@rness/cli 0.9.2 → 0.10.0

package/dist/{chunk-JKDF7ROY.js → chunk-R4BRAAC2.js}

@@ -558,8 +558,8 @@ async function getOrgMembership(org, options) {
   }
   if (status2 === 404) return "not-member";
   if (status2 === 403) {
-    const message = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
-    if (/OAuth App access restrictions/i.test(message)) return "restricted";
+    const message2 = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
+    if (/OAuth App access restrictions/i.test(message2)) return "restricted";
   }
   return "unknown";
 }
@@ -581,8 +581,8 @@ async function createRepository(owner, name, options) {
       throw new Error(`cannot reach the GitHub API: ${reason2(e)}`, { cause: e });
     }
     const body = await res.json().catch(() => void 0);
-    const message = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
-    return { status: res.status, message };
+    const message2 = body !== null && typeof body === "object" ? String(body["message"] ?? "") : "";
+    return { status: res.status, message: message2 };
   };
   let answer = await post2(`/orgs/${encodeURIComponent(owner)}/repos`);
   if (answer.status === 404 && options.self !== void 0 && options.self !== null && options.self.toLowerCase() === owner.toLowerCase())
@@ -775,9 +775,9 @@ async function originUrl(dir) {
 async function init(dir) {
   await git(["init", "-q", "-b", "main"], dir);
 }
-async function commitAll(dir, message) {
+async function commitAll(dir, message2) {
   await git(["add", "-A"], dir);
-  await git(["commit", "-q", "-m", message], dir);
+  await git(["commit", "-q", "-m", message2], dir);
 }
 
 // src/core/remote.ts
@@ -812,7 +812,7 @@ function classifyProbe(url, exitCode, stderr) {
 var STDERR_FLUSH_MS = 200;
 async function probeRemote(url, timeoutMs = 6e4, credentials) {
   positional(url, "repository url");
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const auth = withCredentials(credentials);
     const child = spawn(
       "git",
@@ -831,7 +831,7 @@ async function probeRemote(url, timeoutMs = 6e4, credentials) {
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve7(probe);
+      resolve8(probe);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -876,8 +876,8 @@ function isWorkspaceClone(name) {
 var NAME_RULE = "lowercase letters, digits, '.', '_' and '-', not starting with '-'";
 var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
 var KEYS = ["contract", "org", "agents", "repos", "scopes"];
-function fail(message) {
-  throw new Error(`rness.json: ${message}`);
+function fail(message2) {
+  throw new Error(`rness.json: ${message2}`);
 }
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -1263,7 +1263,7 @@ async function detectGithubSsh(opts) {
     ...opts.interactive ? [] : ["-o", "BatchMode=yes"],
     "git@github.com"
   ];
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = spawn2(opts.command ?? "ssh", args, {
       stdio: [opts.interactive ? "inherit" : "ignore", "ignore", "pipe"]
     });
@@ -1276,7 +1276,7 @@ async function detectGithubSsh(opts) {
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve7(access2);
+      resolve8(access2);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -1397,15 +1397,15 @@ function reportError(e) {
     process.stderr.write(`${e.stack}
 `);
   } else {
-    const message = e instanceof Error ? e.message : String(e);
-    process.stderr.write(`${paint("error", message, process.stderr)}
+    const message2 = e instanceof Error ? e.message : String(e);
+    process.stderr.write(`${paint("error", message2, process.stderr)}
 `);
   }
   return 1;
 }
 
 // src/version.ts
-var VERSION = "0.9.2";
+var VERSION = "0.10.0";
 
 // src/core/block.ts
 import { createHash } from "crypto";
@@ -1473,8 +1473,8 @@ function isCurrentBlock(blockLines, freshHash) {
 // src/core/frontmatter.ts
 import { parse as parse2 } from "yaml";
 var FRONT_MATTER = /^---\r?\n(?:([\s\S]*?)\r?\n)?---(?:\r?\n|$)/;
-function fail2(message) {
-  throw new Error(`front matter: ${message}`);
+function fail2(message2) {
+  throw new Error(`front matter: ${message2}`);
 }
 function stripBom(source) {
   return source.startsWith("\uFEFF") ? source.slice(1) : source;
@@ -1706,6 +1706,46 @@ import { mkdir as mkdir2 } from "fs/promises";
 import { dirname as dirname4, join as join9 } from "path";
 
 // src/core/agents.ts
+var PINNED_BIN = "node_modules/@rness/cli/dist/bin/rness.js";
+function hookLine(rness, event) {
+  const run3 = `f="$CLAUDE_PROJECT_DIR/${rness}/${PINNED_BIN}"; if [ -f "$f" ]; then node "$f" hook ${event};`;
+  if (event === "post-tool-use") return `${run3} fi`;
+  const missing = JSON.stringify({
+    systemMessage: `rness: ${rness} is not installed, so the workspace context is not loaded. Clone the workspace, then install its dependencies in .rness.`
+  });
+  return `${run3} else echo '${missing}'; fi`;
+}
+function hooks(rness) {
+  return [
+    {
+      path: ["hooks", "SessionStart"],
+      contains: {
+        hooks: [
+          {
+            type: "command",
+            command: hookLine(rness, "session-start"),
+            timeout: 10
+          }
+        ]
+      },
+      label: "the rness session-start hook"
+    },
+    {
+      path: ["hooks", "PostToolUse"],
+      contains: {
+        matcher: "Edit|Write",
+        hooks: [
+          {
+            type: "command",
+            command: hookLine(rness, "post-tool-use"),
+            timeout: 10
+          }
+        ]
+      },
+      label: "the rness post-tool-use hook"
+    }
+  ];
+}
 var TARGETS = {
   claude: {
     name: "claude",
@@ -1713,6 +1753,7 @@ var TARGETS = {
     files: [
       {
         file: ".claude/settings.json",
+        at: "clones",
         guarantees: [
           // Read the context repository from a repository without a prompt.
           // Resolved against the project directory, and applied once Claude
@@ -1720,11 +1761,13 @@ var TARGETS = {
           {
             path: ["permissions", "additionalDirectories"],
             contains: "../../.rness"
-          }
+          },
+          ...hooks("../../.rness")
         ]
       },
       {
         file: ".mcp.json",
+        at: "clones",
         guarantees: [
           // The pinned copy, by a path relative to the repository — the
           // directory Claude Code starts the server in (spec 0014 §6). Not
@@ -1742,6 +1785,13 @@ var TARGETS = {
             }
           }
         ]
+      },
+      // A session opened at the workspace root reads this file, one opened
+      // in a clone does not (spec 0011 §1): the hooks only, `.rness` inside.
+      {
+        file: ".claude/settings.json",
+        at: "root",
+        guarantees: hooks(".rness")
       }
     ]
   }
@@ -1755,6 +1805,7 @@ function unsupportedMessage(name) {
 }
 
