@mnemom/mnemom 0.17.34 → 0.17.36

package/node_modules/@noble/hashes/webcrypto.d.ts

@@ -0,0 +1,121 @@
+import { type Pbkdf2Opt } from './pbkdf2.ts';
+import { type KDFInput, type TArg, type TRet } from './utils.ts';
+/** Callable WebCrypto hash function descriptor. */
+export type WebHash = {
+    /**
+     * Hashes one message with the selected WebCrypto digest.
+     * @param msg - message bytes to hash
+     * @returns Promise resolving to digest bytes.
+     */
+    (msg: TArg<Uint8Array>): Promise<TRet<Uint8Array>>;
+    /** WebCrypto algorithm name passed to `crypto.subtle`. */
+    webCryptoName: string;
+    /** Digest size in bytes. */
+    outputLen: number;
+    /** Input block size in bytes. */
+    blockLen: number;
+};
+/** WebCrypto SHA1 (RFC 3174) legacy hash function. It was cryptographically broken. */
+/**
+ * WebCrypto SHA2-256 hash function from RFC 6234.
+ * @param msg - message bytes to hash
+ * @returns Promise resolving to digest bytes.
+ * @example
+ * Hash a message with WebCrypto SHA2-256.
+ * ```ts
+ * await sha256(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export declare const sha256: TRet<WebHash>;
+/**
+ * WebCrypto SHA2-384 hash function from RFC 6234.
+ * @param msg - message bytes to hash
+ * @returns Promise resolving to digest bytes.
+ * @example
+ * Hash a message with WebCrypto SHA2-384.
+ * ```ts
+ * await sha384(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export declare const sha384: TRet<WebHash>;
+/**
+ * WebCrypto SHA2-512 hash function from RFC 6234.
+ * @param msg - message bytes to hash
+ * @returns Promise resolving to digest bytes.
+ * @example
+ * Hash a message with WebCrypto SHA2-512.
+ * ```ts
+ * await sha512(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export declare const sha512: TRet<WebHash>;
+/** WebCrypto HMAC function type. See {@link hmac} for usage. */
+type WebHmacFn = {
+    (hash: TArg<WebHash>, key: TArg<Uint8Array>, message: TArg<Uint8Array>): Promise<TRet<Uint8Array>>;
+    create(hash: TArg<WebHash>, key: TArg<Uint8Array>): any;
+};
+/**
+ * WebCrypto HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256. Webcrypto version.
+ * @param key - authentication key bytes
+ * @param message - message bytes to authenticate
+ * @returns Promise resolving to authentication tag bytes.
+ * `.create()` exists only to mirror the synchronous API surface
+ * and always throws `not implemented`.
+ * @example
+ * Compute an RFC 2104 HMAC with WebCrypto.
+ * ```ts
+ * import { hmac, sha256 } from '@noble/hashes/webcrypto.js';
+ * const key = new Uint8Array([1, 2, 3]);
+ * const message = new Uint8Array([4, 5, 6]);
+ * const mac = await hmac(sha256, key, message);
+ * ```
+ */
+export declare const hmac: TRet<WebHmacFn>;
+/**
+ * WebCrypto HKDF (RFC 5869): derive keys from an initial input.
+ * Combines hkdf_extract + hkdf_expand in one step
+ * @param hash - hash function that would be used (e.g. sha256). Webcrypto version.
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ * @param info - optional context and application specific information bytes
+ * @param length - length of output keying material in bytes.
+ *   RFC 5869 §2.3 allows `0..255*HashLen`, so `0` requests an empty OKM.
+ * @returns Promise resolving to derived key bytes.
+ * The RFC `L <= 255 * HashLen` bound is enforced before calling WebCrypto.
+ * @throws If the current runtime does not provide `crypto.subtle`. {@link Error}
+ * @example
+ * WebCrypto HKDF (RFC 5869): derive keys from an initial input.
