cohorte 2.10.1 → 3.0.0-dev.0

package/core/hooks/gate.py

@@ -1,588 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse gate — generic, profile-driven.
-
-Forces a confirmation prompt (or hard-denies) on dangerous Bash commands,
-inspecting the FULL command string so chained forms like
-`cd apps/api && node ace migration:run` are caught — something prefix-based
-permission rules in settings.json miss. Branch-conditional patterns follow that
-same chain: a leading `cd <dir>` moves where the branch is resolved, so
-`cd <other repo> && git commit` is judged against the checkout it lands in.
-
-Patterns come from `.claude/gate-config.json` (generated by /cohorte-init-pipeline from
-the PIPELINE.md `gate` block):
-
-    { "deny": ["node ace migration:fresh", ...],
-      "ask":  ["git commit", "git push", "node ace migration:run", ...] }
-
-A pattern matches a command segment when the segment *contains* the pattern
-(after normalizing whitespace). `deny` wins over `ask`. If the config is missing
-or unreadable, the hook stays silent (exit 0) and lets settings.json decide.
-
-The hook fires for EVERY agent in the session — the lead, /cohorte-build's implementers,
-and subagents spawned by the Workflow runtime alike. Workflow subagents run in
-acceptEdits regardless of the session's permission mode (their Write/Edit calls
-are auto-approved), but acceptEdits does NOT auto-approve Bash or Task, so this
-gate still sees and can block them. In bypassPermissions (headless `claude -p`,
-unattended workflow runs) there is no human to answer a prompt, so every `ask` match is
-escalated to a hard deny with the reason attached — a clear refusal beats a
-prompt that can never be answered.
-
-Two extra duties beyond Bash patterns:
-
-- Phase gate (`preflight` block in gate-config.json): a Task dispatch of a
-  listed subagent_type (default review) requires a fresh
-  `.claude/preflight.ok` stamp, written by pipeline/scripts/preflight.sh when
-  typecheck+lint+tests are green. Stale/missing stamp => "ask" — dispatching
-  reviewers onto code that doesn't compile burns their whole run. Freshness is
-  a content digest (see tree_digest), not the HEAD sha: the reviewed tree is
-  normally dirty, so a commit must not invalidate a stamp and an uncommitted
-  edit must. The stamp is local and gitignored — never versioned.
-
-Protocol: reads the PreToolUse payload on stdin; emits a JSON permissionDecision
-of "deny" or "ask" on a match; otherwise exits 0 silently.
-
-Four runtimes can run this as a real blocking hook, and they disagree on the envelope —
-`--runtime <id>` (passed by the installer when it registers the hook) selects the dialect:
-
-    claude    PreToolUse           {"hookSpecificOutput": {"permissionDecision": "deny"|"ask", …}}
-    codex     PreToolUse           same envelope, but `ask` is parsed and NOT honoured
-    cursor    beforeShellExecution {"permission": "deny"|"ask", "user_message", "agent_message"}
-    gemini    BeforeTool           {"decision": "deny", "reason": …}         (no ask tier)
-
-Where a runtime has no `ask`, an `ask` verdict is escalated to `deny` with the reason
-attached rather than downgraded to allow: the whole point of the tier is that a human sees
-the command before it runs, and a runtime that cannot ask cannot deliver that — so the safe
-translation is to refuse and let the human re-run it deliberately. Same rule the
-bypassPermissions escalation has always used.
-
-Explicit mode (`--check`) — for OpenCode, whose extension point is plugins rather than a
-blocking hook. Same config, same patterns, same verdicts; the difference is who calls it.
-There the rendered commands instruct the agent to run the check itself before a gated
-command or a phase dispatch:
-
-    gate.py --check "git push --force"      # a Bash command
-    gate.py --check-dispatch review         # the preflight phase gate
-
-It prints ONE line (`gate: allow` / `gate: ask — <reason>` / `gate: deny — <reason>`)
-and exits 0 / 1 / 2 so a shell can branch on it. This is advisory by construction — an
-agent can decline to call it, which a hook makes impossible — so /cohorte-doctor reports
-the gate as "advisory" on those runtimes rather than pretending parity.
