@nirnex/cli 2.0.3 → 4.0.0

package/dist/runtime/envelope.js

@@ -0,0 +1,113 @@
+// Converts an ECO (Execution Context Object) into a TaskEnvelope (TEE).
+// The envelope is the actionable, policy-bearing runtime representation.
+import { generateTaskId } from './session.js';
+import { getConfidenceLabel } from '@nirnex/core/dist/confidence.js';
+const LANE_TOOL_POLICY = {
+    A: {
+        allowed_tools: ['Read', 'Glob', 'Grep', 'Bash', 'Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'WebFetch', 'WebSearch'],
+        requires_guard: [],
+        denied_patterns: [],
+    },
+    B: {
+        allowed_tools: ['Read', 'Glob', 'Grep', 'Bash', 'Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'WebFetch', 'WebSearch'],
+        requires_guard: ['Edit', 'Write', 'MultiEdit'],
+        denied_patterns: ['rm -rf', 'git reset --hard', 'git push --force', 'git push -f'],
+    },
+    C: {
+        allowed_tools: ['Read', 'Glob', 'Grep', 'Bash', 'Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'WebFetch', 'WebSearch'],
+        requires_guard: ['Bash', 'Edit', 'Write', 'MultiEdit'],
+        denied_patterns: [
+            'rm -rf', 'git reset --hard', 'git push --force', 'git push -f',
+            'DROP TABLE', 'ALTER TABLE', 'truncate', '> /dev/null 2>&1 &',
+        ],
+    },
+};
+export function buildEnvelope(eco, prompt, sessionId) {
+    const lane = (eco.recommended_lane ?? eco.forced_lane_minimum ?? 'A');
+    const taskId = generateTaskId();
+    // Derive scope from ECO
+    const modulesTouched = eco.modules_touched ?? [];
+    const blockedPaths = [
+        ...(eco.boundary_warnings ?? []).map((w) => w.split(':')[0]).filter(Boolean),
+    ];
+    // Derive acceptance criteria from evidence checkpoints
+    const checkpoints = eco.evidence_checkpoints ?? {};
+    const acceptanceCriteria = Object.keys(checkpoints).map(k => `checkpoint:${k}`);
+    // Derive constraints from dimension severities
+    const constraints = [];
+    const dims = eco.eco_dimensions ?? {};
+    for (const [dim, val] of Object.entries(dims)) {
+        const v = val;
+        if (v.severity === 'warn' || v.severity === 'escalate') {
+            constraints.push(`dimension:${dim}:${v.severity}${v.detail ? ' — ' + v.detail : ''}`);
+        }
+        else if (v.severity === 'block') {
+            constraints.push(`dimension:${dim}:blocked${v.detail ? ' — ' + v.detail : ''}`);
+        }
+    }
+    for (const r of (eco.escalation_reasons ?? [])) {
+        constraints.push(`escalation:${r}`);
+    }
+    const penalties = eco.penalties ?? [];
+    const confidenceScore = eco.confidence_score ?? 100;
+    const envelope = {
+        task_id: taskId,
+        session_id: sessionId,
+        created_at: new Date().toISOString(),
+        prompt,
+        lane,
+        scope: {
+            allowed_paths: modulesTouched,
+            blocked_paths: blockedPaths,
+            modules_expected: modulesTouched,
+        },
+        constraints,
+        acceptance_criteria: acceptanceCriteria,
+        tool_policy: LANE_TOOL_POLICY[lane],
+        stop_conditions: {
+            required_validations: acceptanceCriteria,
+            forbidden_files: blockedPaths,
+        },
+        confidence: {
+            score: confidenceScore,
+            label: getConfidenceLabel(confidenceScore),
+            penalties,
+        },
+        eco_summary: {
+            intent: eco.intent?.primary ?? 'unknown',
+            recommended_lane: eco.recommended_lane ?? 'A',
+            forced_unknown: eco.forced_unknown ?? false,
+            blocked: eco.blocked ?? false,
+            escalation_reasons: eco.escalation_reasons ?? [],
+            boundary_warnings: eco.boundary_warnings ?? [],
+        },
+        status: 'active',
+    };
+    return envelope;
+}
+export function formatEnvelopeContext(envelope) {
+    const lines = [
+        `[Nirnex] Task ${envelope.task_id} · Lane ${envelope.lane} · Confidence ${envelope.confidence.score}% (${envelope.confidence.label})`,
+        `Intent: ${envelope.eco_summary.intent}`,
+    ];
+    if (envelope.eco_summary.forced_unknown) {
+        lines.push(`⚠ ECO forced unknown — proceed with caution`);
+    }
+    if (envelope.eco_summary.blocked) {
+        lines.push(`✘ Task blocked by ECO — do not proceed with implementation`);
+    }
+    if (envelope.scope.allowed_paths.length > 0) {
+        lines.push(`Scope: ${envelope.scope.allowed_paths.join(', ')}`);
+    }
+    if (envelope.constraints.length > 0) {
+        lines.push(`Constraints: ${envelope.constraints.slice(0, 3).join('; ')}`);
+    }
+    if (envelope.tool_policy.requires_guard.length > 0) {
+        lines.push(`Guarded tools (Lane ${envelope.lane}): ${envelope.tool_policy.requires_guard.join(', ')}`);
+    }
+    if (envelope.eco_summary.escalation_reasons.length > 0) {
+        lines.push(`Escalation: ${envelope.eco_summary.escalation_reasons.join('; ')}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=envelope.js.map

