@orchestrator-claude/definitions 3.37.0 → 3.37.1

package/agents/software-architect.md

@@ -1,11 +1,10 @@
 ---
 name: software-architect
-description: Arquiteto de software sênior do substrato DETERMINÍSTICO — API, domínio, infraestrutura e código de aplicação. Produz ADR e RFC a partir do Ciclo aprovado ou de dívida medida, e carrega duas obrigações que ninguém mais tem: mapear DEAD CODE (por referência, nunca por leitura) e DUAL PATH (duas implementações vivas do mesmo contrato, que é como a divergência entra sem ninguém decidir). Domina análise por símbolo (declaração, referências, implementações), fitness function, e a disciplina de que o desenho não é a verdade — Archify desenha, o instrumento verifica. Use quando a decisão é sobre estrutura de código que roda deterministicamente. Emite CONTESTAÇÃO quando a premissa da task está contradita pelo código — e para. NÃO use para harness (hooks, skills, agentes, MCP, integrações → ai-architect), implementação de task (→ implementer), IaC Azure (→ azure-devops-engineer), CI/containers (→ cicd-platform-engineer), nem para análise de legado dentro do workflow legacy-analysis (→ code-archaeologist).
+description: Arquiteto de software sênior do substrato DETERMINÍSTICO — API, domínio, infraestrutura e código de aplicação. Produz ADR e RFC a partir do Ciclo aprovado ou de dívida medida, e carrega duas obrigações que ninguém mais tem: mapear DEAD CODE (por referência, nunca por leitura) e DUAL PATH (duas implementações vivas do mesmo contrato, que é como a divergência entra sem ninguém decidir). Domina análise por símbolo (declaração, referências, implementações), fitness function, e a disciplina de que o desenho não é a verdade — Archify desenha, o instrumento verifica. Use quando a decisão é sobre estrutura de código que roda deterministicamente. Emite CONTESTAÇÃO quando a premissa da task está contradita pelo código — e para. NÃO use para harness (hooks, skills, agentes, MCP, integrações → harness-architect), implementação de task (→ implementer), IaC Azure (→ azure-devops-engineer), CI/containers (→ cicd-platform-engineer), nem para análise de legado dentro do workflow legacy-analysis (→ code-archaeologist).
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent, mcp__plugin_serena_serena__find_symbol, mcp__plugin_serena_serena__find_referencing_symbols, mcp__plugin_serena_serena__find_declaration, mcp__plugin_serena_serena__find_implementations, mcp__plugin_serena_serena__get_symbols_overview, mcp__plugin_serena_serena__search_for_pattern, mcp__plugin_serena_serena__get_diagnostics_for_file, mcp__plugin_context7_context7__resolve-library-id, mcp__plugin_context7_context7__query-docs, mcp__orchestrator-tools__kbSearch, mcp__orchestrator-tools__kbGetDocument, mcp__orchestrator-tools__kbListDocuments, mcp__orchestrator-tools__startAgentInvocation, mcp__orchestrator-tools__completeAgentInvocation, mcp__orchestrator-extended__artifactStore, mcp__orchestrator-extended__artifactRetrieve
 model: opus
 color: blue
 permissionMode: acceptEdits
-memory: project
 skills:
   - kb-lookup
   - project-conventions
@@ -34,9 +33,9 @@ Você não implementa. Você decide, registra a decisão, e **entrega o mapa do
 |---|---|
 | **Entradas** | RFC decomposta · Ciclo aprovado vindo da lane 3 · dívida técnica medida · pergunta de estrutura ("isso cabe onde?") |
 | **Saída** | ADR e/ou RFC · **mapa de dead code** com evidência de não-referência · **mapa de dual path** com os dois caminhos e quem chama cada um · diagrama Archify quando ajuda a decidir |
-| **Fora de escopo** | harness — hooks, skills, agentes, MCP, integrações, distribuição (**`ai-architect`**) · implementar a task (`implementer`) · IaC Azure (`azure-devops-engineer`) · CI e containers (`cicd-platform-engineer`) · varredura de legado dentro do workflow legacy-analysis (`code-archaeologist`) |
+| **Fora de escopo** | harness — hooks, skills, agentes, MCP, integrações, distribuição (**`harness-architect`**) · implementar a task (`implementer`) · IaC Azure (`azure-devops-engineer`) · CI e containers (`cicd-platform-engineer`) · varredura de legado dentro do workflow legacy-analysis (`code-archaeologist`) |
 
-**A fronteira com o `ai-architect` é por substrato, não por assunto.** Os dois produzem ADR e RFC, os dois têm Archify. O que separa: se a coisa roda deterministicamente e falha igual toda vez, é sua. Se o comportamento depende de um modelo, de um hook interceptando, de uma skill sendo carregada ou de uma definição sendo distribuída, é dele. Na dúvida, diga qual é a dúvida e devolva ao orquestrador — **não decida a fronteira sozinho no meio da task.**
+**A fronteira com o `harness-architect` é por substrato, não por assunto.** Os dois produzem ADR e RFC, os dois têm Archify. O que separa: se a coisa roda deterministicamente e falha igual toda vez, é sua. Se o comportamento depende de um modelo, de um hook interceptando, de uma skill sendo carregada ou de uma definição sendo distribuída, é dele. Na dúvida, diga qual é a dúvida e devolva ao orquestrador — **não decida a fronteira sozinho no meio da task.**
 
 **Sobreposição declarada com `code-archaeologist`:** ele também detecta dead code, escopado à fase ANALYZE do workflow legacy-analysis, em codebase alheio. Você opera no **nosso** código, continuamente, e o seu produto é decisão registrada, não relatório de varredura. Se a task for análise de legado, devolva.
