@holmes-lab/holmes-kit 0.1.0

package/dist/holmes/guardrail/tspec-state.js

@@ -0,0 +1,392 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listOrCount = exports.ID_MAX = exports.REASON_BUDGET = exports.ID_BUDGET = void 0;
+exports.tspecStateFor = tspecStateFor;
+exports.tspecRemediation = tspecRemediation;
+exports.budgetedClause = budgetedClause;
+const approval_blockers_1 = require("../spec/approval-blockers");
+/** Distinct specs by id — a duplicated id must not be counted or named twice. */
+const distinct = (specs) => {
+    const seen = new Set();
+    return specs.filter((s) => (seen.has(s.id) ? false : (seen.add(s.id), true)));
+};
+/**
+ * Classify the T-SPEC situation for `aspecId`. Array lookups only — the gate calls this from a
+ * PreToolUse hook on every tool call, so it never touches the filesystem.
+ */
+function tspecStateFor(aspecId, specs) {
+    const tspecs = specs.filter((s) => s.type === 'T-SPEC');
+    const linked = tspecs.filter((s) => (s.dependsOn ?? []).includes(aspecId));
+    // The approved lookup runs on the RAW list. Review caught the first version deduplicating first:
+    // with a duplicated id where one copy was draft and one approved, `distinct` kept whichever came
+    // first and the approved one was dropped — flipping allow to deny, nondeterministically by readdir
+    // order, against a `breaking_change: none` contract. Deduplication is a MESSAGE concern only.
+    const approved = linked.find((s) => s.status === 'approved');
+    if (approved)
+        return { kind: 'approved', spec: approved };
+    // Every non-approved status lands here — `draft`, `review`, `outdated`. Narrowing to
+    // `=== 'draft'` would silently let an outdated T-SPEC read as a different situation.
+    if (linked.length > 0)
+        return { kind: 'linked-not-approved', specs: distinct(linked) };
+    // A T-SPEC with NO A-SPEC edge at all is the only candidate the gate can point at without
+    // guessing: measured, this repository has 0 of them, so one existing means someone just wrote it
+    // and has not attached it yet — which is exactly the playbook's silent failure.
+    //
+    // The test is the `A-SPEC-` PREFIX, not whether the edge resolves. Review proposed resolvability
+    // to also catch a typo'd edge, and measuring it showed why not: whenever the spec set is
+    // incomplete — an unreadable file, a partial load — every T-SPEC whose target is missing becomes
+    // an "orphan" and gets named. A probe with 73 such T-SPECs printed all of them, which is F1
+    // returning. Missing the typo case costs one unnamed candidate; over-naming hands the author a
+    // list of unrelated documents, and that was the HIGH.
+    const orphans = tspecs.filter((s) => !(s.dependsOn ?? []).some((d) => d.startsWith('A-SPEC-')));
+    return { kind: 'unlinked', orphans: distinct(orphans) };
+}
+/**
+ * Rendering budget. Four rules, because four review rounds each found the previous rendering helper
+ * leaking through a case its sibling already handled:
+ *
+ *  1. An id is printed WHOLE or not at all. Slicing one produces a spec id that does not exist, and
+ *     it split a surrogate pair into `permissionDecisionReason`.
+ *  2. If no id fits, report the COUNT. An empty list followed by `외 N개` names nothing while
+ *     implying a list — measured `T-SPEC  외 1개가 …`, self-contradictory.
+ *  3. Every field is bounded, not just `message`. `next_action` went to 20,028 characters because
+ *     the budgets were applied to the sentence only.
+ *  4. No unconditional first item, anywhere. Keeping `parts[0]` regardless of size is how a 20,000
+ *     character id produced a 40,192-character refusal AFTER the size cap was added.
+ */
+const CAP = 3; // most items ever named
+exports.ID_BUDGET = 200; // an id list is ~15 chars an entry
+exports.REASON_BUDGET = 1200; // ONE approval-blocker sentence is ~500 (field, allowed values, ADR)
+/**
+ * @implements A-SPEC-192 §11R (round 11)
+ * The exact cost of a clause's FRAMING, at the worst-case label (§10R: the id's length must never
+ * decide how much reason survives). `blockerClause(id, [''])` IS that frame; the `- 1` this replaces
+ * under-charged every clause by one character, which is invisible in one clause and 24 characters
+ * over budget across a few. Measured before the fix: 1,294 characters against a 1,200 ceiling.
