@khoavu882/doflow 2.0.0-beta.5 → 2.0.0

package/core/harnesses/shared/hooks/policies/capture-failure.sh

@@ -16,29 +16,60 @@
 #   - never rotates the file (rotation is done by the Node writers only, DEC-019);
 #   - never blocks, never changes the policy's decision, and swallows every error.
 
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_CAPTURE_FAILURE_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_CAPTURE_FAILURE_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_CAPTURE_FAILURE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_CAPTURE_FAILURE_DIR=. ;; esac
 # The line holds only the policy name and the point name from DoFlow's own code, the working
 # directory, the harness name and the install version: never the tool call, its arguments or stdin.
-# It is a no-op when no failure home can be resolved (HOME unset, or XDG_CONFIG_HOME relative) and
-# while capture is off (the `off` sentinel file wins; DOFLOW_FAILURE_CAPTURE=off|0|false|no also
-# turns it off), the same rules the Node writer follows (IC-011, IC-014).
+# It is a no-op when there is no config home (neither XDG_CONFIG_HOME nor HOME is set to an absolute
+# path; doflow_config_home below) and while capture is off (DOFLOW_FAILURE_CAPTURE=off|0|false|no,
+# the `off` sentinel file, or a `failure.capture` value other than "on" in <config home>/settings.json,
+# read by doflow_lex_capture below), the same rules the Node writer follows (IC-011, IC-014, IC-005).
+# The two marked blocks are byte-identical to the ones in bin/doflow-run.
+
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+
+# BEGIN doflow-settings-lexical v1 (rule: src/runtime/settings/lexical.js; checked by test/guards/settings.test.js)
+doflow_lex_capture() {
+  local f="${1:-}" text="" rest="" d=""
+  local re='"failure\.capture"[[:space:]]*:[[:space:]]*("[^"]*"|[^,}"[:space:]]*)'
+  DOFLOW_LEX_CAPTURE=""
+  if [ ! -e "$f" ]; then
+    # Missing is no setting, unless the folder holding it cannot be searched (Node: EACCES is off).
+    d="${f%/*}"
+    if [ -n "$d" ] && [ "$d" != "$f" ] && [ -d "$d" ] && [ ! -x "$d" ]; then DOFLOW_LEX_CAPTURE="off"; fi
+    return 0
+  fi
+  if [ ! -f "$f" ] || [ ! -r "$f" ]; then DOFLOW_LEX_CAPTURE="off"; return 0; fi
+  IFS= read -r -d '' text < "$f" || true
+  rest="$text"
+  while [[ $rest =~ $re ]]; do
+    if [ "${BASH_REMATCH[1]}" = '"on"' ]; then DOFLOW_LEX_CAPTURE="${DOFLOW_LEX_CAPTURE:-on}"; else DOFLOW_LEX_CAPTURE="off"; fi
+    rest="${rest#*"${BASH_REMATCH[0]}"}"
+  done
+  return 0
+}
+# END doflow-settings-lexical v1
 
 doflow_capture_failure() {
   local policy="${1:-}" point="${2:-}"
   local LC_ALL=C   # byte-wise lengths and cuts; scoped to this function
   local home="" setting="" version="" harness="" project="" cwd="" hp="" at="" line="" here="" dir=""
 
-  if [ -n "${XDG_CONFIG_HOME:-}" ]; then
-    case "$XDG_CONFIG_HOME" in
-      /*) home="$XDG_CONFIG_HOME/doflow/failures" ;;
-      *) return 0 ;;
-    esac
-  else
-    case "${HOME:-}" in
-      /*) home="$HOME/.config/doflow/failures" ;;
-      *) return 0 ;;
-    esac
-  fi
+  doflow_config_home
+  [ -n "$DOFLOW_HOME" ] || return 0
+  home="$DOFLOW_HOME/failures"
 
   # Case-insensitive, whitespace trimmed at the ends only: the same reading the Node writer has.
   setting="$(printf '%s' "${DOFLOW_FAILURE_CAPTURE:-}" | tr '[:upper:]' '[:lower:]')" || return 0
@@ -48,6 +79,8 @@ doflow_capture_failure() {
     off|0|false|no) return 0 ;;
   esac
   [ -f "$home/off" ] && return 0
+  doflow_lex_capture "$DOFLOW_HOME/settings.json"
+  [ "$DOFLOW_LEX_CAPTURE" = off ] && return 0
 
