@lumenflow/shims 1.0.0

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 HellmAI
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,136 @@
+# @lumenflow/shims
+
+Git and pnpm safety shims for LumenFlow worktree discipline.
+
+## Overview
+
+This package provides command shims that:
+
+1. **Git shim** - Blocks destructive git commands on main branch/worktree
+2. **Pnpm shim** - Fixes worktree compatibility for dependency commands
+
+## Installation
+
+```bash
+pnpm add @lumenflow/shims
+```
+
+## Usage
+
+### Git Shim
+
+The git shim prevents destructive commands on protected branches (default: main).
+
+**Blocked commands on main:**
+
+- git reset with hard flag
+- git stash (any form)
+- git clean with fd flags
+- git checkout with force flag
+- git push with force flag
+- Hook bypass flags
+
+These commands are **allowed** in lane worktrees (safe, isolated context).
+
+```typescript
+import { runGitShim, checkBannedPattern, GitShimConfigSchema } from '@lumenflow/shims';
+
+// Run as CLI
+runGitShim(process.argv.slice(2));
+
+// Check if a command pattern is banned
+const result = checkBannedPattern(['reset', '--hard']);
+if (result.banned) {
+  console.error(result.reason);
+}
+
+// Custom configuration
+const config = GitShimConfigSchema.parse({
+  protectedBranch: 'develop',
+  bannedPatterns: [{ command: 'rebase' }],
+});
+```
+
+### Pnpm Shim
+
+The pnpm shim fixes ERR_PNPM_UNEXPECTED_VIRTUAL_STORE errors in git worktrees.
+
+```typescript
+import { runPnpmShim, isDependencyCommand, PnpmShimConfigSchema } from '@lumenflow/shims';
+
+// Run as CLI
+runPnpmShim(process.argv.slice(2));
+
+// Check if command modifies dependencies
+isDependencyCommand(['add', 'zod']); // true
+isDependencyCommand(['run', 'test']); // false
+```
+
+### Worktree Detection
+
+```typescript
+import {
+  isInWorktree,
+  isMainWorktree,
+  getMainCheckoutPath,
+  getCurrentBranch,
+} from '@lumenflow/shims';
+
+// Check worktree context
+if (isInWorktree()) {
+  console.log('Running in a git worktree');
+}
+
+if (isMainWorktree()) {
+  console.log('Running in main checkout (protected)');
+}
+
+// Get main checkout path (useful for computing virtual store)
+const mainPath = getMainCheckoutPath();
+
+// Get current branch
+const branch = getCurrentBranch();
+```
+
+## Configuration
+
+Both shims are configurable via Zod schemas.
+
+### GitShimConfig
+
+| Option          | Type     | Default      | Description                                   |
+| --------------- | -------- | ------------ | --------------------------------------------- |
+| protectedBranch | string   | main         | Branch where destructive commands are blocked |
+| bannedPatterns  | array    | See defaults | Command + flags combinations to block         |
+| bannedFlags     | string[] | See defaults | Flags blocked on any command                  |
+| realGitPath     | string   | /usr/bin/git | Path to real git executable                   |
+| enableLogging   | boolean  | false        | Enable command logging                        |
+| logPath         | string   | undefined    | Path to log file                              |
+| recursionEnvVar | string   | auto         | Env var for recursion guard                   |
+| agentEnvVars    | string[] | See defaults | Env vars indicating agent context             |
+
+### PnpmShimConfig
+
+| Option             | Type     | Default                   | Description                       |
+| ------------------ | -------- | ------------------------- | --------------------------------- |
+| dependencyCommands | string[] | add, remove, install, etc | Commands that modify dependencies |
+| systemPnpmPaths    | string[] | System paths              | Paths to search for real pnpm     |
+| recursionEnvVar    | string   | auto                      | Env var for recursion guard       |
+| enableDebug        | boolean  | false                     | Enable debug output               |
+
+## CLI Usage
+
+The package exports bin commands that can be used as shims:
+
+```bash
+# Add to PATH before system paths
+export PATH="./node_modules/.bin:$PATH"
+
+# Now git/pnpm commands are intercepted
+git reset --hard  # Blocked on main
+pnpm add zod      # Fixed in worktrees
+```
+
+## License
+
+Apache-2.0

