@event4u/agent-config 14.17.0 → 14.19.0

package/src/scripts/hooks/{block_unauthorized_git.ts → git_command_classifier.ts}

@@ -1,11 +1,28 @@
-#!/usr/bin/env node
 /**
- * Unauthorized-git gate — `pre_tool_use` concern.
- *
- * Checks a git / GitHub / npm operation against the authorization ledger that
- * `git_authorization_hook.ts` writes on `user_prompt_submit`, so the question
- * "did the user authorize this THIS turn?" is answered from a recorded fact
- * rather than from the model's recollection.
+ * Git / GitHub / npm command classifier — a pure library, not a gate.
+ *
+ * WHAT THIS IS NOT, AND WHY. Until 2026-09-04 this file was the
+ * `block-unauthorized-git` `pre_tool_use` concern: it read the authorization
+ * ledger and REFUSED an operation the turn had not authorized. The owner
+ * removed that enforcement (ADR-254) after it was measured to refuse
+ * authorizations the owner had in fact given — a guardrail sentence inside an
+ * authorization ("never merge empty PRs") read as a withdrawal and erased the
+ * whole ledger, and an answer given as an option number ("1") matched no
+ * authorizing pattern at all.
+ *
+ * What survives is the half that never decided anything: the command parser and
+ * the operation vocabulary. Two callers depend on it and neither gates git —
+ * `block_no_verify.ts` needs `substitutionPayloads` so `git $(echo --no-verify)`
+ * cannot slip past the hook-bypass guard, and `conformance_scan.ts` needs
+ * `commandOp` / `BLOCK_OPS` to MEASURE how often an irreversible operation ran
+ * on an unauthorized turn. Measurement is all that is left here.
+ *
+ * `BLOCK_OPS` and `WARN_OPS` keep their names because they name the
+ * reversibility split `non-destructive-by-default` draws, and that split is
+ * still true. They no longer name an action this file takes.
+ *
+ * SEVERITY SPLIT — by reversibility, not by confidence. Retained below because
+ * it is what the two sets still mean.
  *
  * SEVERITY SPLIT — by reversibility, not by confidence.
  *
@@ -56,33 +73,7 @@
  * substitution in every position tried, `sh -c` and `eval` payloads, env
  * assignment prefixes, and quotes inside the command word.
  */
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-import { readHookStdin } from "./hook_stdin.js";
-import { analyseMergeImpact, describeImpact } from "./merge_impact.js";
-import { atomic_write_json } from "./state_io.js";
-import {
-  consumeGrantTarget,
-  ledgerFileFor,
-  pendingFileFor,
-  PR_NUMBER_MAX,
-  readGrants,
-  STATE_FILE,
-  type GitOp,
-  type MergeGrant,
-} from "../git_authorization_hook.js";
-
-const EXIT_ALLOW = 0;
-// MUST equal dispatch_hook.EXIT_BLOCK. The dispatcher's internal ladder is
-// 0 allow / 1 block / 2 warn — NOT the 2-means-block shape a PreToolUse guard
-// reads naturally from Claude's own native contract. This constant was 2 when
-// this gate first shipped, so the dispatcher reduced every refusal to a WARN
-// and the gate emitted advisory context while the operation went through.
-// Pinned against the dispatcher's export by
-// tests/hooks/concern_block_exit_parity.test.ts.
-const EXIT_BLOCK = 1;
+import { PR_NUMBER_MAX, type GitOp } from "../git_authorization_hook.js";
 
 type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
 type JsonObject = { [k: string]: JsonValue };
@@ -125,6 +116,22 @@ export const BLOCK_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
   "worktree-remove",
   /** `-x` is the flag that takes `.env` and local certificates. */
   "clean-ignored",
+
+  // ── The consequence vocabulary, added 2026-09-06. Every one is already
+  // never-autonomous in the `non-destructive-by-default` prose.
+  //
+  // MEMBERSHIP HERE IS A COUNTING DECISION, NOT A REFUSAL. The set's name
+  // predates ADR-254, which deleted the reader that blocked: the one consumer
+  // that acts on it now is `conformance_scan`'s after-the-fact tally, so
+  // "blocked" describes what the Hard Floor requires of the model, never what
+  // this package does at tool-call time.