 
@@ -126,7 +125,7 @@ Quando o instrumento confirma o que você já esperava, **ele não foi testado
 
 > **Você lança `Explore`, e somente `Explore`.** A ferramenta de spawn não é escopável por tipo no frontmatter — ela te deixaria despachar `implementer`, `azure-devops-engineer` e outros que carregam `createCheckpoint`, o que atravessaria a fronteira entre decidir e executar e poria commit fora do orquestrador. O harness não oferece cerca declarativa para isso, então **a cerca é este parágrafo**. Se uma task parecer exigir que você despache outro tipo de agente, isso é contestação, não permissão implícita.
 
-> **Você não cruza para o harness.** Hook, skill, agente, MCP, plugin e distribuição são do `ai-architect` — mesmo quando o sintoma aparece no código de aplicação.
+> **Você não cruza para o harness.** Hook, skill, agente, MCP, plugin e distribuição são do `harness-architect` — mesmo quando o sintoma aparece no código de aplicação.
 
 ## CONTESTAÇÃO
 
@@ -156,3 +155,9 @@ DECISÃO PROPOSTA
 O QUE EU NÃO CONSEGUI VERIFICAR
 <explícito — e por quê. Esta seção nunca vem vazia por conveniência.>
 ```
+
+## Memory Protocol
+
+Write memories to `.claude/agent-memory/software-architect/` — your **bare** slug directory. Never `orchestrator-software-architect/` and never `orchestrator:software-architect/`: the session-start reader resolves only the bare path, so a memory written to a prefixed sibling costs tokens and is never loaded (TD-214). **If your system prompt names a different directory, this line wins — and say so in your report**, so the divergence stays visible instead of forking again in silence.
+
+Each memory is its own `.md` file (frontmatter: `name`, `description`, `type`), plus an entry in `.claude/agent-memory/software-architect/memory-index.yaml`. Write on surprise feedback (a correction OR a confirmation of a non-obvious choice), on a validated pattern worth repeating, or on decision rationale not captured in code, commit or ADR. Do not write what already lives in code, commits, `CLAUDE.md` or ADRs, and do not write ephemeral task state.

package/agents/specifier.md

@@ -5,7 +5,6 @@ tools: Read, Write, Edit, Grep, Glob, WebSearch, mcp__orchestrator-extended__art
 model: sonnet
 color: red
 permissionMode: default
-memory: project
 skills:
   - artifact-production
   - project-conventions
@@ -350,3 +349,9 @@ When reporting issues in specifications:
 | **MEDIUM** | Unclear criteria, potential ambiguity | Should fix, can proceed |
 | **LOW** | Style/formatting issue, minor improvement | Optional, nice to have |
 
+
+## Memory Protocol
+
+Write memories to `.claude/agent-memory/specifier/` — your **bare** slug directory. Never `orchestrator-specifier/` and never `orchestrator:specifier/`: the session-start reader resolves only the bare path, so a memory written to a prefixed sibling costs tokens and is never loaded (TD-214). **If your system prompt names a different directory, this line wins — and say so in your report**, so the divergence stays visible instead of forking again in silence.
+
+Each memory is its own `.md` file (frontmatter: `name`, `description`, `type`), plus an entry in `.claude/agent-memory/specifier/memory-index.yaml`. Write on surprise feedback (a correction OR a confirmation of a non-obvious choice), on a validated pattern worth repeating, or on decision rationale not captured in code, commit or ADR. Do not write what already lives in code, commits, `CLAUDE.md` or ADRs, and do not write ephemeral task state.

package/agents/task-generator.md

@@ -5,7 +5,6 @@ tools: Read, Write, Edit, Grep, Glob, mcp__orchestrator-extended__artifactStore,
 model: sonnet
 color: pink
 permissionMode: default
-memory: project
 skills:
   - artifact-production
   - project-conventions
@@ -380,3 +379,9 @@ When reporting issues in task backlog:
 | **MEDIUM** | Unclear priority, missing context | Should fix, can proceed |
 | **LOW** | Minor formatting, optional notes | Optional, nice to have |
 
+
+## Memory Protocol
+
+Write memories to `.claude/agent-memory/task-generator/` — your **bare** slug directory. Never `orchestrator-task-generator/` and never `orchestrator:task-generator/`: the session-start reader resolves only the bare path, so a memory written to a prefixed sibling costs tokens and is never loaded (TD-214). **If your system prompt names a different directory, this line wins — and say so in your report**, so the divergence stays visible instead of forking again in silence.