package/dist/runtime/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/runtime/envelope.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,yEAAyE;AAGzE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,gBAAgB,GAA8C;IAClE,CAAC,EAAE;QACD,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;QACtH,cAAc,EAAE,EAAE;QAClB,eAAe,EAAE,EAAE;KACpB;IACD,CAAC,EAAE;QACD,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;QACtH,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;QAC9C,eAAe,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa,CAAC;KACnF;IACD,CAAC,EAAE;QACD,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;QACtH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;QACtD,eAAe,EAAE;YACf,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,aAAa;YAC/D,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB;SAC9D;KACF;CACF,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAAwB,EAAE,MAAc,EAAE,SAAiB;IACvF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAS,CAAC;IAC9E,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAEhC,wBAAwB;IACxB,MAAM,cAAc,GAAa,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3D,MAAM,YAAY,GAAa;QAC7B,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KACrF,CAAC;IAEF,uDAAuD;IACvD,MAAM,WAAW,GAAG,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,MAAM,kBAAkB,GAAa,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAE1F,+CAA+C;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,GAA2C,CAAC;QACtD,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACvD,WAAW,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,MAAM,eAAe,GAAW,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAE5D,MAAM,QAAQ,GAAiB;QAC7B,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,MAAM;QACN,IAAI;QACJ,KAAK,EAAE;YACL,aAAa,EAAE,cAAc;YAC7B,aAAa,EAAE,YAAY;YAC3B,gBAAgB,EAAE,cAAc;SACjC;QACD,WAAW;QACX,mBAAmB,EAAE,kBAAkB;QACvC,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,eAAe,EAAE;YACf,oBAAoB,EAAE,kBAAkB;YACxC,eAAe,EAAE,YAAY;SAC9B;QACD,UAAU,EAAE;YACV,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC;YAC1C,SAAS;SACV;QACD,WAAW,EAAE;YACX,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,GAAG;YAC7C,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;YAC3C,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK;YAC7B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAChD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,EAAE;SAC/C;QACD,MAAM,EAAE,QAAQ;KACjB,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,KAAK,GAAa;QACtB,iBAAiB,QAAQ,CAAC,OAAO,WAAW,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,UAAU,CAAC,KAAK,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG;QACrI,WAAW,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE;KACzC,CAAC;IAEF,IAAI,QAAQ,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/runtime/guard.d.ts

