@litfamily/litcodex 1.0.0

package/node_modules/@litcodex/lit-loop/dist/goal-status.js

@@ -0,0 +1,32 @@
+// src/goal-status.ts — pure goal-status helpers for Codex native-goal integration.
+//
+// Predicates and objective resolver for the lit-loop ↔ Codex `/goal` handoff. All functions are
+// PURE — no I/O, no store, no clock. Imports only loop-types (which re-exports state-types).
+export function codexGoalMode(plan) {
+    return plan.codexGoalMode ?? "aggregate";
+}
+export function aggregateCodexObjective(plan) {
+    return (plan.codexObjective ??
+        `Complete the durable lit-loop plan in ${plan.goalsPath}, including any later accepted/appended goals; use ${plan.ledgerPath} as the audit trail.`);
+}
+/** The Codex goal objective for a lit-loop plan/goal. Defaults to one aggregate goal per plan. */
+export function expectedCodexObjective(plan, goal) {
+    return codexGoalMode(plan) === "per_story" ? goal.objective : aggregateCodexObjective(plan);
+}
+/** True when the goal has at least one criterion and every criterion is `pass`. */
+export function hasAllCriteriaPass(goal) {
+    return goal.successCriteria.length > 0 && goal.successCriteria.every((c) => c.status === "pass");
+}
+/** True when every goal in the plan is `complete`. */
+export function isLitLoopDone(plan) {
+    return plan.goals.every((g) => g.status === "complete");
+}
+/**
+ * True when the given goal is NOT complete AND every OTHER goal IS complete — meaning completing
+ * this goal would finish the entire plan.
+ */
+export function isFinalRunCompletionCandidate(plan, goal) {
+    if (goal.status === "complete")
+        return false;
+    return plan.goals.every((g) => g.id === goal.id || g.status === "complete");
+}

