@flowrail/init 0.0.12 → 0.0.14

package/dist/doctor-script.js

@@ -15,12 +15,24 @@ exports.DOCTOR_SCRIPT_FILENAME = 'scripts/check-flowrail.mjs';
 const DOCTOR_SCRIPT_CONTENT = String.raw `#!/usr/bin/env node
 /**
  * FlowRail doctor script — checks that .mcp.json is present and wired,
- * and that runtime source imports are declared in package.json.
+ * that runtime source imports are declared in package.json, that the
+ * hook/server versions are not skewed, and that the write gate can
+ * actually render verdicts (fail-mode posture + verify latency, #338).
  * Generated by @flowrail/init. Safe to commit to the repo.
  * Re-run the installer if this script fails: npx @flowrail/init@latest
  */
 import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
 import { builtinModules } from 'node:module';
 import path from 'node:path';
 
@@ -1270,6 +1282,148 @@ function settingsHasFlowrailStopWiring(settings) {
   return false;
 }
 
+// ---------------------------------------------------------------------------
+// Trusted endpoint/posture extraction. Mirrors @flowrail/hook status-cli's
+// inspectHookWiring rule: a FLOWRAIL_MCP_URL (or FLOWRAIL_FAIL_MODE) prefix
+// is trusted ONLY from a command whose subcommand AND matcher are the
+// installer's exact pairs — a stale or hand-rolled entry under a wrong
+// matcher never fires at runtime, so its baked values must not steer where
+// this script POSTs the bearer token (or what posture it reports).
+// ---------------------------------------------------------------------------
+
+function matcherIsExactly(matcher, expected) {
+  const tokens = new Set(
+    typeof matcher === 'string'
+      ? matcher.split('|').map((t) => t.trim()).filter(Boolean)
+      : [],
+  );
+  return tokens.size === expected.length && expected.every((t) => tokens.has(t));
+}
+
+/** Correctly-paired PreToolUse flowrail-hook commands: pre-write under
+ *  exactly Write|Edit|MultiEdit, pre-bash under exactly Bash. */
+function validatedPreToolUseCommands(settings) {
+  const out = [];
+  const hooks = settings && typeof settings === 'object' ? settings.hooks : null;
+  const groups = hooks && Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+  for (const group of groups) {
+    const entries = group && Array.isArray(group.hooks) ? group.hooks : [];
+    const isWrite = matcherIsExactly(group && group.matcher, ['Write', 'Edit', 'MultiEdit']);
+    const isBash = matcherIsExactly(group && group.matcher, ['Bash']);
+    for (const hook of entries) {
+      const cmd = hook && typeof hook.command === 'string' ? hook.command : '';
+      if (!cmd.includes('flowrail-hook')) continue;
+      if (isWrite && cmd.includes('pre-write')) out.push({ command: cmd, kind: 'pre-write' });
+      if (isBash && cmd.includes('pre-bash')) out.push({ command: cmd, kind: 'pre-bash' });
+    }
+  }
+  return out;
+}
+
+function readSettingsFile(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function doctorSettingsLayers(settings) {
+  const layers = [
+    readSettingsFile(path.join('.claude', 'settings.local.json')),
+    settings,
+  ];
+  const home = process.env.HOME || process.env.USERPROFILE;
+  if (home) layers.push(readSettingsFile(path.join(home, '.claude', 'settings.json')));
+  return layers;
+}
+
+const PROD_MCP_BASE_URL = 'https://api.flowrail.ai';
+
+/**
+ * The MCP base URL the installed hooks actually call. Same precedence as
+ * "flowrail status" (resolveConfiguredMcpBaseUrl): validated hook-command
+ * prefix across local -> project -> user settings, then those settings'
+ * env blocks in the same order, then .mcp.json, then process env — so an
+ * env-configured install does not silently lose the server-side checks,
+ * and a wrong-pair entry cannot redirect the bearer.
