kenaz 0.3.16 → 0.3.17

package/core/.claude/commands/Ansuz.md

@@ -14,6 +14,7 @@ ARGUMENTS 含 `[專案: X]` 或 `--project-path X` → PROJECT_PATH = X，下方
 ## 工作方式
 - **自己做**：約 30 行內的小修正 → 直接改，跑最近的測試，提交。
 - **開卡派工**（中型、可平行、高風險）：`kenaz_task_create` 開卡（requirements、acceptance criteria、scope paths）→ `node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` → `promptText` 給 subagent、`agentParams` 照用（不換模型）；輸出是 `executor` 區塊時照 RULES.md 的 Dispatch 執行。subagent 在 worktree commit，你驗證後合併。
+- 用戶指定 model 就照做：單張卡加 `--dispatch-model <id>`（不改設定）；「之後都用」才 `kenaz subagent set <id> [--rigor r]`。沒指定就照設定，不自己換。
 - 開卡前確認 scope 與驗收條件對準真正的問題。
 
 ## 驗證（合併前，強度跟風險相稱）

package/core/.claude/hooks/__tests__/vendor-agent-guard.test.js

@@ -0,0 +1,44 @@
+// vendor-agent-guard.js: in another-vendor session, an Agent call that asks for a Claude model is denied.
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { decide } = require('../vendor-agent-guard');
+
+const DS = { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic', KENAZ_PROVIDER: 'deepseek' };
+const call = (model, tool = 'Agent') => ({ tool_name: tool, tool_input: { description: 'x', prompt: 'y', ...(model ? { model } : {}) } });
+
+test('deepseek session: Agent/Task asking for a Claude model is denied with the dispatch.js route', () => {
+  for (const [m, t] of [['opus', 'Agent'], ['sonnet', 'Task'], ['claude-opus-5-5', 'Agent']]) {
+    const d = decide(call(m, t), DS);
+    assert.strictEqual(d.hookSpecificOutput.permissionDecision, 'deny', m);
+    assert.match(d.hookSpecificOutput.permissionDecisionReason, /dispatch\.js .*executor/);
+  }
+  // base URL alone (a session launched before KENAZ_PROVIDER existed) is enough
+  assert.ok(decide(call('opus'), { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic' }));
+});
+
+test('controls: no model, a non-Claude model, a Claude session, or another tool are allowed', () => {
+  assert.strictEqual(decide(call(null), DS), null, 'no model = runs on the session vendor, as intended');
+  assert.strictEqual(decide(call('deepseek-v4-pro'), DS), null);
+  assert.strictEqual(decide(call('opus'), {}), null, 'normal Claude session');
+  assert.strictEqual(decide(call('opus'), { ANTHROPIC_BASE_URL: 'https://api.anthropic.com' }), null);
+  assert.strictEqual(decide({ tool_name: 'Bash', tool_input: { command: 'ls' } }, DS), null);
+});
+
+test('real hook path: the plugin dispatcher runs it in a user project and prints the deny JSON', () => {
+  const root = path.resolve(__dirname, '..', '..', '..');
+  // a user project (inside the core repo the plugin yields to the repo's own .claude/settings.json hooks)
+  const proj = require('fs').mkdtempSync(path.join(require('os').tmpdir(), 'vag-'));
+  require('fs').mkdirSync(path.join(proj, '.kenaz')); require('fs').writeFileSync(path.join(proj, '.kenaz', 'project.yaml'), 'name: p\n');
+  const r = spawnSync(process.execPath, [path.join(root, 'plugins', 'kenaz', 'hooks', 'kenaz-hook.js'), 'vendor-agent-guard'], {
+    input: JSON.stringify(call('opus')), encoding: 'utf8',
+    env: { ...process.env, ...DS, CLAUDE_PROJECT_DIR: proj, KENAZ_MODE: 'full' }, cwd: proj,
+  });
+  assert.match(r.stdout, /"permissionDecision":"deny"/, r.stdout + r.stderr);
+  const ok = spawnSync(process.execPath, [path.join(root, 'plugins', 'kenaz', 'hooks', 'kenaz-hook.js'), 'vendor-agent-guard'], {
+    input: JSON.stringify(call('opus')), encoding: 'utf8',
+    env: { ...process.env, ANTHROPIC_BASE_URL: '', KENAZ_PROVIDER: '', CLAUDE_PROJECT_DIR: proj, KENAZ_MODE: 'full' }, cwd: proj,
+  });
+  assert.strictEqual(ok.stdout.trim(), '', 'control: Claude session prints nothing');
+});