   [[ "$policy" =~ ^[a-z][a-z0-9-]{0,39}$ ]] || policy="unknown"
   [[ "$point" =~ ^[A-Za-z][A-Za-z0-9._:-]{0,39}$ ]] || return 0

package/core/harnesses/shared/hooks/policies/compact-text.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# IC-001 (feature 116): shared PreCompact text builder; sourced, not executed.
+
+doflow_compact_text() {
+  local CWD="${1:-}"
+  local preserve branch sha uncommitted recent text
+
+  preserve='Preserve: decisions made, files modified, open questions, planned next steps, acceptance criteria and pending verification of the active task.'
+
+  if [[ -n "$CWD" ]] && is_git_worktree "$CWD"; then
+    branch=$(git_branch_of "$CWD" || echo "")
+    sha=$(git_short_sha_of "$CWD" || echo "")
+    uncommitted=$(git_uncommitted_count_of "$CWD" || echo "0")
+    recent=$(run_with_timeout 1 -- git -C "$CWD" log --format="%h %s" -2 2>/dev/null \
+      | awk 'NR>1{printf " | "}{printf "%s",$0}' || echo "")
+
+    text=$(printf '%s\nInclude in compact summary:\n- git branch: %s sha: %s\n- uncommitted files: %s\n- cwd: %s\n- recent commits: %s' \
+      "$preserve" "${branch:-unknown}" "${sha:-unknown}" "$uncommitted" "${CWD:-unknown}" "${recent:-none}")
+  else
+    text=$(printf '%s\nInclude in compact summary:\n- cwd: %s (not a git repository)' \
+      "$preserve" "${CWD:-unknown}")
+  fi
+
+  # The cap is 490 BYTES in every locale: LC_ALL=C makes the substring and length below count bytes,
+  # where a UTF-8 locale would count characters. A cut can then end inside a multi-byte character, so
+  # a trailing partial UTF-8 sequence is dropped (FU-tsq77m).
+  local LC_ALL=C cut i b need
+  cut="${text:0:490}"
+  i=$(( ${#cut} - 1 ))
+  # Walk back over at most three continuation bytes (0x80-0xBF) to the byte that starts the last character.
+  while [[ $i -ge 1 && $(( ${#cut} - i )) -le 3 ]]; do
+    printf -v b '%d' "'${cut:i:1}"
+    b=$(( b & 255 )) # the shell may print a byte above 127 as a negative number (bash 3.2) or a code unit
+    [[ $b -ge 128 && $b -lt 192 ]] || break
+    i=$(( i - 1 ))
+  done
+  printf -v b '%d' "'${cut:i:1}"
+  b=$(( b & 255 ))
+  need=1
+  [[ $b -ge 192 ]] && need=2
+  [[ $b -ge 224 ]] && need=3
+  [[ $b -ge 240 ]] && need=4
+  [[ $(( ${#cut} - i )) -lt $need ]] && cut="${cut:0:i}"
+  DF_COMPACT_TEXT="$cut"
+  return 0
+}

package/core/harnesses/shared/hooks/policies/contract.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # contract.sh — shared decision and envelope contract for canonical policies.
 #
 # This file is sourced by policy scripts. It sets no shell options, installs no traps, reads no
@@ -43,6 +44,7 @@ doflow_read_envelope() {
     DF_ENV_TOOL=
     DF_ENV_PATHS=
     DF_ENV_COMMAND=
+    DF_ENV_CWD=
     DF_ENV_PATCH=
     DF_ENV_ROOT=
     DF_ENV_TASK=
@@ -67,6 +69,7 @@ doflow_read_envelope() {
      shellvar("DF_ENV_TOOL"; field("tool")),
      shellvar("DF_ENV_PATHS"; ([$fields.paths[]? | select(type == "string")] | join("\n"))),
      shellvar("DF_ENV_COMMAND"; field("command")),
+     shellvar("DF_ENV_CWD"; ($object.cwd // "") | if type=="string" then . else "" end),
      shellvar("DF_ENV_PATCH"; field("patch")),
      shellvar("DF_ENV_ROOT"; field("projectRoot")),
      shellvar("DF_ENV_TASK"; field("taskId"))][]

