eqtylab
diff --git a/‎.github/workflows/debug-claude.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/debug-claude.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎README.md‎
Lines changed: 13 additions & 12 deletions b/‎README.md‎
Lines changed: 13 additions & 12 deletions
diff --git a/‎cupcake-cli/src/catalog_cli.rs‎
Lines changed: 25 additions & 33 deletions b/‎cupcake-cli/src/catalog_cli.rs‎
Lines changed: 25 additions & 33 deletions
@@ -172,7 +172,7 @@ jobs:
                   "denials": [],
                   "blocks": [],
                   "asks": [],
-                  "allow_overrides": [],
+                  "modifications": [],
                   "add_context": []
               }
           }
 
@@ -18,31 +18,32 @@ Make AI agents follow the rules.
 **Policy enforcement** layer for AI agents; yielding better performance and security **without consuming model context**.
 
 - **Deterministic rule-following** for your agents.
-- **Better performance** by moving rules out of context and into guarantees.
+- **Better performance** by moving rules out of context and into policy-as-code.
 - **LLM-as-a-judge** for more dynamic governance.
 - **Trigger alerts** and put _bad_ agents in timeout when they repeatedly violate rules.
 
-Cupcake intercepts agent events and evaluates them against **user-defined rules** written in **[Open Policy Agent (OPA)](https://www.openpolicyagent.org/) [Rego](https://www.openpolicyagent.org/docs/policy-language)**. Agent actions can be blocked, modified, and auto-corrected by providing the agent helpful feedback. Additional benefits include reactive automation for tasks you dont need to rely on the agent to conduct (like linting after a file edit).
+Cupcake intercepts agent events and evaluates them against **user-defined rules** written in **[Open Policy Agent (OPA)](https://www.openpolicyagent.org/) [Rego](https://www.openpolicyagent.org/docs/policy-language)** or **Typescript policy programs** that abstract Rego. Agent actions can be blocked, modified, and auto-corrected by providing the agent helpful feedback. Additional benefits include reactive automation for tasks you dont need to rely on the agent to conduct (like linting after a file edit).
 
 ## Updates
 
 **`2025-12-09`**: Official open source release. Roadmap will be produced in Q1 2026.
 
-**`2025-04-04`**: We produce the [feature request](https://github.com/anthropics/claude-code/issues/712) for Claude Code Hooks. Runtime alignement requires integration into the agent harnesses, and we pivot away from filesystem and os-level monitoring of agent behavior (early cupcake PoC).
+**`2025-04-04`**: We produce the [feature request](https://github.com/anthropics/claude-code/issues/712) for Claude Code Hooks. Runtime alignment requires integration into the agent harnesses, and we pivot away from filesystem and os-level monitoring of agent behavior (early cupcake PoC).
 
 ## Supported Agent Harnesses
 
-Cupcake provides **native integrations** for multiple AI coding agents:
+Cupcake provides lightweight **native integrations** for multiple AI coding agents:
 
-| Harness                                                                           | Status             | Integration Guide                                                      |
-| --------------------------------------------------------------------------------- | ------------------ | ---------------------------------------------------------------------- |
-| **[Claude Code](https://claude.ai/code)**                                         | ✅ Fully Supported | [Setup Guide](./docs/user-guide/harnesses/claude-code.md)              |
-| **[Cursor](https://cursor.com)**                                                  | ✅ Fully Supported | [Setup Guide](./docs/user-guide/harnesses/cursor.md)                   |
-| **[Factory AI](https://docs.factory.ai/welcome)**                                 | ✅ Fully Supported | [Setup Guide](./docs/user-guide/harnesses/factory.md)                  |
-| **[OpenCode](https://opencode.ai)**                                               | ✅ Fully Supported | [Setup Guide](./docs/agents/opencode/quickstart.md)                    |
-| **[Gemini CLI](https://docs.cloud.google.com/gemini/docs/codeassist/gemini-cli)** | Coming soon        | [Awaiting PR](https://github.com/google-gemini/gemini-cli/issues/2779) |
+| Harness                                                                           | Status             | Integration Guide                                                           |
+| --------------------------------------------------------------------------------- | ------------------ | --------------------------------------------------------------------------- |
+| **[Claude Code](https://claude.ai/code)**                                         | ✅ Fully Supported | [Setup Guide](./docs/user-guide/harnesses/claude-code.md)                   |
+| **[Cursor](https://cursor.com)**                                                  | ✅ Fully Supported | [Setup Guide](./docs/user-guide/harnesses/cursor.md)                        |
+| **[Factory AI](https://docs.factory.ai/welcome)**                                 | ✅ Fully Supported | [Setup Guide](./docs/user-guide/harnesses/factory.md)                       |
+| **[OpenCode](https://opencode.ai)**                                               | ✅ Fully Supported | [Setup Guide](./docs/agents/opencode/quickstart.md)                         |
+| **[AMP](https://ampcode.com)**                                                    | Coming soon        | [Awaiting release](https://ampcode.com/manual?internal#hooks)               |
+| **[Gemini CLI](https://docs.cloud.google.com/gemini/docs/codeassist/gemini-cli)** | Coming soon        | [Awaiting release](https://github.com/google-gemini/gemini-cli/issues/2779) |
 