package/node_modules/@litcodex/lit-loop/dist/guards.d.ts

@@ -0,0 +1,73 @@
+export { LIT_LOOP_DIRECTIVE_MARKER } from "./markers.js";
+/**
+ * Context-pressure / compaction / recovery markers. Lowercase substrings; matching is
+ * case-insensitive (input is lowercased before .includes). VERBATIM and ORDER-STABLE — the single
+ * source of truth (A3 §E): any module needing context-pressure detection MUST import this array,
+ * never copy it. Marker 5 retains the literal token `codex` (the host runtime, NOT a legacy brand —
+ * A3 C16) and the literal U+0027 apostrophe in `model's`.
+ */
+export declare const CONTEXT_PRESSURE_MARKERS: readonly ["context compacted", "context_length_exceeded", "skill descriptions were shortened", "context_too_large", "codex ran out of room in the model's context window", "your input exceeds the context window", "long threads and multiple compactions"];
+/** Tail window (bytes) read for the guard-2 directive-dedupe scan. Exactly 512000. */
+export declare const TRANSCRIPT_SEARCH_BYTES: 512000;
+/**
+ * Per-end byte budget for the guard-3 (context-pressure-transcript) read. Guard 3 reads at most the
+ * first and last GUARD3_WINDOW_BYTES of the transcript (whole file when smaller than 2×). Exactly
+ * 1 MiB per end so worst-case guard-3 work is ≤ 2 MiB of fixed-string scanning (A3 addendum §A).
+ * Distinct from TRANSCRIPT_SEARCH_BYTES (the guard-2 tail); the two MUST NOT be aliased.
+ */
+export declare const GUARD3_WINDOW_BYTES: 1048576;
+/**
+ * The hook OUTPUT envelope event-name value, written to the transcript by M06 and matched by guard
+ * 2 (A3 addendum §D). camelCase, load-bearing; declared exactly once here so M06's emitter and this
+ * guard cannot drift. M06 imports this from ./guards.js (one-way: codex-hook -> guards).
+ */
+export declare const HOOK_OUTPUT_EVENT_NAME: "UserPromptSubmit";
+/** Normalized transcript-path input shape accepted by the file-reading guards. */
+export type GuardTranscriptInput = string | null | undefined;
+/** Structured suppression decision returned to the M06 hook runner. */
+export interface LitLoopGuardDecision {
+    /** true => the hook MUST emit "" (no directive); false => injection may proceed. */
+    readonly suppress: boolean;
+    /** Machine-readable reason. "none" only when suppress === false. */
+    readonly reason: "none" | "context-pressure-prompt" | "already-injected" | "context-pressure-transcript" | "not-a-trigger";
+}
+/**
+ * Pure lexical test: does `text` contain ANY context-pressure marker? Lowercases `text`, then
+ * CONTEXT_PRESSURE_MARKERS.some(m => lower.includes(m)). No I/O, no state, idempotent.
+ * @throws TypeError if `text` is not a string.
+ */
+export declare function hasContextPressureMarker(text: string): boolean;
+/** Alias used by the prompt-level guard (guard 1). Identical semantics to hasContextPressureMarker. */
+export declare function isContextPressurePrompt(prompt: string): boolean;
+/**
+ * Generic per-mode idempotency check (RC1). Reads the TAIL (last TRANSCRIPT_SEARCH_BYTES bytes) of
+ * the transcript, parses each JSONL line, and returns true iff some line is a prior HOOK OUTPUT
+ * envelope: parsed.hookSpecificOutput.hookEventName === HOOK_OUTPUT_EVENT_NAME AND
+ * typeof additionalContext === "string" AND additionalContext.includes(`marker`). A marker quoted
+ * inside a user/assistant content STRING (or a forged envelope embedded as text) is NOT a top-level
+ * envelope line and is skipped. FAIL-OPEN: any thrown Error => false. The multi-mode hook passes the
+ * MATCHED mode's open marker so re-injection is suppressed per mode (mode switching is allowed).
+ */
+export declare function transcriptHasDirectiveMarker(transcriptPath: GuardTranscriptInput, marker: string): boolean;
+/** Lit-loop idempotency guard (guard 2) — the generic check bound to the lit-loop marker. */
+export declare function transcriptHasLitLoopDirective(transcriptPath: GuardTranscriptInput): boolean;
+/**
+ * Context-pressure transcript guard (guard 3). Reads a bounded head+tail window of the transcript
+ * (A3 addendum §A): the whole file when ≤ 2×GUARD3_WINDOW_BYTES, else the first + last
+ * GUARD3_WINDOW_BYTES joined by a "\n" separator (so a marker cannot be manufactured across the
+ * cut), then runs hasContextPressureMarker over it. Markers buried in nested JSON are caught by
+ * design. FAIL-OPEN: any thrown Error => false. null/undefined path => false.
+ */
+export declare function transcriptHasContextPressureMarker(transcriptPath: GuardTranscriptInput): boolean;
+/**
+ * THE single decision the M06 hook runner calls. Evaluates the four guards in fixed order and
+ * returns the first veto, else {suppress:false, reason:"none"}. Suppression dominates activation:
+ * guard 0 (not-a-trigger) runs first so the file-I/O guards only fire when a trigger is present;
+ * guard 1 (context-pressure-prompt) runs before the transcript guards so a recovery prompt that
+ * also contains `lit` is suppressed without any file read. Never throws for any string prompt +
+ * GuardTranscriptInput path (the only throw is the non-string prompt defensive guard).
+ * @throws TypeError only if `prompt` is not a string (M06 type-guards this upstream).
+ */
+export declare function shouldSuppressInjection(prompt: string, transcriptPath: GuardTranscriptInput, openMarker: string): LitLoopGuardDecision;
+/** Lit-loop entry point (backward-compatible) — the generic decision bound to the lit-loop marker. */
+export declare function shouldSuppressLitLoopInjection(prompt: string, transcriptPath: GuardTranscriptInput): LitLoopGuardDecision;

