@smeltjs/core 0.1.0 → 0.3.0

package/dist/hooks/shim.d.ts

@@ -0,0 +1,176 @@
+import { decide, isMainModule } from './guard-core.ts';
+import type { GuardDecision, GuardRequest, GuardSettings } from './guard-core.ts';
+/**
+ * The shim runtime — the one loop every per-harness shim runs.
+ *
+ * A shim is a thin adapter: it maps its harness's native PreToolUse stdin schema
+ * onto a {@link GuardRequest}, hands that to the guard core, and renders the
+ * {@link GuardDecision} back in the harness's native output schema. All policy —
+ * threshold, windows, suggestion rendering, enforcement mode — lives in
+ * `guard-core.ts`; a shim that grew an opinion of its own would be a second guard
+ * that drifts from the first.
+ *
+ * Most of a shim is a *table*, not code: which tool names mean read and shell, which
+ * payload keys carry them, and the two documents the harness's schema wants back. That
+ * table is a {@link HarnessHookSchema}, `shimFromSchema` turns one into a
+ * {@link ShimAdapter}, and every harness's schema lives in its profile
+ * (`src/harness/<id>.ts`). {@link ShimAdapter} stays public as the escape hatch for a
+ * harness a table cannot express.
+ *
+ * The enforcement gate lives here, once, because it is the same for every harness:
+ *
+ *  - **deny mode (the default)**: a deny is rendered as the harness's deny, with the
+ *    guard's steering reason. The transcript stays truthful — the model sees what it
+ *    asked for refused and why, and learns to run the replacement (and
+ *    `smelt retrieve`) itself.
+ *  - **rewrite mode (`hooks.enforcement: "rewrite"` in smelt.config.json)**: when the
+ *    denied call is a Bash command, the guard produced a faithful executable
+ *    `suggestion`, and this harness can modify tool input, the shim substitutes the
+ *    suggestion instead of denying. A harness that cannot rewrite falls back to the
+ *    deny — with the exact command in the reason — so rewrite mode never silently
+ *    weakens into nothing. A substitution is always announced: in the decision
+ *    reason where the harness's rewrite schema carries one (Claude Code, Codex),
+ *    and on stderr where it does not (Gemini, Cursor, Hermes, the opencode
+ *    plugin) — a rewrite nobody can see would change what the model asked for
+ *    without telling anyone. And a shim never rewrites in deny mode: a silent
+ *    rewrite changes what the model asked for without telling it, which is this
+ *    project's signature failure shape applied to the harness.
+ */
+/** What one harness shim supplies. Everything else is {@link runShim}'s. */
+export interface ShimAdapter {
+    /** Map the harness's raw stdin JSON to a guard request; `undefined` = pass through. */
+    readonly toRequest: (raw: unknown) => GuardRequest | undefined;
+    /**
+     * The working directory tool-relative paths resolve against, read from the raw
+     * payload when the harness sends one (Claude Code's hook stdin carries `cwd`: the
+     * *session's* Bash cwd, which after a `cd` differs from this hook process's own).
+     * `undefined` falls back to the shim process's cwd.
+     */
+    readonly cwd?: (raw: unknown) => string | undefined;
+    /** Render an allow. Most harnesses: empty stdout, exit 0. */
+    readonly pass: () => ShimOutput;
+    /** Render a deny, in the harness's schema. */
+    readonly deny: (raw: unknown, request: GuardRequest, decision: GuardDecision) => ShimOutput;
+    /**
+     * Render an input rewrite (only ever called for a Bash-shaped request whose
+     * decision carries a faithful `suggestion`, and only in rewrite mode). Omit on
+     * harnesses whose hook schema cannot modify tool input — they deny instead. A
+     * schema with no reason channel must announce the substitution via `stderr`.
+     */
+    readonly rewrite?: (raw: unknown, request: GuardRequest, decision: GuardDecision) => ShimOutput;
+}
+/** What a shim writes and how it exits. `stdout` is a complete JSON line or ''. */
+export interface ShimOutput {
+    readonly stdout: string;
+    /** Written to the shim process's stderr — the announcement channel for harnesses
+     * whose rewrite schema has no reason field. Never a decision by itself. */
+    readonly stderr?: string;
+    readonly exitCode: number;
+}
+/** The pure half of the shim loop, for tests: raw harness input → rendered output. */
+export declare function renderShimDecision(adapter: ShimAdapter, raw: unknown, settings: GuardSettings, cwd: string, statFile?: Parameters<typeof decide>[3]): ShimOutput;
+/**
+ * The whole shim as a process: read the harness's stdin, decide, render, exit.
+ * Fail open exactly like the guard core — unparseable stdin passes with a stderr
+ * warning, and an unexpected error passes too. A shim crash must never read as a
+ * policy decision.
+ */
+export declare function runShimMain(adapter: ShimAdapter): void;
+/**
+ * Map one `{tool name, tool input}` pair — the shape every surveyed harness feeds its
+ * pre-tool hook, under varying key spellings — onto a {@link GuardRequest}.
+ * `undefined` for tools the guard has no opinion on: pass through.
+ */
+export declare function toolCallRequest(toolName: unknown, toolInput: unknown, names: {
+    readonly read: readonly string[];
+    readonly bash: readonly string[];
+}): GuardRequest | undefined;
+/** The raw stdin as a keyed record, or an empty record when it is not object-shaped. */
+export declare function asRecord(raw: unknown): Record<string, unknown>;
+/**
+ * One harness's pre-tool hook schema — everything that varies between shims, as a
+ * table. Everything that does not vary (the tool mapping, the rewrite-input splice,
+ * the announcement, the deny fallback) belongs to {@link shimFromSchema} and exists
+ * exactly once.
+ *
+ * A schema states capability, never invents it: a harness whose hook cannot modify
+ * tool input simply omits {@link rewrite}, and `renderShimDecision` then falls back to
+ * the deny — whose reason still carries the exact replacement command.
+ */
+export interface HarnessHookSchema {
+    /** Tool names this harness spells a file read with. */
+    readonly readTools: readonly string[];
+    /** Tool names this harness spells a shell command with. */
+    readonly bashTools: readonly string[];
+    /**
+     * Where the tool name lives in the raw payload, in priority order — harnesses
+     * disagree about the spelling (`tool_name`, `toolName`), and some nest the call.
+     * A dotted key reads through one level of nesting (`preToolUse.toolName`).
+     */
+    readonly toolNameKeys: readonly string[];
+    /** Where the tool's input object lives, same rules as {@link toolNameKeys}. */
+    readonly toolInputKeys: readonly string[];
+    /**
+     * The payload key carrying the working directory relative paths resolve against,
+     * for the harnesses that send one (Claude Code's hook stdin carries the *session's*
+     * cwd, which after a `cd` differs from the hook process's own). Absent = the shim
+     * process's cwd.
+     */
+    readonly cwdKey?: string;
+    /** The harness's deny document, with the guard's steering reason in its one slot. */
+    readonly deny: (reason: string) => unknown;
+    /** The harness's input-rewrite document. Absent on a deny-only harness. */
+    readonly rewrite?: HarnessRewriteSchema;
+}
+/** What a rewrite renders, and where the substitution is announced. */
+export interface HarnessRewriteSchema {
+    /** The rewrite document this harness's schema wants back. */
+    readonly document: (rewrite: RewriteSlots) => unknown;
+    /**
+     * Where the substitution is announced. `'reason'` when the document carries a
+     * reason channel the model reads (the template puts {@link RewriteSlots.announcement}
+     * there); `'stderr'` when it does not — a rewrite nobody can see would change what
+     * the model asked for without telling anyone.
+     */
+    readonly announce: 'reason' | 'stderr';
+}
+/** What a rewrite document is built from. Filled in by {@link shimFromSchema}. */
+export interface RewriteSlots {
+    /**
+     * The tool's own input with `command` replaced by the suggestion — the splice every
+     * rewriting harness needs, and which four shims used to carry verbatim. Harnesses
+     * whose rewrite is a shallow merge send only the changed key instead.
+     */
+    readonly input: Record<string, unknown>;
+    /** The replacement command itself. */
+    readonly suggestion: string;
+    /** The announcement, for a document with a reason channel. */
+    readonly announcement: string;
+}
+/** What a deny says when the decision carries no reason — never an empty message. */
+export declare const DENIED_WITHOUT_REASON = "denied by the smelt guard";
+/**
+ * The announcement for a rewrite whose document carries a reason channel the model
+ * reads (Claude Code, Codex): the model is told, in its own transcript, that the
+ * command it asked for is not the command that ran.
+ */
+export declare function rewroteReason(suggestion: string): string;
+/**
+ * The stderr announcement, in two halves so a *generated* consumer can splice values
+ * between them: the opencode plugin this installer writes is JavaScript source, and
+ * its copy of this sentence used to be hand-typed inside a string template where
+ * nothing could see it drift from the shims'. Both halves are pinned by
+ * `test/guards/harness-registry.test.ts`.
+ */
+export declare const REWRITE_ANNOUNCEMENT_OPENING = "smelt guard (rewrite mode): substituted the command in-flight with `";
+export declare const REWRITE_ANNOUNCEMENT_JOIN = "`. ";
+/** The one stderr announcement, for a rewrite schema with no reason channel. */
+export declare function rewriteAnnouncement(suggestion: string, reason: string): string;
+/**
+ * The adapter a {@link HarnessHookSchema} describes. Everything shared lives here
+ * once: the tool mapping, the rewrite-input splice, both announcements, the deny
+ * fallback, and the rule that a schema with no `rewrite` renders a deny instead.
+ */
+export declare function shimFromSchema(schema: HarnessHookSchema): ShimAdapter;
+export { isMainModule };
+//# sourceMappingURL=shim.d.ts.map

