@cybedefend/vibedefend 1.1.1

package/dist/hooks/runtime/session-review.js

@@ -0,0 +1,198 @@
+/**
+ * Stop / end-of-session gap-analysis hook.
+ *
+ * Counts how many code-mutating tool calls happened in the transcript;
+ * if `>= reviewThreshold`, emits the cybe-review directive that asks the
+ * agent to compare the user's prompt against the rules applied during
+ * the session and offer to propose missing ones.
+ *
+ * Transcript handling — every client gives us a path to a transcript
+ * file (JSONL for most, plain JSON array for some). We read it and
+ * scan for tool invocations regardless of the exact field names used
+ * (`tool_uses`, `toolCalls`, `tools`, etc.).
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { sniff } from './sniff.js';
+import { emit } from './emit.js';
+import { loadRuntimeConfig, readStdinJson } from './config.js';
+const COUNTED_TOOLS = new Set([
+    'Edit',
+    'Write',
+    'MultiEdit',
+    'apply_patch',
+    'pre_write_code',
+]);
+export async function sessionReviewHook(deps = {}) {
+    const readStdin = deps.readStdin ?? readStdinJson;
+    const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
+    const emitFn = deps.emitFn ?? emit;
+    const readTranscriptFile = deps.readTranscriptFile ?? defaultReadTranscript;
+    const stdin = await readStdin();
+    const event = sniff(stdin);
+    const config = loadConfig();
+    if (!config)
+        return;
+    if (!config.hooks.enableSessionReview)
+        return;
+    const transcript = loadTranscript(stdin, readTranscriptFile);
+    let editCount = countEdits(transcript);
+    // Dry-run override for hook-debug — pretend the session had N edits.
+    if (process.env.CYBEDEFEND_DRY_RUN === '1') {
+        editCount = parseInt(process.env.CYBEDEFEND_DRY_RUN_EDITS ?? '5', 10);
+    }
+    if (editCount === 0)
+        return;
+    if (editCount < config.hooks.reviewThreshold)
+        return;
+    const userPrompt = extractFirstUserPrompt(transcript);
+    const body = composeReviewBody(editCount, event.client, userPrompt, config.hooks.autoProposeMode);
+    emitFn(body, event.client);
+}
+/**
+ * Resolve the transcript to a JS array of "events". Each client packages
+ * it differently:
+ *   - Inline `transcript: [...]` in stdin (Claude Code Stop)
+ *   - `transcript_path: "..."` pointing to a JSONL or JSON-array file
+ */
+function loadTranscript(stdin, readFile) {
+    if (Array.isArray(stdin.transcript))
+        return stdin.transcript;
+    const path = typeof stdin.transcript_path === 'string' ? stdin.transcript_path : '';
+    if (!path)
+        return [];
+    const raw = readFile(path);
+    if (!raw)
+        return [];
+    // Try JSONL first (one JSON object per line), then a single JSON array.
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('[')) {
+        try {
+            const arr = JSON.parse(trimmed);
+            return Array.isArray(arr) ? arr : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    const out = [];
+    for (const line of trimmed.split('\n')) {
+        const l = line.trim();
+        if (!l)
+            continue;
+        try {
+            out.push(JSON.parse(l));
+        }
+        catch {
+            // Skip malformed lines — agent transcripts occasionally have
+            // partial writes during compaction. Continue rather than abort.
+        }
+    }
+    return out;
+}
+function defaultReadTranscript(path) {
+    if (!existsSync(path))
+        return null;
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Walk every event in the transcript and count tool invocations whose
+ * name is in COUNTED_TOOLS. Tolerant to the multiple field-name
+ * conventions different agents use (`tool_uses` / `toolCalls` / `tools`,
+ * and inside each `name` / `tool_name` / `toolName`).
+ */
+export function countEdits(transcript) {
+    let n = 0;
+    for (const event of transcript) {
+        if (!event || typeof event !== 'object')
+            continue;
+        const rec = event;
+        const candidates = [];
+        for (const key of ['tool_uses', 'toolCalls', 'tools', 'message']) {
+            const v = rec[key];
+            if (Array.isArray(v))
+                candidates.push(...v);
+            else if (v && typeof v === 'object')
+                candidates.push(v);
+        }
+        // Some transcripts inline a `name` / `tool_name` directly on the event.
