@iowarp/clio-coder 0.4.4 → 0.4.6

package/dist/{chunk-PMZVFWSR.js → chunk-B5ZTR6KZ.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/shared-bus.ts
 init_esm_shims();
@@ -63,4 +63,4 @@ function getSharedBus() {
 export {
   getSharedBus
 };
-//# sourceMappingURL=chunk-PMZVFWSR.js.map
+//# sourceMappingURL=chunk-B5ZTR6KZ.js.map

package/dist/{chunk-I5FWO7L5.js → chunk-B6UM3OZC.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/evidence/ordering.ts
 init_esm_shims();
@@ -12,4 +12,4 @@ function compareCodepoints(left, right) {
 export {
   compareCodepoints
 };
-//# sourceMappingURL=chunk-I5FWO7L5.js.map
+//# sourceMappingURL=chunk-B6UM3OZC.js.map

package/dist/{chunk-2CU2H6KE.js → chunk-BBV5TKE6.js}

@@ -1,19 +1,19 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   typebox_exports
-} from "./chunk-5B2AEOW5.js";
+} from "./chunk-GH5ZR6JP.js";
 import {
   ToolNames
-} from "./chunk-4NSRCOYP.js";
+} from "./chunk-EHOSNVVM.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/tools/web-fetch-surface.ts
 init_esm_shims();
 var webFetchToolSurface = {
   name: ToolNames.WebFetch,
-  description: "Fetch an http(s) URL; HTML is cleaned and converted to Markdown. Non-2xx responses are errors.",
+  description: "Fetch an http(s) URL; HTML is cleaned and converted to Markdown. Non-2xx responses are errors. Non-GET/HEAD methods or any body require outward-action approval; private networks require operator opt-in.",
   parameters: typebox_exports.Object({
     url: typebox_exports.String({ description: "Fully-qualified http(s) URL." }),
     method: typebox_exports.Optional(typebox_exports.String({ description: "HTTP method (default GET)." })),
@@ -32,4 +32,4 @@ var webFetchToolSurface = {
 export {
   webFetchToolSurface
 };
-//# sourceMappingURL=chunk-2CU2H6KE.js.map
+//# sourceMappingURL=chunk-BBV5TKE6.js.map