package/dist/hooks/shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../../src/hooks/shim.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAqC,MAAM,iBAAiB,CAAC;AAC1F,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,YAAY,GAAG,SAAS,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,UAAU,CAAC;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,KAAK,UAAU,CAAC;IAC5F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,KAAK,UAAU,CAAC;CACjG;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GACtC,UAAU,CAkBZ;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CA+BtD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5E,YAAY,GAAG,SAAS,CAoB1B;AAiBD,wFAAwF;AACxF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI9D;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACxC;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,yEAC+B,CAAC;AACzE,eAAO,MAAM,yBAAyB,QAAQ,CAAC;AAE/C,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9E;AAkBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CA8CrE;AAED,OAAO,EAAE,YAAY,EAAE,CAAC","sourcesContent":["import process from 'node:process';\n\nimport { decide, isMainModule, readAllOfStdin, readGuardSettings } from './guard-core.ts';\nimport type { GuardDecision, GuardRequest, GuardSettings } from './guard-core.ts';\n\n/**\n * The shim runtime — the one loop every per-harness shim runs.\n *\n * A shim is a thin adapter: it maps its harness's native PreToolUse stdin schema\n * onto a {@link GuardRequest}, hands that to the guard core, and renders the\n * {@link GuardDecision} back in the harness's native output schema. All policy —\n * threshold, windows, suggestion rendering, enforcement mode — lives in\n * `guard-core.ts`; a shim that grew an opinion of its own would be a second guard\n * that drifts from the first.\n *\n * Most of a shim is a *table*, not code: which tool names mean read and shell, which\n * payload keys carry them, and the two documents the harness's schema wants back. That\n * table is a {@link HarnessHookSchema}, `shimFromSchema` turns one into a\n * {@link ShimAdapter}, and every harness's schema lives in its profile\n * (`src/harness/<id>.ts`). {@link ShimAdapter} stays public as the escape hatch for a\n * harness a table cannot express.\n *\n * The enforcement gate lives here, once, because it is the same for every harness:\n *\n *  - **deny mode (the default)**: a deny is rendered as the harness's deny, with the\n *    guard's steering reason. The transcript stays truthful — the model sees what it\n *    asked for refused and why, and learns to run the replacement (and\n *    `smelt retrieve`) itself.\n *  - **rewrite mode (`hooks.enforcement: \"rewrite\"` in smelt.config.json)**: when the\n *    denied call is a Bash command, the guard produced a faithful executable\n *    `suggestion`, and this harness can modify tool input, the shim substitutes the\n *    suggestion instead of denying. A harness that cannot rewrite falls back to the\n *    deny — with the exact command in the reason — so rewrite mode never silently\n *    weakens into nothing. A substitution is always announced: in the decision\n *    reason where the harness's rewrite schema carries one (Claude Code, Codex),\n *    and on stderr where it does not (Gemini, Cursor, Hermes, the opencode\n *    plugin) — a rewrite nobody can see would change what the model asked for\n *    without telling anyone. And a shim never rewrites in deny mode: a silent\n *    rewrite changes what the model asked for without telling it, which is this\n *    project's signature failure shape applied to the harness.\n */\n\n/** What one harness shim supplies. Everything else is {@link runShim}'s. */\nexport interface ShimAdapter {\n  /** Map the harness's raw stdin JSON to a guard request; `undefined` = pass through. */\n  readonly toRequest: (raw: unknown) => GuardRequest | undefined;\n  /**\n   * The working directory tool-relative paths resolve against, read from the raw\n   * payload when the harness sends one (Claude Code's hook stdin carries `cwd`: the\n   * *session's* Bash cwd, which after a `cd` differs from this hook process's own).\n   * `undefined` falls back to the shim process's cwd.\n   */\n  readonly cwd?: (raw: unknown) => string | undefined;\n  /** Render an allow. Most harnesses: empty stdout, exit 0. */\n  readonly pass: () => ShimOutput;\n  /** Render a deny, in the harness's schema. */\n  readonly deny: (raw: unknown, request: GuardRequest, decision: GuardDecision) => ShimOutput;\n  /**\n   * Render an input rewrite (only ever called for a Bash-shaped request whose\n   * decision carries a faithful `suggestion`, and only in rewrite mode). Omit on\n   * harnesses whose hook schema cannot modify tool input — they deny instead. A\n   * schema with no reason channel must announce the substitution via `stderr`.\n   */\n  readonly rewrite?: (raw: unknown, request: GuardRequest, decision: GuardDecision) => ShimOutput;\n}\n\n/** What a shim writes and how it exits. `stdout` is a complete JSON line or ''. */\nexport interface ShimOutput {\n  readonly stdout: string;\n  /** Written to the shim process's stderr — the announcement channel for harnesses\n   * whose rewrite schema has no reason field. Never a decision by itself. */\n  readonly stderr?: string;\n  readonly exitCode: number;\n}\n\n/** The pure half of the shim loop, for tests: raw harness input → rendered output. */\nexport function renderShimDecision(\n  adapter: ShimAdapter,\n  raw: unknown,\n  settings: GuardSettings,\n  cwd: string,\n  statFile?: Parameters<typeof decide>[3],\n): ShimOutput {\n  const request = adapter.toRequest(raw);\n  if (request === undefined) return adapter.pass();\n  const effectiveCwd = adapter.cwd?.(raw) ?? cwd;\n  const decision =\n    statFile === undefined\n      ? decide(request, settings, effectiveCwd)\n      : decide(request, settings, effectiveCwd, statFile);\n  if (decision.action === 'allow') return adapter.pass();\n  if (\n    settings.enforcement === 'rewrite' &&\n    adapter.rewrite !== undefined &&\n    request.tool === 'Bash' &&\n    decision.suggestion !== undefined\n  ) {\n    return adapter.rewrite(raw, request, decision);\n  }\n  return adapter.deny(raw, request, decision);\n}\n\n/**\n * The whole shim as a process: read the harness's stdin, decide, render, exit.\n * Fail open exactly like the guard core — unparseable stdin passes with a stderr\n * warning, and an unexpected error passes too. A shim crash must never read as a\n * policy decision.\n */\nexport function runShimMain(adapter: ShimAdapter): void {\n  let output: ShimOutput;\n  try {\n    const text = readAllOfStdin();\n    let raw: unknown;\n    try {\n      raw = JSON.parse(text);\n    } catch {\n      process.stderr.write(\n        `smelt shim: stdin was not JSON — allowing the call. Fix the hook wiring.\\n`,\n      );\n      raw = undefined;\n    }\n    if (raw === undefined) {\n      output = adapter.pass();\n    } else {\n      const settings = readGuardSettings(process.cwd(), (text_) =>\n        process.stderr.write(`${text_}\\n`),\n      );\n      output = renderShimDecision(adapter, raw, settings, process.cwd());\n    }\n  } catch (error) {\n    process.stderr.write(\n      `smelt shim: unexpected error — allowing the call. ` +\n        `${error instanceof Error ? (error.stack ?? error.message) : String(error)}\\n`,\n    );\n    output = adapter.pass();\n  }\n  if (output.stderr !== undefined && output.stderr !== '') process.stderr.write(output.stderr);\n  if (output.stdout !== '') process.stdout.write(output.stdout);\n  process.exitCode = output.exitCode;\n}\n\n/**\n * Map one `{tool name, tool input}` pair — the shape every surveyed harness feeds its\n * pre-tool hook, under varying key spellings — onto a {@link GuardRequest}.\n * `undefined` for tools the guard has no opinion on: pass through.\n */\nexport function toolCallRequest(\n  toolName: unknown,\n  toolInput: unknown,\n  names: { readonly read: readonly string[]; readonly bash: readonly string[] },\n): GuardRequest | undefined {\n  if (typeof toolName !== 'string') return undefined;\n  const input =\n    typeof toolInput === 'object' && toolInput !== null && !Array.isArray(toolInput)\n      ? (toolInput as Record<string, unknown>)\n      : {};\n\n  if (names.read.includes(toolName)) {\n    const path = firstString(input, ['file_path', 'path', 'absolute_path', 'filePath']);\n    if (path === undefined) return undefined;\n    const offsetLimited =\n      firstDefined(input, ['offset', 'limit', 'start_line', 'end_line']) !== undefined;\n    return { tool: 'Read', input: { path, offsetLimited } };\n  }\n  if (names.bash.includes(toolName)) {\n    const command = firstString(input, ['command']);\n    if (command === undefined) return undefined;\n    return { tool: 'Bash', input: { command } };\n  }\n  return undefined;\n}\n\nfunction firstString(input: Record<string, unknown>, keys: readonly string[]): string | undefined {\n  for (const key of keys) {\n    const value = input[key];\n    if (typeof value === 'string' && value !== '') return value;\n  }\n  return undefined;\n}\n\nfunction firstDefined(input: Record<string, unknown>, keys: readonly string[]): unknown {\n  for (const key of keys) {\n    if (input[key] !== undefined && input[key] !== null) return input[key];\n  }\n  return undefined;\n}\n\n/** The raw stdin as a keyed record, or an empty record when it is not object-shaped. */\nexport function asRecord(raw: unknown): Record<string, unknown> {\n  return typeof raw === 'object' && raw !== null && !Array.isArray(raw)\n    ? (raw as Record<string, unknown>)\n    : {};\n}\n\n/* ------------------------------------------------------------------------------------\n * The hook schema, as data\n * ---------------------------------------------------------------------------------- */\n\n/**\n * One harness's pre-tool hook schema — everything that varies between shims, as a\n * table. Everything that does not vary (the tool mapping, the rewrite-input splice,\n * the announcement, the deny fallback) belongs to {@link shimFromSchema} and exists\n * exactly once.\n *\n * A schema states capability, never invents it: a harness whose hook cannot modify\n * tool input simply omits {@link rewrite}, and `renderShimDecision` then falls back to\n * the deny — whose reason still carries the exact replacement command.\n */\nexport interface HarnessHookSchema {\n  /** Tool names this harness spells a file read with. */\n  readonly readTools: readonly string[];\n  /** Tool names this harness spells a shell command with. */\n  readonly bashTools: readonly string[];\n  /**\n   * Where the tool name lives in the raw payload, in priority order — harnesses\n   * disagree about the spelling (`tool_name`, `toolName`), and some nest the call.\n   * A dotted key reads through one level of nesting (`preToolUse.toolName`).\n   */\n  readonly toolNameKeys: readonly string[];\n  /** Where the tool's input object lives, same rules as {@link toolNameKeys}. */\n  readonly toolInputKeys: readonly string[];\n  /**\n   * The payload key carrying the working directory relative paths resolve against,\n   * for the harnesses that send one (Claude Code's hook stdin carries the *session's*\n   * cwd, which after a `cd` differs from the hook process's own). Absent = the shim\n   * process's cwd.\n   */\n  readonly cwdKey?: string;\n  /** The harness's deny document, with the guard's steering reason in its one slot. */\n  readonly deny: (reason: string) => unknown;\n  /** The harness's input-rewrite document. Absent on a deny-only harness. */\n  readonly rewrite?: HarnessRewriteSchema;\n}\n\n/** What a rewrite renders, and where the substitution is announced. */\nexport interface HarnessRewriteSchema {\n  /** The rewrite document this harness's schema wants back. */\n  readonly document: (rewrite: RewriteSlots) => unknown;\n  /**\n   * Where the substitution is announced. `'reason'` when the document carries a\n   * reason channel the model reads (the template puts {@link RewriteSlots.announcement}\n   * there); `'stderr'` when it does not — a rewrite nobody can see would change what\n   * the model asked for without telling anyone.\n   */\n  readonly announce: 'reason' | 'stderr';\n}\n\n/** What a rewrite document is built from. Filled in by {@link shimFromSchema}. */\nexport interface RewriteSlots {\n  /**\n   * The tool's own input with `command` replaced by the suggestion — the splice every\n   * rewriting harness needs, and which four shims used to carry verbatim. Harnesses\n   * whose rewrite is a shallow merge send only the changed key instead.\n   */\n  readonly input: Record<string, unknown>;\n  /** The replacement command itself. */\n  readonly suggestion: string;\n  /** The announcement, for a document with a reason channel. */\n  readonly announcement: string;\n}\n\n/** What a deny says when the decision carries no reason — never an empty message. */\nexport const DENIED_WITHOUT_REASON = 'denied by the smelt guard';\n\n/**\n * The announcement for a rewrite whose document carries a reason channel the model\n * reads (Claude Code, Codex): the model is told, in its own transcript, that the\n * command it asked for is not the command that ran.\n */\nexport function rewroteReason(suggestion: string): string {\n  return `smelt rewrote this command (hooks.enforcement: \"rewrite\"): ${suggestion}`;\n}\n\n/**\n * The stderr announcement, in two halves so a *generated* consumer can splice values\n * between them: the opencode plugin this installer writes is JavaScript source, and\n * its copy of this sentence used to be hand-typed inside a string template where\n * nothing could see it drift from the shims'. Both halves are pinned by\n * `test/guards/harness-registry.test.ts`.\n */\nexport const REWRITE_ANNOUNCEMENT_OPENING =\n  'smelt guard (rewrite mode): substituted the command in-flight with `';\nexport const REWRITE_ANNOUNCEMENT_JOIN = '`. ';\n\n/** The one stderr announcement, for a rewrite schema with no reason channel. */\nexport function rewriteAnnouncement(suggestion: string, reason: string): string {\n  return `${REWRITE_ANNOUNCEMENT_OPENING}${suggestion}${REWRITE_ANNOUNCEMENT_JOIN}${reason}`;\n}\n\n/**\n * The first of `keys` the raw payload carries, `undefined` when it carries none — the\n * `a ?? b ?? c` every shim used to spell by hand, with dotted keys for the harnesses\n * that nest the tool call one level down.\n */\nfunction payloadValue(raw: unknown, keys: readonly string[]): unknown {\n  const fields = asRecord(raw);\n  for (const key of keys) {\n    const dot = key.indexOf('.');\n    const value =\n      dot === -1 ? fields[key] : asRecord(fields[key.slice(0, dot)])[key.slice(dot + 1)];\n    if (value !== undefined && value !== null) return value;\n  }\n  return undefined;\n}\n\n/**\n * The adapter a {@link HarnessHookSchema} describes. Everything shared lives here\n * once: the tool mapping, the rewrite-input splice, both announcements, the deny\n * fallback, and the rule that a schema with no `rewrite` renders a deny instead.\n */\nexport function shimFromSchema(schema: HarnessHookSchema): ShimAdapter {\n  const { cwdKey, rewrite } = schema;\n  return {\n    toRequest: (raw) =>\n      toolCallRequest(\n        payloadValue(raw, schema.toolNameKeys),\n        payloadValue(raw, schema.toolInputKeys),\n        { read: schema.readTools, bash: schema.bashTools },\n      ),\n    ...(cwdKey === undefined\n      ? {}\n      : {\n          cwd: (raw: unknown): string | undefined => {\n            const cwd = asRecord(raw)[cwdKey];\n            return typeof cwd === 'string' && cwd !== '' ? cwd : undefined;\n          },\n        }),\n    pass: () => ({ stdout: '', exitCode: 0 }),\n    deny: (_raw, _request, decision) => ({\n      stdout: `${JSON.stringify(schema.deny(decision.reason ?? DENIED_WITHOUT_REASON))}\\n`,\n      exitCode: 0,\n    }),\n    ...(rewrite === undefined\n      ? {}\n      : {\n          rewrite: (raw: unknown, _request: GuardRequest, decision: GuardDecision): ShimOutput => {\n            const suggestion = decision.suggestion ?? '';\n            const input = {\n              ...asRecord(payloadValue(raw, schema.toolInputKeys)),\n              command: decision.suggestion,\n            };\n            const document = rewrite.document({\n              input,\n              suggestion,\n              announcement: rewroteReason(suggestion),\n            });\n            return {\n              stdout: `${JSON.stringify(document)}\\n`,\n              ...(rewrite.announce === 'stderr'\n                ? { stderr: `${rewriteAnnouncement(suggestion, decision.reason ?? '')}\\n` }\n                : {}),\n              exitCode: 0,\n            };\n          },\n        }),\n  };\n}\n\nexport { isMainModule };\n"]}