@@ -0,0 +1,2 @@
+export declare function runGuard(): Promise<void>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/runtime/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/runtime/guard.ts"],"names":[],"mappings":"AA2FA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAsC9C"}

package/dist/runtime/guard.js

@@ -0,0 +1,114 @@
+// PreToolUse hook handler.
+// Called before Claude executes each tool call.
+// Loads the active task envelope and evaluates the tool against lane policy.
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadActiveEnvelope } from './session.js';
+function readStdin() {
+    return new Promise(resolve => {
+        let buf = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', chunk => { buf += chunk; });
+        process.stdin.on('end', () => resolve(buf));
+    });
+}
+function extractAffectedFile(toolName, toolInput) {
+    if (toolName === 'Edit' || toolName === 'Write' || toolName === 'Read') {
+        return (toolInput.file_path ?? toolInput.path ?? null);
+    }
+    if (toolName === 'MultiEdit') {
+        const edits = toolInput.edits;
+        return edits?.[0]?.file_path ?? null;
+    }
+    return null;
+}
+function matchesDeniedPattern(command, patterns) {
+    for (const pattern of patterns) {
+        if (command.includes(pattern))
+            return pattern;
+    }
+    return null;
+}
+function evaluateGuard(envelope, toolName, toolInput) {
+    const policy = envelope.tool_policy;
+    // If tool doesn't require guarding for this lane, allow immediately
+    if (!policy.requires_guard.includes(toolName)) {
+        return { decision: 'allow' };
+    }
+    // Bash: check denylist
+    if (toolName === 'Bash') {
+        const command = (toolInput.command ?? '');
+        const matched = matchesDeniedPattern(command, policy.denied_patterns);
+        if (matched) {
+            return {
+                decision: 'deny',
+                reason: `[Nirnex Guard] Command contains denied pattern "${matched}" (Lane ${envelope.lane} policy).`,
+            };
+        }
+        // For Lane C, ask for commands that touch git or system state
+        if (envelope.lane === 'C' && /\b(git|rm|mv|chmod|chown)\b/.test(command)) {
+            return {
+                decision: 'ask',
+                message: `[Nirnex Guard] Lane C task — confirm this command is within scope:\n  ${command}`,
+            };
+        }
+        return { decision: 'allow' };
+    }
+    // Edit / Write / MultiEdit: check scope
+    const filePath = extractAffectedFile(toolName, toolInput);
+    if (filePath && envelope.scope.blocked_paths.length > 0) {
+        for (const blocked of envelope.scope.blocked_paths) {
+            if (filePath.includes(blocked)) {
+                return {
+                    decision: 'deny',
+                    reason: `[Nirnex Guard] File "${filePath}" is in a blocked path "${blocked}" for this task.`,
+                };
+            }
+        }
+    }
+    // Lane C: require file to be within expected scope
+    if (envelope.lane === 'C' && filePath && envelope.scope.allowed_paths.length > 0) {
+        const inScope = envelope.scope.allowed_paths.some(p => filePath.includes(p));
+        if (!inScope) {
+            return {
+                decision: 'ask',
+                message: `[Nirnex Guard] Lane C — "${filePath}" is outside the expected scope [${envelope.scope.allowed_paths.join(', ')}]. Proceed?`,
+            };
+        }
+    }
+    return { decision: 'allow' };
+}
+export async function runGuard() {
+    const raw = await readStdin();
+    let hookData = {
+        session_id: 'unknown',
+        hook_event_name: 'PreToolUse',
+        tool_name: '',
+        tool_input: {},
+    };
+    try {
+        hookData = JSON.parse(raw || '{}');
+    }
+    catch {
+        // Non-fatal: allow on parse failure
+        process.stdout.write(JSON.stringify({ decision: 'allow' }));
+        process.exit(0);
+    }
+    const repoRoot = process.env.NIRNEX_REPO_ROOT ?? process.cwd();
+    const sessionId = hookData.session_id ?? process.env.NIRNEX_SESSION_ID ?? '';
+    // Allow if not in a Nirnex project
+    if (!fs.existsSync(path.join(repoRoot, 'nirnex.config.json'))) {
+        process.stdout.write(JSON.stringify({ decision: 'allow' }));
+        process.exit(0);
+    }
+    const envelope = loadActiveEnvelope(repoRoot, sessionId);
+    // No active envelope → allow (not in a guarded task context)
+    if (!envelope) {
+        process.stdout.write(JSON.stringify({ decision: 'allow' }));
+        process.exit(0);
+    }
+    const decision = evaluateGuard(envelope, hookData.tool_name, hookData.tool_input);
+    process.stdout.write(JSON.stringify(decision));
+    process.exit(0);
+}
+//# sourceMappingURL=guard.js.map

