@allansantos-dev/smart-tool 0.9.6 → 0.9.7

package/redirect_rule.py

@@ -0,0 +1,232 @@
+"""Deterministic redirect rule of the PreToolUse hook for native code searches (Grep, Glob, Bash).
+
+A content search over a directory of a project (grep -r, rg, git grep, the Grep tool on a folder) or over more than
+LISTED_MAX files goes to smart_search; reading listed files, listings, Glob and commands that change files run. Only
+the part of a Bash command that searches is measured, with its own paths: `cd` is carried, `$VAR` set in the command or
+in the environment, `~` and globs are expanded, and a path still holding an unresolved variable is left alone.
+
+Measured on 2026-10-09 against 2,789 real decisions of the LLM router it replaced (session cwd recovered from the
+transcripts): the model redirected 315, this rule 463 (134 shared); in a sample of 40 redirected by the rule alone, 40
+were content searches over a folder or many files; in a sample of 40 redirected by the model alone, ~36 were wrong
+(one file, `node -e` over one file, `git show`, listings, commands changing files). Median 0.2 ms against 1.5 s.
+"""
+import glob
+import os
+import re
+import shlex
+import time
+
+import index_scope
+import project_store
+
+LISTED_MAX = 20
+SCAN_MAX_FILES = 4000
+SCAN_MAX_SECONDS = 0.25
+# Trees the native tools walk into: their presence is part of the cost, they are counted.
+HEAVY_DIRS = frozenset({"node_modules", ".venv", "venv", "vendor", "target", "dist", "build", "out", ".next", ".nuxt",
+                        ".gradle", "Pods"})
+SEARCHERS = frozenset({"grep", "egrep", "fgrep", "rg", "ripgrep", "ack", "ag", "findstr", "select-string", "sls"})
+ALWAYS_RECURSIVE = frozenset({"rg", "ripgrep", "ack", "ag"})
+LISTERS = frozenset({"find", "fd", "ls", "dir", "tree", "get-childitem", "gci"})
+CD_VERBS = frozenset({"cd", "pushd", "set-location", "sl"})
+PATTERN_FLAGS = frozenset({"-e", "--regexp", "-f", "--file"})
+VALUE_FLAGS = frozenset({"-A", "-B", "-C", "-m", "--max-count", "--include", "--exclude", "--exclude-dir", "-g",
+                         "--glob", "-t", "--type", "-T", "--type-not", "--max-depth", "-d", "--context",
+                         "--after-context", "--before-context"})
+RECURSIVE_FLAGS = frozenset({"-r", "-R", "--recursive", "-Recurse", "/s", "/S"})
+_ASSIGN = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=(.*)$")
+_VARIABLE = re.compile(r"\$\{(\w+)\}|\$(\w+)")
+
+
+def resolve_path(raw, base):
+    """Path normalized for the disk: relative to base, and the MSYS `/c/...` form agents write in a POSIX shell on
+    Windows turned into `C:/...`."""
+    if not raw:
+        return None
+    path = raw.strip().replace("\\", "/")
+    msys = re.fullmatch(r"/([A-Za-z])(/.*)?", path)
+    if msys:
+        path = f"{msys.group(1).upper()}:{msys.group(2) or '/'}"
+    if not os.path.isabs(path) and base:
+        path = os.path.join(base, path)
+    return os.path.normpath(path)
+
+
+def count_files(path):
+    """(files, truncated) under a directory, skipping dot-directories, bounded by count and time."""
+    files, deadline = 0, time.monotonic() + SCAN_MAX_SECONDS
+    for _dirpath, dirnames, filenames in os.walk(path):
+        dirnames[:] = [d for d in dirnames if not d.startswith(".") and d != "__pycache__"]
+        files += len(filenames)
+        if files > SCAN_MAX_FILES or time.monotonic() > deadline:
+            return files, True
+    return files, False
+
+
+def _in_project(target, cwd):
+    """A registered project holds target, or target is inside the session's directory."""
