yenop 0.0.0 → 0.1.0

package/LICENSE.md

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Ertunç Varol
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,9 +1,249 @@
 # Yenop
 
-The layer between an AI agent and the systems it can touch.
+**The local-first execution authorization layer for AI agents. One set of rules across the agents you run, and your agents' actions stay on your machine.**
 
-Yenop decides which tool calls actually execute, who approved the ones that cannot be undone, how much a single run may cost, and keeps a receipt for every action.
+An AI agent decides what it wants to do. Yenop decides what is allowed to happen. It sits between the agent and the systems it can touch, and on every action it returns one of three answers:
 
-This is a name reservation. The first release is in preparation. Until then, the package installs nothing.
+**ALLOW**  ·  **ASK** a person  ·  **DENY**
+
+- **One layer across the agents you run.** Claude Code, Cursor, Codex CLI, Gemini CLI, agents built on the OpenAI Agents SDK, and any tool that speaks MCP, judged by the same policies and written to one verifiable record. No single agent vendor will ever govern its competitors; a layer outside all of them can.
+- **It authorizes the action, not the reasoning.** Yenop does not decide whether an agent's thinking is safe. It decides whether the action the agent is about to execute is allowed, reading the actual command and file path, so there is no sentence to jailbreak. And it watches the whole run, so a harmful plan split across steps that each look harmless is still caught.
+- **Local-first.** It runs next to the agent, on your machine. No cloud dependency, no account, and no agent data, source, prompts or secrets leaves the machine unless you choose to export the audit trail. That trail is a plain file you own, hash-chained so tampering is detectable.
+
+Status: **pre-alpha, developer preview** (0.1.0). **Source-available, not open source** (see License). Works today with Claude Code, Cursor, Codex CLI and Gemini CLI hooks, the OpenAI Agents SDK, and an MCP gateway for any MCP client, each verified in a live session against the current release of that runtime. The set of runtimes is frozen for this preview; the next one is added when people using Yenop ask for it.
+
+## See it in thirty seconds
+
+```sh
+yenop demo
+```
+
+A scripted walk through what Yenop does, with no AI agent and nothing real touched: safe work passes silently, a secret-exfiltration attempt is blocked, a multi-step plan is caught by the run's history, a database dump is stopped at the MCP gateway, and Yenop refuses to let the agent switch it off. Every verdict is the real engine.
+
+## Why this exists
+
+Companies are giving agents real access: the shell, the repository, the database, the cloud. An agent is helpful, but it does what it is told, including by a web page or a document carrying a hidden instruction. And the newest models reason in ways you cannot read or log, so you cannot audit the thinking. You can only govern the actions. That is the one place left to put a control, and it is where Yenop sits.
+
+Yenop's claim is deliberately narrow and provable: **a model's decision is never the final authorization decision.** Whatever the agent was convinced to attempt, the deed still has to pass a deterministic rule, and a person still signs off on the irreversible ones.
+
+## Why another layer?
+
+Your agent already has permissions. Cursor has run modes. Codex has a sandbox. MCP servers describe their own tools. Cloud platforms have IAM. So why install one more thing?
+
+Because each of those controls part of the execution path, and each is owned by the party it governs. A runtime's permission system changes with its next release. A tool server's "read-only" hint is the server's word. A model's judgement is the thing being attacked. None of them is independent of the agent, and none of them is the same across the three agents your team runs on the same repository.
+
+Yenop adds an independent enforcement boundary, outside the agent, that stays the same when the runtime, the model, or the tool server changes. One policy, one record, whichever agent acted. It does not replace those controls; it is the layer that is still there when they differ, update, or are talked around.
+
+## Who this is for
+
+Developers and security-minded teams giving coding agents, MCP tools, and autonomous workflows real access: a repository, credentials, a database, infrastructure. If an agent on your machine can reach something you would not want it to touch unasked, Yenop is for you.
+
+## Quickstart
+
+From npm, once published:
+
+```sh
+npm install -g yenop
+yenop init            # sets up ~/.yenop and installs the hook for every agent it detects
+```
+
+From source, today:
+
+```sh
+npm install && npm run build && npm link
+yenop init            # detects Claude Code, Cursor, Codex, Gemini; installs each hook
+yenop status          # mode, layers, daemon, and which agents are covered
+yenop explain Bash '{"command":"terraform destroy -auto-approve"}'
+```
+
+From then on, every action an agent takes in this project passes through Yenop first:
+
+| The agent tries | Yenop says |
+|---|---|
+| `npm test`, editing a source file, reading the README | nothing; the agent's normal flow applies |
+| `terraform destroy`, `DROP TABLE`, a forced push, writing outside the project, an MCP tool that writes | **ask**: the agent shows the exact action and waits for a person |
+| a scanner, exploitation framework, credential cracker, or a reverse shell (`nmap`, `sqlmap`, `hashcat`, `bash -i >& /dev/tcp/...`) | **ask**: dual-use, so a person signs off |
+| reading a private key or `.env`, piping a download into a shell, sending a credential over the network | **deny**: blocked, with the policy named |