package/core/harnesses/shared/hooks/policies/deny-json.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # deny-json.sh — shared PreToolUse deny-JSON emitters for front-door dispatchers.
 #
 # Deliberately carries no `set` directive (unlike lib.sh, which sets -euo
@@ -10,7 +11,7 @@
 #
 # Usage: source "<policy-dir>/deny-json.sh"
 
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_DENY_JSON_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_DENY_JSON_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_DENY_JSON_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_DENY_JSON_DIR=. ;; esac
 
 # Escape a string as a JSON string body without external tools. Work bytewise so
 # every control byte is handled the same way regardless of the caller's locale.
@@ -52,13 +53,3 @@ emit_pretooluse_deny_nested() {
     printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":%s}}\n' "$(_doflow_json_reason "$reason")"
   fi
 }
-
-# Gemini shape: flat {decision, reason} (packages/core/src/hooks/types.ts).
-emit_pretooluse_deny_flat() {
-  local reason="$1"
-  if command -v jq >/dev/null 2>&1; then
-    jq -n --arg reason "$reason" '{decision: "deny", reason: $reason}'
-  else
-    printf '{"decision":"deny","reason":%s}\n' "$(_doflow_json_reason "$reason")"
-  fi
-}

package/core/harnesses/shared/hooks/policies/emission-rules.sh

@@ -0,0 +1,37 @@
+# Generated by node src/runtime/context/emission-rules.js --write. Do not edit.
+# rules-digest: sha256:3f344067dc5466521e89700b8ca03c5729dfe2e3bc0896629d4e08a5395dd4bb
+DF_RULES_VERSION=1
+DF_RULES_MAX_BYTES_DEFAULT=16384
+DF_RULES_SUMMARY_CAP=4000
+DF_RULES_SUMMARY_READ=65536
+doflow_emission_rule() {
+  # $1 = event.segment, $2 = vector: input values joined with ':' in IC-002 order
+  case "$1|$2" in
+    'compact-instructions.instructions|main') DF_ACTION=include ;;
+    'compact-instructions.instructions|worker') DF_ACTION=include ;;
+    'compact-meta.meta|main:default-main') DF_ACTION=write ;;
+    'compact-store.summary|main:default-main') DF_ACTION=write ;;
+    'compact-store.summary|main:launched') DF_ACTION=write ;;
+    'compact-store.summary|worker:launched') DF_ACTION=write ;;
+    'delta.pack|true') DF_ACTION=include ;;
+    'launch.grant|fits:false') DF_ACTION=whole ;;
+    'launch.grant|fits:true') DF_ACTION=whole ;;
+    'launch.grant|over:false') DF_ACTION=pointer ;;
+    'launch.pack|false') DF_ACTION=include ;;
+    'launch.slot|false') DF_ACTION=claim ;;
+    'launch.summary|main:false:pending') DF_ACTION=truncate ;;
+    'launch.summary|worker:false:pending') DF_ACTION=truncate ;;
+    'legacy-adopt.legacy|main:default-main:false:false:true') DF_ACTION=adopt ;;
+    'prompt.git|main:false') DF_ACTION=include ;;
+    'prompt.grant|false:fits:false') DF_ACTION=whole ;;
+    'prompt.grant|false:fits:true') DF_ACTION=whole ;;
+    'prompt.grant|false:over:false') DF_ACTION=pointer ;;
+    'prompt.nudge|main:nudge') DF_ACTION=include ;;
+    'prompt.slot|false') DF_ACTION=claim ;;
+    'prompt.summary|main:default-main:false:false:pending') DF_ACTION=truncate ;;
+    'prompt.summary|main:launched:false:false:pending') DF_ACTION=truncate ;;
+    'prompt.summary|worker:launched:false:false:pending') DF_ACTION=truncate ;;
+    'prompt.warning|main:false:false:true') DF_ACTION=include ;;
+    *) DF_ACTION=skip ;;
+  esac
+}

package/core/harnesses/shared/hooks/policies/emission.jq

@@ -0,0 +1,209 @@
+# emission.jq — one-pass renderer of the prompt segments and the hook response (078 IC-002, IC-004
+# step 7). renderEmission() in src/runtime/context/arbitrate.ts is the reference; both must give
+# expected.text, bytes, refused and dropped of test/fixtures/emission/render-corpus.json byte for
+# byte (IC-022, RK7).
+#
+# Invocation (IC-004 step 7), one process:
+#   jq -n -r -f emission.jq --argjson plan "$PLAN" \
+#     --rawfile git <git-context.json> --rawfile summary <claimed summary> \
+#     --rawfile grant <claimed grant> --arg warning "$WARNING" --arg nudge "$NUDGE"
+#
+# All four names are always bound (jq refuses an undefined $name); emission.sh binds $warning with
+# --arg, because the warning claim renames the file and reads it before the render. A file that does not
+# exist is passed as /dev/null and its name listed in plan.absent; an empty existing file is not
+# absent (an empty warning still renders, an empty git capture is "Not a git repository.").
+#
+# plan:
+#   actions       IC-001 actions by segment; only git, summary, warning, grant and nudge render here
+#   maxBytes      positive integer, the IC-002 byte budget
+#   harness       the harness name (DOFLOW_AGENT); sessionTitle is added on every harness but
+#                 "codex", whose envelope rejects unknown fields (DEC-030)
+#   title         true when a title may be set (the payload carries no session_title)
+#   absent        names among git, summary, grant, warning whose file does not exist (default [])
+#   summaryBytes  the claimed summary file's full size, which can exceed the bounded read; it
+#                 defaults to the UTF-8 size of $summary
+#   mode          "response" (default) prints the hook response; "render" prints
+#                 {text, bytes, refused, dropped, segments}, the renderEmission() result, for parity;
+#                 "hook" (emission.sh, run with -r) prints one first line holding the dropped
+#                 segment names joined with tabs (possibly empty), a second line holding the
+#                 response digest (empty unless plan.digest), then the hook response
+#   digest        hook mode: true computes response_digest (rider R1, 091); other modes ignore it
+#
+# Response bytes (jq's default pretty print): emission is
+#   {"hookSpecificOutput": {"hookEventName": "UserPromptSubmit", "additionalContext": ...}}
+# with sessionTitle on every harness but Codex (DEC-030), when plan.title holds and the git action built a title
+# ("{branch?unknown} — {sha?unknown}", or "no-git" outside a repository; none when the capture
+# file is missing). Nothing rendered prints {} and a newline. Any error exits non-zero and the
+# caller answers with the silent response.
+#
+# Counting (design R1): characters are code points (jq string length and slices), budgets are
+# UTF-8 bytes (utf8bytelength). Portability: jq 1.6+ built with Oniguruma; utf8bytelength is the
+# one builtin newer than 1.5. No index/rindex on strings (byte offsets in 1.6) and no 1.7-only
+# builtin (trim, ltrim, rtrim, abs, pick, toarray, have_decnum). Every regex is anchored
+# with \A or \z, never ^ or $, which Oniguruma reads per line.
+
+def summary_cap: 4000;
+def summary_read: 65536;
+
+# Trailing newlines removed, as $(...) does.
+def rstrip_nl: sub("\n+\\z"; "");
+def no_cr: split("\r") | join("");
+
+# `jq -r '<field> // empty'` in a $(...): null and false are empty, other scalars print as JSON.
+def jq_field:
+  if . == null or . == false then ""
+  elif type == "string" then rstrip_nl
+  else tojson | rstrip_nl
+  end;
+
+# A summary or grant record: \r removed, trailing newlines dropped, frontmatter keys from the lines
+# between the first two `---` lines (first match wins, spaces after `key:` stripped), body from the
