@gatebolt/cli 0.7.0 → 0.9.0

package/dist/agents/claude-code.js

@@ -5,27 +5,55 @@ const CLAUDE_DIR = ".claude";
 const SETTINGS_FILE = "settings.json";
 const PRE_TOOL_USE = "PreToolUse";
 const STOP = "Stop";
+const USER_PROMPT_SUBMIT = "UserPromptSubmit";
 const EDIT_TOOLS_MATCHER = "Edit|Write|NotebookEdit";
 const COMMAND_TYPE = "command";
 const GUARD_SUB = "guard";
 const POST_TURN_SUB = "post-turn";
+const PROMPT_SUB = "prompt";
 const ENFORCE_STRICT = "strict";
 const ENFORCE_LENIENT = "lenient";
+const DENY_DECISION = "deny";
+export const MISSING_CLI_MESSAGE = "GateBolt: CLI not found on PATH - install it: npm i -g @gatebolt/cli";
+function missingCliDenyPayload() {
+    return JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: PRE_TOOL_USE,
+            permissionDecision: DENY_DECISION,
+            permissionDecisionReason: MISSING_CLI_MESSAGE,
+        },
+    });
+}
+function guardCommand(cli) {
+    return (`command -v ${cli} >/dev/null 2>&1 && exec ${cli} hook ${GUARD_SUB} || ` +
+        `{ [ "$GATEBOLT_ENFORCE" = ${ENFORCE_STRICT} ] && ` +
+        `{ echo "${MISSING_CLI_MESSAGE}" >&2; ` +
+        `printf '%s\\n' '${missingCliDenyPayload()}'; }; exit 0; }`);
+}
+function advisoryCommand(cli, sub) {
+    return (`command -v ${cli} >/dev/null 2>&1 && exec ${cli} hook ${sub} || ` +
+        `echo "${MISSING_CLI_MESSAGE}" >&2`);
+}
 export function mergeSettings(existing, opts) {
     const settings = structuredClone(existing);
     const hooks = plainObject(settings.hooks, "hooks");
     settings.hooks = hooks;
     let changed = false;
     const preToolUse = arrayField(hooks[PRE_TOOL_USE], `hooks.${PRE_TOOL_USE}`);
-    if (ensureHookCommand(preToolUse, `hook ${GUARD_SUB}`, opts.command, EDIT_TOOLS_MATCHER)) {
+    if (ensureHookCommand(preToolUse, `hook ${GUARD_SUB}`, guardCommand(opts.command), EDIT_TOOLS_MATCHER)) {
         changed = true;
     }
     hooks[PRE_TOOL_USE] = preToolUse;
     const stop = arrayField(hooks[STOP], `hooks.${STOP}`);
-    if (ensureHookCommand(stop, `hook ${POST_TURN_SUB}`, opts.command)) {
+    if (ensureHookCommand(stop, `hook ${POST_TURN_SUB}`, advisoryCommand(opts.command, POST_TURN_SUB))) {
         changed = true;
     }
     hooks[STOP] = stop;
+    const userPrompt = arrayField(hooks[USER_PROMPT_SUBMIT], `hooks.${USER_PROMPT_SUBMIT}`);
+    if (ensureHookCommand(userPrompt, `hook ${PROMPT_SUB}`, advisoryCommand(opts.command, PROMPT_SUB))) {
+        changed = true;
+    }
+    hooks[USER_PROMPT_SUBMIT] = userPrompt;
     if (opts.enforce === ENFORCE_STRICT) {
         const env = plainObject(settings.env, "env");
         settings.env = env;
@@ -71,11 +99,8 @@ function arrayField(value, label) {
         return value;
     throw new Error(`${SETTINGS_FILE}: "${label}" must be a JSON array.`);
 }
-// Update our command in place when it drifts, not just add-when-absent: a
-// re-run of `init` that left a stale command would silently disable the guard.
-function ensureHookCommand(entries, suffix, command, matcher) {
-    const desired = `${command} ${suffix}`;
-    const existing = findGateboltHook(entries, suffix);
+function ensureHookCommand(entries, marker, desired, matcher) {
+    const existing = findGateboltHook(entries, marker);
     if (existing) {
         if (existing.command === desired)
             return false;
@@ -86,14 +111,14 @@ function ensureHookCommand(entries, suffix, command, matcher) {
     entries.push(matcher === undefined ? { hooks: [hook] } : { matcher, hooks: [hook] });
     return true;
 }
-function findGateboltHook(entries, suffix) {
+function findGateboltHook(entries, marker) {
     for (const entry of entries) {
         if (!isRecord(entry) || !Array.isArray(entry.hooks))
             continue;
         for (const hook of entry.hooks) {
             if (isRecord(hook) &&
                 typeof hook.command === "string" &&
-                hook.command.trim().endsWith(suffix)) {
+                hook.command.includes(marker)) {
                 return hook;
             }
         }

package/dist/commands/declare.js

@@ -109,6 +109,7 @@ export async function runDeclare(argv) {
         baseSha,
         branch,
         profile: connection.profileName,
+        sessionId: process.env.CLAUDE_CODE_SESSION_ID,
     });
     process.stdout.write(`Declared change ${result.changeId} (${declaredFiles.length} file(s)).\n`);
 }

package/dist/commands/hook.js

@@ -1,6 +1,8 @@
 import { existsSync } from "node:fs";
+import { dirname } from "node:path";
 import { formatError } from "../errors.js";
-import { hasCommits, repoContext } from "../git.js";
+import { hasCommits, repoContext, worktreePaths } from "../git.js";
+import { isRecord } from "../json.js";
 import { readSession } from "../session.js";
 import { RequestError } from "../transport.js";
 import { runObserve } from "./observe.js";
@@ -21,33 +23,83 @@ task — specific repo-relative paths, not broad globs like src/** :
 The GateBolt CLI is already configured for this repository. Once it
 prints "Declared change …", retry the edit.`;
 }
-export async function runHook(argv) {
-    anchorToProjectDir();
-    drainStdin();
+function promptReminder(cli) {
+    return `This repository uses GateBolt strict mode. Before editing any file, declare
+the files you plan to touch — run this in Bash first, listing EVERY file you will
+create or modify for this task:
+
+  ${cli} declare \\
+    --task "<one line describing the task>" \\
+    --vendor claude_code --name "Claude Code" --model <your-model-id> \\
+    --file <path> [--file <path> ...]
+
+Then make your edits. Editing before declaring will be blocked.`;
+}
+export async function runHook(argv, input = {}) {
     const sub = argv[0] ?? "";
     switch (sub) {
         case "guard":
-            return runGuard();
+            return runGuard(input);
+        case "prompt":
+            return runPrompt(input);
         case "post-turn":
-            return runPostTurn();
+            return runPostTurn(input);
         case "pre-push":
-            return runPrePush();
+            return runPrePush(input);
         default:
-            throw new Error(`Unknown hook '${sub}'. Expected one of: guard, post-turn, pre-push.`);
+            throw new Error(`Unknown hook '${sub}'. Expected one of: guard, prompt, post-turn, pre-push.`);
     }
 }
-let stdinDrained = false;
-function drainStdin() {
-    if (stdinDrained || process.stdin.isTTY)
-        return;
-    stdinDrained = true;
-    process.stdin.on("error", () => undefined);
-    process.stdin.resume();
-}
-function anchorToProjectDir() {
-    const dir = process.env.CLAUDE_PROJECT_DIR;
-    if (dir && existsSync(dir))
+async function resolveRepo(input) {
+    const candidates = [
+        input.filePath ? dirname(input.filePath) : undefined,
+        input.cwd,
+        process.env.CLAUDE_PROJECT_DIR,
+        process.cwd(),
+    ];
+    for (const dir of candidates) {
+        if (!dir || !existsSync(dir))
+            continue;
         process.chdir(dir);
+        const repo = await hookRepoContext();
+        if (repo)
+            return repo;
+    }
+    return null;
+}
+export async function readHookPayload() {
+    const data = safeJsonParse(await readStdin());
+    if (!isRecord(data))
+        return {};
+    const toolInput = isRecord(data.tool_input) ? data.tool_input : undefined;
+    return {
+        cwd: typeof data.cwd === "string" ? data.cwd : undefined,
+        filePath: toolInput && typeof toolInput.file_path === "string"
+            ? toolInput.file_path
+            : undefined,
+        sessionId: typeof data.session_id === "string" ? data.session_id : undefined,
+    };
+}
+function safeJsonParse(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function readStdin() {
+    if (process.stdin.isTTY)
+        return Promise.resolve("");
+    return new Promise((resolve) => {
+        const chunks = [];
+        const done = () => resolve(Buffer.concat(chunks).toString("utf8"));
+        process.stdin.on("data", (chunk) => {
+            chunks.push(chunk);
+        });
+        process.stdin.on("end", done);
+        process.stdin.on("error", done);
+    });
 }
 async function hookRepoContext() {
     try {
@@ -57,10 +109,10 @@ async function hookRepoContext() {
         return null;
     }
 }
-async function runGuard() {
+async function runGuard(input) {
     if (process.env.GATEBOLT_ENFORCE !== ENFORCE_STRICT)
         return;
-    const repo = await hookRepoContext();
+    const repo = await resolveRepo(input);
     if (!repo)
         return;
     if (await readSession(repo.gitDir))
@@ -71,12 +123,36 @@ async function runGuard() {
     const cli = process.env.GATEBOLT_CLI ?? DEFAULT_CLI;
     process.stdout.write(denyPayload(declareInstructions(cli)));
 }
-async function runPostTurn() {
-    const repo = await hookRepoContext();
-    if (!repo)
+// Proactively remind the agent to declare before its first edit, so it doesn't
+// discover strict mode by tripping the guard. Silent once a declaration is open.
+async function runPrompt(input) {
+    if (process.env.GATEBOLT_ENFORCE !== ENFORCE_STRICT)
         return;
-    if (!(await readSession(repo.gitDir)))
+    const repo = await resolveRepo(input);
+    if (!repo || !(await hasCommits()))
         return;
+    if (await readSession(repo.gitDir))
+        return;
+    process.stdout.write(promptReminder(process.env.GATEBOLT_CLI ?? DEFAULT_CLI));
+}
+async function runPostTurn(input) {
+    const repo = await resolveRepo(input);
+    if (!repo)
+        return;
+    if (await readSession(repo.gitDir))
+        return observeHere();
+    for (const { path, session } of await worktreeSessions()) {
+        if (session.sessionId === undefined) {
+            process.stderr.write(`GateBolt: ${path} has an open declaration from outside this session; leaving it open.\n`);
+            continue;
+        }
+        if (session.sessionId !== input.sessionId)
+            continue;
+        if (chdirTo(path))
+            await observeHere();
+    }
+}
+async function observeHere() {
     try {
         await runObserve([]);
     }
@@ -84,10 +160,33 @@ async function runPostTurn() {
         process.stderr.write(`${formatError(error)}\n`);
     }
 }
+async function worktreeSessions() {
+    const found = [];
+    for (const path of await worktreePaths().catch(() => [])) {
+        if (!chdirTo(path))
+            continue;
+        const repo = await hookRepoContext();
+        const session = repo ? await readSession(repo.gitDir) : null;
+        if (session)
+            found.push({ path, session });
+    }
+    return found;
+}
+// `git worktree list` keeps reporting a worktree whose directory was deleted
+// without a `git worktree prune`.
+function chdirTo(path) {
+    try {
+        process.chdir(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 // Backstop for the interrupt case the Stop hook misses: an open, un-observed
 // declaration.
-async function runPrePush() {
-    const repo = await hookRepoContext();
+async function runPrePush(input) {
+    const repo = await resolveRepo(input);
     if (!repo)
         return;
     if (!(await readSession(repo.gitDir)))

package/dist/commands/init.js

@@ -3,7 +3,7 @@ import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { delimiter, dirname, isAbsolute, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { claudeCodeAdapter } from "../agents/claude-code.js";
+import { claudeCodeAdapter, MISSING_CLI_MESSAGE, } from "../agents/claude-code.js";
 import { repoIdentityFromName, resolveConnection } from "../config.js";
 import { hooksPath, isPathIgnored, isUncommitted, repoContext, } from "../git.js";
 import { isRecord } from "../json.js";
@@ -163,6 +163,10 @@ export function prePushScript(command) {
     return [
         "#!/usr/bin/env sh",
         `# ${PRE_PUSH_MARKER} — reconciles an open declaration before a push.`,
+        `if ! command -v ${command} >/dev/null 2>&1; then`,
+        `  echo "${MISSING_CLI_MESSAGE}" >&2`,
+        "  exit 0",
+        "fi",
         `exec ${command} hook ${PRE_PUSH_FILE}`,
         "",
     ].join("\n");

package/dist/git.js

@@ -34,6 +34,13 @@ export async function hooksPath() {
     const output = await git(["rev-parse", "--git-path", "hooks"]);
     return resolve(output.trim());
 }
+export async function worktreePaths() {
+    const output = await git(["worktree", "list", "--porcelain"]);
+    return output
+        .split("\n")
+        .filter((line) => line.startsWith("worktree "))
+        .map((line) => line.replace(/^worktree /, "").trim());
+}
 export async function isPathIgnored(path) {
     try {
         await git(["check-ignore", "--quiet", path]);

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { runConfigure } from "./commands/configure.js";
 import { runDeclare } from "./commands/declare.js";
-import { runHook } from "./commands/hook.js";
+import { readHookPayload, runHook } from "./commands/hook.js";
 import { runInit } from "./commands/init.js";
 import { runLink } from "./commands/link.js";
 import { runLogin } from "./commands/login.js";
@@ -43,7 +43,7 @@ async function dispatch(command, argv) {
         case "init":
             return runInit(argv);
         case "hook":
-            return runHook(argv);
+            return runHook(argv, await readHookPayload());
         default:
             process.stderr.write(`${USAGE}\nRun \`gatebolt --help\` for details.\n`);
             process.exitCode = 1;

package/dist/session.js

@@ -26,12 +26,13 @@ export function writeSession(gitDir, session) {
     return writeJson(gitDir, SESSION_FILE, session);
 }
 export function readSession(gitDir) {
-    return readJson(gitDir, SESSION_FILE, ({ changeId, baseSha, branch, profile }) => typeof changeId === "string" && typeof baseSha === "string"
+    return readJson(gitDir, SESSION_FILE, ({ changeId, baseSha, branch, profile, sessionId }) => typeof changeId === "string" && typeof baseSha === "string"
         ? {
             changeId,
             baseSha,
             branch: typeof branch === "string" ? branch : undefined,
             profile: typeof profile === "string" ? profile : undefined,
+            sessionId: typeof sessionId === "string" ? sessionId : undefined,
         }
         : null);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatebolt/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Declare-then-observe agent client for GateBolt — records the files an AI agent intends to touch, then reconciles the actual git diff.",
   "keywords": [
     "gatebolt",