@deksden-com/dd-flow-cli 0.8.0 → 0.9.0-beta.0

package/dist/services/hooks.js

@@ -7,6 +7,7 @@ import { AppError } from "../shared/errors.js";
 import { parseJsonObject } from "../shared/json.js";
 import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
 import { appendAudit } from "./audit.js";
+import { commandHasOption, commandOption, commandPosition, parseLifecycleCommand, unwrapShellCommand } from "./lifecycle-command.js";
 import { registerProject, requireProjectByRoot } from "./projects.js";
 import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
 const defaultProfileName = "default";
@@ -272,47 +273,27 @@ export function handleCodexHook(context, input) {
     const command = lifecycleCommandFromPayload(payload);
     if (!command)
         return { ok: true, observed: false, reason: "non_bash_tool" };
-    const stageResume = /\bdd-flow\s+stage\s+resume\b/.test(command);
-    const stagePauseHeredoc = containsUnquotedHeredoc(command) && /\bdd-flow\s+stage\s+pause\b/.test(command);
-    const lifecycleShell = analyzeLifecycleShellCommand(command);
+    const lifecycle = lifecycleFacts(command);
+    if (!lifecycle)
+        return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
     // Resume legitimately receives an answer through stdin. It is matched by
     // immutable lifecycle arguments below; never reject or rewrite that pipe.
-    if (lifecycleShell.kind === "compound" && !stageResume && !stagePauseHeredoc) {
+    if (lifecycle.analysis.kind === "compound" && !lifecycle.stageResume) {
         return {
             ok: false,
             observed: false,
             reason: "compound_lifecycle_command",
             message: "Run the dd-flow lifecycle invocation as the first technical action and as one standalone Bash command in this same Session.",
-            standalone_command: lifecycleShell.standaloneCommand,
+            standalone_command: lifecycle.invocation.command,
             hookSpecificOutput: {
                 hookEventName: "PreToolUse",
                 permissionDecision: "deny",
-                permissionDecisionReason: `dd-flow lifecycle commands must be standalone. Retry in this same Session: ${lifecycleShell.standaloneCommand}`
+                permissionDecisionReason: `dd-flow lifecycle commands must be standalone. Retry in this same Session: ${lifecycle.invocation.command}`
             }
         };
     }
-    const flowPayload = flowSessionPayloadFromRegisterCommand(command);
-    const stageStart = /\bdd-flow\s+stage\s+start\b/.test(command);
-    const workStart = /\bdd-flow\s+work\s+start\b/.test(command);
-    const bootstrapStageStart = stageStart && /(?:^|\s)--bootstrap(?:\s|$)/.test(command);
-    if (!flowPayload && !stageStart && !stageResume && !workStart)
-        return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
-    const commandProjectRoot = optionFromCommand(command, "project-root");
-    const stageName = stageStart ? optionFromCommand(command, "stage") : undefined;
-    const resumeStageName = stageResume ? optionFromCommand(command, "stage") : undefined;
-    const stageRunId = stageStart && !bootstrapStageStart ? positionalFromCommand(command, "dd-flow stage start") : undefined;
-    const resumeRunId = stageResume ? positionalFromCommand(command, "dd-flow stage resume") : undefined;
-    const resumeWorkId = stageResume ? optionFromCommand(command, "work") : undefined;
-    const workId = workStart ? positionalFromCommand(command, "dd-flow work start") : undefined;
-    const contextSha256 = optionFromCommand(command, "context-sha256") ?? undefined;
-    const matchKey = bootstrapStageStart && commandProjectRoot ? bootstrapMatchKey({
-        projectRoot: commandProjectRoot,
-        subject: optionFromCommand(command, "subject") ?? optionFromCommand(command, "slug") ?? "specify",
-        intakeMode: contextSha256 ? "context" : /(?:^|\s)--intake-stdin(?:\s|$)/.test(command) ? "stdin" : "file",
-        ...(contextSha256 ? { contextSha256 } : {})
-    }) : stageStart && stageRunId && stageName && commandProjectRoot ? stageStartMatchKey(stageRunId, stageName, commandProjectRoot, contextSha256)
-        : stageResume && resumeRunId && resumeStageName && resumeWorkId && commandProjectRoot ? stageResumeMatchKey(resumeRunId, resumeStageName, resumeWorkId, commandProjectRoot)
-            : workStart && workId && commandProjectRoot ? workStartMatchKey(workId, commandProjectRoot) : null;
+    const { flowPayload, stageStart, stageResume, workStart, bootstrapStageStart, commandProjectRoot } = lifecycle;
+    const matchKey = commandProjectRoot ? lifecycleMatchKey(lifecycle, commandProjectRoot) : null;
     // A bootstrap stage is the first stateful command for a new materialized project.