-"""
-
-import json
-import os
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-import time
-
-SPLIT = re.compile(r"&&|\|\||[;|\n]")
-WS = re.compile(r"\s+")
-
-# How far to backdate the throwaway index in tree_digest(), in seconds. Anything modified
-# within this window of the digest is re-hashed by content instead of trusted from its cached
-# stat data. Must stay ≥ the filesystem's mtime granularity (1 s on ext4/HFS+); 5 s covers a
-# clock that ticks backwards a little without costing anything on a quiet tree.
-RACY_WINDOW_S = 5
-HOOK_CWD = None
-
-
-def project_root() -> str:
-    return (os.environ.get("COHORTE_PROJECT_DIR") or os.environ.get("CLAUDE_PROJECT_DIR")
-            or HOOK_CWD or ".")
-
-
-# The generated per-project files (gate config + preflight stamp) live under `.claude/`
-# on a Claude install and `.cohorte/` on every other runtime. Probe both, newest layout
-# first, so one gate serves a repo whichever agent is driving it — and so a repo that
-# adds a second runtime doesn't end up with two configs, one of them silently unread.
-STATE_DIRS = (".cohorte", ".claude")
-
-
-def state_path(name: str) -> str:
-    """Path to a per-project pipeline file: the first layout that has it, else `.claude`
-    (the historical default, so a fresh write lands where existing tooling looks)."""
-    root = project_root()
-    for d in STATE_DIRS:
-        p = os.path.join(root, d, name)
-        if os.path.exists(p):
-            return p
-    return os.path.join(root, ".claude", name)
-
-
-def load_config() -> dict:
-    path = state_path("gate-config.json")
-    empty = {"deny": [], "ask": [], "ask_on_default_branch": [], "default_branch": "main",
-             "preflight": {}}
-    try:
-        with open(path, "r", encoding="utf-8") as fh:
-            cfg = json.load(fh)
-    except Exception:
-        return empty
-    preflight = cfg.get("preflight")
-    if not isinstance(preflight, dict):
-        preflight = {}
-    return {
-        "deny": list(cfg.get("deny", [])),
-        "ask": list(cfg.get("ask", [])),
-        # Patterns gated ONLY on the default branch — allowed freely on feature branches.
-        "ask_on_default_branch": list(cfg.get("ask_on_default_branch", [])),
-        "default_branch": cfg.get("default_branch", "main") or "main",
-        # Phase gate: {"enabled": true, "agents": ["review"], "max_age_minutes": 30}
-        "preflight": preflight,
-    }
-
-
-def norm(s: str) -> str:
-    return WS.sub(" ", s.strip())
-
-
-def session_cwd(payload: dict) -> str:
-    """Where the gated command actually runs. A feature worktree is its own
-    checkout — resolving git state in CLAUDE_PROJECT_DIR (the main checkout)
-    would gate every worktree command as if it ran on the default branch."""
-    return payload.get("cwd") or project_root()
-
-
-CD = re.compile(r"^cd\s+(?!-\s*$)(?P<path>.+)$")
-
-
-def cd_target(seg: str, cwd: str):
-    """The directory a `cd <path>` segment lands in, or None if this segment is
-    not a plain `cd` we can resolve. Chained commands are the norm here — the
-    tool's shell has no memory between calls, so agents write
-    `cd <other repo> && git commit`. Resolving git state at the payload cwd then
-    judges that commit against the WRONG checkout: a commit on a feature branch
-    in another repo was refused as if it were on the default branch, and no
-    approval could lift it because the branch it named was never the branch the
-    command would run on.
-
-    Deliberately narrow: one unquoted-or-quoted path, no `cd -`, no `$(…)`, no
-    variables. Anything else returns None and the caller keeps the cwd it had —
-    the conservative direction, since an unresolvable branch still gates."""