-Each harness uses native event formats. Similar to terraform, policies are separated by harness (`policies/claude/`, `policies/cursor/`, `policies/factory/`, `policies/opencode/`) to ensure clarity and full access to harness-specific capabilities.
+Each harness uses native event formats. Similar to terraform, policies are separated by harness (`policies/claude/`, `policies/cursor/`, `policies/factory/`, `policies/opencode/`) to ensure clarity and full access to harness-specific capabilities. If a particular harness is not supported, it is because it has no means for runtime integration.
 
 #### Language Bindings
 
 
@@ -173,7 +173,7 @@ async fn execute_repo_command(command: RepoCommand) -> Result<()> {
         RepoCommand::Add { name, url } => {
             manager.add_registry(&name, &url)?;
             manager.save()?;
-            println!("Added repository '{}' -> {}", name, url);
+            println!("Added repository '{name}' -> {url}");
         }
         RepoCommand::List => {
             println!("Configured repositories:\n");
@@ -189,7 +189,7 @@ async fn execute_repo_command(command: RepoCommand) -> Result<()> {
         RepoCommand::Remove { name } => {
             manager.remove_registry(&name)?;
             manager.save()?;
-            println!("Removed repository '{}'", name);
+            println!("Removed repository '{name}'");
         }
     }
 
@@ -305,7 +305,7 @@ async fn execute_show(name: &str, json_output: bool, force_refresh: bool) -> Res
 
     let versions = index
         .get_versions(name)
-        .context(format!("Rulebook '{}' not found in catalog", name))?;
+        .context(format!("Rulebook '{name}' not found in catalog"))?;
 
     let latest = versions.first().context("No versions available")?;
 
@@ -338,7 +338,7 @@ async fn execute_show(name: &str, json_output: bool, force_refresh: bool) -> Res
         println!();
         println!("Description:");
         for line in latest.description.lines() {
-            println!("  {}", line);
+            println!("  {line}");
         }
 
         println!();
@@ -393,9 +393,8 @@ async fn execute_install(name: &str, version: Option<&str>, force_refresh: bool)
     let entry = index
         .resolve_version(rulebook_name, version_spec)
         .context(format!(
-            "No version matching '{}' found for '{}'.\n\
-             Supported formats: 1.2.0 (exact), ^1.2 (compatible), ~1.2 (patch-level), latest",
-            version_spec, rulebook_name
+            "No version matching '{version_spec}' found for '{rulebook_name}'.\n\
+             Supported formats: 1.2.0 (exact), ^1.2 (compatible), ~1.2 (patch-level), latest"
         ))?;
 
     // Show what version was resolved for non-exact specifiers
@@ -486,7 +485,7 @@ async fn execute_uninstall(name: &str) -> Result<()> {
     let mut lock = CatalogLock::load_or_default()?;
 
     if !lock.is_installed(name) {
-        println!("Rulebook '{}' is not installed.", name);
+        println!("Rulebook '{name}' is not installed.");
         return Ok(());
     }
 
@@ -504,7 +503,7 @@ async fn execute_uninstall(name: &str) -> Result<()> {
     lock.remove_installed(name);
     lock.save()?;
 
-    println!("Uninstalled '{}' v{}", name, version);
+    println!("Uninstalled '{name}' v{version}");
 
     Ok(())
 }
@@ -560,7 +559,7 @@ async fn execute_upgrade(name: Option<&str>, dry_run: bool, force_refresh: bool)
 
     if to_check.is_empty() {
         if let Some(n) = name {
-            println!("Rulebook '{}' is not installed.", n);
+            println!("Rulebook '{n}' is not installed.");
         }
         return Ok(());
     }
@@ -621,10 +620,7 @@ async fn execute_upgrade(name: Option<&str>, dry_run: bool, force_refresh: bool)
     }
 
     for name in &not_in_catalog {
-        println!(
-            "\nWarning: '{}' not found in catalog (may have been removed)",
-            name
-        );
+        println!("\nWarning: '{name}' not found in catalog (may have been removed)");
     }
 
     if dry_run {
@@ -663,7 +659,7 @@ async fn execute_upgrade(name: Option<&str>, dry_run: bool, force_refresh: bool)
 async fn execute_lint(path: &std::path::Path) -> Result<()> {
     use cupcake_core::catalog::RulebookManifest;
 
