@event4u/agent-config 9.25.0 → 9.26.0

package/src/scripts/hooks/block_unauthorized_git.ts

@@ -47,7 +47,14 @@ import { readHookStdin } from "./hook_stdin.js";
 import { STATE_FILE, type GitOp } from "../git_authorization_hook.js";
 
 const EXIT_ALLOW = 0;
-const EXIT_BLOCK = 2;
+// MUST equal dispatch_hook.EXIT_BLOCK. The dispatcher's internal ladder is
+// 0 allow / 1 block / 2 warn — NOT the 2-means-block shape a PreToolUse guard
+// reads naturally from Claude's own native contract. This constant was 2 when
+// this gate first shipped, so the dispatcher reduced every refusal to a WARN
+// and the gate emitted advisory context while the operation went through.
+// Pinned against the dispatcher's export by
+// tests/hooks/concern_block_exit_parity.test.ts.
+const EXIT_BLOCK = 1;
 
 type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
 type JsonObject = { [k: string]: JsonValue };
@@ -72,19 +79,34 @@ export const WARN_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
   "branch",
 ]);
 
+/**
+ * Command → operation. Order matters: the most specific pattern wins, so
+ * `git push --tags` is a tag push and not a plain push.
+ */
+// `git`/`gh` accept global options before the subcommand (`git -C dir push`,
+// `git --git-dir=x push`), and each of those was a silent bypass of the whole
+// gate. `G` allows any run of them.
+const G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
+
 /**
  * Command → operation. Order matters: the most specific pattern wins, so
  * `git push --tags` is a tag push and not a plain push.
  */
 const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
-  { op: "publish", re: /\b(npm|pnpm|yarn)\s+publish\b/i },
-  { op: "release", re: /\bgh\s+release\s+create\b/i },
-  { op: "tag", re: /\bgit\s+push\b[^\n;|&]*--tags\b|\bgit\s+push\b[^\n;|&]*\brefs\/tags\//i },
-  { op: "pr-merge", re: /\bgh\s+pr\s+merge\b/i },
-  { op: "pr-create", re: /\bgh\s+pr\s+create\b/i },
-  { op: "push", re: /\bgit\s+push\b/i },
-  { op: "commit", re: /\bgit\s+commit\b/i },
-  { op: "branch", re: /\bgit\s+(checkout\s+-b|switch\s+-c)\b/i },
+  { op: "publish", re: new RegExp(`\\b(npm|pnpm|yarn)\\s+${G}publish\\b`, "i") },
+  { op: "release", re: /\bgh\s+release\s+create\b|\bgh\s+api\b[^\n]*\/releases\b/i },
+  {
+    op: "tag",
+    re: new RegExp(
+      `\\bgit\\s+${G}push\\b[^\\n;|&]*(--tags|--follow-tags|refs\\/tags\\/)`,
+      "i",
+    ),
+  },
+  { op: "pr-merge", re: /\bgh\s+pr\s+merge\b|\bgh\s+api\b[^\n]*\/pulls\/\d+\/merge\b/i },
+  { op: "pr-create", re: /\bgh\s+pr\s+create\b|\bgh\s+api\b[^\n]*-X\s+POST[^\n]*\/pulls\b/i },
+  { op: "push", re: new RegExp(`\\bgit\\s+${G}push\\b`, "i") },
+  { op: "commit", re: new RegExp(`\\bgit\\s+${G}commit\\b`, "i") },
+  { op: "branch", re: new RegExp(`\\bgit\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") },
 ];
 
 const COMMAND_TOOLS: ReadonlySet<string> = new Set([
@@ -121,21 +143,112 @@ export function extractCommand(envelope: JsonObject): string | null {
   return null;
 }
 
