@smeltjs/core 0.1.0 → 0.2.0

package/dist/hooks/shim.js

@@ -0,0 +1,107 @@
+import process from 'node:process';
+import { decide, isMainModule, parseGuardRequest, readAllOfStdin, readGuardSettings, } from './guard-core.js';
+/** The pure half of the shim loop, for tests: raw harness input → rendered output. */
+export function renderShimDecision(adapter, raw, settings, cwd, statFile) {
+    const request = adapter.toRequest(raw);
+    if (request === undefined)
+        return adapter.pass();
+    const effectiveCwd = adapter.cwd?.(raw) ?? cwd;
+    const decision = statFile === undefined
+        ? decide(request, settings, effectiveCwd)
+        : decide(request, settings, effectiveCwd, statFile);
+    if (decision.action === 'allow')
+        return adapter.pass();
+    if (settings.enforcement === 'rewrite' &&
+        adapter.rewrite !== undefined &&
+        request.tool === 'Bash' &&
+        decision.suggestion !== undefined) {
+        return adapter.rewrite(raw, request, decision);
+    }
+    return adapter.deny(raw, request, decision);
+}
+/**
+ * The whole shim as a process: read the harness's stdin, decide, render, exit.
+ * Fail open exactly like the guard core — unparseable stdin passes with a stderr
+ * warning, and an unexpected error passes too. A shim crash must never read as a
+ * policy decision.
+ */
+export function runShimMain(adapter) {
+    let output;
+    try {
+        const text = readAllOfStdin();
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            process.stderr.write(`smelt shim: stdin was not JSON — allowing the call. Fix the hook wiring.\n`);
+            raw = undefined;
+        }
+        if (raw === undefined) {
+            output = adapter.pass();
+        }
+        else {
+            const settings = readGuardSettings(process.cwd(), (text_) => process.stderr.write(`${text_}\n`));
+            output = renderShimDecision(adapter, raw, settings, process.cwd());
+        }
+    }
+    catch (error) {
+        process.stderr.write(`smelt shim: unexpected error — allowing the call. ` +
+            `${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+        output = adapter.pass();
+    }
+    if (output.stderr !== undefined && output.stderr !== '')
+        process.stderr.write(output.stderr);
+    if (output.stdout !== '')
+        process.stdout.write(output.stdout);
+    process.exitCode = output.exitCode;
+}
+/**
+ * Map one `{tool name, tool input}` pair — the shape every surveyed harness feeds its
+ * pre-tool hook, under varying key spellings — onto a {@link GuardRequest}.
+ * `undefined` for tools the guard has no opinion on: pass through.
+ */
+export function toolCallRequest(toolName, toolInput, names) {
+    if (typeof toolName !== 'string')
+        return undefined;
+    const input = typeof toolInput === 'object' && toolInput !== null && !Array.isArray(toolInput)
+        ? toolInput
+        : {};
+    if (names.read.includes(toolName)) {
+        const path = firstString(input, ['file_path', 'path', 'absolute_path', 'filePath']);
+        if (path === undefined)
+            return undefined;
+        const offsetLimited = firstDefined(input, ['offset', 'limit', 'start_line', 'end_line']) !== undefined;
+        return { tool: 'Read', input: { path, offsetLimited } };
+    }
+    if (names.bash.includes(toolName)) {
+        const command = firstString(input, ['command']);
+        if (command === undefined)
+            return undefined;
+        return { tool: 'Bash', input: { command } };
+    }
+    return undefined;
+}
+function firstString(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === 'string' && value !== '')
+            return value;
+    }
+    return undefined;
+}
+function firstDefined(input, keys) {
+    for (const key of keys) {
+        if (input[key] !== undefined && input[key] !== null)
+            return input[key];
+    }
+    return undefined;
+}
+/** The raw stdin as a keyed record, or an empty record when it is not object-shaped. */
+export function asRecord(raw) {
+    return typeof raw === 'object' && raw !== null && !Array.isArray(raw)
+        ? raw
+        : {};
+}
+export { isMainModule, parseGuardRequest };
+//# sourceMappingURL=shim.js.map