+ * ```ts
+ * import { hkdf, sha256 } from '@noble/hashes/webcrypto.js';
+ * import { randomBytes, utf8ToBytes } from '@noble/hashes/utils.js';
+ * const inputKey = randomBytes(32);
+ * const salt = randomBytes(32);
+ * const info = utf8ToBytes('application-key');
+ * const okm = await hkdf(sha256, inputKey, salt, info, 32);
+ * ```
+ */
+export declare function hkdf(hash: TArg<WebHash>, ikm: TArg<Uint8Array>, salt: TArg<Uint8Array | undefined>, info: TArg<Uint8Array | undefined>, length: number): Promise<TRet<Uint8Array>>;
+/**
+ * WebCrypto PBKDF2-HMAC: RFC 8018 key derivation function.
+ * @param hash - hash function that would be used e.g. sha256. Webcrypto version.
+ * @param password - password from which a derived key is generated; string
+ *   inputs are normalized through `kdfInputToBytes()`, i.e. UTF-8
+ * @param salt - cryptographic salt; string inputs are normalized through
+ *   `kdfInputToBytes()`, i.e. UTF-8
+ * @param opts - PBKDF2 work factor and output settings. `dkLen`, if provided,
+ *   must be `>= 1` per RFC 8018 §5.2. See {@link Pbkdf2Opt}.
+ * @returns Promise resolving to derived key bytes.
+ * Positive-iteration enforcement is currently delegated to backend
+ * `deriveBits()` rejection (for example `c = 0`), not a dedicated
+ * library-side guard. Values above the signed 32-bit backend range are rejected locally.
+ * @throws If the current runtime does not provide `crypto.subtle`. {@link Error}
+ * @example
+ * WebCrypto PBKDF2-HMAC: RFC 2898 key derivation function.
+ * ```ts
+ * import { pbkdf2, sha256 } from '@noble/hashes/webcrypto.js';
+ * const key = await pbkdf2(sha256, 'password', 'salt', { dkLen: 32, c: Math.pow(2, 18) });
+ * ```
+ */
+export declare function pbkdf2(hash: TArg<WebHash>, password: TArg<KDFInput>, salt: TArg<KDFInput>, opts: Pbkdf2Opt): Promise<TRet<Uint8Array>>;
+export {};

package/node_modules/@noble/hashes/webcrypto.js

@@ -0,0 +1,228 @@
+import {} from "./pbkdf2.js";
+import { abytes, ahash, anumber, checkOpts, clean, copyBytes, kdfInputToBytes, } from "./utils.js";
+function _subtle() {
+    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;
+    const sb = cr?.subtle;
+    if (typeof sb === 'object' && sb != null)
+        return sb;
+    throw new Error('crypto.subtle must be defined');
+}
+function createWebHash(name, blockLen, outputLen) {
+    const hashC = async (msg) => {
+        abytes(msg);
+        const crypto = _subtle();
+        return new Uint8Array(await crypto.digest(name, msg));
+    };
+    hashC.webCryptoName = name; // make sure it won't interfere with function name
+    hashC.outputLen = outputLen;
+    hashC.blockLen = blockLen;
+    hashC.create = () => {
+        // Present only so this async wrapper satisfies the shared
+        // hash-wrapper shape checked by `ahashWeb()`.
+        throw new Error('not implemented');
+    };
+    // Later WebCrypto HMAC/HKDF/PBKDF2 calls read descriptor metadata directly, so freezing prevents
+    // callers from retargeting a `sha256` wrapper into a different backend digest by mutation.
+    return Object.freeze(hashC);
+}
+function ahashWeb(hash) {
+    ahash(hash);
+    const name = hash.webCryptoName;
+    if (typeof name !== 'string')
+        throw new Error('non-web hash');
+    return name;
+}
+/** WebCrypto SHA1 (RFC 3174) legacy hash function. It was cryptographically broken. */
+// export const sha1: WebHash = createHash('SHA-1', 64, 20);
+/**
+ * WebCrypto SHA2-256 hash function from RFC 6234.
+ * @param msg - message bytes to hash
+ * @returns Promise resolving to digest bytes.
+ * @example
+ * Hash a message with WebCrypto SHA2-256.
+ * ```ts
+ * await sha256(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export const sha256 = /* @__PURE__ */ createWebHash('SHA-256', 64, 32);
+/**
+ * WebCrypto SHA2-384 hash function from RFC 6234.
+ * @param msg - message bytes to hash
+ * @returns Promise resolving to digest bytes.
+ * @example
+ * Hash a message with WebCrypto SHA2-384.
