@orchestrator-claude/definitions 3.33.0 → 3.35.0

package/dist/install/DevCheckoutDetector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DevCheckoutDetector.d.ts","sourceRoot":"","sources":["../../src/install/DevCheckoutDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA4BlD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,MAAM,EAAE;IAEpD;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAkBpC;;;;OAIG;IACH,OAAO,CAAC,mCAAmC;IAiB3C,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IA4BlC,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"DevCheckoutDetector.d.ts","sourceRoot":"","sources":["../../src/install/DevCheckoutDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA4BlD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,MAAM,EAAE;IAEpD;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IAkBpC;;;;OAIG;IACH,OAAO,CAAC,mCAAmC;IAiB3C,OAAO,CAAC,eAAe;IASvB;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IA4BlC,OAAO,CAAC,YAAY;CAOrB"}

package/dist/install/DevCheckoutDetector.js

@@ -1,10 +1,11 @@
 /**
  * DevCheckoutDetector — read-only dual-condition heuristic (RF-002 / spec
- * §5.1, ADR-004) for the "inverted precedence" risk between `.claude/agents`
- * (project-scope) and `.claude/skills` (user-scope, per Claude Code's
- * documentation): once the installer lands, `~/.claude/agents` resolves from
- * the distributed package while `<repo>/.claude/agents` remains the authored
- * source — they can diverge silently.
+ * §5.1, ADR-004) for the "inverted precedence" risk between the ADR-023
+ * canonical `packages/definitions/agents` (project-scope, authored source)
+ * and `~/.claude/skills` (user-scope, per Claude Code's documentation): once
+ * the installer lands, `~/.claude/agents` resolves from the distributed
+ * package while the monorepo's own authored source remains separate — they
+ * can diverge silently.
  *
  * Detection requires BOTH conditions (reduces false-positives, risk R-6):
  *   (i)  walk-up from `cwd` to the nearest ancestor `package.json` whose
@@ -12,13 +13,27 @@
  *        (`@orchestrator-cli/core` — confirmed via direct Read of
  *        `/home/cmac/workOrch-Claude/orchestrator/package.json`, plan
  *        §11 Verify-Before-Assert);
- *   (ii) that same ancestor's `.claude/agents/*.md` contains REAL files
- *        (never symlinks — `lstatSync(...).isSymbolicLink()`, distinguishing
- *        authored files from the C6/TD-204 INTERIM per-file symlinks) whose
- *        slug (basename without `.md`) collides with `manifestSlugs`.
+ *   (ii) that same ancestor's `packages/definitions/agents/*.md` contains
+ *        REAL files (never symlinks — `lstatSync(...).isSymbolicLink()`,
+ *        distinguishing authored files from the C6/TD-204 INTERIM per-file
+ *        symlinks) whose slug (basename without `.md`) collides with
+ *        `manifestSlugs`.
+ *
+ * REPOINTED (ADR-023 §7, S401): condition (ii) used to read
+ * `<root>/.claude/agents/` — the `.claude/` mirror. That mirror is being
+ * retired (RFC-040 §18.15 — `<repo>/.claude/{agents,skills}` gets deleted as
+ * part of the harness graduation to an installed-plugin route), which would
+ * silently blind this detector (measured, S401: with `.claude/agents`
+ * absent, `detect()` always returned `clean-install`, and the
+ * `cli-install.test.ts` TASK-034 regression guard caught it via a real,
+ * non-mocked `install` invocation timing out instead of aborting). Condition
+ * (ii) now reads `<root>/packages/definitions/agents/` — the ADR-023
+ * canonical SoT, which is NOT deleted by the travessia and is exactly the
+ * tree this monorepo's own contributors actually author. Condition (i) is
+ * unchanged.
  *
  * Never mutates anything — `detect()` only reads `package.json` and lists
- * `.claude/agents/`. This module is purely read-only by design.
+ * `packages/definitions/agents/`. This module is purely read-only by design.
  *
  * ---
  * MEASURED WARNING TEXT (TASK-036/AC-007 gate — CLOSED, S385):
@@ -49,8 +64,8 @@ const MONOREPO_PACKAGE_NAME = '@orchestrator-cli/core';
  * real practical risk it implies (silent drift), not a hypothetical.
  */
 const DEV_CHECKOUT_WARNING_REASON = 'Dev-checkout detectado: este cwd pertence ao monorepo orchestrator e ' +
-    '`.claude/agents/` contém arquivos reais cujos slugs colidem com o ' +
-    'manifest do pacote. Precedência MEDIDA empiricamente (AC-007/TASK-036, ' +
+    '`packages/definitions/agents/` contém arquivos reais cujos slugs colidem ' +
+    'com o manifest do pacote. Precedência MEDIDA empiricamente (AC-007/TASK-036, ' +
     'gate S385, 3/3 runs determinísticos por eixo, probe isolado): agents ' +
     'resolvem por PROJECT-scope (edições locais neste repo têm efeito ' +
     'imediato numa sessão live) e skills resolvem por USER-scope ' +
@@ -66,7 +81,7 @@ export class DevCheckoutDetector {
         this.manifestSlugs = manifestSlugs;
     }
     /**
-     * Read-only detection. Never throws on a missing `.claude/agents`
+     * Read-only detection. Never throws on a missing `packages/definitions/agents`
      * directory or a missing/unparseable ancestor `package.json` — those
      * cases simply resolve to `'clean-install'`.
      */
@@ -114,11 +129,13 @@ export class DevCheckoutDetector {
         }
     }
     /**
-     * Real (non-symlink) `.claude/agents/*.md` files at `root` whose slug
-     * (basename without `.md`) collides with `manifestSlugs`.
+     * Real (non-symlink) `packages/definitions/agents/*.md` files at `root`
+     * whose slug (basename without `.md`) collides with `manifestSlugs`.
+     * Repointed from `.claude/agents/` to the ADR-023 canonical SoT (§7,
+     * S401) — see the module JSDoc "REPOINTED" note above.
      */
     findMatchingRealAgentSlugs(root) {
-        const agentsDir = join(root, '.claude', 'agents');
+        const agentsDir = join(root, 'packages', 'definitions', 'agents');
         if (!existsSync(agentsDir)) {
             return [];
         }

