@bartolli/kmd 0.5.1 → 0.6.0

package/dist/kmd.mjs

@@ -27,9 +27,11 @@ function openDatabase(dbPath) {
   db.exec(SCHEMA);
   return db;
 }
+function kmdHome() {
+  return process.env.KMD_HOME ?? join(homedir(), ".kmd");
+}
 function indexRootDir() {
-  const home = process.env.KMD_HOME ?? join(homedir(), ".kmd");
-  return join(home, "db");
+  return join(kmdHome(), "db");
 }
 function canonicalVaultRoot(vaultRoot2) {
   try {
@@ -119,6 +121,13 @@ import { readFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { parse } from "yaml";
 import { z } from "zod";
+function isValidRegex(pattern) {
+  try {
+    return Boolean(new RegExp(pattern));
+  } catch {
+    return false;
+  }
+}
 function kindName(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
@@ -138,7 +147,7 @@ ${issues}`);
   }
   return parsed.data;
 }
-var ScopeSchema, KindEntrySchema, VaultConfigSchema, BUILT_IN_KINDS;
+var ScopeSchema, KindEntrySchema, WhenSchema, TriggerSchema, TriggersSchema, VaultConfigSchema, BUILT_IN_KINDS;
 var init_config = __esm({
   "../cli/src/config.ts"() {
     "use strict";
@@ -155,6 +164,63 @@ var init_config = __esm({
         where: z.string()
       })
     ]);
+    WhenSchema = z.union([
+      z.string(),
+      z.object({
+        name: z.enum(["newer-than"]),
+        fresh: z.array(z.string().min(1)).min(1),
+        than: z.array(z.string().min(1)).min(1)
+      })
+    ]);
+    TriggerSchema = z.object({
+      id: z.string().min(1),
+      on: z.enum(["prompt", "pretool"]),
+      enforce: z.enum(["inject", "warn", "block"]),
+      keywords: z.array(z.string().min(1)).optional(),
+      intent: z.array(z.string()).optional(),
+      tool: z.string().optional(),
+      args_match: z.string().optional(),
+      files: z.array(z.string().min(1)).optional(),
+      when: WhenSchema.optional(),
+      text: z.string().optional(),
+      reason: z.string().optional()
+    }).superRefine((trigger, ctx) => {
+      if (trigger.on === "prompt" && !trigger.keywords?.length && !trigger.intent?.length) {
+        ctx.addIssue({
+          code: "custom",
+          message: `prompt trigger "${trigger.id}" needs keywords or intent`
+        });
+      }
+      if (trigger.on === "pretool" && trigger.tool === void 0 && trigger.args_match === void 0 && !trigger.files?.length) {
+        ctx.addIssue({
+          code: "custom",
+          message: `pretool trigger "${trigger.id}" needs a tool, args_match, or files matcher`
+        });
+      }
+      if (trigger.on === "prompt" && trigger.files !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: `trigger "${trigger.id}": files applies to pretool triggers only`
+        });
+      }
+      if (trigger.enforce === "block" ? trigger.reason === void 0 : trigger.text === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: trigger.enforce === "block" ? `block trigger "${trigger.id}" needs a reason` : `${trigger.enforce} trigger "${trigger.id}" needs a text`
+        });
+      }
+      const patterns = [...trigger.intent ?? []];
+      if (trigger.args_match !== void 0) patterns.push(trigger.args_match);
+      for (const pattern of patterns) {
+        if (!isValidRegex(pattern)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `trigger "${trigger.id}" has an invalid regex: ${pattern}`
+          });
+        }
+      }
+    });
+    TriggersSchema = z.record(z.string(), z.array(TriggerSchema));
     VaultConfigSchema = z.object({
       scopes: z.record(z.string(), ScopeSchema),
       kinds: z.array(KindEntrySchema),
@@ -167,7 +233,9 @@ var init_config = __esm({
       authoring_rules: z.string().optional(),
       authoring_rules_extra: z.string().optional(),
       sync_protocol: z.string().optional(),
-      sync_protocol_extra: z.string().optional()
+      sync_protocol_extra: z.string().optional(),
+      triggers: TriggersSchema.optional(),
+      triggers_extra: TriggersSchema.optional()
     }).superRefine((config, ctx) => {
       for (const [name, scope] of Object.entries(config.scopes)) {
         if (scope.methodology !== void 0 && !config.methodologies.includes(scope.methodology)) {
@@ -178,6 +246,28 @@ var init_config = __esm({
           });
         }
       }
+      if (config.triggers?._all !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["triggers", "_all"],
