phaedo-mcp 0.3.7 → 0.3.14

package/hooks/agent-hook.mjs

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Phaedo — the merge check for agents other than Claude Code.
+//
+//   node hooks/agent-hook.mjs <cursor|copilot|codex|gemini>
+//
+// Each agent's pre-action hook sends its own JSON on stdin. This turns it into the shape the
+// Claude Code ship hook (pre-ship.mjs) already handles, runs the SAME classification, consult
+// and receipt path, and answers in the agent's own format. Same rule as pre-ship: it only ever
+// adds friction — it never returns "allow" — and it stays silent for anything that isn't a
+// merge, deploy, publish, message, payment, delete or the like.
+//
+//   agent     hook                                         can it show a prompt?
+//   Cursor    ~/.cursor/hooks.json beforeShellExecution,   yes — permission "ask"
+//             beforeMCPExecution
+//   Copilot   ~/.copilot/hooks/phaedo.json preToolUse      yes — permissionDecision "ask"
+//   Codex     ~/.codex/hooks.json PreToolUse               no  — "ask" is unsupported
+//   Gemini    ~/.gemini/settings.json BeforeTool           no  — allow / deny only
+//
+// Where the agent can't prompt, Phaedo pauses the action once with the reason, so the agent
+// stops and asks in the chat; the same call again within RETRY_WINDOW_MS goes through (the
+// subject has answered) and is not consulted twice. A pause, never a wall — and never a loop.
+//
+// FAIL-SAFE: any error, and anything past BUDGET_MS, exits 0 with no output. That matters most
+// for Copilot, where a hook that crashes DENIES the tool call.
+
+import { join } from 'path';
+import { classifyToolCall } from '../ship-actions.js';
+import { runShipHook, callHash, readState, writeState, BUDGET_MS } from './pre-ship.mjs';
+import { isMainModule } from '../lib/is-main.js';
+
+export const AGENTS = Object.freeze({
+  cursor:  { id: 'cursor/ship-hook', canAsk: true },
+  copilot: { id: 'copilot-cli/ship-hook', canAsk: true },
+  codex:   { id: 'codex/ship-hook', canAsk: false },
+  gemini:  { id: 'gemini-cli/ship-hook', canAsk: false },
+});
+export const RETRY_WINDOW_MS = 15 * 60 * 1000;
+
+const parseMaybe = (v) => {
+  if (typeof v !== 'string') return v && typeof v === 'object' ? v : {};
+  try { const o = JSON.parse(v); return o && typeof o === 'object' ? o : {}; } catch { return {}; }
+};
+const shell = (command, cwd) => (typeof command === 'string' && command.trim()
+  ? { tool_name: 'Bash', tool_input: { command }, cwd, hook_event_name: 'PreToolUse' } : null);
+const mcp = (server, tool, args, cwd) => (server && tool
+  ? { tool_name: `mcp__${server}__${tool}`, tool_input: parseMaybe(args), cwd, hook_event_name: 'PreToolUse' } : null);
+
+/** The agent's hook input as the Claude Code PreToolUse shape, or null when it isn't a tool call. PURE. */
+export function normalize(agent, raw) {
+  const r = raw && typeof raw === 'object' ? raw : {};
+  const cwd = r.cwd || (Array.isArray(r.workspace_roots) ? r.workspace_roots[0] : undefined);
+  switch (agent) {
+    case 'cursor':
+      if (typeof r.mcp_server_name === 'string') return mcp(r.mcp_server_name, r.tool_name, r.tool_input, cwd);
+      return shell(r.command, cwd);
+    case 'copilot': {
+      // camelCase `preToolUse` (toolName/toolArgs), or the PascalCase variant (tool_name/tool_input).
+      const name = String(r.toolName ?? r.tool_name ?? '');
+      const args = parseMaybe(r.toolArgs ?? r.tool_input);
+      if (/^(bash|shell|powershell)$/i.test(name)) return shell(args.command, cwd);
+      if (name.startsWith('mcp__')) return { tool_name: name, tool_input: args, cwd, hook_event_name: 'PreToolUse' };
+      return null;
+    }
+    case 'codex':
+      // Codex's PreToolUse is already Claude-shaped: Bash + tool_input.command, mcp__server__tool.
+      if (r.tool_name === 'Bash') return shell(r.tool_input?.command, cwd);
+      if (typeof r.tool_name === 'string' && r.tool_name.startsWith('mcp__')) return { tool_name: r.tool_name, tool_input: parseMaybe(r.tool_input), cwd, hook_event_name: 'PreToolUse' };
+      return null;
+    case 'gemini': {
+      const name = String(r.tool_name || '');
