reinc 0.1.0__tar.gz

reinc-0.1.0/.github/workflows/build.yml

@@ -0,0 +1,54 @@
+name: Build
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build sdist + wheel
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Build package
+        run: uv build
+
+      - name: Verify the package
+        run: |
+          uv run --python 3.12 python -c "
+          import zipfile, glob, sys
+          files = glob.glob('dist/*.whl')
+          if not files:
+              print('No wheel found', file=sys.stderr)
+              sys.exit(1)
+          with zipfile.ZipFile(files[0]) as z:
+              meta = [n for n in z.namelist() if n.endswith('METADATA')]
+              if not meta:
+                  print('No METADATA in wheel', file=sys.stderr)
+                  sys.exit(1)
+              content = z.read(meta[0]).decode()
+              assert 'Name: reinc' in content, 'Package name mismatch'
+              print('Wheel OK:', files[0])
+          "
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 30

reinc-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Create venv
+        run: uv venv --python ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv pip install -e ".[dev]" --python ${{ matrix.python-version }}
+
+      - name: Run tests
+        run: uv run --python ${{ matrix.python-version }} pytest -q
+
+      - name: Run ruff
+        run: uv run --python ${{ matrix.python-version }} ruff check src tests
+
+  # Fast single-version job that gates merge — don't let a 3.13-only fix
+  # break 3.11. The matrix above catches it, but this gives a clean signal.
+  gate:
+    name: All tests pass
+    runs-on: ubuntu-latest
+    needs: test
+    if: always()
+    steps:
+      - name: Check matrix status
+        if: ${{ needs.test.result != 'success' }}
+        run: exit 1
+      - run: echo "All matrix jobs passed"

reinc-0.1.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,71 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build sdist + wheel
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Build package
+        run: uv build
+
+      - name: Verify package metadata
+        run: |
+          uv run --python 3.12 python -c "
+          import zipfile, glob, sys
+          files = glob.glob('dist/*.whl')
+          if not files:
+              print('No wheel found', file=sys.stderr); sys.exit(1)
+          with zipfile.ZipFile(files[0]) as z:
+              meta = [n for n in z.namelist() if n.endswith('METADATA')]
+              content = z.read(meta[0]).decode()
+              assert 'Name: reinc' in content, 'Package name mismatch'
+              print('Wheel OK:', files[0])
+          "
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: pypi
+      url: https://pypi.org/p/reinc
+    permissions:
+      id-token: write  # OIDC trusted publishing
+
+    steps:
+      - name: Download dist
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true  # don't fail if this version was already pushed

reinc-0.1.0/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,58 @@
+name: Publish to TestPyPI
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build sdist + wheel
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Build package
+        run: uv build
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to TestPyPI
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/reinc
+    permissions:
+      id-token: write  # OIDC trusted publishing
+
+    steps:
+      - name: Download dist
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true  # don't fail if this version was already pushed

reinc-0.1.0/.gitignore

@@ -0,0 +1,26 @@
+# Reinc runtime state — dogfooders run `reinc init` themselves
+.reinc/
+
+# Claude
+.claude/
+
+# Cursor
+.cursor/
+
+# Devin
+.devin/
+
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+
+# Tooling
+.pytest_cache/
+.ruff_cache/
+.coverage

reinc-0.1.0/CLAUDE.md

@@ -0,0 +1,292 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project status
+
+The full Claude Code path is implemented and runnable end-to-end: pure decision core,
+sqlite audit, the `reinc hook` client, four wire dialects, agent registration, and a read-only
+logging TUI. `reinc init/hook/register/unregister/monitor/allow/deny` all exist in `cli.py`.