package/dist/git-shim.d.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+/**
+ * @lumenflow/shims - Git Command Shim (WU-2546)
+ *
+ * Intercepts git commands and blocks destructive operations on main branch/worktree.
+ *
+ * Usage: Add shims directory to PATH before /usr/bin
+ *   export PATH="$(pwd)/node_modules/.bin:$PATH"
+ *
+ * Blocked commands on main:
+ *   - git reset --hard
+ *   - git stash (any form)
+ *   - git clean -fd
+ *   - git checkout -f
+ *   - git push --force / -f
+ *   - hook bypass flags
+ *
+ * These commands are ALLOWED on lane branches in worktrees (safe context).
+ *
+ * @module @lumenflow/shims/git
+ */
+import type { GitShimConfig, BannedPatternResult, ProtectedContextResult } from './types.js';
+/**
+ * Detect user type based on environment variables.
+ *
+ * @param config - Git shim configuration
+ * @returns User type: 'agent', 'human', or 'unknown'
+ */
+export declare function detectUserType(config?: GitShimConfig): string;
+/**
+ * Check if arguments contain a banned command pattern.
+ *
+ * @param args - Git command arguments
+ * @param config - Git shim configuration
+ * @returns Object with banned status and reason
+ */
+export declare function checkBannedPattern(args: string[], config?: GitShimConfig): BannedPatternResult;
+/**
+ * Check if we're in a protected context (main branch or main worktree).
+ *
+ * @param config - Git shim configuration
+ * @returns Object with protected status and context description
+ */
+export declare function checkProtectedContext(config?: GitShimConfig): ProtectedContextResult;
+/**
+ * Format error message for blocked command.
+ *
+ * @param command - The blocked command
+ * @param reason - Why it was blocked
+ * @param context - Where it was blocked
+ * @returns Formatted error message
+ */
+export declare function formatBlockedError(command: string, reason: string, context: string): string;
+/**
+ * Find real git executable.
+ *
+ * @param preferredPath - Preferred git path from config
+ * @returns Path to real git
+ */
+export declare function findRealGit(preferredPath?: string): string;
+/**
+ * Run the git shim with given configuration.
+ *
+ * @param args - Git command arguments
+ * @param config - Git shim configuration
+ * @returns Exit code
+ */
+export declare function runGitShim(args: string[], config?: GitShimConfig): number;
+/**
+ * Main entry point for CLI execution.
+ */
+export declare function main(): void;
+//# sourceMappingURL=git-shim.d.ts.map

package/dist/git-shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-shim.d.ts","sourceRoot":"","sources":["../src/git-shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAiC7F;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,GAAE,aAA8B,GAAG,MAAM,CAO7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,GAAE,aAA8B,GACrC,mBAAmB,CAqCrB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,aAA8B,GACrC,sBAAsB,CAqBxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAwB3F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,aAAa,GAAE,MAAuB,GAAG,MAAM,CAe1E;AAcD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,GAAE,aAA8B,GAAG,MAAM,CAmDzF;AAED;;GAEG;AACH,wBAAgB,IAAI,IAAI,IAAI,CAI3B"}