package/dist/{chunk-23L32XTI.js → chunk-BLTEAUCB.js}

@@ -4,36 +4,37 @@ import {
   listChecks,
   runProjectCheck,
   runScriptCheck
-} from "./chunk-K6T2ZAMZ.js";
+} from "./chunk-6OII3LOK.js";
 import {
   BROWSER_MODES,
   prepareVerifyArguments,
   verifyToolSurface
-} from "./chunk-GX5WYQO4.js";
+} from "./chunk-3QKXHCGS.js";
 import {
-  escapeRegExp
-} from "./chunk-VG7TBQIY.js";
+  prepareBoundedImage
+} from "./chunk-YGDMBK7O.js";
 import {
+  escapeRegExp,
   resolveReadPath
-} from "./chunk-OQE5J4C6.js";
+} from "./chunk-V552WL53.js";
 import {
   maxOutputArg,
   timeoutArg
-} from "./chunk-BJVFZO5U.js";
+} from "./chunk-WJIMKGD6.js";
 import {
   VERIFICATION_SCRIPT_FAMILY_HINT,
   isVerificationScriptName
-} from "./chunk-UL3WSD3F.js";
+} from "./chunk-M4KFUXS7.js";
 import {
   truncateUtf8
-} from "./chunk-6XLNIQDB.js";
+} from "./chunk-MYI32N4R.js";
 import {
   combineSafeOutput,
   runCommandVector
-} from "./chunk-TOIVGRUX.js";
+} from "./chunk-GJ24ODAX.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/tools/verify/index.ts
 init_esm_shims();
@@ -105,7 +106,10 @@ async function runFrontendCheck(args, options) {
   const browserMode = browserModeArg(args.browser);
   const validateOptions = {
     timeoutMs: timeoutArg(args),
-    maxOutputBytes: maxOutputArg(args)
+    maxOutputBytes: maxOutputArg(args),
+    supportsImages: options?.supportsImages === true,
+    imageMaxBytes: Math.min(maxOutputArg(args), options?.toolResultMaxBytes ?? 5e4) - 4096,
+    images: []
   };
   if (options?.signal !== void 0) validateOptions.signal = options.signal;
   const checks = [];
@@ -130,7 +134,7 @@ ${output}`,
       details
     };
   }
-  return { kind: "ok", output, details };
+  return { kind: "ok", output, details, ...validateOptions.images?.length ? { images: validateOptions.images } : {} };
 }
 async function validateArtifact(artifactPath, checks, browserMode, options) {
   const ext = path.extname(artifactPath).toLowerCase();
@@ -488,38 +492,63 @@ async function validateBrowserLoad(artifactPath, browserMode, checks, options) {
     });
     return;
   }
-  const result = await runCommandVector(
-    browser,
-    [
-      "--headless=new",
-      "--disable-gpu",
-      "--no-sandbox",
-      "--disable-dev-shm-usage",
-      "--dump-dom",
-      pathToFileURL(artifactPath).href
-    ],
-    {
-      timeoutMs: options.timeoutMs,
-      maxOutputBytes: options.maxOutputBytes,
-      ...options.signal !== void 0 ? { signal: options.signal } : {}
+  const dir = mkdtempSync(path.join(tmpdir(), "clio-coder-browser-check-"));
+  const screenshot = path.join(dir, "loaded.png");
+  try {
+    const result = await runCommandVector(
+      browser,
+      [
+        "--headless=new",
+        "--disable-gpu",
+        "--no-sandbox",
+        "--disable-dev-shm-usage",
+        `--user-data-dir=${path.join(dir, "profile")}`,
+        `--screenshot=${screenshot}`,
+        pathToFileURL(artifactPath).href
+      ],
+      {
+        timeoutMs: options.timeoutMs,
+        maxOutputBytes: options.maxOutputBytes,
+        ...options.signal !== void 0 ? { signal: options.signal } : {}
+      }
+    );
+    let failure;
+    if (result.aborted) failure = "headless browser aborted";
+    else if (result.timedOut) failure = `headless browser timed out after ${options.timeoutMs}ms`;
+    else if (result.outputCapped) failure = `headless browser output exceeded ${options.maxOutputBytes} bytes`;
+    else if (result.exitCode !== 0) {
+      failure = `headless browser exited with ${result.exitCode ?? result.signal ?? "unknown"}`;
+    } else if (!existsSync(screenshot) || !statSync(screenshot).isFile() || statSync(screenshot).size === 0) {
+      failure = "headless browser exited without a rendered screenshot";
+    } else {
+      if (options.supportsImages) {
+        const image = await prepareBoundedImage(readFileSync(screenshot), options.imageMaxBytes ?? 0);
+        if (image) options.images?.push(image);
+        else
+          checks.push({
+            name: "browser image",
+            status: "warn",
+            message: "Screenshot omitted: could not encode within the tool result byte cap."
+          });
+      }
+      checks.push({
+        name: "browser load",
+        status: "pass",
+        message: `loaded and rendered with ${path.basename(browser)}`,
+        path: artifactPath
+      });
+      return;
     }
-  );
-  if (result.exitCode === 0 && !result.timedOut && !result.aborted && !result.outputCapped) {
+    const output = truncateUtf8(combineSafeOutput(result).trim(), 800, " [truncated]");
     checks.push({
       name: "browser load",
-      status: "pass",
-      message: `loaded with ${path.basename(browser)}`,
+      status: "fail",
+      message: `${failure}${output ? `: ${output}` : ""}`,
       path: artifactPath
     });
-    return;
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
   }
-  const output = truncateUtf8(combineSafeOutput(result).trim(), 800, " [truncated]");
-  checks.push({
-    name: "browser load",
-    status: "fail",
-    message: `headless browser exited with ${result.exitCode ?? result.signal ?? "unknown"}${output ? `: ${output}` : ""}`,
-    path: artifactPath
-  });
 }
 function parseAttributes(source) {
   const attrs = {};
@@ -636,4 +665,4 @@ var verifyTool = {
 export {
   verifyTool
 };
-//# sourceMappingURL=chunk-23L32XTI.js.map
+//# sourceMappingURL=chunk-BLTEAUCB.js.map