+# first non-empty line after the second `---`, trailing newlines dropped. Fewer than two `---`
+# lines give an empty body.
+def parse_record:
+  (no_cr | rstrip_nl | split("\n"))
+  | reduce .[] as $line ({fences: 0, started: false, fields: {}, body: []};
+      if .fences < 2 and $line == "---" then .fences += 1
+      elif .fences == 1 then
+        ($line | split(":")) as $parts
+        | if ($parts | length) > 1 and ($parts[0] | length) > 0 and (.fields | has($parts[0]) | not)
+          then .fields[$parts[0]] = ($parts[1:] | join(":") | sub("\\A +"; ""))
+          else . end
+      elif .fences >= 2 and (.started or $line != "") then .started = true | .body += [$line]
+      else . end)
+  | {fields: .fields, body: (.body | join("\n") | rstrip_nl)};
+
+# A bracketed header value: `]` removed, then empty when it is "unknown".
+def known: (. // "") | split("]") | join("") | if . == "unknown" then "" else . end;
+
+def header_tail:
+  (.compacted_at | known) as $at | (.branch | known) as $branch
+  | (if $at != "" then ", compacted \($at)" else "" end)
+    + (if $branch != "" then " on branch \($branch)" else "" end);
+
+# The git capture as an object; anything unparseable or not an object reads as {}.
+def capture($raw):
+  (try ($raw | fromjson) catch null) | if type == "object" then . else {} end;
+
+def is_repo: (.is_git_repo | jq_field) == "true";
+
+def render_git($raw; $missing):
+  if $missing then "Git context unavailable for this session."
+  else capture($raw)
+    | if is_repo | not then "Not a git repository."
+      else
+        ((if (.commits | type) == "array" then .commits else [] end)
+          | map(jq_field) | map(select(. != "")) | .[0:5] | join(" · ")) as $commits
+        | (.stash_count | jq_field) as $stash
+        | "Git context — branch: \(.branch | jq_field | if . == "" then "unknown" else . end) | \(.sha | jq_field | if . == "" then "unknown" else . end)\n"
+          + "Last commits: \(if $commits == "" then "none" else $commits end)\n"
+          + "Uncommitted files: \(.uncommitted_count | jq_field | if . == "" then "0" else . end)"
+          + (if ($stash | test("\\A[0-9]+\\z")) and ($stash | tonumber) > 0 then " | Stashed: \($stash)" else "" end)
+      end
+  end;
+
+def git_title($raw; $missing):
+  if $missing then null
+  else capture($raw)
+    | if is_repo then
+        "\(.branch | jq_field | if . == "" then "unknown" else . end) — \(.sha | jq_field | if . == "" then "unknown" else . end)"
+      else "no-git" end
+  end;
+
+# null when the body is empty: an empty summary renders nothing.
+def render_summary($size):
+  parse_record
+  | if .body == "" then null
+    else (.body | length) as $n
+      | (if $n > summary_cap
+          then .body[0:summary_cap] + "\n[summary truncated: first \(summary_cap) of \(if $size > summary_read then "at least " else "" end)\($n) characters]"
+          else .body end) as $shown
+      | "\n\n[Prior session summary\(.fields | header_tail)]\n\($shown)"
+    end;
+
+def render_grant: "[Granted summary from lineage \(.fields.from_lineage // "")\(.fields | header_tail)]\n\(.body)";
+
+def render_pointer($max): "[Granted summary \(.fields.summary_id // "") withheld: \(.body | utf8bytelength) bytes exceed the \($max)-byte context budget]";
+
+def join_order: ["git", "summary", "warning", "grant", "nudge"];
+
+# IC-002 join: summary drops its leading blank line when nothing precedes it; grant and nudge gain
+# one when something does.
+def join_segments:
+  . as $p
+  | reduce (join_order[] | select($p[.] != null)) as $s ("";
+      if $s == "summary" then (if . == "" then . + ($p[$s] | .[2:]) else . + $p[$s] end)
+      elif $s == "grant" or $s == "nudge" then (if . == "" then "" else . + "\n\n" end) + $p[$s]
+      else . + $p[$s] end);
+
+def render($plan; $in):
+  ($plan.actions // {}) as $a
+  | $plan.maxBytes as $max