     // Its PreToolUse event arrives before stage start can register that project.
     if (bootstrapStageStart && commandProjectRoot) {
@@ -393,22 +374,15 @@ export function handleZcodeEvent(context, input) {
     if (!command || (toolName && toolName !== "Bash" && toolName !== "bash" && update.kind !== "execute")) {
         return { ok: true, observed: false, reason: "non_bash_tool" };
     }
-    const stageResume = /\bdd-flow\s+stage\s+resume\b/.test(command);
-    const stagePauseHeredoc = containsUnquotedHeredoc(command) && /\bdd-flow\s+stage\s+pause\b/.test(command);
-    const lifecycleShell = analyzeLifecycleShellCommand(command, true);
-    if (lifecycleShell.kind === "compound" && !stageResume && !stagePauseHeredoc) {
+    const lifecycle = lifecycleFacts(command);
+    if (!lifecycle)
+        return { ok: true, observed: false, reason: "event_not_participating" };
+    if (lifecycle.analysis.kind === "compound" && !lifecycle.stageResume) {
         throw new AppError("compound_lifecycle_command", "dd-flow lifecycle commands must be a standalone ZCode Bash tool call", 1, {
-            standalone_command: lifecycleShell.standaloneCommand
+            standalone_command: lifecycle.invocation.command
         });
     }
-    const flowPayload = flowSessionPayloadFromRegisterCommand(command);
-    const stageStart = /\bdd-flow\s+stage\s+start\b/.test(command);
-    const workStart = /\bdd-flow\s+work\s+start\b/.test(command);
-    const bootstrapStageStart = stageStart && /(?:^|\s)--bootstrap(?:\s|$)/.test(command);
-    if (!flowPayload && !stageStart && !stageResume && !workStart) {
-        return { ok: true, observed: false, reason: "event_not_participating" };
-    }
-    const commandProjectRoot = optionFromCommand(command, "project-root");
+    const { flowPayload, bootstrapStageStart, commandProjectRoot } = lifecycle;
     const expectedRoot = resolveProjectRoot(input.projectRoot);
     if (commandProjectRoot && resolveProjectRoot(commandProjectRoot) !== expectedRoot) {
         throw new AppError("project_mismatch", "ZCode lifecycle command project root does not match the controlled workspace", 1, {
@@ -416,21 +390,7 @@ export function handleZcodeEvent(context, input) {
             actual: commandProjectRoot
         });
     }
-    const stageName = stageStart ? optionFromCommand(command, "stage") : undefined;
-    const resumeStageName = stageResume ? optionFromCommand(command, "stage") : undefined;
-    const stageRunId = stageStart && !bootstrapStageStart ? positionalFromCommand(command, "dd-flow stage start") : undefined;
-    const resumeRunId = stageResume ? positionalFromCommand(command, "dd-flow stage resume") : undefined;
-    const resumeWorkId = stageResume ? optionFromCommand(command, "work") : undefined;
-    const workId = workStart ? positionalFromCommand(command, "dd-flow work start") : undefined;
-    const contextSha256 = optionFromCommand(command, "context-sha256") ?? undefined;
-    const matchKey = bootstrapStageStart ? bootstrapMatchKey({
-        projectRoot: expectedRoot,
-        subject: optionFromCommand(command, "subject") ?? optionFromCommand(command, "slug") ?? "specify",
-        intakeMode: contextSha256 ? "context" : /(?:^|\s)--intake-stdin(?:\s|$)/.test(command) ? "stdin" : "file",
-        ...(contextSha256 ? { contextSha256 } : {})
-    }) : stageStart && stageRunId && stageName ? stageStartMatchKey(stageRunId, stageName, expectedRoot, contextSha256)
-        : stageResume && resumeRunId && resumeStageName && resumeWorkId ? stageResumeMatchKey(resumeRunId, resumeStageName, resumeWorkId, expectedRoot)
-            : workStart && workId ? workStartMatchKey(workId, expectedRoot) : null;
+    const matchKey = lifecycleMatchKey(lifecycle, expectedRoot);
     if (bootstrapStageStart)
         registerProject(context, { root: expectedRoot });
     const project = requireProjectByRoot(context, expectedRoot);
@@ -522,42 +482,22 @@ export function handleGrokEvent(context, input) {
     if (!command || (toolName && !["Bash", "bash", "run_terminal_command", "RunTerminalCommand"].includes(toolName))) {