+    key = os.path.normcase(os.path.abspath(target)) + os.sep
+    if any(key.startswith(os.path.normcase(os.path.abspath(p["root"])).rstrip(os.sep) + os.sep)
+           for p in project_store.all_projects()):
+        return True
+    return bool(cwd) and index_scope._within_root(cwd, target)
+
+
+def _has_files(target):
+    """Any file under the folder: the size limit measured made no difference (0 files: 463 redirects, 50: 400), and a
+    missed redirect costs more context than a needless one."""
+    files, truncated = count_files(target)
+    return truncated or files > 0
+
+
+def segments(command):
+    """(text, after_single_pipe) of each part of a shell command split on ; && || | and newlines outside quotes."""
+    parts, current, quote, i, after_pipe = [], [], None, 0, False
+    while i < len(command):
+        ch = command[i]
+        if quote:
+            current.append(ch)
+            quote = None if ch == quote else quote
+        elif ch in "'\"":
+            quote = ch
+            current.append(ch)
+        elif command.startswith(("&&", "||"), i):
+            parts.append(("".join(current), after_pipe))
+            current, after_pipe = [], False
+            i += 2
+            continue
+        elif ch in ";\n|":
+            parts.append(("".join(current), after_pipe))
+            current, after_pipe = [], ch == "|"
+        else:
+            current.append(ch)
+        i += 1
+    parts.append(("".join(current), after_pipe))
+    return [(text.strip(), pipe) for text, pipe in parts if text.strip()]
+
+
+def _expand(token, variables):
+    def substitute(match):
+        name = match.group(1) or match.group(2)
+        return variables.get(name, os.environ.get(name, match.group(0)))
+    return os.path.expanduser(_VARIABLE.sub(substitute, token))
+
+
+def _paths(raw, base):
+    """Existing paths of a token (globs expanded), or None when it still holds an unresolved variable."""
+    if "$" in raw or "`" in raw:
+        return None
+    path = resolve_path(raw, base)
+    if any(ch in raw for ch in "*?["):
+        return [os.path.normpath(p) for p in glob.glob(path)]
+    return [path] if path and os.path.exists(path) else []
+
+
+def _search_args(verb, tokens):
+    """Path arguments of a grep-like command (the pattern and flag values dropped) and whether it is recursive."""
+    recursive = verb in ALWAYS_RECURSIVE or any(
+        t in RECURSIVE_FLAGS or (re.fullmatch(r"-[a-zA-Z]+", t) and ("r" in t or "R" in t)) for t in tokens)
+    args, skip, pattern_given = [], False, False
+    for token in tokens:
+        if skip:
+            skip = False
+        elif token in PATTERN_FLAGS:
+            skip, pattern_given = True, True
+        elif token in VALUE_FLAGS:
+            skip = True
+        elif not token.startswith("-") and not (verb == "findstr" and token.startswith("/")):
+            args.append(token)
+    return (args if pattern_given else args[1:]), recursive
+
+
+def _bash(command, cwd):
+    base, variables, verdict = cwd, {}, ("allow", "No content search over a folder.")
