@akira-tl/forgerelay 1.1.2 → 1.2.0

package/dist/lsp/language-server-config.js

@@ -1,90 +1,44 @@
-import { access, readFile, realpath } from "node:fs/promises";
+import { access, realpath } from "node:fs/promises";
 import { constants } from "node:fs";
 import { createHash } from "node:crypto";
 import { delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { z } from "zod";
+import { resolveProjectContext } from "../workspaces/state/project-context.js";
+import { effectiveLanguageServerEntries, resolveLanguageServersConfig, } from "../runtime/config/resolution/language-servers.js";
+import { projectExecutionRequirement } from "../runtime/security/project-execution-trust.js";
 export class LanguageServerConfigurationError extends Error {
     code;
-    constructor(code, message) {
+    availableDefinitionFingerprints;
+    constructor(code, message, availableDefinitionFingerprints) {
         super(message);
         this.code = code;
+        this.availableDefinitionFingerprints = availableDefinitionFingerprints;
         this.name = "LanguageServerConfigurationError";
     }
 }
-const definitionSchema = z.object({
-    enabled: z.boolean().optional(),
-    command: z.string().min(1).optional(),
-    args: z.array(z.string()).optional(),
-    env: z.record(z.string(), z.string()).optional(),
-    languages: z.array(z.string().min(1)).min(1).optional(),
-    extensions: z.array(z.string().regex(/^\./)).min(1).optional(),
-    languageIdByExtension: z.record(z.string().regex(/^\./), z.string().min(1)).optional(),
-    projectMarkers: z.array(z.string().min(1)).optional(),
-}).strict();
-const configSchema = z.record(z.string().min(1), definitionSchema);
-const BUILTIN_DEFINITIONS = {
-    typescript: {
-        executableCandidates: ["typescript-language-server"],
-        args: ["--stdio"],
-        languages: ["typescript", "typescriptreact", "javascript", "javascriptreact"],
-        extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"],
-        languageIdByExtension: {
-            ".ts": "typescript",
-            ".tsx": "typescriptreact",
-            ".js": "javascript",
-            ".jsx": "javascriptreact",
-            ".mjs": "javascript",
-            ".cjs": "javascript",
-        },
-        projectMarkers: ["tsconfig.json", "jsconfig.json", "package.json"],
-    },
-    pyright: {
-        executableCandidates: ["pyright-langserver"],
-        args: ["--stdio"],
-        languages: ["python"],
-        extensions: [".py", ".pyi"],
-        languageIdByExtension: { ".py": "python", ".pyi": "python" },
-        projectMarkers: ["pyrightconfig.json", "pyproject.toml", "setup.cfg", "setup.py"],
-    },
-    "rust-analyzer": {
-        executableCandidates: ["rust-analyzer"],
-        languages: ["rust"],
-        extensions: [".rs"],
-        languageIdByExtension: { ".rs": "rust" },
-        projectMarkers: ["Cargo.toml"],
-    },
-    gopls: {
-        executableCandidates: ["gopls"],
-        languages: ["go"],
-        extensions: [".go"],
-        languageIdByExtension: { ".go": "go" },
-        projectMarkers: ["go.work", "go.mod"],
-    },
-    clangd: {
-        executableCandidates: ["clangd"],
-        languages: ["c", "cpp", "objective-c", "objective-cpp"],
-        extensions: [".c", ".cc", ".cpp", ".cxx", ".h", ".hh", ".hpp", ".hxx", ".m", ".mm"],
-        languageIdByExtension: {
-            ".c": "c",
-            ".cc": "cpp",
-            ".cpp": "cpp",
-            ".cxx": "cpp",
-            ".h": "cpp",
-            ".hh": "cpp",
-            ".hpp": "cpp",
-            ".hxx": "cpp",
-            ".m": "objective-c",
-            ".mm": "objective-cpp",
-        },
-        projectMarkers: ["compile_commands.json", "compile_flags.txt", ".clangd"],
-    },
+const BUILTIN_EXECUTABLE_CANDIDATES = {
+    typescript: ["typescript-language-server"],
+    pyright: ["pyright-langserver"],
+    "rust-analyzer": ["rust-analyzer"],
+    gopls: ["gopls"],
+    clangd: ["clangd"],
 };
 export async function resolveLanguageProject(input) {
     const workspaceRoot = await canonicalWorkspaceRoot(input.workspaceRoot);