+      if (name === 'run_shell_command') return shell(r.tool_input?.command, cwd);
+      const ctx = r.mcp_context && typeof r.mcp_context === 'object' ? r.mcp_context : {};
+      const server = ctx.server_name;
+      if (server && name.startsWith(`mcp_${server}_`)) return mcp(server, name.slice(`mcp_${server}_`.length), r.tool_input, cwd);
+      const m = /^mcp_([^_]+)_(.+)$/.exec(name);
+      return m ? mcp(m[1], m[2], r.tool_input, cwd) : null;
+    }
+    default: return null;
+  }
+}
+
+const PAUSE = " This agent can't show a confirmation prompt, so Phaedo paused it: ask the user, and run the same command again only if they say yes.";
+
+/**
+ * The ship hook's answer in the agent's own format, or null for no output. PURE.
+ * Never "allow": a quiet answer is no output, so the agent's own permission flow applies.
+ */
+export function render(agent, out) {
+  const h = out?.hookSpecificOutput || {};
+  const asked = h.permissionDecision === 'ask';
+  const reason = h.permissionDecisionReason || '';
+  const context = h.additionalContext || '';
+  switch (agent) {
+    case 'cursor':
+      return asked ? { permission: 'ask', user_message: reason, agent_message: context } : null;
+    case 'copilot':
+      return asked ? { permissionDecision: 'ask', permissionDecisionReason: reason } : null;
+    case 'codex':
+      if (asked) return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason + PAUSE } };
+      return context ? { hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: context } } : null;
+    case 'gemini':
+      return asked ? { decision: 'deny', reason: reason + PAUSE, systemMessage: reason } : null;
+    default: return null;
+  }
+}
+
+/**
+ * One invocation. deps: the pre-ship deps (consult, writeReceipt, statePath, now…) plus
+ * `pausePath` for the agents that can't prompt. Returns what to print, or null.
+ */
+export async function runAgentHook(agent, raw, deps) {
+  const spec = AGENTS[agent];
+  if (!spec) return null;
+  const input = normalize(agent, raw);
+  if (!input || !classifyToolCall(input.tool_name, input.tool_input)) return null;
+  const now = deps.now ?? Date.now();
+  const hash = callHash(input);
+
+  if (!spec.canAsk) {
+    const paused = readState(deps.pausePath);
+    paused.pending ||= {};
+    for (const [k, v] of Object.entries(paused.pending)) if (!(now - Date.parse(v?.at) < RETRY_WINDOW_MS)) delete paused.pending[k];
+    const key = `${agent}:${hash}`;
+    if (paused.pending[key]) {
+      // The retry after a pause: the subject answered in the chat. Let it through, once.
+      delete paused.pending[key];
+      writeState(deps.pausePath, paused, now);
+      return null;
+    }
+    const out = await runShipHook(input, { ...deps, agentId: spec.id });
+    if (out?.hookSpecificOutput?.permissionDecision === 'ask') {
+      paused.pending[key] = { at: new Date(now).toISOString() };
+      writeState(deps.pausePath, paused, now);
+    }
+    return render(agent, out);
+  }
+  return render(agent, await runShipHook(input, { ...deps, agentId: spec.id }));
+}
+
+async function main(agent) {
+  let raw = '';
+  for await (const chunk of process.stdin) raw += chunk;
+  let parsed;
+  try { parsed = JSON.parse(raw); } catch { return; }
+  // Cheap exit before importing the vault stack: most tool calls are not ship actions.
+  const input = normalize(agent, parsed);
+  if (!input || !classifyToolCall(input.tool_name, input.tool_input)) return;
+  const { realDeps } = await import('./pre-ship.mjs');
+  const { defaultStateDir } = await import('../cache.js');
+  const deps = await realDeps({ agentId: AGENTS[agent]?.id });
+  const out = await runAgentHook(agent, parsed, { ...deps, pausePath: join(defaultStateDir(), 'agent-hook-paused.json') });
+  if (out) process.stdout.write(JSON.stringify(out));
+}
+
+if (isMainModule(import.meta.url)) {
+  const timeout = new Promise((res) => setTimeout(res, BUDGET_MS));
+  Promise.race([main(process.argv[2]).catch(() => {}), timeout])
+    .then(() => process.exit(0))
+    .catch(() => process.exit(0)); // never break, and never deny by crashing (Copilot fails closed)
+}

