specpipe 1.0.1 → 1.0.2

package/src/commands/remove.js

@@ -3,9 +3,14 @@ import { unlink, rmdir, rm } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { log } from '../lib/logger.js';
-import { readManifest, getAgents, MANIFEST_FILE, LEGACY_MANIFEST_FILE } from '../lib/manifest.js';
-import { removeGlobalHooksFromSettings, stripAgentsMdGuards, removeAgentHooks } from '../lib/installer.js';
-import { agentHasHooks } from '../lib/agents.js';
+import { readManifest, writeManifest, getAgents, MANIFEST_FILE, LEGACY_MANIFEST_FILE } from '../lib/manifest.js';
+import { removeGlobalHooksFromSettings, stripRulesSection, removeAgentHooks, COMPONENTS } from '../lib/installer.js';
+import { agentHasHooks, AGENTS, resolveAgents, emitRules } from '../lib/agents.js';
+import { computeDesired } from '../lib/reconcile.js';
+import { readGlobalManifest } from './init-global.js';
+
+// specpipe's skill dir names (sp-*), derived from the kit's skill component list.
+const GLOBAL_SKILL_NAMES = [...new Set(COMPONENTS.skills.map((p) => p.split('/')[1]))];
 
 const PRESERVE = [
   '.claude/CLAUDE.md',
@@ -15,24 +20,36 @@ const PRESERVE_DIRS = [
   'docs/',
 ];
 
-export async function removeGlobal() {
-  log.info('Removing global specpipe install...');
+export async function removeGlobal({ dryRun = false } = {}) {
+  log.info(dryRun ? 'Global remove — dry run (no changes):' : 'Removing global specpipe install...');
   log.blank();
-
-  // Remove ~/.claude/skills/
-  const globalSkillsDir = join(homedir(), '.claude', 'skills');
-  if (existsSync(globalSkillsDir)) {
-    await rm(globalSkillsDir, { recursive: true, force: true });
-    log.del('~/.claude/skills/');
-  } else {
-    log.skip('~/.claude/skills/ (not found)');
+  const would = (label) => log.del(dryRun ? `${label} (would remove)` : label);
+
+  // Remove only specpipe's sp-* skill dirs from each globally-installed agent's
+  // skills root — never the whole root (it may hold the agent's own / vendor skills,
+  // e.g. Codex ships system skills under ~/.codex/skills/.system).
+  const gm = await readGlobalManifest() || {};
+  const globalAgents = gm.globalAgents || (gm.globalInstalled ? ['claude'] : ['claude']);
+  for (const agent of globalAgents) {
+    const root = AGENTS[agent]?.globalSkillRoot;
+    if (!root) continue;
+    let removed = 0;
+    for (const name of GLOBAL_SKILL_NAMES) {
+      const dir = join(homedir(), ...root.split('/'), name);
+      if (existsSync(dir)) { if (!dryRun) await rm(dir, { recursive: true, force: true }); removed++; }
+    }
+    if (removed) would(`~/${root}/sp-* (${removed} skill${removed === 1 ? '' : 's'})`);
+    else log.skip(`~/${root}/sp-* (none found)`);
+    // Tidy up the skills root if specpipe was its only occupant; rmdir is a no-op
+    // (throws) when other skills remain — e.g. Codex's ~/.codex/skills/.system.
+    if (!dryRun) try { await rmdir(join(homedir(), ...root.split('/'))); } catch { /* not empty — keep */ }
   }
 
