plumbbob 0.9.3 → 0.10.0

package/node_modules/checkride/dist/agent-setup/cursor.js

@@ -0,0 +1,247 @@
+/**
+ * The Cursor hook writer — `.cursor/hooks.json` plus the scripts its entries
+ * invoke.
+ *
+ * Same contract as the Claude writer (`./claude.ts`): sentinel-keyed identity,
+ * in-place refresh, every unrelated key preserved, re-applying is a no-op. The
+ * schema is what differs, and it differs enough that sharing the merge would
+ * cost more than it saved:
+ *
+ * - Cursor requires a top-level `"version": 1`.
+ * - An event maps to a flat list of `{command, matcher?, timeout?}` entries —
+ *   there is no group wrapper and no `type` discriminator, so a hook is one
+ *   object where Claude Code needs two levels.
+ * - The events are lowercase and differently cut: `stop`, `afterFileEdit`
+ *   (purpose-built, no matcher) and `preToolUse` (matched against Cursor's own
+ *   tool names — `Shell`, `Read`, `Write`, `Grep`, `Delete`, `Task`, `MCP:*`).
+ * - Cursor cuts the shell out as its own pair of events, `beforeShellExecution`
+ *   and `afterShellExecution`, whose matchers run against the **command string**
+ *   rather than a tool name. Both guards take a second entry there to cover what
+ *   the file tools never see; the gate does not, since it is not per-call.
+ *
+ * A hook name therefore maps to one *or more* entries, on different events. They
+ * share a name because they are one guard — `--remove-hook protect` takes out
+ * both — and share a script, since the script branches on `hook_event_name`.
+ *
+ * The gate entry carries three fields the Claude writer has no equivalent for —
+ * `timeout`, `loop_limit` and `failClosed` — because Cursor's defaults for all
+ * three end a turn that checkride would keep blocking. See {@link hookSpecs}.
+ */
+import { CURSOR_HOOKS_FILE } from '../gate.js';
+import { GATE_TIMEOUT_SECONDS, HOOK_NAMES, writeHarnessHooks } from './harness.js';
+/**
+ * Project-shared Cursor hook config (committed), relative to the repo root.
+ * Declared in `../gate.js`, which reads it to detect a native Cursor gate, and
+ * re-exported here so this module stays the one place a caller looks for it.
+ */
+export { CURSOR_HOOKS_FILE };
+const GATE_SCRIPT_FILE = '.cursor/hooks/checkride-gate.sh';
+const DIRTY_SCRIPT_FILE = '.cursor/hooks/checkride-dirty.sh';
+const PROTECT_SCRIPT_FILE = '.cursor/hooks/checkride-protect.cjs';
+const HARNESS = 'cursor';
+/** The schema version Cursor's loader expects at the top of the file. */
+const SCHEMA_VERSION = 1;
+/**
+ * `sh` (not the exec bit) runs the script so a clone that lost file modes still
+ * gates; `CURSOR_PROJECT_DIR` anchors it when the session cwd is a subdirectory.
+ *
+ * **Unverified against a live Cursor.** Cursor documents `command` as "a shell
+ * string, an absolute path, or a relative path", but every documented example is
+ * a bare path, and it states separately that project hooks already run from the
+ * project root. If Cursor ever spawns these without a shell, `${…}` stays
+ * literal, the spawn fails, and Cursor's fail-open default ends the turn with no
+ * signal at all — the one failure mode `failClosed` cannot cover, because the
+ * hook it would guard never started. `failClosed` is set regardless; if that
+ * turns out not to catch it, drop both the interpreter and the variable and
+ * write the bare `.cursor/hooks/checkride-gate.sh` the docs show, accepting the
+ * dependence on the exec bit. See docs/cursor.md.
+ */
+const run = (interpreter, file) => `${interpreter} "\${CURSOR_PROJECT_DIR:-.}/${file}"`;
+/**
+ * Cursor's file-mutating tool names. Cursor has no separate `Edit` tool — `Write`
+ * covers both creating and modifying — and `Delete` can remove an accounting
+ * file just as effectively as a write can overwrite it.
