@massu/core 2.5.0 → 2.5.2

package/dist/hooks/pre-tool-use-gate.js

@@ -1167,6 +1167,13 @@ var init_config = __esm({
     });
     LanguageFrameworkEntrySchema = z2.object({
       framework: z2.string().optional(),
+      // `source_dirs` is emitted by `init` (commands/init.ts:417) and existence-checked
+      // by config validation (init.ts:868-876), but until 2026-08-14 it survived only via
+      // `.passthrough()` — declared in the file, untyped in the schema. `lib/source-layout.ts`
+      // derives the index builders' candidate set from it, so it is typed here rather than
+      // read as an unknown: a consumer that has to shape-check its own SoT is one branch away
+      // from silently contributing `undefined` to a path predicate.
+      source_dirs: z2.array(z2.string()).optional(),
       test_framework: z2.string().optional(),
       test: z2.string().optional(),
       runtime: z2.string().optional(),
@@ -1339,6 +1346,16 @@ var init_memory_vector = __esm({
   }
 });
 
+// src/lib/timestamps.ts
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var init_timestamps = __esm({
+  "src/lib/timestamps.ts"() {
+    "use strict";
+  }
+});
+
 // src/db-backup.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
 import { resolve as resolve3, join as join3, basename, dirname as dirname4 } from "path";
@@ -3599,8 +3616,8 @@ function linkSessionToTask(db, sessionId, taskId) {
 }
 function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantResponse, toolCallsJson, toolCallCount, promptTokens, responseTokens) {
   const result = db.prepare(`
-    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3609,14 +3626,15 @@ function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantRes
     toolCallsJson,
     toolCallCount,
     promptTokens,
-    responseTokens
+    responseTokens,
+    nowIso()
   );
   return Number(result.lastInsertRowid);
 }
 function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, inputSize, outputSize, success, filesInvolved) {
   db.prepare(`
-    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3625,7 +3643,8 @@ function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, in
     inputSize,
     outputSize,
     success ? 1 : 0,
-    filesInvolved ? JSON.stringify(filesInvolved) : null
+    filesInvolved ? JSON.stringify(filesInvolved) : null,
+    nowIso()
   );
 }
 function getLastProcessedLine(db, sessionId) {
@@ -3884,6 +3903,7 @@ var init_memory_db = __esm({
     init_db_driver();
     init_config();
     init_memory_vector();
+    init_timestamps();
     init_db_backup();
     init_rule_delivery();
     init_rule_candidate_store();
@@ -3973,12 +3993,57 @@ var init_hook_failure_signal = __esm({
 });
 
 // src/hooks/lib/write-hook-message.ts
-function writeHookMessage(message) {
-  process.stdout.write(JSON.stringify({ message }) + "\n");
+var HOOK_EVENTS = [
+  "UserPromptSubmit",
+  "UserPromptExpansion",
+  "SessionStart",
+  "PreToolUse",
+  "PostToolUse",
+  "Stop",
+  "SubagentStop",
+  "PreCompact"
+];
+var ADDITIONAL_CONTEXT_MAX_CHARS = 1e4;
+function isHookEvent(value) {
+  return typeof value === "string" && HOOK_EVENTS.includes(value);
+}
+function writeHookContext(hookEventName, message) {
+  if (!isHookEvent(hookEventName)) {
+    process.stderr.write(
+      `[massu] writeHookContext: refusing to emit \u2014 unrecognised hook event ${JSON.stringify(hookEventName)}. Known: ${HOOK_EVENTS.join(", ")}.
+`
+    );
+    return;
+  }
+  if (typeof message !== "string" || message.length === 0) return;
+  let additionalContext = message;
+  if (additionalContext.length > ADDITIONAL_CONTEXT_MAX_CHARS) {
+    const marker = `
+[massu] \u2026truncated at ${ADDITIONAL_CONTEXT_MAX_CHARS} chars (spec cap).`;
+    additionalContext = additionalContext.slice(0, ADDITIONAL_CONTEXT_MAX_CHARS - marker.length) + marker;
+  }
+  process.stdout.write(
+    JSON.stringify({ hookSpecificOutput: { hookEventName, additionalContext } }) + "\n"
+  );
 }
 