+        candidates.push(rec);
+        for (const c of candidates) {
+            if (!c || typeof c !== 'object')
+                continue;
+            const obj = c;
+            const name = (typeof obj.name === 'string' && obj.name) ||
+                (typeof obj.tool_name === 'string' && obj.tool_name) ||
+                (typeof obj.toolName === 'string' && obj.toolName) ||
+                '';
+            if (COUNTED_TOOLS.has(name))
+                n += 1;
+        }
+    }
+    return n;
+}
+/**
+ * Pull the first user-role message text from the transcript. Truncated
+ * to 600 chars — enough context for the agent to do the gap analysis
+ * without bloating the output.
+ */
+export function extractFirstUserPrompt(transcript) {
+    for (const event of transcript) {
+        if (!event || typeof event !== 'object')
+            continue;
+        const rec = event;
+        const isUser = rec.role === 'user' || rec.type === 'user' || rec.from === 'user';
+        if (!isUser)
+            continue;
+        const text = (typeof rec.content === 'string' && rec.content) ||
+            (typeof rec.text === 'string' && rec.text) ||
+            (typeof rec.message === 'string' && rec.message) ||
+            '';
+        if (text)
+            return text.slice(0, 600);
+    }
+    return '';
+}
+function composeReviewBody(editCount, client, userPrompt, autoPropose) {
+    const safePrompt = userPrompt || '(could not extract — re-read transcript)';
+    const proposalLine = autoPropose
+        ? [
+            '   **Auto-propose mode is ON** (configured at install). Without asking the user,',
+            '   call `cybe_rules_report_missing(projectId, { rule_text, evidence_files,',
+            '   rationale: "<quote user prompt>", confirmed_by_user: true })` for each',
+            '   uncovered concern. The user will validate them at the next session start',
+            '   via the Accept/Reject picker.',
+        ].join('\n')
+        : [
+            '   Ask the user via AskUserQuestion:',
+            '   > "Your prompt mentioned <concern>, but no business rule covers it.',
+            '   >  Propose this rule for the project?" — Yes / No / Edit before proposing.',
+            '   ONLY on explicit "yes": call `cybe_rules_report_missing(projectId,',
+            '   { rule_text, evidence_files, rationale: "<quote user prompt>",',
+            '   confirmed_by_user: true })`.',
+        ].join('\n');
+    return [
+        `## 🛡️ CybeDefend gap analysis (Stop hook — ${editCount} edits this session, client=${client})`,
+        '',
+        'Do a **gap analysis** between the original user request and the',
+        'business rules that were applied during this session.',
+        '',
+        '**Original user prompt (first 600 chars):**',
+        `> ${safePrompt}`,
+        '',
+        '### Required next-turn action',
+        '1. Extract security/business concerns the prompt mentions.',
+        '2. List CybeDefend rules returned during the session.',
+        '3. For each concern WITHOUT a matching rule:',
+        proposalLine,
+        '4. If every concern is covered, say so:',
+        '   "🛡️ CybeDefend gap analysis: every concern in your request was covered',
+        '    by an existing rule. No new proposals."',
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=session-review.js.map

package/dist/hooks/runtime/session-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-review.js","sourceRoot":"","sources":["../../../src/hooks/runtime/session-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAC;AAUH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAE5E,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO;IAE9C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC7D,IAAI,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAEvC,qEAAqE;IACrE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO;IAC5B,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO;IAErD,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAC5B,SAAS,EACT,KAAK,CAAC,MAAM,EACZ,UAAU,EACV,MAAM,CAAC,KAAK,CAAC,eAAe,CAC7B,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,KAA8B,EAC9B,QAAyC;IAEzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAE7D,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IAEpB,wEAAwE;IACxE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,UAAqB;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,UAAU,GAAc,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;iBACvC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,wEAAwE;QACxE