+**No daemon** — the hook reads/writes sqlite directly, reconstructing the behavioral tracker
+from recent history on each call. **Five agents are fully integrated** (dialect + `reinc register`):
+Claude Code, Codex, Cursor, Devin (`register devin` writes a **global** hook at
+`~/.config/devin/config.json` covering the Devin **CLI**, the **Devin Local** agent, and **Windsurf**
+(which runs Devin Local after the Cognition acquisition) — same hook contract — so Devin Desktop
+and Windsurf are covered when they run Devin Local. Windsurf's legacy *Cascade* hooks (EOL
+2026-07-01) and Devin *Cloud* are out of scope), and **Antigravity** (`register antigravity` writes a
+named-hook entry at `~/.gemini/config/hooks.json`; PreToolUse gates via `{decision:allow|deny|ask}`,
+PostInvocation reads the transcript JSONL for post-audit since PostToolUse carries no tool output).
+A Cline dialect exists (wire only, tested) but has no `register` path yet. 396 tests pass; ruff is clean.
+
+Implemented modules (`src/reinc/`):
+`models.py` (domain types) · `matching.py` (tool:glob + command tokenizing) · `scoring.py`
+(Layer 1 base + Layer 2 sensitivity, per-command bash scoring) · `behavior.py` (Layer 3
+stateful detectors) · `policy.py` (precedence ladder) · `engine.py` (pipeline → `Decision`) ·
+`config.py` (config.toml + personal.toml loader) · `store.py`/`audit.py` (sync sqlite) ·
+`hook.py` (ephemeral client, reads/writes sqlite directly) · `register.py`/`agents.py` ·
+`dialects/` · `tui/`.
+
+## PostToolUse safety path (done — design in `docs/INTEGRATION.md` §3.1)
+
+`reinc hook --post` is the observe-only post-execution path. It scans tool output for
+prompt-injection echoes and secret leaks, persists flagged results to sqlite, and feeds the
+behavioral tracker so subsequent pre calls score higher. **Post-path policy is toml-declared**
+(`[post]` + `[post.scanners]` sections) — detection *patterns* (regex) stay in code, but the
+*consequences* (bonus, feed_tracker, incident_window, incident_cap, enabled) are in config.
+
+Key components:
+- `output.py`: `scan_output(text, post) -> (flags, bonus, reasons)` — prompt-injection + secret
+  scanners. Bonuses and feed_tracker come from `PostConfig.scanner(name)`, not hardcoded.
+- `Dialect.parse_post()`: `claude` (covers Codex), `devin`, `cursor`, `antigravity` impls.
+  Cursor fires three post events (`postToolUse`, `afterShellExecution`, `afterFileEdit`).
+  Antigravity uses `PostInvocation` (not PostToolUse) and reads the transcript JSONL; see below.
+- `hook.py`: `evaluate_post()` parses the post payload, scans output+error, persists to sqlite
+  via `audit.record_result()`. Silent no-op when `[post] enabled=false` or on any error.
+- `behavior.py`: `_post_incident()` detector sums bonuses from flagged results within
+  `incident_window` (default 300s), capped at `incident_cap` (default 50).
+- Cross-call state flows through sqlite: each pre call's hook reads recent actions + flagged
+  results and rebuilds the `BehaviorTracker` — no daemon needed.
+- All five dialects validated against official docs (Claude Code, Codex, Devin, Cursor, Antigravity).
+
+## Pre-hook input scanning (done)
+
+The pre-hook scans tool **input** (file content being written, command being run) for the same
+prompt-injection / secret patterns as the post path — **before** execution. The scanner bonus
+is added to the risk score **before** the band lookup, so writing "IGNORE ALL PREVIOUS
+INSTRUCTIONS" to a file pushes the score from 25 → 65 → **deny** (blocked before the file is
+written), not just caught when the file is read back later. Flags are persisted to the
+`actions.flags` column and shown in `reinc monitor`.
+
+Key components:
+- `ToolCall.content`: new field — the scannable text extracted from tool args by each dialect.
+  `None` for read-only tools (read_file, list_dir, search_files).
+- `output.py`: `scan_input(text, post) -> (flags, bonus, reasons)` — same scanners as
+  `scan_output`, same patterns. Returns bonus that the engine adds to the score.
