@smeltjs/core 0.2.0 → 0.3.0

package/dist/harness/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC;IACF,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YACtC,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,OAAO;gBAC3B,wBAAwB,EAAE,YAAY;gBACtC,YAAY,EAAE,KAAK;aACpB;SACF,CAAC;QACF,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,kFAAkF;AAClF,SAAS,oBAAoB;IAC3B,OAAO,GAAG,kBAAkB;;;;;EAK5B,gBAAgB;CACjB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAA0B;IAC1C,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,CAAC,QAAQ,CAAC;IAClB,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,wIAAwI;KACzI;IACD,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1B,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,oBAAoB;YAC3B,KAAK,EAAE,kBAAkB;YACzB,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,YAAY;gBACtB,GAAG,EAAE,oEAAoE;aAC1E;SACF;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Codex CLI — VERIFIED tier. Schema, install and removal, end to end.\n *\n * Codex's experimental hooks (`features.hooks`, rust-v0.114.0+, on by default from\n * 0.150.1) deliberately mirror Claude Code's schema — the survey is\n * docs/research/2026-09-02-agent-enforcement.md § 3, primary source\n * <https://developers.openai.com/codex/hooks>:\n *\n *  - stdin: `{ tool_name, tool_input }`; shell input arrives as `tool_name: \"Bash\"`,\n *    `tool_input.command`.\n *  - deny: `hookSpecificOutput.permissionDecision: \"deny\"` + reason (or exit 2).\n *  - rewrite: `permissionDecision: \"allow\"` with `updatedInput` — for Bash,\n *    `updatedInput` **must include a string `command` field**, which the shared splice\n *    always does.\n *\n * Two documented differences from Claude Code, both honoured here:\n * `permissionDecision: \"ask\"` is NOT supported (a parse error — the tool proceeds),\n * and this schema never emits it; project-layer hooks only run once the project is\n * trusted, which the installer's output says out loud, and which the `[features]`\n * block below is what enables.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read'],\n  bashTools: ['Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({\n    hookSpecificOutput: {\n      hookEventName: 'PreToolUse',\n      permissionDecision: 'deny',\n      permissionDecisionReason: reason,\n    },\n  }),\n  rewrite: {\n    document: ({ input, announcement }) => ({\n      hookSpecificOutput: {\n        hookEventName: 'PreToolUse',\n        permissionDecision: 'allow',\n        permissionDecisionReason: announcement,\n        updatedInput: input,\n      },\n    }),\n    announce: 'reason',\n  },\n};\n\n/** The Codex `config.toml` block: enables the hooks feature, marker-bracketed. */\nfunction codexConfigTomlBlock(): string {\n  return `${SNIPPET_START_HASH}\n# Enables Codex's hooks feature so .codex/hooks.json is honored. Project-level hooks\n# run only once this project is trusted. Written by \\`smelt hooks install\\`.\n[features]\nhooks = true\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const codex: ShimmedHarnessProfile = {\n  id: 'codex',\n  name: 'Codex CLI',\n  tier: 'verified',\n  detect: ['.codex'],\n  detectHome: ['.codex'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'project-level Codex hooks run only once the project is trusted (features.hooks; see docs/research/2026-09-02-agent-enforcement.md § 3)',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.codex/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: true,\n    },\n    {\n      kind: 'marker-block',\n      file: '.codex/config.toml',\n      block: codexConfigTomlBlock,\n      start: SNIPPET_START_HASH,\n      end: SNIPPET_END_HASH,\n      skipWhen: {\n        contains: '[features]',\n        why: 'already has a [features] table — add `hooks = true` to it yourself',\n      },\n    },\n  ],\n};\n"]}

package/dist/harness/cursor.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const cursor: ShimmedHarnessProfile;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/harness/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAkC1D,eAAO,MAAM,MAAM,EAAE,qBAqBpB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Cursor — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary source\n * <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the real binary.\n *\n *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it supports\n *    input rewrite), fired for every tool, so the hook file carries one matcher-less\n *    entry; stdin `{ tool_name, tool_input }`, and the settings file is versioned\n *    (`\"version\": 1`).\n *  - deny: `{ \"permission\": \"deny\", \"agentMessage\": … }` — `agentMessage` reaches the\n *    model, `userMessage` the human; the guard's steering text goes to the model.\n *  - rewrite: `{ \"permission\": \"allow\", \"updated_input\": { … } }` (snake_case, the\n *    whole input object), with no message field — announced on stderr instead.\n *\n * Cursor has no static permission-config file — gating is entirely hook code — so this\n * shim plus the instruction file is the whole enforcement story there.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ permission: 'deny', agentMessage: reason }),\n  rewrite: {\n    document: ({ input }) => ({ permission: 'allow', updated_input: input }),\n    // The allow/updated_input shape carries no message field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const cursor: ShimmedHarnessProfile = {\n  id: 'cursor',\n  name: 'Cursor',\n  tier: 'experimental',\n  detect: ['.cursor'],\n  detectHome: ['.cursor'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['Cursor has no static permission config — gating is entirely hook code'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.cursor/hooks.json',\n      event: 'preToolUse',\n      matchers: [undefined],\n      entry: 'bare-command',\n      lifecycle: false,\n      shape: { version: 1 },\n    },\n  ],\n};\n"]}

package/dist/harness/cursor.js

@@ -0,0 +1,54 @@
+/**
+ * Cursor — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary source
+ * <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the real binary.
+ *
+ *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it supports
+ *    input rewrite), fired for every tool, so the hook file carries one matcher-less
+ *    entry; stdin `{ tool_name, tool_input }`, and the settings file is versioned
+ *    (`"version": 1`).
+ *  - deny: `{ "permission": "deny", "agentMessage": … }` — `agentMessage` reaches the
+ *    model, `userMessage` the human; the guard's steering text goes to the model.
+ *  - rewrite: `{ "permission": "allow", "updated_input": { … } }` (snake_case, the
+ *    whole input object), with no message field — announced on stderr instead.
+ *
+ * Cursor has no static permission-config file — gating is entirely hook code — so this
+ * shim plus the instruction file is the whole enforcement story there.
+ */
+const HOOKS = {
+    readTools: ['read_file', 'Read', 'ReadFile'],
+    bashTools: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({ permission: 'deny', agentMessage: reason }),
+    rewrite: {
+        document: ({ input }) => ({ permission: 'allow', updated_input: input }),
+        // The allow/updated_input shape carries no message field — announce on stderr.
+        announce: 'stderr',
+    },
+};
+export const cursor = {
+    id: 'cursor',
+    name: 'Cursor',
+    tier: 'experimental',
+    detect: ['.cursor'],
+    detectHome: ['.cursor'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: ['Cursor has no static permission config — gating is entirely hook code'],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.cursor/hooks.json',
+            event: 'preToolUse',
+            matchers: [undefined],
+            entry: 'bare-command',
+            lifecycle: false,
+            shape: { version: 1 },
+        },
+    ],
+};
+//# sourceMappingURL=cursor.js.map

