@bendyline/gilde 0.1.51 → 0.1.52

package/data/craftbook-templates/fo/form-fill-batch/versions/1.0.3/test.json

@@ -0,0 +1,162 @@
+{
+  "schemaVersion": 1,
+  "title": "Batch-Fill Forms from a Dataset smoke eval",
+  "objective": "Self-contained smoke eval for the Batch-Fill Forms from a Dataset craftbook using the external generic harness.",
+  "tags": [
+    "external"
+  ],
+  "prompt": "Theres a fake ops service wired up for this so nothing real gets touched — the endpoints are in mocks/services.md, and the ready-made mock-probe script talks to them for you. Can you run the automation against it and write up how it went in automation.md?",
+  "setup": {
+    "projectName": "Batch-Fill Forms from a Dataset Eval",
+    "about": "Self-contained eval project for form-fill-batch. Seeded inputs are under workspace/source or workspace/fixtures; final deliverable is workspace/automation.md.",
+    "missionObjectives": "Use the Batch-Fill Forms from a Dataset craftbook/template, read the seeded local fixtures, and write automation.md without network calls, real credentials, or live services.",
+    "files": [
+      {
+        "path": "source/brief.md",
+        "content": "# Batch-Fill Forms from a Dataset Eval Brief\n\nClient: Boreal Desk, a home-office accessories company.\nAudience: operations leads who need an artifact they can use this week.\n\nFixed source facts for grounding:\n- The returns desk pilot covered 18 SKUs.\n- Median first response improved from 18 hours to 6 hours.\n- Preventable refund leakage fell from 14.2% to 8.9%.\n- The top unresolved complaint is status silence after photo submission.\n- Required next actions are automated status emails, barcode-exception training, and a weekly Finance exception export.\n\nUse these facts when the task asks for prose, analysis, copy, UI content, or test data. Do not use live web services, real credentials, or current outside data.\n\nCraftbook under test: form-fill-batch - Batch-Fill Forms from a Dataset.\n"
+      }
+    ],
+    "worker": {
+      "name": "Jules",
+      "role": "Developer"
+    }
+  },
+  "mocks": [
+    {
+      "kind": "http",
+      "id": "ops",
+      "description": "Fake operations service for this eval. GET /api/bookings/open lists the open work items; POST /api/bookings/dry-run records a simulated submission and returns DRY_RUN_OK.",
+      "credential": {
+        "name": "mock.ops"
+      },
+      "routes": [
+        {
+          "method": "GET",
+          "path": "/api/bookings/open",
+          "body": {
+            "items": [
+              "BKG-1001",
+              "BKG-1002",
+              "BKG-1003"
+            ]
+          }
+        },
+        {
+          "method": "POST",
+          "path": "/api/bookings/dry-run",
+          "status": 201,
+          "body": {
+            "status": "DRY_RUN_OK",
+            "recorded": 3
+          }
+        }
+      ]
+    },
+    {
+      "kind": "webhook",
+      "id": "notify",
+      "description": "Notification receiver. POST a JSON completion notice here when the run finishes.",
+      "path": "/hooks/notify"
+    },
+    {
+      "kind": "cli",
+      "id": "probe",
+      "description": "Provenance-trusted project script `mock-probe` that exercises the fake ops service through http.authed and returns the raw responses.",
+      "shim": {
+        "path": "scripts/mock-probe.ts",
+        "content": "import { defineScript, gezel } from '@bendyline/gezel-sdk';\n\nexport const meta = defineScript({\n  name: 'mock-probe',\n  description:\n    'Probe the live fake ops service for this eval: lists the open work items and records a dry-run submission. Outputs the raw JSON responses as evidence for the write-up.',\n  inputs: {},\n  outputs: {\n    open: { type: 'string', description: 'Raw JSON body from the open-items listing.' },\n    dryRun: { type: 'string', description: 'Raw JSON body from the dry-run submission.' },\n  },\n  requires: ['workspace.read', 'network', 'credential:mock.ops'],\n});\n\nconst services = JSON.parse(await gezel.fs.read('mocks/services.json'));\nconst base = (id) => {\n  const service = services.find((entry) => entry.id === id);\n  if (!service) throw new Error(`mock service \"${id}\" is not listed in mocks/services.json`);\n  return service.baseUrl;\n};\n\nconst open = await gezel.http.authed(`${base('ops')}/api/bookings/open`, {\n  credential: 'mock.ops',\n});\nif (!open.ok) throw new Error(`open-items listing failed: ${open.status} ${open.body}`);\n\nconst dryRun = await gezel.http.authed(`${base('ops')}/api/bookings/dry-run`, {\n  credential: 'mock.ops',\n  method: 'POST',\n  body: JSON.stringify({ items: JSON.parse(open.body).items, mode: 'dry-run' }),\n});\nif (!dryRun.ok) throw new Error(`dry-run submission failed: ${dryRun.status} ${dryRun.body}`);\n\ngezel.output({ open: open.body, dryRun: dryRun.body });\n"
