@devrik-tools/claude-gates 0.7.2 → 0.8.0

package/plugins/gates/hooks/gates/dependency-skills/index.mjs

@@ -1,15 +1,23 @@
-import { readdirSync } from 'node:fs';
-import { join } from 'node:path';
+// dependency-skills — a dependency that is NEW to the project must be covered by a skill.
+// Only the delta counts: a rewrite of package.json that keeps every existing dependency is
+// not "adding" anything, so the gate compares what will be written (or installed from the
+// shell) against the package.json already on disk. A version bump is never a new dependency.
+
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, isAbsolute, join } from 'node:path';
+import { projectRootOf } from '../../lib/config.mjs';
 import {
   runGate,
   deny,
   toolInGroups,
   writtenPathOf,
   writtenContentOf,
+  shellCommandOf,
 } from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'dependency-skills';
 const CONFIG_KEY = 'requireSkillForNewDependency';
+const PACKAGE_FILE = 'package.json';
 
 const DEFAULT_DEPS_WITHOUT_OWN_API = [
   'clsx',
@@ -22,6 +30,15 @@ const DEFAULT_DEPS_WITHOUT_OWN_API = [
   'regenerator-runtime',
 ];
 
+const INSTALL_COMMANDS = [
+  { manager: 'npm', verbs: ['i', 'install', 'add'] },
+  { manager: 'pnpm', verbs: ['add'] },
+  { manager: 'yarn', verbs: ['add'] },
+  { manager: 'bun', verbs: ['add'] },
+];
+const REGISTRY_NAME_PATTERN = /^(?:@[\w.-]+\/)?[\w.-]+$/;
+const SEGMENT_SEPARATOR = /&&|\|\||[;|\n]/;
+
 function normalize(name) {
   return name.replace(/^@/, '').replace(/\//g, '-').toLowerCase();
 }
@@ -31,21 +48,23 @@ function isExempt(dependencyName, dependenciesWithoutOwnApi) {
   return dependenciesWithoutOwnApi.includes(dependencyName);
 }
 
+// statSync (not Dirent.isDirectory) so a skill installed as a junction/symlink counts.
 function listSkillDirectories(skillsDirectoryPath) {
   try {
-    return readdirSync(skillsDirectoryPath, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
-      .map((entry) => entry.name);
+    return readdirSync(skillsDirectoryPath).filter((name) => {
+      try {
+        return statSync(join(skillsDirectoryPath, name)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
   } catch {
-    // No skills directory in this project — nothing to cross-check against.
     return [];
   }
 }
 
-// A skill covers a dependency when its normalized name equals the dependency's, or contains
-// it as a whole `-`-segment (a `stripe-payments` skill covers `stripe`). The old check was
-// bidirectional substring, so a skill dir `rip` "matched" `stripe` (rip ⊂ st-rip-e) — a false
-// exemption that silenced the warning for an unreviewed dependency.
+// A skill covers a dependency when its normalized name equals the dependency's or contains
+// it as a whole `-` segment; bidirectional substring matching let `rip` cover `stripe`.
 function skillNameMatches(normalizedDependency, skillDirectoryName) {
   const normalizedSkill = normalize(skillDirectoryName);
   if (normalizedSkill === normalizedDependency) return true;
@@ -59,25 +78,100 @@ function hasMatchingSkill(dependencyName, skillDirectories) {
   );
 }
 
-function needsSkillReview(dependencyName, parameters, skillDirectories) {
-  if (isExempt(dependencyName, parameters.depsWithoutOwnApi)) return false;
-  return !hasMatchingSkill(dependencyName, skillDirectories);
+function dependencyNamesOf(parsed) {
+  if (!parsed || typeof parsed !== 'object') return [];
+  const names = new Set();
+  for (const field of ['dependencies', 'devDependencies']) {
+    const block = parsed[field];
+    if (!block || typeof block !== 'object' || Array.isArray(block)) continue;
+    for (const name of Object.keys(block)) names.add(name);
+  }
+  return [...names];
 }
 
