@smeltjs/core 0.2.0 → 0.4.0

package/dist/harness/claude-code.js

@@ -0,0 +1,68 @@
+/**
+ * Claude Code — VERIFIED tier. Schema, install and removal, end to end.
+ *
+ * Schema per <https://code.claude.com/docs/en/hooks> (verified 2026-09-02; the deep
+ * dive is docs/research/2026-09-02-agent-enforcement.md § 1):
+ *
+ *  - stdin: `{ hook_event_name: "PreToolUse", tool_name, tool_input, cwd }`. For
+ *    `Read`, `tool_input.file_path` is already absolute and `offset`/`limit` mark a
+ *    windowed read; for `Bash`, `tool_input.command` is the full command string, and
+ *    a relative path in it resolves against the payload's `cwd` — the *session's*
+ *    working directory, which after the model `cd`s differs from the hook process's
+ *    own cwd.
+ *  - deny: `hookSpecificOutput.permissionDecision: "deny"` with
+ *    `permissionDecisionReason` — which is **shown to the model**, so the guard's
+ *    reason (the exact replacement command, the `smelt retrieve` contract) lands in
+ *    the transcript as steering.
+ *  - rewrite (opt-in, `hooks.enforcement: "rewrite"`): `updatedInput` replaces the
+ *    entire input object of the *same* tool (v2.0.10+), so a Bash command can be
+ *    substituted but a Read can never become a Bash call — Reads deny in every mode.
+ */
+const HOOKS = {
+    readTools: ['Read'],
+    bashTools: ['Bash'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    cwdKey: 'cwd',
+    deny: (reason) => ({
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse',
+            permissionDecision: 'deny',
+            permissionDecisionReason: reason,
+        },
+    }),
+    rewrite: {
+        document: ({ input, announcement }) => ({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'allow',
+                permissionDecisionReason: announcement,
+                // updatedInput replaces the whole input object — unchanged fields ride along.
+                updatedInput: input,
+            },
+        }),
+        announce: 'reason',
+    },
+};
+export const claudeCode = {
+    id: 'claude-code',
+    name: 'Claude Code',
+    tier: 'verified',
+    detect: ['.claude'],
+    detectHome: ['.claude'],
+    instructionFile: 'CLAUDE.md',
+    instructions: 'snippet',
+    caveats: [],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.claude/settings.json',
+            event: 'PreToolUse',
+            matchers: ['Read', 'Bash'],
+            entry: 'command-list',
+            lifecycle: true,
+        },
+    ],
+};
+//# sourceMappingURL=claude-code.js.map

package/dist/harness/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/harness/claude-code.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC;IACF,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YACtC,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,OAAO;gBAC3B,wBAAwB,EAAE,YAAY;gBACtC,8EAA8E;gBAC9E,YAAY,EAAE,KAAK;aACpB;SACF,CAAC;QACF,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAA0B;IAC/C,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1B,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Claude Code — VERIFIED tier. Schema, install and removal, end to end.\n *\n * Schema per <https://code.claude.com/docs/en/hooks> (verified 2026-09-02; the deep\n * dive is docs/research/2026-09-02-agent-enforcement.md § 1):\n *\n *  - stdin: `{ hook_event_name: \"PreToolUse\", tool_name, tool_input, cwd }`. For\n *    `Read`, `tool_input.file_path` is already absolute and `offset`/`limit` mark a\n *    windowed read; for `Bash`, `tool_input.command` is the full command string, and\n *    a relative path in it resolves against the payload's `cwd` — the *session's*\n *    working directory, which after the model `cd`s differs from the hook process's\n *    own cwd.\n *  - deny: `hookSpecificOutput.permissionDecision: \"deny\"` with\n *    `permissionDecisionReason` — which is **shown to the model**, so the guard's\n *    reason (the exact replacement command, the `smelt retrieve` contract) lands in\n *    the transcript as steering.\n *  - rewrite (opt-in, `hooks.enforcement: \"rewrite\"`): `updatedInput` replaces the\n *    entire input object of the *same* tool (v2.0.10+), so a Bash command can be\n *    substituted but a Read can never become a Bash call — Reads deny in every mode.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read'],\n  bashTools: ['Bash'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  cwdKey: 'cwd',\n  deny: (reason) => ({\n    hookSpecificOutput: {\n      hookEventName: 'PreToolUse',\n      permissionDecision: 'deny',\n      permissionDecisionReason: reason,\n    },\n  }),\n  rewrite: {\n    document: ({ input, announcement }) => ({\n      hookSpecificOutput: {\n        hookEventName: 'PreToolUse',\n        permissionDecision: 'allow',\n        permissionDecisionReason: announcement,\n        // updatedInput replaces the whole input object — unchanged fields ride along.\n        updatedInput: input,\n      },\n    }),\n    announce: 'reason',\n  },\n};\n\nexport const claudeCode: ShimmedHarnessProfile = {\n  id: 'claude-code',\n  name: 'Claude Code',\n  tier: 'verified',\n  detect: ['.claude'],\n  detectHome: ['.claude'],\n  instructionFile: 'CLAUDE.md',\n  instructions: 'snippet',\n  caveats: [],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.claude/settings.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: true,\n    },\n  ],\n};\n"]}

package/dist/harness/cline.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const cline: ShimmedHarnessProfile;
+//# sourceMappingURL=cline.d.ts.map