package/dist/runtime/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/runtime/guard.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,gDAAgD;AAChD,6EAA6E;AAE7E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,SAAkC;IAC/E,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACvE,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,IAAI,CAAkB,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAkD,CAAC;QAC3E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAkB;IAC/D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,QAAsB,EAAE,QAAgB,EAAE,SAAkC;IACjG,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC;IAEpC,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,uBAAuB;IACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAW,CAAC;QACpD,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,mDAAmD,OAAO,WAAW,QAAQ,CAAC,IAAI,WAAW;aACtG,CAAC;QACJ,CAAC;QACD,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,yEAAyE,OAAO,EAAE;aAC5F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,wCAAwC;IACxC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACnD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACL,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,wBAAwB,QAAQ,2BAA2B,OAAO,kBAAkB;iBAC7F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B,QAAQ,oCAAoC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;aACtI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAE9B,IAAI,QAAQ,GAAmB;QAC7B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,YAAY;QAC7B,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAmB,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAE7E,mCAAmC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEzD,6DAA6D;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/runtime/session.d.ts

@@ -0,0 +1,13 @@
+import { NirnexSession, TaskEnvelope, TraceEvent } from './types.js';
+export declare const RUNTIME_DIR = ".ai-index/runtime";
+export declare function createSession(repoRoot: string, sessionId: string, partial?: Partial<NirnexSession>): NirnexSession;
+export declare function loadSession(repoRoot: string, sessionId: string): NirnexSession | null;
+export declare function saveSession(repoRoot: string, session: NirnexSession): void;
+export declare function saveEnvelope(repoRoot: string, envelope: TaskEnvelope): void;
+export declare function loadEnvelope(repoRoot: string, taskId: string): TaskEnvelope | null;
+export declare function loadActiveEnvelope(repoRoot: string, sessionId: string): TaskEnvelope | null;
+export declare function appendTraceEvent(repoRoot: string, sessionId: string, event: TraceEvent): void;
+export declare function loadTraceEvents(repoRoot: string, sessionId: string): TraceEvent[];
+export declare function generateTaskId(): string;
+export declare function generateEventId(): string;
+//# sourceMappingURL=session.d.ts.map

package/dist/runtime/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/runtime/session.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErE,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAwB/C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,aAAa,CAetH;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAQrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,IAAI,CAO1E;AAID,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,CAO3E;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQlF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAI3F;AAID,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAK7F;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE,CAWjF;AAED,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}