-/** Parsed `package.json` dependency names, or null when it cannot be read yet. */
-function dependencyNamesIn(content) {
-  let parsed;
+function parseJsonOrNull(text) {
   try {
-    parsed = JSON.parse(content);
+    return JSON.parse(text);
   } catch {
-    // Mid-edit or partially written package.json — nothing reliable to check yet.
     return null;
   }
-  const dependencies = {
-    ...(parsed.dependencies ?? {}),
-    ...(parsed.devDependencies ?? {}),
-  };
-  return Object.keys(dependencies);
+}
+
+function readTextOrEmpty(path) {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function applyEdit(base, edit) {
+  const oldString = String(edit.old_string ?? '');
+  const newString = String(edit.new_string ?? '');
+  if (!oldString) return base || newString;
+  if (edit.replace_all) return base.split(oldString).join(newString);
+  const at = base.indexOf(oldString);
+  if (at === -1) return base;
+  return base.slice(0, at) + newString + base.slice(at + oldString.length);
+}
+
+function writtenPackageText(toolInput, diskText) {
+  if (Array.isArray(toolInput.edits)) {
+    return toolInput.edits.reduce(
+      (text, edit) => applyEdit(text, edit ?? {}),
+      diskText,
+    );
+  }
+  if (typeof toolInput.old_string === 'string')
+    return applyEdit(diskText, toolInput);
+  return writtenContentOf(toolInput);
+}
+
+function packageNameOf(token) {
+  const versionAt = token.indexOf('@', token.startsWith('@') ? 1 : 0);
+  const name = versionAt === -1 ? token : token.slice(0, versionAt);
+  return REGISTRY_NAME_PATTERN.test(name) ? name : null;
+}
+
+function installedPackagesIn(command) {
+  const names = [];
+  for (const segment of command.split(SEGMENT_SEPARATOR)) {
+    const [manager = '', verb = '', ...rest] = segment.trim().split(/\s+/);
+    const spec = INSTALL_COMMANDS.find(
+      (candidate) => candidate.manager === manager.toLowerCase(),
+    );
+    if (!spec || !spec.verbs.includes(verb)) continue;
+    for (const token of rest) {
+      if (token.startsWith('-')) continue;
+      const name = packageNameOf(token);
+      if (name) names.push(name);
+    }
+  }
+  return names;
+}
+
+function resolveAgainst(root, path) {
+  return isAbsolute(path) ? path : join(root, path);
+}
+
+/** Dependencies the call introduces, or null when the written JSON is not parseable yet. */
+function newDependenciesOf(toolName, toolInput, root) {
+  if (toolInGroups(toolName, ['shell'])) {
+    const names = installedPackagesIn(shellCommandOf(toolInput));
+    if (names.length === 0) return [];
+    const disk = dependencyNamesOf(
+      parseJsonOrNull(readTextOrEmpty(join(root, PACKAGE_FILE))),
+    );
+    return names.filter((name) => !disk.includes(name));
+  }
+  if (!toolInGroups(toolName, ['write'])) return [];
+  const filePath = writtenPathOf(toolInput);
+  if (basename(filePath) !== PACKAGE_FILE) return [];
+  const diskText = readTextOrEmpty(resolveAgainst(root, filePath));
+  const written = parseJsonOrNull(writtenPackageText(toolInput, diskText));
+  if (written === null) return null;
+  const disk = dependencyNamesOf(parseJsonOrNull(diskText));
+  return dependencyNamesOf(written).filter((name) => !disk.includes(name));
 }
 
 runGate(
@@ -87,27 +181,21 @@ runGate(
     enabledByDefault: true,
     defaultParams: {
       depsWithoutOwnApi: DEFAULT_DEPS_WITHOUT_OWN_API,
-      projectSkillsDir: '.claude/skills',
+      projectSkillsDir: join('.claude', 'skills'),
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    if (!toolInGroups(toolName, ['write'])) return;
-
-    const filePath = writtenPathOf(toolInput);
-    if (!filePath.replace(/\\/g, '/').endsWith('package.json')) return;
-
-    const content = writtenContentOf(toolInput);
-    if (!content) return;
-
-    const dependencyNames = dependencyNamesIn(content);
-    if (!dependencyNames || dependencyNames.length === 0) return;
+  ({ toolName, toolInput, parameters, cwd }) => {
+    const root = projectRootOf(cwd) ?? cwd;
+    const newDependencies = newDependenciesOf(toolName, toolInput, root);
+    if (!newDependencies || newDependencies.length === 0) return;
 
     const skillDirectories = listSkillDirectories(
-      join(process.cwd(), parameters.projectSkillsDir),
+      resolveAgainst(root, parameters.projectSkillsDir),
     );
-
-    const unmatched = dependencyNames.filter((name) =>
-      needsSkillReview(name, parameters, skillDirectories),
+    const unmatched = newDependencies.filter(
+      (name) =>
+        !isExempt(name, parameters.depsWithoutOwnApi) &&
+        !hasMatchingSkill(name, skillDirectories),
     );
     if (unmatched.length === 0) return;
 