+ */
+const clauseFrame = () => (0, approval_blockers_1.blockerClause)('x'.repeat(exports.ID_MAX), ['']).length;
+/**
+ * The worst-case cost of the `; (외 N건)` tail — text that no budget charged for, so it was spent
+ * every time a clause omitted anything. Priced at the whole count, since the omitted number is only
+ * known after clamping and can never exceed it.
+ */
+const tailCost = (total) => (total > 1 ? approval_blockers_1.BLOCKER_SEP.length + `(외 ${total}건)`.length : 0);
+exports.ID_MAX = 80; // an id longer than this is never quoted — rule 1
+/** Items that fit, whole, within `budget`. Never slices; never keeps an oversized first item. */
+const fitting = (items, budget, cap = CAP) => {
+    const kept = [];
+    let used = 0;
+    for (const item of items) {
+        if (kept.length >= cap)
+            break; // cap counts NAMES KEPT, not positions scanned —
+        // a positional slice let 3 oversized leading ids empty the whole window (round-3: 'N개' while
+        // later ids fit; the round-2 continue-fix had only covered the cap=Infinity path).
+        // SKIP, not break (round-2): an item that does not fit folds into the count; later items name.
+        if (used + item.length > budget)
+            continue;
+        kept.push(item);
+        used += item.length + 2; // the ', ' that will join them
+    }
+    return kept;
+};
+/**
+ * `a, b 외 N개` — or, when nothing fits, `N개` (rule 2). The count always agrees with what is shown.
+ */
+// @implements A-SPEC-192 — exported so the approval-claim refusal reuses the SAME budget instead
+// of growing its own (a second truth) or staying unbounded (the measured 40,192-char refusal class).
+const listOrCount = (items, budget, unit, cap) => {
+    if (items.length === 0)
+        return ''; // nothing to report is not a count of zero
+    const kept = fitting(items, budget, cap);
+    if (kept.length === 0)
+        return `${items.length}${unit}`;
+    const rest = items.length - kept.length;
+    return rest > 0 ? `${kept.join(', ')} 외 ${rest}${unit}` : kept.join(', ');
+};
+exports.listOrCount = listOrCount;
+/**
+ * Whole blockers within `budget`. Empty when none fits — never a dangling label.
+ *
+ * Takes the blockers as an ARRAY, never a joined string. Review found the string form re-split on
+ * `; `, a delimiter that also appears inside author-controlled text, yielding a sliced spec id with
+ * an unterminated quote and a remainder that counted fragments.
+ *
+ * `continue`, not `break`: one oversized blocker must not suppress the rest. Measured on the version
+ * this replaces — a 1,230-character blocker erased a 33-character one that fit easily, and the
+ * refusal came out byte-identical to the message for a spec with NO blockers. The design makes that
+ * silence load-bearing ("approve it"), so the author followed it and `spec_approve` refused with the
+ * very reason the gate had and withheld.
+ */
+const clampBlockers = (blockers, budget) => {
+    const kept = [];
+    let used = 0;
+    for (const b of blockers) {
+        if (used + b.length > budget)
+            continue; // rule 4, and one big item skips only itself
+        kept.push(b);
+        used += b.length + approval_blockers_1.BLOCKER_SEP.length;
+    }
+    return kept;
+};
+/** An id short enough to quote, or null — rule 1 applied to a single id. */
+const quotable = (id) => (id.length <= exports.ID_MAX ? id : null);
+/**
+ * What the author should read, and what they should do, for a state that denies.
+ *
+ * `null` for `approved` — there is nothing to say when nothing is wrong.
+ */
+function tspecRemediation(rawAspecId, state, why) {
+    if (state.kind === 'approved')
+        return null;
+    // Rule 3 applies to the TARGET id too. Review measured a 20,000-character A-SPEC id producing a
+    // 40,128-character message: every budget bounded the T-SPEC ids and none bounded this one, which
+    // is interpolated twice into the sentence and once into `next_action`.
+    const aspecId = quotable(rawAspecId) ?? '대상 A-SPEC';
+    if (state.kind === 'linked-not-approved') {
+        // Why it cannot be approved comes from REQ-182's computation, not a second one here — if the
+        // gate derived its own view, the author could satisfy the gate and be refused at approval.
+        // @implements A-SPEC-192 §6R (round 10) — a SHARE, not a race. The pre-tool-use twin got this
+        // in round 9 and this one — the surface the comment there points at as the source of the
+        // discipline — kept first-come-full-draw. Measured through phaseCheck('WRITE_CODE'): a leading
+        // reason of 1,144 characters erased both siblings' reasons, and making it ONE character longer
+        // flipped the refusal from 1,478 characters (siblings gone) to 353 (siblings in full). An input
+        // that gets worse must not make the answer better.
+        // The reason/quote window follows the specs whose ids the NAME window kept (round-4: fitting
+        // skips oversized leading ids, so a positional slice attributed three unnamed specs' blockers
+        // to the three specs the sentence had just named).
+        const namedIds = new Set(fitting(state.specs.map((s) => s.id), exports.ID_BUDGET, CAP));
+        const window = state.specs.filter((s) => namedIds.has(s.id));
+        const shownSpecs = (window.length > 0 ? window : state.specs).slice(0, CAP);
+        // Each shown spec is guaranteed an equal share first; the unused remainder is then offered in
+        // order, so a long leading reason can spend only what nobody else needs.
+        // @implements A-SPEC-192 §8R (round 10, 2nd) — ONE algorithm, and it counts what it prints.
+        //
+        // The share-plus-remainder shape had two accounting units: `spare` charged the fully wrapped
+        // clause (body + ` [id] 승인까지 남은 것: `), while the remainder pool debited the raw body. So
+        // the moment a reason crossed the share line it refunded its ~25-character wrapper to the pool,
+        // and a sibling whose reason happened to sit in that 25-char window flipped from omitted to
+        // printed — one character worse in, 644 characters "better" out (measured). The same mismatch
+        // let the reservations exceed the budget they defended (3 × (400 + 25) = 1,275 > 1,200).
+        //
+        // Now every spec is priced at the clause it would actually print, and the budget is spent
+        // SHORTEST-FIRST: the money buys the most sentences, one long reason cannot outbid several short
+        // ones, and no separate 'share' branch remains to disagree with this one.
+        // @implements A-SPEC-192 §9R (round 10, 3rd) — ONE unit, all the way down: the CLAUSE.
+        //
+        // §8R priced clauses but still judged individual blockers against the raw budget, and the two
+        // met badly. (i) `clampBlockers(all, REASON_BUDGET)` is cumulative, so a pathological reason that
+        // merely fit the budget was still charged and dragged its own spec's SHORT reason into silence —
+        // the very silence §8R said the exclusion prevented — and at one character more it dropped out
+        // and the short reason came back: worse input, better refusal. (ii) The omission label asked
+        // `some(b => b.length <= REASON_BUDGET)` on BODIES while the budget also has to cover the framing
+        // (` [id] 승인까지 남은 것: `), so a solo spec's 1,176-character reason vanished under the words
+        // "문면 예산 소진" while nothing had spent it, and the effective cap slid with the id's length.
+        //
+        // So each spec's framing is priced first, and every judgement about a blocker is made against
+        // what is left for BODIES after that framing.
+        // @implements A-SPEC-192 §10R (round 10, 5th) — the framing is priced at its WORST case, so how
+        // long your id happens to be never decides how much of your reason survives. Pricing the actual
+        // label made the body budget slide with the id, and crossing ID_MAX (where the id folds to a
+        // short marker) handed ~63 characters back at once: one character longer, one more reason
+        // printed. The clause still fits, because the real frame is never larger than this bound.
+        // @implements A-SPEC-192 §11R (round 11) — the frame is the empty-body clause itself (the `- 1`
+        // under-charged each clause by one character), and the `(외 N건)` tail is text too. Both are
+        // priced, so the ceiling holds instead of being approached.
+        // 사유 계산은 호출자의 함수다 — 한 스펙에 대해 한 번만 부른다. (§11R 에서 절마다 다시 부르는
+        // 판정을 늘렸더니 블로커가 만 건인 스펙에서 스위트가 5분을 넘겼다: 값이 아니라 계산이 문제였다.)