package/node_modules/@litcodex/lit-loop/dist/guards.js

@@ -0,0 +1,215 @@
+// src/guards.ts — M07 activation-policy guard layer.
+//
+// Sits between the M05 bounded trigger matcher (./trigger.js) and the M06 hook runner. M05 asks
+// "does this prompt lexically contain a `lit` trigger?"; M07 asks "given the surrounding session
+// state, should we actually inject the <lit-loop-mode> directive NOW?". It owns four suppression
+// guards, evaluated in a fixed order (suppression dominates activation):
+//   0. not a lit trigger                 -> suppress, "not-a-trigger"
+//   1. prompt is a context-pressure msg  -> suppress, "context-pressure-prompt"
+//   2. transcript already hook-injected  -> suppress, "already-injected"
+//   3. transcript shows context pressure -> suppress, "context-pressure-transcript"
+//   else                                 -> allow,    "none"
+//
+// Detection is PURELY lexical/structural (fixed marker tables + a fixed JSON-envelope shape), so
+// prompt prose cannot alter any guard outcome. Every file-reading guard is FAIL-OPEN: any thrown
+// Error returns false (no suppression from that guard), never throwing — a missing, unreadable,
+// oversized, or malformed transcript can never crash the Codex turn. This module reads transcript
+// files but writes nothing and holds no mutable state.
+//
+// Dependency direction (A3 C9 flat layout; one-way: codex-hook -> guards -> trigger): imports ONLY
+// ./trigger.js and ./markers.js; NEVER ./directive.js, ./state-store.js, or ./codex-hook.js
+// (no-cycle invariant). The marker is the single-source markers.ts value, re-exported here
+// (A3 C1) — never re-declared.
+import { readFileSync } from "node:fs";
+import { LIT_LOOP_DIRECTIVE_MARKER } from "./markers.js";
+import { isLitTriggerPrompt } from "./trigger.js";
+// Re-export the single-source directive marker (A3 C1) so the guards public surface is unchanged
+// while markers.ts stays the only declaration site (guards never imports directive — no cycle).
+export { LIT_LOOP_DIRECTIVE_MARKER } from "./markers.js";
+/**
+ * Context-pressure / compaction / recovery markers. Lowercase substrings; matching is
+ * case-insensitive (input is lowercased before .includes). VERBATIM and ORDER-STABLE — the single
+ * source of truth (A3 §E): any module needing context-pressure detection MUST import this array,
+ * never copy it. Marker 5 retains the literal token `codex` (the host runtime, NOT a legacy brand —
+ * A3 C16) and the literal U+0027 apostrophe in `model's`.
+ */
+export const CONTEXT_PRESSURE_MARKERS = Object.freeze([
+    "context compacted",
+    "context_length_exceeded",
+    "skill descriptions were shortened",
+    "context_too_large",
+    "codex ran out of room in the model's context window",
+    "your input exceeds the context window",
+    "long threads and multiple compactions",
+]);
+/** Tail window (bytes) read for the guard-2 directive-dedupe scan. Exactly 512000. */
+export const TRANSCRIPT_SEARCH_BYTES = 512000;
+/**
+ * Per-end byte budget for the guard-3 (context-pressure-transcript) read. Guard 3 reads at most the
+ * first and last GUARD3_WINDOW_BYTES of the transcript (whole file when smaller than 2×). Exactly
+ * 1 MiB per end so worst-case guard-3 work is ≤ 2 MiB of fixed-string scanning (A3 addendum §A).
+ * Distinct from TRANSCRIPT_SEARCH_BYTES (the guard-2 tail); the two MUST NOT be aliased.
+ */
+export const GUARD3_WINDOW_BYTES = 1048576;
+/**
+ * The hook OUTPUT envelope event-name value, written to the transcript by M06 and matched by guard
+ * 2 (A3 addendum §D). camelCase, load-bearing; declared exactly once here so M06's emitter and this