package/hooks/pre-ship.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // Phaedo — Claude Code ship hook (PreToolUse, PermissionRequest, PostToolUse,
-// PostToolUseFailure on Bash).
+// PostToolUseFailure on Bash; UserPromptSubmit and Stop to catch a "no").
 //
 // WHY THIS EXISTS. The precedent track is starved: no consultation has been written since
 // 2026-07-28, so agreement, calibration and override learning have nothing to read. The
@@ -25,7 +25,13 @@
 //     consult answered, and in any permission mode — a yes on a `proceed` is the scoreable
 //     case agreement needs.
 //   - prompt shown, then declined → Claude Code fires NO hook for a manual denial
-//     (documented), so the agent is told the receipt id up front and records `rejected`.
+//     (documented). It does write the denial into the session transcript, marked
+//     `toolDenialKind: "user-rejected"` on the call's tool_result. So at the subject's next
+//     prompt (UserPromptSubmit), or when the turn ends (Stop — a "no, do this instead"
+//     continues the turn), the hook reads the transcript's tail for its own open calls and
+//     records `rejected`, or `modified` when the subject said what to do instead. A denial by
+//     auto mode's classifier or a permission rule carries a different kind and records
+//     nothing: only a person's no counts. An outcome the agent already recorded is kept.
 //   - no prompt (bypass mode, an allow rule) → nothing recorded. After the run the agent is
 //     told so, and records the subject's reaction only if they give one. Silence is never
 //     approval.
@@ -41,8 +47,9 @@ import { dirname, resolve, join } from 'path';
 import { readFileSync, writeFileSync, renameSync, mkdirSync } from 'fs';
 import { createHash } from 'crypto';
 import { execFile } from 'child_process';
-import { classifyShipCommand } from '../ship-actions.js';
+import { classifyShipCommand, classifyToolCall } from '../ship-actions.js';
 import { isMainModule } from '../lib/is-main.js';
+import { isDirectoryEdition } from '../lib/config-dir.js';
 
 const MCP_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -55,9 +62,20 @@ export const BUDGET_MS = 12000;
 export const ASKING_SIGNALS = new Set(['escalate', 'clarify', 'decline']);
 
 // Permission modes in which a PermissionRequest is not evidence that a PERSON answered:
-// auto mode's classifier and dontAsk decide without one.
+// auto mode's classifier and dontAsk decide without one. With ONE exception, in auto mode: when
+// this hook itself returned `ask`, Claude Code shows the subject a real prompt ("a hook's `ask`
+// also forces a permission prompt in auto mode: the classifier can still deny the tool call,
+// but it can't approve the call silently" — hooks reference). That prompt is the personal
+// reviewer's whole point, so a yes on it is the subject's and is recorded.
 const NO_HUMAN_MODES = new Set(['auto', 'dontAsk']);
 
+// The turn events that look for a "no". Every prompt fires one, so they stay cheap: a small
+// state read, and the transcript only when this session has a consult still open.
+export const TURN_EVENTS = new Set(['UserPromptSubmit', 'Stop']);
+// How a person's denial is marked in the transcript (Claude Code), and how far back to read.
+export const USER_DENIAL = 'user-rejected';
+export const TRANSCRIPT_TAIL_BYTES = 4 * 1024 * 1024;
+
 // The profile is read from the at-rest cache, which only a live read refreshes. Past this
 // age the agent is told once a day, so the subject hears about it in plain words.
 export const STALE_PROFILE_DAYS = 14;
@@ -70,6 +88,10 @@ const PENDING_TTL_MS = DAY_MS;
 export const AGENT_ID = 'claude-code/ship-hook';
 
 export const commandHash = (cmd) => createHash('sha256').update(String(cmd ?? '')).digest('hex');
+// The call's identity across its hook events: the command for Bash, the input for a tool.
+export const callHash = (input) => commandHash(input?.tool_name === 'Bash' ? input?.tool_input?.command : `${input?.tool_name}:${JSON.stringify(input?.tool_input ?? null)}`);
+// The calls this hook reviews: shell commands, and connected tools (MCP).
+const reviewable = (input) => input?.tool_name === 'Bash' || String(input?.tool_name || '').startsWith('mcp__');
 
 // ── CI state for a merge (precedent track Phase 1b, B6) ───────────────────────────────
 // Merging a PR whose checks are failing, or have not finished, is a bigger act than merging a
@@ -217,9 +239,22 @@ export function writeState(path, state, now) {
   renameSync(tmp, path);
 }
 