+ */
+const EDIT_TOOLS = 'Write|Delete';
+/**
+ * Commands `protect` bothers to parse: the ones that name an accounting path at
+ * all. `beforeShellExecution` matches its `matcher` against the **full command
+ * string**, and that is the whole reason a shell guard is affordable here.
+ *
+ * checkride's standing objection to matching a shell tool is that a guard firing
+ * on a wrong parse is worse than a known hole. Filtering first turns the blast
+ * radius from "every command the agent runs" into "commands that already mention
+ * `checkride.baseline.json` or `.check`" — and inside that set the script still
+ * denies only on demonstrated write intent. Reads land here too and are allowed;
+ * they have to be, because triage reads these files.
+ */
+const ACCOUNTING_PATHS = 'checkride\\.baseline\\.json|\\.check\\b';
+/**
+ * Commands `dirty` reads as having written a file: a `>`/`>>` redirect, or one of
+ * the mutating verbs. The negative lookahead on `&` is load-bearing — without it
+ * the `2>&1` on the end of half the agent's commands marks every turn dirty and
+ * the gate stops skipping anything.
+ *
+ * Heuristic on purpose, and biased toward matching: a false positive costs one
+ * pipeline run on a turn that changed nothing, while a false negative is the
+ * status quo — a shell-written file that no gate ever sees. Only the first of
+ * those is recoverable by running the gate.
+ */
+const SHELL_WRITES = '>>?\\s*[^&\\s>]' +
+    '|(^|[\\s;&|(])(rm|mv|cp|tee|sed|truncate|dd|patch|install|shred|ln)(\\s|$)' +
+    '|(^|[\\s;&|(])git\\s+(apply|checkout|restore|stash|clean|reset|revert|switch|merge|rebase|pull|cherry-pick)(\\s|$)';
+/**
+ * Cursor's defaults are tuned for observers; the gate is not one, so all three
+ * of its non-command fields are set against the default rather than with it:
+ *
+ * - `timeout` — a full pipeline run is minutes, and the platform default is not.
+ * - `loop_limit: null` — the default of **5** stops the auto-followup after five
+ *   turns, at which point a red repo finishes anyway. Claude Code re-blocks
+ *   indefinitely; without this the two harnesses are not the same gate, and the
+ *   Cursor one degrades into five nudges.
+ * - `failClosed: true` — Cursor's default is fail-*open*: a hook that crashes,
+ *   times out, or emits unparseable JSON lets the turn end silently. That is the
+ *   vacuous green the whole contract exists to prevent (docs/contract.md).
+ *
+ * The two guards keep Cursor's fail-open default on purpose — see `dirty` and
+ * `protect` in `./scripts.ts` for why each must never block an edit.
+ */
+function hookSpecs() {
+    return [
+        {
+            name: 'gate',
+            event: 'stop',
+            timeout: GATE_TIMEOUT_SECONDS,
+            loopLimit: null,
+            failClosed: true,
+            sentinels: [GATE_SCRIPT_FILE],
+            command: run('sh', GATE_SCRIPT_FILE),
+        },
+        {
+            // `afterFileEdit` rather than `postToolUse`: it is purpose-built for "a
+            // file changed", needs no matcher, and so cannot drift when Cursor renames
+            // a tool.
+            name: 'dirty',
+            event: 'afterFileEdit',
+            sentinels: [DIRTY_SCRIPT_FILE],
+            command: run('sh', DIRTY_SCRIPT_FILE),
+        },
+        {
+            // The shell half of the edit marker. `afterFileEdit` sees only the file
+            // tools, so a turn that wrote through the shell alone used to skip the
+            // gate entirely. The matcher does all the deciding here — the script is
+            // the same unconditional `touch` either event reaches it through.