+- `engine.py`: `decide()` calls `scan_input(call.content, self.post)` after the policy check
+  but before the band lookup. The bonus is `min(100, score + input_bonus)`. When
+  `[post] enabled=false`, both input and output scanning are disabled (zero bonus).
+- `Decision.flags`: tuple of flag names (e.g. `("prompt_injection",)`), persisted to
+  `actions.flags` by `audit.record()`. `recent_with_flags()` merges pre-hook flags
+  (actions.flags) with post-audit flags (results.flags) for the TUI.
+- Each dialect has a `_CONTENT_FIELDS` map and `_extract_content()` helper:
+  - `antigravity`: `CodeContent` (write), `NewContent` (edit), `CommandLine` (bash)
+  - `claude` (covers Codex's Bash/Read/etc): `content` (write), `new_string`/`edits[]` (edit), `command` (bash)
+  - `codex` (apply_patch): patch text from `command` field (contains V4A headers + file content)
+  - `devin`: `content` (write), `new_string` (edit), `command` (bash)
+  - `cursor`: `content` (write), `command` (bash)
+  - `cline`: `content` (write), `diff` (edit), `command` (bash)
+- Config: reuses `[post.scanners]` bonuses (`prompt_injection=40`, `secret_leak=30`). No
+  separate `[pre]` section — the same scanner config controls both paths.
+- Field names verified against official docs for all five agents (Claude Code, Codex, Devin,
+  Cursor, Antigravity).
+
+## Commands
+
+Dev setup uses a venv with the `dev` extra (pytest, pytest-asyncio, ruff):
+
+```bash
+uv venv && uv pip install -e ".[dev]"
+.venv/bin/pytest -q                       # full suite
+.venv/bin/pytest tests/test_engine.py -q  # one module
+.venv/bin/pytest tests/test_engine.py::test_headless_blocks_high  # one test
+.venv/bin/ruff check src tests            # lint (config in pyproject.toml)
+```
+
+Test-first: every core feature gets a test in `tests/test_<module>.py` before moving on.
+Behavioral/scoring tests pass explicit `ts` timestamps into `ToolCall` rather than using wall
+clock, so the pure core stays deterministic — keep new tests doing the same.
+
+## What Reinc is
+
+A local-first safety layer between AI coding agents and the machine. Every agent tool call
+(read/write/edit/delete file, bash, http) is intercepted by the agent's own pre-tool hook,
+scored for risk (0–100), and logged. Reinc never owns the human prompt: when a call needs a
+human, Reinc returns `ask` and the **agent shows its own native approval UI**, where the user
+already works. All data stays local; no servers, no telemetry. Targets Claude Code, Codex,
+Cursor, Devin (CLI + Local + Windsurf, incl. Devin Desktop on Devin Local), Antigravity, Cline, Continue.
+
+## Architecture — the load-bearing decisions
+
+Read `docs/INTEGRATION.md` before touching anything integration-related; it is the source of
+truth and supersedes the README's older "Agent integrations" section.
+
+- **Interception is via each agent's pre-tool-execution HOOK, never via an MCP server.** MCP
+  *adds* tools to an agent; it does **not** gate the agent's native tools. Registering Reinc as an
+  MCP server does not intercept anything.
+- **Reinc delegates the human prompt back to the agent via `ask`.** A medium-risk call returns
+  `permissionDecision: "ask"`, which makes the agent surface its own approval prompt. Reinc has
+  **no interactive TUI and no approval queue** — the only TUI (`reinc monitor`) is read-only logging.
+- **Three declarative layers, one source of truth:** hooks *enforce*, `.reinc/config.toml` (+ the
+  gitignored `.reinc/personal.toml`) *declares* policy, the TUI *logs*. There is no learned/remembered
+  state that changes decisions — config is the whole truth. (Trust memory was removed.)
