failproofai 1.0.4-beta.1 → 1.0.4-beta.2

package/src/hooks/normalize-cli-payload.ts

@@ -10,56 +10,6 @@
  */
 import type { IntegrationType } from "./types";
 
-/**
- * True when `parsed` carries grok's camelCase envelope.
- *
- * This exists because grok EXECUTES OTHER CLIS' HOOK CONFIGS. Its discovery
- * scans `~/.claude/settings.json`, `~/.claude/settings.local.json`,
- * `<cwd>/.claude/settings.json` and the `.cursor` equivalents by default
- * (`[compat.claude] hooks = true`) — and `<cwd>/.claude/settings.json` is
- * exactly the file `policies --install --cli claude --scope project` writes. So
- * on any machine with both tools, grok runs OUR hooks and hands them `--cli
- * claude` on the command line while piping ITS OWN camelCase payload.
- *
- * Verified live against grok 1.0.3: the hook fired, `tool_name` and
- * `tool_input` were both undefined, and every builtin that reads either —
- * block-sudo, block-env-files, block-secrets-write, block-force-push — allowed.
- * Installed, running, costing latency, enforcing nothing; strictly worse than
- * no coverage, because the install reports success. Detecting the envelope lets
- * handler.ts re-route the event onto grok's path (tool maps AND response
- * shapes — grok ignores Claude's `hookSpecificOutput.permissionDecision`, also
- * verified by A/B).
- *
- * The test is on the PAYLOAD, never on an env var: `GROK_HOOK_EVENT` is set by
- * grok's runner but is still just an env var, and mistaking a real Claude event
- * for a grok one would break Claude's own enforcement. `workspaceRoot` +
- * `hookEventName` with no `hook_event_name` is a shape Claude never sends.
- */
-export function isGrokEnvelope(parsed: Record<string, unknown>): boolean {
-  return (
-    typeof parsed.hookEventName === "string" &&
-    typeof parsed.workspaceRoot === "string" &&
-    parsed.hook_event_name === undefined
-  );
-}
-
-/**
- * The CLI whose contract actually governs this event.
- *
- * Identical to the declared `--cli` for every integration except the grok
- * cross-execution case above, where the flag says `claude` and the wire says
- * grok. Returning "grok" there routes the rest of the pipeline — tool-name and
- * tool-input canonicalization, and the response shape policy-evaluator emits —
- * onto the contract that will actually be honored.
- */
-export function resolveEffectiveCli(
-  cli: IntegrationType,
-  parsed: Record<string, unknown>,
-): IntegrationType {
-  if (cli === "claude" && isGrokEnvelope(parsed)) return "grok";
-  return cli;
-}
-
 export function normalizeCliPayload(cli: IntegrationType, parsed: Record<string, unknown>): void {
   // Antigravity (agy) pipes a camelCase protojson payload; normalize the fields
   // the handler downstream reads to canonical snake_case BEFORE any
@@ -97,33 +47,6 @@ export function normalizeCliPayload(cli: IntegrationType, parsed: Record<string,
     }
   }
 