package/dist/{chunk-4O6MANBS.js → chunk-BS4GAMUB.js}

@@ -1,13 +1,13 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   getSharedBus
-} from "./chunk-PMZVFWSR.js";
+} from "./chunk-B5ZTR6KZ.js";
 import {
   BusChannels
-} from "./chunk-F4EKGO4N.js";
+} from "./chunk-HL26ADLH.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/termination.ts
 init_esm_shims();
@@ -91,14 +91,17 @@ var TerminationCoordinator = class {
   getExitCode() {
     return this.exitCode;
   }
-  onDrain(hook) {
-    this.drainHooks.push(hook);
+  onDrain(hook, options) {
+    if (options && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 2 ** 31 - 1)) {
+      throw new RangeError("shutdown hook timeout must be a positive 32-bit timer delay");
+    }
+    this.drainHooks.push({ run: hook, ...options });
   }
   onTerminate(hook) {
-    this.terminateHooks.push(hook);
+    this.terminateHooks.push({ run: hook });
   }
   onPersist(hook) {
-    this.persistHooks.push(hook);
+    this.persistHooks.push({ run: hook });
   }
   async shutdown(code = 0) {
     if (this.started) return;
@@ -137,12 +140,13 @@ var TerminationCoordinator = class {
     log("process.exit");
     process.exit(this.exitCode);
   }
-  async runHooks(hooks, phase, budgetMs, log) {
+  async runHooks(hooks, phase, defaultBudgetMs, log) {
     for (let i = 0; i < hooks.length; i++) {
       const hook = hooks[i];
       if (!hook) continue;
+      const budgetMs = hook.timeoutMs ?? defaultBudgetMs;
       const t0 = process.hrtime.bigint();
-      const completed = await runWithBudget(hook, budgetMs, (err) => {
+      const completed = await runWithBudget(hook.run, budgetMs, (err) => {
         const message = err instanceof Error ? err.message : String(err);
         writeShutdownNotice(`[clio-coder:termination] ${phase}[${i}] failed: ${message}`);
         if (err instanceof Error && err.stack) log(err.stack);
@@ -226,4 +230,4 @@ export {
   runWithBudget,
   getTerminationCoordinator
 };
-//# sourceMappingURL=chunk-4O6MANBS.js.map
+//# sourceMappingURL=chunk-BS4GAMUB.js.map

package/dist/{chunk-XULDXHTN.js → chunk-BT7HGDOX.js}

@@ -2,22 +2,20 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   TASK_MEMORY_DEFAULT_PROCEDURAL_CAP,
   TASK_MEMORY_POLICY_DEFAULT_TIMEOUT_MS,
+  isTerminalRunEnvelope,
   runTaskMemoryPolicy,
   taskMemoryBankDelta
-} from "./chunk-2WZ546HR.js";
-import {
-  isTerminalRunEnvelope
-} from "./chunk-75W7L2E2.js";
-import {
-  hashToolCall
-} from "./chunk-6QOTUPRG.js";
+} from "./chunk-P5JMBPDJ.js";
 import {
   taskBoardCounts
-} from "./chunk-6PAZTBPA.js";
+} from "./chunk-YPRSNUTC.js";
 import {
   legacyToolResultDigest,
   sanitizeToolResultDigest
-} from "./chunk-NAI6ZFCY.js";
+} from "./chunk-7JSSKXG2.js";
+import {
+  INSTRUCTION_SHAPED_WARNING
+} from "./chunk-WXA2CFJO.js";
 import {
   SKILL_INSTALL_OFFER_OPTION_NEVER,
   SKILL_INSTALL_OFFER_OPTION_NOT_NOW,
@@ -25,36 +23,47 @@ import {
   SKILL_INSTALL_OFFER_OPTION_USER,
   SKILL_SUGGESTION_ANCHOR,
   SKILL_SUGGESTION_PREFIX
-} from "./chunk-54X7T7DK.js";
+} from "./chunk-KAFMW7WM.js";
 import {
-  ToolNames
-} from "./chunk-4NSRCOYP.js";
+  hashToolCall
+} from "./chunk-I2K2NCZQ.js";
+import {
+  captureProjectSurface,
+  projectSurfaceTrustNotice
+} from "./chunk-NTK3WTHM.js";
 import {
   registerForegroundStream
-} from "./chunk-JSD46VO2.js";
+} from "./chunk-4U4TKZFR.js";
 import {
   ceilChars
-} from "./chunk-NZMNUPZZ.js";
+} from "./chunk-77CZRFTE.js";
+import {
+  ToolNames
+} from "./chunk-EHOSNVVM.js";
 import {
   BusChannels
-} from "./chunk-F4EKGO4N.js";
+} from "./chunk-HL26ADLH.js";
+import {
+  buildSafeToolEnv
+} from "./chunk-GJ24ODAX.js";
 import {
+  gitCommitAttributionEnabled,
   reportCommitAttributionDiagnostic,
   withManagedGitCommitAttributionEnvironment
-} from "./chunk-U6TMQNSI.js";
+} from "./chunk-LTR5QCLS.js";
 import {
   require_dist
-} from "./chunk-APJ265NV.js";
+} from "./chunk-B5GGDIHT.js";
 import {
   safeResourceWrite
-} from "./chunk-WEPFGWHJ.js";
+} from "./chunk-ZZFWWYLX.js";
 import {
   clioConfigDir
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   __toESM,
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/middleware/runtime.ts
 init_esm_shims();
@@ -207,11 +216,33 @@ function createHookBudgetTracker(options = {}) {
 // src/domains/middleware/rules.ts
 init_esm_shims();
 