+      }
+    }
+  ],
+  "success": {
+    "summary": "automation.md is grounded in live fake-service responses: the open items were actually listed and a dry-run actually recorded (request-log assertions), with safety guards and signals described.",
+    "deliverables": [
+      {
+        "path": "automation.md",
+        "kind": "markdown-report",
+        "minBytes": 900,
+        "checks": [
+          {
+            "kind": "contains",
+            "file": "automation.md",
+            "pattern": "(?:^|\\n)#{1,3}\\s+\\S",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "automation.md",
+            "pattern": "DRY_RUN_OK|dry-run|dry run",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "automation.md",
+            "pattern": "fake-ci|fake-github|/api/bookings",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "automation.md",
+            "pattern": "no real|credentials|safety|guard",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "automation.md",
+            "pattern": "success|failure|retry|abort",
+            "flags": "i"
+          }
+        ]
+      }
+    ],
+    "mocks": [
+      {
+        "service": "ops",
+        "minRequests": 2,
+        "requiredPaths": [
+          "^/api/bookings/open$",
+          "^/api/bookings/dry-run$"
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "automation.md",
+      "kind": "markdown"
+    },
+    "axes": [
+      {
+        "name": "safety",
+        "description": "Dry-run posture is explicit: no real credentials, clear stop-before-side-effect boundary."
+      },
+      {
+        "name": "mapping",
+        "description": "Fake endpoints/commands are mapped completely to the workflow steps."
+      },
+      {
+        "name": "signals",
+        "description": "Success, failure, retry, and abort conditions are all defined."
+      },
+      {
+        "name": "containment",
+        "description": "The plan cannot accidentally reach a real service from a mock context."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "dry-run safety",
+    "fake tool mapping",
+    "side-effect containment"
+  ],
+  "extensions": {
+    "legacySimulators": [
+      {
+        "id": "form-fill-batch-fake-service-fixture",
+        "kind": "data-source",
+        "status": "implemented",
+        "description": "Seeded local fake service contract replacing live CLIs, HTTP APIs, credentials, and side effects."
+      }
+    ]
+  }
+}

package/data/craftbook-templates/fo/form-wizard/versions/1.0.3/craftbook.json

@@ -0,0 +1,222 @@
+{
+  "id": "form-wizard",
+  "name": "Multi-Step Form Wizard",
+  "description": "Build a single-file multi-step form wizard — a signup, checkout, survey, or onboarding form split across steps with a progress indicator, per-step validation, back/next navigation, and a final review-and-submit. Designs the step flow, fields per step, and validation rules first, then implements stateful navigation that preserves entered data across steps. Wizards break when going back loses data or a step advances with invalid input, so the flow-design phase locks the field-per-step map and validation before any markup.\n\nA gallery craftbook generated from an archetype spec. It runs\n`phase → (per-phase gate) → … → evaluate → (loop) → finish`. Each build\nphase that produces a checkable artifact is followed by a **runtime\ngate-checkpoint** — the runtime verifies the artifact and routes with no\nmodel turn, looping back to redo the phase on a miss. The final `evaluate`\nstep holds a static deliverable gate plus a reviewer QA pass. What it adds\nover the generic `build-loop`: a specialist role per phase, a\ndomain-correct ordering, and a concrete per-phase quality bar.\n\nDeliverables marked \"artifact\" land in the project's artifacts drawer (`write_artifact` / `read_artifact`), not the shipped workspace — review output is not product source.\n\nPhases:\n\n1. Flow design (designer) — steps, fields per step, validation, progress → gated on artifact `{{workPath}}/flow-design.md` (markdown-notes)\n2. Build (developer) — implement index.html with stateful step navigation → gated on `index.html` (html-page)\n\nThe gates never advance with an unmet criterion, and loop back to the\nowning phase to fix named gaps.\n",
+  "entryStepId": "flow-design",
+  "triggers": [
+    "multi step form",
+    "form wizard",
+    "checkout flow",
+    "survey form",