package/dist/hooks/shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.js","sourceRoot":"","sources":["../../src/hooks/shim.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,MAAM,EACN,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAmEzB,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,GAAY,EACZ,QAAuB,EACvB,GAAW,EACX,QAAuC;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAC/C,MAAM,QAAQ,GACZ,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,CAAC,IAAI,KAAK,MAAM;QACvB,QAAQ,CAAC,UAAU,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,CAC7E,CAAC;YACF,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CACnC,CAAC;YACF,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDAAoD;YAClD,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACjF,CAAC;QACF,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAiB,EACjB,SAAkB,EAClB,KAA6E;IAE7E,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,CAAC,CAAE,SAAqC;QACxC,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,aAAa,GACjB,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,KAAK,SAAS,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,IAAuB;IAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,IAAuB;IAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnE,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/hooks/shims/claude-code.d.ts

@@ -0,0 +1,23 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Claude Code shim — VERIFIED tier.
+ *
+ * Schema per <https://code.claude.com/docs/en/hooks> (verified 2026-09-02; the deep
+ * dive is docs/research/2026-09-02-agent-enforcement.md § 1):
+ *
+ *  - stdin: `{ hook_event_name: "PreToolUse", tool_name, tool_input, cwd }`. For
+ *    `Read`, `tool_input.file_path` is already absolute and `offset`/`limit` mark a
+ *    windowed read; for `Bash`, `tool_input.command` is the full command string, and
+ *    a relative path in it resolves against the payload's `cwd` — the *session's*
+ *    working directory, which after the model `cd`s differs from this hook
+ *    process's own cwd.
+ *  - deny: `hookSpecificOutput.permissionDecision: "deny"` with
+ *    `permissionDecisionReason` — which is **shown to the model**, so the guard's
+ *    reason (the exact replacement command, the `smelt retrieve` contract) lands in
+ *    the transcript as steering.
+ *  - rewrite (opt-in, `hooks.enforcement: "rewrite"`): `updatedInput` replaces the
+ *    entire input object of the *same* tool (v2.0.10+), so a Bash command can be
+ *    substituted but a Read can never become a Bash call — Reads deny in every mode.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/hooks/shims/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/claude-code.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,OAAO,EAAE,WAqCrB,CAAC"}

package/dist/hooks/shims/claude-code.js

@@ -0,0 +1,61 @@
+import { asRecord, isMainModule, runShimMain, toolCallRequest } from '../shim.js';
+/**
+ * Claude Code shim — VERIFIED tier.
+ *
+ * Schema per <https://code.claude.com/docs/en/hooks> (verified 2026-09-02; the deep
+ * dive is docs/research/2026-09-02-agent-enforcement.md § 1):
+ *
+ *  - stdin: `{ hook_event_name: "PreToolUse", tool_name, tool_input, cwd }`. For
+ *    `Read`, `tool_input.file_path` is already absolute and `offset`/`limit` mark a
+ *    windowed read; for `Bash`, `tool_input.command` is the full command string, and
+ *    a relative path in it resolves against the payload's `cwd` — the *session's*
+ *    working directory, which after the model `cd`s differs from this hook
+ *    process's own cwd.
+ *  - deny: `hookSpecificOutput.permissionDecision: "deny"` with
+ *    `permissionDecisionReason` — which is **shown to the model**, so the guard's
+ *    reason (the exact replacement command, the `smelt retrieve` contract) lands in
+ *    the transcript as steering.
+ *  - rewrite (opt-in, `hooks.enforcement: "rewrite"`): `updatedInput` replaces the
+ *    entire input object of the *same* tool (v2.0.10+), so a Bash command can be
+ *    substituted but a Read can never become a Bash call — Reads deny in every mode.
+ */
+export const adapter = {
+    toRequest: (raw) => {
+        const fields = asRecord(raw);
+        return toolCallRequest(fields['tool_name'], fields['tool_input'], {
+            read: ['Read'],
+            bash: ['Bash'],
+        });
+    },
+    cwd: (raw) => {
+        const cwd = asRecord(raw)['cwd'];
+        return typeof cwd === 'string' && cwd !== '' ? cwd : undefined;
+    },
+    pass: () => ({ stdout: '', exitCode: 0 }),
+    deny: (_raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'deny',
+                permissionDecisionReason: decision.reason ?? 'denied by the smelt guard',
+            },
+        })}\n`,
+        exitCode: 0,
+    }),
+    rewrite: (raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'allow',
+                permissionDecisionReason: `smelt rewrote this command (hooks.enforcement: "rewrite"): ` +
+                    `${decision.suggestion ?? ''}`,
+                // updatedInput replaces the whole input object — unchanged fields ride along.
+                updatedInput: { ...asRecord(asRecord(raw)['tool_input']), command: decision.suggestion },
+            },
+        })}\n`,
+        exitCode: 0,
+    }),
+};
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=claude-code.js.map