+ */
+function resolveDoctorBaseUrl(settings) {
+  const layers = doctorSettingsLayers(settings);
+  for (const layer of layers) {
+    for (const entry of validatedPreToolUseCommands(layer || {})) {
+      const match = entry.command.match(/FLOWRAIL_MCP_URL=(\S+)/);
+      if (match) return match[1].replace(/\/mcp\/?$/, '');
+    }
+  }
+  for (const layer of layers) {
+    const fromSettingsEnv = settingsEnvString(layer, 'FLOWRAIL_MCP_URL');
+    if (fromSettingsEnv && fromSettingsEnv.trim()) {
+      return fromSettingsEnv.trim().replace(/\/mcp\/?$/, '');
+    }
+  }
+  try {
+    const cfg = JSON.parse(readFileSync('.mcp.json', 'utf8'));
+    const url = cfg && cfg.mcpServers && cfg.mcpServers.flowrail ? cfg.mcpServers.flowrail.url : null;
+    if (typeof url === 'string' && url) return url.replace(/\/mcp\/?$/, '');
+  } catch {
+    /* fall through to env */
+  }
+  const fromEnv = (process.env.FLOWRAIL_MCP_URL || '').trim();
+  return fromEnv
+    ? fromEnv.replace(/\/mcp\/?$/, '')
+    : PROD_MCP_BASE_URL;
+}
+
+/**
+ * One bounded MCP POST. The timer covers the WHOLE exchange — fetch AND
+ * body read (a stalled response body must not hang the doctor past the
+ * cap) — and is cleared on every path (a leaked timer keeps the node
+ * process alive for the full cap after the report prints).
+ */
+async function mcpPost(baseUrl, apiKey, requestBody, timeoutMs) {
+  const controller = new AbortController();
+  const abortTimer = setTimeout(() => controller.abort(), timeoutMs);
+  let hardCapTimer;
+  const hardCap = new Promise((resolve) => {
+    hardCapTimer = setTimeout(
+      () => resolve({ transportError: 'operation was aborted after hard cap' }),
+      timeoutMs + 2000,
+    );
+  });
+  const exchange = (async () => {
+    let response;
+    try {
+      response = await fetch(baseUrl.replace(/\/+$/, '') + '/mcp', {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          authorization: 'Bearer ' + apiKey,
+        },
+        body: JSON.stringify(requestBody),
+        signal: controller.signal,
+      });
+    } catch (err) {
+      return { transportError: String((err && err.message) || err) };
+    }
+    try {
+      const body = await response.json();
+      return { httpStatus: response.status, body };
+    } catch (err) {
+      return {
+        httpStatus: response.status,
+        protocolError: String((err && err.message) || err),
+      };
+    }
+  })();
+  try {
+    return await Promise.race([exchange, hardCap]);
+  } finally {
+    clearTimeout(abortTimer);
+    clearTimeout(hardCapTimer);
+  }
+}
+
 /**
  * (b) When the server advertises flowrail_review_app (tools/list) but
  * .claude/settings.json has no FlowRail Stop wiring, whole-app reviews
@@ -1278,42 +1432,27 @@ function settingsHasFlowrailStopWiring(settings) {
  * prefix) and FLOWRAIL_API_KEY; missing either skips silently.
  */
 async function checkStopWiringAgainstServer(settings) {
-  let baseUrl = null;
-  for (const command of flowrailHookCommands(settings)) {
-    const match = command.match(/FLOWRAIL_MCP_URL=(\S+)/);
-    if (match) {
-      baseUrl = match[1];
-      break;
-    }
-  }
+  const baseUrl = resolveDoctorBaseUrl(settings);
   const apiKey = process.env.FLOWRAIL_API_KEY;
   if (!baseUrl || !apiKey) return true;
 
-  let tools;
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 5000);
-    const response = await fetch(baseUrl.replace(/\/+$/, '') + '/mcp', {
-      method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        authorization: 'Bearer ' + apiKey,
-      },
-      body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
-      signal: controller.signal,
-    });
-    clearTimeout(timer);
-    const body = await response.json();
-    tools = body && body.result && Array.isArray(body.result.tools)
-      ? body.result.tools
-      : null;
-  } catch {
+  const out = await mcpPost(
+    baseUrl,
+    apiKey,
+    { jsonrpc: '2.0', id: 1, method: 'tools/list' },
+    5000,
+  );
+  if (out.transportError) {
     console.warn(
       'FlowRail: could not reach the server for tools/list; skipping the ' +
         'Stop-wiring check.',
     );
     return true;
   }
+  const tools =
+    out.body && out.body.result && Array.isArray(out.body.result.tools)
+      ? out.body.result.tools
+      : null;
   if (!tools) return true;
   const advertisesReviewApp = tools.some(
     (tool) => tool && tool.name === 'flowrail_review_app',
@@ -1329,11 +1468,588 @@ async function checkStopWiringAgainstServer(settings) {
   return false;
 }
 
+// ---------------------------------------------------------------------------
+// #338 — write-gate fail-mode posture + verify-latency probe.