package/dist/hooks/shim.js

@@ -0,0 +1,192 @@
+import process from 'node:process';
+import { decide, isMainModule, readAllOfStdin, readGuardSettings } from './guard-core.js';
+/** The pure half of the shim loop, for tests: raw harness input → rendered output. */
+export function renderShimDecision(adapter, raw, settings, cwd, statFile) {
+    const request = adapter.toRequest(raw);
+    if (request === undefined)
+        return adapter.pass();
+    const effectiveCwd = adapter.cwd?.(raw) ?? cwd;
+    const decision = statFile === undefined
+        ? decide(request, settings, effectiveCwd)
+        : decide(request, settings, effectiveCwd, statFile);
+    if (decision.action === 'allow')
+        return adapter.pass();
+    if (settings.enforcement === 'rewrite' &&
+        adapter.rewrite !== undefined &&
+        request.tool === 'Bash' &&
+        decision.suggestion !== undefined) {
+        return adapter.rewrite(raw, request, decision);
+    }
+    return adapter.deny(raw, request, decision);
+}
+/**
+ * The whole shim as a process: read the harness's stdin, decide, render, exit.
+ * Fail open exactly like the guard core — unparseable stdin passes with a stderr
+ * warning, and an unexpected error passes too. A shim crash must never read as a
+ * policy decision.
+ */
+export function runShimMain(adapter) {
+    let output;
+    try {
+        const text = readAllOfStdin();
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            process.stderr.write(`smelt shim: stdin was not JSON — allowing the call. Fix the hook wiring.\n`);
+            raw = undefined;
+        }
+        if (raw === undefined) {
+            output = adapter.pass();
+        }
+        else {
+            const settings = readGuardSettings(process.cwd(), (text_) => process.stderr.write(`${text_}\n`));
+            output = renderShimDecision(adapter, raw, settings, process.cwd());
+        }
+    }
+    catch (error) {
+        process.stderr.write(`smelt shim: unexpected error — allowing the call. ` +
+            `${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+        output = adapter.pass();
+    }
+    if (output.stderr !== undefined && output.stderr !== '')
+        process.stderr.write(output.stderr);
+    if (output.stdout !== '')
+        process.stdout.write(output.stdout);
+    process.exitCode = output.exitCode;
+}
+/**
+ * Map one `{tool name, tool input}` pair — the shape every surveyed harness feeds its
+ * pre-tool hook, under varying key spellings — onto a {@link GuardRequest}.
+ * `undefined` for tools the guard has no opinion on: pass through.
+ */
+export function toolCallRequest(toolName, toolInput, names) {
+    if (typeof toolName !== 'string')
+        return undefined;
+    const input = typeof toolInput === 'object' && toolInput !== null && !Array.isArray(toolInput)
+        ? toolInput
+        : {};
+    if (names.read.includes(toolName)) {
+        const path = firstString(input, ['file_path', 'path', 'absolute_path', 'filePath']);
+        if (path === undefined)
+            return undefined;
+        const offsetLimited = firstDefined(input, ['offset', 'limit', 'start_line', 'end_line']) !== undefined;
+        return { tool: 'Read', input: { path, offsetLimited } };
+    }
+    if (names.bash.includes(toolName)) {
+        const command = firstString(input, ['command']);
+        if (command === undefined)
+            return undefined;
+        return { tool: 'Bash', input: { command } };
+    }
+    return undefined;
+}
+function firstString(input, keys) {
+    for (const key of keys) {
+        const value = input[key];
+        if (typeof value === 'string' && value !== '')
+            return value;
+    }
+    return undefined;
+}
+function firstDefined(input, keys) {
+    for (const key of keys) {
+        if (input[key] !== undefined && input[key] !== null)
+            return input[key];
+    }
+    return undefined;
+}
+/** The raw stdin as a keyed record, or an empty record when it is not object-shaped. */
+export function asRecord(raw) {
+    return typeof raw === 'object' && raw !== null && !Array.isArray(raw)
+        ? raw
+        : {};
+}
+/** What a deny says when the decision carries no reason — never an empty message. */
+export const DENIED_WITHOUT_REASON = 'denied by the smelt guard';
+/**
+ * The announcement for a rewrite whose document carries a reason channel the model
+ * reads (Claude Code, Codex): the model is told, in its own transcript, that the
+ * command it asked for is not the command that ran.
+ */
+export function rewroteReason(suggestion) {
+    return `smelt rewrote this command (hooks.enforcement: "rewrite"): ${suggestion}`;
+}
+/**
+ * The stderr announcement, in two halves so a *generated* consumer can splice values
+ * between them: the opencode plugin this installer writes is JavaScript source, and
+ * its copy of this sentence used to be hand-typed inside a string template where
+ * nothing could see it drift from the shims'. Both halves are pinned by
+ * `test/guards/harness-registry.test.ts`.
+ */
+export const REWRITE_ANNOUNCEMENT_OPENING = 'smelt guard (rewrite mode): substituted the command in-flight with `';
+export const REWRITE_ANNOUNCEMENT_JOIN = '`. ';
+/** The one stderr announcement, for a rewrite schema with no reason channel. */
+export function rewriteAnnouncement(suggestion, reason) {
+    return `${REWRITE_ANNOUNCEMENT_OPENING}${suggestion}${REWRITE_ANNOUNCEMENT_JOIN}${reason}`;
+}
+/**
+ * The first of `keys` the raw payload carries, `undefined` when it carries none — the
+ * `a ?? b ?? c` every shim used to spell by hand, with dotted keys for the harnesses
+ * that nest the tool call one level down.
+ */
+function payloadValue(raw, keys) {
+    const fields = asRecord(raw);
+    for (const key of keys) {
+        const dot = key.indexOf('.');
+        const value = dot === -1 ? fields[key] : asRecord(fields[key.slice(0, dot)])[key.slice(dot + 1)];
+        if (value !== undefined && value !== null)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * The adapter a {@link HarnessHookSchema} describes. Everything shared lives here
+ * once: the tool mapping, the rewrite-input splice, both announcements, the deny
+ * fallback, and the rule that a schema with no `rewrite` renders a deny instead.
+ */
+export function shimFromSchema(schema) {
+    const { cwdKey, rewrite } = schema;
+    return {
+        toRequest: (raw) => toolCallRequest(payloadValue(raw, schema.toolNameKeys), payloadValue(raw, schema.toolInputKeys), { read: schema.readTools, bash: schema.bashTools }),
+        ...(cwdKey === undefined
+            ? {}
+            : {
+                cwd: (raw) => {
+                    const cwd = asRecord(raw)[cwdKey];
+                    return typeof cwd === 'string' && cwd !== '' ? cwd : undefined;
+                },
+            }),
+        pass: () => ({ stdout: '', exitCode: 0 }),
+        deny: (_raw, _request, decision) => ({
+            stdout: `${JSON.stringify(schema.deny(decision.reason ?? DENIED_WITHOUT_REASON))}\n`,
+            exitCode: 0,
+        }),
+        ...(rewrite === undefined
+            ? {}
+            : {
+                rewrite: (raw, _request, decision) => {
+                    const suggestion = decision.suggestion ?? '';
+                    const input = {
+                        ...asRecord(payloadValue(raw, schema.toolInputKeys)),
+                        command: decision.suggestion,
+                    };
+                    const document = rewrite.document({
+                        input,
+                        suggestion,
+                        announcement: rewroteReason(suggestion),
+                    });
+                    return {
+                        stdout: `${JSON.stringify(document)}\n`,
+                        ...(rewrite.announce === 'stderr'
+                            ? { stderr: `${rewriteAnnouncement(suggestion, decision.reason ?? '')}\n` }
+                            : {}),
+                        exitCode: 0,
+                    };
+                },
+            }),
+    };
+}
+export { isMainModule };
+//# sourceMappingURL=shim.js.map