+        const blockersOf = ((cache) => (s) => {
+            const hit = cache.get(s.id);
+            if (hit !== undefined)
+                return hit;
+            const v = why(s);
+            cache.set(s.id, v);
+            return v;
+        })(new Map());
+        const frameLen = (_s) => clauseFrame();
+        const bodyBudget = (s) => Math.max(0, exports.REASON_BUDGET - frameLen(s) - tailCost(blockersOf(s).length));
+        // @implements A-SPEC-192 §12R (round 13) — the reservation-plus-auction this replaces granted a
+        // spec the WHOLE remaining pool without asking whether it could use a single character of it,
+        // and never took the unused part back. Measured: of a 1,200-character budget, 87 were spent and
+        // 19 printable reasons were thrown away; and because the auction ordered by "smallest want",
+        // growing one blocker by ONE character flipped the order and swung the refusal from 87 to 1,013
+        // characters (§8R's cliff, back in the upgrade step). Both die with the unit of allocation: a
+        // budget is spent on REASONS, one at a time, and the cheapest next reason anywhere wins.
+        //
+        // Ties break on the spec ID, never on array position — `LocalMarkdownRepository.list()` hands back the
+        // directory-listing order, which no author controls (r13 measured 2 reasons vs 20 from the
+        // array order alone).
+        /**
+         * The clause body a spec prints when it carries reasons but bought none.
+         *
+         * @implements A-SPEC-192 §12R — priced and rendered by ONE function, because the pricing used a
+         * worst-case reconstruction of this sentence and the two could drift apart. `compact` drops the
+         * pointer so a named spec can still say something when the pointed label does not fit; silence
+         * is byte-identical to "nothing blocks me", which is the r5 finding.
+         */
+        const omitLabel = (s, id, compact) => {
+            const all = blockersOf(s);
+            const hint = compact ? '' : ` — spec_validate${id ? ` ${id}` : ''} 로 확인하십시오`;
+            // §9R: "spent" and "over" are different facts. A body is over budget when it cannot fit even
+            // with the whole budget minus this spec's own framing.
+            return all.some((b) => b.length <= bodyBudget(s))
+                ? `(문면 예산 소진으로 사유 ${all.length}건 생략${hint})`
+                : `(사유 ${all.length}건이 문면 예산을 넘어 생략${hint})`;
+        };
+        /**
+         * Indices of the blockers this spec could print at all — judged one at a time, not cumulatively.
+         * INDICES, not values: two blockers can be byte-identical (a truncating generator, a repeated
+         * validator message), and a value-keyed set then printed every copy — measured 5,020,022
+         * characters against a 1,200 ceiling. What was bought is a position, not a string.
+         */
+        const printable = (s) => {
+            const cap = bodyBudget(s);
+            return blockersOf(s).map((b, i) => (b.length <= cap ? i : -1)).filter((i) => i >= 0);
+        };
+        /** The exact clause cost for a chosen set: framing + bodies + separators + the omission tail. */
+        const clauseCost = (s, bodySum, count) => (count === 0 ? 0
+            : frameLen(s) + bodySum + approval_blockers_1.BLOCKER_SEP.length * (count - 1)
+                + (count < blockersOf(s).length ? tailCost(blockersOf(s).length) : 0));
+        const omitCost = (s, compact) => frameLen(s) + omitLabel(s, 'x'.repeat(exports.ID_MAX), compact).length;
+        const chosen = new Map(); // 산 블로커의 자리 — 인쇄는 원래 순서로 한다
+        const printed = new Set();
+        const allowanceKind = new Map();
+        let pool = exports.REASON_BUDGET;
+        const speaking = shownSpecs
+            .filter((s) => blockersOf(s).length > 0)
+            .map((s) => {
+            const bs = blockersOf(s);
+            // 값은 길이로 매기고, 동점은 자리로 — 배열 순서가 아니라 결정적인 규칙이어야 한다.
+            const rest = printable(s).sort((x, y) => bs[x].length - bs[y].length || x - y);
+            return { s, bs, rest, bodySum: 0, count: 0 };
+        })
+            .sort((a, b) => (a.s.id < b.s.id ? -1 : a.s.id > b.s.id ? 1 : 0));
+        // Marginal-cost greedy: at every step, buy the cheapest "one more reason" available anywhere.
+        // A spec's first reason is priced from silence, so nothing is reserved and nothing is stranded,
+        // and each spec offers its CHEAPEST remaining reason — the old code could only extend a prefix,
+        // so a 900-character leading blocker buried the 9-character one behind it.
