harnery 0.31.6 → 0.32.0

package/dist/commands/doctor.js

@@ -16,9 +16,12 @@ import os from "node:os";
 import path from "node:path";
 import { BUILTIN_ADAPTER_IDS } from "../core/adapters/index.js";
 import { resolveBinName, ripgrepAutoInstall } from "../core/config.js";
-import { loadAdapterWiring } from "../core/hooks/adapter/wiring.js";
+import { ADAPTER_SPECS } from "../core/hooks/adapter/events.js";
+import { loadAdapterWiring, summarizeAdapterWiring } from "../core/hooks/adapter/wiring.js";
+import { inspectCodexWslBridge } from "../core/hooks/codex-wsl-bridge.js";
 import { ADAPTER_BINARIES, ADAPTER_INSTALL_HINTS, ADAPTER_LOGIN_HINTS, } from "../core/workflow/adapters.js";
 import { probeBilling } from "../core/workflow/billing.js";
+import { checkGitHooks, gitHooksInstalled } from "../lib/instructions/git-hooks.js";
 import { findRg, installRg, managedRgPath, rgInstallSupported } from "../lib/tools/ripgrep.js";
 export function registerDoctorCommand(program, emit) {
     program
@@ -65,20 +68,70 @@ export function registerDoctorCommand(program, emit) {
     });
 }
 export function runChecks() {
+    const codexWslBridge = checkCodexWslBridge();
+    // Probe the adapter CLIs before the hook check runs, not in output order:
+    // an unwired adapter only matters if its CLI is actually installed, and
+    // probing once here keeps that join to one spawn per CLI.
+    const workflow = BUILTIN_ADAPTER_IDS.map((id) => ({ id, ...checkWorkflowAdapter(id) }));
+    const installed = workflow.filter((w) => w.installed).map((w) => w.id);
     return [
         checkNode(),
         checkGit(),
         checkBun(),
         checkRipgrep(),
         checkHarneryDir(),
-        checkAdapterHooks(),
-        ...BUILTIN_ADAPTER_IDS.map(checkWorkflowAdapter),
+        checkAdapterHooks(installed),
+        checkGitHookRegions(),
+        ...(codexWslBridge ? [codexWslBridge] : []),
+        ...workflow.map((w) => w.check),
         checkRestic(),
         checkRclone(),
         checkPlaywright(),
         checkPython(),
     ];
 }
+function checkGitHookRegions() {
+    const root = findCoordProjectRoot();
+    if (!root) {
+        return { name: "git hooks", severity: "ok", detail: "n/a (no .harnery/ above cwd)" };
+    }
+    try {
+        if (!gitHooksInstalled(root)) {
+            const bin = resolveBinName(root);
+            return {
+                name: "git hooks",
+                severity: "warn",
+                detail: `not installed - commits are not guarded against peer-claim conflicts and ` +
+                    `claims never auto-release on commit/checkout; run \`${bin} init\` to install`,
+            };
+        }
+        const { status, issues } = checkGitHooks(root);
+        if (status === "fresh") {
+            return { name: "git hooks", severity: "ok", detail: "managed regions current" };
+        }
+        return { name: "git hooks", severity: "warn", detail: issues.join("; ") };
+    }
+    catch (err) {
+        return {
+            name: "git hooks",
+            severity: "warn",
+            detail: `check failed: ${err.message}`,
+        };
+    }
+}
+function checkCodexWslBridge() {
+    const status = inspectCodexWslBridge();
+    if (!status)
+        return null;
+    return {
+        name: "codex:WSL bridge",
+        severity: status.ok ? "ok" : "warn",
+        detail: status.detail,
+        hint: status.ok
+            ? undefined
+            : "forward CODEX_THREAD_ID through WSLENV in the Codex shell environment policy, then start a fresh task",
+    };
+}
 function checkRipgrep() {
     const found = findRg();
     if (found) {
@@ -123,6 +176,9 @@ function whichVersion(bin, args = ["--version"]) {
  * One workflow spawn target: is the adapter CLI installed, and how will its
  * headless children bill (subscription login vs API key — see billing.ts)?
  * Missing is a warn, not a fail: workflows degrade to the adapters you have.
+ *
+ * Reports `installed` alongside the check so `checkAdapterHooks` can reuse the
+ * probe instead of spawning every adapter CLI a second time.
  */
 function checkWorkflowAdapter(adapter) {
     const bin = ADAPTER_BINARIES[adapter];
@@ -130,19 +186,25 @@ function checkWorkflowAdapter(adapter) {
     const r = whichVersion(bin);
     if (!r.ok) {
         return {
-            name,