+
+Each memory is its own `.md` file (frontmatter: `name`, `description`, `type`), plus an entry in `.claude/agent-memory/task-generator/memory-index.yaml`. Write on surprise feedback (a correction OR a confirmation of a non-obvious choice), on a validated pattern worth repeating, or on decision rationale not captured in code, commit or ADR. Do not write what already lives in code, commits, `CLAUDE.md` or ADRs, and do not write ephemeral task state.

package/agents/test-sidecar.md

@@ -110,3 +110,9 @@ Coverage: {pct}% (target: 80%) | Status: {OK | BELOW TARGET}
 ## Mailbox Protocol
 
 When running in a sprint session, follow the **sprint-teammate** skill for the full mailbox protocol (message types, envelope format, inbox/outbox paths). The sprint-teammate skill is injected at session start.
+
+## Memory Protocol
+
+Write memories to `.claude/agent-memory/test-sidecar/` — your **bare** slug directory. Never `orchestrator-test-sidecar/` and never `orchestrator:test-sidecar/`: the session-start reader resolves only the bare path, so a memory written to a prefixed sibling costs tokens and is never loaded (TD-214). **If your system prompt names a different directory, this line wins — and say so in your report**, so the divergence stays visible instead of forking again in silence.
+
+Each memory is its own `.md` file (frontmatter: `name`, `description`, `type`), plus an entry in `.claude/agent-memory/test-sidecar/memory-index.yaml`. Write on surprise feedback (a correction OR a confirmation of a non-obvious choice), on a validated pattern worth repeating, or on decision rationale not captured in code, commit or ADR. Do not write what already lives in code, commits, `CLAUDE.md` or ADRs, and do not write ephemeral task state.

package/dist/scripts/generate-hooks-matcher.d.ts

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * Build-time script: generates the SubagentStart/SubagentStop matcher in
+ * `hooks/hooks.json` from the canonical agent roster
+ * (`packages/definitions/agents/*.md`) — RF-009 (TD-214/TD-239 TASK-007).
+ *
+ * Problem this fixes: `hooks.json`'s SubagentStart/SubagentStop matcher was
+ * a hand-typed 6-name allowlist
+ * (`(orchestrator:)?(implementer|specifier|planner|task-generator|reviewer|researcher)`)
+ * that was never updated as the agent roster grew to 28 — `docs-guardian`
+ * (among 21 others) never received `SubagentStart`'s `[MEMORY-CONTEXT]`
+ * injection (RF-010) nor `SubagentStop`'s invocation tracking, because the
+ * harness never even fired those hooks for them. This script closes that
+ * gap structurally: the matcher is always GENERATED from the real,
+ * on-disk `agents/` directory, never typed by hand again.
+ *
+ * `packages/definitions/agents/` (NOT `.claude/agents`) is the canonical
+ * source in THIS repo's own dogfood session — see TD-243 / the
+ * `resolveCanonicalAgentsDir()` precedent already shipped in
+ * `hooks/subagent-start.ts` (TASK-004, S433): `.claude/agents` resolves to
+ * 0 files here (ADR-023 — `.claude/{agents,skills}` is an INSTALL-TARGET,
+ * not the SoT, in this repo).
+ *
+ * DECISION (documented, not accidental — dispatch explicitly required this):
+ * `orchestrator.md` IS included in the generated matcher, even though the
+ * orchestrator is the main conversation and is never dispatched via
+ * `Agent(subagent_type: "orchestrator")`. Rationale: `hooks/subagent-start.ts`
+ * TASK-004's OWN runtime canonical-agent-set (`getCanonicalAgentNamesDefault`,
+ * feeding `classifyAgentType`) already uses the RAW, unfiltered
+ * `scanAgentDefinitions(resolveCanonicalAgentsDir())` — i.e. it already
+ * tolerates "orchestrator" as a nominally-classifiable agent name today, in
+ * shipped code. Introducing a NEW filter here (excluding orchestrator from
+ * the harness-level matcher while the hook-internal allowlist keeps it)
+ * would create two divergent "canonical roster" definitions to maintain in
+ * lockstep for no functional benefit — the matcher entry is inert either
+ * way, since the dispatch that would exercise it never happens. Including it
+ * keeps this script a pure, unfiltered "read the directory" generator with
+ * zero agent-specific exception logic, which is the whole point of RF-009
+ * (never hand-maintain this list again, including the maintenance burden of
+ * a hand-maintained EXCLUSION list).