+          message: '"_all" is reserved for triggers_extra'
+        });
+      }
+      for (const field of ["triggers", "triggers_extra"]) {
+        for (const [scope, list] of Object.entries(config[field] ?? {})) {
+          const seen = /* @__PURE__ */ new Set();
+          for (const trigger of list) {
+            if (seen.has(trigger.id)) {
+              ctx.addIssue({
+                code: "custom",
+                path: [field, scope],
+                message: `duplicate trigger id "${trigger.id}"`
+              });
+            }
+            seen.add(trigger.id);
+          }
+        }
+      }
     });
     BUILT_IN_KINDS = /* @__PURE__ */ new Set([
       "project",
@@ -373,25 +463,23 @@ function syncPage(db, fields) {
   }
   return "changed";
 }
-async function runSync() {
-  const env = loadEnv();
-  const dbPath = resolveIndexPath(env.WIKI_VAULT);
-  console.log(`sync: ${env.WIKI_VAULT} \u2192 ${dbPath}`);
-  const vaultConfig = await loadVaultConfig(env.WIKI_VAULT);
+async function syncVault(vaultRoot2) {
+  const dbPath = resolveIndexPath(vaultRoot2);
+  const vaultConfig = await loadVaultConfig(vaultRoot2);
   const scopes = new Set(Object.keys(vaultConfig.scopes));
   mkdirSync(dirname(dbPath), { recursive: true });
   const db = openDatabase(dbPath);
   try {
     const files = [];
     for (const domain of SCAN_DOMAINS) {
-      files.push(...await walkMarkdown(env.WIKI_VAULT, domain));
+      files.push(...await walkMarkdown(vaultRoot2, domain));
     }
     const indexedPaths = [];
     let changed = 0;
     let unchanged = 0;
     let skipped = 0;
     for (const file of files) {
-      const path = toRelativePath(env.WIKI_VAULT, file);
+      const path = toRelativePath(vaultRoot2, file);
       const raw = await readFile2(file, "utf8");
       const parsed = parseFrontmatter(raw);
       const fields = buildPageFields(path, raw, parsed, scopes);
@@ -415,19 +503,33 @@ async function runSync() {
       pagesDeleted = Number(pageResult.changes);
       const linkResult = db.prepare("DELETE FROM links WHERE source_path NOT IN (SELECT path FROM pages)").run();
       linksDeleted = Number(linkResult.changes);
-    } else {
-      console.warn("no indexable pages found; skipping orphan deletion (safety)");
     }
     db.exec("INSERT INTO pages_fts(pages_fts) VALUES('rebuild')");
-    setMeta(db, "vault_root", canonicalVaultRoot(env.WIKI_VAULT));
+    setMeta(db, "vault_root", canonicalVaultRoot(vaultRoot2));
     setMeta(db, "last_synced", (/* @__PURE__ */ new Date()).toISOString());
-    console.log(
-      `done: ${changed} changed, ${unchanged} unchanged, ${skipped} skipped, ${pagesDeleted} pages deleted, ${linksDeleted} link orphans cleared`
-    );
+    return {
+      changed,
+      unchanged,
+      skipped,
+      pagesDeleted,
+      linksDeleted,
+      noPages: indexedPaths.length === 0
+    };
   } finally {
     db.close();
   }
 }
+async function runSync() {
+  const env = loadEnv();
+  console.log(`sync: ${env.WIKI_VAULT} \u2192 ${resolveIndexPath(env.WIKI_VAULT)}`);
+  const stats = await syncVault(env.WIKI_VAULT);
+  if (stats.noPages) {
+    console.warn("no indexable pages found; skipping orphan deletion (safety)");
+  }
+  console.log(
+    `done: ${stats.changed} changed, ${stats.unchanged} unchanged, ${stats.skipped} skipped, ${stats.pagesDeleted} pages deleted, ${stats.linksDeleted} link orphans cleared`
+  );
+}
 var EnvSchema, SCAN_DOMAINS, WIKILINK_RE, INDEXED_FRONTMATTER_KEYS;
 var init_sync = __esm({
   "../cli/src/sync.ts"() {
@@ -1138,6 +1240,13 @@ import { readFile as readFile4 } from "node:fs/promises";
 import { join as join7 } from "node:path";
 import { parse as parse2 } from "yaml";
 import { z as z4 } from "zod";
+function isValidRegex2(pattern) {
+  try {
+    return Boolean(new RegExp(pattern));
+  } catch {
+    return false;
+  }
+}
 function kindName2(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
@@ -1157,7 +1266,7 @@ ${issues}`);
   }
   return parsed.data;
 }
-var ScopeSchema2, KindEntrySchema2, VaultConfigSchema2, BUILT_IN_KINDS2;
+var ScopeSchema2, KindEntrySchema2, WhenSchema2, TriggerSchema2, TriggersSchema2, VaultConfigSchema2, BUILT_IN_KINDS2;
 var init_vault_config = __esm({
   "../mcp/src/vault-config.ts"() {
