@polderlabs/bizar 10.7.0 → 10.7.2

package/.claude/commands/tailscale-serve.md

@@ -0,0 +1,100 @@
+---
+description: Authenticate Tailscale Serve and expose a local port on your tailnet
+allowed-tools: Read, Bash
+---
+
+# Tailscale Serve Command
+
+Authenticate and configure Tailscale Serve to expose a local service on your
+tailnet. Auto-detects whether Serve is enabled on the tailnet and either
+provisions HTTPS automatically or surfaces the admin-enable URL clearly.
+
+## Usage
+
+```
+/tailscale-serve                 # expose port 8765 (the BizarHarness dashboard default)
+/tailscale-serve 3000            # expose port 3000
+/tailscale-serve --status        # show current serve config, no changes
+/tailscale-serve --reset         # remove the current serve config
+```
+
+The full arguments are available as `$ARGUMENTS` (and `$1` for the port).
+Parse them and route to the matching step below.
+
+## Steps
+
+1. **Parse the argument**: first arg is the port (default `8765`). If `--status`, run step 3 only. If `--reset`, run step 6 only.
+
+2. **Verify the local port is listening**:
+   ```bash
+   ss -lntp 2>/dev/null | grep -E ":${PORT}\b" || curl -sS -o /dev/null -w "HTTP %{http_code}\n" --max-time 2 http://127.0.0.1:${PORT}/
+   ```
+   If the port is not open, tell the user clearly which command starts the
+   service (e.g. `npm run host:start` for the BizarHarness demo, or
+   `python3 -m http.server 8765` for a pam static server). Do not proceed
+   without an upstream.
+
+3. **Check current Tailscale Serve status**:
+   ```bash
+   tailscale serve status
+   tailscale status --json | jq -r '.Self.DNSName, .Self.TailscaleIPs[0]'
+   ```
+   Capture the MagicDNS name and the Tailscale IP. The DNS name will look
+   like `devbox.tail2cdf4d.ts.net` (trim the trailing dot).
+
+4. **If already configured** (status shows `https://`):
+   - Print the current config
+   - Print the existing endpoints
+   - **Stop** — do not re-configure
+
+5. **Try to enable Serve** (with a hard timeout — it may try to open a browser):
+   ```bash
+   timeout 5 tailscale serve --bg --https=443 "http://127.0.0.1:${PORT}" 2>&1
+   ```
+   - **On success**: print the new config, print the `https://<dnsname>/` endpoint.
+   - **If the output contains "Serve is not enabled"**:
+     - Parse the admin-enable URL from the output (it's the
+       `https://login.tailscale.com/f/serve?node=...` line).
+     - Print it prominently with a clear message:
+       > **Tailscale Serve is not enabled on this tailnet.**
+       > An admin must visit this URL once to enable it:
+       > **<URL>**
+       > Then re-run `/tailscale-serve ${PORT}`.
+     - Do not fall back to plain HTTP automatically — the user asked for
+       authentication, not a workaround. They can run the demo's
+       `host:start` script for the HTTP fallback.
+   - **On any other error**: print the full error, suggest
+     `tailscale serve status` and `sudo tailscale up` as debug steps.
+
+6. **For `--reset`**:
+   ```bash
+   tailscale serve reset
+   ```
+   Confirm the reset succeeded by re-running `tailscale serve status`.
+
+7. **Final output** — always end with a clear status block:
+
+   ```
+   === Tailscale Serve ===
+   config:    <status>
+   upstream:  http://127.0.0.1:<port>
+   endpoints:
+     - https://<dnsname>/         (HTTPS, only if Serve is enabled)
+     - http://<dnsname>:<port>/   (HTTP fallback, only if upstream binds 0.0.0.0)
+
+   To remove: /tailscale-serve --reset
+   ```
+
+## Notes
+
+- `tailscale serve` requires a one-time tailnet admin enable. There is no
+  per-device flag — only the admin can authorize it. The command surfaces
+  the admin URL and stops rather than silently falling back.
+- This command does not start the upstream service. It assumes the service
+  is already running and only wires the HTTPS proxy.
+- For the BizarHarness Demo Dashboard, the typical flow is:
+  ```
+  /tailscale-serve --status       # see current state
+  npm run host:start              # upstream on port 8765
+  /tailscale-serve                # expose it on the tailnet
+  ```