     const sourcePath = await resolveWorkspaceSourcePath(workspaceRoot, input.sourcePath);
-    const projectConfig = await loadProjectLanguageServerConfig(workspaceRoot);
-    const globalConfig = parseLanguageServerConfig(input.globalConfig ?? {}, "global ForgeRelay config");
-    const definitions = await effectiveDefinitions(globalConfig, projectConfig, input.env ?? process.env);
+    const environment = input.env ?? process.env;
+    const project = input.configDir
+        ? await resolveProjectContext(input.configDir, workspaceRoot)
+        : undefined;
+    const resolution = await resolveLanguageServersConfig({
+        ...(input.configDir ? { configDir: input.configDir } : {}),
+        ...(project ? { project } : {}),
+        projectSharedConfigDir: join(workspaceRoot, ".forgerelay"),
+        environment,
+        ...(input.sourceRuntime ? { sourceRuntime: input.sourceRuntime } : {}),
+    });
+    const errors = resolution.diagnostics.filter((diagnostic) => diagnostic.severity === "error" && diagnostic.usingLastKnownGood !== true);
+    const definitions = await materializeResolvedDefinitions(resolution, environment, project?.id);
+    const availableDefinitionFingerprints = Object.fromEntries(definitions.map((definition) => [definition.id, definition.configFingerprint]));
     const extension = extname(sourcePath).toLowerCase();
     const candidates = [];
     for (const definition of definitions) {
@@ -93,96 +47,49 @@ export async function resolveLanguageProject(input) {
         const projectRoot = await findLanguageProjectRoot(workspaceRoot, dirname(sourcePath), definition.projectMarkers);
         if (!projectRoot)
             continue;
-        candidates.push({ definition, projectRoot });
+        candidates.push({ definition, projectRoot, availableDefinitionFingerprints });
     }
     if (candidates.length === 0) {
-        throw new LanguageServerConfigurationError("code.language_service_unavailable", `No available Language-server definition matches ${relative(workspaceRoot, sourcePath) || "."}.`);
+        if (errors.length > 0) {
+            throw new LanguageServerConfigurationError("code.configuration_invalid", `Invalid Language-server configuration: ${errors.map((diagnostic) => `${diagnostic.source.location ?? diagnostic.source.id}: ${diagnostic.message}`).join("; ")}`, availableDefinitionFingerprints);
+        }
+        throw new LanguageServerConfigurationError("code.language_service_unavailable", `No available Language-server definition matches ${relative(workspaceRoot, sourcePath) || "."}.`, availableDefinitionFingerprints);
     }
-    const sourceRank = { builtin: 0, global: 1, project: 2 };
+    const sourceRank = { builtin: 0, global: 1, project: 2, "project-local": 3 };
     const highestRank = Math.max(...candidates.map((candidate) => sourceRank[candidate.definition.source]));
     const highest = candidates.filter((candidate) => sourceRank[candidate.definition.source] === highestRank);
     const deepestLength = Math.max(...highest.map((candidate) => candidate.projectRoot.length));
     const nearest = highest.filter((candidate) => candidate.projectRoot.length === deepestLength);
     if (nearest.length !== 1) {
-        throw new LanguageServerConfigurationError("code.configuration_ambiguous", `Multiple Language-server definitions match ${relative(workspaceRoot, sourcePath)} at the same priority: ${nearest.map((candidate) => candidate.definition.id).join(", ")}.`);
+        throw new LanguageServerConfigurationError("code.configuration_ambiguous", `Multiple Language-server definitions match ${relative(workspaceRoot, sourcePath)} at the same priority: ${nearest.map((candidate) => candidate.definition.id).join(", ")}.`, availableDefinitionFingerprints);
     }
     return nearest[0];
 }
-export async function loadProjectLanguageServerConfig(workspaceRoot) {
-    const path = join(workspaceRoot, ".forgerelay", "language-servers.json");
-    try {
-        return parseLanguageServerConfig(JSON.parse(await readFile(path, "utf8")), path);
-    }