+  "prod-deploy",
+  "prod-data-destroy",
+  "prod-infra-change",
+  "external-send",
+  "money-movement",
+  "trunk-force-push",
+  "out-of-scope-destruction",
 ]);
 
 /** Recoverable operations — warned without a this-turn authorization. */
@@ -163,6 +170,17 @@ const G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
 /** Optional absolute/relative path in front of the tool word: `/usr/bin/npm`. */
 const P = "^(?:\\S*\\/)?";
 
+/**
+ * Tool words the consequence rows classify, as a head anchor.
+ *
+ * Kept as one constant rather than folded into each row: `commandOp` filters
+ * segments by head BEFORE consulting the table, so a row whose tool word is
+ * missing here never runs — a silent no-op that looks exactly like a pattern
+ * that did not match.
+ */
+const CONSEQUENCE_TOOL_HEAD =
+  /^(?:\S*\/)?(terraform|pulumi|kubectl|helm|aws|gcloud|az|vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku|cap|psql|mysql|mariadb|sqlite3|mongosh|mongo|redis-cli|sendmail|msmtp|mail|mailx|curl|stripe|braintree|paypal|rm)\b/i;
+
 /**
  * A `gh api` call that WRITES. Read-only `gh api` is the standard way to inspect
  * GitHub state and must never be refused.
@@ -276,6 +294,13 @@ const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
   // "safe force" is in the same class here because what it is safe against is a
   // stale local view, not a collaborator who pushed after your fetch.
+  {
+    op: "trunk-force-push",
+    re: new RegExp(
+      `${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)[^\\n;|&]*\\b(main|master|trunk|production|prod)\\b`,
+      "i",
+    ),
+  },
   {
     op: "force-push",
     re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i"),
@@ -305,6 +330,73 @@ const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   },
   { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
 
+  // ── Consequence operations, added 2026-09-06
+  // (`road-to-authorization-that-reaches-further` 2.1).
+  //
+  // ORDER: above the generic `push`/`commit` fallbacks, because
+  // `trunk-force-push` is a `git push` and the most specific pattern must win —
+  // the rule this table states at its head.
+  //
+  // These classify commands the count could not see before. They add NOTHING to
+  // any refusal path: `commandOp` and `BLOCK_OPS` have exactly one consumer
+  // that acts on them, the after-the-fact tally in `conformance_scan`, and this
+  // change does not add a second.
+  {
+    op: "prod-data-destroy",
+    re: new RegExp(
+      `${P}(psql|mysql|mariadb|sqlite3|mongosh?)\\b[^\\n]*\\b(drop\\s+(table|database|schema)|truncate|delete\\s+from)\\b` +
+        `|${P}aws\\s+s3\\s+(rm|rb)\\b` +
+        `|${P}aws\\s+(dynamodb|rds)\\s+delete-\\S+` +
+        `|${P}redis-cli\\b[^\\n]*\\bflush(all|db)\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "prod-infra-change",
+    re: new RegExp(
+      `${P}terraform\\s+(apply|destroy)\\b` +
+        `|${P}pulumi\\s+(up|destroy)\\b` +
+        `|${P}kubectl\\s+(apply|delete|scale|drain)\\b` +
+        `|${P}helm\\s+(install|upgrade|uninstall|rollback)\\b` +
+        `|${P}aws\\s+(iam|ec2|route53|elbv2)\\s+(create|delete|put|update|modify|attach|detach)-\\S+` +
+        `|${P}(gcloud|az)\\s+\\S+\\s+(create|delete|update)\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "prod-deploy",
+    re: new RegExp(
+      `${P}(vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku)\\s+${G}deploy\\b` +
+        `|${P}(vercel|netlify)\\b[^\\n]*--prod\\b` +
+        `|${P}(npm|pnpm|yarn)\\s+run\\s+deploy\\b` +
+        `|${P}cap\\s+production\\s+deploy\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "external-send",
+    re: new RegExp(
+      `${P}(sendmail|msmtp|mailx?)\\b` +
+        `|${P}curl\\b(?=[^\\n]*(?:-X|--request)\\s+(?:POST|PUT|PATCH)\\b)(?=[^\\n]*https?:\\/\\/)`,
+      "i",
+    ),
+  },
+  {
+    op: "money-movement",
+    re: new RegExp(
+      `${P}(stripe|braintree|paypal)\\s+\\S*(charge|refund|payout|transfer|payment)\\S*\\b`,
+      "i",
+    ),
+  },
+  {
+    // `rm -rf` on an ABSOLUTE path or a home-relative one. Deliberately not
+    // "outside the working tree" — this function receives a command string and
+    // no cwd, so that reading is not decidable here and a classifier that
+    // guesses is worse than one that under-reports.
+    op: "out-of-scope-destruction",
+    re: new RegExp(`${P}rm\\s+(-\\S+\\s+)*-\\S*[rR]\\S*\\s+(-\\S+\\s+)*(~|/)\\S*`, "i"),
+  },
+
   { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
   { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
   { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") },
@@ -601,7 +693,14 @@ export function commandOp(command: string): GitOp | null {
   // unchecked once `publish` was authorized.
   let found: GitOp | null = null;
   for (const seg of invokedSegments(command)) {
-    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg)) {
+    // Widened 2026-09-06 for the consequence vocabulary. Before this the gate
+    // admitted five tool words, so `terraform apply` and `aws s3 rm` were not
+    // merely unclassified — they could not reach the table at all, and the
+    // count read them as nothing rather than as unmeasured.
+    if (
+      !/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg) &&
+      !CONSEQUENCE_TOOL_HEAD.test(seg)
+    ) {
       continue;
     }
     for (const { op, re } of COMMAND_OPS) {
@@ -643,343 +742,55 @@ export function mergeTargetOf(command: string): number | null {
   return api ? _boundedTarget(api[1] as string) : null;
 }
 
-/** A target only counts inside the API's own range; anything else is no target. */
-function _boundedTarget(digits: string): number | null {
-  const n = Number.parseInt(digits, 10);
-  return Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX ? n : null;
-}
-
 /**
- * Does a standing grant cover this exact merge?
+ * The object a consequence command acts on, or `null` when the command does not
+ * name one.
  *
- * Three conditions, all necessary: the grant is for this op, the command named
- * a target, and that target sits in the grant's frozen set unspent.
+ * The sibling of `mergeTargetOf`, generalised past pull-request numbers, and it
+ * inherits that function's fail-closed stance verbatim: a command that names no
+ * object matches no record, so the caller reports nothing rather than guessing.
+ * Under-reporting is the safe direction for a measurement; a guessed object
+ * would manufacture a violation out of a parse failure.
  *
- * No clock is consulted here, and that is the whole of ADR-252. `authorized`
- * answers "did the user name this operation recently"; a grant answers "did the
- * user name this operation AND this pull request". The second question does not
- * decay with time, because the object it names cannot drift into a different
- * object — a force-push changes the SHA, but the grant is spent on first use, so
- * a merge that already happened can never be replayed against a moved head.
+ * Normalised to lower case with quotes stripped, so it compares against the
+ * prose side's `extractObjects` without either end re-deriving the rule.
  */
-export function grantCovers(
-  grants: MergeGrant[],
-  op: GitOp,
-  target: number | null,
-): MergeGrant | null {
-  if (op !== "pr-merge" || target === null) {
-    return null;
-  }
-  return (
-    grants.find(
-      (g) => g.op === "pr-merge" && g.targets.includes(target) && !g.consumed.includes(target),
-    ) ?? null
-  );
-}
-
-/**
- * A ledger older than this is not "this turn" under any reading.
- *
- * **Widening this constant for a long run is forbidden practice.** On
- * 2026-08-21 it was sed-patched to twelve times this value — six hours —
- * behind a marker promising a revert that never came, so an autonomous PR-drain could
- * merge past the 30-minute bound. The widening was committed to the trunk and
- * left there. It is a twelvefold expansion of the authorization lifetime on
- * the guard that gates `pr-merge`, which is a `BLOCK_OPS` member precisely
- * because it is irreversible.
- *
- * Neither the widened expression nor the marker text is written out here: the
- * obvious regression check for either is a grep, and a comment reciting the
- * literal makes that grep match the guard's own prose on a clean tree.
- *
- * The supported answer to "my run is longer than the window" is that the run
- * STOPS and REPORTS at expiry and the user re-authorizes — never that the
- * window grows. The agent never edits this constant, this file, or the built
- * bundle; `dist/hooks/dispatch.js` is what actually executes, and a source
- * edit without a rebuild is silently inert.