package/.claude/commands/team.md

@@ -0,0 +1,132 @@
+---
+description: Spawn a Claude Code agent team — coordinate Thor (M2.7), Tyr (M3), Mimir (research), and Hermod (git) to complete a complex mission end-to-end.
+allowed-tools: Read, Bash, Agent
+---
+
+# Team — Spawn a Claude Code Agent Team
+
+The `/team` command spawns a **coordinated agent team** for a complex,
+multi-step mission. The lead agent coordinates teammates; each teammate
+owns a disjoint scope; results are synthesized and committed.
+
+The full mission is available as `$ARGUMENTS` (or composed from `$1`).
+
+## When to Use `/team`
+
+Use `/team` for any non-trivial mission that benefits from **parallel
+work + explicit coordination**. Examples:
+
+- **Refactor** — split a module across Thor (M2.7) and Tyr (M3) in parallel.
+- **Multi-feature build** — new feature A (Thor) + new feature B (Tyr) + tests (Heimdall).
+- **Research + implementation** — Mimir researches, Thor implements, Forseti audits.
+- **Migration / upgrade** — Hermod handles the git/PR lifecycle while Thor/Tyr write code.
+- **Bug hunt** — Mimir traces the data flow while Tyr writes the fix and tests.
+
+Do NOT use `/team` for trivial single-file edits or single-question
+clarifications. Use `@brenda` directly for those.
+
+## Default Team Composition
+
+If the user does not specify a team composition, spawn this default:
+
+| Role          | Agent   | Model             | Job                                   |
+|---------------|---------|-------------------|---------------------------------------|
+| Lead          | @mike   | minimax/MiniMax-M3   | Coordinate, synthesize, gate quality  |
+| Implementer 1 | @todd   | minimax/MiniMax-M2.7 | Moderate-complexity implementation   |
+| Implementer 2 | @karen    | minimax/MiniMax-M3   | Complex / cross-cutting work         |
+| Researcher    | @greg  | bizar/MiniMax-M3 | Codebase research, pattern discovery  |
+| Git ops       | @steve | minimax/MiniMax-M2.7 | Branch, commit, push, PR             |
+| Reviewer      | @linda| minimax/MiniMax-M3   | Audit plan + final output            |
+
+You can swap or remove any of these — but always keep at least one
+implementer and a reviewer.
+
+## Protocol (How Odin Runs a `/team` Invocation)
+
+1. **Read `.bizar/PROJECT.md`** if it exists. Factor the project
+   description into the team mission.
+2. **Read `bizar memory status`**. If the vault is reachable, run
+   `bizar memory search "<topic>"` for prior context on the mission.
+3. **Decompose** the mission into disjoint work items. Each item
+   names:
+   - The agent that owns it
+   - The file scope (paths/globs)
+   - The deliverable (a function, a test, a commit, a doc)
+   - The exit signal ("done when X is committed")
+4. **Launch in parallel** — use the **Agent tool** in a **single
+   message** with multiple `Agent` calls so all teammates run
+   concurrently. Each call's prompt names the Bizar agent
+   (`todd`, `karen`, `greg`, `steve`, `linda`) so the audit
+   trail stays readable. For long-running work, pass
+   `run_in_background: true`.
+5. **Monitor** — while the team runs, return control to the user.
+   The team runs asynchronously. Check teammate progress only
+   when the user asks (use `SendMessage` to the named agent).
+6. **Synthesize** — when teammates report back, gate through @linda
+   (audit) and @steve (commit/push). Then report the final outcome
+   to the user with file:line references.
+
+## Pre-Dispatch Checklist (MANDATORY)
+
+- [ ] Each teammate has a **disjoint file scope** — no two agents
+      edit the same file or directory
+- [ ] Lockfiles, `package.json`, root configs, `tsconfig.json`,
+      `vite.config.*`, `Dockerfile`, CI configs are assigned to ONE
+      agent or marked READ-ONLY for everyone else
+- [ ] No subagent has both `bash: allow` AND a write-level git task
+      in the same batch — Hermod is the only git writer
+- [ ] Each teammate's scope is named in plain English
+- [ ] You have prepended a one-paragraph sibling-awareness block to
+      every prompt (Odin baseline, "Parallel Dispatch Coordination")
+- [ ] You have called `bizar memory status` and confirmed the vault
+      is reachable
+
+## Example Mission Strings
+
+**Refactor a module:**
+```
+Refactor src/api/auth.ts into a clean module: extract JWT validation
+into src/auth/jwt.ts, rate-limiting into src/auth/rate-limit.ts, and
+keep the public surface stable. Add tests for each new module. Update
+docs/architecture.md with the new module map. Do not change the HTTP
+route handlers.
+```
+
+**Multi-feature build:**
+```
+Add a kanban board: (1) Thor — backend API at /api/tasks with CRUD
+endpoints and SQLite persistence. (2) Tyr — frontend React component
+in src/components/Kanban.tsx with 5 columns. (3) Heimdall — write
+the OpenAPI spec at docs/api/tasks.yaml. (4) Hermod — open a PR
+named feat/kanban-board.
+```
+
+**Bug hunt:**
+```
+Mimir — trace the data flow from POST /api/checkout through to the
+Stripe webhook handler; find any place where the order status is
+written before the payment is confirmed. Tyr — write a regression
+test that reproduces the race. Thor — fix the bug. Forseti —
+audit the fix for completeness. Hermod — commit + push.
+```
+
+## Tool Reference (Claude Code)
+
+- **Agent tool** — spawn one subagent per call. Use multiple
+  `Agent` calls in a single message for parallelism.
+- `run_in_background: true` on the Agent tool — for tasks that
+  span more than a few minutes.
+- `SendMessage` — talk to a running background agent by name.
+
+## Failure Modes
+
+- **Two agents write the same file** — STOP, revert one branch, reassign.
+- **One agent stalls** — use `TaskStop` to terminate, route the
+  remaining scope to another agent.
+- **Tests fail after team work** — dispatch `todd` to investigate;
+  do not paper over the failure.
+- **Git conflict** — route to `steve` for `git rebase` / merge
+  resolution.
+- **A teammate goes silent** — send a `SendMessage` to the named
+  agent for a status report; if dead, kill and re-spawn with a
+  fresh prompt.