+  | if ($max | type) != "number" or $max <= 0 or ($max | floor) != $max then error("plan.maxBytes must be a positive integer") else . end
+  | ($plan.absent // []) as $absent
+  | def present($k): ($absent | map(select(. == $k)) | length) == 0;
+    ({}
+      | if $a.git == "include" then .git = render_git($in.git; present("git") | not) else . end
+      | if $a.summary == "truncate" and present("summary")
+        then ($in.summary | render_summary($plan.summaryBytes // ($in.summary | utf8bytelength))) as $s
+          | if $s != null then .summary = $s else . end
+        else . end
+      | if $a.warning == "include" and present("warning") then .warning = "\n[Prior session warning: \($in.warning | rstrip_nl)]" else . end
+      | if $a.nudge == "include" and ($in.nudge | type) == "string" and $in.nudge != "" then .nudge = $in.nudge else . end
+    ) as $optional
+    | (if ($a.grant == "whole" or $a.grant == "pointer") and present("grant")
+        then ($in.grant | parse_record) as $r
+          | ($r | render_grant) as $whole
+          | if $a.grant == "whole" and ($whole | utf8bytelength) <= $max
+            then {selected: {grant: $whole}, refused: false}
+            else {selected: {grant: ($r | render_pointer($max))}, refused: true} end
+        else {selected: {}, refused: false} end)
+    | . + {dropped: []}
+    | reduce ("git", "summary", "warning", "nudge") as $s (.;
+        if $optional[$s] == null then .
+        elif (.selected + {($s): $optional[$s]} | join_segments | utf8bytelength) <= $max then .selected[$s] = $optional[$s]
+        else .dropped += [$s] end)
+    | (.selected | join_segments) as $text
+    | {
+        text: (if $text == "" then null else $text end),
+        bytes: ($text | utf8bytelength),
+        refused: .refused,
+        dropped: .dropped,
+        segments: [join_order[] as $s | select(.selected[$s] != null) | $s]
+      };
+
+def response($plan; $in; $result):
+  if $result.text == null then {}
+  else
+    (if $plan.harness != "codex" and $plan.title == true and ($plan.actions // {}).git == "include"
+      then git_title($in.git; ($plan.absent // []) | map(select(. == "git")) | length > 0) else null end) as $title
+    | {"hookSpecificOutput": ({"hookEventName": "UserPromptSubmit", "additionalContext": $result.text}
+        + (if $title != null and $title != "" then {"sessionTitle": $title} else {} end))}
+  end;
+
+# Rider R1 (091): the response exactly as jq's default pretty print writes it (indent 2, insertion
+# order, the same string escaping as tojson), without the trailing newline. The response shape is
+# fixed: {} or one hookSpecificOutput object of string values.
+def pretty_response:
+  if . == {} then "{}"
+  else "{\n  \"hookSpecificOutput\": {\n"
+    + ([.hookSpecificOutput | to_entries[] | "    \(.key | tojson): \(.value | tojson)"] | join(",\n"))
+    + "\n  }\n}"
+  end;
+
+# 8 lowercase hex of h = (h*31 + c) mod 2^32 over the code points of the pretty response. Every step
+# stays below 2^38, exact in doubles; mod and the nibbles use floor, not %, which casts to int on old jq.
+def response_digest:
+  (pretty_response | explode | reduce .[] as $c (0; (. * 31 + $c) | . - ((. / 4294967296) | floor) * 4294967296)) as $h
+  | [268435456, 16777216, 1048576, 65536, 4096, 256, 16, 1]
+  | map(($h / . | floor) - (($h / . / 16) | floor) * 16)
+  | map("0123456789abcdef"[.:. + 1]) | join("");
+
+{git: $git, summary: $summary, grant: $grant, warning: $warning, nudge: $nudge} as $in
+| render($plan; $in) as $result
+| ($plan.mode // "response") as $mode
+| if $mode == "render" then $result
+  elif $mode == "hook" then
+    response($plan; $in; $result) as $response
+    | ($result.dropped | join("\t")), (if $plan.digest == true then $response | response_digest else "" end), $response
+  else response($plan; $in; $result) end