@event4u/agent-config 14.17.0 → 14.19.0

package/src/scripts/hooks/augment-dispatcher.sh

@@ -4,7 +4,7 @@
 # Replaces the four per-concern trampolines (augment-chat-history.sh,
 # augment-roadmap-progress.sh, augment-onboarding-gate.sh,
 # augment-context-hygiene.sh). One script, dispatched per (platform, event)
-# tuple via scripts/hooks/dispatch_hook.py reading scripts/hook_manifest.yaml.
+# tuple via src/scripts/hooks/dispatch_hook.ts reading src/scripts/hook_manifest.yaml.
 #
 # Augment requires hook scripts to use the .sh extension and live at user
 # scope (~/.augment/hooks/) — same constraint as the legacy trampolines.

package/src/scripts/hooks/block_no_verify.ts

@@ -34,7 +34,7 @@ import * as fs from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import { readHookStdin } from './hook_stdin.js';
-import { substitutionPayloads } from './block_unauthorized_git.js';
+import { substitutionPayloads } from './git_command_classifier.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -400,7 +400,7 @@ function _is_blocked(git_tokens: string[]): [boolean, string] {
  * genuinely unparseable command that DOES invoke git. So the test moves from
  * "the string contains git" to "some command position is git", with heredoc
  * bodies removed first — the same data-not-command distinction
- * `block_unauthorized_git` already makes.
+ * `git_command_classifier` already makes.
  *
  * Deliberately regex-shaped rather than tokenised: shlex has already failed by
  * the time this runs, so no reliable token stream exists. It therefore stays
@@ -450,7 +450,7 @@ export function _looks_like_git_invocation(cmd: string, depth = 0): boolean {
  * `_git_base` never sees git. The more parseable the command, the less it was
  * protected. Classification inside the payload is by command position, so a
  * substitution that INVOKES git is checked and one that merely names it in an
- * argument is not — matching what `block_unauthorized_git` does one level up.
+ * argument is not — matching what `git_command_classifier` does one level up.
  *
  * Heredoc bodies are removed before extraction: a backtick or `$(` inside a
  * commit message being written to a file is data, and feeding it back through

