@phren/cli 0.0.10 → 0.0.12

package/mcp/dist/governance-scores.js

@@ -2,7 +2,7 @@ import * as crypto from "crypto";
 import * as fs from "fs";
 import * as path from "path";
 import { appendAuditLog, debugLog, isRecord, memoryScoresFile, memoryUsageLogFile, runtimeFile } from "./shared.js";
-import { withFileLock } from "./governance-locks.js";
+import { withFileLock, isFiniteNumber, hasValidSchemaVersion } from "./shared-governance.js";
 import { errorMessage } from "./utils.js";
 const GOVERNANCE_SCHEMA_VERSION = 1;
 const DEFAULT_MEMORY_SCORES_FILE = {
@@ -15,12 +15,6 @@ function usageLogFile(phrenPath) {
 function scoresJournalFile(phrenPath) {
     return runtimeFile(phrenPath, "scores.jsonl");
 }
-function hasValidSchemaVersion(data) {
-    return !("schemaVersion" in data) || typeof data.schemaVersion === "number";
-}
-function isFiniteNumber(value) {
-    return typeof value === "number" && Number.isFinite(value);
-}
 function isEntryScore(value) {
     if (!isRecord(value))
         return false;
@@ -120,7 +114,7 @@ function readScoreJournal(phrenPath) {
                 return JSON.parse(line);
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                if ((process.env.PHREN_DEBUG))
                     process.stderr.write(`[phren] readScoreJournal parseLine: ${errorMessage(err)}\n`);
                 return null;
             }
@@ -153,7 +147,7 @@ function claimScoreJournal(phrenPath) {
                 return JSON.parse(line);
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                if ((process.env.PHREN_DEBUG))
                     process.stderr.write(`[phren] claimScoreJournal parseLine: ${errorMessage(err)}\n`);
                 return null;
             }
@@ -169,7 +163,7 @@ function claimScoreJournal(phrenPath) {
             fs.unlinkSync(claimedFile);
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+            if ((process.env.PHREN_DEBUG))
                 process.stderr.write(`[phren] claimScoreJournal unlinkClaim: ${errorMessage(err)}\n`);
         }
     }