-    catch (error) {
-        if (isMissingFile(error))
-            return {};
-        if (error instanceof LanguageServerConfigurationError)
-            throw error;
-        const reason = error instanceof Error ? error.message : String(error);
-        throw new LanguageServerConfigurationError("code.configuration_invalid", `Unable to load Language-server configuration at ${path}: ${reason}`);
-    }
-}
-export function parseLanguageServerConfig(value, label) {
-    const parsed = configSchema.safeParse(value ?? {});
-    if (!parsed.success) {
-        const details = parsed.error.issues
-            .map((issue) => `${issue.path.join(".") || "config"}: ${issue.message}`)
-            .join("; ");
-        throw new LanguageServerConfigurationError("code.configuration_invalid", `Invalid Language-server configuration in ${label}: ${details}`);
-    }
-    return parsed.data;
-}
-async function effectiveDefinitions(globalConfig, projectConfig, env) {
-    const ids = new Set([
-        ...Object.keys(BUILTIN_DEFINITIONS),
-        ...Object.keys(globalConfig),
-        ...Object.keys(projectConfig),
-    ]);
+async function materializeResolvedDefinitions(resolution, env, projectId) {
     const definitions = [];
-    for (const id of ids) {
-        const builtin = BUILTIN_DEFINITIONS[id];
-        const global = globalConfig[id];
-        const project = projectConfig[id];
-        const source = project
-            ? "project"
-            : global
-                ? "global"
-                : "builtin";
+    for (const entry of effectiveLanguageServerEntries(resolution)) {
         const merged = {
-            id,
-            source,
-            ...(builtin ?? {}),
-            ...(global ?? {}),
-            ...(project ?? {}),
-            env: {
-                ...(builtin?.env ?? {}),
-                ...(global?.env ?? {}),
-                ...(project?.env ?? {}),
-            },
-            languageIdByExtension: {
-                ...(builtin?.languageIdByExtension ?? {}),
-                ...(global?.languageIdByExtension ?? {}),
-                ...(project?.languageIdByExtension ?? {}),
-            },
+            id: entry.id,
+            source: sourceForScope(entry.scope),
+            ...entry.value,
         };
-        if (merged.enabled === false)
-            continue;
         const languages = merged.languages ?? [];
-        const extensions = merged.extensions?.map((entry) => entry.toLowerCase()) ?? [];
+        const extensions = merged.extensions?.map((value) => value.toLowerCase()) ?? [];
         if (languages.length === 0 || extensions.length === 0)
             continue;
-        const languageIdByExtension = normalizeLanguageIds(id, merged, languages, extensions);
+        const languageIdByExtension = normalizeLanguageIds(entry.id, merged, languages, extensions);
         let command = merged.command;
-        if (!command && builtin?.executableCandidates) {
-            command = await findExecutable(builtin.executableCandidates, env);
+        const executableCandidates = BUILTIN_EXECUTABLE_CANDIDATES[entry.id];
+        if (!command && executableCandidates) {
+            command = await findExecutable(executableCandidates, env);
             if (!command)
                 continue;
         }
         if (!command) {
-            throw new LanguageServerConfigurationError("code.configuration_invalid", `Language-server definition ${id} requires a command.`);
+            throw new LanguageServerConfigurationError("code.configuration_invalid", `Language-server definition ${entry.id} requires a command.`);
         }
         const normalized = {
-            id,
+            id: entry.id,
             command,
             args: merged.args ?? [],
             env: merged.env ?? {},
@@ -190,15 +97,33 @@ async function effectiveDefinitions(globalConfig, projectConfig, env) {
             extensions,
             languageIdByExtension,
             projectMarkers: merged.projectMarkers ?? [],
-            source,
+            source: merged.source,
         };
