@bookedsolid/rea 0.31.0 → 0.33.0

package/hooks/changeset-security-gate.sh

@@ -1,172 +1,137 @@
-#!/usr/bin/env bash
-# changeset-security-gate.sh — PreToolUse: Write|Edit
+#!/bin/bash
+# PreToolUse hook: changeset-security-gate.sh
+# 0.33.0+ — Node-binary shim for `rea hook changeset-security-gate`.
 #
-# Guards .changeset/*.md files against two failure modes:
+# Pre-0.33.0 the gate's full body lived here as bash (172 LOC, frontmatter
+# validation + GHSA/CVE scan + MultiEdit-aware tool handling). The
+# migration to the parser-backed Node binary moves all of that into
+# `src/hooks/changeset-security-gate/index.ts`.
 #
-# 1. SECURITY DISCLOSURE LEAK — GHSA IDs or CVE numbers written to a changeset
-#    file before the advisory is published. Changeset files are committed to git
-#    and appear verbatim in CHANGELOG.md — referencing a GHSA ID pre-publish
-#    creates public pre-disclosure in git history.
+# Behavioral contract is preserved byte-for-byte: exit 0 on
+# pass-through / non-changeset / valid frontmatter, exit 2 on HALT /
+# disclosure leak / malformed frontmatter / malformed payload.
 #
-# 2. MISSING OR MALFORMED FRONTMATTER — changeset files without proper frontmatter
-#    are silently ignored by the changesets tool, wasting the release entry.
+# # CLI-resolution trust boundary
 #
-# Triggered by: PreToolUse — Write and Edit tools
-
-set -euo pipefail
+# Realpath sandbox check + version probe. Same shape as the 0.32.0
+# pilots.
+#
+# # Fail-closed posture
+#
+# changeset-security-gate is BLOCKING-tier — the pre-0.33.0 bash body
+# refused on GHSA/CVE patterns and on malformed frontmatter. Early-exit
+# branches fail closed AFTER the relevance pre-gate passes.
 
-# shellcheck source=_lib/common.sh
-source "$(dirname "$0")/_lib/common.sh"
+set -uo pipefail
 
+# 1. HALT check.
+# shellcheck source=_lib/halt-check.sh
+source "$(dirname "$0")/_lib/halt-check.sh"
 check_halt
+REA_ROOT=$(rea_root)
 
-INPUT="$(cat)"
-TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
-
-# 0.15.0 fix: MultiEdit was not in the allowed tool_name set, so the gate
-# silently exited 0 on every MultiEdit call against `.changeset/*.md` —
-# letting GHSA / CVE pre-disclosure through and skipping frontmatter
-# validation. 0.16.0: NotebookEdit added too (changesets are .md files
-# but a malicious agent could in principle route a .md write through
-# NotebookEdit's new_source path; cheap to allow, free to test).
-if [[ "$TOOL_NAME" != "Write" && "$TOOL_NAME" != "Edit" && "$TOOL_NAME" != "MultiEdit" && "$TOOL_NAME" != "NotebookEdit" ]]; then
-  exit 0
-fi
-
-require_jq
-
-# 0.16.0: payload extraction migrated to `_lib/payload-read.sh`. Shared
-# helpers handle every write-tier tool with the same defensive
-# coercion. Adding the next write-tier tool is a one-line edit there.
-# shellcheck source=_lib/payload-read.sh
-source "$(dirname "$0")/_lib/payload-read.sh"
+proj="${CLAUDE_PROJECT_DIR:-$REA_ROOT}"
 
