failproofai 1.0.3 → 1.0.4-beta.1

package/src/hooks/integrations.ts

@@ -7,7 +7,7 @@
  * is agent-agnostic — only install/uninstall plumbing varies.
  */
 import { execSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, rmSync, chmodSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
@@ -38,6 +38,14 @@ import {
   ANTIGRAVITY_HOOK_EVENT_TYPES,
   ANTIGRAVITY_HOOK_SCOPES,
   GOOSE_HOOK_EVENT_TYPES,
+  GROK_HOOK_EVENT_TYPES,
+  GROK_HOOK_SCOPES,
+  QWEN_HOOK_EVENT_TYPES,
+  QWEN_HOOK_SCOPES,
+  ORI_HOOK_SCOPES,
+  ORI_HOOK_EVENT_TYPES,
+  CLINE_HOOK_SCOPES,
+  CLINE_HOOK_EVENT_TYPES,
   GOOSE_HOOK_SCOPES,
   FAILPROOFAI_HOOK_MARKER,
   INTEGRATION_TYPES,
@@ -2275,13 +2283,755 @@ export const goose: Integration = {
   },
 };
 
-// ── Registry ────────────────────────────────────────────────────────────────
+
+// ── Ori (OpenRouter's ori) ──────────────────────────────────────────────────
+//
+// Enforces on ori's OWN agent (bare `ori` / `ori code`), NOT on its launcher
+// path — `ori claude`, `ori codex`, `ori grok`, `ori opencode` and friends run
+// the real third-party binary with credentials injected and no config-dir
+// redirect, so the hooks already installed for those CLIs keep enforcing there
+// with nothing ori-specific required. See the ORI section of types.ts for the
+// live evidence behind that.
+//
+// A feature is a workspace package under the global workspace's `features/`,
+// AUTO-DISCOVERED with no config file to register it in — so, like Goose, the
+// install is "drop a directory" rather than "edit a settings file". The
+// bookkeeping JSON below exists purely so the Integration interface has a
+// settings path to read, write and detect against; ori itself ignores it.
+//
+// USER scope only: bare `ori` boots the GLOBAL workspace rather than the
+// project's, so one install covers every project and a project-scope install
+// would never be loaded.
+export const ORI_FEATURE_ID = "failproofai";
+
+/** ori's home (override with ORI_HOME, used by tests). */
+export function oriHome(): string {
+  return process.env.ORI_HOME || resolve(homedir(), ".ori");
+}
+
+/** The feature directory failproofai generates inside ori's global workspace. */
+export function oriFeatureDir(): string {
+  return resolve(oriHome(), "global", "features", ORI_FEATURE_ID);
+}
+
+/**
+ * The ori feature shim.
+ *
+ * Claims all three published approval extension points. Each is `unique`, so
+ * leaving one unclaimed invites another feature to take it — but the STATIC one
+ * is deliberately inert (`defaultAction: "ask"`, which is what self-drive
+ * already does). Claiming it with a blanket `reject` would brick every
+ * self-drive session the moment failproofai is installed.
+ *
+ * FAIL-CLOSED BY DEFAULT, and this is the one integration where that is free:
+ * ori declares `failureBehavior: "deny"` on both dynamic points — "a throwing,
+ * rejecting, or malformed provider denies the request" — so letting an error
+ * propagate IS the deny. Set FAILPROOFAI_ORI_FAIL_OPEN=1 to allow instead, for
+ * anyone who would rather a failproofai fault not stop their agent.
+ */
+function buildOriFeatureShim(binaryPath: string): string {
+  return `// AUTO-GENERATED by failproofai. ${FAILPROOFAI_HOOK_MARKER}
+// Re-generate via: failproofai policies --install --cli ori
+//
+// Bridges ori's approval extension points to the failproofai binary. Ships NO
+// inline tool maps: it forwards ori's raw tool name and arguments, and the
+// binary canonicalizes them via ORI_TOOL_MAP / ORI_TOOL_INPUT_MAP (one source
+// of truth), exactly as the OpenClaw plugin does.