package/.claude/commands/test.md

@@ -0,0 +1,62 @@
+---
+description: Run the project's test suite via the Bizar test gate. Auto-detects jest/vitest/bun/pytest/cargo/go. Exits non-zero on failure.
+allowed-tools: Read, Bash
+---
+
+# /test — Run the Project's Test Suite
+
+The `/test` command is a thin wrapper around `bizar test-gate`. It
+auto-detects the project's test runner and runs the full suite.
+
+## What It Does
+
+1. Detects the project stack (one of: npm, pytest, cargo, go).
+2. Runs the matching test command:
+   - `package.json` present → `npm test`
+   - `pyproject.toml` present → `pytest`
+   - `Cargo.toml` present → `cargo test`
+   - `go.mod` present → `go test ./...`
+3. Streams the test output to the user.
+4. Exits non-zero on test failures.
+
+## Exit Codes
+
+| Code | Meaning                          |
+|------|----------------------------------|
+| 0    | All tests passed                 |
+| 1    | Tests failed                     |
+| 2    | No test runner detected          |
+
+## How to Use
+
+Invoke `/test` from the project root. The test gate inspects the
+current directory and picks the right runner.
+
+To run a specific Bizar test scope instead, pass arguments to
+`/test`. The arguments are forwarded to the underlying runner and
+are available as `$ARGUMENTS` (or `$1`, `$2`, ...):
+
+- `/test plugins/bizar` — run only the Bizar plugin tests (bun)
+- `/test --testPathPattern=auth` — pass a flag to the runner
+
+## When to Use
+
+- After any non-trivial code change
+- Before committing (`@steve` should always run `/test` first)
+- As the final step of a `/team` mission — gate quality with tests
+
+## Common Patterns
+
+- **Post-implementation gate** — after Thor and Tyr finish their
+  parallel work, dispatch `todd` to run `/test`. If failures, fix
+  and re-run.
+- **PR check** — run `/test` in CI before merging.
+- **Debug a flaky test** — run `/test` twice; if the second run
+  passes, the test is order-dependent (fix or quarantine).
+
+## Related
+
+- `bizar test-gate` — the underlying CLI command
+- `bizar doctor` — checks the Bizar install itself (not project tests)
+- `make check` — typecheck + tests (full pipeline, dev only)
+- `make e2e` — Bizar plugin end-to-end (dev only)