         return { ok: true, observed: false, reason: "non_bash_tool" };
     }
-    const stageResume = /\bdd-flow\s+stage\s+resume\b/.test(command);
-    const stagePauseHeredoc = containsUnquotedHeredoc(command) && /\bdd-flow\s+stage\s+pause\b/.test(command);
-    const lifecycleShell = analyzeLifecycleShellCommand(command, true);
-    if (lifecycleShell.kind === "compound" && !stageResume && !stagePauseHeredoc) {
+    const lifecycle = lifecycleFacts(command);
+    if (!lifecycle)
+        return { ok: true, observed: false, reason: "event_not_participating" };
+    if (lifecycle.analysis.kind === "compound" && !lifecycle.stageResume) {
         throw new AppError("compound_lifecycle_command", "dd-flow lifecycle commands must be a standalone Grok Build tool call", 1, {
-            standalone_command: lifecycleShell.standaloneCommand
+            standalone_command: lifecycle.invocation.command
         });
     }
-    const flowPayload = flowSessionPayloadFromRegisterCommand(command);
-    const stageStart = /\bdd-flow\s+stage\s+start\b/.test(command);
-    const workStart = /\bdd-flow\s+work\s+start\b/.test(command);
-    const bootstrapStageStart = stageStart && /(?:^|\s)--bootstrap(?:\s|$)/.test(command);
-    if (!flowPayload && !stageStart && !stageResume && !workStart)
-        return { ok: true, observed: false, reason: "event_not_participating" };
-    const commandProjectRoot = optionFromCommand(command, "project-root");
+    const { flowPayload, stageStart, stageResume, workStart, bootstrapStageStart, commandProjectRoot } = lifecycle;
     const expectedRoot = resolveProjectRoot(input.projectRoot);
     if (commandProjectRoot && resolveProjectRoot(commandProjectRoot) !== expectedRoot) {
         throw new AppError("project_mismatch", "Grok Build lifecycle command project root does not match the controlled workspace", 1, {
             expected: expectedRoot, actual: commandProjectRoot
         });
     }
-    const stageName = stageStart ? optionFromCommand(command, "stage") : undefined;
-    const resumeStageName = stageResume ? optionFromCommand(command, "stage") : undefined;
-    const stageRunId = stageStart && !bootstrapStageStart ? positionalFromCommand(command, "dd-flow stage start") : undefined;
-    const resumeRunId = stageResume ? positionalFromCommand(command, "dd-flow stage resume") : undefined;
-    const resumeWorkId = stageResume ? optionFromCommand(command, "work") : undefined;
-    const workId = workStart ? positionalFromCommand(command, "dd-flow work start") : undefined;
-    const contextSha256 = optionFromCommand(command, "context-sha256") ?? undefined;
-    const matchKey = bootstrapStageStart ? bootstrapMatchKey({
-        projectRoot: expectedRoot,
-        subject: optionFromCommand(command, "subject") ?? optionFromCommand(command, "slug") ?? "specify",
-        intakeMode: contextSha256 ? "context" : /(?:^|\s)--intake-stdin(?:\s|$)/.test(command) ? "stdin" : "file",
-        ...(contextSha256 ? { contextSha256 } : {})
-    }) : stageStart && stageRunId && stageName ? stageStartMatchKey(stageRunId, stageName, expectedRoot, contextSha256)
-        : stageResume && resumeRunId && resumeStageName && resumeWorkId ? stageResumeMatchKey(resumeRunId, resumeStageName, resumeWorkId, expectedRoot)
-            : workStart && workId ? workStartMatchKey(workId, expectedRoot) : null;
+    const matchKey = lifecycleMatchKey(lifecycle, expectedRoot);
     if (bootstrapStageStart)
         registerProject(context, { root: expectedRoot });
     const project = requireProjectByRoot(context, expectedRoot);
@@ -642,38 +582,17 @@ export function handleOpenCodeEvent(context, input) {
     if (!command || !["bash", "Bash", "run_command", "run_terminal_command", "RunTerminalCommand"].includes(toolName)) {
         return { ok: true, observed: false, reason: command ? "non_bash_tool" : "event_not_participating" };
     }
-    const stageResume = /\bdd-flow\s+stage\s+resume\b/.test(command);