+import { spawn } from "node:child_process";
+
+import { ApprovalAskers, ApprovalPolicies, UnattendedApprovals } from "ori";
+
+const BIN = ${JSON.stringify(binaryPath)};
+const FAIL_OPEN = process.env.FAILPROOFAI_ORI_FAIL_OPEN === "1";
+
+/** ori hands arguments as a flat {name, value} string array. Rebuild the object
+ *  the binary's tool-input canonicalization expects. The synthetic
+ *  \`escalated\` entry ori appends on the second pass of its escalation ladder
+ *  is metadata, not a tool argument, so it is dropped from the tool input. */
+function toToolInput(request) {
+  const out = {};
+  for (const a of request.arguments ?? []) {
+    if (request.escalated && a.name === "escalated" && a.value === "true") continue;
+    out[a.name] = a.value;
+  }
+  return out;
+}
+
+function callPolicy(request) {
+  return new Promise((done, fail) => {
+    let child;
+    try {
+      child = spawn("node", [BIN, "--hook", "PreToolUse", "--cli", "ori"], {
+        stdio: ["pipe", "pipe", "inherit"],
+      });
+    } catch (err) {
+      FAIL_OPEN ? done({ permission: "allow" }) : fail(err);
+      return;
+    }
+    let out = "";
+    let settled = false;
+    const finish = (fn, arg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(arg);
+    };
+    const timer = setTimeout(() => {
+      try { child.kill(); } catch { /* already gone */ }
+      FAIL_OPEN
+        ? finish(done, { permission: "allow" })
+        : finish(fail, new Error("failproofai timed out"));
+    }, 30_000);
+    child.stdout.on("data", (d) => { out += d; });
+    child.on("error", (err) => {
+      FAIL_OPEN ? finish(done, { permission: "allow" }) : finish(fail, err);
+    });
+    child.on("close", (code, signal) => {
+      // A non-zero exit or a signal means failproofai produced NO verdict — a
+      // missing bundle, a crashed evaluator, an OOM kill. Resolving that to
+      // "allow" is exactly the silent non-enforcement ori's
+      // failureBehavior deny exists to prevent, and it could never fire,
+      // because resolving is what tells ori the provider succeeded. Only a
+      // REJECT reaches that guarantee.
+      if (signal || (typeof code === "number" && code !== 0)) {
+        const err = new Error(
+          "failproofai produced no verdict (" +
+            (signal ? "killed by " + signal : "exit code " + code) +
+            ")",
+        );
+        FAIL_OPEN ? finish(done, { permission: "allow" }) : finish(fail, err);
+        return;
+      }
+      const stdout = out.trim();
+      // Exit 0 with empty stdout IS the evaluator's clean-allow shape — the one
+      // case where no output is a real verdict rather than a failure.
+      if (!stdout) { finish(done, { permission: "allow" }); return; }
+      let verdict;
+      try {
+        verdict = JSON.parse(stdout);
+      } catch (err) {
+        FAIL_OPEN ? finish(done, { permission: "allow" }) : finish(fail, err);
+        return;
+      }
+      // Anything that is not an explicit allow/deny is an unrecognised answer,
+      // not an allow. decide() maps every non-"deny" to allow, so an
+      // unvalidated object would silently become one.
+      if (!verdict || (verdict.permission !== "allow" && verdict.permission !== "deny")) {
+        const err = new Error("failproofai returned an unrecognised verdict: " + stdout.slice(0, 200));
+        FAIL_OPEN ? finish(done, { permission: "allow" }) : finish(fail, err);
+        return;
+      }
+      finish(done, verdict);
+    });
+    try {
+      child.stdin.end(JSON.stringify({
+        hook_event_name: "PreToolUse",
+        tool_name: request.tool,
+        tool_input: toToolInput(request),
+        cwd: process.cwd(),
+        ori: {
+          capabilities: request.capabilities ?? [],
+          escalated: request.escalated === true,
+        },
+      }));
+    } catch (err) {
+      FAIL_OPEN ? finish(done, { permission: "allow" }) : finish(fail, err);
+    }
+  });
+}
+
+async function decide(request) {
+  const verdict = await callPolicy(request);
+  return { outcome: verdict.permission === "deny" ? "deny" : "allow" };
+}
+
+export const provisions = [
+  // Claimed so no other feature can take it; inert on purpose — see above.