+// src/domains/middleware/injection-screen.ts
+init_esm_shims();
+var INJECTION_SCREEN_RULE = {
+  rule: {
+    id: "safety.untrusted-instructions",
+    source: "builtin",
+    description: "Warn when external tool data contains instruction-shaped markers",
+    enabled: true,
+    hooks: ["after_tool"],
+    effectKinds: ["annotate_tool_result"]
+  },
+  toolNames: ["web_fetch", "read", "bash", "dispatch", "monitor"],
+  predicate: (input) => input.metadata?.untrustedInstructionMarkers === true,
+  effects: [
+    {
+      kind: "annotate_tool_result",
+      severity: "warn",
+      message: INSTRUCTION_SHAPED_WARNING
+    }
+  ]
+};
+
 // src/domains/middleware/stalled-turn.ts
 init_esm_shims();
 var STALLED_TURN_REGISTRATION_ID = "nudge.stalled-turn";
 var STALLED_TURN_REQUEST_CONTINUATION_MESSAGE = "You ended your turn after announcing an action without executing it: no tools were called. Continue now and perform the announced action, or state plainly that you are finished and waiting for the user.";
-var SKILL_SUGGESTION_WAIT_CONTINUATION_MESSAGE = "You ended your turn on a skill suggestion without doing the task. The suggestion line has already made the offer and only the operator loads a skill, so nothing is needed from them before you proceed. Continue the task now without the skill.";
+var SKILL_SUGGESTION_WAIT_CONTINUATION_MESSAGE = "You ended your turn on a skill suggestion without doing the task. The suggestion line has already made the offer and only the operator loads a skill, so the skill choice needs nothing from them before you proceed. Continue the already-authorized task now without the skill. This continuation is not an operator answer to any other question: if the remaining work is a proposal awaiting an explicit operator go-ahead, park it on the task board and say so instead of implementing.";
 var INTENT_PATTERN = /\b(let me|i['’]ll|i will|i am going to|i['’]m going to|now i|next i|let's|let us)\b/i;
 var CONCRETE_ACTION_STEMS = [
   "add",
@@ -294,8 +325,10 @@ var ACTION_OBJECT_CONNECTOR_PATTERN = /^(?:at|for|in|into|on|through|to)\s+/i;
 var ACTION_OBJECT_DETERMINER_PATTERN = /^(?:a|an|my|our|that|the|their|these|this|those|your)\s+/i;
 var ACTION_OBJECT_PATTERN = /^(?!(?:again|everyone|later|next|now|soon|then|you)\b)[`"'./~]*[\p{L}\p{N}_-]/iu;
 var CONDITIONAL_LEAD_IN_PATTERN = /\b(?:if|once|unless|until|when|whenever)\b/i;
-var CONDITIONAL_INVITATION_PATTERN = /\b(?:ask|give|point|say|send|share|tell)\b[\s\S]*\b(?:and|then)\s*$/i;
-var CONDITIONAL_OFFER_SUFFIX_PATTERN = /\b(?:if\s+(?:needed|necessary|requested)\b|if\b[^.!?]*\byou\b|when(?:ever)?\s+you\b)/i;
+var CONDITIONAL_INVITATION_PATTERN = /\b(?:answer|approve|ask|confirm|give|point|reply|respond|say|send|share|tell|type)\b[\s\S]*\b(?:and|then)\s*$/i;
+var CONDITIONAL_OFFER_SUFFIX_PATTERN = /\b(?:if\s+(?:needed|necessary|requested|approved|confirmed)\b|(?:if|after|once|until|unless|when(?:ever)?|as\s+soon\s+as|provided|assuming)\b[^.!?]*\byou\b|(?:upon|on|after|with|pending|awaiting|following)\s+(?:your\s+|the\s+operator(?:'s)?\s+)?(?:approval|go-?ahead|confirmation|sign-?off|decision|word|green\s+light|okay|ok)\b)/i;
+var OPERATOR_WAIT_LEAD_PATTERN = /\b(?:await(?:ing)?|pending|waiting\s+(?:for|on))\b/i;
+var NEGATED_OR_HYPOTHETICAL_CLAUSE_PATTERN = /^\s*(?:not|never|would|could|might|may)\b/i;
 var LET_ME_KNOW_PATTERN = /\blet me know\b/i;
 var DEFERRAL_LEAD_PATTERN = /^\s*(?:just\s+|simply\s+|now\s+)?(?:wait|hold\s+off|hold|stand\s+by|pause|defer)\b/i;
 var COMPLETION_PATTERN = /^\s*(?:all\s+done|done|complete|completed|all\s+set)\b|^\s*(?:here(?:'s| is)\s+)?(?:a\s+)?summary\b|^\s*summary\s*:?$/i;
@@ -346,11 +379,12 @@ function announcesConcreteAction(sentence) {
   const intent = INTENT_PATTERN.exec(sentence);
   if (intent) {
     const leadIn = sentence.slice(0, intent.index);
-    if (CONDITIONAL_LEAD_IN_PATTERN.test(leadIn) || CONDITIONAL_INVITATION_PATTERN.test(leadIn) || CONDITIONAL_OFFER_SUFFIX_PATTERN.test(sentence)) {
+    if (CONDITIONAL_LEAD_IN_PATTERN.test(leadIn) || CONDITIONAL_INVITATION_PATTERN.test(leadIn) || OPERATOR_WAIT_LEAD_PATTERN.test(leadIn) || CONDITIONAL_OFFER_SUFFIX_PATTERN.test(sentence)) {
       return false;
     }
     const clause = sentence.slice(intent.index + intent[0].length);
     if (DEFERRAL_LEAD_PATTERN.test(clause)) return false;
+    if (NEGATED_OR_HYPOTHETICAL_CLAUSE_PATTERN.test(clause)) return false;
     if (hasActionWithObject(clause)) return true;
     if (CONDITIONAL_LEAD_IN_PATTERN.test(clause)) return false;
     return namesToolTarget(clause);
@@ -399,7 +433,10 @@ function isQuestion(sentence) {
 }
 