+            name: 'dirty',
+            event: 'afterShellExecution',
+            matcher: SHELL_WRITES,
+            sentinels: [DIRTY_SCRIPT_FILE],
+            command: run('sh', DIRTY_SCRIPT_FILE),
+        },
+        {
+            name: 'protect',
+            event: 'preToolUse',
+            matcher: EDIT_TOOLS,
+            sentinels: [PROTECT_SCRIPT_FILE],
+            command: run('node', PROTECT_SCRIPT_FILE),
+        },
+        {
+            // The shell half of the same guard. A tool-name matcher cannot see
+            // `echo … > checkride.baseline.json`, because that is a shell call and not
+            // a `Write`; `beforeShellExecution` is where it becomes visible. Same
+            // script, same fail-open default — see `protectScript` in `./scripts.ts`
+            // for why the parse behind it refuses to guess.
+            name: 'protect',
+            event: 'beforeShellExecution',
+            matcher: ACCOUNTING_PATHS,
+            sentinels: [PROTECT_SCRIPT_FILE],
+            command: run('node', PROTECT_SCRIPT_FILE),
+        },
+    ];
+}
+/** True when an entry belongs to `spec` (matched by any of its sentinels). */
+function isSpecHook(spec, hook) {
+    const command = hook.command;
+    return typeof command === 'string' && spec.sentinels.some((s) => command.includes(s));
+}
+/** The event's entry list, tolerating a malformed (non-array) config value. */
+function eventHooks(config, event) {
+    const entries = config.hooks?.[event];
+    return Array.isArray(entries) ? entries.map((h) => ({ ...h })) : [];
+}
+/**
+ * The canonical fields for `spec`, omitting the optional ones it doesn't set.
+ * `loopLimit` is compared against `undefined` rather than truth-tested, because
+ * the value checkride writes is `null`.
+ */
+function specFields(spec) {
+    return {
+        command: spec.command,
+        ...(spec.matcher !== undefined ? { matcher: spec.matcher } : {}),
+        ...(spec.timeout !== undefined ? { timeout: spec.timeout } : {}),
+        ...(spec.loopLimit !== undefined ? { loop_limit: spec.loopLimit } : {}),
+        ...(spec.failClosed !== undefined ? { failClosed: spec.failClosed } : {}),
+    };
+}
+/**
+ * Merge one hook into a parsed config, idempotently. An existing entry (found by
+ * sentinel) has its fields refreshed in place, keeping any key checkride does not
+ * own; otherwise a new entry is appended.
+ */
+function applyHook(config, spec) {
+    const hooks = { ...config.hooks };
+    const entries = eventHooks(config, spec.event);
+    const idx = entries.findIndex((h) => isSpecHook(spec, h));
+    if (idx >= 0) {
+        entries[idx] = { ...entries[idx], ...specFields(spec) };
+    }
+    else {
+        entries.push(specFields(spec));
+    }
+    return { ...config, hooks: { ...hooks, [spec.event]: entries } };
+}
+/**
+ * Merge the selected hooks into a parsed config, seeding `version` when absent.
+ * An existing `version` is never overwritten: if a future Cursor bumps it, the
+ * repo's value is the one that matches the rest of the file.
+ */
+export function applyCursorHooks(config = {}, names = HOOK_NAMES) {
+    const seeded = config.version === undefined ? { version: SCHEMA_VERSION, ...config } : config;
+    return hookSpecs()
+        .filter((spec) => names.includes(spec.name))
+        .reduce((acc, spec) => applyHook(acc, spec), seeded);
+}
+/**
+ * Strip one hook from a parsed config. An event left with no entries loses its
+ * key; `version` and every unrelated entry stay. Cursor's schema is flat, so
+ * there is no empty group to prune — the Claude writer's extra step has no
+ * counterpart here.
+ */
+function removeHook(config, spec) {
+    const hooks = { ...config.hooks };
+    const entries = eventHooks(config, spec.event).filter((h) => !isSpecHook(spec, h));
+    if (entries.length > 0)
+        hooks[spec.event] = entries;
+    else
+        delete hooks[spec.event];
+    return { ...config, hooks };
+}
+/** Remove the named hooks from a parsed config — the inverse of {@link applyCursorHooks}. */
+export function removeCursorHooks(config = {}, names = HOOK_NAMES) {
+    return hookSpecs()
+        .filter((spec) => names.includes(spec.name))
+        .reduce((acc, spec) => removeHook(acc, spec), config);
+}
+const SPEC = {
+    name: HARNESS,
+    configFile: CURSOR_HOOKS_FILE,
+    // Cursor's config has no field that renders the gate's command in its UI, so
+    // the package manager reaches its hooks only through the generated script.