package/dist/hooks/shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.js","sourceRoot":"","sources":["../../src/hooks/shim.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAyE1F,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,GAAY,EACZ,QAAuB,EACvB,GAAW,EACX,QAAuC;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAC/C,MAAM,QAAQ,GACZ,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;QAClC,OAAO,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,CAAC,IAAI,KAAK,MAAM;QACvB,QAAQ,CAAC,UAAU,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,CAC7E,CAAC;YACF,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CACnC,CAAC;YACF,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDAAoD;YAClD,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACjF,CAAC;QACF,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAiB,EACjB,SAAkB,EAClB,KAA6E;IAE7E,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,CAAC,CAAE,SAAqC;QACxC,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,aAAa,GACjB,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,KAAK,SAAS,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,IAAuB;IAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,IAAuB;IAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnE,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAqED,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,8DAA8D,UAAU,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,sEAAsE,CAAC;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,MAAc;IACpE,OAAO,GAAG,4BAA4B,GAAG,UAAU,GAAG,yBAAyB,GAAG,MAAM,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,IAAuB;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GACT,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CACjB,eAAe,CACb,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,EACtC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EACvC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,CACnD;QACH,GAAG,CAAC,MAAM,KAAK,SAAS;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,EAAE,CAAC,GAAY,EAAsB,EAAE;oBACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;oBAClC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBACjE,CAAC;aACF,CAAC;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC,IAAI;YACpF,QAAQ,EAAE,CAAC;SACZ,CAAC;QACF,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE,CAAC,GAAY,EAAE,QAAsB,EAAE,QAAuB,EAAc,EAAE;oBACrF,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC7C,MAAM,KAAK,GAAG;wBACZ,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;wBACpD,OAAO,EAAE,QAAQ,CAAC,UAAU;qBAC7B,CAAC;oBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;wBAChC,KAAK;wBACL,UAAU;wBACV,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC;qBACxC,CAAC,CAAC;oBACH,OAAO;wBACL,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI;wBACvC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;4BAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;4BAC3E,CAAC,CAAC,EAAE,CAAC;wBACP,QAAQ,EAAE,CAAC;qBACZ,CAAC;gBACJ,CAAC;aACF,CAAC;KACP,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC","sourcesContent":["import process from 'node:process';\n\nimport { decide, isMainModule, readAllOfStdin, readGuardSettings } from './guard-core.ts';\nimport type { GuardDecision, GuardRequest, GuardSettings } from './guard-core.ts';\n\n/**\n * The shim runtime — the one loop every per-harness shim runs.\n *\n * A shim is a thin adapter: it maps its harness's native PreToolUse stdin schema\n * onto a {@link GuardRequest}, hands that to the guard core, and renders the\n * {@link GuardDecision} back in the harness's native output schema. All policy —\n * threshold, windows, suggestion rendering, enforcement mode — lives in\n * `guard-core.ts`; a shim that grew an opinion of its own would be a second guard\n * that drifts from the first.\n *\n * Most of a shim is a *table*, not code: which tool names mean read and shell, which\n * payload keys carry them, and the two documents the harness's schema wants back. That\n * table is a {@link HarnessHookSchema}, `shimFromSchema` turns one into a\n * {@link ShimAdapter}, and every harness's schema lives in its profile\n * (`src/harness/<id>.ts`). {@link ShimAdapter} stays public as the escape hatch for a\n * harness a table cannot express.\n *\n * The enforcement gate lives here, once, because it is the same for every harness:\n *\n *  - **deny mode (the default)**: a deny is rendered as the harness's deny, with the\n *    guard's steering reason. The transcript stays truthful — the model sees what it\n *    asked for refused and why, and learns to run the replacement (and\n *    `smelt retrieve`) itself.\n *  - **rewrite mode (`hooks.enforcement: \"rewrite\"` in smelt.config.json)**: when the\n *    denied call is a Bash command, the guard produced a faithful executable\n *    `suggestion`, and this harness can modify tool input, the shim substitutes the\n *    suggestion instead of denying. A harness that cannot rewrite falls back to the\n *    deny — with the exact command in the reason — so rewrite mode never silently\n *    weakens into nothing. A substitution is always announced: in the decision\n *    reason where the harness's rewrite schema carries one (Claude Code, Codex),\n *    and on stderr where it does not (Gemini, Cursor, Hermes, the opencode\n *    plugin) — a rewrite nobody can see would change what the model asked for\n *    without telling anyone. And a shim never rewrites in deny mode: a silent\n *    rewrite changes what the model asked for without telling it, which is this\n *    project's signature failure shape applied to the harness.\n */\n\n/** What one harness shim supplies. Everything else is {@link runShim}'s. */\nexport interface ShimAdapter {\n  /** Map the harness's raw stdin JSON to a guard request; `undefined` = pass through. */\n  readonly toRequest: (raw: unknown) => GuardRequest | undefined;\n  /**\n   * The working directory tool-relative paths resolve against, read from the raw\n   * payload when the harness sends one (Claude Code's hook stdin carries `cwd`: the\n   * *session's* Bash cwd, which after a `cd` differs from this hook process's own).\n   * `undefined` falls back to the shim process's cwd.