package/.claude/commands/validate.md

@@ -0,0 +1,68 @@
+---
+description: Validate the Bizar install end-to-end — settings.json parses, plugin entry resolves, all agent files are installed, all skills/rules/hooks/commands are in place, provider config is sane, and the 9router gateway is reachable.
+allowed-tools: Read, Bash
+---
+
+# /validate — Validate the Bizar Install
+
+The `/validate` command runs `bizar doctor` with the full check
+battery. It is the fastest way to confirm the install is healthy
+and Claude Code will see every Bizar component on the next session
+start.
+
+## What It Checks
+
+1. **claude-reachable** — `claude --version` exits 0.
+2. **claude-config-valid** — `~/.claude/settings.json` parses as JSON.
+3. **plugin-entry-present** — `settings.json` has a Bizar plugin entry.
+4. **plugin-path-resolves** — the plugin path on disk actually exists.
+5. **agent-files-installed** — all agent files in `~/.claude/agents/`
+   (mike, janet, susan, pam, greg, brenda, steve, todd, brad,
+   karen, carl, linda, oscar, kevin).
+6. **tools-available** — at least one of `semble`, `skills`
+   is on PATH.
+7. **provider-config-sanity** — `provider.9router` has at least
+   one sane model entry.
+8. **9router-reachable** — 9Router gateway responds at
+   `http://localhost:20128/health` (lenient — warn, don't fail).
+9. **slash-commands-installed** — all Bizar slash commands
+   (`/audit`, `/explain`, `/init`, `/learn`, `/plan`, `/plow-through`,
+   `/pr-review`, `/tailscale-serve`, `/visual-plan`, `/bizar`,
+   `/team`, `/test`, `/validate`) are present in `~/.claude/commands/`.
+10. **skills-installed** — every subdir of `config/skills/` is
+    mirrored to `~/.claude/skills/`.
+11. **rules-installed** — every `.md` in `config/rules/` is mirrored
+    to `~/.claude/rules/`.
+12. **hooks-installed** — `.claude/hooks/` scripts are installed
+    with executable permissions.
+
+## How to Use
+
+Invoke `/validate` (no arguments) from anywhere. It is read-only and
+never modifies the system.
+
+If any check fails, the user should run `bizar update` to refresh the
+install, or `bizar repair` to fix common issues.
+
+## Output
+
+Each check prints ✓ or ✗ with a one-line message. The summary line
+shows the total pass/fail count. Exits non-zero if any check fails.
+
+For machine-readable output, the user can run `bizar doctor --json`
+directly.
+
+## When to Use
+
+- After a manual config edit — confirm nothing broke.
+- Before a `/team` mission — confirm the install is healthy so the
+  team has all the tools it needs.
+- After `bizar install` or `bizar update` — the install already
+  calls doctor, but a manual re-run is cheap.
+- When a user asks "why is Claude Code misbehaving?" — start here.
+
+## Related
+
+- `bizar doctor` — the underlying CLI command
+- `bizar update` — refreshes the install (re-runs syncConfigExtras)
+- `bizar repair` — fixes common issues (stale symlinks, version drift)

package/.claude/commands/visual-plan.md

@@ -0,0 +1,24 @@
+---
+description: Toggle the Bizar visual plan canvas or check its current status.
+---
+
+# /visual-plan — Toggle Visual Plan Canvas
+
+Toggle the Bizar visual plan canvas or check its current status.
+
+The full arguments are available as `$ARGUMENTS` (and `$1`).
+
+## Usage
+
+```
+/visual-plan on   — Enable the visual plan canvas in the current session
+/visual-plan off  — Disable the visual plan canvas
+/visual-plan status — Show whether the canvas is currently enabled
+```
+
+## Notes
+
+The visual plan canvas shows plans as interactive node graphs. When enabled, plan elements appear as draggable nodes on a canvas that agents can manipulate directly. This is useful for visual thinkers or when planning complex multi-step work.
+
+This is a session-level toggle — it affects the current Claude Code
+session only.