-    const lifecycleShell = analyzeLifecycleShellCommand(command, true);
-    const agyBootstrapHeredoc = agy && containsUnquotedHeredoc(command) && /\bdd-flow\s+stage\s+start\b/.test(command) && /(?:^|\s)--bootstrap(?:\s|$)/.test(command);
-    const stagePauseHeredoc = containsUnquotedHeredoc(command) && /\bdd-flow\s+stage\s+pause\b/.test(command);
-    if (lifecycleShell.kind === "compound" && !stageResume && !agyBootstrapHeredoc && !stagePauseHeredoc) {
-        throw new AppError("compound_lifecycle_command", `dd-flow lifecycle commands must be a standalone ${agy ? "Antigravity" : "OpenCode"} shell tool call`, 1, { standalone_command: lifecycleShell.standaloneCommand });
-    }
-    const flowPayload = flowSessionPayloadFromRegisterCommand(command);
-    const stageStart = /\bdd-flow\s+stage\s+start\b/.test(command);
-    const workStart = /\bdd-flow\s+work\s+start\b/.test(command);
-    const bootstrapStageStart = stageStart && /(?:^|\s)--bootstrap(?:\s|$)/.test(command);
-    if (!flowPayload && !stageStart && !stageResume && !workStart)
+    const lifecycle = lifecycleFacts(command);
+    if (!lifecycle)
         return { ok: true, observed: false, reason: "event_not_participating" };
-    const commandProjectRoot = optionFromCommand(command, "project-root");
+    if (lifecycle.analysis.kind === "compound" && !lifecycle.stageResume) {
+        throw new AppError("compound_lifecycle_command", `dd-flow lifecycle commands must be a standalone ${agy ? "Antigravity" : "OpenCode"} shell tool call`, 1, { standalone_command: lifecycle.invocation.command });
+    }
+    const { flowPayload, bootstrapStageStart, commandProjectRoot } = lifecycle;
     if (commandProjectRoot && resolveProjectRoot(commandProjectRoot) !== expectedRoot) {
         throw new AppError("project_mismatch", "OpenCode lifecycle command project root does not match the controlled workspace", 1, { expected: expectedRoot, actual: commandProjectRoot });
     }
-    const stageName = stageStart ? optionFromCommand(command, "stage") : undefined;
-    const resumeStageName = stageResume ? optionFromCommand(command, "stage") : undefined;
-    const stageRunId = stageStart && !bootstrapStageStart ? positionalFromCommand(command, "dd-flow stage start") : undefined;
-    const resumeRunId = stageResume ? positionalFromCommand(command, "dd-flow stage resume") : undefined;
-    const resumeWorkId = stageResume ? optionFromCommand(command, "work") : undefined;
-    const workId = workStart ? positionalFromCommand(command, "dd-flow work start") : undefined;
-    const contextSha256 = optionFromCommand(command, "context-sha256") ?? undefined;
-    const matchKey = bootstrapStageStart ? bootstrapMatchKey({
-        projectRoot: expectedRoot,
-        subject: optionFromCommand(command, "subject") ?? optionFromCommand(command, "slug") ?? "specify",
-        intakeMode: contextSha256 ? "context" : /(?:^|\s)--intake-stdin(?:\s|$)/.test(command) ? "stdin" : "file",
-        ...(contextSha256 ? { contextSha256 } : {})
-    }) : stageStart && stageRunId && stageName ? stageStartMatchKey(stageRunId, stageName, expectedRoot, contextSha256)
-        : stageResume && resumeRunId && resumeStageName && resumeWorkId ? stageResumeMatchKey(resumeRunId, resumeStageName, resumeWorkId, expectedRoot)
-            : workStart && workId ? workStartMatchKey(workId, expectedRoot) : null;
+    const matchKey = lifecycleMatchKey(lifecycle, expectedRoot);
     if (bootstrapStageStart)
         registerProject(context, { root: expectedRoot });
     const project = requireProjectByRoot(context, expectedRoot);
@@ -721,22 +640,17 @@ export function handleAgyEvent(context, input) {
     };
     return handleOpenCodeEvent(context, { projectRoot: input.projectRoot, stdin: JSON.stringify(translated) });
 }
-/**
- * A Desktop hook inherits the app environment, not an inline `VAR=value`
- * assignment made by the pending Bash tool call. Find the explicit
- * DD_FLOW_HOME assignment for the dd-flow invocation, including a safe stdin
- * pipeline such as `cat <<EOF | CODEX_HOME=... DD_FLOW_HOME=... dd-flow`.