+ *
+ * Usage: npx tsx src/scripts/generate-hooks-matcher.ts
+ */
+/**
+ * Sorted basenames (extension stripped) of every `*.md` file directly under
+ * `agentsDir`. Fail-open (returns `[]` on a missing directory) — mirrors
+ * `hooks/lib/capability-scanner.ts`'s `scanAgentDefinitions`, deliberately
+ * NOT imported from there: this script lives in `src/scripts/` (build-time,
+ * plain `.ts`, no bundling), while `capability-scanner.ts` lives in
+ * `hooks/lib/` (runtime, gets inlined into `.mjs` bundles by
+ * `bundle-hooks.ts`) — cross-importing would couple two independently
+ * regenerated artifacts for a five-line function.
+ */
+export declare function scanAgentSlugs(agentsDir: string): string[];
+/**
+ * Builds the `(orchestrator:)?(slug1|slug2|...)` matcher string. The
+ * `(orchestrator:)?` optional-namespace prefix MUST survive — under plugin
+ * scope the harness sends `orchestrator:<agent>`, not a bare agent name (see
+ * `hooks/subagent-start.ts` module doc, TASK-004's namespace-normalization
+ * fix). Throws on an empty slug list rather than silently emitting
+ * `(orchestrator:)?()`, a matcher that matches nothing and would make every
+ * `SubagentStart`/`SubagentStop` hook permanently dark without any visible
+ * error.
+ */
+export declare function buildSubagentMatcher(slugs: string[]): string;
+/**
+ * Tests whether `matcher` (as committed in hooks.json) matches `slug` as a
+ * COMPLETE string, both bare and under the `orchestrator:` namespace prefix
+ * — i.e. does this slug have its own genuine alternative in the matcher,
+ * not merely appear as a substring of some other alternative. Anchored
+ * (`^...$`) deliberately: this is a stricter, more meaningful check than an
+ * unanchored `.test()` would be for "is this slug a real member of the
+ * allowlist".
+ */
+export declare function matcherCoversSlug(matcher: string, slug: string): boolean;
+/**
+ * Replaces the `"matcher": "..."` value inside BOTH the `SubagentStart` and
+ * `SubagentStop` blocks of a `hooks.json` source string with `newMatcher`,
+ * leaving everything else (formatting, other hook entries) byte-identical.
+ * A plain `JSON.parse` + `JSON.stringify(obj, null, 2)` round-trip was
+ * deliberately NOT used here — it would reformat every compact
+ * single-line `{ "type": "command", ... }` hook entry onto multiple lines,
+ * rewriting the whole file's style for an unrelated reason. Throws if it
+ * does not find EXACTLY 2 matches (guards against a silent no-op if
+ * hooks.json's SubagentStart/SubagentStop shape is ever restructured).
+ */
+export declare function applyMatcherToHooksJson(hooksJsonContent: string, newMatcher: string): string;
+/**
+ * Pure computation: the matcher `hooks.json` SHOULD contain right now,
+ * given the real, on-disk `<packageRoot>/agents/` directory. Performs no
+ * writes — safe to call from a freshness-check test (mirrors
+ * `generate-manifest.ts`'s `generateManifest()` pure/writer split).
+ */
+export declare function generateHooksMatcher(packageRoot?: string): {
+    matcher: string;
+    slugs: string[];
+};
+/**
+ * Writes the freshly-generated matcher into `<packageRoot>/hooks/hooks.json`.
+ * The only function in this module that performs I/O writes.
+ */
+export declare function writeHooksMatcher(packageRoot?: string): {
+    matcher: string;
+    slugs: string[];
+};
+//# sourceMappingURL=generate-hooks-matcher.d.ts.map

package/dist/scripts/generate-hooks-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-hooks-matcher.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-hooks-matcher.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AASH;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAM1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAK5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAiB5F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,GAAE,MAA6B,GAAG;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAIA;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,GAAE,MAA6B,GAAG;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAOA"}

package/dist/scripts/generate-hooks-matcher.js

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * Build-time script: generates the SubagentStart/SubagentStop matcher in
+ * `hooks/hooks.json` from the canonical agent roster
+ * (`packages/definitions/agents/*.md`) — RF-009 (TD-214/TD-239 TASK-007).
+ *
+ * Problem this fixes: `hooks.json`'s SubagentStart/SubagentStop matcher was
+ * a hand-typed 6-name allowlist
+ * (`(orchestrator:)?(implementer|specifier|planner|task-generator|reviewer|researcher)`)
+ * that was never updated as the agent roster grew to 28 — `docs-guardian`
+ * (among 21 others) never received `SubagentStart`'s `[MEMORY-CONTEXT]`
+ * injection (RF-010) nor `SubagentStop`'s invocation tracking, because the
+ * harness never even fired those hooks for them. This script closes that
+ * gap structurally: the matcher is always GENERATED from the real,
+ * on-disk `agents/` directory, never typed by hand again.
