failproofai 1.0.3 → 1.0.4-beta.1

package/src/hooks/normalize-cli-payload.ts

@@ -10,6 +10,56 @@
  */
 import type { IntegrationType } from "./types";
 
+/**
+ * True when `parsed` carries grok's camelCase envelope.
+ *
+ * This exists because grok EXECUTES OTHER CLIS' HOOK CONFIGS. Its discovery
+ * scans `~/.claude/settings.json`, `~/.claude/settings.local.json`,
+ * `<cwd>/.claude/settings.json` and the `.cursor` equivalents by default
+ * (`[compat.claude] hooks = true`) — and `<cwd>/.claude/settings.json` is
+ * exactly the file `policies --install --cli claude --scope project` writes. So
+ * on any machine with both tools, grok runs OUR hooks and hands them `--cli
+ * claude` on the command line while piping ITS OWN camelCase payload.
+ *
+ * Verified live against grok 1.0.3: the hook fired, `tool_name` and
+ * `tool_input` were both undefined, and every builtin that reads either —
+ * block-sudo, block-env-files, block-secrets-write, block-force-push — allowed.
+ * Installed, running, costing latency, enforcing nothing; strictly worse than
+ * no coverage, because the install reports success. Detecting the envelope lets
+ * handler.ts re-route the event onto grok's path (tool maps AND response
+ * shapes — grok ignores Claude's `hookSpecificOutput.permissionDecision`, also
+ * verified by A/B).
+ *
+ * The test is on the PAYLOAD, never on an env var: `GROK_HOOK_EVENT` is set by
+ * grok's runner but is still just an env var, and mistaking a real Claude event
+ * for a grok one would break Claude's own enforcement. `workspaceRoot` +
+ * `hookEventName` with no `hook_event_name` is a shape Claude never sends.
+ */
+export function isGrokEnvelope(parsed: Record<string, unknown>): boolean {
+  return (
+    typeof parsed.hookEventName === "string" &&
+    typeof parsed.workspaceRoot === "string" &&
+    parsed.hook_event_name === undefined
+  );
+}
+
+/**
+ * The CLI whose contract actually governs this event.
+ *
+ * Identical to the declared `--cli` for every integration except the grok
+ * cross-execution case above, where the flag says `claude` and the wire says
+ * grok. Returning "grok" there routes the rest of the pipeline — tool-name and
+ * tool-input canonicalization, and the response shape policy-evaluator emits —
+ * onto the contract that will actually be honored.
+ */
+export function resolveEffectiveCli(
+  cli: IntegrationType,
+  parsed: Record<string, unknown>,
+): IntegrationType {
+  if (cli === "claude" && isGrokEnvelope(parsed)) return "grok";
+  return cli;
+}
+
 export function normalizeCliPayload(cli: IntegrationType, parsed: Record<string, unknown>): void {
   // Antigravity (agy) pipes a camelCase protojson payload; normalize the fields
   // the handler downstream reads to canonical snake_case BEFORE any
@@ -47,6 +97,33 @@ export function normalizeCliPayload(cli: IntegrationType, parsed: Record<string,
     }
   }
 