package/dist/harness/cline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.d.ts","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAoCjF,eAAO,MAAM,KAAK,EAAE,qBAmBnB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport { nodeCommand, shimScriptPath } from './paths.ts';\nimport type { HarnessInstallContext, ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Cline — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Cline row; primary source\n * <https://docs.cline.bot/features/hooks>), not yet smoke-tested against the real\n * binary.\n *\n *  - event: `PreToolUse`, delivered to an executable under `.clinerules/hooks/` —\n *    hence the two-line wrapper below, which is the file Cline runs; stdin carries the\n *    tool call (accepted spellings: `tool_name`/`tool_input`, `toolName`/`toolInput`,\n *    or nested under `preToolUse`).\n *  - deny: `{ \"cancel\": true, \"errorMessage\": … }`. **Deny-only**: the response has no\n *    input-modification field, so under `hooks.enforcement: \"rewrite\"` this harness\n *    falls back to the deny, whose reason still carries the exact replacement pipeline.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read', 'read_file', 'readFile'],\n  bashTools: ['Bash', 'execute_command', 'executeCommand', 'shell'],\n  toolNameKeys: ['tool_name', 'toolName', 'preToolUse.toolName', 'preToolUse.tool'],\n  toolInputKeys: ['tool_input', 'toolInput', 'preToolUse.toolInput', 'preToolUse.input'],\n  deny: (reason) => ({ cancel: true, errorMessage: reason }),\n};\n\n/** Cline's hook is an executable file; this two-liner hands it to the cline shim. */\nfunction clineHookSource(ctx: HarnessInstallContext): string {\n  return `#!/bin/sh\n# smelt:hooks v1 — Cline PreToolUse hook. EXPERIMENTAL tier: schema mapped from the\n# capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Cline row),\n# not yet smoke-tested against the real binary. Written by \\`smelt hooks install\\`.\nexec ${nodeCommand(ctx.cwd, shimScriptPath(cline))}\n`;\n}\n\nexport const cline: ShimmedHarnessProfile = {\n  id: 'cline',\n  name: 'Cline',\n  tier: 'experimental',\n  detect: ['.clinerules'],\n  detectHome: [],\n  instructionFile: '.clinerules/smelt.md',\n  instructions: 'snippet',\n  caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'own-file',\n      file: '.clinerules/hooks/PreToolUse',\n      content: clineHookSource,\n      mode: 0o755,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/cline.js

@@ -0,0 +1,54 @@
+import { nodeCommand, shimScriptPath } from './paths.js';
+/**
+ * Cline — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Cline row; primary source
+ * <https://docs.cline.bot/features/hooks>), not yet smoke-tested against the real
+ * binary.
+ *
+ *  - event: `PreToolUse`, delivered to an executable under `.clinerules/hooks/` —
+ *    hence the two-line wrapper below, which is the file Cline runs; stdin carries the
+ *    tool call (accepted spellings: `tool_name`/`tool_input`, `toolName`/`toolInput`,
+ *    or nested under `preToolUse`).
+ *  - deny: `{ "cancel": true, "errorMessage": … }`. **Deny-only**: the response has no
+ *    input-modification field, so under `hooks.enforcement: "rewrite"` this harness
+ *    falls back to the deny, whose reason still carries the exact replacement pipeline.
+ */
+const HOOKS = {
+    readTools: ['Read', 'read_file', 'readFile'],
+    bashTools: ['Bash', 'execute_command', 'executeCommand', 'shell'],
+    toolNameKeys: ['tool_name', 'toolName', 'preToolUse.toolName', 'preToolUse.tool'],
+    toolInputKeys: ['tool_input', 'toolInput', 'preToolUse.toolInput', 'preToolUse.input'],
+    deny: (reason) => ({ cancel: true, errorMessage: reason }),
+};
+/** Cline's hook is an executable file; this two-liner hands it to the cline shim. */
+function clineHookSource(ctx) {
+    return `#!/bin/sh
+# smelt:hooks v1 — Cline PreToolUse hook. EXPERIMENTAL tier: schema mapped from the
+# capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Cline row),
+# not yet smoke-tested against the real binary. Written by \`smelt hooks install\`.
+exec ${nodeCommand(ctx.cwd, shimScriptPath(cline))}
+`;
+}
+export const cline = {
+    id: 'cline',
+    name: 'Cline',
+    tier: 'experimental',
+    detect: ['.clinerules'],
+    detectHome: [],
+    instructionFile: '.clinerules/smelt.md',
+    instructions: 'snippet',
+    caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'own-file',
+            file: '.clinerules/hooks/PreToolUse',
+            content: clineHookSource,
+            mode: 0o755,
+            guardOnly: true,
+        },
+    ],
+};
+//# sourceMappingURL=cline.js.map

package/dist/harness/cline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cline.js","sourceRoot":"","sources":["../../src/harness/cline.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGzD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,CAAC;IACjE,YAAY,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,qBAAqB,EAAE,iBAAiB,CAAC;IACjF,aAAa,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;IACtF,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;CAC3D,CAAC;AAEF,qFAAqF;AACrF,SAAS,eAAe,CAAC,GAA0B;IACjD,OAAO;;;;OAIF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;CACjD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAA0B;IAC1C,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,aAAa,CAAC;IACvB,UAAU,EAAE,EAAE;IACd,eAAe,EAAE,sBAAsB;IACvC,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,CAAC,qFAAqF,CAAC;IAChG,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport { nodeCommand, shimScriptPath } from './paths.ts';\nimport type { HarnessInstallContext, ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Cline — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Cline row; primary source\n * <https://docs.cline.bot/features/hooks>), not yet smoke-tested against the real\n * binary.\n *\n *  - event: `PreToolUse`, delivered to an executable under `.clinerules/hooks/` —\n *    hence the two-line wrapper below, which is the file Cline runs; stdin carries the\n *    tool call (accepted spellings: `tool_name`/`tool_input`, `toolName`/`toolInput`,\n *    or nested under `preToolUse`).\n *  - deny: `{ \"cancel\": true, \"errorMessage\": … }`. **Deny-only**: the response has no\n *    input-modification field, so under `hooks.enforcement: \"rewrite\"` this harness\n *    falls back to the deny, whose reason still carries the exact replacement pipeline.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read', 'read_file', 'readFile'],\n  bashTools: ['Bash', 'execute_command', 'executeCommand', 'shell'],\n  toolNameKeys: ['tool_name', 'toolName', 'preToolUse.toolName', 'preToolUse.tool'],\n  toolInputKeys: ['tool_input', 'toolInput', 'preToolUse.toolInput', 'preToolUse.input'],\n  deny: (reason) => ({ cancel: true, errorMessage: reason }),\n};\n\n/** Cline's hook is an executable file; this two-liner hands it to the cline shim. */\nfunction clineHookSource(ctx: HarnessInstallContext): string {\n  return `#!/bin/sh\n# smelt:hooks v1 — Cline PreToolUse hook. EXPERIMENTAL tier: schema mapped from the\n# capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Cline row),\n# not yet smoke-tested against the real binary. Written by \\`smelt hooks install\\`.\nexec ${nodeCommand(ctx.cwd, shimScriptPath(cline))}\n`;\n}\n\nexport const cline: ShimmedHarnessProfile = {\n  id: 'cline',\n  name: 'Cline',\n  tier: 'experimental',\n  detect: ['.clinerules'],\n  detectHome: [],\n  instructionFile: '.clinerules/smelt.md',\n  instructions: 'snippet',\n  caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'own-file',\n      file: '.clinerules/hooks/PreToolUse',\n      content: clineHookSource,\n      mode: 0o755,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/codex.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const codex: ShimmedHarnessProfile;
+//# sourceMappingURL=codex.d.ts.map