-FILE_PATH=$(extract_file_path "$INPUT")
-
-# Only care about .changeset/*.md files — exclude README.md (changeset tool metadata)
-if ! echo "$FILE_PATH" | grep -qE '\.changeset/[^/]+\.md$' || echo "$FILE_PATH" | grep -qE '\.changeset/README\.md$'; then
-  exit 0
-fi
-
-CONTENT=$(extract_write_content "$INPUT")
-
-# ─── 1. SECURITY DISCLOSURE CHECK ───────────────────────────────────────────
+# 2. Relevance pre-gate. This is a PreToolUse Write/Edit/MultiEdit/
+#    NotebookEdit matcher, so the payload always has a `tool_input.
+#    file_path` (or `notebook_path`).
 #
-# These patterns in a changeset mean security details are about to be committed
-# to git history BEFORE the advisory is published — creating pre-disclosure.
-# GHSA IDs and CVE numbers must NEVER appear in changeset files.
-
-DISCLOSURE_PATTERNS=(
-  'GHSA-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}'
-  'CVE-[0-9]{4}-[0-9]+'
-)
-
-MATCHED_PATTERN=""
-for PATTERN in "${DISCLOSURE_PATTERNS[@]}"; do
-  if echo "$CONTENT" | grep -qE "$PATTERN"; then
-    MATCHED_PATTERN="$PATTERN"
-    break
+#    2026-05-15 codex round-2 P2 fix: scan `tool_input.file_path` /
+#    `tool_input.notebook_path` ONLY, NOT the raw JSON payload. Pre-fix
+#    a Write to `README.md` whose body merely mentions `.changeset/`
+#    (e.g. "See .changeset/example.md") tripped the fail-closed branch
+#    when the CLI was unbuilt — the substring lived in the
+#    tool_input.content blob, not in the target path. The Node body
+#    correctly filters by file_path; the shim's pre-gate must match
+#    that posture.
+INPUT=$(cat)
+RELEVANT=0
+PROBE=""
+if command -v jq >/dev/null 2>&1; then
+  PROBE=$(printf '%s' "$INPUT" | jq -r '(.tool_input.file_path // .tool_input.notebook_path // "")' 2>/dev/null || true)
+  if printf '%s' "$PROBE" | grep -qE '\.changeset/'; then
+    RELEVANT=1
+  fi
+else
+  if printf '%s' "$INPUT" | grep -qE '\.changeset/'; then
+    RELEVANT=1
   fi
-done
-
-if [[ -n "$MATCHED_PATTERN" ]]; then
-  json_output "block" \
-    "CHANGESET SECURITY GATE: This changeset contains a security advisory identifier (matched: '${MATCHED_PATTERN}').
-
-Do NOT reference GHSA IDs or CVE numbers in changeset files before the advisory is published.
-Changeset files are committed to git — this creates pre-disclosure in public history and CHANGELOG.
-
-CORRECT approach for security fix changesets:
-  Use vague language only — no identifiers, no vulnerability details.
-
-  WRONG:  'fix(hooks): patch GHSA-3w3m-7gg4-f82g — symlink-guard now covers Edit tool'
-  RIGHT:  'security: extend symlink protection to cover all write-capable tools'
-
-  WRONG:  'security: fix CVE-2026-1234 prompt injection via tool descriptions'
-  RIGHT:  'security: harden middleware chain against indirect instruction attacks'
-
-After the release ships:
-  1. Publish the GitHub Security Advisory (Security tab → Advisories → Publish)
-  2. The GHSA becomes the detailed public disclosure document
-  3. Optionally update CHANGELOG.md post-publish to add the GHSA reference"
 fi
-
-# ─── 2. FRONTMATTER VALIDATION ───────────────────────────────────────────────
-#
-# A changeset without valid frontmatter is silently ignored by the changesets
-# tool — the package bump and CHANGELOG entry never appear in the release.
-#
-# 0.15.0 fix: skip frontmatter validation for MultiEdit. MultiEdit's
-# `tool_input.edits[].new_string` payload is a list of partial string
-# replacements, not the full file body — running the frontmatter
-# validator against the concatenation of new_strings would reject every
-# legitimate MultiEdit on an existing changeset (none of the edit
-# fragments individually contains a frontmatter block, even though the
-# resulting file does). The disclosure scan above still runs on
-# MultiEdit content because GHSA/CVE patterns match per-fragment without
-# any structural assumption.
-if [[ "$TOOL_NAME" == "MultiEdit" ]]; then
+if [ "$RELEVANT" -eq 0 ]; then
   exit 0
 fi
 