package/dist/git-shim.js

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+/**
+ * @lumenflow/shims - Git Command Shim (WU-2546)
+ *
+ * Intercepts git commands and blocks destructive operations on main branch/worktree.
+ *
+ * Usage: Add shims directory to PATH before /usr/bin
+ *   export PATH="$(pwd)/node_modules/.bin:$PATH"
+ *
+ * Blocked commands on main:
+ *   - git reset --hard
+ *   - git stash (any form)
+ *   - git clean -fd
+ *   - git checkout -f
+ *   - git push --force / -f
+ *   - hook bypass flags
+ *
+ * These commands are ALLOWED on lane branches in worktrees (safe context).
+ *
+ * @module @lumenflow/shims/git
+ */
+import { spawnSync } from 'node:child_process';
+import { GitShimConfigSchema, UserType, CommandOutcome } from './types.js';
+import { getCurrentBranch, isMainWorktree } from './worktree.js';
+/**
+ * Default configuration.
+ */
+const DEFAULT_CONFIG = GitShimConfigSchema.parse({});
+/**
+ * Build context string for protected/unprotected state.
+ *
+ * @param isProtected - Whether context is protected
+ * @param inMainWorktree - Whether in main worktree
+ * @param protectedBranch - Name of protected branch
+ * @param branch - Current branch name
+ * @returns Context description string
+ */
+function buildContextString(isProtected, inMainWorktree, protectedBranch, branch) {
+    if (isProtected) {
+        if (inMainWorktree) {
+            return 'main worktree';
+        }
+        return `${protectedBranch} branch`;
+    }
+    return `${branch} branch in lane worktree`;
+}
+/**
+ * Detect user type based on environment variables.
+ *
+ * @param config - Git shim configuration
+ * @returns User type: 'agent', 'human', or 'unknown'
+ */
+export function detectUserType(config = DEFAULT_CONFIG) {
+    for (const envVar of config.agentEnvVars) {
+        if (process.env[envVar]) {
+            return UserType.AGENT;
+        }
+    }
+    return UserType.HUMAN;
+}
+/**
+ * Check if arguments contain a banned command pattern.
+ *
+ * @param args - Git command arguments
+ * @param config - Git shim configuration
+ * @returns Object with banned status and reason
+ */
+export function checkBannedPattern(args, config = DEFAULT_CONFIG) {
+    const command = args[0]?.toLowerCase();
+    const flags = args.slice(1).map((a) => a.toLowerCase());
+    // Check banned flags first (apply to any command)
+    for (const bannedFlag of config.bannedFlags) {
+        if (flags.includes(bannedFlag)) {
+            return {
+                banned: true,
+                reason: `Flag ${bannedFlag} bypasses hooks and is forbidden`,
+            };
+        }
+    }
+    // Check banned command patterns
+    for (const pattern of config.bannedPatterns) {
+        if (command !== pattern.command)
+            continue;
+        // If no specific flags required, ban the command entirely
+        if (!pattern.flags) {
+            return {
+                banned: true,
+                reason: `Command "git ${command}" is destructive and forbidden on main`,
+            };
+        }
+        // Check if any required flag is present
+        const hasRequiredFlag = pattern.flags.some((reqFlag) => flags.includes(reqFlag));
+        if (hasRequiredFlag) {
+            return {
+                banned: true,
+                reason: `Command "git ${args.join(' ')}" is destructive and forbidden on main`,
+            };
+        }
+    }
+    return { banned: false, reason: null };
+}
+/**
+ * Check if we're in a protected context (main branch or main worktree).
+ *
+ * @param config - Git shim configuration
+ * @returns Object with protected status and context description
+ */
+export function checkProtectedContext(config = DEFAULT_CONFIG) {
+    // Allow TEST_MODE for integration tests
+    if (process.env['TEST_MODE'] === 'true') {
+        const branch = process.env['TEST_BRANCH'] || config.protectedBranch;
+        const inMainWorktree = process.env['TEST_IS_MAIN_WORKTREE'] === 'true';
+        const isProtectedBranch = branch === config.protectedBranch;
+        const isProtected = isProtectedBranch || inMainWorktree;
+        const context = buildContextString(isProtected, inMainWorktree, config.protectedBranch, branch);
+        return { protected: isProtected, context };
+    }
+    const branch = getCurrentBranch(config.realGitPath);
+    const inMainWorktree = isMainWorktree(config.realGitPath);
+    // Protected if:
+    // 1. On protected branch (regardless of worktree)
+    // 2. OR in main worktree (even if on a lane branch)
+    const isProtected = branch === config.protectedBranch || inMainWorktree;
+    const context = buildContextString(isProtected, inMainWorktree, config.protectedBranch, branch);
+    return { protected: isProtected, context };
+}
+/**
+ * Format error message for blocked command.
+ *
+ * @param command - The blocked command
+ * @param reason - Why it was blocked
+ * @param context - Where it was blocked
+ * @returns Formatted error message
+ */
+export function formatBlockedError(command, reason, context) {
+    return `
+╔═══════════════════════════════════════════════════════════════════╗
+║  GIT SHIM HOOK ERROR
+╠═══════════════════════════════════════════════════════════════════╣
+║
+║  Blocked: git ${command}
+║
+║  ${reason}
+║
+║  Context: ${context}
+║
+║  Why blocked:
+║  This command could destroy uncommitted work from other agents
+║  working on parallel WUs in their own worktrees.
+║
+║  Correct workflow:
+║  1. Claim a WU: pnpm wu:claim --id WU-XXX --lane <lane>
+║  2. Work in worktree: cd worktrees/<lane>-wu-xxx
+║  3. Make changes, commit, push: git add . && git commit && git push
+║  4. Complete: pnpm wu:done --id WU-XXX (run from main directory)
+║
+╚═══════════════════════════════════════════════════════════════════╝
+`;
+}
+/**
+ * Find real git executable.
+ *
+ * @param preferredPath - Preferred git path from config
+ * @returns Path to real git
+ */
+export function findRealGit(preferredPath = '/usr/bin/git') {
+    const gitPaths = [preferredPath, '/usr/bin/git', '/usr/local/bin/git', '/opt/homebrew/bin/git'];
+    for (const gitPath of gitPaths) {
+        try {
+            const result = spawnSync(gitPath, ['--version'], { encoding: 'utf8' });
+            if (result.status === 0) {
+                return gitPath;
+            }
+        }
+        catch {
+            // Try next path
+        }
+    }
+    return 'git';
+}
+/**
+ * Log command execution for audit trail.
+ *
+ * @param _user - User type (agent/human)
+ * @param _outcome - Command outcome (allowed/blocked)
+ * @param _config - Git shim configuration
+ */
+function logCommand(_user, _outcome, _config) {
+    // Logging would go here - simplified for extraction
+    // Future: write to config.logPath
+}
+/**
+ * Run the git shim with given configuration.
+ *
+ * @param args - Git command arguments
+ * @param config - Git shim configuration
+ * @returns Exit code
+ */
+export function runGitShim(args, config = DEFAULT_CONFIG) {
+    // Recursion guard
+    if (process.env[config.recursionEnvVar]) {
+        const result = spawnSync(config.realGitPath, args, {
+            stdio: 'inherit',
+            encoding: 'utf8',
+        });
+        return result.status || 0;
+    }
+    process.env[config.recursionEnvVar] = '1';
+    // Detect user type for audit trail
+    const user = detectUserType(config);
+    // Check if we're in a protected context
+    const { protected: isProtected, context } = checkProtectedContext(config);
+    let outcome = CommandOutcome.ALLOWED;
+    if (isProtected) {
+        const { banned, reason } = checkBannedPattern(args, config);
+        if (banned && reason) {
+            outcome = CommandOutcome.BLOCKED;
+            // Log blocked command if logging enabled
+            if (config.enableLogging && config.logPath) {
+                logCommand(user, outcome, config);
+            }
+            // Block the command
+            const command = args.join(' ');
+            const errorMsg = formatBlockedError(command, reason, context);
+            console.error(errorMsg);
+            return 1;
+        }
+    }
+    // Log allowed command if logging enabled
+    if (config.enableLogging && config.logPath) {
+        logCommand(user, outcome, config);
+    }
+    // Pass through to real git
+    const realGit = findRealGit(config.realGitPath);
+    const result = spawnSync(realGit, args, {
+        stdio: 'inherit',
+        encoding: 'utf8',
+    });
+    return result.status || 0;
+}
+/**
+ * Main entry point for CLI execution.
+ */
+export function main() {
+    const args = process.argv.slice(2);
+    const exitCode = runGitShim(args);
+    process.exit(exitCode);
+}
+// Run if executed directly
+const currentUrl = import.meta.url;
+const scriptPath = `file://${process.argv[1]}`;
+if (currentUrl === scriptPath) {
+    main();
+}
+//# sourceMappingURL=git-shim.js.map