-  // grok pipes a camelCase envelope (verified live against grok 1.0.3 with a
-  // recorder hook on all 14 events). Normalize the fields the handler reads to
-  // snake_case BEFORE any canonicalization runs. Note `workspaceRoot` → `cwd`:
-  // grok sends BOTH, they were identical in every capture, and `cwd` is what
-  // resolveCwd + block-read-outside-cwd need. `toolResult` is grok's PostToolUse
-  // output key — it is NOT Claude's `tool_response`, so a sanitize policy
-  // reading the documented Claude key would see nothing without this line.
-  // `hookEventName` is deliberately NOT mapped: its value is snake_case
-  // ("pre_tool_use") whereas the canonical set is PascalCase, and the `--hook`
-  // arg already carries the PascalCase name.
-  if (cli === "grok") {
-    if (typeof parsed.toolName === "string") parsed.tool_name = parsed.toolName;
-    if (parsed.toolInput !== undefined) parsed.tool_input = parsed.toolInput;
-    if (parsed.toolResult !== undefined && parsed.tool_response === undefined) {
-      parsed.tool_response = parsed.toolResult;
-    }
-    if (typeof parsed.sessionId === "string") parsed.session_id = parsed.sessionId;
-    if (typeof parsed.transcriptPath === "string") parsed.transcript_path = parsed.transcriptPath;
-    if (typeof parsed.workspaceRoot === "string" && parsed.cwd === undefined) {
-      parsed.cwd = parsed.workspaceRoot;
-    }
-    if (typeof parsed.permissionMode === "string") parsed.permission_mode = parsed.permissionMode;
-    if (typeof parsed.stopHookActive === "boolean") {
-      parsed.stop_hook_active = parsed.stopHookActive;
-    }
-  }
-
   // Goose pipes `event` / `working_dir` instead of Claude's `hook_event_name` /
   // `cwd` (its `tool_name` / `tool_input` are already canonical field names).
   // Normalize both so resolveCwd keeps its cwd (block-read-outside-cwd) and the
@@ -135,53 +58,4 @@ export function normalizeCliPayload(cli: IntegrationType, parsed: Record<string,
       parsed.hook_event_name = parsed.event;
     }
   }
-
-  // Cline pipes its own payload verbatim — its hooks are event-NAMED scripts,
-  // not a generated shim that could pre-shape stdin — so without this every
-  // field the handler reads (tool_name, tool_input, session_id, cwd) is
-  // undefined and resolveCwd / block-read-outside-cwd see nothing. Verified live
-  // against cline v3.0.60 with a recorder hook on PreToolUse.
-  //
-  // `tool_call.input` is the source, NOT `preToolUse.parameters`: the latter
-  // JSON-STRINGIFIES every array value (`commands` arrives as the literal string
-  // `["echo hi"]`), so reading it would hand the batch expander a string and
-  // silently drop the entire fan-out. `preToolUse` is used only as a fallback
-  // for a payload carrying no `tool_call` at all.
-  //
-  // `hookName` is deliberately NOT mapped onto hook_event_name: its value is
-  // cline's INTERNAL name ("tool_call"), not the filename event, and the --hook
-  // argument already carries the canonical one. Same reasoning as grok's
-  // hookEventName.
-  if (cli === "cline") {
-    const tc = parsed.tool_call;
-    if (tc && typeof tc === "object" && !Array.isArray(tc)) {
-      const t = tc as Record<string, unknown>;
-      if (typeof t.name === "string") parsed.tool_name = t.name;
-      if (t.input !== undefined) parsed.tool_input = t.input;
-    }
-    const pre = parsed.preToolUse;
-    if (pre && typeof pre === "object" && !Array.isArray(pre)) {
-      const pp = pre as Record<string, unknown>;
-      if (parsed.tool_name === undefined && typeof pp.toolName === "string") {
-        parsed.tool_name = pp.toolName;
-      }
-      if (parsed.tool_input === undefined && pp.parameters !== undefined) {
-        parsed.tool_input = pp.parameters;
-      }
-    }
-    // taskId is the conversation ("conv_…"). sessionContext.rootSessionId and
-    // agent_id / parent_agent_id stay raw for custom policies correlating a
-    // subagent back to its root.
-    if (typeof parsed.taskId === "string") parsed.session_id = parsed.taskId;
-    const roots = parsed.workspaceRoots;
-    if (Array.isArray(roots) && typeof roots[0] === "string" && roots[0].length > 0) {
-      parsed.cwd = roots[0];
-    } else {
-      const wi = parsed.workspaceInfo;
-      if (wi && typeof wi === "object" && !Array.isArray(wi)) {
-        const rp = (wi as Record<string, unknown>).rootPath;
-        if (typeof rp === "string" && rp.length > 0) parsed.cwd = rp;
-      }
-    }
-  }
 }

package/src/hooks/notice.ts

@@ -0,0 +1,155 @@
+/**
+ * Putting a short message in front of a HUMAN, inside the agent they are using.
+ *
+ * A notice is not a verdict. `allow` / `deny` / `instruct` all answer "what
+ * happens to this tool call"; a notice answers nothing — it is one line of text
+ * for the person, delivered alongside whatever the verdict turned out to be.
+ * That is why it is a separate field rather than a fourth decision: shaping it
+ * into stdout beside a verdict ad hoc is how the copilot nested-vs-flat
+ * `additionalContext` bug happened.
+ *
+ * ## Why the channel differs per CLI, and why it is not `additionalContext`
+ *
+ * Measured across all 12 CLIs by live probe. The obvious channel —
+ * `hookSpecificOutput.additionalContext` — reaches the MODEL, not the user, and
+ * a model is a paraphraser: over eight real Claude turns it mentioned an
+ * informational notice 8/8, but an earlier notice that asked the agent to *act*
+ * was disclaimed as a suspected prompt injection 6/6 ("instructions arriving
+ * that way aren't something I'll act on unasked"). A security notice routed
+ * through something that may decline to repeat it is not a delivered notice.
+ *
+ * So each CLI gets the channel that was proven to paint text on the user's
+ * terminal, and the ones with no such channel get nothing rather than a
+ * pretend delivery:
+ *
+ *   claude   `{"systemMessage":…}`  renders `Stop says: …`; model-invisible
+ *                                   (a neutral probe answered `NONE`)
+ *   codex    `{"systemMessage":…}`  renders `• Stop (completed) says: …`
+ *   copilot  exit 0 + stderr        renders as a `!` session warning
+ *   factory  plain stdout           renders under a `Hooks Stop` block
+ *
+ * opencode, pi and openclaw have real channels too, but they live inside the
+ * plugin shims we ship rather than in a hook's stdout, so they are wired there.
+ * cursor, devin, goose, antigravity and hermes have no channel that reaches a
+ * human without an unsupported escape hatch — they get nothing here, and their
+ * users get the finding from `failproofai audit` and the emailed digest.
+ */
+import type { IntegrationType } from "./types";
+
+/** How a notice is delivered on one CLI. */
+type NoticeChannel = "systemMessage" | "stderr" | "stdout" | "none";
+
+/**
+ * Per-CLI channel, from live probes rather than documentation.
+ *
+ * A CLI absent from this map delivers nothing — deliberately. Guessing a
+ * channel produces the worst outcome available: output that looks delivered
+ * from our side and reaches nobody, so we would report a leak as "notified"
+ * that the user never saw.
+ */
+const NOTICE_CHANNEL: Partial<Record<IntegrationType, NoticeChannel>> = {
+  claude: "systemMessage",
+  codex: "systemMessage",
+  copilot: "stderr",
+  factory: "stdout",
+};
+
+/**
+ * Claude truncates `systemMessage` at 4000 characters on the cloud-forwarding
+ * path, and a notice that gets cut mid-sentence reads as a broken tool. Ours is
+ * two lines by design; this is a backstop, not a budget.
+ */
+const MAX_NOTICE_CHARS = 900;
+
+export interface ShapedNotice {
+  /** Merged into the outcome's stdout, or empty. */
+  stdout: string;
+  /** Merged into the outcome's stderr, or empty. */
+  stderr: string;
+}
+
+/**
+ * Render a notice for one CLI, merging it into any verdict JSON already bound
+ * for stdout.
+ *
+ * `existingStdout` matters: a Stop-gate deny already emits a JSON object on
+ * several CLIs, and emitting a second object would produce two JSON documents
+ * on one stream — which every host parses as a syntax error and drops, taking
+ * the deny with it. So the notice is merged INTO that object when there is one.
+ */
+export function shapeNotice(
+  cli: IntegrationType | undefined,
+  notice: string,
+  existingStdout = "",
+): ShapedNotice {
+  const empty: ShapedNotice = { stdout: existingStdout, stderr: "" };
+  if (!notice.trim() || !cli) return empty;
+
+  const channel = NOTICE_CHANNEL[cli] ?? "none";
+  const text = notice.length > MAX_NOTICE_CHARS
+    ? notice.slice(0, MAX_NOTICE_CHARS - 1) + "…"
+    : notice;
+
+  switch (channel) {
+    case "systemMessage": {
+      // Merge into the verdict object when one exists, so the stream stays a
+      // single JSON document.
+      if (existingStdout.trim().startsWith("{")) {
+        try {
+          const parsed = JSON.parse(existingStdout) as Record<string, unknown>;
+          parsed.systemMessage = text;
+          return { stdout: JSON.stringify(parsed), stderr: "" };
+        } catch {
+          // Not the JSON we thought it was — leave the verdict untouched
+          // rather than risk destroying it to add a courtesy message.
+          return empty;
+        }
+      }
+      // Anything already on stdout that we could not merge into is left
+      // exactly as it is, and the notice is dropped instead. The alternative —
+      // emitting our own object over the top — DESTROYS it: measured with a
+      // JSON array on stdout, which does not start with `{`, so it fell past
+      // the merge and was replaced wholesale. A courtesy message is never worth
+      // more than whatever the host was already being told.
+      if (existingStdout.trim()) return empty;
+      return { stdout: JSON.stringify({ systemMessage: text }), stderr: "" };
+    }
+    case "stderr":
+      // Exit code is NOT touched: on copilot a non-zero exit from a tool event
+      // is a block, and a notice must never block anything.
+      return { stdout: existingStdout, stderr: text + "\n" };
+    case "stdout":
+      // factory renders plain text under its Hooks block. Only safe when no
+      // verdict JSON is already on the stream.
+      if (existingStdout.trim()) return empty;
+      return { stdout: text + "\n", stderr: "" };
+    default:
+      return empty;
+  }
+}
+
+/** True when this CLI has a channel that was proven to reach a human. */
+export function canDeliverNotice(cli: IntegrationType | undefined): boolean {
+  return !!cli && (NOTICE_CHANNEL[cli] ?? "none") !== "none";
+}
+
+/**
+ * The notice itself. A FIXED template with no interpolation of scanned content.
+ *
+ * The count is a number we computed; everything else is a constant. That is not
+ * stylistic: the alternative is interpolating a finding's `example`, which is
+ * the verbatim text of a command from a repository — attacker-controlled
+ * through a README, a Makefile target or an npm script. Tested against the
+ * shipped redactor, `echo "IGNORE ALL PRIOR INSTRUCTIONS…"` passes through
+ * byte-identical, because that redactor masks secrets, not instructions. On the
+ * CLIs where the only channel is the model's context, that string would land
+ * directly in the prompt. So nothing scanned ever reaches this template.
+ */
+export function leakNoticeText(newFindings: number): string {
+  const n = newFindings === 1 ? "a credential" : `${newFindings} credentials`;
+  return (
+    `failproofai found ${n} in this project's agent transcripts.\n` +
+    "Run `failproofai audit` to see the details, " +
+    "or `failproofai audit --schedule` to get these by email."
+  );
+}