+  ApprovalPolicies.provide({ defaultAction: "ask", rules: [] }),
+  // The gate that fires when a human is present (\`ori --approvals manual\`).
+  ApprovalAskers.provide(decide),
+  // The gate that fires on unattended runs.
+  UnattendedApprovals.provide(decide),
+];
+`;
+}
+
+const ORI_FEATURE_PACKAGE_JSON = `${JSON.stringify(
+  { name: "failproofai", private: true, type: "module" },
+  null,
+  2,
+)}\n`;
+
+export const ori: Integration = {
+  id: "ori",
+  displayName: "Ori",
+  scopes: ORI_HOOK_SCOPES,
+  eventTypes: ORI_HOOK_EVENT_TYPES,
+
+  // USER scope only — ori has no project workspace that bare `ori` would boot.
+  // The path is bookkeeping for this interface, not something ori reads.
+  getSettingsPath() {
+    return resolve(oriFeatureDir(), "failproofai.json");
+  },
+
+  readSettings(settingsPath) {
+    return readJsonFile(settingsPath);
+  },
+
+  writeSettings(settingsPath, settings) {
+    writeJsonFile(settingsPath, settings);
+  },
+
+  buildHookEntry(binaryPath, eventType) {
+    return { type: "command", command: `"${binaryPath}" --hook ${eventType} --cli ori`, [FAILPROOFAI_HOOK_MARKER]: true };
+  },
+
+  isFailproofaiHook(hook) {
+    if (!hook || typeof hook !== "object") return false;
+    return (hook as Record<string, unknown>)[FAILPROOFAI_HOOK_MARKER] === true;
+  },
+
+  /**
+   * Install: write the feature (feature.ts + package.json) into ori's global
+   * workspace, and record the entry in the bookkeeping JSON. ori discovers the
+   * directory on its own — there is no config array to append to.
+   */
+  writeHookEntries(settings, binaryPath) {
+    const dir = oriFeatureDir();
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(resolve(dir, "feature.ts"), buildOriFeatureShim(binaryPath), "utf8");
+    writeFileSync(resolve(dir, "package.json"), ORI_FEATURE_PACKAGE_JSON, "utf8");
+
+    const s = settings as Record<string, unknown>;
+    s.hooks = ORI_HOOK_EVENT_TYPES.map((eventType) =>
+      this.buildHookEntry(binaryPath, eventType, "user"),
+    );
+  },
+
+  /**
+   * Uninstall: drop the whole feature directory, but ONLY when the generated
+   * feature carries our marker — never delete a hand-written ori feature that
+   * happens to sit at the same path.
+   */
+  removeHooksFromFile(settingsPath) {
+    const dir = dirname(settingsPath);
+    const featurePath = resolve(dir, "feature.ts");
+    let removed = 0;
+
+    const settings = this.readSettings(settingsPath) as Record<string, unknown>;
+    if (Array.isArray(settings.hooks)) {
+      removed = settings.hooks.filter((h) => this.isFailproofaiHook(h)).length;
+    }
+
+    const ours =
+      existsSync(featurePath) &&
+      readFileSync(featurePath, "utf8").includes(FAILPROOFAI_HOOK_MARKER);
+    if (ours) {
+      rmSync(dir, { recursive: true, force: true });
+      return removed || 1;
+    }
+
+    // Someone replaced the feature by hand — leave it, drop only our record.
+    delete settings.hooks;
+    this.writeSettings(settingsPath, settings);
+    return removed;
+  },
+
+  hooksInstalledInSettings() {
+    const featurePath = resolve(oriFeatureDir(), "feature.ts");
+    if (!existsSync(featurePath)) return false;
+    try {
+      return readFileSync(featurePath, "utf8").includes(FAILPROOFAI_HOOK_MARKER);
+    } catch {
+      return false;
+    }
+  },
+
+  detectInstalled() {
+    return binaryExists("ori");
+  },
+};
+
+
+// ── Cline (cline CLI) ───────────────────────────────────────────────────────
+//
+// Cline's config is a DIRECTORY OF EVENT-NAMED FILES, not a settings file — the
+// only integration shaped that way. There is no JSON to merge and no array to
+// append to: the install drops one launcher script per event, named exactly for
+// the event it subscribes to.