-            severity: "warn",
-            detail: `${bin} missing (workflow --adapter ${adapter} unavailable)`,
-            hint: `${ADAPTER_INSTALL_HINTS[adapter]}  then: ${ADAPTER_LOGIN_HINTS[adapter]}`,
+            check: {
+                name,
+                severity: "warn",
+                detail: `${bin} missing (workflow --adapter ${adapter} unavailable)`,
+                hint: `${ADAPTER_INSTALL_HINTS[adapter]}  then: ${ADAPTER_LOGIN_HINTS[adapter]}`,
+            },
+            installed: false,
         };
     }
     const probe = probeBilling(adapter);
     if (probe.login === "absent" && !probe.apiKeyPresent) {
         return {
-            name,
-            severity: "warn",
-            detail: `${r.out} — installed, but no stored login or API key detected`,
-            hint: ADAPTER_LOGIN_HINTS[adapter],
+            check: {
+                name,
+                severity: "warn",
+                detail: `${r.out} — installed, but no stored login or API key detected`,
+                hint: ADAPTER_LOGIN_HINTS[adapter],
+            },
+            installed: true,
         };
     }
     const billing = probe.mode === "subscription"
@@ -150,7 +212,7 @@ function checkWorkflowAdapter(adapter) {
             ? "billing: subscription"
             : "billing: subscription (login unverifiable, CLI is the authority)"
         : `billing: ${probe.mode} (${probe.apiKeySource})`;
-    return { name, severity: "ok", detail: `${r.out} — ${billing}` };
+    return { check: { name, severity: "ok", detail: `${r.out} — ${billing}` }, installed: true };
 }
 function checkNode() {
     const v = process.versions.node;
@@ -289,13 +351,21 @@ function checkHarneryDir() {
  * loadAdapterWiring — so a bare settings file never false-warns. The remedy is
  * always the same: re-run `<bin> init` (idempotent, additive).
  */
-function checkAdapterHooks() {
+function checkAdapterHooks(installedAdapters = []) {
     const root = findCoordProjectRoot();
     if (!root) {
         return { name: "adapter hooks", severity: "ok", detail: "n/a (no .harnery/ above cwd)" };
     }
     const drift = loadAdapterWiring(root);
-    if (drift.length === 0) {
+    // A adapter with zero harnery hooks is only worth flagging when the project
+    // plainly uses harnery hooks (something else is wired) AND that adapter's CLI
+    // is installed. Both conditions matter: the first keeps a project that has
+    // never run init quiet, the second keeps a project that simply doesn't have
+    // Codex quiet. What's left is the case that reads as healthy but isn't — an
+    // agent can start a session through that adapter and register nothing.
+    const summary = summarizeAdapterWiring(root);
+    const unwired = summary.wired.length > 0 ? summary.unwired.filter((id) => installedAdapters.includes(id)) : [];
+    if (drift.length === 0 && unwired.length === 0) {
         return { name: "adapter hooks", severity: "ok", detail: "wired + current" };
     }
     const bin = resolveBinName(root);
@@ -316,10 +386,23 @@ function checkAdapterHooks() {
         }
         return `${d.settingsFile}: ${bits.join("; ")}`;
     });
+    for (const id of unwired) {
+        parts.push(`${ADAPTER_SPECS[id].settingsFile}: ${id} CLI installed, no harnery hooks wired`);
+    }
     const needsManualRepair = drift.some((d) => d.parseError || d.invalidTopLevelKeys.length > 0 || d.invalidEventKeys.length > 0);
-    const hint = needsManualRepair
-        ? `repair the invalid adapter settings, then run \`${bin} init\` to migrate harnery hooks`
-        : `run \`${bin} init\` to migrate the hook set (idempotent)`;
+    const wireHints = unwired.map((id) => `\`${bin} init --adapter ${id}\``);
+    let hint;
+    if (needsManualRepair) {
+        hint = `repair the invalid adapter settings, then run \`${bin} init\` to migrate harnery hooks`;
+    }
+    else if (drift.length > 0) {
+        hint = `run \`${bin} init\` to migrate the hook set (idempotent)`;
+        if (wireHints.length > 0)
+            hint += `; ${wireHints.join(" and ")} to wire the rest`;
+    }
+    else {
+        hint = `run ${wireHints.join(" and ")} (idempotent, additive)`;
+    }
     return { name: "adapter hooks", severity: "warn", detail: parts.join("  |  "), hint };
 }
 function macOrLinux(mac, linux) {