package/dist/install/DevCheckoutDetector.js.map

@@ -1 +1 @@
-{"version":3,"file":"DevCheckoutDetector.js","sourceRoot":"","sources":["../../src/install/DevCheckoutDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGnD,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,2BAA2B,GAC/B,uEAAuE;IACvE,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,8DAA8D;IAC9D,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,+BAA+B,CAAC;AAMlC,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,aAAuB;QAAvB,kBAAa,GAAb,aAAa,CAAU;IAAG,CAAC;IAExD;;;;OAIG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,YAAY;YACZ,MAAM,EAAE,2BAA2B;SACpC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,mCAAmC,CAAC,GAAW;QACrD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACtD,IAAI,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;gBACzE,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,eAAuB;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAqB,CAAC;YACtF,OAAO,MAAM,CAAC,IAAI,KAAK,qBAAqB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,0BAA0B,CAAC,IAAY;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBACzC,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY;QAClB,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,iIAAiI;SAC1I,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"DevCheckoutDetector.js","sourceRoot":"","sources":["../../src/install/DevCheckoutDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGnD,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,2BAA2B,GAC/B,uEAAuE;IACvE,2EAA2E;IAC3E,+EAA+E;IAC/E,uEAAuE;IACvE,mEAAmE;IACnE,8DAA8D;IAC9D,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,+BAA+B,CAAC;AAMlC,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,aAAuB;QAAvB,kBAAa,GAAb,aAAa,CAAU;IAAG,CAAC;IAExD;;;;OAIG;IACH,MAAM,CAAC,GAAW;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;QAED,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,YAAY;YACZ,MAAM,EAAE,2BAA2B;SACpC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,mCAAmC,CAAC,GAAW;QACrD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACtD,IAAI,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;gBACzE,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,eAAuB;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAqB,CAAC;YACtF,OAAO,MAAM,CAAC,IAAI,KAAK,qBAAqB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,0BAA0B,CAAC,IAAY;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBACzC,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY;QAClB,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE,iIAAiI;SAC1I,CAAC;IACJ,CAAC;CACF"}

