@holmes-lab/holmes-kit 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -5,7 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 <!-- @implements A-SPEC-209 -->
-## [0.10.0] - 2026-09-04
+## [0.10.1] - 2026-09-04
+
+### Fixed
+
+- **Antigravity hooks: 0.10.0's `command`+`args` form regressed on the real launcher — reverted to an
+  unquoted single command string** (REQ-541). Field measurement on Windows/agy showed the hook
+  launcher **ignores `args`** and runs only the `command` string: 0.10.0's `command:"node"` +
+  `args:[path]` launched bare `node`, which evaluated the stdin JSON payload as code
+  (`SyntaxError: Unexpected token ':'`, exit 1) — every tool blocked. A second measurement had already
+  shown it keeps quotes **literal** (the pre-0.10.0 `node "<path>"` form died with MODULE_NOT_FOUND).
+  The only form the launcher runs is an unquoted single string, whitespace-split. `.agents/hooks.json`
+  now emits `command: "node <forward-slash path>"` (no quotes, no `args`); on win32 a path containing
+  a space is converted to its 8.3 short name, best-effort (lookup failure keeps the original path).
+  `doctor` continues to judge old (args) and new (string) wirings alike. **Re-run
+  `holmes-kit init --target <dir> --agent antigravity --force` after upgrading** — the fix changes
+  what init writes, not files already on disk. *Windows/agy real runtime and the 8.3 branch remain
+  unverified in this environment; validated by emitted shape + a naive-split execution simulation.*
 
 Governance UX tools for multi-agent round-trips and observability, a cross-harness approval fix, and
 an Antigravity portability fix. All additive and backward-compatible; existing behaviour is unchanged

package/dist/.build-id

@@ -1 +1 @@
-0d70dec-mtn1jk14
+b8567d9-mtn379s6

package/dist/holmes/cli/agents.d.ts

@@ -49,6 +49,19 @@ export interface AgentFile {
     path: string;
     content: string;
 }
+/**
+ * Antigravity 훅 배선.
+ *
+ * 매처는 `*` 다. 좁히면 그 밖의 도구가 게이트를 지나가고, Antigravity 의 도구 목록은 우리가
+ * 통제하지 않는다 — 이름을 열거하는 순간 다음에 추가되는 도구가 무료 통행권을 얻는다.
+ * (Claude 배선이 `guardrail` 모드에서 좁은 매처를 쓰는 것과 다른 선택인데, 그쪽은 그 좁힘이
+ * 무엇을 뜻하는지 문서화된 모드 선택이고 여기는 기본 배선이기 때문이다.)
+ */
+/** `node <forward-slash path>` — unquoted, single string; the only form agy's launcher runs. */
+export declare function antigravityHookCommand(scriptPath: string): string;
+/** win32-only, best-effort: a spaced path becomes its 8.3 short name (no spaces); anything else — or
+ *  any lookup failure — returns the input unchanged. */
+export declare function shortPathIfSpaced(p: string): string;
 /**
  * 이 하네스에 써야 할 파일들. **쓰지는 않는다** — 무엇을 쓸지만 말한다.
  *

package/dist/holmes/cli/agents.js

@@ -34,11 +34,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CODEX_MARKETPLACE = exports.CODEX_PLUGIN_DIR = exports.HARNESS_ENFORCES = exports.AGENTS = void 0;
+exports.antigravityHookCommand = antigravityHookCommand;
+exports.shortPathIfSpaced = shortPathIfSpaced;
 exports.agentFiles = agentFiles;
 exports.agentLinks = agentLinks;
 // @implements A-SPEC-442
 // @implements A-SPEC-193
 const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
 const mcp_launcher_1 = require("./mcp-launcher");
 /**
  * 하네스별 배선물.
@@ -107,19 +110,37 @@ const mcpConfig = (packageRoot, specsDir, launcher) => {
  * (Claude 배선이 `guardrail` 모드에서 좁은 매처를 쓰는 것과 다른 선택인데, 그쪽은 그 좁힘이
  * 무엇을 뜻하는지 문서화된 모드 선택이고 여기는 기본 배선이기 때문이다.)
  */
-// @implements A-SPEC-539.1
-// agy's hook launcher tokenizes the `command` string on whitespace and does NOT honor quotes, so an
-// earlier quoted `node "<path>"` (A-SPEC-193 §2b-2) still broke on a path with spaces: measured on a
-// Windows machine whose Node lives at `C:\Program Files\nodejs`, reported from agy 2026-09-04 — the
-// launcher split `node "C:\Program Files\...` at the space, node took `"C:\Program` for a module
-// (MODULE_NOT_FOUND), and the gate loaded not at all (silently off). Passing the script path as an
-// `args` ELEMENT — the same array form mcp_config already uses — sidesteps tokenization entirely, on
-// every platform. This supersedes the quoted-string form for the antigravity wiring; quoting only
-// ever helped launchers that honor quotes, which agy's does not.
+// @implements A-SPEC-541.1
+// Two field measurements (both 2026-09-04, Windows/agy) pinned the launcher's real contract, each by
+// killing one prior form:
+//   · `node "C:\...js"` (quoted, A-SPEC-193 §2b-2) → the quotes stayed LITERAL and node got
+//     `"C:\...` as a module path → MODULE_NOT_FOUND. The launcher does not honor quotes.
+//   · `command:'node', args:[path]` (A-SPEC-539.1 / 0.10.0) → the launcher IGNORED `args` and ran
+//     bare `node`, which took the stdin JSON payload as code → `SyntaxError: Unexpected token ':'`
+//     (exit 1), every tool blocked. The launcher executes only the single `command` string.
+// So the only form it can run is an UNQUOTED single command string, whitespace-split — which means
+// the path itself must carry no space. Forward slashes (node accepts them on Windows) avoid JSON
+// backslash escaping; a spaced path is converted to its 8.3 short name on win32, best-effort.
+/** `node <forward-slash path>` — unquoted, single string; the only form agy's launcher runs. */
+function antigravityHookCommand(scriptPath) {
+    return `node ${scriptPath.replace(/\\/g, '/')}`;
+}
+/** win32-only, best-effort: a spaced path becomes its 8.3 short name (no spaces); anything else — or
+ *  any lookup failure — returns the input unchanged. */
+function shortPathIfSpaced(p) {
+    if (process.platform !== 'win32' || !p.includes(' '))
+        return p;
+    try {
+        const out = (0, node_child_process_1.execFileSync)('cmd', ['/d', '/c', `for %I in ("${p}") do @echo %~sI`], { encoding: 'utf8' }).trim();
+        return out !== '' && !out.includes(' ') ? out : p;
+    }
+    catch {
+        return p;
+    }
+}
 const antigravityHookEntry = (packageRoot, script) => ({
     type: 'command',
-    command: 'node',
-    args: [path.join(packageRoot, 'bin', script)],
+    command: antigravityHookCommand(shortPathIfSpaced(path.join(packageRoot, 'bin', script))),
     timeout: 30,
 });
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@implements A-SPEC-209",
   "name": "@holmes-lab/holmes-kit",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Holmes-Kit — deterministic Agentic Software Engineering (ASE) harness with causal traceability (spec chain + D-CPG + RTM + phase guardrail)",
   "main": "dist/holmes/mcp/server.js",
   "types": "dist/holmes/mcp/server.d.ts",