+        const configFingerprint = createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
+        const executionRequirement = projectId ? projectExecutionRequirement({
+            projectId,
+            resolution,
+            entryKey: `servers.${entry.id}`,
+            display: { kind: "language-server", name: entry.id },
+        }) : undefined;
         definitions.push({
             ...normalized,
-            fingerprint: createHash("sha256").update(JSON.stringify(normalized)).digest("hex"),
+            ...(executionRequirement ? { executionRequirement } : {}),
+            configFingerprint,
+            fingerprint: configFingerprint,
         });
     }
     return definitions;
 }
+function sourceForScope(scope) {
+    if (scope === "built-in")
+        return "builtin";
+    if (scope === "user")
+        return "global";
+    if (scope === "project" || scope === "project-local")
+        return scope;
+    throw new Error(`Unsupported Language Server config scope: ${scope}`);
+}
 function normalizeLanguageIds(id, definition, languages, extensions) {
     const mapping = Object.fromEntries(Object.entries(definition.languageIdByExtension ?? {})
         .map(([extension, languageId]) => [extension.toLowerCase(), languageId]));
@@ -308,6 +233,3 @@ function isWithin(root, candidate) {
     const rel = relative(root, candidate);
     return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
 }
-function isMissingFile(error) {
-    return error instanceof Error && "code" in error && error.code === "ENOENT";
-}

package/dist/lsp/runtime/manager.js

@@ -4,6 +4,7 @@ import { resolve, sep } from "node:path";
 import { CodeIntelligenceError, LanguageService, languageServiceKey, } from "../code-intelligence.js";
 import { LanguageServerConfigurationError, resolveLanguageProject, } from "../language-server-config.js";
 import { managedLanguageServerIdForCommand, managedLanguageServerRuntimeIdentity, managedTypeScriptTsserverPath, withManagedLanguageServerPath, } from "./managed-language-servers.js";
+import { compatibilityAllowProjectExecutionTrustPolicy, } from "../../runtime/security/project-execution-trust.js";
 const LANGUAGE_SERVICE_IDLE_MS = 10 * 60 * 1_000;
 const LANGUAGE_SERVICE_CLEANUP_INTERVAL_MS = 60 * 1_000;
 const MAX_LANGUAGE_SERVICES = 16;
@@ -26,8 +27,10 @@ export class CodeIntelligenceManager {
     cleanupTimer;
     policy;
     crashCooldownMs;
+    projectExecutionTrustPolicy;
     constructor(config, options = {}) {
         this.config = config;
+        this.projectExecutionTrustPolicy = options.projectExecutionTrustPolicy ?? compatibilityAllowProjectExecutionTrustPolicy;
         this.crashCooldownMs = positiveInteger(options.crashCooldownMs, LANGUAGE_SERVICE_CRASH_COOLDOWN_MS, "crashCooldownMs");
         this.policy = {
             idleMs: positiveInteger(options.idleMs, LANGUAGE_SERVICE_IDLE_MS, "idleMs"),
@@ -47,24 +50,31 @@ export class CodeIntelligenceManager {
         this.cleanupTimer.unref();
     }
     async run(workspaceRoot, input, options = {}) {
+        const canonicalWorkspaceRoot = await realpath(resolve(workspaceRoot));
+        this.assertWorkspaceRootAvailable(canonicalWorkspaceRoot);
         let project;
-        let canonicalWorkspaceRoot;
         try {
-            canonicalWorkspaceRoot = await realpath(resolve(workspaceRoot));
-            this.assertWorkspaceRootAvailable(canonicalWorkspaceRoot);
             project = withManagedLanguageServerRuntime(await resolveLanguageProject({
                 workspaceRoot: canonicalWorkspaceRoot,
                 sourcePath: input.path,
-                globalConfig: this.config.languageServers,
+                configDir: this.config.configDir,
                 env: withManagedLanguageServerPath(process.env, this.config.configDir),
+                sourceRuntime: this.config.configRuntime.sources,
             }), this.config.configDir);
         }
         catch (error) {
             if (error instanceof LanguageServerConfigurationError) {
+                if (error.availableDefinitionFingerprints) {