+  // grok pipes a camelCase envelope (verified live against grok 1.0.3 with a
+  // recorder hook on all 14 events). Normalize the fields the handler reads to
+  // snake_case BEFORE any canonicalization runs. Note `workspaceRoot` → `cwd`:
+  // grok sends BOTH, they were identical in every capture, and `cwd` is what
+  // resolveCwd + block-read-outside-cwd need. `toolResult` is grok's PostToolUse
+  // output key — it is NOT Claude's `tool_response`, so a sanitize policy
+  // reading the documented Claude key would see nothing without this line.
+  // `hookEventName` is deliberately NOT mapped: its value is snake_case
+  // ("pre_tool_use") whereas the canonical set is PascalCase, and the `--hook`
+  // arg already carries the PascalCase name.
+  if (cli === "grok") {
+    if (typeof parsed.toolName === "string") parsed.tool_name = parsed.toolName;
+    if (parsed.toolInput !== undefined) parsed.tool_input = parsed.toolInput;
+    if (parsed.toolResult !== undefined && parsed.tool_response === undefined) {
+      parsed.tool_response = parsed.toolResult;
+    }
+    if (typeof parsed.sessionId === "string") parsed.session_id = parsed.sessionId;
+    if (typeof parsed.transcriptPath === "string") parsed.transcript_path = parsed.transcriptPath;
+    if (typeof parsed.workspaceRoot === "string" && parsed.cwd === undefined) {
+      parsed.cwd = parsed.workspaceRoot;
+    }
+    if (typeof parsed.permissionMode === "string") parsed.permission_mode = parsed.permissionMode;
+    if (typeof parsed.stopHookActive === "boolean") {
+      parsed.stop_hook_active = parsed.stopHookActive;
+    }
+  }
+
   // Goose pipes `event` / `working_dir` instead of Claude's `hook_event_name` /
   // `cwd` (its `tool_name` / `tool_input` are already canonical field names).
   // Normalize both so resolveCwd keeps its cwd (block-read-outside-cwd) and the
@@ -58,4 +135,53 @@ export function normalizeCliPayload(cli: IntegrationType, parsed: Record<string,
       parsed.hook_event_name = parsed.event;
     }
   }
+
+  // Cline pipes its own payload verbatim — its hooks are event-NAMED scripts,
+  // not a generated shim that could pre-shape stdin — so without this every
+  // field the handler reads (tool_name, tool_input, session_id, cwd) is
+  // undefined and resolveCwd / block-read-outside-cwd see nothing. Verified live
+  // against cline v3.0.60 with a recorder hook on PreToolUse.
+  //
+  // `tool_call.input` is the source, NOT `preToolUse.parameters`: the latter
+  // JSON-STRINGIFIES every array value (`commands` arrives as the literal string
+  // `["echo hi"]`), so reading it would hand the batch expander a string and
+  // silently drop the entire fan-out. `preToolUse` is used only as a fallback
+  // for a payload carrying no `tool_call` at all.
+  //
+  // `hookName` is deliberately NOT mapped onto hook_event_name: its value is
+  // cline's INTERNAL name ("tool_call"), not the filename event, and the --hook
+  // argument already carries the canonical one. Same reasoning as grok's
+  // hookEventName.
+  if (cli === "cline") {
+    const tc = parsed.tool_call;
+    if (tc && typeof tc === "object" && !Array.isArray(tc)) {
+      const t = tc as Record<string, unknown>;
+      if (typeof t.name === "string") parsed.tool_name = t.name;
+      if (t.input !== undefined) parsed.tool_input = t.input;
+    }
+    const pre = parsed.preToolUse;
+    if (pre && typeof pre === "object" && !Array.isArray(pre)) {
+      const pp = pre as Record<string, unknown>;
+      if (parsed.tool_name === undefined && typeof pp.toolName === "string") {
+        parsed.tool_name = pp.toolName;
+      }
+      if (parsed.tool_input === undefined && pp.parameters !== undefined) {
+        parsed.tool_input = pp.parameters;
+      }
+    }
+    // taskId is the conversation ("conv_…"). sessionContext.rootSessionId and
+    // agent_id / parent_agent_id stay raw for custom policies correlating a
+    // subagent back to its root.
+    if (typeof parsed.taskId === "string") parsed.session_id = parsed.taskId;
+    const roots = parsed.workspaceRoots;
+    if (Array.isArray(roots) && typeof roots[0] === "string" && roots[0].length > 0) {
+      parsed.cwd = roots[0];
+    } else {
+      const wi = parsed.workspaceInfo;
+      if (wi && typeof wi === "object" && !Array.isArray(wi)) {
+        const rp = (wi as Record<string, unknown>).rootPath;
+        if (typeof rp === "string" && rp.length > 0) parsed.cwd = rp;
+      }
+    }
+  }
 }

package/src/hooks/policy-evaluator.ts

@@ -27,7 +27,45 @@ function appendHint(baseReason: string, hint: unknown): string {
   return `${base}. ${normalizedHint}`;
 }
 