+ * guard cannot drift. M06 imports this from ./guards.js (one-way: codex-hook -> guards).
+ */
+export const HOOK_OUTPUT_EVENT_NAME = "UserPromptSubmit";
+const PROMPT_NOT_A_STRING = "lit guard: prompt must be a string";
+const TEXT_NOT_A_STRING = "lit guard: text must be a string";
+// --- Internal helpers (not exported; semantics load-bearing) ----------------------------------
+/** Narrow to a plain (non-null, non-array) record. */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Parse one JSONL line. Empty/whitespace line -> null; JSON.parse Error -> null (skipped);
+ * a non-Error throw (rare) is rethrown so the caller's fail-open boundary handles only Errors.
+ */
+function parseJsonLine(line) {
+    if (line.trim().length === 0) {
+        return null;
+    }
+    try {
+        return JSON.parse(line);
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return null;
+        }
+        throw error;
+    }
+}
+// --- Pure marker matcher (guard 1 primitive) ---------------------------------------------------
+/**
+ * Pure lexical test: does `text` contain ANY context-pressure marker? Lowercases `text`, then
+ * CONTEXT_PRESSURE_MARKERS.some(m => lower.includes(m)). No I/O, no state, idempotent.
+ * @throws TypeError if `text` is not a string.
+ */
+export function hasContextPressureMarker(text) {
+    if (typeof text !== "string") {
+        throw new TypeError(TEXT_NOT_A_STRING);
+    }
+    const lower = text.toLowerCase();
+    return CONTEXT_PRESSURE_MARKERS.some((marker) => lower.includes(marker));
+}
+/** Alias used by the prompt-level guard (guard 1). Identical semantics to hasContextPressureMarker. */
+export function isContextPressurePrompt(prompt) {
+    return hasContextPressureMarker(prompt);
+}
+// --- Guard 2: idempotency (already-injected) ---------------------------------------------------
+/**
+ * Generic per-mode idempotency check (RC1). Reads the TAIL (last TRANSCRIPT_SEARCH_BYTES bytes) of
+ * the transcript, parses each JSONL line, and returns true iff some line is a prior HOOK OUTPUT
+ * envelope: parsed.hookSpecificOutput.hookEventName === HOOK_OUTPUT_EVENT_NAME AND
+ * typeof additionalContext === "string" AND additionalContext.includes(`marker`). A marker quoted
+ * inside a user/assistant content STRING (or a forged envelope embedded as text) is NOT a top-level
+ * envelope line and is skipped. FAIL-OPEN: any thrown Error => false. The multi-mode hook passes the
+ * MATCHED mode's open marker so re-injection is suppressed per mode (mode switching is allowed).
+ */
+export function transcriptHasDirectiveMarker(transcriptPath, marker) {
+    if (transcriptPath === null || transcriptPath === undefined) {
+        return false;
+    }
+    try {
+        const buf = readFileSync(transcriptPath);
+        const tail = buf.subarray(Math.max(0, buf.byteLength - TRANSCRIPT_SEARCH_BYTES)).toString("utf8");
+        for (const line of tail.split(/\r?\n/)) {
+            const parsed = parseJsonLine(line);
+            if (parsed === null || !isRecord(parsed)) {
+                continue;
+            }
+            const hso = parsed["hookSpecificOutput"];
+            if (!isRecord(hso)) {
+                continue;
+            }
+            if (hso["hookEventName"] !== HOOK_OUTPUT_EVENT_NAME) {
+                continue;
+            }
+            const additionalContext = hso["additionalContext"];
+            if (typeof additionalContext === "string" && additionalContext.includes(marker)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return false; // fail-open