package/dist/runtime/session.js

@@ -0,0 +1,111 @@
+// Session and envelope state management.
+// All state is stored under .ai-index/runtime/ as JSON files.
+import fs from 'node:fs';
+import path from 'node:path';
+export const RUNTIME_DIR = '.ai-index/runtime';
+function runtimeDir(repoRoot) {
+    return path.join(repoRoot, RUNTIME_DIR);
+}
+function sessionsDir(repoRoot) {
+    return path.join(runtimeDir(repoRoot), 'sessions');
+}
+function envelopesDir(repoRoot) {
+    return path.join(runtimeDir(repoRoot), 'envelopes');
+}
+function eventsDir(repoRoot, sessionId) {
+    return path.join(runtimeDir(repoRoot), 'events', sessionId);
+}
+function ensureDir(p) {
+    if (!fs.existsSync(p))
+        fs.mkdirSync(p, { recursive: true });
+}
+// ─── Session ──────────────────────────────────────────────────────────────
+export function createSession(repoRoot, sessionId, partial = {}) {
+    ensureDir(sessionsDir(repoRoot));
+    const session = {
+        session_id: sessionId,
+        repo_root: repoRoot,
+        db_path: path.join(repoRoot, '.aidos.db'),
+        index_freshness: 'unknown',
+        current_head: '',
+        policy_mode: 'standard',
+        created_at: new Date().toISOString(),
+        tasks: [],
+        ...partial,
+    };
+    saveSession(repoRoot, session);
+    return session;
+}
+export function loadSession(repoRoot, sessionId) {
+    const p = path.join(sessionsDir(repoRoot), `${sessionId}.json`);
+    if (!fs.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveSession(repoRoot, session) {
+    ensureDir(sessionsDir(repoRoot));
+    fs.writeFileSync(path.join(sessionsDir(repoRoot), `${session.session_id}.json`), JSON.stringify(session, null, 2), 'utf8');
+}
+// ─── Envelope ─────────────────────────────────────────────────────────────
+export function saveEnvelope(repoRoot, envelope) {
+    ensureDir(envelopesDir(repoRoot));
+    fs.writeFileSync(path.join(envelopesDir(repoRoot), `${envelope.task_id}.json`), JSON.stringify(envelope, null, 2), 'utf8');
+}
+export function loadEnvelope(repoRoot, taskId) {
+    const p = path.join(envelopesDir(repoRoot), `${taskId}.json`);
+    if (!fs.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function loadActiveEnvelope(repoRoot, sessionId) {
+    const session = loadSession(repoRoot, sessionId);
+    if (!session?.active_task_id)
+        return null;
+    return loadEnvelope(repoRoot, session.active_task_id);
+}
+// ─── Trace events ─────────────────────────────────────────────────────────
+export function appendTraceEvent(repoRoot, sessionId, event) {
+    const dir = eventsDir(repoRoot, sessionId);
+    ensureDir(dir);
+    const eventsPath = path.join(dir, 'events.jsonl');
+    fs.appendFileSync(eventsPath, JSON.stringify(event) + '\n', 'utf8');
+}
+export function loadTraceEvents(repoRoot, sessionId) {
+    const eventsPath = path.join(eventsDir(repoRoot, sessionId), 'events.jsonl');
+    if (!fs.existsSync(eventsPath))
+        return [];
+    return fs
+        .readFileSync(eventsPath, 'utf8')
+        .split('\n')
+        .filter(Boolean)
+        .map(line => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((e) => e !== null);
+}
+export function generateTaskId() {
+    const ts = Date.now().toString(36);
+    const rand = Math.random().toString(36).slice(2, 6);
+    return `task_${ts}_${rand}`;
+}
+export function generateEventId() {
+    const ts = Date.now().toString(36);
+    const rand = Math.random().toString(36).slice(2, 6);
+    return `evt_${ts}_${rand}`;
+}
+//# sourceMappingURL=session.js.map

package/dist/runtime/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/runtime/session.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,8DAA8D;AAE9D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAE/C,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,SAAiB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAE7E,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,SAAiB,EAAE,UAAkC,EAAE;IACrG,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAAkB;QAC7B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QACzC,eAAe,EAAE,SAAS;QAC1B,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,KAAK,EAAE,EAAE;QACT,GAAG,OAAO;KACX,CAAC;IACF,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,SAAiB;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAsB;IAClE,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,OAAO,CAAC,EAC9D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAChC,MAAM,CACP,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,QAAsB;IACnE,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,OAAO,CAAC,EAC7D,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACjC,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc;IAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IACpE,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,6EAA6E;AAE7E,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAAiB,EAAE,KAAiB;IACrF,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,CAAC,CAAC;IACf,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAiB;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,EAAE;SACN,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;SAChC,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IACvE,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;AAC7B,CAAC"}

package/dist/runtime/trace-hook.d.ts

@@ -0,0 +1,2 @@
+export declare function runTraceHook(): Promise<void>;
+//# sourceMappingURL=trace-hook.d.ts.map

package/dist/runtime/trace-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-hook.d.ts","sourceRoot":"","sources":["../../src/runtime/trace-hook.ts"],"names":[],"mappings":"AA6DA,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAiElD"}