+/** Which element of a batch this evaluation is for. Absent for every non-batch
+ *  call — which is every other CLI, and every cline event that is not a
+ *  fan-out tool. */
+export interface BatchContext {
+  index: number;
+  count: number;
+  label: string;
+  degraded: boolean;
+  /** Every element's canonical input, so a batch-aware policy sees the set. */
+  all: Array<Record<string, unknown>>;
+  /** The un-expanded original tool input. */
+  raw: Record<string, unknown>;
+}
+
+export interface EvaluateOptions {
+  /** Per-INVOCATION telemetry dedupe set, shared across every element of a
+   *  batch fan-out. Without it a 12-element batch fires 12 copies of the same
+   *  policy_evaluation_error for one real tool call. */
+  dedupe?: Set<string>;
+  /** Set when this call is one element of an expanded batch. */
+  batch?: BatchContext;
+  /** Return the raw instruct/allow entries instead of shaping them; the batch
+   *  combiner shapes ONCE at the end. A DENY is unaffected — it short-circuits
+   *  and is returned fully shaped, because it is the answer. */
+  collectEntries?: boolean;
+  /** Skip the policy loop entirely and shape THESE entries. This is why no
+   *  shaping code had to move: the existing per-CLI instruct/allow tails run in
+   *  place, with the real eventType, session and payload. */
+  preEvaluated?: {
+    instructEntries: Array<{ policyName: string; reason: string }>;
+    allowEntries: Array<{ policyName: string; reason: string }>;
+  };
+}
+
 export interface EvaluationResult {
+  /** Raw instruct entries, returned ONLY when opts.collectEntries is set. */
+  instructEntries?: Array<{ policyName: string; reason: string }>;
+  /** Raw allow-note entries, returned ONLY when opts.collectEntries is set. */
+  allowEntries?: Array<{ policyName: string; reason: string }>;
   exitCode: number;
   stdout: string;
   stderr: string;
@@ -130,6 +168,7 @@ export async function evaluatePolicies(
   payload: Record<string, unknown>,
   session?: SessionMetadata,
   config?: HooksConfig,
+  opts?: EvaluateOptions,
 ): Promise<EvaluationResult> {
   const toolName = payload.tool_name as string | undefined;
   const toolInput = payload.tool_input as Record<string, unknown> | undefined;
@@ -138,7 +177,7 @@ export async function evaluatePolicies(
 
   hookLogInfo(`evaluating ${policies.length} policies for ${eventType}`);
 
-  if (policies.length === 0) {
+  if (policies.length === 0 && !opts?.preEvaluated) {
     return { exitCode: 0, stdout: "", stderr: "", policyName: null, reason: null, decision: "allow" };
   }
 
@@ -151,13 +190,18 @@ export async function evaluatePolicies(
     cli: session?.cli,
   };
 
-  // Track all instruct results (accumulated, does not short-circuit)
-  const instructEntries: Array<{ policyName: string; reason: string }> = [];
+  // Track all instruct results (accumulated, does not short-circuit).
+  // Seeded from opts.preEvaluated on the batch combiner's final shaping call.
+  const instructEntries: Array<{ policyName: string; reason: string }> = [
+    ...(opts?.preEvaluated?.instructEntries ?? []),
+  ];
 
   // Track informational messages from allow decisions (with policy attribution)
-  const allowEntries: Array<{ policyName: string; reason: string }> = [];
+  const allowEntries: Array<{ policyName: string; reason: string }> = [
+    ...(opts?.preEvaluated?.allowEntries ?? []),
+  ];
 