- *
- * **ADR-251 (2026-08-30) decided this question and KEPT the value.** An AI
- * council converged 2/2 on a different authorization SHAPE rather than a wider
- * window, against the measured pressure that 7 of the 10 most recent sessions
- * of this package outlive a 30-minute window (median span 3.1 h) and that the
- * constant has been hand-widened twice. `LEDGER_MAX_AGE_MS` is unchanged at 30
- * minutes and raising it remains forbidden — that transition is owner-reserved,
- * and this record did not take it.
- *
- * What the record DID change is the behaviour at expiry: the run PAUSES,
- * reports the remaining work, and ASKS for re-authorization, instead of ending.
- * The user's reply renews this ledger through the path that already exists —
- * `git_authorization_hook.ts` rewrites the session's ledger with a fresh
- * `detected_at` on every human-typed prompt (`:512-537`), so a mid-run reply
- * carrying an authorization phrase resets the age this constant is compared
- * against. No new machinery, and the signal stays agent-unforgeable.
- *
- * See `docs/decisions/ADR-251-authorization-window-shape-not-width.md`.
- */
-export const LEDGER_MAX_AGE_MS = 30 * 60 * 1000;
-
-/**
- * Load the ledger, and refuse one that does not belong to THIS session and
- * THIS turn.
- *
- * The header claims the gate answers "did the user authorize this THIS turn?".
- * Before this check it answered "did anyone, in any session, ever authorize
- * it?" — the file records `session_id` and `detected_at` and neither was read.
- * Two concurrent worktrees share one state root, so session A typing
- * `mach den release` authorized session B.
- */
-function _loadLedger(
-  consumer_root: string,
-  session_id: string,
-  now: number,
-): { authorized: Set<GitOp>; present: boolean; grants: MergeGrant[] } {
-  // Grants are read on their OWN path, and the separation is load-bearing.
-  // `_readLedgerFile` below discards the entire ledger once `detected_at` is
-  // older than `LEDGER_MAX_AGE_MS`, so folding grants into its return value
-  // would let the clock silently kill them too — the change would ship, look
-  // correct, and do nothing after thirty minutes, with no test going red.
-  // `readGrants` performs the session check and no age check, which is exactly
-  // the contract: object identity, not recency (ADR-252).
-  const grants = readGrants(consumer_root, session_id);
-  // This session's own ledger first; the flat legacy file only as a fallback,
-  // so a ledger written by an older build still counts. Reading the flat file
-  // FIRST was the defect: any concurrent session in the repo overwrites it, and
-  // the session check below then discarded a real authorization as foreign.
-  const candidates = [ledgerFileFor(session_id)];
-  if (!candidates.includes(STATE_FILE)) {
-    candidates.push(STATE_FILE);
-  }
-  for (const rel of candidates) {
-    const found = _readLedgerFile(path.join(consumer_root, rel), session_id, now);
-    if (found !== null) {
-      return { ...found, grants };
-    }
-  }
-  return { authorized: new Set<GitOp>(), present: false, grants };
-}
-
-/**
- * Read one ledger file. `null` means "this file does not answer the question" —
- * absent, malformed, foreign session, or expired — so the caller may try the
- * next candidate. A parsed, in-session, fresh ledger answers definitively.
- */
-function _readLedgerFile(
-  file: string,
-  session_id: string,
-  now: number,
-): { authorized: Set<GitOp>; present: boolean } | null {
-  try {
-    const raw = fs.readFileSync(file, "utf8");
-    const decoded = JSON.parse(raw) as unknown;
-    if (_isObject(decoded) && Array.isArray(decoded["authorized"])) {
-      const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
-      // A ledger from a different session is another conversation's consent.
-      if (session_id && ledgerSession && ledgerSession !== session_id) {
-        return null;
-      }
-      const at = Date.parse(String(decoded["detected_at"] ?? ""));
-      if (Number.isFinite(at) && now - at > LEDGER_MAX_AGE_MS) {
-        return null;
-      }
-      return {
-        authorized: new Set((decoded["authorized"] as string[]).filter(Boolean) as GitOp[]),
-        present: true,
-      };
+export function commandObject(op: GitOp, command: string): string | null {
+  const patterns = COMMAND_OBJECTS[op];
+  if (!patterns) return null;
+  for (const re of patterns) {
+    const m = new RegExp(re.source, re.flags.replace("g", "")).exec(command);
+    const raw = m?.[1];
+    if (raw) {
+      const value = raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+      if (value) return value;
     }
-  } catch {
-    /* fall through */
   }
   return null;
 }
 
-export interface Decision {
-  exit: number;
-  stdout: string;
-  stderr: string;
-  /**
-   * The op this decision refused, when it refused one.
