oh-my-harness 0.11.0 → 0.13.0

package/README.md

@@ -53,11 +53,10 @@ npx oh-my-harness init "TypeScript Next.js frontend with Python FastAPI backend"
 
 # Or install globally
 npm install -g oh-my-harness
-oh-my-harness init --preset nextjs fastapi
+oh-my-harness init "React app with TDD"
 
 # Short alias works too
-omh init "React app with TDD"
-omh init --preset android            # Android/Kotlin with Hilt, JUnit, Gradle
+omh init "Android Kotlin app with Hilt, JUnit, Gradle"
 omh catalog list
 omh test          # Dry-run verify your harness
 omh stats         # TUI analytics dashboard
@@ -88,9 +87,9 @@ your-project/
 │   └── manifest.json                  # Generated-files manifest
 ├── .claude/
 │   ├── settings.json                  # Claude permissions + hooks → .omh/hooks/*.sh
-│   └── oh-my-harness.json             # Active preset tracking
+│   └── oh-my-harness.json             # Harness init/sync state
 └── .codex/
-    ├── config.toml                    # [features] codex_hooks = true
+    ├── config.toml                    # [features] hooks = true, goals = true
     └── hooks.json                     # Codex hooks → .omh/hooks/*.sh (same scripts)
 ```
 
@@ -102,7 +101,7 @@ your-project/
   ~/.omh/config.json   ┌─────────────────────┐
   ┌────────────────┐   │                     │
   │ • Claude CLI   │──▶│   NL Processing     │◀── "React + FastAPI
-  │ • Claude API   │   │   or --preset flag  │     TDD enforced"
+  │ • Claude API   │   │   (describe your    │     TDD enforced"
   │ • OpenAI API   │   │                     │
   │ • Gemini API   │   └────────┬────────────┘
   └────────────────┘            │
@@ -196,6 +195,7 @@ All enforcement is powered by **catalog blocks** — reusable, parameterized hoo
 hooks:
   - block: branch-guard
   - block: tdd-guard
+    mode: ask          # ask for approval instead of hard-blocking (Claude)
   - block: commit-test-gate
     params:
       testCommand: "npx vitest run"
@@ -218,6 +218,20 @@ hooks:
       baseBranch: main
 ```
 
+#### `mode`: block vs. ask
+
+Any blocking hook accepts an optional `mode` (default `block`):
+
+- **`block`** — hard-blocks the tool call. The agent cannot proceed.
+- **`ask`** — escalates to the user for approval instead of blocking outright.
+  - **Claude Code**: shows a native permission prompt (`permissionDecision: "ask"`).
+  - **Codex**: `ask` is **not** supported, so the hook falls back to a hard
+    block — your guardrail is never silently downgraded to "allow". The same
+    generated script detects the calling runtime and responds accordingly.
+
+`mode: ask` only applies to blocks that can block (`canBlock: true`); setting it
+on a non-blocking block (e.g. `lint-on-save`) is reported and ignored.
+
 ---
 
 ## 🖥️ Commands
@@ -225,7 +239,7 @@ hooks:
 ```bash
 # 🚀 Initialize
 omh init "your project description"      # NL-powered (requires AI provider)
-omh init --preset nextjs fastapi          # Preset-based (instant)
+omh init                                  # Interactive TUI (import existing harness.yaml)
 
 # 📋 Catalog
 omh catalog list                          # Browse all building blocks
@@ -236,9 +250,7 @@ omh hook add branch-guard                 # Add a hook
 omh hook remove auto-pr                   # Remove a hook
 
 # 🔄 Sync & manage
-omh sync                                 # Regenerate from harness.yaml
-omh add nextjs                            # Add a preset
-omh remove fastapi                        # Remove a preset
+omh sync                                 # Regenerate all files from harness.yaml
 
 # 🩺 Verify & monitor
 omh doctor                               # Health check
@@ -314,7 +326,7 @@ Keyboard: `1/2/3` views, `↑/↓` scroll, `d` date filter, `r` reload, `q` quit
 
 ## 📊 Stateful Hook Logging
 
-Every hook invocation is recorded in `.claude/hooks/.state/events.jsonl`:
+Every hook invocation is recorded in `.omh/state/events.jsonl`:
 
 ```jsonl
 {"ts":"2026-03-18T08:00:00Z","event":"PreToolUse","hook":"catalog-tdd-guard.sh","decision":"block","reason":"TDD — foo.test.* 테스트 파일을 먼저 수정하세요"}
@@ -338,7 +350,7 @@ oh-my-harness/
 │   │   ├── template-engine.ts # Handlebars rendering + applyDefaults
 │   │   └── converter.ts    # HookEntry[] → rendered scripts
 │   ├── cli/
-│   │   ├── commands/       # init, add, remove, doctor, catalog, hook, sync, test
+│   │   ├── commands/       # init, doctor, catalog, hook, sync, test
 │   │   ├── stats/          # TUI dashboard (ink/React)
 │   │   │   ├── App.tsx     # App shell (tab bar, keyboard nav)
 │   │   │   ├── data.ts     # Data aggregation layer
@@ -350,10 +362,10 @@ oh-my-harness/
 │   │   ├── provider-setup.ts  # Provider configuration UI
 │   │   └── tool-checker.ts    # Command executable checks
 │   ├── core/
-│   │   ├── harness-schema.ts   # harness.yaml Zod schema
-│   │   ├── harness-converter.ts # enforcement→hooks + MergedConfig
-│   │   ├── generator.ts        # Orchestrates all generators
-│   │   └── config-merger.ts    # Multi-preset merge
+│   │   ├── harness-schema.ts      # harness.yaml Zod schema
+│   │   ├── merged-config.ts       # MergedConfig + HooksConfig interfaces
+│   │   ├── harness-converter-v2.ts # harness.yaml → MergedConfig (catalog pipeline)
+│   │   └── generator.ts           # Orchestrates all generators
 │   ├── generators/
 │   │   ├── claude-md.ts    # CLAUDE.md with idempotent markers
 │   │   ├── hooks.ts        # Hook scripts + event logger injection
@@ -376,8 +388,7 @@ oh-my-harness/
 │       │   └── gemini-api.ts
 │       ├── parse-intent.ts      # LLM prompt integration
 │       └── prompt-templates.ts  # NL prompt construction
-├── presets/                # Built-in preset definitions
-└── tests/                  # 873+ tests (unit + integration)
+└── tests/                  # 900+ tests (unit + integration)
 ```
 
 ---
@@ -406,8 +417,9 @@ oh-my-harness/
 - [x] Codex emitter — `AGENTS.md` + `.codex/hooks.json` + `.codex/config.toml`
 - [x] Unified `.omh/` layout — single source of truth for hooks & state across runtimes
 - [ ] Cursor (`.cursor/rules/`) emitter
-- [ ] GitHub Copilot emitter
-- [ ] Community preset registry
+- [ ] Pi ([pi.dev](https://pi.dev)) emitter — generate harness config for the Pi coding agent
+- [x] `ask` mode — request approval before executing risky tools (Claude; Codex falls back to block)
+- [ ] Community harness.yaml registry — share and reuse configs
 - [ ] `omh modify "change X"` — NL config editing
 
 ---

package/dist/catalog/blocks/lint-on-save.js

@@ -31,19 +31,40 @@ export const lintOnSave = {
     template: `#!/bin/bash
 set -euo pipefail
 INPUT=$(cat)
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
-[[ -z "$FILE_PATH" ]] && exit 0
-PATTERN='{{{filePattern}}}'
-BASENAME=$(basename "$FILE_PATH")
-if [[ "$BASENAME" == $PATTERN ]]; then
-  SCOPE='{{{scope}}}'
-  if [[ "\${SCOPE:-file}" == "module" ]]; then
-    echo "oh-my-harness: Running {{{command}}} ..." >&2
-    {{{command}}} >&2 || true
-  else
-    echo "oh-my-harness: Running {{{command}}} on $FILE_PATH..." >&2
-    {{{command}}} "$FILE_PATH" >&2 || true
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+FILE_PATHS=()
+DIRECT_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+[[ -n "$DIRECT_PATH" ]] && FILE_PATHS+=("$DIRECT_PATH")
+if [[ "$TOOL_NAME" == "apply_patch" ]]; then
+  PATCH_TEXT=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+  if [[ -n "$PATCH_TEXT" ]]; then
+    while IFS= read -r _OMH_HEADER_PATH; do
+      # CRLF patches leave a trailing \\r since sed's $ matches before \\n
+      # only; strip it so filename pattern matching isn't bypassed.