-/** Classify a shell command into the operation it performs, if any. */
+/**
+ * Split a shell command into the segments that are actually INVOKED.
+ *
+ * A substring match over the whole command string is wrong, and measurably so:
+ * the round-2 self-scan found this gate firing on two commands of the auditor's
+ * own session whose only sin was carrying `npm publish` inside a `printf`
+ * argument as test data. Blocking a command because it mentions an operation is
+ * the worst false-positive shape a refusing gate can have.
+ *
+ * So: split on shell separators, drop leading env assignments, and keep the
+ * segment only from its command word. `printf '{"cmd":"npm publish"}'` yields a
+ * segment starting at `printf` and never matches.
+ *
+ * Quoted payloads are NOT simply discarded — `sh -c "npm publish"` really does
+ * publish. Those are unwrapped and re-split, so closing the false positive does
+ * not open a bypass.
+ */
+export function invokedSegments(command: string, depth = 0): string[] {
+  if (depth > 3) {
+    return [];
+  }
+  const out: string[] = [];
+  // Strip heredoc bodies before splitting: a line inside `<<EOF … EOF` is data
+  // being written, not a command being run, but after a newline split it looks
+  // exactly like an invocation.
+  const withoutHeredocs = command.replace(
+    /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[\s\S]*?^\s*\2\s*$/gm,
+    "<<HEREDOC",
+  );
+  for (const raw of withoutHeredocs.split(/\n|;|&&|\|\||\||&/)) {
+    let seg = raw.trim();
+    if (!seg) {
+      continue;
+    }
+    // Drop leading env assignments: `FOO=bar BAZ=1 npm publish`.
+    seg = seg.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+)+/, "");
+    // Unwrap `sh -c '<payload>'` / `bash -c "<payload>"` and recurse.
+    const wrapped = /^(?:\S*\/)?(?:ba|z|k)?sh\s+-[a-z]*c\s+(?:"([^"]*)"|'([^']*)'|(\S+))/.exec(seg);
+    if (wrapped) {
+      out.push(...invokedSegments(wrapped[1] ?? wrapped[2] ?? wrapped[3] ?? "", depth + 1));
+      continue;
+    }
+    out.push(seg);
+  }
+  return out;
+}
+
+/**
+ * Classify a shell command into the operation it performs, if any.
+ *
+ * Matches per invoked segment and only when the segment BEGINS with the tool —
+ * a mention inside an argument is not an invocation.
+ */
 export function commandOp(command: string): GitOp | null {
-  for (const { op, re } of COMMAND_OPS) {
-    if (re.test(command)) {
-      return op;
+  // Every segment is classified and the MOST SEVERE result wins. Returning the
+  // first match let `npm publish && git push --tags` pass its tag push
+  // unchecked once `publish` was authorized.
+  let found: GitOp | null = null;
+  for (const seg of invokedSegments(command)) {
+    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg)) {
+      continue;
+    }
+    for (const { op, re } of COMMAND_OPS) {
+      if (re.test(seg)) {
+        if (BLOCK_OPS.has(op)) {
+          return op;
+        }
+        found ??= op;
+        break;
+      }
     }
   }
-  return null;
+  return found;
 }
 
-function _loadLedger(consumer_root: string): { authorized: Set<GitOp>; present: boolean } {
+/** A ledger older than this is not "this turn" under any reading. */
+export const LEDGER_MAX_AGE_MS = 30 * 60 * 1000;
+
+/**
+ * Load the ledger, and refuse one that does not belong to THIS session and
+ * THIS turn.
+ *
+ * The header claims the gate answers "did the user authorize this THIS turn?".
+ * Before this check it answered "did anyone, in any session, ever authorize
+ * it?" — the file records `session_id` and `detected_at` and neither was read.
+ * Two concurrent worktrees share one state root, so session A typing
+ * `mach den release` authorized session B.
+ */
+function _loadLedger(
+  consumer_root: string,
+  session_id: string,
+  now: number,
+): { authorized: Set<GitOp>; present: boolean } {
   try {
     const raw = fs.readFileSync(path.join(consumer_root, STATE_FILE), "utf8");
     const decoded = JSON.parse(raw) as unknown;
     if (_isObject(decoded) && Array.isArray(decoded["authorized"])) {
+      const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+      // A ledger from a different session is another conversation's consent.
+      if (session_id && ledgerSession && ledgerSession !== session_id) {
+        return { authorized: new Set<GitOp>(), present: false };
+      }
+      const at = Date.parse(String(decoded["detected_at"] ?? ""));
+      if (Number.isFinite(at) && now - at > LEDGER_MAX_AGE_MS) {
+        return { authorized: new Set<GitOp>(), present: false };
+      }
       return {
         authorized: new Set((decoded["authorized"] as string[]).filter(Boolean) as GitOp[]),
         present: true,
@@ -203,7 +316,11 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
       return EXIT_ALLOW;
     }
   }
-  const decision = decide(extractCommand(envelope), _loadLedger(options.consumer_root));
+  const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
+  const decision = decide(
+    extractCommand(envelope),
+    _loadLedger(options.consumer_root, session_id, Date.now()),
+  );
   if (decision.stdout) {
     process.stdout.write(decision.stdout);
   }