package/dist/hooks/shims/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/hooks/shims/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;YAChE,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;IACL,CAAC;IACD,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B;aACzE;SACF,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,OAAO;gBAC3B,wBAAwB,EACtB,6DAA6D;oBAC7D,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE;gBAChC,8EAA8E;gBAC9E,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;aACzF;SACF,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;CACH,CAAC;AAEF,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/hooks/shims/cline.d.ts

@@ -0,0 +1,17 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Cline shim — EXPERIMENTAL tier: schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Cline row; primary source
+ * <https://docs.cline.bot/features/hooks>), not yet smoke-tested against the real
+ * binary.
+ *
+ *  - event: `PreToolUse`, delivered to an executable under `.clinerules/hooks/`;
+ *    stdin carries the tool call (accepted spellings: `tool_name`/`tool_input`,
+ *    `toolName`/`toolInput`, or nested under `preToolUse`).
+ *  - deny: `{ "cancel": true, "errorMessage": … }`. **Deny-only**: the response
+ *    schema has no input-modification field, so under
+ *    `hooks.enforcement: "rewrite"` this harness falls back to the deny, whose
+ *    reason still carries the exact replacement pipeline.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=cline.d.ts.map

package/dist/hooks/shims/cline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/cline.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,OAAO,EAAE,WAqBrB,CAAC"}

package/dist/hooks/shims/cline.js

@@ -0,0 +1,39 @@
+import { asRecord, isMainModule, runShimMain, toolCallRequest } from '../shim.js';
+/**
+ * Cline shim — EXPERIMENTAL tier: schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Cline row; primary source
+ * <https://docs.cline.bot/features/hooks>), not yet smoke-tested against the real
+ * binary.
+ *
+ *  - event: `PreToolUse`, delivered to an executable under `.clinerules/hooks/`;
+ *    stdin carries the tool call (accepted spellings: `tool_name`/`tool_input`,
+ *    `toolName`/`toolInput`, or nested under `preToolUse`).
+ *  - deny: `{ "cancel": true, "errorMessage": … }`. **Deny-only**: the response
+ *    schema has no input-modification field, so under
+ *    `hooks.enforcement: "rewrite"` this harness falls back to the deny, whose
+ *    reason still carries the exact replacement pipeline.
+ */
+export const adapter = {
+    toRequest: (raw) => {
+        const fields = asRecord(raw);
+        const nested = asRecord(fields['preToolUse']);
+        const name = fields['tool_name'] ?? fields['toolName'] ?? nested['toolName'] ?? nested['tool'];
+        const input = fields['tool_input'] ?? fields['toolInput'] ?? nested['toolInput'] ?? nested['input'];
+        return toolCallRequest(name, input, {
+            read: ['Read', 'read_file', 'readFile'],
+            bash: ['Bash', 'execute_command', 'executeCommand', 'shell'],
+        });
+    },
+    pass: () => ({ stdout: '', exitCode: 0 }),
+    deny: (_raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            cancel: true,
+            errorMessage: decision.reason ?? 'denied by the smelt guard',
+        })}\n`,
+        exitCode: 0,
+    }),
+    // No `rewrite`: Cline's PreToolUse response cannot modify tool input (deny-only).
+};
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=cline.js.map

package/dist/hooks/shims/cline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../../src/hooks/shims/cline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/F,MAAM,KAAK,GACT,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACxF,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE;YAClC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC;YACvC,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B;SAC7D,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,kFAAkF;CACnF,CAAC;AAEF,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/hooks/shims/codex.d.ts

@@ -0,0 +1,23 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Codex CLI shim — VERIFIED tier.
+ *
+ * Codex's experimental hooks (`features.hooks`, rust-v0.114.0+, on by default from
+ * 0.150.1) deliberately mirror Claude Code's schema — the survey is
+ * docs/research/2026-09-02-agent-enforcement.md § 3, primary source
+ * <https://developers.openai.com/codex/hooks>:
+ *
+ *  - stdin: `{ tool_name, tool_input }`; shell input arrives as `tool_name: "Bash"`,
+ *    `tool_input.command`.
+ *  - deny: `hookSpecificOutput.permissionDecision: "deny"` + reason (or exit 2).
+ *  - rewrite: `permissionDecision: "allow"` with `updatedInput` — for Bash,
+ *    `updatedInput` **must include a string `command` field**, which this shim's
+ *    rewrite always does.
+ *
+ * Two documented differences from Claude Code, both honoured here:
+ * `permissionDecision: "ask"` is NOT supported (a parse error — the tool proceeds),
+ * and this shim never emits it; project-layer hooks only run once the project is
+ * trusted, which the installer's output says out loud.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=codex.d.ts.map

package/dist/hooks/shims/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/codex.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,OAAO,EAAE,WAgCrB,CAAC"}

package/dist/hooks/shims/codex.js

@@ -0,0 +1,56 @@
+import { asRecord, isMainModule, runShimMain, toolCallRequest } from '../shim.js';
+/**
+ * Codex CLI shim — VERIFIED tier.
+ *
+ * Codex's experimental hooks (`features.hooks`, rust-v0.114.0+, on by default from
+ * 0.150.1) deliberately mirror Claude Code's schema — the survey is
+ * docs/research/2026-09-02-agent-enforcement.md § 3, primary source
+ * <https://developers.openai.com/codex/hooks>:
+ *
+ *  - stdin: `{ tool_name, tool_input }`; shell input arrives as `tool_name: "Bash"`,
+ *    `tool_input.command`.
+ *  - deny: `hookSpecificOutput.permissionDecision: "deny"` + reason (or exit 2).
+ *  - rewrite: `permissionDecision: "allow"` with `updatedInput` — for Bash,
+ *    `updatedInput` **must include a string `command` field**, which this shim's
+ *    rewrite always does.
+ *
+ * Two documented differences from Claude Code, both honoured here:
+ * `permissionDecision: "ask"` is NOT supported (a parse error — the tool proceeds),
+ * and this shim never emits it; project-layer hooks only run once the project is
+ * trusted, which the installer's output says out loud.
+ */
+export const adapter = {
+    toRequest: (raw) => {
+        const fields = asRecord(raw);
+        return toolCallRequest(fields['tool_name'], fields['tool_input'], {
+            read: ['Read'],
+            bash: ['Bash', 'shell'],
+        });
+    },
+    pass: () => ({ stdout: '', exitCode: 0 }),
+    deny: (_raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'deny',
+                permissionDecisionReason: decision.reason ?? 'denied by the smelt guard',
+            },
+        })}\n`,
+        exitCode: 0,
+    }),
+    rewrite: (raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'allow',
+                permissionDecisionReason: `smelt rewrote this command (hooks.enforcement: "rewrite"): ` +
+                    `${decision.suggestion ?? ''}`,
+                updatedInput: { ...asRecord(asRecord(raw)['tool_input']), command: decision.suggestion },
+            },
+        })}\n`,
+        exitCode: 0,
+    }),
+};
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=codex.js.map

package/dist/hooks/shims/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/hooks/shims/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;YAChE,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B;aACzE;SACF,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,OAAO;gBAC3B,wBAAwB,EACtB,6DAA6D;oBAC7D,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE;gBAChC,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;aACzF;SACF,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;CACH,CAAC;AAEF,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/hooks/shims/cursor.d.ts