package/.claude/hooks/README.md

@@ -0,0 +1,108 @@
+# Bizar Harness — Claude Code Hooks
+
+This directory contains the **Claude Code** adapter scripts that back the
+project-scoped hooks defined in `.claude/settings.json`.
+
+They replaced the legacy Cline hooks. The Claude Code
+set is the only supported path on Bizar v6.3.0+; the legacy Cline hooks
+are no longer installed.
+
+## Adapter inventory
+
+| File | Event | Matcher | Behaviour |
+|------|-------|---------|-----------|
+| `pretooluse-editwrite.mjs`   | `PreToolUse`       | `Write\|Edit\|MultiEdit\|Bash` | Blocks `.env`/secrets/lockfiles; warns on `console.log`/`debugger`/`.only()` in `src/`; scans `Bash` against the 36-pattern dangerous-pattern list |
+| `posttooluse-editwrite.mjs`  | `PostToolUse`      | `Edit\|Write\|MultiEdit`        | Logs edit/write latency + size to `~/.config/bizar/hook-logs/` |
+| `sessionstart-prime.mjs`     | `SessionStart`     | (none — branches on `source`)  | Reads PROGRESS.md + feature_list.json + git log + .bizar/PROJECT.md; branches on `startup`/`clear`/`resume`; WIP=1 guard |
+| `thinking-route.mjs`         | `UserPromptSubmit` | (none)                          | Slash-command routing (team/plow-through/test/validate/plan/audit/pr-review) + 35-bucket thinking-* mental-model router |
+| `worker-suggest.mjs`        | `UserPromptSubmit` | (none)                          | Calls `cli/worker-dispatcher.mjs:dispatch()` against `config/trigger-patterns.json` |
+| `sessionend-recall.mjs`      | `SessionEnd`       | (none)                          | Reads `transcript_path`; writes `.bizar/sessions/<date>-<id>.md` + `.bizar/session-state.json` handoff |
+
+## SessionStart ↔ SessionEnd handoff
+
+The two lifecycle hooks form a state machine via the `.bizar/session-state.json`
+file:
+
+```
+SessionEnd (session N)
+  ↓ writes .bizar/session-state.json with {nextStep, blockers, filesTouched}
+SessionStart (session N+1, source: "resume")
+  ↑ reads it; primes the agent with "Last nextStep: …" + blockers
+```
+
+If `.bizar/session-state.json` is missing, the resume branch degrades
+gracefully to "No prior session-state.json found — treating as fresh start."
+
+## I/O contract
+
+Claude Code invokes each hook as a child process, pipes JSON on
+**stdin**, and reads JSON on **stdout**. The five adapters above all
+read using `process.stdin` and write a single JSON object to
+`process.stdout`.
+
+### Stdin (varies by event)
+
+```jsonc
+// PreToolUse
+{
+  "session_id": "...",
+  "transcript_path": "...",
+  "cwd": "/home/drb0rk/Projects/BizarHarness",
+  "hook_event_name": "PreToolUse",
+  "tool_name": "Write",
+  "tool_input": { "file_path": "/path", "content": "..." }
+}
+
+// PostToolUse  (adds tool_response)
+// UserPromptSubmit  (uses .user_prompt instead of .tool_name/.tool_input)
+// SessionStart  (uses .source = "startup" | "resume" | "clear")
+// SessionEnd  (uses .reason = "exit" | "clear" | "logout" | "prompt_input_exit")
+```
+
+### Stdout
+
+```jsonc
+// Block (PreToolUse only)
+{
+  "hookSpecificOutput": {
+    "hookEventName": "PreToolUse",
+    "permissionDecision": "deny",
+    "permissionDecisionReason": "..."
+  }
+}
+
+// Inject context for the next turn (all events)
+{
+  "hookSpecificOutput": {
+    "hookEventName": "PostToolUse",   // or PreToolUse / SessionStart / UserPromptSubmit
+    "additionalContext": "..."
+  }
+}
+```
+
+For a non-blocking `PreToolUse`, omitting `permissionDecision` and
+emitting only `additionalContext` is a soft hint to the model — the
+tool call still proceeds.
+
+## Claude Code lifecycle mapping
+
+The legacy Cline plugin used four separate events (PreToolUse,
+PostToolUse, TaskStart, TaskResume, UserPromptSubmit). Claude Code
+collapses "task start" and "task resume" into a single `SessionStart`
+event that branches on `source` (`startup`, `resume`, `clear`). The
+adapter `sessionstart-prime.mjs` reads `source` and applies the
+appropriate priming logic for each branch.
+
+## Disabling an individual hook
+
+Easiest path: comment out the matching `hooks` array entry in
+`.claude/settings.json`. Removing the executable bit
+(`chmod -x …`) also works — Claude Code silently skips hooks it can't
+execute.
+
+## See also
+
+- `cli/provision-claude.mjs` — installs Claude Code hooks to
+  `~/.claude/hooks/` and wires them via `~/.claude/settings.json`.
+- `.claude/settings.json` — the project hook wiring
+- `.bizar/session-state.json` — handoff artifact between SessionEnd and SessionStart