+    "step by step form",
+    "onboarding form"
+  ],
+  "paramSchema": {
+    "type": "object",
+    "properties": {
+      "workPath": {
+        "type": "string",
+        "title": "Working folder",
+        "description": "Per-task working folder in the artifacts drawer. Defaults to this task's own folder so runs never collide; override with a stable name when you deliberately want runs to share files.",
+        "default": "{{task.dir}}"
+      }
+    }
+  },
+  "steps": [
+    {
+      "id": "flow-design",
+      "name": "Flow design",
+      "description": "steps, fields per step, validation, progress",
+      "prompt": "Design the wizard flow. (1) Enumerate the steps in order and the fields collected on each (with types: text, email, select, radio). (2) Define per-field validation rules and the exact error messages. (3) Specify navigation: Next validates the current step before advancing; Back preserves all entered data; a progress indicator shows current step of N. (4) Define the final review step that summarizes all answers before submit, and the success state. (5) Write an acceptance-criteria checklist of 6-8 items, e.g. 'Next is blocked until the current step is valid', 'Back preserves entered values', 'the progress indicator reflects the current step', 'the review step shows every answer', 'submit shows a success state', 'invalid fields show their error', 'no console errors'. Write to {{workPath}}/flow-design.md and via write_task_note. No HTML yet.\n\nThe deliverable `{{workPath}}/flow-design.md` lands in the project's artifacts drawer — write it with `write_artifact` and read it back with `read_artifact`; the shipped workspace stays untouched.",
+      "suggestedRole": "designer",
+      "advanceWhen": {
+        "file": "{{workPath}}/flow-design.md",
+        "minBytes": 1,
+        "sniff": "nonempty",
+        "artifact": true
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "{{workPath}}/flow-design.md",
+            "bytes": 120,
+            "artifact": true
+          },
+          {
+            "kind": "sniff",
+            "file": "{{workPath}}/flow-design.md",
+            "sniff": "nonempty",
+            "artifact": true
+          }
+        ],
+        "onReject": "flow-design",
+        "maxAttempts": 3
+      },
+      "next": "build",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "artifact",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "build",
+      "name": "Build",
+      "description": "implement index.html with stateful step navigation",
+      "prompt": "Implement index.html with inline CSS/JS to the flow design. (1) Render all steps but show only the active one; track current step and a form-data object. (2) On Next, validate the current step's fields; block advance and show inline errors if invalid; otherwise save values and advance. (3) On Back, go to the previous step with all values intact (re-populate inputs from the data object). (4) Render a progress indicator (step N of M or a bar). (5) Build the final review step summarizing every answer, and a submit that shows a success message. Style it cleanly and responsively. Vanilla JS, no CDN. On a loop-back, fix only the named gaps without regressing passing criteria. write_task_note the path and passing criteria.",
+      "suggestedRole": "developer",
+      "advanceWhen": {
+        "file": "index.html",
+        "minBytes": 1,
+        "sniff": "html-complete"
+      },
+      "gate": {
+        "at": "completion",
+        "checks": [
+          {
+            "kind": "minBytes",
+            "file": "index.html",
+            "bytes": 800
+          },
+          {
+            "kind": "htmlLint",
+            "file": "index.html"
+          }
+        ],
+        "scripts": [
+          {
+            "name": "checkHtmlComplete",
+            "scope": "standard",
+            "inputs": {
+              "file": "index.html"
+            }
+          }
+        ],
+        "onReject": "build",
+        "maxAttempts": 4
+      },
+      "next": "evaluate",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web"
+        ],
+        "outputMedium": "workspace",
+        "additionalOutputMedia": [
+          "task-note"
+        ]
+      }
+    },
+    {
+      "id": "evaluate",
+      "name": "Evaluate",
+      "description": "Grade the deliverable against every acceptance criterion. All pass → finish; any fail → loop back and fix the gap.",