+        }
+        throw error;
+    }
+}
+/** Lit-loop idempotency guard (guard 2) — the generic check bound to the lit-loop marker. */
+export function transcriptHasLitLoopDirective(transcriptPath) {
+    return transcriptHasDirectiveMarker(transcriptPath, LIT_LOOP_DIRECTIVE_MARKER);
+}
+// --- Guard 3: context-pressure transcript ------------------------------------------------------
+/**
+ * Context-pressure transcript guard (guard 3). Reads a bounded head+tail window of the transcript
+ * (A3 addendum §A): the whole file when ≤ 2×GUARD3_WINDOW_BYTES, else the first + last
+ * GUARD3_WINDOW_BYTES joined by a "\n" separator (so a marker cannot be manufactured across the
+ * cut), then runs hasContextPressureMarker over it. Markers buried in nested JSON are caught by
+ * design. FAIL-OPEN: any thrown Error => false. null/undefined path => false.
+ */
+export function transcriptHasContextPressureMarker(transcriptPath) {
+    if (transcriptPath === null || transcriptPath === undefined) {
+        return false;
+    }
+    try {
+        const buf = readFileSync(transcriptPath);
+        const n = buf.byteLength;
+        let text;
+        if (n <= 2 * GUARD3_WINDOW_BYTES) {
+            text = buf.toString("utf8");
+        }
+        else {
+            const head = buf.subarray(0, GUARD3_WINDOW_BYTES).toString("utf8");
+            const tail = buf.subarray(n - GUARD3_WINDOW_BYTES).toString("utf8");
+            text = `${head}\n${tail}`;
+        }
+        return hasContextPressureMarker(text);
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return false; // fail-open
+        }
+        throw error;
+    }
+}
+// --- Single entry point (A3 C3) -----------------------------------------------------------------
+/**
+ * THE single decision the M06 hook runner calls. Evaluates the four guards in fixed order and
+ * returns the first veto, else {suppress:false, reason:"none"}. Suppression dominates activation:
+ * guard 0 (not-a-trigger) runs first so the file-I/O guards only fire when a trigger is present;
+ * guard 1 (context-pressure-prompt) runs before the transcript guards so a recovery prompt that
+ * also contains `lit` is suppressed without any file read. Never throws for any string prompt +
+ * GuardTranscriptInput path (the only throw is the non-string prompt defensive guard).
+ * @throws TypeError only if `prompt` is not a string (M06 type-guards this upstream).
+ */
+export function shouldSuppressInjection(prompt, transcriptPath, openMarker) {
+    if (typeof prompt !== "string") {
+        throw new TypeError(PROMPT_NOT_A_STRING);
+    }
+    if (!isLitTriggerPrompt(prompt)) {
+        return { suppress: true, reason: "not-a-trigger" };
+    }
+    if (isContextPressurePrompt(prompt)) {
+        return { suppress: true, reason: "context-pressure-prompt" };
+    }
+    // RC1: guard 2 checks the MATCHED mode's marker only — re-injecting the SAME mode is suppressed,
+    // switching modes (e.g. `lit` after `litwork`) is allowed.
+    if (transcriptHasDirectiveMarker(transcriptPath, openMarker)) {
+        return { suppress: true, reason: "already-injected" };
+    }
+    if (transcriptHasContextPressureMarker(transcriptPath)) {
+        return { suppress: true, reason: "context-pressure-transcript" };
+    }
+    return { suppress: false, reason: "none" };
+}
+/** Lit-loop entry point (backward-compatible) — the generic decision bound to the lit-loop marker. */
+export function shouldSuppressLitLoopInjection(prompt, transcriptPath) {
+    return shouldSuppressInjection(prompt, transcriptPath, LIT_LOOP_DIRECTIVE_MARKER);
+}

