hx-cli 0.2.2__tar.gz → 0.2.3__tar.gz

{hx_cli-0.2.2 → hx_cli-0.2.3}/CHANGELOG.md

@@ -28,6 +28,47 @@ the project follows [semantic versioning](https://semver.org/).
 
 ---
 
+## [0.2.3] - 2026-09-18
+
+### Added
+
+- Hooks: shell commands HX runs at `PreToolUse`, `PostToolUse`,
+  `UserPromptSubmit` and `Stop`. A hook can refuse an action (exit 2, or
+  `{"decision": "block"}`), rewrite a tool's arguments before the permission
+  engine sees them (`updatedInput`), or add a note for the model
+  (`additionalContext`). Configure them under `"hooks"` in
+  `~/.hx/settings.json`; `/hooks` lists what is loaded. Hooks declared in a
+  project's checked-in `.hx/settings.json` are ignored and reported, because
+  cloning a repository must not be enough to run commands on your machine.
+- `Symbols`: outline a file, find where a name is defined, or find where it is
+  used, over a tree-sitter parse tree rather than a regex - so a match inside a
+  comment or a string never counts. Python, TypeScript, JavaScript, Go and
+  Rust. Needs the grammars: `uv tool install "hx-cli[symbols]"`. Without them
+  the tool is not registered at all.
+- An example hook, `examples/hooks/check.sh`: after every `Edit`/`Write` it
+  runs the project's own checker (`ruff`, `tsc`, `go vet`, `cargo check`)
+  against just that file and hands the output back to the model, so a typo is
+  caught on the next turn instead of at test time.
+- Line anchors. `Read` now labels each line with a short content hash, and
+  `Edit` accepts those anchors in a `hashline` argument to replace a span
+  without retyping it. An anchor that no longer resolves means the file moved,
+  so the patch is rejected instead of landing at the wrong lines. Set
+  `"tools": {"hashline": false}` to go back to plain `cat -n` reads.
+
+### Removed
+
+- The `telemetry` setting, which was parsed and never read by anything.
+
+### Fixed
+
+- The README's Status section said there were two model routes; Devin made it
+  three in 0.2.2.
+- `MultiEdit` and `NotebookEdit` were listed as mutating tools and as edit
+  tools in the permission engine, but no such tools exist. A rule written
+  against either name silently matched nothing.
+
+---
+
 ## [0.2.2] - 2026-09-17
 
 ### Added
@@ -440,7 +481,8 @@ First release, published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/)
 - `/configure` and `hx auth` for the OpenRouter key, `hx upgrade` for
   self-update, and `install.sh` bootstrapping uv with a pinned Python.
 
-[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/aletisunil/hx/compare/v0.2.3...HEAD
+[0.2.3]: https://github.com/aletisunil/hx/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/aletisunil/hx/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/aletisunil/hx/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/aletisunil/hx/compare/v0.1.9...v0.2.0

{hx_cli-0.2.2 → hx_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hx-cli
-Version: 0.2.2
+Version: 0.2.3
 Summary: HX - an agent harness for the terminal
 Project-URL: Homepage, https://github.com/aletisunil/hx
 Project-URL: Issues, https://github.com/aletisunil/hx/issues
@@ -14,7 +14,6 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.11
-Requires-Dist: click>=8.1
 Requires-Dist: httpx>=0.27
 Requires-Dist: markdown-it-py>=3.0
 Requires-Dist: pydantic>=2.7
@@ -31,6 +30,9 @@ Requires-Dist: pytest>=8.2; extra == 'dev'
 Requires-Dist: ruff>=0.6; extra == 'dev'
 Requires-Dist: types-pygments; extra == 'dev'
 Requires-Dist: types-pyyaml; extra == 'dev'
+Provides-Extra: symbols
+Requires-Dist: tree-sitter-language-pack>=0.7; extra == 'symbols'
+Requires-Dist: tree-sitter>=0.23; extra == 'symbols'
 Description-Content-Type: text/markdown
 