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC1C,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,MAAM,IAAI,GACR,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;gBAC1C,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC;gBACpD,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;gBAClD,EAAE,CAAC;YACL,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAqB;IAC1D,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,MAAM,GACV,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GACR,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;YAChD,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;YAC1C,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;YAChD,EAAE,CAAC;QACL,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAiB,EACjB,MAAc,EACd,UAAkB,EAClB,WAAoB;IAEpB,MAAM,UAAU,GAAG,UAAU,IAAI,0CAA0C,CAAC;IAC5E,MAAM,YAAY,GAAG,WAAW;QAC9B,CAAC,CAAC;YACE,kFAAkF;YAClF,4EAA4E;YAC5E,2EAA2E;YAC3E,6EAA6E;YAC7E,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC;QACd,CAAC,CAAC;YACE,sCAAsC;YACtC,wEAAwE;YACxE,+EAA+E;YAC/E,uEAAuE;YACvE,mEAAmE;YACnE,iCAAiC;SAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjB,OAAO;QACL,+CAA+C,SAAS,+BAA+B,MAAM,GAAG;QAChG,EAAE;QACF,iEAAiE;QACjE,uDAAuD;QACvD,EAAE;QACF,6CAA6C;QAC7C,KAAK,UAAU,EAAE;QACjB,EAAE;QACF,+BAA+B;QAC/B,4DAA4D;QAC5D,uDAAuD;QACvD,8CAA8C;QAC9C,YAAY;QACZ,yCAAyC;QACzC,4EAA4E;QAC5E,6CAA6C;QAC7C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/hooks/runtime/session-start.js

@@ -0,0 +1,101 @@
+/**
+ * SessionStart hook — fetch the proposal-inbox count + nudge the agent
+ * to run through it before responding to the user.
+ *
+ * Maps to:
+ *   - Claude Code, VS Code, Codex: SessionStart event
+ *   - Cursor: sessionStart event
+ *   - Windsurf: pre_user_prompt (fires every turn; idempotent because
+ *     the body only nudges if proposals exist)
+ */
+import { sniff } from './sniff.js';
+import { resolveProjectId, resolveToken } from './resolve.js';
+import { fetchProposalsCount } from './api.js';
+import { emitContext } from './emit.js';
+import { loadRuntimeConfig, readStdinJson } from './config.js';
+export async function sessionStartHook(deps = {}) {
+    const readStdin = deps.readStdin ?? readStdinJson;
+    const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
+    const resolveProject = deps.resolveProject ?? resolveProjectId;
+    const resolveTok = deps.resolveTokenFn ?? resolveToken;
+    const fetchProposals = deps.fetchProposalsFn ?? fetchProposalsCount;
+    // SessionStart context goes through `emitContext`, not `emit`, so the
+    // body lands inside Codex's `additionalContext` JSON envelope (and as
+    // plain markdown for everyone else). See emit.ts for the rationale.
+    const emitFn = deps.emitFn ?? emitContext;
+    const stdin = await readStdin();
+    const event = sniff(stdin);
+    const config = loadConfig();
+    if (!config)
+        return;
+    const { projectId, apiBase: configApiBase } = resolveProject();
+    if (!projectId)
+        return;
+    const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
+    // Dry-run for hook-debug — emit a sentinel without hitting the API.
+    if (process.env.CYBEDEFEND_DRY_RUN === '1') {
+        emitFn(`## CybeDefend session bootstrap (dry-run, client=${event.client})\n- project: ${projectId}\n`, event.client);
+        return;
+    }
+    // Token + proposal-count are best-effort. The projectId block MUST surface
+    // even when neither is available — that is the most important piece of
+    // session context for the agent (especially under Codex, whose MCP
+    // credentials live in a different Keychain service that `resolveToken`
+    // doesn't read yet, and so token lookup returns null on every Codex
+    // session). The proposal-count line is omitted on failure rather than
+    // showing a misleading "0" or blocking the whole bootstrap.
+    const token = resolveTok(config.region.mcpName);
+    let total = null;
+    if (token) {
+        const result = await fetchProposals({ apiBase, projectId, token });
+        if (result)
+            total = result.total;
+    }
+    const lines = [
+        '## CybeDefend session bootstrap',
+        `- project: \`${projectId}\` (client: ${event.client})`,
+    ];
+    if (total !== null) {
+        lines.push(`- pending proposals: **${total}**`);
+    }
+    lines.push('- (workflow doctrine is auto-injected via the MCP `Server.instructions` field;', '   if your client does not surface it, load the `cybe-init` MCP prompt manually.)');
+    // Part 1: Always emit an explicit Step 0 — proposals inbox line.