 // src/hooks/security-gate.ts
 init_hook_failure_signal();
+
+// src/hooks/lib/is-direct-invocation.ts
+import { pathToFileURL } from "url";
+function isDirectInvocation(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return moduleUrl === pathToFileURL(entry).href;
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/security-gate.ts
+var HOOK_EVENT = "PreToolUse";
 var DANGEROUS_BASH_PATTERNS = [
   // BLOCK — destructive and irreversible, or arbitrary remote code execution.
   { pattern: /rm\s+-[a-z]*r[a-z]*f[a-z]*\s+\/(?:\s|$)/, label: "rm -rf /", severity: "block" },
@@ -4098,7 +4163,7 @@ async function main() {
     const input = await readStdin();
     const hookInput = JSON.parse(input);
     const messages = runSecurityGateChecks(hookInput);
-    for (const msg of messages) writeHookMessage(msg);
+    for (const msg of messages) writeHookContext(HOOK_EVENT, msg);
   } catch (err) {
     recordHookFailure("security-gate", err);
     process.stderr.write("MASSU SECURITY GATE \u2014 BLOCKED (gate could not evaluate this call)\n");
@@ -4117,7 +4182,7 @@ function readStdin() {
     setTimeout(() => resolve5(data), 400);
   });
 }
-if (process.argv[1]?.endsWith("security-gate.js") || process.argv[1]?.endsWith("security-gate")) {
+if (isDirectInvocation(import.meta.url)) {
   main();
 }
 
@@ -4219,7 +4284,57 @@ function getFeatureImpact(db, filePaths) {
 
 // src/hooks/pre-delete-check.ts
 init_config();
+
+// src/lib/source-layout.ts
+init_config();
+function normalizeDir(raw) {
+  if (typeof raw !== "string") return null;
+  const posix = raw.replace(/\\/g, "/");
+  if (posix.startsWith("/") || /^[A-Za-z]:\//.test(posix)) return null;
+  const parts = posix.split("/").filter((p) => p !== "" && p !== ".");
+  if (parts.some((p) => p === "..")) return null;
+  if (parts.length === 0) return ".";
+  return parts.join("/");
+}
+function declaredLanguageSourceDirs() {
+  const languages = getConfig().framework.languages;
+  if (!languages) return [];
+  const out = [];
+  for (const entry of Object.values(languages)) {
+    if (Array.isArray(entry.source_dirs)) out.push(...entry.source_dirs);
+  }
+  return out;
+}
+function getSourceLayout() {
+  const config = getConfig();
+  const paths = config.paths;
+  const declared = [
+    paths.source,
+    ...paths.monorepo_roots ?? [],
+    ...declaredLanguageSourceDirs()
+  ];
+  const normalized = declared.map(normalizeDir).filter((d) => d !== null);
+  const includesRoot = normalized.includes(".");
+  const sourceDirs = includesRoot ? [] : [...new Set(normalized)].sort();
+  const source = normalizeDir(paths.source) ?? ".";
+  const under = (child) => source === "." ? child : `${source}/${child}`;
+  return {
+    sourceDirs,
+    includesRoot,
+    extensions: getResolvedPaths().extensions,
+    pagesDir: normalizeDir(paths.pages ?? under("app")) ?? under("app"),
+    componentsDir: normalizeDir(paths.components ?? under("components")) ?? under("components")
+  };
+}
+function isUnderSourceDir(path, layout = getSourceLayout()) {
+  if (normalizeDir(path) === null) return false;
+  if (layout.includesRoot) return true;
+  return layout.sourceDirs.some((d) => path.startsWith(`${d}/`));
+}
+
+// src/hooks/pre-delete-check.ts
 init_hook_failure_signal();
+var HOOK_EVENT2 = "PreToolUse";
 var PROJECT_ROOT2 = getProjectRoot();
 var KNOWLEDGE_PROTECTED_FILES = [
   "knowledge-db.ts",
@@ -4269,8 +4384,8 @@ function extractDeletedFiles(input) {
     if (rmMatch) {
       const paths = rmMatch[1].split(/\s+/).filter((p) => !p.startsWith("-"));
       for (const p of paths) {
-        const relPath = p.startsWith("src/") ? p : p.replace(PROJECT_ROOT2 + "/", "");
-        if (relPath.startsWith("src/") || relPath.endsWith(".py")) {
+        const relPath = isUnderSourceDir(p) ? p : p.replace(PROJECT_ROOT2 + "/", "");
+        if (isUnderSourceDir(relPath) || relPath.endsWith(".py")) {
           files.push(relPath);
         }
       }
@@ -4280,7 +4395,7 @@ function extractDeletedFiles(input) {
     const content = input.tool_input.content || "";
     if (content.trim().length === 0) {
       const relPath = input.tool_input.file_path.replace(PROJECT_ROOT2 + "/", "");
-      if (relPath.startsWith("src/") || relPath.endsWith(".py")) {
+      if (isUnderSourceDir(relPath) || relPath.endsWith(".py")) {
         files.push(relPath);
       }
     }
@@ -4363,7 +4478,7 @@ async function main2() {
     const input = await readStdin2();
     const hookInput = JSON.parse(input);
     const messages = runPreDeleteChecks(hookInput);
-    for (const msg of messages) writeHookMessage(msg);
+    for (const msg of messages) writeHookContext(HOOK_EVENT2, msg);
   } catch (err) {
     recordHookFailure("pre-delete-check", err);
     process.stderr.write("MASSU SECURITY GATE \u2014 BLOCKED (gate could not evaluate this call)\n");
@@ -4382,7 +4497,7 @@ function readStdin2() {
     setTimeout(() => resolve5(data), 400);
   });
 }
-if (process.argv[1]?.endsWith("pre-delete-check.js") || process.argv[1]?.endsWith("pre-delete-check")) {
+if (isDirectInvocation(import.meta.url)) {
   main2();
 }
 
