greprag 5.80.0 → 5.82.0

package/dist/hook.js

@@ -49,7 +49,6 @@ const proc_1 = require("./proc");
 const docptr_refs_1 = require("./docptr-refs");
 const project_anchor_1 = require("./project-anchor");
 const mechanic_role_1 = require("./mechanic-role");
-const assistant_doctrine_1 = require("./assistant-doctrine");
 const session_id_1 = require("./session-id");
 const hook_runtime_1 = require("./hook-runtime");
 const harness_1 = require("./harness");
@@ -67,9 +66,12 @@ const email_pull_1 = require("./email-pull");
 const watcher_registry_1 = require("./commands/watcher-registry");
 // adr: adr/secret-scrubber.md — secret detection is canonical in @greprag/core.
 // This imports the CLI MIRROR (the zero-dep hook can't import core at runtime).
-// buildRedactionMap (the .env/process.env walker) is client-only and stays in
-// this file — the pure module is deliberately filesystem-free.
+// buildRedactionMap (the .env/process.env walker) is client-only and lives in
+// ./env-redaction beside this hook — the pure module is deliberately
+// filesystem-free, and the walker's classification (a path is never a secret)
+// is unit-tested there.
 const secret_scrubber_1 = require("./secret-scrubber");
+const env_redaction_1 = require("./env-redaction");
 // adr: adr/opencode-monitor-relay.md 2026-06-06 (g) — recap renderer is the
 // single source of truth for the recap body pushed at session start. Both
 // Claude/Codex SessionStart and the opencode plugin use the same renderer so
@@ -85,6 +87,7 @@ const guard_1 = require("./guard");
 // auto-silences when resolved (the arm-check pattern). The hook below assembles the
 // live env (ALL I/O) and emits; the modules are pure.
 const reminder_registry_1 = require("./commands/reminder-registry");
+const persona_1 = require("./commands/persona");
 const app_settings_1 = require("./app-settings");
 const inbox_primer_reminder_1 = require("./commands/inbox-primer-reminder");
 const skill_activation_manifest_1 = require("./skill-activation-manifest");
@@ -105,6 +108,7 @@ const context_governor_1 = require("./commands/context-governor");
 // lives in ./commands/pipe-wrap. docs/pre-llm-compression.md, adr/pipe-wrap-hook.md
 const pipe_wrap_1 = require("./commands/pipe-wrap");
 const search_guard_1 = require("./commands/search-guard");
+const merge_guard_1 = require("./commands/merge-guard");
 // Governed compact (Chip D) — PreCompact renders the transcript to pixel-font
 // PNG pages (lossless ~3x-density archive, CCR-indexed); SessionStart(compact)
 // injects the pointer so the post-compact model can Read the verbatim record.
@@ -129,13 +133,16 @@ const procedure_1 = require("./procedure");
 // per turn by the Stop hook (observeProcedureTurn), closed by negative
 // continuity, distilled server-side, transitions applied to the local store.
 const procedure_watch_1 = require("./procedure-watch");
+const procedure_scope_1 = require("./procedure-scope");
 const procedure_runtime_1 = require("./procedure-runtime");
+const procedure_enabled_1 = require("./procedure-enabled");
 const procedure_shadow_1 = require("./procedure-shadow");
 const inline_atom_hook_1 = require("./inline-atom-hook");
 const inline_atom_background_1 = require("./inline-atom-background");
 const reminder_injector_1 = require("./reminder-injector");
 const skill_landing_1 = require("./skill-landing");
 const skill_mirror_client_1 = require("./skill-mirror-client");
+const repodoc_client_1 = require("./repodoc-client");
 const native_skill_pending_1 = require("./native-skill-pending");
 const doc_mirror_client_1 = require("./doc-mirror-client");
 const equipped_loadouts_cache_1 = require("./equipped-loadouts-cache");
@@ -620,60 +627,11 @@ function detectArtifacts(toolCalls, cwd) {
     return events;
 }
 // ---------- Env-var scrubbing ---------------------------------------------
-// Pattern + entropy detection now lives in ./secret-scrubber — the CLI MIRROR of
+// Pattern + entropy detection lives in ./secret-scrubber — the CLI MIRROR of
 // the canonical @greprag/core module (the zero-dep hook can't import core at
-// runtime). scrubString / scrubObject are imported at the top of this file. The
-// 18 original provider patterns are preserved verbatim there, so this path
-// scrubs identically — now backed by ~150 patterns + a high-entropy catch-all.