@@ -0,0 +1,19 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Cursor CLI/agent shim — EXPERIMENTAL tier: schema mapped from the capability
+ * matrix (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary
+ * source <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the
+ * real binary.
+ *
+ *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it
+ *    supports input rewrite); stdin `{ tool_name, tool_input }`.
+ *  - deny: `{ "permission": "deny", "agentMessage": … }` — `agentMessage` reaches
+ *    the model, `userMessage` the human; the guard's steering text goes to the model.
+ *  - rewrite: `{ "permission": "allow", "updated_input": { … } }` (snake_case, the
+ *    whole input object).
+ *
+ * Cursor has no static permission-config file — gating is entirely hook code — so
+ * this shim plus the instruction file is the whole enforcement story there.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/hooks/shims/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/cursor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,OAAO,EAAE,WA2BrB,CAAC"}

package/dist/hooks/shims/cursor.js

@@ -0,0 +1,47 @@
+import { asRecord, isMainModule, runShimMain, toolCallRequest } from '../shim.js';
+/**
+ * Cursor CLI/agent shim — EXPERIMENTAL tier: schema mapped from the capability
+ * matrix (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary
+ * source <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the
+ * real binary.
+ *
+ *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it
+ *    supports input rewrite); stdin `{ tool_name, tool_input }`.
+ *  - deny: `{ "permission": "deny", "agentMessage": … }` — `agentMessage` reaches
+ *    the model, `userMessage` the human; the guard's steering text goes to the model.
+ *  - rewrite: `{ "permission": "allow", "updated_input": { … } }` (snake_case, the
+ *    whole input object).
+ *
+ * Cursor has no static permission-config file — gating is entirely hook code — so
+ * this shim plus the instruction file is the whole enforcement story there.
+ */
+export const adapter = {
+    toRequest: (raw) => {
+        const fields = asRecord(raw);
+        return toolCallRequest(fields['tool_name'], fields['tool_input'], {
+            read: ['read_file', 'Read', 'ReadFile'],
+            bash: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],
+        });
+    },
+    pass: () => ({ stdout: '', exitCode: 0 }),
+    deny: (_raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            permission: 'deny',
+            agentMessage: decision.reason ?? 'denied by the smelt guard',
+        })}\n`,
+        exitCode: 0,
+    }),
+    rewrite: (raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            permission: 'allow',
+            updated_input: { ...asRecord(asRecord(raw)['tool_input']), command: decision.suggestion },
+        })}\n`,
+        // The allow/updated_input shape carries no message field — announce on stderr.
+        stderr: `smelt guard (rewrite mode): substituted the command in-flight with ` +
+            `\`${decision.suggestion ?? ''}\`. ${decision.reason ?? ''}\n`,
+        exitCode: 0,
+    }),
+};
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=cursor.js.map

package/dist/hooks/shims/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../../src/hooks/shims/cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;YAChE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;YACvC,IAAI,EAAE,CAAC,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B;SAC7D,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;SAC1F,CAAC,IAAI;QACN,+EAA+E;QAC/E,MAAM,EACJ,qEAAqE;YACrE,KAAK,QAAQ,CAAC,UAAU,IAAI,EAAE,OAAO,QAAQ,CAAC,MAAM,IAAI,EAAE,IAAI;QAChE,QAAQ,EAAE,CAAC;KACZ,CAAC;CACH,CAAC;AAEF,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/hooks/shims/gemini.d.ts