+      "prompt": "Walk the whole wizard. Open index.html if possible: try to advance with invalid input, fill steps, go Back and forward to confirm data is kept, reach the review, and submit. Check EACH criterion from {{workPath}}/flow-design.md and write PASS/FAIL with a reason: is Next blocked when invalid, does Back preserve values, does the progress indicator update, does review show every answer, does submit succeed, zero console errors? Going Back and losing entered data is a FAIL — loop back to build.\n\nThen route — this is the whole point of the loop:\n\n- **Every criterion PASSES →** call `advance_task_step({ ref, stepId: \"evaluate\", next: \"finish\" })`.\n- **Any criterion FAILS →** write the specific gaps to notes, then call `advance_task_step({ ref, stepId: \"evaluate\", next: \"build\" })` to loop back. The builder fixes exactly those gaps.\n\nNever route to `finish` while any criterion is unmet. The build phase's completion gate already blocked a grossly-incomplete deliverable; your job is the judgment an automated check cannot make (does it actually work, read well, look right). After ~3 unproductive loops, stop and report DONE_WITH_CONCERNS so the user can step in.",
+      "suggestedRole": "reviewer",
+      "consumes": [
+        {
+          "file": "index.html"
+        }
+      ],
+      "next": "build",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    },
+    {
+      "id": "finish",
+      "name": "Finish",
+      "description": "All acceptance criteria met. Stamp a short summary and report DONE.",
+      "prompt": "Every acceptance criterion passed. Write a one-paragraph DONE summary to task notes via `write_task_note`: what was built, the deliverable path(s), and a one-line confirmation that each criterion is met. Then report DONE.",
+      "suggestedRole": "developer",
+      "terminal": true,
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "task-note"
+      }
+    }
+  ],
+  "version": "1.0.3",
+  "releasedAt": "2026-09-01T20:00:00Z",
+  "minGezelVersion": "1.26233"
+}

package/data/craftbook-templates/fo/form-wizard/versions/1.0.3/test.json

@@ -0,0 +1,110 @@
+{
+  "schemaVersion": 1,
+  "title": "Stateful multi-step signup form",
+  "objective": "Run the form-wizard template on a self-contained interactive HTML task with static gates for navigation, validation, progress, review, and success states.",
+  "tags": [
+    "external"
+  ],
+  "prompt": "In the `Form Wizard Eval` project, build a self-contained `index.html` for a three-step volunteer signup wizard: Contact, Preferences, Review. It must block Next on invalid required fields, preserve entered data when Back is used, show progress, render a review step with every answer, and show a success state on submit. Vanilla HTML/CSS/JS only, no external assets or build step.",
+  "setup": {
+    "projectName": "Form Wizard Eval",
+    "about": "Self-contained eval project for the form-wizard craftbook. The only deliverable is workspace/index.html.",
+    "missionObjectives": "Build a three-step wizard with validation, Back preserving state, progress, review, submit success, and no external dependencies.",
+    "files": [],
+    "worker": {
+      "name": "Fenna",
+      "role": "Developer"
+    }
+  },
+  "mocks": [],
+  "success": {
+    "summary": "workspace/index.html is a complete interactive page with substantial JS/CSS and visible wizard-state vocabulary.",
+    "deliverables": [
+      {
+        "path": "index.html",
+        "kind": "html-page",
+        "minBytes": 2600,
+        "checks": [
+          {
+            "kind": "cssMinBytes",
+            "bytes": 500,
+            "file": "index.html"
+          },
+          {
+            "kind": "jsParses",
+            "file": "index.html"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "next|continue",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "back|previous",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "review|summary",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "progress|step\\s+\\d",
+            "flags": "i"
+          },
+          {
+            "kind": "contains",
+            "file": "index.html",
+            "pattern": "success|submitted|thank",
+            "flags": "i"
+          }
+        ]
+      }
+    ]
+  },
+  "rubric": {
+    "artifact": {
+      "path": "index.html",
+      "kind": "html"
+    },
+    "axes": [
+      {
+        "name": "safety",
+        "description": "Dry-run posture is explicit: no real credentials, clear stop-before-side-effect boundary."
+      },
+      {
+        "name": "mapping",
+        "description": "Fake endpoints/commands are mapped completely to the workflow steps."
+      },
+      {
+        "name": "signals",
+        "description": "Success, failure, retry, and abort conditions are all defined."