+| inline code handed to an interpreter (`python -c`, `eval`) that touches a protected file | **ask** or **deny**: opaque code is judged by what it names |
+| a run that has been denied 20 times, or has made 1,000 calls | **deny**: the breaker halts the run |
+
+Yenop only ever tightens. It never grants something the agent would have asked about on its own.
+
+## Watch it happen
+
+```sh
+yenop viewer --open
+```
+
+A read-only web page of the receipts, on this machine only, updating every couple of seconds: green allowed, amber needs a person, red blocked, each with the reason and the recorded answer. Off the decision path, writes nothing. Put it beside your agent during a demo.
+
+Roll it out without breaking anyone's flow: **observe mode** records decisions without blocking. Run it for a week, read what would have been stopped, tune the policies, then switch to enforce.
+
+## Read the week
+
+```sh
+yenop report            # last 7 days, this project
+yenop report --days 30 --all
+```
+
+Counts by verdict, by rule, by runtime and by kind of action, from the receipts on this machine. The line that matters is the **ask approval rate**: of the calls held for a person, how many the person then allowed. Near 100 % means a rule asks too often; near 0 % means the asks were real catches. That is how the baseline gets tuned by evidence rather than opinion. `yenop feedback` opens the discussion board for the things a number cannot say.
+
+**Telemetry is off by default and stays off unless you turn it on.** `yenop telemetry enable` sends the report's numbers once a day; `yenop telemetry status` prints the exact payload; `disable` stops it; `reset` issues a new random install id. What is sent is an allow-list, built in [`src/core/telemetry.ts`](src/core/telemetry.ts): counts by verdict, rule id, runtime and tool kind, the Yenop version, the operating system name and major version, which runtimes are hooked, and a random install id. Never a command, a path, a prompt, source, a hostname, a username, a project or tenant name, a receipt, or an MCP argument. A field not listed there does not leave the machine.
+
+---
+
+## Every agent, one engine
+
+Yenop turns each runtime's event into one canonical action, so the engine, the policies, the run state and the receipts never know which agent produced it. A rule written once applies to all of them.
+
+**Claude Code.** A PreToolUse hook decides before each tool runs, and later events record whether the call ran, failed, or was refused. Silent on allow, a prompt on ask, a block on deny.
+
+**Cursor.** `yenop init` writes `.cursor/hooks.json`. Cursor sends every tool call through `preToolUse` first, then through a specialised hook for shell and MCP calls that can ask a person, so Yenop judges everything at the first gate and lets an ask through to the second, where Cursor shows it as "Pending approval… Hook requested approval: Yenop: …", even in its Run Everything mode. File edits can only be allowed or denied there, so an edit that needs a person is blocked with a message rather than let through. Every hook is fail-closed, so a crash or timeout blocks. Verified in a live session against Cursor 3.21.18: allow, ask, deny on a secret read, and an attempt to edit its own hook file refused. Two facts about Cursor itself: its documentation describes the specialised hooks as the gates, but `preToolUse` fires first and a hook that stays silent there blocks the call, which is how the first version of this adapter failed, safely; and when a person clicks Skip on an approval, Cursor reports the command to hooks exactly as if it had run with no output, so on Cursor "approved, ran" in a receipt means "Cursor reported it complete", nothing more.
+
+**Codex CLI.** `yenop init` writes `.codex/hooks.json`. Shell commands, `apply_patch` edits and MCP calls are judged, and a patch touching several files is judged by the strictest of them. Two facts about Codex itself: it has no way to ask a person from a hook, so a step that needs one is blocked with a message; and it ignores a hook that crashes or times out. Be precise about whose guarantee is whose: **Yenop's boundary is fail-closed**, a decision it cannot make is a deny; **Codex's runtime is fail-open**, it proceeds if the hook itself does not answer. Yenop answers with the one signal Codex always honours and is built to answer every time, but it cannot change Codex's design, and we say so rather than imply otherwise. Proven against a live model that tried to route around a blocked edit through an interpreter, and was stopped.
+
+**Gemini CLI.** `yenop init` writes the hooks into `.gemini/settings.json`. Every built-in tool (shell, file reads and writes, `read_many_files`, `save_memory`, web fetch and search) and every MCP tool is judged before it runs, and Gemini honours all three answers: allow silently, **ask** by forcing its own confirmation prompt even in an auto-approve mode, deny with the reason handed to the model. Two facts about Gemini itself, read from its source rather than its docs: a hook that times out or fails to start is ignored, so Gemini's runtime is fail-open like Codex's, and Yenop answers with JSON on exit 0 for every verdict including its own failure, the one path Gemini honours without ambiguity; and Gemini skips a project's hooks in a folder it does not trust and shows new hooks for review, so `yenop status` reads both switches and says when nothing is enforced. Verified in a live session against Gemini CLI 0.60.0 with auto-approve on and no sandbox: allow silent, deny with the reason, ask shown as Gemini's own dialog with the run's history in it, and the ask comes back even after a person picked "Allow for this session", so Gemini's convenience switch never bypasses Yenop. The recorded events are the fixtures. One honest note: the model itself refused to read `.env` before any tool call; Yenop's deny was exercised on a `.npmrc`. A model's refusal is a mood, not a boundary, which is the point.
+
+**OpenAI Agents SDK.** An agent you build with `@openai/agents` runs in your own process, so Yenop runs there too, as a pair of tool guardrails: the input guardrail decides, the output guardrail records what happened.
+
+```ts
+import { tool } from "@openai/agents";
+import { yenopGuardrails } from "yenop/openai-agents";
+
+const guard = yenopGuardrails({
+  tools: { run_shell: { kind: "shell" }, write_file: { kind: "write" }, fetch_url: { kind: "web", readOnly: true } },
+  onAsk: async (decision) => askInTerminal(decision.message), // or Slack, or your approval UI
+});
+const runShell = tool({ name: "run_shell", /* ... */ inputGuardrails: guard.inputGuardrails, outputGuardrails: guard.outputGuardrails });
+```
+
+Your tools are your own functions, so `tools` says what each can do; one you leave out is judged as unknown and held for a person. A guardrail cannot ask anyone by itself: `onAsk` is where you route an ask, and without it an ask is refused, never let through. A deny reaches the agent as a rejection with the reason, so it can do something else, or as the SDK's tripwire exception with `onDeny: "throw"`. One SDK run is one Yenop run, so the run-level rules follow the agent across its calls. No dependency on the SDK: the types are structural, checked against `@openai/agents-core` 0.18.0, and verified with the real SDK: [`examples/openai-agents/`](examples/openai-agents/) is a forty-line agent whose `npm test` ran, whose `.npmrc` read was refused with the reason handed back to the model, and whose `rm -rf build` waited on a person in the terminal.
+
+**Any MCP agent: the gateway.** Point the client at Yenop instead of at the tool server:
+
+```json
+{ "mcpServers": {
+  "supabase": { "command": "yenop", "args": ["mcp", "--server", "supabase", "--", "npx", "-y", "@supabase/mcp-server"] }
+} }
+```
+
+Yenop launches the real server, forwards every message, and runs a decision on each `tools/call`. Allowed calls go through untouched; blocked ones never reach the server, and the client gets a tool error with the reason. This is where the trusted-backend attacks land: an injected instruction telling the agent to dump a database through a Supabase server, or exfiltrate a repo through a GitHub server. The server would obey. The gateway does not. When a call needs a person, the gateway asks through the client using MCP elicitation, speaking both protocol generations; a client that cannot show forms gets `--on-ask block` or `--on-ask allow`. Under Claude Code the hook already gates MCP calls, so run the gateway there with `--on-ask allow`; it earns its keep with clients that have no hook.
+
+## How it decides
+
+```
+action → budget breakers → permit policies → approval policies → receipt → allow / ask / deny
+```
+
+**Shell commands are parsed, not pattern-matched.** Yenop splits a command into programs and arguments, follows `sudo`, `xargs`, `bash -c`, `$(...)`, variables and redirects, ignores heredoc bodies and comments, and exposes facts like `context.shell.destructive`, `context.shell.secretPath`, `context.shell.opaque` and `context.shell.ops`. A README that mentions `rm -rf` is a write to a README; a public key is not a secret. Code handed to an interpreter is not read as shell but treated as opaque and judged by what it names, so obfuscation becomes the reason a person is asked. This is checked by property tests that generate about fourteen thousand disguised commands on every push, and by an adversarial harness that lets a real model try to find a route.
+
+**Decisions look at the run, not only at the call.** A model that plans where nobody can see can split a harmful plan into steps that each look harmless: read a forum page, dump the environment, fetch a URL. Every run remembers two sticky facts, whether it has taken in **untrusted content** and whether it has touched **sensitive data**, and every call is described by its flow: does it reach an external host, send data out, change state. The baseline asks a person before any external network call once sensitive data is in play, and names the shape, untrusted input plus sensitive data plus a way out, as `lethal-trifecta` in the receipt. A run left idle expires, so a crashed session never taints a later one.
+
+**An ask carries the run's history.** The person deciding cannot see the model's reasoning, so the prompt says which earlier steps made the run untrusted or sensitive and what it did just before. The receipt then records the answer, and whether the call went on to run or fail.
+
+**Yenop protects itself.** An agent told "no" may be told, by whoever is manipulating it, to change the rules. So any change to Yenop's own files needs a person: the `.yenop` folders and policies, the mode, the daemon, and the hook registration files of every agent. Looking is free.
+
+## Policies
+
+Policies come in layers evaluated together: the **baseline** shipped in [`policies/`](policies/) and updated with each release, your **home** layer in `~/.yenop/policies/`, and a **project** layer committed with the code. Add a file to tighten. To loosen a baseline rule, switch it off by id with `"disabledPolicies": ["..."]`; the shipped files are never edited in place. Two folders, two questions: `permit/` asks "may this happen at all", `approve/` asks "must a person see it first". The vocabulary is frozen in [`policies/schema.cedarschema`](policies/schema.cedarschema) and every layer is validated against it on load. See [policies/README.md](policies/README.md).
+