package/dist/harness/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AA4D1D,eAAO,MAAM,KAAK,EAAE,qBAkCnB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Codex CLI — VERIFIED tier. Schema, install and removal, end to end.\n *\n * Codex's experimental hooks (`features.hooks`, rust-v0.114.0+, on by default from\n * 0.150.1) deliberately mirror Claude Code's schema — the survey is\n * docs/research/2026-09-02-agent-enforcement.md § 3, primary source\n * <https://developers.openai.com/codex/hooks>:\n *\n *  - stdin: `{ tool_name, tool_input }`; shell input arrives as `tool_name: \"Bash\"`,\n *    `tool_input.command`.\n *  - deny: `hookSpecificOutput.permissionDecision: \"deny\"` + reason (or exit 2).\n *  - rewrite: `permissionDecision: \"allow\"` with `updatedInput` — for Bash,\n *    `updatedInput` **must include a string `command` field**, which the shared splice\n *    always does.\n *\n * Two documented differences from Claude Code, both honoured here:\n * `permissionDecision: \"ask\"` is NOT supported (a parse error — the tool proceeds),\n * and this schema never emits it; project-layer hooks only run once the project is\n * trusted, which the installer's output says out loud, and which the `[features]`\n * block below is what enables.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read'],\n  bashTools: ['Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({\n    hookSpecificOutput: {\n      hookEventName: 'PreToolUse',\n      permissionDecision: 'deny',\n      permissionDecisionReason: reason,\n    },\n  }),\n  rewrite: {\n    document: ({ input, announcement }) => ({\n      hookSpecificOutput: {\n        hookEventName: 'PreToolUse',\n        permissionDecision: 'allow',\n        permissionDecisionReason: announcement,\n        updatedInput: input,\n      },\n    }),\n    announce: 'reason',\n  },\n};\n\n/** The Codex `config.toml` block: enables the hooks feature, marker-bracketed. */\nfunction codexConfigTomlBlock(): string {\n  return `${SNIPPET_START_HASH}\n# Enables Codex's hooks feature so .codex/hooks.json is honored. Project-level hooks\n# run only once this project is trusted. Written by \\`smelt hooks install\\`.\n[features]\nhooks = true\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const codex: ShimmedHarnessProfile = {\n  id: 'codex',\n  name: 'Codex CLI',\n  shortName: 'Codex',\n  tier: 'verified',\n  detect: ['.codex'],\n  detectHome: ['.codex'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'project-level Codex hooks run only once the project is trusted (features.hooks; see docs/research/2026-09-02-agent-enforcement.md § 3)',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.codex/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: true,\n    },\n    {\n      kind: 'marker-block',\n      file: '.codex/config.toml',\n      block: codexConfigTomlBlock,\n      start: SNIPPET_START_HASH,\n      end: SNIPPET_END_HASH,\n      skipWhen: {\n        contains: '[features]',\n        why: 'already has a [features] table — add `hooks = true` to it yourself',\n      },\n    },\n  ],\n};\n"]}

package/dist/harness/codex.js

@@ -0,0 +1,92 @@
+import { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.js';
+/**
+ * Codex CLI — VERIFIED tier. Schema, install and removal, end to end.
+ *
+ * Codex's experimental hooks (`features.hooks`, rust-v0.114.0+, on by default from
+ * 0.150.1) deliberately mirror Claude Code's schema — the survey is
+ * docs/research/2026-09-02-agent-enforcement.md § 3, primary source
+ * <https://developers.openai.com/codex/hooks>:
+ *
+ *  - stdin: `{ tool_name, tool_input }`; shell input arrives as `tool_name: "Bash"`,
+ *    `tool_input.command`.
+ *  - deny: `hookSpecificOutput.permissionDecision: "deny"` + reason (or exit 2).
+ *  - rewrite: `permissionDecision: "allow"` with `updatedInput` — for Bash,
+ *    `updatedInput` **must include a string `command` field**, which the shared splice
+ *    always does.
+ *
+ * Two documented differences from Claude Code, both honoured here:
+ * `permissionDecision: "ask"` is NOT supported (a parse error — the tool proceeds),
+ * and this schema never emits it; project-layer hooks only run once the project is
+ * trusted, which the installer's output says out loud, and which the `[features]`
+ * block below is what enables.
+ */
+const HOOKS = {
+    readTools: ['Read'],
+    bashTools: ['Bash', 'shell'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse',
+            permissionDecision: 'deny',
+            permissionDecisionReason: reason,
+        },
+    }),
+    rewrite: {
+        document: ({ input, announcement }) => ({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'allow',
+                permissionDecisionReason: announcement,
+                updatedInput: input,
+            },
+        }),
+        announce: 'reason',
+    },
+};
+/** The Codex `config.toml` block: enables the hooks feature, marker-bracketed. */
+function codexConfigTomlBlock() {
+    return `${SNIPPET_START_HASH}
+# Enables Codex's hooks feature so .codex/hooks.json is honored. Project-level hooks
+# run only once this project is trusted. Written by \`smelt hooks install\`.
+[features]
+hooks = true
+${SNIPPET_END_HASH}
+`;
+}
+export const codex = {
+    id: 'codex',
+    name: 'Codex CLI',
+    shortName: 'Codex',
+    tier: 'verified',
+    detect: ['.codex'],
+    detectHome: ['.codex'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: [
+        'project-level Codex hooks run only once the project is trusted (features.hooks; see docs/research/2026-09-02-agent-enforcement.md § 3)',
+    ],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.codex/hooks.json',
+            event: 'PreToolUse',
+            matchers: ['Read', 'Bash'],
+            entry: 'command-list',
+            lifecycle: true,
+        },
+        {
+            kind: 'marker-block',
+            file: '.codex/config.toml',
+            block: codexConfigTomlBlock,
+            start: SNIPPET_START_HASH,
+            end: SNIPPET_END_HASH,
+            skipWhen: {
+                contains: '[features]',
+                why: 'already has a [features] table — add `hooks = true` to it yourself',
+            },
+        },
+    ],
+};
+//# sourceMappingURL=codex.js.map