package/.claude/hooks/__tests__/pretooluse-editwrite.test.mjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+// Test suite for .claude/hooks/pretooluse-editwrite.mjs
+//
+// Invokes the hook with a synthetic Claude Code PreToolUse payload over
+// stdin, captures stdout, and asserts on `permissionDecision`.
+//
+// Run:  node --test .claude/hooks/__tests__/pretooluse-editwrite.test.mjs
+
+'use strict';
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const HOOK = path.resolve(__dirname, '..', 'pretooluse-editwrite.mjs');
+
+function runHook(toolName, filePath) {
+  const payload = JSON.stringify({
+    session_id: 'test-session',
+    cwd: '/tmp',
+    hook_event_name: 'PreToolUse',
+    tool_name: toolName,
+    tool_input: toolName === 'Write'
+      ? { file_path: filePath, content: '' }
+      : toolName === 'Edit'
+        ? { file_path: filePath, new_string: '' }
+        : { file_path: filePath, edits: [] },
+  });
+  const result = spawnSync('node', [HOOK], { input: payload, encoding: 'utf8' });
+  if (result.status !== 0) {
+    throw new Error(`hook exited ${result.status}\nstderr: ${result.stderr}`);
+  }
+  const out = result.stdout.trim();
+  if (!out || out === '{}') return { decision: null, context: null };
+  const parsed = JSON.parse(out);
+  return {
+    decision: parsed.hookSpecificOutput?.permissionDecision ?? null,
+    reason: parsed.hookSpecificOutput?.permissionDecisionReason ?? null,
+    context: parsed.hookSpecificOutput?.additionalContext ?? null,
+  };
+}
+
+test('Write .env → deny', () => {
+  const r = runHook('Write', '/repo/.env');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write .env.local → deny', () => {
+  const r = runHook('Write', '/repo/.env.local');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write .env.production → deny', () => {
+  const r = runHook('Write', '/repo/.env.production');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write .envrc → deny', () => {
+  const r = runHook('Write', '/repo/.envrc');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write .env.example → allow (docs)', () => {
+  const r = runHook('Write', '/repo/research/gstack/.env.example');
+  assert.notEqual(r.decision, 'deny');
+  assert.match(r.context, /Bizar PreToolUse/);
+});
+
+test('Write .env.sample → allow (docs)', () => {
+  const r = runHook('Write', '/repo/templates/.env.sample');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write .env.template → allow (docs)', () => {
+  const r = runHook('Write', '/repo/templates/deploy/docker/.env.template');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write secrets/api.json → deny', () => {
+  const r = runHook('Write', '/repo/secrets/api.json');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write credentials/x.json → deny', () => {
+  const r = runHook('Write', '/repo/credentials/x.json');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write node_modules/x.js → deny', () => {
+  const r = runHook('Write', '/repo/node_modules/x.js');
+  assert.equal(r.decision, 'deny');
+});
+
+test('Write bun.lock → allow (package-manager output)', () => {
+  const r = runHook('Write', '/repo/bun.lock');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write bun.lockb → allow (binary lock variant)', () => {
+  const r = runHook('Write', '/repo/bun.lockb');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write package-lock.json → allow (package-manager output)', () => {
+  const r = runHook('Write', '/repo/package-lock.json');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write yarn.lock → allow', () => {
+  const r = runHook('Write', '/repo/yarn.lock');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write pnpm-lock.yaml → allow', () => {
+  const r = runHook('Write', '/repo/pnpm-lock.yaml');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Write src/index.ts → allow + neutral context', () => {
+  const r = runHook('Write', '/repo/src/index.ts');
+  assert.notEqual(r.decision, 'deny');
+  assert.match(r.context, /tool=Write/);
+  assert.match(r.context, /path=\/repo\/src\/index\.ts/);
+  // No debug-artifact warning in the hook context line anymore.
+  assert.doesNotMatch(r.context, /console\.log/);
+  assert.doesNotMatch(r.context, /Heads up/);
+});
+
+test('Edit .env → deny (same rule applies to Edit)', () => {
+  const r = runHook('Edit', '/repo/.env');
+  assert.equal(r.decision, 'deny');
+});
+
+test('MultiEdit .env.example → allow (docs)', () => {
+  const r = runHook('MultiEdit', '/repo/.env.example');
+  assert.notEqual(r.decision, 'deny');
+});
+
+test('Unknown tool → no decision (silent pass)', () => {
+  const r = runHook('Bash', '/repo/.env');
+  // PreToolUse:Bash is handled by a separate hook — this one is a no-op.
+  assert.equal(r.decision, null);
+});