-  for (const policy of policies) {
+  for (const policy of opts?.preEvaluated ? [] : policies) {
     // Inject params: merge policyParams[policy.name] over schema defaults.
     // policy.name is canonical (e.g. "failproofai/block-force-push"); user
     // config keys may be flat or canonical — getConfigParamsFor accepts both.
@@ -235,7 +279,17 @@ export async function evaluatePolicies(
       } else {
         displayTool = "operation";
       }
-      const blockedMessage = `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`;
+      // One locator, built once, at the single site every CLI's deny shape
+      // interpolates — so cline's {cancel,errorMessage} names the offending
+      // element for free and nothing else needs to know a batch happened.
+      const batchLocator = opts?.batch
+        ? ` [batch ${opts.batch.index + 1}/${opts.batch.count}: ${
+            opts.batch.label.length > 120
+              ? `${opts.batch.label.slice(0, 117)}…`
+              : opts.batch.label
+          }]`
+        : "";
+      const blockedMessage = `Blocked ${displayTool}${batchLocator} by failproofai because: ${reason}, as per the policy configured by the user`;
 
       // Cursor's hook protocol expects a flat `{permission, user_message,
       // agent_message}` shape for any blocking decision, regardless of which
@@ -378,6 +432,58 @@ export async function evaluatePolicies(
         };
       }
 
+      // Ori: the generated ori feature parses a flat {permission, reason} and
+      // returns ori's own {outcome:"allow"|"deny"} to the approval extension
+      // point. There is exactly one event (PreToolUse) — ori exposes no Stop,
+      // prompt, post-tool or session gate — so unlike Pi/OpenClaw there is no
+      // Stop special case to write. The reason is carried for the operator's
+      // logs only: ori's verdict shape has no reason field, so a denial reaches
+      // the model as a bare tool failure.
+      if (session?.cli === "ori") {
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({ permission: "deny", reason: blockedMessage }),
+          stderr: "",
+          policyName: policy.name,
+          reason,
+          decision: "deny",
+        };
+      }
+
+      // Cline: the installed launcher relays this object verbatim on stdout, and
+      // cline IGNORES THE EXIT CODE — the JSON is the entire verdict. The only
+      // blocking shape its schema accepts is {cancel, errorMessage}; there is no
+      // decision/block/permissionDecision field, so every generic branch below
+      // is inert for cline and this one must come first.
+      //
+      // Stop / StopFailure are deliberately NOT a cancel: `cancel:true` becomes
+      // {stop:true} -> ControlledStopError -> the whole run aborts, and at
+      // TaskComplete the task has ALREADY finished, so that kills a completed
+      // run instead of re-entering the loop. Destructive and useless, hence the
+      // context channel there and `Stop: "observe"` in enforcement-capability.
+      if (session?.cli === "cline") {
+        if (eventType === "Stop" || eventType === "StopFailure") {
+          return {
+            exitCode: 0,
+            stdout: JSON.stringify({
+              context: `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}`,
+            }),
+            stderr: `[failproofai] ${policy.name}: ${reason}\n`,
+            policyName: policy.name,
+            reason,
+            decision: "deny",
+          };
+        }
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({ cancel: true, errorMessage: blockedMessage }),
+          stderr: "",
+          policyName: policy.name,
+          reason,
+          decision: "deny",
+        };
+      }
+
       // OpenCode: `session.idle` is a notification-only bus event — by the
       // time the plugin handler fires, OpenCode has already gone idle and
       // throwing from the handler does not force-retry. The only working
@@ -505,6 +611,91 @@ export async function evaluatePolicies(
         };
       }
 