-    m = CD.match(seg)
-    if not m:
-        return None
-    path = m.group("path").strip()
-    if len(path) >= 2 and path[0] == path[-1] and path[0] in "\"'":
-        path = path[1:-1]
-    elif any(c in path for c in "$`\"'*?"):
-        return None  # expansion or globbing — we cannot know where it lands
-    path = os.path.expanduser(path)
-    target = path if os.path.isabs(path) else os.path.join(cwd, path)
-    target = os.path.normpath(target)
-    return target if os.path.isdir(target) else None
-
-
-def current_branch(cwd: str):
-    """The checked-out branch at `cwd`, or None (not a repo / detached / git absent)."""
-    try:
-        out = subprocess.run(
-            ["git", "rev-parse", "--abbrev-ref", "HEAD"],
-            cwd=cwd, capture_output=True, text=True, timeout=3,
-        )
-        if out.returncode == 0:
-            return out.stdout.strip() or None
-    except Exception:
-        pass
-    return None
-
-
-def known_heads(cwd: str):
-    """Every HEAD sha this repo currently has checked out: `cwd`'s plus each
-    linked worktree's. The preflight may legitimately have run in a feature
-    worktree while the Task dispatch fires from the main checkout (or vice
-    versa) — comparing against a single HEAD flags those runs as stale."""
-    heads = set()
-    try:
-        out = subprocess.run(
-            ["git", "rev-parse", "HEAD"],
-            cwd=cwd, capture_output=True, text=True, timeout=3,
-        )
-        if out.returncode == 0 and out.stdout.strip():
-            heads.add(out.stdout.strip())
-    except Exception:
-        pass
-    try:
-        out = subprocess.run(
-            ["git", "worktree", "list", "--porcelain"],
-            cwd=cwd, capture_output=True, text=True, timeout=3,
-        )
-        if out.returncode == 0:
-            for line in out.stdout.splitlines():
-                if line.startswith("HEAD "):
-                    heads.add(line.split(" ", 1)[1].strip())
-    except Exception:
-        pass
-    return heads
-
-
-def worktree_dirs(cwd: str):
-    """`cwd` plus every linked worktree path — the checkouts a stamp may describe."""
-    dirs = [cwd]
-    try:
-        out = subprocess.run(
-            ["git", "worktree", "list", "--porcelain"],
-            cwd=cwd, capture_output=True, text=True, timeout=3,
-        )
-        if out.returncode == 0:
-            for line in out.stdout.splitlines():
-                if line.startswith("worktree "):
-                    p = line.split(" ", 1)[1].strip()
-                    if p and p not in dirs:
-                        dirs.append(p)
-    except Exception:
-        pass
-    return dirs
-
-
-def tree_digest(cwd: str):
-    """The digest pipeline/scripts/preflight.sh stamps for the checkout at `cwd`: the git
-    tree id of the working tree, computed in a throwaway index (`.claude`, `.cohorte` and `specs`
-    excluded — the pipeline writes those itself). Content-addressed, so a commit of the
-    same code keeps the stamp valid and any real edit invalidates it. Must stay identical
-    to the shell side. Returns None when git can't answer, and the caller falls back."""
-    tmp = None
-    try:
-        idx = subprocess.run(
-            ["git", "rev-parse", "--absolute-git-dir"],
-            cwd=cwd, capture_output=True, text=True, timeout=3,
-        )
-        if idx.returncode != 0:
-            return None
-        real_index = os.path.join(idx.stdout.strip(), "index")
-        fd, tmp = tempfile.mkstemp(prefix="cohorte-idx-")
-        os.close(fd)
-        # Seed from the real index to keep its stat cache — `add` then re-hashes only
-        # what changed instead of the whole tree on every dispatch.
-        if os.path.exists(real_index):
-            shutil.copyfile(real_index, tmp)
-            # Age the copy by a few seconds. Git trusts an entry's cached stat data only when
-            # the entry's mtime is OLDER than the index file's; entries at or after it are
-            # "racily clean" and get re-hashed by content. copyfile stamps the temp index with
-            # `now`, so a file edited in the same second as the preflight — with an unchanged
-            # size — looked clean here and the gate greened code that had changed. Backdating
-            # forces a content check for anything touched inside that window, and leaves the
-            # stat-cache fast path (the whole point of seeding from the real index) intact for
-            # every older file.