 // src/core/json-guarantees.ts
+import { isDeepStrictEqual } from "util";
 function isObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1798,14 +1849,15 @@ function apply(root, g, create) {
   }
   if (value === void 0) {
     if (!create) return { holds: false, changed: false };
-    parent[last] = [g.contains];
+    parent[last] = [structuredClone(g.contains)];
     return { holds: true, changed: true };
   }
   if (!Array.isArray(value))
     return { invalid: `${g.path.join(".")} is not a list` };
-  if (value.includes(g.contains)) return { holds: true, changed: false };
+  if (value.some((entry) => isDeepStrictEqual(entry, g.contains)))
+    return { holds: true, changed: false };
   if (!create) return { holds: false, changed: false };
-  value.push(g.contains);
+  value.push(structuredClone(g.contains));
   return { holds: true, changed: true };
 }
 function styleOf(text) {
@@ -1849,21 +1901,33 @@ function missingGuarantees(existing, guarantees) {
   return missing;
 }
 function describeGuarantee(g) {
-  return "value" in g ? `${g.path.join(".")} is missing` : `${g.path.join(".")} lacks ${g.contains}`;
+  if ("value" in g) return `${g.path.join(".")} is missing`;
+  const what = g.label ?? (typeof g.contains === "string" ? g.contains : JSON.stringify(g.contains));
+  return `${g.path.join(".")} lacks ${what}`;
 }
 
 // src/core/agent-targets.ts
 async function filesOf(root, manifest, targets) {
   const files = [];
+  if (!await exists(join9(root, "org"))) return files;
+  for (const target of targets)
+    for (const owned of target.files)
+      if (owned.at === "root")
+        files.push({
+          guarantees: owned.guarantees,
+          file: join9(root, ...owned.file.split("/")),
+          label: owned.file
+        });
   for (const repo of Object.keys(manifest.repos)) {
     if (!await exists(join9(root, "org", repo))) continue;
     for (const target of targets)
       for (const owned of target.files)
-        files.push({
-          guarantees: owned.guarantees,
-          file: join9(root, "org", repo, ...owned.file.split("/")),
-          label: `org/${repo}/${owned.file}`
-        });
+        if (owned.at === "clones")
+          files.push({
+            guarantees: owned.guarantees,
+            file: join9(root, "org", repo, ...owned.file.split("/")),
+            label: `org/${repo}/${owned.file}`
+          });
   }
   return files;
 }
@@ -1876,7 +1940,9 @@ var BLOCK_FILES = ["AGENTS.md", "CLAUDE.md"];
 function writtenFiles(manifest) {
   return [
     ...BLOCK_FILES,
-    ...declared(manifest).flatMap((t) => t.files.map((f) => f.file))
+    ...declared(manifest).flatMap(
+      (t) => t.files.filter((f) => f.at === "clones").map((f) => f.file)
+    )
   ];
 }
 async function agentTargets(root, manifest, opts) {
@@ -2064,8 +2130,8 @@ function sessionUi(p) {
     intro: (title) => {
       p.intro(badge(title));
     },
-    outro: (message, tone = "done") => {
-      p.outro(badge(message, tone));
+    outro: (message2, tone = "done") => {
+      p.outro(badge(message2, tone));
     },
     line: (verb, rest, sentence) => {
       say(verb, sentence ?? `${rest} ${verb}`);
@@ -3240,13 +3306,13 @@ function scaffoldMessage(subject, version) {
 
 ${SCAFFOLD_TRAILER}: ${version}`;
 }
-async function commitUpgrade(rnessDir, message) {
+async function commitUpgrade(rnessDir, message2) {
   const add = await run(rnessDir, ["add", "-A"]);
   if (add.code !== 0) return { kind: "refused", output: add.stderr.trim() };
   const staged = await run(rnessDir, ["diff", "--cached", "--quiet"]);
   if (staged.code === 0 && !await mergeInProgress(rnessDir))
     return { kind: "nothing" };
-  const commit = await run(rnessDir, ["commit", "-q", "-m", message]);
+  const commit = await run(rnessDir, ["commit", "-q", "-m", message2]);
   if (commit.code !== 0)
     return {
       kind: "refused",
@@ -3767,9 +3833,9 @@ async function cloneSelection(input) {
       manifest = result.manifest;
       ui.line("declared", `scope ${result.name} (org/${result.name})`);
     } catch (e) {
-      const message = firstLine4(e instanceof Error ? e.message : String(e));
-      ui.error(`${spec}: ${message}`);
-      failures.push({ spec, message });
+      const message2 = firstLine4(e instanceof Error ? e.message : String(e));
+      ui.error(`${spec}: ${message2}`);
+      failures.push({ spec, message: message2 });
     }
   }
   return failures;
@@ -4262,36 +4328,89 @@ ${next2.map((l) => `  ${l}`).join("\n")}
   }
 }
 