- * Other shell syntax is deliberately not evaluated here.
- */
+/** A Desktop hook must open the same isolated state as the actual lifecycle invocation. */
 export function isolatedDdFlowHomeFromHookStdin(stdin) {
     try {
         const payload = parseJsonObject(stdin || "{}", "codex hook stdin");
         const command = lifecycleCommandFromPayload(payload);
-        const direct = command?.match(/(?:^|[|;\r\n]\s*)(?:env\s+)?(?:(?!DD_FLOW_HOME=)[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|[^\s|;]+)\s+)*DD_FLOW_HOME=(['"]?)([^\s'";|]+)\1\s+dd-flow\b/);
-        // An exported home applies to the following pipeline command; this is the
-        // other form emitted by generated commands that send stdin through a pipe.
-        const exported = command?.match(/(?:^|[;\r\n]\s*)export\s+DD_FLOW_HOME=(['"]?)([^\s'";|]+)\1(?=\s*(?:[;\r\n]|$))/);
-        const home = direct?.[2] ?? exported?.[2];
+        if (!command)
+            return null;
+        const analysis = parseLifecycleCommand(command);
+        if (analysis.kind === "none")
+            return null;
+        const home = analysis.invocation.env.DD_FLOW_HOME;
         return home && path.isAbsolute(home) ? path.resolve(home) : null;
     }
     catch {
@@ -750,51 +664,13 @@ export function isolatedDdFlowHomeFromHookStdin(stdin) {
  */
 function lifecycleCommandFromPayload(payload) {
     const command = commandFromPayload(payload);
-    if (!command)
-        return undefined;
-    const wrapped = command.trim().match(/^(?:\S*\/)?bash\s+-c\s+"((?:\\.|[^"\\])*)"\s*$/);
-    return wrapped ? wrapped[1].replace(/\\([\\"])/g, "$1") : command;
+    return command ? unwrapShellCommand(command) : undefined;
 }
 function commandWithHookEvent(command, eventKey) {
-    if (/(?:^|\s)--hook-event-id(?:=|\s)/.test(command))
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind !== "standalone" || !analysis.invocation.rewriteSafe || commandHasOption(analysis.invocation, "hook-event-id"))
         return command;
-    // Heredoc payloads are opaque bytes from the user. Appending a flag to the
-    // whole Bash command changes those bytes and corrupts `stage resume` input.
-    if (containsUnquotedHeredoc(command))
-        return command;
-    if (/^\s*dd-flow\s+session\s+register\b/.test(command) && !/[;|&\n\r]|\$\(/.test(command))
-        return `${command.trim()} --hook-event-id ${JSON.stringify(eventKey)}`;
-    const lifecycle = analyzeLifecycleShellCommand(command, true);
-    if (lifecycle.kind !== "standalone")
-        return command;
-    return `${lifecycle.standaloneCommand} --hook-event-id ${JSON.stringify(eventKey)}`;
-}
-function containsUnquotedHeredoc(command) {
-    let quote = null;
-    let escaped = false;
-    for (let index = 0; index < command.length - 1; index += 1) {
-        const char = command[index];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (char === "\\" && quote !== "'") {
-            escaped = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        if (char === "<" && command[index + 1] === "<")
-            return true;
-    }
-    return false;
+    return `${command.trim()} --hook-event-id ${JSON.stringify(eventKey)}`;
 }
 /**
  * Recognise the small shell surface used by generated dd-flow lifecycle
@@ -802,57 +678,52 @@ function containsUnquotedHeredoc(command) {
  * is rejected so a hook event can never bind the wrong command.
