@rulemetric/hooks 0.15.0 → 0.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/hooks",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "publishConfig": {
     "access": "public"
   },

package/scripts/_normalize.sh

@@ -32,6 +32,7 @@ fi
 #   HOOK_TOOL_INPUT  - Tool input as JSON
 #   HOOK_TOOL_OUTPUT - Tool output as JSON
 #   HOOK_TRANSCRIPT_PATH - Path to transcript file (empty if unavailable)
+#   HOOK_MODEL       - Resolved model at SessionStart when the harness supplies it
 
 # Portable short content hash for synthetic session IDs. `shasum` is a perl
 # script — absent on minimal Linux hosts (containers, slim distros), where its
@@ -91,6 +92,7 @@ _rulemetric_normalize() {
     HOOK_TOOL_INPUT=$(echo "$input" | jq -c '.toolCall.args // .tool_input // {}' 2>/dev/null || echo '{}')
     HOOK_TOOL_OUTPUT=$(echo "$input" | jq -c '.toolCall.result // .tool_response // {}' 2>/dev/null || echo '{}')
     HOOK_TRANSCRIPT_PATH=$(echo "$input" | jq -r '.transcriptPath // empty' 2>/dev/null)
+    HOOK_MODEL=$(echo "$input" | jq -r '.model // empty' 2>/dev/null)
 
   elif [ "$has_toolName" = "true" ] && [ "$has_sessionId" != "true" ]; then
     # Copilot CLI: no session ID, uses toolName/toolArgs/toolResult
@@ -129,6 +131,7 @@ _rulemetric_normalize() {
     fi
 
     HOOK_TRANSCRIPT_PATH=""
+    HOOK_MODEL=$(echo "$input" | jq -r '.model // empty' 2>/dev/null)
 
   elif [ "$has_sessionId" = "true" ]; then
     # VS Code Copilot (agent mode): sessionId (camelCase), tool_name, tool_input, tool_response
@@ -140,6 +143,7 @@ _rulemetric_normalize() {
     HOOK_TOOL_INPUT=$(echo "$input" | jq -c '.tool_input // {}')
     HOOK_TOOL_OUTPUT=$(echo "$input" | jq -c '.tool_response // {}')
     HOOK_TRANSCRIPT_PATH=$(echo "$input" | jq -r '.transcript_path // empty')
+    HOOK_MODEL=$(echo "$input" | jq -r '.model // empty' 2>/dev/null)
 
   elif [ "$has_conversation_id" = "true" ] && [ "$has_hook_event_name" = "true" ]; then
     # Cursor: conversation_id + hook_event_name
@@ -157,6 +161,7 @@ _rulemetric_normalize() {
     HOOK_CWD=$(echo "$input" | jq -r '.workspace_roots[0] // .cwd // empty')
     HOOK_PROMPT=$(echo "$input" | jq -r '.prompt // empty')
     HOOK_TRANSCRIPT_PATH=$(echo "$input" | jq -r '.transcript_path // empty')
+    HOOK_MODEL=$(echo "$input" | jq -r '.model // empty' 2>/dev/null)
 
     # Map hook_event_name to tool fields
     local event_name
@@ -201,6 +206,7 @@ _rulemetric_normalize() {
     HOOK_TOOL_INPUT=$(echo "$input" | jq -c '.tool_input // {}')
     HOOK_TOOL_OUTPUT=$(echo "$input" | jq -c '.tool_response // {}')
     HOOK_TRANSCRIPT_PATH=$(echo "$input" | jq -r '.transcript_path // empty')
+    HOOK_MODEL=$(echo "$input" | jq -r '.model // empty' 2>/dev/null)
   fi
 
   # Truncate large payloads (Read tool output can be massive)
@@ -224,7 +230,7 @@ _rulemetric_normalize() {
     fi
   fi
 
-  export HOOK_TOOL HOOK_SESSION_ID HOOK_CWD HOOK_PROMPT
+  export HOOK_TOOL HOOK_SESSION_ID HOOK_CWD HOOK_PROMPT HOOK_MODEL
   export HOOK_TOOL_NAME HOOK_TOOL_INPUT HOOK_TOOL_OUTPUT HOOK_TRANSCRIPT_PATH
 }
 