package/core/.claude/hooks/vendor-agent-guard.js

@@ -0,0 +1,40 @@
+'use strict';
+// PreToolUse(Agent|Task): in a session whose model requests go to another vendor (kenaz launch --provider
+// deepseek, or the env set by hand), an Agent-tool subagent runs on that vendor too, whatever `model` says.
+// Asking it for a Claude model is therefore always a silent substitution: deny it and point at the path that
+// does reach Claude (dispatch.js -> executor block -> claude -p on the user's own login). Agent calls without
+// a Claude model are allowed (they run on the session's vendor, as expected). Fails open on any error.
+// Field report 2026-10-12: a DeepSeek Ansuz asked the Agent tool for opus and the subagent ran deepseek-v4-pro.
+const path = require('path');
+
+const CLAUDE_MODEL = /^(opus|sonnet|haiku|fable)$|^claude-/i;
+
+function decide(input, env = process.env) {
+  if (!input || !['Agent', 'Task'].includes(input.tool_name)) return null;
+  const model = String((input.tool_input && input.tool_input.model) || '').trim();
+  if (!CLAUDE_MODEL.test(model)) return null;
+  let other = false;
+  try { other = require(path.join(__dirname, '..', '..', '.formation', 'bifrost', 'exec.js')).otherVendorSession(env); } catch (_) { return null; }
+  if (!other) return null;
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: `This session's model requests go to ${env.KENAZ_PROVIDER || 'another vendor'} (${env.ANTHROPIC_BASE_URL || 'KENAZ_PROVIDER'}), so an Agent-tool subagent would run there, not on Claude '${model}'. ` +
+        'For a Claude subagent run dispatch.js (card first): node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent [--dispatch-model ' + model + '] ' +
+        '-> it prints an `executor` block; run executor.command with Bash run_in_background (claude -p on the user\'s Claude login). ' +
+        'To use this session\'s model instead, call the Agent tool again without `model`.',
+    },
+  };
+}
+
+function main() {
+  try {
+    const raw = require('fs').readFileSync(0, 'utf8');
+    const out = decide(JSON.parse(raw || '{}'));
+    if (out) process.stdout.write(JSON.stringify(out));
+  } catch (_) { /* fail open */ }
+}
+
+if (require.main === module) main(); // hook wrappers require() it and call main() (same as memory-guard.js)
+module.exports = { decide, main };

package/core/.claude/settings.json

@@ -71,6 +71,15 @@
           }
         ],
         "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write"
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const d=process.env.CLAUDE_PROJECT_DIR;process.chdir(d);require(d+'/.claude/hooks/vendor-agent-guard.js').main()\""
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/core/.formation/bifrost/exec.js

@@ -92,6 +92,13 @@ async function deepseekModels(key, fetchFn = globalThis.fetch, timeoutMs = 3000)
     return Object.keys(out).length ? out : null;
   } catch { return null; }
 }
+/** True in a Claude Code session whose model requests go to another vendor (kenaz launch, or the env set by
+ *  hand): KENAZ_PROVIDER, or ANTHROPIC_BASE_URL not on anthropic.com. The Agent tool there reaches only that vendor. */
+function otherVendorSession(env = process.env) {
+  if (env.KENAZ_PROVIDER && env.KENAZ_PROVIDER !== 'anthropic') return true;
+  const u = String(env.ANTHROPIC_BASE_URL || '').replace(/^https?:\/\//i, '');
+  return !!u && !/(^|\.)anthropic\.com(\/|:|$)/i.test(u);
+}
 const DEEPSEEK_UNSET = ['ANTHROPIC_API_KEY']; // never send a real Anthropic key to another vendor
 // The claude adapter must reach Claude, not the vendor `kenaz launch` pointed this session at: drop every override
 // launch sets (the vendor key lives in ANTHROPIC_AUTH_TOKEN; DEEPSEEK_API_KEY is dropped too, the child does not need it).
@@ -168,4 +175,4 @@ async function main(argv) {
 }
 