package/src/hooks/policy-evaluator.ts

@@ -27,45 +27,7 @@ function appendHint(baseReason: string, hint: unknown): string {
   return `${base}. ${normalizedHint}`;
 }
 
-/** Which element of a batch this evaluation is for. Absent for every non-batch
- *  call — which is every other CLI, and every cline event that is not a
- *  fan-out tool. */
-export interface BatchContext {
-  index: number;
-  count: number;
-  label: string;
-  degraded: boolean;
-  /** Every element's canonical input, so a batch-aware policy sees the set. */
-  all: Array<Record<string, unknown>>;
-  /** The un-expanded original tool input. */
-  raw: Record<string, unknown>;
-}
-
-export interface EvaluateOptions {
-  /** Per-INVOCATION telemetry dedupe set, shared across every element of a
-   *  batch fan-out. Without it a 12-element batch fires 12 copies of the same
-   *  policy_evaluation_error for one real tool call. */
-  dedupe?: Set<string>;
-  /** Set when this call is one element of an expanded batch. */
-  batch?: BatchContext;
-  /** Return the raw instruct/allow entries instead of shaping them; the batch
-   *  combiner shapes ONCE at the end. A DENY is unaffected — it short-circuits
-   *  and is returned fully shaped, because it is the answer. */
-  collectEntries?: boolean;
-  /** Skip the policy loop entirely and shape THESE entries. This is why no
-   *  shaping code had to move: the existing per-CLI instruct/allow tails run in
-   *  place, with the real eventType, session and payload. */
-  preEvaluated?: {
-    instructEntries: Array<{ policyName: string; reason: string }>;
-    allowEntries: Array<{ policyName: string; reason: string }>;
-  };
-}
-
 export interface EvaluationResult {
-  /** Raw instruct entries, returned ONLY when opts.collectEntries is set. */
-  instructEntries?: Array<{ policyName: string; reason: string }>;
-  /** Raw allow-note entries, returned ONLY when opts.collectEntries is set. */
-  allowEntries?: Array<{ policyName: string; reason: string }>;
   exitCode: number;
   stdout: string;
   stderr: string;
@@ -168,7 +130,6 @@ export async function evaluatePolicies(
   payload: Record<string, unknown>,
   session?: SessionMetadata,
   config?: HooksConfig,
-  opts?: EvaluateOptions,
 ): Promise<EvaluationResult> {
   const toolName = payload.tool_name as string | undefined;
   const toolInput = payload.tool_input as Record<string, unknown> | undefined;
@@ -177,7 +138,7 @@ export async function evaluatePolicies(
 
   hookLogInfo(`evaluating ${policies.length} policies for ${eventType}`);
 