 // src/domains/middleware/rules.ts
-var BUILTIN_MIDDLEWARE_RULE_DEFINITIONS = [STALLED_TURN_RULE_DEFINITION];
+var BUILTIN_MIDDLEWARE_RULE_DEFINITIONS = [
+  STALLED_TURN_RULE_DEFINITION,
+  INJECTION_SCREEN_RULE
+];
 var BUILTIN_MIDDLEWARE_RULE_IDS = BUILTIN_MIDDLEWARE_RULE_DEFINITIONS.map((definition) => definition.rule.id);
 function listMiddlewareRuleDefinitions() {
   return BUILTIN_MIDDLEWARE_RULE_DEFINITIONS.map(cloneRuleDefinition);
@@ -1167,7 +1204,9 @@ function matchMarketplaceSkills(userText, entries, excludedNames) {
     const match = scorePromotionEntry(userText, entry);
     if (match) matches.push(match);
   }
-  return matches.sort((a, b) => b.score - a.score || a.entry.name.localeCompare(b.entry.name));
+  return matches.sort(
+    (a, b) => Number(b.matchedTrigger !== void 0) - Number(a.matchedTrigger !== void 0) || b.score - a.score || a.entry.name.localeCompare(b.entry.name)
+  );
 }
 var OWN_MARKETPLACE_URL_PREFIX = "https://github.com/iowarp/clio-coder/";
 function isOwnMarketplaceSource(entry) {
@@ -2017,7 +2056,7 @@ function announceMemoryStepEndpoint(deps, complete) {
 init_esm_shims();
 var TASK_BOARD_REMINDER_REGISTRATION_ID = "observer.task-board-reminder";
 function taskBoardReminderMessage(steps) {
-  return `[Tasks] This request enumerates ${steps} steps. Before the first edit, declare the task board: tasks action="plan" with a title and one task per step, then work them one at a time ("start", then "done" with an evidence note).`;
+  return `[Tasks] This request enumerates ${steps} steps. Before the first edit, declare the task board: tasks action="plan" with a title and one task per authorized step, then work them one at a time ("start", then "done" with an evidence note). A plan does not authorize implementation: for proposed work awaiting an operator go-ahead, use action="block" with a note naming the pending operator decision, or action="drop", and wait.`;
 }
 function countEnumeratedSteps(text) {
   const value = text ?? "";
@@ -2078,7 +2117,7 @@ function buildOpenTasksMessage(board) {
   const rows = open.map((task) => `  ${task.status === "active" ? "[>]" : "[ ]"} ${task.id} ${task.title}`);
   return `[Clio Coder] task board "${board.title}" still has ${open.length} of ${counts.total} task(s) open:
 ${rows.join("\n")}
-Continue working them, or record the honest state on the board: tasks action="done" with an evidence note, action="block" with a reason, or action="drop". Do not end the turn with a stale board.`;
+Continue only work already authorized by the operator. This reminder and a self-created plan are not authorization to implement a proposal. If implementation awaits an operator decision, use tasks action="block" with a note naming that pending operator decision, or action="drop"; then wait for an explicit operator go-ahead. A skill-install choice does not authorize implementation. Otherwise record the honest state on the board: tasks action="done" with an evidence note, action="block" with a reason, or action="drop". Do not end the turn with a stale board.`;
 }
 function createTaskNudgeRegistration(options) {
   return {
@@ -2913,6 +2952,10 @@ function userHookToRegistration(hook, deps) {
     evaluate: (input) => {
       if (!hook.enabled) return [];
       try {
+        if (deps.isTrusted?.() === false) {
+          deps.recordReceipt({ ...baseReceipt(input), outcome: "skipped" });
+          return [];
+        }
         return evaluateHook(hook, deps, baseReceipt(input));
       } catch {
         deps.recordReceipt({ ...baseReceipt(input), outcome: "skipped" });
@@ -2964,16 +3007,8 @@ function evaluateHook(hook, deps, base) {
 init_esm_shims();
 var import_yaml = __toESM(require_dist(), 1);
 import { spawnSync } from "node:child_process";
-import { readFileSync as readFileSync3 } from "node:fs";
-import { join } from "node:path";
 var COMMAND_OUTPUT_MAX_BYTES = 1024 * 1024;