package/hooks/agent-git-guard.mjs

@@ -0,0 +1,118 @@
+import { createRequire as __createRequireShim } from 'node:module'; const require = __createRequireShim(import.meta.url);
+
+// hooks/lib/api-client.ts
+import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname(__filename);
+var PROJECT_ROOT = join(__dirname, "..", "..", "..");
+var STATE_DIR = join(PROJECT_ROOT, ".orchestrator", ".state");
+var JWT_CACHE = join(STATE_DIR, "jwt-token");
+var DEBUG_LOG = join(STATE_DIR, "hook-debug.log");
+mkdirSync(STATE_DIR, { recursive: true });
+var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
+var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
+var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
+function log(prefix, msg) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
+  try {
+    const line = `[${ts}] ${prefix}: ${msg}
+`;
+    writeFileSync(DEBUG_LOG, line, { flag: "a" });
+  } catch {
+  }
+}
+var LAST_COMPLETED_FILE = join(STATE_DIR, "last-completed-workflow.json");
+var LAST_COMPLETED_TTL_MS = 60 * 60 * 1e3;
+var INVOCATIONS_DIR = join(STATE_DIR, "invocations");
+var INVOCATION_STATE_TTL_MS = 4 * 60 * 60 * 1e3;
+var DISPATCH_INTENT_DIR = join(STATE_DIR, "dispatch-intent");
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  const raw = Buffer.concat(chunks).toString("utf-8").trim();
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+function getField(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current == null || typeof current !== "object") return "";
+    current = current[part];
+  }
+  return current != null ? String(current) : "";
+}
+function outputPreToolUse(opts) {
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: opts.decision,
+      ...opts.reason && { permissionDecisionReason: opts.reason },
+      ...opts.context && { additionalContext: opts.context }
+    }
+  };
+  console.log(JSON.stringify(output));
+}
+
+// hooks/agent-git-guard.ts
+var HOOK = "AGENT-GIT-GUARD";
+var defaultDeps = {
+  readStdin,
+  output: outputPreToolUse,
+  log,
+  getEnv: (key) => process.env[key]
+};
+var PUSH = /\bgit\s+push(\s|$)/;
+var MERGE = /\bgit\s+merge(\s|$)/;
+var GH_PR_MERGE = /\bgh\s+pr\s+merge(\s|$)/;
+function commandIsPushOrMerge(command) {
+  return PUSH.test(command) || MERGE.test(command) || GH_PR_MERGE.test(command);
+}
+function evaluateGitGuard(command, agentId, agentType) {
+  if (!agentId) return { decision: "allow" };
+  if (!commandIsPushOrMerge(command)) return { decision: "allow" };
+  const who = agentType && agentType.length > 0 ? `Sub-agent '${agentType}'` : "Sub-agent";
+  return {
+    decision: "deny",
+    reason: `[AGENT-GIT-GUARD] ${who} is not permitted to run git push / git merge / gh pr merge. Per RFC-022 + TD-169, push and merge are owned EXCLUSIVELY by the main orchestrator (the main conversation). Make your changes locally and return them in your report \u2014 the orchestrator reviews, then pushes/merges. (Prevents the S288 unauthorized merge-to-main breach.)`
+  };
+}
+async function mainWithDeps(deps) {
+  const { readStdin: readStdin2, output, log: log2, getEnv } = deps;
+  const stdin = await readStdin2();
+  const command = getField(stdin, "tool_input.command") || getField(stdin, "command") || "";
+  const agentId = getField(stdin, "agent_id");
+  const agentType = getField(stdin, "agent_type");
+  if (getEnv("SKIP_AGENT_GIT_GUARD") === "true") {
+    log2(HOOK, `BYPASS (SKIP_AGENT_GIT_GUARD): ${command.slice(0, 60)}`);
+    return;
+  }
+  const result = evaluateGitGuard(command, agentId, agentType);
+  if (result.decision === "deny") {
+    log2(HOOK, `DENY (agent=${agentType || "unknown"}): ${command.slice(0, 80)}`);
+    output({ decision: "deny", reason: result.reason });
+    return;
+  }
+  log2(
+    HOOK,
+    `ALLOW (agent=${agentId ? agentType || "sub-agent" : "main"}): ${command.slice(0, 60)}`
+  );
+}
+async function main() {
+  await mainWithDeps(defaultDeps);
+}
+main().catch(() => process.exit(0));
+export {
+  commandIsPushOrMerge,
+  evaluateGitGuard,
+  mainWithDeps
+};