+                    await this.invalidateUnavailableServices(canonicalWorkspaceRoot, error.availableDefinitionFingerprints);
+                }
                 throw new CodeIntelligenceError(error.code, error.message);
             }
             throw error;
         }
+        if (project.definition.executionRequirement) {
+            await this.projectExecutionTrustPolicy.authorize(project.definition.executionRequirement);
+        }
+        await this.invalidateUnavailableServices(canonicalWorkspaceRoot, project.availableDefinitionFingerprints);
         await this.invalidateChangedServices(project);
         const identity = languageServiceKey(project);
         this.assertNotCoolingDown(identity, project);
@@ -217,6 +227,27 @@ export class CodeIntelligenceManager {
         }
         throw new CodeIntelligenceError("code.language_service_cooldown", `Language server ${project.definition.id} is cooling down after repeated crashes; retry in ${remaining}ms.`);
     }
+    async invalidateUnavailableServices(workspaceRoot, availableDefinitionFingerprints) {
+        const root = resolve(workspaceRoot);
+        const invalidated = [];
+        for (const [key, service] of this.services) {
+            if (resolve(service.workspaceRoot) !== root)
+                continue;
+            const currentFingerprint = availableDefinitionFingerprints[service.project.definition.id];
+            if (currentFingerprint === service.project.definition.configFingerprint)
+                continue;
+            this.invalidatedServiceKeys.add(key);
+            this.crashStates.delete(key);
+            if (service.isIdle)
+                invalidated.push([key, service]);
+        }
+        for (const [key, service] of invalidated) {
+            if (this.services.get(key) === service)
+                this.services.delete(key);
+            this.invalidatedServiceKeys.delete(key);
+            await service.shutdown();
+        }
+    }
     async invalidateChangedServices(project) {
         const root = resolve(project.projectRoot);
         const invalidated = [];

package/dist/mcp/hooks/config.js

@@ -0,0 +1,141 @@
+import * as z from "zod/v4";
+import { defineConfigDomain } from "../../runtime/config/definition/definition.js";
+export const HOOK_EVENTS = [
+    "WorkspaceOpen",
+    "BeforeTool",
+    "AfterTool",
+    "AfterToolFailure",
+    "ExternalMcpBeforeForward",
+    "ExternalMcpAfterForward",
+    "AfterFileChange",
+    "BeforeWorktreeClose",
+    "AfterWorktreeClose",
+    "SubagentStart",
+    "SubagentStop",
+];
+const schemaMetadata = {
+    $schema: z.string().optional().describe("Editor-only JSON Schema URL. Ignored by ForgeRelay resolution."),
+};
+const nonEmptyString = z.string().trim().min(1);
+const regexString = z.string().min(1).refine((value) => {
+    try {
+        new RegExp(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, "Must be a valid regular expression.");
+export const hookMatcherSchema = z.object({
+    tool: nonEmptyString.optional(),
+    commandRegex: regexString.optional(),
+    pathRegex: regexString.optional(),
+    provider: nonEmptyString.optional(),
+    workspaceMode: z.enum(["checkout", "worktree"]).optional(),
+    capability: nonEmptyString.optional(),
+    externalServer: nonEmptyString.optional(),
+    externalTool: nonEmptyString.optional(),
+}).strict();
+export const hookEntrySchema = z.object({
+    event: z.enum(HOOK_EVENTS),
+    matcher: hookMatcherSchema.optional(),
+    command: nonEmptyString,
+    timeoutSeconds: z.number().int().min(1).max(300).optional(),
+    report: z.boolean().optional(),
+}).strict();
+const resolvedHookEntrySchema = hookEntrySchema.extend({
+    name: nonEmptyString.optional(),
+    order: z.number().int().nonnegative().optional(),
+});
+export const hookDisabledEntrySchema = z.object({ disabled: z.literal(true) }).strict();
+export const hookCanonicalFileSchema = z.union([
+    hookEntrySchema.extend(schemaMetadata),
+    hookDisabledEntrySchema.extend(schemaMetadata),
+]);
+export const hookEntriesSchema = z.record(z.string().min(1), z.union([