+        for (;;) {
+            let best;
+            for (const g of speaking) {
+                const i = g.rest[0];
+                if (i === undefined)
+                    continue;
+                const inc = clauseCost(g.s, g.bodySum + g.bs[i].length, g.count + 1) - clauseCost(g.s, g.bodySum, g.count);
+                if (best === undefined || inc < best.inc)
+                    best = { g, inc, i };
+            }
+            if (best === undefined || best.inc > pool)
+                break;
+            best.g.rest.shift();
+            best.g.bodySum += best.g.bs[best.i].length;
+            best.g.count += 1;
+            pool -= best.inc;
+            printed.add(best.g.s.id);
+            const set = chosen.get(best.g.s.id) ?? new Set();
+            set.add(best.i);
+            chosen.set(best.g.s.id, set);
+        }
+        // A named spec that bought no reason still says SOMETHING when anything is left — silence is
+        // byte-identical to "nothing blocks me" (r5's finding). The compact label is the fallback when
+        // even the pointed one does not fit; reasons come first because a label is not an action.
+        for (const g of speaking) {
+            if (printed.has(g.s.id))
+                continue;
+            for (const compact of [false, true]) {
+                const cost = omitCost(g.s, compact);
+                if (cost > pool)
+                    continue;
+                printed.add(g.s.id);
+                pool -= cost;
+                allowanceKind.set(g.s.id, compact ? 'compact' : 'pointed');
+                break;
+            }
+        }
+        const reasons = shownSpecs
+            .map((s) => {
+            const all = blockersOf(s);
+            if (all.length === 0 || !printed.has(s.id))
+                return '';
+            // 산 블로커를 원래 순서로 인쇄한다 — 값은 길이로 매기되, 저자가 읽는 차례는 바꾸지 않는다
+            // (approvalBlockers 는 부모 먼저처럼 의미 있는 차례로 돌려준다).
+            const bought = chosen.get(s.id) ?? new Set();
+            const kept = all.filter((_b, i) => bought.has(i));
+            if (kept.length === 0) {
+                // r5(192): dropping oversized/over-budget blockers WITHOUT a label made this refusal
+                // byte-identical to the no-blocker one. r6: the label itself must obey rule 1/3 — raw
+                // `${s.id}` resurrected the unbounded-id class (20k-char id → 20,132-char deny), and one
+                // wording conflated 'sentence too big alone' with 'shared budget spent' (a 5-char reason
+                // read as pathological). quotable folds the id; the two causes get their own words.
+                const q = quotable(s.id);
+                // 값 매김이 산 라벨과 같은 라벨을 인쇄한다 — 지목형이 예산에 들어가면 그것을, 아니면 축약형을.
+                const pointed = (0, approval_blockers_1.blockerClause)(q ?? `${s.type}`, [omitLabel(s, q ?? '', false)]);
+                const compact = (0, approval_blockers_1.blockerClause)(q ?? `${s.type}`, [omitLabel(s, q ?? '', true)]);
+                return (allowanceKind.get(s.id) === 'compact') ? compact : pointed;
+            }
+            const rest = all.length - kept.length;
+            return (0, approval_blockers_1.blockerClause)(quotable(s.id) ?? `${s.type}`, rest > 0 ? [...kept, `(외 ${rest}건)`] : kept);
+        })
+            .filter((r) => r.length > 0)
+            .join('');
+        const named = (0, exports.listOrCount)(state.specs.map((s) => s.id), exports.ID_BUDGET, '개');
+        const first = quotable((shownSpecs[0] ?? state.specs[0]).id);
+        return {
+            message: `T-SPEC ${named}가 A-SPEC ${aspecId}를 시험한다고 선언했으나 approved가 아닙니다.${reasons}`,
+            next_action: first ? `그 T-SPEC을 승인 (spec_approve ${first})` : '그 T-SPEC을 승인',
+        };
+    }
+    // BOTH moves, because the gate genuinely cannot tell which applies. Naming only one of them is
+    // how the earlier draft turned "write the test" into "attach an unrelated document".
+    const orphans = state.orphans.length > 0
+        // The deps list inside each item is bounded too, so no single item can blow the budget and get
+        // dropped whole — the author would then see "외 N개" with nothing named.