-// src/commands/logout.ts
-async function logoutCommand() {
-  try {
-    const stored = await readAuth();
-    await clearAuth();
-    const undone = await removeGitSetup().catch(() => false);
-    if (stored === null && !undone) {
-      process.stdout.write("not logged in\n");
-      return 0;
+// src/core/blocks.ts
+import { join as join20 } from "path";
+var PROBLEM = /* @__PURE__ */ new Set(["stale", "malformed"]);
+async function checkBlocks({
+  root,
+  rnessDir,
+  manifest,
+  org
+}) {
+  const checks = [];
+  const note = (label, status2, message2 = null) => {
+    checks.push({ label, status: status2, message: message2 });
+  };
+  const derive = () => ({
+    problems: checks.filter((c) => PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
+    warnings: checks.filter((c) => !PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
+    checks
+  });
+  if (!await exists(join20(root, "org"))) return derive();
+  const targets = [
+    { scope: null, dir: root, depth: 0, file: "AGENTS.md", label: "AGENTS.md" },
+    { scope: null, dir: root, depth: 0, file: "CLAUDE.md", label: "CLAUDE.md" }
+  ];
+  for (const [name, entry] of Object.entries(manifest.scopes)) {
+    const segments = entry.path.split("/");
+    targets.push({
+      scope: name,
+      dir: join20(root, ...segments),
+      depth: segments.length,
+      file: "AGENTS.md",
+      label: `${entry.path}/AGENTS.md`
+    });
+  }
+  for (const t of targets) {
+    if (!await exists(t.dir)) {
+      note(
+        t.label,
+        "missing-dir",
+        `${t.label}: directory not present, block not checked`
+      );
+      continue;
     }
-    if (stored !== null)
-      process.stdout.write(
-        `${status("logged out", `${stored.login} (github.com)`)}
-`
+    const text = await readOrNull(join20(t.dir, t.file));
+    const lines = text === null ? [] : text.split(/\r?\n/);
+    const found = findBlock(lines);
+    if (found.kind === "none") {
+      note(
+        t.label,
+        "no-block",
+        `${t.label}: no rness block yet (run ${rnessCommand()} sync)`
       );
-    if (undone)
-      process.stdout.write(
-        `${status("updated", "git: rness no longer answers for https://github.com")}
-`
+      continue;
+    }
+    if (found.kind === "error") {
+      note(t.label, "malformed", `${t.label}: ${found.message}`);
+      continue;
+    }
+    const context2 = await assembleContext({
+      rnessDir,
+      manifest,
+      scope: t.scope
+    });
+    const fresh2 = renderBlock({
+      scope: t.scope,
+      org,
+      depth: t.depth,
+      context: context2
+    });
+    const pointerLeft = t.file === "CLAUDE.md" && lines.some((l) => l.trim() === "@AGENTS.md");
+    if (isCurrentBlock(lines.slice(found.begin, found.end + 1), fresh2.hash) && !pointerLeft)
+      note(t.label, "current");
+    else
+      note(
+        t.label,
+        "stale",
+        `${t.label}: stale rness block (run ${rnessCommand()} sync)`
       );
-    process.stdout.write(`revoke rness on GitHub: ${revokeUrl()}
-`);
-    return 0;
-  } catch (e) {
-    return reportError(e);
   }
+  return derive();
 }
 
 // src/core/contract.ts
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var STATUSES = {
   adr: ["Proposed", "Accepted", "Rejected", "Superseded"],
   specs: [
@@ -4310,7 +4429,7 @@ async function checkContract(rnessDir) {
   const problems = [];
   for (const name of COLLECTIONS) {
     const allowed = STATUSES[name];
-    const items = await collectMarkdown(join20(rnessDir, name));
+    const items = await collectMarkdown(join21(rnessDir, name));
     for (const item of items) {
       const where = `${name}/${item.rel}`;
       if (SKIP.has(where)) continue;
@@ -4346,11 +4465,39 @@ async function checkContract(rnessDir) {
   return problems;
 }
 