-function readBatch(source, filePath, fileIssues) {
-  let text;
-  try {
-    text = readFileSync3(filePath, "utf8");
-  } catch {
-    return null;
-  }
+function readBatch(source, filePath, text, fileIssues) {
   try {
     const parsed = (0, import_yaml.parse)(text);
     return { source, declarations: parsed ?? [] };
@@ -3006,31 +3041,47 @@ function readHookSources(options) {
     }
     batches.push({ source, declarations: entry.declarations });
   }
-  const projectBatch = readBatch(
-    { origin: "project", sourcePath: ".clio-coder/hooks.yaml" },
-    join(options.cwd, ".clio-coder", "hooks.yaml"),
-    fileIssues
-  );
-  if (projectBatch) batches.push(projectBatch);
-  const localBatch = readBatch(
-    { origin: "project.local", sourcePath: ".clio-coder/hooks.local.yaml" },
-    join(options.cwd, ".clio-coder", "hooks.local.yaml"),
-    fileIssues
-  );
-  if (localBatch) batches.push(localBatch);
-  return { batches, fileIssues };
+  const projectSurface = captureProjectSurface(options.cwd, "hooks");
+  for (const [index, file] of projectSurface.files.entries()) {
+    const source = {
+      origin: index === 0 ? "project" : "project.local",
+      sourcePath: index === 0 ? ".clio-coder/hooks.yaml" : ".clio-coder/hooks.local.yaml"
+    };
+    if (file.error !== void 0) fileIssues.push({ source, message: file.error });
+    if (file.text === null) continue;
+    if (projectSurface.verdict !== "trusted") {
+      fileIssues.push({ source, message: projectSurfaceTrustNotice(projectSurface, file.path) });
+      continue;
+    }
+    const batch = readBatch(source, file.path, file.text, fileIssues);
+    if (batch) batches.push(batch);
+  }
+  return { batches, fileIssues, projectSurface };
 }
 function buildUserHookRegistrations(options) {
   const workspaceRoot = options.workspaceRoot ?? options.cwd;
   const readOptions = { cwd: options.cwd };
   if (options.capturedSources !== void 0) readOptions.capturedSources = options.capturedSources;
-  const { batches, fileIssues } = readHookSources(readOptions);
+  const { batches, fileIssues, projectSurface } = readHookSources(readOptions);
   const loaded = loadUserHooks(batches, { workspaceRoot });
   const runCommand = options.runCommand ?? spawnSyncCommandRunner();
+  let reportedUntrusted = false;
+  const projectStillTrusted = () => {
+    const current = captureProjectSurface(options.cwd, "hooks");
+    if (current.verdict === "trusted" && current.contentHash === projectSurface.contentHash) return true;
+    if (!reportedUntrusted) {
+      reportedUntrusted = true;
+      options.report?.(
+        `[clio-coder:hooks] project hooks changed or trust was revoked; hooks skipped. Review with clio-coder config trust hooks, then reload extensions.`
+      );
+    }
+    return false;
+  };
   const registrations = loaded.hooks.map(
     (hook) => userHookToRegistration(hook, {
       recordReceipt: options.recordReceipt,
       runCommand,
+      ...hook.source.origin === "project" || hook.source.origin === "project.local" ? { isTrusted: projectStillTrusted } : {},
       ...options.now !== void 0 ? { now: options.now } : {}
     })
   );
@@ -3039,8 +3090,9 @@ function buildUserHookRegistrations(options) {
 function spawnSyncCommandRunner() {
   return (argv, options) => {
     const [command, ...args] = argv;
-    const attribution = withManagedGitCommitAttributionEnvironment(process.env, {
+    const attribution = withManagedGitCommitAttributionEnvironment(buildSafeToolEnv(), {
       cwd: options.cwd ?? process.cwd(),
+      enabled: gitCommitAttributionEnabled(process.env),
       evidence: {}
     });
     reportCommitAttributionDiagnostic(attribution.diagnostic);
@@ -3096,4 +3148,4 @@ export {
   createWatchdogRegistration,
   MiddlewareDomainModule
 };
-//# sourceMappingURL=chunk-XULDXHTN.js.map
+//# sourceMappingURL=chunk-BT7HGDOX.js.map