+**Fail closed.** Any evaluation error is a deny. A policy file that does not parse or does not match the vocabulary makes Yenop refuse every action in that project, naming the file and error, while keeping `yenop check`, `status` and `receipts` working so a person can fix it. A guard that cannot read its rules must not wave things through.
+
+## Tamper-evident receipts
+
+The receipts file is a hash chain: each line carries the hash of the line before it, so editing, deleting, or reordering any line is detectable.
+
+```sh
+yenop receipts --verify
+```
+
+reports an unbroken chain, or names the first broken line and exits non-zero. This turns the log from "trust us" into evidence a third party can check. It is local tamper-evidence, not a signature: it catches changes to the recorded history; anchoring the head against a wholesale rewrite is the control plane's job.
+
+## What it protects against, and what it does not
+
+A security tool should say both. Yenop governs agent execution on a machine you control.
+
+**It protects against**
+
+- tool misuse after a prompt injection: an agent convinced to act still has to pass a rule
+- unauthorized destructive commands, and writes outside the project
+- reads of secret files and credential stores, however the path is spelled or reached
+- exfiltration paths: a credential over the network, a download piped into a shell, an outside call after sensitive data
+- multi-step attack chains that look harmless one call at a time
+- tool servers overreaching what they claimed to cover
+- an agent editing Yenop's own rules or hook registration to switch it off
+- runaway loops, by per-run budgets
+
+**It does not claim to protect against**
+
+- a person with root on the machine, or an attacker who already has it: they can remove Yenop like any other program
+- a compromised operating system or a compromised Yenop binary
+- vulnerabilities inside a tool that was legitimately allowed to run
+- actions taken through a path Yenop is not hooked into, such as an agent Yenop does not yet support, or a runtime that ignores a hook by design (Codex, see above)
+- a wholesale rewrite of the receipts file from scratch: the chain catches edits, deletions and reordering locally; anchoring the head against a full rewrite is the control plane's job
+
+Yenop governs agent execution. It does not govern a compromised host.
+
+## The daemon
+
+Opening the policies, the Cedar engine and the state database costs about 100 ms from scratch. Yenop keeps a small resident service on `127.0.0.1` that holds everything warm and decides in about a millisecond.
+
+| Path | Round trip | When |
+|---|---|---|
+| HTTP hook, posts straight to the daemon | ~1 ms | `yenop init --hook http` |
+| Command hook, forwards over a raw socket | ~45 ms, almost all Node starting | default |
+| Command hook, no daemon | ~120 ms, then it starts one for next time | fallback |
+
+The command hook is the default because it cannot fail open: with no daemon it decides in-process. `yenop service install` hands the daemon to the operating system's supervisor (launchd on macOS, a systemd user service on Linux) so it stays up; do that before making the HTTP hook the default. The daemon serves every project, reloads within a second of a policy change, keeps its port and token across restarts, retires itself when Yenop is rebuilt, and binds only loopback behind a token.
+
+## On-prem and offline
+
+Yenop is built to run where you cannot reach a cloud. `npm run pack:offline` produces a self-contained bundle that installs on an air-gapped machine with only Node. Nothing it does requires a network. See [docs/on-prem.md](docs/on-prem.md) for the air-gapped install, running the daemon under a supervisor, platform support, and sending receipts to a SIEM.
+
+## Try it safely
+
+```sh
+yenop playground     # ~/yenop-playground: fake infra, .env, build output, enforcement on
+```
+
+Open that folder in an agent and ask it to delete the build folder, run `terraform destroy`, or print the database password. Delete the folder when done.
+
+## Formats and versions
+
+| Thing | Version field | Where |
+|---|---|---|
+| Receipts | `v` and a `prev` hash on every line | `~/.yenop/receipts.jsonl` |
+| Config files | `v` | `~/.yenop/config.json`, `<project>/.yenop/config.json` |
+| State database | `PRAGMA user_version` | `~/.yenop/state.db` |
+| Policy vocabulary | comment header | `policies/schema.cedarschema` |
+
+A file newer than the running Yenop understands is an error, never a silent misread.
+
+## Layout
+
+```
+src/core/       decision engine, Cedar evaluation, run state (SQLite), receipts (JSONL)
+src/adapters/   one thin adapter per runtime, on a shared hook pipeline
+src/daemon/     the resident decision service, its client, and the raw-socket fast path
+src/viewer/     the read-only receipts page
+src/cli/        the yenop command
+policies/       the default policy pack and the vocabulary
+fixtures/       hook events recorded from each runtime, replayed on every push
+examples/       small agents with Yenop in front of them (OpenAI Agents SDK)
+harness/        the adversarial harness: a real model as red-teamer
+site/           yenop.com
+```
+
+Design references: OWASP AISVS control group C09, the MCP specification, Cedar, AuthZEN, RFC 8693.
+
+## License
+
+Yenop is source-available under the [Functional Source License, Version 1.1, with Apache 2.0 as the future license](LICENSE.md) (FSL-1.1-ALv2).
+
+- You may read, install, run, modify and redistribute it, including inside your company and for your customers' internal use.
+- You may not offer it, or something substantially similar built from it, as a competing commercial product or service.
+- Every release becomes Apache 2.0 two years after it is published.
+
+Organization features, such as shared approvals, central policy, cross-runtime receipts and the enterprise build, are separate commercial products. "Yenop" is a trademark; forks must use another name.
 