 # HX
@@ -438,6 +440,7 @@ than being silently resolved.
 | `/skills` | installed skills |
 | `/agents` | subagent types |
 | `/mcp` | server status |
+| `/hooks` | configured hooks, and any that were refused |
 | `/theme [name]` | `dark`, `light`, `ansi`, or any theme in `~/.hx/themes` |
 | `/queue [steer <n>\|clear]` | messages waiting for the turn to end, and what to do with them |
 | `/copy` | copy the last reply to the clipboard |
@@ -555,7 +558,6 @@ along with the `.hx/.gitignore` it added to hide it.
 {
   "theme": "dark",                    // dark | light | ansi, or a file in ~/.hx/themes
   "quiet_startup": false,             // skip the startup header
-  "telemetry": false,
 
   "models": {
     "model": "anthropic/claude-sonnet-4.5",
@@ -598,10 +600,18 @@ along with the `.hx/.gitignore` it added to hide it.
   "tui": {
     "enterWhileBusy": "queue",        // queue | steer - what enter does mid-turn
     "fullscreen": false               // true takes the whole window (see /fullscreen)
+  },
+
+  "tools": {
+    "hashline": true                  // Read labels lines with content anchors Edit accepts
   }
 }
 ```
 
+`hooks` is configured in the same files but is deliberately not part of this
+merge: it is read per layer, and only from your own settings. See
+[Extending it](#extending-it).
+
 Environment overrides: `HX_MODEL`, `HX_SUBAGENT_MODEL`, `HX_MAX_TOKENS`,
 `HX_PERMISSION_MODE`, `HX_SANDBOX`, `HX_COMPACT_AT`, `HX_GIT_NOTICES`,
 `HX_THEME`, `HX_QUIET_STARTUP`. Also `HX_HOME` to relocate user state, `HX_TAVILY_API_KEY`
@@ -762,6 +772,54 @@ rest to the session directory, and hands the model that path to grep.
 
 ---
 
+## Reading and editing code
+
+**Line anchors.** `Read` labels every line with a short content hash:
+
+```
+     1 a3f9	def handle(request):
+     2 7c1c	    if request.method == "POST":
+```
+
+The anchor is a hash of the line and its two neighbours, truncated to the
+narrowest width that is unambiguous in that file. `Edit` takes those anchors
+instead of retyped content:
+
+```json
+{ "file_path": "app.py", "hashline": [{ "start": "a3f9", "end": "7c1c", "new_string": "..." }] }
+```
+
+The span is inclusive; omit `end` to replace one line, pass an empty
+`new_string` to delete. Anchors are recomputed from disk when the edit runs, so
+a file that moved under the model fails to resolve and the patch is rejected
+rather than applied at stale coordinates. Exact-match `old_string` still works
+and is unchanged; anchors are a second shape, not a replacement. Turn the whole
+thing off with `"tools": {"hashline": false}` and reads go back to plain
+`cat -n`.
+
+**Symbols** answers structural questions with a parse tree rather than a
+regex — three modes, `outline` for one file's shape, `definition` for where a
+name is defined, `references` for where it is used:
+
+```
+Symbols(mode="references", symbol="handle")
+```
+
+Because it matches identifier nodes, the same word in a comment or a string
+literal never matches. It cannot resolve types, so an unrelated symbol with the
+same name in another file still does; it is tighter than `Grep`, not a language
+server. Python, TypeScript, JavaScript, Go and Rust.
+
+It needs grammars that are not installed by default, and the tool is simply not
+registered without them — its schema never enters the cached prefix advertising
+something that cannot run:
+
+```sh
+uv tool install "hx-cli[symbols]"
+```
+
+---
+
 ## Extending it
 
 **Skills** are directories containing `SKILL.md` with YAML frontmatter:
@@ -818,6 +876,68 @@ Or `hx mcp add local python server.py`. Tools arrive namespaced
 with a per-server timeout; one that is broken or slow logs a warning and is
 dropped rather than taking the session with it.
 
+**Hooks** are shell commands HX runs at named points in a turn. Four events:
+`PreToolUse`, `PostToolUse`, `UserPromptSubmit` and `Stop`.
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [{ "type": "command", "command": "~/.hx/guard-bash.sh", "timeout": 10 }]
+      }
+    ],
+    "PostToolUse": [
+      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "ruff check --quiet" }] }
+    ]
+  }
+}
+```
+
+`matcher` is a regex matched against the whole tool name; omit it, or use `*`,
+to match every tool. The hook reads a JSON event on stdin — `session_id`,
+`cwd`, `hook_event_name`, and `tool_name`/`tool_input` where they apply — and
+answers with its exit code:
+
+| Exit | Means |
+|---|---|
+| `0` | allow |
+| `2` | block. stderr becomes the reason the model is given |
+| anything else | the hook is broken. Reported as a notice; the action proceeds |
+
+That last row is deliberate: a typo in a shell command must not be able to
+wedge a session. Only an explicit refusal stops anything.
+