+    // The model's context-window scan picks up named anchors ("Step 0")
+    // much more reliably than generic doctrine paragraphs, especially on
+    // Codex where the token is not yet available so total stays null.
+    lines.push('');
+    if (total === null) {
+        // Token unavailable (Codex with unresolvable keychain, or transient
+        // API failure) — emit a strong "YOU MUST call" warning so the model
+        // still has a clear Step 0 signal even without a concrete count.
+        lines.push('- **Step 0 — proposals inbox**: ⚠ unable to verify (no MCP token reachable).', '  **YOU MUST call `cybe_rules_list_proposals(projectId, status="proposed")` as', '  your VERY FIRST action this session, before any project work.**');
+    }
+    else if (total === 0) {
+        lines.push('- **Step 0 — proposals inbox**: 0 pending. ✓ Bootstrap complete; no action required.');
+    }
+    else {
+        lines.push(`- **Step 0 — proposals inbox**: ${total} pending. ⚠ ACTION REQUIRED —`, '  list them via `cybe_rules_list_proposals(projectId, status="proposed")`', '  and surface each via AskUserQuestion (Accept / Reject / Skip / Tell me more)', '  **before responding to the user request.**');
+    }
+    // Part 3: Action Guards reminder — message varies by client.
+    // Hard-enforcement clients (Claude Code, Codex, Cursor) have a PreToolUse
+    // hook that exits with code 2 on deny, which hard-blocks the tool call
+    // BEFORE the LLM executes it. Pushing the LLM to call cybe_guards_check
+    // preemptively dilutes that UX: the user sees a polite "I checked and
+    // refused" instead of a clean runtime intercept. On those clients the LLM
+    // should do nothing — just make the tool call and let the hook intercept it.
+    //
+    // Windsurf's pre_write_code hook only covers file writes. Read, Bash,
+    // WebFetch, and network actions are NOT intercepted at the hook level, so
+    // the LLM must still pre-check those itself via cybe_guards_check.
+    const HARD_ENFORCEMENT_CLIENTS = new Set(['claude-code', 'codex', 'cursor']);
+    lines.push('');
+    if (HARD_ENFORCEMENT_CLIENTS.has(event.client)) {
+        lines.push('- **Action Guards** are enforced silently by a PreToolUse hook on this', '  client. The hook intercepts your tool calls before they execute and', '  blocks any that match a deny rule. You do NOT need to call any guard', '  tool preemptively — just make your tool call. If the hook blocks it,', '  you will see a stderr message; do not retry the same action.');
+    }
+    else {
+        // Windsurf and other partial-coverage clients
+        lines.push('- **Action Guards** — your runtime hook only covers file writes. For', '  Read / Bash / WebFetch / network actions, you MUST call', '  `cybe_guards_check(projectId, agent, tool, target)` BEFORE the action', '  and respect a deny verdict.');
+    }
+    emitFn(lines.join('\n') + '\n', event.client);
+}
+//# sourceMappingURL=session-start.js.map

package/dist/hooks/runtime/session-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start.js","sourceRoot":"","sources":["../../../src/hooks/runtime/session-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW/D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAE1C,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,MAAM,CACJ,oDAAoD,KAAK,CAAC,MAAM,iBAAiB,SAAS,IAAI,EAC9F,KAAK,CAAC,MAAM,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,iCAAiC;QACjC,gBAAgB,SAAS,eAAe,KAAK,CAAC,MAAM,GAAG;KACxD,CAAC;IACF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,0BAA0B,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,mFAAmF,CACpF,CAAC;IAEF,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,KAAK,CAAC,IAAI,CACR,8EAA8E,EAC9E,gFAAgF,EAChF,mEAAmE,CACpE,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,sFAAsF,CACvF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,mCAAmC,KAAK,+BAA+B,EACvE,2EAA2E,EAC3E,gFAAgF,EAChF,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CACR,wEAAwE,EACxE,uEAAuE,EACvE,wEAAwE,EACxE,wEAAwE,EACxE,gEAAgE,CACjE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,sEAAsE,EACtE,2DAA2D,EAC3D,yEAAyE,EACzE,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC"}

package/dist/hooks/runtime/sniff.js

@@ -0,0 +1,112 @@
+/** Extract a file path from a unified-diff patch (Codex `apply_patch`). */
+function filePathFromPatch(patch) {
+    const lines = patch.split('\n');
+    for (const line of lines) {
+        const updateMatch = /^\*\*\* (?:Update|Add|Create) File: (.+)$/.exec(line);
+        if (updateMatch)
+            return updateMatch[1];
+        const pmMatch = /^\+\+\+ b\/(.+)$/.exec(line);
+        if (pmMatch)
+            return pmMatch[1];
+    }
+    return '';
+}
+/** Concatenate `new_string` from a MultiEdit `edits` array. */
+function joinMultiEditNewStrings(edits) {
+    if (!Array.isArray(edits))
+        return '';
+    return edits
+        .map((e) => (typeof e.new_string === 'string' ? e.new_string : ''))
+        .filter((s) => s.length > 0)
+        .join('\n---\n');
+}
+/** Concatenate Windsurf-shaped edits. */
+function joinWindsurfEdits(edits) {
+    return joinMultiEditNewStrings(edits);
+}
+/**
+ * Pure function: maps an unparsed stdin object to a NormalizedEvent.