+ * ```ts
+ * await sha384(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export const sha384 = /* @__PURE__ */ createWebHash('SHA-384', 128, 48);
+/**
+ * WebCrypto SHA2-512 hash function from RFC 6234.
+ * @param msg - message bytes to hash
+ * @returns Promise resolving to digest bytes.
+ * @example
+ * Hash a message with WebCrypto SHA2-512.
+ * ```ts
+ * await sha512(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+export const sha512 = /* @__PURE__ */ createWebHash('SHA-512', 128, 64);
+/**
+ * WebCrypto HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256. Webcrypto version.
+ * @param key - authentication key bytes
+ * @param message - message bytes to authenticate
+ * @returns Promise resolving to authentication tag bytes.
+ * `.create()` exists only to mirror the synchronous API surface
+ * and always throws `not implemented`.
+ * @example
+ * Compute an RFC 2104 HMAC with WebCrypto.
+ * ```ts
+ * import { hmac, sha256 } from '@noble/hashes/webcrypto.js';
+ * const key = new Uint8Array([1, 2, 3]);
+ * const message = new Uint8Array([4, 5, 6]);
+ * const mac = await hmac(sha256, key, message);
+ * ```
+ */
+export const hmac = /* @__PURE__ */ (() => {
+    const hmac_ = async (hash, key, message) => {
+        const crypto = _subtle();
+        abytes(key, undefined, 'key');
+        abytes(message, undefined, 'message');
+        const hashName = ahashWeb(hash);
+        // importKey() snapshots key synchronously, but message is not passed to sign() until after
+        // importKey() resolves. Keep the wrapper's inputs stable across that await.
+        const _message = copyBytes(message);
+        try {
+            // WebCrypto keys can't be zeroized
+            // prettier-ignore
+            const wkey = await crypto.importKey('raw', key, { name: 'HMAC', hash: hashName }, false, ['sign']);
+            return new Uint8Array(await crypto.sign('HMAC', wkey, _message));
+        }
+        finally {
+            clean(_message);
+        }
+    };
+    hmac_.create = (_hash, _key) => {
+        throw new Error('not implemented');
+    };
+    return hmac_;
+})();
+/**
+ * WebCrypto HKDF (RFC 5869): derive keys from an initial input.
+ * Combines hkdf_extract + hkdf_expand in one step
+ * @param hash - hash function that would be used (e.g. sha256). Webcrypto version.
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ * @param info - optional context and application specific information bytes
+ * @param length - length of output keying material in bytes.
+ *   RFC 5869 §2.3 allows `0..255*HashLen`, so `0` requests an empty OKM.
+ * @returns Promise resolving to derived key bytes.
+ * The RFC `L <= 255 * HashLen` bound is enforced before calling WebCrypto.
+ * @throws If the current runtime does not provide `crypto.subtle`. {@link Error}
+ * @example
+ * WebCrypto HKDF (RFC 5869): derive keys from an initial input.
+ * ```ts
+ * import { hkdf, sha256 } from '@noble/hashes/webcrypto.js';
+ * import { randomBytes, utf8ToBytes } from '@noble/hashes/utils.js';
+ * const inputKey = randomBytes(32);
+ * const salt = randomBytes(32);
+ * const info = utf8ToBytes('application-key');
+ * const okm = await hkdf(sha256, inputKey, salt, info, 32);
+ * ```
+ */
+export async function hkdf(hash, ikm, salt, info, length) {
+    const crypto = _subtle();
+    const hashName = ahashWeb(hash);
+    const hashOutputLen = hash.outputLen;
+    abytes(ikm, undefined, 'ikm');
+    anumber(length, 'length');
+    if (length > 255 * hashOutputLen)
+        throw new Error('Length must be <= 255*HashLen');
+    if (salt !== undefined)
+        abytes(salt, undefined, 'salt');
+    if (info !== undefined)
+        abytes(info, undefined, 'info');
+    // salt and info reach deriveBits() only after importKey() resolves, so snapshot them now.