package/mcp/dist/hooks.js

@@ -1,18 +1,12 @@
 import * as fs from "fs";
 import * as path from "path";
-import { createHmac, randomUUID } from "crypto";
+import { createHmac } from "crypto";
 import { execFileSync } from "child_process";
 import { fileURLToPath } from "url";
-import { EXEC_TIMEOUT_QUICK_MS, PhrenError, debugLog, runtimeFile, homePath, installPreferencesFile } from "./shared.js";
+import { EXEC_TIMEOUT_QUICK_MS, PhrenError, debugLog, runtimeFile, homePath, installPreferencesFile, atomicWriteText } from "./shared.js";
 import { errorMessage } from "./utils.js";
 import { hookConfigPath } from "./provider-adapters.js";
 import { PACKAGE_SPEC } from "./package-metadata.js";
-function atomicWriteText(filePath, content) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    const tmpPath = `${filePath}.tmp-${randomUUID()}`;
-    fs.writeFileSync(tmpPath, content);
-    fs.renameSync(tmpPath, filePath);
-}
 export function commandExists(cmd) {
     try {
         const whichCmd = process.platform === "win32" ? "where.exe" : "which";
@@ -215,10 +209,34 @@ function validateCodexConfig(config) {
         Array.isArray(config.hooks?.UserPromptSubmit) &&
         Array.isArray(config.hooks?.Stop));
 }
+// ── mtime-based install-preferences cache (shared by readHookPreferences + readCustomHooks) ──
+const _installPrefsJsonCache = new Map();
+export function clearHookPrefsCache() {
+    _installPrefsJsonCache.clear();
+}
+function cachedReadInstallPrefsJson(phrenPath) {
+    const prefsPath = installPreferencesFile(phrenPath);
+    let mtimeMs;
+    try {
+        mtimeMs = fs.statSync(prefsPath).mtimeMs;
+    }
+    catch {
+        _installPrefsJsonCache.delete(prefsPath);
+        return null;
+    }
+    const cached = _installPrefsJsonCache.get(prefsPath);
+    if (cached && cached.mtimeMs === mtimeMs) {
+        return cached.parsed;
+    }
+    const parsed = JSON.parse(fs.readFileSync(prefsPath, "utf8"));
+    _installPrefsJsonCache.set(prefsPath, { mtimeMs, parsed });
+    return parsed;
+}
 function readHookPreferences(phrenPath) {
     try {
-        const prefsPath = installPreferencesFile(phrenPath);
-        const prefs = JSON.parse(fs.readFileSync(prefsPath, "utf8"));
+        const prefs = cachedReadInstallPrefsJson(phrenPath);
+        if (!prefs)
+            return { enabled: true, toolPrefs: {} };
         const enabled = prefs.hooksEnabled !== false;
         const toolPrefs = prefs.hookTools && typeof prefs.hookTools === "object"
             ? prefs.hookTools
@@ -250,20 +268,38 @@ const VALID_HOOK_EVENTS = new Set(HOOK_EVENT_VALUES);
 export function getHookTarget(h) {
     return "webhook" in h ? h.webhook : h.command;
 }
+/** Re-validate a command hook at execution time (mirrors mcp-hooks.ts validateHookCommand). */
+function validateCommandAtExecution(command) {
+    const trimmed = command.trim();
+    if (!trimmed)
+        return "Command cannot be empty.";
+    if (trimmed.length > 1000)
+        return "Command too long (max 1000 characters).";
+    if (/[`$(){}&|;<>]/.test(trimmed))
+        return "Command contains disallowed shell characters.";
+    if (/\b(eval|source)\b/.test(trimmed))
+        return "eval and source are not permitted in hook commands.";
+    if (!/^[\w./~"'"]/.test(trimmed))
+        return "Command must begin with an executable name or path.";
+    return null;
+}
 const DEFAULT_CUSTOM_HOOK_TIMEOUT = 5000;
 const HOOK_TIMEOUT_MS = parseInt(process.env.PHREN_HOOK_TIMEOUT_MS || '14000', 10);
 const HOOK_ERROR_LOG_MAX_LINES = 1000;
 export function readCustomHooks(phrenPath) {
     try {
-        const prefsPath = installPreferencesFile(phrenPath);
-        const prefs = JSON.parse(fs.readFileSync(prefsPath, "utf8"));
-        if (!Array.isArray(prefs.customHooks))
+        const prefs = cachedReadInstallPrefsJson(phrenPath);
+        if (!prefs || !Array.isArray(prefs.customHooks))
             return [];
-        return prefs.customHooks.filter((h) => h &&
-            typeof h.event === "string" &&
-            VALID_HOOK_EVENTS.has(h.event) &&
-            ((typeof h.command === "string" && h.command.trim().length > 0) ||
-                (typeof h.webhook === "string" && h.webhook.trim().length > 0)));
+        return prefs.customHooks.filter((h) => {
+            if (!h || typeof h !== "object")
+                return false;
+            const rec = h;
+            return (typeof rec.event === "string" &&
+                VALID_HOOK_EVENTS.has(rec.event) &&
+                ((typeof rec.command === "string" && rec.command.trim().length > 0) ||
+                    (typeof rec.webhook === "string" && rec.webhook.trim().length > 0)));
+        });
     }
     catch (err) {
         debugLog(`readCustomHooks: ${errorMessage(err)}`);
@@ -321,6 +357,14 @@ export function runCustomHooks(phrenPath, event, env = {}) {
             });
             continue;
         }
+        const cmdErr = validateCommandAtExecution(hook.command);
+        if (cmdErr) {
+            const message = `${event}: skipped hook (re-validation failed): ${cmdErr}`;
+            debugLog(`runCustomHooks: ${message}`);
+            errors.push({ code: PhrenError.VALIDATION_ERROR, message });
+            appendHookErrorLog(phrenPath, event, message);
+            continue;
+        }
         const shellArgs = isWindows ? ["/c", hook.command] : ["-c", hook.command];
         try {
             execFileSync(shellCmd, shellArgs, {