+A hook may also print JSON on stdout: `{"decision": "block", "reason": "..."}`
+refuses, `{"updatedInput": {...}}` rewrites a tool's arguments before the
+permission engine sees them, and `{"additionalContext": "..."}` adds a note for
+the model to read. The format matches Claude Code's, so hooks already written
+against that work here unchanged.
+
+A worked example ships in the repository:
+[`examples/hooks/check.sh`](https://github.com/aletisunil/hx/blob/main/examples/hooks/check.sh)
+runs the checker a project already has — `ruff`, `tsc`, `go vet`, `cargo
+check` — against the one file the model just edited, and returns whatever it
+says as `additionalContext`. The model sees the errors appended to its own edit
+result and fixes them on the next turn, rather than discovering them at test
+time. It exits 0 either way: by `PostToolUse` the write has already landed, so
+refusing it would be an answer to something that already happened.
+
+```sh
+curl -o ~/.hx/check.sh https://raw.githubusercontent.com/aletisunil/hx/main/examples/hooks/check.sh
+chmod +x ~/.hx/check.sh
+```
+
+**Where hooks may be declared is a security boundary.** They are loaded from
+`~/.hx/settings.json` and `~/.hx/projects/<slug>/settings.local.json` only.
+Hooks in a project's checked-in `.hx/settings.json` are ignored and listed by
+`/hooks`, because that file arrives with a clone and cloning a repository must
+never be enough to run commands on the machine that cloned it. To adopt a
+shared hook, copy it into your own settings — a deliberate act by the person
+who will run it. Subagents inherit the parent's hooks, so a guard cannot be
+bypassed by delegating through `Task`.
+
 ---
 
 ## Development
@@ -868,9 +988,10 @@ src/hx/
   core/         loop, context assembly, compaction, late injection, sessions, usage
   auth/         credential store, OAuth flows, per-route resolution
   providers/    OpenRouter, Codex, Devin, the model catalogue, a scripted provider for tests
-  tools/        Bash, Read, Write, Edit, Glob, Grep, TodoWrite, Task, WebSearch,
-                WebFetch, output capping
+  tools/        Bash, Read, Write, Edit, Glob, Grep, Symbols, TodoWrite, Task,
+                WebSearch, WebFetch, line anchors, output capping
   permissions/  rule engine, shell decomposition, Seatbelt/bubblewrap
+  hooks/        the four events, the trust boundary, subprocess execution
   skills/ agents/ mcp/
   keys.py       keybinding registry: ids, defaults, descriptions, user overrides
   term/         the renderer: raw mode, input decoding, the differ, the screen
@@ -933,12 +1054,13 @@ streaming with prefix caching and accurate cost accounting, session persistence
 and resume, the tool suite, the permission engine and OS sandbox, late
 injection, compaction, output capping, skills, subagents, MCP, and the TUI.
 
-Two routes to a model: an OpenRouter API key, or a ChatGPT Plus/Pro
-subscription over OAuth. The model id decides which.
+Three routes to a model: an OpenRouter API key, a ChatGPT Plus/Pro
+subscription over OAuth, or a Devin subscription over OAuth. The model id
+decides which.
 
 Published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/), released
 from CI on a tag.
 
-The one thing still unproven in CI is a live call on either route: the `live`
-tests exist and cover both wire formats, tool use, reasoning replay and a
+The one thing still unproven in CI is a live call on any route: the `live`
+tests exist and cover all three wire formats, tool use, reasoning replay and a
 genuine cache hit, but they need a credential and are deselected by default.

{hx_cli-0.2.2 → hx_cli-0.2.3}/README.md

@@ -403,6 +403,7 @@ than being silently resolved.
 | `/skills` | installed skills |
 | `/agents` | subagent types |
 | `/mcp` | server status |
+| `/hooks` | configured hooks, and any that were refused |
 | `/theme [name]` | `dark`, `light`, `ansi`, or any theme in `~/.hx/themes` |
 | `/queue [steer <n>\|clear]` | messages waiting for the turn to end, and what to do with them |
 | `/copy` | copy the last reply to the clipboard |
@@ -520,7 +521,6 @@ along with the `.hx/.gitignore` it added to hide it.
 {
   "theme": "dark",                    // dark | light | ansi, or a file in ~/.hx/themes
   "quiet_startup": false,             // skip the startup header
-  "telemetry": false,
 
   "models": {
     "model": "anthropic/claude-sonnet-4.5",
@@ -563,10 +563,18 @@ along with the `.hx/.gitignore` it added to hide it.
   "tui": {
     "enterWhileBusy": "queue",        // queue | steer - what enter does mid-turn
     "fullscreen": false               // true takes the whole window (see /fullscreen)
+  },
+
+  "tools": {
+    "hashline": true                  // Read labels lines with content anchors Edit accepts
   }
 }
 ```
 