@@ -0,0 +1,23 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Gemini CLI shim — EXPERIMENTAL tier: the schema below is mapped from the
+ * capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Gemini
+ * CLI row; primary source <https://geminicli.com/docs/hooks/reference/>), and the
+ * field names were additionally checked 2026-09-02 against the shipped
+ * `@google/gemini-cli` 0.58.0 bundle (installed headlessly for KOT-212's
+ * verification pass): the BeforeTool stdin payload is `{ tool_name, tool_input }`,
+ * `read_file` takes `file_path` with `start_line`/`end_line` windows, the shell
+ * tool is `run_shell_command` with `command`, denial is `{ "decision": "deny",
+ * "reason": … }`, and `hookSpecificOutput.tool_input` substitutes the input. What
+ * has NOT run is a live end-to-end session (needs credentials this environment does
+ * not have), so the tier stays experimental — treat surprises as shim bugs and
+ * please report them.
+ *
+ * Carried caveat from the matrix: Gemini's policy engine has an open bug where an
+ * `allow` policy is ignored in non-interactive runs
+ * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses
+ * hooks, not the policy engine, but non-interactive behaviour is the least-tested
+ * corner; verify before relying on it in CI.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=gemini.d.ts.map

package/dist/hooks/shims/gemini.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/gemini.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,OAAO,EAAE,WA6BrB,CAAC"}

package/dist/hooks/shims/gemini.js

@@ -0,0 +1,53 @@
+import { asRecord, isMainModule, runShimMain, toolCallRequest } from '../shim.js';
+/**
+ * Gemini CLI shim — EXPERIMENTAL tier: the schema below is mapped from the
+ * capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Gemini
+ * CLI row; primary source <https://geminicli.com/docs/hooks/reference/>), and the
+ * field names were additionally checked 2026-09-02 against the shipped
+ * `@google/gemini-cli` 0.58.0 bundle (installed headlessly for KOT-212's
+ * verification pass): the BeforeTool stdin payload is `{ tool_name, tool_input }`,
+ * `read_file` takes `file_path` with `start_line`/`end_line` windows, the shell
+ * tool is `run_shell_command` with `command`, denial is `{ "decision": "deny",
+ * "reason": … }`, and `hookSpecificOutput.tool_input` substitutes the input. What
+ * has NOT run is a live end-to-end session (needs credentials this environment does
+ * not have), so the tier stays experimental — treat surprises as shim bugs and
+ * please report them.
+ *
+ * Carried caveat from the matrix: Gemini's policy engine has an open bug where an
+ * `allow` policy is ignored in non-interactive runs
+ * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses
+ * hooks, not the policy engine, but non-interactive behaviour is the least-tested
+ * corner; verify before relying on it in CI.
+ */
+export const adapter = {
+    toRequest: (raw) => {
+        const fields = asRecord(raw);
+        return toolCallRequest(fields['tool_name'], fields['tool_input'], {
+            read: ['read_file', 'ReadFile', 'Read'],
+            bash: ['run_shell_command', 'Shell', 'Bash'],
+        });
+    },
+    pass: () => ({ stdout: '', exitCode: 0 }),
+    deny: (_raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            decision: 'deny',
+            reason: decision.reason ?? 'denied by the smelt guard',
+        })}\n`,
+        exitCode: 0,
+    }),
+    rewrite: (raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'BeforeTool',
+                tool_input: { ...asRecord(asRecord(raw)['tool_input']), command: decision.suggestion },
+            },
+        })}\n`,
+        // The BeforeTool rewrite shape carries no reason field — announce on stderr.
+        stderr: `smelt guard (rewrite mode): substituted the command in-flight with ` +
+            `\`${decision.suggestion ?? ''}\`. ${decision.reason ?? ''}\n`,
+        exitCode: 0,
+    }),
+};
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=gemini.js.map

package/dist/hooks/shims/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../src/hooks/shims/gemini.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;YAChE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;YACvC,IAAI,EAAE,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B;SACvD,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;aACvF;SACF,CAAC,IAAI;QACN,6EAA6E;QAC7E,MAAM,EACJ,qEAAqE;YACrE,KAAK,QAAQ,CAAC,UAAU,IAAI,EAAE,OAAO,QAAQ,CAAC,MAAM,IAAI,EAAE,IAAI;QAChE,QAAQ,EAAE,CAAC;KACZ,CAAC;CACH,CAAC;AAEF,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/hooks/shims/grok.d.ts