-// buildRedactionMap below is CLIENT-ONLY (reads .env + process.env) and stays
-// here on purpose: the pure module is filesystem-free. adr: adr/secret-scrubber.md
-/** Build a redaction map of value → [REDACTED:VAR_NAME] from .env files and process.env. */
-function buildRedactionMap(cwd) {
-    const entries = [];
-    const seenValues = new Set();
-    const addEntry = (key, value) => {
-        if (!value || value.length < 16)
-            return;
-        if (seenValues.has(value))
-            return;
-        seenValues.add(value);
-        entries.push([value, `[REDACTED:${key}]`]);
-    };
-    // Walk up looking for .env files
-    let dir = path.resolve(cwd);
-    for (let depth = 0; depth < 8; depth++) {
-        const envPath = path.join(dir, '.env');
-        if (fs.existsSync(envPath)) {
-            try {
-                const raw = fs.readFileSync(envPath, 'utf-8');
-                for (const line of raw.split('\n')) {
-                    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.+?)\s*$/);
-                    if (!m)
-                        continue;
-                    let value = m[2].trim();
-                    if ((value.startsWith('"') && value.endsWith('"')) ||
-                        (value.startsWith("'") && value.endsWith("'"))) {
-                        value = value.slice(1, -1);
-                    }
-                    addEntry(m[1], value);
-                }
-            }
-            catch { /* skip */ }
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    // Process env
-    for (const [key, value] of Object.entries(process.env)) {
-        if (typeof value === 'string')
-            addEntry(key, value);
-    }
-    // Sort by value length desc so longer values are replaced first
-    entries.sort((a, b) => b[0].length - a[0].length);
-    return entries;
-}
+// runtime). The CLIENT-ONLY .env/process.env walker (buildRedactionMap) lives
+// in ./env-redaction; both are imported at the top of this file.
+// adr: adr/secret-scrubber.md
 // ---------- Field-size cap ------------------------------------------------
 function capField(text) {
     if (!text || text.length <= MAX_FIELD_CHARS)
@@ -773,6 +731,14 @@ function collectDocEvents(filesTouched, cwd) {
 /** One observed turn of the active watch. Never throws (the caller also
  *  guards); every network call fail-open. */
 async function observeProcedureTurn(cfg, anchor, turn, cwd, redaction) {
+    // Master switch. Off since 2026-09-11. No watch can open while it is off, but
+    // a watch left open by the last enabled session must not keep observing and
+    // must never distill — so clear it rather than resume it.
+    // adr: adr/procedure-system-off.md
+    if (!procedure_enabled_1.PROCEDURE_SYSTEM_ENABLED) {
+        (0, procedure_watch_1.clearProcedureWatch)(anchor.projectId);
+        return;
+    }
     const watch = (0, procedure_watch_1.readProcedureWatch)(anchor.projectId);
     if (!watch) {
         // File exists but is unreadable/corrupt — drop it so it can't wedge the observer.