 https://yenop.com

package/dist/adapters/claude-code/hook.d.ts

@@ -0,0 +1,43 @@
+import type { DecisionRequest } from "../../core/types.js";
+import { readStdin as readStdinShared, type HookEvent, type HookRunResult, type HookTranslator } from "../hooks/pipeline.js";
+export interface ClaudeCodeHookInput {
+    session_id: string;
+    cwd?: string;
+    permission_mode?: string;
+    hook_event_name?: string;
+    tool_name: string;
+    tool_input?: Record<string, unknown>;
+    tool_use_id?: string;
+    agent_id?: string;
+    agent_type?: string;
+    /** PermissionDenied only. */
+    denial_reason?: string;
+}
+/** Events Claude Code sends after the decision, and what each says about the call. */
+export declare const OUTCOME_EVENTS: Record<string, "ran" | "failed" | "denied">;
+export declare function runIdOf(input: ClaudeCodeHookInput): string;
+export interface ClaudeCodeHookOutput {
+    hookSpecificOutput: {
+        hookEventName: "PreToolUse";
+        permissionDecision: "allow" | "deny" | "ask";
+        permissionDecisionReason: string;
+    };
+}
+export declare function toDecisionRequest(input: ClaudeCodeHookInput): DecisionRequest;
+export type { HookRunResult };
+/**
+ * The JSON Claude Code should receive, or null when Yenop has nothing to say
+ * (allow, or observe mode). Shared by the command hook and the daemon's HTTP hook.
+ */
+export declare function hookDecisionBody(effect: "allow" | "deny" | "ask", message: string, mode: "enforce" | "observe"): ClaudeCodeHookOutput | null;
+/** Command-hook rendering: nothing on allow, JSON on ask, JSON plus exit 2 on deny. */
+export declare function renderHookResult(effect: "allow" | "deny" | "ask", message: string, mode?: "enforce" | "observe"): HookRunResult;
+/**
+ * Parse a Claude Code hook event. Throws on input that is not Claude Code's JSON, so the pipeline fails closed:
+ * a permission hook that cannot read its input must block, not shrug.
+ */
+export declare function parseClaudeCode(raw: string): HookEvent;
+export declare const claudeCodeTranslator: HookTranslator;
+/** Command hook entry point: the shared pipeline with the Claude Code translator. */
+export declare function runHook(raw: string): Promise<HookRunResult>;
+export declare const readStdin: typeof readStdinShared;