+      // grok: deny is `{decision:"deny", reason}` on stdout at exit 0 — verified
+      // live against grok 1.0.3, and it beat `--yolo` (bypassPermissions). grok
+      // does NOT read Claude's hookSpecificOutput shape: the same hook emitting
+      // Claude's shape let the command run, emitting this one blocked it.
+      //
+      // Stop takes `{decision:"block", reason}` instead (Claude's turn-end
+      // vocabulary, which grok shares) — but ONLY on a real turn end. grok fires
+      // Stop a second time at session shutdown (`reason: "shutdown"`) and
+      // explicitly discards that decision, so blocking there would record
+      // enforcement that cannot happen. Falling through to allow is correct:
+      // the turn is already over. grok caps continuations at 8 per turn.
+      if (session?.cli === "grok") {
+        if (eventType === "Stop" || eventType === "SubagentStop") {
+          const grokStopReason = typeof payload.reason === "string" ? payload.reason : undefined;
+          if (eventType === "Stop" && grokStopReason && grokStopReason !== "end_turn") {
+            return {
+              exitCode: 0,
+              stdout: "",
+              stderr: "",
+              policyName: policy.name,
+              reason,
+              decision: "allow",
+            };
+          }
+          const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}\n\nYou MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`;
+          return {
+            exitCode: 0,
+            stdout: JSON.stringify({ decision: "block", reason: reasonText }),
+            stderr: "",
+            policyName: policy.name,
+            reason,
+            decision: "deny",
+          };
+        }
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({ decision: "deny", reason: blockedMessage }),
+          stderr: "",
+          policyName: policy.name,
+          reason,
+          decision: "deny",
+        };
+      }
+
+      // qwen: PreToolUse honors Claude's own
+      // `hookSpecificOutput.permissionDecision` shape (verified live — it beat
+      // `-y`), so that event deliberately falls through to the generic Claude
+      // branch below rather than being duplicated here. Stop is the divergence:
+      // it reads the top-level `{decision:"block", reason}` instead, which is
+      // what forces another turn (verified live — the agent ran the required
+      // command and only then finished). Unlike grok there is no session-end
+      // Stop fire to filter out.
+      // qwen's todo hooks (canonical TaskCreated / TaskCompleted) are the only
+      // events in the widened set that can actually veto. They read the
+      // top-level `{decision:"block", reason}` — NOT Claude's permissionDecision
+      // — and only during their `validation` phase; in `postWrite` the todo is
+      // already persisted and upstream ignores the block. Emitting it
+      // unconditionally is right: it enforces where it can and is inert where it
+      // cannot, and the phase is upstream's to decide, not ours to guess.
+      if (
+        session?.cli === "qwen" &&
+        (eventType === "TaskCreated" || eventType === "TaskCompleted")
+      ) {
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({ decision: "block", reason: blockedMessage }),
+          stderr: "",
+          policyName: policy.name,
+          reason,
+          decision: "deny",
+        };
+      }
+
+      if (session?.cli === "qwen" && (eventType === "Stop" || eventType === "SubagentStop")) {
+        const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}\n\nYou MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`;
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({ decision: "block", reason: reasonText }),
+          stderr: "",
+          policyName: policy.name,
+          reason,
+          decision: "deny",
+        };
+      }
+
       if (eventType === "PreToolUse") {
         const response = {
           hookSpecificOutput: {
@@ -693,6 +884,21 @@ export async function evaluatePolicies(
     }
   }
 
+  // The batch combiner asked for RAW entries; it dedupes the union across all
+  // elements and shapes it once, through these same tails, on a final call.
+  if (opts?.collectEntries) {
+    return {
+      exitCode: 0,
+      stdout: "",
+      stderr: "",
+      policyName: null,
+      reason: null,
+      decision: "allow",
+      instructEntries,
+      allowEntries,
+    };
+  }
+
   // No deny — check if we accumulated any instructs
   if (instructEntries.length > 0) {
     const combined = instructEntries.map((e) => e.reason).join("\n");
@@ -980,6 +1186,44 @@ export async function evaluatePolicies(
       };
     }
 