-            old = time.time() - RACY_WINDOW_S
-            os.utime(tmp, (old, old))
-        else:
-            os.unlink(tmp)  # a 0-byte index is a corrupt index — let git create it
-        env = dict(os.environ, GIT_INDEX_FILE=tmp)
-        # Drop the excluded paths outright — an `add` exclude only stops them being
-        # *updated*, so already-tracked ones would still shift the tree id.
-        subprocess.run(
-            ["git", "rm", "--cached", "-r", "-q", "--ignore-unmatch", "--",
-             ".claude", ".cohorte", "specs"],
-            cwd=cwd, capture_output=True, timeout=10, env=env,
-        )
-        add = subprocess.run(
-            ["git", "add", "-A", "--", ".",
-             ":(exclude).claude", ":(exclude).cohorte", ":(exclude)specs"],
-            cwd=cwd, capture_output=True, timeout=30, env=env,
-        )
-        if add.returncode != 0:
-            return None
-        out = subprocess.run(
-            ["git", "write-tree"], cwd=cwd, capture_output=True, text=True, timeout=10, env=env,
-        )
-        if out.returncode != 0:
-            return None
-        return out.stdout.strip() or None
-    except Exception:
-        return None
-    finally:
-        for p in ((tmp, tmp + ".lock") if tmp else ()):
-            try:
-                os.unlink(p)
-            except Exception:
-                pass
-
-
-def known_digests(cwd: str):
-    """Every checkout's current digest. The preflight may have run in a feature worktree
-    while the Task dispatch fires from the main checkout (or vice versa) — same reason
-    known_heads() spans worktrees."""
-    return {d for d in (tree_digest(p) for p in worktree_dirs(cwd)) if d}
-
-
-def check_preflight(payload: dict, cfg: dict) -> int:
-    """Phase gate on Task dispatches: review agents need a green preflight stamp."""
-    pf = cfg.get("preflight") or {}
-    if not pf.get("enabled"):
-        return 0
-    agents = pf.get("agents") or ["review"]
-    # Runtimes name a subagent dispatch differently. Claude Code and Cursor send a `Task` tool
-    # carrying `subagent_type`; Gemini exposes each subagent as a tool of the SAME NAME, so the
-    # dispatch arrives as `tool_name: review`. Accept both rather than gating only the shape
-    # one vendor happens to use — a phase gate that silently never fires is the 1.3.0 bug.
-    tool_input = payload.get("tool_input") or {}
-    subagent = tool_input.get("subagent_type") or tool_input.get("agent_type") or ""
-    if not subagent and payload.get("tool_name") in agents:
-        subagent = payload.get("tool_name")
-    if subagent not in agents:
-        return 0
-
-    stamp = state_path("preflight.ok")
-    why = None
-    try:
-        with open(stamp, "r", encoding="utf-8") as fh:
-            raw = fh.read().strip()
-    except Exception:
-        raw = None
-        why = "no preflight stamp found"
-    if raw is not None:
-        try:
-            fields = raw.split()
-            epoch_s = fields[0]
-            sha = fields[1] if len(fields) > 1 else ""
-            digest = fields[2] if len(fields) > 2 else ""
-            age_min = (time.time() - float(epoch_s)) / 60
-            max_age = float(pf.get("max_age_minutes", 30) or 30)
-            cwd = session_cwd(payload)
-            if age_min > max_age:
-                why = f"the preflight stamp is {age_min:.0f} min old (max {max_age:.0f})"
-            elif digest not in ("", "none"):
-                # 2.0.0+ stamp: key off the verified CONTENT, not HEAD. A commit that
-                # doesn't touch code keeps the stamp valid; an edit that never reaches a
-                # commit invalidates it — both of which the sha comparison got backwards.
-                digests = known_digests(cwd)
-                if digests and digest not in digests:
-                    why = "the code changed since the preflight ran"
-            else:
-                # Pre-2.0.0 stamp (no digest) — fall back to the HEAD comparison.
