@alecsibilia/luca 13.0.0-alpha.10 → 13.0.0-alpha.13

package/dist/chunks/branch.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.CI5IvdwC.mjs';
+import '../shared/luca.BDFQnOdW.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,13 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as runWriteHandler, u as lucaBranchGuardTool } from '../shared/luca.BtwZ3m3l.mjs';
-import '../shared/luca.ig-qt2eC.mjs';
+import { t as lucaBranchGuardTool } from '../shared/luca.CbIDM-ci.mjs';
+import '../shared/luca.DpeRJDkV.mjs';
+import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
 import 'node:os';
-import '../shared/luca.GSXJf0Tv.mjs';
-import '../shared/luca.LySXBNNL.mjs';
-import '../shared/luca.DbrDoFFH.mjs';
+import '../shared/luca.B15qErL2.mjs';
+import '../shared/luca.YEUgoPFK.mjs';
+import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
+import '../shared/luca.Dmpy9SlE.mjs';
 
 const guardCommand = defineCommand({
   meta: {
@@ -28,7 +31,8 @@ const guardCommand = defineCommand({
       description: 'Branch name that must NOT equal the current branch (typically the repository default branch, default "main").'
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("branch guard", cmd, rawArgs);
     await runWriteHandler("branch guard", lucaBranchGuardTool, {
       default_branch: args["default-branch"]
     });

package/dist/chunks/checks.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.CI5IvdwC.mjs';
+import '../shared/luca.BDFQnOdW.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,13 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { f as readJsonPayload, r as runWriteHandler, t as lucaChecksRunTool } from '../shared/luca.BtwZ3m3l.mjs';
-import '../shared/luca.ig-qt2eC.mjs';
+import { s as lucaChecksRunTool } from '../shared/luca.CbIDM-ci.mjs';
+import '../shared/luca.DpeRJDkV.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
 import 'node:os';
-import '../shared/luca.GSXJf0Tv.mjs';
-import '../shared/luca.LySXBNNL.mjs';
-import '../shared/luca.DbrDoFFH.mjs';
+import '../shared/luca.B15qErL2.mjs';
+import '../shared/luca.YEUgoPFK.mjs';
+import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
+import '../shared/luca.Dmpy9SlE.mjs';
 
 const runCommand = defineCommand({
   meta: {
@@ -32,7 +35,8 @@ const runCommand = defineCommand({
       description: "Per-command timeout in milliseconds (range 100-600000, default 90000). On timeout the process is killed."
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("checks run", cmd, rawArgs);
     const commands = await readJsonPayload("checks run", args.file);
     await runWriteHandler("checks run", lucaChecksRunTool, {
       commands,

package/dist/chunks/claim-verify.mjs

@@ -1,420 +1,19 @@
 import { defineCommand } from 'citty';
 import { resolve } from 'pathe';
-import '../shared/luca.CI5IvdwC.mjs';
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { v as verifyFile } from '../shared/luca.BDFQnOdW.mjs';
+import 'node:fs';
 import 'node:fs/promises';
-import { join } from 'node:path';
+import 'node:path';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';
-import { spawnSync } from 'node:child_process';
+import 'node:child_process';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
+import { s as sanitizeControlChars } from '../shared/luca.BAqmbI4n.mjs';
 import 'zod';
 import 'node:os';
 import 'consola';
 