  */
 export function analyzeLifecycleShellCommand(command, includeSessionRegister = false) {
-    const segments = [];
-    let start = 0;
-    let quote = null;
-    let escaped = false;
-    let compound = false;
-    for (let index = 0; index < command.length; index += 1) {
-        const char = command[index];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (char === "\\" && quote !== "'") {
-            escaped = true;
-            continue;
-        }
-        if (quote) {
-            if (char === quote)
-                quote = null;
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        const pair = command.slice(index, index + 2);
-        if (pair === "$(" || pair === "&&" || pair === "||") {
-            compound = true;
-            segments.push(command.slice(start, index).trim());
-            index += 1;
-            start = index + 1;
-            continue;
-        }
-        if (char === ";" || char === "|" || char === "&" || char === "\n" || char === "\r" || char === "(") {
-            compound = true;
-            segments.push(command.slice(start, index).trim());
-            start = index + 1;
-        }
-    }
-    segments.push(command.slice(start).trim());
-    // `stage resume` intentionally accepts the user's complete answer on stdin.
-    // We recognise it for observability but never rewrite a compound invocation.
-    const lifecyclePattern = includeSessionRegister
-        ? /\bdd-flow\s+(?:session\s+register|stage\s+(?:start|resume)|work\s+start)\b/
-        : /\bdd-flow\s+(?:stage\s+(?:start|resume)|work\s+start)\b/;
-    const lifecycle = segments.filter((segment) => lifecyclePattern.test(segment));
-    if (!lifecycle.length)
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind === "none" || (!includeSessionRegister && analysis.invocation.operation === "session_register"))
         return { kind: "none" };
-    const standaloneCommand = lifecycle[0];
-    return compound || lifecycle.length !== 1
-        ? { kind: "compound", standaloneCommand }
-        : { kind: "standalone", standaloneCommand };
+    return analysis.kind === "compound"
+        ? { kind: "compound", standaloneCommand: analysis.invocation.command }
+        : { kind: "standalone", standaloneCommand: command.trim() };
+}
+function lifecycleFacts(command) {
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind === "none")
+        return null;
+    const invocation = analysis.invocation;
+    const stageStart = invocation.operation === "stage_start";
+    const stageResume = invocation.operation === "stage_resume";
+    const workStart = invocation.operation === "work_start";
+    return {
+        analysis,
+        invocation,
+        flowPayload: flowSessionPayloadFromRegisterCommand(invocation),
+        stageStart,
+        stageResume,
+        workStart,
+        bootstrapStageStart: stageStart && commandHasOption(invocation, "bootstrap"),
+        commandProjectRoot: commandOption(invocation, "project-root"),
+        stageName: stageStart || stageResume ? commandOption(invocation, "stage") : undefined,
+        runId: stageStart || stageResume ? commandPosition(invocation, 0) : undefined,
+        workId: stageResume ? commandOption(invocation, "work") : workStart ? commandPosition(invocation, 0) : undefined,
+        contextSha256: commandOption(invocation, "context-sha256")
+    };
+}
+function lifecycleMatchKey(facts, projectRoot) {
+    const { invocation, bootstrapStageStart, stageStart, stageResume, workStart, stageName, runId, workId, contextSha256 } = facts;
+    if (bootstrapStageStart)
+        return bootstrapMatchKey({
+            projectRoot,
+            subject: commandOption(invocation, "subject") ?? commandOption(invocation, "slug") ?? "specify",
+            intakeMode: contextSha256 ? "context" : commandHasOption(invocation, "intake-stdin") ? "stdin" : "file",
+            ...(contextSha256 ? { contextSha256 } : {})
+        });
+    if (stageStart && runId && stageName)
+        return stageStartMatchKey(runId, stageName, projectRoot, contextSha256);
+    if (stageResume && runId && stageName && workId)