package/src/scripts/hooks/category_a.ts

@@ -0,0 +1,291 @@
+/**
+ * category_a — which `pre_tool_use` calls this package is willing to hand the
+ * host an explicit `permissionDecision: allow` for.
+ *
+ * WHY THIS EXISTS. `host_semantics` built exactly one envelope shape, so a
+ * call this package does not gate at all still cost the user a host
+ * confirmation. `permissionDecision` is offered by the host contract and was
+ * never emitted, so the prompt is ours to remove — but only for calls where
+ * "we do not gate this" is a fact about the call rather than about our
+ * coverage. That is what category A names: reads, navigation, build, test and
+ * lint inside the working tree with no consequence operation attached.
+ *
+ * THE CLASSIFIER IS AN ALLOWLIST AND MUST STAY ONE. A denylist answers "is
+ * this one of the bad shapes I thought of", so every shape nobody thought of
+ * would be auto-allowed. Everything below answers the opposite question, and an
+ * unrecognised call is not category A. The failure direction of a bug here is
+ * then a prompt that did not go away, never a confirmation that was skipped.
+ *
+ * WHAT AN ALLOW DOES NOT DO. It never overrides a verdict from this package:
+ * composition lives in `host_semantics.composePermissionDecision`, where one
+ * `ask` or `deny` beats every `allow`, and the dispatcher reaches the allow
+ * path only when the reduced severity is already `allow`. It is also not a
+ * grant — the host's own strings record `permissionDecision=allow ignored: a
+ * confined session takes grants only from its command line`.
+ */
+import * as path from "node:path";
+
+/** A JSON-ish tool input as it arrives in the dispatcher envelope. */
+export type ToolInput = Record<string, unknown>;
+
+/**
+ * Tools whose every documented effect is a read. `WebFetch` and `WebSearch`
+ * are deliberately absent — they reach the network, which is the egress leg of
+ * the lethal trifecta and not something to auto-allow.
+ */
+const READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+    "Read",
+    "Glob",
+    "Grep",
+    "NotebookRead",
+    "LS",
+    "TodoRead",
+]);
+
+/** Per-tool input keys that carry a filesystem path needing confinement. */
+const PATH_KEYS: readonly string[] = [
+    "file_path",
+    "notebook_path",
+    "path",
+    "directory",
+];
+
+/**
+ * Any of these in a Bash command string disqualifies it before the argv is
+ * looked at. Chaining, substitution, redirection and backgrounding all let a
+ * safe head token carry an arbitrary second command, and a classifier that
+ * tries to parse past them is a shell parser with a security boundary attached.
+ * Refusing the whole shape is both smaller and correct.
+ */
+const SHELL_METACHARACTERS = /[;&|`$><\n\r(){}\\]/;
+
+/**
+ * Words naming a consequence operation, matched as whole tokens anywhere in
+ * the command. Defence in depth: the metacharacter rule already prevents a
+ * second command, so a hit here means the FIRST command is consequential.
+ */
+const CONSEQUENCE_WORDS: ReadonlySet<string> = new Set([
+    "push", "publish", "deploy", "release", "merge", "rebase", "reset",
+    "revert", "restore", "checkout", "commit", "tag", "fetch", "pull", "clone",
+    "rm", "rmdir", "unlink", "mv", "cp", "chmod", "chown", "kill", "sudo",
+    "curl", "wget", "ssh", "scp", "rsync", "nc", "telnet",
+    "drop", "truncate", "delete", "insert", "migrate", "seed", "restore-db",
+    "install", "uninstall", "upgrade", "prune", "clean", "apply", "destroy",
+    "terraform", "kubectl", "helm", "aws", "gcloud", "az", "docker", "podman",
+    "systemctl", "launchctl", "crontab", "mail", "sendmail",
+]);
+
+/** Read-only `git` subcommands; every consequential one is absent by design. */
+const GIT_READ_SUBCOMMANDS: ReadonlySet<string> = new Set([
+    "status", "log", "diff", "show", "branch", "blame", "describe",
+    "shortlog", "rev-parse", "ls-files", "ls-tree", "cat-file", "whatchanged",
+]);
+
+/**
+ * Head tokens that cannot write outside their arguments and whose named
+ * operation is a read, a navigation, a build, a test or a lint.
+ *