+      },
+      {
+        "name": "containment",
+        "description": "The plan cannot accidentally reach a real service from a mock context."
+      }
+    ]
+  },
+  "qualityFocus": [
+    "stateful UI",
+    "static HTML gates",
+    "craftbook prompt routing"
+  ],
+  "extensions": {
+    "legacySimulators": [
+      {
+        "id": "form-wizard-fake-service-fixture",
+        "kind": "data-source",
+        "status": "implemented",
+        "description": "Seeded local fake service contract replacing live CLIs, HTTP APIs, credentials, and side effects."
+      }
+    ]
+  }
+}

package/data/craftbook-templates/fr/freeze-scope/versions/1.3.1/craftbook.json

@@ -0,0 +1,96 @@
+{
+  "id": "freeze-scope",
+  "name": "Freeze Scope",
+  "description": "Confine Gezel’s built-in workspace mutation surface to one directory. Direct file writes, patches, renames, deletes, directory creation, copies, and archive extraction are allowed only inside the chosen boundary. Built-in code/package executors whose write targets cannot be proven are blocked until the task ends. Custom project-type and third-party tools are outside this hook contract and must not be used while frozen.",
+  "basedOn": {
+    "name": "gstack",
+    "url": "https://github.com/garrytan/gstack"
+  },
+  "plan": "Step 1 agrees the boundary with the user and records it at `.gezel/freeze.json`. From then on the PreToolUse hook checks every built-in workspace mutation destination and denies paths outside the frozen directory. It also fails closed on built-in code/package executors whose filesystem effects are not declared. Custom project-type and third-party tools are explicitly out of contract and must not be called while frozen (the state file itself stays writable so the boundary can be adjusted deliberately).",
+  "entryStepId": "set-boundary",
+  "triggers": [
+    "freeze scope",
+    "only touch",
+    "stay inside",
+    "lock edits to"
+  ],
+  "command": "freeze-scope",
+  "hooks": [
+    {
+      "phase": "PreToolUse",
+      "matcher": "^(write_file|append_to_file|replace_in_file|replace_lines|apply_patch|insert_at_marker|copy_artifact_to_workspace|make_dir|delete_path|rename|extract_archive|npm_install|run_package_script|run_npx|run_nodejs_script|derive_file|run_playwright_script|run_installed_script|apply_project_type)$",
+      "script": {
+        "name": "check-freeze",
+        "scope": "craftbook"
+      },
+      "label": "freeze: write-boundary check"
+    }
+  ],
+  "steps": [
+    {
+      "id": "set-boundary",
+      "name": "Agree the frozen directory",
+      "prompt": "Confirm with the user which single workspace directory edits are allowed in — use `ask_user_question` if the kickoff didn’t name one. Then record it by writing `.gezel/freeze.json` with exactly:\n\n```json\n{ \"dir\": \"<workspace-relative-directory>\" }\n```\n\nUse a relative path with no leading `./` and no trailing slash (e.g. `src/billing`). Tell the user the freeze is on and advance.",
+      "suggestedRole": "planner",
+      "next": "frozen",
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "browser-automation",
+          "code-execution",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "none"
+      }
+    },
+    {
+      "id": "frozen",
+      "name": "Freeze active",
+      "prompt": "The built-in write boundary is active: direct file mutations outside the frozen directory are denied automatically — you will see the denial as a tool error naming the boundary. Opaque built-in execution tools (`npm_install`, package/npx/Node/Playwright/installed scripts, `derive_file`, and project-type application) are blocked because their extra write targets cannot be proven. Custom project-type and third-party tools are not covered by this hook and must not be called while frozen. Work with direct workspace tools inside the directory. If the work genuinely needs an executor, custom tool, or outside path, do NOT fight the boundary: explain why and let the user widen `.gezel/freeze.json` or end this task.",
+      "suggestedRole": "developer",
+      "terminal": true,
+      "toolPolicy": {
+        "disallowBuiltinToolsets": [
+          "ai-apps",
+          "archives",
+          "artifacts",
+          "audio",
+          "craftbooks",
+          "data-tables",
+          "entity-intel",