+`hooks` is configured in the same files but is deliberately not part of this
+merge: it is read per layer, and only from your own settings. See
+[Extending it](#extending-it).
+
 Environment overrides: `HX_MODEL`, `HX_SUBAGENT_MODEL`, `HX_MAX_TOKENS`,
 `HX_PERMISSION_MODE`, `HX_SANDBOX`, `HX_COMPACT_AT`, `HX_GIT_NOTICES`,
 `HX_THEME`, `HX_QUIET_STARTUP`. Also `HX_HOME` to relocate user state, `HX_TAVILY_API_KEY`
@@ -727,6 +735,54 @@ rest to the session directory, and hands the model that path to grep.
 
 ---
 
+## Reading and editing code
+
+**Line anchors.** `Read` labels every line with a short content hash:
+
+```
+     1 a3f9	def handle(request):
+     2 7c1c	    if request.method == "POST":
+```
+
+The anchor is a hash of the line and its two neighbours, truncated to the
+narrowest width that is unambiguous in that file. `Edit` takes those anchors
+instead of retyped content:
+
+```json
+{ "file_path": "app.py", "hashline": [{ "start": "a3f9", "end": "7c1c", "new_string": "..." }] }
+```
+
+The span is inclusive; omit `end` to replace one line, pass an empty
+`new_string` to delete. Anchors are recomputed from disk when the edit runs, so
+a file that moved under the model fails to resolve and the patch is rejected
+rather than applied at stale coordinates. Exact-match `old_string` still works
+and is unchanged; anchors are a second shape, not a replacement. Turn the whole
+thing off with `"tools": {"hashline": false}` and reads go back to plain
+`cat -n`.
+
+**Symbols** answers structural questions with a parse tree rather than a
+regex — three modes, `outline` for one file's shape, `definition` for where a
+name is defined, `references` for where it is used:
+
+```
+Symbols(mode="references", symbol="handle")
+```
+
+Because it matches identifier nodes, the same word in a comment or a string
+literal never matches. It cannot resolve types, so an unrelated symbol with the
+same name in another file still does; it is tighter than `Grep`, not a language
+server. Python, TypeScript, JavaScript, Go and Rust.
+
+It needs grammars that are not installed by default, and the tool is simply not
+registered without them — its schema never enters the cached prefix advertising
+something that cannot run:
+
+```sh
+uv tool install "hx-cli[symbols]"
+```
+
+---
+
 ## Extending it
 
 **Skills** are directories containing `SKILL.md` with YAML frontmatter:
@@ -783,6 +839,68 @@ Or `hx mcp add local python server.py`. Tools arrive namespaced
 with a per-server timeout; one that is broken or slow logs a warning and is
 dropped rather than taking the session with it.
 
+**Hooks** are shell commands HX runs at named points in a turn. Four events:
+`PreToolUse`, `PostToolUse`, `UserPromptSubmit` and `Stop`.
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [{ "type": "command", "command": "~/.hx/guard-bash.sh", "timeout": 10 }]
+      }
+    ],
+    "PostToolUse": [
+      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "ruff check --quiet" }] }
+    ]
+  }
+}
+```
+
+`matcher` is a regex matched against the whole tool name; omit it, or use `*`,
+to match every tool. The hook reads a JSON event on stdin — `session_id`,
+`cwd`, `hook_event_name`, and `tool_name`/`tool_input` where they apply — and
+answers with its exit code:
+
+| Exit | Means |
+|---|---|
+| `0` | allow |
+| `2` | block. stderr becomes the reason the model is given |
+| anything else | the hook is broken. Reported as a notice; the action proceeds |
+
+That last row is deliberate: a typo in a shell command must not be able to
+wedge a session. Only an explicit refusal stops anything.
+
+A hook may also print JSON on stdout: `{"decision": "block", "reason": "..."}`
+refuses, `{"updatedInput": {...}}` rewrites a tool's arguments before the
+permission engine sees them, and `{"additionalContext": "..."}` adds a note for
+the model to read. The format matches Claude Code's, so hooks already written
+against that work here unchanged.
+
+A worked example ships in the repository:
+[`examples/hooks/check.sh`](https://github.com/aletisunil/hx/blob/main/examples/hooks/check.sh)
+runs the checker a project already has — `ruff`, `tsc`, `go vet`, `cargo
+check` — against the one file the model just edited, and returns whatever it
+says as `additionalContext`. The model sees the errors appended to its own edit
+result and fixes them on the next turn, rather than discovering them at test
+time. It exits 0 either way: by `PostToolUse` the write has already landed, so
+refusing it would be an answer to something that already happened.
+
+```sh
+curl -o ~/.hx/check.sh https://raw.githubusercontent.com/aletisunil/hx/main/examples/hooks/check.sh
+chmod +x ~/.hx/check.sh
+```
+
+**Where hooks may be declared is a security boundary.** They are loaded from
+`~/.hx/settings.json` and `~/.hx/projects/<slug>/settings.local.json` only.
+Hooks in a project's checked-in `.hx/settings.json` are ignored and listed by
+`/hooks`, because that file arrives with a clone and cloning a repository must
+never be enough to run commands on the machine that cloned it. To adopt a
+shared hook, copy it into your own settings — a deliberate act by the person
+who will run it. Subagents inherit the parent's hooks, so a guard cannot be
+bypassed by delegating through `Task`.
+
 ---
 
 ## Development
@@ -833,9 +951,10 @@ src/hx/
   core/         loop, context assembly, compaction, late injection, sessions, usage
   auth/         credential store, OAuth flows, per-route resolution
   providers/    OpenRouter, Codex, Devin, the model catalogue, a scripted provider for tests
-  tools/        Bash, Read, Write, Edit, Glob, Grep, TodoWrite, Task, WebSearch,
-                WebFetch, output capping
+  tools/        Bash, Read, Write, Edit, Glob, Grep, Symbols, TodoWrite, Task,
+                WebSearch, WebFetch, line anchors, output capping
   permissions/  rule engine, shell decomposition, Seatbelt/bubblewrap
+  hooks/        the four events, the trust boundary, subprocess execution
   skills/ agents/ mcp/
   keys.py       keybinding registry: ids, defaults, descriptions, user overrides
   term/         the renderer: raw mode, input decoding, the differ, the screen
@@ -898,12 +1017,13 @@ streaming with prefix caching and accurate cost accounting, session persistence
 and resume, the tool suite, the permission engine and OS sandbox, late
 injection, compaction, output capping, skills, subagents, MCP, and the TUI.
 
-Two routes to a model: an OpenRouter API key, or a ChatGPT Plus/Pro
-subscription over OAuth. The model id decides which.
+Three routes to a model: an OpenRouter API key, a ChatGPT Plus/Pro
+subscription over OAuth, or a Devin subscription over OAuth. The model id
+decides which.
 
 Published to PyPI as [`hx-cli`](https://pypi.org/project/hx-cli/), released
 from CI on a tag.
 
-The one thing still unproven in CI is a live call on either route: the `live`
-tests exist and cover both wire formats, tool use, reasoning replay and a
+The one thing still unproven in CI is a live call on any route: the `live`
+tests exist and cover all three wire formats, tool use, reasoning replay and a
 genuine cache hit, but they need a credential and are deselected by default.

hx_cli-0.2.3/examples/hooks/check.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+#
+# PostToolUse hook: check the file the model just edited, and hand whatever the
+# checker says straight back to it.
+#
+# Without this, HX has no idea whether an edit compiles. The model writes a
+# file, sees "Applied 1 edit(s)" and a diff, and finds out something broke two
+# turns later when it runs the tests - or never. This closes that loop using
+# the checkers the project already has, with no language server to supervise.
+#
+# Wire it up in ~/.hx/settings.json (hooks are loaded from your own settings
+# only - see "Extending it" in the README):
+#
+#   {
+#     "hooks": {
+#       "PostToolUse": [
+#         {
+#           "matcher": "Edit|Write",
+#           "hooks": [{"type": "command", "command": "~/.hx/check.sh", "timeout": 30}]
+#         }
+#       ]
+#     }
+#   }
+#
+# Exits 0 whether or not it finds anything. By PostToolUse the write has
+# already landed, so exit 2 would refuse an edit that is on disk regardless -
+# a confusing answer to something that already happened. Errors here are
+# context for the next turn, not a veto.
+
+set -uo pipefail
+
+# Resolve a checker the way the project would run it. A bare `command -v ruff`
+# finds nothing on the common setup where the tool lives in ./.venv and never
+# on $PATH, and the hook then does nothing on every edit without saying why.
+# Order: the project's venv, then $PATH, then `uv run` if this is a uv project.
+find_tool() {
+	local name=$1
+	if [ -x "./.venv/bin/$name" ]; then
+		printf './.venv/bin/%s' "$name"
+		return 0
+	fi
+	if command -v "$name" >/dev/null 2>&1; then
+		printf '%s' "$name"
+		return 0
+	fi
+	if [ -f ./pyproject.toml ] && command -v uv >/dev/null 2>&1; then
+		printf 'uv run --quiet %s' "$name"
+		return 0
+	fi
+	return 1
+}
+
+event=$(cat)
+
+path=$(
+	printf '%s' "$event" |
+		python3 -c 'import json,sys; print(json.load(sys.stdin).get("tool_input", {}).get("file_path", ""))' \
+			2>/dev/null
+)
+
+# No path, or a file that no longer exists: nothing to check, and a hook that
+# complains about its own inability to run is noise on every single edit.
+[ -n "$path" ] && [ -f "$path" ] || exit 0
+
+# One file, not the project. `ruff check .` on every edit is slow and buries
+# the error the model just introduced under whatever was already failing.
+case "$path" in
+*.py)
+	ruff=$(find_tool ruff) || exit 0
+	# shellcheck disable=SC2086 # find_tool may return "uv run --quiet ruff"
+	output=$($ruff check --quiet "$path" 2>&1)
+	;;
+*.ts | *.tsx)
+	command -v npx >/dev/null || exit 0
+	# Single-file tsc ignores the project graph, so imports it cannot resolve
+	# are reported as errors. Real ones still surface; treat it as a smoke
+	# test rather than a substitute for `tsc -p .`.
+	output=$(npx --no-install tsc --noEmit "$path" 2>&1)
+	;;
+*.go)
+	command -v go >/dev/null || exit 0
+	output=$(go vet "$(dirname "$path")" 2>&1)
+	;;
+*.rs)
+	command -v cargo >/dev/null || exit 0
+	output=$(cargo check --quiet --message-format short 2>&1)
+	;;
+*)
+	# An extension with no checker is silence, not a complaint. A hook that
+	# says something on every Markdown edit gets switched off within a day.
+	exit 0
+	;;
+esac
+
+[ -z "$output" ] && exit 0
+
+printf '%s' "$output" |
+	python3 -c '
+import json, sys
+print(json.dumps({
+    "additionalContext": "Checker output for the file you just edited:\n" + sys.stdin.read().strip()
+}))
+'