package/dist/commands/init.d.ts

@@ -18,8 +18,7 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
 import { type AdapterId, type AdapterSpec } from "../core/hooks/adapter/events.js";
-import { type HookGroup, type SettingsFile } from "../core/hooks/adapter/wiring.js";
-export type { HookGroup, SettingsFile };
+import { type SettingsFile } from "../core/hooks/adapter/wiring.js";
 export declare function registerInitCommand(program: Command, emit: EmitContext, binName?: string): void;
 /**
  * Merge agent-hook entries into a adapter settings object in place, idempotently.

package/dist/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAiB,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,YAAY,EAClB,MAAM,iCAAiC,CAAC;AAUzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAYxC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CA4I/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,SAAS,GACjB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAqCvE;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAmB1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAmDhG;AASD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkCxF"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAiB,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,iCAAiC,CAAC;AAmBzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAuJ/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,SAAS,GACjB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAqCvE;AAyDD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAmB1F;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAmDhG;AASD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkCxF"}

package/dist/commands/init.js

@@ -23,6 +23,7 @@ import { DEFAULT_BIN_NAME, pinnedBinName, stripJsonComments } from "../core/conf
 import { ADAPTER_SPECS } from "../core/hooks/adapter/events.js";
 import { commandWiresSubcommand, groupCommands, makeEntry, } from "../core/hooks/adapter/wiring.js";
 import { applyInstructions, checkInstructions, } from "../lib/instructions/apply.js";
+import { applyGitHooks, checkGitHooks } from "../lib/instructions/git-hooks.js";
 import { HostAddendumError } from "../lib/instructions/host-addendum.js";
 // This file is src/commands/init.ts → harnery package root is two levels up.
 const HARNERY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
@@ -55,14 +56,18 @@ export function registerInitCommand(program, emit, binName) {
         // ── --check: read-only drift report on the block + skills ──────────────
         if (opts.check === true) {
             const { status, issues } = checkInstructions(projectRoot, { binName: bin, adapter });
-            const head = status === "fresh"
-                ? "harn init --check: instructions + skills are current"
-                : status === "drift"
+            const gitHooks = checkGitHooks(projectRoot);
+            if (gitHooks.status !== "fresh")
+                issues.push(...gitHooks.issues);
+            const merged = status === "error" ? "error" : gitHooks.status !== "fresh" ? "drift" : status;
+            const head = merged === "fresh"
+                ? "harn init --check: instructions + skills + git hooks are current"
+                : merged === "drift"
                     ? "harn init --check: drift found (re-run `init` to refresh)"
                     : "harn init --check: error";
             const lines = issues.length ? `\n${issues.map((i) => `  ✗ ${i}`).join("\n")}` : "";
             emit.text(`${head}${lines}`);
-            emit.setExitCode(status === "fresh" ? 0 : status === "drift" ? 2 : 1);
+            emit.setExitCode(merged === "fresh" ? 0 : merged === "drift" ? 2 : 1);
             return;
         }
         const dryRun = opts.dryRun === true;
@@ -152,7 +157,13 @@ export function registerInitCommand(program, emit, binName) {
             return;
         }
         actions.push(...applied.actions);
-        emit.text(render(projectRoot, dryRun, actions, applied.warnings));
+        // ── 4. git-hook managed regions ────────────────────────────────────────
+        // Same lifecycle contract as the instructions block: the coordination
+        // content of the consumer's git hooks is machine-owned and versioned;
+        // everything else in those files belongs to the host.
+        const gitHooks = applyGitHooks(projectRoot, { dryRun });
+        actions.push(...gitHooks.actions);
+        emit.text(render(projectRoot, dryRun, actions, [...applied.warnings, ...gitHooks.warnings]));
     });
 }
 /**