+// THE PERSONAL PART OF THE PROMPT. Auto mode's reviewer judges an action by its type; this says
+// why THIS person would want to see it — their own rule when one decided it, else what is at
+// stake. Built only from the agent's descriptor and the consult answer (never vault content).
+export function personalWhy(descriptor = {}, response = {}) {
+  const rule = /^Per your standing rule: (.+?)\.?$/.exec(String(response?.rationale_hint || '').trim());
+  if (rule) return `your rule: ${rule[1]}`;
+  const w = [];
+  if (descriptor.reversible === false) w.push("it can't be undone");
+  if (typeof descriptor.amount === 'number' && descriptor.amount > 0) w.push(`it spends $${descriptor.amount.toLocaleString('en-US', { maximumFractionDigits: 2 })}`);
+  return w.join(' and ');
+}
+
 // What the subject reads on the prompt. Plain words, no numbers, no protocol terms.
-export function promptReason(signal, summary, why) {
-  const what = why ? `${summary} — ${why}` : summary;
+export function promptReason(signal, summary, why, personal = '') {
+  const reasons = [why, personal].filter(Boolean).join('; ');
+  const what = reasons ? `${summary} — ${reasons}` : summary;
   if (signal === 'decline') return `Phaedo thinks you'd say no to this one: ${what}. Go ahead anyway?`;
   if (signal === 'clarify') return `Phaedo isn't sure how you'd want this handled: ${what}. Go ahead?`;
   return `Phaedo thinks you'd want to OK this yourself: ${what}.`;
@@ -227,9 +262,14 @@ export function promptReason(signal, summary, why) {
 
 // What the agent reads before the command. It carries the receipt id — the one handle
 // that attributes an outcome to THIS decision rather than whatever receipt is newest.
-export function preContext({ summary, signal, receiptId, asked, hint }) {
-  const head = `Phaedo was consulted before this command (${summary}) and answered "${signal}"` +
+export function preContext({ summary, signal, receiptId, asked, hint, recordsNo = false }) {
+  const head = `Phaedo was consulted before this action (${summary}) and answered "${signal}"` +
     (hint ? ` — ${hint}` : '') + `. receipt_id: ${receiptId}.`;
+  if (asked && recordsNo) {
+    return `${head} Phaedo flagged it for the user, so they may be asked to confirm. A yes or a no on ` +
+      `the prompt is recorded automatically. If they later say they wanted it done differently, call ` +
+      `phaedo_record_outcome with this receipt_id and "modified".`;
+  }
   if (asked) {
     return `${head} Phaedo flagged it for the user, so they may be asked to confirm. If they decline, ` +
       `call phaedo_record_outcome with this receipt_id and "rejected" (or "modified" if they want it ` +
@@ -243,7 +283,7 @@ export function preContext({ summary, signal, receiptId, asked, hint }) {
 
 // After the command, when Phaedo had flagged it and no prompt was shown.
 export function unpromptedContext(receiptId) {
-  return `No confirmation prompt was shown for this command (receipt_id: ${receiptId}), though Phaedo ` +
+  return `No confirmation prompt was shown for this action (receipt_id: ${receiptId}), though Phaedo ` +
     `had flagged it for the user. Tell them in one line that it ran and Phaedo had flagged it, and ` +
     `record their reaction with phaedo_record_outcome and this receipt_id if they give one. Silence ` +
     `is not approval.`;
@@ -255,21 +295,67 @@ export function staleContext(days, mcpDir) {
     `\`cd ${mcpDir} && npm run pull\` and approving on their phone.`;
 }
 