@@ -4423,6 +4538,7 @@ function readStdinToEof(deadlineMs = 4e3) {
 
 // src/hooks/pre-tool-use-gate.ts
 init_hook_failure_signal();
+var HOOK_EVENT3 = "PreToolUse";
 var EXIT_DENY = 2;
 var EXIT_ALLOW = 0;
 function deny(reason, detail) {
@@ -4472,11 +4588,13 @@ async function main3() {
   }
   const blocking = findings.filter((f) => f.severity === "block");
   for (const f of findings.filter((x) => x.severity === "warn")) {
-    writeHookMessage(f.message);
+    writeHookContext(HOOK_EVENT3, f.message);
   }
   if (blocking.length > 0) {
     deny(blocking.map((f) => f.message).join("\n\n"));
   }
   process.exit(EXIT_ALLOW);
 }
-main3();
+if (isDirectInvocation(import.meta.url)) {
+  main3();
+}

package/dist/hooks/quality-event.js

@@ -1167,6 +1167,13 @@ var init_config = __esm({
     });
     LanguageFrameworkEntrySchema = z2.object({
       framework: z2.string().optional(),
+      // `source_dirs` is emitted by `init` (commands/init.ts:417) and existence-checked
+      // by config validation (init.ts:868-876), but until 2026-08-14 it survived only via
+      // `.passthrough()` — declared in the file, untyped in the schema. `lib/source-layout.ts`
+      // derives the index builders' candidate set from it, so it is typed here rather than
+      // read as an unknown: a consumer that has to shape-check its own SoT is one branch away
+      // from silently contributing `undefined` to a path predicate.
+      source_dirs: z2.array(z2.string()).optional(),
       test_framework: z2.string().optional(),
       test: z2.string().optional(),
       runtime: z2.string().optional(),
@@ -1339,6 +1346,16 @@ var init_memory_vector = __esm({
   }
 });
 