package/mcp/dist/index.js

@@ -48,13 +48,13 @@ function cleanStaleLocks(phrenPath) {
                 }
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                if ((process.env.PHREN_DEBUG))
                     process.stderr.write(`[phren] cleanStaleLocks statFile: ${errorMessage(err)}\n`);
             }
         }
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+        if ((process.env.PHREN_DEBUG))
             process.stderr.write(`[phren] cleanStaleLocks readdir: ${errorMessage(err)}\n`);
     }
 }
@@ -88,7 +88,7 @@ async function main() {
             db?.close();
         }
         catch (err) {
-            if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+            if ((process.env.PHREN_DEBUG))
                 process.stderr.write(`[phren] rebuildIndex dbClose: ${errorMessage(err)}\n`);
         }
         db = await buildIndex(phrenPath, profile);
@@ -158,7 +158,7 @@ async function main() {
                 trackToolCall(phrenPath, registeredName);
             }
             catch (err) {
-                if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+                if ((process.env.PHREN_DEBUG))
                     process.stderr.write(`[phren] trackToolCall: ${errorMessage(err)}\n`);
             }
             return handler(...args);

package/mcp/dist/init-config.js

@@ -4,27 +4,16 @@
  */
 import * as fs from "fs";
 import * as path from "path";
-import { randomUUID } from "crypto";
-import { execFileSync } from "child_process";
-import { buildLifecycleCommands } from "./hooks.js";
-import { EXEC_TIMEOUT_QUICK_MS, isRecord, hookConfigPath, homePath, readRootManifest, } from "./shared.js";
+import { buildLifecycleCommands, commandExists } from "./hooks.js";
+import { isRecord, hookConfigPath, homePath, readRootManifest, atomicWriteText, } from "./shared.js";
 import { isFeatureEnabled, errorMessage } from "./utils.js";
 import { probeVsCodeConfig, resolveCodexMcpConfig, resolveCopilotMcpConfig, resolveCursorMcpConfig, } from "./provider-adapters.js";
 import { getMcpEnabledPreference, getHooksEnabledPreference } from "./init-preferences.js";
-import { resolveEntryScript, VERSION } from "./init-shared.js";
-function log(msg) {
-    process.stdout.write(msg + "\n");
-}
+import { resolveEntryScript, log, VERSION } from "./init-shared.js";
 function getObjectProp(value, key) {
     const candidate = value[key];
     return isRecord(candidate) ? candidate : undefined;
 }
-function atomicWriteText(filePath, content) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    const tmpPath = `${filePath}.tmp-${randomUUID()}`;
-    fs.writeFileSync(tmpPath, content);
-    fs.renameSync(tmpPath, filePath);
-}
 export function patchJsonFile(filePath, patch) {
     let data = {};
     if (fs.existsSync(filePath)) {
@@ -44,16 +33,6 @@ export function patchJsonFile(filePath, patch) {
     patch(data);
     atomicWriteText(filePath, JSON.stringify(data, null, 2) + "\n");
 }
-function commandExists(cmd) {
-    try {
-        const whichCmd = process.platform === "win32" ? "where.exe" : "which";
-        execFileSync(whichCmd, [cmd], { stdio: ["ignore", "ignore", "ignore"], timeout: EXEC_TIMEOUT_QUICK_MS });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function buildMcpServerConfig(phrenPath) {
     const entryScript = resolveEntryScript();
     if (entryScript && fs.existsSync(entryScript)) {
@@ -228,7 +207,7 @@ export function configureClaude(phrenPath, opts = {}) {
                 eventHooks.push({ matcher: "", hooks: [hookBody] });
             }
         };
-        const toolHookEnabled = hooksEnabled && (isFeatureEnabled("PHREN_FEATURE_TOOL_HOOK", false) || isFeatureEnabled("PHREN_FEATURE_TOOL_HOOK", false));
+        const toolHookEnabled = hooksEnabled && isFeatureEnabled("PHREN_FEATURE_TOOL_HOOK", false);
         if (hooksEnabled) {
             upsertPhrenHook("UserPromptSubmit", {
                 type: "command",