+    hookDisabledEntrySchema,
+    z.array(resolvedHookEntrySchema).min(1),
+]));
+const legacyHookHandlerSchema = z.object({
+    name: nonEmptyString.optional(),
+    command: nonEmptyString,
+    timeoutSeconds: z.number().int().min(1).max(300).optional(),
+    report: z.boolean().optional(),
+}).strict();
+const legacyDirectHookRuleSchema = legacyHookHandlerSchema.extend({
+    matcher: hookMatcherSchema.optional(),
+});
+const legacyHookRuleSchema = z.union([
+    legacyDirectHookRuleSchema,
+    z.object({
+        matcher: hookMatcherSchema.optional(),
+        handlers: z.array(legacyHookHandlerSchema).min(1),
+    }).strict(),
+]);
+const legacyHookConfigSchema = z.object(Object.fromEntries(HOOK_EVENTS.map((event) => [event, z.array(legacyHookRuleSchema).optional()]))).strict();
+export function normalizeLegacyHookEntries(value) {
+    const parsed = legacyHookConfigSchema.parse(value ?? {});
+    const hooks = {};
+    let order = 0;
+    for (const event of HOOK_EVENTS) {
+        for (const [ruleIndex, rule] of (parsed[event] ?? []).entries()) {
+            const matcher = rule.matcher;
+            const handlers = "handlers" in rule ? rule.handlers : [rule];
+            for (const [handlerIndex, handler] of handlers.entries()) {
+                const key = handler.name ?? legacyHookKey(event, ruleIndex, handlerIndex);
+                const entry = {
+                    event,
+                    ...(matcher ? { matcher } : {}),
+                    command: handler.command,
+                    ...(handler.name ? { name: handler.name } : {}),
+                    order,
+                    ...(handler.timeoutSeconds === undefined ? {} : { timeoutSeconds: handler.timeoutSeconds }),
+                    ...(handler.report === undefined ? {} : { report: handler.report }),
+                };
+                order += 1;
+                const current = hooks[key];
+                if (current && !Array.isArray(current)) {
+                    throw new Error(`Legacy Hook ${key} conflicts with a disabled Hook entry.`);
+                }
+                hooks[key] = [...(current ?? []), entry];
+            }
+        }
+    }
+    return hooks;
+}
+function legacyHookKey(event, ruleIndex, handlerIndex) {
+    return `@legacy/${event}/${String(ruleIndex + 1).padStart(4, "0")}/${String(handlerIndex + 1).padStart(4, "0")}`;
+}
+const HOOK_SCOPES = ["project-local", "project", "user"];
+export const hooksConfigDefinition = defineConfigDomain({
+    domain: "hooks",
+    title: "ForgeRelay Lifecycle Hook configuration",
+    description: "Lifecycle Hook files composed by stable file name across user, project, and Project Local scopes.",
+    fileShape: {
+        kind: "keyed-entry",
+        field: "hooks",
+        fileSchema: hookCanonicalFileSchema,
+        normalizeEntry: (value) => {
+            if (isRecord(value) && value.disabled === true)
+                return { disabled: true };
+            return [value];
+        },
+    },
+    fields: {
+        hooks: {
+            schema: hookEntriesSchema,
+            description: "Lifecycle Hooks keyed by stable Hook name.",
+            required: true,
+            legalScopes: HOOK_SCOPES,
+            merge: "keyed",
+            reload: "hot",
+            sensitivity: "sensitive",
+            interpolation: "none",
+            builtIn: { kind: "none" },
+            executionEffect: (value) => isRecord(value) && value.disabled === true ? "none" : "process",
+        },
+    },
+});
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/mcp/hooks/external-mcp-transform.js

@@ -1,9 +1,11 @@
 import { performance } from "node:perf_hooks";
+import { ConfigSourceRuntime } from "../../runtime/config/runtime/source-refresh.js";
 import { commandPreview, logEvent, workspaceLogLabel } from "../../runtime/logging/logger.js";
 import { resolveCompatibilityCommandShellRuntime, snapshotCommandShellRuntime, } from "../../runtime/shell/command-shell-runtime.js";
+import { compatibilityAllowProjectExecutionTrustPolicy, } from "../../runtime/security/project-execution-trust.js";