-  if (policies.length === 0 && !opts?.preEvaluated) {
+  if (policies.length === 0) {
     return { exitCode: 0, stdout: "", stderr: "", policyName: null, reason: null, decision: "allow" };
   }
 
@@ -190,18 +151,13 @@ export async function evaluatePolicies(
     cli: session?.cli,
   };
 
-  // Track all instruct results (accumulated, does not short-circuit).
-  // Seeded from opts.preEvaluated on the batch combiner's final shaping call.
-  const instructEntries: Array<{ policyName: string; reason: string }> = [
-    ...(opts?.preEvaluated?.instructEntries ?? []),
-  ];
+  // Track all instruct results (accumulated, does not short-circuit)
+  const instructEntries: Array<{ policyName: string; reason: string }> = [];
 
   // Track informational messages from allow decisions (with policy attribution)
-  const allowEntries: Array<{ policyName: string; reason: string }> = [
-    ...(opts?.preEvaluated?.allowEntries ?? []),
-  ];
+  const allowEntries: Array<{ policyName: string; reason: string }> = [];
 
-  for (const policy of opts?.preEvaluated ? [] : policies) {
+  for (const policy of policies) {
     // Inject params: merge policyParams[policy.name] over schema defaults.
     // policy.name is canonical (e.g. "failproofai/block-force-push"); user
     // config keys may be flat or canonical — getConfigParamsFor accepts both.
@@ -279,17 +235,7 @@ export async function evaluatePolicies(
       } else {
         displayTool = "operation";
       }
-      // One locator, built once, at the single site every CLI's deny shape
-      // interpolates — so cline's {cancel,errorMessage} names the offending
-      // element for free and nothing else needs to know a batch happened.
-      const batchLocator = opts?.batch
-        ? ` [batch ${opts.batch.index + 1}/${opts.batch.count}: ${
-            opts.batch.label.length > 120
-              ? `${opts.batch.label.slice(0, 117)}…`
-              : opts.batch.label
-          }]`
-        : "";
-      const blockedMessage = `Blocked ${displayTool}${batchLocator} by failproofai because: ${reason}, as per the policy configured by the user`;
+      const blockedMessage = `Blocked ${displayTool} by failproofai because: ${reason}, as per the policy configured by the user`;
 
       // Cursor's hook protocol expects a flat `{permission, user_message,
       // agent_message}` shape for any blocking decision, regardless of which
@@ -432,58 +378,6 @@ export async function evaluatePolicies(
         };
       }
 
-      // Ori: the generated ori feature parses a flat {permission, reason} and
-      // returns ori's own {outcome:"allow"|"deny"} to the approval extension
-      // point. There is exactly one event (PreToolUse) — ori exposes no Stop,
-      // prompt, post-tool or session gate — so unlike Pi/OpenClaw there is no
-      // Stop special case to write. The reason is carried for the operator's
-      // logs only: ori's verdict shape has no reason field, so a denial reaches
-      // the model as a bare tool failure.
-      if (session?.cli === "ori") {
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ permission: "deny", reason: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
-      // Cline: the installed launcher relays this object verbatim on stdout, and
-      // cline IGNORES THE EXIT CODE — the JSON is the entire verdict. The only
-      // blocking shape its schema accepts is {cancel, errorMessage}; there is no
-      // decision/block/permissionDecision field, so every generic branch below
-      // is inert for cline and this one must come first.
-      //
-      // Stop / StopFailure are deliberately NOT a cancel: `cancel:true` becomes
-      // {stop:true} -> ControlledStopError -> the whole run aborts, and at
-      // TaskComplete the task has ALREADY finished, so that kills a completed
-      // run instead of re-entering the loop. Destructive and useless, hence the
-      // context channel there and `Stop: "observe"` in enforcement-capability.
-      if (session?.cli === "cline") {
-        if (eventType === "Stop" || eventType === "StopFailure") {
-          return {
-            exitCode: 0,
-            stdout: JSON.stringify({
-              context: `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}`,
-            }),
-            stderr: `[failproofai] ${policy.name}: ${reason}\n`,
-            policyName: policy.name,
-            reason,
-            decision: "deny",
-          };
-        }
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ cancel: true, errorMessage: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
       // OpenCode: `session.idle` is a notification-only bus event — by the
       // time the plugin handler fires, OpenCode has already gone idle and
       // throwing from the handler does not force-retry. The only working
@@ -611,91 +505,6 @@ export async function evaluatePolicies(
         };
       }
 