+    for text, after_pipe in segments(command):
+        try:
+            tokens = shlex.split(text, posix=True)
+        except ValueError:
+            tokens = text.split()
+        while tokens and _ASSIGN.match(tokens[0]):
+            name, value = _ASSIGN.match(tokens[0]).groups()
+            variables[name] = _expand(value, variables)
+            tokens = tokens[1:]
+        if not tokens:
+            continue
+        verb = tokens[0].lower()
+        if verb in CD_VERBS and len(tokens) > 1:
+            base = resolve_path(_expand(tokens[1], variables), base) or base
+            continue
+        xargs = verb == "xargs" and len(tokens) > 1 and tokens[1].lower() in SEARCHERS
+        if after_pipe and not xargs:
+            continue
+        if xargs:
+            if base and os.path.isdir(base) and _in_project(base, cwd) and _has_files(base):
+                return "redirect", base, "content search over the files of a listing"
+            continue
+        if verb == "git":
+            rest, repo = tokens[1:], base
+            while len(rest) > 1 and rest[0] == "-C":
+                repo = resolve_path(_expand(rest[1], variables), repo) or repo
+                rest = rest[2:]
+            if rest and rest[0] == "grep":
+                specs = rest[rest.index("--") + 1:] if "--" in rest else []
+                found = [_paths(_expand(raw, variables), repo) for raw in specs]
+                only_files = specs and all(f and all(os.path.isfile(p) for p in f) for f in found)
+                listed = sum(len(f) for f in found if f) if only_files else 0
+                if (not only_files or listed > LISTED_MAX) and repo and os.path.isdir(repo) and \
+                        _in_project(repo, cwd) and _has_files(repo):
+                    return "redirect", repo, "git grep over the repository"
+            continue
+        if verb in LISTERS:
+            recursive = verb in ("find", "fd", "tree") or "-recurse" in (t.lower() for t in tokens) or any(
+                re.fullmatch(r"-[a-zA-Z]*R[a-zA-Z]*", t) for t in tokens[1:])
+            first = next((t for t in tokens[1:] if not t.startswith("-")), ".")
+            for target in (_paths(_expand(first, variables), base) or []) if recursive else []:
+                if os.path.isdir(target) and _in_project(target, cwd) and count_files(target)[1]:
+                    return "redirect", target, "recursive listing of a very large tree"
+            continue
+        if verb not in SEARCHERS:
+            continue
+        args, recursive = _search_args(verb, tokens[1:])
+        if not args:
+            if recursive and base and os.path.isdir(base) and _in_project(base, cwd) and _has_files(base):
+                return "redirect", base, "recursive content search of the working folder"
+            continue
+        listed = 0
+        for raw in args:
+            found = _paths(_expand(raw, variables), base)
+            if found is None:
+                verdict = ("allow", "The searched path uses a variable the hook cannot resolve.")
+                continue
+            for target in found:
+                if os.path.isdir(target):
+                    if recursive and _in_project(target, cwd) and _has_files(target):
+                        return "redirect", target, "recursive content search over a folder"
+                else:
+                    listed += 1
+        if listed > LISTED_MAX:
+            return "redirect", base, f"content search over {listed} files"
+        if listed:
+            verdict = ("allow", "Search inside listed files.")
+    return verdict[0], None, verdict[1]
+
+
+def decide(tool_name, tool_input, cwd):
+    """(decision, target, reason) for a Grep, Glob or Bash call: decision is redirect or allow, target the folder that
+    would be searched (None when allowed)."""
+    if tool_name == "Glob":
+        return "allow", None, "Glob lists file names; smart_search does not replace a listing."
+    if tool_name == "Grep":
+        target = resolve_path(tool_input.get("path") or cwd, cwd)
+        if not target or not os.path.exists(target):
+            return "allow", None, "The path does not exist: the native tool's error is the useful answer."
+        if os.path.isfile(target):
+            return "allow", None, "Search inside one file."
+        if not _in_project(target, cwd):
+            return "allow", None, "The folder is outside every project: no index covers it."
+        if not _has_files(target):
+            return "allow", None, "The folder has no files."
+        return "redirect", target, "content search over a folder"
+    if tool_name == "Bash":
+        return _bash(tool_input.get("command") or "", cwd)
+    return "allow", None, "Tool not redirected."

package/router.py

@@ -1,242 +1,27 @@
 #!/usr/bin/env python3
-"""Roteador de tool calls do Smart Tool. V1 não tem classificador mecânico de "tem
-escopo": toda chamada de tool nativa casada pelo hook passa por aqui, que pergunta a um
-modelo pequeno se deve deixar passar ou redirecionar pra `smart_search`. Cada decisão é
-logada em `router-metrics.jsonl` pra orientar um classificador mais fino depois, com
-base em uso real — não numa suposição a priori.