+ *
+ * `packages/definitions/agents/` (NOT `.claude/agents`) is the canonical
+ * source in THIS repo's own dogfood session — see TD-243 / the
+ * `resolveCanonicalAgentsDir()` precedent already shipped in
+ * `hooks/subagent-start.ts` (TASK-004, S433): `.claude/agents` resolves to
+ * 0 files here (ADR-023 — `.claude/{agents,skills}` is an INSTALL-TARGET,
+ * not the SoT, in this repo).
+ *
+ * DECISION (documented, not accidental — dispatch explicitly required this):
+ * `orchestrator.md` IS included in the generated matcher, even though the
+ * orchestrator is the main conversation and is never dispatched via
+ * `Agent(subagent_type: "orchestrator")`. Rationale: `hooks/subagent-start.ts`
+ * TASK-004's OWN runtime canonical-agent-set (`getCanonicalAgentNamesDefault`,
+ * feeding `classifyAgentType`) already uses the RAW, unfiltered
+ * `scanAgentDefinitions(resolveCanonicalAgentsDir())` — i.e. it already
+ * tolerates "orchestrator" as a nominally-classifiable agent name today, in
+ * shipped code. Introducing a NEW filter here (excluding orchestrator from
+ * the harness-level matcher while the hook-internal allowlist keeps it)
+ * would create two divergent "canonical roster" definitions to maintain in
+ * lockstep for no functional benefit — the matcher entry is inert either
+ * way, since the dispatch that would exercise it never happens. Including it
+ * keeps this script a pure, unfiltered "read the directory" generator with
+ * zero agent-specific exception logic, which is the whole point of RF-009
+ * (never hand-maintain this list again, including the maintenance burden of
+ * a hand-maintained EXCLUSION list).
+ *
+ * Usage: npx tsx src/scripts/generate-hooks-matcher.ts
+ */
+import { readFileSync, writeFileSync, readdirSync, existsSync } from 'node:fs';
+import { resolve, join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_PACKAGE_ROOT = resolve(__dirname, '../..');
+/**
+ * Sorted basenames (extension stripped) of every `*.md` file directly under
+ * `agentsDir`. Fail-open (returns `[]` on a missing directory) — mirrors
+ * `hooks/lib/capability-scanner.ts`'s `scanAgentDefinitions`, deliberately
+ * NOT imported from there: this script lives in `src/scripts/` (build-time,
+ * plain `.ts`, no bundling), while `capability-scanner.ts` lives in
+ * `hooks/lib/` (runtime, gets inlined into `.mjs` bundles by
+ * `bundle-hooks.ts`) — cross-importing would couple two independently
+ * regenerated artifacts for a five-line function.
+ */
+export function scanAgentSlugs(agentsDir) {
+    if (!existsSync(agentsDir))
+        return [];
+    return readdirSync(agentsDir)
+        .filter((f) => f.endsWith('.md'))
+        .map((f) => f.replace(/\.md$/, ''))
+        .sort();
+}
+/**
+ * Builds the `(orchestrator:)?(slug1|slug2|...)` matcher string. The
+ * `(orchestrator:)?` optional-namespace prefix MUST survive — under plugin
+ * scope the harness sends `orchestrator:<agent>`, not a bare agent name (see
+ * `hooks/subagent-start.ts` module doc, TASK-004's namespace-normalization
+ * fix). Throws on an empty slug list rather than silently emitting
+ * `(orchestrator:)?()`, a matcher that matches nothing and would make every
+ * `SubagentStart`/`SubagentStop` hook permanently dark without any visible
+ * error.
+ */
+export function buildSubagentMatcher(slugs) {
+    if (slugs.length === 0) {
+        throw new Error('buildSubagentMatcher: empty slug list would produce a vacuous matcher');
+    }
+    return `(orchestrator:)?(${slugs.join('|')})`;
+}
+/**
+ * Tests whether `matcher` (as committed in hooks.json) matches `slug` as a
+ * COMPLETE string, both bare and under the `orchestrator:` namespace prefix
+ * — i.e. does this slug have its own genuine alternative in the matcher,
+ * not merely appear as a substring of some other alternative. Anchored
+ * (`^...$`) deliberately: this is a stricter, more meaningful check than an
+ * unanchored `.test()` would be for "is this slug a real member of the
+ * allowlist".
+ */
+export function matcherCoversSlug(matcher, slug) {
+    const re = new RegExp(`^${matcher}$`);
+    return re.test(slug) && re.test(`orchestrator:${slug}`);
+}
+/**
+ * Replaces the `"matcher": "..."` value inside BOTH the `SubagentStart` and
+ * `SubagentStop` blocks of a `hooks.json` source string with `newMatcher`,
+ * leaving everything else (formatting, other hook entries) byte-identical.
