@r1z4x/tezgah 1.11.0 → 1.14.0

package/hosts/omp/tezgah-hook.ts.in

@@ -301,6 +301,68 @@ function labelled(content: any, label: string): any {
   return undefined;
 }
 
+// The calls one omp tool call carries, as the core names them (B-010). omp
+// routes an MCP call through its device tool - `write` to `xd://mcp__<name>`
+// with the call's arguments as JSON in `content` - and the core's MCP rules,
+// the MCP_EFFECT spawn filter and the Stop rule's `external` row are keyed on
+// the real name, so the device form is read as `mcp__<name>` with the parsed
+// arguments (an unparsable body stays readable as `content`). The URL is
+// matched the way omp resolves it: trimmed, the scheme in any case. `ast_edit`
+// (direct or as `xd://ast_edit`) only stages its rewrite and omp applies it
+// later through `write xd://resolve`, so the gate reads its targets here: one
+// `edit` per `paths` item, the ops' replacement text as the new content, marked
+// `via: "ast_edit"` - only such an item is read as a glob or a directory.
+// `outer` keeps the device `write` itself in front, for the gate only: its
+// content rules (a credential, a skip) read the whole body whatever class the
+// carried call is, as they did before the route (review 153 F1). The gate
+// writes no `began` for it (tezgah_gate.ROUTED_DEVICE): its result is recorded
+// as the call it carries.
+const DEVICE = /^xd:\/\/(mcp__[^/?#]+|ast_edit)$/i;
+function deviceOf(tool: string, args: any): RegExpExecArray | null {
+  return tool.toLowerCase() === "write" ? DEVICE.exec(String(args?.path ?? "").trim()) : null;
+}
+function routed(tool: string, args: any, outer = false): Array<[string, any]> {
+  let name = tool;
+  let input = args ?? {};
+  const device = deviceOf(name, input);
+  const calls: Array<[string, any]> = device && outer ? [[name, input]] : [];
+  if (device) {
+    name = device[1].toLowerCase() === "ast_edit" ? "ast_edit"
+      : "mcp__" + device[1].slice("mcp__".length);
+    const raw = String(input?.content ?? "");
+    try {
+      const parsed = JSON.parse(raw);
+      input = parsed && typeof parsed === "object" ? parsed : { content: raw };
+    } catch {
+      input = { content: raw };
+    }
+  }
+  if (name.toLowerCase() !== "ast_edit") return [...calls, [name, input]];
+  const ops = Array.isArray(input?.ops) ? input.ops : [];
+  const out = ops.map((op: any) => String(op?.out ?? "")).join("\n");
+  const paths = Array.isArray(input?.paths) ? input.paths : [];
+  return [...calls, ...paths.map((p: any): [string, any] =>
+    ["edit", { path: String(p), new_string: out, via: "ast_edit" }])];
+}
+
+// omp emits a device call and then, under the same id, the native event of the
+// call it carries: the device event leaves one key per carried call it passed
+// and that native event consumes it, so a row, a label and a retry count are
+// written once (review 153 F4). Nothing else is skipped: a direct call leaves
+// no key, and a reused id, an empty one or a refused call reaches the gate and
+// the ledger again (review 153 round 2 #1). ponytail: the newest 512 keys.
+const CARRIED = { call: new Set<string>(), result: new Set<string>() };
+function carriedKey(id: any, tool: string, input: any): string | null {
+  if (id == null || id === "") return null;
+  return `${id}:${tool.toLowerCase()}:${String(input?.path ?? "")}`;
+}
+function carry(seen: Set<string>, keys: string[]): void {
+  for (const key of keys) {
+    seen.add(key);
+    if (seen.size > 512) seen.delete(seen.values().next().value as string);
+  }
+}
+
 // A check's own output saying it ran nothing: the same literal as
 // hooks/tezgah_integrity.py `EMPTY_RUN` (tests/test_omp_extension.py pins the
 // two equal), read here because the bridge sends the hook a size and never the
@@ -315,6 +377,22 @@ function emptyRun(content: any): boolean {
   return EMPTY_RUN.test(text.slice(-EMPTY_RUN_TAIL));
 }
 