package/dist/harness/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/harness/codex.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC;IACF,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YACtC,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,OAAO;gBAC3B,wBAAwB,EAAE,YAAY;gBACtC,YAAY,EAAE,KAAK;aACpB;SACF,CAAC;QACF,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,kFAAkF;AAClF,SAAS,oBAAoB;IAC3B,OAAO,GAAG,kBAAkB;;;;;EAK5B,gBAAgB;CACjB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAA0B;IAC1C,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,CAAC,QAAQ,CAAC;IAClB,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,wIAAwI;KACzI;IACD,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1B,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,IAAI;SAChB;QACD;YACE,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,oBAAoB;YAC3B,KAAK,EAAE,kBAAkB;YACzB,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,YAAY;gBACtB,GAAG,EAAE,oEAAoE;aAC1E;SACF;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Codex CLI — VERIFIED tier. Schema, install and removal, end to end.\n *\n * Codex's experimental hooks (`features.hooks`, rust-v0.114.0+, on by default from\n * 0.150.1) deliberately mirror Claude Code's schema — the survey is\n * docs/research/2026-09-02-agent-enforcement.md § 3, primary source\n * <https://developers.openai.com/codex/hooks>:\n *\n *  - stdin: `{ tool_name, tool_input }`; shell input arrives as `tool_name: \"Bash\"`,\n *    `tool_input.command`.\n *  - deny: `hookSpecificOutput.permissionDecision: \"deny\"` + reason (or exit 2).\n *  - rewrite: `permissionDecision: \"allow\"` with `updatedInput` — for Bash,\n *    `updatedInput` **must include a string `command` field**, which the shared splice\n *    always does.\n *\n * Two documented differences from Claude Code, both honoured here:\n * `permissionDecision: \"ask\"` is NOT supported (a parse error — the tool proceeds),\n * and this schema never emits it; project-layer hooks only run once the project is\n * trusted, which the installer's output says out loud, and which the `[features]`\n * block below is what enables.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read'],\n  bashTools: ['Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({\n    hookSpecificOutput: {\n      hookEventName: 'PreToolUse',\n      permissionDecision: 'deny',\n      permissionDecisionReason: reason,\n    },\n  }),\n  rewrite: {\n    document: ({ input, announcement }) => ({\n      hookSpecificOutput: {\n        hookEventName: 'PreToolUse',\n        permissionDecision: 'allow',\n        permissionDecisionReason: announcement,\n        updatedInput: input,\n      },\n    }),\n    announce: 'reason',\n  },\n};\n\n/** The Codex `config.toml` block: enables the hooks feature, marker-bracketed. */\nfunction codexConfigTomlBlock(): string {\n  return `${SNIPPET_START_HASH}\n# Enables Codex's hooks feature so .codex/hooks.json is honored. Project-level hooks\n# run only once this project is trusted. Written by \\`smelt hooks install\\`.\n[features]\nhooks = true\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const codex: ShimmedHarnessProfile = {\n  id: 'codex',\n  name: 'Codex CLI',\n  shortName: 'Codex',\n  tier: 'verified',\n  detect: ['.codex'],\n  detectHome: ['.codex'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'project-level Codex hooks run only once the project is trusted (features.hooks; see docs/research/2026-09-02-agent-enforcement.md § 3)',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.codex/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: true,\n    },\n    {\n      kind: 'marker-block',\n      file: '.codex/config.toml',\n      block: codexConfigTomlBlock,\n      start: SNIPPET_START_HASH,\n      end: SNIPPET_END_HASH,\n      skipWhen: {\n        contains: '[features]',\n        why: 'already has a [features] table — add `hooks = true` to it yourself',\n      },\n    },\n  ],\n};\n"]}

package/dist/harness/cursor.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const cursor: ShimmedHarnessProfile;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/harness/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAkC1D,eAAO,MAAM,MAAM,EAAE,qBAqBpB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Cursor — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary source\n * <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the real binary.\n *\n *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it supports\n *    input rewrite), fired for every tool, so the hook file carries one matcher-less\n *    entry; stdin `{ tool_name, tool_input }`, and the settings file is versioned\n *    (`\"version\": 1`).\n *  - deny: `{ \"permission\": \"deny\", \"agentMessage\": … }` — `agentMessage` reaches the\n *    model, `userMessage` the human; the guard's steering text goes to the model.\n *  - rewrite: `{ \"permission\": \"allow\", \"updated_input\": { … } }` (snake_case, the\n *    whole input object), with no message field — announced on stderr instead.\n *\n * Cursor has no static permission-config file — gating is entirely hook code — so this\n * shim plus the instruction file is the whole enforcement story there.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ permission: 'deny', agentMessage: reason }),\n  rewrite: {\n    document: ({ input }) => ({ permission: 'allow', updated_input: input }),\n    // The allow/updated_input shape carries no message field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const cursor: ShimmedHarnessProfile = {\n  id: 'cursor',\n  name: 'Cursor',\n  tier: 'experimental',\n  detect: ['.cursor'],\n  detectHome: ['.cursor'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['Cursor has no static permission config — gating is entirely hook code'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.cursor/hooks.json',\n      event: 'preToolUse',\n      matchers: [undefined],\n      entry: 'bare-command',\n      lifecycle: false,\n      shape: { version: 1 },\n    },\n  ],\n};\n"]}

package/dist/harness/cursor.js

@@ -0,0 +1,54 @@
+/**
+ * Cursor — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary source
+ * <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the real binary.
+ *
+ *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it supports
+ *    input rewrite), fired for every tool, so the hook file carries one matcher-less
+ *    entry; stdin `{ tool_name, tool_input }`, and the settings file is versioned
+ *    (`"version": 1`).
+ *  - deny: `{ "permission": "deny", "agentMessage": … }` — `agentMessage` reaches the
+ *    model, `userMessage` the human; the guard's steering text goes to the model.
+ *  - rewrite: `{ "permission": "allow", "updated_input": { … } }` (snake_case, the
+ *    whole input object), with no message field — announced on stderr instead.
+ *
+ * Cursor has no static permission-config file — gating is entirely hook code — so this
+ * shim plus the instruction file is the whole enforcement story there.
+ */
+const HOOKS = {
+    readTools: ['read_file', 'Read', 'ReadFile'],
+    bashTools: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({ permission: 'deny', agentMessage: reason }),
+    rewrite: {
+        document: ({ input }) => ({ permission: 'allow', updated_input: input }),
+        // The allow/updated_input shape carries no message field — announce on stderr.
+        announce: 'stderr',
+    },
+};
+export const cursor = {
+    id: 'cursor',
+    name: 'Cursor',
+    tier: 'experimental',
+    detect: ['.cursor'],
+    detectHome: ['.cursor'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: ['Cursor has no static permission config — gating is entirely hook code'],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.cursor/hooks.json',
+            event: 'preToolUse',
+            matchers: [undefined],
+            entry: 'bare-command',
+            lifecycle: false,
+            shape: { version: 1 },
+        },
+    ],
+};
+//# sourceMappingURL=cursor.js.map