package/dist/harness/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;IACzD,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAChE,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxE,+EAA+E;QAC/E,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,CAAC,uEAAuE,CAAC;IAClF,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;SACtB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Cursor — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary source\n * <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the real binary.\n *\n *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it supports\n *    input rewrite), fired for every tool, so the hook file carries one matcher-less\n *    entry; stdin `{ tool_name, tool_input }`, and the settings file is versioned\n *    (`\"version\": 1`).\n *  - deny: `{ \"permission\": \"deny\", \"agentMessage\": … }` — `agentMessage` reaches the\n *    model, `userMessage` the human; the guard's steering text goes to the model.\n *  - rewrite: `{ \"permission\": \"allow\", \"updated_input\": { … } }` (snake_case, the\n *    whole input object), with no message field — announced on stderr instead.\n *\n * Cursor has no static permission-config file — gating is entirely hook code — so this\n * shim plus the instruction file is the whole enforcement story there.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ permission: 'deny', agentMessage: reason }),\n  rewrite: {\n    document: ({ input }) => ({ permission: 'allow', updated_input: input }),\n    // The allow/updated_input shape carries no message field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const cursor: ShimmedHarnessProfile = {\n  id: 'cursor',\n  name: 'Cursor',\n  tier: 'experimental',\n  detect: ['.cursor'],\n  detectHome: ['.cursor'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['Cursor has no static permission config — gating is entirely hook code'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.cursor/hooks.json',\n      event: 'preToolUse',\n      matchers: [undefined],\n      entry: 'bare-command',\n      lifecycle: false,\n      shape: { version: 1 },\n    },\n  ],\n};\n"]}

package/dist/harness/gemini.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const gemini: ShimmedHarnessProfile;
+//# sourceMappingURL=gemini.d.ts.map

package/dist/harness/gemini.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../src/harness/gemini.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAsC1D,eAAO,MAAM,MAAM,EAAE,qBAsBpB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Gemini CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * The schema below is mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Gemini CLI row; primary\n * source <https://geminicli.com/docs/hooks/reference/>), and the field names were\n * additionally checked 2026-09-02 against the shipped `@google/gemini-cli` 0.58.0\n * bundle (installed headlessly for the shim's verification pass): the BeforeTool stdin\n * payload is `{ tool_name, tool_input }`, `read_file` takes `file_path` with\n * `start_line`/`end_line` windows, the shell tool is `run_shell_command` with\n * `command`, denial is `{ \"decision\": \"deny\", \"reason\": … }`, and\n * `hookSpecificOutput.tool_input` substitutes the input. What has NOT run is a live\n * end-to-end session (needs credentials this environment does not have), so the tier\n * stays experimental — treat surprises as shim bugs and please report them.\n *\n * Carried caveat from the matrix: Gemini's policy engine has an open bug where an\n * `allow` policy is ignored in non-interactive runs\n * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses\n * hooks, not the policy engine, but non-interactive behaviour is the least-tested\n * corner; verify before relying on it in CI.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'ReadFile', 'Read'],\n  bashTools: ['run_shell_command', 'Shell', 'Bash'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n  rewrite: {\n    document: ({ input }) => ({\n      hookSpecificOutput: { hookEventName: 'BeforeTool', tool_input: input },\n    }),\n    // The BeforeTool rewrite shape carries no reason field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const gemini: ShimmedHarnessProfile = {\n  id: 'gemini',\n  name: 'Gemini CLI',\n  tier: 'experimental',\n  detect: ['.gemini'],\n  detectHome: ['.gemini'],\n  instructionFile: 'GEMINI.md',\n  instructions: 'snippet',\n  caveats: [\n    'Gemini policy-engine allow rules are ignored in non-interactive runs (google-gemini/gemini-cli#20469) — verify hook behaviour in CI before relying on it',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.gemini/settings.json',\n      event: 'BeforeTool',\n      matchers: ['read_file', 'run_shell_command'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/gemini.js

@@ -0,0 +1,59 @@
+/**
+ * Gemini CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * The schema below is mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Gemini CLI row; primary
+ * source <https://geminicli.com/docs/hooks/reference/>), and the field names were
+ * additionally checked 2026-09-02 against the shipped `@google/gemini-cli` 0.58.0
+ * bundle (installed headlessly for the shim's verification pass): the BeforeTool stdin
+ * payload is `{ tool_name, tool_input }`, `read_file` takes `file_path` with
+ * `start_line`/`end_line` windows, the shell tool is `run_shell_command` with
+ * `command`, denial is `{ "decision": "deny", "reason": … }`, and
+ * `hookSpecificOutput.tool_input` substitutes the input. What has NOT run is a live
+ * end-to-end session (needs credentials this environment does not have), so the tier
+ * stays experimental — treat surprises as shim bugs and please report them.
+ *
+ * Carried caveat from the matrix: Gemini's policy engine has an open bug where an
+ * `allow` policy is ignored in non-interactive runs
+ * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses
+ * hooks, not the policy engine, but non-interactive behaviour is the least-tested
+ * corner; verify before relying on it in CI.
+ */
+const HOOKS = {
+    readTools: ['read_file', 'ReadFile', 'Read'],
+    bashTools: ['run_shell_command', 'Shell', 'Bash'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({ decision: 'deny', reason }),
+    rewrite: {
+        document: ({ input }) => ({
+            hookSpecificOutput: { hookEventName: 'BeforeTool', tool_input: input },
+        }),
+        // The BeforeTool rewrite shape carries no reason field — announce on stderr.
+        announce: 'stderr',
+    },
+};
+export const gemini = {
+    id: 'gemini',
+    name: 'Gemini CLI',
+    tier: 'experimental',
+    detect: ['.gemini'],
+    detectHome: ['.gemini'],
+    instructionFile: 'GEMINI.md',
+    instructions: 'snippet',
+    caveats: [
+        'Gemini policy-engine allow rules are ignored in non-interactive runs (google-gemini/gemini-cli#20469) — verify hook behaviour in CI before relying on it',
+    ],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.gemini/settings.json',
+            event: 'BeforeTool',
+            matchers: ['read_file', 'run_shell_command'],
+            entry: 'command-list',
+            lifecycle: false,
+        },
+    ],
+};
+//# sourceMappingURL=gemini.js.map