+- **The field converged on Claude Code's hook contract** (stdin JSON `{tool_name, tool_input}` →
+  stdout `permissionDecision: allow|deny|ask` or exit code 2 = block), but the convergence is
+  looser than first assumed. Code is organized around *dialects*, not per-agent. Shipped dialects:
+  **`claude`** (Claude Code), **`codex`** (`CodexDialect(ClaudeDialect)` — same wire/render + config
+  schema as claude, but its own parse: Codex writes/edits files via `apply_patch`, with the patch in
+  `tool_input.command` and the path inside the V4A patch body, so the shared claude dialect left
+  every Codex file change unmapped → silent allow → unlogged; case-insensitive lookup. **Codex has
+  no native `ask`** — `permissionDecision:"ask"` is parsed-but-unsupported and fails OPEN, so codex
+  sets `supports_ask=False` and the decision pipeline downgrades warn-tier `ask`→`deny` *before the
+  audit write*, so the monitor logs the enforced deny), **`cursor`** (`{permission}` response,
+  `failClosed` register), **`devin`** (lowercase tool names `exec`/`read`/`write`/`edit`/`glob`/`grep`,
+  `{decision:block|ask}` + `hookSpecificOutput.additionalContext`, **native `ask`** so warn-tier
+  surfaces Devin's own prompt), and **`cline`** (Claude-family variant, `{cancel:true}`, wire-only so
+  far). Codex/Cursor/Devin/Cline each needed their own tool map and/or block signal — **none** reused
+  claude fully (Codex came closest: it reuses the render, not the parse). The `devin` dialect covers
+  the Devin **CLI**, the **Devin Local** agent, and **Windsurf** (which runs Devin Local after the
+  Cognition acquisition — same hook contract), so Devin Desktop and Windsurf are covered when they
+  run Devin Local. Out of scope: Windsurf's legacy *Cascade* hooks (a distinct exit-2-only contract,
+  EOL 2026-07-01 — not building it) and Devin *Cloud* (remote sandbox).
+  **`antigravity`** is a subprocess dialect (the CLI runs hooks as shell commands with JSON
+  stdin/stdout, like Claude — NOT the in-process Python SDK). Its wire contract nests tool info
+  under `{toolCall:{name,args}}` and emits `{decision:allow|deny|ask,reason}`. Post-audit is unique:
+  Antigravity's PostToolUse stdin carries no tool output (only `stepIdx` + `error`), so reinc
+  registers on **PostInvocation** instead, which provides `transcriptPath` + `initialNumSteps`.
+  The hook reads the transcript JSONL, skips `initialNumSteps` entries, and extracts `CODE_ACTION`
+  entries (tool results) for output scanning — restoring post-incident auditing with parity to
+  Claude/Devin. Config uses a named-hook format: `{reinc: {PreToolUse: [...], PostInvocation: [...]}}`
+  at `~/.gemini/config/hooks.json`.
+- **Single-process model:** an ephemeral `reinc hook` process per tool call that parses
+  the agent's format, opens sqlite, reads recent history (reconstructing the behavioral
+  scorer's state), scores the call, writes the audit row, and emits the agent's response
+  format. No daemon, no socket — the hook is the whole system. Cross-call behavioral
+  state (recon, exfil, cascade, post-incident) flows through sqlite: each hook call
+  reads the last ~300s of actions for that agent and rebuilds the tracker. `reinc monitor`
+  is a read-only TUI that polls sqlite every 0.5s — it doesn't score or intercept.
+- **`reinc core` is agent-agnostic and pure** (policy engine, scorer, audit). All dialect/agent
+  knowledge lives in the hook adapters. Keep this boundary clean — it's the OSS value.
+
+## Invariants that fall out of the agent matrix (don't violate these)
+
+- **Fail closed.** Cursor hooks fail-OPEN by default; `reinc register` must set `failClosed: true`.
+  A crashed Reinc must never silently allow. `evaluate()` also denies on any parse/eval exception.