-"""
+"""Routing of the native tool calls the PreToolUse hook matches (Grep, Glob, Bash, Read). Deterministic: calls that
+neither search nor read code, or that change files, run; accepted block patterns redirect; the rest follows
+redirect_rule. Searches the rule lets run are reviewed in the background by the router model, which may propose new
+block patterns (block_patterns). Every decision is logged in router-metrics.jsonl. Also holds the router-model
+helpers of the web search (tier order and result assessment)."""
 import contextvars
 import json
 import os
 import paths
 import re
+import sys
 import time
 
 import atomic_io
+import block_patterns
 import model_client
-import index_scope
-import indexer
+import redirect_rule
 import web_search_adapters
 
 # Per request: the daemon serves each hook call on its own thread, so a module global mixed up clients.
 CLIENT = contextvars.ContextVar("router_client", default=None)
 METRICS_PATH = os.path.join(paths.DATA_DIR, "router-metrics.jsonl")
 
-_SYSTEM_PROMPT = (
-    "You decide whether a tool call (native: Grep, Glob, Read, or Bash running a "
-    "search/read command such as grep/find/cat/ls -R/rg) should execute directly or "
-    "be redirected to an indexed semantic search (smart_search), because it is "
-    "potentially expensive or imprecise (e.g. no path filter, a large directory like "
-    "node_modules, an unscoped recursive command, or a question better answered by "
-    "semantic search than by regex/raw listing). For Bash, judge by the command's "
-    "content (the tool_input 'command' field): only consider redirecting commands "
-    "whose purpose is to search/read source code — never redirect commands with any "
-    "other effect (build, git, install, running a script, etc.), even if grep/cat/find "
-    "appear mid-pipeline.\n\n"
-    "The 'target' object is measured on disk right now — prefer it over any guess you "
-    "would make from the path string alone:\n"
-    "- target.files / target.truncated: files found under the target, ignoring the "
-    "directories listed in target.heavy_dirs and target.ignored_by_default. 'truncated': "
-    "true means the scan hit its budget, so the tree is big.\n"
-    "- target.heavy_dirs: dependency/build trees present under the target (node_modules, "
-    ".venv, dist...). A raw recursive search may reach them, unless the project's ignore "
-    "rules already exclude them.\n"
-    "- target.ignored_by_default: directories the native search tool skips on its own "
-    "(.git, __pycache__, dot-directories). Their presence is NOT a cost signal.\n"
-    "- target.scope: present when the target could not be derived from the call itself, "
-    "so the measurement describes the session directory and not what the command reads.\n"
-    "- target.outside_project: the target is outside the project root; no index covers "
-    "it, so never redirect.\n"
-    "- target.indexed: whether a semantic index already exists for this project. When it "
-    "is false, redirecting forces a cold index build inside the call (embedding every "
-    "file, tens of seconds) — only worth it when the search really is broad.\n"
-    "- target.missing: true when the path does not exist; never redirect those, the "
-    "native tool's own error is the useful answer.\n\n"
-    "Reading one specific file is never redirected. When in doubt, answer 'allow'. "
-    "Call submit_decision with your answer."
-)
-
-# Toda chamada de Grep/Glob/Read/Bash do agente espera por esta decisão, e o desfecho de
-# falha é `allow` — então esperar mais só atrasa o agente sem mudar o resultado. O valor
-# pressupõe `router_model` sem cadeia de raciocínio: um modelo "thinking" gasta mais de mil
-# tokens numa decisão binária e estoura isto sempre, abrindo o breaker e deixando o
-# roteamento desligado de forma permanente.
-DECISION_TIMEOUT_S = 8
-
-_SCAN_MAX_FILES = 4000
-_SCAN_MAX_SECONDS = 0.25
-# Percorridos pela tool nativa: a presença deles é sinal de custo de verdade.
-_HEAVY_DIR_NAMES = frozenset({
-    "node_modules", ".venv", "venv", "vendor", "target", "dist", "build", "out",
-    ".next", ".nuxt", ".gradle", "Pods",
-})
-# Grep/Glob do Claude Code são ripgrep, que já pula estes por padrão — listá-los junto
-# dos de cima superestimaria o custo e enviesaria a decisão pra `redirect`.