     "use strict";
@@ -1174,6 +1283,63 @@ var init_vault_config = __esm({
         where: z4.string()
       })
     ]);
+    WhenSchema2 = z4.union([
+      z4.string(),
+      z4.object({
+        name: z4.enum(["newer-than"]),
+        fresh: z4.array(z4.string().min(1)).min(1),
+        than: z4.array(z4.string().min(1)).min(1)
+      })
+    ]);
+    TriggerSchema2 = z4.object({
+      id: z4.string().min(1),
+      on: z4.enum(["prompt", "pretool"]),
+      enforce: z4.enum(["inject", "warn", "block"]),
+      keywords: z4.array(z4.string().min(1)).optional(),
+      intent: z4.array(z4.string()).optional(),
+      tool: z4.string().optional(),
+      args_match: z4.string().optional(),
+      files: z4.array(z4.string().min(1)).optional(),
+      when: WhenSchema2.optional(),
+      text: z4.string().optional(),
+      reason: z4.string().optional()
+    }).superRefine((trigger, ctx) => {
+      if (trigger.on === "prompt" && !trigger.keywords?.length && !trigger.intent?.length) {
+        ctx.addIssue({
+          code: "custom",
+          message: `prompt trigger "${trigger.id}" needs keywords or intent`
+        });
+      }
+      if (trigger.on === "pretool" && trigger.tool === void 0 && trigger.args_match === void 0 && !trigger.files?.length) {
+        ctx.addIssue({
+          code: "custom",
+          message: `pretool trigger "${trigger.id}" needs a tool, args_match, or files matcher`
+        });
+      }
+      if (trigger.on === "prompt" && trigger.files !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: `trigger "${trigger.id}": files applies to pretool triggers only`
+        });
+      }
+      if (trigger.enforce === "block" ? trigger.reason === void 0 : trigger.text === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: trigger.enforce === "block" ? `block trigger "${trigger.id}" needs a reason` : `${trigger.enforce} trigger "${trigger.id}" needs a text`
+        });
+      }
+      const patterns = [...trigger.intent ?? []];
+      if (trigger.args_match !== void 0) patterns.push(trigger.args_match);
+      for (const pattern of patterns) {
+        if (!isValidRegex2(pattern)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `trigger "${trigger.id}" has an invalid regex: ${pattern}`
+          });
+        }
+      }
+    });
+    TriggersSchema2 = z4.record(z4.string(), z4.array(TriggerSchema2));
     VaultConfigSchema2 = z4.object({
       scopes: z4.record(z4.string(), ScopeSchema2),
       kinds: z4.array(KindEntrySchema2),
@@ -1186,7 +1352,9 @@ var init_vault_config = __esm({
       authoring_rules: z4.string().optional(),
       authoring_rules_extra: z4.string().optional(),
       sync_protocol: z4.string().optional(),
-      sync_protocol_extra: z4.string().optional()
+      sync_protocol_extra: z4.string().optional(),
+      triggers: TriggersSchema2.optional(),
+      triggers_extra: TriggersSchema2.optional()
     }).superRefine((config, ctx) => {
       for (const [name, scope] of Object.entries(config.scopes)) {
         if (scope.methodology !== void 0 && !config.methodologies.includes(scope.methodology)) {
@@ -1197,6 +1365,28 @@ var init_vault_config = __esm({
           });
         }
       }
+      if (config.triggers?._all !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["triggers", "_all"],
+          message: '"_all" is reserved for triggers_extra'
+        });
+      }
+      for (const field of ["triggers", "triggers_extra"]) {
+        for (const [scope, list] of Object.entries(config[field] ?? {})) {
+          const seen = /* @__PURE__ */ new Set();
+          for (const trigger of list) {
+            if (seen.has(trigger.id)) {
+              ctx.addIssue({
+                code: "custom",
+                path: [field, scope],
+                message: `duplicate trigger id "${trigger.id}"`
+              });
+            }
+            seen.add(trigger.id);
+          }
+        }
+      }
     });
     BUILT_IN_KINDS2 = /* @__PURE__ */ new Set([
       "project",
@@ -2014,8 +2204,561 @@ var init_start = __esm({
   }
 });
 
-// bin/kmd.ts
+// ../cli/src/hook.ts
+var hook_exports = {};
+__export(hook_exports, {
+  dedupeMatches: () => dedupeMatches,
+  dedupePretoolMatches: () => dedupePretoolMatches,
+  effectiveTriggers: () => effectiveTriggers,