-const SYMBOL_STOPWORDS = /* @__PURE__ */ new Set([
-  "true",
-  "false",
-  "null",
-  "undefined",
-  "void",
-  "any",
-  "unknown",
-  "never",
-  "string",
-  "number",
-  "boolean",
-  "object",
-  "array",
-  "bun",
-  "npm",
-  "pnpm",
-  "yarn",
-  "git",
-  "gh",
-  "pr",
-  "ci",
-  "cd",
-  "repo",
-  "main",
-  "master",
-  "dev",
-  "build",
-  "test",
-  "lint",
-  "tsc",
-  "eslint",
-  "todo",
-  "fixme",
-  "note",
-  "warn",
-  "info",
-  "log",
-  "http",
-  "https",
-  "json",
-  "yaml",
-  "toml",
-  "env",
-  "src",
-  "dist",
-  "lib",
-  "app",
-  "apps"
-]);
-const COUNTABLE_NOUNS = /* @__PURE__ */ new Set([
-  "file",
-  "files",
-  "test",
-  "tests",
-  "table",
-  "tables",
-  "index",
-  "indexes",
-  "indices",
-  "function",
-  "functions",
-  "endpoint",
-  "endpoints",
-  "route",
-  "routes",
-  "mutation",
-  "mutations",
-  "query",
-  "queries",
-  "action",
-  "actions",
-  "tool",
-  "tools",
-  "mode",
-  "modes",
-  "phase",
-  "phases",
-  "wave",
-  "waves",
-  "commit",
-  "commits",
-  "package",
-  "packages",
-  "module",
-  "modules",
-  "class",
-  "classes",
-  "method",
-  "methods",
-  "component",
-  "components",
-  "hook",
-  "hooks"
-]);
-function singularize(noun) {
-  const lower = noun.toLowerCase();
-  if (lower === "indices") return "index";
-  if (lower === "queries") return "query";
-  if (lower === "classes") return "class";
-  if (lower === "indexes") return "index";
-  if (lower.endsWith("ies") && lower.length > 3) {
-    return `${lower.slice(0, -3)}y`;
-  }
-  if (lower.endsWith("s") && !lower.endsWith("ss")) return lower.slice(0, -1);
-  return lower;
-}
-const BACKTICK_RE = /`([^`\n]+)`/g;
-const FILE_PATH_RE = /(?:^|[\s(`'"])((?:packages|src|apps|lib|tests?|docs?|\.planning|\.luca|\.changeset|\.github)\/[\w./-]+\.[\w]+)(?=[\s)`'".,;!?]|$)/g;
-const QUANTITATIVE_RE = /\b(\d+)\s+([a-zA-Z]+)\b/g;
-const IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function extractClaims(text) {
-  if (!text) return [];
-  const lines = text.split("\n");
-  const seen = /* @__PURE__ */ new Set();
-  const claims = [];
-  const pushIfNew = (key, claim) => {
-    if (seen.has(key)) return;
-    seen.add(key);
-    claims.push(claim);
-  };
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i] ?? "";
-    const sourceLine = i + 1;
-    const sourceContext = line.trim().slice(0, 240);
-    for (const match of line.matchAll(BACKTICK_RE)) {
-      const inner = (match[1] ?? "").trim();
-      if (inner.includes("/") && /\.\w+(?:[#?:]|$)/.test(inner)) continue;
-      if (!IDENTIFIER_RE.test(inner)) continue;
-      if (inner.length < 3) continue;
-      if (SYMBOL_STOPWORDS.has(inner.toLowerCase())) continue;
-      pushIfNew(`symbol:${inner}`, {
-        type: "symbol",
-        text: match[0],
-        identifier: inner,
-        sourceLine,
-        sourceContext
-      });
-    }
-    for (const match of line.matchAll(FILE_PATH_RE)) {
-      const path = match[1];
-      if (!path) continue;
-      pushIfNew(`path:${path}`, {
-        type: "file-path",
-        text: path,
-        path,
-        sourceLine,
-        sourceContext
-      });
-    }
-    for (const match of line.matchAll(QUANTITATIVE_RE)) {
-      const numStr = match[1];
-      const noun = match[2];
-      if (!numStr || !noun) continue;
-      if (numStr.length === 4) {
-        const n = Number(numStr);
-        if (n >= 1900 && n <= 2200) continue;
-      }
-      const lowerNoun = noun.toLowerCase();
-      if (!COUNTABLE_NOUNS.has(lowerNoun)) continue;
-      const num = Number(numStr);
-      if (!Number.isFinite(num)) continue;
-      pushIfNew(`count:${num}:${lowerNoun}`, {
-        type: "quantitative",
-        text: `${numStr} ${noun}`,
-        number: num,
-        noun: singularize(lowerNoun),
-        sourceLine,
-        sourceContext
-      });
-    }
-  }
-  return claims;
-}
-function gitAvailable(repoRoot) {
-  const r = spawnSync(
-    "git",
-    ["-C", repoRoot, "rev-parse", "--is-inside-work-tree"],
-    { encoding: "utf-8" }
-  );
-  return r.status === 0;
-}
-function gitGrepFiles(repoRoot, needle, timeoutMs) {
-  const r = spawnSync(
-    "git",
-    ["-C", repoRoot, "grep", "--untracked", "-l", "--fixed-strings", needle],
-    { encoding: "utf-8", timeout: timeoutMs }
-  );
-  if (r.signal === "SIGTERM" || r.error?.message?.includes("ETIMEDOUT")) {
-    return { ok: false, matchedFiles: [], timedOut: true };
-  }
-  if (r.status === 1) return { ok: true, matchedFiles: [], timedOut: false };
-  if (r.status !== 0) return { ok: false, matchedFiles: [], timedOut: false };
-  const matchedFiles = (r.stdout ?? "").split("\n").map((s) => s.trim()).filter(Boolean);
-  return { ok: true, matchedFiles, timedOut: false };
-}
-const FS_SKIP_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  ".next",
-  ".turbo",
-  "coverage",
-  ".cache"
-]);
-const FS_SKIP_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".png",
-  ".jpg",
-  ".jpeg",
-  ".gif",
-  ".webp",
-  ".ico",
-  ".pdf",
-  ".zip",
-  ".tar",
-  ".gz",
-  ".lock",
-  ".lockb"
-]);
-const FS_MAX_FILE_BYTES = 5 * 1024 * 1024;
-function fsGrepFiles(repoRoot, needle, timeoutMs) {
-  const start = Date.now();
-  const matchedFiles = [];
-  const stack = [repoRoot];
-  while (stack.length > 0) {
-    if (Date.now() - start > timeoutMs) {
-      return { ok: false, matchedFiles, timedOut: true };
-    }
-    const dir = stack.pop();
-    if (dir === void 0) break;
-    let entries;
-    try {
-      entries = readdirSync(dir);
-    } catch {
-      continue;
-    }
-    for (const name of entries) {
-      const full = join(dir, name);
-      let info;
-      try {
-        info = statSync(full);
-      } catch {
-        continue;
-      }
-      if (info.isDirectory()) {
-        if (FS_SKIP_DIRS.has(name)) continue;
-        stack.push(full);
-        continue;
-      }
-      if (!info.isFile()) continue;
-      const dotIdx = name.lastIndexOf(".");
-      if (dotIdx >= 0) {
-        const ext = name.slice(dotIdx).toLowerCase();
-        if (FS_SKIP_EXTENSIONS.has(ext)) continue;
-      }
-      if (info.size > FS_MAX_FILE_BYTES) continue;
-      try {
-        if (readFileSync(full).includes(needle)) {
-          matchedFiles.push(full);
-        }
-      } catch {
-      }
-    }
-  }
-  return { ok: true, matchedFiles, timedOut: false };
-}
-function searchFiles(repoRoot, needle, timeoutMs, useGit) {
-  return useGit ? gitGrepFiles(repoRoot, needle, timeoutMs) : fsGrepFiles(repoRoot, needle, timeoutMs);
-}
-function verifyClaims(claims, opts) {
-  const totalBudgetMs = opts.totalBudgetMs ?? 3e4;
-  const perClaimBudgetMs = opts.perClaimBudgetMs ?? 5e3;
-  const useGit = gitAvailable(opts.repoRoot);
-  const start = Date.now();
-  const failures = [];
-  let timedOut = false;
-  const breakdown = { symbols: 0, filePaths: 0, quantitative: 0 };
-  for (const claim of claims) {
-    if (claim.type === "symbol") breakdown.symbols++;
-    else if (claim.type === "file-path") breakdown.filePaths++;
-    else breakdown.quantitative++;
-    if (Date.now() - start > totalBudgetMs) {
-      timedOut = true;
-      failures.push({
-        claim,
-        reason: "timeout",
-        evidence: `Total budget ${totalBudgetMs}ms exhausted before this claim was checked.`
-      });
-      continue;
-    }
-    if (claim.type === "symbol" && claim.identifier) {
-      const r = searchFiles(
-        opts.repoRoot,
-        claim.identifier,