+//
+// Two rules from the live contract govern the whole install (cline v3.0.60):
+//   1. FILENAME == EVENT, case-insensitively, and only ten names exist. A typo
+//      is not an error, it is SILENCE — which is exactly how an earlier probe
+//      concluded, wrongly, that cline had no reachable hook surface.
+//   2. The EXTENSION must be in cline's allowlist or the file is skipped, also
+//      silently. We write `.sh` with a matching shebang so the interpreter is
+//      unambiguous whichever rule cline applies (shebang first, else extension).
+//
+// THE CRITICAL DIFFERENCE FROM ORI: ori owns its entire feature directory, so
+// uninstall can remove it wholesale. Cline's hooks directory is SHARED with the
+// user's own hooks, so uninstall deletes individual files carrying our marker
+// and MUST NEVER remove the directory — deleting someone's hand-written
+// `PreToolUse.py` because it sat at the same path is unrecoverable.
+//
+// NEVER emit `--hooks-dir`: that flag writes CLINE_HOOKS_DIR, which appears
+// exactly once in cline's shipped binary — the write — and is read by nothing.
+
+/** The extension we write. In cline's allowlist, and paired with a shebang. */
+export const CLINE_HOOK_FILE_EXTENSION = ".sh";
+
+/** cline's home (CLINE_DIR is cline's own var; CLINE_HOME is for tests). */
+export function clineIntegrationHome(): string {
+  return process.env.CLINE_HOME || process.env.CLINE_DIR || resolve(homedir(), ".cline");
+}
+
+/**
+ * cline scans four directories; we write the two that map onto our scopes.
+ * User scope is `$CLINE_DIR/hooks`; project scope is `<cwd>/.clinerules/hooks`.
+ */
+export function clineHooksDir(scope: HookScope, cwd?: string): string {
+  const base = cwd ? resolve(cwd) : process.cwd();
+  return scope === "user"
+    ? resolve(clineIntegrationHome(), "hooks")
+    : resolve(base, ".clinerules", "hooks");
+}
+
+function buildClineHookScript(binaryPath: string, eventType: string, scope: HookScope): string {
+  const invocation = scope === "project" ? "npx -y failproofai" : `"${binaryPath}"`;
+  return `#!/usr/bin/env bash
+# AUTO-GENERATED by failproofai. ${FAILPROOFAI_HOOK_MARKER}
+# Re-generate via: failproofai policies --install --cli cline
+#
+# THE FILENAME IS THE EVENT. cline binds this file to its ${eventType} event by
+# basename (case-insensitively) and by nothing else: renaming it silently
+# unsubscribes it, and an extension outside cline's allowlist is skipped without
+# a log line. Verified against cline v3.0.60.
+#
+# cline IGNORES THE EXIT CODE. The verdict is the single JSON object on stdout,
+# so this script must ALWAYS print exactly one object, and must print '{}' when
+# failproofai produced nothing: unparseable stdout makes cline skip the hook and
+# run the tool anyway (fail-open, 120s default timeout).
+#
+# Blocking shape, the only one cline reads: {"cancel":true,"errorMessage":"..."}.
+# There is no decision/block/permissionDecision field in cline's schema.
+set -u
+
+payload="$(cat)"
+
+# stderr is deliberately NOT redirected: failproofai's diagnostics belong in
+# cline's own hook log, and stdout stays clean because the evaluator writes
+# every operator note to stderr.
+verdict="$(printf '%s' "$payload" | ${invocation} --hook ${eventType} --cli cline)"
+
+if [ -z "$verdict" ]; then
+  verdict='{}'
+fi
+printf '%s\\n' "$verdict"
+exit 0
+`;
+}
+
+export const cline: Integration = {
+  id: "cline",
+  displayName: "Cline",
+  scopes: CLINE_HOOK_SCOPES,
+  eventTypes: CLINE_HOOK_EVENT_TYPES,
+
+  getSettingsPath(scope, cwd) {
+    // Bookkeeping only, so the Integration interface has something to read,
+    // write and detect against. Inert for cline twice over: `.json` is not in
+    // the extension allowlist AND `failproofai` is not one of the ten event
+    // names, so cline never executes it.
