@brunobracaioli/aibrain 0.4.0-beta.2 → 0.4.0-beta.4

package/dist/guardrails/guards.mjs

@@ -0,0 +1,397 @@
+// @ts-check
+/**
+ * Block guardrails for PreToolUse (spec aisac-engineering-extensions FR2,
+ * FR2.1, FR2.2). Each guard is a pure decision from the tool name and input;
+ * it returns a refusal reason or null. Guards decide from names only and
+ * never open the files they protect. They lower risk; they are not a sandbox.
+ */
+import { execFileSync } from 'node:child_process';
+import { isAbsolute, resolve } from 'node:path';
+import { effectiveWords, programName, splitShell } from './shell-words.mjs';
+
+/**
+ * @typedef {object} GuardContext
+ * @property {string} projectDir
+ * @property {string} home
+ * @property {string} prefsPath The extensions preferences file (FR2.2).
+ * @property {'pt-BR' | 'en'} locale
+ */
+/** @typedef {{ tool_name?: unknown, tool_input?: unknown, cwd?: unknown }} ToolEvent */
+
+const TEMPLATE_SUFFIXES = new Set(['example', 'sample', 'template']);
+const SECRET_DIRECTORIES = new Set(['.ssh', '.aws', '.gnupg']);
+const SECRET_NAMES = new Set(['.envrc', '.npmrc', '.netrc', '.pgpass', 'credentials.json']);
+const PRIVATE_KEY_NAME = /^id_(?:rsa|dsa|ecdsa|ed25519)(?:[._-].*)?$/u;
+const CERTIFICATE_EXTENSION = /\.(?:pem|p12|pfx)$/iu;
+const KEY_EXTENSION = /\.key$/iu;
+const SERVICE_ACCOUNT = /^service-account.*\.json$/iu;
+// Splits a word into the names it mentions (`open('.env')` -> `open`, `.env`),
+// so `process.env.HOME` stays one name and passes.
+const NAME_DELIMITERS = /[\s'"=<>:(),;|&`$]+/u;
+// A quoted name inside a word that contains spaces (`python -c "open('.env')"`).
+const QUOTED_NAME = /['"]([^'"\s]+)['"]/gu;
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh']);
+const SEARCH_PROGRAMS = new Set(['grep', 'egrep', 'fgrep', 'rg', 'ag', 'ack']);
+const MAX_NESTING = 2;
+const AISAC_PROGRAMS = new Set(['aisac', 'aibrain']);
+const AISAC_PACKAGE = /^@(?:aisac\/cli|brunobracaioli\/aibrain)(?:@\S*)?$/u;
+const EXTENSION_COMMANDS = new Set(['hooks', 'mcp']);
+const EXTENSION_CHANGES = new Set(['enable', 'disable', 'reset']);
+const GIT_OPTIONS_WITH_VALUE = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace']);
+const PROTECTED_BRANCHES = new Set(['main', 'master']);
+const GIT_TIMEOUT_MS = 2_000;
+const DANGEROUS_RM_TARGETS = new Set([
+  '/',
+  '/*',
+  '~',
+  '~/',
+  '~/*',
+  '.',
+  './',
+  './*',
+  '..',
+  '../',
+  '*',
+  '$HOME',
+  '$HOME/',
+  '$HOME/*',
+  '${HOME}',
+  '${HOME}/',
+]);
+const DATABASE_CLIENTS = new Set([
+  'psql',
+  'mysql',
+  'mariadb',
+  'sqlite3',
+  'sqlcmd',
+  'clickhouse-client',
+  'cockroach',
+  'duckdb',
+]);
+const DESTRUCTIVE_SQL =
+  /\b(?:DROP\s+(?:DATABASE|TABLE|SCHEMA)|TRUNCATE(?:\s+TABLE)?\s+[A-Za-z_"`])/iu;
+
+const MESSAGES = {
+  en: {
+    secret: 'refused: this touches a secret file (rule: %s). Ask the user to do it themselves.',
+    extensions:
+      'refused: AISAC extensions are changed only by the user, from their own terminal (aisac hooks / aisac mcp).',
+    pushProtected: 'refused: push to %s. Open a pull request instead.',
+    pushForce:
+      'refused: force push. Use --force-with-lease on your own branch if it is really needed.',
+    rm: 'refused: rm -rf on %s.',
+    sql: 'refused: destructive SQL (DROP or TRUNCATE) sent to a database client.',
+  },
+  'pt-BR': {
+    secret:
+      'recusado: isto mexe num arquivo de segredo (regra: %s). Peça ao usuário para fazer isso.',
+    extensions:
+      'recusado: as extensões do AISAC só são mudadas pelo usuário, no terminal dele (aisac hooks / aisac mcp).',