@@ -121,10 +209,3 @@ runGate(
     );
   },
 );
-
-// Deliberately simplified vs. the source guard (guard-dependencies-skills.mjs):
-// dropped the hardcoded alias table (stripe -> stripe-payments, etc.) and the
-// .ai/skills-baseline.json freeze mechanism — that belongs to a separate
-// adopt-stack-and-skills.mjs script that does not exist in this repo. This
-// gate only does simple substring matching between dependency name and skill
-// directory name, both normalized.

package/plugins/gates/hooks/gates/diagnosis-before-patch/index.mjs

@@ -1,9 +1,17 @@
+// diagnosis-before-patch — a timeout/deadline/retry value that CHANGES gets a reminder to
+// bring the evidence first. Only a change counts: a new file, or a value that stays as it
+// is on disk, is not a symptom being patched. Advisory only, never a block.
+
+import { readFileSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { projectRootOf } from '../../lib/config.mjs';
 import {
   runGate,
   warn,
   toolInGroups,
   writtenContentOf,
   writtenPathOf,
+  compileRegexList,
 } from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'diagnosis-before-patch';
@@ -17,9 +25,57 @@ const DEFAULT_TIMEOUT_PATTERNS = [
   String.raw`\b(query_?timeout|hard_?deadline)\b`,
 ];
 
-function extractText(toolName, toolInput) {
-  if (!toolInGroups(toolName, ['write'])) return '';
-  return writtenContentOf(toolInput);
+// From a pattern hit, the key and the numeric value that follows it (value may be empty).
+const ASSIGNMENT_PATTERN = /^([\w.$-]+)\s*[:=]?\s*['"]?([\d.]*)/;
+const ASSIGNMENT_WINDOW = 200;
+
+function assignmentsIn(text, patterns) {
+  const values = new Map();
+  for (const pattern of patterns) {
+    const global = new RegExp(pattern.source, `${pattern.flags}g`);
+    for (const match of text.matchAll(global)) {
+      const slice = text.slice(match.index, match.index + ASSIGNMENT_WINDOW);
+      const assignment = ASSIGNMENT_PATTERN.exec(slice);
+      if (!assignment) continue;
+      const [, key, value] = assignment;
+      if (!values.has(key)) values.set(key, value);
+    }
+  }
+  return values;
+}
+
+function changedKeys(before, after) {
+  const changes = [];
+  for (const [key, value] of after) {
+    if (before.has(key) && before.get(key) !== value)
+      changes.push({ key, from: before.get(key), to: value });
+  }
+  return changes;
+}
+
+function readTextOrNull(path) {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+// Edit-style tools carry old/new pairs; anything else is compared with the file on disk.
+function beforeAfterPairs(toolInput, root) {
+  if (Array.isArray(toolInput.edits)) {
+    return toolInput.edits.map((edit) => [
+      String(edit?.old_string ?? ''),
+      String(edit?.new_string ?? ''),
+    ]);
+  }
+  if (typeof toolInput.old_string === 'string') {
+    return [[toolInput.old_string, writtenContentOf(toolInput)]];
+  }
+  const path = writtenPathOf(toolInput);
+  if (!path) return [];
+  const onDisk = readTextOrNull(isAbsolute(path) ? path : join(root, path));
+  return onDisk === null ? [] : [[onDisk, writtenContentOf(toolInput)]];
 }
 
 runGate(
@@ -27,32 +83,38 @@ runGate(
     id: GATE_ID,
     configKey: CONFIG_KEY,
     enabledByDefault: true,
+    severity: 'warn',
     defaultParams: {
       timeoutPatterns: DEFAULT_TIMEOUT_PATTERNS,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    const text = extractText(toolName, toolInput);
-    if (!text) return;
+  ({ toolName, toolInput, parameters, cwd }) => {
+    if (!toolInGroups(toolName, ['write'])) return;
+    const { patterns } = compileRegexList(parameters.timeoutPatterns);
+    if (patterns.length === 0) return;
 