package/dist/runtime/trace-hook.js

@@ -0,0 +1,102 @@
+// PostToolUse hook handler.
+// Called after each tool execution. Appends a trace event, detects deviation,
+// and optionally injects context back to Claude if drift is found.
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadActiveEnvelope, appendTraceEvent, generateEventId } from './session.js';
+function readStdin() {
+    return new Promise(resolve => {
+        let buf = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', chunk => { buf += chunk; });
+        process.stdin.on('end', () => resolve(buf));
+    });
+}
+function extractAffectedFiles(toolName, toolInput) {
+    const files = [];
+    if (toolName === 'Edit' || toolName === 'Write' || toolName === 'Read') {
+        const f = toolInput.file_path ?? toolInput.path;
+        if (typeof f === 'string')
+            files.push(f);
+    }
+    else if (toolName === 'MultiEdit') {
+        const edits = toolInput.edits;
+        for (const e of edits ?? []) {
+            if (e.file_path)
+                files.push(e.file_path);
+        }
+    }
+    else if (toolName === 'Bash') {
+        // Cannot reliably extract files from arbitrary commands
+    }
+    return files;
+}
+function detectDeviations(affectedFiles, toolName, toolInput, allowedPaths, blockedPaths, lane) {
+    const flags = [];
+    for (const f of affectedFiles) {
+        for (const blocked of blockedPaths) {
+            if (f.includes(blocked)) {
+                flags.push(`file_in_blocked_path:${f}`);
+            }
+        }
+        if (lane === 'C' && allowedPaths.length > 0) {
+            const inScope = allowedPaths.some(p => f.includes(p));
+            if (!inScope) {
+                flags.push(`file_out_of_scope:${f}`);
+            }
+        }
+    }
+    return flags;
+}
+export async function runTraceHook() {
+    const raw = await readStdin();
+    let hookData = {
+        session_id: 'unknown',
+        hook_event_name: 'PostToolUse',
+        tool_name: '',
+        tool_input: {},
+        tool_result: {},
+    };
+    try {
+        hookData = JSON.parse(raw || '{}');
+    }
+    catch {
+        process.exit(0);
+    }
+    const repoRoot = process.env.NIRNEX_REPO_ROOT ?? process.cwd();
+    const sessionId = hookData.session_id ?? process.env.NIRNEX_SESSION_ID ?? '';
+    if (!fs.existsSync(path.join(repoRoot, 'nirnex.config.json'))) {
+        process.exit(0);
+    }
+    const envelope = loadActiveEnvelope(repoRoot, sessionId);
+    const affectedFiles = extractAffectedFiles(hookData.tool_name, hookData.tool_input);
+    const deviationFlags = envelope
+        ? detectDeviations(affectedFiles, hookData.tool_name, hookData.tool_input, envelope.scope.allowed_paths, envelope.scope.blocked_paths, envelope.lane)
+        : [];
+    const event = {
+        event_id: generateEventId(),
+        session_id: sessionId,
+        task_id: envelope?.task_id ?? 'none',
+        timestamp: new Date().toISOString(),
+        tool: hookData.tool_name,
+        tool_input: hookData.tool_input,
+        tool_result: hookData.tool_result,
+        affected_files: affectedFiles,
+        deviation_flags: deviationFlags,
+    };
+    try {
+        appendTraceEvent(repoRoot, sessionId, event);
+    }
+    catch {
+        // Non-fatal
+    }
+    // If deviation detected, inject context back to Claude
+    if (deviationFlags.length > 0) {
+        const output = {
+            additionalContext: `[Nirnex Trace] Deviation detected in ${hookData.tool_name}: ${deviationFlags.join(', ')}. Verify this is intentional.`,
+        };
+        process.stdout.write(JSON.stringify(output));
+    }
+    process.exit(0);
+}
+//# sourceMappingURL=trace-hook.js.map

package/dist/runtime/trace-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-hook.js","sourceRoot":"","sources":["../../src/runtime/trace-hook.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,8EAA8E;AAC9E,mEAAmE;AAEnE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGrF,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,SAAkC;IAChF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAkD,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,wDAAwD;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,aAAuB,EACvB,QAAgB,EAChB,SAAkC,EAClC,YAAsB,EACtB,YAAsB,EACtB,IAAY;IAEZ,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAE9B,IAAI,QAAQ,GAAoB;QAC9B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,aAAa;QAC9B,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAoB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAE7E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEzD,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC,gBAAgB,CACd,aAAa,EACb,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,KAAK,CAAC,aAAa,EAC5B,QAAQ,CAAC,KAAK,CAAC,aAAa,EAC5B,QAAQ,CAAC,IAAI,CACd;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,KAAK,GAAe;QACxB,QAAQ,EAAE,eAAe,EAAE;QAC3B,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,MAAM;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,cAAc;KAChC,CAAC;IAEF,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAkB;YAC5B,iBAAiB,EAAE,wCAAwC,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;SAC3I,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/runtime/types.d.ts

