@brainervirus/workit-core 8.1.1 → 8.3.0

package/src/forge/pr-edit.ts

@@ -0,0 +1,291 @@
+// `workit pr ready|edit|threads|reply` (audit M13): the PR lifecycle steps
+// `pr status` prescribes, so an agent never reaches for gh/glab directly.
+//
+// Every write needs the `pr` grant and an open PR/MR. `edit --base` retargets
+// only to the branch's default target or to a branch the workspace policy does
+// not protect, so a feature PR is never pointed at a production branch by an
+// edit. `reply` and `resolve` act only on a thread `pr status` lists as
+// unresolved on that PR, so a stray id never lands on another PR.
+import { spawnSync } from "node:child_process";
+import { requireGrant } from "../autonomy";
+import { isProtectedTarget } from "../core/branch";
+import { recordedBaseKey, workspaceReleaseTracks } from "../core/release-tracks";
+import { vcsConfig } from "../core/vcs-config";
+import { GIT_TIMEOUTS } from "../git/rev";
+import { listStacks } from "../stack";
+import { checkNames } from "./pr-ops";
+import { selectPr } from "./report";
+import type { ResolvedForge } from "./resolve";
+import {
+  failure,
+  success,
+  type ForgeResult,
+  type ForgeThread,
+  type PrEdit,
+  type PrMeta,
+} from "./types";
+
+const label = (resolved: ResolvedForge, number: number): string =>
+  `${resolved.forge.kind === "github" ? "PR #" : "MR !"}${number}`;
+
+/** The grant, the PR number and its metadata; refuses a closed or merged PR. */
+function openPr(cwd: string, resolved: ResolvedForge, pr: number | null): ForgeResult<PrMeta> {
+  const grant = requireGrant(cwd, "pr");
+  if (!grant.allowed) return failure("blocked", grant.error, grant.unblock);
+  const number = selectPr(cwd, resolved, { pr });
+  if (!number.ok) return number;
+  const meta = resolved.forge.prMeta(number.data);
+  if (!meta.ok) return meta;
+  if (meta.data.state !== "open")
+    return failure(
+      "blocked",
+      `${meta.data.state}: ${label(resolved, meta.data.number)} is ${meta.data.state}`,
+      `workit pr status --pr ${meta.data.number}`,
+    );
+  return meta;
+}
+
+export type ReadyOutcome = { number: number; url: string; draft: boolean; changed: boolean };
+
+/** Mark a draft ready for review, or (`undo`) convert it back to a draft; verified after. */
+export function readyPullRequest(
+  cwd: string,
+  resolved: ResolvedForge,
+  input: { pr: number | null; undo: boolean },
+): ForgeResult<ReadyOutcome> {
+  const meta = openPr(cwd, resolved, input.pr);
+  if (!meta.ok) return meta;
+  const { number, url } = meta.data;
+  const want = input.undo;
+  if (meta.data.draft === want) return success({ number, url, draft: want, changed: false });
+  const set = resolved.forge.setDraft(number, want);
+  if (!set.ok) return set;
+  const after = resolved.forge.prMeta(number);
+  if (!after.ok) return after;
+  if (after.data.draft !== want)
+    return failure(
+      "failed",
+      `ready_unverified: the forge accepted the change but ${label(resolved, number)} still reads ${after.data.draft ? "draft" : "ready"}`,
+      `workit pr status --pr ${number}`,
+    );
+  return success({ number, url, draft: want, changed: true });
+}
+
+export type EditOutcome = {
+  number: number;
+  url: string;
+  title: string;
+  base: string;
+  /** What was asked for, by field (title, body, base, labels, reviewers). */
+  changed: string[];
+};
+
+const git = (cwd: string, args: string[]): string | null => {
+  const run = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+  });
+  return run.status === 0 ? run.stdout.trim() || null : null;
+};
+
+/**
+ * Where `pr edit --base` may point the PR: the head branch's default target
+ * (from the release track that owns the PR's current base, else the head's
+ * own track; an undetermined line refuses), or the head's stack parent —
+ * its recorded `workitBase` or its parent entry in a stack. A protected
+ * branch other than the default target never qualifies.
+ */
+function checkBase(cwd: string, meta: PrMeta, base: string): ForgeResult<void> {
+  const head = meta.headBranch;
+  if (!base || /\s/u.test(base) || base.startsWith("refs/") || base.startsWith("-"))
+    return failure("invalid_input", `--base must be a plain branch name, not "${base}"`);
+  if (base === head) return failure("invalid_input", `${head} cannot be its own base`);
+  const read = workspaceReleaseTracks(cwd);
+  if (read.error) return failure("blocked", read.error, "fix the workspace's releaseTracks");
+  const owners = read.tracks.filter((track) =>
+    [
+      track.integrationBranch,
+      track.productionBranch,
+      track.baseBranch,
+      track.pullRequestTarget,
+    ].includes(meta.base),
+  );
+  const config = vcsConfig("resolve", cwd, {
+    branch: head,
+    ...(owners.length === 1 ? { track: owners[0].name } : {}),
+  });
+  if (config.ok === false)
+    return failure("blocked", String(config.error), "fix ~/.config/workit/vcs.json");
+  const blocking = config.releaseTrack?.blocking;
+  if (blocking)
+    return failure(
+      "blocked",
+      String(blocking),
+      "retarget it on the forge yourself, or fix WORKFLOW_RELEASE_TRACK",
+    );
+  const target = String(config.defaultTargetBranch ?? "") || null;
+  if (base === target) return success(undefined);
+  const instead = target
+    ? `workit pr edit --pr ${meta.number} --base ${target}  # or retarget it on the forge yourself`
+    : "retarget it on the forge yourself";
+  if (isProtectedTarget(cwd, base))
+    return failure(
+      "blocked",
+      `protected_base: ${base} is protected by the workspace branch policy and is not ${head}'s default target${target ? ` (${target})` : ""}; workit never retargets a PR onto it`,
+      instead,
+    );
+  const stacks = listStacks(cwd);
+  // Only the branch directly below the head: a descendant or sibling would
+  // make a cycle or cross stacks.
+  const parents = new Set<string>(
+    stacks.ok
+      ? stacks.data.flatMap((stack) =>
+          stack.branches.filter((entry) => entry.branch === head).map((entry) => entry.parent),
+        )
+      : [],
+  );
+  const recorded = git(cwd, ["config", "--get", recordedBaseKey(head)]);
+  if (base === recorded || parents.has(base)) return success(undefined);
+  return failure(
+    "blocked",
+    `not_stack_parent: ${base} is neither ${head}'s default target${target ? ` (${target})` : ""} nor its stack parent; workit retargets only to those`,
+    instead,
+  );
+}
+
+export function editPullRequest(
+  cwd: string,
+  resolved: ResolvedForge,
+  input: { pr: number | null; edit: PrEdit },
+): ForgeResult<EditOutcome> {
+  const { edit } = input;
+  const changed = [
+    ...(edit.title !== undefined ? ["title"] : []),
+    ...(edit.body !== undefined ? ["body"] : []),
+    ...(edit.base !== undefined ? ["base"] : []),
+    ...(edit.addLabels.length || edit.removeLabels.length ? ["labels"] : []),
+    ...(edit.addReviewers.length ? ["reviewers"] : []),
+  ];
+  if (!changed.length) return failure("invalid_input", "nothing to edit");
+  if (edit.title !== undefined && !edit.title.trim())
+    return failure("invalid_input", "--title must not be empty");
+  const bad = checkNames(
+    resolved.forge.kind,
+    resolved.forge.repo,
+    [...edit.addLabels, ...edit.removeLabels],
+    edit.addReviewers,
+  );
+  if (bad) return failure("invalid_input", bad);
+
+  const meta = openPr(cwd, resolved, input.pr);
+  if (!meta.ok) return meta;
+  const { number } = meta.data;
+  if (edit.base !== undefined) {
+    const allowed = checkBase(cwd, meta.data, edit.base);
+    if (!allowed.ok) return allowed;
+  }
+  const done = resolved.forge.editPr(number, edit);
+  if (!done.ok) return done;
+  const after = resolved.forge.prMeta(number);
+  if (!after.ok) return after;
+  if (edit.base !== undefined && after.data.base !== edit.base)
+    return failure(
+      "failed",
+      `edit_unverified: ${label(resolved, number)} still targets ${after.data.base}, not ${edit.base}`,
+      `workit pr status --pr ${number}`,
+    );
+  return success({
+    number,
+    url: after.data.url,
+    title: after.data.title,
+    base: after.data.base,
+    changed,
+  });
+}
+
+export type ThreadsOutcome = {
+  number: number;
+  url: string;
+  threads: ForgeThread[];
+  truncated: boolean;
+};
+
+/** The PR's unresolved review threads (the ones `pr status` counts). Read-only. */
+export function listThreads(
+  cwd: string,
+  resolved: ResolvedForge,
+  input: { pr: number | null },
+): ForgeResult<ThreadsOutcome> {
+  const number = selectPr(cwd, resolved, { pr: input.pr });
+  if (!number.ok) return number;
+  const status = resolved.forge.prStatus(number.data);
+  if (!status.ok) return status;
+  return success({
+    number: status.data.number,
+    url: status.data.url,
+    threads: status.data.threads,
+    truncated: status.data.truncated,
+  });
+}
+
+export type ReplyOutcome = {
+  number: number;
+  thread: string;
+  replied: boolean;
+  replyUrl: string | null;
+  resolved: boolean;
+};
+
+/** Reply to and/or resolve one unresolved thread of the PR. */
+export function replyToThread(
+  cwd: string,
+  resolved: ResolvedForge,
+  input: { pr: number | null; thread: string; body: string | null; resolve: boolean },
+): ForgeResult<ReplyOutcome> {
+  if (input.body === null && !input.resolve)
+    return failure("invalid_input", "pass --body-file <f> and/or --resolve");
+  if (input.body !== null && !input.body.trim())
+    return failure("invalid_input", "the reply body is empty");
+  const meta = openPr(cwd, resolved, input.pr);
+  if (!meta.ok) return meta;
+  const { number } = meta.data;
+  const status = resolved.forge.prStatus(number);
+  if (!status.ok) return status;
+  const listed = status.data.threads.some((thread) => thread.id === input.thread);
+  // A list cut at the page cap may miss the thread: ask for it directly.
+  const open =
+    listed ||
+    (status.data.truncated &&
+      (() => {
+        const state = resolved.forge.threadState(number, input.thread);
+        return state.ok && state.data === "open";
+      })());
+  if (!open)
+    return failure(
+      "not_found",
+      `thread ${input.thread} is not an unresolved thread of ${label(resolved, number)}`,
+      `workit pr threads --pr ${number}`,
+    );
+  let replyUrl: string | null = null;
+  if (input.body !== null) {
+    const replied = resolved.forge.replyThread(number, input.thread, input.body);
+    if (!replied.ok) return replied;
+    replyUrl = replied.data.url;
+  }
+  if (input.resolve) {
+    const done = resolved.forge.resolveThread(number, input.thread);
+    if (!done.ok)
+      return input.body === null
+        ? done
+        : failure(done.code, `replied, but not resolved: ${done.error}`, done.unblock);
+  }
+  return success({
+    number,
+    thread: input.thread,
+    replied: input.body !== null,
+    replyUrl,
+    resolved: input.resolve,
+  });
+}

package/src/forge/pr-ops.ts

@@ -59,6 +59,9 @@ export type CreateInput = {
   body: string;
   draft: boolean;
   actor: LedgerActor;
+  /** Applied after the PR is opened or found (`--label`, `--reviewer`). */
+  labels?: string[];
+  reviewers?: string[];
 };
 
 export type CreateOutcome = {
@@ -86,10 +89,14 @@ const createNext = (cwd: string): string => {
   return `a non-author verifies the head (workit-review); the endpoint is ${endpoint}, so ${AFTER_REVIEW[endpoint]}`;
 };
 
+/** Workit's own commit trailer: provenance for the ledger, not PR prose. */
+const SESSION_TRAILER = /^Workit-Session:.*$/gimu;
+
 /**
  * `--fill`: the title and body from the branch's commits on top of the base
  * (fetched first). One commit gives its subject and body; several give the
- * oldest subject and a list of every subject.
+ * oldest subject and every subject with its body, like `gh pr create
+ * --fill-verbose`. `Workit-Session:` trailers are left out of the body.
  */
 export function fillFromCommits(
   cwd: string,
@@ -122,7 +129,7 @@ export function fillFromCommits(
     .filter(Boolean)
     .map((entry) => {
       const [subject = "", body = ""] = entry.split("\x1f");
-      return { subject: subject.trim(), body: body.trim() };
+      return { subject: subject.trim(), body: body.replace(SESSION_TRAILER, "").trim() };
     });
   if (commits.length === 0)
     return failure(
@@ -133,10 +140,49 @@ export function fillFromCommits(
   if (commits.length === 1) return success({ title: commits[0].subject, body: commits[0].body });
   return success({
     title: commits[0].subject,
-    body: commits.map((commit) => `- ${commit.subject}`).join("\n"),
+    body: commits
+      .map((commit) =>
+        [`- ${commit.subject}`, ...(commit.body ? ["", indent(commit.body), ""] : [])].join("\n"),
+      )
+      .join("\n")
+      .trim(),
   });
 }
 
+const indent = (text: string): string =>
+  text
+    .split("\n")
+    .map((line) => (line ? `  ${line}` : line))
+    .join("\n");
+
+/**
+ * Labels and reviewers a PR write may send, checked before any forge call
+ * (so `pr create --label/--reviewer` never fails after the PR is open):
+ * comma-free names (GitLab joins labels with commas), GitLab reviewers are
+ * usernames, and a GitHub `org/team` belongs to the repository's owner.
+ */
+export function checkNames(
+  kind: "github" | "gitlab",
+  repo: string,
+  labels: readonly string[],
+  reviewers: readonly string[],
+): string | null {
+  const bad = [...labels, ...reviewers].find(
+    (value) => !value.trim() || value.includes(",") || value !== value.trim(),
+  );
+  if (bad !== undefined) return `invalid label or reviewer "${bad}"`;
+  const owner = repo.split("/")[0]?.toLowerCase() ?? "";
+  for (const reviewer of reviewers) {
+    if (!reviewer.includes("/")) continue;
+    if (kind === "gitlab") return `GitLab reviewers are usernames, not teams ("${reviewer}")`;
+    const [org = "", team = "", ...rest] = reviewer.split("/");
+    if (!team || rest.length) return `invalid team reviewer "${reviewer}" (use <org>/<team>)`;
+    if (org.toLowerCase() !== owner)
+      return `team ${reviewer} is not in ${owner}; GitHub only requests teams of the repository's owner`;
+  }
+  return null;
+}
+
 /** The pushed head of the current branch, bound before any forge write. */
 export function boundSource(
   cwd: string,
@@ -193,6 +239,13 @@ export async function createPullRequest(
   input: CreateInput,
   sleep: Sleep,
 ): Promise<ForgeResult<CreateOutcome>> {
+  const names = checkNames(
+    resolved.forge.kind,
+    resolved.forge.repo,
+    input.labels ?? [],
+    input.reviewers ?? [],
+  );
+  if (names) return failure("invalid_input", names);
   const grant = requireGrant(cwd, "pr");
   if (!grant.allowed) return grantBlocked(grant);
   const source = boundSource(cwd, resolved);
@@ -242,6 +295,21 @@ export async function createPullRequest(
     repo: resolved.forge.repo,
     created,
   });
+  const labels = input.labels ?? [];
+  const reviewers = input.reviewers ?? [];
+  if (labels.length || reviewers.length) {
+    const edited = resolved.forge.editPr(ref.number, {
+      addLabels: labels,
+      removeLabels: [],
+      addReviewers: reviewers,
+    });
+    if (!edited.ok)
+      return failure(
+        edited.code,
+        `${noun(resolved)} #${ref.number} is open (${ref.url}), but its labels or reviewers were not set: ${edited.error}`,
+        `workit pr edit --pr ${ref.number}${labels.map((name) => ` --add-label ${name}`).join("")}${reviewers.map((name) => ` --add-reviewer ${name}`).join("")}`,
+      );
+  }
   return success({
     number: ref.number,
     url: ref.url,
@@ -351,19 +419,37 @@ const refuse = (error: string, unblock: string, refusal: MergeRefusal): MergeRes
   refusal,
 });
 
-const NEXT_HINTS: Record<string, string> = {
-  RESOLVE_CONFLICTS: "rebase onto the base, resolve, then workit git push --force-with-lease",
-  REBASE: "rebase onto the base, then workit git push --force-with-lease",
-  RESOLVE_THREADS: "address and resolve the open review threads (workit pr status lists them)",
-  FIX_CI:
-    "fix the failing checks (workit pr status shows the log tails), push, then workit ci wait",
-  WAITING_CI: "workit ci wait",
-  ADDRESS_REVIEW: "address the requested changes",
-  REVIEW: "get the required review",
-  MARK_READY: "mark the PR ready for review",
-  IN_MERGE_QUEUE: "the PR is already in the merge queue",
-  NOT_MERGEABLE: "workit pr status  # the forge reports it cannot merge yet",
-};
+/**
+ * The command (or step) that clears a `next` blocker, for `pr status` and a
+ * `pr merge` refusal; null for READY and the terminal states.
+ */
+export function nextHint(next: string, number: number): string | null {
+  const pr = `--pr ${number}`;
+  switch (next) {
+    case "RESOLVE_CONFLICTS":
+      return "rebase onto the base, resolve, then workit git push --force-with-lease";
+    case "REBASE":
+      return "rebase onto the base, then workit git push --force-with-lease";
+    case "RESOLVE_THREADS":
+      return `workit pr threads ${pr}; fix or answer each: workit pr reply ${pr} --thread <id> --body-file <f> [--resolve]`;
+    case "FIX_CI":
+      return "fix the failing checks (workit pr status shows the log tails), push, then workit ci wait";
+    case "WAITING_CI":
+      return "workit ci wait";
+    case "ADDRESS_REVIEW":
+      return `address the requested changes; answer threads with workit pr reply ${pr} --thread <id> --body-file <f>`;
+    case "REVIEW":
+      return `get the required review (workit pr edit ${pr} --add-reviewer <login>)`;
+    case "MARK_READY":
+      return `workit pr ready ${pr}`;
+    case "IN_MERGE_QUEUE":
+      return "the PR is already in the merge queue";
+    case "NOT_MERGEABLE":
+      return "workit pr status  # the forge reports it cannot merge yet";
+    default:
+      return null;
+  }
+}
 
 export async function mergePullRequest(
   cwd: string,
@@ -406,7 +492,7 @@ export async function mergePullRequest(
   if (doc.next !== "READY")
     return refuse(
       `not_ready: ${label} is ${doc.next} (${doc.blockers.join(", ") || doc.next.toLowerCase()})`,
-      NEXT_HINTS[doc.next] ?? "workit pr status",
+      nextHint(doc.next, doc.number) ?? "workit pr status",
       { reason: "not_ready", next: doc.next, blockers: doc.blockers },
     );
 

package/src/forge/types.ts

@@ -140,6 +140,28 @@ export type MergeResult = {
   mergeSha: string | null;
 };
 
+/** The editable fields of a PR/MR (`workit pr ready|edit`). */
+export type PrMeta = {
+  number: number;
+  url: string;
+  state: PrState;
+  draft: boolean;
+  title: string;
+  base: string;
+  headBranch: string;
+};
+
+/** What `workit pr edit` changes; unset fields are left alone. */
+export type PrEdit = {
+  title?: string;
+  body?: string;
+  base?: string;
+  addLabels: string[];
+  removeLabels: string[];
+  /** Logins; on GitHub `org/team` requests a team. */
+  addReviewers: string[];
+};
+
 /** A repository as the forge sees it: id and the repo it was forked from. */
 export type RepoInfo = { id: number | null; parent: string | null };
 
@@ -163,4 +185,14 @@ export interface Forge {
   merge(n: number, options: { sha: string; method: MergeMethod }): ForgeResult<MergeResult>;
   /** Retarget a PR/MR to another base branch (S12 stacks). */
   updateBase(n: number, base: string): ForgeResult<void>;
+  /** Title, draft flag, base and state of one PR/MR. */
+  prMeta(n: number): ForgeResult<PrMeta>;
+  /** Mark a draft ready (`draft: false`) or convert it back to a draft. */
+  setDraft(n: number, draft: boolean): ForgeResult<void>;
+  editPr(n: number, edit: PrEdit): ForgeResult<void>;
+  /** Reply to a review thread (GitHub review thread id, GitLab discussion id). */
+  replyThread(n: number, thread: string, body: string): ForgeResult<{ url: string | null }>;
+  resolveThread(n: number, thread: string): ForgeResult<void>;
+  /** One review thread of PR `n` read directly: null when it is not on that PR. */
+  threadState(n: number, thread: string): ForgeResult<"open" | "resolved" | null>;
 }

package/src/hooks/handle.ts

@@ -2,6 +2,14 @@
 import { sessionContextText, turnContextText } from "./context";
 import type { HostDescriptor, Support } from "./descriptor";
 import { shellPolicy } from "./policy";
+import {
+  callKey,
+  NEXT_COMMAND,
+  noteRawCommit,
+  rawGitPost,
+  rawGitPre,
+  settlePendingCommit,
+} from "./raw-git";
 import { shellWrites, writeGate } from "./write-gate";
 import type { HookDecision, HookEventKind, HookInput, HostAdapter, RenderedHook } from "./protocol";
 