+    pushProtected: 'recusado: push na %s. Abra um pull request.',
+    pushForce:
+      'recusado: push forçado. Use --force-with-lease na sua branch, se for mesmo preciso.',
+    rm: 'recusado: rm -rf em %s.',
+    sql: 'recusado: SQL destrutivo (DROP ou TRUNCATE) enviado a um cliente de banco.',
+  },
+};
+
+/** @param {GuardContext} context @param {keyof typeof MESSAGES.en} key @param {string} [value] */
+function message(context, key, value = '') {
+  return (MESSAGES[context.locale] ?? MESSAGES.en)[key].replace('%s', value);
+}
+
+/** @param {unknown} value @returns {Record<string, unknown>} */
+function record(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? /** @type {Record<string, unknown>} */ (value)
+    : {};
+}
+
+/**
+ * The secret rule a path matches, or null. Names only. With `extensions`
+ * false, only dot names, key names and private directories count: used for
+ * names found inside code, where `obj.key` is not a file.
+ * @param {string} path
+ * @param {{ extensions?: boolean }} [options]
+ * @returns {string | null}
+ */
+export function secretRule(path, options = {}) {
+  const segments = path.split(/[/\\]/u).filter((segment) => segment.length > 0);
+  if (segments.some((segment) => SECRET_DIRECTORIES.has(segment))) return 'private directory';
+  const name = segments.at(-1) ?? '';
+  if (name === '.env') return '.env';
+  if (name.startsWith('.env.')) {
+    const suffix = name.slice('.env.'.length);
+    return TEMPLATE_SUFFIXES.has(suffix) ? null : '.env.*';
+  }
+  if (/^\.env[*?[]/u.test(name)) return '.env*';
+  if (SECRET_NAMES.has(name)) return name;
+  if (PRIVATE_KEY_NAME.test(name) && !name.endsWith('.pub')) return 'private key';
+  if (options.extensions === false) return null;
+  if (CERTIFICATE_EXTENSION.test(name)) return 'key or certificate file';
+  if (KEY_EXTENSION.test(name) && !name.startsWith('.')) return 'key file';
+  if (SERVICE_ACCOUNT.test(name)) return 'service account key';
+  return null;
+}
+
+/** Resolve `~`, `$HOME` and relative paths for comparison. @param {string} path @param {GuardContext} context */
+function resolvePath(path, context) {
+  const expanded = path
+    .replace(/^~(?=\/|$)/u, context.home)
+    .replace(/^\$\{?HOME\}?(?=\/|$)/u, context.home);
+  return isAbsolute(expanded) ? resolve(expanded) : resolve(context.projectDir, expanded);
+}
+
+/** @param {string} path @param {GuardContext} context */
+function isPreferencesPath(path, context) {
+  return path.length > 0 && resolvePath(path, context) === resolve(context.prefsPath);
+}
+
+/** Path-like parts of a word: the word itself and a `--flag=value` / `VAR=value` value. @param {string} word */
+function pathCandidates(word) {
+  const equals = word.lastIndexOf('=');
+  return equals === -1 ? [word] : [word, word.slice(equals + 1)];
+}
+
+/** @param {string[]} words */
+function changesExtensions(words) {
+  const effective = effectiveWords(words);
+  const program = programName(effective[0] ?? '');
+  const aisacEntry =
+    AISAC_PROGRAMS.has(program) ||
+    AISAC_PACKAGE.test(effective[0] ?? '') ||
+    (program === 'node' && /(?:@aisac\/cli|aibrain)[\\/].*cli\.mjs$/u.test(effective[1] ?? ''));
+  if (!aisacEntry) return false;
+  const rest = effective.slice(program === 'node' ? 2 : 1);
+  const commandIndex = rest.findIndex((word) => EXTENSION_COMMANDS.has(word));
+  return (
+    commandIndex !== -1 && rest.slice(commandIndex + 1).some((word) => EXTENSION_CHANGES.has(word))
+  );
+}
+
+/**
+ * `secrets-guard` (FR2.1) with the FR2.2 self-protection.