-        perClaimBudgetMs,
-        useGit
-      );
-      if (r.timedOut) {
-        timedOut = true;
-        failures.push({
-          claim,
-          reason: "timeout",
-          evidence: `Search for symbol "${claim.identifier}" exceeded ${perClaimBudgetMs}ms.`
-        });
-        continue;
-      }
-      if (!r.ok || r.matchedFiles.length === 0) {
-        failures.push({
-          claim,
-          reason: "symbol-not-found",
-          evidence: `git grep for "${claim.identifier}" returned 0 hits.`
-        });
-      }
-      continue;
-    }
-    if (claim.type === "file-path" && claim.path) {
-      const abs = join(opts.repoRoot, claim.path);
-      if (!existsSync(abs)) {
-        failures.push({
-          claim,
-          reason: "file-not-found",
-          evidence: `Path "${claim.path}" does not exist (resolved to ${abs}).`
-        });
-      }
-      continue;
-    }
-    if (claim.type === "quantitative" && claim.noun && typeof claim.number === "number") {
-      const r = searchFiles(
-        opts.repoRoot,
-        claim.noun,
-        perClaimBudgetMs,
-        useGit
-      );
-      if (r.timedOut) {
-        timedOut = true;
-        failures.push({
-          claim,
-          reason: "timeout",
-          evidence: `Search for noun "${claim.noun}" exceeded ${perClaimBudgetMs}ms.`
-        });
-        continue;
-      }
-      if (!r.ok) {
-        failures.push({
-          claim,
-          reason: "count-mismatch",
-          evidence: `grep for "${claim.noun}" failed; cannot verify "${claim.text}".`
-        });
-        continue;
-      }
-      const found = r.matchedFiles.length;
-      if (Math.abs(found - claim.number) > 1) {
-        failures.push({
-          claim,
-          reason: "count-mismatch",
-          evidence: `Claim says "${claim.text}", repo has ${found} file(s) mentioning "${claim.noun}" (tolerance \xB11).`
-        });
-      }
-      continue;
-    }
-  }
-  return {
-    passed: failures.length === 0,
-    totalClaims: claims.length,
-    failures,
-    extractedBreakdown: breakdown,
-    timedOut
-  };
-}
-function verifyTextArtifact(text, opts) {
-  return verifyClaims(extractClaims(text), opts);
-}
-function verifyFile(filePath, opts) {
-  let text;
-  try {
-    text = readFileSync(filePath, "utf-8");
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return {
-      passed: false,
-      totalClaims: 0,
-      failures: [
-        {
-          claim: {
-            type: "file-path",
-            text: filePath,
-            path: filePath,
-            sourceLine: 0,
-            sourceContext: ""
-          },
-          reason: "artifact-unreadable",
-          evidence: `Could not read "${filePath}": ${msg}`
-        }
-      ],
-      extractedBreakdown: { symbols: 0, filePaths: 0, quantitative: 0 },
-      timedOut: false
-    };
-  }
-  return verifyTextArtifact(text, opts);
-}
-
 const claimVerifyCommand = defineCommand({
   meta: {
     name: "claim-verify",
@@ -446,8 +45,14 @@ const claimVerifyCommand = defineCommand({
     for (const failure of report.failures) {
       const loc = failure.claim.sourceLine > 0 ? ` (line ${failure.claim.sourceLine})` : "";
       logger.error(
-        `${failure.reason}: ${failure.claim.text}${loc}
-  ${failure.evidence}`
+        `${failure.reason}: ${sanitizeControlChars(failure.claim.text)}${loc}
+  ${sanitizeControlChars(failure.evidence)}`
+      );
+    }
+    for (const warning of report.forbiddenLanguage) {
+      logger.warn(
+        `forbidden-language: "${warning.phrase}" (line ${warning.sourceLine}) has no nearby probe evidence
+  ${sanitizeControlChars(warning.sourceContext)}`
       );
     }
     if (report.passed) {

