Module hook_mode 

Hook-mode policy shared by the engine and the agent-hook installers.

Which integration mode an agent gets (Mcp / Hybrid / Replace), the agent lists behind that choice, and the MCP server env block every installer writes. Pure policy over Config and the environment: the installers in hooks consume it, and engine modules (config, telemetry, host coverage, context overhead) read it without depending on hooks.

Enums

HookMode

Controls how hooks instruct agents to access lean-ctx functionality.

Constants

HYBRID_AGENTS

Agents that get Hybrid mode (MCP + shell hooks) because they lack reliable deny infrastructure but do have shell hooks for command compression.

MCP_ONLY_AGENTS

First-class agents that get MCP registration only — no shell hooks, because their hook surface does not (yet) carry lean-ctx’s contract.

REPLACE_AGENTS

Agents with reliable shell + hook infrastructure that can run Replace mode (native tools denied, lean-ctx MCP is the only path). These agents have either permissions.deny support or PreToolUse deny-hook capability.

Functions

claude_hides_native_search

Whether Claude Code (and CodeBuddy, which shares its contract) keeps native Grep/Glob out of the model’s tool list via permissions.deny.

is_supported_agent

True when agent is integrated via init --agent / setup (hooks, rules, MCP registration). GH #1520: used by wrap’s error path to point users of a supported-but-not-proxy-wrappable agent (e.g. opencode) at the working command instead of a bare “unsupported agent”.

mcp_server_env_json

The MCP server env block as a JSON object, for the JSON-config agents.

mcp_server_env_pairs

Env key/value pairs for the lean-ctx MCP server entry written into agent configs (Codex TOML + the JSON agents).

recommend_hook_mode

Auto-detect the best hook mode for a given agent key.

replace_mode_chosen

True when native-tool denial is in effect: the user chose Replace and has not suppressed denials (#1037). Deny hooks consult this at call time, so a hook entry written while Replace was the default stops blocking the moment the binary updates — no settings rewrite has to happen first.