-_IGNORED_BY_DEFAULT_DIRS = frozenset({".git", "__pycache__", ".mypy_cache", ".pytest_cache"})
-_PATH_FIELDS = ("path", "file_path", "notebook_path")
-_RECURSIVE_RE = re.compile(r"\b(?:grep|egrep|fgrep)\s+(?:-\w+\s+)*-\w*[rR]|\b(?:rg|find|fd|tree)\s|\bls\s+-\w*R|-Recurse\b")
-
-
-def _resolve_path(raw, cwd):
-    """Path do `tool_input` normalizado para o disco. Relativo resolve contra o `cwd` do
-    payload (não o do processo do hook, que é outro), e a forma MSYS `/c/...` — que o
-    agente emite com frequência em shell POSIX no Windows — é convertida, senão
-    `os.path.exists` responde `False` sobre um arquivo que existe."""
-    if not raw:
-        return None
-    path = raw.strip().replace("\\", "/")
-    msys = re.fullmatch(r"/([A-Za-z])(/.*)?", path)
-    if msys:
-        path = f"{msys.group(1).upper()}:{msys.group(2) or '/'}"
-    if not os.path.isabs(path) and cwd:
-        path = os.path.join(cwd, path)
-    return os.path.normpath(path)
-
-
-def _target_path(tool_input, cwd):
-    for field in _PATH_FIELDS:
-        value = tool_input.get(field)
-        if isinstance(value, str) and value.strip():
-            return value
-    return None
-
-
-def _command_paths(command, cwd):
-    """Paths que aparecem como argumento do comando e existem em disco. Sem isto, um
-    `grep -n foo arquivo.py` num monorepo seria medido como se varresse o repo todo."""
-    found = []
-    previous, base = "", cwd
-    for token in re.findall(r'"([^"]+)"|\'([^\']+)\'|(\S+)', command or ""):
-        raw = next((t for t in token if t), "")
-        if token[2]:
-            # `cd dir; grep x file`: the separator sticks to the unquoted word before it.
-            raw = raw.rstrip(";")
-        after_cd, previous = previous.lower() in ("cd", "pushd", "set-location", "sl"), raw
-        if after_cd:
-            # The directory of a `cd` is where the command runs (base for what follows), not what it searches.
-            base = _resolve_path(raw, base) or base
-            continue
-        if not raw or raw.startswith("-"):
-            continue
-        resolved = _resolve_path(raw, base)
-        if resolved and os.path.exists(resolved):
-            found.append(resolved)
-    return found
-
-
-def _scan_target(path):
-    files = 0
-    heavy = set()
-    ignored = set()
-    truncated = False
-    deadline = time.monotonic() + _SCAN_MAX_SECONDS
-    for dirpath, dirnames, filenames in os.walk(path):
-        for name in list(dirnames):
-            if name in _HEAVY_DIR_NAMES:
-                heavy.add(name)
-                dirnames.remove(name)
-            elif name in _IGNORED_BY_DEFAULT_DIRS or name.startswith("."):
-                ignored.add(name)
-                dirnames.remove(name)
-        for _ in filenames:
-            files += 1
-            # Testar o orçamento só entre diretórios deixaria um único diretório com
-            # centenas de milhares de entradas passar por cima dele.
-            if files > _SCAN_MAX_FILES or time.monotonic() > deadline:
-                return {"files": files, "heavy_dirs": sorted(heavy),
-                        "ignored_by_default": sorted(ignored), "truncated": True}
-        if time.monotonic() > deadline:
-            truncated = True
-            break
-    return {"files": files, "heavy_dirs": sorted(heavy),
-            "ignored_by_default": sorted(ignored), "truncated": truncated}
-
-
-def _index_facts(project_root):
-    try:
-        # A identidade é compartilhada; índices legados continuam visíveis até a migração.