@@ -868,7 +834,7 @@ async function observeProcedureTurn(cfg, anchor, turn, cwd, redaction) {
                     }
                     else {
                         const store = (0, procedure_1.readProcedureStore)(anchor.projectId);
-                        const { store: nextStore, action } = (0, procedure_watch_1.applyDistillTransition)(store, next, outcome, distilled, (0, procedure_watch_1.learnTriggersForVerb)(next.verb, store));
+                        const { store: nextStore, action } = (0, procedure_watch_1.applyDistillTransition)(store, next, outcome, distilled, (0, procedure_watch_1.learnTriggersForVerb)(next.verb, store), (0, procedure_scope_1.projectCheckoutRoots)(cwd));
                         if (action !== 'discarded')
                             (0, procedure_1.writeProcedureStore)(anchor.projectId, nextStore);
                     }
@@ -1110,7 +1076,7 @@ async function store(input, source = 'claude-code') {
         ? (0, turn_provenance_1.provenanceElisionMarker)(provenance, (0, turn_provenance_1.provenanceHint)(provenance, turn.userPrompt))
         : turn.userPrompt;
     // Env-var scrub
-    const redaction = buildRedactionMap(cwd);
+    const redaction = (0, env_redaction_1.buildRedactionMap)(cwd);
     const userPrompt = capField((0, secret_scrubber_1.scrubString)(userPromptForStore, redaction));
     const agentResponse = capField((0, secret_scrubber_1.scrubString)(turn.agentResponse, redaction));
     // Strip internal-only fields (_output, _useId) before sending to API,
@@ -1218,6 +1184,17 @@ async function store(input, source = 'claude-code') {
             });
         }
     }
+    // Repo chunk index (adr/node-identity-port.md): the chunks are DERIVED from a
+    // document plus the node graph committed beside it, so they are rebuilt when
+    // the document moves rather than when someone remembers to run a push. Same
+    // event as docptr and the skill mirror — the turn already knows what it wrote.
+    // Only a repository that has been indexed at least once participates, and
+    // within it only documents whose graph actually moved. Best-effort, never
+    // throws: a stale index is a worse search result, a thrown Stop hook is lost
+    // work.
+    await (0, repodoc_client_1.maybeRebuildChunks)({
+        filesTouched: turn.filesTouched, cwd, apiUrl: cfg.apiUrl, apiKey: cfg.apiKey,
+    });
 }
 // ---------- Main ---------------------------------------------------------
 // ---------- Recap (SessionStart) ------------------------------------------
@@ -1329,13 +1306,56 @@ function shouldEmitDriftWarning(storedId, derivedId) {
     return (Date.now() - lastMs) >= DRIFT_WARNING_TTL_MS;
 }
 function grokSidecarHead(short, full) {
-    const arm = (0, session_id_1.armMonitorCommand)(short, null, false, false, 'grok');
+    const arm = (0, session_id_1.armMonitorCommand)(short, null, false, 'grok');
     return (0, session_id_1.buildSessionIdContext)(short, (0, session_id_1.readIdentityAlias)())
         + `\n\nARM (Grok monitor persistent:true): \`${arm}\`\n`
         + `Send with --from-session ${full || short} (full UUID or 16-hex, never 8-hex).\n`
         + 'Chip: `greprag load grok-chip-spawn` then `greprag grok spawn`. Helper: spawn_subagent. Parent keeps ONE watch. Peers: `greprag inbox watchers` then `greprag send`.\n'
         + 'If a greprag inbox monitor is already listed, do not start another. Instant exit = already armed.\n\n';
 }
+/** SessionStart(persona) / PostCompact(persona) — Persona on its own hook, with
+ *  its own inline budget.
+ *
+ *  The harness caps EACH hook invocation at ~2048 bytes independently, so a
+ *  dedicated hook buys Persona a full allowance nothing else competes for. That
+ *  matters because Persona is the one block that shapes every token the agent
+ *  emits; the rest of the announce is reference material `greprag load` serves
+ *  on demand. It also means the operator can grow their Persona without silently
+ *  pushing another announce section out.
+ *
+ *  Registered on SessionStart AND PostCompact, for Claude Code and Codex alike.
+ *  PostCompact is not an optional extra: a compaction wipes SessionStart context,
+ *  so without it a long session silently loses its speaking rules mid-flight.
+ *
+ *  The emitted `hookEventName` is the CONSTANT 'SessionStart', never the payload's
+ *  event name. `PostCompact` is a hook REGISTRATION point, not a value the harness
+ *  accepts in `hookSpecificOutput` — Claude Code validates that field against a
+ *  fixed enum and REJECTS the whole payload when it echoes 'PostCompact', so the
+ *  persona is dropped on exactly the path this hook exists to cover. Every other
+ *  greprag PostCompact hook (`recompact`, `session-id`) already emits 'SessionStart'
+ *  for this reason.