package/hooks/agent-git-guard.ts

@@ -0,0 +1,166 @@
+/**
+ * agent-git-guard.ts — PreToolUse[Bash] hook (TD-169 enforcement)
+ *
+ * BLOCKS `git push`, `git merge`, and `gh pr merge` when the command is run by a
+ * SUB-AGENT, while ALLOWING the main orchestrator (main conversation) to run them.
+ *
+ * Mechanism: Claude Code injects `agent_id` into PreToolUse stdin ONLY when the
+ * hook fires inside a sub-agent call (see hook-reference: "Present only when the
+ * hook fires inside a subagent call"). workflow-guard.ts uses the same signal for
+ * Write/Edit (the sub-agent branch of decideWorkflowGuardAction). This hook extends
+ * it to the git escape-to-remote path.
+ *
+ * Why this exists: S288 governance breach — an `implementer` sub-agent autonomously
+ * committed + pushed + `gh pr merge`'d an unauthorized FK-drop to main. Prose
+ * commit-policy in dispatch prompts is unenforced (agents hold Bash + gh). This hook
+ * is the enforcement layer (cf. workflow-guard model; S288-handoff §TD-169).
+ *
+ * Scope: push / merge ONLY — NOT commit. A local commit by a sub-agent is recoverable
+ * and is sometimes legitimate (orchestrator Commit Policy option b). Push/merge to a
+ * remote is the unrecoverable breach vector, so that is what we deny.
+ *
+ * RFC-040 TD-204 §⑤-A (S366) — Classe-A asset-safety classification:
+ * this gate is classified Classe-A (same family as workflow-guard.ts's
+ * `.orchestrator`-registration and workflow-active checks — asset-safety
+ * gates that must remain intact everywhere, never silently no-op). UNLIKE
+ * workflow-guard.ts, this gate's decision (evaluateGitGuard) is a pure
+ * function of (command, agentId, agentType) ONLY — it never inspects any
+ * file_path or cwd. A sub-agent attempting `git push`/`git merge`/`gh pr
+ * merge` is denied identically no matter which project's working tree the
+ * Bash command runs against. This makes it **globally cwd-safe already**:
+ * no TD-204 ⑤-A remediation (project-root resolution / `.unmanaged`
+ * sentinel / unregistered-path branching) is needed here — there is no
+ * path-dependent branch to make cwd-scoped-safe in the first place. See
+ * tests/unit/hooks/agent-git-guard-path-invariance.test.ts for the
+ * property-style proof.
+ *
+ * Decision:
+ *   - agent_id absent (main orchestrator)        → silent pass-through (allow)
+ *   - agent_id present + push/merge/gh-pr-merge  → DENY
+ *   - agent_id present + commit/read-only/other  → silent pass-through (allow)
+ *   - SKIP_AGENT_GIT_GUARD=true                  → allow (escape hatch, logged)
+ *   - parse error / empty stdin                  → fail-open (allow)
+ */
+
+import { log, readStdin, getField, outputPreToolUse } from './lib/api-client.js';
+
+const HOOK = 'AGENT-GIT-GUARD';
+
+// ─────────────────────────────────────────────────────────────
+// Dependency injection interface (enables testing without IO)
+// ─────────────────────────────────────────────────────────────
+
+export interface HookDeps {
+  readStdin: () => Promise<Record<string, unknown>>;
+  output: (opts: { decision: 'allow' | 'deny'; reason?: string; context?: string }) => void;
+  log: (prefix: string, msg: string) => void;
+  getEnv: (key: string) => string | undefined;
+}
+
+const defaultDeps: HookDeps = {
+  readStdin,
+  output: outputPreToolUse,
+  log,
+  getEnv: (key) => process.env[key],
+};
+
+// ─────────────────────────────────────────────────────────────
+// Pure helpers (exported for testing)
+// ─────────────────────────────────────────────────────────────
+
+// `(\s|$)` after the verb avoids matching plumbing like `git merge-base`.