+ * `node`, `python`, `ruby`, `php` and `sh` are deliberately absent: their named
+ * operation is "run this program", which establishes nothing about what the
+ * program does. A test runner is admitted by name because the name IS the
+ * operation.
+ */
+const SAFE_HEADS: ReadonlySet<string> = new Set([
+    "ls", "pwd", "cat", "head", "tail", "wc", "file", "stat", "find",
+    "grep", "rg", "tree", "du", "df", "which", "basename", "dirname",
+    "realpath", "sort", "uniq", "cut", "diff", "cmp", "date", "echo",
+    "tsc", "eslint", "prettier", "biome", "stylelint",
+    "vitest", "jest", "mocha", "pytest", "mypy", "ruff", "flake8", "black",
+    "phpstan", "phpunit", "psalm", "pest", "rspec", "rubocop",
+    "golangci-lint", "shellcheck", "markdownlint", "hadolint",
+]);
+
+/**
+ * Multi-purpose runners: the head token decides nothing, so the subcommand
+ * must be declared. `npm run <script>` executes whatever the manifest says,
+ * which is why the script name is checked separately below.
+ */
+const RUNNER_SUBCOMMANDS: Readonly<Record<string, ReadonlySet<string>>> = {
+    npm: new Set(["test", "run", "ls", "list", "why", "outdated", "view"]),
+    pnpm: new Set(["test", "run", "ls", "list", "why", "outdated"]),
+    yarn: new Set(["test", "run", "list", "why", "info"]),
+    npx: new Set(["tsc", "eslint", "prettier", "vitest", "jest"]),
+    composer: new Set(["test", "run-script", "show", "validate", "diagnose"]),
+    cargo: new Set(["test", "build", "check", "clippy", "fmt", "tree"]),
+    go: new Set(["test", "build", "vet", "list", "version"]),
+    make: new Set(["test", "build", "lint", "check", "typecheck"]),
+    task: new Set(["test", "build", "lint", "check", "typecheck", "--list"]),
+    just: new Set(["test", "build", "lint", "check"]),
+    bundle: new Set(["exec"]),
+    dotnet: new Set(["test", "build"]),
+    mvn: new Set(["test", "compile", "verify"]),
+    gradle: new Set(["test", "build", "check"]),
+};
+
+/** Script names a `run`-style subcommand may name and stay category A. */
+const SAFE_SCRIPT_NAMES: ReadonlySet<string> = new Set([
+    "test", "tests", "lint", "typecheck", "types", "build", "check",
+    "format", "fmt", "unit", "e2e", "coverage", "compile",
+]);
+
+/** Subcommands that take a script name rather than acting themselves. */
+const SCRIPT_TAKING_SUBCOMMANDS: ReadonlySet<string> = new Set([
+    "run", "run-script", "exec",
+]);
+
+/**
+ * Is `candidate` inside `root`?
+ *
+ * Pure `path` arithmetic, no `fs`: the classifier must be decidable from the
+ * envelope alone, and a stat call would make it depend on what happens to
+ * exist on the machine that runs the hook.
+ */
+export function isInsideWorkingTree(candidate: string, root: string): boolean {
+    if (!candidate.trim() || !root.trim()) return false;
+    const abs = path.resolve(root, candidate);
+    const rel = path.relative(path.resolve(root), abs);
+    if (rel === "") return true;
+    return !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+/** Split a command on whitespace; the caller has already refused metacharacters. */
+function _argv(command: string): string[] {
+    return command.trim().split(/\s+/).filter((t) => t.length > 0);
+}
+
+/** Strip a leading `-`/`--` so a flag is never mistaken for a subcommand. */
+function _isFlag(token: string): boolean {
+    return token.startsWith("-");
+}
+
+/** First non-flag token after the head, or `""`. */
+function _firstSubcommand(argv: readonly string[]): string {
+    for (const token of argv.slice(1)) {
+        if (!_isFlag(token)) return token;
+    }
+    return "";
+}
+
+/**
+ * `git` global options that consume the NEXT token as their value.
+ *
+ * Without this, `git -C sub status` resolves its subcommand to `sub` and the
+ * whole directory-flag form — the shape the canon now teaches in place of
+ * `cd X && …` — falls out of category A. That defect was found by the friction
+ * corpus on its first run, which is the reason the corpus counts confirmations
+ * rather than gates: a gate count would have looked identical.
+ *
+ * The `--flag=value` spelling consumes no extra token and needs no entry.
+ */
