chore(go): audit providers kimi grok qwen letta

Move Kimi, Grok, and Qwen onto managed_runtime.go and shell_command.go;
share the encoded and shell command builders and the quoted Windows
legacy parser with Droid; split managed_changes.go; dedupe Letta's hook
entry filtering and stop swallowing settings read errors.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

cmd/elydora/plugins/qwen_contract.go

@@ -4,7 +4,6 @@ import (
 	"path/filepath"
 	"runtime"
 	"sort"
-	"strings"
 )
 
 const (
@@ -40,12 +39,6 @@ type qwenManagedRemoval struct {
 	removeGroup    bool
 }
 
-type qwenRuntimeContract struct {
-	agentID   string
-	guardPath string
-	auditPath string
-}
-
 func qwenExpectedShell() string {
 	if runtime.GOOS == "windows" {
 		return "powershell"
@@ -58,41 +51,52 @@ func buildQwenGroup(nodePath, scriptPath, name string) map[string]any {
 		"hooks": []any{map[string]any{
 			"type":    "command",
 			"name":    name,
-			"command": buildQwenCommand(nodePath, scriptPath),
+			"command": buildShellCommand(nodePath, scriptPath),
 			"shell":   qwenExpectedShell(),
 			"timeout": qwenHookTimeout,
 		}},
 	}
 }
 
+func qwenRuntimeReferenceForCommand(
+	command, scriptName, runtimeRoot string,
+) *managedScriptReference {
+	executable, scriptPath, ok := parseShellCommand(command)
+	if !ok || !filepath.IsAbs(executable) || !isNodeExecutable(executable) {
+		return nil
+	}
+	return managedScriptWithin(scriptPath, scriptName, runtimeRoot)
+}
+
 func currentQwenReference(
 	handler map[string]any,
 	scriptName, hookName, runtimeRoot string,
-) (qwenRuntimeReference, bool) {
+) *managedScriptReference {
 	if len(handler) != 5 || handler["type"] != "command" ||
 		handler["name"] != hookName || handler["shell"] != qwenExpectedShell() ||
 		handler["timeout"] != qwenHookTimeout {
-		return qwenRuntimeReference{}, false
+		return nil
 	}
 	command, ok := handler["command"].(string)
 	if !ok {
-		return qwenRuntimeReference{}, false
+		return nil
 	}
 	return qwenRuntimeReferenceForCommand(command, scriptName, runtimeRoot)
 }
 
+// legacyQwenReference reads the pre-2.1 unnamed handler.
 func legacyQwenReference(
 	handler map[string]any,
 	scriptName, runtimeRoot string,
-) (qwenRuntimeReference, bool) {
+) *managedScriptReference {
 	if len(handler) != 4 || handler["type"] != "command" ||
 		handler["shell"] != qwenExpectedShell() ||
 		handler["timeout"] != qwenHookTimeout {
-		return qwenRuntimeReference{}, false
+		return nil
 	}
 	command, ok := handler["command"].(string)
 	if !ok {
-		return qwenRuntimeReference{}, false
+		return nil
 	}
 	return qwenRuntimeReferenceForCommand(command, scriptName, runtimeRoot)
 }
@@ -101,19 +105,19 @@ func managedQwenReference(
 	handler map[string]any,
 	scriptName, hookName, runtimeRoot string,
 	includeLegacy bool,
-) (qwenRuntimeReference, bool) {
-	if reference, ok := currentQwenReference(
+) *managedScriptReference {
+	if reference := currentQwenReference(
 		handler,
 		scriptName,
 		hookName,
 		runtimeRoot,
-	); ok {
-		return reference, true
+	); reference != nil {
+		return reference
 	}
 	if includeLegacy {
 		return legacyQwenReference(handler, scriptName, runtimeRoot)
 	}
-	return qwenRuntimeReference{}, false
+	return nil
 }
 