package/dist/harness/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/harness/cursor.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;IACzD,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAChE,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxE,+EAA+E;QAC/E,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,CAAC,uEAAuE,CAAC;IAClF,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;SACtB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Cursor — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Cursor row; primary source\n * <https://cursor.com/docs/agent/hooks>), not yet smoke-tested against the real binary.\n *\n *  - event: `preToolUse` (the broad hook — unlike `beforeShellExecution`, it supports\n *    input rewrite), fired for every tool, so the hook file carries one matcher-less\n *    entry; stdin `{ tool_name, tool_input }`, and the settings file is versioned\n *    (`\"version\": 1`).\n *  - deny: `{ \"permission\": \"deny\", \"agentMessage\": … }` — `agentMessage` reaches the\n *    model, `userMessage` the human; the guard's steering text goes to the model.\n *  - rewrite: `{ \"permission\": \"allow\", \"updated_input\": { … } }` (snake_case, the\n *    whole input object), with no message field — announced on stderr instead.\n *\n * Cursor has no static permission-config file — gating is entirely hook code — so this\n * shim plus the instruction file is the whole enforcement story there.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['run_terminal_cmd', 'Shell', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ permission: 'deny', agentMessage: reason }),\n  rewrite: {\n    document: ({ input }) => ({ permission: 'allow', updated_input: input }),\n    // The allow/updated_input shape carries no message field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const cursor: ShimmedHarnessProfile = {\n  id: 'cursor',\n  name: 'Cursor',\n  tier: 'experimental',\n  detect: ['.cursor'],\n  detectHome: ['.cursor'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['Cursor has no static permission config — gating is entirely hook code'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.cursor/hooks.json',\n      event: 'preToolUse',\n      matchers: [undefined],\n      entry: 'bare-command',\n      lifecycle: false,\n      shape: { version: 1 },\n    },\n  ],\n};\n"]}

package/dist/harness/gemini.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const gemini: ShimmedHarnessProfile;
+//# sourceMappingURL=gemini.d.ts.map

package/dist/harness/gemini.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../src/harness/gemini.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAsC1D,eAAO,MAAM,MAAM,EAAE,qBAuBpB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Gemini CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * The schema below is mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Gemini CLI row; primary\n * source <https://geminicli.com/docs/hooks/reference/>), and the field names were\n * additionally checked 2026-09-02 against the shipped `@google/gemini-cli` 0.58.0\n * bundle (installed headlessly for the shim's verification pass): the BeforeTool stdin\n * payload is `{ tool_name, tool_input }`, `read_file` takes `file_path` with\n * `start_line`/`end_line` windows, the shell tool is `run_shell_command` with\n * `command`, denial is `{ \"decision\": \"deny\", \"reason\": … }`, and\n * `hookSpecificOutput.tool_input` substitutes the input. What has NOT run is a live\n * end-to-end session (needs credentials this environment does not have), so the tier\n * stays experimental — treat surprises as shim bugs and please report them.\n *\n * Carried caveat from the matrix: Gemini's policy engine has an open bug where an\n * `allow` policy is ignored in non-interactive runs\n * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses\n * hooks, not the policy engine, but non-interactive behaviour is the least-tested\n * corner; verify before relying on it in CI.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'ReadFile', 'Read'],\n  bashTools: ['run_shell_command', 'Shell', 'Bash'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n  rewrite: {\n    document: ({ input }) => ({\n      hookSpecificOutput: { hookEventName: 'BeforeTool', tool_input: input },\n    }),\n    // The BeforeTool rewrite shape carries no reason field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const gemini: ShimmedHarnessProfile = {\n  id: 'gemini',\n  name: 'Gemini CLI',\n  shortName: 'Gemini',\n  tier: 'experimental',\n  detect: ['.gemini'],\n  detectHome: ['.gemini'],\n  instructionFile: 'GEMINI.md',\n  instructions: 'snippet',\n  caveats: [\n    'Gemini policy-engine allow rules are ignored in non-interactive runs (google-gemini/gemini-cli#20469) — verify hook behaviour in CI before relying on it',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.gemini/settings.json',\n      event: 'BeforeTool',\n      matchers: ['read_file', 'run_shell_command'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/gemini.js

@@ -0,0 +1,60 @@
+/**
+ * Gemini CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * The schema below is mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Gemini CLI row; primary
+ * source <https://geminicli.com/docs/hooks/reference/>), and the field names were
+ * additionally checked 2026-09-02 against the shipped `@google/gemini-cli` 0.58.0
+ * bundle (installed headlessly for the shim's verification pass): the BeforeTool stdin
+ * payload is `{ tool_name, tool_input }`, `read_file` takes `file_path` with
+ * `start_line`/`end_line` windows, the shell tool is `run_shell_command` with
+ * `command`, denial is `{ "decision": "deny", "reason": … }`, and
+ * `hookSpecificOutput.tool_input` substitutes the input. What has NOT run is a live
+ * end-to-end session (needs credentials this environment does not have), so the tier
+ * stays experimental — treat surprises as shim bugs and please report them.
+ *
+ * Carried caveat from the matrix: Gemini's policy engine has an open bug where an
+ * `allow` policy is ignored in non-interactive runs
+ * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses
+ * hooks, not the policy engine, but non-interactive behaviour is the least-tested
+ * corner; verify before relying on it in CI.
+ */
+const HOOKS = {
+    readTools: ['read_file', 'ReadFile', 'Read'],
+    bashTools: ['run_shell_command', 'Shell', 'Bash'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({ decision: 'deny', reason }),
+    rewrite: {
+        document: ({ input }) => ({
+            hookSpecificOutput: { hookEventName: 'BeforeTool', tool_input: input },
+        }),
+        // The BeforeTool rewrite shape carries no reason field — announce on stderr.
+        announce: 'stderr',
+    },
+};
+export const gemini = {
+    id: 'gemini',
+    name: 'Gemini CLI',
+    shortName: 'Gemini',
+    tier: 'experimental',
+    detect: ['.gemini'],
+    detectHome: ['.gemini'],
+    instructionFile: 'GEMINI.md',
+    instructions: 'snippet',
+    caveats: [
+        'Gemini policy-engine allow rules are ignored in non-interactive runs (google-gemini/gemini-cli#20469) — verify hook behaviour in CI before relying on it',
+    ],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.gemini/settings.json',
+            event: 'BeforeTool',
+            matchers: ['read_file', 'run_shell_command'],
+            entry: 'command-list',
+            lifecycle: false,
+        },
+    ],
+};
+//# sourceMappingURL=gemini.js.map