-      // grok: deny is `{decision:"deny", reason}` on stdout at exit 0 — verified
-      // live against grok 1.0.3, and it beat `--yolo` (bypassPermissions). grok
-      // does NOT read Claude's hookSpecificOutput shape: the same hook emitting
-      // Claude's shape let the command run, emitting this one blocked it.
-      //
-      // Stop takes `{decision:"block", reason}` instead (Claude's turn-end
-      // vocabulary, which grok shares) — but ONLY on a real turn end. grok fires
-      // Stop a second time at session shutdown (`reason: "shutdown"`) and
-      // explicitly discards that decision, so blocking there would record
-      // enforcement that cannot happen. Falling through to allow is correct:
-      // the turn is already over. grok caps continuations at 8 per turn.
-      if (session?.cli === "grok") {
-        if (eventType === "Stop" || eventType === "SubagentStop") {
-          const grokStopReason = typeof payload.reason === "string" ? payload.reason : undefined;
-          if (eventType === "Stop" && grokStopReason && grokStopReason !== "end_turn") {
-            return {
-              exitCode: 0,
-              stdout: "",
-              stderr: "",
-              policyName: policy.name,
-              reason,
-              decision: "allow",
-            };
-          }
-          const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}\n\nYou MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`;
-          return {
-            exitCode: 0,
-            stdout: JSON.stringify({ decision: "block", reason: reasonText }),
-            stderr: "",
-            policyName: policy.name,
-            reason,
-            decision: "deny",
-          };
-        }
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ decision: "deny", reason: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
-      // qwen: PreToolUse honors Claude's own
-      // `hookSpecificOutput.permissionDecision` shape (verified live — it beat
-      // `-y`), so that event deliberately falls through to the generic Claude
-      // branch below rather than being duplicated here. Stop is the divergence:
-      // it reads the top-level `{decision:"block", reason}` instead, which is
-      // what forces another turn (verified live — the agent ran the required
-      // command and only then finished). Unlike grok there is no session-end
-      // Stop fire to filter out.
-      // qwen's todo hooks (canonical TaskCreated / TaskCompleted) are the only
-      // events in the widened set that can actually veto. They read the
-      // top-level `{decision:"block", reason}` — NOT Claude's permissionDecision
-      // — and only during their `validation` phase; in `postWrite` the todo is
-      // already persisted and upstream ignores the block. Emitting it
-      // unconditionally is right: it enforces where it can and is inert where it
-      // cannot, and the phase is upstream's to decide, not ours to guess.
-      if (
-        session?.cli === "qwen" &&
-        (eventType === "TaskCreated" || eventType === "TaskCompleted")
-      ) {
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ decision: "block", reason: blockedMessage }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
-      if (session?.cli === "qwen" && (eventType === "Stop" || eventType === "SubagentStop")) {
-        const reasonText = `MANDATORY ACTION REQUIRED from failproofai (policy: ${policy.name}): ${reason}\n\nYou MUST complete the above action NOW. Do NOT ask the user for confirmation — execute the required action, then attempt to finish your task again.`;
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({ decision: "block", reason: reasonText }),
-          stderr: "",
-          policyName: policy.name,
-          reason,
-          decision: "deny",
-        };
-      }
-
       if (eventType === "PreToolUse") {
         const response = {
           hookSpecificOutput: {
@@ -884,21 +693,6 @@ export async function evaluatePolicies(
     }
   }
 
-  // The batch combiner asked for RAW entries; it dedupes the union across all
-  // elements and shapes it once, through these same tails, on a final call.
-  if (opts?.collectEntries) {
-    return {
-      exitCode: 0,
-      stdout: "",
-      stderr: "",
-      policyName: null,
-      reason: null,
-      decision: "allow",
-      instructEntries,
-      allowEntries,
-    };
-  }
-
   // No deny — check if we accumulated any instructs
   if (instructEntries.length > 0) {
     const combined = instructEntries.map((e) => e.reason).join("\n");
@@ -1186,44 +980,6 @@ export async function evaluatePolicies(
       };
     }
 