package/dist/commands/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/commands/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAa1E,OAAO,EAYL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AA+rBhC;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAsE7F;AAgND,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,YAAY,CAAC,EAAE,qBAAqB,GACnC,IAAI,CA4EN"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/commands/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAa1E,OAAO,EAYL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AA8rBhC;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAsE7F;AA+MD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,YAAY,CAAC,EAAE,qBAAqB,GACnC,IAAI,CA2EN"}

package/dist/commands/tunnel.js

@@ -763,7 +763,7 @@ function status(opts) {
         return;
     }
     if (states.length === 1) {
-        // Single tunnel: show the full detail block (backward-compatible).
+        // A single tunnel is clearer as a detail block than as a one-row table.
         statusDetail(states[0]);
         return;
     }
@@ -794,7 +794,7 @@ function logs(opts) {
     const name = resolveName(opts.name);
     const state = readState(name);
     const provider = state?.provider ?? "cloudflare";
-    const which = opts.cloudflared || opts.provider ? providerLogFile(name, provider) : gateLogFile(name);
+    const which = opts.provider ? providerLogFile(name, provider) : gateLogFile(name);
     const path = cachePath("tunnel", which);
     if (!existsSync(path)) {
         emit.error({ code: "tunnel_no_log", message: `No log file at ${path}` });
@@ -898,7 +898,6 @@ export function registerTunnelCommand(program, emitParam, contextParam) {
         .option("-f, --follow", "follow the log")
         .option("--gate", "tail the gate log (default)")
         .option("--provider", "tail the provider log instead")
-        .option("--cloudflared", "tail the Cloudflare provider log instead (legacy alias)")
         .action(logs);
     const allow = cmd
         .command("allow")

package/dist/core/agents/canonical-emit.d.ts

@@ -30,8 +30,7 @@ export interface CanonicalEmitInput {
 export declare function resolveEmitRoot(start?: string): string | null;
 export declare function emitCanonical(input: CanonicalEmitInput): void;
 /**
- * Normalize the heartbeat's `platform` field (which uses snake_case
- * `claude_code`) to the canonical kebab-case Adapter type.
+ * Normalize the heartbeat's `platform` field to the canonical Adapter type.
  */
 export declare function normalizeAdapter(platform: string | undefined): "claude-code" | "cursor" | "codex";
 //# sourceMappingURL=canonical-emit.d.ts.map

package/dist/core/agents/canonical-emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-emit.d.ts","sourceRoot":"","sources":["../../../src/core/agents/canonical-emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAE5E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAsC7D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAIjG"}
+{"version":3,"file":"canonical-emit.d.ts","sourceRoot":"","sources":["../../../src/core/agents/canonical-emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAE5E;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAsC7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAIjG"}

package/dist/core/agents/canonical-emit.js

@@ -69,8 +69,7 @@ export function emitCanonical(input) {
     }
 }
 /**
- * Normalize the heartbeat's `platform` field (which uses snake_case
- * `claude_code`) to the canonical kebab-case Adapter type.
+ * Normalize the heartbeat's `platform` field to the canonical Adapter type.
  */
 export function normalizeAdapter(platform) {
     if (platform === "cursor")