package/mcp/dist/init-preferences.js

@@ -6,7 +6,7 @@ import * as path from "path";
 import * as crypto from "crypto";
 import { debugLog, installPreferencesFile } from "./phren-paths.js";
 import { errorMessage } from "./utils.js";
-import { withFileLock } from "./governance-locks.js";
+import { withFileLock } from "./shared-governance.js";
 function preferencesFile(phrenPath) {
     return installPreferencesFile(phrenPath);
 }

package/mcp/dist/init-setup.js

@@ -11,7 +11,7 @@ import { getMachineName } from "./machine-identity.js";
 import { execFileSync } from "child_process";
 import { GOVERNANCE_SCHEMA_VERSION, } from "./shared-governance.js";
 import { STOP_WORDS, errorMessage } from "./utils.js";
-import { ROOT, STARTER_DIR, VERSION, resolveEntryScript } from "./init-shared.js";
+import { ROOT, STARTER_DIR, VERSION, resolveEntryScript, commandVersion, versionAtLeast, nearestWritableTarget } from "./init-shared.js";
 import { readInstallPreferences } from "./init-preferences.js";
 import { TASKS_FILENAME } from "./data-tasks.js";
 import { getProjectOwnershipDefault, parseProjectOwnershipMode, readProjectConfig, writeProjectConfig, } from "./project-config.js";
@@ -311,21 +311,6 @@ export function getVerifyOutcomeNote(phrenPath, checks) {
     }
     return "Some reported issues are optional for your chosen install mode; review git-remote / MCP failures separately from hard failures.";
 }
-function commandVersion(cmd, args = ["--version"]) {
-    const effectiveCmd = process.platform === "win32" && (cmd === "npm" || cmd === "npx") ? `${cmd}.cmd` : cmd;
-    try {
-        return execFileSync(effectiveCmd, args, {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-            shell: process.platform === "win32" && effectiveCmd.endsWith(".cmd"),
-            timeout: EXEC_TIMEOUT_QUICK_MS,
-        }).trim();
-    }
-    catch (err) {
-        debugLog(`commandVersion ${effectiveCmd} failed: ${errorMessage(err)}`);
-        return null;
-    }
-}
 export function getHookEntrypointCheck(deps = {}) {
     const pathExists = deps.pathExists ?? fs.existsSync;
     const versionReader = deps.versionReader ?? commandVersion;
@@ -344,40 +329,6 @@ export function getHookEntrypointCheck(deps = {}) {
         fix: hookEntrypointOk ? undefined : "Rebuild phren: `npm run build` or reinstall the package, and ensure npm/npx is available for hook fallbacks",
     };
 }
-function parseSemverTriple(raw) {
-    const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
-    if (!match)
-        return null;
-    return [Number.parseInt(match[1], 10), Number.parseInt(match[2], 10), Number.parseInt(match[3], 10)];
-}
-function versionAtLeast(raw, major, minor = 0) {
-    if (!raw)
-        return false;
-    const parsed = parseSemverTriple(raw);
-    if (!parsed)
-        return false;
-    const [m, n] = parsed;
-    if (m !== major)
-        return m > major;
-    return n >= minor;
-}
-function nearestWritableTarget(filePath) {
-    let probe = fs.existsSync(filePath) ? filePath : path.dirname(filePath);
-    while (!fs.existsSync(probe)) {
-        const parent = path.dirname(probe);
-        if (parent === probe)
-            return false;
-        probe = parent;
-    }
-    try {
-        fs.accessSync(probe, fs.constants.W_OK);
-        return true;
-    }
-    catch (err) {
-        debugLog(`nearestWritableTarget failed for ${filePath}: ${errorMessage(err)}`);
-        return false;
-    }
-}
 function gitRemoteStatus(phrenPath) {
     try {
         execFileSync("git", ["-C", phrenPath, "rev-parse", "--is-inside-work-tree"], {
@@ -1087,14 +1038,14 @@ export function updateMachinesYaml(phrenPath, machine, profile) {
         }
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-            process.stderr.write(`[phren] updateMachinesYaml parse: ${err instanceof Error ? err.message : String(err)}\n`);
+        if ((process.env.PHREN_DEBUG))
+            process.stderr.write(`[phren] updateMachinesYaml parse: ${errorMessage(err)}\n`);
     }
     // Passive init/link refreshes should keep an existing mapping; explicit overrides can remap.
     if (hasExistingMapping && !machine && !profile)
         return;
     const mapping = setMachineProfile(phrenPath, machineName, profileName);
-    if (!mapping.ok && (process.env.PHREN_DEBUG || process.env.PHREN_DEBUG)) {
+    if (!mapping.ok && (process.env.PHREN_DEBUG)) {
         process.stderr.write(`[phren] updateMachinesYaml setMachineProfile: ${mapping.error}\n`);
     }
 }
@@ -1289,8 +1240,8 @@ export function runPostInitVerify(phrenPath) {
         ftsOk = entries.some(d => d.isDirectory() && !d.name.startsWith("."));
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
-            process.stderr.write(`[phren] runPostInitVerify projectScan: ${err instanceof Error ? err.message : String(err)}\n`);
+        if ((process.env.PHREN_DEBUG))
+            process.stderr.write(`[phren] runPostInitVerify projectScan: ${errorMessage(err)}\n`);
         ftsOk = false;
     }
     checks.push({

