@praxisflux/gates 0.61.0 → 0.61.1

package/codebase-to-course/lib/gate-runner.mjs

@@ -18,6 +18,14 @@
 //
 // Contract (Claude Code Stop hook): stdin is JSON with { stop_hook_active, session_id, cwd, … };
 // exit 0 = allow the model to stop; exit 2 = block, and stderr becomes the message it sees.
+//
+// Root resolution in evaluate() (spec 062), most specific first: explicit { cwd } option ->
+// $CLAUDE_PROJECT_DIR -> input.cwd -> process.cwd(). An explicit argument is a caller naming a
+// directory on purpose and must never be silently overridden by an ambient variable. The env
+// var still outranks input.cwd: it's the harness's authoritative statement of the project root,
+// while input.cwd is merely where the hook happened to fire (a worktree, a subdir, wherever the
+// session sat). The only production caller, runStopHook below, passes no cwd, so this ordering
+// is byte-identical to before for the real Stop-hook path.
 
 /** Read all of stdin as a string (empty string on a TTY, so it's safe to run by hand). */
 export function readStdin() {
@@ -34,9 +42,9 @@ export function readStdin() {
  * Pure core: given the parsed hook input and the gates, return { block, message }.
  * Separated from process I/O so it is unit-testable.
  */
-export function evaluate(input, gates, { cwd = process.cwd() } = {}) {
+export function evaluate(input, gates, { cwd = undefined } = {}) {
   if (input && input.stop_hook_active === true) return { block: false, message: "", warnings: "" };
-  const start = process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || cwd;
+  const start = cwd || process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || process.cwd();
   const ctx = {
     sessionId: (input && input.session_id) || process.env.CLAUDE_CODE_SESSION_ID || null,
     input: input || {},

package/grounding-wiki/lib/gate-runner.mjs

@@ -18,6 +18,14 @@
 //
 // Contract (Claude Code Stop hook): stdin is JSON with { stop_hook_active, session_id, cwd, … };
 // exit 0 = allow the model to stop; exit 2 = block, and stderr becomes the message it sees.
+//
+// Root resolution in evaluate() (spec 062), most specific first: explicit { cwd } option ->
+// $CLAUDE_PROJECT_DIR -> input.cwd -> process.cwd(). An explicit argument is a caller naming a
+// directory on purpose and must never be silently overridden by an ambient variable. The env
+// var still outranks input.cwd: it's the harness's authoritative statement of the project root,
+// while input.cwd is merely where the hook happened to fire (a worktree, a subdir, wherever the
+// session sat). The only production caller, runStopHook below, passes no cwd, so this ordering
+// is byte-identical to before for the real Stop-hook path.
 
 /** Read all of stdin as a string (empty string on a TTY, so it's safe to run by hand). */
 export function readStdin() {
@@ -34,9 +42,9 @@ export function readStdin() {
  * Pure core: given the parsed hook input and the gates, return { block, message }.
  * Separated from process I/O so it is unit-testable.
  */
-export function evaluate(input, gates, { cwd = process.cwd() } = {}) {
+export function evaluate(input, gates, { cwd = undefined } = {}) {
   if (input && input.stop_hook_active === true) return { block: false, message: "", warnings: "" };
-  const start = process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || cwd;
+  const start = cwd || process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || process.cwd();
   const ctx = {
     sessionId: (input && input.session_id) || process.env.CLAUDE_CODE_SESSION_ID || null,
     input: input || {},

package/lib/gate-runner.mjs

@@ -18,6 +18,14 @@
 //
 // Contract (Claude Code Stop hook): stdin is JSON with { stop_hook_active, session_id, cwd, … };
 // exit 0 = allow the model to stop; exit 2 = block, and stderr becomes the message it sees.
+//
+// Root resolution in evaluate() (spec 062), most specific first: explicit { cwd } option ->
+// $CLAUDE_PROJECT_DIR -> input.cwd -> process.cwd(). An explicit argument is a caller naming a
+// directory on purpose and must never be silently overridden by an ambient variable. The env
+// var still outranks input.cwd: it's the harness's authoritative statement of the project root,
+// while input.cwd is merely where the hook happened to fire (a worktree, a subdir, wherever the
+// session sat). The only production caller, runStopHook below, passes no cwd, so this ordering
+// is byte-identical to before for the real Stop-hook path.
 
 /** Read all of stdin as a string (empty string on a TTY, so it's safe to run by hand). */
 export function readStdin() {
@@ -34,9 +42,9 @@ export function readStdin() {
  * Pure core: given the parsed hook input and the gates, return { block, message }.
  * Separated from process I/O so it is unit-testable.
  */
-export function evaluate(input, gates, { cwd = process.cwd() } = {}) {
+export function evaluate(input, gates, { cwd = undefined } = {}) {
   if (input && input.stop_hook_active === true) return { block: false, message: "", warnings: "" };
-  const start = process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || cwd;
+  const start = cwd || process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || process.cwd();
   const ctx = {
     sessionId: (input && input.session_id) || process.env.CLAUDE_CODE_SESSION_ID || null,
     input: input || {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praxisflux/gates",
-  "version": "0.61.0",
+  "version": "0.61.1",
   "description": "praxisflux gate checks as a zero-dependency CLI (spec-bridge, wiki-freshness, course) — status can't exceed proven artifacts",
   "license": "MIT",
   "repository": {

package/spec-bridge/lib/gate-runner.mjs

@@ -18,6 +18,14 @@
 //
 // Contract (Claude Code Stop hook): stdin is JSON with { stop_hook_active, session_id, cwd, … };
 // exit 0 = allow the model to stop; exit 2 = block, and stderr becomes the message it sees.
+//
+// Root resolution in evaluate() (spec 062), most specific first: explicit { cwd } option ->
+// $CLAUDE_PROJECT_DIR -> input.cwd -> process.cwd(). An explicit argument is a caller naming a
+// directory on purpose and must never be silently overridden by an ambient variable. The env
+// var still outranks input.cwd: it's the harness's authoritative statement of the project root,
+// while input.cwd is merely where the hook happened to fire (a worktree, a subdir, wherever the
+// session sat). The only production caller, runStopHook below, passes no cwd, so this ordering
+// is byte-identical to before for the real Stop-hook path.
 
 /** Read all of stdin as a string (empty string on a TTY, so it's safe to run by hand). */
 export function readStdin() {
@@ -34,9 +42,9 @@ export function readStdin() {
  * Pure core: given the parsed hook input and the gates, return { block, message }.
  * Separated from process I/O so it is unit-testable.
  */
-export function evaluate(input, gates, { cwd = process.cwd() } = {}) {
+export function evaluate(input, gates, { cwd = undefined } = {}) {
   if (input && input.stop_hook_active === true) return { block: false, message: "", warnings: "" };
-  const start = process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || cwd;
+  const start = cwd || process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || process.cwd();
   const ctx = {
     sessionId: (input && input.session_id) || process.env.CLAUDE_CODE_SESSION_ID || null,
     input: input || {},