package/scripts/scoped-live.mjs

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, lstatSync, realpathSync } from 'node:fs';
+import { resolve, join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
+
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+export function readArtifact(root, path) {
+  if (!path || path.startsWith('/') || path.includes('\\') || path.split('/').some(s => !s || s === '.' || s === '..')) throw new Error('Unsafe artifact path');
+  let current = resolve(root);
+  for (const segment of path.split('/')) {
+    current = join(current, segment);
+    try { if (lstatSync(current).isSymbolicLink()) throw new Error('Artifact symlink refused'); }
+    catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  }
+  const stat = lstatSync(current);
+  if (!stat.isFile() || stat.size > 200_000) throw new Error('Artifact is not a bounded regular file');
+  return readFileSync(current, 'utf8');
+}
+
+export function observeEnvironment(root) {
+  const contextHashes = {};
+  const context = path => {
+    try { const stat = lstatSync(path); if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 2_000_000) throw new Error('Unsupported context file'); contextHashes[path] = hash(readFileSync(path)); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; contextHashes[path] = null; }
+  };
+  for (let current = resolve(root); ; current = dirname(current)) {
+    for (const file of ['CLAUDE.md', 'CLAUDE.local.md', 'AGENTS.md', '.mcp.json', '.claude/settings.json', '.claude/settings.local.json']) context(join(current, file));
+    if (dirname(current) === current) break;
+  }
+  for (const file of ['settings.json', 'CLAUDE.md']) context(join(homedir(), '.claude', file));
+  const userConfig = join(homedir(), '.claude.json');
+  context(userConfig);
+  if (contextHashes[userConfig]) contextHashes[userConfig] = hash(JSON.stringify(stableClaudeConfig(JSON.parse(readFileSync(userConfig, 'utf8')), resolve(root))));
+  return {
+    harnessVersion: execFileSync('claude', ['--version'], { encoding: 'utf8', timeout: 5000 }).trim(),
+    repositoryRevision: execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8', timeout: 5000 }).trim(),
+    contextHashes: Object.fromEntries(Object.entries(contextHashes).sort(([a], [b]) => a.localeCompare(b))),
+  };
+}
+
+// .claude.json mixes session counters/history with configuration. Retain only
+// configuration here; settings files are separately hashed in full above.
+export function stableClaudeConfig(config, root) {
+  const keys = ['mcpServers', 'mcpContextUris', 'allowedTools', 'enabledMcpjsonServers', 'disabledMcpjsonServers', 'disabledMcpServers', 'hasClaudeMdExternalIncludesApproved', 'claudeInChromeDefaultEnabled', 'cachedDynamicConfigs', 'cachedGrowthBookFeatures', 'cachedStatsigGates', 'cachedExperimentFeatures', 'cachedExperimentData'];
+  const pick = object => Object.fromEntries(keys.map(key => [key, object?.[key] ?? null]));
+  return { global: pick(config), project: pick(config.projects?.[root]) };
+}
+
+export function transcriptEvidence(path, sessionId) {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.size > 20_000_000) throw new Error('Transcript cannot be inspected');
+  const models = new Set();
+  const tools = new Set();
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    const row = JSON.parse(line);
+    if (row.sessionId && row.sessionId !== sessionId) throw new Error('Transcript contains another session');
+    if (row.type === 'assistant' && row.message?.model && row.message.model !== '<synthetic>') models.add(row.message.model);
+    if (row.type === 'assistant' && Array.isArray(row.message?.content)) {
+      for (const block of row.message.content) if (block.type === 'tool_use' && typeof block.name === 'string') tools.add(block.name);
+    }
+  }
+  if (!models.size) throw new Error('No observed actor model');
+  return { observedModels: [...models], observedTools: [...tools] };
+}
+
+export function transcriptModels(path, sessionId) { return transcriptEvidence(path, sessionId).observedModels; }
+
+export async function runScopedHook(mode, sessionId, root, model, transcriptPath) {
+  const id = process.env.RULEMETRIC_SCOPED_CONFIRMATION_ID;
+  const taskId = process.env.RULEMETRIC_SCOPED_TASK_ID;
+  if (!id || !taskId) return;
+  const token = process.env.RULEMETRIC_API_KEY || process.env.RULEMETRIC_ACCESS_TOKEN;
+  const api = process.env.RULEMETRIC_API_URL;
+  if (!api || !token) return;
+  const request = async (path, body) => {
+    const response = await fetch(`${api}/api${path}`, { method: body ? 'POST' : 'GET',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(5000) });
+    if (!response.ok) throw new Error(`Scoped ${mode} refused (${response.status})`);
+    return response.json();
+  };
+  const { confirmation } = await request(`/scoped-live-confirmations/${id}/contract`);
+  const protocol = confirmation.protocol;
+  const environment = protocol.verification ? observeEnvironment(root) : undefined;
+  if (mode === 'start') {
+    const configurationHash = environment ? hash(JSON.stringify(environment)) : process.env.RULEMETRIC_SCOPED_CONFIGURATION_HASH;
+    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment });
+    const content = Buffer.from(rendered.contentBase64, 'base64');
+    if (hash(content) !== rendered.deliveryHash) throw new Error('Scoped delivery hash mismatch');
+    // No unhashed headings or wrappers are added to the treatment.
+    await new Promise((resolve, reject) => process.stdout.write(content, error => error ? reject(error) : resolve()));
+    await request(`/scoped-live-confirmations/${id}/assignments/${rendered.assignment.id}/delivery`, { deliveryHash: rendered.deliveryHash });
+  } else if (mode === 'end' && protocol.verification) {
+    const task = protocol.verification.tasks.find(task => task.taskId === taskId);
+    if (!task) throw new Error('Unknown task');
+    const artifacts = [...new Set(task.checks.map(check => check.path))].map(path => {
+      try { return { path, content: readArtifact(root, path) }; }
+      catch (error) { return { path, content: null, error: error.message }; }
+    });
+    await request(`/scoped-live-confirmations/${id}/verify`, { externalSessionId: sessionId, projectPath: root, environment, ...transcriptEvidence(transcriptPath, sessionId), artifacts });
+    // A non-final task legitimately returns 409; its receipt is already durable.
+    await request(`/scoped-live-confirmations/${id}/decide`, {}).catch(() => {});
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+  runScopedHook(...process.argv.slice(2)).catch(error => { process.stderr.write(`[rulemetric] ${error.message}\n`); process.exitCode = 1; });
+}