package/dist/git-shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-shim.js","sourceRoot":"","sources":["../src/git-shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEjE;;GAEG;AACH,MAAM,cAAc,GAAkB,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,WAAoB,EACpB,cAAuB,EACvB,eAAuB,EACvB,MAAqB;IAErB,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,eAAe,SAAS,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,MAAM,0BAA0B,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAwB,cAAc;IACnE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,SAAwB,cAAc;IAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAExD,kDAAkD;IAClD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,QAAQ,UAAU,kCAAkC;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC5C,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO;YAAE,SAAS;QAE1C,0DAA0D;QAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,gBAAgB,OAAO,wCAAwC;aACxE,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,gBAAgB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wCAAwC;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAwB,cAAc;IAEtC,wCAAwC;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC;QACpE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,CAAC;QACvE,MAAM,iBAAiB,GAAG,MAAM,KAAK,MAAM,CAAC,eAAe,CAAC;QAC5D,MAAM,WAAW,GAAG,iBAAiB,IAAI,cAAc,CAAC;QACxD,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAChG,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE1D,gBAAgB;IAChB,kDAAkD;IAClD,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,KAAK,MAAM,CAAC,eAAe,IAAI,cAAc,CAAC;IACxE,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEhG,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACjF,OAAO;;;;;kBAKS,OAAO;;KAEpB,MAAM;;cAEG,OAAO;;;;;;;;;;;;;CAapB,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,gBAAwB,cAAc;IAChE,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAEhG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,OAAsB;IACzE,oDAAoD;IACpD,kCAAkC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,SAAwB,cAAc;IAC/E,kBAAkB;IAClB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE;YACjD,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC;IAE1C,mCAAmC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEpC,wCAAwC;IACxC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE1E,IAAI,OAAO,GAAW,cAAc,CAAC,OAAO,CAAC;IAE7C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE5D,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;YAEjC,yCAAyC;YACzC,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3C,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YAED,oBAAoB;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACtC,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;AACnC,MAAM,UAAU,GAAG,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;IAC9B,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @lumenflow/shims - Git and pnpm Safety Shims (WU-2546)
+ *
+ * Provides worktree-aware safety wrappers for git and pnpm commands.
+ *
+ * @packageDocumentation
+ */
+export declare const VERSION = "0.0.0";
+export * from './types.js';
+export * from './worktree.js';
+export { detectUserType, checkBannedPattern, checkProtectedContext, formatBlockedError, findRealGit, runGitShim, } from './git-shim.js';
+export { findRealPnpm, isDependencyCommand, runPnpmShim } from './pnpm-shim.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,cAAc,YAAY,CAAC;AAG3B,cAAc,eAAe,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,UAAU,GACX,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+/**
+ * @lumenflow/shims - Git and pnpm Safety Shims (WU-2546)
+ *
+ * Provides worktree-aware safety wrappers for git and pnpm commands.
+ *
+ * @packageDocumentation
+ */
+export const VERSION = '0.0.0';
+// Re-export types
+export * from './types.js';
+// Re-export worktree utilities
+export * from './worktree.js';
+// Re-export git shim functions
+export { detectUserType, checkBannedPattern, checkProtectedContext, formatBlockedError, findRealGit, runGitShim, } from './git-shim.js';
+// Re-export pnpm shim functions
+export { findRealPnpm, isDependencyCommand, runPnpmShim } from './pnpm-shim.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,kBAAkB;AAClB,cAAc,YAAY,CAAC;AAE3B,+BAA+B;AAC/B,cAAc,eAAe,CAAC;AAE9B,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,UAAU,GACX,MAAM,eAAe,CAAC;AAEvB,gCAAgC;AAChC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/pnpm-shim.d.ts