+      _OMH_HEADER_PATH="\${_OMH_HEADER_PATH%$'\\r'}"
+      [[ -n "$_OMH_HEADER_PATH" ]] && FILE_PATHS+=("$_OMH_HEADER_PATH")
+    done < <(printf '%s\\n' "$PATCH_TEXT" | sed -nE 's/^\\*\\*\\* (Add|Update) File: (.+)$/\\2/p')
   fi
 fi
+[[ \${#FILE_PATHS[@]} -eq 0 ]] && exit 0
+
+PATTERN='{{{filePattern}}}'
+SCOPE='{{{scope}}}'
+_OMH_RAN_MODULE=0
+for FILE_PATH in "\${FILE_PATHS[@]}"; do
+  BASENAME=$(basename "$FILE_PATH")
+  if [[ "$BASENAME" == $PATTERN ]]; then
+    if [[ "\${SCOPE:-file}" == "module" ]]; then
+      if [[ "$_OMH_RAN_MODULE" -eq 0 ]]; then
+        echo "oh-my-harness: Running {{{command}}} ..." >&2
+        {{{command}}} >&2 || true
+        _OMH_RAN_MODULE=1
+      fi
+    else
+      echo "oh-my-harness: Running {{{command}}} on $FILE_PATH..." >&2
+      {{{command}}} "$FILE_PATH" >&2 || true
+    fi
+  fi
+done
 exit 0`,
 };

package/dist/catalog/blocks/lockfile-guard.js

@@ -19,17 +19,34 @@ export const lockfileGuard = {
     template: `#!/bin/bash
 set -euo pipefail
 INPUT=$(cat)
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
-[[ -z "$FILE_PATH" ]] && exit 0
-BASENAME=$(basename "$FILE_PATH")
-LOCKFILES=({{#each lockfiles}}"{{{this}}}" {{/each}})
-for LOCKFILE in "\${LOCKFILES[@]}"; do
-  if [[ "$BASENAME" == "$LOCKFILE" ]]; then
-    REASON="oh-my-harness: direct edits to lockfile $BASENAME are blocked. Use the package manager instead."
-    _log_event "block" "$REASON"
-    _emit_decision "block" "$REASON"
-    exit 0
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+FILE_PATHS=()
+DIRECT_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+[[ -n "$DIRECT_PATH" ]] && FILE_PATHS+=("$DIRECT_PATH")
+if [[ "$TOOL_NAME" == "apply_patch" ]]; then
+  PATCH_TEXT=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+  if [[ -n "$PATCH_TEXT" ]]; then
+    while IFS= read -r _OMH_HEADER_PATH; do
+      # CRLF patches leave a trailing \\r since sed's $ matches before \\n
+      # only; strip it so basename/path comparisons aren't bypassed.
+      _OMH_HEADER_PATH="\${_OMH_HEADER_PATH%$'\\r'}"
+      [[ -n "$_OMH_HEADER_PATH" ]] && FILE_PATHS+=("$_OMH_HEADER_PATH")
+    done < <(printf '%s\\n' "$PATCH_TEXT" | sed -nE 's/^\\*\\*\\* (Add|Update|Delete) File: (.+)$/\\2/p')
   fi
+fi
+[[ \${#FILE_PATHS[@]} -eq 0 ]] && exit 0
+
+LOCKFILES=({{#each lockfiles}}"{{{this}}}" {{/each}})
+for FILE_PATH in "\${FILE_PATHS[@]}"; do
+  BASENAME=$(basename "$FILE_PATH")
+  for LOCKFILE in "\${LOCKFILES[@]}"; do
+    if [[ "$BASENAME" == "$LOCKFILE" ]]; then
+      REASON="oh-my-harness: direct edits to lockfile $BASENAME are blocked. Use the package manager instead."