   // Remove ~/.claude/hooks/
   const globalHooksDir = join(homedir(), '.claude', 'hooks');
   if (existsSync(globalHooksDir)) {
-    await rm(globalHooksDir, { recursive: true, force: true });
-    log.del('~/.claude/hooks/');
+    if (!dryRun) await rm(globalHooksDir, { recursive: true, force: true });
+    would('~/.claude/hooks/');
   } else {
     log.skip('~/.claude/hooks/ (not found)');
   }
@@ -41,44 +58,91 @@ export async function removeGlobal() {
   // The script is no longer part of the kit — sweep up the orphan if present.
   const legacyScript = join(homedir(), '.claude', 'scripts', 'build-test.sh');
   if (existsSync(legacyScript)) {
-    await unlink(legacyScript);
-    log.del('~/.claude/scripts/build-test.sh (legacy)');
-    try {
-      await rmdir(join(homedir(), '.claude', 'scripts'));
-    } catch { /* keep dir if user has other scripts in it */ }
+    if (!dryRun) await unlink(legacyScript);
+    would('~/.claude/scripts/build-test.sh (legacy)');
+    if (!dryRun) try { await rmdir(join(homedir(), '.claude', 'scripts')); } catch { /* keep if other scripts */ }
   }
 
   // Remove devkit hook entries from ~/.claude/settings.json
-  await removeGlobalHooksFromSettings();
-  log.del('hook entries from ~/.claude/settings.json');
+  if (!dryRun) await removeGlobalHooksFromSettings();
+  would('hook entries from ~/.claude/settings.json');
 
   // Remove global manifest
   const globalManifest = join(homedir(), '.claude', '.devkit-manifest.json');
   if (existsSync(globalManifest)) {
-    await unlink(globalManifest);
-    log.del('~/.claude/.devkit-manifest.json');
+    if (!dryRun) await unlink(globalManifest);
+    would('~/.claude/.devkit-manifest.json');
   }
 
   log.blank();
-  log.pass('Global install removed. Per-project installs are unaffected.');
-  log.info('Run `specpipe init` in each project to restore per-project hooks.');
+  log.pass(dryRun ? 'Dry run — nothing changed.' : 'Global install removed. Per-project installs are unaffected.');
+  if (!dryRun) log.info('Run `specpipe init` in each project to restore per-project hooks.');
 }
 
-export async function removeCommand(path, opts = {}) {
-  if (opts.global) {
-    await removeGlobal();
-    return;
+/**
+ * Remove only the named agents, keeping the rest. A file is deleted only when no
+ * remaining agent still wants it (reconcile against computeDesired), so shared
+ * artifacts survive: .agents/skills/* stays while Codex OR Antigravity remains,
+ * SPECPIPE-RULES.md stays while OpenClaw OR Hermes remains. Each removed agent's
+ * merge-mode rules section (Claude → CLAUDE.md, Codex → AGENTS.md) and enforced
+ * hook config are stripped/removed separately — those are unique per agent.
+ */
+async function removeAgentsPartial(targetDir, manifest, removeSet, remaining, dryRun) {
+  const removedLabels = removeSet.map((a) => AGENTS[a]?.label || a).join(', ');
+  const keptLabels = remaining.map((a) => AGENTS[a]?.label || a).join(', ');
+  log.info(dryRun ? `Dry run — would remove ${removedLabels}, keep ${keptLabels}:` : `Removing ${removedLabels}; keeping ${keptLabels}.`);
+  log.blank();
+
+  const skillsSet = manifest.skills ? new Set(manifest.skills) : null;
+  const desired = await computeDesired(remaining, skillsSet); // paths a remaining agent still needs
+  const removedDirs = new Set();
+
+  for (const file of Object.keys(manifest.files)) {
+    if (PRESERVE.includes(file) || PRESERVE_DIRS.some((d) => file.startsWith(d))) { log.keep(file); continue; }
+    if (desired.has(file)) {
+      // Still owned by a remaining agent — keep, and reassign the owner so the
+      // manifest stays accurate (the removed agent may have been the recorded owner).
+      if (!dryRun) manifest.files[file].agent = desired.get(file).agent;
+      continue;
+    }
+    const full = join(targetDir, file);
+    if (existsSync(full)) {
+      if (dryRun) { log.del(`${file} (would remove)`); }
+      else { await unlink(full); log.del(file); delete manifest.files[file]; }
+      let d = dirname(file);
+      while (d && d !== '.' && d !== '/') { removedDirs.add(d); d = dirname(d); }
+    } else if (!dryRun) {
+      delete manifest.files[file];
+    }
   }
 