+ *
+ *  Fetch failures stay silent — a missing Persona is not worth a startup error.
+ *  adr: adr/persona.md, adr/announce-inline-budget.md */
+async function personaHook(input) {
+    const cwd = input.cwd || process.cwd();
+    const cfg = (0, hook_runtime_1.getHookConfig)(cwd);
+    if (!cfg.enabled || !cfg.apiKey)
+        return;
+    try {
+        const res = await fetch(`${cfg.apiUrl}/v1/persona`, {
+            headers: { 'Authorization': `Bearer ${cfg.apiKey}` },
+        });
+        if (!res.ok)
+            return;
+        const data = await res.json();
+        const announce = typeof data.announce === 'string' ? data.announce.trim() : '';
+        if (!announce)
+            return;
+        (0, hook_runtime_1.writeAdditionalContext)('SessionStart', (0, persona_1.fitPersonaAnnounce)(announce));
+    }
+    catch { /* never block session start on Persona */ }
+}
 /** Where the full, unabridged announce is parked for on-demand reading.
  *  adr: adr/announce-inline-budget.md */
 function announceCachePath(short) {
@@ -1362,9 +1382,9 @@ function buildInlineAnnounce(blocks, short) {
         catch { /* cache is a convenience; never block session start */ }
     }
     // Reserve room for the pointer line before fitting, so adding it can never be
-    // what pushes the payload over the cap.
-    const POINTER_RESERVE = 220;
-    const { kept, droppedIds } = (0, reminder_registry_1.fitAnnounceBudget)(blocks, reminder_registry_1.ANNOUNCE_INLINE_BUDGET, POINTER_RESERVE);
+    // what pushes the payload over the cap. The number lives beside the budget in
+    // reminder-registry so the `mustInline` build guard charges the same reserve.
+    const { kept, droppedIds } = (0, reminder_registry_1.fitAnnounceBudget)(blocks, reminder_registry_1.ANNOUNCE_INLINE_BUDGET, reminder_registry_1.ANNOUNCE_POINTER_RESERVE);
     if (!droppedIds.length)
         return kept.map(b => b.text).join('\n\n') || null;
     const names = droppedIds.join(', ');
@@ -1373,9 +1393,14 @@ function buildInlineAnnounce(blocks, short) {
         + `Read them with \`greprag announce\`.]`;
     return [...kept.map(b => b.text), pointer].join('\n\n');
 }
-function writeRecapOutput(text, mode, grokShort, grokFull) {
-    if (grokShort)
-        (0, grok_session_1.writeGrokSidecar)(grokShort, grokSidecarHead(grokShort, grokFull) + (text || ''));
+/** `grokExtra` is sidecar-ONLY text. The Grok sidecar is a FILE the agent reads
+ *  (adr/grok-platform.md) — it has no inline cap, so a block that cannot fit the
+ *  inline budget still belongs there whole. Persona is the one such block today.