{hx_cli-0.2.2 → hx_cli-0.2.3}/pyproject.toml

@@ -23,7 +23,6 @@ dependencies = [
   "httpx>=0.27",
   "pydantic>=2.7",
   "pyyaml>=6.0",
-  "click>=8.1",
   # System trust store, so a corporate proxy CA the machine already trusts is
   # enough - certifi alone is why `hx` fails on networks where browsers work.
   "truststore>=0.10",
@@ -37,6 +36,13 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
+# Tree-sitter grammars for the Symbols tool. Optional because the wheels are
+# large and the rest of HX works without them - the tool is simply not
+# registered when the import fails.
+symbols = [
+    "tree-sitter>=0.23",
+    "tree-sitter-language-pack>=0.7",
+]
 dev = [
   "pytest>=8.2",
   "pytest-asyncio>=0.23",
@@ -99,6 +105,13 @@ plugins = []
 module = ["pyte.*", "wcwidth.*", "markdown_it.*"]
 ignore_missing_imports = true
 
+# The Symbols grammars are an optional extra, so the lint job does not install
+# them. Type-checking must pass in the configuration users actually get - the
+# one where the import fails and the tool is never registered.
+[[tool.mypy.overrides]]
+module = ["tree_sitter.*", "tree_sitter_language_pack.*"]
+ignore_missing_imports = true
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 asyncio_mode = "auto"

{hx_cli-0.2.2 → hx_cli-0.2.3}/src/hx/__init__.py

@@ -1,5 +1,5 @@
 """HX - an agent harness for the terminal."""
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"
 
 __all__ = ["__version__"]

{hx_cli-0.2.2 → hx_cli-0.2.3}/src/hx/agents/subagent.py

@@ -21,6 +21,7 @@ from hx.core.events import SubagentFinished, SubagentStarted
 if TYPE_CHECKING:
     from hx.config import Settings
     from hx.core.events import EventBus
+    from hx.hooks.engine import HookEngine
     from hx.permissions.engine import PermissionEngine
     from hx.providers.base import Provider
     from hx.providers.models import ModelRegistry
@@ -57,6 +58,7 @@ class SubagentRunner:
         models: ModelRegistry | None = None,
         parent_session_id: str | None = None,
         parent_usage: object | None = None,
+        hooks: HookEngine | None = None,
     ) -> None:
         self.definitions = definitions
         self.provider = provider
@@ -67,6 +69,9 @@ class SubagentRunner:
         self.models = models
         self.parent_session_id = parent_session_id
         self.parent_usage = parent_usage
+        self.hooks = hooks
+        """Shared with the parent: a hook that guards Bash must guard a subagent's
+        Bash too, or the guard is one delegation away from being bypassed."""
         self._active: dict[str, str] = {}
 
     async def run(self, agent_type: str, prompt: str, description: str) -> SubagentResult:
@@ -155,6 +160,7 @@ class SubagentRunner:
             bus=self.bus,
             settings=self.settings,
             model_info=self.models.get_or_default(model) if self.models else None,
+            hooks=self.hooks,
         )
         loop.origin = f"{definition.name} subagent"
         return loop