+        ? ` 간선이 없는 T-SPEC이 있습니다 — ${(0, exports.listOrCount)(state.orphans.map((s) => {
+            const deps = s.dependsOn ?? [];
+            return `${s.id}: [${(0, exports.listOrCount)(deps, exports.ID_BUDGET, '개')}]`;
+        }), exports.ID_BUDGET, '개')}.`
+        : '';
+    return {
+        message: `A-SPEC ${aspecId}를 depends_on에 담은 T-SPEC이 없습니다(테스트 먼저).`
+            + ` 아직 쓰지 않았다면 4분면 T-SPEC을 작성·승인하고, 이미 썼다면 그 T-SPEC의 depends_on에 ${aspecId}를 추가하라.${orphans}`,
+        next_action: `T-SPEC 작성·승인, 또는 기존 T-SPEC의 depends_on에 ${aspecId} 추가`,
+    };
+}
+/**
+ * @implements A-SPEC-192 §10R (round 10, 4th)
+ * ONE spec's clause, budgeted — the shared discipline both refusal surfaces now use.
+ *
+ * The twin in `phase.ts` compared the whole joined summary (framing + id + every blocker) against
+ * REASON_BUDGET and dropped it ALL when it did not fit. Two harms followed, both measured. A 93-char
+ * parent blocker — the one action the author could take right now — vanished because a sibling
+ * blocker happened to be 1,154 characters. And because the id sits inside what was being measured,
+ * the effective budget slid with the id's LENGTH: growing an id by one character past ID_MAX made
+ * the §7R scrub fold it, freed 63 characters, and turned a 236-char refusal that named nothing into
+ * a 1,209-char refusal that named everything. Worse input, better answer, decided by something the
+ * author cannot control.
+ *
+ * Here the framing is priced first and every judgement about a blocker is made against what remains
+ * for bodies; blockers are dropped one at a time and counted, and the label distinguishes "no reason
+ * fits at all" from "the budget was spent elsewhere" — the same words the sibling uses.
+ */
+function budgetedClause(labelId, fallbackLabel, blockers, spentElsewhere = false) {
+    if (blockers.length === 0)
+        return '';
+    const label = quotable(labelId) ?? fallbackLabel;
+    // Worst-case framing (§10R): the budget must not depend on the id's length. See tspec-state's
+    // frameLen for the measurement that forced this.
+    // §11R: the frame is the empty-body clause ITSELF — the `- 1` under-priced every clause by one
+    // character, and the `(외 N건)` tail below was charged to nothing at all. Both are text; both are
+    // priced here, so "budget" means a ceiling rather than an estimate.
+    const frame = clauseFrame();
+    const budget = Math.max(0, exports.REASON_BUDGET - frame - tailCost(blockers.length));
+    const kept = clampBlockers(blockers, budget);
+    if (kept.length === 0) {
+        const q = quotable(labelId);
+        const hint = ` — spec_validate${q ? ` ${q}` : ''} 로 확인하십시오`;
+        const anyFits = blockers.some((b) => b.length <= budget);
+        return (0, approval_blockers_1.blockerClause)(label, [(anyFits || spentElsewhere)
+                ? `(문면 예산 소진으로 사유 ${blockers.length}건 생략${hint})`
+                : `(사유 ${blockers.length}건이 문면 예산을 넘어 생략${hint})`]);
+    }
+    const rest = blockers.length - kept.length;
+    return (0, approval_blockers_1.blockerClause)(label, rest > 0 ? [...kept, `(외 ${rest}건)`] : kept);
+}

package/dist/holmes/guardrail/write-target.js

@@ -0,0 +1,224 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PATH_FIELDS = exports.READ_ONLY_TOOLS = void 0;
+exports.writesFiles = writesFiles;
+exports.resolveTarget = resolveTarget;
+exports.isProtectedTarget = isProtectedTarget;
+exports.specTargetOf = specTargetOf;
+exports.protectedFileKindOf = protectedFileKindOf;
+exports.protectedKindOf = protectedKindOf;
+// @implements A-SPEC-163
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * Tools known to only READ. Everything else that carries a path is treated as a write.
+ *
+ * The list is inverted on purpose. The gate used to ask `['Write','Edit'].includes(name)`, and
+ * measured 2026-08-08 that meant `MultiEdit`, `NotebookEdit`, and a lower-case `write` reached the
+ * same protected files `Write` was denied — No-Spec-No-Code, the role gate, the ledger ban and the
+ * approval-config ban all bypassed by a different name. Adding those three names would postpone the
+ * problem to the fourth tool; inverting it means an unrecognised tool fails CLOSED.