+ * A plain `JSON.parse` + `JSON.stringify(obj, null, 2)` round-trip was
+ * deliberately NOT used here — it would reformat every compact
+ * single-line `{ "type": "command", ... }` hook entry onto multiple lines,
+ * rewriting the whole file's style for an unrelated reason. Throws if it
+ * does not find EXACTLY 2 matches (guards against a silent no-op if
+ * hooks.json's SubagentStart/SubagentStop shape is ever restructured).
+ */
+export function applyMatcherToHooksJson(hooksJsonContent, newMatcher) {
+    let replacements = 0;
+    const updated = hooksJsonContent.replace(/("(?:SubagentStart|SubagentStop)":\s*\[\s*\{\s*"matcher":\s*")[^"]*(")/g, (_match, pre, post) => {
+        replacements++;
+        return `${pre}${newMatcher}${post}`;
+    });
+    if (replacements !== 2) {
+        throw new Error(`applyMatcherToHooksJson: expected exactly 2 matcher replacements ` +
+            `(SubagentStart + SubagentStop), found ${String(replacements)} — ` +
+            `hooks.json's shape may have changed; update this script's regex.`);
+    }
+    return updated;
+}
+/**
+ * Pure computation: the matcher `hooks.json` SHOULD contain right now,
+ * given the real, on-disk `<packageRoot>/agents/` directory. Performs no
+ * writes — safe to call from a freshness-check test (mirrors
+ * `generate-manifest.ts`'s `generateManifest()` pure/writer split).
+ */
+export function generateHooksMatcher(packageRoot = DEFAULT_PACKAGE_ROOT) {
+    const slugs = scanAgentSlugs(join(packageRoot, 'agents'));
+    const matcher = buildSubagentMatcher(slugs);
+    return { matcher, slugs };
+}
+/**
+ * Writes the freshly-generated matcher into `<packageRoot>/hooks/hooks.json`.
+ * The only function in this module that performs I/O writes.
+ */
+export function writeHooksMatcher(packageRoot = DEFAULT_PACKAGE_ROOT) {
+    const { matcher, slugs } = generateHooksMatcher(packageRoot);
+    const hooksJsonPath = join(packageRoot, 'hooks', 'hooks.json');
+    const content = readFileSync(hooksJsonPath, 'utf-8');
+    const updated = applyMatcherToHooksJson(content, matcher);
+    writeFileSync(hooksJsonPath, updated);
+    return { matcher, slugs };
+}
+// ─── CLI Entry Guard ──────────────────────────────────────────────────────────
+// Mirrors the pattern in generate-manifest.ts / sync-hook-mirrors.ts:
+// importing this module (e.g. from a test) must NOT trigger a write — only
+// direct CLI execution does.
+const isCli = process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1];
+if (isCli) {
+    const { matcher, slugs } = writeHooksMatcher();
+    console.log(`Generated hooks.json SubagentStart/SubagentStop matcher (${String(slugs.length)} agents):`);
+    console.log(`  ${matcher}`);
+}
+//# sourceMappingURL=generate-hooks-matcher.js.map

package/dist/scripts/generate-hooks-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-hooks-matcher.js","sourceRoot":"","sources":["../../src/scripts/generate-hooks-matcher.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,OAAO,WAAW,CAAC,SAAS,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;SAClC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAe;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,oBAAoB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,gBAAwB,EAAE,UAAkB;IAClF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CACtC,yEAAyE,EACzE,CAAC,MAAM,EAAE,GAAW,EAAE,IAAY,EAAE,EAAE;QACpC,YAAY,EAAE,CAAC;QACf,OAAO,GAAG,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;IACtC,CAAC,CACF,CAAC;IACF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,yCAAyC,MAAM,CAAC,YAAY,CAAC,KAAK;YAClE,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,cAAsB,oBAAoB;IAI7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAsB,oBAAoB;IAI1E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,iFAAiF;AACjF,sEAAsE;AACtE,2EAA2E;AAC3E,6BAA6B;AAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAElG,IAAI,KAAK,EAAE,CAAC;IACV,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC/C,OAAO,CAAC,GAAG,CACT,4DAA4D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAC5F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;AAC9B,CAAC"}

package/dist/scripts/generate-manifest.d.ts

@@ -20,10 +20,32 @@ import type { ManifestSchema } from '../manifest/types.js';
  * called with no argument (preserves the original CLI behavior).
  */
 export declare function generateManifest(packageRoot?: string): ManifestSchema;
+/**
+ * True when two manifests differ ONLY by their `generatedAt` stamp — i.e. the
+ * substantive content (schema, namespace, version, and every definition entry
+ * with its content-derived checksum) is identical.
+ */
+export declare function isManifestContentEqual(a: ManifestSchema, b: ManifestSchema): boolean;
 /**
  * Thin writer: computes the manifest via generateManifest() and writes it to
  * <packageRoot>/manifest.json. This is the only function in this module that
  * performs I/O writes.