+    apply: applyCursorHooks,
+    scripts: { gate: GATE_SCRIPT_FILE, dirty: DIRTY_SCRIPT_FILE, protect: PROTECT_SCRIPT_FILE },
+    remove: removeCursorHooks,
+};
+/** Write or refresh the selected Cursor hooks in `cwd`. */
+export function writeCursorHooks(cwd, opts) {
+    return writeHarnessHooks(cwd, SPEC, opts);
+}
+//# sourceMappingURL=cursor.js.map

package/node_modules/checkride/dist/agent-setup/cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.js","sourceRoot":"","sources":["../../src/agent-setup/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGnF;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAElE,MAAM,OAAO,GAAgB,QAAQ,CAAC;AAEtC,yEAAyE;AACzE,MAAM,cAAc,GAAG,CAAC,CAAC;AAoCzB;;;;;;;;;;;;;;GAcG;AACH,MAAM,GAAG,GAAG,CAAC,WAAmB,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,WAAW,+BAA+B,IAAI,GAAG,CAAC;AAEhH;;;;GAIG;AACH,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAChB,iBAAiB;IACjB,4EAA4E;IAC5E,oHAAoH,CAAC;AAEvH;;;;;;;;;;;;;;;GAeG;AACH,SAAS,SAAS;IAChB,OAAO;QACL;YACE,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,oBAAoB;YAC7B,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,CAAC,gBAAgB,CAAC;YAC7B,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC;SACrC;QACD;YACE,wEAAwE;YACxE,2EAA2E;YAC3E,UAAU;YACV,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC;SACtC;QACD;YACE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC;SACtC;QACD;YACE,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,CAAC,mBAAmB,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC;SAC1C;QACD;YACE,mEAAmE;YACnE,2EAA2E;YAC3E,sEAAsE;YACtE,yEAAyE;YACzE,gDAAgD;YAChD,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,CAAC,mBAAmB,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAc,EAAE,IAAgB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,MAAmB,EAAE,KAAgB;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAc;IAChC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,MAAmB,EAAE,IAAc;IACpD,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAsB,EAAE,EAAE,QAA2B,UAAU;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9F,OAAO,SAAS,EAAE;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAmB,EAAE,IAAc;IACrD,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;;QAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAC/B,SAAsB,EAAE,EACxB,QAA2B,UAAU;IAErC,OAAO,SAAS,EAAE;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,IAAI,GAA6B;IACrC,IAAI,EAAE,OAAO;IACb,UAAU,EAAE,iBAAiB;IAC7B,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE;IAC3F,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAkB;IAC9D,OAAO,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/node_modules/checkride/dist/agent-setup/files.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Filesystem helpers shared by the per-harness hook writers.
+ *
+ * Every write `agent-setup` makes is idempotent — a second run must report
+ * `changed: false` for every file — so the writers never write blind: they read
+ * first, compare, and only then touch the disk. `dryRun` computes the same
+ * result without writing anything.
+ */
+/**
+ * One file a hook writer produced, and whether this run actually changed it.
+ * `removed` marks a deletion, so a caller reporting the run can tell a file that
+ * was written from one that was taken away — both are changes.
+ */
+export type HookFile = {
+    path: string;
+    changed: boolean;
+    removed?: boolean;
+};
+export declare function readIfExists(path: string): Promise<string | null>;
+/** Write `content` to `cwd/rel` (creating directories) unless it already matches. */
+export declare function putFile(cwd: string, rel: string, content: string, opts: {
+    dryRun: boolean;
+    executable?: boolean;
+}): Promise<HookFile>;
+/**
+ * Delete `cwd/rel` if it is there. Reports `changed: true` only when a file was
+ * actually removed, so a second removal is the no-op every other write here is.