+const GIT_VALUE_FLAGS: ReadonlySet<string> = new Set([
+    "-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path",
+]);
+
+/**
+ * The `git` subcommand, with global options skipped.
+ *
+ * Returns `""` when a global option's VALUE escapes the working tree — an
+ * absolute path or a `..` traversal. The check is textual rather than resolved
+ * against a root because this function is pure and receives no root; what it
+ * can decide is exactly the property that matters, and a relative path with no
+ * `..` cannot escape.
+ */
+function _gitSubcommand(argv: readonly string[]): string {
+    for (let i = 1; i < argv.length; i++) {
+        const token = argv[i] as string;
+        if (!_isFlag(token)) return token;
+        const [flag, inlineValue] = token.includes("=")
+            ? [token.slice(0, token.indexOf("=")), token.slice(token.indexOf("=") + 1)]
+            : [token, null];
+        const value = inlineValue ?? (GIT_VALUE_FLAGS.has(flag) ? argv[++i] : undefined);
+        if (value !== undefined && (path.isAbsolute(value) || value.split("/").includes(".."))) {
+            return "";
+        }
+    }
+    return "";
+}
+
+/** Non-flag token after the subcommand, or `""`. */
+function _secondSubcommand(argv: readonly string[]): string {
+    const nonFlags = argv.slice(1).filter((t) => !_isFlag(t));
+    return nonFlags[1] ?? "";
+}
+
+/**
+ * Does any token in the command name a consequence operation?
+ *
+ * Tokenised rather than substring-matched: a substring test would refuse
+ * `git log --format=…` for containing `mat`, and a classifier that refuses
+ * everything is indistinguishable from one that was never wired.
+ */
+export function namesConsequenceOperation(command: string): boolean {
+    for (const raw of _argv(command)) {
+        const token = raw.replace(/^-+/, "").toLowerCase();
+        if (CONSEQUENCE_WORDS.has(token)) return true;
+        // `npm:publish`, `db:seed`, `deploy:prod` — a namespaced script name
+        // hides the consequential half behind a separator.
+        for (const part of token.split(/[:/=,]/)) {
+            if (part && CONSEQUENCE_WORDS.has(part)) return true;
+        }
+    }
+    return false;
+}
+
+/** Is this Bash command string category A? */
+export function isCategoryABashCommand(command: string): boolean {
+    if (typeof command !== "string" || !command.trim()) return false;
+    if (SHELL_METACHARACTERS.test(command)) return false;
+    if (namesConsequenceOperation(command)) return false;
+
+    const argv = _argv(command);
+    const head = (argv[0] ?? "").toLowerCase();
+    if (!head) return false;
+
+    if (SAFE_HEADS.has(head)) return true;
+
+    if (head === "git") {
+        return GIT_READ_SUBCOMMANDS.has(_gitSubcommand(argv));
+    }
+
+    const allowed = RUNNER_SUBCOMMANDS[head];
+    if (!allowed) return false;
+    const sub = _firstSubcommand(argv);
+    if (!sub || !allowed.has(sub)) return false;
+    if (SCRIPT_TAKING_SUBCOMMANDS.has(sub)) {
+        const script = _secondSubcommand(argv);
+        return script !== "" && SAFE_SCRIPT_NAMES.has(script.toLowerCase());
+    }
+    return true;
+}
+
+/**
+ * Is this tool call category A?
+ *
+ * `workingTree` is the root every path argument must resolve inside. An empty
+ * root means the dispatcher could not establish one, and an unestablished
+ * boundary is not a boundary — the call is not category A.
+ */
+export function isCategoryA(
+    toolName: string,
+    toolInput: ToolInput,
+    workingTree: string,
+): boolean {
+    if (!workingTree.trim()) return false;
+    if (typeof toolName !== "string" || !toolName) return false;
+
+    if (READ_ONLY_TOOLS.has(toolName)) {
+        for (const key of PATH_KEYS) {
+            const value = toolInput?.[key];
+            if (typeof value !== "string") continue;
+            if (!isInsideWorkingTree(value, workingTree)) return false;
+        }
+        return true;
+    }
+
+    if (toolName === "Bash") {
+        const command = toolInput?.["command"];
+        return typeof command === "string" && isCategoryABashCommand(command);
+    }
+
+    return false;
+}

package/src/scripts/hooks/cline-dispatcher.sh

@@ -4,7 +4,7 @@
 # Routes user-scope `~/Documents/Cline/Hooks/<HookName>` events into
 # the active workspace's `./agent-config dispatch:hook`. Project-scope
 # `.clinerules/hooks/<HookName>` does NOT need this trampoline —
-# install.py `ensure_cline_bridge()` writes per-event scripts there
+# the installer's `ensure_cline_bridge()` writes per-event scripts there
 # that dispatch directly because Cline fires project hooks with the
 # workspace as cwd.
 #

package/src/scripts/hooks/concern_registry.ts

@@ -41,6 +41,7 @@ import { main as wrapperFreshnessMain } from '../wrapper_freshness_hook.js';
 import { main as surfaceProbeMain } from '../surface_probe_hook.js';
 import { main as teamReviewGateMain } from '../team_review_gate_hook.js';
 import { main as prUrlReminderMain } from '../pr_url_reminder_hook.js';
+import { main as pushSettleMain } from './push_settle_hook.js';
 import { main as sessionCanaryMain } from '../session_canary_hook.js';
 import { main as councilAvailabilityMain } from '../council_availability_hook.js';
 import { main as telemetryDisclosureMain } from '../telemetry_disclosure_hook.js';
@@ -48,7 +49,6 @@ import { main as selfRepairMain } from '../self_repair_hook.js';
 import { main as sessionRegisterMain } from '../session_register_hook.js';
 import { main as languageMirrorMain } from '../language_mirror_hook.js';
 import { main as gitAuthorizationMain } from '../git_authorization_hook.js';
-import { main as blockUnauthorizedGitMain } from './block_unauthorized_git.js';
 import { main as evidenceIndependenceMain } from './evidence_independence.js';
 import { main as blockNoVerifyMain } from './block_no_verify.js';
 import { main as blockKernelRuleWritesMain } from './block_kernel_rule_writes.js';
@@ -102,6 +102,7 @@ export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
     'src/scripts/surface_probe_hook.ts': surfaceProbeMain as ConcernMain,
     'src/scripts/team_review_gate_hook.ts': teamReviewGateMain as ConcernMain,
     'src/scripts/pr_url_reminder_hook.ts': prUrlReminderMain as ConcernMain,
+    'src/scripts/hooks/push_settle_hook.ts': pushSettleMain as ConcernMain,
     'src/scripts/session_canary_hook.ts': sessionCanaryMain as ConcernMain,
     'src/scripts/council_availability_hook.ts': councilAvailabilityMain as ConcernMain,
     'src/scripts/telemetry_disclosure_hook.ts': telemetryDisclosureMain as ConcernMain,
@@ -109,7 +110,6 @@ export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
     'src/scripts/session_register_hook.ts': sessionRegisterMain as ConcernMain,
     'src/scripts/language_mirror_hook.ts': languageMirrorMain as ConcernMain,
     'src/scripts/git_authorization_hook.ts': gitAuthorizationMain as ConcernMain,
-    'src/scripts/hooks/block_unauthorized_git.ts': blockUnauthorizedGitMain as ConcernMain,
     'src/scripts/hooks/evidence_independence.ts': evidenceIndependenceMain as ConcernMain,
     'src/scripts/hooks/block_no_verify.ts': blockNoVerifyMain as ConcernMain,
     'src/scripts/hooks/block_kernel_rule_writes.ts': blockKernelRuleWritesMain as ConcernMain,

package/src/scripts/hooks/cursor-dispatcher.sh

@@ -3,7 +3,7 @@
 #
 # Routes user-scope `~/.cursor/hooks.json` events into the active
 # workspace's `./agent-config dispatch:hook`. Project-scope
-# `.cursor/hooks.json` does NOT need this trampoline — install.py
+# `.cursor/hooks.json` does NOT need this trampoline — the installer
 # `ensure_cursor_bridge()` writes direct dispatch:hook commands there
 # because the project hooks fire with the workspace as cwd.
 #
@@ -20,10 +20,16 @@
 #   - Re-pipe the original JSON into
 #       ./agent-config dispatch:hook --platform cursor \
 #           --event $1 --native-event $2
-#   - Always exit 0 — Cursor's pre-hooks can block via exit code, but
-#     none of our concerns block; chat-history / roadmap-progress /
-#     context-hygiene are observe-only and onboarding-gate writes
-#     state without denying sessionStart.
+#   - Always exit 0 — Cursor's pre-hooks can block via exit code. The
+#     manifest declares 7 concerns at `severity: blocking`, and this host
+#     binds none of them: cursor's platform row carries session_start,
+#     session_end, stop, user_prompt_submit and post_tool_use, and every
+#     blocking concern sits in a slot or platform row outside that set.
+#     The count is a YAML parse of the concerns map, never `grep -c
+#     'severity: blocking'`, which returns 8 by also counting the prose
+#     line that quotes the key. What IS bound here — chat-history /
+#     roadmap-progress / context-hygiene — is observe-only, and
+#     onboarding-gate writes state without denying sessionStart.
 
 set -u
 

package/src/scripts/hooks/dispatch_hook.ts

@@ -9,12 +9,10 @@
  * stdout/stderr split, and exit codes. Helper names keep snake_case for
  * fidelity (concern authors rely on the documented surface).
  *
- * Per `docs/contracts/hook-architecture-v1.md`. Reads the manifest at
- * `scripts/hook_manifest.yaml`, resolves which concerns fire on the given
- * (platform, event) tuple, and runs each concern sequentially with the
- * stdin envelope contract. Reduces concern exit codes per the spec
- * (0=allow, 1=block, 2=warn, ≥3=error → fail-open unless concern is
- * fail_closed).
+ * Per `docs/contracts/hook-architecture-v1.md`. Reads `src/scripts/hook_manifest.yaml`,
+ * resolves which concerns fire on the given (platform, event) tuple, and runs each
+ * sequentially with the stdin envelope contract. Reduces concern exit codes per the
+ * spec (0=allow, 1=block, 2=warn, ≥3=error → fail-open unless concern is fail_closed).
  *
  * Invocation:
  *
@@ -50,13 +48,16 @@ import {
   setHookStdinOverride,
   clearHookStdinOverride,
 } from "./hook_stdin.js";
-import { emitFor, type Severity } from "./host_semantics.js";
+import { emitFor, type PermissionDecision, type Severity } from "./host_semantics.js";
+import { _concern_permission_verdict, _payload_tool_name, _permission_for } from "./permission_gate.js";
+export { _concern_permission_verdict, _payload_tool_input, _payload_tool_name, _permission_for, _working_tree_root } from "./permission_gate.js";
 import { _concern_body_classes, planPayloadShapes } from "./payload_stub.js";
 import { resolveSessionRole, type SessionRole } from "../_lib/session_role.js";
 import { stdinReadFailure, denyOnStdinFailure } from './stdin_failure_policy.js';
 export { stdinReadFailure, denyOnStdinFailure, _is_fail_closed_blocking } from './stdin_failure_policy.js';
 import { _py_json_dumps } from './py_json_dumps.js';
 import { _fallback_yaml } from './fallback_yaml.js';
+import { detectSurface } from '../_lib/surface.js';
 import { recordCapture, recordOpportunity } from "../_lib/collector_denominator.js";
 export { _fallback_yaml } from './fallback_yaml.js';
 
@@ -255,20 +256,6 @@ interface ConcernDef extends JsonObject {
   name: string;
 }
 
-/**
- * The tool name the host reported for this event, or `""`.
- *
- * Only tool events carry one. Read defensively: the payload is host-shaped and
- * a missing / non-string field must degrade to "unknown tool", never throw.
- */
-export function _payload_tool_name(envelope: JsonObject): string {
-  const payload = envelope["payload"];
-  if (!_isObject(payload)) {
-    return "";
-  }
-  const raw = payload["tool_name"];
-  return typeof raw === "string" ? raw : "";
-}
 