+ *  adr: adr/persona.md */
+function writeRecapOutput(text, mode, grokShort, grokFull, grokExtra) {
+    if (grokShort) {
+        (0, grok_session_1.writeGrokSidecar)(grokShort, grokSidecarHead(grokShort, grokFull) + (grokExtra || '') + (text || ''));
+    }
     if (!text)
         return;
     if (mode === 'additionalContext') {
@@ -1667,11 +1692,38 @@ async function recap(input, mode = 'plain', opts = {}) {
             return null;
         }
     })();
+    // Parity units THIS harness still owes. The lead is filtered out server-side by
+    // state, and diverged units are dropped here — two-sided advancement needs the
+    // operator, not an unattended port. adr: adr/parity-system.md
+    const parityPendingPromise = (async () => {
+        try {
+            const res = await fetch(`${cfg.apiUrl}/v1/parity/list`, {
+                headers: { 'Authorization': `Bearer ${cfg.apiKey}` },
+            });
+            if (!res.ok)
+                return undefined;
+            const data = await res.json();
+            const pending = (data.units || [])
+                .filter(u => !u.divergedHint && u.lead?.harness && u.lead.harness !== platform)
+                .flatMap(u => (u.followers || [])
+                .filter(f => f.state === 'stale' && f.harness === platform && f.path)
+                .map(f => ({
+                unit: String(u.name || ''),
+                summary: String(u.summary || ''),
+                path: String(f.path),
+                leadHarness: String(u.lead?.harness || ''),
+            })));
+            return pending.length ? pending : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
     const updateAvailablePromise = checkForUpdate();
     const bodyPromise = (!opts.compact && anchor.sessionStartRecap)
         ? (0, opencode_plugin_helpers_1.buildRecapBody)(cfg.apiUrl, cfg.apiKey, anchor)
         : Promise.resolve('');
-    const [, corpusApiDocs, docPointers, enrichmentDown, skillGains, mirroredSkills, loadoutState, personaAnnounce, updateAvailable, body,] = await Promise.all([
+    const [, corpusApiDocs, docPointers, enrichmentDown, skillGains, mirroredSkills, loadoutState, personaAnnounce, parityPending, updateAvailable, body,] = await Promise.all([
         matchsetPromise,
         corpusApiDocsPromise,
         docPointersPromise,
@@ -1680,6 +1732,7 @@ async function recap(input, mode = 'plain', opts = {}) {
         mirroredSkillsPromise,
         loadoutStatePromise,
         personaPromise,
+        parityPendingPromise,
         updateAvailablePromise,
         bodyPromise,
     ]);
@@ -1699,12 +1752,6 @@ async function recap(input, mode = 'plain', opts = {}) {
         const top = behind.reduce((a, b) => (isNewer(a.minCliVersion, b.minCliVersion) ? b : a));
         return { from: top.fromHandle || 'another tenant', needed: top.minCliVersion, current: installed };
     })();
-    // Assistant doctrine auto-load — fires ONLY for the flagged assistant project
-    // (isAssistantProject), so a normal project sees zero change. The hook owns the
-    // doctrine-file read; the assistant-doctrine module routes the text. adr: adr/assistant-role.md
-    const assistantDoctrine = (0, project_anchor_1.isAssistantProject)(anchor)
-        ? (0, assistant_doctrine_1.buildAssistantDoctrineContext)(cwd)
-        : null;
     // Active Procedure installs (adr/procedure-install-control-plane.md). Local,
     // operator-owned state; missing/corrupt installs fail closed to no announce.
     const procedureAnnounces = (() => {
@@ -1717,7 +1764,7 @@ async function recap(input, mode = 'plain', opts = {}) {
     })();
     // ── THE single SessionStart announce assembly (docs/reminder-interrupt.md §Registry
     // spec) ──────────────────────────────────────────────────────────────────────────────
-    // Every agent-facing announce — setup-warning, front-desk, assistant-doctrine,
+    // Every agent-facing announce — setup-warning, front-desk, delivery-control,
     // watcher-arm, mechanic — is now a registry module. The hook did the I/O above; here it
     // stuffs the results into ONE env and collectAnnounces renders them in registry order.
     // Loaded once + re-fired on compact (recap matcher ''). The Mechanic kill switch drops
@@ -1739,19 +1786,12 @@ async function recap(input, mode = 'plain', opts = {}) {
         short: announceShort, turnCount: 0, stress: 0, armed: false, sessionUnread: 0,
         ownerPid: hasLocalMonitorLifecycle ? sessionOwnerPid : null,
         alias: (0, session_id_1.readIdentityAlias)(),
-        assistant: (() => { try {
-            return (0, project_anchor_1.isAssistantProject)(anchor);
-        }
-        catch {
-            return false;
-        } })(),
         mechanic: announceMechanic,
         mechanicLive: announceMechanicLive,
         platform,
         projectName: anchor.projectName,
         deliveryRepo: (0, project_anchor_1.computeGitDerivedProjectId)(cwd) !== null,
         setupWarning,
-        assistantDoctrine,
         corpusApiDocs,
         docPointers,
         enrichmentDown,
@@ -1760,11 +1800,36 @@ async function recap(input, mode = 'plain', opts = {}) {
         procedureAnnounces,
         equippedLoadouts,
         personaAnnounce,
+        parityPending,
         updateAvailable,
         activeCommandDrift: activeCommandDrift(),
         loadoutUpdateRequired,
     };
-    let announceReg = (0, app_settings_1.filterEnabledInterrupts)(reminder_registry_1.REGISTRY);
+    // Derive the registry for THIS harness first, so a module's `harnesses:` tag is
+    // honored here the way it already is on the opencode path.
