#202 adapter: guard another agent harness (Aider / Cursor / Continue / generic MCP)

[Anonymous]

Originally created by: fu351

Refreshed from [#95] (opened 2026-07-11) — see that thread for earlier discussion.

Why

Doberman mediates a coding agent's tool calls into allow / authenticate / block decisions. Several reference host integrations already exist — src/doberman/hosthooks/claude_code.py (Claude Code), src/doberman/hosthooks/codex.py (Codex CLI), and adapters/openclaw/ (OpenClaw) — but the decision engine underneath is harness-agnostic, and every additional adapter multiplies the project's reach.

What to do

Pick one harness and add an adapter for it. Good candidates (comment on the issue to claim one so we don't double up):

• Aider
• Cursor
• Continue
• A generic MCP / stdio bridge (guards anything speaking that protocol)

The adapter's job: normalize that harness's tool-call events into a SecurityObject and route them through the existing decision engine — reusing the shared rules, not re-implementing them. Two hard invariants:

• No path around the engine. Every mediated tool call goes through the chokepoint; there is no bypass.
• Fail closed. If an event can't be parsed into a SecurityObject, deny/BLOCK — never pass it through unchecked.

Study the existing integrations before starting: src/doberman/hosthooks/claude_code.py and src/doberman/hosthooks/codex.py show the Python pre/post-tool hook shape, how a decision maps back to allow/deny for the host, and taint-floor application; adapters/openclaw/ shows the same pattern bridging a different (JS/Node) host runtime. Together they show the adapter contract holds across languages, not just within hosthooks/.

If you'd rather warm up first, [#189] (docs: document the shared shape of Doberman's host adapters, level-3) pairs naturally with this issue — it documents the pattern before you build a new adapter on top of it.

Tests (tests/integration)

• A representative tool call from the new harness produces the same verdict the engine gives for the equivalent SecurityObject.
• A BLOCK means the downstream tool never ran (assert the fake tool recorded nothing).

Done when

• The adapter guards a real round trip for that harness; a BLOCK is provably enforced; tests are green; docs note the newly supported host.

Great for…

…anyone who uses one of these tools daily — you'll be able to run your own agent behind Doberman when you're done.

[Anonymous]

Originally posted by: fu351

Trimmed the candidate list: Codex CLI is already guarded (src/doberman/hosthooks/codex.py, adapters/codex/, with tests), so it's off the menu. Aider, Cursor, Continue, and a generic MCP/stdio bridge are the open ones — claim whichever you use daily. Level stays 7.