-# Must start with ---
-if ! echo "$CONTENT" | head -1 | grep -qE '^---'; then
-  json_output "block" \
-    "CHANGESET FORMAT GATE: Missing frontmatter block.
-
-Every changeset must start with a frontmatter block specifying which package to bump:
-
----
-'@bookedsolid/rea': patch
----
-
-Brief description of what changed and why (close #N if applicable).
-
-Bump types: patch (bug fix/security), minor (new feature), major (breaking change)"
+# 3. Resolve the rea CLI.
+REA_ARGV=()
+RESOLVED_CLI_PATH=""
+if [ -f "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/node_modules/@bookedsolid/rea/dist/cli/index.js"
+elif [ -f "$proj/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/dist/cli/index.js"
 fi
 
-# Must have at least one package bump entry and a closing ---.
-# 0.15.0 fix: accept single-quoted, double-quoted, AND unquoted package
-# names (all three are valid YAML for the same string). Pre-fix the
-# regex required single quotes, so a tool or human authoring the
-# changeset with `"@scope/name": patch` was rejected as malformed even
-# though the Changesets tool itself accepts every form.
-#
-# Codex round-1 P2-1 fix: explicit-alternation form (no backref) so
-# the unquoted variant matches on BSD grep too. The earlier
-# `^([\"']?)[^\"']+\1: ...` shape relied on backref-with-empty-capture
-# semantics that BSD's grep rejects when the capture group's `?` made
-# it absent — quoted forms matched on macOS but unquoted did not.
-FRONTMATTER=$(echo "$CONTENT" | awk '/^---/{count++; if(count==2){exit} next} count==1{print}')
-if ! echo "$FRONTMATTER" | grep -qE "^(\"[^\"]+\"|'[^']+'|[^\"'[:space:]]+): (patch|minor|major)"; then
-  json_output "block" \
-    "CHANGESET FORMAT GATE: Frontmatter does not contain a valid package bump entry.
-
-The frontmatter must include at least one package/bump pair:
-
----
-'@bookedsolid/rea': patch
----
-
-Valid bump types: patch | minor | major"
+if [ "${#REA_ARGV[@]}" -eq 0 ]; then
+  printf 'rea: changeset-security-gate cannot run — the rea CLI is not built.\n' >&2
+  printf 'Run `pnpm install && pnpm build` (or `npm install` for a consumer install) to restore protection.\n' >&2
+  exit 2
 fi
 
-# Must have a non-empty description after the closing ---
-DESCRIPTION=$(echo "$CONTENT" | awk 'BEGIN{count=0} /^---/{count++; next} count>=2{print}' | grep -v '^[[:space:]]*$' | head -1 || true)
-if [[ -z "$DESCRIPTION" ]]; then
-  json_output "block" \
-    "CHANGESET FORMAT GATE: Missing description after frontmatter.
-
-Add a meaningful description explaining what changed and why:
-
----
-'@bookedsolid/rea': patch
----
+# 4. Realpath sandbox check.
+if ! command -v node >/dev/null 2>&1; then
+  printf 'rea: changeset-security-gate cannot run — `node` is not on PATH.\n' >&2
+  exit 2
+fi
 
-fix(gateway): policy-loader now uses async I/O with 500ms TTL cache
+sandbox_check=$(node -e '
+  const fs = require("fs");
+  const path = require("path");
+  const cli = process.argv[1];
+  const projDir = process.argv[2];
+  let real, realProj;
+  try { real = fs.realpathSync(cli); } catch (e) {
+    process.stdout.write("bad:realpath"); process.exit(1);
+  }
+  try { realProj = fs.realpathSync(projDir); } catch (e) {
+    process.stdout.write("bad:realpath-proj"); process.exit(1);
+  }
+  const sep = path.sep;
+  const projWithSep = realProj.endsWith(sep) ? realProj : realProj + sep;
+  if (!(real === realProj || real.startsWith(projWithSep))) {
+    process.stdout.write("bad:cli-escapes-project"); process.exit(1);
+  }
+  let cur = path.dirname(path.dirname(path.dirname(real)));
+  let found = false;
+  for (let i = 0; i < 20 && cur && cur !== path.dirname(cur); i += 1) {
+    const pj = path.join(cur, "package.json");
+    if (fs.existsSync(pj)) {
+      try {
+        const data = JSON.parse(fs.readFileSync(pj, "utf8"));
+        if (data && data.name === "@bookedsolid/rea") { found = true; break; }
+      } catch (e) { /* keep walking */ }
+    }
+    cur = path.dirname(cur);
+  }
+  if (!found) { process.stdout.write("bad:no-rea-pkg-json"); process.exit(1); }
+  process.stdout.write("ok");
+' -- "$RESOLVED_CLI_PATH" "$proj" 2>/dev/null)
+
+if [ "$sandbox_check" != "ok" ]; then
+  printf 'rea: changeset-security-gate FAILED sandbox check (%s) — refusing.\n' "$sandbox_check" >&2
+  exit 2
+fi
 