+    // Ori: the approval extension points return {outcome:"allow"|"deny"} and
+    // nothing else — there is no additional-context channel to carry a
+    // directive, and no Stop event to convert one into a retry. So instruct()
+    // allows the action and writes the directive to stderr for the operator's
+    // logs; the model never sees it. Same degradation as Goose and Hermes.
+    if (session?.cli === "ori") {
+      const stderrMsg = instructEntries
+        .map((e) => `[failproofai] ${e.policyName}: ${e.reason}`)
+        .join("\n");
+      return {
+        exitCode: 0,
+        stdout: "",
+        stderr: stderrMsg + "\n",
+        policyName: policyNames[0],
+        policyNames,
+        reason: combined,
+        decision: "instruct",
+      };
+    }
+
+    // Cline HAS a real additional-context channel — `context` is in its verdict
+    // schema and parseHookControl reads it — so unlike Goose/Hermes/ori this
+    // does not have to degrade to a stderr note. It is mirrored to stderr as
+    // well: the field is verified-PARSED by cline, but that the model actually
+    // sees it is unprobed, and the operator's log should not depend on that.
+    if (session?.cli === "cline") {
+      return {
+        exitCode: 0,
+        stdout: JSON.stringify({ context: `Instruction from failproofai: ${combined}` }),
+        stderr:
+          instructEntries.map((e) => `[failproofai] ${e.policyName}: ${e.reason}`).join("\n") + "\n",
+        policyName: policyNames[0],
+        policyNames,
+        reason: combined,
+        decision: "instruct",
+      };
+    }
+
     if (eventType === "Stop" || eventType === "SubagentStop") {
       // Stop/SubagentStop instruct: exitCode 2 + stderr forces Claude to retry
       // the agent (or subagent) loop with the reason as context. Same widening
@@ -1102,6 +1346,53 @@ export async function evaluatePolicies(
       };
     }
 
+    // grok: instruct has a channel only at the turn boundary. On Stop we reuse
+    // the verified `{decision:"block", reason}` force-retry shape so the
+    // instruction actually reaches the model (grok also documents a softer
+    // `hookSpecificOutput.additionalContext` for Stop, but that path is not
+    // verified and "block" is). The `end_turn` guard is the same one the deny
+    // branch uses — the session-shutdown fire has no turn left to instruct.
+    // On every other event grok has no additional-context channel, so instruct
+    // degrades to allow + a stderr note (like Hermes/Goose/Factory); emitting
+    // Claude's hookSpecificOutput there would be a shape grok discards.
+    //
+    // qwen deliberately has NO branch here: it honors Claude's
+    // `hookSpecificOutput.additionalContext` on PreToolUse/PostToolUse/
+    // UserPromptSubmit (wrapping it in a `<qwen:user-prompt-submit-context>`
+    // provenance tag), so the generic path below is already correct for it.
+    if (session?.cli === "grok") {
+      const stderrMsg = allowEntries
+        .map((e) => `[failproofai] ${e.policyName}: ${e.reason}`)
+        .join("\n");
+      const grokStopReason = typeof payload.reason === "string" ? payload.reason : undefined;
+      const atRealTurnEnd =
+        eventType === "SubagentStop" ||
+        (eventType === "Stop" && (!grokStopReason || grokStopReason === "end_turn"));
+      if (atRealTurnEnd) {
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify({
+            decision: "block",
+            reason: `Instruction from failproofai: ${combined}`,
+          }),
+          stderr: stderrMsg + "\n",
+          policyName: policyNames[0],
+          policyNames,
+          reason: combined,
+          decision: "instruct",
+        };
+      }
+      return {
+        exitCode: 0,
+        stdout: "",
+        stderr: stderrMsg + "\n",
+        policyName: policyNames[0],
+        policyNames,
+        reason: combined,
+        decision: "allow",
+      };
+    }
+
     const supportsHookSpecificOutput =
       eventType === "PreToolUse" ||
       eventType === "PostToolUse" ||