package/dist/chunks/classify.mjs

@@ -1,5 +1,5 @@
 import { defineCommand } from 'citty';
-import { C as ClassifyComplexityInputSchema } from '../shared/luca.CI5IvdwC.mjs';
+import { C as ClassifyComplexityInputSchema } from '../shared/luca.BDFQnOdW.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';

package/dist/chunks/confidence.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
-import '../shared/luca.CI5IvdwC.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.GSXJf0Tv.mjs';
+import '../shared/luca.BDFQnOdW.mjs';
+import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.B15qErL2.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,15 +8,18 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as readConfidenceJournal, b as renderConfidenceJournalMarkdown, g as getConfidenceSummary } from '../shared/luca.LySXBNNL.mjs';
+import { r as readConfidenceJournal, b as renderConfidenceJournalMarkdown, g as getConfidenceSummary } from '../shared/luca.YEUgoPFK.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
 import 'zod';
-import { f as readJsonPayload, r as runWriteHandler, w as lucaConfidenceLogTool } from '../shared/luca.BtwZ3m3l.mjs';
-import '../shared/luca.ig-qt2eC.mjs';
+import { v as lucaConfidenceLogTool } from '../shared/luca.CbIDM-ci.mjs';
+import '../shared/luca.DpeRJDkV.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
 import 'node:os';
-import '../shared/luca.DbrDoFFH.mjs';
+import '../shared/luca.BKflEntw.mjs';
 import 'consola';
+import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
+import '../shared/luca.Dmpy9SlE.mjs';
 
 function selectConfidenceGateActions(entries) {
   const auto = [];
@@ -128,7 +131,8 @@ const logCommand = defineCommand({
       description: "Optional. Explicit gate routing override: auto | research | ask. Overrides confidence-derived bucketing when set."
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("confidence log", cmd, rawArgs);
     let payload;
     if (args.file) {
       const fromFile = await readJsonPayload("confidence log", args.file);
@@ -181,7 +185,8 @@ const readCommand = defineCommand({
       description: "Phase slug to read (default: the active phase)."
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("confidence read", cmd, rawArgs);
     const cwd = process.cwd();
     const slug = await resolveSlug({ explicit: args.slug, cwd });
     const entries = readConfidenceJournal({ cwd, slug });
@@ -200,7 +205,8 @@ const summaryCommand = defineCommand({
       description: "Phase slug to summarize (default: the active phase)."
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("confidence summary", cmd, rawArgs);
     const cwd = process.cwd();
     const slug = await resolveSlug({ explicit: args.slug, cwd });
     const summary = getConfidenceSummary(
@@ -221,7 +227,8 @@ const renderCommand = defineCommand({
       description: "Phase slug to render (default: the active phase)."
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("confidence render", cmd, rawArgs);
     const cwd = process.cwd();
     const slug = await resolveSlug({ explicit: args.slug, cwd });
     const md = renderConfidenceJournalMarkdown(
@@ -242,7 +249,8 @@ const gateCommand = defineCommand({
       description: "Phase slug (defaults to active phase)."
     }
   },
-  async run({ args }) {
+  async run({ args, rawArgs, cmd }) {
+    rejectUnknownFlags("confidence gate", cmd, rawArgs);
     const cwd = process.cwd();
     const slug = await resolveSlug({ explicit: args.slug, cwd });
     const actions = selectConfidenceGateActions(