package/dist/core/agents/cli.js

@@ -91,24 +91,11 @@ async function handleVerdict(root) {
         const { evaluateClaim } = await import("./rules/claim-conflict.js");
         verdict = evaluateClaim(root, parsed);
     }
-    else if (parsed.rule === "commit") {
-        const { evaluateCommit } = await import("./rules/commit-conflict.js");
-        const result = evaluateCommit(root, parsed);
-        // Map CommitVerdictResult → the standard verdict envelope, stash details
-        // on extra fields so the bash caller can pull conflicts + log_lines.
-        verdict = {
-            allow: result.allow,
-            exit_code: result.exit_code,
-            rule: result.rule,
-            reason: result.message,
-            // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-        };
-        verdict.conflicts = result.conflicts;
-        verdict.log_lines = result.log_lines;
-        verdict.suppressed_self_attribution =
-            result.suppressed_self_attribution ?? false;
-    }
     else {
+        // NB: rule === "commit" was served here until 2026-08-09; the commit
+        // guard now enters through `git-hook pre-commit`, which runs the same
+        // evaluateCommit in-process. A straggler host lands in this fail-open
+        // branch, which is the pre-migration behavior for a malformed request.
         verdict = {
             allow: true,
             exit_code: 0,
@@ -233,13 +220,6 @@ async function handleStateAction(root, action, rest) {
             process.stdout.write(`${JSON.stringify({ instance_id: owner, task: hb.task ?? null, cleared: !task })}\n`);
             return 0;
         }
-        case "stamp-status-call": {
-            const hb = writer.stampStatusCheck(root, owner);
-            if (!hb)
-                return 1;
-            process.stdout.write(`${JSON.stringify({ instance_id: owner, last_status_at: hb.last_status_at })}\n`);
-            return 0;
-        }
         case "set-turn-summary": {
             const summary = args.join(" ");
             const hb = writer.setTurnSummary(root, owner, summary);
@@ -313,10 +293,13 @@ async function handleStateAction(root, action, rest) {
             // fragility. Positionals (sessionId, model) stay as-is once flags are
             // filtered out.
             const adapter = args.find((a) => a.startsWith("--adapter="))?.slice("--adapter=".length);
+            const forkedFrom = args
+                .find((a) => a.startsWith("--forked-from="))
+                ?.slice("--forked-from=".length);
             const positional = args.filter((a) => !a.startsWith("--"));
             const sessionId = positional[0];
             const model = positional[1];
-            const hb = writer.healHeartbeat(root, owner, sessionId, model, adapter);
+            const hb = writer.healHeartbeat(root, owner, sessionId, model, adapter, forkedFrom ? { forkedFrom } : undefined);
             process.stdout.write(`${JSON.stringify({ instance_id: owner, recreated: !!hb })}\n`);
             return hb ? 0 : 1;
         }
@@ -450,70 +433,35 @@ async function handleCouncilAction(root, action, rest) {
 }
 async function handleAssignName(root, rest) {
     const { assignName } = await import("./state/names.js");
-    const [owner, kindArg] = rest;
+    // Optional recorded-fork-lineage flag: --forked-from <parent_instance_id>.
+    // Supplied by an adapter layer that knows (or detected) that this session
+    // was branched from another conversation. Inert on resume: assignName only
+    // stamps lineage on the row that first assigns the instance.
+    let forkedFrom;
+    const positional = [];
+    for (let i = 0; i < rest.length; i++) {
+        if (rest[i] === "--forked-from") {
+            forkedFrom = rest[++i];
+            continue;
+        }
+        positional.push(rest[i]);
+    }
+    const [owner, kindArg] = positional;
     if (!owner || !kindArg) {
-        process.stderr.write("agent-coord assign-name <instance_id> <session|subagent|transient>\n");
+        process.stderr.write("agent-coord assign-name <instance_id> <session|subagent|transient> [--forked-from <instance_id>]\n");
         return 2;
     }
     if (kindArg !== "session" && kindArg !== "subagent" && kindArg !== "transient") {
         process.stderr.write(`agent-coord assign-name: invalid kind ${kindArg}\n`);
         return 2;
     }
-    const name = assignName(root, owner, kindArg);
-    process.stdout.write(`${JSON.stringify({ instance_id: owner, name, kind: kindArg })}\n`);
-    return 0;
-}
-async function handlePostCommit(root) {
-    const raw = await readStdin();
-    let req = {};
-    try {
-        req = JSON.parse(raw);
-    }
-    catch {
-        return 0;
-    }
-    const { groupUnclaim } = await import("./state/heartbeat-writer.js");
-    // Session-group-wide unclaim. `owner` is the parent's session_id which is
-    // also the group key (parent + subagents share session_id). Each actual
-    // removal also emits a durable claim.release event — the projector rebuilds
-    // files_touched from the permanent Edit/Write events, so a file-only prune
-    // would resurrect on the next replay.
-    if (req.owner && Array.isArray(req.prune)) {
-        for (const path of req.prune) {
-            try {
-                for (const hit of groupUnclaim(root, req.owner, path)) {
-                    await emitClaimRelease(root, hit.instance_id, hit, path, "commit");
-                }
-            }
-            catch {
-                /* best-effort */
-            }
-        }
-    }
-    return 0;
-}
-async function handlePostCheckout(root, _rest) {
-    const raw = await readStdin();
-    let req = {};
-    try {
-        req = JSON.parse(raw);
-    }
-    catch {
-        return 0;
-    }
-    const { groupUnclaim } = await import("./state/heartbeat-writer.js");
-    if (req.owner && Array.isArray(req.removed)) {
-        for (const path of req.removed) {
-            try {
-                for (const hit of groupUnclaim(root, req.owner, path)) {