+ */
+export declare function dropFile(cwd: string, rel: string, opts: {
+    dryRun: boolean;
+}): Promise<HookFile>;
+/**
+ * Merge `next` into the JSON config at `cwd/rel` and write it back when it
+ * changed. `merge` receives the parsed file — or `undefined` when there is none
+ * — and returns the merged value; it must be idempotent.
+ *
+ * `skipIfMissing` suppresses creating the file at all: a run that only *removes*
+ * hooks has nothing to say to a repo that never had that harness configured, and
+ * writing `{}` into a `.claude/settings.json` that did not exist would be a
+ * confusing way to say "nothing to remove".
+ *
+ * A malformed file is named in the error, so a consumer sees
+ * `invalid .claude/settings.json: <reason>` instead of a bare `SyntaxError`
+ * stack (mirrors `invalidConfig` in `config.ts`).
+ */
+export declare function putJson<T>(cwd: string, rel: string, merge: (current?: T) => T, opts: {
+    dryRun: boolean;
+    skipIfMissing?: boolean;
+}): Promise<HookFile>;
+//# sourceMappingURL=files.d.ts.map

package/node_modules/checkride/dist/agent-setup/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/agent-setup/files.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7E,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMvE;AAED,qFAAqF;AACrF,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACxB,OAAO,CAAC,QAAQ,CAAC,CAKnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EACzB,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GACjD,OAAO,CAAC,QAAQ,CAAC,CAoBnB"}

package/node_modules/checkride/dist/agent-setup/files.js

@@ -0,0 +1,80 @@
+/**
+ * Filesystem helpers shared by the per-harness hook writers.
+ *
+ * Every write `agent-setup` makes is idempotent — a second run must report
+ * `changed: false` for every file — so the writers never write blind: they read
+ * first, compare, and only then touch the disk. `dryRun` computes the same
+ * result without writing anything.
+ */
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export async function readIfExists(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Write `content` to `cwd/rel` (creating directories) unless it already matches. */
+export async function putFile(cwd, rel, content, opts) {
+    const path = join(cwd, rel);
+    const raw = await readIfExists(path);
+    const changed = raw !== content;
+    if (changed && !opts.dryRun) {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, content);
+        if (opts.executable)
+            await chmod(path, 0o755);
+    }
+    return { path: rel, changed };
+}
+/**
+ * Delete `cwd/rel` if it is there. Reports `changed: true` only when a file was
+ * actually removed, so a second removal is the no-op every other write here is.
+ */
+export async function dropFile(cwd, rel, opts) {
+    const path = join(cwd, rel);
+    const changed = (await readIfExists(path)) !== null;
+    if (changed && !opts.dryRun)
+        await rm(path, { force: true });
+    return { path: rel, changed, removed: true };
+}
+/**
+ * Merge `next` into the JSON config at `cwd/rel` and write it back when it
+ * changed. `merge` receives the parsed file — or `undefined` when there is none
+ * — and returns the merged value; it must be idempotent.
+ *
+ * `skipIfMissing` suppresses creating the file at all: a run that only *removes*
+ * hooks has nothing to say to a repo that never had that harness configured, and
+ * writing `{}` into a `.claude/settings.json` that did not exist would be a
+ * confusing way to say "nothing to remove".
+ *
+ * A malformed file is named in the error, so a consumer sees
+ * `invalid .claude/settings.json: <reason>` instead of a bare `SyntaxError`
+ * stack (mirrors `invalidConfig` in `config.ts`).