package/src/hooks/resolve-transcript-path.ts

@@ -31,6 +31,8 @@ import { findCodexTranscript } from "../../lib/codex-sessions";
 import { findCopilotTranscript } from "../../lib/copilot-sessions";
 import { findCursorTranscript } from "../../lib/cursor-sessions";
 import { findPiTranscript } from "../../lib/pi-sessions";
+import { findGrokTranscript } from "../../lib/grok-sessions";
+import { findQwenTranscript } from "../../lib/qwen-sessions";
 import { findFactoryTranscript } from "../../lib/factory-sessions";
 import { findAntigravityTranscript } from "../../lib/antigravity-sessions";
 import type { IntegrationType } from "./types";
@@ -74,6 +76,14 @@ export function resolveTranscriptPath(
       // its live-hook payload carries no transcript file, so hand back a virtual
       // path (like devin) — audit/download read the DB directly.
       return `goose-db://${sessionId}`;
+    case "grok":
+      // grok writes real JSONL at ~/.grok/sessions/<percent-encoded-cwd>/
+      // <sessionId>/chat_history.jsonl.
+      return findGrokTranscript(sessionId) ?? undefined;
+    case "qwen":
+      // qwen writes real JSONL at ~/.qwen/projects/<encoded-cwd>/chats/
+      // <sessionId>.jsonl (note the extra `chats/` level vs Claude/Factory).
+      return findQwenTranscript(sessionId) ?? undefined;
     case "opencode":
       return `opencode-db://${sessionId}`;
     case "hermes":

package/src/hooks/risk-patterns.ts

@@ -0,0 +1,26 @@
+/**
+ * Path-risk regexes, shared by the builtins that enforce on them and by the
+ * batch-collapse fallback that has to decide WHICH path survives a collapse.
+ *
+ * They live here rather than in builtin-policies.ts for two reasons:
+ *
+ *   1. A second hand-maintained copy is exactly how a bypass gets reintroduced:
+ *      someone tightens `SECRET_FILE_RE` in the builtin and the collapse
+ *      fallback keeps probing the old shape, so the riskiest path stops being
+ *      picked and a `.pem` write rides through on a batch.
+ *   2. `tool-name-canonicalize.ts` is on the AUDIT path, and builtin-policies.ts
+ *      imports `node:child_process`. Importing the builtins from there to reach
+ *      four regexes would drag the policy engine into transcript replay.
+ *
+ * Zero imports, on purpose. Keep it that way.
+ */
+
+/** `.env`, `.env.local`, `path/to/.env` — but not `something.environment`. */
+export const ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
+
+/** NOTE the `$` anchor: this can only ever match at the END of a string, which
+ *  is why joining a list of paths and testing the join is a SILENT BYPASS —
+ *  only the last element could match. See pickRiskiestPath in batch-expand.ts. */
+export const SECRET_FILE_RE = /\.(?:pem|key)$/;
+export const SECRET_FILE_ID_RSA_RE = /id_rsa/;
+export const SECRET_FILE_CREDENTIALS_RE = /credentials/;

package/src/hooks/tool-name-canonicalize.ts

@@ -25,7 +25,14 @@ import {
   ANTIGRAVITY_TOOL_INPUT_MAP,
   GOOSE_TOOL_MAP,
   GOOSE_TOOL_INPUT_MAP,
+  GROK_TOOL_MAP,
+  GROK_TOOL_INPUT_MAP,
+  QWEN_TOOL_MAP,
+  ORI_TOOL_MAP,
+  ORI_TOOL_INPUT_MAP,
+  CLINE_TOOL_MAP,
 } from "./types";
+import { canonicalizeClineToolInput, applyPatchFilePaths } from "./batch-expand";
 