+  evaluateMatches: () => evaluateMatches,
+  hookStateDir: () => hookStateDir,
+  kiroIdePromptEvent: () => kiroIdePromptEvent,
+  loadTriggerFile: () => loadTriggerFile,
+  matchPretoolTriggers: () => matchPretoolTriggers,
+  matchPromptTriggers: () => matchPromptTriggers,
+  parsePretoolEvent: () => parsePretoolEvent,
+  parsePromptEvent: () => parsePromptEvent,
+  renderPosttool: () => renderPosttool,
+  renderPretool: () => renderPretool,
+  resolveScope: () => resolveScope,
+  runHookPosttool: () => runHookPosttool,
+  runHookPretool: () => runHookPretool,
+  runHookPrompt: () => runHookPrompt,
+  vaultPathTouched: () => vaultPathTouched
+});
+import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync, rmSync as rmSync2, statSync, writeFileSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join10, resolve as resolve2, sep as sep2 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 import { parseArgs as parseArgs2 } from "node:util";
+import { parse as parseYaml3 } from "yaml";
+import { z as z7 } from "zod";
+function eventFields(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof data !== "object" || data === null) return null;
+  return data;
+}
+function parsePromptEvent(raw) {
+  const fields = eventFields(raw);
+  if (fields === null) return null;
+  const { session_id, prompt, cwd } = fields;
+  if (typeof session_id !== "string" || typeof prompt !== "string") return null;
+  return { session_id, prompt, ...typeof cwd === "string" && { cwd } };
+}
+function kiroIdePromptEvent(now = Date.now()) {
+  const prompt = process.env.USER_PROMPT;
+  if (prompt === void 0 || prompt === "") return null;
+  const cwd = process.cwd();
+  return { session_id: `kiro:${cwd}:${Math.floor(now / KIRO_IDE_BUCKET_MS)}`, prompt, cwd };
+}
+function loadTriggerFile(path) {
+  try {
+    const result = z7.array(TriggerSchema).safeParse(parseYaml3(readFileSync(path, "utf8")));
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+function effectiveTriggers(config, scope, fileTriggers = []) {
+  const replace = scope === void 0 ? void 0 : config.triggers?.[scope];
+  const base = replace ?? [...DEFAULT_TRIGGERS, ...fileTriggers];
+  const allExtras = config.triggers_extra?.[ALL_SCOPES_KEY] ?? [];
+  const scopeExtras = scope === void 0 || scope === ALL_SCOPES_KEY ? [] : config.triggers_extra?.[scope] ?? [];
+  const seen = /* @__PURE__ */ new Set();
+  const triggers = [];
+  const duplicates = [];
+  for (const trigger of [...base, ...allExtras, ...scopeExtras]) {
+    if (seen.has(trigger.id)) {
+      duplicates.push(trigger.id);
+      continue;
+    }
+    seen.add(trigger.id);
+    triggers.push(trigger);
+  }
+  return { triggers, duplicates };
+}
+function expandHome(path) {
+  if (path === "~") return homedir3();
+  return path.startsWith("~/") ? join10(homedir3(), path.slice(2)) : path;
+}
+function resolveScope(config, cwd) {
+  if (cwd === void 0 || cwd === "") return void 0;
+  let best;
+  let bestLength = -1;
+  for (const [name, scope] of Object.entries(config.scopes)) {
+    if (scope.repo === void 0) continue;
+    const repo = expandHome(scope.repo).replace(/\/+$/, "");
+    if (!repo.startsWith("/")) continue;
+    if (cwd !== repo && !cwd.startsWith(`${repo}/`)) continue;
+    if (repo.length > bestLength) {
+      best = name;
+      bestLength = repo.length;
+    }
+  }
+  return best;
+}
+function keywordQuery(keywords) {
+  return keywords.map((keyword) => `"${keyword.replaceAll('"', '""')}"`).join(" OR ");
+}
+function openPromptIndex(prompt) {
+  const db = new DatabaseSync2(":memory:");
+  db.exec(`CREATE VIRTUAL TABLE prompt_doc USING fts5(text, tokenize = 'porter unicode61')`);
+  db.prepare("INSERT INTO prompt_doc (text) VALUES (?)").run(prompt);
+  return db;
+}
+function matchPromptTriggers(prompt, triggers) {
+  const candidates = triggers.filter(
+    (trigger) => trigger.on === "prompt" && trigger.enforce === "inject" && trigger.text !== void 0
+  );
+  if (candidates.length === 0) return [];
+  const matches = [];
+  let db = null;
+  try {
+    for (const trigger of candidates) {
+      let hit = false;
+      if (trigger.keywords !== void 0 && trigger.keywords.length > 0) {
+        db ??= openPromptIndex(prompt);