+    let announceReg = (0, app_settings_1.filterEnabledInterrupts)((0, reminder_registry_1.harnessModules)(platform, reminder_registry_1.REGISTRY));
+    // Persona NEVER rides this inline path, on any harness or any event. Every
+    // harness that reaches recap/recompact delivers it through the dedicated
+    // `greprag-hook persona` hook (Claude Code + Codex, SessionStart AND
+    // PostCompact) or, for Grok, through the uncapped sidecar file below — each
+    // with a full ANNOUNCE_HARNESS_CAP allowance to itself. Competing inside
+    // ANNOUNCE_INLINE_BUDGET never worked: the operator's 1,886-byte persona is
+    // larger than the whole budget, so `fitAnnounceBudget` deferred it WHOLE on
+    // every path except Claude Code SessionStart.
+    //
+    // Unconditional is the point. The previous attempt scoped this by harness and
+    // broke Codex PostCompact, because `recompact` is one subcommand shared by
+    // Claude Code and Codex and cannot tell which one invoked it. A rule that needs
+    // no harness knowledge cannot be got wrong by a harness it cannot see.
+    //
+    // OpenCode is unaffected: its plugin never calls recap(), it renders
+    // `persona-announce` from the same registry straight into the system prompt,
+    // and that path has no inline cap. So the module stays registered for everyone.
+    // adr: adr/persona.md, adr/announce-inline-budget.md
+    const personaSidecar = platform === 'grok' && personaAnnounce
+        ? personaAnnounce.trim() + '\n\n'
+        : '';
+    announceReg = announceReg.filter(m => m.id !== 'persona-announce');
     if ((0, reminder_injector_1.mechanicKilled)())
         announceReg = announceReg.filter(m => m.id !== 'mechanic-friction');
     if (!announceShort)
@@ -1783,7 +1848,7 @@ async function recap(input, mode = 'plain', opts = {}) {
     // that the rest existed. adr: adr/announce-inline-budget.md
     const announceBlock = buildInlineAnnounce((0, reminder_registry_1.collectAnnounceBlocks)(announceEnv, announceReg), (0, session_id_1.truncateSessionId)(input.session_id));
     if (opts.compact) {
-        writeRecapOutput(announceBlock ? announceBlock + '\n' : '', mode, grokShort, input.session_id);
+        writeRecapOutput(announceBlock ? announceBlock + '\n' : '', mode, grokShort, input.session_id, personaSidecar);
         return;
     }
     const preamble = () => (announceBlock ? announceBlock + '\n' : '');
@@ -1792,7 +1857,7 @@ async function recap(input, mode = 'plain', opts = {}) {
     // hook globally. Setup warnings still fire above.
     if (!anchor.sessionStartRecap) {
         const out = preamble();
-        writeRecapOutput(out, mode, grokShort, input.session_id);
+        writeRecapOutput(out, mode, grokShort, input.session_id, personaSidecar);
         return;
     }
     // Recap body is hourlies-only — daily summaries used to render here (one
@@ -1809,7 +1874,7 @@ async function recap(input, mode = 'plain', opts = {}) {
     // if they're pending.
     if (!body) {
         const out = preamble();
-        writeRecapOutput(out, mode, grokShort, input.session_id);
+        writeRecapOutput(out, mode, grokShort, input.session_id, personaSidecar);
         return;
     }
     const parts = [];
@@ -1828,7 +1893,7 @@ async function recap(input, mode = 'plain', opts = {}) {
         ? body
         : '[greprag memory — session recap not inlined (over the SessionStart cap). '
             + 'Read it with `greprag memory recap`.]');
-    writeRecapOutput(parts.join('\n') + '\n', mode, grokShort, input.session_id);
+    writeRecapOutput(parts.join('\n') + '\n', mode, grokShort, input.session_id, personaSidecar);
 }
 /** Arm-state detection moved LOCAL (2026-06-04). The former `isSessionArmed`
  *  asked the server's watcher registry "does this session have a live socket?"