-    const patterns = parameters.timeoutPatterns.map(
-      (source) => new RegExp(source, 'i'),
+    const root = projectRootOf(cwd) ?? cwd;
+    const changes = beforeAfterPairs(toolInput, root).flatMap(
+      ([before, after]) =>
+        changedKeys(
+          assignmentsIn(before, patterns),
+          assignmentsIn(after, patterns),
+        ),
     );
-    const matched = patterns
-      .map((pattern) => pattern.exec(text))
-      .find((match) => match !== null);
-    if (!matched) return;
+    if (changes.length === 0) return;
 
     const filePath = writtenPathOf(toolInput) || '(unknown path)';
+    const described = changes
+      .map((change) => `${change.key}: ${change.from} -> ${change.to}`)
+      .join(', ');
     warn(
       CONFIG_KEY,
-      `You are writing '${matched[0].trim()}' into ${filePath} — a timeout/deadline/retry ` +
-        'value. Before changing a value to fix a symptom ("X is slow/fails"), confirm you ' +
-        'have the evidence that proves the cause: a log line from the failing provider/' +
-        "process, not a hypothesis. If you don't have that log line yet, get it before " +
-        'writing this change — do not guess a new number. A timeout should measure ' +
-        'inactivity, not total time: a process that is still progressing should not be cut ' +
-        'off. This is a warning, not a block — the write proceeds either way.',
+      `You are changing a timeout/deadline/retry value in ${filePath} (${described}). ` +
+        'Before changing a value to fix a symptom ("X is slow/fails"), confirm you have ' +
+        'the evidence that proves the cause: a log line from the failing provider/process, ' +
+        "not a hypothesis. If you don't have that log line yet, get it before writing this " +
+        'change — do not guess a new number. A timeout should measure inactivity, not total ' +
+        'time. This is a warning, not a block — the write proceeds either way.',
     );
   },
 );

package/plugins/gates/hooks/gates/engram-first/index.mjs

@@ -0,0 +1,41 @@
+import { deny, runGate } from '../../lib/hook-io.mjs';
+import {
+  DEFAULT_PARAMS,
+  GATE_ID,
+  isResearchTool,
+  queryOf,
+  readState,
+} from './shared.mjs';
+
+const CONFIG_KEY = 'requireEngramBeforeResearch';
+
+const TOPIC_EXCERPT_LENGTH = 80;
+
+function denyResearchWithoutMemory(toolName, toolInput) {
+  const topic = queryOf(toolInput);
+  const suggestion = topic
+    ? ` (e.g. mem_search "${topic.slice(0, TOPIC_EXCERPT_LENGTH)}")`
+    : '';
+  deny(
+    CONFIG_KEY,
+    `${toolName} was called before any engram lookup in this session. Persistent memory is the ` +
+      `first source: call mem_search with the topic you are about to research${suggestion}. ` +
+      'If it returns nothing, research with context7 (libraries) or the web, then mem_save what ' +
+      'you learned before ending the turn.',
+  );
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: true,
+    defaultParams: { ...DEFAULT_PARAMS },
+  },
+  ({ toolName, toolInput, sessionId, parameters, cwd }) => {
+    if (!isResearchTool(toolName, parameters)) return;
+    const state = readState(sessionId, cwd);
+    if (state.memSearchCount > 0) return;
+    denyResearchWithoutMemory(toolName, toolInput);
+  },
+);