\n   */\n  readonly cwd?: (raw: unknown) => string | undefined;\n  /** Render an allow. Most harnesses: empty stdout, exit 0. */\n  readonly pass: () => ShimOutput;\n  /** Render a deny, in the harness's schema. */\n  readonly deny: (raw: unknown, request: GuardRequest, decision: GuardDecision) => ShimOutput;\n  /**\n   * Render an input rewrite (only ever called for a Bash-shaped request whose\n   * decision carries a faithful `suggestion`, and only in rewrite mode). Omit on\n   * harnesses whose hook schema cannot modify tool input — they deny instead. A\n   * schema with no reason channel must announce the substitution via `stderr`.\n   */\n  readonly rewrite?: (raw: unknown, request: GuardRequest, decision: GuardDecision) => ShimOutput;\n}\n\n/** What a shim writes and how it exits. `stdout` is a complete JSON line or ''. */\nexport interface ShimOutput {\n  readonly stdout: string;\n  /** Written to the shim process's stderr — the announcement channel for harnesses\n   * whose rewrite schema has no reason field. Never a decision by itself. */\n  readonly stderr?: string;\n  readonly exitCode: number;\n}\n\n/** The pure half of the shim loop, for tests: raw harness input → rendered output. */\nexport function renderShimDecision(\n  adapter: ShimAdapter,\n  raw: unknown,\n  settings: GuardSettings,\n  cwd: string,\n  statFile?: Parameters<typeof decide>[3],\n): ShimOutput {\n  const request = adapter.toRequest(raw);\n  if (request === undefined) return adapter.pass();\n  const effectiveCwd = adapter.cwd?.(raw) ?? cwd;\n  const decision =\n    statFile === undefined\n      ? decide(request, settings, effectiveCwd)\n      : decide(request, settings, effectiveCwd, statFile);\n  if (decision.action === 'allow') return adapter.pass();\n  if (\n    settings.enforcement === 'rewrite' &&\n    adapter.rewrite !== undefined &&\n    request.tool === 'Bash' &&\n    decision.suggestion !== undefined\n  ) {\n    return adapter.rewrite(raw, request, decision);\n  }\n  return adapter.deny(raw, request, decision);\n}\n\n/**\n * The whole shim as a process: read the harness's stdin, decide, render, exit.\n * Fail open exactly like the guard core — unparseable stdin passes with a stderr\n * warning, and an unexpected error passes too. A shim crash must never read as a\n * policy decision.\n */\nexport function runShimMain(adapter: ShimAdapter): void {\n  let output: ShimOutput;\n  try {\n    const text = readAllOfStdin();\n    let raw: unknown;\n    try {\n      raw = JSON.parse(text);\n    } catch {\n      process.stderr.write(\n        `smelt shim: stdin was not JSON — allowing the call. Fix the hook wiring.\\n`,\n      );\n      raw = undefined;\n    }\n    if (raw === undefined) {\n      output = adapter.pass();\n    } else {\n      const settings = readGuardSettings(process.cwd(), (text_) =>\n        process.stderr.write(`${text_}\\n`),\n      );\n      output = renderShimDecision(adapter, raw, settings, process.cwd());\n    }\n  } catch (error) {\n    process.stderr.write(\n      `smelt shim: unexpected error — allowing the call. ` +\n        `${error instanceof Error ? (error.stack ?? error.message) : String(error)}\\n`,\n    );\n    output = adapter.pass();\n  }\n  if (output.stderr !== undefined && output.stderr !== '') process.stderr.write(output.stderr);\n  if (output.stdout !== '') process.stdout.write(output.stdout);\n  process.exitCode = output.exitCode;\n}\n\n/**\n * Map one `{tool name, tool input}` pair — the shape every surveyed harness feeds its\n * pre-tool hook, under varying key spellings — onto a {@link GuardRequest}.\n * `undefined` for tools the guard has no opinion on: pass through.\n */\nexport function toolCallRequest(\n  toolName: unknown,\n  toolInput: unknown,\n  names: { readonly read: readonly string[]; readonly bash: readonly string[] },\n): GuardRequest | undefined {\n  if (typeof toolName !== 'string') return undefined;\n  const input =\n    typeof toolInput === 'object' && toolInput !== null && !Array.isArray(toolInput)\n      ? (toolInput as Record<string, unknown>)\n      : {};\n\n  if (names.read.includes(toolName)) {\n    const path = firstString(input, ['file_path', 'path', 'absolute_path', 'filePath']);\n    if (path === undefined) return undefined;\n    const offsetLimited =\n      firstDefined(input, ['offset', 'limit', 'start_line', 'end_line']) !== undefined;\n    return { tool: 'Read', input: { path, offsetLimited } };\n  }\n  if (names.bash.includes(toolName)) {\n    const command = firstString(input, ['command']);\n    if (command === undefined) return undefined;\n    return { tool: 'Bash', input: { command } };\n  }\n  return undefined;\n}\n\nfunction firstString(input: Record<string, unknown>, keys: readonly string[]): string | undefined {\n  for (const key of keys) {\n    const value = input[key];\n    if (typeof value === 'string' && value !== '') return value;\n  }\n  return undefined;\n}\n\nfunction firstDefined(input: Record<string, unknown>, keys: readonly string[]): unknown {\n  for (const key of keys) {\n    if (input[key] !== undefined && input[key] !== null) return input[key];\n  }\n  return undefined;\n}\n\n/** The raw stdin as a keyed record, or an empty record when it is not object-shaped. */\nexport function asRecord(raw: unknown): Record<string, unknown> {\n  return typeof raw === 'object' && raw !== null && !Array.isArray(raw)\n    ? (raw as Record<string, unknown>)\n    : {};\n}\n\n/* ------------------------------------------------------------------------------------\n * The hook schema, as data\n * ---------------------------------------------------------------------------------- */\n\n/**\n * One harness's pre-tool hook schema — everything that varies between shims, as a\n * table. Everything that does not vary (the tool mapping, the rewrite-input splice,\n * the announcement, the deny fallback) belongs to {@link shimFromSchema} and exists\n * exactly once.\n *\n * A schema states capability, never invents it: a harness whose hook cannot modify\n * tool input simply omits {@link rewrite}, and `renderShimDecision` then falls back to\n * the deny — whose reason still carries the exact replacement command.