+const PUSH = /\bgit\s+push(\s|$)/;
+const MERGE = /\bgit\s+merge(\s|$)/;
+const GH_PR_MERGE = /\bgh\s+pr\s+merge(\s|$)/;
+
+/**
+ * True when the bash command performs a push or merge (the escape-to-remote
+ * operations owned exclusively by the main orchestrator). Excludes `git merge-base`
+ * (read-only plumbing), `git commit`, and read-only git/gh commands.
+ */
+export function commandIsPushOrMerge(command: string): boolean {
+  return PUSH.test(command) || MERGE.test(command) || GH_PR_MERGE.test(command);
+}
+
+export interface GuardResult {
+  decision: 'allow' | 'deny';
+  reason?: string;
+}
+
+/**
+ * Pure decision: deny only when a sub-agent (agentId present) attempts a
+ * push/merge. Empty agentId == main orchestrator == always allowed.
+ *
+ * Path-independent by construction (RFC-040 TD-204 §⑤-A, Classe-A): the
+ * signature takes no file_path/cwd input, so the decision is provably the
+ * same for every project's working tree — globally cwd-safe without any
+ * project-root resolution.
+ */
+export function evaluateGitGuard(
+  command: string,
+  agentId: string,
+  agentType?: string
+): GuardResult {
+  if (!agentId) return { decision: 'allow' }; // main orchestrator owns git
+  if (!commandIsPushOrMerge(command)) return { decision: 'allow' }; // commit/read-only fine
+
+  const who = agentType && agentType.length > 0 ? `Sub-agent '${agentType}'` : 'Sub-agent';
+  return {
+    decision: 'deny',
+    reason:
+      `[AGENT-GIT-GUARD] ${who} is not permitted to run git push / git merge / gh pr merge. ` +
+      `Per RFC-022 + TD-169, push and merge are owned EXCLUSIVELY by the main orchestrator ` +
+      `(the main conversation). Make your changes locally and return them in your report — ` +
+      `the orchestrator reviews, then pushes/merges. (Prevents the S288 unauthorized merge-to-main breach.)`,
+  };
+}
+
+// ─────────────────────────────────────────────────────────────
+// Core logic (exported for testing)
+// ─────────────────────────────────────────────────────────────
+
+export async function mainWithDeps(deps: HookDeps): Promise<void> {
+  const { readStdin, output, log, getEnv } = deps;
+
+  const stdin = await readStdin();
+
+  const command =
+    (getField(stdin, 'tool_input.command') as string | undefined) ||
+    (getField(stdin, 'command') as string | undefined) ||
+    '';
+
+  const agentId = getField(stdin, 'agent_id');
+  const agentType = getField(stdin, 'agent_type');
+
+  // Escape hatch (parity with workflow-guard SKIP_*). Process-env only — a
+  // sub-agent's transient shell env does not persist into the hook process.
+  if (getEnv('SKIP_AGENT_GIT_GUARD') === 'true') {
+    log(HOOK, `BYPASS (SKIP_AGENT_GIT_GUARD): ${command.slice(0, 60)}`);
+    return; // silent pass-through
+  }
+
+  const result = evaluateGitGuard(command, agentId, agentType);
+
+  if (result.decision === 'deny') {
+    log(HOOK, `DENY (agent=${agentType || 'unknown'}): ${command.slice(0, 80)}`);
+    output({ decision: 'deny', reason: result.reason });
+    return;
+  }
+
+  // Allow path is a silent pass-through so we never clobber the context that the
+  // sibling Bash hook (verification-before-completion) injects.
+  log(
+    HOOK,
+    `ALLOW (agent=${agentId ? agentType || 'sub-agent' : 'main'}): ${command.slice(0, 60)}`
+  );
+}
+
+// ─────────────────────────────────────────────────────────────
+// Entry point (production use)
+// ─────────────────────────────────────────────────────────────
+
+async function main(): Promise<void> {
+  await mainWithDeps(defaultDeps);
+}
+
+main().catch(() => process.exit(0));