+    const _salt = salt === undefined ? new Uint8Array(0) : copyBytes(salt);
+    const _info = info === undefined ? new Uint8Array(0) : copyBytes(info);
+    try {
+        const wkey = await crypto.importKey('raw', ikm, 'HKDF', false, ['deriveBits']);
+        const opts = { name: 'HKDF', hash: hashName, salt: _salt, info: _info };
+        const out = new Uint8Array(await crypto.deriveBits(opts, wkey, 8 * length));
+        if (out.length !== length) {
+            clean(out);
+            throw new Error('WebCrypto returned an invalid derived key length');
+        }
+        return out;
+    }
+    finally {
+        clean(_salt, _info);
+    }
+}
+/**
+ * WebCrypto PBKDF2-HMAC: RFC 8018 key derivation function.
+ * @param hash - hash function that would be used e.g. sha256. Webcrypto version.
+ * @param password - password from which a derived key is generated; string
+ *   inputs are normalized through `kdfInputToBytes()`, i.e. UTF-8
+ * @param salt - cryptographic salt; string inputs are normalized through
+ *   `kdfInputToBytes()`, i.e. UTF-8
+ * @param opts - PBKDF2 work factor and output settings. `dkLen`, if provided,
+ *   must be `>= 1` per RFC 8018 §5.2. See {@link Pbkdf2Opt}.
+ * @returns Promise resolving to derived key bytes.
+ * Positive-iteration enforcement is currently delegated to backend
+ * `deriveBits()` rejection (for example `c = 0`), not a dedicated
+ * library-side guard. Values above the signed 32-bit backend range are rejected locally.
+ * @throws If the current runtime does not provide `crypto.subtle`. {@link Error}
+ * @example
+ * WebCrypto PBKDF2-HMAC: RFC 2898 key derivation function.
+ * ```ts
+ * import { pbkdf2, sha256 } from '@noble/hashes/webcrypto.js';
+ * const key = await pbkdf2(sha256, 'password', 'salt', { dkLen: 32, c: Math.pow(2, 18) });
+ * ```
+ */
+export async function pbkdf2(hash, password, salt, opts) {
+    const crypto = _subtle();
+    const hashName = ahashWeb(hash);
+    const _opts = checkOpts({ dkLen: 32 }, opts);
+    const { c, dkLen } = _opts;
+    anumber(c, 'c');
+    anumber(dkLen, 'dkLen');
+    // Node's native WebCrypto PBKDF2 binding accepts only a signed 32-bit iteration count and aborts
+    // the process on larger values instead of returning a rejected promise.
+    if (c > 0x7fffffff)
+        throw new Error('"c" exceeds WebCrypto backend limit');
+    // RFC 8018 §5.2 defines dkLen as a positive integer.
+    if (dkLen < 1)
+        throw new Error('"dkLen" must be >= 1');
+    // SubtleCrypto.deriveBits() accepts an unsigned-long bit count. Byte lengths at or above
+    // 2^29 would wrap after multiplication by eight instead of requesting the intended length.
+    if (dkLen >= 2 ** 29)
+        throw new Error('derived key too long');
+    const _password = kdfInputToBytes(password, 'password');
+    try {
+        const saltBytes = kdfInputToBytes(salt, 'salt');
+        // String conversion already returns an owned array. Caller-owned byte salts need a snapshot
+        // because deriveBits() does not receive them until after importKey() resolves.