-                    await emitClaimRelease(root, hit.instance_id, hit, path, "checkout");
-                }
-            }
-            catch {
-                /* best-effort */
-            }
-        }
-    }
+    const name = assignName(root, owner, kindArg, forkedFrom ? { forkedFrom } : undefined);
+    process.stdout.write(`${JSON.stringify({
+        instance_id: owner,
+        name,
+        kind: kindArg,
+        ...(forkedFrom ? { forked_from: forkedFrom } : {}),
+    })}\n`);
     return 0;
 }
 async function handleShellMutationPaths(root, rest) {
@@ -776,6 +724,97 @@ async function handleEmitEvent(root, rest) {
     process.stdout.write(`${JSON.stringify(result.envelope)}\n`);
     return 0;
 }
+/**
+ * `agent-coord git-hook <event> [args]` — the single entry a host git hook
+ * invokes. Owns ALL of the coordination git plumbing that hosts used to carry
+ * as bash (staged/committed/checkout-removed collection, submodule
+ * canonicalization, gitlink probe, verdict, claim pruning), so a harnery
+ * upgrade upgrades hook behavior with no change to the host's hook file.
+ *
+ * Events: pre-commit (E-guard verdict; exit 1 blocks the commit),
+ * post-commit (prune committed paths' claims), post-checkout <old> <new>
+ * (release claims on paths the ref move rewrote).
+ *
+ * Fail-open by design: an internal error never blocks a commit (parity with
+ * the bash era, where a crashed verdict read as empty and the hook moved on).
+ * A clean conflict verdict still blocks.
+ */
+async function handleGitHook(fallbackRoot, rest) {
+    const event = rest[0];
+    if (process.env.HARNERY_AGENT_COORD_OFF === "1")
+        return 0;
+    const cwd = process.cwd();
+    try {
+        const gh = await import("./git-hook.js");
+        // Pin the coord root to the superproject: a submodule cwd may carry its
+        // own config-only .harnery that the generic root walk would land on.
+        const root = gh.discoverCoordRoot(cwd) ?? fallbackRoot;
+        if (event === "pre-commit") {
+            const { staged, gitlinks } = gh.collectStaged(cwd);
+            if (staged.length === 0)
+                return 0;
+            const { evaluateCommit } = await import("./rules/commit-conflict.js");
+            const result = evaluateCommit(root, {
+                staged_paths: staged,
+                staged_gitlinks: gitlinks,
+                bypass: process.env.HARNERY_AGENT_COORD_BYPASS === "1",
+            });
+            // Forensics channel shared with the stdin `verdict` path.
+            try {
+                const logPath = join(root, ".harnery", "debug", "agent-coord-verdict.ndjson");
+                await mkdir(dirname(logPath), { recursive: true });
+                await appendFile(logPath, `${JSON.stringify({ ts: new Date().toISOString(), via: "git-hook", staged, verdict: result })}\n`);
+            }
+            catch {
+                /* diagnostics never break a verdict */
+            }
+            if (result.rule !== "commit.pass") {
+                if (result.message)
+                    process.stdout.write(`\n${result.message}\n\n`);
+                for (const c of result.conflicts) {
+                    process.stdout.write(`    ${c.staged_path}  (held by ${c.short_name})\n`);
+                }
+                process.stdout.write("\n");
+            }
+            if (!result.allow) {
+                process.stdout.write("  Wait for them to finish, split the commit, or set\n" +
+                    "  HARNERY_AGENT_COORD_BYPASS=1 to force this commit through.\n\n");
+                return result.exit_code || 1;
+            }
+            return 0;
+        }
+        if (event === "post-commit" || event === "post-checkout") {
+            const paths = event === "post-commit"
+                ? gh.collectCommitted(cwd)
+                : gh.collectCheckoutRemoved(cwd, rest[1] ?? "", rest[2] ?? "");
+            if (paths.length === 0)
+                return 0;
+            const { resolveOwner } = await import("../hooks/resolve/owner.js");
+            const owner = resolveOwner({ payload: null, coordRoot: root })?.instance_id;
+            if (!owner)
+                return 0;
+            const { groupUnclaim } = await import("./state/heartbeat-writer.js");
+            const reason = event === "post-commit" ? "commit" : "checkout";
+            for (const path of paths) {
+                try {
+                    for (const hit of groupUnclaim(root, owner, path)) {
+                        await emitClaimRelease(root, hit.instance_id, hit, path, reason);
+                    }
+                }
+                catch {
+                    /* best-effort */
+                }
+            }
+            return 0;
+        }
+        process.stderr.write(`agent-coord git-hook: unknown event ${event ?? "(none)"}\n`);
+        return 0;
+    }
+    catch {
+        // Fail open: coordination must never brick git.
+        return 0;
+    }
+}
 async function main() {
     const [subcommand, ...rest] = process.argv.slice(2);
     const root = findCoordRoot(process.cwd());
@@ -791,7 +830,6 @@ async function main() {
         return handleEmitEvent(root, rest);
     }
     if (subcommand === "set-task" ||
-        subcommand === "stamp-status-call" ||
         subcommand === "set-turn-summary" ||
         subcommand === "release-claim" ||
         subcommand === "kill-heartbeat" ||
@@ -835,11 +873,8 @@ async function main() {
     if (subcommand === "shell-mutation-claim-log") {
         return handleShellMutationClaimLog(root, rest);
     }
-    if (subcommand === "post-commit") {
-        return handlePostCommit(root);
-    }
-    if (subcommand === "post-checkout") {
-        return handlePostCheckout(root, rest);
+    if (subcommand === "git-hook") {
+        return handleGitHook(root, rest);
     }
     await logNoop(root, subcommand ?? "(none)", rest);
     // Phase 1/2: silent on stdout for unknown subcommands, exit 0. Existing