package/hooks/hooks.json

@@ -0,0 +1,78 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume",
+        "hooks": [
+          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session-start.mjs\"", "timeout": 10000 },
+          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/sprint-registry.mjs\"", "timeout": 5000 }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/user-prompt.mjs\"", "timeout": 10000 }]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "mcp__(plugin_orchestrator_)?orchestrator-tools__advancePhase",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-guardian.mjs\"", "timeout": 15000 }]
+      },
+      {
+        "matcher": "Write|Edit",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-guard.mjs\"", "timeout": 10000 }]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/verification-before-completion.mjs\"", "timeout": 5000 },
+          { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/agent-git-guard.mjs\"", "timeout": 5000 }
+        ]
+      },
+      {
+        "matcher": "Agent",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/pre-agent-dispatch.mjs\"", "timeout": 5000 }]
+      },
+      {
+        "matcher": "mcp__plugin_playwright_playwright__browser_take_screenshot|mcp__plugin_playwright_playwright__browser_pdf_save",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/playwright-output-guard.mjs\"", "timeout": 5000 }]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "matcher": "(orchestrator:)?(implementer|specifier|planner|task-generator|reviewer|researcher)",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-start.mjs\"", "timeout": 10000 }]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "matcher": "(orchestrator:)?(implementer|specifier|planner|task-generator|reviewer|researcher)",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-stop.mjs\"", "timeout": 30000 }]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/dangling-guard.mjs\"", "timeout": 15000 }]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/mailbox-listener.mjs\"", "timeout": 5000 }]
+      },
+      {
+        "matcher": "mcp__(plugin_orchestrator_)?orchestrator-tools__advancePhase",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/post-implement.mjs\"", "timeout": 15000 }]
+      }
+    ],
+    "PostCompact": [
+      {
+        "matcher": "",
+        "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/post-compact.mjs\"", "timeout": 5000 }]
+      }
+    ]
+  }
+}