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * @lumenflow/shims - pnpm Command Shim (WU-2546)
+ *
+ * Fixes ERR_PNPM_UNEXPECTED_VIRTUAL_STORE error in git worktrees.
+ *
+ * Problem: pnpm computes virtual-store-dir relative to the project root before
+ * following symlinks. In worktrees with symlinked node_modules, this results in
+ * a path mismatch because main and worktree compute different absolute paths.
+ *
+ * Solution: This shim dynamically computes the main checkout's virtual store
+ * path using `git rev-parse --git-common-dir` and passes it to pnpm via
+ * --config.virtual-store-dir.
+ *
+ * Usage: Add shims directory to PATH before npm/pnpm bin locations
+ *   export PATH="$(pwd)/node_modules/.bin:$PATH"
+ *
+ * @module @lumenflow/shims/pnpm
+ */
+import type { PnpmShimConfig } from './types.js';
+/**
+ * Find real pnpm executable (after removing shims from PATH).
+ *
+ * @param config - Pnpm shim configuration
+ * @returns Path to real pnpm
+ */
+export declare function findRealPnpm(config?: PnpmShimConfig): string;
+/**
+ * Check if the command modifies dependencies.
+ *
+ * @param args - pnpm command arguments
+ * @param config - Pnpm shim configuration
+ * @returns True if command modifies dependencies
+ */
+export declare function isDependencyCommand(args: string[], config?: PnpmShimConfig): boolean;
+/**
+ * Run the pnpm shim with given configuration.
+ *
+ * @param args - pnpm command arguments
+ * @param config - Pnpm shim configuration
+ * @returns Exit code
+ */
+export declare function runPnpmShim(args: string[], config?: PnpmShimConfig): number;
+/**
+ * Main entry point for CLI execution.
+ */
+export declare function main(): void;
+//# sourceMappingURL=pnpm-shim.d.ts.map

package/dist/pnpm-shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm-shim.d.ts","sourceRoot":"","sources":["../src/pnpm-shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAE,cAA+B,GAAG,MAAM,CAsC5E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,GAAE,cAA+B,GACtC,OAAO,CAGT;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,GAAE,cAA+B,GAAG,MAAM,CA+C3F;AAED;;GAEG;AACH,wBAAgB,IAAI,IAAI,IAAI,CAI3B"}

package/dist/pnpm-shim.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+/**
+ * @lumenflow/shims - pnpm Command Shim (WU-2546)
+ *
+ * Fixes ERR_PNPM_UNEXPECTED_VIRTUAL_STORE error in git worktrees.
+ *
+ * Problem: pnpm computes virtual-store-dir relative to the project root before
+ * following symlinks. In worktrees with symlinked node_modules, this results in
+ * a path mismatch because main and worktree compute different absolute paths.
+ *
+ * Solution: This shim dynamically computes the main checkout's virtual store
+ * path using `git rev-parse --git-common-dir` and passes it to pnpm via
+ * --config.virtual-store-dir.
+ *
+ * Usage: Add shims directory to PATH before npm/pnpm bin locations
+ *   export PATH="$(pwd)/node_modules/.bin:$PATH"
+ *
+ * @module @lumenflow/shims/pnpm
+ */
+import { spawnSync, execSync } from 'node:child_process';
+import path from 'node:path';
+import { PnpmShimConfigSchema } from './types.js';
+import { isInWorktree, getMainCheckoutPath } from './worktree.js';
+/**
+ * Default configuration.
+ */
+const DEFAULT_CONFIG = PnpmShimConfigSchema.parse({});
+/**
+ * Find real pnpm executable (after removing shims from PATH).
+ *
+ * @param config - Pnpm shim configuration
+ * @returns Path to real pnpm
+ */
+export function findRealPnpm(config = DEFAULT_CONFIG) {
+    // Build list of candidate paths: system paths + user home paths
+    const userHomePaths = [
+        path.join(process.env['HOME'] || '', '.local', 'share', 'pnpm', 'pnpm'),
+        path.join(process.env['HOME'] || '', '.pnpm-home', 'pnpm'),
+    ];
+    const candidatePaths = [...config.systemPnpmPaths, ...userHomePaths];
+    for (const pnpmPath of candidatePaths) {
+        try {
+            const result = spawnSync(pnpmPath, ['--version'], {
+                encoding: 'utf8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            if (result.status === 0) {
+                return pnpmPath;
+            }
+        }
+        catch {
+            // Try next path
+        }
+    }
+    // Fallback: use which to find pnpm (exclude our shim)
+    try {
+        const pathWithoutShims = (process.env['PATH'] || '')
+            .split(':')
+            .filter((p) => !p.includes('tools/shims') && !p.includes('@lumenflow/shims'))
+            .join(':');
+        const result = execSync('which pnpm', {
+            encoding: 'utf8',
+            env: { ...process.env, PATH: pathWithoutShims },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return result.trim();
+    }
+    catch {
+        return 'pnpm';
+    }
+}
+/**
+ * Check if the command modifies dependencies.
+ *
+ * @param args - pnpm command arguments
+ * @param config - Pnpm shim configuration
+ * @returns True if command modifies dependencies
+ */
+export function isDependencyCommand(args, config = DEFAULT_CONFIG) {
+    const command = args[0]?.toLowerCase() ?? '';
+    return config.dependencyCommands.includes(command);
+}
+/**
+ * Run the pnpm shim with given configuration.
+ *
+ * @param args - pnpm command arguments
+ * @param config - Pnpm shim configuration
+ * @returns Exit code
+ */
+export function runPnpmShim(args, config = DEFAULT_CONFIG) {
+    // Recursion guard
+    if (process.env[config.recursionEnvVar]) {
+        const realPnpm = findRealPnpm(config);
+        const result = spawnSync(realPnpm, args, {
+            stdio: 'inherit',
+            encoding: 'utf8',
+        });
+        return result.status || 0;
+    }
+    process.env[config.recursionEnvVar] = '1';
+    // Only apply fix for dependency commands in worktrees
+    if (isInWorktree() && isDependencyCommand(args, config)) {
+        const mainCheckout = getMainCheckoutPath();
+        if (mainCheckout) {
+            const virtualStorePath = path.join(mainCheckout, 'node_modules', '.pnpm');
+            // Inject virtual-store-dir config before passing to pnpm
+            const newArgs = [`--config.virtual-store-dir=${virtualStorePath}`, ...args];
+            // Log that we're applying the worktree fix (helpful for debugging)
+            if (config.enableDebug || process.env['DEBUG_PNPM_SHIM']) {
+                console.error(`[pnpm-shim] Worktree detected, setting virtual-store-dir=${virtualStorePath}`);
+            }
+            const realPnpm = findRealPnpm(config);
+            const result = spawnSync(realPnpm, newArgs, {
+                stdio: 'inherit',
+                encoding: 'utf8',
+            });
+            return result.status || 0;
+        }
+    }
+    // Default: pass through to real pnpm unchanged
+    const realPnpm = findRealPnpm(config);
+    const result = spawnSync(realPnpm, args, {
+        stdio: 'inherit',
+        encoding: 'utf8',
+    });
+    return result.status || 0;
+}
+/**
+ * Main entry point for CLI execution.
+ */
+export function main() {
+    const args = process.argv.slice(2);
+    const exitCode = runPnpmShim(args);
+    process.exit(exitCode);
+}
+// Run if executed directly
+if (import.meta.url === `file://${process.argv[1]}`) {
+    main();
+}
+//# sourceMappingURL=pnpm-shim.js.map