+- **`ask` is the human path, not a blocking hook.** Because the agent (not Reinc) owns the prompt,
+  the hook returns immediately and there is no human-vs-hook-timeout coupling to manage. Hook
+  timeouts are fixed and short; don't reintroduce a "hook.timeout > policy.timeout" rule.
+- **Don't assume input transform.** Antigravity can only allow/block, not rewrite tool input.
+  Any "sanitize instead of block" feature must degrade to block on that agent. (Windsurf's
+  legacy Cascade was also allow/block only, but current Windsurf runs Devin Local which supports
+  `additionalContext`.)
+- **There is no `delete_file` tool on most agents** — deletes arrive as `Bash(rm …)`. Destructive-
+  action detection must live in bash parsing, not in a tool name.
+- **No token/cost from hooks.** A tool-call hook sees args, not LLM token usage. Don't reintroduce
+  `token_budget`/`cost_budget` or `$cost` displays — they are not computable this way.
+- **Guardrail, not sandbox.** Hooks run in the agent's trust domain and documented bypasses exist.
+  Never claim airtight containment. An OS-sandbox floor is an optional later layer (`THREAT_MODEL.md`).
+- **`reinc hook` is the hot path — keep it import-light.** It runs as a fresh subprocess on every
+  tool call. `cli.py` must NOT import the TUI (`textual`) at module top; `ReincMonitor` is imported
+  lazily inside `_run_monitor`. Don't reintroduce heavy top-level imports on the hook path.
+
+## Policy model
+
+Project policy lives in `.reinc/config.toml` (committed to git so teammates share rules). Personal
+overrides go in `.reinc/personal.toml` (gitignored), appended via `reinc allow <pattern>` /
+`reinc deny <pattern>`. `.reinc/db/` is also gitignored. Precedence:
+`never_allow` → `block` → `warn` → `allow` → risk scorer + thresholds (no trust tiers). Risk score =
+`min(100, round((base × sensitivity_multiplier + behavior_bonus) × agent_trust_multiplier))`. The
+agent_trust multiplier (0.7/1.0/1.3) scales the score only; it never overrides explicit rules.
+**`bash` base is per-command** (not flat 35): read-only (`ls`, `cat`, `git status`) → 8, network
+(`curl`, `ssh`) → 45, write/sys (`rm`, `pip install`, `git push`) → 35, unknown → 35 (fail safe).
+See `scoring.py:_bash_score`. Rules use `tool:glob` patterns with per-tool `*` semantics.
+**`docs/POLICY.md` is the full rule reference** (syntax, tool list, precedence, recipes); the `reinc init` default config is commented.
+
+## Known issues / open work
+
+- Matching is a hand-rolled glob→regex in `matching.py` (not `pathspec`), because rules need
+  per-tool `*` semantics — see the decision note in `docs/INTEGRATION.md`. Don't reintroduce a
+  glob library without revisiting that.
+- Bash rules now also match an argv-normalized form (`normalize_command` in `matching.py`):
+  basename of the executable + collapsed whitespace, so `/bin/rm` and `rm   -rf   /` no longer
+  evade `bash:rm -rf /`. Residual gaps (documented, not closed — guardrail not sandbox): flag
+  reorder/bundling (`rm -fr`, `rm -r -f`), wrappers (`sudo`/`env`/`xargs rm`), and shell operators
+  (`x && rm -rf /`). A rule still needs the right pattern; normalization only canonicalizes form.
+- Policy path rules now match the full path **or** its basename (`rule_matches` in `matching.py`),
+  mirroring the scorer — so `write_file:.env*` / `*.pem` block nested/absolute paths
+  (`/tmp/proj/.env`), not just a bare `.env`. Found via live Claude Code testing: the agent writes
+  full paths, so the old basename-blind matcher let `block` fall through to the scorer (→ `ask`
+  instead of `deny`). Slash-containing patterns stay anchored to the full path.
+- **Abs-vs-CWD-relative normalization fixed** (`project_relative_candidate` in `matching.py`, used by
+  both `rule_matches` and `scoring._matches_path`). Found by dogfooding this repo: `[allow]` rules
+  and `[paths]` groups are written project-relative (`edit_file:src/**`, `tests/**`), but Claude
+  Code sends **absolute** paths for file tools — a slash-containing pattern only matches the full
+  path (basename fallback can't help, a basename has no slash), so every such rule silently never
+  matched and fell through to the scorer. This was the actual cause of most dogfooding friction —
+  declared `[allow]` rules for `src/**`/`tests/**` never fired. Fix: when the pattern isn't itself
+  rooted (no leading `/` or `~`) and the target is absolute, also try the path relative to `cwd`
+  (reinc's hook always runs with cwd == project root — same assumption `config.py` makes resolving
+  `db_path`). Still open: symlink/TOCTOU, case sensitivity.
+- **Behavioral/scorer reasons weren't reaching the user.** `score_call` (`scoring.py`) always built a
+  human-readable `RiskScore.reasons` tuple (base score, sensitivity, behavior-detector text like
+  `"post-incident: recent secret_leak flagged in output"`), but `engine.py`'s `Decision.reason` only
+  ever said `"score N (band)"` — the detailed why was computed and silently discarded. Worse: when
+  the pre-hook input-scan bonus applied, the code rebuilt `RiskScore` with no `reasons=` arg,
+  **wiping** the original reasons rather than just omitting them from the message. Both fixed —
+  `Decision.reason` now appends `score.reasons`, and the input-bonus path preserves + extends them.
+- **Post-execution output scanning had no way to avoid re-flagging the reinc repo's own source.**
+  `engine.py`/`models.py`/`README.md`/`docs/*.md` documented the injection scanner by quoting a
+  literal trigger phrase (`"IGNORE ALL PREVIOUS INSTRUCTIONS"`), which made reading reinc's own
+  code/docs during dogfooding trip the `prompt_injection` scanner and poison the next 300s of
+  session via `_post_incident` (`behavior.py`) — a self-inflicted false positive, not a real
+  attack. Fixed by rephrasing the six occurrences to describe the pattern referentially instead of
+  quoting it. Test fixtures (`tests/test_*.py`) still use the literal strings deliberately — that's
+  what they're testing — so reading the test suite itself can still self-trigger; not fixed (a
+  `[post] skip_paths` exemption was discussed but shelved as unnecessary scope for now).
+- **`results.output`/`results.error` were persisted to sqlite in plaintext even when flagged
+  `secret_leak`.** A secret gets scanned, flagged, and then the raw value sits right next to the
+  flag forever in `.reinc/db/history.sqlite` — which `reinc monitor` reads live and isn't itself
+  encrypted. Fixed: `hook.py:_record_result` now redacts matched secret material (`redact_secrets`
+  in `output.py`, regex-based `re.sub` → `[REDACTED:secret_leak]`) before persisting, when
+  `secret_leak` is among the flags. Prompt-injection text is left intact (not sensitive, useful for
+  triage). `actions.target` (e.g. a bash command with a secret embedded as an arg) is intentionally
+  **not** redacted — Antigravity's call-id-less result correlation matches on exact
+  `(agent, kind, target)`, so altering the persisted target would break that lookup; this is a
+  known residual gap, not an oversight.