+ */
+export async function putJson(cwd, rel, merge, opts) {
+    const path = join(cwd, rel);
+    const raw = await readIfExists(path);
+    if (raw === null && opts.skipIfMissing === true)
+        return { path: rel, changed: false };
+    let current;
+    if (raw !== null) {
+        try {
+            current = JSON.parse(raw);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new Error(`invalid ${rel}: ${reason}`, { cause: err });
+        }
+    }
+    const nextRaw = `${JSON.stringify(merge(current), null, 2)}\n`;
+    const changed = raw !== nextRaw;
+    if (changed && !opts.dryRun) {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, nextRaw);
+    }
+    return { path: rel, changed };
+}
+//# sourceMappingURL=files.js.map

package/node_modules/checkride/dist/agent-setup/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/agent-setup/files.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAS1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,GAAW,EACX,OAAe,EACf,IAA+C;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,KAAK,OAAO,CAAC;IAChC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,GAAW,EACX,IAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,GAAW,EACX,KAAyB,EACzB,IAAkD;IAElD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,OAAsB,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,KAAK,OAAO,CAAC;IAChC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/node_modules/checkride/dist/agent-setup/harness.d.ts

@@ -0,0 +1,101 @@
+/**
+ * The shape a harness writer fills in, and the one routine that drives it.
+ *
+ * Every harness needs the same two writes — merge its hook entries into its
+ * config file, then drop whichever scripts those entries invoke — and differs
+ * only in *where* each lands, *how* its config merges, and how much of the work
+ * its config can do without a script at all. Keeping that common body here is
+ * what makes a new harness a description rather than a copy: a `HarnessSpec`
+ * plus a merge function, and nothing else.
+ */
+import { type HarnessName } from '../gate.js';
+import { type PackageManager } from '../pm/index.js';
+import type { HookFile } from './files.js';
+/**
+ * Every hook `agent-setup` can write; `--hook <a,b>` selects a subset. It lives
+ * here rather than in `./hook.ts` so the per-harness writers can name it without
+ * importing the module that imports them.
+ */
+export declare const HOOK_NAMES: readonly ["gate", "dirty", "protect"];
+export type HookName = (typeof HOOK_NAMES)[number];
+/**
+ * Ceiling for the gate run, in seconds, for any harness whose config carries
+ * one. Generous on purpose: it exists to break a hang, not to police a slow
+ * repo, and checkride's own per-check timeouts fire long before it does.
+ *
+ * Both harnesses default lower than a real pipeline takes — Cursor's default is
+ * short, and Claude Code's is 600s — and both read a timed-out stop hook as a
+ * *broken* one, which under Claude Code means the turn simply ends. A gate that
+ * quietly stops gating on the slowest repos is the vacuous green the contract
+ * exists to prevent, so neither default is left in place.
+ */
+export declare const GATE_TIMEOUT_SECONDS = 900;
+/**
+ * The spinner text a harness shows while the gate runs.
+ *
+ * Without it the only feedback during a full pipeline run is the harness's
+ * default spinner, which is indistinguishable from a hung model — the user is
+ * left guessing whether anything is happening at all. Naming the command that
+ * is actually running answers that in the one place they are already looking.
+ */
+export declare function gateStatusMessage(pm: PackageManager): string;
+/**
+ * Where one harness keeps its hooks, and how to merge into its config.
+ *
+ * `T` is that harness's config shape, so each writer keeps its own types all
+ * the way through — `apply` is never handed a config it does not understand.
+ */
+export type HarnessSpec<T> = {
+    name: HarnessName;
+    /** The harness's hook config, relative to the repo root. */
+    configFile: string;
+    /**
+     * Where each hook's script lives, relative to the repo root — for the hooks
+     * that still need one.
+     *
+     * A hook is absent here when the harness can express it as *configuration*
+     * instead: Claude Code's `protect` is a `permissions.deny` rule and its
+     * `dirty` is an inline one-liner, so neither writes a file. Generated code in
+     * a consumer's repo is a cost — a file to review, to keep in sync, and to
+     * wonder about — and it should be paid only where config cannot do the job.
+     */
+    scripts: Partial<Record<HookName, string>>;
+    /**
+     * Scripts an earlier checkride wrote for this harness that this one does not.
+     * Deleted whenever their hook is written or removed, so a repo upgrading into
+     * the config-only form does not keep a dead file it will never run again.