-  const targetDir = resolve(path);
-  const manifest = await readManifest(targetDir);
+  for (const agent of removeSet) {
+    const r = emitRules(agent, '');
+    if (r && r.mode === 'merge') {
+      if (dryRun) log.del(`${r.path} (specpipe rules section — would strip)`);
+      else if (await stripRulesSection(targetDir, r.path)) log.del(`${r.path} (specpipe rules section)`);
+    }
+    if (agentHasHooks(agent)) {
+      if (dryRun) log.del(`${AGENTS[agent].label} enforced hooks (would remove)`);
+      else await removeAgentHooks(agent, targetDir);
+    }
+  }
 
-  if (!manifest) {
-    log.fail('No manifest found. Nothing to remove.');
-    process.exit(1);
+  if (!dryRun) {
+    manifest.agents = remaining;
+    await writeManifest(targetDir, manifest);
+    for (const dir of [...removedDirs].sort((a, b) => b.split('/').length - a.split('/').length)) {
+      try { await rmdir(join(targetDir, dir)); } catch { /* not empty or missing */ }
+    }
   }
 
-  log.info('Removing specpipe files...');
+  log.blank();
+  log.pass(dryRun ? `Dry run — would remove ${removedLabels}, keep ${keptLabels}.` : `Removed ${removedLabels}. Kept ${keptLabels}.`);
+}
+
+/** Remove everything specpipe installed in this project (all agents). */
+async function removeAll(targetDir, manifest, dryRun) {
+  log.info(dryRun ? 'Remove — dry run (no changes):' : 'Removing specpipe files...');
   log.blank();
 
   const removedDirs = new Set();
@@ -91,9 +155,8 @@ export async function removeCommand(path, opts = {}) {
     }
     const fullPath = join(targetDir, file);
     if (existsSync(fullPath)) {
-      await unlink(fullPath);
-      log.del(file);
-      // Track ancestor dirs (within the project) for empty-dir cleanup.
+      if (dryRun) { log.del(`${file} (would remove)`); }
+      else { await unlink(fullPath); log.del(file); }
       let d = dirname(file);
       while (d && d !== '.' && d !== '/') { removedDirs.add(d); d = dirname(d); }
     }
@@ -103,31 +166,78 @@ export async function removeCommand(path, opts = {}) {
   for (const rel of [MANIFEST_FILE, LEGACY_MANIFEST_FILE]) {
     const p = join(targetDir, rel);
     if (existsSync(p)) {
-      await unlink(p);
-      log.del(rel);
+      if (dryRun) { log.del(`${rel} (would remove)`); }
+      else { await unlink(p); log.del(rel); }
       let d = dirname(rel);
       while (d && d !== '.' && d !== '/') { removedDirs.add(d); d = dirname(d); }
     }
   }
 
-  // Codex guards live as a section in a shared AGENTS.md — strip just that section.
-  if (manifest.agentsMdGuards) {
-    if (await stripAgentsMdGuards(targetDir)) log.del('AGENTS.md (specpipe guards section)');
+  // Rules live as a marked section in shared CLAUDE.md / AGENTS.md — strip just our
+  // section, preserving the rest of the user's file (don't delete the whole file).
+  for (const f of ['.claude/CLAUDE.md', 'AGENTS.md']) {
+    if (dryRun) { if (existsSync(join(targetDir, f))) log.del(`${f} (specpipe rules section — would strip)`); }
+    else if (await stripRulesSection(targetDir, f)) log.del(`${f} (specpipe rules section)`);
   }
 
-  // Enforced hooks (Codex/Cursor) live outside the tracked file set — clean per agent.
+  // Enforced hooks (Codex/Cursor/Antigravity) live outside the tracked file set — clean per agent.
   for (const agent of getAgents(manifest)) {
-    if (agentHasHooks(agent)) await removeAgentHooks(agent, targetDir);
+    if (agentHasHooks(agent) && !dryRun) await removeAgentHooks(agent, targetDir);
   }
 
   // Legacy: older installs placed build-test.sh under scripts/.
   removedDirs.add('scripts');
 
