@envseal/core 0.1.6 → 0.1.7

package/dist/paths.d.ts

@@ -14,4 +14,13 @@ export declare function loadOrCreateSalt(paths: ProjectPaths): Buffer;
 export declare const HOOK_HEARTBEAT_FILE = "hook-heartbeat";
 /** ISO timestamp of the hook's last observed run for a project, or null. */
 export declare function readHookHeartbeat(root: string): string | null;
+export declare const HOOK_DECISIONS_FILE = "hook-decisions";
+export interface HookDecisions {
+    allow: number;
+    deny: number;
+}
+/** Cumulative hook decisions for a project, or null when unknown. */
+export declare function readHookDecisions(root: string): HookDecisions | null;
+/** Increment the allow or deny counter. Never throws; never touches decisions. */
+export declare function recordHookDecision(root: string, allow: boolean): void;
 //# sourceMappingURL=paths.d.ts.map

package/dist/paths.js

@@ -102,4 +102,63 @@ export function readHookHeartbeat(root) {
         return null;
     }
 }
+// --- Hook decision counters --------------------------------------------------
+//
+// The heartbeat proves the hook RAN; it says nothing about whether the matcher
+// ever fires. These cumulative allow/deny counters answer that next question:
+// a hook that runs but decides wrongly (or is neutered to allow everything)
+// shows allow > 0 with deny stuck at 0. They prove the matcher FIRES, not that
+// every decision is right — a same-uid agent can rewrite them, so they are
+// observational and advisory, exactly like the heartbeat.
+//
+// Deliberately a SECOND file, not a second line in the heartbeat: older
+// readers parse the heartbeat as a bare timestamp, and an unreadable new
+// format would regress them to "never ran". An absent counter file reads as
+// null ("unknown", pre-counters hook), never as zero.
+//
+// Counts are approximate under concurrent hook invocations (read-modify-write
+// can lose an increment). Direction survives imprecision: deny > 0 still
+// proves a deny happened.
+export const HOOK_DECISIONS_FILE = 'hook-decisions';
+function isHookDecisions(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const rec = value;
+    return (typeof rec.allow === 'number' &&
+        Number.isInteger(rec.allow) &&
+        rec.allow >= 0 &&
+        typeof rec.deny === 'number' &&
+        Number.isInteger(rec.deny) &&
+        rec.deny >= 0);
+}
+/** Cumulative hook decisions for a project, or null when unknown. */
+export function readHookDecisions(root) {
+    try {
+        const raw = readFileSync(join(resolve(root), '.envseal', HOOK_DECISIONS_FILE), 'utf8');
+        const parsed = JSON.parse(raw);
+        return isHookDecisions(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Increment the allow or deny counter. Never throws; never touches decisions. */
+export function recordHookDecision(root, allow) {
+    try {
+        const stateDir = join(resolve(root), '.envseal');
+        const marker = join(stateDir, HOOK_DECISIONS_FILE);
+        const current = readHookDecisions(root) ?? { allow: 0, deny: 0 };
+        if (allow) {
+            current.allow += 1;
+        }
+        else {
+            current.deny += 1;
+        }
+        mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        writeFileSync(marker, `${JSON.stringify(current)}\n`, { mode: 0o600 });
+    }
+    catch {
+        // Observational only — an unwritable counter changes nothing.
+    }
+}
 //# sourceMappingURL=paths.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/core",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -22,10 +22,10 @@
   "dependencies": {
     "jsonc-parser": "^3.3.1",
     "ulid": "^2.3.0",
-    "@envseal/protocol": "0.1.6",
-    "@envseal/detector": "0.1.6",
-    "@envseal/registry": "0.1.6",
-    "@envseal/prompters": "0.1.6"
+    "@envseal/protocol": "0.1.7",
+    "@envseal/detector": "0.1.7",
+    "@envseal/registry": "0.1.7",
+    "@envseal/prompters": "0.1.7"
   },
   "devDependencies": {
     "fast-check": "^3.23.1"