-    // Ori: the approval extension points return {outcome:"allow"|"deny"} and
-    // nothing else — there is no additional-context channel to carry a
-    // directive, and no Stop event to convert one into a retry. So instruct()
-    // allows the action and writes the directive to stderr for the operator's
-    // logs; the model never sees it. Same degradation as Goose and Hermes.
-    if (session?.cli === "ori") {
-      const stderrMsg = instructEntries
-        .map((e) => `[failproofai] ${e.policyName}: ${e.reason}`)
-        .join("\n");
-      return {
-        exitCode: 0,
-        stdout: "",
-        stderr: stderrMsg + "\n",
-        policyName: policyNames[0],
-        policyNames,
-        reason: combined,
-        decision: "instruct",
-      };
-    }
-
-    // Cline HAS a real additional-context channel — `context` is in its verdict
-    // schema and parseHookControl reads it — so unlike Goose/Hermes/ori this
-    // does not have to degrade to a stderr note. It is mirrored to stderr as
-    // well: the field is verified-PARSED by cline, but that the model actually
-    // sees it is unprobed, and the operator's log should not depend on that.
-    if (session?.cli === "cline") {
-      return {
-        exitCode: 0,
-        stdout: JSON.stringify({ context: `Instruction from failproofai: ${combined}` }),
-        stderr:
-          instructEntries.map((e) => `[failproofai] ${e.policyName}: ${e.reason}`).join("\n") + "\n",
-        policyName: policyNames[0],
-        policyNames,
-        reason: combined,
-        decision: "instruct",
-      };
-    }
-
     if (eventType === "Stop" || eventType === "SubagentStop") {
       // Stop/SubagentStop instruct: exitCode 2 + stderr forces Claude to retry
       // the agent (or subagent) loop with the reason as context. Same widening
@@ -1346,53 +1102,6 @@ export async function evaluatePolicies(
       };
     }
 
-    // grok: instruct has a channel only at the turn boundary. On Stop we reuse
-    // the verified `{decision:"block", reason}` force-retry shape so the
-    // instruction actually reaches the model (grok also documents a softer
-    // `hookSpecificOutput.additionalContext` for Stop, but that path is not
-    // verified and "block" is). The `end_turn` guard is the same one the deny
-    // branch uses — the session-shutdown fire has no turn left to instruct.
-    // On every other event grok has no additional-context channel, so instruct
-    // degrades to allow + a stderr note (like Hermes/Goose/Factory); emitting
-    // Claude's hookSpecificOutput there would be a shape grok discards.
-    //
-    // qwen deliberately has NO branch here: it honors Claude's
-    // `hookSpecificOutput.additionalContext` on PreToolUse/PostToolUse/
-    // UserPromptSubmit (wrapping it in a `<qwen:user-prompt-submit-context>`
-    // provenance tag), so the generic path below is already correct for it.
-    if (session?.cli === "grok") {
-      const stderrMsg = allowEntries
-        .map((e) => `[failproofai] ${e.policyName}: ${e.reason}`)
-        .join("\n");
-      const grokStopReason = typeof payload.reason === "string" ? payload.reason : undefined;
-      const atRealTurnEnd =
-        eventType === "SubagentStop" ||
-        (eventType === "Stop" && (!grokStopReason || grokStopReason === "end_turn"));
-      if (atRealTurnEnd) {
-        return {
-          exitCode: 0,
-          stdout: JSON.stringify({
-            decision: "block",
-            reason: `Instruction from failproofai: ${combined}`,
-          }),
-          stderr: stderrMsg + "\n",
-          policyName: policyNames[0],
-          policyNames,
-          reason: combined,
-          decision: "instruct",
-        };
-      }
-      return {
-        exitCode: 0,
-        stdout: "",
-        stderr: stderrMsg + "\n",
-        policyName: policyNames[0],
-        policyNames,
-        reason: combined,
-        decision: "allow",
-      };
-    }
-
     const supportsHookSpecificOutput =
       eventType === "PreToolUse" ||
       eventType === "PostToolUse" ||