+ */
+exports.READ_ONLY_TOOLS = [
+    'read', 'grep', 'glob', 'ls', 'notebookread',
+    'webfetch', 'websearch', 'todowrite', 'task', 'bashoutput', 'killshell',
+];
+/**
+ * Payload keys that name a file. Shared with normalization so the two cannot drift: a field the
+ * gate does not know about is a path the gate cannot see, which is how `notebook_path` slipped
+ * through.
+ */
+exports.PATH_FIELDS = ['file_path', 'notebook_path'];
+const pathIn = (input) => {
+    if (!input || typeof input !== 'object')
+        return undefined;
+    const rec = input;
+    for (const f of exports.PATH_FIELDS)
+        if (typeof rec[f] === 'string' && rec[f] !== '')
+            return rec[f];
+    return undefined;
+};
+/**
+ * Whether this tool call writes a file.
+ *
+ * A missing or non-string name counts as a write. `normalizeHookInput` turns both into `''`, and the
+ * old membership test read that as "not a write tool" — REQ-144 closed exactly this direction for
+ * the path field while leaving the name field open.
+ */
+function writesFiles(toolName, input) {
+    if (pathIn(input) === undefined)
+        return false;
+    const name = (typeof toolName === 'string' ? toolName : '').toLowerCase();
+    return !exports.READ_ONLY_TOOLS.includes(name);
+}
+/**
+ * The file a raw path actually names.
+ *
+ * `path.resolve` folds `//`, `.` and `..`. Then the longest EXISTING ancestor is realpath'd and the
+ * remainder rejoined lexically — a whole-path `realpath` throws on a file that does not exist yet,
+ * which is precisely when the gate has to answer.
+ */
+function resolveTarget(root, raw, depth = 0) {
+    const abs = path.resolve(root, raw);
+    // A DANGLING symlink still names where a write would land, and `realpath` fails on it — so the
+    // link is followed explicitly. Without this, `ln -s .ax/ledger/not-yet-there innocent` then
+    // writing `innocent` creates a file inside the protected directory while the gate sees a name
+    // outside it. The depth cap stops a symlink cycle from spinning.
+    if (depth < 8) {
+        try {
+            if (fs.lstatSync(abs).isSymbolicLink()) {
+                return resolveTarget(path.dirname(abs), fs.readlinkSync(abs), depth + 1);
+            }
+        }
+        catch { /* not a symlink, or unreadable — fall through to ancestor resolution */ }
+    }
+    const parts = [];
+    let cur = abs;
+    for (;;) {
+        try {
+            return path.join(fs.realpathSync(cur), ...parts.reverse());
+        }
+        catch {
+            const parent = path.dirname(cur);
+            if (parent === cur)
+                return abs; // reached the filesystem root without an existing ancestor
+            parts.push(path.basename(cur));
+            cur = parent;
+        }
+    }
+}
+/** Governance directories, relative to the project root. */
+const PROTECTED_DIRS = [
+    path.join('.ax', 'ledger'),
+    path.join('.ax', 'roles'),
+    path.join('.ax', 'cpg_cache'),
+    path.join('.ax', 'state'),
+    '.claude',
+];
+/**
+ * Whether a write lands inside a governance directory.
+ *
+ * Comparison folds case because that is what the filesystem does: measured 2026-08-08 on macOS,
+ * writing `.AX/roles/policy.yaml` changed the very file the gate protects. On a case-sensitive
+ * filesystem folding over-protects, which is the safe direction and only collides for a project
+ * that deliberately keeps both `.ax` and `.AX`.
+ *
+ * The separator suffix matters: without it `.axolotl/` would inherit `.ax/`'s protection by prefix.
+ */
+function isProtectedTarget(root, raw) {
+    return protectedKindOf(root, raw) !== null;
+}
+/**
+ * Which governance directory a write lands in, or `null`.
+ *
+ * Callers that phrase a refusal need to name the right thing — REQ-155 measured how much a message
+ * that points at the wrong file costs — so the matched directory is returned rather than a bare
+ * boolean re-derived from a second regex.
+ */
+/**
+ * The spec FILE a write lands on, resolved — or `null` when the target is not a spec.