-    println!("Validating rulebook at {:?}...\n", path);
+    println!("Validating rulebook at {path:?}...\n");
 
     let mut errors: Vec<String> = Vec::new();
     let mut warnings: Vec<String> = Vec::new();
@@ -681,7 +677,7 @@ async fn execute_lint(path: &std::path::Path) -> Result<()> {
         Ok(manifest) => {
             // Validate manifest fields
             if let Err(e) = manifest.validate() {
-                errors.push(format!("Manifest validation failed: {}", e));
+                errors.push(format!("Manifest validation failed: {e}"));
             }
 
             // Check policies exist for declared harnesses
@@ -692,34 +688,30 @@ async fn execute_lint(path: &std::path::Path) -> Result<()> {
                 for harness in &manifest.metadata.harnesses {
                     let harness_dir = policies_dir.join(harness);
                     if !harness_dir.exists() {
-                        errors.push(format!(
-                            "Missing policies directory for harness: {}",
-                            harness
-                        ));
+                        errors.push(format!("Missing policies directory for harness: {harness}"));
                         continue;
                     }
 
                     // Check for system/evaluate.rego
                     let system_eval = harness_dir.join("system").join("evaluate.rego");
                     if !system_eval.exists() {
                         errors.push(format!(
-                            "Missing system/evaluate.rego for harness: {}",
-                            harness
+                            "Missing system/evaluate.rego for harness: {harness}"
                         ));
                     }
 
                     // Check that at least some .rego files exist
                     let rego_files = count_rego_files(&harness_dir);
                     if rego_files == 0 {
-                        errors.push(format!("No .rego files found for harness: {}", harness));
+                        errors.push(format!("No .rego files found for harness: {harness}"));
                     }
                 }
             }
 
             // Validate Rego namespaces
             if policies_dir.exists() {
                 if let Err(e) = validate_rego_namespaces(path, &manifest.metadata.name) {
-                    errors.push(format!("Namespace validation failed: {}", e));
+                    errors.push(format!("Namespace validation failed: {e}"));
                 }
             }
 
@@ -740,7 +732,7 @@ async fn execute_lint(path: &std::path::Path) -> Result<()> {
             println!();
         }
         Err(e) => {
-            errors.push(format!("Failed to parse manifest.yaml: {}", e));
+            errors.push(format!("Failed to parse manifest.yaml: {e}"));
         }
     }
 
@@ -818,11 +810,11 @@ fn print_validation_results(errors: &[String], warnings: &[String]) {
     }
 
     for error in errors {
-        println!("ERROR: {}", error);
+        println!("ERROR: {error}");
     }
 
     for warning in warnings {
-        println!("WARNING: {}", warning);
+        println!("WARNING: {warning}");
     }
 
     println!();
@@ -844,7 +836,7 @@ async fn execute_package(path: &std::path::Path, output: &std::path::Path) -> Re
     use sha2::{Digest, Sha256};
     use tar::Builder;
 
-    println!("Packaging rulebook at {:?}...\n", path);
+    println!("Packaging rulebook at {path:?}...\n");
 
     // Validate first
     let manifest_path = path.join("manifest.yaml");
@@ -859,15 +851,15 @@ async fn execute_package(path: &std::path::Path, output: &std::path::Path) -> Re
     let version = &manifest.metadata.version;
 
     // Create tarball filename
-    let tarball_name = format!("{}-{}.tar.gz", name, version);
+    let tarball_name = format!("{name}-{version}.tar.gz");
     let tarball_path = output.join(&tarball_name);
 
     // Ensure output directory exists
     std::fs::create_dir_all(output)?;
 
     // Create tarball
     let tarball_file = std::fs::File::create(&tarball_path)
-        .with_context(|| format!("Failed to create {:?}", tarball_path))?;
+        .with_context(|| format!("Failed to create {tarball_path:?}"))?;
 
     let encoder = GzEncoder::new(tarball_file, Compression::default());
     let mut builder = Builder::new(encoder);
@@ -884,11 +876,11 @@ async fn execute_package(path: &std::path::Path, output: &std::path::Path) -> Re
     let tarball_bytes = std::fs::read(&tarball_path)?;
     let digest = format!("sha256:{:x}", Sha256::digest(&tarball_bytes));
 
-    println!("Created: {:?}", tarball_path);
+    println!("Created: {tarball_path:?}");
     println!("Size:    {} bytes", tarball_bytes.len());
-    println!("Digest:  {}", digest);
+    println!("Digest:  {digest}");
     println!();
-    println!("Rulebook: {} v{}", name, version);
+    println!("Rulebook: {name} v{version}");
     println!("Harnesses: {}", manifest.metadata.harnesses.join(", "));
 
     Ok(())
Original file line number	Diff line number	Diff line change
`@@ -172,7 +172,7 @@ jobs:`
`172`	`172`	`"denials": [],`
`173`	`173`	`"blocks": [],`
`174`	`174`	`"asks": [],`
`175`		`- "allow_overrides": [],`
	`175`	`+ "modifications": [],`
`176`	`176`	`"add_context": []`
`177`	`177`	`}`
`178`	`178`	`}`