\n */\nexport interface HarnessHookSchema {\n  /** Tool names this harness spells a file read with. */\n  readonly readTools: readonly string[];\n  /** Tool names this harness spells a shell command with. */\n  readonly bashTools: readonly string[];\n  /**\n   * Where the tool name lives in the raw payload, in priority order — harnesses\n   * disagree about the spelling (`tool_name`, `toolName`), and some nest the call.\n   * A dotted key reads through one level of nesting (`preToolUse.toolName`).\n   */\n  readonly toolNameKeys: readonly string[];\n  /** Where the tool's input object lives, same rules as {@link toolNameKeys}. */\n  readonly toolInputKeys: readonly string[];\n  /**\n   * The payload key carrying the working directory relative paths resolve against,\n   * for the harnesses that send one (Claude Code's hook stdin carries the *session's*\n   * cwd, which after a `cd` differs from the hook process's own). Absent = the shim\n   * process's cwd.\n   */\n  readonly cwdKey?: string;\n  /** The harness's deny document, with the guard's steering reason in its one slot. */\n  readonly deny: (reason: string) => unknown;\n  /** The harness's input-rewrite document. Absent on a deny-only harness. */\n  readonly rewrite?: HarnessRewriteSchema;\n}\n\n/** What a rewrite renders, and where the substitution is announced. */\nexport interface HarnessRewriteSchema {\n  /** The rewrite document this harness's schema wants back. */\n  readonly document: (rewrite: RewriteSlots) => unknown;\n  /**\n   * Where the substitution is announced. `'reason'` when the document carries a\n   * reason channel the model reads (the template puts {@link RewriteSlots.announcement}\n   * there); `'stderr'` when it does not — a rewrite nobody can see would change what\n   * the model asked for without telling anyone.\n   */\n  readonly announce: 'reason' | 'stderr';\n}\n\n/** What a rewrite document is built from. Filled in by {@link shimFromSchema}. */\nexport interface RewriteSlots {\n  /**\n   * The tool's own input with `command` replaced by the suggestion — the splice every\n   * rewriting harness needs, and which four shims used to carry verbatim. Harnesses\n   * whose rewrite is a shallow merge send only the changed key instead.\n   */\n  readonly input: Record<string, unknown>;\n  /** The replacement command itself. */\n  readonly suggestion: string;\n  /** The announcement, for a document with a reason channel. */\n  readonly announcement: string;\n}\n\n/** What a deny says when the decision carries no reason — never an empty message. */\nexport const DENIED_WITHOUT_REASON = 'denied by the smelt guard';\n\n/**\n * The announcement for a rewrite whose document carries a reason channel the model\n * reads (Claude Code, Codex): the model is told, in its own transcript, that the\n * command it asked for is not the command that ran.\n */\nexport function rewroteReason(suggestion: string): string {\n  return `smelt rewrote this command (hooks.enforcement: \"rewrite\"): ${suggestion}`;\n}\n\n/**\n * The stderr announcement, in two halves so a *generated* consumer can splice values\n * between them: the opencode plugin this installer writes is JavaScript source, and\n * its copy of this sentence used to be hand-typed inside a string template where\n * nothing could see it drift from the shims'. Both halves are pinned by\n * `test/guards/harness-registry.test.ts`.\n */\nexport const REWRITE_ANNOUNCEMENT_OPENING =\n  'smelt guard (rewrite mode): substituted the command in-flight with `';\nexport const REWRITE_ANNOUNCEMENT_JOIN = '`. ';\n\n/** The one stderr announcement, for a rewrite schema with no reason channel. */\nexport function rewriteAnnouncement(suggestion: string, reason: string): string {\n  return `${REWRITE_ANNOUNCEMENT_OPENING}${suggestion}${REWRITE_ANNOUNCEMENT_JOIN}${reason}`;\n}\n\n/**\n * The first of `keys` the raw payload carries, `undefined` when it carries none — the\n * `a ?? b ?? c` every shim used to spell by hand, with dotted keys for the harnesses\n * that nest the tool call one level down.\n */\nfunction payloadValue(raw: unknown, keys: readonly string[]): unknown {\n  const fields = asRecord(raw);\n  for (const key of keys) {\n    const dot = key.indexOf('.');\n    const value =\n      dot === -1 ? fields[key] : asRecord(fields[key.slice(0, dot)])[key.slice(dot + 1)];\n    if (value !== undefined && value !== null) return value;\n  }\n  return undefined;\n}\n\n/**\n * The adapter a {@link HarnessHookSchema} describes. Everything shared lives here\n * once: the tool mapping, the rewrite-input splice, both announcements, the deny\n * fallback, and the rule that a schema with no `rewrite` renders a deny instead.\n */\nexport function shimFromSchema(schema: HarnessHookSchema): ShimAdapter {\n  const { cwdKey, rewrite } = schema;\n  return {\n    toRequest: (raw) =>\n      toolCallRequest(\n        payloadValue(raw, schema.toolNameKeys),\n        payloadValue(raw, schema.toolInputKeys),\n        { read: schema.readTools, bash: schema.bashTools },\n      ),\n    ...(cwdKey === undefined\n      ? {}\n      : {\n          cwd: (raw: unknown): string | undefined => {\n            const cwd = asRecord(raw)[cwdKey];\n            return typeof cwd === 'string' && cwd !== '' ? cwd : undefined;\n          },\n        }),\n    pass: () => ({ stdout: '', exitCode: 0 }),\n    deny: (_raw, _request, decision) => ({\n      stdout: `${JSON.stringify(schema.deny(decision.reason ?? DENIED_WITHOUT_REASON))}\\n`,\n      exitCode: 0,\n    }),\n    ...(rewrite === undefined\n      ? {}\n      : {\n          rewrite: (raw: unknown, _request: GuardRequest, decision: GuardDecision): ShimOutput => {\n            const suggestion = decision.suggestion ?? '';\n            const input = {\n              ...asRecord(payloadValue(raw, schema.toolInputKeys)),\n              command: decision.suggestion,\n            };\n            const document = rewrite.document({\n              input,\n              suggestion,\n              announcement: rewroteReason(suggestion),\n            });\n            return {\n              stdout: `${JSON.stringify(document)}\\n`,\n              ...(rewrite.announce === 'stderr'\n                ? { stderr: `${rewriteAnnouncement(suggestion, decision.reason ?? '')}\\n` }\n                : {}),\n              exitCode: 0,\n            };\n          },\n        }),\n  };\n}\n\nexport { isMainModule };\n"]}