+//
+// Everything above can pass while the write gate still allows every code
+// write: under the open fail mode a verifier error/timeout degrades to a
+// SILENT allow, and since #300 the deployed verifier can exceed the hook's
+// inline budget on every call. These two checks make that visible.
+// ---------------------------------------------------------------------------
+
+// MUST mirror @flowrail/hook src/env.ts. The generated doctor is
+// dependency-free, so it carries the same strict resolver and bounds.
+const DEFAULT_VERIFY_TIMEOUT_MS = 30_000;
+const MIN_VERIFY_TIMEOUT_MS = 1_000;
+const MAX_VERIFY_TIMEOUT_MS = 30_000;
+// The probe waits well past the resolver's 30s ceiling so it can report the
+// TRUE round-trip number after the hook itself would have given up.
+const VERIFY_LATENCY_PROBE_CAP_MS = 60000;
+const VERIFY_RETRY_BACKOFF_MS = 1500;
+const PROBE_MARKER_FILE = 'status-probe.json';
+const DIAGNOSTIC_DETAIL_MAX_CHARS = 300;
+
+function failModeSettingsLayers(settings) {
+  return doctorSettingsLayers(settings);
+}
+
+function settingsEnvString(settings, name) {
+  const env = settings && typeof settings === 'object' ? settings.env : null;
+  const raw = env && typeof env === 'object' && !Array.isArray(env)
+    ? env[name]
+    : undefined;
+  return typeof raw === 'string' ? raw : undefined;
+}
+
+const FAIL_MODE_KEYS = [
+  'FLOWRAIL_FAIL_MODE',
+  'FLOWRAIL_DEP_FAIL_MODE',
+  'FLOWRAIL_VERIFY_FAIL_MODE',
+];
+
+function stripSurroundingShellQuotes(value) {
+  if (value.length < 2) return value;
+  const first = value.charAt(0);
+  const last = value.charAt(value.length - 1);
+  return (first === '"' && last === '"') ||
+    (first === "'" && last === "'")
+    ? value.slice(1, -1)
+    : value;
+}
+
+/**
+ * Resolve the same per-variable environment as one installed dispatcher:
+ * validated command prefix, then local/project/user settings env, then the
+ * doctor's process env. Each key resolves independently so a pre-bash-only
+ * dependency incident lever cannot be hidden by the pre-write posture.
+ */
+function effectiveDispatcherFailModeEnv(settings, dispatcher) {
+  const layers = failModeSettingsLayers(settings);
+  const effective = {};
+  for (const key of FAIL_MODE_KEYS) {
+    for (const layer of layers) {
+      for (const entry of validatedPreToolUseCommands(layer || {})) {
+        if (entry.kind !== dispatcher) continue;
+        const match = entry.command.match(
+          new RegExp('(?:^|\\s)' + key + '=(\\S+)'),
+        );
+        if (match) {
+          effective[key] = match[1];
+          break;
+        }
+      }
+      if (effective[key] !== undefined) break;
+    }
+    if (effective[key] !== undefined) continue;
+    for (const layer of layers) {
+      const raw = settingsEnvString(layer, key);
+      if (raw !== undefined) {
+        effective[key] = raw;
+        break;
+      }
+    }
+    if (effective[key] === undefined && process.env[key] !== undefined) {
+      effective[key] = process.env[key];
+    }
+  }
+  return effective;
+}
+
+function parseFailMode(raw) {
+  if (typeof raw !== 'string') return undefined;
+  const normalized = raw.trim().toLowerCase();
+  return normalized === 'open' || normalized === 'closed'
+    ? normalized
+    : undefined;
+}
+
+/** Mirrors @flowrail/hook resolveFailMode's direction-aware legacy map. */