@@ -74,13 +82,32 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
       return text ? { kind: "context", text } : NONE;
     }
     case "shell.pre": {
-      const policy = usable(descriptor.shellPolicy.deny)
-        ? shellPolicy(input.cwd, event.command)
-        : NONE;
-      if (policy.kind !== "none" || !usable(descriptor.events["write.pre"].support)) return policy;
-      const writes = shellWrites(event.command);
-      return writes.writes ? writeGate(input.cwd, writes.targets) : NONE;
+      const canDeny = usable(descriptor.shellPolicy.deny);
+      const policy = canDeny ? shellPolicy(input.cwd, event.command) : NONE;
+      if (policy.kind !== "none") return policy;
+      // Without a post-tool event, the previous raw commit is recorded now.
+      const postTool = usable(descriptor.events["shell.post"].support);
+      if (!postTool) settlePendingCommit(input);
+      const raw = canDeny ? rawGitPre(input, event.command) : NONE;
+      if (raw.kind === "deny") return raw;
+      const writes = usable(descriptor.events["write.pre"].support)
+        ? shellWrites(event.command)
+        : { writes: false, targets: null };
+      const gate = writes.writes ? writeGate(input.cwd, writes.targets) : NONE;
+      if (gate.kind === "deny") return gate;
+      // The command will run: note HEAD so the post-tool hook (or the next
+      // command, without one) can tell whether a raw commit moved it.
+      noteRawCommit(
+        input,
+        event.command,
+        postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND,
+      );
+      return raw;
     }
+    case "shell.post":
+      if (usable(descriptor.events["shell.post"].support))
+        rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
+      return NONE;
     case "write.pre":
       return usable(descriptor.events["write.pre"].support)
         ? writeGate(input.cwd, event.paths)
@@ -99,7 +126,6 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
     // Host permission policy owns other tools; attestation, prompt and stop
     // control arrive with the CLI-observed evidence model.
     case "tool.pre":
-    case "shell.post":
     case "subagent.stop":
     case "prompt.submit":
     case "stop":

package/src/hooks/hosts/claude-code.ts

@@ -135,6 +135,8 @@ type Parsed = { ok: true; event: HookEvent } | { ok: false; error: string };
 
 /** Claude's shell tools: Bash everywhere, PowerShell on Windows. */
 const SHELL_TOOLS = new Set(["Bash", "PowerShell"]);
+const dialectOf = (value: Record<string, unknown>) =>
+  value.tool_name === "PowerShell" ? ("powershell" as const) : ("posix" as const);
 const toolCommand = (value: Record<string, unknown>): string | null =>
   isRecord(value.tool_input) ? commandText(value.tool_input.command) : null;
 
@@ -163,7 +165,7 @@ const eventOf = (name: ClaudeHookEvent, value: Record<string, unknown>): Parsed
         return { ok: true, event: { kind: "tool.pre", tool: value.tool_name, toolUseId } };
       const command = toolCommand(value);
       return command
-        ? { ok: true, event: { kind: "shell.pre", command, toolUseId } }
+        ? { ok: true, event: { kind: "shell.pre", command, toolUseId, dialect: dialectOf(value) } }
         : { ok: false, error: `tool_input.command is required for ${value.tool_name}` };
     }
     case "PostToolUse": {
@@ -179,6 +181,7 @@ const eventOf = (name: ClaudeHookEvent, value: Record<string, unknown>): Parsed
           stdout: optionalText(response.stdout) ?? "",
           exitCode: typeof response.exit_code === "number" ? response.exit_code : null,
           toolUseId,
+          dialect: dialectOf(value),
         },
       };
     }
@@ -222,7 +225,14 @@ const eventOf = (name: ClaudeHookEvent, value: Record<string, unknown>): Parsed
   }
 };
 
-const CONTEXT_EVENTS = new Set(["SessionStart", "UserPromptSubmit", "SubagentStart"]);
+/** Events whose hookSpecificOutput takes additionalContext (PreToolUse: a raw-git nudge). */
+const CONTEXT_EVENTS = new Set([
+  "SessionStart",
+  "UserPromptSubmit",
+  "SubagentStart",
+  "PreToolUse",
+  "PostToolUse",
+]);
 
 /** Never emits `allow`: that would bypass the user's own permission prompt. */
 const render = (decision: HookDecision, native: string | null) => {