@haus-tech/haus-workflow 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.1.0](https://github.com/WeAreHausTech/haus-workflow/compare/v1.0.0...v1.1.0) (2026-07-02)
+
+### Features
+
+- **decisions:** add local pre-PR ADR gate (decisions guard hook) ([#163](https://github.com/WeAreHausTech/haus-workflow/issues/163)) ([2f2d8fb](https://github.com/WeAreHausTech/haus-workflow/commit/2f2d8fb0840389a9b4d1631b686da996064fc8e6))
+
 ## [1.0.0](https://github.com/WeAreHausTech/haus-workflow/compare/v0.32.1...v1.0.0) (2026-07-02)
 
 ### ⚠ BREAKING CHANGES

package/dist/cli.js

@@ -1538,11 +1538,11 @@ function reconcileManagedRules(existing, prevTracked, newRules) {
 function mergeDenyRules(settings, rules) {
   const existingDeny = settings.permissions?.deny ?? [];
   const trackedDeny = settings._haus?.denyRules ?? [];
-  const { rules: deny2, tracked, added } = reconcileManagedRules(existingDeny, trackedDeny, rules);
+  const { rules: deny, tracked, added } = reconcileManagedRules(existingDeny, trackedDeny, rules);
   const updated = { ...settings };
   updated.permissions = {
     ...settings.permissions ?? {},
-    deny: deny2
+    deny
   };
   updated._haus = {
     hooks: settings._haus?.hooks ?? [],
@@ -1805,6 +1805,13 @@ var PROJECT_HOOK_FRAGMENTS = [
     matcher: "Bash",
     command: "haus guard bash --from-hook"
   },
+  {
+    id: "haus.decisions-guard",
+    gate: "keep",
+    event: "PreToolUse",
+    matcher: "Bash",
+    command: "haus decisions guard --from-hook"
+  },
   {
     id: "haus.decisions-suggest",
     gate: "keep",
@@ -1910,6 +1917,10 @@ var CANONICAL_HOOKS = {
       {
         matcher: "Bash",
         hooks: [{ type: "command", command: "haus guard bash --from-hook" }]
+      },
+      {
+        matcher: "Bash",
+        hooks: [{ type: "command", command: "haus decisions guard --from-hook" }]
       }
     ],
     Stop: [
@@ -3053,8 +3064,59 @@ async function runClone(url, opts = {}) {
   log(`\u2713 cloned ${url} \u2192 ${target}`);
 }
 
-// src/commands/decisions.ts
-import path22 from "node:path";
+// src/claude/hook-io.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/utils/audit-checks.ts
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+
+// src/claude/hook-io.ts
+function stdin() {
+  try {
+    if (process.stdin.isTTY) return "";
+    return readFileSync2(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function readHookPayload() {
+  const raw = stdin();
+  if (!raw) return { payload: {}, malformed: false };
+  try {
+    const parsed = JSON.parse(raw);
+    return { payload: isRecord(parsed) ? parsed : {}, malformed: false };
+  } catch {
+    return { payload: {}, malformed: true };
+  }
+}
+function emitPreToolUseDeny(reason) {
+  log(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: reason
+      }
+    })
+  );
+}
+
+// src/decisions/base-ref.ts
+init_exec();
+async function resolveBaseRef(root) {
+  const symbolic = await runGit(["symbolic-ref", "refs/remotes/origin/HEAD"], { cwd: root });
+  if (symbolic.exitCode === 0) {
+    const ref = symbolic.stdout.trim().replace(/^refs\/remotes\//, "");
+    if (ref) return ref;
+  }
+  for (const candidate of ["origin/main", "origin/master", "main", "master"]) {
+    const check = await runGit(["rev-parse", "--verify", "--quiet", candidate], { cwd: root });
+    if (check.exitCode === 0) return candidate;
+  }
+  return void 0;
+}
 
 // src/decisions/check.ts
 import path21 from "node:path";
@@ -3303,6 +3365,46 @@ async function listDecisionNumbers(decisionsDir) {
   return entries.map((name) => decisionNumberFromFile(name)).filter((n) => n != null).map((n) => Number(n));
 }
 