+function resolveDispatcherFailMode(env, dispatcher) {
+  const dedicatedKey =
+    dispatcher === 'verify'
+      ? 'FLOWRAIL_VERIFY_FAIL_MODE'
+      : 'FLOWRAIL_DEP_FAIL_MODE';
+  const dedicated = parseFailMode(env[dedicatedKey]);
+  if (dedicated !== undefined) return dedicated;
+  const legacy = parseFailMode(env.FLOWRAIL_FAIL_MODE);
+  if (dispatcher === 'dep') return legacy;
+  if (legacy === 'closed') return 'closed';
+  if (legacy === 'open') return 'advisory';
+  return undefined;
+}
+
+function reportInvalidDedicatedFailMode(env, dispatcher) {
+  const key =
+    dispatcher === 'verify'
+      ? 'FLOWRAIL_VERIFY_FAIL_MODE'
+      : 'FLOWRAIL_DEP_FAIL_MODE';
+  const raw = env[key];
+  if (raw === undefined || parseFailMode(raw) !== undefined) return;
+  console.warn(
+    'FlowRail: ' + key + '=' + JSON.stringify(raw) +
+      ' is not recognized; falling through to direction-aware ' +
+      'FLOWRAIL_FAIL_MODE handling.',
+  );
+}
+
+function failModePostureMessage(verifyMode, depMode, rawEnv) {
+  const dedicatedRaw = rawEnv.FLOWRAIL_VERIFY_FAIL_MODE;
+  const dedicatedRawTrimmed =
+    typeof dedicatedRaw === 'string' ? dedicatedRaw.trim() : undefined;
+  const dedicatedNormalized = parseFailMode(dedicatedRaw);
+  const invalidDedicatedNote =
+    dedicatedRaw !== undefined && dedicatedNormalized === undefined
+      ? '; FLOWRAIL_VERIFY_FAIL_MODE=' +
+        (dedicatedRawTrimmed || JSON.stringify(dedicatedRaw)) +
+        ' is not a recognised value and was ignored'
+      : '';
+  const depGateNote =
+    depMode === 'closed'
+      ? '; the pre-bash dependency-install adapter is also closed'
+      : depMode === 'open'
+        ? '; the pre-bash dependency-install adapter opens new-dependency checks'
+        : '; pre-bash new-dependency installs still fail closed (ADR-008)';
+
+  if (verifyMode === 'closed') {
+    const origin =
+      dedicatedNormalized === 'closed'
+        ? 'FLOWRAIL_VERIFY_FAIL_MODE=closed'
+        : 'FLOWRAIL_FAIL_MODE=closed';
+    return (
+      'FlowRail: write gate fail mode is CLOSED — verifier errors/timeouts ' +
+      'block code writes (' + origin + ')' + invalidDedicatedNote +
+      depGateNote + '.'
+    );
+  }
+  if (verifyMode === 'advisory') {
+    return (
+      'FlowRail: write gate fail mode is ADVISORY (FLOWRAIL_FAIL_MODE=open) — ' +
+      'verifier errors/timeouts allow code writes with loud stderr and ' +
+      'agent-visible context' + invalidDedicatedNote + depGateNote + '. ' +
+      'Set FLOWRAIL_VERIFY_FAIL_MODE=closed to block instead.'
+    );
+  }
+
+  const legacyRaw =
+    typeof rawEnv.FLOWRAIL_FAIL_MODE === 'string'
+      ? rawEnv.FLOWRAIL_FAIL_MODE.trim()
+      : undefined;
+  const origin =
+    verifyMode === 'open'
+      ? 'FLOWRAIL_VERIFY_FAIL_MODE=open'
+      : dedicatedRawTrimmed
+        ? 'FLOWRAIL_VERIFY_FAIL_MODE=' + dedicatedRawTrimmed +
+          ' is not a recognised value — no valid legacy tightening'
+        : legacyRaw
+          ? 'FLOWRAIL_FAIL_MODE=' + legacyRaw +
+            ' is not a recognised value — treated as unset'
+          : 'default — FLOWRAIL_FAIL_MODE unset';
+  return (
+    'FlowRail: write gate fail mode is OPEN (' + origin + ') — verifier ' +
+    'errors/timeouts allow code writes silently' + depGateNote + '. ' +
+    'Set FLOWRAIL_VERIFY_FAIL_MODE=closed to block instead.'
+  );
+}
+
+function effectiveWriteGateVerifyTimeoutRaw(settings) {
+  const layers = failModeSettingsLayers(settings);
+  for (const layer of layers) {
+    for (const entry of validatedPreToolUseCommands(layer || {})) {
+      if (entry.kind !== 'pre-write') continue;
+      const match = entry.command.match(/FLOWRAIL_VERIFY_TIMEOUT_MS=(\S+)/);
+      if (match) return stripSurroundingShellQuotes(match[1]);
+    }
+  }
+  for (const layer of layers) {
+    const raw = settingsEnvString(layer, 'FLOWRAIL_VERIFY_TIMEOUT_MS');
+    if (raw !== undefined) return raw;
+  }
+  return process.env.FLOWRAIL_VERIFY_TIMEOUT_MS;
+}
+
+function resolveHookVerifyBudgetMs(settings) {
+  const raw = effectiveWriteGateVerifyTimeoutRaw(settings);
+  if (raw === undefined) return DEFAULT_VERIFY_TIMEOUT_MS;
+  const normalized = raw.trim();
+  if (!/^\d+$/.test(normalized) || /^0+$/.test(normalized)) {
+    console.warn(
+      'FlowRail: FLOWRAIL_VERIFY_TIMEOUT_MS=' + normalized +
+        ' is not a valid positive integer millisecond value; using the ' +
+        DEFAULT_VERIFY_TIMEOUT_MS + 'ms default.',
+    );
+    return DEFAULT_VERIFY_TIMEOUT_MS;
+  }
+  const parsed = BigInt(normalized);
+  const min = BigInt(MIN_VERIFY_TIMEOUT_MS);
+  const max = BigInt(MAX_VERIFY_TIMEOUT_MS);
+  const resolvedBigInt = parsed < min ? min : parsed > max ? max : parsed;
+  const resolved = Number(resolvedBigInt);
+  if (resolvedBigInt !== parsed) {
+    console.warn(
+      'FlowRail: FLOWRAIL_VERIFY_TIMEOUT_MS=' + normalized + ' is outside ' +
+        MIN_VERIFY_TIMEOUT_MS + '-' + MAX_VERIFY_TIMEOUT_MS + 'ms; using ' +
+        resolved + 'ms.',
+    );
+  }
+  return resolved;
+}
+
+function reportHookVerifyBudget(settings, hookVerifyBudgetMs) {
+  const raw = effectiveWriteGateVerifyTimeoutRaw(settings);
+  const budgetLabel = hookVerifyBudgetMs / 1000 + 's';
+  if (raw === undefined) {
+    console.log(
+      'FlowRail: Write gate verify budget: ' + budgetLabel +
+        ' (default — FLOWRAIL_VERIFY_TIMEOUT_MS unset).',
+    );
+    return;
+  }
+  const normalized = raw.trim();
+  if (!/^\d+$/.test(normalized) || /^0+$/.test(normalized)) {
+    console.log(
+      'FlowRail: Write gate verify budget: ' + budgetLabel + ' — ' +
+        'FLOWRAIL_VERIFY_TIMEOUT_MS=' + normalized +
+        ' is not a valid positive integer millisecond value; using the ' +
+        budgetLabel + ' default.',
+    );
+    return;
+  }
+  if (BigInt(normalized) !== BigInt(hookVerifyBudgetMs)) {
+    console.log(
+      'FlowRail: Write gate verify budget: ' + budgetLabel + ' — ' +
+        'FLOWRAIL_VERIFY_TIMEOUT_MS=' + normalized +
+        ' was clamped to the supported range.',
+    );
+    return;
+  }
+  console.log(
+    'FlowRail: Write gate verify budget: ' + budgetLabel +
+      ' (FLOWRAIL_VERIFY_TIMEOUT_MS=' + normalized + ').',
+  );
+}
+
+function reportFailModePosture(settings) {
+  const hasWriteGate = failModeSettingsLayers(settings).some(
+    (layer) => validatedPreToolUseCommands(layer || {}).length > 0,
+  );
+  if (!hasWriteGate) return;
+  const verifyEnv = effectiveDispatcherFailModeEnv(settings, 'pre-write');
+  const depEnv = effectiveDispatcherFailModeEnv(settings, 'pre-bash');
+  reportInvalidDedicatedFailMode(verifyEnv, 'verify');
+  reportInvalidDedicatedFailMode(depEnv, 'dep');
+  const verifyMode = resolveDispatcherFailMode(verifyEnv, 'verify');
+  const depMode = resolveDispatcherFailMode(depEnv, 'dep');
+  const message = failModePostureMessage(
+    verifyMode,
+    depMode,
+    verifyEnv,
+  );
+  if (verifyMode === 'closed') console.log(message);
+  else console.warn(message);
+}
+
+function safeDiagnosticDetail(value) {
+  return String(value)
+    .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/[\x00-\x1F\x7F]/g, '')
+    .slice(0, DIAGNOSTIC_DETAIL_MAX_CHARS);
+}
+
+function resolveProbeStateRoot(cwd) {
+  let dir = cwd;
+  for (let depth = 0; depth < 32; depth++) {
+    try {
+      if (statSync(path.join(dir, '.flowrail')).isDirectory()) return dir;
+    } catch {
+      /* keep walking */
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return cwd;
+}
+
+function writeProbeMarker(probeStartedAt) {
+  const root = resolveProbeStateRoot(process.cwd());
+  const dir = path.join(root, '.flowrail');
+  const target = path.join(dir, PROBE_MARKER_FILE);
+  const temp = target + '.' + process.pid + '.tmp';
+  try {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(temp, JSON.stringify({ probeStartedAt }), 'utf8');
+    renameSync(temp, target);
+  } catch {
+    try {
+      unlinkSync(temp);
+    } catch {
+      /* best-effort marker */
+    }
+  }
+}
+
+/**
+ * One real, cache-busted flowrail_verify_code round trip, measured against
+ * the hook budget. Needs the base URL (from the hook command's
+ * FLOWRAIL_MCP_URL prefix) and FLOWRAIL_API_KEY; missing either prints a
+ * visible skip line. Skipped on predev/prebuild:
+ * the probe is an LLM call server-side and up to 60s of wall time — it
+ * must not tax every dev-server start or build. Run the doctor directly
+ * (node scripts/check-flowrail.mjs) to measure.
+ *
+ * An over-budget probe or two consecutive transport failures after the
+ * status route succeeds fail the doctor: both prove the write-time verify
+ * route cannot serve the gate. Each attempt consumes daily verify quota;
+ * exhausting it can hard-block all real writes until UTC rollover.
+ */
+async function checkVerifyLatency(settings, hookVerifyBudgetMs) {
+  const lifecycle = process.env.npm_lifecycle_event;
+  if (lifecycle === 'predev' || lifecycle === 'prebuild') {
+    console.warn(
+      'FlowRail: Verify latency probe skipped (' + lifecycle + ' lifecycle).',
+    );
+    return true;
+  }
+  const baseUrl = resolveDoctorBaseUrl(settings);
+  const apiKey = process.env.FLOWRAIL_API_KEY;
+  if (!apiKey) {
+    console.warn(
+      'FlowRail: Verify latency probe skipped (no API key).',
+    );
+    return true;
+  }
+  // Deliberately NOT derived from the resolved budget: the doctor's probe cap
+  // is a flat 60s so it can still measure a round trip that overruns whatever
+  // budget the gate is configured with. That overrun is the finding.
+  const verifyProbeCapMs = VERIFY_LATENCY_PROBE_CAP_MS;
+
+  // Reachability precheck (cheap, bounded) uses the same status route as
+  // flowrail status. A healthy status response followed by two verify
+  // transport failures is route asymmetry, not a whole-server blip.
+  const pre = await mcpPost(
+    baseUrl,
+    apiKey,
+    {
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'tools/call',
+      params: { name: 'flowrail_get_status', arguments: {} },
+    },
+    5000,
+  );
+  const statusCapturedAt = Date.now();
+  if (pre.transportError || pre.httpStatus !== 200 || !pre.body || !pre.body.result) {
+    // 401/403 (bad key) also lands here — the doctor cannot probe.
+    console.warn(
+      'FlowRail: server not probeable (flowrail_get_status failed); skipping the ' +
+        'write-gate latency check.',
+    );
+    return true;
+  }
+
+  const verifyRequest = () => ({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'tools/call',
+    params: {
+      name: 'flowrail_verify_code',
+      arguments: {
+        // Unique per run: the server's verifier cache short-circuits on
+        // identical content, which would measure the cache, not the model.