+ *
+ * Returns a NormalizedEvent with `client: 'unknown'` if no schema matches,
+ * so the caller can early-exit without crashing.
+ */
+export function sniff(input) {
+    // ── Windsurf ─────────────────────────────────────────────────────────
+    if (typeof input.agent_action_name === 'string') {
+        const action = input.agent_action_name;
+        const toolInfo = input.tool_info ?? {};
+        const filePath = typeof toolInfo.file_path === 'string' ? toolInfo.file_path : '';
+        const newContent = joinWindsurfEdits(toolInfo.edits);
+        let toolName = action;
+        if (action === 'pre_write_code' || action === 'post_write_code') {
+            toolName = 'Write';
+        }
+        else if (action === 'pre_read_code' || action === 'post_read_code') {
+            toolName = 'Read';
+        }
+        return { client: 'windsurf', toolName, filePath, newContent, raw: input };
+    }
+    // ── VS Code Copilot ──────────────────────────────────────────────────
+    // VS Code uses camelCase field name `hookEventName` (distinct from
+    // Claude Code/Cursor/Codex's snake_case `hook_event_name`).
+    if ('hookEventName' in input) {
+        return extractToolInputShape(input, 'vscode');
+    }
+    // ── Cursor / Codex / Claude Code (shared shape) ──────────────────────
+    if ('hook_event_name' in input) {
+        const evt = typeof input.hook_event_name === 'string' ? input.hook_event_name : '';
+        let client;
+        if (/^[a-z]/.test(evt)) {
+            // Cursor uses camelCase event values (`preToolUse`).
+            client = 'cursor';
+        }
+        else {
+            // Codex emits `apply_patch` as a tool name (with patch payload);
+            // Claude Code uses Edit/Write/MultiEdit. Disambiguate via tool_name.
+            const toolName = typeof input.tool_name === 'string' ? input.tool_name : '';
+            client = toolName === 'apply_patch' ? 'codex' : 'claude-code';
+        }
+        return extractToolInputShape(input, client);
+    }
+    // ── Nothing matched ──────────────────────────────────────────────────
+    return {
+        client: 'unknown',
+        toolName: '',
+        filePath: '',
+        newContent: '',
+        raw: input,
+    };
+}
+/**
+ * Shared extraction for the Claude-Code-shaped families (Cursor / Codex /
+ * Claude Code / VS Code Copilot). Pulls `tool_name` + `tool_input.*`,
+ * deriving the file path / new content depending on which tool fired.
+ */
+function extractToolInputShape(input, client) {
+    const toolName = typeof input.tool_name === 'string' ? input.tool_name : '';
+    const toolInput = input.tool_input ?? {};
+    let filePath = typeof toolInput.file_path === 'string' ? toolInput.file_path : '';
+    let newContent = '';
+    switch (toolName) {
+        case 'Write':
+            newContent =
+                typeof toolInput.content === 'string' ? toolInput.content : '';
+            break;
+        case 'Edit':
+            newContent =
+                typeof toolInput.new_string === 'string' ? toolInput.new_string : '';
+            break;
+        case 'MultiEdit':
+            newContent = joinMultiEditNewStrings(toolInput.edits);
+            break;
+        case 'apply_patch': {
+            const patch = typeof toolInput.patch === 'string' ? toolInput.patch : '';
+            newContent = patch;
+            if (!filePath)
+                filePath = filePathFromPatch(patch);
+            break;
+        }
+    }
+    return { client, toolName, filePath, newContent, raw: input };
+}
+//# sourceMappingURL=sniff.js.map

package/dist/hooks/runtime/sniff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sniff.js","sourceRoot":"","sources":["../../../src/hooks/runtime/sniff.ts"],"names":[],"mappings":"AAiBA,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+DAA+D;AAC/D,SAAS,uBAAuB,CAC9B,KAAiD;IAEjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,yCAAyC;AACzC,SAAS,iBAAiB,CACxB,KAAiD;IAEjD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,KAA8B;IAClD,wEAAwE;IACxE,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACvC,MAAM,QAAQ,GAAI,KAAK,CAAC,SAAqC,IAAI,EAAE,CAAC;QACpE,MAAM,QAAQ,GACZ,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,iBAAiB,CAClC,QAAQ,CAAC,KAAmD,CAC7D,CAAC;QACF,IAAI,QAAQ,GAAG,MAAM,CAAC;QACtB,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAChE,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;aAAM,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACrE,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,4DAA4D;IAC5D,IAAI,eAAe,IAAI,KAAK,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,MAAgB,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,qDAAqD;YACrD,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,qEAAqE;YACrE,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,GAAG,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,CAAC;QACD,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,EAAE;QACd,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAA8B,EAC9B,MAAgB;IAEhB,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAI,KAAK,CAAC,UAAsC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ,GACV,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,UAAU,GAAG,EAAE,CAAC;IAEpB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,UAAU;gBACR,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM;QACR,KAAK,MAAM;YACT,UAAU;gBACR,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM;QACR,KAAK,WAAW;YACd,UAAU,GAAG,uBAAuB,CAClC,SAAS,CAAC,KAAmD,CAC9D,CAAC;YACF,MAAM;QACR,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GACT,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC"}

package/dist/hooks/runtime/types.js

@@ -0,0 +1,22 @@
+/**
+ * Shared types for the Node-based hook runtime.
+ *
+ * The runtime replaces the previous bash hook scripts entirely. One
+ * bundled `dist/hook-runner.js` is copied to `~/.cybedefend/hook-runner.js`
+ * at install time and invoked by every AI agent via:
+ *
+ *   node ~/.cybedefend/hook-runner.js <subcommand>
+ *
+ * Subcommands: fetch-rules | session-start | session-review | pre-compact
+ *
+ * Why Node instead of bash:
+ *  - Cross-platform: Windows native (no Git Bash needed), Linux, macOS
+ *  - Zero shell deps: no jq, no curl, no awk; uses Node's built-in fetch
+ *    + JSON.parse + native HTTP
+ *  - Testable: each module is a pure function, unit-tested with vitest
+ *    instead of `bash -n` subprocess + apostrophe-in-heredoc whack-a-mole
+ *  - Robust: JSON parsing handles unicode, multi-line strings, escapes —
+ *    edges that fail silently with `jq -r` + bash variable interpolation
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/hooks/runtime/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hooks/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/hooks/runtime/user-prompt-submit.js

@@ -0,0 +1,154 @@
+/**
+ * UserPromptSubmit hook — Claude Code only.
+ *
+ * Fires before the agent processes each user prompt. We use it to force
+ * the CybeDefend workflow doctrine to surface BEFORE any skill (e.g.
+ * `superpowers:brainstorming`) hijacks the flow. Observed gap on Claude
+ * Code: the brainstorming skill auto-activates on task descriptions and
+ * takes precedence over MCP `Server.instructions` (which carries the
+ * doctrine), so the agent explores + asks clarifying questions WITHOUT
+ * ever calling `cybe_rules_list_proposals` or `cybe_rules_fetch`. Codex
+ * has no equivalent skill hijack, which is why it follows the doctrine
+ * directly — hence this hook is Claude-Code-scoped.
+ *
+ * Output is plain markdown to stdout (Claude Code's documented contract
+ * for UserPromptSubmit: stdout becomes additional context).