-                heads = known_heads(cwd)
-                if heads and sha not in ("", "none") and sha not in heads:
-                    why = "HEAD moved since the preflight ran"
-        except Exception:
-            why = "the preflight stamp is unreadable (expected `<epoch> <sha> <digest>`)"
-    if why is None:
-        return 0
-    # Same rule as the Bash gate: unattended runs have nobody to answer an "ask".
-    unattended = payload.get("permission_mode") == "bypassPermissions"
-    return decide(
-        "deny" if unattended else "ask",
-        f"Phase gate: dispatching `{subagent}` but {why}. Run the deterministic pre-flight first "
-        f"(pipeline/scripts/preflight.sh — typecheck + lint + tests) so agents never review red code; "
-        f"or confirm to dispatch anyway (PIPELINE.md gate.preflight)."
-        + (" (denied outright: unattended run, nobody to confirm)" if unattended else ""),
-    )
-
-
-def check_cli(argv) -> int:
-    """Explicit gate for runtimes with no PreToolUse hook.
-
-    Builds the same payload the hook would have received and runs the same evaluation,
-    then translates the verdict into a line + exit code a shell (or an agent reading the
-    output) can act on. Exit 0 = allow, 1 = ask, 2 = deny — chosen so `&&` naturally
-    stops on anything that isn't a clean allow."""
-    mode = argv[0]
-    unattended = False
-    cwd = os.getcwd()
-    words = []
-    i = 1
-    while i < len(argv):
-        a = argv[i]
-        if a == "--unattended":
-            unattended = True
-        elif a == "--cwd" and i + 1 < len(argv):
-            cwd = argv[i + 1]
-            i += 1
-        elif a.startswith("--cwd="):
-            cwd = a[6:]
-        else:
-            words.append(a)
-        i += 1
-    subject = " ".join(words).strip()
-    if not subject:
-        print(f"gate: usage — gate.py {mode} <{'command' if mode == '--check' else 'agent'}>",
-              file=sys.stderr)
-        return 2
-
-    payload = {"cwd": cwd, "permission_mode": "bypassPermissions" if unattended else "default"}
-    if mode == "--check":
-        payload["tool_name"] = "Bash"
-        payload["tool_input"] = {"command": subject}
-    else:
-        payload["tool_name"] = "Task"
-        payload["tool_input"] = {"subagent_type": subject}
-
-    # Reuse the hook path verbatim — one evaluator, so the two modes can never drift into
-    # different verdicts on the same config. `decide()` records instead of printing while
-    # DECISIONS is armed, so the hook's JSON never leaks into the human-readable output.
-    global DECISIONS
-    DECISIONS = []
-    cfg = load_config()
-    if payload["tool_name"] == "Task":
-        check_preflight(payload, cfg)
-    else:
-        check_bash(payload, cfg)
-
-    if not DECISIONS:
-        print("gate: allow")
-        return 0
-    decision, reason = DECISIONS[0]
-    print(f"gate: {decision} — {reason}")
-    return 2 if decision == "deny" else 1
-
-
-def check_bash(payload: dict, cfg: dict) -> int:
-    """Pattern gate on a Bash command. Split out of main() so --check reuses it."""
-    command = (payload.get("tool_input") or {}).get("command", "") or ""
-    deny, ask, branch_gated = cfg["deny"], cfg["ask"], cfg["ask_on_default_branch"]
-    default = cfg["default_branch"]
-    if not deny and not ask and not branch_gated:
-        return 0
-
-    # No human can answer a prompt in bypassPermissions (headless runs) — an "ask"
-    # there either hangs or silently auto-resolves, so escalate it to a clear deny.
-    unattended = payload.get("permission_mode") == "bypassPermissions"
-    ask_decision = "deny" if unattended else "ask"
-    ask_suffix = " (denied outright: unattended run, nobody to confirm)" if unattended else ""
-
-    # Branch-conditional patterns (e.g. git/docker) are gated only on the default branch;
-    # on a feature branch they run freely. Unknown branch (no repo / detached / no git) ⇒
-    # be conservative and gate. The branch is resolved per segment at the cwd that
-    # segment runs in — a leading `cd <dir>` in the same chain moves it — and cached,
-    # so the common case is still one git call.