@@ -0,0 +1,108 @@
+export type Lane = 'A' | 'B' | 'C';
+export interface NirnexSession {
+    session_id: string;
+    repo_root: string;
+    db_path: string;
+    index_freshness: 'fresh' | 'stale' | 'unknown';
+    current_head: string;
+    policy_mode: 'strict' | 'standard' | 'permissive';
+    created_at: string;
+    tasks: string[];
+    active_task_id?: string;
+}
+export interface TaskEnvelope {
+    task_id: string;
+    session_id: string;
+    created_at: string;
+    prompt: string;
+    lane: Lane;
+    scope: {
+        allowed_paths: string[];
+        blocked_paths: string[];
+        modules_expected: string[];
+    };
+    constraints: string[];
+    acceptance_criteria: string[];
+    tool_policy: {
+        allowed_tools: string[];
+        requires_guard: string[];
+        denied_patterns: string[];
+    };
+    stop_conditions: {
+        required_validations: string[];
+        forbidden_files: string[];
+    };
+    confidence: {
+        score: number;
+        label: string;
+        penalties: Array<{
+            rule: string;
+            deduction: number;
+            detail: string;
+        }>;
+    };
+    eco_summary: {
+        intent: string;
+        recommended_lane: string;
+        forced_unknown: boolean;
+        blocked: boolean;
+        escalation_reasons: string[];
+        boundary_warnings: string[];
+    };
+    status: 'pending' | 'active' | 'completed' | 'failed';
+}
+export interface TraceEvent {
+    event_id: string;
+    session_id: string;
+    task_id: string;
+    timestamp: string;
+    tool: string;
+    tool_input: Record<string, unknown>;
+    tool_result?: Record<string, unknown>;
+    affected_files: string[];
+    deviation_flags: string[];
+}
+export interface HookSessionStart {
+    session_id: string;
+    transcript_path?: string;
+}
+export interface HookPromptSubmit {
+    session_id: string;
+    transcript_path?: string;
+    hook_event_name: 'UserPromptSubmit';
+    prompt: string;
+}
+export interface HookPreToolUse {
+    session_id: string;
+    transcript_path?: string;
+    hook_event_name: 'PreToolUse';
+    tool_name: string;
+    tool_input: Record<string, unknown>;
+}
+export interface HookPostToolUse {
+    session_id: string;
+    transcript_path?: string;
+    hook_event_name: 'PostToolUse';
+    tool_name: string;
+    tool_input: Record<string, unknown>;
+    tool_result: Record<string, unknown>;
+}
+export interface HookStop {
+    session_id: string;
+    transcript_path?: string;
+    stop_hook_active?: boolean;
+}
+export interface GuardDecision {
+    decision: 'allow' | 'deny' | 'ask';
+    reason?: string;
+    message?: string;
+}
+export interface ValidateDecision {
+    decision: 'allow' | 'block';
+    reason?: string;
+}
+export interface ContextOutput {
+    additionalContext?: string;
+    blockMessage?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/runtime/types.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEnC,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE;QACL,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE;QACX,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF,eAAe,EAAE;QACf,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACvE,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,OAAO,CAAC;QACxB,OAAO,EAAE,OAAO,CAAC;QACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IACF,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;CACvD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAID,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,kBAAkB,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,YAAY,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,aAAa,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/runtime/types.js

@@ -0,0 +1,3 @@
+// Shared types for the Nirnex runtime hook pipeline.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/runtime/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/runtime/types.ts"],"names":[],"mappings":"AAAA,qDAAqD"}

package/dist/runtime/validate.d.ts

@@ -0,0 +1,2 @@
+export declare function runValidate(): Promise<void>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/runtime/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/runtime/validate.ts"],"names":[],"mappings":"AAmBA,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAuFjD"}