package/dist/chunks/hook.mjs

@@ -1,16 +1,16 @@
 import { defineCommand } from 'citty';
-import { c as coarsePhaseOf, t as toLucaRelative, a as classifyWritePath, b as TMP_PATH_PATTERN, A as AUDIT_PATH_PATTERN, W as WAVE_FILE_RE } from '../shared/luca.CI5IvdwC.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.GSXJf0Tv.mjs';
+import { c as coarsePhaseOf, t as toLucaRelative, a as classifyWritePath, b as TMP_PATH_PATTERN, A as AUDIT_PATH_PATTERN, W as WAVE_FILE_RE } from '../shared/luca.BDFQnOdW.mjs';
+import { l as loadCurrentState, S as STEP_ARTIFACTS, r as resolveActiveSlug } from '../shared/luca.B15qErL2.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
-import { l as lucaStateClaimOwnerTool, S as STEP_ARTIFACTS } from '../shared/luca.ig-qt2eC.mjs';
-import { p as phasePathFor } from '../shared/luca.DbrDoFFH.mjs';
+import { p as phasePathFor } from '../shared/luca.BKflEntw.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
 import { parse } from 'shell-quote';
+import { l as lucaStateClaimOwnerTool } from '../shared/luca.DpeRJDkV.mjs';
 import 'zod';
 import 'node:os';
 
@@ -234,7 +234,8 @@ const LUCA_READ_VERBS = /* @__PURE__ */ new Set([
   "aggregate",
   "filter-stale",
   "detect-convergence",
-  "regression-check"
+  "regression-check",
+  "lint"
 ]);
 const LUCA_NOUN_VERBS = {
   state: /* @__PURE__ */ new Set(["read", "advance", "claim-owner", "set-current-phase"]),
@@ -253,7 +254,9 @@ const LUCA_NOUN_VERBS = {
   workflow: /* @__PURE__ */ new Set(["reset"]),
   confidence: /* @__PURE__ */ new Set(["log"]),
   // Read-side surfaces over the per-phase verify.json files.
-  verification: /* @__PURE__ */ new Set(["read", "aggregate"])
+  verification: /* @__PURE__ */ new Set(["read", "aggregate"]),
+  // Read-only plan-quality linter over a plan.md file.
+  plan: /* @__PURE__ */ new Set(["lint"])
 };
 function classifyLucaCommand(rest) {
   if (rest.some((t) => ["--help", "-h", "--version"].includes(t))) {
@@ -590,10 +593,10 @@ async function handleStageGateHook(opts) {
   }
   let category;
   let pathBlockReason;
-  if (toolName === "Edit" || toolName === "Write" || toolName === "NotebookEdit") {
-    const targetPath = toolInput?.file_path;
+  if (toolName === "Edit" || toolName === "Write" || toolName === "NotebookEdit" || toolName === "replace" || toolName === "write_file") {
+    const targetPath = toolInput?.file_path ?? toolInput?.path;
     if (!targetPath) {
-      log(`stage-gate: ${toolName} without file_path \u2014 allowing`);
+      log(`stage-gate: ${toolName} without file_path/path \u2014 allowing`);
       return { exitCode: 0, toolName, toolInput, decision: "allow" };
     }
     const relTarget = toLucaRelative(targetPath, cwd);
@@ -620,7 +623,7 @@ async function handleStageGateHook(opts) {
     } else {
       category = pathClassToToolCategory(pc.class);
     }
-  } else if (toolName === "Bash") {
+  } else if (toolName === "Bash" || toolName === "run_shell_command" || toolName === "run_command") {
     const command = toolInput?.command ?? "";
     const bashResult = classifyBashCommand(command);
     if (bashResult.category === "denied") {