+        const row = db.prepare("SELECT count(*) AS n FROM prompt_doc WHERE prompt_doc MATCH ?").get(keywordQuery(trigger.keywords));
+        hit = row.n > 0;
+      }
+      if (!hit && trigger.intent !== void 0) {
+        hit = trigger.intent.some((pattern) => new RegExp(pattern, "i").test(prompt));
+      }
+      if (hit) {
+        matches.push({ id: trigger.id, text: trigger.text });
+      }
+    }
+  } finally {
+    db?.close();
+  }
+  return matches;
+}
+function parsePretoolEvent(raw) {
+  const fields = eventFields(raw);
+  if (fields === null) return null;
+  const { session_id, tool_name, tool_input, cwd } = fields;
+  if (typeof session_id !== "string" || typeof tool_name !== "string") return null;
+  return { session_id, tool_name, tool_input, ...typeof cwd === "string" && { cwd } };
+}
+function globToRegExp(glob) {
+  let source = "^";
+  let i = 0;
+  while (i < glob.length) {
+    const char = glob[i];
+    if (char === "*") {
+      if (glob.startsWith("**/", i)) {
+        source += "(?:.*/)?";
+        i += 3;
+      } else if (glob.startsWith("**", i)) {
+        source += ".*";
+        i += 2;
+      } else {
+        source += "[^/]*";
+        i += 1;
+      }
+    } else if (char === "?") {
+      source += "[^/]";
+      i += 1;
+    } else {
+      source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+      i += 1;
+    }
+  }
+  return new RegExp(`${source}$`);
+}
+function pathCandidates(toolInput, cwd) {
+  if (typeof toolInput !== "object" || toolInput === null) return [];
+  const fields = toolInput;
+  const candidates = [];
+  for (const key of ["file_path", "notebook_path", "path"]) {
+    const value = fields[key];
+    if (typeof value === "string" && value !== "") {
+      candidates.push(value);
+      if (cwd !== void 0 && value.startsWith(`${cwd}/`)) {
+        candidates.push(value.slice(cwd.length + 1));
+      }
+    }
+  }
+  return candidates;
+}
+function matchPretoolTriggers(toolName, toolInput, triggers, cwd) {
+  const matches = [];
+  for (const trigger of triggers) {
+    if (trigger.on !== "pretool") continue;
+    if (trigger.tool !== void 0 && trigger.tool !== toolName) continue;
+    if (trigger.args_match !== void 0) {
+      const serialized = JSON.stringify(toolInput ?? {});
+      if (!new RegExp(trigger.args_match).test(serialized)) continue;
+    }
+    if (trigger.files !== void 0 && trigger.files.length > 0) {
+      const candidates = pathCandidates(toolInput, cwd);
+      const hit = trigger.files.some((glob) => {
+        const regex = globToRegExp(glob);
+        return candidates.some((candidate) => regex.test(candidate));
+      });
+      if (!hit) continue;
+    }
+    const text = trigger.enforce === "block" ? trigger.reason : trigger.text;
+    if (text === void 0) continue;
+    matches.push({
+      id: trigger.id,
+      enforce: trigger.enforce,
+      text,
+      ...trigger.when !== void 0 && { when: trigger.when }
+    });
+  }
+  return matches;
+}
+function evaluateMatches(matches, vaultRoot2) {
+  const fired = [];
+  const skipped = [];
+  for (const match of matches) {
+    if (match.when === void 0) {
+      fired.push(match);
+      continue;
+    }
+    const verdict = evaluateWhen(match.when, vaultRoot2);
+    if (verdict === null) skipped.push(match.id);
+    else if (!verdict) fired.push(match);
+  }
+  return { fired, skipped };
+}
+function evaluateWhen(when, vaultRoot2) {
+  if (typeof when === "string") return null;
+  try {
+    const than = newestUpdated(vaultRoot2, when.than);
+    if (than === null) return true;
+    const fresh = newestUpdated(vaultRoot2, when.fresh);
+    if (fresh === null) return false;
+    return fresh >= than;
+  } catch {
+    return null;
+  }
+}
+function newestUpdated(vaultRoot2, globs) {
+  const regexes = globs.map(globToRegExp);
+  let newest = null;
+  for (const entry of readdirSync2(vaultRoot2, { recursive: true })) {
+    const rel = entry.split(sep2).join("/");
+    if (!rel.endsWith(".md")) continue;
+    if (rel.startsWith(".") || rel.includes("/.")) continue;
+    if (!regexes.some((regex) => regex.test(rel))) continue;
+    const updated = readUpdated(join10(vaultRoot2, entry));
+    if (updated !== null && (newest === null || updated > newest)) {
+      newest = updated;
+    }
+  }
+  return newest;
+}