-    cwd = session_cwd(payload)
-    branch_cache = {}
-
-    def on_default_at(directory: str) -> bool:
-        if directory not in branch_cache:
-            branch = current_branch(directory)
-            branch_cache[directory] = branch is None or branch == default
-        return branch_cache[directory]
-
-    segments = [s for s in (norm(raw) for raw in SPLIT.split(command)) if s]
-
-    # Deny wins over ask across the WHOLE chain, not just in segment order. Scanning
-    # segment-by-segment returned on the first match, so `git commit -m x && node ace
-    # migration:fresh` surfaced only the benign `git commit` ask — and the human's one
-    # confirmation ran the hard-denied command behind it. Scan every segment for deny
-    # patterns first; only a fully deny-free chain gets an ask.
-    for seg in segments:
-        for pat in deny:
-            if norm(pat) in seg:
-                return decide("deny", f"`{pat}` is forbidden by the project's PIPELINE.md gate.")
-
-    for seg in segments:
-        for pat in ask:
-            if norm(pat) in seg:
-                return decide(ask_decision,
-                              f"`{pat}` is a gated command — confirm first (PIPELINE.md gate)."
-                              f"{ask_suffix}")
-        if branch_gated and on_default_at(cwd):
-            for pat in branch_gated:
-                if norm(pat) in seg:
-                    return decide(ask_decision,
-                                  f"`{pat}` is gated on the default branch `{default}` — confirm "
-                                  f"(PIPELINE.md gate). It runs freely on feature branches."
-                                  f"{ask_suffix}")
-        # Apply the `cd` AFTER matching this segment: a `cd` is not itself gated,
-        # and every later segment in the chain runs in the new directory.
-        moved = cd_target(seg, cwd)
-        if moved:
-            cwd = moved
-
-    return 0
-
-
-def main() -> int:
-    argv = sys.argv[1:]
-    if argv and argv[0] in ("--check", "--check-dispatch"):
-        return check_cli(argv)
-
-    global RUNTIME, HOOK_CWD
-    for i, a in enumerate(argv):
-        if a == "--runtime" and i + 1 < len(argv):
-            RUNTIME = argv[i + 1]
-        elif a.startswith("--runtime="):
-            RUNTIME = a[10:]
-
-    try:
-        payload = json.load(sys.stdin)
-    except Exception:
-        return 0  # malformed input → don't block
-
-    # Codex provides the project cwd in the envelope, not CLAUDE_PROJECT_DIR.
-    # A globally installed hook must inspect the calling project, not the process cwd.
-    if isinstance(payload.get("cwd"), str) and payload["cwd"]:
-        HOOK_CWD = payload["cwd"]
-
-    tool = payload.get("tool_name")
-    # Cursor's shell hook carries the command at the top level rather than in tool_input, and
-    # names no tool. Normalise once here so every check below stays runtime-agnostic.
-    if RUNTIME == "cursor" and not tool:
-        tool = "Bash"
-        payload = dict(payload, tool_name="Bash",
-                       tool_input=payload.get("tool_input") or {"command": payload.get("command", "")})
-    cfg = load_config()
-
-    # A dispatch, in whichever shape this runtime sends it (see check_preflight).
-    if tool in ("Task", "spawn_agent", "Agent") or tool in ((cfg.get("preflight") or {}).get("agents") or ["review"]):
-        return check_preflight(payload, cfg)
-    # Bash is Claude's/Codex's name for the shell tool; Gemini calls it run_shell_command, and
-    # Cursor's beforeShellExecution was normalised to "Bash" above. Anything else is not a
-    # command we gate.
-    if tool not in ("Bash", "shell", "run_shell_command"):
-        return 0
-    return check_bash(payload, cfg)
-
-
-# Armed by --check: while it is a list, decide() records the verdict instead of emitting
-# a hook envelope, which only a hook host understands.
