@rulemetric/hooks 0.15.1 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/hooks",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "publishConfig": {
     "access": "public"
   },

package/scripts/_log.sh

@@ -3,7 +3,7 @@
 # Appends JSON lines to $TMPDIR/rulemetric/hook.log
 # Never fails — all writes guarded with || true
 
-if ! command -v jq >/dev/null 2>&1; then
+if ! command -v jq >/dev/null 2>&1 || [ ! -x "$(command -v jq)" ]; then
   _rulemetric_log_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
   # npm normalises tarball file modes to 0644, so the bundled shim arrives
   # NON-EXECUTABLE from a published install — `command -v jq` then never finds

package/scripts/scoped-live.mjs

@@ -2,11 +2,11 @@ import { createHash } from 'node:crypto';
 import { readFileSync, lstatSync, realpathSync } from 'node:fs';
 import { resolve, join, dirname } from 'node:path';
 import { homedir } from 'node:os';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 
 const hash = bytes => createHash('sha256').update(bytes).digest('hex');
-export function readArtifact(root, path) {
+export function readArtifact(root, path, maxBytes = 200_000) {
   if (!path || path.startsWith('/') || path.includes('\\') || path.split('/').some(s => !s || s === '.' || s === '..')) throw new Error('Unsafe artifact path');
   let current = resolve(root);
   for (const segment of path.split('/')) {
@@ -15,10 +15,30 @@ export function readArtifact(root, path) {
     catch (error) { if (error.code === 'ENOENT') return null; throw error; }
   }
   const stat = lstatSync(current);
-  if (!stat.isFile() || stat.size > 200_000) throw new Error('Artifact is not a bounded regular file');
+  if (!stat.isFile() || stat.size > maxBytes) throw new Error('Artifact is not a bounded regular file');
   return readFileSync(current, 'utf8');
 }
 
+/** Execute only the prospectively frozen check, never an actor's success claim. */
+export function runRepositoryCheck(root, check) {
+  const definitionHash = hash(JSON.stringify({ name: check.name, path: check.path, kind: check.kind, expected: check.expected, primary: check.primary, command: check.command, timeoutMs: check.timeoutMs, fileHashes: Object.fromEntries(Object.entries(check.fileHashes).sort(([a], [b]) => a.localeCompare(b))) }));
+  const result = { name: check.name, definitionHash, exitCode: null, outputHash: null, error: null };
+  const unchanged = () => Object.entries(check.fileHashes).every(([path, expected]) => {
+    const content = readArtifact(root, path, 2_000_000);
+    return content !== null && hash(content) === expected;
+  });
+  try {
+    if (!unchanged()) return { ...result, error: 'Verifier files changed' };
+    const child = spawnSync(check.command[0], check.command.slice(1), {
+      cwd: root, timeout: check.timeoutMs, maxBuffer: 200_000, encoding: 'utf8',
+      env: { PATH: process.env.PATH, HOME: process.env.HOME, TMPDIR: process.env.TMPDIR, CI: '1' },
+    });
+    if (!unchanged()) return { ...result, error: 'Verifier files changed' };
+    return { ...result, exitCode: child.status, outputHash: hash((child.stdout ?? '') + (child.stderr ?? '')),
+      error: child.error ? child.error.message : child.signal ? `Verifier terminated: ${child.signal}` : null };
+  } catch (error) { return { ...result, error: error.message }; }
+}
+
 export function observeEnvironment(root) {
   const contextHashes = {};
   const context = path => {
@@ -32,8 +52,13 @@ export function observeEnvironment(root) {
   for (const file of ['settings.json', 'CLAUDE.md']) context(join(homedir(), '.claude', file));
   const userConfig = join(homedir(), '.claude.json');
   context(userConfig);
-  if (contextHashes[userConfig]) contextHashes[userConfig] = hash(JSON.stringify(stableClaudeConfig(JSON.parse(readFileSync(userConfig, 'utf8')), resolve(root))));
+  const config = contextHashes[userConfig] ? JSON.parse(readFileSync(userConfig, 'utf8')) : null;
+  if (config) contextHashes[userConfig] = hash(JSON.stringify(stableClaudeConfig(config, resolve(root))));
+  const runtimeStateHash = config ? hash(JSON.stringify(Object.fromEntries(
+    ['cachedDynamicConfigs', 'cachedGrowthBookFeatures', 'cachedStatsigGates', 'cachedExperimentFeatures', 'cachedExperimentData'].map(key => [key, config[key] ?? null]),
+  ))) : null;
   return {
+    runtimeStateHash,
     harnessVersion: execFileSync('claude', ['--version'], { encoding: 'utf8', timeout: 5000 }).trim(),
     repositoryRevision: execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8', timeout: 5000 }).trim(),
     contextHashes: Object.fromEntries(Object.entries(contextHashes).sort(([a], [b]) => a.localeCompare(b))),
@@ -43,7 +68,7 @@ export function observeEnvironment(root) {
 // .claude.json mixes session counters/history with configuration. Retain only
 // configuration here; settings files are separately hashed in full above.
 export function stableClaudeConfig(config, root) {
-  const keys = ['mcpServers', 'mcpContextUris', 'allowedTools', 'enabledMcpjsonServers', 'disabledMcpjsonServers', 'disabledMcpServers', 'hasClaudeMdExternalIncludesApproved', 'claudeInChromeDefaultEnabled', 'cachedDynamicConfigs', 'cachedGrowthBookFeatures', 'cachedStatsigGates', 'cachedExperimentFeatures', 'cachedExperimentData'];
+  const keys = ['mcpServers', 'mcpContextUris', 'allowedTools', 'enabledMcpjsonServers', 'disabledMcpjsonServers', 'disabledMcpServers', 'hasClaudeMdExternalIncludesApproved', 'claudeInChromeDefaultEnabled'];
   const pick = object => Object.fromEntries(keys.map(key => [key, object?.[key] ?? null]));
   return { global: pick(config), project: pick(config.projects?.[root]) };
 }
@@ -68,6 +93,17 @@ export function transcriptEvidence(path, sessionId) {
 