+function readUpdated(path) {
+  try {
+    const { data } = parseFrontmatter(readFileSync(path, "utf8"));
+    const updated = data.updated;
+    if (typeof updated === "string") return updated;
+    if (updated instanceof Date) return updated.toISOString().slice(0, 10);
+  } catch {
+  }
+  return null;
+}
+function renderPretool(matches, format) {
+  const block = matches.find((match) => match.enforce === "block");
+  const context = matches.filter((match) => match.enforce === "inject").map((match) => match.text);
+  const warnings = matches.filter((match) => match.enforce === "warn").map((match) => match.text);
+  if (format === "claude") {
+    const hookSpecificOutput = { hookEventName: "PreToolUse" };
+    if (block !== void 0) {
+      hookSpecificOutput.permissionDecision = "deny";
+      hookSpecificOutput.permissionDecisionReason = block.text;
+    }
+    if (context.length > 0) {
+      hookSpecificOutput.additionalContext = context.join("\n");
+    }
+    const decided = block !== void 0 || context.length > 0;
+    return { stdout: decided ? JSON.stringify({ hookSpecificOutput }) : null, stderr: warnings };
+  }
+  if (matches.length === 0) return { stdout: null, stderr: [] };
+  return {
+    stdout: JSON.stringify({
+      decision: block !== void 0 ? "deny" : "none",
+      ...block !== void 0 && { reason: block.text },
+      context,
+      warnings
+    }),
+    stderr: []
+  };
+}
+function patchPaths(toolInput) {
+  const fields = typeof toolInput === "object" && toolInput !== null ? toolInput : {};
+  const sources = [toolInput, fields.patch, fields.input, fields.command].filter(
+    (value) => typeof value === "string"
+  );
+  const paths = [];
+  for (const source of sources) {
+    for (const match of source.matchAll(PATCH_FILE_RE)) {
+      paths.push(match[1].trim());
+    }
+  }
+  return paths;
+}
+function vaultPathTouched(toolInput, vaultRoot2, cwd) {
+  const root = resolve2(vaultRoot2);
+  const candidates = [...pathCandidates(toolInput, cwd), ...patchPaths(toolInput)];
+  return candidates.some((candidate) => {
+    const absolute = resolve2(cwd ?? ".", candidate);
+    return absolute === root || absolute.startsWith(`${root}/`);
+  });
+}
+function renderPosttool(findings, synced, format) {
+  if (findings.length === 0 && synced) return null;
+  const lines = findings.map((f) => `${f.severity}: ${f.path} [${f.rule}] ${f.message}`);
+  if (format === "claude") {
+    if (hasErrors(findings)) {
+      return JSON.stringify({
+        decision: "block",
+        reason: `kmd validate failed \u2014 fix before the index syncs:
+${lines.join("\n")}`
+      });
+    }
+    const hookSpecificOutput = { hookEventName: "PostToolUse" };
+    const notes = [...lines];
+    if (!synced) notes.push("kmd sync failed \u2014 index not updated; see hook stderr");
+    hookSpecificOutput.additionalContext = notes.join("\n");
+    return JSON.stringify({ hookSpecificOutput });
+  }
+  return JSON.stringify({ findings, synced });
+}
+function dedupePretoolMatches(stateDir, sessionId, matches) {
+  const blocks = matches.filter((match) => match.enforce === "block");
+  const rest = matches.filter((match) => match.enforce !== "block");
+  const fresh = dedupeMatches(stateDir, sessionId, rest);
+  return matches.filter((match) => blocks.includes(match) || fresh.includes(match));
+}
+function hookStateDir() {
+  return join10(kmdHome(), "state", "hook");
+}
+function dedupeMatches(stateDir, sessionId, matches) {
+  if (matches.length === 0) return [];
+  const file = join10(stateDir, `${sessionId.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
+  const fired = readFired(file);
+  const fresh = matches.filter((match) => !fired.has(match.id));
+  if (fresh.length > 0) {
+    mkdirSync4(stateDir, { recursive: true });
+    for (const match of fresh) {
+      fired.add(match.id);
+    }
+    writeFileSync(file, JSON.stringify([...fired]));
+    pruneStale(stateDir, file);
+  }
+  return fresh;
+}
+function readFired(file) {
+  try {
+    const data = JSON.parse(readFileSync(file, "utf8"));
+    if (Array.isArray(data)) {
+      return new Set(data.filter((entry) => typeof entry === "string"));
+    }
+  } catch {
+  }
+  return /* @__PURE__ */ new Set();
+}
+function pruneStale(stateDir, keep) {
+  try {