-        db = indexer.existing_db_path(project_root)
-        if db and os.path.isfile(db):
-            return {"indexed": True, "index_kib": os.path.getsize(db) // 1024}
-        return {"indexed": False}
-    except OSError:
-        return {"indexed": False}
-
-
-def _target_facts(tool_name, tool_input, cwd):
-    """Fatos medidos em disco sobre o alvo da chamada. Roda antes de toda tool call
-    casada pelo hook, então é limitado por tempo e por contagem, não desce em diretório
-    pesado e nunca sai da raiz do projeto. Sem isto o modelo julga custo só pelo texto do
-    path."""
-    raw = _target_path(tool_input, cwd)
-    if raw is None and tool_name == "Bash":
-        candidates = _command_paths(tool_input.get("command"), cwd)
-        if candidates and _RECURSIVE_RE.search(tool_input.get("command") or ""):
-            # `sed -n 1,9p a.py; grep -rn x src`: the recursive part is the cost, not the file read before it.
-            candidates = [c for c in candidates if os.path.isdir(c)] or candidates
-        if candidates:
-            raw = candidates[0]
-    scope_note = None
-    if raw is None:
-        raw, scope_note = cwd, "session cwd, not derived from the command"
-    path = _resolve_path(raw, cwd)
-    if not path:
-        return {}
-    facts = {"path": _display_path(path, cwd)}
-    if scope_note:
-        facts["scope"] = scope_note
-    # Fora da raiz do projeto nada é medido: varrer `C:\` ou o perfil do usuário antes de
-    # uma tool call custaria mais que a própria chamada, e a decisão seria `allow` igual.
-    if cwd and not index_scope._within_root(cwd, path):
-        facts["outside_project"] = True
-        return facts
-    try:
-        if os.path.isfile(path):
-            facts["is_file"] = True
-            facts["kib"] = os.path.getsize(path) // 1024
-            return facts
-        if not os.path.isdir(path):
-            # Só afirma ausência quando o path é inequívoco; adivinhar `missing` faria o
-            # pré-filtro liberar a chamada com um motivo falso no dataset de calibração.
-            facts["missing"] = True
-            return facts
-        facts.update(_scan_target(path))
-    except OSError as exc:
-        facts["scan_error"] = str(exc)
-        return facts
-    facts.update(_index_facts(cwd or path))
-    return facts
-
-
-def _display_path(path, cwd):
-    """Relativo ao projeto quando possível: o path absoluto carrega o nome do usuário do
-    Windows e vai inteiro no prompt enviado ao gateway."""
-    if cwd:
-        try:
-            rel = os.path.relpath(path, cwd)
-            if not rel.startswith(".."):
-                return rel.replace(os.sep, "/")
-        except ValueError:
-            pass
-    return os.path.basename(path) or path
-
-_DECISION_TOOL = {
-    "type": "function",
-    "function": {
-        "name": "submit_decision",
-        "description": "Submit the routing decision for this tool call.",
-        "parameters": {
-            "type": "object",
-            "properties": {
-                "decision": {"type": "string", "enum": ["allow", "redirect"]},
-                "reason": {"type": "string", "description": "Short justification, one sentence."},
-            },
-            "required": ["decision", "reason"],
-        },
-    },
-}
-
-
 METRICS_MAX_BYTES = 4 * 1024 * 1024
 _METRIC_MAX_FIELD_CHARS = 600
 _SECRET_ARG_RE = re.compile(
@@ -310,7 +95,7 @@ _SEARCH_VERB_RE = re.compile(
 )
 # Commands that read code or pages without a search verb at their start: their pipe filters still search content.
 _READ_PRODUCER_RE = re.compile(
-    r"\bgit\s+(grep|ls-files|show|log\s+-p|diff)\b|\b(curl|wget|iwr|invoke-webrequest)\b|\bgh\s+api\b|"
+    r"\bgit\s+(?:-C\s+\S+\s+)?(grep|ls-files|show|log\s+-p|diff)\b|\b(curl|wget|iwr|invoke-webrequest)\b|\bgh\s+api\b|"
     r"readFileSync|read_text\(|open\(",
     re.IGNORECASE,
 )
@@ -332,11 +117,6 @@ def _mutates(command):
     """Whether a shell command changes files, the repository or dependencies."""