package/dist/adapters/claude-code/hook.js

@@ -0,0 +1,101 @@
+/**
+ * Claude Code PreToolUse adapter.
+ * stdin: the hook JSON Claude Code sends. stdout: a hook decision, or nothing to defer to Claude Code's own flow.
+ * Yenop only ever tightens: on allow it prints nothing, on ask it asks, on deny it blocks (exit 2 + JSON reason).
+ */
+import { classifyTool } from "../../core/tools.js";
+import { runHookWith, safeUser, readStdin as readStdinShared } from "../hooks/pipeline.js";
+/** Events Claude Code sends after the decision, and what each says about the call. */
+export const OUTCOME_EVENTS = {
+    PostToolUse: "ran",
+    PostToolUseFailure: "failed",
+    PermissionDenied: "denied",
+};
+export function runIdOf(input) {
+    return `claude-code:${input.session_id}`;
+}
+export function toDecisionRequest(input) {
+    const req = {
+        runId: runIdOf(input),
+        principal: {
+            runtime: "claude-code",
+            agent: input.agent_type ? `subagent:${input.agent_type}` : "main",
+            user: safeUser(),
+        },
+        tool: classifyTool(input.tool_name),
+        args: input.tool_input ?? {},
+    };
+    if (input.cwd !== undefined)
+        req.cwd = input.cwd;
+    if (input.permission_mode !== undefined)
+        req.permissionMode = input.permission_mode;
+    if (input.tool_use_id !== undefined)
+        req.callId = input.tool_use_id;
+    return req;
+}
+/**
+ * The JSON Claude Code should receive, or null when Yenop has nothing to say
+ * (allow, or observe mode). Shared by the command hook and the daemon's HTTP hook.
+ */
+export function hookDecisionBody(effect, message, mode) {
+    if (mode === "observe" || effect === "allow")
+        return null;
+    return {
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: effect,
+            permissionDecisionReason: `Yenop: ${message}`,
+        },
+    };
+}
+/** Command-hook rendering: nothing on allow, JSON on ask, JSON plus exit 2 on deny. */
+export function renderHookResult(effect, message, mode = "enforce") {
+    const body = hookDecisionBody(effect, message, mode);
+    if (!body)
+        return { stdout: "", exitCode: 0 };
+    return { stdout: JSON.stringify(body), exitCode: effect === "deny" ? 2 : 0 };
+}
+function renderFromBody(body) {
+    if (!("hookSpecificOutput" in body))
+        return { stdout: "", exitCode: 0 };
+    return { stdout: JSON.stringify(body), exitCode: body.hookSpecificOutput.permissionDecision === "deny" ? 2 : 0 };
+}
+/**
+ * Parse a Claude Code hook event. Throws on input that is not Claude Code's JSON, so the pipeline fails closed:
+ * a permission hook that cannot read its input must block, not shrug.
+ */
+export function parseClaudeCode(raw) {
+    const input = JSON.parse(raw); // throws → deny
+    if (typeof input.tool_name !== "string" || typeof input.session_id !== "string")
+        throw new Error("claude-code hook event without tool_name/session_id");
+    const outcome = OUTCOME_EVENTS[input.hook_event_name ?? ""];
+    if (outcome) {
+        if (!input.tool_use_id)
+            return { kind: "ignore" };
+        const ev = { kind: "outcome", runId: runIdOf(input), callId: input.tool_use_id, tool: input.tool_name, outcome };
+        if (input.denial_reason !== undefined)
+            ev.detail = input.denial_reason;
+        if (input.cwd !== undefined)
+            ev.cwd = input.cwd;
+        return ev;
+    }
+    if (input.hook_event_name !== undefined && input.hook_event_name !== "PreToolUse")
+        return { kind: "ignore" };
+    return { kind: "decision", event: "PreToolUse", askCapable: true, request: toDecisionRequest(input) };
+}
+export const claudeCodeTranslator = {
+    runtime: "claude-code",
+    parse: parseClaudeCode,
+    body: (effect, message, mode) => hookDecisionBody(effect, message, mode),
+    result: (body) => renderFromBody((body ?? {})),
+    failure: (reason) => ({
+        stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: `Yenop failed and refuses by default: ${reason}. Run "yenop status".` } }),
+        exitCode: 2,
+    }),
+};
+/** Command hook entry point: the shared pipeline with the Claude Code translator. */
+export function runHook(raw) {
+    return runHookWith(claudeCodeTranslator, raw);
+}
+export const readStdin = readStdinShared;
+//# sourceMappingURL=hook.js.map