+// src/lib/timestamps.ts
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var init_timestamps = __esm({
+  "src/lib/timestamps.ts"() {
+    "use strict";
+  }
+});
+
 // src/db-backup.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
 import { resolve as resolve3, join as join3, basename, dirname as dirname4 } from "path";
@@ -3670,8 +3687,8 @@ function linkSessionToTask(db, sessionId, taskId) {
 }
 function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantResponse, toolCallsJson, toolCallCount, promptTokens, responseTokens) {
   const result = db.prepare(`
-    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3680,14 +3697,15 @@ function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantRes
     toolCallsJson,
     toolCallCount,
     promptTokens,
-    responseTokens
+    responseTokens,
+    nowIso()
   );
   return Number(result.lastInsertRowid);
 }
 function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, inputSize, outputSize, success, filesInvolved) {
   db.prepare(`
-    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3696,7 +3714,8 @@ function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, in
     inputSize,
     outputSize,
     success ? 1 : 0,
-    filesInvolved ? JSON.stringify(filesInvolved) : null
+    filesInvolved ? JSON.stringify(filesInvolved) : null,
+    nowIso()
   );
 }
 function getLastProcessedLine(db, sessionId) {
@@ -3955,6 +3974,7 @@ var init_memory_db = __esm({
     init_db_driver();
     init_config();
     init_memory_vector();
+    init_timestamps();
     init_db_backup();
     init_rule_delivery();
     init_rule_candidate_store();
@@ -4072,6 +4092,21 @@ function toolResponseText(raw) {
 
 // src/hooks/quality-event.ts
 init_hook_failure_signal();
+init_timestamps();
+
+// src/hooks/lib/is-direct-invocation.ts
+import { pathToFileURL } from "url";
+function isDirectInvocation(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return moduleUrl === pathToFileURL(entry).href;
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/quality-event.ts
 var TEST_FAILURE_PATTERNS = [
   /\bFAIL\b/,
   /✗/,
@@ -4135,11 +4170,11 @@ async function main() {
     const db = getMemoryDb();
     try {
       const stmt = db.prepare(`
-        INSERT INTO quality_events (session_id, event_type, tool_name, details)
-        VALUES (?, ?, ?, ?)
+        INSERT INTO quality_events (session_id, event_type, tool_name, details, created_at)
+        VALUES (?, ?, ?, ?, ?)
       `);
       for (const signal of signals) {
-        stmt.run(session_id, signal.event_type, tool_name, signal.details);
+        stmt.run(session_id, signal.event_type, tool_name, signal.details, nowIso());
       }
     } finally {
       db.close();
@@ -4160,4 +4195,6 @@ function readStdin() {
     setTimeout(() => resolve5(data), 3e3);
   });
 }
-main();
+if (isDirectInvocation(import.meta.url)) {
+  main();
+}

package/dist/hooks/rule-enforcement-pipeline.js

@@ -697,6 +697,13 @@ var init_config = __esm({
     });
     LanguageFrameworkEntrySchema = z2.object({
       framework: z2.string().optional(),
+      // `source_dirs` is emitted by `init` (commands/init.ts:417) and existence-checked
+      // by config validation (init.ts:868-876), but until 2026-08-14 it survived only via
+      // `.passthrough()` — declared in the file, untyped in the schema. `lib/source-layout.ts`
+      // derives the index builders' candidate set from it, so it is typed here rather than
+      // read as an unknown: a consumer that has to shape-check its own SoT is one branch away
+      // from silently contributing `undefined` to a path predicate.
+      source_dirs: z2.array(z2.string()).optional(),
       test_framework: z2.string().optional(),
       test: z2.string().optional(),
       runtime: z2.string().optional(),
@@ -1339,6 +1346,16 @@ var init_memory_vector = __esm({
   }
 });
 