-DECISIONS = None
-
-# Which runtime is hosting this hook — set from `--runtime <id>`. Defaults to Claude Code:
-# it is the only host that ran this file before the flag existed, so an old registration
-# that predates the adapter keeps behaving exactly as it did.
-RUNTIME = "claude"
-
-# Runtimes whose hook contract has no "ask" tier. Codex parses `permissionDecision: ask` and
-# ignores it — which would let a gated command through — and Gemini's BeforeTool only
-# allows or denies. Escalate rather than downgrade: see the module docstring.
-NO_ASK = {"codex", "gemini"}
-
-
-def decide(decision: str, reason: str) -> int:
-    if DECISIONS is not None:
-        DECISIONS.append((decision, reason))
-        return 0
-
-    if decision == "ask" and RUNTIME in NO_ASK:
-        decision = "deny"
-        reason += (f" (denied outright: {RUNTIME} has no confirmation tier, so an \"ask\" here "
-                   f"would silently run. Re-run it yourself if you meant to.)")
-
-    if RUNTIME == "cursor":
-        # Cursor's own envelope. `agent_message` is what the model is told, `user_message`
-        # what the human sees — the reason serves both.
-        print(json.dumps({"permission": decision, "user_message": reason, "agent_message": reason}))
-        return 2 if decision == "deny" else 0
-
-    if RUNTIME == "gemini":
-        # BeforeTool speaks {"decision", "reason"}; anything else is read as allow.
-        print(json.dumps({"decision": decision, "reason": reason}))
-        return 0
-
-    # Claude Code and Codex share the PreToolUse envelope.
-    print(
-        json.dumps(
-            {
-                "hookSpecificOutput": {
-                    "hookEventName": "PreToolUse",
-                    "permissionDecision": decision,
-                    "permissionDecisionReason": reason,
-                }
-            }
-        )
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

package/core/runtimes/claude.json

@@ -1,74 +0,0 @@
-{
-  "id": "claude",
-  "label": "Claude Code",
-  "docs": "https://docs.claude.com/en/docs/claude-code/slash-commands",
-  "detect": [
-    "~/.claude",
-    "~/.config/claude"
-  ],
-  "scopes": {
-    "global": {
-      "root": "~/.claude",
-      "core": "~/.claude",
-      "commands": "~/.claude/commands",
-      "agents": "~/.claude/agents",
-      "hooks": "~/.claude/hooks",
-      "workflows": "~/.claude/workflows",
-      "settings": "~/.claude/settings.json",
-      "hooks_config": "~/.claude/settings.json"
-    },
-    "project": {
-      "root": ".claude",
-      "core": ".claude",
-      "commands": ".claude/commands",
-      "agents": ".claude/agents",
-      "hooks": ".claude/hooks",
-      "workflows": ".claude/workflows",
-      "settings": ".claude/settings.json",
-      "hooks_config": ".claude/settings.json"
-    }
-  },
-  "exclude_commands": [],
-  "command": {
-    "format": "md",
-    "ext": ".md",
-    "frontmatter": [
-      "model",
-      "description",
-      "argument-hint",
-      "allowed-tools",
-      "disable-model-invocation"
-    ],
-    "args": "$ARGUMENTS",
-    "invoke": "/<name>"
-  },
-  "agent": {
-    "format": "md",
-    "frontmatter": [
-      "name",
-      "description",
-      "tools",
-      "model"
-    ],
-    "dispatch": "Task tool, subagent_type: <name>",
-    "address": "<name>",
-    "ext": ".md"
-  },
-  "capabilities": {
-    "subagents": true,
-    "hooks": true,
-    "workflows": true,
-    "inline_design": true,
-    "mcp": true,
-    "tool_restriction": true
-  },
-  "memory": "CLAUDE.md",
-  "headless": "claude -p",
-  "hook": {
-    "format": "claude",
-    "event": "PreToolUse",
-    "matcher": "Bash|Task",
-    "supports_ask": true,
-    "config_shape": "settings"
-  }
-}