 if (require.main === module) main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
-module.exports = { parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };
+module.exports = { otherVendorSession, parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };

package/core/.formation/tools/__tests__/subagent-executor.test.js

@@ -178,14 +178,14 @@ test('dispatch under KENAZ_PROVIDER: Claude id -> executor adapter claude, no ag
   fs.mkdirSync(path.join(sb, '.kenaz', 'locks'), { recursive: true });
   fs.writeFileSync(path.join(sb, 'README.md'), 'x'); fs.writeFileSync(path.join(sb, '.gitignore'), '.formation/worktrees/\n.kenaz/\n');
   git(sb, ['init', '-q']); git(sb, ['add', '-A']); git(sb, ['commit', '-q', '--no-verify', '-m', 'init']);
-  const base = { ...process.env }; delete base.CLAUDE_PROJECT_DIR; delete base.CODEX_SESSION_ID; delete base.CODEX_THREAD_ID; delete base.KENAZ_PROVIDER;
+  const base = { ...process.env }; delete base.CLAUDE_PROJECT_DIR; delete base.CODEX_SESSION_ID; delete base.CODEX_THREAD_ID; delete base.KENAZ_PROVIDER; delete base.ANTHROPIC_BASE_URL;
   const sh = (script, args, env) => spawnSync(process.execPath, [script, ...args], { env, encoding: 'utf8', windowsHide: true, cwd: ROOT });
   const mk = sh(TASKAPI, ['--project-path', sb, 'create', '--title', 't2430', '--description', 'd', '--scope-paths', 'zzz/a.js', '--requirements', 'r1',
     '--acceptance-criteria', 'a1', '--acceptance-criteria', 'a2', '--acceptance-criteria', 'a3', '--technical-notes', 't1', '--technical-notes', 't2', '--force'], base);
   const id = ((mk.stdout || '').match(/TASK_\d+/) || [])[0]; assert.ok(id, mk.stdout + mk.stderr);
-  const disp = (model, provider) => {
+  const disp = (model, provider, extra = {}) => {
     fs.writeFileSync(path.join(sb, '.kenaz', 'dashboard-models.json'), JSON.stringify({ dispatchModel: model }));
-    const env = { ...base, ...(provider ? { KENAZ_PROVIDER: provider } : {}), DEEPSEEK_API_KEY: KEY };
+    const env = { ...base, ...(provider ? { KENAZ_PROVIDER: provider } : {}), DEEPSEEK_API_KEY: KEY, ...extra };
     const r = sh(DISPATCH, ['--skill=do', `--task=${id}`, '--dispatch-mode=subagent', '--project-path', sb, '--force'], env);
     return { r, j: (() => { try { return JSON.parse(r.stdout); } catch { return null; } })() };
   };
@@ -202,6 +202,11 @@ test('dispatch under KENAZ_PROVIDER: Claude id -> executor adapter claude, no ag
   const none = disp('claude-sonnet-5-5', null); // control: no KENAZ_PROVIDER = byte-for-byte as before
   assert.equal(none.j.executor, undefined);
   assert.deepEqual(Object.keys(none.j.agentParams), ['description', 'model']); assert.equal(none.j.agentParams.model, 'sonnet');
+  // a session launched before KENAZ_PROVIDER existed, or with the env set by hand, is recognised by its base URL
+  const byUrl = disp('claude-opus-5', null, { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic' });
+  assert.equal(byUrl.j.executor.adapter, 'claude'); assert.equal(byUrl.j.agentParams, undefined);
+  const official = disp('claude-opus-5', null, { ANTHROPIC_BASE_URL: 'https://api.anthropic.com' }); // control
+  assert.equal(official.j.executor, undefined); assert.equal(official.j.agentParams.model, 'opus');
 });
 