+        const _salt = typeof salt === 'string' ? saltBytes : copyBytes(saltBytes);
+        try {
+            const key = await crypto.importKey('raw', _password, 'PBKDF2', false, [
+                'deriveBits',
+            ]);
+            const deriveOpts = { name: 'PBKDF2', salt: _salt, iterations: c, hash: hashName };
+            const out = new Uint8Array(await crypto.deriveBits(deriveOpts, key, 8 * dkLen));
+            if (out.length !== dkLen) {
+                clean(out);
+                throw new Error('WebCrypto returned an invalid derived key length');
+            }
+            return out;
+        }
+        finally {
+            clean(_salt);
+        }
+    }
+    finally {
+        if (typeof password === 'string')
+            clean(_password);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.34",
+  "version": "0.17.36",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {
@@ -18,7 +18,7 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@mnemom/aip-verifier": "https://github.com/mnemom/aip/releases/download/aip-verifier-v0.6.0/mnemom-aip-verifier-0.6.0.tgz",
+    "@mnemom/aip-verifier": "file:vendor/mnemom-aip-verifier-0.6.0.tgz",
     "@mnemom/policy-engine": "^0.3.0",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
@@ -34,6 +34,9 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.12"
   },
+  "bundleDependencies": [
+    "@mnemom/aip-verifier"
+  ],
   "files": [
     "dist",
     "!dist/__tests__",

package/plugins/integrity-manifest.json

@@ -12,12 +12,16 @@
     },
     {
       "path": "hooks/hooks.json",
-      "sha256": "c9fe91672a14aa8fc74d8fe523e412b7fdbe16a281cdc1d3e51b162fef3a7ed3"
+      "sha256": "fe45556f57011f0f1805fc56d2c86d5e2462cd1ba998ef7b54778b26556cfc4e"
     },
     {
       "path": "hooks/register.tsx",
       "sha256": "98da58c198d4015a5d454110249b1bc5c9fe0a1e2271c310f46c1185935d4436"
     },
+    {
+      "path": "hooks/seat-ask.mjs",
+      "sha256": "dcd0b419fc2a6fb1275aff34abb3d107311cecb4c8d7eac3c49b0c8a600db4a3"
+    },
     {
       "path": "hooks/seat-hello.mjs",
       "sha256": "4d6cd4e2fed2dc701bc6990ed5c43b37fb4aaf202b25012c3a052845d624daee"
@@ -31,5 +35,5 @@
       "sha256": "b877ea4d4d6fe11ae2eb10e035b5f017b225905f7f9ec015b3c3010609cad27b"
     }
   ],
-  "dir_hash": "ad16249ecbdd1e2fc6913529f9aefb357d516da7230f26a4e1c2c0ccf09735c5"
+  "dir_hash": "845a702134fb66daa9cbe8cc9a51f6a06ce08a08392ed5f0cf68ac4af7625398"
 }

package/plugins/mnemom/hooks/hooks.json

@@ -12,6 +12,18 @@
           }
         ]
       }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "[ -z \"$MNEMOM_SEAT_SOCKET\" ] || node \"${CLAUDE_PLUGIN_ROOT}/hooks/seat-ask.mjs\"",
+            "timeout": 600
+          }
+        ]
+      }
     ]
   }
 }

package/plugins/mnemom/hooks/seat-ask.mjs

@@ -0,0 +1,221 @@
+// The seat question hook (durable S1 amendment 61, signed off by Wassim 2026-11-02): a COMMAND hook on
+// PreToolUse for AskUserQuestion. In a durable seat nobody watches the screen, so a drawn dialog
+// would wait forever. This hook makes the question a journaled durable fact instead:
+//
+//   1. ask:     {op:"question_ask", session_id, spawn_id, epoch, tool_use_id, questions} over the
+//               per-seat socket. The seat proxy relays it to the host daemon, which alone holds the
+//               executor key and calls exec_question; the api journals question.asked.
+//   2. poll:    {op:"question_poll", ..., approval_id} every POLL_INTERVAL_MS until WAIT_MS ends.
+//               answered  -> stdout permissionDecision "allow" with updatedInput {questions, answers}:
+//                            the dialog never draws and the tool result carries the owner's answer.
+//               dismissed -> "deny" with the dismissed reason (the session is not suspended).
+//               expired   -> "deny" with the expired reason.
+//      created:false is this same call asked again (the daemon passes on only an answer whose
+//      question_sha is this ask's), so it is polled like a new one. A 409 durable_question_busy means
+//      an earlier question is still with the owner: this one was not recorded, the hook denies with
+//      PENDING_REASON at once and releases nothing (the earlier question belongs to its own wait).
+//   3. release: when the window ends first, {op:"question_release", ..., approval_id}, then "deny"
+//               with the hand-off reason: the model ends its turn and the owner's answer arrives
+//               later as an amendment 60 inbox message, which the daemon delivers unattended.
+//
+// Without MNEMOM_SEAT_SOCKET (every launch that is not a durable seat) it does nothing. If the ask
+// cannot be made (no socket, the daemon or api refuses), it writes nothing and exits 0, so Claude
+// Code shows its own dialog as it always did: this hook only ever removes the screen dependency, it
+// never blocks a question. It never sees a key: the ids are non-secret.