+    const cutoff = Date.now() - SESSION_STATE_MAX_AGE_MS;
+    for (const entry of readdirSync2(stateDir)) {
+      const path = join10(stateDir, entry);
+      if (path !== keep && statSync(path).mtimeMs < cutoff) {
+        rmSync2(path, { force: true });
+      }
+    }
+  } catch {
+  }
+}
+function hookInvocation() {
+  const { values: values2, positionals: positionals2 } = parseArgs2({
+    args: process.argv.slice(2),
+    allowPositionals: true,
+    strict: false,
+    options: {
+      scope: { type: "string" },
+      harness: { type: "string" },
+      triggers: { type: "string" }
+    }
+  });
+  const vaultRoot2 = positionals2[2] ?? process.env.WIKI_VAULT;
+  if (vaultRoot2 === void 0 || vaultRoot2 === "") {
+    diag2("no vault root (positional or $WIKI_VAULT)");
+    return null;
+  }
+  return {
+    vaultRoot: vaultRoot2,
+    scope: typeof values2.scope === "string" ? values2.scope : process.env.WIKI_SCOPE,
+    harness: values2.harness,
+    triggersFile: values2.triggers
+  };
+}
+function resolveFileTriggers(invocation) {
+  if (typeof invocation.triggersFile !== "string") return [];
+  const loaded = loadTriggerFile(invocation.triggersFile);
+  if (loaded === null) {
+    diag2(`triggers file unreadable or invalid: ${invocation.triggersFile}`);
+    return [];
+  }
+  return loaded;
+}
+async function runHookPrompt() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    const { vaultRoot: vaultRoot2 } = invocation;
+    let event = null;
+    if (invocation.harness === "kiro-ide") {
+      event = kiroIdePromptEvent();
+    } else if (invocation.harness !== void 0) {
+      diag2(`unknown harness "${String(invocation.harness)}" \u2014 reading the neutral stdin event`);
+    }
+    event ??= parsePromptEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a prompt event ({session_id, prompt})");
+      return;
+    }
+    const config = await loadVaultConfig(vaultRoot2);
+    const scope = invocation.scope ?? resolveScope(config, event.cwd);
+    const { triggers, duplicates } = effectiveTriggers(
+      config,
+      scope,
+      resolveFileTriggers(invocation)
+    );
+    for (const id of duplicates) {
+      diag2(`duplicate trigger id "${id}" \u2014 later occurrence ignored`);
+    }
+    const matches = matchPromptTriggers(event.prompt, triggers);
+    for (const match of dedupeMatches(hookStateDir(), event.session_id, matches)) {
+      console.log(match.text);
+    }
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
+async function runHookPretool() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    const { vaultRoot: vaultRoot2 } = invocation;
+    let format = "neutral";
+    if (invocation.harness === "claude") {
+      format = "claude";
+    } else if (invocation.harness !== void 0) {
+      diag2(`unknown harness "${String(invocation.harness)}" \u2014 emitting the neutral contract`);
+    }
+    const event = parsePretoolEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a pretool event ({session_id, tool_name})");
+      return;
+    }
+    const config = await loadVaultConfig(vaultRoot2);
+    const scope = invocation.scope ?? resolveScope(config, event.cwd);
+    const { triggers, duplicates } = effectiveTriggers(
+      config,
+      scope,
+      resolveFileTriggers(invocation)
+    );
+    for (const id of duplicates) {
+      diag2(`duplicate trigger id "${id}" \u2014 later occurrence ignored`);
+    }
+    const matches = matchPretoolTriggers(event.tool_name, event.tool_input, triggers, event.cwd);
+    const { fired, skipped } = evaluateMatches(matches, vaultRoot2);
+    for (const id of skipped) {
+      diag2(`trigger "${id}": unknown or unevaluable predicate \u2014 skipped`);
+    }
+    const rendered = renderPretool(
+      dedupePretoolMatches(hookStateDir(), event.session_id, fired),
+      format
+    );
+    for (const line of rendered.stderr) {
+      console.error(line);
+    }
+    if (rendered.stdout !== null) {
+      console.log(rendered.stdout);
+    }
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
+async function runHookPosttool() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    let format = "neutral";
+    if (invocation.harness === "claude") {
+      format = "claude";
+    } else if (invocation.harness !== void 0) {
