@prodcycle/prodcycle 0.6.8 → 0.6.10

package/dist/cli.js

@@ -558,14 +558,51 @@ async function collectHookFiles(filePath) {
     const candidate = payload?.tool_input ?? payload;
     const hookFilePath = candidate?.file_path ?? candidate?.path;
     const hookContent = candidate?.content ?? candidate?.new_string;
-    if (hookFilePath && typeof hookContent === 'string') {
-        return { files: { [hookFilePath]: hookContent }, claudeHook };
+    // Coding agents (Claude Code's PostToolUse in particular) pass the file
+    // path as an absolute path. The compliance API rejects absolute paths
+    // (`File path must be relative`), so we relativise here against cwd's
+    // realpath — same code path as `--file <path>`, just driven by the stdin
+    // payload. Without this fix every PostToolUse hook call from Claude Code
+    // failed with "File path must be relative".
+    let hookFileKey = hookFilePath;
+    if (hookFilePath && path.isAbsolute(hookFilePath)) {
+        try {
+            const realpathFile = fs.realpathSync(path.resolve(hookFilePath));
+            const realpathCwd = fs.realpathSync(process.cwd());
+            const resolved = resolveHookFileKey(hookFilePath, realpathFile, realpathCwd);
+            if (!resolved.ok) {
+                // The helper's message references `--file`; rewrite for the stdin call site.
+                console.error(resolved.error.replace('hook: --file ', 'hook: file_path '));
+                process.exit(2);
+            }
+            hookFileKey = resolved.key;
+        }
+        catch (err) {
+            // File may not exist on disk yet (e.g. a Write event mid-creation) —
+            // ONLY ENOENT triggers the lexical fallback. Re-throw permission /
+            // symlink-loop / other fs errors so a real problem isn't silently
+            // converted into a degraded lexical-only key.
+            const code = err?.code;
+            if (code !== 'ENOENT') {
+                throw err;
+            }
+            const rel = path.relative(process.cwd(), hookFilePath);
+            if (rel.startsWith('..') || path.isAbsolute(rel)) {
+                console.error(`hook: file_path ${hookFilePath} is outside the current directory ` +
+                    `(${process.cwd()}). Pass a path relative to the repo root.`);
+                process.exit(2);
+            }
+            hookFileKey = rel;
+        }
+    }
+    if (hookFileKey && typeof hookContent === 'string') {
+        return { files: { [hookFileKey]: hookContent }, claudeHook };
     }
-    if (hookFilePath && fs.existsSync(hookFilePath)) {
+    if (hookFilePath && hookFileKey && fs.existsSync(hookFilePath)) {
         // Only a path was given — read from disk so post-edit hooks still work
         // when the agent doesn't ship the content inline.
         const content = fs.readFileSync(hookFilePath, 'utf8');
-        return { files: { [hookFilePath]: content }, claudeHook };
+        return { files: { [hookFileKey]: content }, claudeHook };
     }
     console.error('hook: stdin payload not recognized. Expected one of:\n' +
         '  {"files": {"path": "content"}}\n' +

package/dist/utils/fs.js

@@ -335,7 +335,13 @@ async function collectFiles(baseDir, includePatterns, excludePatterns) {
     const files = {};
     const state = { count: 0, limitReached: false };
     walk(repoRoot, repoRoot, gitignores, prodcycleIgnores, includePatterns, excludePatterns, files, state);
-    return files;
+    // Canonical sort by path. Object iteration order is insertion order, which
+    // reflects directory-walk order — that differs between Node's `readdirSync`
+    // and Python's `os.walk`, so the two CLIs would otherwise chunk the same
+    // file set into different request shapes and the server-side per-chunk
+    // evaluation produced subtle finding divergences (CLAUDE.md "Node and
+    // Python must stay symmetric"). Sorting here makes the wire shape identical.
+    return Object.fromEntries(Object.entries(files).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
 }
 function walk(dir, repoRoot, gitignores, prodcycleIgnores, includePatterns, userExcludes, files, state) {
     if (state.limitReached)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prodcycle/prodcycle",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "Multi-framework policy-as-code compliance scanner for infrastructure and application code.",
   "homepage": "https://docs.prodcycle.com",
   "repository": {