+        content:
+          '// FlowRail doctor latency probe ' + randomUUID() +
+          ' — benign fixture, unique per run.\n' +
+          'export const flowrailLatencyProbe = true;\n',
+        file_path: 'flowrail-latency-probe.ts',
+      },
+    },
+  });
+  console.log(
+    'FlowRail: Verify latency probe uses up to two daily cache-miss verifies; ' +
+      'repeated runs can exhaust quota and block all code writes until UTC rollover.',
+  );
+  const serverNowRaw = pre.body.result.server_now;
+  const serverNow = typeof serverNowRaw === 'string' ? Date.parse(serverNowRaw) : NaN;
+  let startedAt = Date.now();
+  let probeStartedAt = Number.isNaN(serverNow)
+    ? null
+    : new Date(serverNow + (startedAt - statusCapturedAt)).toISOString();
+  if (probeStartedAt === null) {
+    console.warn(
+      'FlowRail: latency-probe marker not written (server time unavailable; ' +
+        'cannot safely align local and server timestamps).',
+    );
+  }
+  let out = await mcpPost(
+    baseUrl,
+    apiKey,
+    verifyRequest(),
+    verifyProbeCapMs,
+  );
+  let elapsedMs = Date.now() - startedAt;
+  const retryableTransport =
+    (out.transportError &&
+      elapsedMs < verifyProbeCapMs &&
+      !/operation was aborted/i.test(out.transportError)) ||
+    out.httpStatus === 429 ||
+    (out.httpStatus >= 500 && out.httpStatus <= 599);
+  if (retryableTransport) {
+    await new Promise((resolve) => setTimeout(resolve, VERIFY_RETRY_BACKOFF_MS));
+    startedAt = Date.now();
+    probeStartedAt = Number.isNaN(serverNow)
+      ? null
+      : new Date(serverNow + (startedAt - statusCapturedAt)).toISOString();
+    out = await mcpPost(
+      baseUrl,
+      apiKey,
+      verifyRequest(),
+      verifyProbeCapMs,
+    );
+    elapsedMs = Date.now() - startedAt;
+  }
+  if (probeStartedAt !== null) writeProbeMarker(probeStartedAt);
+  const elapsedLabel = (elapsedMs / 1000).toFixed(1) + 's';
+  const budgetLabel = hookVerifyBudgetMs / 1000 + 's';
+  const posture = resolveDispatcherFailMode(
+    effectiveDispatcherFailModeEnv(settings, 'pre-write'),
+    'verify',
+  );
+  const consequence =
+    posture === 'closed'
+      ? 'with the closed verifier posture the write gate will block every code write (issue #300)'
+      : posture === 'advisory'
+        ? 'the write gate will allow every code write with advisory context (issue #300)'
+        : 'the write gate is failing open on every code write (issue #300)';
+
+  if (out.transportError) {
+    if (
+      elapsedMs >= verifyProbeCapMs ||
+      /operation was aborted/i.test(out.transportError)
+    ) {
+      console.error(
+        'FlowRail: no verify verdict within ' + budgetLabel + ' (gave up after ' +
+          elapsedLabel + ') — ' + consequence + '.',
+      );
+      return false;
+    }
+    console.error(
+      'FlowRail: verify-latency probe failed after two transport errors while ' +
+        'flowrail_get_status was healthy (' +
+        safeDiagnosticDetail(out.transportError) + ').',
+    );
+    return false;
+  }
+  if (
+    out.httpStatus === 429 ||
+    (out.httpStatus >= 500 && out.httpStatus <= 599)
+  ) {
+    console.error(
+      'FlowRail: verify-latency probe failed after two transport errors while ' +
+        'flowrail_get_status was healthy ' +
+        '(HTTP ' + out.httpStatus + '); retry later.',
+    );
+    return false;
+  }
+
+  // The server answered. A JSON-RPC {error} (the server's only encoding
+  // for a crashed verify tool), a non-200, or a result without a
+  // recognisable status (contract mismatch — the real gate BLOCKS every
+  // write on it, ADR-005) is a broken verify path on a reachable server:
+  // the gate cannot render verdicts, and that must be loud, not a skip.