+// src/lib/timestamps.ts
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var init_timestamps = __esm({
+  "src/lib/timestamps.ts"() {
+    "use strict";
+  }
+});
+
 // src/db-backup.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync, statSync, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
 import { resolve as resolve3, join as join3, basename, dirname as dirname4 } from "path";
@@ -3599,8 +3616,8 @@ function linkSessionToTask(db, sessionId, taskId) {
 }
 function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantResponse, toolCallsJson, toolCallCount, promptTokens, responseTokens) {
   const result = db.prepare(`
-    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3609,14 +3626,15 @@ function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantRes
     toolCallsJson,
     toolCallCount,
     promptTokens,
-    responseTokens
+    responseTokens,
+    nowIso()
   );
   return Number(result.lastInsertRowid);
 }
 function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, inputSize, outputSize, success, filesInvolved) {
   db.prepare(`
-    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3625,7 +3643,8 @@ function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, in
     inputSize,
     outputSize,
     success ? 1 : 0,
-    filesInvolved ? JSON.stringify(filesInvolved) : null
+    filesInvolved ? JSON.stringify(filesInvolved) : null,
+    nowIso()
   );
 }
 function getLastProcessedLine(db, sessionId) {
@@ -3884,6 +3903,7 @@ var init_memory_db = __esm({
     init_db_driver();
     init_config();
     init_memory_vector();
+    init_timestamps();
     init_db_backup();
     init_rule_delivery();
     init_rule_candidate_store();
@@ -3978,12 +3998,57 @@ import { existsSync as existsSync9, readFileSync as readFileSync6, readdirSync a
 import { basename as basename3, resolve as resolve5 } from "path";
 
 // src/hooks/lib/write-hook-message.ts
-function writeHookMessage(message) {
-  process.stdout.write(JSON.stringify({ message }) + "\n");
+var HOOK_EVENTS = [
+  "UserPromptSubmit",
+  "UserPromptExpansion",
+  "SessionStart",
+  "PreToolUse",
+  "PostToolUse",
+  "Stop",
+  "SubagentStop",
+  "PreCompact"
+];
+var ADDITIONAL_CONTEXT_MAX_CHARS = 1e4;
+function isHookEvent(value) {
+  return typeof value === "string" && HOOK_EVENTS.includes(value);
+}
+function writeHookContext(hookEventName, message) {
+  if (!isHookEvent(hookEventName)) {
+    process.stderr.write(
+      `[massu] writeHookContext: refusing to emit \u2014 unrecognised hook event ${JSON.stringify(hookEventName)}. Known: ${HOOK_EVENTS.join(", ")}.
+`
+    );
+    return;
+  }
+  if (typeof message !== "string" || message.length === 0) return;
+  let additionalContext = message;
+  if (additionalContext.length > ADDITIONAL_CONTEXT_MAX_CHARS) {
+    const marker = `
+[massu] \u2026truncated at ${ADDITIONAL_CONTEXT_MAX_CHARS} chars (spec cap).`;
+    additionalContext = additionalContext.slice(0, ADDITIONAL_CONTEXT_MAX_CHARS - marker.length) + marker;
+  }
+  process.stdout.write(
+    JSON.stringify({ hookSpecificOutput: { hookEventName, additionalContext } }) + "\n"
+  );
 }
 
 // src/hooks/rule-enforcement-pipeline.ts
 init_hook_failure_signal();
+
+// src/hooks/lib/is-direct-invocation.ts
+import { pathToFileURL } from "url";
+function isDirectInvocation(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return moduleUrl === pathToFileURL(entry).href;
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/rule-enforcement-pipeline.ts
+var HOOK_EVENT = "PostToolUse";
 async function main() {
   try {
     const input = await readStdin();
@@ -4081,7 +4146,7 @@ async function main() {
     lines.push("  This step is MANDATORY per the auto-learning pipeline.");
     lines.push("============================================================================");
     lines.push("");
-    writeHookMessage(lines.join("\n"));
+    writeHookContext(HOOK_EVENT, lines.join("\n"));
   } catch (err) {
     recordHookFailure("rule-enforcement-pipeline", err);
   }
@@ -4098,4 +4163,6 @@ function readStdin() {
     setTimeout(() => resolve6(data), 3e3);
   });
 }
-main();
+if (isDirectInvocation(import.meta.url)) {
+  main();
+}