 /**
  * Canonicalize a per-CLI tool name to the Claude PascalCase form that builtin
@@ -56,6 +63,18 @@ export function canonicalizeToolName(
   // Goose: shell→Bash, write/edit/view→file ops, todo__todo_write→TodoWrite, …
   // (verified live against goose v1.43.0). Handles bare + `<ext>__<tool>` names.
   if (cli === "goose") return GOOSE_TOOL_MAP[raw] ?? raw;
+  // grok: run_terminal_command→Bash, write/read_file/search_replace→file ops, …
+  // (every entry observed on the wire against grok 1.0.3).
+  if (cli === "grok") return GROK_TOOL_MAP[raw] ?? raw;
+  // qwen: run_shell_command→Bash, write_file/read_file/edit→file ops, …
+  // (verified live against qwen-code 0.21.12).
+  if (cli === "qwen") return QWEN_TOOL_MAP[raw] ?? raw;
+  // Ori: tool ids arrive lowercase (bash/read/write/edit/glob/grep) — all six
+  // captured at the live approval gate on ori 0.12.0+68f9a36.
+  if (cli === "ori") return ORI_TOOL_MAP[raw] ?? raw;
+  // Cline: run_commands/read_files/search_codebase/apply_patch — all four
+  // observed live on cline v3.0.60's PreToolUse payload.
+  if (cli === "cline") return CLINE_TOOL_MAP[raw] ?? raw;
   return raw;
 }
 
@@ -95,6 +114,26 @@ export function canonicalizeToolInput(
   // Goose file tools (write/edit/view) deliver the path as `path`, read_image as
   // `source`; map to `file_path` so path builtins fire (verified goose v1.43.0).
   else if (cli === "goose") perToolMap = GOOSE_TOOL_INPUT_MAP[toolName];
+  // grok's read_file delivers `target_file` and list_dir `target_directory`;
+  // every other grok tool is already canonical. Without the Read entry a live
+  // `.env` read walks past block-env-files (verified grok 1.0.3). qwen needs no
+  // entry at all — all six of its tools deliver canonical keys.
+  else if (cli === "grok") perToolMap = GROK_TOOL_INPUT_MAP[toolName];
+  // Ori: read/write deliver the path as `path`; bash/glob/grep are already
+  // canonical. `edit` is special — its path lives INSIDE the patch blob and is
+  // derived below rather than renamed, because there is no key to rename.
+  else if (cli === "ori") {
+    if (toolName === "Edit") return canonicalizeOriEditInput(rawInput as Record<string, unknown>);
+    perToolMap = ORI_TOOL_INPUT_MAP[toolName];
+  }
+  // Cline has NO key-rename map: every tool is batch- or blob-shaped, so this
+  // is a value-SHAPE transform. It is the SAFETY NET for the paths that do not
+  // fan out (PostToolUse, audit replay, fail-closed shaping); PreToolUse
+  // enforces through expandBatchToolInput instead, because a collapse cannot
+  // make an anchored regex match every element.
+  else if (cli === "cline") {
+    return canonicalizeClineToolInput(toolName, rawInput as Record<string, unknown>);
+  }
   if (!perToolMap) return rawInput;
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(rawInput as Record<string, unknown>)) {
@@ -102,3 +141,28 @@ export function canonicalizeToolInput(
   }
   return out;
 }
+
+/**
+ * Recover the file path(s) from an OpenAI apply_patch blob.
+ *
+ * Kept as the ori-facing NAME so existing callers and
+ * __tests__/hooks/ori-canonicalize.test.ts keep working, but the implementation
+ * now lives in batch-expand.ts and is shared: ori's `edit` and cline's
+ * `apply_patch` carry byte-identical blobs, and one implementation is what
+ * stops a third CLI adding a third regex.
+ *
+ * NOTE for a follow-up: `splitApplyPatch` (same module) now returns per-file
+ * old/new text as well, which closes ori's documented multi-file KNOWN GAP —
+ * and a worse one the gap comment understates, that ori's Edit sets NO
+ * old_string/new_string at all, so block-secrets-write can never fire on it.
+ * Deliberately NOT changed here: ori's behaviour stays as shipped in this PR.
+ */
+export const oriPatchFilePaths = applyPatchFilePaths;
+
+function canonicalizeOriEditInput(input: Record<string, unknown>): Record<string, unknown> {
+  const patch = input.patch;
+  if (typeof patch !== "string") return input;
+  const paths = oriPatchFilePaths(patch);
+  if (paths.length === 0) return input;
+  return { ...input, file_path: paths[0], ori_patch_files: paths };
+}