 test('dispatch: executor block for codex:/deepseek:, byte-for-byte agentParams for a Claude id', (t) => {
@@ -210,7 +215,7 @@ test('dispatch: executor block for codex:/deepseek:, byte-for-byte agentParams f
   fs.mkdirSync(path.join(sb, '.kenaz', 'locks'), { recursive: true });
   fs.writeFileSync(path.join(sb, 'README.md'), 'x'); fs.writeFileSync(path.join(sb, '.gitignore'), '.formation/worktrees/\n.kenaz/\n');
   git(sb, ['init', '-q']); git(sb, ['add', '-A']); git(sb, ['commit', '-q', '--no-verify', '-m', 'init']);
-  const env = { ...process.env, DEEPSEEK_API_KEY: KEY }; delete env.CLAUDE_PROJECT_DIR; delete env.CODEX_SESSION_ID; delete env.CODEX_THREAD_ID;
+  const env = { ...process.env, DEEPSEEK_API_KEY: KEY }; delete env.ANTHROPIC_BASE_URL; delete env.KENAZ_PROVIDER; delete env.CLAUDE_PROJECT_DIR; delete env.CODEX_SESSION_ID; delete env.CODEX_THREAD_ID;
   const sh = (script, args) => spawnSync(process.execPath, [script, ...args], { env, encoding: 'utf8', windowsHide: true, cwd: ROOT });
   const mk = sh(TASKAPI, ['--project-path', sb, 'create', '--title', 't2422', '--description', 'd', '--scope-paths', 'zzz/a.js', '--requirements', 'r1',
     '--acceptance-criteria', 'a1', '--acceptance-criteria', 'a2', '--acceptance-criteria', 'a3', '--technical-notes', 't1', '--technical-notes', 't2', '--force']);

package/core/.formation/tools/dispatch.js

@@ -1065,7 +1065,9 @@ async function getSubagentDispatchParams(options) {
   }
   // TASK_2430: in a `kenaz launch` session the Agent tool only reaches the other vendor, so a Claude model
   // id runs as a `claude -p` executor on the user's own Claude login instead.
-  if (!isCodex && !exec && process.env.KENAZ_PROVIDER && process.env.KENAZ_PROVIDER !== 'anthropic') {
+  // A session started before KENAZ_PROVIDER existed, or with the env set by hand, is recognised by its base URL.
+  const otherVendor = require('../bifrost/exec').otherVendorSession(process.env);
+  if (!isCodex && !exec && otherVendor) {
     const fam = translateModelForAgentTool(rawModel).model;
     if (fam) exec = { adapter: 'claude', id: fam };
   }

package/core/.specialist/Ansuz/RULES.md

@@ -70,6 +70,11 @@ the real defect BEFORE carding or dispatching.
   opus). dispatch.js moves the card to active.
 - The dispatch model is the project's setting: `kenaz subagent` (or /kenaz subagent) shows it per rigor, `kenaz subagent set <id> [--rigor r]`
   changes it (writes .kenaz/dashboard-models.json). Your own model is the user's session model (/model).
+- When the user names a model in conversation, act on it yourself (user decision 2026-10-12), never on your own
+  judgment (2026-09-22): for one card ("use opus for this", "let deepseek do the frontend") pass
+  `--dispatch-model <id>` to dispatch.js (claude-opus-5-5, opus, codex:<id>, deepseek:<model>) and leave the setting
+  alone; for "from now on / always" run `kenaz subagent set <id> [--rigor r]` (core repo:
+  `node .formation/tools/dispatch-model.js set <id> [--rigor r]`) and say what changed. No model named = the setting.
 - Executor model (`kenaz subagent set codex:<id>` or `deepseek:<model>`): dispatch.js prints an `executor` block instead of
   agentParams. Run `executor.command` with Bash run_in_background, wait for the completion notice, read `executor.resultFile`
   (ok, exitCode, lastMessage, commits; `no commits` = failure), then verify and merge `executor.branchName` as usual.

package/core/KENAZ_CORE_VERSION

@@ -1 +1 @@
-0.3.16
+0.3.17

package/core/plugins/kenaz/commands/Ansuz.md

@@ -14,6 +14,7 @@ ARGUMENTS 含 `[專案: X]` 或 `--project-path X` → PROJECT_PATH = X，下方
 ## 工作方式
 - **自己做**：約 30 行內的小修正 → 直接改，跑最近的測試，提交。
 - **開卡派工**（中型、可平行、高風險）：`kenaz_task_create` 開卡（requirements、acceptance criteria、scope paths）→ `node "${CLAUDE_PLUGIN_ROOT}/hooks/core-resolve.js" .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` → `promptText` 給 subagent、`agentParams` 照用（不換模型）；輸出是 `executor` 區塊時照 RULES.md 的 Dispatch 執行。subagent 在 worktree commit，你驗證後合併。
+- 用戶指定 model 就照做：單張卡加 `--dispatch-model <id>`（不改設定）；「之後都用」才 `kenaz subagent set <id> [--rigor r]`。沒指定就照設定，不自己換。
 - 開卡前確認 scope 與驗收條件對準真正的問題。
 