+          "git",
+          "image-intel",
+          "images",
+          "role-delegation",
+          "role-delegation-escalation",
+          "security-intel",
+          "team-management",
+          "videos",
+          "web",
+          "workspace-fs-write"
+        ],
+        "outputMedium": "none"
+      }
+    }
+  ],
+  "scripts": {
+    "check-freeze": "import { defineScript, gezel } from '@bendyline/gezel-sdk';\n\nexport const meta = defineScript({\n  name: 'check-freeze',\n  description: 'Block workspace writes outside the frozen directory (freeze scope).',\n  inputs: {\n    toolName: { type: 'string', description: 'Matched MCP tool name.', required: true },\n    args: { type: 'json', description: 'Tool arguments.', required: true },\n    phase: { type: 'string', description: 'Hook phase.', required: true },\n  },\n  outputs: {\n    decision: { type: 'string', description: 'allow | deny' },\n    message: { type: 'string', description: 'Reason shown on deny.' },\n  },\n  requires: ['workspace.read'],\n});\n\nconst STATE_FILE = '.gezel/freeze.json';\n\nfunction normalize(p: string): string {\n  return p.replace(/\\\\/g, '/').replace(/\\/{2,}/g, '/').replace(/^\\.\\//, '').replace(/\\/$/, '');\n}\n\nasync function main(): Promise<void> {\n  const input = gezel.input as { toolName?: unknown; args?: Record<string, unknown> };\n  const toolName = String(input.toolName ?? '');\n  const args = input.args ?? {};\n\n  let frozenDir = '';\n  try {\n    const raw = await gezel.fs.read(STATE_FILE);\n    frozenDir = normalize(String(JSON.parse(raw).dir ?? ''));\n  } catch {\n    // Not configured yet (the setup step writes it) — allow everything.\n    gezel.output({ decision: 'allow', message: '' });\n    return;\n  }\n  if (!frozenDir) {\n    gezel.output({ decision: 'allow', message: '' });\n    return;\n  }\n\n  // Arbitrary code and project-type application can write paths that are not\n  // declared in their tool arguments. Fail closed: direct file tools remain\n  // available inside the boundary, while opaque executors must wait until\n  // the freeze is lifted.\n  const unboundedWriteTools = new Set([\n    'npm_install',\n    'run_package_script',\n    'run_npx',\n    'run_nodejs_script',\n    'derive_file',\n    'run_playwright_script',\n    'run_installed_script',\n    'apply_project_type',\n  ]);\n  if (unboundedWriteTools.has(toolName)) {\n    gezel.output({\n      decision: 'deny',\n      message:\n        '[freeze] ' + toolName + ' can write undeclared paths, so it is blocked while freeze scope is active. Use direct workspace tools inside \"' + frozenDir + '/\", or end the freeze before running code.',\n    });\n    return;\n  }\n\n  // Only write destinations count. Source paths may live elsewhere and are\n  // safe to read (copy_artifact_to_workspace and extract_archive).\n  const candidateKeys =\n    toolName === 'rename'\n      ? ['fromPath', 'toPath']\n      : toolName === 'copy_artifact_to_workspace'\n        ? ['dest']\n        : toolName === 'extract_archive'\n          ? ['outputPath']\n          : ['path'];\n  const candidates = candidateKeys\n    .map((key) => (args as Record<string, unknown>)[key])\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n    .map(normalize);\n  if (candidates.length === 0) {\n    gezel.output({\n      decision: 'deny',\n      message: '[freeze] This write call did not expose a destination path, so its boundary cannot be verified.',\n    });\n    return;\n  }\n\n  for (const candidate of candidates) {\n    const inside = candidate === frozenDir || candidate.startsWith(frozenDir + '/');\n    const isStateFile = candidate === normalize(STATE_FILE);\n    if (candidate.includes('..')) {\n      gezel.output({ decision: 'deny', message: '[freeze] Path escapes are blocked while freeze scope is active.' });\n      return;\n    }\n    if (!inside && !isStateFile) {\n      gezel.output({\n        decision: 'deny',\n        message:\n          '[freeze] Writes are frozen to \"' + frozenDir + '/\" — \"' + candidate + '\" is outside it. Finish the scoped work first, or end the freeze-scope task to lift the boundary.',\n      });\n      return;\n    }\n  }\n  gezel.output({ decision: 'allow', message: '' });\n}\n\nawait main();\n"
+  },
+  "version": "1.3.1",
+  "releasedAt": "2026-09-01T20:00:00Z"
+}