+- Claude, Codex, Cursor, and Devin are fully integrated (dialect + register). Cline has a wire
+  dialect but no `register` (its hooks are executable scripts dropped in `.clinerules/hooks/`, not
+  a JSON config — convention not yet pinned). Codex now gates `apply_patch` writes/edits/deletes
+  (patch in `tool_input.command`, path parsed from the V4A body), not just Bash, and degrades
+  warn-tier `ask`→`deny` since Codex PreToolUse has no native ask (fail-open otherwise) — all
+  confirmed against developers.openai.com/codex/hooks; residual: multi-file patches scored on the
+  first path. Devin's
+  tool vocab + native `ask` were confirmed against live hook stdin and the CLI hooks docs (lowercase
+  `exec`/`read`/`write`/`edit`/`glob`/`grep`). Cursor is **IDE/cloud-first**: it handles the
+  per-action `beforeShellExecution`/`beforeReadFile` events plus a `matcher`-scoped `preToolUse` for
+  writes/deletes, using Cursor's **real** tool names (`Shell`/`Read`/`Write`/`Grep`/`Delete`, not
+  Claude's `Edit`/`MultiEdit`/`Search`/`List`). `ask` is only enforced on `beforeShellExecution`,
+  else it fails safe to deny — note `preToolUse` doesn't enforce `ask` **even in the IDE** (per
+  Cursor's docs). **Cursor CLI caveat:** the CLI fires only a subset of hooks (`beforeShellExecution`
+  is the lone pre-exec gate), so file writes/edits/reads can't be blocked pre-exec there — only
+  audited via `afterFileEdit`/`postToolUse`; full blocking works in IDE/cloud. The `preToolUse`
+  file-tool field names are still best-effort (verified against cursor.com/docs/hooks.md).
+  Windsurf is covered by the `devin` dialect (it runs Devin Local after the Cognition acquisition).
+  Antigravity is fully integrated (subprocess CLI hooks, not the in-process Python SDK); its
+  PostInvocation transcript-read path is verified against a live session — `initialNumSteps` is a
+  `step_index` threshold (NOT a line number; transcript step indices have gaps), and all tool-result
+  types are scanned (CODE_ACTION, VIEW_FILE, LIST_DIRECTORY, RUN_COMMAND — not just CODE_ACTION).
+  Results link to actions by (agent, kind, target) fallback since Antigravity has no `call_id`.
+  `project_root` extracts `workspacePaths[0]` from the payload so config loads from the project
+  dir, not `~/.gemini/config/` (where Antigravity runs hooks). The transcript schema is
+  undocumented and may change.
+- **Self-hardening done; see `docs/THREAT_MODEL.md`.** `register` pins reinc's *absolute* path in
+  the injected hook command (no bare-`reinc` PATH hijack); `register`'s reinc-ownership check
+  matches on the `hook --agent <name>` marker, not the executable path, so absolute-path hooks
+  still unregister. `init` sets `.reinc/` to `0700`. The sqlite db uses WAL mode with a 5s
+  busy_timeout for concurrent hook processes.
+- `[project.urls]` points to `cabernect/reinc` (Homepage/Issues), matching the real git remote —
+  but that GitHub repo hasn't been pushed yet (confirmed via `git ls-remote`: "Repository not
+  found"), and the `reinc` package name isn't registered on PyPI (checked 2026-07-01: name is
+  free). README's PyPI/brew/curl install lines are aspirational until both exist.
+- `strict` mode asks on low/medium bands and denies on high (score > `block_above`).
+  `interactive` mode allows low, asks medium, denies high — `block_above` is honored in both.
+  `permissive` mode allows low/medium, asks high (no auto-deny). `headless` allows low/medium,
+  denies high (no human available for `ask`).
+- The CLI command layer and the process boundary are now covered: `tests/test_cli.py` (click
+  `CliRunner` — stdin→wire output per dialect, exit codes, fail-closed, register/init/allow/deny)
+  and `tests/test_e2e.py` (black-box subprocess incl. a sqlite exfil round-trip). TUI quit is
+  fixed + tested: Textual binds ctrl+c to a
+  `system` binding → `action_help_quit`, which only *shows* a "press ctrl+q" hint (and ctrl+q is
+  eaten by terminals as XON/XOFF). `ReincMonitor` overrides `action_help_quit` to `self.exit()` so
+  ctrl+c actually quits; `q` is the shown fallback. NOTE: a passing Pilot `press("ctrl+c")` test
+  alone is not proof of real-terminal behavior — validate against the actual action the terminal
+  invokes. Remaining TUI gap: the live feed/table rendering isn't asserted.