+    return resolve(
+      clineHooksDir(scope === "local" ? "project" : scope, cwd),
+      "failproofai.json",
+    );
+  },
+
+  readSettings(settingsPath) {
+    return readJsonFile(settingsPath);
+  },
+
+  writeSettings(settingsPath, settings) {
+    writeJsonFile(settingsPath, settings);
+  },
+
+  buildHookEntry(binaryPath, eventType, scope) {
+    const effective: HookScope = scope === "local" ? "project" : (scope ?? "user");
+    return {
+      type: "command",
+      file: `${eventType}${CLINE_HOOK_FILE_EXTENSION}`,
+      command: `${
+        effective === "project" ? "npx -y failproofai" : `"${binaryPath}"`
+      } --hook ${eventType} --cli cline`,
+      [FAILPROOFAI_HOOK_MARKER]: true,
+    };
+  },
+
+  isFailproofaiHook(hook) {
+    if (!hook || typeof hook !== "object") return false;
+    return (hook as Record<string, unknown>)[FAILPROOFAI_HOOK_MARKER] === true;
+  },
+
+  writeHookEntries(settings, binaryPath, scope) {
+    const effective: HookScope = scope === "local" ? "project" : (scope ?? "user");
+    const dir = clineHooksDir(effective);
+    mkdirSync(dir, { recursive: true });
+    for (const eventType of CLINE_HOOK_EVENT_TYPES) {
+      const file = resolve(dir, `${eventType}${CLINE_HOOK_FILE_EXTENSION}`);
+      // Refuse to clobber a hook we did not write. A hand-written PreToolUse.sh
+      // is someone's enforcement too, and overwriting it is the same class of
+      // damage as deleting it.
+      if (existsSync(file)) {
+        let existing = "";
+        try {
+          existing = readFileSync(file, "utf8");
+        } catch {
+          /* unreadable — treat as foreign and leave alone */
+          continue;
+        }
+        if (!existing.includes(FAILPROOFAI_HOOK_MARKER)) continue;
+      }
+      writeFileSync(file, buildClineHookScript(binaryPath, eventType, effective), "utf8");
+      // cline does not require the executable bit (it picks an interpreter from
+      // the shebang or the extension), but set it anyway: harmless, and it keeps
+      // the file usable if cline ever execs directly.
+      try {
+        chmodSync(file, 0o755);
+      } catch {
+        /* best effort */
+      }
+    }
+    const s = settings as Record<string, unknown>;
+    s.hooks = CLINE_HOOK_EVENT_TYPES.map((e) => this.buildHookEntry(binaryPath, e, effective));
+  },
+
+  removeHooksFromFile(settingsPath) {
+    const dir = dirname(settingsPath);
+    let removed = 0;
+    for (const eventType of CLINE_HOOK_EVENT_TYPES) {
+      const file = resolve(dir, `${eventType}${CLINE_HOOK_FILE_EXTENSION}`);
+      if (!existsSync(file)) continue;
+      let body = "";
+      try {
+        body = readFileSync(file, "utf8");
+      } catch {
+        continue;
+      }
+      if (!body.includes(FAILPROOFAI_HOOK_MARKER)) continue; // not ours — leave it
+      try {
+        unlinkSync(file);
+        removed++;
+      } catch {
+        /* already gone */
+      }
+    }
+    // NEVER remove `dir`. Unlike ori's feature directory, this one is SHARED
+    // with the user's own hooks.