+ * @param {ToolEvent} event @param {GuardContext} context
+ * @returns {string | null}
+ */
+export function secretsGuard(event, context) {
+  const tool = typeof event.tool_name === 'string' ? event.tool_name : '';
+  const input = record(event.tool_input);
+  if (tool === 'Bash')
+    return secretsInCommand(typeof input.command === 'string' ? input.command : '', context);
+  const pathValue = tool === 'Grep' ? input.path : (input.file_path ?? input.notebook_path);
+  if (typeof pathValue !== 'string' || pathValue.length === 0) return null;
+  if (tool !== 'Read' && tool !== 'Grep' && isPreferencesPath(pathValue, context))
+    return message(context, 'extensions');
+  const rule = secretRule(pathValue);
+  return rule === null ? null : message(context, 'secret', rule);
+}
+
+/** @param {string} text @param {GuardContext} context */
+function mentionsPreferences(text, context) {
+  return text.includes(resolve(context.prefsPath)) || text.includes('.aibrain/extensions.json');
+}
+
+/** Contents of `$(...)` and backtick substitutions in a word. @param {string} word */
+function substitutions(word) {
+  /** @type {string[]} */
+  const found = [];
+  for (const match of word.matchAll(/\$\(([^()]*(?:\([^()]*\)[^()]*)*)\)|`([^`]*)`/gu))
+    found.push(match[1] ?? match[2] ?? '');
+  return found;
+}
+
+/**
+ * A word's refusal. A word without spaces is a path candidate and a list of
+ * names; a word with spaces (a quoted script or message) counts only for
+ * quoted names inside it, so `git commit -m "ignore .env files"` passes.
+ * @param {string} word @param {GuardContext} context @param {number} depth
+ * @returns {string | null}
+ */
+function wordRefusal(word, context, depth) {
+  if (mentionsPreferences(word, context)) return message(context, 'extensions');
+  if (!/\s/u.test(word)) {
+    for (const candidate of pathCandidates(word)) {
+      if (isPreferencesPath(candidate, context)) return message(context, 'extensions');
+      const rule = secretRule(candidate);
+      if (rule !== null) return message(context, 'secret', rule);
+    }
+    for (const name of word.split(NAME_DELIMITERS)) {
+      const rule = name.length > 0 ? secretRule(name, { extensions: false }) : null;
+      if (rule !== null) return message(context, 'secret', rule);
+    }
+  } else {
+    for (const match of word.matchAll(QUOTED_NAME)) {
+      const rule = secretRule(match[1] ?? '', { extensions: false });
+      if (rule !== null) return message(context, 'secret', rule);
+    }
+  }
+  if (depth < MAX_NESTING)
+    for (const inner of substitutions(word)) {
+      const refusal = secretsInCommand(inner, context, depth + 1);
+      if (refusal !== null) return refusal;
+    }
+  return null;
+}
+
+/** Words that are search patterns, not files (`grep PATTERN`, `rg -e PATTERN`). @param {string[]} words */
+function searchPatternIndexes(words) {
+  const indexes = new Set();
+  if (!SEARCH_PROGRAMS.has(programName(words[0] ?? ''))) return indexes;
+  let explicit = false;
+  for (let index = 1; index < words.length; index += 1)
+    if (words[index] === '-e' || words[index] === '--regexp') {
+      indexes.add(index + 1);
+      explicit = true;
+    }
+  if (!explicit) {
+    const first = words.findIndex((word, index) => index > 0 && !word.startsWith('-'));
+    if (first !== -1) indexes.add(first);
+  }
+  return indexes;
+}
+
+/** @param {string} command @param {GuardContext} context @param {number} [depth] @returns {string | null} */
+function secretsInCommand(command, context, depth = 0) {
+  if (command.length === 0) return null;
+  const parsed = splitShell(command);
+  if (!parsed.ok) {
+    if (mentionsPreferences(command, context)) return message(context, 'extensions');
+    for (const name of command.split(NAME_DELIMITERS)) {
+      const rule = name.length > 0 ? secretRule(name, { extensions: false }) : null;
+      if (rule !== null) return message(context, 'secret', rule);
+    }
+    return null;
+  }
+  for (const item of parsed.commands) {
+    if (changesExtensions(item.words)) return message(context, 'extensions');
+    const words = effectiveWords(item.words);
+    const program = programName(words[0] ?? '');
+    const patterns = searchPatternIndexes(words);
+    const prefix = item.words.slice(0, item.words.length - words.length);
+    for (const [index, word] of [...prefix, ...words].entries()) {
+      if (patterns.has(index - prefix.length)) continue;
+      const refusal = wordRefusal(word, context, depth);
+      if (refusal !== null) return refusal;
+    }
+    for (const target of item.targets) {
+      const refusal = wordRefusal(target, context, depth);
+      if (refusal !== null) return refusal;
+    }
+    // `bash -c "cat .env"` and `eval "..."` carry a whole command in one word.