   // Remove now-empty directories, deepest first (preserves dirs with user content).
-  for (const dir of [...removedDirs].sort((a, b) => b.split('/').length - a.split('/').length)) {
-    try { await rmdir(join(targetDir, dir)); } catch { /* not empty or missing */ }
+  if (!dryRun) {
+    for (const dir of [...removedDirs].sort((a, b) => b.split('/').length - a.split('/').length)) {
+      try { await rmdir(join(targetDir, dir)); } catch { /* not empty or missing */ }
+    }
   }
 
   log.blank();
-  log.pass('Removed. CLAUDE.md and docs/ preserved.');
+  log.pass(dryRun ? 'Dry run — nothing changed. CLAUDE.md and docs/ would be preserved.' : 'Removed. CLAUDE.md and docs/ preserved.');
+}
+
+export async function removeCommand(path, opts = {}) {
+  const dryRun = !!opts.dryRun;
+
+  if (opts.global) {
+    await removeGlobal({ dryRun });
+    return;
+  }
+
+  const targetDir = resolve(path);
+  const manifest = await readManifest(targetDir);
+
+  if (!manifest) {
+    log.fail('No manifest found. Nothing to remove.');
+    process.exit(1);
+  }
+
+  const installedAgents = getAgents(manifest);
+
+  // Selective removal: drop only the named agents, keep the rest.
+  if (opts.agents) {
+    let requested;
+    try { requested = resolveAgents(opts.agents); }
+    catch (e) { log.fail(e.message); process.exit(1); }
+
+    const removeSet = requested.filter((a) => installedAgents.includes(a));
+    for (const a of requested.filter((a) => !installedAgents.includes(a))) {
+      log.warn(`${AGENTS[a]?.label || a} is not installed here — skipping.`);
+    }
+    if (removeSet.length === 0) {
+      log.fail('None of the requested agents are installed here. Nothing to remove.');
+      process.exit(1);
+    }
+    const remaining = installedAgents.filter((a) => !removeSet.includes(a));
+    if (remaining.length > 0) {
+      await removeAgentsPartial(targetDir, manifest, removeSet, remaining, dryRun);
+      return;
+    }
+    // Removing every installed agent — fall through to a full teardown.
+  }
+
+  await removeAll(targetDir, manifest, dryRun);
 }

package/src/commands/upgrade.js

@@ -6,9 +6,10 @@ import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { log } from '../lib/logger.js';
 import { readManifest, writeManifest, setFileEntry, refreshCustomizationStatus, getAgents } from '../lib/manifest.js';
-import { setPermissions, COMPONENTS, installSkillGlobal, getGlobalSkillsDir, installHookGlobal, getGlobalHooksDir, mergeGlobalSettings, installAgentRules, installAgentHooks } from '../lib/installer.js';
+import { setPermissions, installAgentRules, installAgentHooks } from '../lib/installer.js';
 import { agentRulesMode, agentHasHooks } from '../lib/agents.js';
 import { computeDesired } from '../lib/reconcile.js';
+import { initGlobal } from './init-global.js';
 import { unlink } from 'node:fs/promises';
 
 const GLOBAL_MANIFEST = join(homedir(), '.claude', '.devkit-manifest.json');
@@ -16,60 +17,21 @@ const GLOBAL_MANIFEST = join(homedir(), '.claude', '.devkit-manifest.json');
 async function readGlobalManifest() {
   try { return JSON.parse(await readFile(GLOBAL_MANIFEST, 'utf-8')); } catch { return null; }
 }
-async function writeGlobalManifest(data) {
-  await mkdir(join(homedir(), '.claude'), { recursive: true });
-  await writeFile(GLOBAL_MANIFEST, JSON.stringify(data, null, 2) + '\n');
-}
 