+// The text of one assistant message, whatever shape it arrives in: omp hands
+// `session_stop` the message OBJECT its `getLastAssistantMessage()` returns,
+// and the core must judge the prose, never its `str()` (plan 143). A thinking
+// or tool block is not the reply: only `type: "text"` is.
+function textOf(message: any): string | undefined {
+  if (typeof message === "string") return message;
+  if (typeof message?.content === "string") return message.content;
+  if (Array.isArray(message?.content)) {
+    // joined and trimmed exactly as the core does (`reply_prose`), so the two
+    // never hand the rule a different text for one reply
+    return message.content.map((p: any) => (p?.type === "text" && typeof p.text === "string"
+                                            ? p.text : "")).join("\n").trim();
+  }
+  return undefined;
+}
+
 // The text of the newest assistant message in an agent_end `messages` list:
 // the subagent's final report, which the hook reads like a Stop reply.
 function lastReply(messages: any): string | undefined {
@@ -322,11 +400,8 @@ function lastReply(messages: any): string | undefined {
   for (let i = messages.length - 1; i >= 0; i--) {
     const m = messages[i];
     if (m?.role !== "assistant") continue;
-    if (typeof m.content === "string") return m.content;
-    if (Array.isArray(m.content)) {
-      return m.content.map((p: any) => (p?.type === "text" && typeof p.text === "string"
-                                        ? p.text : "")).join("\n");
-    }
+    const text = textOf(m);
+    if (text !== undefined) return text;
   }
   return undefined;
 }
@@ -460,6 +535,13 @@ function isSubagent(ctx: any): boolean {
   }
 }
 
+// A subagent's events name the main session as `parent`, as its session_start
+// does: the switch latch counts from the earlier of the two sessions' first
+// rows, so a switch the parent made mid-session holds no sway here (B-036).
+function parentOf(ctx: any): string | undefined {
+  return isSubagent(ctx) ? process.env.TEZGAH_SESSION || undefined : undefined;
+}
+
 // The session an omp fork was forked from: a main session whose header still
 // names a `parentSession` (an id, or a `<stamp>_<id>.jsonl` path). The hook
 // writes it as a `forked` row, so the race rule names a fork as one instead of
@@ -575,7 +657,8 @@ export default function tezgahOmp(pi: any): void {
   // A failed hook answers nothing, so the last good line would keep claiming a
   // gate that is not running: the widget is repainted with the failure instead.
   const refresh = (ctx: any): void => {
-    const res = ask({ event: "status", cwd: cwdOf(ctx), session_id: sessionOf(ctx) });
+    const res = ask({ event: "status", cwd: cwdOf(ctx), session_id: sessionOf(ctx),
+                      parent: parentOf(ctx) });
     if (hookError) return markBroken(ctx);
     show(ctx, res);
   };
@@ -706,7 +789,7 @@ export default function tezgahOmp(pi: any): void {
     // `subagent`: a task prompt is the parent's brief, never the user's grant
     const res = ask({ event: "user_prompt", cwd: cwdOf(ctx), prompt,
                       session_id: session, transcript_path: sessionFileOf(ctx),
-                      subagent: isSubagent(ctx) });
+                      subagent: isSubagent(ctx), parent: parentOf(ctx) });
     if (hookError) return noticeMessage(ctx, session);
     if (!res.context) return undefined;
     // A hidden message, not a system-prompt rewrite: omp keeps per-request
@@ -717,38 +800,44 @@ export default function tezgahOmp(pi: any): void {
   });
 
   pi.on("tool_call", async (event: any, ctx: any) => {
-    const tool = String(event?.toolName ?? event?.name ?? "");
     // An MCP tool is named per server (`mcp__<server>_<tool>`), so no exact
     // list can hold it: an effect verb in the name reaches the gate, whose
-    // content rules read its payload (tezgah_integrity.mcp_class).
-    if (!GATED.includes(tool.toLowerCase()) && !MCP_EFFECT.test(tool)) {
-      return undefined;
-    }
-    const res = ask({ event: "pre_tool_use", cwd: cwdOf(ctx), tool,
-                      input: event?.input ?? event?.args ?? {},
-                      session_id: sessionOf(ctx) });
-    if (hookError) {
-      markBroken(ctx);
-      return undefined;  // a hook that cannot answer cannot refuse either
-    }
-    if (res.deny) return { block: true, reason: res.deny };
-    if (res.advice && event?.toolCallId != null) {
-      ADVICE.set(String(event.toolCallId), String(res.advice));
+    // content rules read its payload (tezgah_integrity.mcp_class). A device
+    // call is judged as itself and as the call it carries (`routed`), and the
+    // native event of a carried call it passed is not asked twice (`CARRIED`).
+    const callId = event?.toolCallId;
+    const name = String(event?.toolName ?? event?.name ?? "");
+    const args = event?.input ?? event?.args ?? {};
+    const device = deviceOf(name, args) != null;
+    const carried: string[] = [];
+    for (const [n, [tool, input]] of routed(name, args, true).entries()) {
+      if (!GATED.includes(tool.toLowerCase()) && !MCP_EFFECT.test(tool)) continue;
+      const key = carriedKey(callId, tool, input);
+      if (device) {
+        if (n > 0 && key) carried.push(key);  // the device `write` itself is first
+      } else if (key && CARRIED.call.delete(key)) {
+        continue;
+      }
+      const res = ask({ event: "pre_tool_use", cwd: cwdOf(ctx), tool, input,
+                        session_id: sessionOf(ctx), parent: parentOf(ctx) });
+      if (hookError) {
+        markBroken(ctx);
+        return undefined;  // a hook that cannot answer cannot refuse either
+      }
+      if (res.deny) return { block: true, reason: res.deny };
+      if (res.advice && event?.toolCallId != null) {
+        ADVICE.set(String(event.toolCallId), String(res.advice));
+      }
     }
+    carry(CARRIED.call, carried);
     return undefined;
   });
 
