plugin-scanner 2.0.600__tar.gz → 2.0.601__tar.gz

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.600
+Version: 2.0.601
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard
@@ -176,6 +176,8 @@ See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local fl
   Guard respects Cursor’s native tool approval and focuses on artifact trust before launch.
 - `opencode`
   Guard authors package-level policy while OpenCode keeps native once, always, or reject prompts for managed MCP tools.
+- `kimi`
+  Guard installs managed `PreToolUse` and `UserPromptSubmit` hooks in `~/.kimi-code/config.toml`, blocks with exit code `2` and a JSON `permissionDecision: "deny"` response, and fails open on hook crash or timeout.
 - `hermes`
   Guard installs a managed Hermes overlay bundle, routes MCP servers through Guard proxies, and prefers native-or-center delivery for blocked requests.
 - `gemini`

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/README.md

@@ -134,6 +134,8 @@ See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local fl
   Guard respects Cursor’s native tool approval and focuses on artifact trust before launch.
 - `opencode`
   Guard authors package-level policy while OpenCode keeps native once, always, or reject prompts for managed MCP tools.
+- `kimi`
+  Guard installs managed `PreToolUse` and `UserPromptSubmit` hooks in `~/.kimi-code/config.toml`, blocks with exit code `2` and a JSON `permissionDecision: "deny"` response, and fails open on hook crash or timeout.
 - `hermes`
   Guard installs a managed Hermes overlay bundle, routes MCP servers through Guard proxies, and prefers native-or-center delivery for blocked requests.
 - `gemini`

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/app-routing.test.ts

@@ -9,6 +9,7 @@ function assert(condition: boolean, message: string): void {
 
 assert(parseAppDetail("/apps/opencode") === "opencode", "valid app route parses harness slug");
 assert(parseAppDetail("/apps/claude-code") === "claude-code", "hyphenated app route parses harness slug");
+assert(parseAppDetail("/apps/kimi") === "kimi", "kimi app route parses harness slug");
 assert(parseAppDetail("/apps/OpenCode") === "opencode", "app route normalizes case");
 assert(parseAppDetail("/apps/*") === null, "wildcard app route is rejected");
 assert(parseAppDetail("/apps/%2A") === null, "encoded wildcard app route is rejected");

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/approval-center-utils.ts

@@ -550,6 +550,8 @@ export function harnessDisplayName(harness: string): string {
       return "Hermes";
     case "openclaw":
       return "OpenClaw";
+    case "kimi":
+      return "Kimi";
     default:
       return capitalizeHarness(normalized);
   }

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/apps/app-catalog.ts

@@ -7,15 +7,16 @@ export const SUPPORTED_APP_SLUGS = [
   "gemini",
   "hermes",
   "openclaw",
+  "kimi",
 ] as const;
 
 export type SupportedAppSlug = (typeof SUPPORTED_APP_SLUGS)[number];
 
 export const SUPPORTED_APPS_BRIEF =
-  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, and OpenClaw.";
+  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, and Kimi.";
 
 export const SUPPORTED_APPS_FULL =
-  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, and more. Run your AI app once and Guard will detect it automatically.";
+  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, Kimi, and more. Run your AI app once and Guard will detect it automatically.";
 
 export type AppInstallStatus = "active" | "partial" | "observed" | "not_installed";
 

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/fleet-workspace-phase11.test.ts

@@ -10,11 +10,11 @@ function assert(condition: boolean, message: string): void {
 }
 
 function testSupportedAppSlugs(): void {
-  const expected = ["codex", "claude-code", "opencode", "copilot", "cursor", "gemini", "hermes", "openclaw"];
+  const expected = ["codex", "claude-code", "opencode", "copilot", "cursor", "gemini", "hermes", "openclaw", "kimi"];
   for (const slug of expected) {
     assert(SUPPORTED_APP_SLUGS.includes(slug as typeof SUPPORTED_APP_SLUGS[number]), `SUPPORTED_APP_SLUGS missing: ${slug}`);
   }
-  assert(SUPPORTED_APP_SLUGS.length === 8, `Expected 8 slugs, got ${SUPPORTED_APP_SLUGS.length}`);
+  assert(SUPPORTED_APP_SLUGS.length === 9, `Expected 9 slugs, got ${SUPPORTED_APP_SLUGS.length}`);
 }
 