@@ -1975,9 +2040,14 @@ async function notify(input, source = 'claude-code', chipContext) {
     // proven-registered `notify` hook — so arming never depends on a freshly-merged
     // subcommand reaching the operator's settings. Fires whatever's deficient (stacking),
     // and auto-silences each module the instant its deficiency resolves.
+    // Claude Code inbox delivery is TURN-BASED (2026-09-04). The Monitor watcher is
+    // retired here: Claude Code has native in-harness session messaging, so greprag's
+    // job is only to land OUTSIDE mail — and it does that on the same UserPromptSubmit
+    // steering Codex uses. adr: adr/monitor-resilience.md
+    const inbox = await (0, codex_steering_1.buildCodexInboxSteering)(input, cfg);
     const reminders = await (0, reminder_injector_1.injectReminders)(input, cfg, short);
     const inlineAtoms = (0, inline_atom_hook_1.buildPendingInlineAtomContext)(input, short);
-    const parts = [reminders, inlineAtoms].filter((p) => !!p);
+    const parts = [inbox, reminders, inlineAtoms].filter((p) => !!p);
     if (parts.length)
         (0, hook_runtime_1.writeAdditionalContext)('UserPromptSubmit', parts.join('\n\n'));
 }
@@ -2256,7 +2326,7 @@ async function main() {
     const validSubs = new Set([
         'store', 'recap', 'recompact', 'notify', 'mail', 'friction-reminder', 'session-id', 'pre-spawn-check', 'armcheck',
         'collision-check', 'drain', 'coordinate-gate', 'codex-coordinate-gate', 'procedure-check',
-        'guard', 'guard-refresh', 'guard-flush',
+        'guard', 'guard-refresh', 'guard-flush', 'persona',
         'context-probe', 'context-check', 'crush-wrap',
         'pre-compact', 'archive-pointer',
         'codex-store', 'codex-notify', 'codex-inbox', 'codex-recap',
@@ -2431,7 +2501,10 @@ async function main() {
         // silence on any non-qualifying command. A narrow rg preflight denial runs
         // before wrap because generated/temp crawls are harmful before output exists.
         // adr: adr/pipe-wrap-hook.md
-        const out = (0, search_guard_1.runSearchGuard)(input)
+        // The merge guard runs FIRST: it is a deny, and denying a command must not
+        // depend on whether a later rewrite step happens to fire.
+        const out = (0, merge_guard_1.runMergeGuard)(input)
+            || (0, search_guard_1.runSearchGuard)(input)
             || (0, pipe_wrap_1.runPipeWrap)(input);
         if (out)
             process.stdout.write(JSON.stringify(out) + '\n');
@@ -2444,6 +2517,15 @@ async function main() {
         if (message)
             process.stdout.write(JSON.stringify({ systemMessage: message }) + '\n');
     }
+    else if (subcommand === 'persona') {
+        // Persona rides its OWN hook, not the announce. The harness caps each hook's
+        // inline output at ~2048 bytes independently, so a dedicated invocation gives
+        // Persona a full allowance that no other announce section can crowd out.
+        // Persona governs every token the agent emits; everything else in the
+        // announce is reference material that `greprag load` can serve on demand.
+        // adr: adr/announce-inline-budget.md
+        await personaHook(input);
+    }
     else if (subcommand === 'archive-pointer') {
         // SessionStart(matcher=compact) — the one documented post-compact channel
         // whose output reaches the model. Points at the PNG archive.