-Previously, loadPolicy used fs.readFileSync on every tool invocation, blocking
-the event loop under concurrency. Closes #34."
+# 5. Version-probe.
+probe_out=$("${REA_ARGV[@]}" hook changeset-security-gate --help 2>&1)
+probe_status=$?
+if [ "$probe_status" -ne 0 ] || ! printf '%s' "$probe_out" | grep -q -e 'changeset-security-gate'; then
+  printf 'rea: this shim requires the `rea hook changeset-security-gate` subcommand (introduced in 0.33.0).\n' >&2
+  printf 'The resolved CLI at %s does not implement it.\n' "$RESOLVED_CLI_PATH" >&2
+  printf 'Run `pnpm install` (or `npm install`) to sync the CLI; refusing in the meantime to preserve enforcement.\n' >&2
+  exit 2
 fi
 
-exit 0
+# 6. Forward stdin.
+printf '%s' "$INPUT" | "${REA_ARGV[@]}" hook changeset-security-gate
+exit $?

package/hooks/dependency-audit-gate.sh

@@ -1,179 +1,138 @@
 #!/bin/bash
 # PreToolUse hook: dependency-audit-gate.sh
-# Fires BEFORE every Bash tool call.
-# Detects package install commands (npm install, pnpm add, yarn add) and
-# verifies the package exists on the registry before allowing the install.
+# 0.33.0+ — Node-binary shim for `rea hook dependency-audit-gate`.
 #
-# Exit codes:
-#   0 = allow (not an install command, or package verified)
-#   2 = block (package not found on registry)
+# Pre-0.33.0 the gate's full body lived here as bash (179 LOC, the
+# segment splitter + install-pattern detection + per-package
+# `npm view` probe). The migration to the parser-backed Node binary
+# moves all of that into `src/hooks/dependency-audit-gate/index.ts`.
+#
+# Behavioral contract is preserved byte-for-byte: exit 0 on
+# pass-through / all-packages-verified, exit 2 on HALT / any package
+# missing / malformed payload.
+#
+# # CLI-resolution trust boundary
+#
+# Realpath sandbox check + version probe. Same shape as the 0.32.0
+# pilots and the env-file-protection shim above.
+#
+# # Fail-closed posture
+#
+# dependency-audit-gate is BLOCKING-tier — the pre-0.33.0 bash body
+# refused on missing packages. Early-exit branches (CLI missing,
+# node missing, sandbox failed, version skew) fail closed AFTER the
+# relevance pre-gate passes.
 
 set -uo pipefail
 
-# ── 1. Read ALL stdin immediately ─────────────────────────────────────────────
-INPUT=$(cat)
-
-# ── 2. Dependency check ──────────────────────────────────────────────────────
-if ! command -v jq >/dev/null 2>&1; then
-  printf 'REA ERROR: jq is required but not installed.\n' >&2
-  printf 'Install: brew install jq  OR  apt-get install -y jq\n' >&2
-  exit 2
-fi
-
-# ── 3. HALT check ────────────────────────────────────────────────────────────
-# 0.16.0: HALT check sourced from shared _lib/halt-check.sh.
+# 1. HALT check.
 # shellcheck source=_lib/halt-check.sh
 source "$(dirname "$0")/_lib/halt-check.sh"
 check_halt
 REA_ROOT=$(rea_root)
 
-# ── 4. Parse command ──────────────────────────────────────────────────────────
-CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
-
-if [[ -z "$CMD" ]]; then
-  exit 0
-fi
-
-# ── 5. Detect package install commands ────────────────────────────────────────
-# Match: npm install <pkg>, npm i <pkg>, pnpm add <pkg>, yarn add <pkg>
-# Skip: npm install (no args), npm ci, npm install --save-dev (without new pkg)
+proj="${CLAUDE_PROJECT_DIR:-$REA_ROOT}"
 