 function testSupportedAppsBriefMentionsAllApps(): void {

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/home-dashboard.test.ts

@@ -139,6 +139,7 @@ const displayNames = [
   { harness: "cursor", expected: "Cursor" },
   { harness: "hermes", expected: "Hermes" },
   { harness: "openclaw", expected: "OpenClaw" },
+  { harness: "kimi", expected: "Kimi" },
 ];
 
 for (const { harness, expected } of displayNames) {

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/home-dashboard.tsx

@@ -72,7 +72,7 @@ export function resolveCloudUpsellVisible(
 export function buildEmptyStateCopy(): { title: string; body: string; installHint: string } {
   return {
     title: "No apps connected",
-    body: "Connect an AI app so Guard can start protecting it. Guard works with Codex, Claude Code, Cursor, Hermes, and more.",
+    body: "Connect an AI app so Guard can start protecting it. Guard works with Codex, Claude Code, Cursor, Hermes, Kimi, and more.",
     installHint: "hol-guard apps connect <app>",
   };
 }

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/dashboard/src/runtime-overview.tsx

@@ -2,7 +2,7 @@ import { ActionButton, Badge, KeyValueGrid, SectionLabel, Surface, Tag, ProofStr
 import { harnessDisplayName, formatRelativeTime } from "./approval-center-utils";
 import type { GuardCloudSyncHealth, GuardInventoryItem, GuardProofStatus, GuardReceipt, GuardRuntimeDevice, GuardRuntimeSnapshot, PackageManagerProtection } from "./guard-types";
 
-const WATCHED_HARNESSES = ["codex", "claude-code", "opencode", "copilot", "gemini", "cursor", "hermes", "openclaw"] as const;
+const WATCHED_HARNESSES = ["codex", "claude-code", "opencode", "copilot", "gemini", "cursor", "hermes", "openclaw", "kimi"] as const;
 
 type WatchedHarnessName = (typeof WATCHED_HARNESSES)[number];
 

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/docs/guard/architecture.md

@@ -4,7 +4,7 @@ Guard lives inside `codex_plugin_scanner` and is the local product surface for h
 
 The runtime is split into:
 
-- `guard/adapters`: harness discovery for Codex, Claude Code, Copilot CLI, Cursor, Gemini, and OpenCode
+- `guard/adapters`: harness discovery for Codex, Claude Code, Copilot CLI, Cursor, Gemini, Kimi, and OpenCode
 - `guard/shims`: local launcher shims that route harness launches through Guard
 - `guard/consumer`: orchestration for detection, policy evaluation, and consumer-mode scan output
 - `guard/policy`: local action resolution for allow, review, warn, and block decisions

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/docs/guard/get-started.md

@@ -330,6 +330,10 @@ Current strategy:
 - `gemini`
   scans `.gemini/settings.json`, extension manifests, hooks, MCP registrations, and Gemini skill directories before
   launch, then routes blocked changes to the approval center
+- `kimi`
+  installs Guard-owned `PreToolUse` and `UserPromptSubmit` hooks in `~/.kimi-code/config.toml`, blocks dangerous tool
+  calls and prompts with exit code `2` plus a JSON `permissionDecision: "deny"` response, and fails open on hook crash
+  or timeout
 
 Guard does not claim VS Code Copilot extension-host interception in this pass. A VS Code inline tool prompt by itself is
 not proof that Guard blocked the action, because that prompt can come from VS Code's own permission surface. For Copilot,

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/docs/guard/harness-support.md