package/src/scripts/hooks/design_slop_hook.ts

@@ -71,8 +71,20 @@ function enabled(root: string): boolean {
   return false;
 }
 
+/**
+ * The dispatcher nests the host-shaped tool fields under `payload`; a bare host
+ * invocation puts them at the top level. Read both — this hook shipped reading
+ * only the top level, so under the dispatcher `extract` always returned null and
+ * the concern was silent on every write it was supposed to flag.
+ */
+function _unwrap(envelope: JsonObject): JsonObject {
+  const inner = envelope["payload"];
+  return isObject(inner) ? inner : envelope;
+}
+
 /** Best-effort: pull (toolName, filePath, proposedContent) from the PreToolUse envelope. */
-function extract(envelope: JsonObject): { file: string; content: string } | null {
+function extract(outer: JsonObject): { file: string; content: string } | null {
+  const envelope = _unwrap(outer);
   const ti = envelope["tool_input"] ?? envelope["toolInput"] ?? envelope["input"];
   if (!isObject(ti)) return null;
   const fileVal = ti["file_path"] ?? ti["path"] ?? ti["filePath"];

package/src/scripts/hooks/dispatch_hook.ts

@@ -231,6 +231,79 @@ interface ConcernDef extends JsonObject {
   name: string;
 }
 