+    const script =
+      SHELLS.has(program) && words.includes('-c')
+        ? words[words.indexOf('-c') + 1]
+        : program === 'eval'
+          ? words.slice(1).join(' ')
+          : undefined;
+    if (script !== undefined && depth < MAX_NESTING) {
+      const refusal = secretsInCommand(script, context, depth + 1);
+      if (refusal !== null) return refusal;
+    }
+  }
+  return null;
+}
+
+/** Destination branch of a push refspec (`HEAD:main`, `+main`, `refs/heads/main`). @param {string} refspec */
+function refspecDestination(refspec) {
+  const unforced = refspec.startsWith('+') ? refspec.slice(1) : refspec;
+  const colon = unforced.lastIndexOf(':');
+  const destination = colon === -1 ? unforced : unforced.slice(colon + 1);
+  return destination.replace(/^refs\/heads\//u, '');
+}
+
+/** @param {string} directory */
+function currentBranch(directory) {
+  try {
+    return execFileSync('git', ['-C', directory, 'symbolic-ref', '--short', 'HEAD'], {
+      encoding: 'utf8',
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * `git-guard`: pushes to main or master, and force pushes.
+ * @param {ToolEvent} event @param {GuardContext} context
+ * @returns {string | null}
+ */
+export function gitGuard(event, context) {
+  const command = record(event.tool_input).command;
+  if (event.tool_name !== 'Bash' || typeof command !== 'string') return null;
+  const parsed = splitShell(command);
+  if (!parsed.ok) return null;
+  for (const item of parsed.commands) {
+    const words = effectiveWords(item.words);
+    if (programName(words[0] ?? '') !== 'git') continue;
+    let index = 1;
+    let directory = context.projectDir;
+    while (index < words.length && (words[index] ?? '').startsWith('-')) {
+      const option = words[index] ?? '';
+      if (GIT_OPTIONS_WITH_VALUE.has(option)) {
+        if (option === '-C') directory = resolve(directory, words[index + 1] ?? '.');
+        index += 2;
+      } else index += 1;
+    }
+    if (words[index] !== 'push') continue;
+    const args = words.slice(index + 1);
+    const flags = args.filter((word) => word.startsWith('-'));
+    const positional = args.filter((word) => !word.startsWith('-'));
+    const forced =
+      flags.some(
+        (flag) =>
+          flag === '--force' ||
+          flag === '--mirror' ||
+          (/^-[A-Za-z]+$/u.test(flag) && flag.includes('f')),
+      ) || positional.slice(1).some((refspec) => refspec.startsWith('+'));
+    if (forced) return message(context, 'pushForce');
+    if (flags.includes('--all')) return message(context, 'pushProtected', 'main/master (--all)');
+    const refspecs = positional.slice(1);
+    const destinations =
+      refspecs.length > 0 ? refspecs.map(refspecDestination) : [currentBranch(directory)];
+    const protectedBranch = destinations.find((branch) => PROTECTED_BRANCHES.has(branch));
+    if (protectedBranch !== undefined) return message(context, 'pushProtected', protectedBranch);
+  }
+  return null;
+}
+
+/**
+ * `destructive-guard`: rm -rf on a root-like target, and destructive SQL sent to a client.