@@ -75,6 +75,14 @@ Current Guard support in this repo:
   - blocks newly introduced OpenCode MCP, plugin, and skill artifacts before launch when local Guard policy requires
     approval
   - native shell and managed MCP package-manager calls now share the same package-request evaluator, evidence fields, and approval-center copy
+- `kimi`
+  - detects `~/.kimi-code/config.toml` and workspace `.kimi-code/config.toml`
+  - detects `~/.kimi-code/mcp.json` MCP server registrations
+  - detects existing `[[hooks]]` entries in Kimi Code's TOML config
+  - installs Guard-owned `PreToolUse`, `UserPromptSubmit`, `PostToolUse`, `SessionStart`, and `Stop` hooks in `~/.kimi-code/config.toml` by calling `hol-guard hook --harness kimi`
+  - blocks dangerous tool calls and prompts by returning exit code `2` and a JSON `permissionDecision: "deny"` response in `hookSpecificOutput`
+  - fails open if a hook crashes or times out, so Kimi Code keeps working when Guard is unreachable
+  - uses the same JSON stdin/stdout wire protocol as Codex and Claude Code
 
 Approval tiers:
 
@@ -133,3 +141,4 @@ Generated from `src/codex_plugin_scanner/guard/adapters/contracts.py`.
 | `hermes` | `hermes` | ❌ | ✅ | ❌ | shell, mcp_tool, prompt |
 | `openclaw` | `openclaw` | ❌ | ✅ | ❌ | mcp_tool |
 | `antigravity` | `antigravity` | ❌ | ✅ | ❌ | mcp_tool, prompt |
+| `kimi` | `kimi`, `kimi-code`, `kimi-cli` | ❌ | ✅ | ❌ | shell, prompt |

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.600"
+version = "2.0.601"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.600"
+version = "2.0.601"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/src/codex_plugin_scanner/guard/adapters/__init__.py

@@ -10,6 +10,7 @@ from .copilot import CopilotHarnessAdapter
 from .cursor import CursorHarnessAdapter
 from .gemini import GeminiHarnessAdapter
 from .hermes import HermesHarnessAdapter
+from .kimi import KimiHarnessAdapter
 from .openclaw import OpenClawHarnessAdapter
 from .opencode import OpenCodeHarnessAdapter
 
@@ -21,6 +22,7 @@ ADAPTERS: tuple[HarnessAdapter, ...] = (
     AntigravityHarnessAdapter(),
     GeminiHarnessAdapter(),
     HermesHarnessAdapter(),
+    KimiHarnessAdapter(),
     OpenClawHarnessAdapter(),
     OpenCodeHarnessAdapter(),
 )

{plugin_scanner-2.0.600 → plugin_scanner-2.0.601}/src/codex_plugin_scanner/guard/adapters/contracts.py

@@ -137,6 +137,7 @@ _DISPLAY_NAMES = {
     "hermes": "Hermes",
     "openclaw": "OpenClaw",
     "antigravity": "Antigravity",
+    "kimi": "Kimi",
 }
 
 
@@ -280,6 +281,20 @@ HARNESS_CONTRACTS: tuple[HarnessProtectionContract, ...] = (
         ),
         smoke_command="hol-guard install antigravity --dry-run",
     ),
+    HarnessProtectionContract(
+        harness="kimi",
+        install_aliases=("kimi", "kimi-code", "kimi-cli"),
+        config_paths=("~/.kimi-code/config.toml",),
+        event_surfaces=("shell", "prompt"),
+        native_approval=False,
+        browser_fallback=True,
+        resume_support=False,
+        known_blind_spots=(
+            "Tool output post-processing and inline edits applied without a tool call are not visible to Guard. "
+            "Hooks run in parallel and fail open on crash or timeout."
+        ),
+        smoke_command="hol-guard install kimi --dry-run",
+    ),
 )
 