+    const settings = this.readSettings(settingsPath) as Record<string, unknown>;
+    delete settings.hooks;
+    this.writeSettings(settingsPath, settings);
+    return removed;
+  },
+
+  hooksInstalledInSettings(scope, cwd) {
+    const file = resolve(
+      clineHooksDir(scope === "local" ? "project" : scope, cwd),
+      `PreToolUse${CLINE_HOOK_FILE_EXTENSION}`,
+    );
+    if (!existsSync(file)) return false;
+    try {
+      return readFileSync(file, "utf8").includes(FAILPROOFAI_HOOK_MARKER);
+    } catch {
+      return false;
+    }
+  },
+
+  detectInstalled() {
+    return binaryExists("cline");
+  },
+};
+
+// ── Registry ──────────────────────────────────────────────────────────────
 
 // `Partial` is kept (not every IntegrationType is guaranteed installable for
 // LIVE hooks / Pillar 1) so a future audit-only CLI can omit its entry without a
 // type error. `hermes` now has BOTH an audit adapter
 // (src/audit/cli-adapters/hermes.ts) AND live-hook install support, so it is
 // registered here.
+// ── grok (xAI grok CLI) integration ─────────────────────────────────────────
+//
+// grok reads Claude's NESTED hook schema out of its own directory: every
+// `*.json` under `~/.grok/hooks/` (user, always trusted) or
+// `<repo>/.grok/hooks/` (project). We own one file, `failproofai.json`, so the
+// install never has to merge with a user's other hook files — the same
+// arrangement as Copilot's `.github/hooks/failproofai.json`.
+//
+// `timeout` is in SECONDS (grok's default is 5, which is too tight for a cold
+// `npx` start; 30 matches what the other second-based CLIs use here).
+//
+// TWO project-scope conditions that are NOT in grok's docs and were found by
+// probing grok 1.0.3 — both silently produce a config that never fires:
+//   • the directory must be a GIT REPO (a trusted non-git dir logs
+//     `project_sources=0`), and
+//   • the folder must be TRUSTED (`grok --trust` or `/hooks-trust`).
+// `projectScopeWarning()` below reports the first; the second is surfaced in
+// the install output, since neither has any other detector.
+//
+// Deny/instruct semantics live in policy-evaluator.ts's `cli === "grok"` branch
+// (grok's OWN `{decision:"deny"}` / `{decision:"block"}` shapes — it ignores
+// Claude's hookSpecificOutput deny, verified by A/B on a live session).
+const grok: Integration = {
+  id: "grok",
+  displayName: "grok CLI",
+  scopes: GROK_HOOK_SCOPES,
+  eventTypes: GROK_HOOK_EVENT_TYPES,
+
+  getSettingsPath(scope, cwd) {
+    const base = cwd ? resolve(cwd) : process.cwd();
+    switch (scope) {
+      case "user":
+        return resolve(homedir(), ".grok", "hooks", "failproofai.json");
+      case "project":
+      case "local":
+        // grok has no "local" scope; fall back to project so callers don't crash.
+        return resolve(base, ".grok", "hooks", "failproofai.json");
+    }
+  },
+
+  readSettings(settingsPath) {
+    return readJsonFile(settingsPath);
+  },
+
+  writeSettings(settingsPath, settings) {
+    writeJsonFile(settingsPath, settings);
+  },
+
+  buildHookEntry(binaryPath, eventType, scope) {
+    const command =
+      scope === "project"
+        ? `npx -y failproofai --hook ${eventType} --cli grok`
+        : `"${binaryPath}" --hook ${eventType} --cli grok`;
+    return {
+      type: "command",
+      command,
+      // grok reads `timeout` in SECONDS. Its own default is 5s (600s for
+      // Stop/SubagentStop); 30 leaves room for a cold `npx` start without
+      // stalling the UI, and a timed-out hook fails OPEN on grok.
+      timeout: 30,
+      [FAILPROOFAI_HOOK_MARKER]: true,
+    };
+  },
+
+  isFailproofaiHook: isMarkedHook,
+
+  writeHookEntries(settings, binaryPath, scope) {
+    const s = settings as ClaudeSettings;
+    if (!s.hooks) s.hooks = {};
+
+    for (const eventType of GROK_HOOK_EVENT_TYPES) {
+      const hookEntry = this.buildHookEntry(binaryPath, eventType, scope) as unknown as ClaudeHookEntry;
+      if (!s.hooks[eventType]) s.hooks[eventType] = [];
+      const matchers: ClaudeHookMatcher[] = s.hooks[eventType];
+
+      let found = false;
+      for (const matcher of matchers) {
+        if (!matcher.hooks) continue;
+        const idx = matcher.hooks.findIndex((h) => isMarkedHook(h as Record<string, unknown>));
+        if (idx >= 0) {
+          matcher.hooks[idx] = hookEntry;
+          found = true;
+          break;
+        }
+      }
+      // No `matcher` key: an omitted matcher matches every tool. Do NOT write
+      // `"*"` here — grok treats a matcher as a REGEX, and the same bare `"*"`
+      // is an invalid pattern that matches nothing on Goose.