package/dist/{chunk-S66XZJOF.js → chunk-C27U2TYG.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/guardrails.ts
 init_esm_shims();
@@ -65,4 +65,4 @@ export {
   configureGuardrails,
   resolveGuardrail
 };
-//# sourceMappingURL=chunk-S66XZJOF.js.map
+//# sourceMappingURL=chunk-C27U2TYG.js.map

package/dist/{chunk-QZWQA4DE.js → chunk-CBSKDFWL.js}

@@ -2,10 +2,10 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   ToolNames,
   isBuiltinToolName
-} from "./chunk-4NSRCOYP.js";
+} from "./chunk-EHOSNVVM.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/tools/profiles.ts
 init_esm_shims();
@@ -98,4 +98,4 @@ export {
   assertToolProfileEnforceable,
   applyToolProfile
 };
-//# sourceMappingURL=chunk-QZWQA4DE.js.map
+//# sourceMappingURL=chunk-CBSKDFWL.js.map

package/dist/{chunk-2LEAKD4C.js → chunk-CKK25WN3.js}

@@ -1,10 +1,10 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   resolveClioDirs
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/compile-cache.ts
 init_esm_shims();
@@ -69,4 +69,4 @@ export {
   workerCompileCacheEnvironment,
   deleteInjectedCompileCacheFrom
 };
-//# sourceMappingURL=chunk-2LEAKD4C.js.map
+//# sourceMappingURL=chunk-CKK25WN3.js.map

package/dist/{chunk-BYP5D4HI.js → chunk-CTTI7G3T.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/xdg.ts
 init_esm_shims();
@@ -123,4 +123,4 @@ export {
   stateRootRemoved,
   resetXdgCache
 };
-//# sourceMappingURL=chunk-BYP5D4HI.js.map
+//# sourceMappingURL=chunk-CTTI7G3T.js.map