 _CONTRACT_BY_ALIAS: dict[str, HarnessProtectionContract] = {}

plugin_scanner-2.0.601/src/codex_plugin_scanner/guard/adapters/kimi.py

@@ -0,0 +1,313 @@
+"""Kimi Code CLI harness adapter for HOL Guard."""
+
+from __future__ import annotations
+
+import os
+import re
+import shlex
+import sys
+from pathlib import Path
+
+from ..aibom_detection import extend_detection_with_workspace_aibom
+from ..models import GuardArtifact, HarnessDetection
+from ..shims import install_guard_shim, remove_guard_shim
+from .base import HarnessAdapter, HarnessContext, _command_available, _ensure_path_within_root, _json_payload
+
+try:
+    import tomllib  # type: ignore[attr-defined]
+except ModuleNotFoundError:
+    import tomli as tomllib  # type: ignore[no-redef]
+
+
+_KIMI_HOME_ENV_VAR = "KIMI_CODE_HOME"
+_KIMI_DIR = ".kimi-code"
+_KIMI_CONFIG_FILE = "config.toml"
+_KIMI_MCP_FILE = "mcp.json"
+
+_GUARD_MANAGED_BEGIN = "# BEGIN HOL GUARD MANAGED HOOKS"
+_GUARD_MANAGED_END = "# END HOL GUARD MANAGED HOOKS"
+_GUARD_MANAGED_MARKER = "HOL GUARD MANAGED HOOKS"
+
+
+class KimiHarnessAdapter(HarnessAdapter):
+    """Discover Kimi Code CLI settings, hooks, MCP servers, and manage Guard hooks."""
+
+    harness = "kimi"
+    aliases = ("kimi", "kimi-code", "kimi-cli")
+    executable = "kimi"
+    launcher_name = "kimi"
+    approval_tier = "approval-center"
+    approval_summary = (
+        "Guard scans Kimi Code config, hooks, and MCP registrations before launch "
+        "and routes blocked changes to the local approval center."
+    )
+    fallback_hint = "Kimi Code gets preflight approval through Guard until it exposes a richer native approval surface."
+
+    @staticmethod
+    def _kimi_home_dir(context: HarnessContext) -> Path:
+        value = os.environ.get(_KIMI_HOME_ENV_VAR)
+        if value:
+            return Path(value).expanduser().resolve()
+        return context.home_dir
+
+    @classmethod
+    def _config_candidates(cls, context: HarnessContext) -> list[tuple[Path, str]]:
+        home = cls._kimi_home_dir(context)
+        candidates: list[tuple[Path, str]] = [
+            (home / _KIMI_DIR / _KIMI_CONFIG_FILE, "global"),
+        ]
+        if context.workspace_dir is not None:
+            candidates.append((context.workspace_dir / _KIMI_DIR / _KIMI_CONFIG_FILE, "project"))
+        return candidates
+
+    @classmethod
+    def _mcp_candidates(cls, context: HarnessContext) -> list[tuple[Path, str]]:
+        home = cls._kimi_home_dir(context)
+        candidates: list[tuple[Path, str]] = [
+            (home / _KIMI_DIR / _KIMI_MCP_FILE, "global"),
+        ]
+        if context.workspace_dir is not None:
+            candidates.append((context.workspace_dir / _KIMI_DIR / _KIMI_MCP_FILE, "project"))
+        return candidates
+
+    @staticmethod
+    def _read_toml(path: Path) -> dict[str, object]:
+        if not path.is_file():
+            return {}
+        try:
+            with path.open("rb") as handle:
+                payload = tomllib.load(handle)
+        except (OSError, tomllib.TOMLDecodeError):
+            return {}
+        return payload if isinstance(payload, dict) else {}
+
+    def policy_path(self, context: HarnessContext) -> Path:
+        home = self._kimi_home_dir(context)
+        if context.workspace_dir is not None:
+            return context.workspace_dir / _KIMI_DIR / _KIMI_CONFIG_FILE
+        return home / _KIMI_DIR / _KIMI_CONFIG_FILE
+
+    def _managed_config_path(self, context: HarnessContext) -> Path:
+        home = self._kimi_home_dir(context)
+        return home / _KIMI_DIR / _KIMI_CONFIG_FILE
+
+    def detect(self, context: HarnessContext) -> HarnessDetection:
+        artifacts: list[GuardArtifact] = []
+        found_paths: list[str] = []
+
+        for config_path, scope in self._config_candidates(context):
+            if not config_path.is_file():
+                continue
+            found_paths.append(str(config_path))
+            payload = self._read_toml(config_path)
+            if payload:
+                self._append_hook_artifacts(artifacts, payload, config_path, scope)
+
+        for mcp_path, scope in self._mcp_candidates(context):
+            if not mcp_path.is_file():