+//
+// The reason strings are S1 question.ts's QUESTION_HANDOFF_REASON and QUESTION_DISMISSED_REASON
+// (a plugin file cannot import the contract; a CLI test pins them equal).
+import net from "node:net";
+import { createHash } from "node:crypto";
+import { pathToFileURL } from "node:url";
+
+export const SEAT_SOCKET_ENV = "MNEMOM_SEAT_SOCKET";
+export const SEAT_SESSION_ENV = "MNEMOM_SEAT_SESSION_ID";
+export const SEAT_SPAWN_ENV = "MNEMOM_SEAT_SPAWN_ID";
+export const SEAT_EPOCH_ENV = "MNEMOM_SEAT_EPOCH";
+
+/** hooks.json gives this hook 600 s; it stops waiting well before, to release and answer cleanly. */
+export const WAIT_MS = 540_000;
+export const POLL_INTERVAL_MS = 3_000;
+/** One socket round trip (the seat proxy relays it to the daemon and the daemon to the api). */
+export const OP_TIMEOUT_MS = 20_000;
+export const MAX_ANSWER_BYTES = 256 * 1024;
+
+export const HANDOFF_REASON =
+  "This question is now with your owner. End your turn now without guessing; the owner's answer will arrive as your next message.";
+export const DISMISSED_REASON =
+  "Your owner dismissed this question without answering. Decide without it, or ask differently.";
+/**
+ * The session already has a different question with the owner (one per session: asking another is
+ * 409 durable_question_busy). This call's question was not recorded; the model must not take the
+ * earlier question's answer for this one.
+ */
+export const PENDING_REASON =
+  "This question was not sent: an earlier question of yours is still waiting for your owner. End your turn now without guessing; the owner's answer to that earlier question will arrive as your next message. Ask this one again after that if it still matters.";
+export const EXPIRED_REASON =
+  "Your owner did not answer this question before it expired. Decide without it, or ask again later.";
+
+/** S1 codes.ts durable_question_busy: another question of this session's is open. */
+const BUSY_CODE = "durable_question_busy";
+const TOOL_USE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+
+/** The seat ids from the env: `{ skip: true }` outside a seat or with an incomplete seat env. */
+export function seatFromEnv(env) {
+  const socketPath = env[SEAT_SOCKET_ENV];
+  const sessionId = env[SEAT_SESSION_ENV];
+  const spawnId = env[SEAT_SPAWN_ENV];
+  const epoch = env[SEAT_EPOCH_ENV];
+  if (!socketPath || !sessionId || !spawnId || !/^\d{1,9}$/.test(epoch ?? ""))
+    return { skip: true };
+  return { socketPath, session_id: sessionId, spawn_id: spawnId, epoch: Number(epoch) };
+}
+
+/**
+ * The tool call from the hook's stdin JSON, or null when it is not an AskUserQuestion call with
+ * questions. tool_use_id comes from the input; when the engine gives none, a stable id is derived
+ * from the questions (asking again returns the session's open question either way).
+ */
+export function toolCallOf(input) {
+  if (!input || typeof input !== "object") return null;
+  if (input.tool_name !== "AskUserQuestion") return null;
+  const ti = input.tool_input;
+  if (!ti || typeof ti !== "object" || !Array.isArray(ti.questions)) return null;
+  let id = typeof input.tool_use_id === "string" ? input.tool_use_id : "";
+  if (!TOOL_USE_ID_RE.test(id))
+    id = `h${createHash("sha256").update(JSON.stringify(ti.questions)).digest("hex").slice(0, 40)}`;
+  return { tool_use_id: id, tool_input: ti, questions: ti.questions };
+}
+
+/**
+ * One JSON line out, the first line back, parsed. Rejects on a socket error, close or timeout, and
+ * on an answer line over MAX_ANSWER_BYTES however the bytes were chunked.
+ */
+export function sendFrame(socketPath, frame, timeoutMs = OP_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    const sock = net.createConnection({ path: socketPath });
+    let buf = Buffer.alloc(0);
+    const done = (fn, v) => {
+      clearTimeout(timer);
+      sock.destroy();
+      fn(v);
+    };
+    const timer = setTimeout(() => done(reject, new Error("no answer in time")), timeoutMs);
+    sock.on("connect", () => sock.write(`${JSON.stringify(frame)}\n`));
+    sock.on("data", (d) => {
+      buf = Buffer.concat([buf, d]);
+      const i = buf.indexOf(0x0a);
+      // The line's bytes, or all the bytes so far while no newline has come.