 import { resolveShellCommandForRuntime } from "../process/process-platform.js";
 import { executeHookCommand } from "./command-runner.js";
-import { loadProjectHookConfig, matchHookRule, } from "./hooks.js";
+import { resolveHookExecutionPlan, } from "./hooks.js";
 export class ExternalMcpTransformError extends Error {
     server;
     tool;
@@ -23,12 +25,18 @@ export class ExternalMcpTransformRunner {
     hooks;
     logging;
     baseEnv;
+    configDir;
+    sourceRuntime;
+    projectExecutionTrustPolicy;
     commandShellRuntime;
     maxCaptureBytes;
-    constructor(hooks, logging, baseEnv = process.env, commandShellRuntime, mediaMaxBytes = 20 * 1024 * 1024) {
+    constructor(hooks, logging, baseEnv = process.env, commandShellRuntime, mediaMaxBytes = 20 * 1024 * 1024, configDir, sourceRuntime = new ConfigSourceRuntime(), projectExecutionTrustPolicy = compatibilityAllowProjectExecutionTrustPolicy) {
         this.hooks = hooks;
         this.logging = logging;
         this.baseEnv = baseEnv;
+        this.configDir = configDir;
+        this.sourceRuntime = sourceRuntime;
+        this.projectExecutionTrustPolicy = projectExecutionTrustPolicy;
         this.commandShellRuntime = snapshotCommandShellRuntime(commandShellRuntime ?? resolveCompatibilityCommandShellRuntime(process.platform, baseEnv));
         this.maxCaptureBytes = Math.max(MIN_TRANSFORM_CAPTURE_BYTES, Math.ceil((mediaMaxBytes * 4) / 3) + TRANSFORM_CAPTURE_OVERHEAD_BYTES);
     }
@@ -49,21 +57,20 @@ export class ExternalMcpTransformRunner {
             workspaceMode: context.workspaceMode,
             payload: transformMetadata(context, phase),
         };
-        const project = await loadProjectHookConfig(context.workspaceRoot);
-        const handlers = [
-            ...(this.hooks[event] ?? []).map((rule) => ({ scope: "global", rule })),
-            ...(project.hooks[event] ?? []).map((rule) => ({ scope: "project", rule })),
-        ].flatMap(({ scope, rule }) => {
-            const matched = matchHookRule(rule.matcher, invocation);
-            if (!matched)
-                return [];
-            return rule.handlers.map((handler) => ({ scope, handler }));
+        const plan = await resolveHookExecutionPlan({
+            event,
+            invocation,
+            legacyUser: this.hooks,
+            ...(this.configDir ? { configDir: this.configDir } : {}),
+            ...(context.project ? { project: context.project } : {}),
+            sourceRuntime: this.sourceRuntime,
         });
+        const handlers = plan.handlers;
         let value = initialValue;
         const transforms = [];
         for (const [index, entry] of handlers.entries()) {
             signal?.throwIfAborted();
-            const execution = await this.runHandler(event, phase, context, entry.handler, entry.scope, index, value, signal);
+            const execution = await this.runHandler(event, phase, context, entry.handler, entry.scope, index, value, entry.executionRequirement, signal);
             value = execution.value;
             transforms.push({
                 phase,
@@ -74,7 +81,7 @@ export class ExternalMcpTransformRunner {
         }
         return { value, transforms };
     }
-    async runHandler(event, phase, context, handler, scope, index, currentValue, signal) {
+    async runHandler(event, phase, context, handler, scope, index, currentValue, executionRequirement, signal) {
         const startedAt = performance.now();
         const name = handler.name ?? `${event} handler ${index + 1}`;
         const shell = resolveShellCommandForRuntime(handler.command, this.commandShellRuntime);
@@ -95,6 +102,8 @@ export class ExternalMcpTransformRunner {
         };
         const stdin = JSON.stringify(transformInput(phase, context, currentValue));
         try {
+            if (executionRequirement)
+                await this.projectExecutionTrustPolicy.authorize(executionRequirement);
             const result = await executeHookCommand({
                 executable: shell.executable,
                 args: shell.args,