+                continue
+            found_paths.append(str(mcp_path))
+            payload = _json_payload(mcp_path)
+            if payload:
+                self._append_mcp_artifacts(artifacts, payload, mcp_path, scope)
+
+        installed = bool(found_paths) or _command_available(self.executable)
+        detection = HarnessDetection(
+            harness=self.harness,
+            installed=installed,
+            command_available=_command_available(self.executable),
+            config_paths=tuple(found_paths),
+            artifacts=tuple(artifacts),
+            warnings=(),
+        )
+        return extend_detection_with_workspace_aibom(
+            detection,
+            home_dir=context.home_dir,
+            workspace_dir=context.workspace_dir,
+        )
+
+    def _append_hook_artifacts(
+        self,
+        artifacts: list[GuardArtifact],
+        payload: dict[str, object],
+        config_path: Path,
+        scope: str,
+    ) -> None:
+        hooks = payload.get("hooks")
+        if not isinstance(hooks, list):
+            return
+        for index, entry in enumerate(hooks):
+            if not isinstance(entry, dict):
+                continue
+            command = entry.get("command")
+            if not isinstance(command, str) or not command.strip():
+                continue
+            event = entry.get("event")
+            event_name = event if isinstance(event, str) else ""
+            matcher = entry.get("matcher")
+            timeout = entry.get("timeout")
+            metadata: dict[str, object] = {"event": event_name, "command": command}
+            if isinstance(matcher, str):
+                metadata["matcher"] = matcher
+            if isinstance(timeout, (int, float)):
+                metadata["timeout"] = timeout
+            artifact_id = f"kimi:{scope}:hook:{event_name.lower() or 'unknown'}:{index}"
+            name = f"{event_name or 'hook'}:{matcher}" if isinstance(matcher, str) and matcher else event_name or "hook"
+            artifacts.append(
+                GuardArtifact(
+                    artifact_id=artifact_id,
+                    name=name,
+                    harness=self.harness,
+                    artifact_type="hook",
+                    source_scope=scope,
+                    config_path=str(config_path),
+                    command=command,
+                    metadata=metadata,
+                )
+            )
+
+    def _append_mcp_artifacts(
+        self,
+        artifacts: list[GuardArtifact],
+        payload: dict[str, object],
+        mcp_path: Path,
+        scope: str,
+    ) -> None:
+        servers = payload.get("mcpServers")
+        if not isinstance(servers, dict):
+            return
+        for server_name, server_config in servers.items():
+            if not isinstance(server_name, str) or not isinstance(server_config, dict):
+                continue
+            command = server_config.get("command")
+            url = server_config.get("url")
+            if not isinstance(command, str) and not isinstance(url, str):
+                continue
+            raw_args = server_config.get("args")
+            args = tuple(str(value) for value in raw_args) if isinstance(raw_args, list) else ()
+            transport = "http" if isinstance(url, str) else "stdio"
+            artifacts.append(
+                GuardArtifact(
+                    artifact_id=f"kimi:{scope}:mcp:{server_name}",
+                    name=server_name,
+                    harness=self.harness,
+                    artifact_type="mcp_server",
+                    source_scope=scope,
+                    config_path=str(mcp_path),
+                    command=command if isinstance(command, str) else None,
+                    args=args,
+                    url=url if isinstance(url, str) else None,
+                    transport=transport,
+                )
+            )
+
+    @staticmethod
+    def _hook_command_parts(context: HarnessContext) -> tuple[str, ...]:
+        guard_args = [
+            "guard",
+            "hook",
+            "--guard-home",
+            str(context.guard_home),
+            "--harness",
+            "kimi",
