@r1z4x/tezgah 1.9.0 → 1.11.0

package/hooks/tezgah_stopspec.py

@@ -207,7 +207,14 @@ class Trace:
         if name == "Dc":
             return self.col("U")[i] and bool(ti.DESIGN_COMPONENT.search(self.masked(i)))
         if name == "Dk":
-            return self.col("P")[i] and bool(ti.DESIGN_CHECK.search(self.masked(i)))
+            # a `slop` verdict only counts for the repository it scanned (review
+            # of plan 133, finding 5): a scan of some other tree proves nothing
+            # about this one
+            detail = self.masked(i)
+            if not (self.col("P")[i] and ti.DESIGN_CHECK.search(detail)):
+                return False
+            return (not ti.DESIGN_SLOP.search(detail)
+                    or ti._slop_row_holds(row, None))
         if name == "X":
             return (self.external is not None
                     and kind in ("run", "verify", "verify_ok", "verify_fail")

package/hooks/tezgah_task.py

@@ -547,9 +547,12 @@ def _phased(root, ident=None):
     # and allowlist would lock writes in a cloned repo (audit L-16). Only
     # positive evidence turns the rule off - the index tracks `.tezgah` -
     # never a can't-tell, which would switch the user's own guard off in
-    # silence (review R2); the answer is cached on the index's stat.
-    from tezgah_paths import workspace_tracked
-    if out and workspace_tracked(root):
+    # silence (review R2); the answer is cached on the index's stat. A
+    # repository that carries `tezgah.owner` says it outright: `tasks: off`
+    # means its plans are its own, and `harness: excluded` makes `root_for`
+    # answer None, so no caller reaches this with a root at all.
+    from tezgah_paths import tasks_disabled, workspace_tracked
+    if out and (workspace_tracked(root) or tasks_disabled(root)):
         return []
     return out
 
@@ -706,9 +709,14 @@ def phased_record(root, rel):
     if (len(parts) != 4 or "/".join(parts[:3]).casefold() != ".tezgah/plans/open"
             or not parts[3].casefold().endswith(".md")):
         return False
+    from tezgah_paths import tasks_disabled
     for name, _, text in _plan_files(root, "open"):
         if name.casefold() == parts[3].casefold():
-            return frontmatter(text).get("phase") in TASK_PHASES
+            # Read after the name matches, so an ordinary write pays no marker
+            # read. A repository that says `tasks: off` owns its plans: holding
+            # a write to one of them is the machine running there.
+            return (frontmatter(text).get("phase") in TASK_PHASES
+                    and not tasks_disabled(root))
     return False
 
 

package/hooks/tezgah_taste_ledger.py

@@ -454,7 +454,7 @@ def block(root, day=None):
     return (("Taste (learned from this user's own corrections; follow a rule, treat a "
              "hint as the default; the narrower scope wins - path, then language, then "
              "repository, then user - and AGENTS.md/CLAUDE.md beat every learning; "
-             "`tezgah-taste reject <id>` drops one):\n"
+             "`~/.config/tezgah/bin/tezgah-taste reject <id>` drops one):\n"
              + "\n".join(_line(mode, learning) for mode, learning in picked)),
             [m[1]["id"] for m in picked])
 

package/hosts/cursor/hook.py

@@ -24,7 +24,10 @@ so this adapter translates them onto the shared tezgah core:
                          ({"decision": "block", "reason": ...}, which Cursor
                          documents as an automatic follow-up - the native
                          spelling is {"followup_message": ...})
-  beforeSubmitPrompt  -> {"continue": true}
+  beforeSubmitPrompt  -> {"continue": true, "additional_context": <per-turn>}
+                         (the docs list only continue/user_message, but
+                         cursor-agent 2026.10.01-2026.10.19 forwards
+                         additional_context for this event; see CONTEXT_MAX)
 Everything else answers "{}" and never blocks.
 
 Cursor names its own tools, so `hooks.json` has to name them too: the matcher on
@@ -105,6 +108,30 @@ REINFORCE = ("tezgah contract active: keep using the code graph "
 RECOVERY = ("tezgah: tool call failed. Read the error, fix the cause, then "
             "re-run; prefer codegraph_explore/codegraph_callers over guessing "
             "at code.")
+# cursor-agent (2026.10.01-2026.10.19, bundled `HookAdditionalContextTooLargeError`)
+# trims the additional_context of beforeSubmitPrompt, preToolUse, postToolUse and
+# postToolUseFailure and drops it WHOLE when its JavaScript length - UTF-16 code
+# units, so an emoji counts two - is over 10000; a busy turn (every conditional
+# armed) measured 10288. Cutting the tail keeps the reminder and the first rules
+# instead of nothing. sessionStart is not capped: its text goes to the request
+# context (`hooksAdditionalContextPromise`) without that check, and stored Cursor
+# chats carry 15000-character session contexts whole, so the core is not cut.
+# Known limit: with a custom mode on, cursor-agent appends "\n\n" and that mode's
+# text to beforeSubmitPrompt's context before the length check; the hook cannot
+# see it, so a turn cut to exactly the limit is then dropped whole.
+CONTEXT_MAX = 10000
+CONTEXT_CUT = "\n[... cut to Cursor's %d-character hook limit]" % CONTEXT_MAX
+
+
+def fit(text):
+    """The text as Cursor will carry it: at most CONTEXT_MAX UTF-16 code units."""
+    text = text.strip()
+    data = text.encode("utf-16-le", "surrogatepass")
+    if len(data) <= 2 * CONTEXT_MAX:
+        return text
+    keep = 2 * (CONTEXT_MAX - len(CONTEXT_CUT))  # the marker is ASCII: one unit a char
+    # "ignore" drops the high half of a pair the cut split, never adding a unit
+    return data[:keep].decode("utf-16-le", "ignore") + CONTEXT_CUT
 
 
 def cwd_of(payload):
@@ -451,7 +478,7 @@ def dispatch(payload):
         text = context_for("user_prompt", cwd, payload)
         out = {"continue": True}
         if text:
-            out["additional_context"] = text
+            out["additional_context"] = fit(text)
     else:
         out = {}
     return out