-   *
-   * `decide` stays pure; `run` turns this into the pending record that lets the
-   * user's answer to the refusal count as authorization for that one op. See
-   * `git_authorization_hook.PENDING_FILE` for why that record exists at all.
-   */
-  blockedOp?: GitOp;
-  /**
-   * The grant target this decision spent, when a standing grant is what allowed
-   * it.
-   *
-   * `decide` stays pure; `run` turns this into the ledger write that marks the
-   * target used. Single use is the property that keeps a grant from being a
-   * standing licence: the user authorized merging PR #1499, once.
-   */
-  consumedTarget?: number;
-}
-
-export function decide(
-  command: string | null,
-  ledger: { authorized: Set<GitOp>; present: boolean; grants?: MergeGrant[] },
-  impact?: string,
-): Decision {
-  if (command === null) {
-    return { exit: EXIT_ALLOW, stdout: "", stderr: "" };
-  }
-  const op = commandOp(command);
-  if (op === null || ledger.authorized.has(op)) {
-    return { exit: EXIT_ALLOW, stdout: "", stderr: "" };
-  }
-
-  // A standing grant is the SECOND way an operation can be authorized, and it
-  // is strictly narrower than the first rather than an escape from it. Only
-  // `pr-merge` can hold one, the command must name its pull request, and that
-  // number must sit unspent in a set the user's own sentence froze. An unnamed
-  // target matches nothing and a spent target matches nothing, so every path
-  // that is not exactly "the user named this PR and it has not been merged yet"
-  // falls through to the clock-bound decision below unchanged (ADR-252).
-  const target = mergeTargetOf(command);
-  if (grantCovers(ledger.grants ?? [], op, target) && target !== null) {
-    return { exit: EXIT_ALLOW, stdout: "", stderr: "", consumedTarget: target };
-  }
-
-  const shown = command.length > 120 ? `${command.slice(0, 117)}…` : command;
-
-  if (BLOCK_OPS.has(op)) {
-    // STAGE 2. The refusal stands either way — what the scan changes is whether
-    // the user has to go read the diff to answer it. `impact` is injected by
-    // `run`, never computed here, so `decide` stays pure and testable without a
-    // repository.
-    const scan = op === "pr-merge" && target !== null && impact ? ` ${impact}` : "";
-    const reason =
-      `Blocked: \`${op}\` with no authorization in this turn's prompt. ` +
-      `This operation is irreversible and non-destructive-by-default already declares it ` +
-      `never-autonomous. Command: ${shown}.${scan} ` +
-      `Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
-    return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}\n`, blockedOp: op };
-  }
-
-  if (WARN_OPS.has(op)) {
-    const reason =
-      `No \`${op}\` authorization found in this turn's prompt (commit-policy: a one-shot ` +
-      `authorization is spent on the operation it named). If the user did authorize it this ` +
-      `turn, proceed; otherwise stop and ask. Command: ${shown}`;
-    return {
-      exit: EXIT_ALLOW,
-      stdout: `${JSON.stringify({ decision: "warn", reason })}\n`,
-      stderr: "",
-    };
-  }
+/** Per-operation object patterns on the COMMAND side. */
+const COMMAND_OBJECTS: Readonly<Record<string, readonly RegExp[]>> = {
+  "prod-data-destroy": [
+    /\bdrop\s+(?:table|database|schema|collection)\s+(?:if\s+exists\s+)?["'`]?([\w.$-]+)/i,
+    /\btruncate\s+(?:table\s+)?["'`]?([\w.$-]+)/i,
+    /\bdelete\s+from\s+["'`]?([\w.$-]+)/i,
+    /\bs3:\/\/([\w.-]+)/i,
+    /--table-name[= ]["'`]?([\w.-]+)/i,
+  ],
+  "external-send": [
+    /\bhttps?:\/\/([^\s/"'`]+)/i,
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/,
+  ],
+  "money-movement": [
+    /--customer[= ]["'`]?([\w.-]+)/i,
+    /--amount[= ]["'`]?([\d.,]+)/i,
+    /\b(\d[\d.,]*)\s*(?:eur|usd)\b/i,
+  ],
+};
 
-  return { exit: EXIT_ALLOW, stdout: "", stderr: "" };
-}
-
-export function run(stdin_text: string, options: { consumer_root: string }): number {
-  let envelope: JsonObject = {};
-  if (stdin_text.trim()) {
-    try {
-      const decoded = JSON.parse(stdin_text) as unknown;
-      if (_isObject(decoded)) {
-        envelope = decoded;
-      }
-    } catch {
-      return EXIT_ALLOW;
-    }
-  }
-  const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const command = extractCommand(envelope);
-  const ledger = _loadLedger(options.consumer_root, session_id, Date.now());
-
-  // STAGE 2 runs only on the path where it can change something: a merge that is
-  // ABOUT to be refused. Not on an allowed merge (nothing to tell the user), not
-  // on an op whose target the command does not name, and never on publish or
-  // release — a scan costs a diff read, and spending one where it cannot change
-  // the outcome is latency in the user's critical path for nothing.