   pi.on("tool_result", async (event: any, ctx: any) => {
-    const tool = String(event?.toolName ?? "");
-    const args = event?.input ?? {};
     const id = event?.toolCallId != null ? String(event.toolCallId) : "";
     const advice = ADVICE.get(id);
     ADVICE.delete(id);
     const graph = advice ? { additionalContext: advice } : undefined;
-    if (!WATCHED.includes(tool.toLowerCase()) && !tool.startsWith("mcp__")
-        && !skillRead(tool, args)) {
-      return graph;
-    }
     // Tri-state: an unread outcome must never be written as a passed check,
     // because the Stop rule below reads this ledger as evidence.
     const failed = typeof event?.isError === "boolean" ? event.isError : null;
@@ -762,18 +851,34 @@ export default function tezgahOmp(pi: any): void {
     const content = event?.content;
     const resultLen = typeof content === "string" ? content.length
       : Array.isArray(content) ? content.length : undefined;
-    // omp's todo call holds one op and its result's `details.phases` the whole
-    // list, so that list crosses for this one tool: the queue the Stop rule and
-    // the idle-wait warning read (tezgah_integrity.note_todo).
-    const phases = tool.toLowerCase() === "todo" ? event?.details?.phases : undefined;
-    const todo = Array.isArray(phases)
-      ? phases.flatMap((p: any) => (Array.isArray(p?.tasks) ? p.tasks : []))
-      : undefined;
-    const res = ask({ event: "post_tool_use", cwd: cwdOf(ctx), tool,
-                      input: event?.input ?? {}, failed, idx: idxGlyph,
-                      session_id: sessionOf(ctx), result_len: resultLen,
-                      empty_run: emptyRun(content) || undefined, todo });
-    if (hookError) return markBroken(ctx);
+    let res: any;
+    // a device call is recorded as the call it carries (`routed`): an MCP
+    // query's answer is an `external` row, never an edit of `xd://...`
+    const name = String(event?.toolName ?? "");
+    const input = event?.input ?? {};
+    const device = deviceOf(name, input) != null;
+    for (const [tool, args] of routed(name, input)) {
+      if (!WATCHED.includes(tool.toLowerCase()) && !tool.startsWith("mcp__")
+          && !skillRead(tool, args)) {
+        continue;
+      }
+      const key = carriedKey(event?.toolCallId, tool, args);
+      if (!device && key && CARRIED.result.delete(key)) continue;
+      // omp's todo call holds one op and its result's `details.phases` the whole
+      // list, so that list crosses for this one tool: the queue the Stop rule and
+      // the idle-wait warning read (tezgah_integrity.note_todo).
+      const phases = tool.toLowerCase() === "todo" ? event?.details?.phases : undefined;
+      const todo = Array.isArray(phases)
+        ? phases.flatMap((p: any) => (Array.isArray(p?.tasks) ? p.tasks : []))
+        : undefined;
+      res = ask({ event: "post_tool_use", cwd: cwdOf(ctx), tool,
+                  input: args, failed, idx: idxGlyph,
+                  session_id: sessionOf(ctx), parent: parentOf(ctx), result_len: resultLen,
+                  empty_run: emptyRun(content) || undefined, todo });
+      if (hookError) return markBroken(ctx);
+      if (device && key) carry(CARRIED.result, [key]);
+    }
+    if (!res) return graph;
     show(ctx, res);
     // A result that came from outside the user and the workspace is labelled in
     // place; every other result is left exactly as the host produced it.
@@ -785,9 +890,19 @@ export default function tezgahOmp(pi: any): void {
   });
 
   pi.on("session_stop", async (event: any, ctx: any) => {
+    // `sessionModes` exists only in an interactive TUI session; its `plan`
+    // state is what every other host sends as `permission_mode`, so the core
+    // reads one field (tezgah_integrity.read_only_turn). A session without it
+    // (print, RPC, a subagent) sends nothing and is judged as `default`.
+    let mode: string | undefined;
+    try {
+      mode = ctx?.sessionModes?.getState?.()?.plan === "active" ? "plan" : undefined;
+    } catch { mode = undefined; }
     const res = ask({ event: "stop", cwd: cwdOf(ctx), session_id: sessionOf(ctx),
-                      last_assistant_message: event?.last_assistant_message,
-                      stop_hook_active: event?.stop_hook_active === true });
+                      last_assistant_message: textOf(event?.last_assistant_message)
+                                              ?? lastReply(event?.messages),
+                      stop_hook_active: event?.stop_hook_active === true,
+                      permission_mode: mode });
     if (hookError) {
       markBroken(ctx);
       return undefined;  // an unanswerable Stop rule must not block the turn