package/dist/harness/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../src/harness/gemini.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC;IACjD,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChD,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACxB,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE;SACvE,CAAC;QACF,6EAA6E;QAC7E,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,0JAA0J;KAC3J;IACD,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;YAC5C,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,KAAK;SACjB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Gemini CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * The schema below is mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Gemini CLI row; primary\n * source <https://geminicli.com/docs/hooks/reference/>), and the field names were\n * additionally checked 2026-09-02 against the shipped `@google/gemini-cli` 0.58.0\n * bundle (installed headlessly for the shim's verification pass): the BeforeTool stdin\n * payload is `{ tool_name, tool_input }`, `read_file` takes `file_path` with\n * `start_line`/`end_line` windows, the shell tool is `run_shell_command` with\n * `command`, denial is `{ \"decision\": \"deny\", \"reason\": … }`, and\n * `hookSpecificOutput.tool_input` substitutes the input. What has NOT run is a live\n * end-to-end session (needs credentials this environment does not have), so the tier\n * stays experimental — treat surprises as shim bugs and please report them.\n *\n * Carried caveat from the matrix: Gemini's policy engine has an open bug where an\n * `allow` policy is ignored in non-interactive runs\n * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses\n * hooks, not the policy engine, but non-interactive behaviour is the least-tested\n * corner; verify before relying on it in CI.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'ReadFile', 'Read'],\n  bashTools: ['run_shell_command', 'Shell', 'Bash'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n  rewrite: {\n    document: ({ input }) => ({\n      hookSpecificOutput: { hookEventName: 'BeforeTool', tool_input: input },\n    }),\n    // The BeforeTool rewrite shape carries no reason field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const gemini: ShimmedHarnessProfile = {\n  id: 'gemini',\n  name: 'Gemini CLI',\n  tier: 'experimental',\n  detect: ['.gemini'],\n  detectHome: ['.gemini'],\n  instructionFile: 'GEMINI.md',\n  instructions: 'snippet',\n  caveats: [\n    'Gemini policy-engine allow rules are ignored in non-interactive runs (google-gemini/gemini-cli#20469) — verify hook behaviour in CI before relying on it',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.gemini/settings.json',\n      event: 'BeforeTool',\n      matchers: ['read_file', 'run_shell_command'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/grok.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const grok: ShimmedHarnessProfile;
+//# sourceMappingURL=grok.d.ts.map

package/dist/harness/grok.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.d.ts","sourceRoot":"","sources":["../../src/harness/grok.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AA2B1D,eAAO,MAAM,IAAI,EAAE,qBAoBlB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Grok CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary source\n * <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against the real\n * binary. Note the matrix's provenance warning: the official CLI is\n * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party\n * clone with a different hook surface.\n *\n *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool\n *    names).\n *  - deny: `{ \"decision\": \"deny\", \"reason\": … }` or exit 2. **Deny-only**: the input\n *    is read-only to hooks, so there is no `rewrite` here — under\n *    `hooks.enforcement: \"rewrite\"` this harness falls back to the deny, whose reason\n *    still carries the exact replacement pipeline.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read', 'read_file', 'ReadFile'],\n  bashTools: ['Bash', 'shell', 'run_shell_command'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n};\n\nexport const grok: ShimmedHarnessProfile = {\n  id: 'grok',\n  name: 'Grok CLI',\n  tier: 'experimental',\n  detect: ['.grok'],\n  detectHome: ['.grok'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.grok/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/grok.js

@@ -0,0 +1,46 @@
+/**
+ * Grok CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary source
+ * <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against the real
+ * binary. Note the matrix's provenance warning: the official CLI is
+ * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party
+ * clone with a different hook surface.
+ *
+ *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool
+ *    names).
+ *  - deny: `{ "decision": "deny", "reason": … }` or exit 2. **Deny-only**: the input
+ *    is read-only to hooks, so there is no `rewrite` here — under
+ *    `hooks.enforcement: "rewrite"` this harness falls back to the deny, whose reason
+ *    still carries the exact replacement pipeline.
+ */
+const HOOKS = {
+    readTools: ['Read', 'read_file', 'ReadFile'],
+    bashTools: ['Bash', 'shell', 'run_shell_command'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({ decision: 'deny', reason }),
+};
+export const grok = {
+    id: 'grok',
+    name: 'Grok CLI',
+    tier: 'experimental',
+    detect: ['.grok'],
+    detectHome: ['.grok'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.grok/hooks.json',
+            event: 'PreToolUse',
+            matchers: ['Read', 'Bash'],
+            entry: 'command-list',
+            lifecycle: false,
+        },
+    ],
+};
+//# sourceMappingURL=grok.js.map

package/dist/harness/grok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../src/harness/grok.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC;IACjD,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAA0B;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC;IACjB,UAAU,EAAE,CAAC,OAAO,CAAC;IACrB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,CAAC,qFAAqF,CAAC;IAChG,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1B,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,KAAK;SACjB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Grok CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary source\n * <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against the real\n * binary. Note the matrix's provenance warning: the official CLI is\n * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party\n * clone with a different hook surface.\n *\n *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool\n *    names).\n *  - deny: `{ \"decision\": \"deny\", \"reason\": … }` or exit 2. **Deny-only**: the input\n *    is read-only to hooks, so there is no `rewrite` here — under\n *    `hooks.enforcement: \"rewrite\"` this harness falls back to the deny, whose reason\n *    still carries the exact replacement pipeline.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read', 'read_file', 'ReadFile'],\n  bashTools: ['Bash', 'shell', 'run_shell_command'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n};\n\nexport const grok: ShimmedHarnessProfile = {\n  id: 'grok',\n  name: 'Grok CLI',\n  tier: 'experimental',\n  detect: ['.grok'],\n  detectHome: ['.grok'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.grok/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/hermes.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const hermes: ShimmedHarnessProfile;
+//# sourceMappingURL=hermes.d.ts.map

package/dist/harness/hermes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.d.ts","sourceRoot":"","sources":["../../src/harness/hermes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAmDjF,eAAO,MAAM,MAAM,EAAE,qBAqBpB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport { nodeCommand, shimScriptPath } from './paths.ts';\nimport type { HarnessInstallContext, ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Hermes Agent — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary\n * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>), not\n * yet smoke-tested against the real binary.\n *\n *  - event: `pre_tool_call`; stdin carries the tool name and its arguments\n *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).\n *  - deny: `{ \"action\": \"block\", \"reason\": … }`.\n *  - rewrite: `{ \"action\": \"modify\", \"args\": { … } }` — a **shallow merge** into the\n *    tool's arguments, so this schema sends only the `command` key and the harness\n *    keeps the rest. The modify document has **no reason field**, so the substitution\n *    is announced on stderr — a rewrite must never be silent.\n *\n * Carried caveat from the matrix: Hermes has a known bypass where memory tools ignore\n * `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —\n * tool gating there is leaky at the edges, so treat this hook as best-effort steering,\n * not a boundary.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['execute_command', 'terminal', 'bash', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['args', 'tool_input'],\n  deny: (reason) => ({ action: 'block', reason }),\n  rewrite: {\n    // A shallow merge: only the key that changed travels, never the spliced whole.\n    document: ({ suggestion }) => ({ action: 'modify', args: { command: suggestion } }),\n    announce: 'stderr',\n  },\n};\n\n/** Hermes hook config, as a mergeable snippet — their config is a home-level YAML. */\nfunction hermesHooksYaml(ctx: HarnessInstallContext): string {\n  return `${SNIPPET_START_HASH}\n# Hermes Agent hook config for the smelt guard. EXPERIMENTAL tier: schema mapped from\n# the capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Hermes\n# row), not yet smoke-tested against the real binary. If Hermes does not read this\n# file directly, merge the \\`hooks:\\` section into ~/.hermes/config.yaml.\nhooks:\n  pre_tool_call:\n    - command: ${nodeCommand(ctx.cwd, shimScriptPath(hermes))}\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const hermes: ShimmedHarnessProfile = {\n  id: 'hermes',\n  name: 'Hermes Agent',\n  tier: 'experimental',\n  detect: ['.hermes', '.hermes.md'],\n  detectHome: ['.hermes'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'Hermes memory tools bypass disabled_toolsets (NousResearch/hermes-agent#46171) — treat tool gating there as leaky',\n    'hook config may need merging into ~/.hermes/config.yaml by hand; the written file says how',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'own-file',\n      file: '.hermes/hooks.yaml',\n      content: hermesHooksYaml,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/hermes.js

@@ -0,0 +1,71 @@
+import { nodeCommand, shimScriptPath } from './paths.js';
+import { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.js';
+/**
+ * Hermes Agent — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary
+ * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>), not
+ * yet smoke-tested against the real binary.
+ *
+ *  - event: `pre_tool_call`; stdin carries the tool name and its arguments
+ *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).
+ *  - deny: `{ "action": "block", "reason": … }`.
+ *  - rewrite: `{ "action": "modify", "args": { … } }` — a **shallow merge** into the
+ *    tool's arguments, so this schema sends only the `command` key and the harness
+ *    keeps the rest. The modify document has **no reason field**, so the substitution
+ *    is announced on stderr — a rewrite must never be silent.
+ *
+ * Carried caveat from the matrix: Hermes has a known bypass where memory tools ignore
+ * `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —
+ * tool gating there is leaky at the edges, so treat this hook as best-effort steering,
+ * not a boundary.
+ */
+const HOOKS = {
+    readTools: ['read_file', 'Read', 'ReadFile'],
+    bashTools: ['execute_command', 'terminal', 'bash', 'Bash', 'shell'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['args', 'tool_input'],
+    deny: (reason) => ({ action: 'block', reason }),
+    rewrite: {
+        // A shallow merge: only the key that changed travels, never the spliced whole.
+        document: ({ suggestion }) => ({ action: 'modify', args: { command: suggestion } }),
+        announce: 'stderr',
+    },
+};
+/** Hermes hook config, as a mergeable snippet — their config is a home-level YAML. */
+function hermesHooksYaml(ctx) {
+    return `${SNIPPET_START_HASH}
+# Hermes Agent hook config for the smelt guard. EXPERIMENTAL tier: schema mapped from
+# the capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Hermes
+# row), not yet smoke-tested against the real binary. If Hermes does not read this
+# file directly, merge the \`hooks:\` section into ~/.hermes/config.yaml.
+hooks:
+  pre_tool_call:
+    - command: ${nodeCommand(ctx.cwd, shimScriptPath(hermes))}
+${SNIPPET_END_HASH}
+`;
+}
+export const hermes = {
+    id: 'hermes',
+    name: 'Hermes Agent',
+    tier: 'experimental',
+    detect: ['.hermes', '.hermes.md'],
+    detectHome: ['.hermes'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: [
+        'Hermes memory tools bypass disabled_toolsets (NousResearch/hermes-agent#46171) — treat tool gating there as leaky',
+        'hook config may need merging into ~/.hermes/config.yaml by hand; the written file says how',
+    ],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'own-file',
+            file: '.hermes/hooks.yaml',
+            content: hermesHooksYaml,
+            guardOnly: true,
+        },
+    ],
+};
+//# sourceMappingURL=hermes.js.map

package/dist/harness/hermes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.js","sourceRoot":"","sources":["../../src/harness/hermes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;IACnE,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;IACrC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/C,OAAO,EAAE;QACP,+EAA+E;QAC/E,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC;QACnF,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,sFAAsF;AACtF,SAAS,eAAe,CAAC,GAA0B;IACjD,OAAO,GAAG,kBAAkB;;;;;;;iBAOb,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;EAC3D,gBAAgB;CACjB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,mHAAmH;QACnH,4FAA4F;KAC7F;IACD,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport { nodeCommand, shimScriptPath } from './paths.ts';\nimport type { HarnessInstallContext, ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Hermes Agent — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary\n * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>), not\n * yet smoke-tested against the real binary.\n *\n *  - event: `pre_tool_call`; stdin carries the tool name and its arguments\n *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).\n *  - deny: `{ \"action\": \"block\", \"reason\": … }`.\n *  - rewrite: `{ \"action\": \"modify\", \"args\": { … } }` — a **shallow merge** into the\n *    tool's arguments, so this schema sends only the `command` key and the harness\n *    keeps the rest. The modify document has **no reason field**, so the substitution\n *    is announced on stderr — a rewrite must never be silent.\n *\n * Carried caveat from the matrix: Hermes has a known bypass where memory tools ignore\n * `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —\n * tool gating there is leaky at the edges, so treat this hook as best-effort steering,\n * not a boundary.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['execute_command', 'terminal', 'bash', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['args', 'tool_input'],\n  deny: (reason) => ({ action: 'block', reason }),\n  rewrite: {\n    // A shallow merge: only the key that changed travels, never the spliced whole.\n    document: ({ suggestion }) => ({ action: 'modify', args: { command: suggestion } }),\n    announce: 'stderr',\n  },\n};\n\n/** Hermes hook config, as a mergeable snippet — their config is a home-level YAML. */\nfunction hermesHooksYaml(ctx: HarnessInstallContext): string {\n  return `${SNIPPET_START_HASH}\n# Hermes Agent hook config for the smelt guard. EXPERIMENTAL tier: schema mapped from\n# the capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Hermes\n# row), not yet smoke-tested against the real binary. If Hermes does not read this\n# file directly, merge the \\`hooks:\\` section into ~/.hermes/config.yaml.\nhooks:\n  pre_tool_call:\n    - command: ${nodeCommand(ctx.cwd, shimScriptPath(hermes))}\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const hermes: ShimmedHarnessProfile = {\n  id: 'hermes',\n  name: 'Hermes Agent',\n  tier: 'experimental',\n  detect: ['.hermes', '.hermes.md'],\n  detectHome: ['.hermes'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'Hermes memory tools bypass disabled_toolsets (NousResearch/hermes-agent#46171) — treat tool gating there as leaky',\n    'hook config may need merging into ~/.hermes/config.yaml by hand; the written file says how',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'own-file',\n      file: '.hermes/hooks.yaml',\n      content: hermesHooksYaml,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/kilocode.d.ts