package/node_modules/@litcodex/lit-loop/dist/handoff-route.d.ts

@@ -0,0 +1,5 @@
+import { type GuardTranscriptInput } from "./guards.js";
+/** True only for the complete, case-insensitive bare invocation with optional edge whitespace. */
+export declare function isExactBareHandoffPrompt(prompt: string): boolean;
+/** Apply transcript idempotency and context-pressure guards to the dedicated handoff route. */
+export declare function shouldSuppressHandoffInjection(transcriptPath: GuardTranscriptInput): boolean;

package/node_modules/@litcodex/lit-loop/dist/handoff-route.js

@@ -0,0 +1,11 @@
+import { transcriptHasContextPressureMarker, transcriptHasDirectiveMarker, } from "./guards.js";
+import { HANDOFF_DIRECTIVE_MARKER } from "./markers.js";
+/** True only for the complete, case-insensitive bare invocation with optional edge whitespace. */
+export function isExactBareHandoffPrompt(prompt) {
+    return /^\s*handoff\s*$/iu.test(prompt);
+}
+/** Apply transcript idempotency and context-pressure guards to the dedicated handoff route. */
+export function shouldSuppressHandoffInjection(transcriptPath) {
+    return (transcriptHasDirectiveMarker(transcriptPath, HANDOFF_DIRECTIVE_MARKER) ||
+        transcriptHasContextPressureMarker(transcriptPath));
+}

package/node_modules/@litcodex/lit-loop/dist/hook-cli.d.ts

@@ -0,0 +1,19 @@
+/** Hard cap on stdin to bound memory / ReDoS exposure inside the 5 s Codex hook budget. 8 MB. */
+export declare const MAX_STDIN_BYTES = 8000000;
+/** Machine-readable error envelope emitted to stderr on a NON-zero exit. */
+export interface LitHookError {
+    readonly ok: false;
+    readonly error: {
+        readonly code: LitHookErrorCode;
+        readonly message: string;
+    };
+}
+export type LitHookErrorCode = "LIT_HOOK_STDIN_INVALID_JSON" | "LIT_HOOK_STDIN_TOO_LARGE";
+/**
+ * Stream-driven entry point. Resolves exactly one exit code (0 or 2); NEVER calls process.exit and
+ * NEVER throws. Writes the camelCase activation line to stdout (empty on no-op), or a LitHookError
+ * line to stderr on malformed / oversized stdin.
+ */
+export declare function runUserPromptSubmitHookCli(stdin: NodeJS.ReadableStream, stdout: NodeJS.WritableStream, stderr: NodeJS.WritableStream, repoRoot?: string): Promise<number>;
+export declare function runStopSkillReviewHookCli(stdin: NodeJS.ReadableStream, stdout: NodeJS.WritableStream, stderr: NodeJS.WritableStream, repoRoot?: string): Promise<number>;
+export declare function runPreToolUseCreateGoalGuardCli(stdin: NodeJS.ReadableStream, stdout: NodeJS.WritableStream, stderr: NodeJS.WritableStream): Promise<number>;