 /**
  * Per-concern tool filter — the `tools:` key.
@@ -290,7 +277,7 @@ export function _payload_tool_name(envelope: JsonObject): string {
  * - A host matcher would only help the two hosts that support one (Claude,
  *   Gemini). The in-process skip helps all eight platforms in the manifest.
  *
- * ## What this does NOT claim
+ * What this does NOT claim:
  *
  * It does not claim a latency win. The measured hook cost that was fixed was
  * the *invocation path* (~370 of ~450–500 ms was eager CLI imports); nothing in
@@ -509,6 +496,7 @@ export function _build_envelope(args: Args, payload_text: string): JsonObject {
       process.env["AGENT_SESSION_ID"] ||
       "",
     workspace_root: process.cwd(),
+    surface: detectSurface(payloadObj),
     payload: payloadObj,
     settings: {},
   };
@@ -1280,6 +1268,11 @@ export function main(argv?: string[]): number {
   // fixed-field schema (PII-exclusion-by-construction), and a concern's raw
   // stderr is free-form content. This array is in-memory only.
   const concern_messages: ConcernMessage[] = [];
+  // Per-concern permission verdicts for the host's `permissionDecision` field.
+  // Separate from `rcs` because the two ladders are not the same: an advisory
+  // concern can ask for a confirmation without blocking, and a reduced `allow`
+  // must not become a grant when one of them did.
+  const permission_verdicts: PermissionDecision[] = [];
   // Per-concern `tools:` filter (see _concern_matches_tool). Applied here so it
   // is one place, after the envelope exists and before any concern is spawned.
   const tool_name = _payload_tool_name(envelope);
@@ -1339,6 +1332,7 @@ export function main(argv?: string[]): number {
     }
     rcs.push(rc);
     const reply = _parse_concern_stdout(stdout_text);
+    permission_verdicts.push(_concern_permission_verdict(rc, reply));
     // A concern states its reason either as JSON {"reason": …} on stdout
     // (advisory concerns) or as a formatted stderr line (the block guards, e.g.
     // `block-no-verify: BLOCKED — …`). Both are captured here so the emission
@@ -1423,6 +1417,7 @@ export function main(argv?: string[]): number {
     _severity_for(final_rc) as Severity,
     decidingReasons,
     final_rc,
+    _permission_for(args.event, envelope, final_rc, permission_verdicts),
   );
   if (emission.stdout) {
     process.stdout.write(emission.stdout);

package/src/scripts/hooks/evidence_independence.ts

@@ -365,8 +365,21 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
     });
     try {
       atomic_write_json(target, state);
-    } catch {
-      /* observability only */
+    } catch (err) {
+      /* Unlike its two siblings in `git_authorization_hook`, this one fails
+         OPEN, which is why it gets a diagnostic rather than a shrug. The turn's
+         evaluation count lives only in this file: a failed write leaves
+         `evaluations` one short, so the NEXT self-commissioned evaluation in the
+         same turn reads `priorEvaluations === 0` and the verdict-shopping warn
+         does not fire. The item-1 pre-loaded-verdict BLOCK is unaffected — it
+         reads the prompt, not this state — so the degradation is bounded to the
+         advisory half. Silent was the wrong call for a guard that loses a check
+         when it fails. */
+      process.stderr.write(
+        `evidence-independence: evaluation-count write failed (${_errText(err)}) — ` +
+          "this turn's count did NOT advance, so a second self-scoped evaluation " +
+          "will not be warned about. The pre-loaded-verdict block is unaffected.\n",
+      );
     }
   }
 
@@ -379,6 +392,12 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
   return decision.exit;
 }
 
+/** One-line, bounded rendering of a caught value for a stderr diagnostic. */
+function _errText(err: unknown): string {
+  const t = err instanceof Error ? err.message : String(err);
+  return t.replace(/\s+/g, " ").trim().slice(0, 200);
+}
+
 export function main(argv?: string[]): number {
   const args = argv ?? process.argv.slice(2);
   let consumer_root = process.cwd();