@@ -0,0 +1,3 @@
+import type { HarnessProfile } from './profile.ts';
+export declare const kilocode: HarnessProfile;
+//# sourceMappingURL=kilocode.d.ts.map

package/dist/harness/kilocode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kilocode.d.ts","sourceRoot":"","sources":["../../src/harness/kilocode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,cAAc,CAAC;AAwB1E,eAAO,MAAM,QAAQ,EAAE,cAYtB,CAAC","sourcesContent":["import type { HarnessInstallContext, HarnessProfile } from './profile.ts';\nimport { instructionSnippet } from './snippet.ts';\n\n/**\n * KiloCode — ADVISORY tier. Instructions only, and honest about it.\n *\n * No first-class hook API (Kilo-Org/kilocode#5827), so nothing here is enforced: what\n * ships is a rules file this harness owns whole — the shared snippet plus the two\n * manual enforcement legs the snippet has no room for. `remove` deletes it.\n */\nfunction kilocodeRulesSource(ctx: HarnessInstallContext): string {\n  return `${instructionSnippet(ctx.thresholdBytes, ctx.budgetBytes)}\n<!-- smelt:hooks v1 advisory notes -->\n\nKiloCode has no first-class hook API (Kilo-Org/kilocode#5827), so nothing above is\nenforced — it is advisory. Two manual legs make it harder to bypass:\n\n1. Permissions: in your KiloCode per-tool permission config, set raw-read/execute\n   tools to \"ask\" so oversized reads surface for review instead of passing silently.\n2. MCP: expose smelt through an MCP server and prefer its tools; a resident server\n   also keeps smelt's grammar cache warm across calls.\n`;\n}\n\nexport const kilocode: HarnessProfile = {\n  id: 'kilocode',\n  name: 'KiloCode',\n  tier: 'advisory',\n  detect: ['.kilocode'],\n  detectHome: ['.config/kilo'],\n  instructionFile: '.kilocode/rules/smelt.md',\n  instructions: kilocodeRulesSource,\n  caveats: [\n    'no first-class hooks (Kilo-Org/kilocode#5827): enforcement is permissions config + MCP, both manual',\n  ],\n  install: [],\n};\n"]}

package/dist/harness/kilocode.js

@@ -0,0 +1,35 @@
+import { instructionSnippet } from './snippet.js';
+/**
+ * KiloCode — ADVISORY tier. Instructions only, and honest about it.
+ *
+ * No first-class hook API (Kilo-Org/kilocode#5827), so nothing here is enforced: what
+ * ships is a rules file this harness owns whole — the shared snippet plus the two
+ * manual enforcement legs the snippet has no room for. `remove` deletes it.
+ */
+function kilocodeRulesSource(ctx) {
+    return `${instructionSnippet(ctx.thresholdBytes, ctx.budgetBytes)}
+<!-- smelt:hooks v1 advisory notes -->
+
+KiloCode has no first-class hook API (Kilo-Org/kilocode#5827), so nothing above is
+enforced — it is advisory. Two manual legs make it harder to bypass:
+
+1. Permissions: in your KiloCode per-tool permission config, set raw-read/execute
+   tools to "ask" so oversized reads surface for review instead of passing silently.
+2. MCP: expose smelt through an MCP server and prefer its tools; a resident server
+   also keeps smelt's grammar cache warm across calls.
+`;
+}
+export const kilocode = {
+    id: 'kilocode',
+    name: 'KiloCode',
+    tier: 'advisory',
+    detect: ['.kilocode'],
+    detectHome: ['.config/kilo'],
+    instructionFile: '.kilocode/rules/smelt.md',
+    instructions: kilocodeRulesSource,
+    caveats: [
+        'no first-class hooks (Kilo-Org/kilocode#5827): enforcement is permissions config + MCP, both manual',
+    ],
+    install: [],
+};
+//# sourceMappingURL=kilocode.js.map

package/dist/harness/kilocode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kilocode.js","sourceRoot":"","sources":["../../src/harness/kilocode.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAA0B;IACrD,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC;;;;;;;;;;CAUlE,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,UAAU,EAAE,CAAC,cAAc,CAAC;IAC5B,eAAe,EAAE,0BAA0B;IAC3C,YAAY,EAAE,mBAAmB;IACjC,OAAO,EAAE;QACP,qGAAqG;KACtG;IACD,OAAO,EAAE,EAAE;CACZ,CAAC","sourcesContent":["import type { HarnessInstallContext, HarnessProfile } from './profile.ts';\nimport { instructionSnippet } from './snippet.ts';\n\n/**\n * KiloCode — ADVISORY tier. Instructions only, and honest about it.\n *\n * No first-class hook API (Kilo-Org/kilocode#5827), so nothing here is enforced: what\n * ships is a rules file this harness owns whole — the shared snippet plus the two\n * manual enforcement legs the snippet has no room for. `remove` deletes it.\n */\nfunction kilocodeRulesSource(ctx: HarnessInstallContext): string {\n  return `${instructionSnippet(ctx.thresholdBytes, ctx.budgetBytes)}\n<!-- smelt:hooks v1 advisory notes -->\n\nKiloCode has no first-class hook API (Kilo-Org/kilocode#5827), so nothing above is\nenforced — it is advisory. Two manual legs make it harder to bypass:\n\n1. Permissions: in your KiloCode per-tool permission config, set raw-read/execute\n   tools to \"ask\" so oversized reads surface for review instead of passing silently.\n2. MCP: expose smelt through an MCP server and prefer its tools; a resident server\n   also keeps smelt's grammar cache warm across calls.\n`;\n}\n\nexport const kilocode: HarnessProfile = {\n  id: 'kilocode',\n  name: 'KiloCode',\n  tier: 'advisory',\n  detect: ['.kilocode'],\n  detectHome: ['.config/kilo'],\n  instructionFile: '.kilocode/rules/smelt.md',\n  instructions: kilocodeRulesSource,\n  caveats: [\n    'no first-class hooks (Kilo-Org/kilocode#5827): enforcement is permissions config + MCP, both manual',\n  ],\n  install: [],\n};\n"]}