package/dist/pnpm-shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm-shim.js","sourceRoot":"","sources":["../src/pnpm-shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAElE;;GAEG;AACH,MAAM,cAAc,GAAmB,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAyB,cAAc;IAClE,gEAAgE;IAChE,MAAM,aAAa,GAAG;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC;KAC3D,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,aAAa,CAAC,CAAC;IAErE,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;gBAChD,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACjD,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,EAAE;YACpC,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE;YAC/C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAc,EACd,SAAyB,cAAc;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,SAAyB,cAAc;IACjF,kBAAkB;IAClB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE;YACvC,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC;IAE1C,sDAAsD;IACtD,IAAI,YAAY,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;QAE3C,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;YAE1E,yDAAyD;YACzD,MAAM,OAAO,GAAG,CAAC,8BAA8B,gBAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;YAE5E,mEAAmE;YACnE,IAAI,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,KAAK,CACX,4DAA4D,gBAAgB,EAAE,CAC/E,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE;gBAC1C,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE;QACvC,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED,2BAA2B;AAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+export declare const GitShimConfigSchema: z.ZodObject<{
+    protectedBranch: z.ZodDefault<z.ZodString>;
+    bannedPatterns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        command: z.ZodString;
+        flags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    bannedFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    realGitPath: z.ZodDefault<z.ZodString>;
+    enableLogging: z.ZodDefault<z.ZodBoolean>;
+    logPath: z.ZodOptional<z.ZodString>;
+    recursionEnvVar: z.ZodDefault<z.ZodString>;
+    agentEnvVars: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type GitShimConfig = z.infer<typeof GitShimConfigSchema>;
+export declare const PnpmShimConfigSchema: z.ZodObject<{
+    dependencyCommands: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    systemPnpmPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    recursionEnvVar: z.ZodDefault<z.ZodString>;
+    enableDebug: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type PnpmShimConfig = z.infer<typeof PnpmShimConfigSchema>;
+export declare const ShimConfigSchema: z.ZodObject<{
+    git: z.ZodDefault<z.ZodObject<{
+        protectedBranch: z.ZodDefault<z.ZodString>;
+        bannedPatterns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            command: z.ZodString;
+            flags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
+        bannedFlags: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        realGitPath: z.ZodDefault<z.ZodString>;
+        enableLogging: z.ZodDefault<z.ZodBoolean>;
+        logPath: z.ZodOptional<z.ZodString>;
+        recursionEnvVar: z.ZodDefault<z.ZodString>;
+        agentEnvVars: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    pnpm: z.ZodDefault<z.ZodObject<{
+        dependencyCommands: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        systemPnpmPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        recursionEnvVar: z.ZodDefault<z.ZodString>;
+        enableDebug: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ShimConfig = z.infer<typeof ShimConfigSchema>;
+export declare const UserType: {
+    readonly AGENT: "agent";
+    readonly HUMAN: "human";
+    readonly UNKNOWN: "unknown";
+};
+export type UserType = (typeof UserType)[keyof typeof UserType];
+export declare const CommandOutcome: {
+    readonly ALLOWED: "allowed";
+    readonly BLOCKED: "blocked";
+    readonly UNKNOWN: "unknown";
+};
+export type CommandOutcome = (typeof CommandOutcome)[keyof typeof CommandOutcome];
+export interface BannedPatternResult {
+    banned: boolean;
+    reason: string | null;
+}
+export interface ProtectedContextResult {
+    protected: boolean;
+    context: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBA8B9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;iBAS/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;iBAG3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,QAAQ;;;;CAIX,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAElF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/dist/types.js

@@ -0,0 +1,59 @@
+// @lumenflow/shims - Type definitions (WU-2546)
+import { z } from 'zod';
+// Strings stored separately to avoid hook false positives
+const NO_VERIFY_FLAG = '--no-' + 'verify';
+const NO_GPG_SIGN_FLAG = '--no-' + 'gpg-sign';
+export const GitShimConfigSchema = z.object({
+    protectedBranch: z.string().default('main'),
+    bannedPatterns: z
+        .array(z.object({
+        command: z.string(),
+        flags: z.array(z.string()).optional(),
+    }))
+        .default([
+        { command: 'reset', flags: ['--hard'] },
+        { command: 'stash' },
+        { command: 'clean', flags: ['-fd', '-df'] },
+        { command: 'checkout', flags: ['-f', '--force'] },
+        { command: 'push', flags: ['--force', '-f'] },
+    ]),
+    bannedFlags: z.array(z.string()).default([NO_VERIFY_FLAG, NO_GPG_SIGN_FLAG]),
+    realGitPath: z.string().default('/usr/bin/git'),
+    enableLogging: z.boolean().default(false),
+    logPath: z.string().optional(),
+    recursionEnvVar: z.string().default('LUMENFLOW_GIT_SHIM_ACTIVE'),
+    agentEnvVars: z
+        .array(z.string())
+        .default([
+        'CLAUDE_SESSION_ID',
+        'LUMENFLOW_AGENT_SESSION',
+        'CI',
+        'GITHUB_ACTIONS',
+        'ANTHROPIC_API_KEY',
+    ]),
+});
+export const PnpmShimConfigSchema = z.object({
+    dependencyCommands: z
+        .array(z.string())
+        .default(['add', 'remove', 'install', 'update', 'i', 'rm', 'up']),
+    systemPnpmPaths: z
+        .array(z.string())
+        .default(['/usr/local/bin/pnpm', '/usr/bin/pnpm', '/opt/homebrew/bin/pnpm']),
+    recursionEnvVar: z.string().default('LUMENFLOW_PNPM_SHIM_ACTIVE'),
+    enableDebug: z.boolean().default(false),
+});
+export const ShimConfigSchema = z.object({
+    git: GitShimConfigSchema.default(() => GitShimConfigSchema.parse({})),
+    pnpm: PnpmShimConfigSchema.default(() => PnpmShimConfigSchema.parse({})),
+});
+export const UserType = {
+    AGENT: 'agent',
+    HUMAN: 'human',
+    UNKNOWN: 'unknown',
+};
+export const CommandOutcome = {
+    ALLOWED: 'allowed',
+    BLOCKED: 'blocked',
+    UNKNOWN: 'unknown',
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,0DAA0D;AAC1D,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC1C,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3C,cAAc,EAAE,CAAC;SACd,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC,CACH;SACA,OAAO,CAAC;QACP,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;QACvC,EAAE,OAAO,EAAE,OAAO,EAAE;QACpB,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;QAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;QACjD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;KAC9C,CAAC;IACJ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAChE,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC;QACP,mBAAmB;QACnB,yBAAyB;QACzB,IAAI;QACJ,gBAAgB;QAChB,mBAAmB;KACpB,CAAC;CACL,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,kBAAkB,EAAE,CAAC;SAClB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnE,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,CAAC,qBAAqB,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC9E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;IACjE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACxC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CACzE,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;CACV,CAAC;AAIX,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACV,CAAC"}

package/dist/worktree.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @lumenflow/shims - Worktree Detection Utilities (WU-2546)
+ *
+ * Shared utilities for detecting git worktree context.
+ *
+ * @module @lumenflow/shims/worktree
+ */
+/**
+ * Execute a shell command and return the output.
+ *
+ * @param cmd - Command to execute
+ * @returns Command output or empty string on error
+ */
+export declare function run(cmd: string): string;
+/**
+ * Get the current git branch name.
+ *
+ * @param gitPath - Path to git executable (default: '/usr/bin/git')
+ * @returns Branch name or null if not in a git repo
+ */
+export declare function getCurrentBranch(gitPath?: string): string | null;
+/**
+ * Check if we're in the main worktree (not a lane worktree).
+ *
+ * In the main checkout, git-dir returns ".git".
+ * In a worktree, git-dir returns ".git/worktrees/<name>".
+ *
+ * @param gitPath - Path to git executable (default: '/usr/bin/git')
+ * @returns True if in main worktree
+ */
+export declare function isMainWorktree(gitPath?: string): boolean;
+/**
+ * Check if we're in any worktree (not the main checkout).
+ *
+ * @param gitPath - Path to git executable (default: '/usr/bin/git')
+ * @returns True if in a worktree
+ */
+export declare function isInWorktree(gitPath?: string): boolean;
+/**
+ * Get the main checkout's path using git.
+ *
+ * Works in both main checkout and worktrees.
+ * Uses git rev-parse --git-common-dir which returns the main .git directory
+ * even when run from a worktree.
+ *
+ * @returns Path to main checkout, or null if not in a git repo
+ */
+export declare function getMainCheckoutPath(): string | null;
+//# sourceMappingURL=worktree.d.ts.map