+      if (!found) matchers.push({ hooks: [hookEntry] });
+    }
+  },
+
+  removeHooksFromFile(settingsPath) {
+    const settings = this.readSettings(settingsPath) as ClaudeSettings;
+    if (!settings.hooks) return 0;
+
+    let removed = 0;
+    for (const eventType of Object.keys(settings.hooks)) {
+      const matchers = settings.hooks[eventType];
+      if (!Array.isArray(matchers)) continue;
+      for (let i = matchers.length - 1; i >= 0; i--) {
+        const matcher = matchers[i];
+        if (!matcher.hooks) continue;
+        const before = matcher.hooks.length;
+        matcher.hooks = matcher.hooks.filter((h) => !isMarkedHook(h as Record<string, unknown>));
+        removed += before - matcher.hooks.length;
+        if (matcher.hooks.length === 0) matchers.splice(i, 1);
+      }
+      if (matchers.length === 0) delete settings.hooks[eventType];
+    }
+    if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+
+    this.writeSettings(settingsPath, settings as Record<string, unknown>);
+    return removed;
+  },
+
+  hooksInstalledInSettings(scope, cwd) {
+    const settingsPath = this.getSettingsPath(scope, cwd);
+    if (!existsSync(settingsPath)) return false;
+    try {
+      const settings = this.readSettings(settingsPath) as ClaudeSettings;
+      if (!settings.hooks) return false;
+      for (const matchers of Object.values(settings.hooks)) {
+        if (!Array.isArray(matchers)) continue;
+        for (const matcher of matchers) {
+          if (!matcher.hooks) continue;
+          if (matcher.hooks.some((h) => isMarkedHook(h as Record<string, unknown>))) return true;
+        }
+      }
+    } catch {
+      // Corrupt settings — treat as not installed
+    }
+    return false;
+  },
+
+  detectInstalled() {
+    return binaryExists("grok");
+  },
+};
+
+// ── qwen (Qwen Code) integration ────────────────────────────────────────────
+//
+// qwen keeps hooks under a Claude-style `"hooks"` key inside its normal
+// settings file, which also holds `model`, `modelProviders`, auth, etc. — so
+// reads/writes go through the merge-preserving readJsonFile/writeJsonFile
+// helpers (like Claude/Copilot/Devin), never a whole-file replace.
+//   user    → ~/.qwen/settings.json
+//   project → <cwd>/.qwen/settings.json
+//
+// The one shape difference from every other integration: `timeout` is in
+// MILLISECONDS (qwen's default is 60000). Do not "unify" it with the
+// seconds-based CLIs — 30 would mean 30ms and every hook would time out.
+//
+// Deny is Claude's own `hookSpecificOutput.permissionDecision` on PreToolUse
+// (so no evaluator branch is needed for it); only Stop diverges. See the
+// `cli === "qwen"` branch in policy-evaluator.ts.
+const qwen: Integration = {
+  id: "qwen",
+  displayName: "Qwen Code",
+  scopes: QWEN_HOOK_SCOPES,
+  eventTypes: QWEN_HOOK_EVENT_TYPES,
+
+  getSettingsPath(scope, cwd) {
+    const base = cwd ? resolve(cwd) : process.cwd();
+    switch (scope) {
+      case "user":
+        return resolve(homedir(), ".qwen", "settings.json");
+      case "project":
+      case "local":
+        // qwen has no "local" scope; fall back to project so callers don't crash.