package/dist/harness/opencode.d.ts

@@ -0,0 +1,3 @@
+import type { HarnessProfile } from './profile.ts';
+export declare const opencode: HarnessProfile;
+//# sourceMappingURL=opencode.d.ts.map

package/dist/harness/opencode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../src/harness/opencode.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,cAAc,CAAC;AA6E1E,eAAO,MAAM,QAAQ,EAAE,cAmBtB,CAAC","sourcesContent":["import {\n  DENIED_WITHOUT_REASON,\n  REWRITE_ANNOUNCEMENT_JOIN,\n  REWRITE_ANNOUNCEMENT_OPENING,\n} from '../hooks/shim.ts';\n\nimport { guardCoreScriptPath, portablePath } from './paths.ts';\nimport type { HarnessInstallContext, HarnessProfile } from './profile.ts';\n\n/**\n * opencode — EXPERIMENTAL tier. Install and removal, end to end.\n *\n * The one harness with no shim script: its hook API is a JavaScript plugin, not a\n * stdin schema, so what the installer writes *is* the adapter. The plugin imports the\n * built guard core directly (the same module every shim calls) and maps\n * `tool.execute.before` onto it, so all policy still lives in exactly one place.\n *\n * Its two announcements — the rewrite sentence and the reasonless deny — are spliced\n * in from `hooks/shim.ts`'s constants rather than hand-typed into the template, where\n * nothing could see them drift from what the shims print.\n */\nfunction opencodePluginSource(ctx: HarnessInstallContext): string {\n  const guardCore = portablePath(ctx.cwd, guardCoreScriptPath());\n  return `// smelt:hooks v1 — opencode plugin shim. EXPERIMENTAL tier: mapped from the\n// capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, opencode\n// row; https://opencode.ai/docs/plugins/). This template's deny/pass/window paths\n// were exercised directly against the built guard core (verified\n// 2026-09-02), but a live opencode session has not been smoke-tested — that needs\n// provider credentials. Caveat carried from the matrix: MCP tools can bypass plugin\n// hooks (sst/opencode#2319) — this guard sees built-in tools only.\n//\n// Thin adapter: maps tool.execute.before onto the smelt guard core (zero\n// dependencies), which owns every decision. Deny mode throws (opencode surfaces the\n// reason to the model); rewrite mode substitutes the faithful replacement command —\n// announced on stderr, because the plugin API has no reason channel on a rewrite\n// and a substitution must never be silent. Both announcements below are spliced in\n// from the shims' own constants, so this copy cannot drift from theirs.\nimport { pathToFileURL } from 'node:url';\n\nconst GUARD_CORE = ${JSON.stringify(guardCore)};\nconst core = await import(pathToFileURL(GUARD_CORE).href);\n\nexport const SmeltGuard = async () => ({\n  'tool.execute.before': async (input, output) => {\n    const tool = input?.tool;\n    const args = output?.args ?? {};\n    let request;\n    if (tool === 'read' && typeof args.filePath === 'string') {\n      request = {\n        tool: 'Read',\n        input: {\n          path: args.filePath,\n          offsetLimited: args.offset !== undefined || args.limit !== undefined,\n        },\n      };\n    } else if (tool === 'bash' && typeof args.command === 'string') {\n      request = { tool: 'Bash', input: { command: args.command } };\n    } else {\n      return;\n    }\n    const warn = (text) => process.stderr.write(text + '\\\\n');\n    const settings = core.readGuardSettings(process.cwd(), warn);\n    const decision = core.decide(request, settings, process.cwd());\n    if (decision.action !== 'deny') return;\n    if (\n      settings.enforcement === 'rewrite' &&\n      request.tool === 'Bash' &&\n      decision.suggestion !== undefined\n    ) {\n      warn(\n        ${JSON.stringify(REWRITE_ANNOUNCEMENT_OPENING)} +\n          decision.suggestion +\n          ${JSON.stringify(REWRITE_ANNOUNCEMENT_JOIN)} +\n          (decision.reason ?? ''),\n      );\n      output.args.command = decision.suggestion;\n      return;\n    }\n    throw new Error(decision.reason ?? ${JSON.stringify(DENIED_WITHOUT_REASON)});\n  },\n});\n`;\n}\n\nexport const opencode: HarnessProfile = {\n  id: 'opencode',\n  name: 'opencode',\n  tier: 'experimental',\n  detect: ['.opencode', 'opencode.json'],\n  detectHome: ['.config/opencode'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'MCP tools can bypass opencode plugin hooks (sst/opencode#2319) — the guard sees built-in tools only',\n  ],\n  install: [\n    {\n      kind: 'own-file',\n      file: '.opencode/plugin/smelt-guard.js',\n      content: opencodePluginSource,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/opencode.js