+      if ((i < 0 ? buf.length : i) > MAX_ANSWER_BYTES)
+        return done(reject, new Error("answer too long"));
+      if (i < 0) return;
+      try {
+        done(resolve, JSON.parse(buf.subarray(0, i).toString("utf8")));
+      } catch {
+        done(reject, new Error("answer is not JSON"));
+      }
+    });
+    sock.on("error", (e) => done(reject, e));
+    sock.on("close", () => {
+      if (buf.indexOf(0x0a) < 0) done(reject, new Error("closed without an answer"));
+    });
+  });
+}
+
+/** The api body of a relayed answer `{ok, status, body}` when ok, else null. */
+function okBody(reply) {
+  return reply &&
+    typeof reply === "object" &&
+    reply.ok === true &&
+    reply.body &&
+    typeof reply.body === "object"
+    ? reply.body
+    : null;
+}
+
+export function decision(permissionDecision, extra) {
+  return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision, ...extra } };
+}
+
+/**
+ * The hook. Resolves to the stdout object to print, or null to print nothing (Claude Code then
+ * draws its dialog as usual). Never throws.
+ */
+export async function runSeatAsk(env, input, deps = {}) {
+  const send = deps.send ?? sendFrame;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const warn = deps.warn ?? ((l) => process.stderr.write(`${l}\n`));
+  const waitMs = deps.waitMs ?? WAIT_MS;
+  const seat = seatFromEnv(env);
+  if (seat.skip) return null;
+  const call = toolCallOf(input);
+  if (!call) return null;
+  const { socketPath, ...ids } = seat;
+  let reply;
+  try {
+    reply = await send(socketPath, {
+      op: "question_ask",
+      ...ids,
+      tool_use_id: call.tool_use_id,
+      questions: call.questions,
+    });
+  } catch (e) {
+    warn(`mnemom: question not recorded: ${e instanceof Error ? e.message : String(e)}`);
+    return null;
+  }
+  if (reply?.status === 409 && reply.body?.error?.code === BUSY_CODE)
+    return decision("deny", { permissionDecisionReason: PENDING_REASON });
+  const asked = okBody(reply);
+  if (!asked || typeof asked.approval_id !== "string") {
+    warn("mnemom: question not recorded (refused); showing the dialog");
+    return null;
+  }
+  const approval_id = asked.approval_id;
+  const deadline = now() + waitMs;
+  while (now() < deadline) {
+    await sleep(POLL_INTERVAL_MS);
+    let st;
+    try {
+      st = okBody(await send(socketPath, { op: "question_poll", ...ids, approval_id }));
+    } catch {
+      continue; // a transient socket or daemon blip: keep the turn held and try again
+    }
+    if (!st) continue;
+    if (st.state === "answered" && st.answers && typeof st.answers === "object")
+      return decision("allow", {
+        permissionDecisionReason: `answered by the owner (question ${approval_id})`,
+        updatedInput: { ...call.tool_input, answers: st.answers },
+      });
+    if (st.state === "dismissed")
+      return decision("deny", { permissionDecisionReason: DISMISSED_REASON });
+    if (st.state === "expired")
+      return decision("deny", { permissionDecisionReason: EXPIRED_REASON });
+    if (st.state === "handed_off") break;
+  }
+  try {
+    await send(socketPath, { op: "question_release", ...ids, approval_id });
+  } catch (e) {
+    // The question stays open at the api and in own_questions; hand off all the same, the model
+    // must not sit on a dialog nobody can see.
+    warn(`mnemom: question release failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return decision("deny", { permissionDecisionReason: HANDOFF_REASON });
+}
+
+async function readStdin() {
+  let s = "";
+  for await (const c of process.stdin) s += c;
+  return s;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  let input;
+  try {
+    input = JSON.parse(await readStdin());
+  } catch {
+    input = null;
+  }
+  const out = await runSeatAsk(process.env, input);
+  if (out) process.stdout.write(`${JSON.stringify(out)}\n`);
+  process.exitCode = 0;
+}