+      diag2(`unknown harness "${String(invocation.harness)}" \u2014 emitting the neutral contract`);
+    }
+    const event = parsePretoolEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a posttool event ({session_id, tool_name})");
+      return;
+    }
+    if (!vaultPathTouched(event.tool_input, invocation.vaultRoot, event.cwd)) return;
+    const findings = await validateVault(invocation.vaultRoot);
+    let synced = false;
+    if (!hasErrors(findings)) {
+      try {
+        await syncVault(invocation.vaultRoot);
+        synced = true;
+      } catch (err) {
+        diag2(`sync failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const rendered = renderPosttool(findings, synced, format);
+    if (rendered !== null) {
+      console.log(rendered);
+    }
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
+async function readStdin() {
+  process.stdin.setEncoding("utf8");
+  let input = "";
+  for await (const chunk of process.stdin) {
+    input += chunk;
+  }
+  return input;
+}
+function diag2(message) {
+  console.error(`kmd hook: ${message}`);
+}
+var DEFAULT_TRIGGERS, SESSION_STATE_MAX_AGE_MS, KIRO_IDE_BUCKET_MS, ALL_SCOPES_KEY, PATCH_FILE_RE;
+var init_hook = __esm({
+  "../cli/src/hook.ts"() {
+    "use strict";
+    init_database();
+    init_config();
+    init_frontmatter();
+    init_sync();
+    init_validate();
+    DEFAULT_TRIGGERS = [];
+    SESSION_STATE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+    KIRO_IDE_BUCKET_MS = 30 * 60 * 1e3;
+    ALL_SCOPES_KEY = "_all";
+    PATCH_FILE_RE = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm;
+  }
+});
+
+// bin/kmd.ts
+import { parseArgs as parseArgs3 } from "node:util";
+process.removeAllListeners("warning");
+process.on("warning", (warning) => {
+  if (warning.name !== "ExperimentalWarning") {
+    console.error(warning.stack ?? `${warning.name}: ${warning.message}`);
+  }
+});
 var USAGE = `usage: kmd <command> [options]
 
 commands:
@@ -2024,11 +2767,14 @@ commands:
   mcp [<vault-root>]       start the stdio MCP server (default: $WIKI_VAULT)
   config [<vault-root>]    print vault + index resolution; with no vault, list known vaults
   db reset [<vault-root>]  delete the vault's index (default: $WIKI_VAULT)
+  hook <prompt|pretool|posttool> [<vault-root>] [--scope <s>] [--harness <claude|kiro-ide>] [--triggers <file>]
+                           harness gate engine: JSON event on stdin, decision/context on stdout;
+                           posttool auto-runs validate + sync after a vault write
 
 options:
   --version   print version
   --help      show this help`;
-var { positionals, values } = parseArgs2({
+var { positionals, values } = parseArgs3({
   args: process.argv.slice(2),
   allowPositionals: true,
   strict: false,
@@ -2081,13 +2827,32 @@ async function run() {
       }
       break;
     }
+    case "hook": {
+      const sub = positionals[1];
+      if (sub === "prompt") {
+        const { runHookPrompt: runHookPrompt2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookPrompt2();
+      } else if (sub === "pretool") {
+        const { runHookPretool: runHookPretool2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookPretool2();
+      } else if (sub === "posttool") {
+        const { runHookPosttool: runHookPosttool2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookPosttool2();
+      } else {
+        console.error(
+          sub ? `unknown hook event: ${sub}` : "usage: kmd hook <prompt|pretool|posttool> [<vault-root>] [--scope <scope>] [--harness <claude|kiro-ide>]"
+        );
+        process.exit(2);
+      }
+      break;
+    }
     case "--version":
     case "-v": {
-      const { readFileSync } = await import("node:fs");
-      const { join: join10, dirname: dirname4 } = await import("node:path");
+      const { readFileSync: readFileSync2 } = await import("node:fs");
+      const { join: join11, dirname: dirname4 } = await import("node:path");
       const { fileURLToPath } = await import("node:url");
       const pkgDir = dirname4(dirname4(fileURLToPath(import.meta.url)));
-      const pkg = JSON.parse(readFileSync(join10(pkgDir, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync2(join11(pkgDir, "package.json"), "utf8"));
       console.log(pkg.version);
       break;
     }