package/dist/adapters/claude-code/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/adapters/claude-code/hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,IAAI,eAAe,EAA2D,MAAM,sBAAsB,CAAC;AAgBpJ,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAgD;IACzE,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,QAAQ;IAC5B,gBAAgB,EAAE,QAAQ;CAC3B,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,KAA0B;IAChD,OAAO,eAAe,KAAK,CAAC,UAAU,EAAE,CAAC;AAC3C,CAAC;AAUD,MAAM,UAAU,iBAAiB,CAAC,KAA0B;IAC1D,MAAM,GAAG,GAAoB;QAC3B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,SAAS,EAAE;YACT,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM;YACjE,IAAI,EAAE,QAAQ,EAAE;SACjB;QACD,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;KAC7B,CAAC;IACF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACjD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,eAAe,CAAC;IACpF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAKD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgC,EAAE,OAAe,EAAE,IAA2B;IAC7G,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,UAAU,OAAO,EAAE;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,MAAgC,EAAE,OAAe,EAAE,OAA8B,SAAS;IACzH,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,IAAkD;IACxE,IAAI,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC,CAAC,gBAAgB;IACtE,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxJ,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClD,MAAM,EAAE,GAAc,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QAC5H,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,EAAE,CAAC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;QACvE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAChD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7G,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,CAAC,MAAgC,EAAE,OAAe,EAAE,IAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAmC;IAClJ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,IAAI,EAAE,CAAiD,CAAC;IAC9F,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,wCAAwC,MAAM,uBAAuB,EAAE,EAAE,CAAC;QAC5M,QAAQ,EAAE,CAAC;KACZ,CAAC;CACH,CAAC;AAEF,qFAAqF;AACrF,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC"}

package/dist/adapters/claude-code/install.d.ts

@@ -0,0 +1,23 @@
+/** Any command that ends in this is ours, whatever path the CLI lives at. */
+export declare const YENOP_HOOK_MARKER = "hook claude-code";
+/**
+ * The command Claude Code should run. When `yenop` on PATH is this very build (a global npm
+ * install or `npm link`), use the short form so the settings file carries no machine path.
+ * Otherwise fall back to node plus the absolute path of this build.
+ */
+export declare function hookCommandFor(cliPath: string, runtime?: string): string;
+/**
+ * Install the HTTP form of the hook: Claude Code posts straight to the daemon, no process spawn.
+ * The token lives in the settings file, which is why this form belongs in settings.local.json or the user file.
+ */
+export declare function installClaudeCodeHttpHook(settingsPath: string, port: number, token: string): {
+    changed: boolean;
+    path: string;
+};
+export declare function installClaudeCodeHook(settingsPath: string, command: string): {
+    changed: boolean;
+    path: string;
+};
+/** PreToolUse decides. The others only report what became of the call, so they run without making the agent wait. */
+export declare const DECISION_EVENT = "PreToolUse";
+export declare const REPORT_EVENTS: string[];