+/**
+ * The tool name the host reported for this event, or `""`.
+ *
+ * Only tool events carry one. Read defensively: the payload is host-shaped and
+ * a missing / non-string field must degrade to "unknown tool", never throw.
+ */
+export function _payload_tool_name(envelope: JsonObject): string {
+  const payload = envelope["payload"];
+  if (!_isObject(payload)) {
+    return "";
+  }
+  const raw = payload["tool_name"];
+  return typeof raw === "string" ? raw : "";
+}
+
+/**
+ * Per-concern tool filter — the `tools:` key.
+ *
+ * 13 concerns fire on EVERY tool call (6 pre + 7 post), and three of them
+ * already re-read `tool_name` and return early — after the dispatcher has
+ * already spawned the work. A concern may now declare which tools it cares
+ * about, and the dispatcher skips it in-process for everything else.
+ *
+ * ## Why the filter is here and not in the generated host config
+ *
+ * The obvious alternative is a host `matcher` per concern group. Rejected on
+ * two measurements:
+ *
+ * - `build_claude_hook_matrix` collapses each event to ONE command string, and
+ *   `claude_hook_matrix_parity.test.ts` asserts exactly one group per event with
+ *   exactly one command. Per-concern matchers mean per-concern groups, which
+ *   breaks that parity contract for a filter the dispatcher can apply itself.
+ * - A host matcher would only help the two hosts that support one (Claude,
+ *   Gemini). The in-process skip helps all eight platforms in the manifest.
+ *
+ * ## What this does NOT claim
+ *
+ * It does not claim a latency win. The measured hook cost that was fixed was
+ * the *invocation path* (~370 of ~450–500 ms was eager CLI imports); nothing in
+ * the tree measures how much of the current ~84 ms p95 the concern bodies
+ * account for. `bench_hook_latency` reads the manifest, so the claim is
+ * benchable — it is simply not yet benched, and is therefore not asserted.
+ * What IS true without a benchmark: a concern that cannot fire on a tool no
+ * longer runs at all, instead of running and returning early.
+ *
+ * Absent `tools:` → the concern runs on every event, unchanged. `"*"` is the
+ * explicit form of the same thing. Matching is exact on the host's `tool_name`.
+ * A non-tool event (session_start, stop, …) reports no tool name and is NEVER
+ * filtered — a lifecycle concern must not be silently skipped by a key that
+ * only describes tool events.
+ */
+export function _concern_matches_tool(concern: JsonObject, tool_name: string): boolean {
+  const raw = concern["tools"];
+  if (raw === undefined || raw === null) {
+    return true;
+  }
+  if (!Array.isArray(raw) || raw.length === 0) {
+    // A malformed or empty filter must not silence a concern — fail toward
+    // running it, the same direction `fail_closed` guards take.
+    return true;
+  }
+  const names = raw.filter((t): t is string => typeof t === "string");
+  if (names.length === 0 || names.includes("*")) {
+    return true;
+  }
+  // No tool in the payload → not a tool event (or a host that omits it).
+  // Either way this key cannot decide, so it does not.
+  if (tool_name === "") {
+    return true;
+  }
+  return names.includes(tool_name);
+}
+
 /**
  * Return the ordered concern definitions for (platform, event).
  */
@@ -995,7 +1068,13 @@ export function main(argv?: string[]): number {
   // fixed-field schema (PII-exclusion-by-construction), and a concern's raw
   // stderr is free-form content. This array is in-memory only.
   const concern_messages: Array<{ rc: number; text: string }> = [];
+  // Per-concern `tools:` filter (see _concern_matches_tool). Applied here so it
+  // is one place, after the envelope exists and before any concern is spawned.
+  const tool_name = _payload_tool_name(envelope);
   for (const concern of concerns) {
+    if (!_concern_matches_tool(concern, tool_name)) {
+      continue;
+    }
     const concern_started = _now_iso();
     const { rc: rawRcResult, stderr: stderr_text, stdout: stdout_text, duration_ms } =
       _run_concern(concern, envelope);
@@ -1032,8 +1111,24 @@ export function main(argv?: string[]): number {
       typeof reply["reason"] === "string" && (reply["reason"] as string).trim()
         ? (reply["reason"] as string).trim()
         : stderr_text.trim();
-    if (stated) {
-      concern_messages.push({ rc, text: stated });
+    // `additional_context` — the longer, model-facing half of a concern's
+    // reply. The contract has promised since v1 that it is forwarded and
+    // "concatenated with \n\n separators"
+    // (docs/contracts/hook-architecture-v1.md § reply shape), but nothing here
+    // ever read the key: `reason` is capped at ~200 chars by convention and is
+    // written for a human reading stderr, so every concern that put its
+    // actionable instruction in `additional_context` delivered it nowhere.
+    // Found 2026-08-06 by tracing why the language-mirror pin reached the model
+    // on no path; `pr_url_reminder` had the same silent gap, and its own header
+    // calls `additional_context` "what surfaces back to the model".
+    const extra =
+      typeof reply["additional_context"] === "string" &&
+      (reply["additional_context"] as string).trim()
+        ? (reply["additional_context"] as string).trim()
+        : "";
+    const message = [stated, extra].filter(Boolean).join("\n\n");
+    if (message) {
+      concern_messages.push({ rc, text: message });
     }
     if (
       args.event === "session_start" &&

package/src/scripts/hooks/evidence_independence.ts

@@ -52,7 +52,14 @@ import { atomic_write_json } from "./state_io.js";
 import { readHookStdin } from "./hook_stdin.js";
 
 const EXIT_ALLOW = 0;
-const EXIT_BLOCK = 2;
+// MUST equal dispatch_hook.EXIT_BLOCK. The dispatcher's internal ladder is
+// 0 allow / 1 block / 2 warn — NOT the 2-means-block shape a PreToolUse guard
+// reads naturally from Claude's own native contract. This constant was 2 when
+// this gate first shipped, so the dispatcher reduced every refusal to a WARN
+// and the gate emitted advisory context while the operation went through.
+// Pinned against the dispatcher's export by
+// tests/hooks/concern_block_exit_parity.test.ts.
+const EXIT_BLOCK = 1;
 
 export const STATE_FILE = path.join("agents", "state", "evidence-dispatch.json");
 