+      _log_event "block" "$REASON"
+      _emit_decision "block" "$REASON"
+      exit 0
+    fi
+  done
 done
 exit 0`,
 };

package/dist/catalog/blocks/path-guard.js

@@ -18,52 +18,72 @@ export const pathGuard = {
     template: `#!/bin/bash
 set -euo pipefail
 INPUT=$(cat)
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
-[[ -z "$FILE_PATH" ]] && exit 0
-# Normalize path to prevent directory traversal attacks (e.g., ./foo/../dist/secret.js -> dist/secret.js)
-if command -v python3 >/dev/null 2>&1; then
-  if ! NORMALIZED=$(python3 -c "import os,sys; print(os.path.normpath(sys.argv[1]))" "$FILE_PATH" 2>/dev/null); then
-    REASON="oh-my-harness: path normalization unavailable for non-canonical path"
-    _log_event "block" "$REASON"
-    _emit_decision "block" "$REASON"
-    exit 0
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+# Collect file paths. Claude Edit/Write expose tool_input.file_path directly;
+# Codex apply_patch ships the patch text in tool_input.command and encodes
+# paths in "*** {Add|Update|Delete} File: <path>" headers.
+FILE_PATHS=()
+DIRECT_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+[[ -n "$DIRECT_PATH" ]] && FILE_PATHS+=("$DIRECT_PATH")
+if [[ "$TOOL_NAME" == "apply_patch" ]]; then
+  PATCH_TEXT=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+  if [[ -n "$PATCH_TEXT" ]]; then
+    while IFS= read -r _OMH_HEADER_PATH; do
+      # CRLF patches leave a trailing \\r since sed's $ matches before \\n
+      # only; strip it so basename/path comparisons aren't bypassed.
+      _OMH_HEADER_PATH="\${_OMH_HEADER_PATH%$'\\r'}"
+      [[ -n "$_OMH_HEADER_PATH" ]] && FILE_PATHS+=("$_OMH_HEADER_PATH")
+    done < <(printf '%s\\n' "$PATCH_TEXT" | sed -nE 's/^\\*\\*\\* (Add|Update|Delete) File: (.+)$/\\2/p')
   fi
-else
-  case "$FILE_PATH" in
-    /*|../*|*/../*|*/..|./*|*/./*|*/.)
-      REASON="oh-my-harness: path normalization unavailable for non-canonical path"
-      _log_event "block" "$REASON"
-      _emit_decision "block" "$REASON"
-      exit 0
-      ;;
-  esac
-  NORMALIZED="$FILE_PATH"
 fi
+[[ \${#FILE_PATHS[@]} -eq 0 ]] && exit 0
+
 BLOCKED_PATHS=({{#each blockedPaths}}"{{{this}}}" {{/each}})
-for BLOCKED in "\${BLOCKED_PATHS[@]}"; do
-  if [[ "$BLOCKED" == */ ]]; then
-    if [[ "$NORMALIZED" == "$BLOCKED"* || "$NORMALIZED" == *"/$BLOCKED"* ]]; then
-      REASON="oh-my-harness: file path matches blocked directory: $BLOCKED"
-      _log_event "block" "$REASON"
-      _emit_decision "block" "$REASON"
-      exit 0
-    fi
-  elif [[ "$BLOCKED" == \\** ]]; then
-    PATTERN="\${BLOCKED#\\*}"
-    if [[ "$NORMALIZED" == *"$PATTERN" ]]; then
-      REASON="oh-my-harness: file path matches blocked pattern: $BLOCKED"
+for FILE_PATH in "\${FILE_PATHS[@]}"; do
+  # Normalize each path to prevent directory traversal attacks (e.g., ./foo/../dist/secret.js -> dist/secret.js)
+  if command -v python3 >/dev/null 2>&1; then
+    if ! NORMALIZED=$(python3 -c "import os,sys; print(os.path.normpath(sys.argv[1]))" "$FILE_PATH" 2>/dev/null); then
+      REASON="oh-my-harness: path normalization unavailable for non-canonical path"
       _log_event "block" "$REASON"
       _emit_decision "block" "$REASON"
       exit 0
     fi
   else
-    if [[ "$NORMALIZED" == "$BLOCKED" || "$NORMALIZED" == *"/$BLOCKED" ]]; then
-      REASON="oh-my-harness: file path matches blocked path: $BLOCKED"
-      _log_event "block" "$REASON"
-      _emit_decision "block" "$REASON"
-      exit 0
-    fi
+    case "$FILE_PATH" in
+      /*|../*|*/../*|*/..|./*|*/./*|*/.)