package/dist/harness/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../src/harness/gemini.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC;IACjD,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChD,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACxB,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE;SACvE,CAAC;QACF,6EAA6E;QAC7E,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,YAAY;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,0JAA0J;KAC3J;IACD,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;YAC5C,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,KAAK;SACjB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Gemini CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * The schema below is mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Gemini CLI row; primary\n * source <https://geminicli.com/docs/hooks/reference/>), and the field names were\n * additionally checked 2026-09-02 against the shipped `@google/gemini-cli` 0.58.0\n * bundle (installed headlessly for the shim's verification pass): the BeforeTool stdin\n * payload is `{ tool_name, tool_input }`, `read_file` takes `file_path` with\n * `start_line`/`end_line` windows, the shell tool is `run_shell_command` with\n * `command`, denial is `{ \"decision\": \"deny\", \"reason\": … }`, and\n * `hookSpecificOutput.tool_input` substitutes the input. What has NOT run is a live\n * end-to-end session (needs credentials this environment does not have), so the tier\n * stays experimental — treat surprises as shim bugs and please report them.\n *\n * Carried caveat from the matrix: Gemini's policy engine has an open bug where an\n * `allow` policy is ignored in non-interactive runs\n * (<https://github.com/google-gemini/gemini-cli/issues/20469>) — this preset uses\n * hooks, not the policy engine, but non-interactive behaviour is the least-tested\n * corner; verify before relying on it in CI.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'ReadFile', 'Read'],\n  bashTools: ['run_shell_command', 'Shell', 'Bash'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n  rewrite: {\n    document: ({ input }) => ({\n      hookSpecificOutput: { hookEventName: 'BeforeTool', tool_input: input },\n    }),\n    // The BeforeTool rewrite shape carries no reason field — announce on stderr.\n    announce: 'stderr',\n  },\n};\n\nexport const gemini: ShimmedHarnessProfile = {\n  id: 'gemini',\n  name: 'Gemini CLI',\n  shortName: 'Gemini',\n  tier: 'experimental',\n  detect: ['.gemini'],\n  detectHome: ['.gemini'],\n  instructionFile: 'GEMINI.md',\n  instructions: 'snippet',\n  caveats: [\n    'Gemini policy-engine allow rules are ignored in non-interactive runs (google-gemini/gemini-cli#20469) — verify hook behaviour in CI before relying on it',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.gemini/settings.json',\n      event: 'BeforeTool',\n      matchers: ['read_file', 'run_shell_command'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/grok.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const grok: ShimmedHarnessProfile;
+//# sourceMappingURL=grok.d.ts.map

package/dist/harness/grok.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.d.ts","sourceRoot":"","sources":["../../src/harness/grok.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AA2B1D,eAAO,MAAM,IAAI,EAAE,qBAqBlB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Grok CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary source\n * <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against the real\n * binary. Note the matrix's provenance warning: the official CLI is\n * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party\n * clone with a different hook surface.\n *\n *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool\n *    names).\n *  - deny: `{ \"decision\": \"deny\", \"reason\": … }` or exit 2. **Deny-only**: the input\n *    is read-only to hooks, so there is no `rewrite` here — under\n *    `hooks.enforcement: \"rewrite\"` this harness falls back to the deny, whose reason\n *    still carries the exact replacement pipeline.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read', 'read_file', 'ReadFile'],\n  bashTools: ['Bash', 'shell', 'run_shell_command'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n};\n\nexport const grok: ShimmedHarnessProfile = {\n  id: 'grok',\n  name: 'Grok CLI',\n  shortName: 'Grok',\n  tier: 'experimental',\n  detect: ['.grok'],\n  detectHome: ['.grok'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.grok/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/grok.js

@@ -0,0 +1,47 @@
+/**
+ * Grok CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary source
+ * <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against the real
+ * binary. Note the matrix's provenance warning: the official CLI is
+ * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party
+ * clone with a different hook surface.
+ *
+ *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool
+ *    names).
+ *  - deny: `{ "decision": "deny", "reason": … }` or exit 2. **Deny-only**: the input
+ *    is read-only to hooks, so there is no `rewrite` here — under
+ *    `hooks.enforcement: "rewrite"` this harness falls back to the deny, whose reason
+ *    still carries the exact replacement pipeline.
+ */
+const HOOKS = {
+    readTools: ['Read', 'read_file', 'ReadFile'],
+    bashTools: ['Bash', 'shell', 'run_shell_command'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['tool_input'],
+    deny: (reason) => ({ decision: 'deny', reason }),
+};
+export const grok = {
+    id: 'grok',
+    name: 'Grok CLI',
+    shortName: 'Grok',
+    tier: 'experimental',
+    detect: ['.grok'],
+    detectHome: ['.grok'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'json-hooks',
+            file: '.grok/hooks.json',
+            event: 'PreToolUse',
+            matchers: ['Read', 'Bash'],
+            entry: 'command-list',
+            lifecycle: false,
+        },
+    ],
+};
+//# sourceMappingURL=grok.js.map