package/node_modules/@litcodex/lit-loop/dist/hook-cli.js

@@ -0,0 +1,189 @@
+// src/hook-cli.ts — M06 process adapter (A2 §2.4, A3 addendum A3/A4).
+//
+// The ONLY module that touches process streams + exit codes for the hook route. Reads stdin to a
+// UTF-8 string defensively, then BOM-strip → empty-check → JSON.parse (in that exact order, A3 A4),
+// hands the parsed value to the pure engine, and writes the decision. Exit map: any structurally
+// valid event → 0 (no-op writes zero bytes); unparseable or oversized stdin → 2 with a
+// machine-readable LitHookError JSON line on stderr. NEVER calls process.exit (the dispatcher does)
+// and NEVER throws.
+import { isAbsolute } from "node:path";
+import { applyPreToolUseCreateGoalGuard, formatAdditionalContextOutput, isLitUserPromptSubmitInput, runUserPromptSubmitHook, } from "./codex-hook.js";
+import { evaluatePlanPersistence, formatStopBlockOutput, recordLitPlanActivation } from "./plan-persistence.js";
+import { markPendingReviews, pendingReviewNotice } from "./skill-loop/hook.js";
+/** Hard cap on stdin to bound memory / ReDoS exposure inside the 5 s Codex hook budget. 8 MB. */
+export const MAX_STDIN_BYTES = 8_000_000;
+const INVALID_JSON_MESSAGE = "lit hook: stdin was not valid JSON";
+const TOO_LARGE_MESSAGE = `lit hook: stdin exceeded ${MAX_STDIN_BYTES} bytes`;
+function errorLine(code, message) {
+    const payload = { ok: false, error: { code, message } };
+    return `${JSON.stringify(payload)}\n`;
+}
+/**
+ * Read stdin to completion, enforcing MAX_STDIN_BYTES per chunk on the raw byte total BEFORE any
+ * decode (A3 A3). Resolves the decoded UTF-8 string, or `null` if the cap was exceeded (in which
+ * case the stream is destroyed and no decode/parse is attempted on the over-limit buffer).
+ */
+function readStdin(stdin) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let total = 0;
+        let settled = false;
+        const finish = (value) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            resolve(value);
+        };
+        stdin.on("data", (chunk) => {
+            const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+            total += buf.length;
+            if (total > MAX_STDIN_BYTES) {
+                // Stop reading and abandon the over-limit buffer without decoding/parsing it.
+                stdin.pause();
+                const destroy = stdin.destroy;
+                if (typeof destroy === "function") {
+                    destroy.call(stdin);
+                }
+                finish(null);
+                return;
+            }
+            chunks.push(buf);
+        });
+        stdin.on("end", () => {
+            finish(Buffer.concat(chunks).toString("utf8"));
+        });
+        stdin.on("error", () => {
+            // Treat a stream error like end-of-input over what we collected; the parse step decides.
+            finish(Buffer.concat(chunks).toString("utf8"));
+        });
+        stdin.on("close", () => {
+            finish(Buffer.concat(chunks).toString("utf8"));
+        });
+    });
+}
+/**
+ * Stream-driven entry point. Resolves exactly one exit code (0 or 2); NEVER calls process.exit and
+ * NEVER throws. Writes the camelCase activation line to stdout (empty on no-op), or a LitHookError
+ * line to stderr on malformed / oversized stdin.
+ */
+export async function runUserPromptSubmitHookCli(stdin, stdout, stderr, repoRoot = process.cwd()) {
+    const decoded = await readStdin(stdin);
+    if (decoded === null) {
+        stderr.write(errorLine("LIT_HOOK_STDIN_TOO_LARGE", TOO_LARGE_MESSAGE));
+        return 2;
+    }
+    // A3 A4 ordering: strip ONE leading BOM, then empty-check, then parse.
+    let raw = decoded;
+    if (raw.charCodeAt(0) === 0xfeff) {
+        raw = raw.slice(1);
+    }
+    if (raw.trim().length === 0) {
+        return 0;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        stderr.write(errorLine("LIT_HOOK_STDIN_INVALID_JSON", INVALID_JSON_MESSAGE));
+        return 2;
+    }
+    const decision = runUserPromptSubmitHook(parsed);
+    if (decision.kind === "inject" && decision.mode === "lit-plan") {
+        const scope = hookSessionScope(parsed, repoRoot);
+        if (scope !== null)
+            recordLitPlanActivation(scope.cwd, scope.sessionId);