+// src/commands/decisions-guard.ts
+init_exec();
+var PR_CREATE_PATTERN = /\bgh\s+pr\s+create\b/;
+function readPayload(options) {
+  if (options.stdinPayload != null) {
+    try {
+      const parsed = JSON.parse(options.stdinPayload);
+      return { payload: isRecord(parsed) ? parsed : {}, malformed: false };
+    } catch {
+      return { payload: {}, malformed: true };
+    }
+  }
+  return readHookPayload();
+}
+async function runDecisionsGuard(options = {}) {
+  const { payload, malformed } = readPayload(options);
+  if (malformed) {
+    emitPreToolUseDeny("Malformed hook payload");
+    return;
+  }
+  const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
+  const command = String(toolInput.command ?? "");
+  if (!PR_CREATE_PATTERN.test(command)) return;
+  const root = process.cwd();
+  const baseRef = await resolveBaseRef(root);
+  if (!baseRef) return;
+  const range = `${baseRef}...HEAD`;
+  const logRange = `${baseRef}..HEAD`;
+  const commitMessages = (await runGit(["log", "--format=%B", logRange], { cwd: root })).stdout;
+  const result = await runDecisionsCheck(root, { range, commitMessages });
+  if (result.triggered && !result.satisfied) {
+    emitPreToolUseDeny(
+      `I didn't run that \u2014 this change needs an ADR before opening a PR (${result.reasons.join("; ")}). Run haus decisions suggest, add the decision under docs/decisions/, then retry.`
+    );
+  }
+}
+
+// src/commands/decisions.ts
+import path22 from "node:path";
+
 // src/decisions/next-number.ts
 async function nextDecisionNumber(root) {
   const decisionsDir = await resolveDecisionsDir(root);
@@ -3511,11 +3613,6 @@ async function auditDecisionsLayout(root) {
 // src/scanner/scan-project.ts
 import path27 from "node:path";
 
-// src/utils/audit-checks.ts
-function isRecord(v) {
-  return typeof v === "object" && v !== null;
-}
-
 // src/utils/versions.ts
 import semver from "semver";
 function normalizeVersion(version) {
@@ -4411,9 +4508,6 @@ async function runFetchRefs(options) {
   }
 }
 
-// src/commands/guard.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-
 // src/security/guard-bash.ts
 function matchesDenyToken(command, denyPhrase) {
   if (denyPhrase === "sudo") {
@@ -4438,50 +4532,25 @@ function guardFileAccess(candidate) {
 }
 
 // src/commands/guard.ts
-function stdin() {
-  try {
-    if (process.stdin.isTTY) return "";
-    return readFileSync2(0, "utf8");
-  } catch {
-    return "";
-  }
-}
-function deny(reason) {
-  log(
-    JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: reason
-      }
-    })
-  );
-}
 async function runGuard(kind, _options) {
-  const raw = stdin();
-  let payload = {};
-  if (raw) {
-    try {
-      const parsed = JSON.parse(raw);
-      if (isRecord(parsed)) payload = parsed;
-    } catch {
-      deny("Malformed hook payload");
-      return;
-    }
+  const { payload, malformed } = readHookPayload();
+  if (malformed) {
+    emitPreToolUseDeny("Malformed hook payload");
+    return;
   }
   const toolInput = isRecord(payload.tool_input) ? payload.tool_input : {};
   if (kind === "file-access") {
     const candidate = String(toolInput.path ?? toolInput.file_path ?? "");
     const reason2 = guardFileAccess(candidate);
     if (reason2) {
-      deny(reason2);
+      emitPreToolUseDeny(reason2);
     }
     return;
   }
   const command = String(toolInput.command ?? "");
   const reason = guardBash(command);
   if (reason) {
-    deny(reason);
+    emitPreToolUseDeny(reason);
   }
 }
 
@@ -7101,6 +7170,7 @@ function registerDecisionsCommand(name) {
     (opts) => runDecisions("suggest", void 0, opts)
   );
   cmd.command("next-number").action(() => runDecisions("next-number"));
+  cmd.command("guard").option("--from-hook", "Emit JSON for Claude Code PreToolUse hook").action((opts) => runDecisionsGuard(opts));
   cmd.command("validate").argument("[path]", "Decision markdown file").action((filePath) => runDecisions("validate", filePath));
 }
 registerDecisionsCommand("decisions");

package/library/catalog/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.2.1",
+  "version": "3.3.0",
   "items": [
     {
       "id": "haus.agentic-workflow-standard",
@@ -1334,7 +1334,7 @@
       "ecosystem": "general",
       "installMode": "copy-selected",
       "tokenEstimate": 120,
-      "default": false,
+      "default": true,
       "reviewStatus": "approved",
       "riskLevel": "low"
     },
@@ -1353,7 +1353,7 @@
       "ecosystem": "general",
       "tokenEstimate": 650,
       "tokenBudget": 900,
-      "default": false,
+      "default": true,
       "reviewStatus": "approved",
       "riskLevel": "low"
     },

package/library/global/settings-fragments/hooks.json

@@ -15,6 +15,13 @@
       "matcher": "Bash",
       "command": "haus guard bash --from-hook"
     },
+    {
+      "id": "hook.decisions.guard",
+      "gate": "keep",
+      "event": "PreToolUse",
+      "matcher": "Bash",
+      "command": "haus decisions guard --from-hook"
+    },
     {
       "id": "hook.decisions.suggest",
       "gate": "keep",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {