套逻辑。
+ *
+ * 行为：
+ *   - 文件不存在 → 创建，action='created'
+ *   - 文件存在 → backup 到 ~/.skillfm/backups/<ts>/，深度合并 patch
+ *   - 已注册（marker 命中）→ skip，action='already-registered'
+ *   - 文件不是合法 JSON → 抛 SKILLFM.HARNESS.PARSE_FAILED
+ */
+import type { InstalledFile } from './types.js';
+export interface JsonMergeOptions {
+    /** 目标文件绝对路径 */
+    filePath: string;
+    /**
+     * 已注册检测器：返回 true 表示该 patch 已经在 data 内，跳过写入。
+     * 例如 hook-file 检查 hooks.PreToolUse 数组里 command 是否含 SKILLFM_GUARD_COMMAND。
+     */
+    isAlreadyRegistered: (data: unknown) => boolean;
+    /**
+     * 合并函数：把 patch 内容深度合并到 data。原地修改 data，返回 void。
+     * 调用方负责保证语义（数组 append vs object merge）。
+     */
+    mergePatch: (data: Record<string, unknown>) => void;
+    /** 默认空对象时的初始 JSON（如某些文件需要 `{ "version": 1 }`） */
+    emptyJson?: () => Record<string, unknown>;
+    /** 是否 dry-run（不落盘，仅返回预期 action） */
+    dryRun?: boolean;
+}
+export declare function mergeJsonFile(opts: JsonMergeOptions): InstalledFile;
+/**
+ * 检查 array 中是否已有任何 entry 的 stringify 含 marker（粗粒度去重）。
+ */
+export declare function arrayHasMarker(array: unknown, marker: string): boolean;
+/**
+ * Ensure path `data[k1][k2]...` exists as object, return innermost ref.
+ */
+export declare function ensureObjectPath(data: Record<string, unknown>, ...keys: string[]): Record<string, unknown>;
+/**
+ * Ensure path `data[k1][k2]...` exists as array, return ref.
+ */
+export declare function ensureArrayPath(data: Record<string, unknown>, ...keys: string[]): unknown[];
+//# sourceMappingURL=json-merge.d.ts.map

package/dist/harness/kernels/json-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-merge.d.ts","sourceRoot":"","sources":["../../../src/harness/kernels/json-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMhD,MAAM,WAAW,gBAAgB;IAC/B,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD;;;OAGG;IACH,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACpD,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,mCAAmC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAMD,wBAAgB,aAAa,CAAC,IAAI,EAAE,gBAAgB,GAAG,aAAa,CA4DnE;AAMD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAStE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,IAAI,EAAE,MAAM,EAAE,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,IAAI,EAAE,MAAM,EAAE,GAChB,OAAO,EAAE,CAWX"}