@massu/core 1.10.8 → 1.12.0

package/dist/hooks/quality-event.js

@@ -348,6 +348,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -466,6 +482,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -1018,6 +1036,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c) => c.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,

package/dist/hooks/rule-enforcement-pipeline.js

@@ -339,6 +339,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -457,6 +473,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -487,6 +505,11 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
   return _config;
 }
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/rule-enforcement-pipeline.ts
 async function main() {
   try {
@@ -585,7 +608,7 @@ async function main() {
     lines.push("  This step is MANDATORY per the auto-learning pipeline.");
     lines.push("============================================================================");
     lines.push("");
-    console.log(lines.join("\n"));
+    writeHookMessage(lines.join("\n"));
   } catch {
   }
   process.exit(0);

package/dist/hooks/security-gate.js

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 import{createRequire as __cr}from"module";const require=__cr(import.meta.url);
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/security-gate.ts
 var DANGEROUS_BASH_PATTERNS = [
   { pattern: /rm\s+-[a-z]*r[a-z]*f[a-z]*\s+\/(?:\s|$)/, label: "rm -rf /" },
@@ -70,44 +75,47 @@ function checkPythonContent(content) {
   }
   return null;
 }
-async function main() {
+function runSecurityGateChecks(hookInput) {
+  const messages = [];
   try {
-    const input = await readStdin();
-    const hookInput = JSON.parse(input);
     const { tool_name, tool_input } = hookInput;
     if (tool_name === "Bash" && tool_input.command) {
       const violation = checkBashCommand(tool_input.command);
       if (violation) {
-        process.stdout.write(JSON.stringify({
-          message: `SECURITY GATE: Dangerous command pattern detected: ${violation}
+        messages.push(`SECURITY GATE: Dangerous command pattern detected: ${violation}
 Command: ${tool_input.command.slice(0, 200)}
-Review carefully before proceeding.`
-        }));
+Review carefully before proceeding.`);
       }
     }
     if ((tool_name === "Write" || tool_name === "Edit") && tool_input.file_path) {
       const violation = checkFilePath(tool_input.file_path);
       if (violation) {
-        process.stdout.write(JSON.stringify({
-          message: `SECURITY GATE: Attempt to write to protected file: ${violation}
+        messages.push(`SECURITY GATE: Attempt to write to protected file: ${violation}
 Path: ${tool_input.file_path}
-Ensure this is intentional and no secrets will be exposed.`
-        }));
+Ensure this is intentional and no secrets will be exposed.`);
       }
     }
     const pyContent = tool_input.content || tool_input.new_string;
     if ((tool_name === "Write" || tool_name === "Edit") && tool_input.file_path?.endsWith(".py") && pyContent) {
       const pyViolation = checkPythonContent(pyContent);
       if (pyViolation) {
-        process.stdout.write(JSON.stringify({
-          message: `SECURITY GATE: Dangerous Python pattern detected: ${pyViolation}
+        messages.push(`SECURITY GATE: Dangerous Python pattern detected: ${pyViolation}
 File: ${tool_input.file_path}
-Review carefully before proceeding.`
-        }));
+Review carefully before proceeding.`);
       }
     }
   } catch {
   }
+  return messages;
+}
+async function main() {
+  try {
+    const input = await readStdin();
+    const hookInput = JSON.parse(input);
+    const messages = runSecurityGateChecks(hookInput);
+    for (const msg of messages) writeHookMessage(msg);
+  } catch {
+  }
   process.exit(0);
 }
 function readStdin() {
@@ -121,4 +129,9 @@ function readStdin() {
     setTimeout(() => resolve(data), 400);
   });
 }
-main();
+if (process.argv[1]?.endsWith("security-gate.js") || process.argv[1]?.endsWith("security-gate")) {
+  main();
+}
+export {
+  runSecurityGateChecks
+};

package/dist/hooks/session-end.js

@@ -348,6 +348,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -466,6 +482,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -1018,6 +1036,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c) => c.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,