+// src/commands/logout.ts
+async function logoutCommand() {
+  try {
+    const stored = await readAuth();
+    await clearAuth();
+    const undone = await removeGitSetup().catch(() => false);
+    if (stored === null && !undone) {
+      process.stdout.write("not logged in\n");
+      return 0;
+    }
+    if (stored !== null)
+      process.stdout.write(
+        `${status("logged out", `${stored.login} (github.com)`)}
+`
+      );
+    if (undone)
+      process.stdout.write(
+        `${status("updated", "git: rness no longer answers for https://github.com")}
+`
+      );
+    process.stdout.write(`revoke rness on GitHub: ${revokeUrl()}
+`);
+    return 0;
+  } catch (e) {
+    return reportError(e);
+  }
+}
+
 // src/commands/upgrade.ts
 import { execFile as execFile6 } from "child_process";
 import { mkdtemp as mkdtemp3, readFile as readFile9, rm as rm7 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename5, join as join21, relative as relative5 } from "path";
+import { basename as basename5, join as join22, relative as relative5 } from "path";
 import { promisify as promisify6 } from "util";
 var execFileP6 = promisify6(execFile6);
 var NOTES = "https://github.com/rness-dev/rness/tree/main/packages/cli#readme";
@@ -4370,10 +4517,10 @@ async function latestVersion() {
 async function scaffoldFor(version, rnessDir) {
   if (version === VERSION) return { dir: scaffoldDir() };
   const installed = await readPinnedCli(rnessDir);
-  const inside = installed === null ? null : join21(installed.dir, "scaffold");
-  if (installed?.version === version && inside !== null && await exists(join21(inside, "package.json")))
-    return { dir: inside };
-  const scratch = await mkdtemp3(join21(tmpdir3(), "rness-pack-"));
+  const inside2 = installed === null ? null : join22(installed.dir, "scaffold");
+  if (installed?.version === version && inside2 !== null && await exists(join22(inside2, "package.json")))
+    return { dir: inside2 };
+  const scratch = await mkdtemp3(join22(tmpdir3(), "rness-pack-"));
   const cleanup = () => rm7(scratch, { recursive: true, force: true });
   try {
     const { stdout } = await execFileP6(
@@ -4388,8 +4535,8 @@ async function scaffoldFor(version, rnessDir) {
       { timeout: 6e4 }
     );
     const tarball = stdout.trim().split("\n").at(-1) ?? "";
-    await execFileP6("tar", ["-xzf", join21(scratch, tarball), "-C", scratch]);
-    return { dir: join21(scratch, "package", "scaffold"), cleanup };
+    await execFileP6("tar", ["-xzf", join22(scratch, tarball), "-C", scratch]);
+    return { dir: join22(scratch, "package", "scaffold"), cleanup };
   } catch (e) {
     await cleanup();
     throw new Error(
@@ -4401,7 +4548,7 @@ async function scaffoldFor(version, rnessDir) {
 async function declaredManager(rnessDir, pm) {
   try {
     const pkg = JSON.parse(
-      await readFile9(join21(rnessDir, "package.json"), "utf8")
+      await readFile9(join22(rnessDir, "package.json"), "utf8")
     );
     if (typeof pkg.packageManager === "string") return pkg.packageManager;
   } catch {
@@ -4412,7 +4559,7 @@ async function clonesToCommit(root, cwd, manifest) {
   const files = writtenFiles(manifest);
   const clones = [];
   for (const repo of Object.keys(manifest.repos)) {
-    const dir = join21(root, "org", repo);
+    const dir = join22(root, "org", repo);
     if (!await exists(dir)) continue;
     try {
       const paths = await changedPaths(dir, files);
@@ -4425,14 +4572,14 @@ async function clonesToCommit(root, cwd, manifest) {
 }
 function finish(ui, cwd, rnessDir, label, target, ending) {
   const rel = relative5(cwd, rnessDir) || ".";
-  const message = `chore: rness ${target}`;
+  const message2 = `chore: rness ${target}`;
   const next = [];
   if (ending.commit === "committed") next.push(`git -C ${rel} push`);
   if (ending.commit === "refused")
-    next.push(`git -C ${rel} commit -m "${message}"`);
+    next.push(`git -C ${rel} commit -m "${message2}"`);
   for (const c of ending.clones)
     next.push(
-      `git -C ${c.dir} add ${c.paths.join(" ")} && git -C ${c.dir} commit -m "${message}"`
+      `git -C ${c.dir} add ${c.paths.join(" ")} && git -C ${c.dir} commit -m "${message2}"`
     );
   if (ending.commit !== "nothing")
     next.push("# teammates: git pull \u2014 the next rness command installs it");
@@ -4605,7 +4752,7 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
         await source.cleanup?.();
       }
     }
-    const packageFile = join21(ws.rnessDir, "package.json");
+    const packageFile = join22(ws.rnessDir, "package.json");
     const restore = /* @__PURE__ */ new Map([
       [packageFile, await readFile9(packageFile, "utf8")]
     ]);
@@ -4621,8 +4768,8 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
           () => ["installed", `dependencies with ${pm}`]
         );
       } catch (e) {
-        const message2 = e instanceof Error ? e.message : String(e);
-        ui.error(message2);
+        const message3 = e instanceof Error ? e.message : String(e);
+        ui.error(message3);
         if (!merged) {
           for (const [file, text] of restore) await writeFileAtomic(file, text);
           ui.hint(
@@ -4635,7 +4782,7 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
             `the scaffold merge is still staged; undo it with: git -C ${relative5(cwd, ws.rnessDir) || "."} merge --abort`,
             "stderr"
           );
-        if (/minimum.?release.?age|NO_MATURE/i.test(message2))
+        if (/minimum.?release.?age|NO_MATURE/i.test(message3))
           ui.hint(
             "pnpm refuses versions published less than 24 h ago: add '@rness/cli' under minimumReleaseAgeExclude in .rness/pnpm-workspace.yaml",
             "stderr"
@@ -4654,13 +4801,13 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
     ui.gitIsSilent = true;
     const code = await syncBlocks(ui, ws.root, basename5(ws.root));
     if (code !== 0) return code;
-    const message = `chore: rness ${target}`;
-    const committed = await commitUpgrade(ws.rnessDir, message);
+    const message2 = `chore: rness ${target}`;
+    const committed = await commitUpgrade(ws.rnessDir, message2);
     if (committed.kind === "committed")
       ui.line(
         "committed",
-        `${label} \u2014 ${message}`,
-        `Committed ${label}: ${message}`
+        `${label} \u2014 ${message2}`,
+        `Committed ${label}: ${message2}`
       );
     if (committed.kind === "refused") {
       ui.error(
@@ -4682,85 +4829,28 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal, deps =
   }
 }
 