package/plugins/gates/hooks/gates/engram-first/session-start.mjs

@@ -0,0 +1,64 @@
+import { gateParameters, isGateEnabled } from '../../lib/config.mjs';
+import { coerceParameters, readHookPayload } from '../../lib/hook-io.mjs';
+import { CONFIG_KEY, DEFAULT_PARAMS } from './shared.mjs';
+
+const PROBE_TIMEOUT_MS = 1500;
+const SESSION_START_EVENT = 'SessionStart';
+const NOT_ENROLLED = 'non_enrolled_pending_mutations';
+
+async function getJson(url) {
+  const response = await fetch(url, {
+    signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+  });
+  if (!response.ok) return null;
+  return response.json();
+}
+
+function withoutTrailingSlash(text) {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === '/') end -= 1;
+  return text.slice(0, end);
+}
+
+function speak(context) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: SESSION_START_EVENT,
+        additionalContext: context,
+      },
+    }),
+  );
+}
+
+function enrollmentProblem(status, projectName) {
+  if (!status || status.reason_code !== NOT_ENROLLED) return null;
+  const message = String(status.reason_message ?? '');
+  if (projectName && !message.includes(`${projectName}=`)) return null;
+  return projectName ?? 'this project';
+}
+
+async function main() {
+  const cwd = process.cwd();
+  if (!isGateEnabled(CONFIG_KEY, true, cwd)) return;
+  const { parameters } = coerceParameters(
+    DEFAULT_PARAMS,
+    gateParameters(CONFIG_KEY, cwd),
+  );
+  const base = withoutTrailingSlash(String(parameters.engramUrl));
+  const status = await getJson(`${base}/sync/status`);
+  if (!status) return;
+  const current = await getJson(
+    `${base}/project/current?cwd=${encodeURIComponent(cwd)}`,
+  );
+  const project = enrollmentProblem(status, current?.project);
+  if (!project) return;
+  speak(
+    `[${CONFIG_KEY}] Engram cloud is configured but "${project}" is not enrolled, so its memories stay ` +
+      `local only (daemon reports ${status.reason_code}). Run \`engram cloud enroll ${project}\` once ` +
+      'to replicate them; local SQLite remains the source of truth either way.',
+  );
+}
+
+readHookPayload();
+main().catch(() => {});

package/plugins/gates/hooks/gates/engram-first/shared.mjs

@@ -0,0 +1,90 @@
+import {
+  mcpActionSegment,
+  mcpServerSegment,
+  toolInGroups,
+} from '../../lib/hook-io.mjs';
+import {
+  readSessionState,
+  writeSessionState,
+} from '../../lib/session-state.mjs';
+
+export const GATE_ID = 'engram-first';
+export const CONFIG_KEY = 'requireEngramBeforeResearch';
+
+export const DEFAULT_PARAMS = Object.freeze({
+  engramServers: ['engram', 'plugin_engram_engram'],
+  context7Servers: ['context7', 'plugin_context7_context7'],
+  researchTools: ['WebSearch', 'WebFetch'],
+  engramUrl: 'http://127.0.0.1:7437',
+  requireSaveBeforeStop: true,
+});
+
+const MAX_RECORDED_QUERIES = 30;
+const MAX_QUERY_LENGTH = 200;
+
+export const EMPTY_STATE = Object.freeze({
+  memSearchCount: 0,
+  memSearchHits: 0,
+  memSearchQueries: [],
+  memSaveCount: 0,
+  researchCalls: 0,
+  lastResearchAt: 0,
+  lastMemSaveAt: 0,
+});
+
+function serverMatches(toolName, servers) {
+  const server = mcpServerSegment(String(toolName ?? '')).toLowerCase();
+  return servers.some((name) => String(name).toLowerCase() === server);
+}
+
+export function isEngramTool(toolName, parameters) {
+  return serverMatches(toolName, parameters.engramServers);
+}
+
+export function isContext7Tool(toolName, parameters) {
+  return serverMatches(toolName, parameters.context7Servers);
+}
+
+export function isResearchTool(toolName, parameters) {
+  if (isEngramTool(toolName, parameters)) return false;
+  const lowered = String(toolName ?? '').toLowerCase();
+  if (parameters.researchTools.some((name) => name.toLowerCase() === lowered))
+    return true;
+  if (isContext7Tool(toolName, parameters)) return true;
+  return toolInGroups(toolName, ['research']);
+}
+
+export function engramActionOf(toolName) {
+  return mcpActionSegment(String(toolName ?? '')).toLowerCase();
+}
+
+export function readState(sessionId, cwd) {
+  return {
+    ...EMPTY_STATE,
+    ...readSessionState(GATE_ID, sessionId, {}, { cwd }),
+  };
+}
+
+export function writeState(sessionId, state, cwd) {
+  return writeSessionState(GATE_ID, sessionId, state, { cwd });
+}
+
+export function rememberQuery(state, query) {
+  const queries = [
+    ...state.memSearchQueries,
+    String(query ?? '').slice(0, MAX_QUERY_LENGTH),
+  ];
+  return queries.slice(-MAX_RECORDED_QUERIES);
+}
+
+export function queryOf(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return '';
+  return String(
+    toolInput.query ??
+      toolInput.title ??
+      toolInput.libraryName ??
+      toolInput.prompt ??
+      toolInput.url ??
+      '',
+  );
+}