package/dist/harness/grok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../src/harness/grok.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,CAAC;IACjD,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,YAAY,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAA0B;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,UAAU;IAChB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,OAAO,CAAC;IACjB,UAAU,EAAE,CAAC,OAAO,CAAC;IACrB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,CAAC,qFAAqF,CAAC;IAChG,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1B,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,KAAK;SACjB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport type { ShimmedHarnessProfile } from './profile.ts';\n\n/**\n * Grok CLI — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Grok CLI row; primary source\n * <https://docs.x.ai/build/features/hooks>), not yet smoke-tested against the real\n * binary. Note the matrix's provenance warning: the official CLI is\n * `xai-org/grok-build` (binary `grok`) — `superagent-ai/grok-cli` is a third-party\n * clone with a different hook surface.\n *\n *  - event: `PreToolUse`; stdin `{ tool_name, tool_input }` (Claude-Code-like tool\n *    names).\n *  - deny: `{ \"decision\": \"deny\", \"reason\": … }` or exit 2. **Deny-only**: the input\n *    is read-only to hooks, so there is no `rewrite` here — under\n *    `hooks.enforcement: \"rewrite\"` this harness falls back to the deny, whose reason\n *    still carries the exact replacement pipeline.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['Read', 'read_file', 'ReadFile'],\n  bashTools: ['Bash', 'shell', 'run_shell_command'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['tool_input'],\n  deny: (reason) => ({ decision: 'deny', reason }),\n};\n\nexport const grok: ShimmedHarnessProfile = {\n  id: 'grok',\n  name: 'Grok CLI',\n  shortName: 'Grok',\n  tier: 'experimental',\n  detect: ['.grok'],\n  detectHome: ['.grok'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: ['deny-only hooks: input rewrite is not supported, so rewrite mode falls back to deny'],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'json-hooks',\n      file: '.grok/hooks.json',\n      event: 'PreToolUse',\n      matchers: ['Read', 'Bash'],\n      entry: 'command-list',\n      lifecycle: false,\n    },\n  ],\n};\n"]}

package/dist/harness/hermes.d.ts

@@ -0,0 +1,3 @@
+import type { ShimmedHarnessProfile } from './profile.ts';
+export declare const hermes: ShimmedHarnessProfile;
+//# sourceMappingURL=hermes.d.ts.map

package/dist/harness/hermes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.d.ts","sourceRoot":"","sources":["../../src/harness/hermes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAmDjF,eAAO,MAAM,MAAM,EAAE,qBAsBpB,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport { nodeCommand, shimScriptPath } from './paths.ts';\nimport type { HarnessInstallContext, ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Hermes Agent — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary\n * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>), not\n * yet smoke-tested against the real binary.\n *\n *  - event: `pre_tool_call`; stdin carries the tool name and its arguments\n *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).\n *  - deny: `{ \"action\": \"block\", \"reason\": … }`.\n *  - rewrite: `{ \"action\": \"modify\", \"args\": { … } }` — a **shallow merge** into the\n *    tool's arguments, so this schema sends only the `command` key and the harness\n *    keeps the rest. The modify document has **no reason field**, so the substitution\n *    is announced on stderr — a rewrite must never be silent.\n *\n * Carried caveat from the matrix: Hermes has a known bypass where memory tools ignore\n * `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —\n * tool gating there is leaky at the edges, so treat this hook as best-effort steering,\n * not a boundary.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['execute_command', 'terminal', 'bash', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['args', 'tool_input'],\n  deny: (reason) => ({ action: 'block', reason }),\n  rewrite: {\n    // A shallow merge: only the key that changed travels, never the spliced whole.\n    document: ({ suggestion }) => ({ action: 'modify', args: { command: suggestion } }),\n    announce: 'stderr',\n  },\n};\n\n/** Hermes hook config, as a mergeable snippet — their config is a home-level YAML. */\nfunction hermesHooksYaml(ctx: HarnessInstallContext): string {\n  return `${SNIPPET_START_HASH}\n# Hermes Agent hook config for the smelt guard. EXPERIMENTAL tier: schema mapped from\n# the capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Hermes\n# row), not yet smoke-tested against the real binary. If Hermes does not read this\n# file directly, merge the \\`hooks:\\` section into ~/.hermes/config.yaml.\nhooks:\n  pre_tool_call:\n    - command: ${nodeCommand(ctx.cwd, shimScriptPath(hermes))}\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const hermes: ShimmedHarnessProfile = {\n  id: 'hermes',\n  name: 'Hermes Agent',\n  shortName: 'Hermes',\n  tier: 'experimental',\n  detect: ['.hermes', '.hermes.md'],\n  detectHome: ['.hermes'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'Hermes memory tools bypass disabled_toolsets (NousResearch/hermes-agent#46171) — treat tool gating there as leaky',\n    'hook config may need merging into ~/.hermes/config.yaml by hand; the written file says how',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'own-file',\n      file: '.hermes/hooks.yaml',\n      content: hermesHooksYaml,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/hermes.js

@@ -0,0 +1,72 @@
+import { nodeCommand, shimScriptPath } from './paths.js';
+import { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.js';
+/**
+ * Hermes Agent — EXPERIMENTAL tier. Schema, install and removal, end to end.
+ *
+ * Schema mapped from the capability matrix
+ * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary
+ * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>), not
+ * yet smoke-tested against the real binary.
+ *
+ *  - event: `pre_tool_call`; stdin carries the tool name and its arguments
+ *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).
+ *  - deny: `{ "action": "block", "reason": … }`.
+ *  - rewrite: `{ "action": "modify", "args": { … } }` — a **shallow merge** into the
+ *    tool's arguments, so this schema sends only the `command` key and the harness
+ *    keeps the rest. The modify document has **no reason field**, so the substitution
+ *    is announced on stderr — a rewrite must never be silent.
+ *
+ * Carried caveat from the matrix: Hermes has a known bypass where memory tools ignore
+ * `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —
+ * tool gating there is leaky at the edges, so treat this hook as best-effort steering,
+ * not a boundary.
+ */
+const HOOKS = {
+    readTools: ['read_file', 'Read', 'ReadFile'],
+    bashTools: ['execute_command', 'terminal', 'bash', 'Bash', 'shell'],
+    toolNameKeys: ['tool_name'],
+    toolInputKeys: ['args', 'tool_input'],
+    deny: (reason) => ({ action: 'block', reason }),
+    rewrite: {
+        // A shallow merge: only the key that changed travels, never the spliced whole.
+        document: ({ suggestion }) => ({ action: 'modify', args: { command: suggestion } }),
+        announce: 'stderr',
+    },
+};
+/** Hermes hook config, as a mergeable snippet — their config is a home-level YAML. */
+function hermesHooksYaml(ctx) {
+    return `${SNIPPET_START_HASH}
+# Hermes Agent hook config for the smelt guard. EXPERIMENTAL tier: schema mapped from
+# the capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Hermes
+# row), not yet smoke-tested against the real binary. If Hermes does not read this
+# file directly, merge the \`hooks:\` section into ~/.hermes/config.yaml.
+hooks:
+  pre_tool_call:
+    - command: ${nodeCommand(ctx.cwd, shimScriptPath(hermes))}
+${SNIPPET_END_HASH}
+`;
+}
+export const hermes = {
+    id: 'hermes',
+    name: 'Hermes Agent',
+    shortName: 'Hermes',
+    tier: 'experimental',
+    detect: ['.hermes', '.hermes.md'],
+    detectHome: ['.hermes'],
+    instructionFile: 'AGENTS.md',
+    instructions: 'snippet',
+    caveats: [
+        'Hermes memory tools bypass disabled_toolsets (NousResearch/hermes-agent#46171) — treat tool gating there as leaky',
+        'hook config may need merging into ~/.hermes/config.yaml by hand; the written file says how',
+    ],
+    hooks: HOOKS,
+    install: [
+        {
+            kind: 'own-file',
+            file: '.hermes/hooks.yaml',
+            content: hermesHooksYaml,
+            guardOnly: true,
+        },
+    ],
+};
+//# sourceMappingURL=hermes.js.map