-// src/core/blocks.ts
-import { join as join22 } from "path";
-var PROBLEM = /* @__PURE__ */ new Set(["stale", "malformed"]);
-async function checkBlocks({
-  root,
-  rnessDir,
-  manifest,
-  org
-}) {
-  const checks = [];
-  const note = (label, status2, message = null) => {
-    checks.push({ label, status: status2, message });
-  };
-  const derive = () => ({
-    problems: checks.filter((c) => PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
-    warnings: checks.filter((c) => !PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
-    checks
+// src/core/check-workspace.ts
+async function checkWorkspace(ws, manifest) {
+  for (const s of Object.keys(manifest.scopes)) scopeChain(manifest, s);
+  const problems = await checkContract(ws.rnessDir);
+  const blocks = await checkBlocks({
+    root: ws.root,
+    rnessDir: ws.rnessDir,
+    manifest,
+    org: workspaceName(manifest, ws.root)
   });
-  if (!await exists(join22(root, "org"))) return derive();
-  const targets = [
-    { scope: null, dir: root, depth: 0, file: "AGENTS.md", label: "AGENTS.md" },
-    { scope: null, dir: root, depth: 0, file: "CLAUDE.md", label: "CLAUDE.md" }
-  ];
-  for (const [name, entry] of Object.entries(manifest.scopes)) {
-    const segments = entry.path.split("/");
-    targets.push({
-      scope: name,
-      dir: join22(root, ...segments),
-      depth: segments.length,
-      file: "AGENTS.md",
-      label: `${entry.path}/AGENTS.md`
-    });
-  }
-  for (const t of targets) {
-    if (!await exists(t.dir)) {
-      note(
-        t.label,
-        "missing-dir",
-        `${t.label}: directory not present, block not checked`
-      );
-      continue;
-    }
-    const text = await readOrNull(join22(t.dir, t.file));
-    const lines = text === null ? [] : text.split(/\r?\n/);
-    const found = findBlock(lines);
-    if (found.kind === "none") {
-      note(
-        t.label,
-        "no-block",
-        `${t.label}: no rness block yet (run ${rnessCommand()} sync)`
-      );
-      continue;
-    }
-    if (found.kind === "error") {
-      note(t.label, "malformed", `${t.label}: ${found.message}`);
-      continue;
-    }
-    const context2 = await assembleContext({
-      rnessDir,
-      manifest,
-      scope: t.scope
-    });
-    const fresh2 = renderBlock({
-      scope: t.scope,
-      org,
-      depth: t.depth,
-      context: context2
-    });
-    const pointerLeft = t.file === "CLAUDE.md" && lines.some((l) => l.trim() === "@AGENTS.md");
-    if (isCurrentBlock(lines.slice(found.begin, found.end + 1), fresh2.hash) && !pointerLeft)
-      note(t.label, "current");
-    else
-      note(
-        t.label,
-        "stale",
-        `${t.label}: stale rness block (run ${rnessCommand()} sync)`
+  problems.push(...blocks.problems);
+  for (const name of unsupportedAgents(manifest.agents ?? []))
+    problems.push(unsupportedMessage(name));
+  const targets = await agentTargets(ws.root, manifest, { check: true });
+  for (const o of targets)
+    if (o.status === "stale")
+      problems.push(
+        `${o.label}: ${o.detail ?? ""} (run ${rnessCommand()} sync)`
       );
-  }
-  return derive();
+    else if (o.status === "invalid")
+      problems.push(`${o.label}: ${o.detail ?? "unreadable"}`);
+  return { problems, blocks, targets };
 }
 
 // src/commands/validate.ts
@@ -4769,26 +4859,8 @@ async function validateCommand(opts, deps = {}) {
   try {
     const ws = await findWorkspace(cwd);
     const manifest = await loadManifest(ws.rnessDir);
-    for (const s of Object.keys(manifest.scopes)) scopeChain(manifest, s);
     const org = workspaceName(manifest, ws.root);
-    const problems = await checkContract(ws.rnessDir);
-    const blocks = await checkBlocks({
-      root: ws.root,
-      rnessDir: ws.rnessDir,
-      manifest,
-      org
-    });
-    problems.push(...blocks.problems);
-    for (const name of unsupportedAgents(manifest.agents ?? []))
-      problems.push(unsupportedMessage(name));
-    const targets = await agentTargets(ws.root, manifest, { check: true });
-    for (const o of targets)
-      if (o.status === "stale")
-        problems.push(
-          `${o.label}: ${o.detail ?? ""} (run ${rnessCommand()} sync)`
-        );
-      else if (o.status === "invalid")
-        problems.push(`${o.label}: ${o.detail ?? "unreadable"}`);
+    const { problems, blocks, targets } = await checkWorkspace(ws, manifest);
     const scaffoldWarnings = [];
     if (await isRepository2(ws.rnessDir) && !await isShallow(ws.rnessDir)) {
       const pin = await readPin(ws.rnessDir);
@@ -4865,134 +4937,9 @@ password=${resolved.token}
   return 0;
 }
 