package/dist/adapters/claude-code/install.js

@@ -0,0 +1,86 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+/** Any command that ends in this is ours, whatever path the CLI lives at. */
+export const YENOP_HOOK_MARKER = "hook claude-code";
+/**
+ * The command Claude Code should run. When `yenop` on PATH is this very build (a global npm
+ * install or `npm link`), use the short form so the settings file carries no machine path.
+ * Otherwise fall back to node plus the absolute path of this build.
+ */
+export function hookCommandFor(cliPath, runtime = "claude-code") {
+    try {
+        const which = execFileSync("sh", ["-lc", "command -v yenop"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        if (which && realpathSync(which) === realpathSync(cliPath))
+            return `yenop hook ${runtime}`;
+    }
+    catch {
+        /* not on PATH */
+    }
+    return `node ${JSON.stringify(cliPath)} hook ${runtime}`;
+}
+/**
+ * Add the Yenop PreToolUse hook to a Claude Code settings file.
+ * Project scope uses .claude/settings.local.json so the machine-specific command path is never committed.
+ * Idempotent: an existing Yenop entry is replaced, other hooks are left alone.
+ */
+function isOurs(h) {
+    if (h.type === "http")
+        return (h.url ?? "").includes("/hooks/claude-code");
+    return (h.command ?? "").trim().endsWith(YENOP_HOOK_MARKER);
+}
+/**
+ * Install the HTTP form of the hook: Claude Code posts straight to the daemon, no process spawn.
+ * The token lives in the settings file, which is why this form belongs in settings.local.json or the user file.
+ */
+export function installClaudeCodeHttpHook(settingsPath, port, token) {
+    const entry = {
+        type: "http",
+        url: `http://127.0.0.1:${port}/hooks/claude-code`,
+        headers: { Authorization: `Bearer ${token}` },
+        timeout: 10,
+        statusMessage: "Yenop is checking this action",
+    };
+    return installEntry(settingsPath, entry);
+}
+export function installClaudeCodeHook(settingsPath, command) {
+    const entry = { type: "command", command, timeout: 15, statusMessage: "Yenop is checking this action" };
+    return installEntry(settingsPath, entry);
+}
+/** PreToolUse decides. The others only report what became of the call, so they run without making the agent wait. */
+export const DECISION_EVENT = "PreToolUse";
+export const REPORT_EVENTS = ["PostToolUse", "PostToolUseFailure", "PermissionDenied"];
+function installEntry(settingsPath, entry) {
+    let settings = {};
+    if (existsSync(settingsPath)) {
+        settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+    }
+    else {
+        mkdirSync(join(settingsPath, ".."), { recursive: true });
+    }
+    settings.hooks ??= {};
+    let changed = false;
+    const put = (event, e) => {
+        const groups = (settings.hooks[event] ??= []);
+        const existing = groups.find((g) => g.hooks.some(isOurs));
+        if (existing) {
+            const same = existing.matcher === "*" && existing.hooks.length === 1 && JSON.stringify(existing.hooks[0]) === JSON.stringify(e);
+            if (same)
+                return;
+            existing.matcher = "*";
+            existing.hooks = [e];
+        }
+        else {
+            groups.push({ matcher: "*", hooks: [e] });
+        }
+        changed = true;
+    };
+    put(DECISION_EVENT, entry);
+    const { statusMessage: _quiet, ...report } = entry;
+    for (const ev of REPORT_EVENTS)
+        put(ev, { ...report, async: true });
+    if (changed)
+        writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
+    return { changed, path: settingsPath };
+}
+//# sourceMappingURL=install.js.map

package/dist/adapters/claude-code/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/adapters/claude-code/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAqBlD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAO,GAAG,aAAa;IACrE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChI,IAAI,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,cAAc,OAAO,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAY;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAoB,EAAE,IAAY,EAAE,KAAa;IACzF,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,oBAAoB,IAAI,oBAAoB;QACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,+BAA+B;KAC/C,CAAC;IACF,OAAO,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,OAAe;IACzE,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,+BAA+B,EAAE,CAAC;IACnH,OAAO,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;AAEvF,SAAS,YAAY,CAAC,YAAoB,EAAE,KAAgB;IAC1D,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAa,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,CAAY,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChI,IAAI,IAAI;gBAAE,OAAO;YACjB,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;YACvB,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;IACF,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC;IACnD,KAAK,MAAM,EAAE,IAAI,aAAa;QAAE,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO;QAAE,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACzC,CAAC"}

package/dist/adapters/codex/hook.d.ts

@@ -0,0 +1,7 @@
+import type { Mode } from "../../core/config.js";
+import { type Effect, type HookEvent, type HookTranslator } from "../hooks/pipeline.js";
+/** The files a patch touches, from its headers. Exported so a recorded apply_patch event can be checked against it. */
+export declare function pathsInPatch(patch: string): string[];
+export declare function parseCodex(raw: string): HookEvent;
+export declare function codexBody(effect: Effect, message: string, mode: Mode): Record<string, unknown> | null;
+export declare const codexTranslator: HookTranslator;