@@ -0,0 +1,18 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Grok CLI shim — EXPERIMENTAL tier: schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary
+ * source <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against
+ * the real binary. Note the matrix's provenance warning: the official CLI is
+ * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party
+ * clone with a different hook surface.
+ *
+ *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool
+ *    names).
+ *  - deny: `{ "decision": "deny", "reason": … }` or exit 2. **Deny-only**: the input
+ *    is read-only to hooks, so there is no rewrite here — under
+ *    `hooks.enforcement: "rewrite"` this harness falls back to the deny, whose
+ *    reason still carries the exact replacement pipeline.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=grok.d.ts.map

package/dist/hooks/shims/grok.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/grok.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO,EAAE,WAiBrB,CAAC"}

package/dist/hooks/shims/grok.js

@@ -0,0 +1,37 @@
+import { asRecord, isMainModule, runShimMain, toolCallRequest } from '../shim.js';
+/**
+ * Grok CLI shim — EXPERIMENTAL tier: schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary
+ * source <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against
+ * the real binary. Note the matrix's provenance warning: the official CLI is
+ * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party
+ * clone with a different hook surface.
+ *
+ *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool
+ *    names).
+ *  - deny: `{ "decision": "deny", "reason": … }` or exit 2. **Deny-only**: the input
+ *    is read-only to hooks, so there is no rewrite here — under
+ *    `hooks.enforcement: "rewrite"` this harness falls back to the deny, whose
+ *    reason still carries the exact replacement pipeline.
+ */
+export const adapter = {
+    toRequest: (raw) => {
+        const fields = asRecord(raw);
+        return toolCallRequest(fields['tool_name'], fields['tool_input'], {
+            read: ['Read', 'read_file', 'ReadFile'],
+            bash: ['Bash', 'shell', 'run_shell_command'],
+        });
+    },
+    pass: () => ({ stdout: '', exitCode: 0 }),
+    deny: (_raw, _request, decision) => ({
+        stdout: `${JSON.stringify({
+            decision: 'deny',
+            reason: decision.reason ?? 'denied by the smelt guard',
+        })}\n`,
+        exitCode: 0,
+    }),
+    // No `rewrite`: Grok's PreToolUse cannot modify tool input (deny-only harness).
+};
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=grok.js.map

package/dist/hooks/shims/grok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../../src/hooks/shims/grok.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;YAChE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC;YACvC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B;SACvD,CAAC,IAAI;QACN,QAAQ,EAAE,CAAC;KACZ,CAAC;IACF,gFAAgF;CACjF,CAAC;AAEF,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC"}

package/dist/hooks/shims/hermes.d.ts

@@ -0,0 +1,22 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Hermes Agent shim — EXPERIMENTAL tier: schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary
+ * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>),
+ * not yet smoke-tested against the real binary.
+ *
+ *  - event: `pre_tool_call`; stdin carries the tool name and its arguments
+ *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).
+ *  - deny: `{ "action": "block", "reason": … }`.
+ *  - rewrite: `{ "action": "modify", "args": { … } }` — a **shallow merge** into the
+ *    tool's arguments, so this shim sends only the `command` key and the harness
+ *    keeps the rest. The modify schema has **no reason field**, so the substitution
+ *    is announced on stderr — a rewrite must never be silent.
+ *
+ * Carried caveat from the matrix: Hermes has a known bypass where memory tools
+ * ignore `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —
+ * tool gating there is leaky at the edges, so treat this hook as best-effort
+ * steering, not a boundary.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=hermes.d.ts.map

package/dist/hooks/shims/hermes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/hermes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,OAAO,EAAE,WA2BrB,CAAC"}