+        REASON="oh-my-harness: path normalization unavailable for non-canonical path"
+        _log_event "block" "$REASON"
+        _emit_decision "block" "$REASON"
+        exit 0
+        ;;
+    esac
+    NORMALIZED="$FILE_PATH"
   fi
+  for BLOCKED in "\${BLOCKED_PATHS[@]}"; do
+    if [[ "$BLOCKED" == */ ]]; then
+      if [[ "$NORMALIZED" == "$BLOCKED"* || "$NORMALIZED" == *"/$BLOCKED"* ]]; then
+        REASON="oh-my-harness: file path matches blocked directory: $BLOCKED"
+        _log_event "block" "$REASON"
+        _emit_decision "block" "$REASON"
+        exit 0
+      fi
+    elif [[ "$BLOCKED" == \\** ]]; then
+      PATTERN="\${BLOCKED#\\*}"
+      if [[ "$NORMALIZED" == *"$PATTERN" ]]; then
+        REASON="oh-my-harness: file path matches blocked pattern: $BLOCKED"
+        _log_event "block" "$REASON"
+        _emit_decision "block" "$REASON"
+        exit 0
+      fi
+    else
+      if [[ "$NORMALIZED" == "$BLOCKED" || "$NORMALIZED" == *"/$BLOCKED" ]]; then
+        REASON="oh-my-harness: file path matches blocked path: $BLOCKED"
+        _log_event "block" "$REASON"
+        _emit_decision "block" "$REASON"
+        exit 0
+      fi
+    fi
+  done
 done
 exit 0`,
 };

package/dist/catalog/blocks/secret-file-guard.js

@@ -19,17 +19,34 @@ export const secretFileGuard = {
     template: `#!/bin/bash
 set -euo pipefail
 INPUT=$(cat)
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
-[[ -z "$FILE_PATH" ]] && exit 0
-BASENAME=$(basename "$FILE_PATH")
-PATTERNS=({{#each patterns}}"{{{this}}}" {{/each}})
-for PATTERN in "\${PATTERNS[@]}"; do
-  if [[ "$BASENAME" == $PATTERN ]]; then
-    REASON="oh-my-harness: file $BASENAME matches secret file pattern: $PATTERN"
-    _log_event "block" "$REASON"
-    _emit_decision "block" "$REASON"
-    exit 0
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+FILE_PATHS=()
+DIRECT_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+[[ -n "$DIRECT_PATH" ]] && FILE_PATHS+=("$DIRECT_PATH")
+if [[ "$TOOL_NAME" == "apply_patch" ]]; then
+  PATCH_TEXT=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+  if [[ -n "$PATCH_TEXT" ]]; then
+    while IFS= read -r _OMH_HEADER_PATH; do
+      # CRLF patches leave a trailing \\r since sed's $ matches before \\n
+      # only; strip it so basename/path comparisons aren't bypassed.
+      _OMH_HEADER_PATH="\${_OMH_HEADER_PATH%$'\\r'}"
+      [[ -n "$_OMH_HEADER_PATH" ]] && FILE_PATHS+=("$_OMH_HEADER_PATH")
+    done < <(printf '%s\\n' "$PATCH_TEXT" | sed -nE 's/^\\*\\*\\* (Add|Update|Delete) File: (.+)$/\\2/p')
   fi
+fi
+[[ \${#FILE_PATHS[@]} -eq 0 ]] && exit 0
+
+PATTERNS=({{#each patterns}}"{{{this}}}" {{/each}})
+for FILE_PATH in "\${FILE_PATHS[@]}"; do
+  BASENAME=$(basename "$FILE_PATH")
+  for PATTERN in "\${PATTERNS[@]}"; do
+    if [[ "$BASENAME" == $PATTERN ]]; then
+      REASON="oh-my-harness: file $BASENAME matches secret file pattern: $PATTERN"
+      _log_event "block" "$REASON"
+      _emit_decision "block" "$REASON"
+      exit 0
+    fi
+  done
 done
 exit 0`,
 };

package/dist/catalog/converter.d.ts

@@ -4,6 +4,7 @@ export interface HookConfigEntry {
     type: "command";
     command: string;
     matcher?: string;
+    mode?: "block" | "ask";
 }
 export interface ConvertResult {
     hooksConfig: Record<string, HookConfigEntry[]>;

package/dist/catalog/converter.js

@@ -31,9 +31,18 @@ export async function convertHookEntries(entries, registry, _projectDir) {
         const scriptName = count === 0 ? `${entry.block}.sh` : `${entry.block}-${count}.sh`;
         const scriptPath = `${OMH_HOOKS_DIR}/${scriptName}`;
         scripts.set(scriptPath, scriptContent);
+        // Resolve ask/block mode. "ask" only makes sense for blocks that can
+        // block a tool call; for non-blocking blocks it is meaningless, so warn
+        // and fall back to "block" rather than emitting a no-op ask.