package/hooks/playwright-output-guard.mjs

@@ -0,0 +1,136 @@
+import { createRequire as __createRequireShim } from 'node:module'; const require = __createRequireShim(import.meta.url);
+
+// hooks/playwright-output-guard.ts
+import { dirname as dirname3, isAbsolute, normalize, resolve } from "node:path";
+
+// hooks/lib/api-client.ts
+import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
+import { join as join2, dirname as dirname2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// ../project-root-resolver/dist/index.js
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  let currentDir = cwd;
+  for (; ; ) {
+    if (existsSync(join(currentDir, sentinel))) {
+      return currentDir;
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      return null;
+    }
+    currentDir = parentDir;
+  }
+}
+
+// hooks/lib/api-client.ts
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname2(__filename);
+var PROJECT_ROOT = join2(__dirname, "..", "..", "..");
+var STATE_DIR = join2(PROJECT_ROOT, ".orchestrator", ".state");
+var JWT_CACHE = join2(STATE_DIR, "jwt-token");
+var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
+mkdirSync(STATE_DIR, { recursive: true });
+var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
+var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
+var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
+var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
+function resolveHookProjectRoot(cwd) {
+  return resolveProjectRoot(cwd);
+}
+function log(prefix, msg) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
+  try {
+    const line = `[${ts}] ${prefix}: ${msg}
+`;
+    writeFileSync(DEBUG_LOG, line, { flag: "a" });
+  } catch {
+  }
+}
+var LAST_COMPLETED_FILE = join2(STATE_DIR, "last-completed-workflow.json");
+var LAST_COMPLETED_TTL_MS = 60 * 60 * 1e3;
+var INVOCATIONS_DIR = join2(STATE_DIR, "invocations");
+var INVOCATION_STATE_TTL_MS = 4 * 60 * 60 * 1e3;
+var DISPATCH_INTENT_DIR = join2(STATE_DIR, "dispatch-intent");
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  const raw = Buffer.concat(chunks).toString("utf-8").trim();
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+function getField(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current == null || typeof current !== "object") return "";
+    current = current[part];
+  }
+  return current != null ? String(current) : "";
+}
+function outputPreToolUse(opts) {
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: opts.decision,
+      ...opts.reason && { permissionDecisionReason: opts.reason },
+      ...opts.context && { additionalContext: opts.context }
+    }
+  };
+  console.log(JSON.stringify(output));
+}
+
+// hooks/playwright-output-guard.ts
+var HOOK = "PLAYWRIGHT-OUTPUT-GUARD";
+var PROJECT_ROOT2 = process.env.CLAUDE_PROJECT_DIR ?? resolveHookProjectRoot(process.cwd()) ?? process.cwd();
+var GUIDANCE = 'Playwright Output Guard: screenshots n\xE3o podem cair na raiz do repo (auto-checkpoint os varre \u2014 recorr\xEAncia S266-S268). Use `filename: ".playwright-mcp/<nome>.png"` (descart\xE1vel, gitignored), `filename: ".cobaia-evidence/<sess\xE3o>/<nome>.png"` (evid\xEAncia a versionar), ou omita `filename` (default j\xE1 vai para .playwright-mcp/).';
+function evaluateFilename(filename) {
+  if (!filename) return { decision: "allow" };
+  const resolved = isAbsolute(filename) ? normalize(filename) : resolve(PROJECT_ROOT2, filename);
+  const dir = dirname3(resolved);
+  if (dir === PROJECT_ROOT2) {
+    return { decision: "deny", reason: GUIDANCE };
+  }
+  if (!resolved.startsWith(PROJECT_ROOT2 + "/") && !isAbsolute(filename)) {
+    return { decision: "deny", reason: GUIDANCE };
+  }
+  return { decision: "allow" };
+}
+var defaultDeps = {
+  readStdin,
+  output: outputPreToolUse,
+  log
+};
+async function mainWithDeps(deps) {
+  const stdin = await deps.readStdin();
+  const filename = getField(stdin, "tool_input.filename");
+  const result = evaluateFilename(filename || void 0);
+  deps.log(HOOK, `filename=${filename || "(none)"} decision=${result.decision}`);
+  if (result.decision === "deny") {
+    deps.output({ decision: "deny", reason: result.reason });
+    return;
+  }
+  deps.output({
+    decision: "allow",
+    ...filename ? {} : {
+      context: "[PLAYWRIGHT-OUTPUT-GUARD] sem filename: output em .playwright-mcp/ (gitignored)."
+    }
+  });
+}
+async function main() {
+  await mainWithDeps(defaultDeps);
+}
+main().catch(() => process.exit(0));
+export {
+  PROJECT_ROOT2 as PROJECT_ROOT,
+  evaluateFilename,
+  mainWithDeps
+};