 ## 驗證（合併前，強度跟風險相稱）

package/core/plugins/kenaz/hooks/hooks.json

@@ -1,28 +1,152 @@
 {
   "hooks": {
-    "SessionStart": [{ "hooks": [
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-start" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" guidance" }
-    ] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" prompt-runner" }] }],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-start"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" guidance"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" prompt-runner"
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
-      { "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] },
-      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" synapse-first" }] },
-      { "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" memory-guard" }] }
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" synapse-first"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" memory-guard"
+          }
+        ]
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" vendor-agent-guard"
+          }
+        ]
+      }
     ],
     "PostToolUse": [
-      { "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] },
-      { "matcher": "TaskCreate|TaskUpdate", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" task-bridge" }] }
-    ],
-    "PostToolUseFailure": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "Notification": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SubagentStart": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SubagentStop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SessionEnd": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "Stop": [{ "hooks": [
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-stop" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" autonomy-stop" }
-    ] }]
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      },
+      {
+        "matcher": "TaskCreate|TaskUpdate",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" task-bridge"
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-stop"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" autonomy-stop"
+          }
+        ]
+      }
+    ]
   }
 }

package/core/plugins/kenaz/hooks/kenaz-hook.js

@@ -31,6 +31,7 @@ const HOOKS = {
   'autonomy-stop':  { kind: 'script', file: 'autonomy-stop.js', call: 'main', minMode: 'full' },
   'synapse-first':  { kind: 'script', file: 'synapse-first-investigation.js', minMode: 'full' },
   'memory-guard':   { kind: 'script', file: 'memory-guard.js', call: 'main', minMode: 'full' },
+  'vendor-agent-guard': { kind: 'script', file: 'vendor-agent-guard.js', call: 'main', minMode: 'assist' },
   'task-bridge':    { kind: 'script', file: 'task-bridge.js', minMode: 'assist' },
 };
 

package/lib/cli.js

@@ -35,8 +35,9 @@ function installer() {
 
 /** A core module from the installed core, else this checkout; null when neither is there. */
 function coreModule(p, ...rel) {
-  // installed core, then the core bundled in this npm package (npx before `kenaz install`), then the repo checkout
-  for (const f of [path.join(p.core, ...rel), path.join(PKG_ROOT, 'core', ...rel), path.join(__dirname, '..', '..', '..', ...rel)]) {
+  // installed core, then the repo checkout (dev: live source), then the core bundled in this npm package (npx
+  // before `kenaz install`). Bundled before repo ran a stale prepack copy from a dev checkout (2026-10-12).
+  for (const f of [path.join(p.core, ...rel), path.join(__dirname, '..', '..', '..', ...rel), path.join(PKG_ROOT, 'core', ...rel)]) {
     if (fs.existsSync(f)) return require(f);
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kenaz",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "Install Kenaz (plugin, hooks, kenaz-server) for Claude Code and Codex: npx kenaz install",
   "bin": {
     "kenaz": "bin/kenaz.js"
@@ -20,11 +20,11 @@
     "test": "node --test lib/cli.test.js"
   },
   "optionalDependencies": {
-    "@kenazai/server-darwin-arm64": "0.3.16",
-    "@kenazai/server-darwin-x64": "0.3.16",
-    "@kenazai/server-linux-arm64": "0.3.16",
-    "@kenazai/server-linux-x64": "0.3.16",
-    "@kenazai/server-win32-x64": "0.3.16"
+    "@kenazai/server-darwin-arm64": "0.3.17",
+    "@kenazai/server-darwin-x64": "0.3.17",
+    "@kenazai/server-linux-arm64": "0.3.17",
+    "@kenazai/server-linux-x64": "0.3.17",
+    "@kenazai/server-win32-x64": "0.3.17"
   },
   "license": "UNLICENSED",
   "repository": {