-// src/commands/mcp.ts
-import { createInterface } from "readline";
-
-// src/mcp/protocol.ts
-var MODERN_VERSIONS = ["2026-07-28"];
-var LEGACY_VERSIONS = [
-  "2025-11-25",
-  "2025-06-18",
-  "2025-03-26",
-  "2024-11-05"
-];
-var SUPPORTED = [...MODERN_VERSIONS, ...LEGACY_VERSIONS];
-var VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
-var CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
-var SERVER_INFO_KEY = "io.modelcontextprotocol/serverInfo";
-function isObject2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function errorLine(id, code, message, data) {
-  return JSON.stringify({
-    jsonrpc: "2.0",
-    id,
-    error: data === void 0 ? { code, message } : { code, message, data }
-  });
-}
-function createProtocol(opts) {
-  const serverInfo = { name: opts.name, version: opts.version };
-  return {
-    async handle(line2) {
-      let message;
-      try {
-        message = JSON.parse(line2);
-      } catch {
-        return errorLine(null, -32700, "Parse error");
-      }
-      const rawId = isObject2(message) ? message["id"] : void 0;
-      const id = typeof rawId === "string" || typeof rawId === "number" ? rawId : null;
-      if (!isObject2(message) || message["jsonrpc"] !== "2.0" || typeof message["method"] !== "string")
-        return errorLine(id, -32600, "Invalid Request");
-      if (!("id" in message)) return null;
-      if (id === null) return errorLine(null, -32600, "Invalid Request");
-      const method = message["method"];
-      const params = isObject2(message["params"]) ? message["params"] : {};
-      const meta = isObject2(params["_meta"]) ? params["_meta"] : null;
-      const modern = meta !== null && typeof meta[VERSION_KEY] === "string";
-      if (modern) {
-        const requested = meta[VERSION_KEY];
-        if (!MODERN_VERSIONS.includes(requested))
-          return errorLine(id, -32022, "Unsupported protocol version", {
-            supported: SUPPORTED,
-            requested
-          });
-        if (!isObject2(meta[CAPABILITIES_KEY]))
-          return errorLine(
-            id,
-            -32602,
-            `Invalid params: ${CAPABILITIES_KEY} is required`
-          );
-      }
-      const answer = (result) => JSON.stringify({
-        jsonrpc: "2.0",
-        id,
-        result: modern ? {
-          resultType: "complete",
-          ...result,
-          _meta: { [SERVER_INFO_KEY]: serverInfo }
-        } : result
-      });
-      switch (method) {
-        case "server/discover":
-          return answer({
-            supportedVersions: SUPPORTED,
-            capabilities: { tools: {} }
-          });
-        case "initialize": {
-          const asked = params["protocolVersion"];
-          const protocolVersion = typeof asked === "string" && LEGACY_VERSIONS.includes(asked) ? asked : LEGACY_VERSIONS[0];
-          return JSON.stringify({
-            jsonrpc: "2.0",
-            id,
-            result: {
-              protocolVersion,
-              capabilities: { tools: {} },
-              serverInfo
-            }
-          });
-        }
-        case "ping":
-          return answer({});
-        case "tools/list":
-          return answer({
-            tools: opts.tools.map((t) => ({
-              name: t.name,
-              title: t.title,
-              description: t.description,
-              inputSchema: t.inputSchema
-            }))
-          });
-        case "tools/call": {
-          const name = params["name"];
-          const tool = opts.tools.find((t) => t.name === name);
-          if (tool === void 0)
-            return errorLine(id, -32602, `Unknown tool: ${String(name)}`);
-          const args = isObject2(params["arguments"]) ? params["arguments"] : {};
-          try {
-            const r = await tool.call(args);
-            return answer({
-              content: [{ type: "text", text: r.text }],
-              isError: r.isError === true
-            });
-          } catch (e) {
-            return answer({
-              content: [
-                {
-                  type: "text",
-                  text: `${tool.name} failed: ${e instanceof Error ? e.message : String(e)}`
-                }
-              ],
-              isError: true
-            });
-          }
-        }
-        default:
-          return errorLine(id, -32601, "Method not found");
-      }
-    }
-  };
-}
+// src/commands/hook.ts
+import { realpath as realpath4 } from "fs/promises";
+import { isAbsolute as isAbsolute2, posix as posix5, relative as relative7, resolve as resolve7, sep as sep5 } from "path";
 
 // src/mcp/tools.ts
 import { readFile as readFile10, realpath as realpath3, stat as stat4 } from "fs/promises";
@@ -5073,21 +5020,31 @@ async function context(cwd, args) {
       manifest,
       relative6(ws.root, cwd).split(sep4).join(posix4.sep)
     );
+  const summary = await scopeSummary(ws, manifest, scope);
+  return {
+    text: [
+      ...summary.lines,
+      "Read one with rness_read; search with rness_search."
+    ].join("\n")
+  };
+}
+async function scopeSummary(ws, manifest, scope) {
   const entry = scope === null ? void 0 : manifest.scopes[scope];
   const where = scope === null || entry === void 0 ? "global scope" : `scope ${scope} (${entry.path}${entry.extends.length > 0 ? `, extends ${entry.extends.join(", ")}` : ""})`;
   const ctx = await assembleContext({ rnessDir: ws.rnessDir, manifest, scope });
   const index = new Map(
     (await documents(ws.rnessDir)).map((d) => [d.path, d])
   );
-  const out = [`Workspace ${workspaceName(manifest, ws.root)} \xB7 ${where}`];
+  const lines = [`Workspace ${workspaceName(manifest, ws.root)} \xB7 ${where}`];
+  const counts = {};
   for (const collection of ctx.collections) {
     const docs = collection.files.map((f) => index.get(`${collection.name}/${f.rel}`)).filter((d) => d !== void 0);
     if (docs.length === 0) continue;
-    out.push(`${LABELS[collection.name]} (${docs.length}):`);
-    for (const d of docs) out.push(line(d));
+    counts[collection.name] = docs.length;
+    lines.push(`${LABELS[collection.name]} (${docs.length}):`);
+    for (const d of docs) lines.push(line(d));
   }
-  out.push("Read one with rness_read; search with rness_search.");
-  return { text: out.join("\n") };
+  return { where, counts, lines };
 }
 async function list(cwd, args) {
   const { ws } = await workspaceAt(cwd);
@@ -5248,6 +5205,285 @@ function mcpTools(cwd) {
   ];
 }
 