 export async function upgradeGlobal({ force = false } = {}) {
-  const globalSkillsDir = getGlobalSkillsDir();
-  await mkdir(globalSkillsDir, { recursive: true });
-
   const meta = await readGlobalManifest() || {};
-  const globalFiles = meta.files || {};
-  const updatedFiles = { ...globalFiles };
-
-  log.blank();
-  console.log('--- Upgrading global skills ---');
-  let updated = 0; let skipped = 0; let identical = 0;
-
-  for (const relPath of COMPONENTS.skills) {
-    const { result, kitHash } = await installSkillGlobal(relPath, globalSkillsDir, { force, globalFiles });
-    if (result === 'copied') updated++;
-    else if (result === 'identical') identical++;
-    else skipped++;
-    if (result !== 'skipped') updatedFiles[relPath] = { kitHash };
-  }
-
-  let skillParts = [`${updated} updated`, `${identical} unchanged`];
-  if (skipped > 0) skillParts.push(`${skipped} customized (use --force to overwrite)`);
-  log.pass(`Global skills: ${skillParts.join(', ')}`);
-
-  // Upgrade hooks if previously installed globally
-  if (meta.globalHooksInstalled) {
-    const globalHooksDir = getGlobalHooksDir();
-    await mkdir(globalHooksDir, { recursive: true });
-
-    log.blank();
-    console.log('--- Upgrading global hooks ---');
-    let hUpdated = 0; let hSkipped = 0; let hIdentical = 0;
-
-    for (const relPath of COMPONENTS.hooks) {
-      const { result, kitHash } = await installHookGlobal(relPath, globalHooksDir, { force, globalFiles });
-      if (result === 'copied') hUpdated++;
-      else if (result === 'identical') hIdentical++;
-      else hSkipped++;
-      if (result !== 'skipped') updatedFiles[relPath] = { kitHash };
-    }
-
-    await mergeGlobalSettings(globalHooksDir);
-
-    let hookParts = [`${hUpdated} updated`, `${hIdentical} unchanged`];
-    if (hSkipped > 0) hookParts.push(`${hSkipped} customized (use --force to overwrite)`);
-    log.pass(`Global hooks: ${hookParts.join(', ')}`);
-  }
-
-  await writeGlobalManifest({ ...meta, globalInstalled: true, files: updatedFiles, updatedAt: new Date().toISOString() });
+  const agents = meta.globalAgents || (meta.globalInstalled ? ['claude'] : ['claude']);
+
+  // initGlobal is idempotent + customization-aware, so it doubles as the upgrade
+  // path. It refreshes every agent installed globally (plus Claude hooks if any) and
+  // rewrites the manifest.
+  await initGlobal({
+    agents,
+    skills: meta.skills ? new Set(meta.skills) : null,
+    hookSelection: meta.hooks ? new Set(meta.hooks) : null,
+    force,
+    hooks: meta.globalHooksInstalled || false,
+  });
 
   // Warn about per-project skills that shadow global
   const projects = meta.projects || [];
@@ -112,9 +74,11 @@ export async function upgradeCommand(path, opts) {
     log.blank();
   }
 
-  // Desired installed state for every agent this project targets.
+  // Desired installed state for every agent this project targets, honoring the
+  // skill selection recorded at install time (so upgrade doesn't resurrect skills
+  // the user deselected).
   const agents = getAgents(manifest);
-  const desired = await computeDesired(agents);
+  const desired = await computeDesired(agents, manifest.skills ? new Set(manifest.skills) : null);
 
   let updated = 0;
   let skippedCustomized = 0;
@@ -183,9 +147,10 @@ export async function upgradeCommand(path, opts) {
   // merged (not reconciled via computeDesired), so re-merge it here to pick up kit
   // changes. Owned rule files were already handled by the reconcile loop above.
   if (!opts.dryRun) {
+    const hooksSet = manifest.hooks ? new Set(manifest.hooks) : null;
     for (const agent of agents) {
-      if (agentRulesMode(agent) === 'agents-md') await installAgentRules(agent, targetDir, { force: opts.force });
-      if (agentHasHooks(agent)) await installAgentHooks(agent, targetDir, { force: opts.force });
+      if (agentRulesMode(agent) === 'merge') await installAgentRules(agent, targetDir, { force: opts.force });
+      if (agentHasHooks(agent)) await installAgentHooks(agent, targetDir, { force: opts.force, hooks: hooksSet });
     }
   }
 