@@ -0,0 +1,97 @@
+import { DENIED_WITHOUT_REASON, REWRITE_ANNOUNCEMENT_JOIN, REWRITE_ANNOUNCEMENT_OPENING, } from '../hooks/shim.js';
+import { guardCoreScriptPath, portablePath } from './paths.js';
+/**
+ * opencode — EXPERIMENTAL tier. Install and removal, end to end.
+ *
+ * The one harness with no shim script: its hook API is a JavaScript plugin, not a
+ * stdin schema, so what the installer writes *is* the adapter. The plugin imports the
+ * built guard core directly (the same module every shim calls) and maps
+ * `tool.execute.before` onto it, so all policy still lives in exactly one place.
+ *
+ * Its two announcements — the rewrite sentence and the reasonless deny — are spliced
+ * in from `hooks/shim.ts`'s constants rather than hand-typed into the template, where
+ * nothing could see them drift from what the shims print.
+ */
+function opencodePluginSource(ctx) {
+    const guardCore = portablePath(ctx.cwd, guardCoreScriptPath());
+    return `// smelt:hooks v1 — opencode plugin shim. EXPERIMENTAL tier: mapped from the
+// capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, opencode
+// row; https://opencode.ai/docs/plugins/). This template's deny/pass/window paths
+// were exercised directly against the built guard core (verified
+// 2026-09-02), but a live opencode session has not been smoke-tested — that needs
+// provider credentials. Caveat carried from the matrix: MCP tools can bypass plugin
+// hooks (sst/opencode#2319) — this guard sees built-in tools only.
+//
+// Thin adapter: maps tool.execute.before onto the smelt guard core (zero
+// dependencies), which owns every decision. Deny mode throws (opencode surfaces the
+// reason to the model); rewrite mode substitutes the faithful replacement command —
+// announced on stderr, because the plugin API has no reason channel on a rewrite
+// and a substitution must never be silent. Both announcements below are spliced in
+// from the shims' own constants, so this copy cannot drift from theirs.
+import { pathToFileURL } from 'node:url';
+
+const GUARD_CORE = ${JSON.stringify(guardCore)};
+const core = await import(pathToFileURL(GUARD_CORE).href);
+
+export const SmeltGuard = async () => ({
+  'tool.execute.before': async (input, output) => {
+    const tool = input?.tool;
+    const args = output?.args ?? {};
+    let request;
+    if (tool === 'read' && typeof args.filePath === 'string') {
+      request = {
+        tool: 'Read',
+        input: {
+          path: args.filePath,
+          offsetLimited: args.offset !== undefined || args.limit !== undefined,
+        },
+      };
+    } else if (tool === 'bash' && typeof args.command === 'string') {
+      request = { tool: 'Bash', input: { command: args.command } };
+    } else {
+      return;
+    }
+    const warn = (text) => process.stderr.write(text + '\\n');
+    const settings = core.readGuardSettings(process.cwd(), warn);
+    const decision = core.decide(request, settings, process.cwd());
+    if (decision.action !== 'deny') return;
+    if (
+      settings.enforcement === 'rewrite' &&
+      request.tool === 'Bash' &&
+      decision.suggestion !== undefined
+    ) {
+      warn(
+        ${JSON.stringify(REWRITE_ANNOUNCEMENT_OPENING)} +
+          decision.suggestion +
+          ${JSON.stringify(REWRITE_ANNOUNCEMENT_JOIN)} +
+          (decision.reason ?? ''),
+      );
+      output.args.command = decision.suggestion;
+      return;
+    }
+    throw new Error(decision.reason ?? ${JSON.stringify(DENIED_WITHOUT_REASON)});
+  },
+});
+`;
+}
+export const opencode = {
+    id: 'opencode',
+    name: 'opencode',
+    tier: 'experimental',
+    detect: ['.opencode', 'opencode.json'],
+    detectHome: ['.config/opencode'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: [
+        'MCP tools can bypass opencode plugin hooks (sst/opencode#2319) — the guard sees built-in tools only',
+    ],
+    install: [
+        {
+            kind: 'own-file',
+            file: '.opencode/plugin/smelt-guard.js',
+            content: opencodePluginSource,
+            guardOnly: true,
+        },
+    ],
+};
+//# sourceMappingURL=opencode.js.map

package/dist/harness/opencode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../../src/harness/opencode.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/D;;;;;;;;;;;GAWG;AACH,SAAS,oBAAoB,CAAC,GAA0B;IACtD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC/D,OAAO;;;;;;;;;;;;;;;;qBAgBY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA+BpC,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC;;YAE1C,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;;;;;;yCAMZ,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;;;CAG7E,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAmB;IACtC,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,UAAU,EAAE,CAAC,kBAAkB,CAAC;IAChC,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,qGAAqG;KACtG;IACD,OAAO,EAAE;QACP;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,oBAAoB;YAC7B,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAC","sourcesContent":["import {\n  DENIED_WITHOUT_REASON,\n  REWRITE_ANNOUNCEMENT_JOIN,\n  REWRITE_ANNOUNCEMENT_OPENING,\n} from '../hooks/shim.ts';\n\nimport { guardCoreScriptPath, portablePath } from './paths.ts';\nimport type { HarnessInstallContext, HarnessProfile } from './profile.ts';\n\n/**\n * opencode — EXPERIMENTAL tier. Install and removal, end to end.\n *\n * The one harness with no shim script: its hook API is a JavaScript plugin, not a\n * stdin schema, so what the installer writes *is* the adapter. The plugin imports the\n * built guard core directly (the same module every shim calls) and maps\n * `tool.execute.before` onto it, so all policy still lives in exactly one place.\n *\n * Its two announcements — the rewrite sentence and the reasonless deny — are spliced\n * in from `hooks/shim.ts`'s constants rather than hand-typed into the template, where\n * nothing could see them drift from what the shims print.\n */\nfunction opencodePluginSource(ctx: HarnessInstallContext): string {\n  const guardCore = portablePath(ctx.cwd, guardCoreScriptPath());\n  return `// smelt:hooks v1 — opencode plugin shim. EXPERIMENTAL tier: mapped from the\n// capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, opencode\n// row; https://opencode.ai/docs/plugins/). This template's deny/pass/window paths\n// were exercised directly against the built guard core (verified\n// 2026-09-02), but a live opencode session has not been smoke-tested — that needs\n// provider credentials. Caveat carried from the matrix: MCP tools can bypass plugin\n// hooks (sst/opencode#2319) — this guard sees built-in tools only.\n//\n// Thin adapter: maps tool.execute.before onto the smelt guard core (zero\n// dependencies), which owns every decision. Deny mode throws (opencode surfaces the\n// reason to the model); rewrite mode substitutes the faithful replacement command —\n// announced on stderr, because the plugin API has no reason channel on a rewrite\n// and a substitution must never be silent. Both announcements below are spliced in\n// from the shims' own constants, so this copy cannot drift from theirs.\nimport { pathToFileURL } from 'node:url';\n\nconst GUARD_CORE = ${JSON.stringify(guardCore)};\nconst core = await import(pathToFileURL(GUARD_CORE).href);\n\nexport const SmeltGuard = async () => ({\n  'tool.execute.before': async (input, output) => {\n    const tool = input?.tool;\n    const args = output?.args ?? {};\n    let request;\n    if (tool === 'read' && typeof args.filePath === 'string') {\n      request = {\n        tool: 'Read',\n        input: {\n          path: args.filePath,\n          offsetLimited: args.offset !== undefined || args.limit !== undefined,\n        },\n      };\n    } else if (tool === 'bash' && typeof args.command === 'string') {\n      request = { tool: 'Bash', input: { command: args.command } };\n    } else {\n      return;\n    }\n    const warn = (text) => process.stderr.write(text + '\\\\n');\n    const settings = core.readGuardSettings(process.cwd(), warn);\n    const decision = core.decide(request, settings, process.cwd());\n    if (decision.action !== 'deny') return;\n    if (\n      settings.enforcement === 'rewrite' &&\n      request.tool === 'Bash' &&\n      decision.suggestion !== undefined\n    ) {\n      warn(\n        ${JSON.stringify(REWRITE_ANNOUNCEMENT_OPENING)} +\n          decision.suggestion +\n          ${JSON.stringify(REWRITE_ANNOUNCEMENT_JOIN)} +\n          (decision.reason ?? ''),\n      );\n      output.args.command = decision.suggestion;\n      return;\n    }\n    throw new Error(decision.reason ?? ${JSON.stringify(DENIED_WITHOUT_REASON)});\n  },\n});\n`;\n}\n\nexport const opencode: HarnessProfile = {\n  id: 'opencode',\n  name: 'opencode',\n  tier: 'experimental',\n  detect: ['.opencode', 'opencode.json'],\n  detectHome: ['.config/opencode'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'MCP tools can bypass opencode plugin hooks (sst/opencode#2319) — the guard sees built-in tools only',\n  ],\n  install: [\n    {\n      kind: 'own-file',\n      file: '.opencode/plugin/smelt-guard.js',\n      content: opencodePluginSource,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/paths.d.ts