+        let mode = entry.mode ?? "block";
+        if (mode === "ask" && !block.canBlock) {
+            errors.push(`Block "${entry.block}" does not support ask mode (canBlock=false); falling back to block.`);
+            mode = "block";
+        }
         const hookEntry = {
             type: "command",
             command: scriptPath,
+            mode,
         };
         if (block.matcher) {
             hookEntry.matcher = block.matcher;

package/dist/catalog/types.d.ts

@@ -23,6 +23,7 @@ export interface BuildingBlock {
 export interface HookEntry {
     block: string;
     params: Record<string, unknown>;
+    mode?: "block" | "ask";
 }
 export declare const ParamDefinitionSchema: z.ZodObject<{
     name: z.ZodString;
@@ -31,15 +32,15 @@ export declare const ParamDefinitionSchema: z.ZodObject<{
     required: z.ZodBoolean;
     default: z.ZodOptional<z.ZodUnknown>;
 }, "strip", z.ZodTypeAny, {
-    description: string;
-    type: "string" | "number" | "boolean" | "string[]";
     name: string;
+    type: "string" | "number" | "boolean" | "string[]";
+    description: string;
     required: boolean;
     default?: unknown;
 }, {
-    description: string;
-    type: "string" | "number" | "boolean" | "string[]";
     name: string;
+    type: "string" | "number" | "boolean" | "string[]";
+    description: string;
     required: boolean;
     default?: unknown;
 }>;
@@ -58,15 +59,15 @@ export declare const BuildingBlockSchema: z.ZodObject<{
         required: z.ZodBoolean;
         default: z.ZodOptional<z.ZodUnknown>;
     }, "strip", z.ZodTypeAny, {
-        description: string;
-        type: "string" | "number" | "boolean" | "string[]";
         name: string;
+        type: "string" | "number" | "boolean" | "string[]";
+        description: string;
         required: boolean;
         default?: unknown;
     }, {
-        description: string;
-        type: "string" | "number" | "boolean" | "string[]";
         name: string;
+        type: "string" | "number" | "boolean" | "string[]";
+        description: string;
         required: boolean;
         default?: unknown;
     }>, "many">;
@@ -74,46 +75,49 @@ export declare const BuildingBlockSchema: z.ZodObject<{
     tags: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
     id: string;
-    description: string;
+    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "UserPromptSubmit" | "Stop" | "PreCompact" | "PostCompact" | "SubagentStop" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
+    name: string;
     params: {
-        description: string;
-        type: "string" | "number" | "boolean" | "string[]";
         name: string;
+        type: "string" | "number" | "boolean" | "string[]";
+        description: string;
         required: boolean;
         default?: unknown;
     }[];
+    description: string;
+    category: "notification" | "git" | "quality" | "security" | "formatting" | "custom" | "auto-fix" | "automation" | "file-protection" | "audit";
+    canBlock: boolean;
     template: string;
-    name: string;
     tags: string[];
-    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "UserPromptSubmit" | "Stop" | "PreCompact" | "PostCompact" | "SubagentStop" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
-    category: "notification" | "custom" | "git" | "quality" | "security" | "formatting" | "auto-fix" | "automation" | "file-protection" | "audit";
-    canBlock: boolean;
     matcher?: string | undefined;
 }, {
     id: string;
-    description: string;
+    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "UserPromptSubmit" | "Stop" | "PreCompact" | "PostCompact" | "SubagentStop" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
+    name: string;
     params: {
-        description: string;
-        type: "string" | "number" | "boolean" | "string[]";
         name: string;
+        type: "string" | "number" | "boolean" | "string[]";
+        description: string;
         required: boolean;
         default?: unknown;
     }[];
+    description: string;
+    category: "notification" | "git" | "quality" | "security" | "formatting" | "custom" | "auto-fix" | "automation" | "file-protection" | "audit";
+    canBlock: boolean;
     template: string;
-    name: string;
     tags: string[];
-    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "UserPromptSubmit" | "Stop" | "PreCompact" | "PostCompact" | "SubagentStop" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