package/plugins/gates/hooks/gates/engram-first/stop.mjs

@@ -0,0 +1,23 @@
+import { block, runStopHook } from '../../lib/hook-io.mjs';
+import { CONFIG_KEY, DEFAULT_PARAMS, GATE_ID, readState } from './shared.mjs';
+
+runStopHook(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: true,
+    defaultParams: { ...DEFAULT_PARAMS },
+  },
+  ({ sessionId, parameters, cwd }) => {
+    if (!parameters.requireSaveBeforeStop) return;
+    const state = readState(sessionId, cwd);
+    if (state.researchCalls === 0) return;
+    if (state.lastMemSaveAt >= state.lastResearchAt) return;
+    block(
+      CONFIG_KEY,
+      `This session made ${state.researchCalls} research call(s) (web/context7) and nothing was saved to ` +
+        'engram afterwards. Call mem_save with what the research established (What/Why/Where/Learned, ' +
+        'or mem_session_summary if it was broad), then end the turn. Research that is not saved is repeated next session.',
+    );
+  },
+);

package/plugins/gates/hooks/gates/engram-first/track.mjs

@@ -0,0 +1,97 @@
+import { gateParameters, isGateEnabled } from '../../lib/config.mjs';
+import {
+  allow,
+  coerceParameters,
+  readHookPayload,
+  sessionIdOf,
+  toolInputOf,
+  toolNameOf,
+  toolResponseOf,
+} from '../../lib/hook-io.mjs';
+import {
+  CONFIG_KEY,
+  DEFAULT_PARAMS,
+  engramActionOf,
+  isEngramTool,
+  isResearchTool,
+  queryOf,
+  readState,
+  rememberQuery,
+  writeState,
+} from './shared.mjs';
+
+const SAVE_ACTIONS = new Set(['mem_save', 'mem_session_summary', 'mem_update']);
+const NO_RESULT_PATTERN = /no memories found|no results|0 results/i;
+
+function responseText(toolResponse) {
+  if (typeof toolResponse === 'string') return toolResponse;
+  try {
+    return JSON.stringify(toolResponse ?? '');
+  } catch {
+    return '';
+  }
+}
+
+function searchHit(toolResponse) {
+  const text = responseText(toolResponse);
+  return text.length > 0 && !NO_RESULT_PATTERN.test(text);
+}
+
+function nextState(state, { toolName, toolInput, toolResponse, parameters }) {
+  const now = Date.now();
+  if (isEngramTool(toolName, parameters)) {
+    const action = engramActionOf(toolName);
+    if (action === 'mem_search') {
+      return {
+        ...state,
+        memSearchCount: state.memSearchCount + 1,
+        memSearchHits: state.memSearchHits + (searchHit(toolResponse) ? 1 : 0),
+        memSearchQueries: rememberQuery(state, queryOf(toolInput)),
+      };
+    }
+    if (SAVE_ACTIONS.has(action)) {
+      return {
+        ...state,
+        memSaveCount: state.memSaveCount + 1,
+        lastMemSaveAt: now,
+      };
+    }
+    return state;
+  }
+  if (isResearchTool(toolName, parameters)) {
+    return {
+      ...state,
+      researchCalls: state.researchCalls + 1,
+      lastResearchAt: now,
+    };
+  }
+  return state;
+}
+
+function main() {
+  const rawPayload = readHookPayload();
+  if (rawPayload === null) allow();
+  const cwd = process.cwd();
+  if (!isGateEnabled(CONFIG_KEY, true, cwd)) allow();
+  const { parameters } = coerceParameters(
+    DEFAULT_PARAMS,
+    gateParameters(CONFIG_KEY, cwd),
+  );
+  const sessionId = sessionIdOf(rawPayload);
+  const context = {
+    toolName: toolNameOf(rawPayload) ?? '',
+    toolInput: toolInputOf(rawPayload),
+    toolResponse: toolResponseOf(rawPayload),
+    parameters,
+  };
+  const state = readState(sessionId, cwd);
+  const updated = nextState(state, context);
+  if (updated !== state) writeState(sessionId, updated, cwd);
+  allow();
+}
+
+try {
+  main();
+} catch {
+  allow();
+}