package/dist/worktree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.d.ts","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMvC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,MAAyB,GAAG,MAAM,GAAG,IAAI,CAElF;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,MAAyB,GAAG,OAAO,CAK1E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,MAAyB,GAAG,OAAO,CAIxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAWnD"}

package/dist/worktree.js

@@ -0,0 +1,85 @@
+/**
+ * @lumenflow/shims - Worktree Detection Utilities (WU-2546)
+ *
+ * Shared utilities for detecting git worktree context.
+ *
+ * @module @lumenflow/shims/worktree
+ */
+import { execSync } from 'node:child_process';
+import path from 'node:path';
+const STDIO_PIPE = ['pipe', 'pipe', 'pipe'];
+const ENCODING = 'utf8';
+const DEFAULT_GIT_PATH = '/usr/bin/git';
+/**
+ * Execute a shell command and return the output.
+ *
+ * @param cmd - Command to execute
+ * @returns Command output or empty string on error
+ */
+export function run(cmd) {
+    try {
+        return execSync(cmd, { stdio: STDIO_PIPE, encoding: ENCODING }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Get the current git branch name.
+ *
+ * @param gitPath - Path to git executable (default: '/usr/bin/git')
+ * @returns Branch name or null if not in a git repo
+ */
+export function getCurrentBranch(gitPath = DEFAULT_GIT_PATH) {
+    return run(`${gitPath} rev-parse --abbrev-ref HEAD`) || null;
+}
+/**
+ * Check if we're in the main worktree (not a lane worktree).
+ *
+ * In the main checkout, git-dir returns ".git".
+ * In a worktree, git-dir returns ".git/worktrees/<name>".
+ *
+ * @param gitPath - Path to git executable (default: '/usr/bin/git')
+ * @returns True if in main worktree
+ */
+export function isMainWorktree(gitPath = DEFAULT_GIT_PATH) {
+    const gitDir = run(`${gitPath} rev-parse --git-dir`);
+    if (!gitDir)
+        return true;
+    const normalized = gitDir.replace(/\\/g, '/');
+    return !normalized.includes('/worktrees/');
+}
+/**
+ * Check if we're in any worktree (not the main checkout).
+ *
+ * @param gitPath - Path to git executable (default: '/usr/bin/git')
+ * @returns True if in a worktree
+ */
+export function isInWorktree(gitPath = DEFAULT_GIT_PATH) {
+    const gitDir = run(`${gitPath} rev-parse --git-dir`);
+    if (!gitDir)
+        return false;
+    return gitDir.includes('/worktrees/');
+}
+/**
+ * Get the main checkout's path using git.
+ *
+ * Works in both main checkout and worktrees.
+ * Uses git rev-parse --git-common-dir which returns the main .git directory
+ * even when run from a worktree.
+ *
+ * @returns Path to main checkout, or null if not in a git repo
+ */
+export function getMainCheckoutPath() {
+    try {
+        const gitCommonDir = execSync('git rev-parse --git-common-dir', {
+            encoding: ENCODING,
+            stdio: STDIO_PIPE,
+        }).trim();
+        return path.dirname(path.resolve(gitCommonDir));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=worktree.js.map

package/dist/worktree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAqB,MAAM,oBAAoB,CAAC;AACjE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,GAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,MAAe,CAAC;AACjC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,gBAAgB;IACjE,OAAO,GAAG,CAAC,GAAG,OAAO,8BAA8B,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,gBAAgB;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,gBAAgB;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,QAAQ,CAAC,gCAAgC,EAAE;YAC9D,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC,IAAI,EAAE,CAAC;QAEV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@lumenflow/shims",
+  "version": "1.0.0",
+  "description": "Git and pnpm safety shims for LumenFlow worktree discipline",
+  "keywords": [
+    "lumenflow",
+    "git",
+    "pnpm",
+    "shim",
+    "worktree",
+    "safety"
+  ],
+  "homepage": "https://github.com/hellmai/os",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/hellmai/os.git",
+    "directory": "packages/@lumenflow/shims"
+  },
+  "license": "Apache-2.0",
+  "author": {
+    "name": "HellmAI",
+    "url": "https://hellm.ai"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./git": {
+      "types": "./dist/git-shim.d.ts",
+      "import": "./dist/git-shim.js"
+    },
+    "./pnpm": {
+      "types": "./dist/pnpm-shim.d.ts",
+      "import": "./dist/pnpm-shim.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "lumenflow-git": "./dist/git-shim.js",
+    "lumenflow-pnpm": "./dist/pnpm-shim.js"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "dependencies": {
+    "zod": "^4.3.5"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.0.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "build:dist": "tsc -p tsconfig.build.json",
+    "pack:dist": "pnpm pack",
+    "clean": "rm -rf dist *.tgz",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint src --max-warnings 0",
+    "typecheck": "tsc --noEmit"
+  }
+}