+     */
+    retired?: Partial<Record<HookName, string>>;
+    /**
+     * Merge the named hooks into a parsed config. Must be idempotent. `pm` is the
+     * repo's package manager, which a harness that renders the gate's command in
+     * its own UI (Claude Code's `statusMessage`) needs in the config, not just in
+     * the script.
+     */
+    apply: (config: T | undefined, names: readonly string[], pm: PackageManager) => T;
+    /** Strip the named hooks from a parsed config. Must be idempotent. */
+    remove: (config: T | undefined, names: readonly string[]) => T;
+};
+export type WriteOptions = {
+    pm?: PackageManager;
+    dryRun?: boolean;
+    hooks: readonly string[];
+    /**
+     * Hooks to tear out: their config entries are stripped and their scripts
+     * deleted. Removal wins over `hooks`, so a name in both is removed — the
+     * caller-facing flags (`--hook`/`--remove-hook`) reject that combination
+     * before it gets here, and this is the safe reading if one ever slips through.
+     */
+    remove?: readonly string[];
+};
+/**
+ * Write or refresh `spec`'s hooks in `cwd` and tear out the ones marked for
+ * removal: the config entries first, then only the scripts the selected hooks
+ * actually invoke. Every write is idempotent, and `dryRun` computes the result
+ * without touching the disk.
+ *
+ * A run that only removes never *creates* the harness's config file — a repo
+ * that was never wired for this harness has nothing to un-wire.
+ */
+export declare function writeHarnessHooks<T extends object>(cwd: string, spec: HarnessSpec<T>, opts: WriteOptions): Promise<HookFile[]>;
+//# sourceMappingURL=harness.d.ts.map

package/node_modules/checkride/dist/agent-setup/harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/agent-setup/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAwB,KAAK,cAAc,EAAa,MAAM,gBAAgB,CAAC;AACtF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;GAIG;AACH,eAAO,MAAM,UAAU,uCAAwC,CAAC;AAChE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,cAAc,KAAK,CAAC,CAAC;IAClF,sEAAsE;IACtE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,CAAC,EAAE,cAAc,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EACtD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAyDrB"}

package/node_modules/checkride/dist/agent-setup/harness.js

@@ -0,0 +1,93 @@
+/**
+ * The shape a harness writer fills in, and the one routine that drives it.
+ *
+ * Every harness needs the same two writes — merge its hook entries into its
+ * config file, then drop whichever scripts those entries invoke — and differs
+ * only in *where* each lands, *how* its config merges, and how much of the work
+ * its config can do without a script at all. Keeping that common body here is
+ * what makes a new harness a description rather than a copy: a `HarnessSpec`
+ * plus a merge function, and nothing else.
+ */
+import { gatePreflight } from '../gate.js';
+import { detectPackageManager, runScript } from '../pm/index.js';
+import { dropFile, putFile, putJson } from './files.js';
+import { dirtyScript, gateScript, protectScript } from './scripts.js';
+/**
+ * Every hook `agent-setup` can write; `--hook <a,b>` selects a subset. It lives
+ * here rather than in `./hook.ts` so the per-harness writers can name it without
+ * importing the module that imports them.
+ */
+export const HOOK_NAMES = ['gate', 'dirty', 'protect'];
+/**
+ * Ceiling for the gate run, in seconds, for any harness whose config carries
+ * one. Generous on purpose: it exists to break a hang, not to police a slow
+ * repo, and checkride's own per-check timeouts fire long before it does.
+ *
+ * Both harnesses default lower than a real pipeline takes — Cursor's default is
+ * short, and Claude Code's is 600s — and both read a timed-out stop hook as a
+ * *broken* one, which under Claude Code means the turn simply ends. A gate that
+ * quietly stops gating on the slowest repos is the vacuous green the contract
+ * exists to prevent, so neither default is left in place.
+ */
+export const GATE_TIMEOUT_SECONDS = 900;
+/**
+ * The spinner text a harness shows while the gate runs.
+ *
+ * Without it the only feedback during a full pipeline run is the harness's
+ * default spinner, which is indistinguishable from a hung model — the user is
+ * left guessing whether anything is happening at all. Naming the command that
+ * is actually running answers that in the one place they are already looking.