package/scripts/session-end.sh

@@ -92,6 +92,14 @@ fi
 
 _rulemetric_log "session-end" "success"
 
+# Check frozen artifacts after final capture. Missing or cancelled receipt stays
+# visible as missing evidence and cannot become a positive performance claim.
+if [ -n "${RULEMETRIC_SCOPED_CONFIRMATION_ID:-}" ] && command -v node >/dev/null 2>&1; then
+  RULEMETRIC_API_URL="${RULEMETRIC_API_URL:-}" \
+  RULEMETRIC_API_KEY="${RULEMETRIC_API_KEY:-${RULEMETRIC_ACCESS_TOKEN:-}}" \
+    node "$SCRIPT_DIR/scoped-live.mjs" end "$HOOK_SESSION_ID" "$HOOK_CWD" "${HOOK_MODEL:-}" "${HOOK_TRANSCRIPT_PATH:-}" || true
+fi
+
 # ── Emit a synthetic instruction snapshot (hooks-first, zero-proxy linking) ──
 # The proxy classifies the rendered system prompt into context_items that
 # link-instructions matches on. Hooks-only sessions have no proxy, so build an

package/scripts/session-start.sh

@@ -100,6 +100,26 @@ if ! proxy_alive; then
   fi
 fi
 
+# ── Scoped live-confirmation delivery (fail closed) ──
+# A task identifier and configuration hash are intentionally supplied before
+# launch, not inferred from the prompt/session after an instruction has already
+# been shown. Ordinary sessions do nothing here. The API writes the assignment
+# first; this hook prints precisely the returned bytes and only then acknowledges
+# their hash.
+_rulemetric_scoped_live_confirmation() {
+  [ -n "${RULEMETRIC_SCOPED_CONFIRMATION_ID:-}" ] || return 0
+  command -v node >/dev/null 2>&1 || return 0
+  RULEMETRIC_API_URL="${RULEMETRIC_API_URL:-}" \
+  RULEMETRIC_API_KEY="${RULEMETRIC_API_KEY:-${RULEMETRIC_ACCESS_TOKEN:-}}" \
+    node "$SCRIPT_DIR/scoped-live.mjs" start "$HOOK_SESSION_ID" "$HOOK_CWD" "${HOOK_MODEL:-}" "${HOOK_TRANSCRIPT_PATH:-}"
+}
+
+_rulemetric_scoped_live_confirmation || true
+
+# Frozen confirmations do not receive changing recommendation/memory context.
+# This applies even when their scoped delivery is refused.
+if [ -n "${RULEMETRIC_SCOPED_CONFIRMATION_ID:-}" ]; then exit 0; fi
+
 # ── Instruction suggestions (non-blocking) ──
 # Fetch the top precomputed suggestions for this project and surface them to
 # the user. All failures are silent — this block MUST NOT prevent session

package/scripts/user-prompt.sh

@@ -85,6 +85,7 @@ _rulemetric_log "user-prompt" "success"
 # prompt) isn't re-surfaced or double-exposed. All failures are silent — this MUST NOT
 # break prompt submission. Mirrors _rulemetric_inject_memories() in session-start.sh.
 _rulemetric_inject_relevant_memories() {
+  [ -z "${RULEMETRIC_SCOPED_CONFIRMATION_ID:-}" ] || return 0
   local api_url="${RULEMETRIC_API_URL:-}"
   [ -n "$api_url" ] && [ -n "$AUTH_HEADER" ] || return 0
   [ -n "$HOOK_PROMPT" ] || return 0