package/dist/core/agents/coord-client.d.ts

@@ -40,11 +40,15 @@ export interface Heartbeat {
     task?: string;
     /** UTC ISO-8601 timestamp when task was last set/cleared. Used by adapters without Stop enforcement to compute staleness. 2026-05-24. */
     task_updated_at?: string | null;
+    /** Session name built on the first non-empty set-task; its presence means "this session has been named". 2026-08-09. */
+    suggested_session_name?: string;
+    /** Stamped by turn.stop once the suggested name is seen in assistant reply text. 2026-08-09. */
+    session_name_seen_at?: string;
     /** Auto-generated per-turn summary written by the Stop hook via Haiku. 2026-05-23. */
     turn_summary?: string | null;
     /** UTC ISO-8601 timestamp when turn_summary was last refreshed. */
     turn_summary_updated_at?: string | null;
-    /** Hook client: `claude_code` (default) or `cursor`. Cursor Phase 1. */
+    /** Hook client: `claude-code` (default) or `cursor`. Cursor Phase 1. */
     platform?: string;
 }
 /**
@@ -101,7 +105,7 @@ export declare function nearestCoordRoot(start: string): string | null;
 export declare function rootKnowsSession(root: string): boolean;
 /** Parse owner from a pid-map row (`owner` or `owner\tplatform`). */
 export declare function parsePidmapRowOwner(row: string): string;
-/** Parse platform from a pid-map row; legacy rows default to `claude_code`. */
+/** Parse platform from a pid-map row; legacy rows default to `claude-code`. */
 export declare function parsePidmapRowPlatform(row: string): string;
 /** Parse the start token from a pid-map row; rows written before it carry none. */
 export declare function parsePidmapRowStartToken(row: string): string | undefined;
@@ -128,7 +132,7 @@ export declare function pidStartToken(pid: number): string | null;
  *
  * Pid-map files are `instance_id` or `instance_id\tplatform` (Cursor Phase 1).
  * Prefer a row whose platform matches `HARNERY_AGENT_COORD_PLATFORM` (default
- * `claude_code`); otherwise return the first owner seen on the walk.
+ * `claude-code`); otherwise return the first owner seen on the walk.
  *
  * Subagents intentionally do not write pid-map entries; a Bash-tool ppid-walk
  * from inside a subagent therefore resolves to the *parent's* pid-map entry.

package/dist/core/agents/coord-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yIAAyI;IACzI,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CxD;AAgCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAwCA;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AA0DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgDpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMlE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}
+{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yIAAyI;IACzI,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wHAAwH;IACxH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gGAAgG;IAChG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CxD;AAgCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAwCA;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AA2DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgDpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMlE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}