+/**
+ * What the transcript says became of each call in `ids`: Map id → { denied }, where `denied` is
+ * `rejected` or `modified` for a person's no (modified when they said what to do instead), and
+ * null for any other result (it ran, failed, or something other than a person refused it).
+ * A call with no result yet is absent. Reads only the tool_result entries. PURE.
+ */
+export function callResults(jsonl, ids) {
+  const want = new Set(ids);
+  const out = new Map();
+  if (!want.size) return out;
+  const words = (c) => (typeof c === 'string' ? c : Array.isArray(c) ? c.map((p) => (typeof p?.text === 'string' ? p.text : '')).join('\n') : '');
+  for (const line of String(jsonl || '').split('\n')) {
+    if (!line.includes('tool_use_id')) continue;
+    let j;
+    try { j = JSON.parse(line); } catch { continue; }
+    for (const c of Array.isArray(j?.message?.content) ? j.message.content : []) {
+      if (c?.type !== 'tool_result' || !want.has(c.tool_use_id)) continue;
+      // Quitting the app mid-prompt is marked as a denial too; it is not a decision.
+      const byPerson = j.toolDenialKind === USER_DENIAL && !j.interruptedByShutdown;
+      out.set(c.tool_use_id, { denied: byPerson ? (/the user said:/i.test(words(c.content)) ? 'modified' : 'rejected') : null });
+    }
+  }
+  return out;
+}
+
 /**
  * One hook invocation. Pure apart from injected deps, so the whole flow is testable
  * without a vault, a receipt store or Claude Code.
  *
  * deps: { consult(req) → { response, drivers, source? }, writeReceipt({request,response,drivers}) → id,
- *         markOutcome(id, action), statePath, now, mcpDir? }
+ *         markOutcome(id, action, { keepExisting }?), statePath, now, mcpDir?,
+ *         readTranscript(path)? — present only where a transcript records denials (Claude Code) }
  * Returns the JSON object to print, or null for no output.
  */
 export async function runShipHook(input, deps) {
-  if (!input || input.tool_name !== 'Bash') return null;
   const now = deps.now ?? Date.now();
-  const ev = input.hook_event_name;
+  const ev = input?.hook_event_name;
+
+  if (TURN_EVENTS.has(ev)) {
+    // A denied prompt leaves its call open: no PostToolUse ever comes. Close this session's.
+    const state = readState(deps.statePath);
+    const open = Object.entries(state.pending).filter(([, e]) => e?.session_id && e.session_id === input.session_id);
+    if (!open.length || !input.transcript_path || !deps.readTranscript) return null;
+    let text = '';
+    try { text = await deps.readTranscript(input.transcript_path); } catch { return null; }
+    const results = callResults(text, open.map(([id]) => id));
+    let closed = false;
+    for (const [id, entry] of open) {
+      const r = results.get(id);
+      if (!r) continue;              // still running, or not written yet — the next event looks again
+      delete state.pending[id]; closed = true;
+      if (r.denied) await deps.markOutcome(entry.receipt_id, r.denied, { keepExisting: true });
+    }
+    if (closed) writeState(deps.statePath, state, now);
+    return null;
+  }
+
+  if (!reviewable(input)) return null;
 
   if (ev === 'PreToolUse') {
-    const ship = classifyShipCommand(input.tool_input?.command);
+    const ship = classifyToolCall(input.tool_name, input.tool_input);
     if (!ship) return null;
     // B6 + B3: one GitHub lookup per merge — check state, size, paths. Each can only raise.
     let ci = null, stakes = null;
@@ -281,7 +367,7 @@ export async function runShipHook(input, deps) {
     const raised = why !== '';
     const request = {
       consultation_type: 'action_approval',
-      agent_id: AGENT_ID,
+      agent_id: deps.agentId || AGENT_ID,
       action_descriptor: raised ? { ...ship.action_descriptor, magnitude: 'high' } : ship.action_descriptor,
       action_binding: ship.action_binding,
     };
@@ -299,12 +385,12 @@ export async function runShipHook(input, deps) {
     const state = readState(deps.statePath);
     if (input.tool_use_id) {
       state.pending[input.tool_use_id] = {
-        receipt_id: receiptId, cmd_hash: commandHash(input.tool_input?.command),
+        receipt_id: receiptId, cmd_hash: callHash(input), session_id: input.session_id || null,
         asked, prompt_shown: false, at: new Date(now).toISOString(),
       };
     }
     let context = preContext({
-      summary: ship.summary, signal, receiptId, asked,
+      summary: ship.summary, signal, receiptId, asked, recordsNo: Boolean(deps.readTranscript),
       hint: typeof response?.rationale_hint === 'string' ? response.rationale_hint : '',
     });
     if (raised) context += ` GitHub shows ${why}, so Phaedo treated this merge as high-stakes.`;
@@ -317,7 +403,7 @@ export async function runShipHook(input, deps) {
     return {
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
-        ...(asked ? { permissionDecision: 'ask', permissionDecisionReason: promptReason(signal, ship.summary, why) } : {}),
+        ...(asked ? { permissionDecision: 'ask', permissionDecisionReason: promptReason(signal, ship.summary, why, personalWhy(request.action_descriptor, response)) } : {}),
         additionalContext: context,
       },
     };
@@ -326,13 +412,15 @@ export async function runShipHook(input, deps) {
   if (ev === 'PermissionRequest') {
     // Evidence that a prompt is about to be shown for this command. PermissionRequest has
     // no tool_use_id (documented), so match the newest pending consult on the same command.
-    if (NO_HUMAN_MODES.has(input.permission_mode)) return null;
-    const h = commandHash(input.tool_input?.command);
+    if (input.permission_mode === 'dontAsk') return null;
+    const h = callHash(input);
     const state = readState(deps.statePath);
     const hit = Object.values(state.pending)
       .filter((e) => e.cmd_hash === h && !e.prompt_shown)
       .sort((a, b) => Date.parse(b.at) - Date.parse(a.at))[0];
     if (!hit) return null;
+    // Auto mode: only the prompt Phaedo forced is a person's; anything else is the classifier.
+    if (NO_HUMAN_MODES.has(input.permission_mode) && !hit.asked) return null;
     hit.prompt_shown = true;
     writeState(deps.statePath, state, now);
     return null;                     // never decide here — the subject answers the prompt
@@ -361,17 +449,19 @@ export async function runShipHook(input, deps) {
 }
 