     return bool(_FILE_WRITE_RE.search(command) or _MUTATING_VERB_RE.search(_QUOTED_RE.sub("''", command)))
 
-BREAKER_PATH = os.path.join(os.path.dirname(METRICS_PATH), "router-breaker.json")
-BREAKER_FAILURES = 3
-BREAKER_COOLDOWN_S = 300
-
-
 def _mechanical_decision(tool_name, tool_input):
     """`(decisão, motivo)` quando a resposta não depende de julgamento nem de tocar o
     disco, ou `None`.
@@ -363,141 +143,33 @@ def _mechanical_decision(tool_name, tool_input):
     return None
 
 
-def _mechanical_decision_from_facts(facts):
-    if facts.get("missing"):
-        return "allow", "The path does not exist: the native tool's error is the useful answer."
-    if facts.get("is_file"):
-        return "allow", "Target is a single file, already scoped."
-    if facts.get("outside_project"):
-        return "allow", "Target is outside the project root: no index covers it."
-    return None
-
-
-def _breaker_state():
-    try:
-        with open(BREAKER_PATH, "r", encoding="utf-8") as f:
-            state = json.load(f)
-        return state if isinstance(state, dict) else {}
-    except (OSError, json.JSONDecodeError):
-        return {}
+def _log_error(message):
+    print(f"[smart-tool] {message}", file=sys.stderr, flush=True)
 
 
-def _breaker_write(state):
-    # tmp + replace: processos concorrentes gravam aqui (cada tool call é um processo
-    # novo), e um `open("w")` truncado no meio faz o leitor ver arquivo vazio — ou seja,
-    # breaker fechado justo quando ele deveria estar aberto. Sem `fsync`: perder a última
-    # escrita aqui é inofensivo e este caminho roda antes de cada tool call.
-    try:
-        os.makedirs(os.path.dirname(BREAKER_PATH), exist_ok=True)
-        tmp_path = f"{BREAKER_PATH}.tmp.{os.getpid()}"
-        with open(tmp_path, "w", encoding="utf-8") as f:
-            json.dump(state, f)
-        os.replace(tmp_path, BREAKER_PATH)
-    except OSError:
-        pass
-
-
-def breaker_open_until():
-    """Instante até quando o roteador está desligado por falhas recentes, ou 0.
-
-    Gateway lento é o pior caso de custo: sem isto, cada tool call paga o timeout inteiro
-    para terminar em `allow` de qualquer forma. O estado é compartilhado em arquivo porque
-    cada chamada do hook é um processo novo — nada sobrevive em memória."""
-    now = time.time()
-    try:
-        until = float(_breaker_state().get("open_until") or 0)
-    except (TypeError, ValueError):
-        return 0
-    # Teto pelo próprio cooldown: um salto de relógio (resume de VM, correção de fuso) no
-    # instante da gravação deixaria um `open_until` no futuro distante, e o roteador
-    # ficaria desligado pra sempre — sem erro em lugar nenhum, porque com o breaker aberto
-    # nunca há sucesso pra reabrir.
-    if until - now > BREAKER_COOLDOWN_S:
-        return 0
-    return until if now < until else 0
-
-
-def note_failure():
-    state = _breaker_state()
-    now = time.time()
-    # Janela de tempo em vez de contador: cada hook é um processo, e três falhas
-    # simultâneas leriam todas `failures=0` e gravariam `1`, nunca alcançando o limite.
-    # Falha de semana passada também não pode somar com a de hoje.
-    recent = [t for t in state.get("failures", []) if isinstance(t, (int, float)) and now - t < BREAKER_COOLDOWN_S]
-    recent.append(now)
-    state["failures"] = recent[-BREAKER_FAILURES:]
-    if len(recent) >= BREAKER_FAILURES:
-        state["open_until"] = now + BREAKER_COOLDOWN_S
-        state["failures"] = []
-    _breaker_write(state)
-
-
-def note_success():
-    state = _breaker_state()
-    if not state:
-        return
-    # Um cooldown aberto por outro processo sobrevive: quem leu o estado antes da abertura
-    # e teve sucesso não pode apagar a decisão de quem já viu o gateway falhar 3 vezes.