package/dist/harness/hermes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.js","sourceRoot":"","sources":["../../src/harness/hermes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,KAAK,GAAsB;IAC/B,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;IAC5C,SAAS,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;IACnE,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;IACrC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/C,OAAO,EAAE;QACP,+EAA+E;QAC/E,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC;QACnF,QAAQ,EAAE,QAAQ;KACnB;CACF,CAAC;AAEF,sFAAsF;AACtF,SAAS,eAAe,CAAC,GAA0B;IACjD,OAAO,GAAG,kBAAkB;;;;;;;iBAOb,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;EAC3D,gBAAgB;CACjB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAA0B;IAC3C,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,cAAc;IACpB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,UAAU,EAAE,CAAC,SAAS,CAAC;IACvB,eAAe,EAAE,WAAW;IAC5B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE;QACP,mHAAmH;QACnH,4FAA4F;KAC7F;IACD,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE;QACP;YACE,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAC","sourcesContent":["import type { HarnessHookSchema } from '../hooks/shim.ts';\n\nimport { nodeCommand, shimScriptPath } from './paths.ts';\nimport type { HarnessInstallContext, ShimmedHarnessProfile } from './profile.ts';\nimport { SNIPPET_END_HASH, SNIPPET_START_HASH } from './snippet.ts';\n\n/**\n * Hermes Agent — EXPERIMENTAL tier. Schema, install and removal, end to end.\n *\n * Schema mapped from the capability matrix\n * (docs/research/2026-09-02-harness-capability-matrix.md, Hermes Agent row; primary\n * source <https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks>), not\n * yet smoke-tested against the real binary.\n *\n *  - event: `pre_tool_call`; stdin carries the tool name and its arguments\n *    (`tool_name` + `args`, with `tool_input` accepted as a fallback spelling).\n *  - deny: `{ \"action\": \"block\", \"reason\": … }`.\n *  - rewrite: `{ \"action\": \"modify\", \"args\": { … } }` — a **shallow merge** into the\n *    tool's arguments, so this schema sends only the `command` key and the harness\n *    keeps the rest. The modify document has **no reason field**, so the substitution\n *    is announced on stderr — a rewrite must never be silent.\n *\n * Carried caveat from the matrix: Hermes has a known bypass where memory tools ignore\n * `disabled_toolsets` (<https://github.com/NousResearch/hermes-agent/issues/46171>) —\n * tool gating there is leaky at the edges, so treat this hook as best-effort steering,\n * not a boundary.\n */\nconst HOOKS: HarnessHookSchema = {\n  readTools: ['read_file', 'Read', 'ReadFile'],\n  bashTools: ['execute_command', 'terminal', 'bash', 'Bash', 'shell'],\n  toolNameKeys: ['tool_name'],\n  toolInputKeys: ['args', 'tool_input'],\n  deny: (reason) => ({ action: 'block', reason }),\n  rewrite: {\n    // A shallow merge: only the key that changed travels, never the spliced whole.\n    document: ({ suggestion }) => ({ action: 'modify', args: { command: suggestion } }),\n    announce: 'stderr',\n  },\n};\n\n/** Hermes hook config, as a mergeable snippet — their config is a home-level YAML. */\nfunction hermesHooksYaml(ctx: HarnessInstallContext): string {\n  return `${SNIPPET_START_HASH}\n# Hermes Agent hook config for the smelt guard. EXPERIMENTAL tier: schema mapped from\n# the capability matrix (docs/research/2026-09-02-harness-capability-matrix.md, Hermes\n# row), not yet smoke-tested against the real binary. If Hermes does not read this\n# file directly, merge the \\`hooks:\\` section into ~/.hermes/config.yaml.\nhooks:\n  pre_tool_call:\n    - command: ${nodeCommand(ctx.cwd, shimScriptPath(hermes))}\n${SNIPPET_END_HASH}\n`;\n}\n\nexport const hermes: ShimmedHarnessProfile = {\n  id: 'hermes',\n  name: 'Hermes Agent',\n  shortName: 'Hermes',\n  tier: 'experimental',\n  detect: ['.hermes', '.hermes.md'],\n  detectHome: ['.hermes'],\n  instructionFile: 'AGENTS.md',\n  instructions: 'snippet',\n  caveats: [\n    'Hermes memory tools bypass disabled_toolsets (NousResearch/hermes-agent#46171) — treat tool gating there as leaky',\n    'hook config may need merging into ~/.hermes/config.yaml by hand; the written file says how',\n  ],\n  hooks: HOOKS,\n  install: [\n    {\n      kind: 'own-file',\n      file: '.hermes/hooks.yaml',\n      content: hermesHooksYaml,\n      guardOnly: true,\n    },\n  ],\n};\n"]}

package/dist/harness/kilocode.d.ts

@@ -0,0 +1,3 @@
+import type { HarnessProfile } from './profile.ts';
+export declare const kilocode: HarnessProfile;
+//# sourceMappingURL=kilocode.d.ts.map