+// src/commands/hook.ts
+var NOUNS = {
+  standards: ["standard", "standards"],
+  adr: ["decision", "decisions"],
+  specs: ["specification", "specifications"],
+  plans: ["plan", "plans"],
+  skills: ["skill", "skills"]
+};
+var SHOWN_PROBLEMS = 3;
+async function readInput(input) {
+  if (input.isTTY === true) return {};
+  let text = "";
+  for await (const chunk of input) text += String(chunk);
+  try {
+    const data = JSON.parse(text);
+    return data !== null && typeof data === "object" && !Array.isArray(data) ? data : {};
+  } catch {
+    return {};
+  }
+}
+var message = (e) => e instanceof Error ? e.message : String(e);
+function cwdOf(input, env) {
+  const cwd = input["cwd"];
+  if (typeof cwd === "string" && cwd !== "") return cwd;
+  return env["CLAUDE_PROJECT_DIR"] ?? process.cwd();
+}
+var toPosix2 = (p) => p.split(sep5).join(posix5.sep);
+function count(n, [one, many]) {
+  return `${n} ${n === 1 ? one : many}`;
+}
+async function safetyNet(ws, manifest) {
+  const notes = [];
+  const drift = await pinDrift(ws.rnessDir);
+  if (drift !== null)
+    notes.push(
+      `.rness pins @rness/cli ${drift.pin} but ${drift.installed ?? "nothing"} is installed \u2014 run ${await workspacePackageManager(ws.rnessDir)} install in .rness`
+    );
+  try {
+    const { problems } = await checkWorkspace(ws, manifest);
+    if (problems.length > 0)
+      notes.push(
+        `${count(problems.length, ["problem", "problems"])} in the workspace context \u2014 run rness validate`,
+        ...problems.slice(0, SHOWN_PROBLEMS).map((p) => `  ${p}`)
+      );
+  } catch (e) {
+    notes.push(message(e));
+  }
+  return notes;
+}
+async function sessionStart(input, env) {
+  const cwd = cwdOf(input, env);
+  let banner2 = null;
+  let context2 = [];
+  let notes;
+  try {
+    const ws = await findWorkspace(cwd);
+    const manifest = await loadManifest(ws.rnessDir);
+    const scope = resolveScope(manifest, toPosix2(relative7(ws.root, cwd)));
+    const summary = await scopeSummary(ws, manifest, scope);
+    const counts = COLLECTIONS.flatMap((c) => {
+      const n = summary.counts[c];
+      return n === void 0 ? [] : [count(n, NOUNS[c])];
+    });
+    banner2 = `rness ${VERSION} \xB7 ${workspaceName(manifest, ws.root)} \xB7 ${scope === null ? "global scope" : `scope ${scope}`} \u2014 ${counts.length === 0 ? "nothing applies yet" : counts.join(", ")}`;
+    const at = toPosix2(relative7(cwd, ws.rnessDir)) || ".rness";
+    context2 = [
+      ...summary.lines,
+      `These documents are in ${at}: read one there, or with rness_read when the rness MCP server is connected.`
+    ];
+    notes = await safetyNet(ws, manifest);
+  } catch (e) {
+    notes = [message(e)];
+  }
+  const warnings = notes.map((n) => `rness: ${n}`);
+  const shown = [
+    ...banner2 !== null && input["source"] !== "compact" ? [banner2] : [],
+    ...warnings
+  ];
+  return {
+    ...shown.length > 0 ? { systemMessage: shown.join("\n") } : {},
+    hookSpecificOutput: {
+      hookEventName: "SessionStart",
+      additionalContext: [...context2, ...warnings].join("\n")
+    }
+  };
+}
+function inside(from, to) {
+  const rel = relative7(from, to);
+  return rel === "" || rel.startsWith("..") || isAbsolute2(rel) ? null : toPosix2(rel);
+}
+async function postToolUse(input, io) {
+  const toolInput = input["tool_input"];
+  const path = toolInput !== null && typeof toolInput === "object" ? toolInput["file_path"] : void 0;
+  if (typeof path !== "string" || path === "") return 0;
+  const cwd = cwdOf(input, io.env);
+  let ws;
+  try {
+    ws = await findWorkspace(cwd);
+  } catch {
+    return 0;
+  }
+  const file = resolve7(cwd, path);
+  const rel = inside(ws.rnessDir, file) ?? inside(
+    await realpath4(ws.rnessDir).catch(() => ws.rnessDir),
+    await realpath4(file).catch(() => file)
+  );
+  if (rel === null) return 0;
+  const first = rel.split("/")[0] ?? "";
+  let problems = [];
+  if (rel === "rness.json") {
+    try {
+      const manifest = await loadManifest(ws.rnessDir);
+      for (const s of Object.keys(manifest.scopes)) scopeChain(manifest, s);
+    } catch (e) {
+      problems = [message(e)];
+    }
+  } else if (COLLECTIONS.includes(first) && rel.endsWith(".md"))
+    problems = (await checkContract(ws.rnessDir)).filter(
+      (p) => p.startsWith(`${rel}:`)
+    );
+  if (problems.length === 0) return 0;
+  io.error.write(
+    [
+      ...problems.map((p) => `rness: ${p}`),
+      `Fix it in ${rel}; rness validate checks the whole workspace.`,
+      ""
+    ].join("\n")
+  );
+  return 2;
+}
+async function hookCommand(event, io = {
+  input: process.stdin,
+  output: process.stdout,
+  error: process.stderr,
+  env: process.env
+}) {
+  if (event !== "session-start" && event !== "post-tool-use") {
+    io.error.write(
+      `unknown hook event ${JSON.stringify(event)} (known: session-start, post-tool-use)
+`
+    );
+    return 1;
+  }
+  const input = await readInput(io.input);
+  if (event === "post-tool-use") return postToolUse(input, io);
+  io.output.write(`${JSON.stringify(await sessionStart(input, io.env))}
+`);
+  return 0;
+}
+
+// src/commands/mcp.ts
+import { createInterface } from "readline";
+
+// src/mcp/protocol.ts
+var MODERN_VERSIONS = ["2026-07-28"];
+var LEGACY_VERSIONS = [
+  "2025-11-25",
+  "2025-06-18",
+  "2025-03-26",
+  "2024-11-05"
+];
+var SUPPORTED = [...MODERN_VERSIONS, ...LEGACY_VERSIONS];
+var VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