-    open_until = breaker_open_until()
-    _breaker_write({"open_until": open_until} if open_until else {})
-
-
-def decide(tool_name, tool_input, router_model, cwd=None):
+def decide(tool_name, tool_input, cwd=None):
+    """(decision, reason, target) for one hook call: decision is redirect or allow, target the folder the redirected
+    search would read (the session folder for an accepted pattern, None when allowed). An allowed search is queued for
+    the router model's review, which never delays the call."""
     safe_input = tool_input if isinstance(tool_input, dict) else {}
-
-    # Ordem importa: tudo que decide sem tocar disco vem antes do snapshot, e o breaker
-    # vem antes dele também — em cooldown o desfecho é `allow` de qualquer forma, então
-    # percorrer diretório ali seria I/O puro por nada.
     mechanical = _mechanical_decision(tool_name, safe_input)
     if mechanical:
         decision, reason = mechanical
         _log_decision(tool_name, tool_input, decision, reason, extra={"mechanical": True})
-        return decision, reason
-
-    if breaker_open_until():
-        reason = "Router in cooldown after recent gateway failures."
-        _log_decision(tool_name, tool_input, "allow", reason, extra={"breaker": True})
-        return "allow", reason
-
-    facts = _target_facts(tool_name, safe_input, cwd)
-    mechanical = _mechanical_decision_from_facts(facts)
-    if mechanical:
-        decision, reason = mechanical
-        _log_decision(tool_name, tool_input, decision, reason, extra={"mechanical": True})
-        return decision, reason
-
-    started = time.monotonic()
-    try:
-        # O orçamento inteiro do hook no host é de poucos segundos: obter token não pode
-        # consumir mais que a própria decisão.
-        token = model_client.get_token()
-        response = model_client.fetch(
-            "/v1/chat/completions", token, method="POST", timeout=DECISION_TIMEOUT_S,
-            body={
-                "model": router_model,
-                "messages": [
-                    {"role": "system", "content": _SYSTEM_PROMPT},
-                    {"role": "user", "content": json.dumps({
-                        # Mesma redação do log: a linha de comando também vai pro gateway.
-                        "tool_name": tool_name, "tool_input": _redacted_input(safe_input),
-                        "target": facts,
-                    }, ensure_ascii=False)},
-                ],
-                "tools": [_DECISION_TOOL],
-                "tool_choice": {"type": "function", "function": {"name": "submit_decision"}},
-                "temperature": 0,
-            },
-        )
-        tool_call = response["choices"][0]["message"]["tool_calls"][0]
-        args = json.loads(tool_call["function"]["arguments"])
-    except Exception:
-        note_failure()
-        raise
-    note_success()
-    decision = args.get("decision", "allow")
-    reason = args.get("reason", "")
-    _log_decision(tool_name, tool_input, decision, reason, extra={"ms": round((time.monotonic() - started) * 1000)})
-    return decision, reason
+        return decision, reason, None
+    learned = block_patterns.matching(tool_name, safe_input)
+    if learned:
+        reason = f"accepted block pattern: {learned['reason']}"
+        _log_decision(tool_name, tool_input, "redirect", reason, extra={"pattern": learned["id"]})
+        return "redirect", reason, cwd
+    decision, target, reason = redirect_rule.decide(tool_name, safe_input, cwd)
+    _log_decision(tool_name, tool_input, decision, reason, extra={"rule": True})
+    if decision == "allow":
+        try:
+            block_patterns.review_later(tool_name, safe_input, reason, METRICS_PATH, _redacted_input, _log_error)
+        except (OSError, ValueError) as exc:
+            _log_error(f"block pattern review not queued: {exc}")
+    return decision, reason, target
 
 
 def _web_search_tier_system_prompt():