+ * @param {ToolEvent} event @param {GuardContext} context
+ * @returns {string | null}
+ */
+export function destructiveGuard(event, context) {
+  const command = record(event.tool_input).command;
+  if (event.tool_name !== 'Bash' || typeof command !== 'string') return null;
+  const parsed = splitShell(command);
+  if (!parsed.ok) return null;
+  let databaseClient = false;
+  for (const item of parsed.commands) {
+    const words = effectiveWords(item.words);
+    const program = programName(words[0] ?? '');
+    if (DATABASE_CLIENTS.has(program)) databaseClient = true;
+    if (program !== 'rm') continue;
+    const flags = words.slice(1).filter((word) => word.startsWith('-'));
+    const recursive = flags.some(
+      (flag) => flag === '--recursive' || (/^-[A-Za-z]+$/u.test(flag) && /[rR]/u.test(flag)),
+    );
+    const force = flags.some(
+      (flag) => flag === '--force' || (/^-[A-Za-z]+$/u.test(flag) && flag.includes('f')),
+    );
+    const target = words
+      .slice(1)
+      .find((word) => !word.startsWith('-') && DANGEROUS_RM_TARGETS.has(word));
+    if (recursive && force && target !== undefined) return message(context, 'rm', target);
+  }
+  return databaseClient && DESTRUCTIVE_SQL.test(command) ? message(context, 'sql') : null;
+}
+
+/** Guards by catalog id, in the order they run. */
+export const GUARDS = Object.freeze({
+  'secrets-guard': secretsGuard,
+  'git-guard': gitGuard,
+  'destructive-guard': destructiveGuard,
+});

package/dist/guardrails/run.mjs

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+// @ts-check
+/**
+ * Guardrail dispatcher (spec aisac-engineering-extensions FR2, FR5): the
+ * command the session plugin `aisac-guardrails` runs for each host event. One
+ * process per event runs every enabled hook bound to it, so a tool call pays
+ * for one Node start. Arguments come from the launcher; the event payload
+ * comes from the host on stdin and is untrusted.
+ *
+ * Exit 0 always, except exit 2 for a PreToolUse refusal (reason on stderr).
+ * Any error lets the tool call run: a broken guard must not stop all work.
+ */
+import { homedir } from 'node:os';
+import { isAbsolute } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { hookById } from '../extensions-catalog.mjs';
+import { GUARDS } from './guards.mjs';
+import {
+  continuityReminder,
+  docsReminder,
+  recordEdit,
+  resetTurn,
+  restoreCompactSnapshot,
+  saveCompactSnapshot,
+  sessionContext,
+} from './continuity.mjs';
+import { formatEdited } from './format.mjs';
+
+const MAX_INPUT_BYTES = 1024 * 1024;
+const EVENTS = new Set([
+  'PreToolUse',
+  'PostToolUse',
+  'UserPromptSubmit',
+  'SessionStart',
+  'PreCompact',
+  'Stop',
+]);
+const REFUSAL_EXIT_CODE = 2;
+
+/**
+ * @typedef {object} RunOptions
+ * @property {import('../extensions-catalog.mjs').HookEvent} event
+ * @property {string[]} hooks
+ * @property {string} stateDir
+ * @property {string} prefsPath
+ * @property {'pt-BR' | 'en'} locale
+ */
+
+/**
+ * Strict launcher arguments; null when anything is off.
+ * @param {string[]} argv
+ * @returns {RunOptions | null}
+ */
+export function parseArguments(argv) {
+  /** @type {Record<string, string>} */
+  const values = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const name = argv[index] ?? '';
+    const value = argv[index + 1];
+    if (
+      !['--event', '--hooks', '--state', '--prefs', '--locale'].includes(name) ||
+      value === undefined
+    )
+      return null;
+    values[name] = value;
+  }
+  const event = values['--event'] ?? '';
+  const stateDir = values['--state'] ?? '';
+  const prefsPath = values['--prefs'] ?? '';
+  if (!EVENTS.has(event) || !isAbsolute(stateDir) || !isAbsolute(prefsPath)) return null;
+  const hooks = (values['--hooks'] ?? '').split(',').filter((id) => {
+    const entry = hookById(id);
+    return entry !== undefined && entry.bindings.some((binding) => binding.event === event);
+  });
+  return {
+    event: /** @type {import('../extensions-catalog.mjs').HookEvent} */ (event),
+    hooks,
+    stateDir,
+    prefsPath,
+    locale: values['--locale'] === 'pt-BR' ? 'pt-BR' : 'en',
+  };
+}
+
+/** @returns {Promise<string | null>} */
+async function readInput() {
+  /** @type {Buffer[]} */
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    size += buffer.length;
+    if (size > MAX_INPUT_BYTES) return null;
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+/** Does a hook's binding for this event accept the tool or source? @param {string} id @param {string} event @param {string} subject */
+function bound(id, event, subject) {
+  return (hookById(id)?.bindings ?? []).some(
+    (binding) =>
+      binding.event === event &&
+      (binding.matcher === undefined || binding.matcher.split('|').includes(subject)),
+  );
+}
+
+/**
+ * Run the enabled hooks for one event.