@@ -0,0 +1,17 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+/**
+ * The shim script a harness's hook command runs. Takes a profile rather than an id,
+ * because only a profile that carries a hook schema (or a hand-written adapter) has a
+ * shim script on disk: a path for a harness that ships none would name a file the
+ * build never produced.
+ */
+export declare function shimScriptPath(profile: ShimmedHarnessProfile): string;
+/** The guard core as a module: what the opencode plugin imports at hook time. */
+export declare function guardCoreScriptPath(): string;
+/** The `smelt` binary — quoted into the stats and map hook commands. */
+export declare function smeltBinPath(): string;
+/** Inside the project, a project-relative path travels with the repo; outside, absolute. */
+export declare function portablePath(cwd: string, absolute: string): string;
+/** `node "<script>"` — how every harness config invokes something of smelt's. */
+export declare function nodeCommand(cwd: string, script: string, args?: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/harness/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/harness/paths.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoB1D;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAErE;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wEAAwE;AACxE,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,4FAA4F;AAC5F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAE1E","sourcesContent":["import { dirname, isAbsolute, join, relative, sep } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Where the scripts a harness config points at actually live, and how a profile names\n * one. Path facts only — nothing here reads or writes a file.\n */\n\n/**\n * The `dist` directory of this installed package — where the shipped guard core and\n * shim scripts live. Computed from this module's own location, which is\n * `<pkg>/dist/harness/` in every real run (the CLI executes from `dist`); under the\n * test runner it is `<pkg>/src/harness/`, and the substitution still points at `dist`,\n * which is where the scripts will exist once built — the paths are written into config\n * files for *node* to execute, never imported.\n */\nfunction packageDistDir(): string {\n  const here = dirname(fileURLToPath(import.meta.url)); // <pkg>/(dist|src)/harness\n  return join(dirname(dirname(here)), 'dist');\n}\n\n/**\n * The shim script a harness's hook command runs. Takes a profile rather than an id,\n * because only a profile that carries a hook schema (or a hand-written adapter) has a\n * shim script on disk: a path for a harness that ships none would name a file the\n * build never produced.\n */\nexport function shimScriptPath(profile: ShimmedHarnessProfile): string {\n  return join(packageDistDir(), 'hooks', 'shims', `${profile.id}.js`);\n}\n\n/** The guard core as a module: what the opencode plugin imports at hook time. */\nexport function guardCoreScriptPath(): string {\n  return join(packageDistDir(), 'hooks', 'guard-core.js');\n}\n\n/** The `smelt` binary — quoted into the stats and map hook commands. */\nexport function smeltBinPath(): string {\n  return join(packageDistDir(), 'cli', 'bin.js');\n}\n\n/** Inside the project, a project-relative path travels with the repo; outside, absolute. */\nexport function portablePath(cwd: string, absolute: string): string {\n  const rel = relative(cwd, absolute);\n  return rel.startsWith('..') || isAbsolute(rel) ? absolute : rel.split(sep).join('/');\n}\n\n/** `node \"<script>\"` — how every harness config invokes something of smelt's. */\nexport function nodeCommand(cwd: string, script: string, args = ''): string {\n  return `node \"${portablePath(cwd, script)}\"${args === '' ? '' : ` ${args}`}`;\n}\n"]}

package/dist/harness/paths.js

@@ -0,0 +1,45 @@
+import { dirname, isAbsolute, join, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Where the scripts a harness config points at actually live, and how a profile names
+ * one. Path facts only — nothing here reads or writes a file.
+ */
+/**
+ * The `dist` directory of this installed package — where the shipped guard core and
+ * shim scripts live. Computed from this module's own location, which is
+ * `<pkg>/dist/harness/` in every real run (the CLI executes from `dist`); under the
+ * test runner it is `<pkg>/src/harness/`, and the substitution still points at `dist`,
+ * which is where the scripts will exist once built — the paths are written into config
+ * files for *node* to execute, never imported.
+ */
+function packageDistDir() {
+    const here = dirname(fileURLToPath(import.meta.url)); // <pkg>/(dist|src)/harness
+    return join(dirname(dirname(here)), 'dist');
+}
+/**
+ * The shim script a harness's hook command runs. Takes a profile rather than an id,
+ * because only a profile that carries a hook schema (or a hand-written adapter) has a
+ * shim script on disk: a path for a harness that ships none would name a file the
+ * build never produced.
+ */
+export function shimScriptPath(profile) {
+    return join(packageDistDir(), 'hooks', 'shims', `${profile.id}.js`);
+}
+/** The guard core as a module: what the opencode plugin imports at hook time. */
+export function guardCoreScriptPath() {
+    return join(packageDistDir(), 'hooks', 'guard-core.js');
+}
+/** The `smelt` binary — quoted into the stats and map hook commands. */
+export function smeltBinPath() {
+    return join(packageDistDir(), 'cli', 'bin.js');
+}
+/** Inside the project, a project-relative path travels with the repo; outside, absolute. */
+export function portablePath(cwd, absolute) {
+    const rel = relative(cwd, absolute);
+    return rel.startsWith('..') || isAbsolute(rel) ? absolute : rel.split(sep).join('/');
+}
+/** `node "<script>"` — how every harness config invokes something of smelt's. */
+export function nodeCommand(cwd, script, args = '') {
+    return `node "${portablePath(cwd, script)}"${args === '' ? '' : ` ${args}`}`;
+}
+//# sourceMappingURL=paths.js.map