capability

type Capability ¶

type Capability struct {
	HookSupported  bool
	HookVerified   bool
	HookProbedAt   time.Time
	HookError      string
	InterceptScope string
}

Capability is the per-provider hook support metadata.

HookSupported is the static declaration: "an adapter for this provider exists in the codebase and is wired into the gate binary." UI uses this to decide whether the gate toggle is even available.

HookVerified is the dynamic claim: "we spawned the real binary and confirmed the deny path is honored." Set by HookCapabilityCheck (D5); stays false until that probe runs successfully.

InterceptScope is a free-form short label describing which tool classes the hook covers ("bash+edit+mcp", "shell-only", "untested"). Surfaced in the UI badge so users see coverage at a glance.

func Lookup(name string) (Capability, bool)

type CheckInput ¶

type CheckInput struct {
	// ProviderName is the registry key for the Capability/Writer/Prober
	// triple this check should exercise.
	ProviderName string

	// GateBinary is the absolute path to the <app>-gate executable the
	// provider will invoke via its hook. Empty means "skip probe; we
	// can't verify without a gate to point at".
	GateBinary string

	// WorkspaceRoot is where the probe's throwaway workspace will be
	// created. Empty → os.TempDir. The probe writes a fresh subdir
	// underneath and removes it on completion regardless of outcome.
	WorkspaceRoot string
}

CheckInput is the per-provider data HookCapabilityCheck needs to drive a probe. Kept minimal so test code can construct it without pulling the whole provider.Instance struct in.

type CheckResult ¶

type CheckResult struct {
	Capability
}

CheckResult is what HookCapabilityCheck returns. It mirrors the Capability registry entry but with the runtime-probe fields filled in. Callers typically merge it back into the registry so subsequent Lookup() calls reflect the verified state.

func HookCapabilityCheck(ctx context.Context, in CheckInput) CheckResult

type HookConfigWriter ¶

type HookConfigWriter interface {
	Write(workspace, gateBin string) error
	Remove(workspace string) error
	DryRun(workspace, gateBin string) (path string, content []byte, err error)
}

HookConfigWriter is the per-provider strategy for installing / removing the hook command in the provider's project-scoped settings directory.

Lifecycle (per spawn):

• GateEnabled=true → Write(workspace, gateBin)
• GateEnabled=false → Remove(workspace) (clean up stale config from a previous run where gate was on)

Implementations must be idempotent: Write twice with the same args produces the same on-disk content; Remove on a non-existent file is a no-op. The point is that a partially-failed previous run leaves the world in a recoverable state.

DryRun(workspace, gateBin) returns the path the writer *would* touch without actually writing. The capability probe (D5) uses it to spawn the provider against a temp workspace without polluting any real settings file.

func LookupHookConfigWriter(name string) (HookConfigWriter, bool)

type Prober ¶

type Prober interface {
	SendSentinel(ctx context.Context, workspace, sentinelPath string) error
}

Prober is the per-provider strategy for verifying that a freshly- installed hook config actually intercepts shell commands. Called by HookCapabilityCheck (D5) once the writer (above) has put a probe config into a throwaway workspace. The implementation spawns the real provider binary, asks it to touch a sentinel file, waits for the spawn to exit, and reports nil if the sentinel did not appear (deny was honored). Any non-nil error — sentinel created, spawn failed, timeout — flips HookVerified to false on the registry entry.

Probers are provider-specific because each CLI has its own way of receiving a one-shot prompt: claude takes stream-json on stdin, codex has `codex exec`, gemini has `-p`. Encoding that variety here would couple capability/ to every CLI's flag surface; the Prober interface keeps it abstract.

func LookupProber(name string) (Prober, bool)