+var CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var SERVER_INFO_KEY = "io.modelcontextprotocol/serverInfo";
+function isObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function errorLine(id, code, message2, data) {
+  return JSON.stringify({
+    jsonrpc: "2.0",
+    id,
+    error: data === void 0 ? { code, message: message2 } : { code, message: message2, data }
+  });
+}
+function createProtocol(opts) {
+  const serverInfo = { name: opts.name, version: opts.version };
+  return {
+    async handle(line2) {
+      let message2;
+      try {
+        message2 = JSON.parse(line2);
+      } catch {
+        return errorLine(null, -32700, "Parse error");
+      }
+      const rawId = isObject2(message2) ? message2["id"] : void 0;
+      const id = typeof rawId === "string" || typeof rawId === "number" ? rawId : null;
+      if (!isObject2(message2) || message2["jsonrpc"] !== "2.0" || typeof message2["method"] !== "string")
+        return errorLine(id, -32600, "Invalid Request");
+      if (!("id" in message2)) return null;
+      if (id === null) return errorLine(null, -32600, "Invalid Request");
+      const method = message2["method"];
+      const params = isObject2(message2["params"]) ? message2["params"] : {};
+      const meta = isObject2(params["_meta"]) ? params["_meta"] : null;
+      const modern = meta !== null && typeof meta[VERSION_KEY] === "string";
+      if (modern) {
+        const requested = meta[VERSION_KEY];
+        if (!MODERN_VERSIONS.includes(requested))
+          return errorLine(id, -32022, "Unsupported protocol version", {
+            supported: SUPPORTED,
+            requested
+          });
+        if (!isObject2(meta[CAPABILITIES_KEY]))
+          return errorLine(
+            id,
+            -32602,
+            `Invalid params: ${CAPABILITIES_KEY} is required`
+          );
+      }
+      const answer = (result) => JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        result: modern ? {
+          resultType: "complete",
+          ...result,
+          _meta: { [SERVER_INFO_KEY]: serverInfo }
+        } : result
+      });
+      switch (method) {
+        case "server/discover":
+          return answer({
+            supportedVersions: SUPPORTED,
+            capabilities: { tools: {} }
+          });
+        case "initialize": {
+          const asked = params["protocolVersion"];
+          const protocolVersion = typeof asked === "string" && LEGACY_VERSIONS.includes(asked) ? asked : LEGACY_VERSIONS[0];
+          return JSON.stringify({
+            jsonrpc: "2.0",
+            id,
+            result: {
+              protocolVersion,
+              capabilities: { tools: {} },
+              serverInfo
+            }
+          });
+        }
+        case "ping":
+          return answer({});
+        case "tools/list":
+          return answer({
+            tools: opts.tools.map((t) => ({
+              name: t.name,
+              title: t.title,
+              description: t.description,
+              inputSchema: t.inputSchema
+            }))
+          });
+        case "tools/call": {
+          const name = params["name"];
+          const tool = opts.tools.find((t) => t.name === name);
+          if (tool === void 0)
+            return errorLine(id, -32602, `Unknown tool: ${String(name)}`);
+          const args = isObject2(params["arguments"]) ? params["arguments"] : {};
+          try {
+            const r = await tool.call(args);
+            return answer({
+              content: [{ type: "text", text: r.text }],
+              isError: r.isError === true
+            });
+          } catch (e) {
+            return answer({
+              content: [
+                {
+                  type: "text",
+                  text: `${tool.name} failed: ${e instanceof Error ? e.message : String(e)}`
+                }
+              ],
+              isError: true
+            });
+          }
+        }
+        default:
+          return errorLine(id, -32601, "Method not found");
+      }
+    }
+  };
+}
+
 // src/commands/mcp.ts
 async function mcpCommand(opts, io = {
   input: process.stdin,
@@ -5337,6 +5573,9 @@ function buildProgram(state) {
   program.command("git-credential", { hidden: true }).argument("<operation>").action(async (operation) => {
     state.code = await gitCredentialCommand(operation);
   });
+  program.command("hook", { hidden: true }).argument("<event>", "session-start or post-tool-use").action(async (event) => {
+    state.code = await hookCommand(event);
+  });
   program.command("upgrade").alias("update").description(
     "Move this workspace to another @rness/cli: pin it in .rness/package.json, install, sync"
   ).argument("[version]", "an exact version (default: the latest release)").option("-y, --yes", "do not ask for confirmation").addOption(new Option("--cwd <dir>").hideHelp()).action(async (version, opts) => {
@@ -5414,7 +5653,8 @@ var OWN_COMMANDS = [
   "update",
   "login",
   "logout",
-  "git-credential"
+  "git-credential",
+  "hook"
 ];
 var CATCH_UP_DONE = "RNESS_CATCH_UP_DONE";
 async function catchUp(argv, deps = {}) {
@@ -5509,14 +5749,14 @@ export {
   copyScaffold,
   loginCommand,
   createCommand,
-  logoutCommand,
+  checkBlocks,
   STATUSES,
   checkContract,
+  logoutCommand,
   upgradeCommand,
-  checkBlocks,
   validateCommand,
   run2 as run,
   OWN_COMMANDS,
   catchUp
 };
-//# sourceMappingURL=chunk-JKDF7ROY.js.map
+//# sourceMappingURL=chunk-R4BRAAC2.js.map