package/dist/hooks/shims/claude-code.d.ts

@@ -0,0 +1,10 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Claude Code shim — VERIFIED tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/claude-code.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/claude-code.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/hooks/shims/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/claude-code.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,WAAuC,CAAC","sourcesContent":["import { claudeCode } from '../../harness/claude-code.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Claude Code shim — VERIFIED tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/claude-code.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/claude-code.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(claudeCode);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/claude-code.js

@@ -0,0 +1,14 @@
+import { claudeCode } from '../../harness/claude-code.js';
+import { shimAdapterOf } from '../../harness/profile.js';
+import { isMainModule, runShimMain } from '../shim.js';
+/**
+ * Claude Code shim — VERIFIED tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/claude-code.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/claude-code.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export const adapter = shimAdapterOf(claudeCode);
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=claude-code.js.map

package/dist/hooks/shims/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/hooks/shims/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB,aAAa,CAAC,UAAU,CAAC,CAAC;AAE9D,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC","sourcesContent":["import { claudeCode } from '../../harness/claude-code.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Claude Code shim — VERIFIED tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/claude-code.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/claude-code.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(claudeCode);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/cline.d.ts

@@ -0,0 +1,10 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Cline shim — EXPERIMENTAL tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/cline.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/cline.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=cline.d.ts.map

package/dist/hooks/shims/cline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/cline.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,WAAkC,CAAC","sourcesContent":["import { cline } from '../../harness/cline.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Cline shim — EXPERIMENTAL tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/cline.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/cline.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(cline);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/cline.js

@@ -0,0 +1,14 @@
+import { cline } from '../../harness/cline.js';
+import { shimAdapterOf } from '../../harness/profile.js';
+import { isMainModule, runShimMain } from '../shim.js';
+/**
+ * Cline shim — EXPERIMENTAL tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/cline.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/cline.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export const adapter = shimAdapterOf(cline);
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=cline.js.map

package/dist/hooks/shims/cline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../../src/hooks/shims/cline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;AAEzD,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC","sourcesContent":["import { cline } from '../../harness/cline.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Cline shim — EXPERIMENTAL tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/cline.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/cline.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(cline);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/codex.d.ts

@@ -0,0 +1,10 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Codex CLI shim — VERIFIED tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/codex.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/codex.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=codex.d.ts.map

package/dist/hooks/shims/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/codex.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,WAAkC,CAAC","sourcesContent":["import { codex } from '../../harness/codex.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Codex CLI shim — VERIFIED tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/codex.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/codex.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(codex);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/codex.js

@@ -0,0 +1,14 @@
+import { codex } from '../../harness/codex.js';
+import { shimAdapterOf } from '../../harness/profile.js';
+import { isMainModule, runShimMain } from '../shim.js';
+/**
+ * Codex CLI shim — VERIFIED tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/codex.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/codex.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export const adapter = shimAdapterOf(codex);
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=codex.js.map

package/dist/hooks/shims/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/hooks/shims/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB,aAAa,CAAC,KAAK,CAAC,CAAC;AAEzD,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC","sourcesContent":["import { codex } from '../../harness/codex.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Codex CLI shim — VERIFIED tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/codex.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/codex.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(codex);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/cursor.d.ts

@@ -0,0 +1,10 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Cursor shim — EXPERIMENTAL tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/cursor.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/cursor.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/hooks/shims/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/hooks/shims/cursor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,EAAE,WAAmC,CAAC","sourcesContent":["import { cursor } from '../../harness/cursor.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Cursor shim — EXPERIMENTAL tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/cursor.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/cursor.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(cursor);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/cursor.js

@@ -0,0 +1,14 @@
+import { cursor } from '../../harness/cursor.js';
+import { shimAdapterOf } from '../../harness/profile.js';
+import { isMainModule, runShimMain } from '../shim.js';
+/**
+ * Cursor shim — EXPERIMENTAL tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/cursor.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/cursor.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export const adapter = shimAdapterOf(cursor);
+if (isMainModule(import.meta.url))
+    runShimMain(adapter);
+//# sourceMappingURL=cursor.js.map

package/dist/hooks/shims/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../../src/hooks/shims/cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB,aAAa,CAAC,MAAM,CAAC,CAAC;AAE1D,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC;IAAE,WAAW,CAAC,OAAO,CAAC,CAAC","sourcesContent":["import { cursor } from '../../harness/cursor.ts';\nimport { shimAdapterOf } from '../../harness/profile.ts';\nimport { isMainModule, runShimMain } from '../shim.ts';\nimport type { ShimAdapter } from '../shim.ts';\n\n/**\n * Cursor shim — EXPERIMENTAL tier. The runnable front door only: every fact about this\n * harness, its hook schema included, lives in its profile\n * (`src/harness/cursor.ts`), and `shimFromSchema` turns that schema into the\n * adapter below. The installer wires `node dist/hooks/shims/cursor.js` as the\n * harness's hook command; this file is what that runs.\n */\nexport const adapter: ShimAdapter = shimAdapterOf(cursor);\n\nif (isMainModule(import.meta.url)) runShimMain(adapter);\n"]}

package/dist/hooks/shims/gemini.d.ts

@@ -0,0 +1,10 @@
+import type { ShimAdapter } from '../shim.ts';
+/**
+ * Gemini CLI shim — EXPERIMENTAL tier. The runnable front door only: every fact about this
+ * harness, its hook schema included, lives in its profile
+ * (`src/harness/gemini.ts`), and `shimFromSchema` turns that schema into the
+ * adapter below. The installer wires `node dist/hooks/shims/gemini.js` as the
+ * harness's hook command; this file is what that runs.
+ */
+export declare const adapter: ShimAdapter;
+//# sourceMappingURL=gemini.d.ts.map