+        ]
+        if context.home_dir.resolve() != Path.home().resolve():
+            guard_args.extend(["--home", str(context.home_dir)])
+        if context.workspace_dir is not None:
+            guard_args.extend(["--workspace", str(context.workspace_dir)])
+        package_root = Path(__file__).resolve().parents[3]
+        code = (
+            "import sys;"
+            f"sys.path.insert(0, {str(package_root)!r});"
+            "from codex_plugin_scanner.cli import main;"
+            f"raise SystemExit(main({guard_args!r}))"
+        )
+        return (sys.executable, "-c", code)
+
+    def install(self, context: HarnessContext) -> dict[str, object]:
+        shim_manifest = install_guard_shim(
+            self.harness,
+            context,
+            launcher_name=self.launcher_name,
+            display_name="kimi",
+        )
+        config_path = self._managed_config_path(context)
+        _ensure_path_within_root(context.home_dir, config_path, label="Kimi Code")
+        config_path.parent.mkdir(parents=True, exist_ok=True)
+
+        hook_command = shlex.join(self._hook_command_parts(context))
+        managed_block = self._build_managed_block(hook_command)
+        existing_text = config_path.read_text(encoding="utf-8") if config_path.is_file() else ""
+        cleaned_text = _remove_managed_block(existing_text)
+        new_text = f"{cleaned_text.rstrip()}\n\n{managed_block}\n".lstrip()
+        config_path.write_text(new_text, encoding="utf-8")
+
+        return {
+            "harness": self.harness,
+            "active": True,
+            "config_path": str(config_path),
+            **shim_manifest,
+            "notes": [
+                "Guard hook entries added to ~/.kimi-code/config.toml",
+                *[str(note) for note in shim_manifest.get("notes", [])],
+            ],
+        }
+
+    def uninstall(self, context: HarnessContext) -> dict[str, object]:
+        shim_manifest = remove_guard_shim(
+            self.harness,
+            context,
+            launcher_name=self.launcher_name,
+            display_name="kimi",
+        )
+        config_path = self._managed_config_path(context)
+        if config_path.is_file():
+            _ensure_path_within_root(context.home_dir, config_path, label="Kimi Code")
+            existing_text = config_path.read_text(encoding="utf-8")
+            cleaned_text = _remove_managed_block(existing_text)
+            config_path.write_text(cleaned_text.rstrip() + "\n", encoding="utf-8")
+        return {
+            "harness": self.harness,
+            "active": False,
+            "config_path": str(config_path),
+            **shim_manifest,
+            "notes": [
+                "Guard hook entries removed from ~/.kimi-code/config.toml",
+                *[str(note) for note in shim_manifest.get("notes", [])],
+            ],
+        }
+
+    @staticmethod
+    def _build_managed_block(hook_command: str) -> str:
+        escaped_command = _toml_escape(hook_command)
+        lines = [
+            _GUARD_MANAGED_BEGIN,
+            "# The hooks below are managed by HOL Guard. Do not edit manually.",
+        ]
+        for event in ("PreToolUse", "UserPromptSubmit", "PostToolUse", "SessionStart", "Stop"):
+            lines.extend(
+                [
+                    "[[hooks]]",
+                    f'event = "{event}"',
+                    f'command = "{escaped_command}"',
+                    "timeout = 30",
+                ]
+            )
+        lines.append(_GUARD_MANAGED_END)
+        return "\n".join(lines)
+
+
+def _toml_escape(value: str) -> str:
+    """Escape backslashes and double quotes for a TOML double-quoted string."""
+    return value.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def _remove_managed_block(text: str) -> str:
+    pattern = re.compile(
+        rf"^\s*{re.escape(_GUARD_MANAGED_BEGIN)}.*?{re.escape(_GUARD_MANAGED_END)}\s*\n?",
+        re.MULTILINE | re.DOTALL,
+    )
+    cleaned = pattern.sub("", text)
+    # Also remove any leftover marker-only lines from partial edits.
+    cleaned = re.sub(rf"^\s*#.*{re.escape(_GUARD_MANAGED_MARKER)}.*$\n?", "", cleaned, flags=re.MULTILINE)
+    return cleaned