+ *
+ * IDEMPOTENT (S445 Task B). `generatedAt` is the only clock-derived field in the
+ * manifest — every other field is content-derived (SHA256 checksums). Stamping a
+ * fresh timestamp unconditionally meant that every `npm run build` produced a
+ * diff in the git-TRACKED manifest.json even when not a single byte of any
+ * definition had changed. Two costs, both real and both paid repeatedly: the
+ * working tree was left dirty after any build (and the release requires a clean
+ * tree), and readers were trained to wave away diffs in the one file whose diffs
+ * carry the checksum of every distributed definition.
+ *
+ * So `generatedAt` is preserved whenever the content is unchanged, and the write
+ * is skipped entirely when the resulting bytes would be identical (this also
+ * leaves mtime alone, so mtime-based caches elsewhere are not churned either).
+ * The field keeps its documented meaning and stays a real ISO instant: it now
+ * answers "when was this manifest generated", where before it answered "when was
+ * this build last run" — which is what made it non-reproducible.
  */
 export declare function writeManifest(packageRoot?: string): ManifestSchema;
 //# sourceMappingURL=generate-manifest.d.ts.map

package/dist/scripts/generate-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-manifest.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-manifest.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AAkF5E;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAA6B,GAAG,cAAc,CAuC3F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAA6B,GAAG,cAAc,CAKxF"}
+{"version":3,"file":"generate-manifest.d.ts","sourceRoot":"","sources":["../../src/scripts/generate-manifest.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AAkF5E;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,MAA6B,GAAG,cAAc,CAuC3F;AA0BD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAIpF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAA6B,GAAG,cAAc,CAwBxF"}

package/dist/scripts/generate-manifest.js

@@ -121,15 +121,80 @@ export function generateManifest(packageRoot = DEFAULT_PACKAGE_ROOT) {
     };
     return manifest;
 }
+/**
+ * Deep structural equality ignoring key order. Used to answer "did the manifest
+ * CONTENT change?" — the previous manifest is parsed from disk, so its key order
+ * comes from the file and cannot be compared by raw serialization.
+ */
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b || a === null || b === null)
+        return false;
+    if (typeof a !== 'object')
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((item, i) => deepEqual(item, b[i]));
+    }
+    const aKeys = Object.keys(a).sort();
+    const bKeys = Object.keys(b).sort();
+    if (aKeys.length !== bKeys.length || !aKeys.every((k, i) => k === bKeys[i]))
+        return false;
+    return aKeys.every((k) => deepEqual(a[k], b[k]));
+}
+/**
+ * True when two manifests differ ONLY by their `generatedAt` stamp — i.e. the
+ * substantive content (schema, namespace, version, and every definition entry
+ * with its content-derived checksum) is identical.
+ */
+export function isManifestContentEqual(a, b) {
+    const { generatedAt: _a, ...restA } = a;
+    const { generatedAt: _b, ...restB } = b;
+    return deepEqual(restA, restB);
+}
 /**
  * Thin writer: computes the manifest via generateManifest() and writes it to
  * <packageRoot>/manifest.json. This is the only function in this module that
  * performs I/O writes.
+ *
+ * IDEMPOTENT (S445 Task B). `generatedAt` is the only clock-derived field in the
+ * manifest — every other field is content-derived (SHA256 checksums). Stamping a
+ * fresh timestamp unconditionally meant that every `npm run build` produced a
+ * diff in the git-TRACKED manifest.json even when not a single byte of any
+ * definition had changed. Two costs, both real and both paid repeatedly: the
+ * working tree was left dirty after any build (and the release requires a clean
+ * tree), and readers were trained to wave away diffs in the one file whose diffs
+ * carry the checksum of every distributed definition.
+ *
+ * So `generatedAt` is preserved whenever the content is unchanged, and the write
+ * is skipped entirely when the resulting bytes would be identical (this also
+ * leaves mtime alone, so mtime-based caches elsewhere are not churned either).
+ * The field keeps its documented meaning and stays a real ISO instant: it now
+ * answers "when was this manifest generated", where before it answered "when was
+ * this build last run" — which is what made it non-reproducible.
  */
 export function writeManifest(packageRoot = DEFAULT_PACKAGE_ROOT) {
-    const manifest = generateManifest(packageRoot);
+    const next = generateManifest(packageRoot);
     const outputPath = resolve(packageRoot, 'manifest.json');
-    writeFileSync(outputPath, JSON.stringify(manifest, null, 2) + '\n');
+    let previousRaw = null;
+    let previous = null;
+    try {
+        previousRaw = readFileSync(outputPath, 'utf-8');
+        previous = JSON.parse(previousRaw);
+    }
+    catch {
+        // Absent or unparseable (cold start / corrupted) — fall through and write.