@@ -77,7 +84,7 @@ const DISPATCH_TOOLS: ReadonlySet<string> = new Set([
 
 /** The dispatch is an EVALUATION of work rather than ordinary fan-out. */
 const EVALUATION_RE =
-  /\b(review|reviewer|audit|auditor|judge|verdict|blind[- ]pass|blind review|adversarial|critique|assess(ment)?|verify (my|the) (work|change|diff|implementation)|find (any )?(bugs|issues|defects|problems) in (my|the))\b/i;
+  /\b(review|reviewer|audit|auditor|judge|verdict|blind[- ]pass|blind review|adversarial|critique|assess(ment)?|verify (my|the) (work|change|diff|implementation)|find (any )?(bugs|issues|defects|problems) in (my|the)|pr(ü|ue)f(e|ung)?|begutachte|gutachten|bewerte|(gegen)?check(e)?|durchsicht|review(e|iere))\b/i;
 
 /**
  * Verdict pre-loading. Each pattern is a phrase that tells the evaluator what
@@ -85,6 +92,16 @@ const EVALUATION_RE =
  * fabricated honest-null.
  */
 const PRELOADED_VERDICT_RE = [
+  // German — the operator writes German, and an English-only list meant no
+  // German dispatch was ever screened at all.
+  /\bich erwarte (hier )?(keine|nichts)\b/i,
+  /\b(du )?(wirst|solltest) (hier )?nichts finden\b/i,
+  /\bbest(ä|ae)tige (nur|kurz)\b/i,
+  /\b(ist|sollte) (wahrscheinlich|vermutlich|sicher) (sauber|korrekt|in ordnung|fine)\b/i,
+  /\bkeine findings? (erwartet|zu erwarten)\b/i,
+  // English paraphrases of the audited construct.
+  /\bi am confident there is nothing\b/i,
+  /\ba clean pass is the likely\b/i,
   /\bno[- ]findings? (is|are) (expected|welcome|fine|acceptable|the likely)/i,
   /\b(you )?(should|will|probably) find (nothing|no (issues|problems|bugs|findings))/i,
   /\bconfirm (that )?there (are|is) no\b/i,
@@ -162,6 +179,20 @@ interface DispatchState extends JsonObject {
   evaluations: JsonValue[];
 }
 
+/** The current user turn's stamp, or "" when no ledger exists yet. */
+function _ledgerStamp(consumer_root: string): string {
+  try {
+    const raw = fs.readFileSync(
+      path.join(consumer_root, "agents", "state", "git-authorization.json"),
+      "utf8",
+    );
+    const d = JSON.parse(raw) as Record<string, unknown>;
+    return typeof d["detected_at"] === "string" ? d["detected_at"] : "";
+  } catch {
+    return "";
+  }
+}
+
 function _load(target: string): DispatchState {
   try {
     const decoded = JSON.parse(fs.readFileSync(target, "utf8")) as unknown;
@@ -258,10 +289,13 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
   const state = _load(target);
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
 
-  // The authorization ledger owns turn boundaries; this guard reads its own
-  // marker so it never depends on another concern's ordering.
-  const turnMarker =
-    typeof envelope["turn_id"] === "string" ? (envelope["turn_id"] as string) : session_id;
+  // Turn boundary. `turn_id` does NOT exist in the production envelope — the
+  // dispatcher never sets it, so the original marker fell through to
+  // `session_id` and the counter was session-scoped: one self-review anywhere
+  // in a session blocked every later one. The only per-user-turn stamp that
+  // actually exists is `detected_at` in the authorization ledger, which
+  // `git_authorization_hook` rewrites on every `user_prompt_submit`.
+  const turnMarker = `${session_id}:${_ledgerStamp(options.consumer_root)}`;
   if (state.session_id !== turnMarker) {
     state.session_id = turnMarker;
     state.turn_started_at = new Date().toISOString();