-extract_packages() {
-  local cmd="$1"
-
-  # 0.15.0 fix: the previous parser ran `grep` against the entire bash
-  # command string with no segment boundary anchor. A heredoc body or
-  # commit-message containing `pnpm install` (e.g. inside
-  # `git commit -m "$(cat <<EOF ... pnpm install ... EOF)"`) matched the
-  # grep, the `.*` in the sed stripped up to that occurrence, and the rest
-  # of the command (`chore:`, `&&`, `||`, etc.) was passed to
-  # `npm view <token> name` and reported as missing packages. The hook
-  # then refused to commit perfectly innocent code.
-  #
-  # Fix: split the command on shell command separators (`;`, `&&`, `||`,
-  # `|`, newlines) and only run the install-detection on segments whose
-  # FIRST non-whitespace token is one of the install commands. Heredoc
-  # bodies inside `$()` substitutions are NOT split into separate segments
-  # — the entire `$(cat <<EOF ... EOF)` is one token attached to the
-  # outer command — but they're never the FIRST token on a segment, so
-  # the anchor rejects them.
-
-  # 0.17.0 helix-017 #3: unwrap nested-shell wrappers (`bash -c 'PAYLOAD'`,
-  # `sh -lc "PAYLOAD"`, etc.) before splitting so the inner install
-  # command becomes a segment that anchors against the install-pattern
-  # check below. Pre-fix `bash -lc 'npm install pkg'` produced a single
-  # segment whose first token was `bash` — install-detection skipped.
-  # 0.17.0 helix-019 #3: delegate splitting to the shared
-  # `_rea_split_segments` so this gate inherits the full separator set
-  # (including bare `&` background-process operator added in 0.16.1)
-  # and the quote-mask that prevents over-fire from in-quote separators.
-  # Pre-fix the local segmenter splat on `|||&&|;|` only, missing bare
-  # `&` — `echo warmup & pnpm add lodash` stayed merged into one segment
-  # and the install-pattern leading-token check skipped it entirely.
-  local segments
-  if [ -f "$(dirname "$0")/_lib/cmd-segments.sh" ]; then
-    # shellcheck source=_lib/cmd-segments.sh
-    source "$(dirname "$0")/_lib/cmd-segments.sh"
-    segments=$(_rea_split_segments "$cmd")
-  else
-    # Fallback (lib unavailable): legacy local splitter preserved.
-    segments=$(printf '%s\n' "$cmd" | sed -E 's/(\|\||\&\&|;|\||\&)/\n/g')
+# 2. Relevance pre-gate. Look for any install-pattern keyword.
+#
+#    2026-05-15 codex round-2 P2 fix: scan `tool_input.command` ONLY,
+#    not the raw JSON payload. Pre-fix `git commit -m "docs: run pnpm
+#    install foo before start"` triggered the fail-closed branch on a
+#    fresh checkout (the install-pattern regex hit the substring
+#    inside the commit-message ARG of the git command, not a real
+#    install invocation). The Node body's segment-anchored matcher
+#    correctly distinguishes between the two — the shim's pre-gate
+#    must match that posture.
+#
+#    `jq`-less fallback preserves the pre-0.33.0 over-trigger shape.
+INPUT=$(cat)
+RELEVANT=0
+PROBE=""
+if command -v jq >/dev/null 2>&1; then
+  PROBE=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
+  if printf '%s' "$PROBE" | grep -qE '(npm[[:space:]]+(install|i|add)|pnpm[[:space:]]+(add|install|i)|yarn[[:space:]]+add)[[:space:]]'; then
+    RELEVANT=1
   fi
-
-  while IFS= read -r segment; do
-    # Trim leading whitespace.
-    segment="${segment#"${segment%%[![:space:]]*}"}"
-    # Anchor to start: only match when the install command is the FIRST
-    # thing on the segment, optionally preceded by `sudo` / `exec` /
-    # `time` / etc.
-    #
-    # 0.16.1 helix-016 P2 fix: also strip leading KEY=VALUE env-var
-    # assignments. Pre-fix the prefix allow-list only permitted
-    # sudo/exec/time, so `CI=1 pnpm add foo` and
-    # `NODE_ENV=development npm install bar` bypassed the audit
-    # entirely. POSIX shell allows any number of leading KEY=VALUE
-    # assignments before the command word; we strip them the same
-    # way the shell does.
-    local stripped_segment
-    stripped_segment=$(printf '%s' "$segment" | sed -E 's/^([[:space:]]*[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]+[[:space:]]+)+//')
-
-    if printf '%s' "$stripped_segment" | grep -qiE '^(sudo[[:space:]]+|exec[[:space:]]+|time[[:space:]]+)*(npm[[:space:]]+(install|i|add)|pnpm[[:space:]]+(add|install|i)|yarn[[:space:]]+add)[[:space:]]+'; then
-      # Strip the leading prefix wrappers + install command, leaving args.
-      local after_cmd
-      after_cmd=$(printf '%s' "$stripped_segment" | sed -E 's/^(sudo[[:space:]]+|exec[[:space:]]+|time[[:space:]]+)*(npm[[:space:]]+(install|i|add)|pnpm[[:space:]]+(add|install|i)|yarn[[:space:]]+add)[[:space:]]+//')
-
-      for token in $after_cmd; do
-        if [[ "$token" == -* ]]; then continue; fi
-        if [[ "$token" == ./* || "$token" == /* || "$token" == ../* ]]; then continue; fi
-        if [[ -z "$token" ]]; then continue; fi
-        # 0.16.1: tighten token classification (helix-016 sibling concern).
-        # A "package name" is something that doesn't contain shell
-        # metacharacters — `2>&1`, `$VAR`, etc. are never valid npm
-        # package names. Skip any token containing `=`, `>`, `<`, `&`,
-        # `|`, `;`, `$`, backtick, or quotes.
-        if [[ "$token" == *=* || "$token" == *">"* || "$token" == *"<"* ||
-              "$token" == *"&"* || "$token" == *"|"* || "$token" == *";"* ||
-              "$token" == *'$'* || "$token" == *'`'* ||
-              "$token" == *'"'* || "$token" == *"'"* ]]; then continue; fi
-        # `npm view` can't validate `@workspace:*` / `link:` / `file:`
-        # prefixes (workspace protocols). Skip them — they're never npm
-        # registry packages.
-        if [[ "$token" == workspace:* || "$token" == link:* || "$token" == file:* || "$token" == git+* ]]; then continue; fi
-        local pkg_name
-        pkg_name=$(printf '%s' "$token" | sed -E 's/@[^@/]+$//')
-        if [[ -z "$pkg_name" ]]; then
-          pkg_name="$token"
-        fi
-        printf '%s\n' "$pkg_name"
-      done
-    fi
-  done <<< "$segments"
-}
-
-PACKAGES=$(extract_packages "$CMD")
-
-if [[ -z "$PACKAGES" ]]; then
+else
+  if printf '%s' "$INPUT" | grep -qE '(npm[[:space:]]+(install|i|add)|pnpm[[:space:]]+(add|install|i)|yarn[[:space:]]+add)[[:space:]]'; then
+    RELEVANT=1
+  fi
+fi
+if [ "$RELEVANT" -eq 0 ]; then
   exit 0
 fi
 
-# ── 6. Verify packages exist on registry ──────────────────────────────────────
-FAILED=""
-CHECKED=0
+# 3. Resolve the rea CLI.
+REA_ARGV=()
+RESOLVED_CLI_PATH=""
+if [ -f "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/node_modules/@bookedsolid/rea/dist/cli/index.js"
+elif [ -f "$proj/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/dist/cli/index.js"
+fi
 
-while IFS= read -r pkg; do
-  [[ -z "$pkg" ]] && continue
-  CHECKED=$((CHECKED + 1))
+if [ "${#REA_ARGV[@]}" -eq 0 ]; then
+  printf 'rea: dependency-audit-gate cannot run — the rea CLI is not built.\n' >&2
+  printf 'Run `pnpm install && pnpm build` (or `npm install` for a consumer install) to restore protection.\n' >&2
+  exit 2
+fi
 
-  # Cap at 5 packages per command to avoid slow hook
-  if [[ $CHECKED -gt 5 ]]; then
-    break
-  fi
+# 4. Realpath sandbox check.
+if ! command -v node >/dev/null 2>&1; then
+  printf 'rea: dependency-audit-gate cannot run — `node` is not on PATH.\n' >&2
+  exit 2
+fi
 
-  # Use npm view to check if package exists
-  # macOS doesn't have `timeout` by default, use a background process with kill
-  if command -v timeout >/dev/null 2>&1; then
-    if ! timeout 5 npm view "$pkg" name >/dev/null 2>&1; then
-      FAILED="${FAILED}  - ${pkg}\n"
-    fi
-  else
-    # Fallback: run npm view without timeout (still fast for simple checks)
-    if ! npm view "$pkg" name >/dev/null 2>&1; then
-      FAILED="${FAILED}  - ${pkg}\n"
-    fi
-  fi
-done <<< "$PACKAGES"
+sandbox_check=$(node -e '
+  const fs = require("fs");
+  const path = require("path");
+  const cli = process.argv[1];
+  const projDir = process.argv[2];
+  let real, realProj;
+  try { real = fs.realpathSync(cli); } catch (e) {
+    process.stdout.write("bad:realpath"); process.exit(1);
+  }
+  try { realProj = fs.realpathSync(projDir); } catch (e) {
+    process.stdout.write("bad:realpath-proj"); process.exit(1);
+  }
+  const sep = path.sep;
+  const projWithSep = realProj.endsWith(sep) ? realProj : realProj + sep;
+  if (!(real === realProj || real.startsWith(projWithSep))) {
+    process.stdout.write("bad:cli-escapes-project"); process.exit(1);
+  }
+  let cur = path.dirname(path.dirname(path.dirname(real)));
+  let found = false;
+  for (let i = 0; i < 20 && cur && cur !== path.dirname(cur); i += 1) {
+    const pj = path.join(cur, "package.json");
+    if (fs.existsSync(pj)) {
+      try {
+        const data = JSON.parse(fs.readFileSync(pj, "utf8"));
+        if (data && data.name === "@bookedsolid/rea") { found = true; break; }
+      } catch (e) { /* keep walking */ }
+    }
+    cur = path.dirname(cur);
+  }
+  if (!found) { process.stdout.write("bad:no-rea-pkg-json"); process.exit(1); }
+  process.stdout.write("ok");
+' -- "$RESOLVED_CLI_PATH" "$proj" 2>/dev/null)
+
+if [ "$sandbox_check" != "ok" ]; then
+  printf 'rea: dependency-audit-gate FAILED sandbox check (%s) — refusing.\n' "$sandbox_check" >&2
+  exit 2
+fi
 
-if [[ -n "$FAILED" ]]; then
-  {
-    printf 'DEPENDENCY AUDIT: Package not found on npm registry\n'
-    printf '\n'
-    printf '  The following packages could not be verified:\n'
-    printf '%b' "$FAILED"
-    printf '\n'
-    printf '  Rule: All packages must exist on the npm registry before installation.\n'
-    printf '  Check: Is the package name spelled correctly? Does it exist on npmjs.com?\n'
-  } >&2
+# 5. Version-probe.
+probe_out=$("${REA_ARGV[@]}" hook dependency-audit-gate --help 2>&1)
+probe_status=$?
+if [ "$probe_status" -ne 0 ] || ! printf '%s' "$probe_out" | grep -q -e 'dependency-audit-gate'; then
+  printf 'rea: this shim requires the `rea hook dependency-audit-gate` subcommand (introduced in 0.33.0).\n' >&2
+  printf 'The resolved CLI at %s does not implement it.\n' "$RESOLVED_CLI_PATH" >&2
+  printf 'Run `pnpm install` (or `npm install`) to sync the CLI; refusing in the meantime to preserve enforcement.\n' >&2
   exit 2
 fi
 
-exit 0
+# 6. Forward stdin.
+printf '%s' "$INPUT" | "${REA_ARGV[@]}" hook dependency-audit-gate
+exit $?