+ *
+ * @implements A-SPEC-191 §23 (round 12) — §22 moved `.mcp.json`, `.env`, `.ax/roles` and
+ * `.ax/ledger` onto identity and left the spec store itself on a case-sensitive regex over the
+ * caller's string. Measured on one fixture: `.AX/specs/…`, `.Ax/specs/…`, `.ax/SPECS/…`,
+ * `.ax//specs/…`, `.ax/./specs/…`, a link named `alias.md` and a link named `specslink` ALL
+ * reached the same files with the pattern looking elsewhere — so a session could self-approve an
+ * A-SPEC and a T-SPEC and then write the code they authorise, and could rewrite the body of an
+ * already-approved spec. The two rules the spec chain rests on (no self-approval, no seal-breaking
+ * edit) were both spelling-deep. The RESOLVED path is returned so callers read the disk at the
+ * same file they judged — asking `existsSync` about the caller's spelling was its own bypass.
+ */
+function specTargetOf(root, specsDir, raw) {
+    const resolved = resolveTarget(root, raw);
+    if (!/\.md$/i.test(resolved))
+        return null;
+    const t = resolved.toLowerCase();
+    // The WIRED store and the default layout both count. A deployment can move its specs, but
+    // `<root>/.ax/specs` stays a spec store by the project's own convention — judging only the wired
+    // one would hand back exactly the bypass this section closes for anyone who writes to the other.
+    for (const dir of [specsDir, path.join('.ax', 'specs')]) {
+        const b = resolveTarget(root, dir).toLowerCase();
+        if (t.startsWith(b + path.sep))
+            return resolved;
+    }
+    return null;
+}
+/**
+ * Which governance FILE a write lands on, or `null`.
+ *
+ * @implements A-SPEC-191 §22 (round 11) — `.ax/*` and `.claude` were judged by identity here while
+ * `.mcp.json` and `.env` were judged by a regex over the caller's string, one function away. So the
+ * same sentence that A-SPEC-163 wrote ("identity, not spelling") was true of half its subject:
+ * a link inside the project under any other name reached `.mcp.json` with the pattern looking at a
+ * different string, and on a case-insensitive volume `.MCP.json` was the same file too. The
+ * resolution is `resolveTarget`'s — it follows links, including dangling ones, because a write
+ * through a dangling link creates exactly the file it names.
+ */
+function protectedFileKindOf(root, raw) {
+    const resolved = resolveTarget(root, raw);
+    const base = resolveTarget(root, '.');
+    const foldedTarget = resolved.toLowerCase();
+    const foldedBase = base.toLowerCase();
+    if (foldedTarget !== foldedBase && !foldedTarget.startsWith(foldedBase + path.sep))
+        return null;
+    const name = path.basename(resolved).toLowerCase();
+    if (name === '.mcp.json')
+        return '.mcp.json';
+    // @implements A-SPEC-193 §8 (round 13) — 하네스가 늘면 **집행 지점도 는다**. Antigravity 는
+    // `.agents/hooks.json` 에서 PreToolUse/Stop 을 읽고 `.agents/mcp_config.json` 에서 도구를
+    // 읽는다. 그 둘은 `.claude/settings*` 및 `.mcp.json` 과 정확히 같은 성질의 파일이다 — 세션이
+    // 고칠 수 있으면 세션이 제 게이트를 끌 수 있다(실측: 배선 직후 두 파일 모두 allow 였다).
+    // `.agents` 전체를 잠그지는 않는다: 규칙과 스킬은 평범한 저작물이고, 잠그면 진짜 작업이 막힌다.
+    const parent = path.basename(path.dirname(resolved)).toLowerCase();
+    if (parent === '.agents' && (name === 'hooks.json' || name === 'mcp_config.json'))
+        return `.agents/${name}`;
+    // Example/sample/template/dist copies carry no secret — the same exclusion the hook's regex had.
+    if (/^\.env(\.[\w-]+)?$/.test(name) && !/\.(example|sample|template|dist)$/.test(name))
+        return '.env';
+    return null;
+}
+function protectedKindOf(root, raw) {
+    const target = resolveTarget(root, raw).toLowerCase();
+    const base = resolveTarget(root, '.').toLowerCase();
+    if (target !== base && !target.startsWith(base + path.sep))
+        return null; // outside the project
+    for (const d of PROTECTED_DIRS) {
+        const dir = path.join(base, d).toLowerCase();
+        if (target === dir || target.startsWith(dir + path.sep))
+            return d;
+    }
+    return null;
+}