 // ── Real deps: the same consult path as the MCP server (consult-runtime.js). ──────────
-async function realDeps() {
+// `agentId` names the agent on the receipt; other agents' hooks (agent-hook.mjs) pass their own.
+export async function realDeps({ agentId = AGENT_ID, statePath } = {}) {
   const { loadConsultVd, buildConsultOpts } = await import('../consult-runtime.js');
   const { resolveConsultation, consultDrivers, withRevision } = await import('../consult.js');
-  const { buildReceipt, appendReceipt, receiptsCapFromEnv, markOutcome } = await import('../receipts.js');
+  const { buildReceipt, appendReceipt, receiptsCapFromEnv } = await import('../receipts.js');
   const { sourceOf } = await import('../fingerprint-source.js');
   const { defaultStateDir } = await import('../cache.js');
   const stateDir = defaultStateDir();
   const quiet = () => {};
   const opts = buildConsultOpts(MCP_DIR, process.env, { warn: quiet });
   return {
-    statePath: join(stateDir, 'ship-hook.json'),
+    statePath: statePath || join(stateDir, 'ship-hook.json'),
+    agentId,
     mcpDir: MCP_DIR,
     prFacts: (ship, cwd) => lookupPrFacts(ship, cwd),
     async consult(request) {
@@ -382,11 +472,46 @@ async function realDeps() {
       return { response, drivers, source: sourceOf(vd) };
     },
     async writeReceipt({ request, response, drivers }) {
-      const r = buildReceipt({ via: 'phaedo_consult', agentId: AGENT_ID, clientId: opts.clientId, request, response, drivers });
+      const r = buildReceipt({ via: 'phaedo_consult', agentId, clientId: opts.clientId, request, response, drivers });
       await appendReceipt(stateDir, r, { cap: receiptsCapFromEnv(process.env) });
       return r.receipt_id;
     },
-    async markOutcome(id, action) { await markOutcome(stateDir, id, action); },
+    async markOutcome(id, action, opts) { await markOutcomeKeeping(stateDir, id, action, opts); },
+    // Only Claude Code's transcript marks a person's denial; other agents' hooks have none. The
+    // directory edition never reads chat history, so it does not wire the turn events either.
+    ...(agentId === AGENT_ID && !isDirectoryEdition(MCP_DIR) ? { readTranscript: readTail } : {}),
+  };
+}
+
+// The hook's own outcomes never overwrite one already recorded (the agent's, or a yes).
+async function markOutcomeKeeping(stateDir, id, action, { keepExisting = false } = {}) {
+  const { readReceipts, markOutcome } = await import('../receipts.js');
+  if (keepExisting && (await readReceipts(stateDir)).some((r) => r.receipt_id === id && r.user_action)) return;
+  await markOutcome(stateDir, id, action);
+}
+
+// The last few MB of the transcript — a denial is near the end; the first, cut line is dropped.
+async function readTail(path, max = TRANSCRIPT_TAIL_BYTES) {
+  const { openSync, fstatSync, readSync, closeSync } = await import('fs');
+  const fd = openSync(path, 'r');
+  try {
+    const size = fstatSync(fd).size;
+    const len = Math.min(size, max);
+    const buf = Buffer.alloc(len);
+    readSync(fd, buf, 0, len, size - len);
+    const text = buf.toString('utf8');
+    return len < size ? text.slice(text.indexOf('\n') + 1) : text;
+  } finally { closeSync(fd); }
+}
+
+// The turn events' deps: no consult and no vault — only the state, the transcript, the receipts.
+export async function turnDeps({ statePath } = {}) {
+  const { defaultStateDir } = await import('../cache.js');
+  const stateDir = defaultStateDir();
+  return {
+    statePath: statePath || join(stateDir, 'ship-hook.json'),
+    readTranscript: readTail,
+    async markOutcome(id, action, opts) { await markOutcomeKeeping(stateDir, id, action, opts); },
   };
 }
 
@@ -394,9 +519,13 @@ async function main() {
   let raw = '';
   for await (const chunk of process.stdin) raw += chunk;
   const input = JSON.parse(raw);
+  if (TURN_EVENTS.has(input.hook_event_name)) {
+    await runShipHook(input, await turnDeps());
+    return;                          // never says anything on a prompt or a stop
+  }
   // Cheap exit before importing the vault stack: most Bash calls are not ship actions.
-  if (input?.tool_name !== 'Bash') return;
-  if (input.hook_event_name === 'PreToolUse' && !classifyShipCommand(input.tool_input?.command)) return;
+  if (!reviewable(input)) return;
+  if (input.hook_event_name === 'PreToolUse' && !classifyToolCall(input.tool_name, input.tool_input)) return;
   const out = await runShipHook(input, await realDeps());
   if (out) process.stdout.write(JSON.stringify(out));
 }

package/hooks/session-start.mjs

@@ -16,12 +16,15 @@
 //
 // FAIL-SAFE: any error (no pairing, phone unreachable + no cache, render failure)
 // exits 0 with NO output, so a missing fingerprint never blocks or slows your
-// session beyond a short timeout. It never writes anything.
+// session beyond a short timeout. The one thing it writes: other agents' instruction files
+// that already carry Phaedo's block (rules-files.js) get the same profile, refreshed — never
+// a file the subject didn't opt in with `npm run rules`.
 
 import { fileURLToPath } from 'url';
 import { dirname, resolve } from 'path';
 import { loadFingerprintPreferCache } from '../fingerprint-source.js';
 import { buildInjectionResponse } from '../projection.js';
+import { refreshExisting } from '../rules-files.js';
 
 // hooks/ lives one level under mcp/ — the sources resolve against mcp/.
 const MCP_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -46,7 +49,10 @@ async function run() {
   // Same pattern that #76 applied to escalation (cache-preferred fingerprint read).
   const vd = await loadFingerprintPreferCache(MCP_DIR);
   const response = buildInjectionResponse(vd, { requested_layers: ['all'], mode: 'standard' });
-  if (response && response.projection) emitContext(response.projection);
+  if (response && response.projection) {
+    emitContext(response.projection);
+    await refreshExisting(response.projection).catch(() => {});
+  }
 }
 
 const timeout = new Promise((res) => setTimeout(res, BUDGET_MS));

package/install.mjs

@@ -27,6 +27,9 @@ import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
 import { spawnSync } from 'child_process';
+import { MCP_HOOK_MATCHER } from './ship-actions.js';
+import { targets as rulesTargets, removeFromFile } from './rules-files.js';
+import { applyAgentHooks } from './agent-hooks.js';
 
 const BASE_DIR = dirname(fileURLToPath(import.meta.url));
 const SERVER_PATH = join(BASE_DIR, 'server.js');
@@ -46,7 +49,13 @@ const SHIP_HOOK_MARKER = 'hooks/pre-ship.mjs';           // identifies our ship-
 // it ran or failed (to record that person's yes). Its own budget is 12s; the timeout is
 // the backstop.
 export const SHIP_HOOK_EVENTS = ['PreToolUse', 'PermissionRequest', 'PostToolUse', 'PostToolUseFailure'];
-const SHIP_HOOK_ENTRY = { matcher: 'Bash', timeout: 15 };
+// The same hook on the turn events, to record a "no" from the transcript (full install only:
+// the directory edition does not read chat history). No matcher — these events have no tool.
+export const SHIP_TURN_EVENTS = ['UserPromptSubmit', 'Stop'];
+// Shell commands, plus connected-tool calls whose name says they send, pay, delete or merge
+// (ship-actions.js MCP_HOOK_MATCHER) — the personal reviewer covers both.
+export const SHIP_HOOK_MATCHER = `Bash|${MCP_HOOK_MATCHER}`;
+const SHIP_HOOK_ENTRY = { matcher: SHIP_HOOK_MATCHER, timeout: 15 };
 
 // ── Client registry ──────────────────────────────────────────────────────────
 // Every supported client stores MCP servers as a top-level `mcpServers` object,
@@ -239,7 +248,7 @@ export function applyCodeHook({ action, dryRun = false, home = homedir() } = {})
     const stop = removeHookEntry(both.settings, 'Stop', STOP_CAPTURE_HOOK_MARKER);
     let s = stop.settings;
     let shipChanged = false;
-    for (const ev of SHIP_HOOK_EVENTS) {
+    for (const ev of [...SHIP_HOOK_EVENTS, ...SHIP_TURN_EVENTS]) {
       const r = removeHookEntry(s, ev, SHIP_HOOK_MARKER);
       s = r.settings; shipChanged = shipChanged || r.changed;
     }
@@ -276,6 +285,10 @@ export function applyCodeHook({ action, dryRun = false, home = homedir() } = {})
     const r = mergeHookEntry(settings, ev, hookCommand({ hookPath: SHIP_HOOK_PATH }), SHIP_HOOK_MARKER, SHIP_HOOK_ENTRY);
     settings = r.settings; shipChanged = shipChanged || r.changed;
   }
+  for (const ev of SHIP_TURN_EVENTS) {
+    const r = mergeHookEntry(settings, ev, hookCommand({ hookPath: SHIP_HOOK_PATH }), SHIP_HOOK_MARKER, { timeout: SHIP_HOOK_ENTRY.timeout });
+    settings = r.settings; shipChanged = shipChanged || r.changed;
+  }
   const changed = start.changed || captureChanged || shipChanged;
   if (!changed) return { name, status: 'unchanged', detail: `already configured${captureNote}` };
   if (!dryRun) { if (read.existed) backup(path); writeConfig(path, settings); }
@@ -412,6 +425,7 @@ function parseArgs(argv) {
     else if (a === '--dry-run') opts.dryRun = true;
     else if (a === '--only') opts.only = argv[++i];
     else if (a === '--code-hook') opts.codeHook = true;
+    else if (a === '--agent-hooks') opts.agentHooks = true;
     else if (a === '--consult-model') opts.consultModel = argv[++i];
     else if (a === '--consult-url') opts.consultUrl = argv[++i];
     else if (a === '--no-model-judge') opts.noModelJudge = true;
@@ -430,6 +444,8 @@ const HELP = `Phaedo MCP installer
   node install.mjs --pair          configure, then run the one-time pairing
   node install.mjs --code-hook     also add the Claude Code SessionStart hook
                                    (true auto-injection; ~/.claude/settings.json)
+  node install.mjs --agent-hooks   also add Phaedo's merge check to Cursor, Copilot CLI,
+                                   Codex and Gemini CLI (each one found on this computer)
   node install.mjs --capture-model <name|off>   turn the capture hook's local
                                    model detector on (e.g. llama3.1:8b) or off.
                                    Writes <state dir>/capture-model.json, which
@@ -507,6 +523,19 @@ async function main(argv) {
   if (opts.codeHook || action === 'uninstall') {
     results.push(applyCodeHook({ action, dryRun: opts.dryRun }));
   }
+  // The merge check in other agents (agent-hooks.js): opt-in on install, always cleaned up.
+  if (opts.agentHooks || action === 'uninstall') {
+    results.push(...applyAgentHooks({ action, dryRun: opts.dryRun }));
+  }
+  // Other agents' instruction files (rules-files.js): with the hook gone nothing would keep
+  // them current, so an uninstall always takes Phaedo's block back out.
+  if (action === 'uninstall') {
+    for (const t of Object.values(rulesTargets())) {
+      const r = await removeFromFile(t.file, { dryRun: opts.dryRun }).catch((e) => ({ status: 'error', error: e.message }));
+      if (r.status === 'removed') results.push({ name: t.label, status: opts.dryRun ? 'would-remove' : 'removed', detail: `took Phaedo's section out of ${t.file}` });
+      else if (r.status === 'error') results.push({ name: t.label, status: 'error', detail: `${r.error} (${t.file})` });
+    }
+  }
   // Capture-model on-switch (state-dir config file; see applyCaptureModelConfig).
   if (action === 'install' && opts.captureModel !== undefined) {
     const r = await applyCaptureModelConfig(opts.captureModel, { url: opts.captureUrl, dryRun: opts.dryRun });