+        return stageResumeMatchKey(runId, stageName, workId, projectRoot);
+    if (workStart && workId)
+        return workStartMatchKey(workId, projectRoot);
+    return null;
 }
 /** Trusted session identity is created by PreToolUse, never supplied by an agent. */
 export function sessionIdForHookEvent(context, projectId, eventKey) {
@@ -956,7 +827,7 @@ export function assertStageStartHookEvent(context, input) {
     const expected = stageStartMatchKey(input.runId, input.stage, input.projectRoot, input.contextSha256);
     const event = context.db.get("SELECT session_id, match_key, status FROM hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
     if (!event?.session_id || event.status !== "observed" || event.match_key !== expected) {
-        throw new AppError("trusted_stage_launch_required", "stage start requires one fresh matching PreToolUse event", 1, { run_id: input.runId, stage: input.stage, event_key: input.eventKey });
+        throw new AppError("trusted_stage_launch_required", "stage start requires one fresh matching PreToolUse event", 1, { run_id: input.runId, stage: input.stage, event_key: input.eventKey, expected_match_key: expected, observed_match_key: event?.match_key ?? null, observed_status: event?.status ?? null });
     }
     return hookSessionIdentity(context, input.projectId, input.eventKey);
 }
@@ -1435,27 +1306,6 @@ function projectForHook(context, explicitRoot, cwd) {
     })
         .sort((left, right) => right.root.length - left.root.length)[0];
 }
-function optionFromCommand(command, name) {
-    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const match = command.match(new RegExp(`(?:^|\\s)--${escaped}(?:=|\\s+)("(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*'|[^\\s]+)`));
-    return match?.[1] ? shellArgument(match[1]) : undefined;
-}
-function positionalFromCommand(command, prefix) {
-    const escaped = prefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const match = command.match(new RegExp(`\\b${escaped}\\s+("(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*'|[^\\s]+)`));
-    return match?.[1] ? shellArgument(match[1]) : undefined;
-}
-function shellArgument(raw) {
-    if (raw.startsWith('"')) {
-        try {
-            return JSON.parse(raw);
-        }
-        catch {
-            return undefined;
-        }
-    }
-    return raw.startsWith("'") ? raw.slice(1, -1) : raw;
-}
 function hookEventKey(payload, eventName, toolName, command) {
     const explicit = stringValue(payload.tool_use_id) ?? stringValue(payload.event_id) ?? stringValue(payload.delivery_id) ?? stringValue(payload.id);
     if (explicit)

package/dist/services/ids.js

@@ -42,10 +42,27 @@ export function previewNextEntityId(context, input) {
 }
 /** Work ids are globally allocated because work_id is the database primary key. */
 export function nextWorkId(context, _projectId, slug) {
+    return nextWorkIds(context, _projectId, [slug])[0];
+}
+/** Allocate one collision-free operator id for each member of an atomic Work batch. */
+export function nextWorkIds(context, _projectId, slugs) {
+    if (!slugs.length)
+        return [];
     const used = new Set();
     for (const row of context.db.all("SELECT work_id AS id FROM works WHERE work_id LIKE ?", ["WRK-%"]))
         addSequence(used, row.id, "WRK");
-    return formatFullId("WRK", Math.max(0, ...used) + 1, normalizeSlug(slug));
+    const first = Math.max(0, ...used) + 1;
+    return slugs.map((slug, index) => formatFullId("WRK", first + index, normalizeSlug(slug)));
+}
+/** Merge requests are global runtime entities, just like Work. */
+export function nextMergeRequestId(context) {
+    const used = new Set();
+    for (const row of context.db.all("SELECT merge_request_id AS id FROM merge_requests WHERE merge_request_id LIKE ?", ["MRG-%"])) {
+        const match = /^MRG-(\d+)$/.exec(row.id);
+        if (match)
+            used.add(Number(match[1]));
+    }
+    return `MRG-${String(Math.max(0, ...used) + 1).padStart(3, "0")}`;
 }
 function parseEntityKind(value) {
     const normalized = value.toLowerCase();