+  const protocolError = out.protocolError;
+  const rpcError = out.body && out.body.error;
+  const result = out.body ? out.body.result : null;
+  const structured =
+    result && result.structuredContent && typeof result.structuredContent === 'object'
+      ? result.structuredContent
+      : null;
+  // Match the write gate's unflattened body.result contract: top-level
+  // status wins. structuredContent is compatibility fallback only and
+  // must not override a status the gate itself will act on.
+  const status = result
+    ? result.status ?? (structured ? structured.status : undefined)
+    : undefined;
+  if (
+    out.httpStatus !== 200 ||
+    protocolError ||
+    rpcError ||
+    (status !== 'pass' && status !== 'fail')
+  ) {
+    const detail = protocolError
+      ? 'invalid MCP response: ' + safeDiagnosticDetail(protocolError)
+      : rpcError
+      ? 'MCP error ' + safeDiagnosticDetail(rpcError.code) + ': ' +
+        safeDiagnosticDetail(rpcError.message)
+      : out.httpStatus !== 200
+        ? 'HTTP ' + out.httpStatus
+        : 'unrecognised verify result';
+    const contractMismatch =
+      result &&
+      status !== 'pass' &&
+      status !== 'fail' &&
+      out.httpStatus === 200 &&
+      !protocolError &&
+      !rpcError;
+    const brokenConsequence =
+      contractMismatch
+        ? 'writes are BLOCKED regardless of fail mode (ADR-005).'
+        : consequence + '.';
+    console.error(
+      'FlowRail: the verify path is broken even though the server is ' +
+        'reachable (' + detail + ') — the write gate cannot render verdicts; ' +
+        brokenConsequence,
+    );
+    return false;
+  }
+  // Synthetic verdicts (quota exhausted / credential unavailable / cost
+  // cap) are produced WITHOUT invoking the judge, so they arrive fast —
+  // reporting their round trip as verifier latency would be a false
+  // green. Sentinel ids: leading underscore (_quota_exceeded,
+  // _credential_unavailable) or cost_cap_exceeded; real guardrail ids
+  // are kebab-case.
+  const structuredVerdicts = structured ? structured.per_guardrail_verdicts : undefined;
+  const verdicts = Array.isArray(structuredVerdicts)
+    ? structuredVerdicts
+    : Array.isArray(result.per_guardrail_verdicts)
+      ? result.per_guardrail_verdicts
+      : [];
+  for (const v of verdicts) {
+    const gid = v && typeof v.guardrail_id === 'string' ? v.guardrail_id : '';
+    if (gid.charAt(0) === '_' || gid === 'cost_cap_exceeded') {
+      console.warn(
+        'FlowRail: verify-latency probe inconclusive — the server answered ' +
+          'with a synthetic verdict (' +
+          safeDiagnosticDetail((v && v.reason_summary) || gid) +
+          '); the latency of the real verifier was not measured.',
+      );
+      return true;
+    }
+  }
+  if (elapsedMs > hookVerifyBudgetMs) {
+    console.error(
+      'FlowRail: verify round trip ' + elapsedLabel + ' exceeds the ' +
+        budgetLabel + ' hook write-gate budget (FLOWRAIL_VERIFY_TIMEOUT_MS) — ' +
+        consequence + '.',
+    );
+    return false;
+  }
+  console.log(
+    'FlowRail: verify round trip ' + elapsedLabel + ' (within the ' +
+      budgetLabel + ' hook write-gate budget).',
+  );
+  return true;
+}
+
 const claudeSettings = readClaudeSettings();
+const effectiveClaudeSettings = claudeSettings || {};
+reportFailModePosture(effectiveClaudeSettings);
+const hookVerifyBudgetMs = resolveHookVerifyBudgetMs(effectiveClaudeSettings);
+reportHookVerifyBudget(effectiveClaudeSettings, hookVerifyBudgetMs);
 if (claudeSettings !== null) {
   if (!checkHookSubcommandCapabilities(claudeSettings)) ok = false;
   if (!(await checkStopWiringAgainstServer(claudeSettings))) ok = false;
 }
+if (!(await checkVerifyLatency(effectiveClaudeSettings, hookVerifyBudgetMs))) ok = false;
 
 if (!ok) process.exit(1);
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowrail/init",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "description": "One-shot FlowRail installer for Claude Code. Wires PreToolUse hooks, MCP server config, and skill markdown into a tester's repo, then probes the FlowRail server with their bearer.",
   "license": "UNLICENSED",
   "private": false,