+ *
+ * Semantics:
+ *  - Loud on empty: even when the proposal inbox is empty (total=0),
+ *    we still emit a forceful reminder that the agent MUST explicitly
+ *    acknowledge "No pending business-rule proposals" (satisfies step 0
+ *    of the doctrine — silently skipping the step is what we observed
+ *    and want to prevent).
+ *  - If the API/token is unavailable, the doctrine still surfaces with
+ *    a "could not verify, call cybe_rules_list_proposals yourself"
+ *    fallback — never blocks the user's prompt.
+ *  - When projectId can't be resolved (no `.cybedefend/config.json`),
+ *    the hook is a silent no-op — there's no project context to anchor
+ *    the doctrine against and emitting a half-finished reminder would
+ *    confuse more than help.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { sniff } from './sniff.js';
+import { resolveProjectId, resolveToken } from './resolve.js';
+import { fetchProposalsCount } from './api.js';
+import { emit } from './emit.js';
+import { loadRuntimeConfig, readStdinJson } from './config.js';
+/** Cap on persisted entries — drops oldest when exceeded. */
+const SESSIONS_CAP = 100;
+/** Default filename for the disk-backed tracker. */
+function defaultSessionsFile() {
+    const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join(homedir(), '.cybedefend');
+    return join(dir, 'user-prompt-seen-sessions.json');
+}
+/**
+ * Disk-backed SessionTracker. Best-effort — any FS error degrades to
+ * "haven't seen this session" which results in re-emitting the doctrine
+ * (loud is strictly better than silently swallowing it).
+ */
+function defaultSessionTracker(file = defaultSessionsFile()) {
+    function load() {
+        if (!existsSync(file))
+            return [];
+        try {
+            const raw = readFileSync(file, 'utf8');
+            const data = JSON.parse(raw);
+            if (!Array.isArray(data.sessions))
+                return [];
+            return data.sessions.filter((s) => typeof s === 'string');
+        }
+        catch {
+            return []; // corrupt file → start over
+        }
+    }
+    return {
+        hasSeen(sessionId) {
+            return load().includes(sessionId);
+        },
+        async markSeen(sessionId) {
+            const existing = load();
+            if (existing.includes(sessionId))
+                return;
+            const next = [...existing, sessionId].slice(-SESSIONS_CAP);
+            try {
+                mkdirSync(join(file, '..'), { recursive: true });
+                writeFileSync(file, JSON.stringify({ sessions: next }), 'utf8');
+            }
+            catch {
+                /* swallow — non-fatal */
+            }
+        },
+    };
+}
+export async function userPromptSubmitHook(deps = {}) {
+    const readStdin = deps.readStdin ?? readStdinJson;
+    const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
+    const resolveProject = deps.resolveProject ?? resolveProjectId;
+    const resolveTok = deps.resolveTokenFn ?? resolveToken;
+    const fetchProposals = deps.fetchProposalsFn ?? fetchProposalsCount;
+    const emitFn = deps.emitFn ?? emit;
+    const sessionTracker = deps.sessionTracker ?? defaultSessionTracker();
+    const stdin = await readStdin();
+    const event = sniff(stdin);
+    // Per-session dedupe. If we have a session_id and we've already fired
+    // the doctrine for it, exit silently. If session_id is missing (older
+    // Claude Code build, malformed payload, etc.) we fall through and
+    // emit — loud is strictly better than silently dropping the doctrine.
+    const sessionId = typeof stdin.session_id === 'string' && stdin.session_id.length > 0
+        ? stdin.session_id
+        : null;
+    if (sessionId !== null && sessionTracker.hasSeen(sessionId)) {
+        return;
+    }
+    const config = loadConfig();
+    if (!config)
+        return;
+    const { projectId, apiBase: configApiBase } = resolveProject();
+    if (!projectId)
+        return; // silent no-op — see file header
+    const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
+    // Best-effort: token may not be available (Claude Code without an MCP
+    // OAuth dance against cybedefend-local, or transient Keychain failure).
+    // We still emit the doctrine — the agent calling
+    // `cybe_rules_list_proposals` itself satisfies step 0.