-  let impact: string | undefined;
-  const stage1 = command === null ? null : commandOp(command);
-  const stage2Target = command === null ? null : mergeTargetOf(command);
-  if (
-    stage1 === "pr-merge" &&
-    stage2Target !== null &&
-    !ledger.authorized.has("pr-merge") &&
-    !grantCovers(ledger.grants ?? [], "pr-merge", stage2Target)
-  ) {
-    try {
-      impact = describeImpact(
-        stage2Target,
-        analyseMergeImpact(stage2Target, { cwd: options.consumer_root }),
-      );
-    } catch {
-      // The scan is an enrichment, never a gate. A refusal without it is the
-      // pre-stage-2 message, which is still correct.
-    }
-  }
-
-  const decision = decide(command, ledger, impact);
-  if (decision.consumedTarget !== undefined) {
-    // Spend the target at the moment the merge is actually let through, never
-    // when the grant was minted. A grant the run never reached stays whole, and
-    // a pull request that merged can never be replayed — which is what makes a
-    // force-push back to an already-merged head harmless here.
-    consumeGrantTarget(options.consumer_root, session_id, decision.consumedTarget);
-  }
-  if (decision.blockedOp) {
-    // Record WHAT was refused, so the user's answer to the question this
-    // refusal just told the agent to ask can authorize that one operation.
-    // Best-effort: a failed write degrades to the previous behaviour, where a
-    // numbered answer is unrecordable and the refusal simply repeats.
-    try {
-      atomic_write_json(path.join(options.consumer_root, pendingFileFor(session_id)), {
-        op: decision.blockedOp,
-        session_id,
-        refused_at: new Date().toISOString(),
-      });
-    } catch {
-      /* observability only — see above */
-    }
-  }
-  if (decision.stdout) {
-    process.stdout.write(decision.stdout);
-  }
-  if (decision.stderr) {
-    process.stderr.write(decision.stderr);
-  }
-  return decision.exit;
-}
-
-export function main(argv?: string[]): number {
-  const args = argv ?? process.argv.slice(2);
-  let consumer_root = process.cwd();
-  for (let i = 0; i < args.length; i += 1) {
-    const a = args[i];
-    if (a === "--project-dir" && args[i + 1] !== undefined) {
-      consumer_root = args[i + 1] as string;
-      i += 1;
-    } else if (a !== undefined && a.startsWith("--project-dir=")) {
-      consumer_root = a.slice("--project-dir=".length);
-    }
-  }
-  return run(readHookStdin(), { consumer_root });
-}
-
-declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
-function _isCliEntry(): boolean {
-  if (typeof __AGENT_CONFIG_BUNDLE__ !== "undefined" && __AGENT_CONFIG_BUNDLE__) {
-    return false;
-  }
-  if (process.argv[1] === undefined) {
-    return false;
-  }
-  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) {
-    return true;
-  }
-  try {
-    const here = fs.realpathSync(fileURLToPath(import.meta.url));
-    const argv = fs.realpathSync(path.resolve(process.argv[1]));
-    return here === argv;
-  } catch {
-    return false;
-  }
-}
-
-if (_isCliEntry()) {
-  process.exit(main());
+/** A target only counts inside the API's own range; anything else is no target. */
+function _boundedTarget(digits: string): number | null {
+  const n = Number.parseInt(digits, 10);
+  return Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX ? n : null;
 }