 func exactCurrentQwenGroup(group map[string]any) bool {
@@ -138,14 +142,15 @@ func managedQwenRemovals(
 			handlers := group["hooks"].([]any)
 			indexes := make([]int, 0)
 			for handlerIndex, handlerValue := range handlers {
-				reference, managed := managedQwenReference(
+				reference := managedQwenReference(
 					handlerValue.(map[string]any),
 					contract.script,
 					contract.name,
 					runtimeRoot,
 					true,
 				)
-				if managed && (agentID == "" || sameQwenAgentID(reference.agentID, agentID)) {
+				if reference != nil &&
+					(agentID == "" || sameManagedAgentID(reference.agentID, agentID)) {
 					indexes = append(indexes, handlerIndex)
 				}
 			}
@@ -163,18 +168,11 @@ func managedQwenRemovals(
 	return removals
 }
 
-func normalizedQwenAgentID(agentID string) string {
-	if runtime.GOOS == "windows" {
-		return strings.ToLower(agentID)
-	}
-	return agentID
-}
-
 func qwenReferencesForEvent(
 	settings qwenHookSettings,
 	event, scriptName, hookName, runtimeRoot string,
-) map[string][]qwenRuntimeReference {
-	references := map[string][]qwenRuntimeReference{}
+) map[string][]managedScriptReference {
+	references := map[string][]managedScriptReference{}
 	groups, _ := settings[event].([]any)
 	for _, groupValue := range groups {
 		group := groupValue.(map[string]any)
@@ -182,17 +180,17 @@ func qwenReferencesForEvent(
 			continue
 		}
 		for _, handlerValue := range group["hooks"].([]any) {
-			reference, ok := currentQwenReference(
+			reference := currentQwenReference(
 				handlerValue.(map[string]any),
 				scriptName,
 				hookName,
 				runtimeRoot,
 			)
-			if !ok {
+			if reference == nil {
 				continue
 			}
-			key := normalizedQwenAgentID(reference.agentID)
-			references[key] = append(references[key], reference)
+			key := managedReferenceKey(reference.agentID)
+			references[key] = append(references[key], *reference)
 		}
 	}
 	return references
@@ -201,7 +199,7 @@ func qwenReferencesForEvent(
 func qwenRuntimeContracts(
 	settings qwenHookSettings,
 	runtimeRoot string,
-) []qwenRuntimeContract {
+) []managedRuntimeContract {
 	guards := qwenReferencesForEvent(
 		settings,
 		"PreToolUse",
@@ -223,31 +221,23 @@ func qwenRuntimeContracts(
 		qwenAuditHookName,
 		runtimeRoot,
 	)
-	contracts := make([]qwenRuntimeContract, 0)
+	contracts := make([]managedRuntimeContract, 0)
 	for key, guard := range guards {
 		post := posts[key]
 		failure := failures[key]
 		if len(guard) != 1 || len(post) != 1 || len(failure) != 1 ||
-			!sameQwenPath(post[0].scriptPath, failure[0].scriptPath) {
+			!sameManagedPath(post[0].scriptPath, failure[0].scriptPath) {
 			continue
 		}
-		contracts = append(contracts, qwenRuntimeContract{
+		contracts = append(contracts, managedRuntimeContract{
 			agentID:   guard[0].agentID,
 			guardPath: guard[0].scriptPath,
 			auditPath: post[0].scriptPath,
 		})
 	}
 	sort.Slice(contracts, func(left, right int) bool {
-		return normalizedQwenAgentID(contracts[left].agentID) <
-			normalizedQwenAgentID(contracts[right].agentID)
+		return managedReferenceKey(contracts[left].agentID) <
+			managedReferenceKey(contracts[right].agentID)
 	})
 	return contracts
 }
-
-func qwenRuntimeRoot() (string, error) {
-	return AgentRuntimeRoot()
-}
-
-func qwenContractDirectory(contract qwenRuntimeContract) string {
-	return filepath.Dir(contract.guardPath)
-}