+ */
+export function gateStatusMessage(pm) {
+    return `checkride gate — running \`${runScript(pm, 'check')}\``;
+}
+/**
+ * Write or refresh `spec`'s hooks in `cwd` and tear out the ones marked for
+ * removal: the config entries first, then only the scripts the selected hooks
+ * actually invoke. Every write is idempotent, and `dryRun` computes the result
+ * without touching the disk.
+ *
+ * A run that only removes never *creates* the harness's config file — a repo
+ * that was never wired for this harness has nothing to un-wire.
+ */
+export async function writeHarnessHooks(cwd, spec, opts) {
+    const pm = opts.pm ?? detectPackageManager({ cwd });
+    const dryRun = opts.dryRun ?? false;
+    const gone = opts.remove ?? [];
+    const names = opts.hooks.filter((name) => !gone.includes(name));
+    // Read on every write, which is what makes the preflight the one seam that
+    // survives a refresh: `hooks add` rewrites the script and re-points the
+    // harness config, and re-derives this from the repo's own config each time.
+    const preflight = gatePreflight(cwd);
+    const bodies = {
+        // The gate guards on the edit marker only when the hook that sets it is
+        // written too; alone, the guard would disarm the gate entirely. Removing
+        // `dirty` therefore rewrites a surviving gate unguarded, which is why the
+        // config merge and the script bodies both read the post-removal selection.
+        gate: () => gateScript(pm, {
+            harness: spec.name,
+            dirtyGuard: names.includes('dirty'),
+            ...(preflight === null ? {} : { preflight }),
+        }),
+        dirty: dirtyScript,
+        protect: protectScript,
+    };
+    const config = await putJson(cwd, spec.configFile, (c) => spec.apply(spec.remove(c, gone), names, pm), { dryRun, skipIfMissing: names.length === 0 });
+    // A hook this harness expresses as config has no script to write, and may have
+    // a retired one to clear away. `touched` is both directions at once, because a
+    // dead file is worth deleting whether the hook is arriving or leaving.
+    const touched = HOOK_NAMES.filter((name) => names.includes(name) || gone.includes(name));
+    const [written, removed, swept] = await Promise.all([
+        Promise.all(HOOK_NAMES.filter((name) => names.includes(name) && spec.scripts[name] !== undefined).map((name) => putFile(cwd, spec.scripts[name] ?? '', bodies[name](), { dryRun, executable: true }))),
+        Promise.all(HOOK_NAMES.filter((name) => gone.includes(name) && spec.scripts[name] !== undefined).map((name) => dropFile(cwd, spec.scripts[name] ?? '', { dryRun }))),
+        Promise.all(touched
+            .map((name) => spec.retired?.[name])
+            .filter((path) => path !== undefined)
+            .map((path) => dropFile(cwd, path, { dryRun }))),
+    ]);
+    // Only report a retired script that was actually there. Every repo set up
+    // after these became configuration has none, and listing files that never
+    // existed as "absent" would make the common run read like a cleanup.
+    return [config, ...written, ...removed, ...swept.filter((f) => f.changed)];
+}
+//# sourceMappingURL=harness.js.map

package/node_modules/checkride/dist/agent-setup/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/agent-setup/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAuB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEtF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAGhE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAkB;IAClD,OAAO,8BAA8B,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC;AAClE,CAAC;AAqDD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,IAAoB,EACpB,IAAkB;IAElB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,MAAM,GAAmC;QAC7C,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,EAAE,GAAG,EAAE,CACT,UAAU,CAAC,EAAE,EAAE;YACb,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAC7C,CAAC;QACJ,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,aAAa;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,GAAG,EACH,IAAI,CAAC,UAAU,EACf,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAClD,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAC9C,CAAC;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CACrF,CACF;QACD,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CACpD,CACF;QACD,OAAO,CAAC,GAAG,CACT,OAAO;aACJ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;aACnC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;aACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAClD;KACF,CAAC,CAAC;IACH,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7E,CAAC"}