+        previous = null;
+    }
+    const manifest = previous && isManifestContentEqual(previous, next)
+        ? { ...next, generatedAt: previous.generatedAt }
+        : next;
+    const serialized = JSON.stringify(manifest, null, 2) + '\n';
+    if (previousRaw === serialized)
+        return manifest;
+    writeFileSync(outputPath, serialized);
     return manifest;
 }
 // ─── CLI Entry Guard ──────────────────────────────────────────────────────────

package/dist/scripts/generate-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-manifest.js","sourceRoot":"","sources":["../../src/scripts/generate-manifest.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzD,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,GAAW,EAAE,SAAiB;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB;IAChF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/C,wFAAwF;IACxF,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,OAAO,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB,EAAE,QAAgB,EAAE,OAAe;IACxE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC5B,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;QACzB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,oBAAoB;IACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/C,sBAAsB;IACtB,4FAA4F;IAC5F,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,uEAAuE;IACvE,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,6CAA6C;IAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,mBAAmB,CAC7D,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAmB;QAC/B,MAAM,EAAE,6BAA6B;QACrC,SAAS,EAAE,cAAc;QACzB,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,WAAW,EAAE;YACX,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAChE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACtE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;SAC5D;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,cAAsB,oBAAoB;IACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACzD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,2EAA2E;AAC3E,6BAA6B;AAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAElG,IAAI,KAAK,EAAE,CAAC;IACV,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IAEjC,MAAM,SAAS,GACb,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;QAClC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;QAClC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM;QACjC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM;QACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,yBAAyB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"generate-manifest.js","sourceRoot":"","sources":["../../src/scripts/generate-manifest.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzD,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,GAAW,EAAE,SAAiB;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9B,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB;IAChF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAE/C,wFAAwF;IACxF,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,OAAO,QAAQ,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB,EAAE,QAAgB,EAAE,OAAe;IACxE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC;QAC5B,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;QACzB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,cAAsB,oBAAoB;IACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/C,sBAAsB;IACtB,4FAA4F;IAC5F,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/D,uEAAuE;IACvE,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,6CAA6C;IAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,mBAAmB,CAC7D,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAmB;QAC/B,MAAM,EAAE,6BAA6B;QACrC,SAAS,EAAE,cAAc;QACzB,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,WAAW,EAAE;YACX,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAChE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACtE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;SAC5D;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1F,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACvB,SAAS,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAG,CAA6B,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAiB,EAAE,CAAiB;IACzE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,cAAsB,oBAAoB;IACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEzD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,QAAQ,GAA0B,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAmB,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GACZ,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChD,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChD,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,WAAW,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IAEhD,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,2EAA2E;AAC3E,6BAA6B;AAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAElG,IAAI,KAAK,EAAE,CAAC;IACV,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IAEjC,MAAM,SAAS,GACb,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;QAClC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;QAClC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM;QACjC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM;QACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,4BAA4B,SAAS,yBAAyB,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/hooks/agent-git-guard.mjs

@@ -2,19 +2,71 @@ import { createRequire as __createRequireShim } from 'node:module'; const requir
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname(__filename);
-var PROJECT_ROOT = join(__dirname, "..", "..", "..");
-var STATE_DIR = join(PROJECT_ROOT, ".orchestrator", ".state");
-var JWT_CACHE = join(STATE_DIR, "jwt-token");
-var DEBUG_LOG = join(STATE_DIR, "hook-debug.log");
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+
+// ../project-root-resolver/dist/index.js
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
+function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
+  let currentDir = cwd;
+  for (; ; ) {
+    if (existsSync(join(currentDir, sentinel))) {
+      candidates.push(currentDir);
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
+  }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
+}
+
+// hooks/lib/api-client.ts
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
+var JWT_CACHE = join2(STATE_DIR, "jwt-token");
+var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
+function resolveHookProjectRoot(cwd) {
+  return resolveProjectRoot(cwd);
+}
 function log(prefix, msg) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
   try {
@@ -24,11 +76,11 @@ function log(prefix, msg) {
   } catch {
   }
 }
-var LAST_COMPLETED_FILE = join(STATE_DIR, "last-completed-workflow.json");
+var LAST_COMPLETED_FILE = join2(STATE_DIR, "last-completed-workflow.json");
 var LAST_COMPLETED_TTL_MS = 60 * 60 * 1e3;
-var INVOCATIONS_DIR = join(STATE_DIR, "invocations");
+var INVOCATIONS_DIR = join2(STATE_DIR, "invocations");
 var INVOCATION_STATE_TTL_MS = 4 * 60 * 60 * 1e3;
-var DISPATCH_INTENT_DIR = join(STATE_DIR, "dispatch-intent");
+var DISPATCH_INTENT_DIR = join2(STATE_DIR, "dispatch-intent");
 async function readStdin() {
   const chunks = [];
   for await (const chunk of process.stdin) {