package/src/lib/agent-guards.js

@@ -1,100 +1,56 @@
-// Guardrails (advisory rules) + enforced (blocking) hooks per agent.
-// Claude enforces guards via its native .claude/hooks; every other agent gets the
-// same intent as an always-on RULE. Codex/Cursor additionally support blocking
-// hooks (verified payloads), so they also get enforced guard scripts.
+// Operating rules (the single rich source kit/rules/specpipe-rules.md) emitted per
+// agent into its project-config file. Claude → CLAUDE.md and Codex → AGENTS.md get a
+// marked section merged into the (possibly pre-existing) shared file; the others get
+// an owned rules file. Enforced (blocking) hooks are separate (hooks.js).
 
 const RULES = {
+  // Claude reads .claude/CLAUDE.md — merge our section in, don't clobber the user's file.
+  claude: { mode: 'merge', path: '.claude/CLAUDE.md' },
   cursor: {
     mode: 'file',
-    path: '.cursor/rules/specpipe-guards.mdc',
+    path: '.cursor/rules/specpipe-rules.mdc',
     frontmatter: 'description: specpipe operating rules — spec-first cycle, guardrails, testing, conventions\nglobs:\nalwaysApply: true',
   },
-  // Antigravity rules are plain markdown (no documented trigger/glob frontmatter);
-  // official Google DevRel uses the singular `.agent/rules/` path.
-  antigravity: { mode: 'doc', path: '.agent/rules/specpipe-guards.md' },
-  codex: { mode: 'agents-md', path: 'AGENTS.md' },
-  openclaw: { mode: 'doc', path: 'SPECPIPE-GUARDS.md' },
-  hermes: { mode: 'doc', path: 'SPECPIPE-GUARDS.md' },
+  // Antigravity rules are plain markdown (no documented trigger/glob frontmatter).
+  // Antigravity moved its default workspace-rules dir to `.agents/rules/` (plural) as of
+  // v1.19.5 — the team rep confirmed `.agents` is the path "going forward"; `.agent/rules`
+  // (singular) is only a backward-compat fallback. Use the plural default, which also lines
+  // up with Antigravity's `.agents/skills/` + `.agents/hooks.json`.
+  // Source: discuss.ai.google.dev/t/new-folder-for-rules/126165
+  antigravity: { mode: 'doc', path: '.agents/rules/specpipe-rules.md' },
+  codex: { mode: 'merge', path: 'AGENTS.md' },
+  openclaw: { mode: 'doc', path: 'SPECPIPE-RULES.md' },
+  hermes: { mode: 'doc', path: 'SPECPIPE-RULES.md' },
 };
 
-export const GUARDS_BEGIN = '<!-- specpipe:guards:begin -->';
-export const GUARDS_END = '<!-- specpipe:guards:end -->';
+export const RULES_BEGIN = '<!-- specpipe:rules:begin -->';
+export const RULES_END = '<!-- specpipe:rules:end -->';
 
-/** How an agent carries guardrails: 'file' | 'doc' | 'agents-md' | null (native hooks). */
+/** How an agent carries its rules: 'merge' (marked section in a shared file) | 'file' | 'doc' | null. */
 export function agentRulesMode(agentId) {
   return RULES[agentId]?.mode || null;
 }
 