+ * @param {RunOptions} options
+ * @param {Record<string, unknown>} input
+ * @returns {Promise<{ exitCode: number, stdout: string, stderr: string }>}
+ */
+export async function dispatch(options, input) {
+  const envProject = process.env.CLAUDE_PROJECT_DIR;
+  const projectDir =
+    typeof envProject === 'string' && isAbsolute(envProject)
+      ? envProject
+      : typeof input.cwd === 'string' && isAbsolute(input.cwd)
+        ? input.cwd
+        : process.cwd();
+  const context = {
+    projectDir,
+    stateDir: options.stateDir,
+    prefsPath: options.prefsPath,
+    home: homedir(),
+    locale: options.locale,
+  };
+  const enabled = new Set(options.hooks);
+  const tool = typeof input.tool_name === 'string' ? input.tool_name : '';
+  const toolInput =
+    typeof input.tool_input === 'object' && input.tool_input !== null
+      ? /** @type {Record<string, unknown>} */ (input.tool_input)
+      : {};
+  const quiet = { exitCode: 0, stdout: '', stderr: '' };
+
+  if (options.event === 'PreToolUse') {
+    for (const [id, guard] of Object.entries(GUARDS)) {
+      if (!enabled.has(id) || !bound(id, 'PreToolUse', tool)) continue;
+      const reason = guard(input, context);
+      if (reason !== null)
+        return { exitCode: REFUSAL_EXIT_CODE, stdout: '', stderr: `[aisac ${id}] ${reason}\n` };
+    }
+    return quiet;
+  }
+  if (options.event === 'PostToolUse') {
+    const filePath = toolInput.file_path;
+    if (enabled.has('format-on-edit') && bound('format-on-edit', 'PostToolUse', tool))
+      await formatEdited(projectDir, filePath);
+    if (enabled.has('continuity-reminder') && bound('continuity-reminder', 'PostToolUse', tool))
+      await recordEdit(context, input.session_id, filePath);
+    const reminder =
+      enabled.has('docs-reminder') && bound('docs-reminder', 'PostToolUse', tool)
+        ? await docsReminder(context, input.session_id, filePath)
+        : '';
+    return reminder.length === 0
+      ? quiet
+      : {
+          exitCode: 0,
+          stdout: JSON.stringify({
+            hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: reminder },
+          }),
+          stderr: '',
+        };
+  }
+  if (options.event === 'UserPromptSubmit') {
+    if (enabled.has('docs-reminder') || enabled.has('continuity-reminder'))
+      await resetTurn(context, input.session_id);
+    return quiet;
+  }
+  if (options.event === 'Stop') {
+    const reason = enabled.has('continuity-reminder')
+      ? await continuityReminder(context, input.session_id, input.stop_hook_active)
+      : '';
+    return reason.length === 0
+      ? quiet
+      : { exitCode: 0, stdout: JSON.stringify({ decision: 'block', reason }), stderr: '' };
+  }
+  if (options.event === 'PreCompact') {
+    if (enabled.has('compact-continuity')) await saveCompactSnapshot(context, input.session_id);
+    return quiet;
+  }
+  const source = typeof input.source === 'string' ? input.source : 'startup';
+  const text =
+    source === 'compact'
+      ? enabled.has('compact-continuity')
+        ? await restoreCompactSnapshot(context, input.session_id)
+        : ''
+      : enabled.has('session-context') && bound('session-context', 'SessionStart', source)
+        ? await sessionContext(context)
+        : '';
+  return { exitCode: 0, stdout: text, stderr: '' };
+}
+
+async function main() {
+  const options = parseArguments(process.argv.slice(2));
+  if (options === null || options.hooks.length === 0) return;
+  const raw = await readInput();
+  if (raw === null) return;
+  /** @type {unknown} */
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return;
+  const result = await dispatch(options, /** @type {Record<string, unknown>} */ (parsed));
+  if (result.stdout.length > 0) process.stdout.write(result.stdout);
+  if (result.stderr.length > 0) process.stderr.write(result.stderr);
+  process.exitCode = result.exitCode;
+}
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href)
+  main().catch(() => {
+    process.exitCode = 0;
+  });