+    const token = resolveTok(config.region.mcpName);
+    let total = null;
+    if (token) {
+        const result = await fetchProposals({ apiBase, projectId, token });
+        if (result)
+            total = result.total;
+    }
+    const lines = [
+        '## ⚠️ CybeDefend doctrine — execute BEFORE answering this prompt',
+        '',
+        `**Project**: \`${projectId}\``,
+        '',
+        '### Step 0 — Proposal inbox',
+    ];
+    if (total === null) {
+        lines.push('- CybeDefend: could not fetch proposal-inbox status (token / API unreachable).', '- Call `cybe_rules_list_proposals(projectId, status="proposed")` yourself to verify, then handle each surfaced proposal via AskUserQuestion (Accept / Reject / Skip / Tell me more) before continuing.');
+    }
+    else if (total > 0) {
+        lines.push(`- CybeDefend: **${total}** pending proposals.`, '- Call `cybe_rules_list_proposals(projectId, status="proposed")` and surface each via AskUserQuestion (Accept / Reject / Skip / Tell me more) BEFORE responding to this prompt.');
+    }
+    else {
+        lines.push('- CybeDefend: **0** pending proposals.', '- You MUST still acknowledge step 0 in your reply ("No pending business-rule proposals."). Silently skipping this step is a doctrine violation observed in earlier sessions.');
+    }
+    lines.push('', '### Step 1 — Rules fetch (before any code edit)', '- Even if you plan to brainstorm / explore / ask clarifying questions first, call BOTH:', '  - `cybe_rules_fetch(projectId, files=[...], intent="<1-2 sentence narrative>")` for business rules', '  - `cybe_secrules_fetch(projectId, files=[...], intent="...", languages=[...])` for security rules', '- Use a rich `intent` — the retrieval is 60% graph + 40% vector, so a generic placeholder like "Editing file" returns nothing useful.', '- The PreToolUse hook fires automatically as a backstop on Edit/Write/MultiEdit, but your explicit call with a narrative intent gets better matches.', '', '### Order', '1. Satisfy step 0 (acknowledge / handle the inbox).', '2. Satisfy step 1 (fetch rules with a narrative intent) once you know which files you will touch.', '3. THEN proceed with whatever skill / brainstorm / implementation flow fits the task.', '');
+    emitFn(lines.join('\n'), event.client);
+    // Mark the session so subsequent prompts in the same conversation
+    // don't re-emit the doctrine. Best-effort — a write failure (FS
+    // permissions, disk full) just means the next prompt will re-emit,
+    // which is annoying but not broken.
+    if (sessionId !== null) {
+        try {
+            await sessionTracker.markSeen(sessionId);
+        }
+        catch {
+            /* swallow — non-fatal */
+        }
+    }
+}
+//# sourceMappingURL=user-prompt-submit.js.map

package/dist/hooks/runtime/user-prompt-submit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-prompt-submit.js","sourceRoot":"","sources":["../../../src/hooks/runtime/user-prompt-submit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAY/D,6DAA6D;AAC7D,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,oDAAoD;AACpD,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,OAAe,mBAAmB,EAAE;IACjE,SAAS,IAAI;QACX,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,4BAA4B;QACzC,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,CAAC,SAAiB;YACvB,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAiB;YAC9B,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO;YACzC,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,sEAAsE;IACtE,sEAAsE;IACtE,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,SAAS,KAAK,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,iCAAiC;IAEzD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAE5E,sEAAsE;IACtE,wEAAwE;IACxE,iDAAiD;IACjD,uDAAuD;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,kEAAkE;QAClE,EAAE;QACF,kBAAkB,SAAS,IAAI;QAC/B,EAAE;QACF,6BAA6B;KAC9B,CAAC;IACF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,wMAAwM,CACzM,CAAC;IACJ,CAAC;SAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,mBAAmB,KAAK,uBAAuB,EAC/C,iLAAiL,CAClL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,wCAAwC,EACxC,8KAA8K,CAC/K,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,iDAAiD,EACjD,yFAAyF,EACzF,sGAAsG,EACtG,qGAAqG,EACrG,uIAAuI,EACvI,sJAAsJ,EACtJ,EAAE,EACF,WAAW,EACX,qDAAqD,EACrD,mGAAmG,EACnG,uFAAuF,EACvF,EAAE,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEvC,kEAAkE;IAClE,gEAAgE;IAChE,mEAAmE;IACnE,oCAAoC;IACpC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;AACH,CAAC"}