 /**
- * Emit the guardrails artifact for an agent from the canonical guards body.
- * @returns {{ mode, path, content } | null} null for Claude (native hooks).
+ * Emit an agent's rules artifact from the canonical rules body. 'merge' agents
+ * (Claude → CLAUDE.md, Codex → AGENTS.md) get a marked section to merge into a shared
+ * file; the rest get an owned file (Cursor .mdc, Antigravity/OpenClaw/Hermes doc).
+ * @returns {{ mode, path, content } | null}
  */
 export function emitRules(agentId, body) {
   const r = RULES[agentId];
   if (!r) return null;
   if (r.mode === 'file') return { mode: 'file', path: r.path, content: `---\n${r.frontmatter}\n---\n${body}` };
   if (r.mode === 'doc') return { mode: 'doc', path: r.path, content: `# specpipe — operating rules\n\n${body}` };
-  // agents-md: a marked section merged into a shared AGENTS.md
-  return { mode: 'agents-md', path: r.path, content: `${GUARDS_BEGIN}\n## specpipe — operating rules\n\n${body}${GUARDS_END}\n` };
+  // merge: a marked section merged into a shared CLAUDE.md / AGENTS.md. Force a
+  // newline before the END marker so it always sits on its own line — otherwise a
+  // rules source that doesn't end in \n would glue the body to the marker and break
+  // stripRulesSection's line-based match.
+  return { mode: 'merge', path: r.path, content: `${RULES_BEGIN}\n## specpipe — operating rules\n\n${body.replace(/\n*$/, '\n')}${RULES_END}\n` };
 }
 
-// ── Enforced hooks (block tool calls, not just advise) ──────────────────────
-// Agents whose hook payloads + block primitive (exit 2) are verified compatible
-// with the shared guard scripts (kit/hooks/specpipe-*.sh). Claude has its own
-// .claude/hooks; Antigravity/Hermes lack a usable blocking-hook surface → omitted.
-const SHELL_GUARD = 'specpipe-shell-guard.sh';
-const READ_GUARD = 'specpipe-read-guard.sh';
-
-const EHOOKS = {
-  // Codex PreToolUse payload == Claude's (.tool_input.command); exit 2 blocks.
-  // Verified matcher: "Bash". Read/Edit tool names unverified → shell guard only.
-  codex: {
-    dir: '.codex/hooks',
-    scripts: [SHELL_GUARD],
-    configPath: '.codex/hooks.json',
-    config: {
-      hooks: {
-        PreToolUse: [
-          { matcher: 'Bash', hooks: [{ type: 'command', command: `bash .codex/hooks/${SHELL_GUARD}` }] },
-        ],
-      },
-    },
-  },
-  // Cursor: beforeShellExecution (.command) + beforeReadFile (.file_path) verified;
-  // fail-open by default, so failClosed: true to actually enforce.
-  cursor: {
-    dir: '.cursor/hooks',
-    scripts: [SHELL_GUARD, READ_GUARD],
-    configPath: '.cursor/hooks.json',
-    config: {
-      version: 1,
-      hooks: {
-        beforeShellExecution: [{ command: `./.cursor/hooks/${SHELL_GUARD}`, failClosed: true }],
-        beforeReadFile: [{ command: `./.cursor/hooks/${READ_GUARD}`, failClosed: true }],
-      },
-    },
-  },
-};
-
-/** Kit-relative source path for a guard script. */
-export const HOOKS_SRC_DIR = 'hooks';
-
-/** Whether an agent gets enforced (blocking) hooks beyond advisory rules. */
-export function agentHasHooks(agentId) {
-  return !!EHOOKS[agentId];
-}
-
-/**
- * Emit an agent's enforced-hook artifacts (Codex/Cursor). Returns the scripts to
- * copy (kit-relative src + on-disk dst) and the hook config file to write, or null.
- */
-export function emitHooks(agentId) {
-  const h = EHOOKS[agentId];
-  if (!h) return null;
-  return {
-    hooksDir: h.dir,
-    scripts: h.scripts.map((name) => ({ src: `${HOOKS_SRC_DIR}/${name}`, dst: `${h.dir}/${name}` })),
-    configPath: h.configPath,
-    configContent: JSON.stringify(h.config, null, 2) + '\n',
-  };
-}
+// ── Enforced hooks ──────────────────────────────────────────────────────────
+// The hook registry (which agents block which tool calls + each agent's verified
+// config shape, including Claude and Antigravity) lives in hooks.js. Re-exported
+// here so callers keep importing from agents.js. HOOKS_SRC_DIR stays as an alias.
+export { emitHooks, agentHasHooks, HOOKS_DIR as HOOKS_SRC_DIR } from './hooks.js';