+    }
+    let notice = null;
+    if (isLitUserPromptSubmitInput(parsed)) {
+        try {
+            notice = pendingReviewNotice(repoRoot);
+        }
+        catch {
+            // Pending-review surfacing is advisory and may never disable the existing prompt routes.
+        }
+    }
+    if (decision.kind === "inject" && notice !== null) {
+        const envelope = JSON.parse(decision.stdout);
+        stdout.write(formatAdditionalContextOutput(`${envelope.hookSpecificOutput.additionalContext}\n\n${notice}`));
+    }
+    else if (decision.kind === "inject") {
+        stdout.write(decision.stdout);
+    }
+    else if (notice !== null) {
+        stdout.write(formatAdditionalContextOutput(notice));
+    }
+    return 0;
+}
+/** Read `{ session_id, cwd }` from a hook event; `cwd` falls back to `repoRoot` when absent or relative. */
+function hookSessionScope(parsed, repoRoot) {
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+        return null;
+    const record = parsed;
+    const sessionId = record["session_id"];
+    if (typeof sessionId !== "string" || sessionId.length === 0)
+        return null;
+    const cwd = record["cwd"];
+    return { sessionId, cwd: typeof cwd === "string" && isAbsolute(cwd) ? cwd : repoRoot };
+}
+export async function runStopSkillReviewHookCli(stdin, stdout, stderr, repoRoot = process.cwd()) {
+    const decoded = await readStdin(stdin);
+    if (decoded === null) {
+        stderr.write(errorLine("LIT_HOOK_STDIN_TOO_LARGE", TOO_LARGE_MESSAGE));
+        return 2;
+    }
+    let raw = decoded;
+    if (raw.charCodeAt(0) === 0xfeff)
+        raw = raw.slice(1);
+    if (raw.trim().length === 0)
+        return 0;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        stderr.write(errorLine("LIT_HOOK_STDIN_INVALID_JSON", INVALID_JSON_MESSAGE));
+        return 2;
+    }
+    try {
+        markPendingReviews(repoRoot, parsed, { env: process.env });
+    }
+    catch {
+        // Pending-review marking is advisory and never blocks the existing start-work handler.
+    }
+    const scope = hookSessionScope(parsed, repoRoot);
+    if (scope !== null) {
+        const persistence = evaluatePlanPersistence(scope.cwd, scope.sessionId);
+        if (persistence.decision === "block")
+            stdout.write(formatStopBlockOutput(persistence.reason));
+    }
+    return 0;
+}
+export async function runPreToolUseCreateGoalGuardCli(stdin, stdout, stderr) {
+    const decoded = await readStdin(stdin);
+    if (decoded === null) {
+        stderr.write(errorLine("LIT_HOOK_STDIN_TOO_LARGE", TOO_LARGE_MESSAGE));
+        return 2;
+    }
+    let raw = decoded;
+    if (raw.charCodeAt(0) === 0xfeff) {
+        raw = raw.slice(1);
+    }
+    if (raw.trim().length === 0) {
+        return 0;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        stderr.write(errorLine("LIT_HOOK_STDIN_INVALID_JSON", INVALID_JSON_MESSAGE));
+        return 2;
+    }
+    const decision = applyPreToolUseCreateGoalGuard(parsed);
+    if (decision.kind === "deny") {
+        stdout.write(decision.stdout);
+    }
+    return 0;
+}

package/node_modules/@litcodex/lit-loop/dist/lit-mark.d.ts

@@ -0,0 +1,20 @@
+export declare const standard: readonly string[];
+export declare const banner: readonly string[];
+export declare const micro: readonly string[];
+export type ColorMode = "truecolor" | "256" | "none";
+/** The standard mark in a 28-column field, with an arbitrary product label alongside. */
+export declare function lockup(productName: string): string[];
+export declare function supportsBlocks(env: NodeJS.ProcessEnv): boolean;
+export declare function colorMode(opts: {
+    readonly isTty: boolean;
+    readonly env: NodeJS.ProcessEnv;
+    readonly json?: boolean;
+}): ColorMode;
+/** Flat Ignition cell colors preserve glyphs and leave appended lockup labels unpainted. */
+export declare function colorize(rows: readonly string[], opts: {
+    readonly mode: ColorMode;
+    readonly shadow?: string;
+}): string[];
+/** Codex statusMessage is one header span, so use the permitted one-line session lockup. */
+export declare const sessionLockup = "LIT \u00B7 codex";
+export declare function microLine(discipline: string): string;