-    category: "notification" | "custom" | "git" | "quality" | "security" | "formatting" | "auto-fix" | "automation" | "file-protection" | "audit";
-    canBlock: boolean;
     matcher?: string | undefined;
 }>;
 export declare const HookEntrySchema: z.ZodObject<{
     block: z.ZodString;
     params: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    mode: z.ZodDefault<z.ZodEnum<["block", "ask"]>>;
 }, "strip", z.ZodTypeAny, {
-    params: Record<string, unknown>;
     block: string;
+    params: Record<string, unknown>;
+    mode: "block" | "ask";
 }, {
     block: string;
     params?: Record<string, unknown> | undefined;
+    mode?: "block" | "ask" | undefined;
 }>;

package/dist/catalog/types.js

@@ -21,4 +21,5 @@ export const BuildingBlockSchema = z.object({
 export const HookEntrySchema = z.object({
     block: z.string(),
     params: z.record(z.unknown()).default({}),
+    mode: z.enum(["block", "ask"]).default("block"),
 });

package/dist/cli/commands/doctor.js

@@ -68,8 +68,13 @@ export async function doctorCommand(options = {}) {
         JSON.parse(await fs.readFile(codexHooksPath, "utf-8"));
         const tomlRaw = await fs.readFile(codexTomlPath, "utf-8");
         const parsed = parse(tomlRaw);
-        if (parsed.features?.codex_hooks !== true) {
-            messages.push("FAIL: .codex/config.toml missing [features] codex_hooks = true.");
+        if (parsed.features?.hooks !== true) {
+            messages.push(parsed.features?.codex_hooks === true
+                ? "FAIL: .codex/config.toml uses deprecated [features] codex_hooks; run `omh sync` to migrate to hooks = true."
+                : "FAIL: .codex/config.toml missing [features] hooks = true.");
+        }
+        else if (parsed.features?.goals !== true) {
+            messages.push("FAIL: .codex/config.toml missing [features] goals = true.");
         }
         else {
             checks.codexConfig = true;

package/dist/cli/commands/hook.js

@@ -5,6 +5,7 @@ import chalk from "chalk";
 import * as clack from "@clack/prompts";
 import { createDefaultRegistry } from "../../catalog/registry.js";
 import { syncCommand } from "./sync.js";
+import { buildMinimalHarnessConfig } from "../../core/harness-defaults.js";
 async function readHarnessYaml(projectDir) {
     const harnessYamlPath = path.join(projectDir, "harness.yaml");
     try {
@@ -14,7 +15,12 @@ async function readHarnessYaml(projectDir) {
     catch (err) {
         const error = err;
         if (error.code === "ENOENT") {
-            return {};
+            // Bootstrap a schema-conformant skeleton on first use so that
+            // `omh hook add` works before the user has run `omh init`.
+            // stacks are populated from the deterministic project detector so the
+            // generated yaml is informative rather than empty.
+            const minimal = await buildMinimalHarnessConfig(projectDir);
+            return minimal;
         }
         throw error;
     }

package/dist/cli/commands/init.d.ts

@@ -1,13 +1,9 @@
-import { PresetRegistry } from "../../core/preset-registry.js";
-import type { PresetConfig } from "../../core/preset-types.js";
 import type { ClaudeRunner } from "../../nl/parse-intent.js";
 export interface InitOptions {
     yes?: boolean;
     projectDir?: string;
-    presetsDir?: string;
-    preset?: string[];
     nlRunner?: ClaudeRunner;
-    _nlDescription?: string;
+    description?: string;
 }
 export interface HarnessState {
     presets: string[];
@@ -15,7 +11,6 @@ export interface HarnessState {
 }
 export declare function readHarnessState(projectDir: string): Promise<HarnessState>;
 export declare function writeHarnessState(projectDir: string, state: HarnessState): Promise<void>;
-export declare function loadAndMergePresets(presetNames: string[], registry: PresetRegistry): Promise<PresetConfig[]>;
-export declare function initCommand(presetNames: string[], options?: InitOptions): Promise<void>;
-/** Headless init for CI/automation — bypasses TUI */
+export declare function initCommand(descriptionParts: string[], options?: InitOptions): Promise<void>;
 export declare const initCommandHeadless: typeof initCommand;
+export declare function initWithNL(projectDir: string, options: InitOptions): Promise<void>;