package/mcp/dist/init-shared.js

@@ -2,8 +2,11 @@
  * Shared constants and utilities for init modules.
  * Kept separate to avoid circular dependencies between init-config and init-setup.
  */
+import * as fs from "fs";
 import * as path from "path";
-import { homePath } from "./shared.js";
+import { execFileSync } from "child_process";
+import { homePath, EXEC_TIMEOUT_QUICK_MS, debugLog } from "./shared.js";
+import { errorMessage } from "./utils.js";
 import { ROOT as PACKAGE_ROOT, VERSION } from "./package-metadata.js";
 export const ROOT = PACKAGE_ROOT;
 export { VERSION };
@@ -15,6 +18,55 @@ export function resolveEntryScript() {
 export function log(msg) {
     process.stdout.write(msg + "\n");
 }
+export function commandVersion(cmd, args = ["--version"]) {
+    const effectiveCmd = process.platform === "win32" && (cmd === "npm" || cmd === "npx") ? `${cmd}.cmd` : cmd;
+    try {
+        return execFileSync(effectiveCmd, args, {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            shell: process.platform === "win32" && effectiveCmd.endsWith(".cmd"),
+            timeout: EXEC_TIMEOUT_QUICK_MS,
+        }).trim();
+    }
+    catch (err) {
+        debugLog(`commandVersion ${effectiveCmd} failed: ${errorMessage(err)}`);
+        return null;
+    }
+}
+export function parseSemverTriple(raw) {
+    const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
+    if (!match)
+        return null;
+    return [Number.parseInt(match[1], 10), Number.parseInt(match[2], 10), Number.parseInt(match[3], 10)];
+}
+export function versionAtLeast(raw, major, minor = 0) {
+    if (!raw)
+        return false;
+    const parsed = parseSemverTriple(raw);
+    if (!parsed)
+        return false;
+    const [m, n] = parsed;
+    if (m !== major)
+        return m > major;
+    return n >= minor;
+}
+export function nearestWritableTarget(filePath) {
+    let probe = fs.existsSync(filePath) ? filePath : path.dirname(filePath);
+    while (!fs.existsSync(probe)) {
+        const parent = path.dirname(probe);
+        if (parent === probe)
+            return false;
+        probe = parent;
+    }
+    try {
+        fs.accessSync(probe, fs.constants.W_OK);
+        return true;
+    }
+    catch (err) {
+        debugLog(`nearestWritableTarget failed for ${filePath}: ${errorMessage(err)}`);
+        return false;
+    }
+}
 export async function confirmPrompt(message) {
     if (process.env.CI === "true" || !process.stdin.isTTY)
         return true;