+        return resolve(base, ".qwen", "settings.json");
+    }
+  },
+
+  readSettings(settingsPath) {
+    return readJsonFile(settingsPath);
+  },
+
+  writeSettings(settingsPath, settings) {
+    writeJsonFile(settingsPath, settings);
+  },
+
+  buildHookEntry(binaryPath, eventType, scope) {
+    const command =
+      scope === "project"
+        ? `npx -y failproofai --hook ${eventType} --cli qwen`
+        : `"${binaryPath}" --hook ${eventType} --cli qwen`;
+    return {
+      type: "command",
+      command,
+      name: `failproofai-${eventType}`,
+      // MILLISECONDS — qwen is the only integration that is not seconds-based.
+      // 30000 = 30s, matching the wall-clock budget the others use.
+      timeout: 30000,
+      [FAILPROOFAI_HOOK_MARKER]: true,
+    };
+  },
+
+  isFailproofaiHook: isMarkedHook,
+
+  writeHookEntries(settings, binaryPath, scope) {
+    const s = settings as ClaudeSettings;
+    if (!s.hooks) s.hooks = {};
+
+    for (const eventType of QWEN_HOOK_EVENT_TYPES) {
+      const hookEntry = this.buildHookEntry(binaryPath, eventType, scope) as unknown as ClaudeHookEntry;
+      if (!s.hooks[eventType]) s.hooks[eventType] = [];
+      const matchers: ClaudeHookMatcher[] = s.hooks[eventType];
+
+      let found = false;
+      for (const matcher of matchers) {
+        if (!matcher.hooks) continue;
+        const idx = matcher.hooks.findIndex((h) => isMarkedHook(h as Record<string, unknown>));
+        if (idx >= 0) {
+          matcher.hooks[idx] = hookEntry;
+          found = true;
+          break;
+        }
+      }
+      // Matcher omitted = match every tool. qwen also accepts `""`/`"*"`, but an
+      // omitted key is the one form that is unambiguous across all of them.
+      if (!found) matchers.push({ hooks: [hookEntry] });
+    }
+  },
+
+  removeHooksFromFile(settingsPath) {
+    const settings = this.readSettings(settingsPath) as ClaudeSettings;
+    if (!settings.hooks) return 0;
+
+    let removed = 0;
+    for (const eventType of Object.keys(settings.hooks)) {
+      const matchers = settings.hooks[eventType];
+      if (!Array.isArray(matchers)) continue;
+      for (let i = matchers.length - 1; i >= 0; i--) {
+        const matcher = matchers[i];
+        if (!matcher.hooks) continue;
+        const before = matcher.hooks.length;
+        matcher.hooks = matcher.hooks.filter((h) => !isMarkedHook(h as Record<string, unknown>));
+        removed += before - matcher.hooks.length;
+        if (matcher.hooks.length === 0) matchers.splice(i, 1);
+      }
+      if (matchers.length === 0) delete settings.hooks[eventType];
+    }
+    if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+
+    this.writeSettings(settingsPath, settings as Record<string, unknown>);
+    return removed;
+  },
+
+  hooksInstalledInSettings(scope, cwd) {
+    const settingsPath = this.getSettingsPath(scope, cwd);
+    if (!existsSync(settingsPath)) return false;
+    try {
+      const settings = this.readSettings(settingsPath) as ClaudeSettings;
+      if (!settings.hooks) return false;
+      for (const matchers of Object.values(settings.hooks)) {
+        if (!Array.isArray(matchers)) continue;
+        for (const matcher of matchers) {
+          if (!matcher.hooks) continue;
+          if (matcher.hooks.some((h) => isMarkedHook(h as Record<string, unknown>))) return true;
+        }
+      }
+    } catch {
+      // Corrupt settings — treat as not installed
+    }
+    return false;
+  },
+
+  detectInstalled() {
+    return binaryExists("qwen");
+  },
+};
+
 const INTEGRATIONS: Partial<Record<IntegrationType, Integration>> = {
   claude: claudeCode,
   codex,
@@ -2295,6 +3045,10 @@ const INTEGRATIONS: Partial<Record<IntegrationType, Integration>> = {
   devin,
   antigravity,
   goose,
+  grok,
+  qwen,
+  ori,
+  cline,
 };
 
 export function getIntegration(id: IntegrationType): Integration {