 export function transcriptModels(path, sessionId) { return transcriptEvidence(path, sessionId).observedModels; }
 
+export function collectScopedOutcome(protocol, taskId, sessionId, root, transcriptPath) {
+    const environment = observeEnvironment(root);
+    const task = protocol.verification.tasks.find(task => task.taskId === taskId);
+    if (!task) throw new Error('Unknown task');
+    const artifacts = [...new Set(task.checks.map(check => check.path))].map(path => {
+      try { return { path, content: readArtifact(root, path) }; }
+      catch (error) { return { path, content: null, error: error.message }; }
+    });
+    return { externalSessionId: sessionId, projectPath: root, environment, ...transcriptEvidence(transcriptPath, sessionId), artifacts, commands: task.checks.filter(check => check.kind === 'command_exit').map(check => runRepositoryCheck(root, check)) };
+}
+
 export async function runScopedHook(mode, sessionId, root, model, transcriptPath) {
   const id = process.env.RULEMETRIC_SCOPED_CONFIRMATION_ID;
   const taskId = process.env.RULEMETRIC_SCOPED_TASK_ID;
@@ -79,28 +115,41 @@ export async function runScopedHook(mode, sessionId, root, model, transcriptPath
     const response = await fetch(`${api}/api${path}`, { method: body ? 'POST' : 'GET',
       headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
       ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(5000) });
-    if (!response.ok) throw new Error(`Scoped ${mode} refused (${response.status})`);
+    if (!response.ok) {
+      const detail = await response.text();
+      throw new Error(`Scoped ${mode} refused (${response.status}): ${detail.slice(0, 1000)}`);
+    }
     return response.json();
   };
   const { confirmation } = await request(`/scoped-live-confirmations/${id}/contract`);
   const protocol = confirmation.protocol;
   const environment = protocol.verification ? observeEnvironment(root) : undefined;
   if (mode === 'start') {
-    const configurationHash = environment ? hash(JSON.stringify(environment)) : process.env.RULEMETRIC_SCOPED_CONFIGURATION_HASH;
-    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment });
+    if (!model && protocol.research?.enrollment === 'prospective-launches') {
+      // SessionStart's model is optional. A requested model is not an observed
+      // outcome: retain the launch pin and verify actual transcript models later.
+      const requested = process.env.RULEMETRIC_SCOPED_REQUESTED_MODEL;
+      if (requested && requested === protocol.model) model = requested;
+      else {
+        // Compatibility for already-queued launches from workers without the pin env.
+        const jobs = await request('/launch-jobs?limit=100');
+        const launch = jobs.find(job => job.tool === 'claude_code' && ['claimed', 'running'].includes(job.status)
+          && job.config?.projectPath === root && job.config?.scopedConfirmation?.id === id
+          && job.config?.scopedConfirmation?.taskId === taskId && job.config?.model === protocol.model);
+        model = launch?.config.model;
+      }
+      if (!model) throw new Error('SessionStart omitted model and no matching claimed launch model is available');
+      process.stderr.write('[rulemetric] Enrollment uses the requested launch model; actual model remains subject to transcript verification.\n');
+    }
+    const configurationHash = environment ? hash(JSON.stringify({ harnessVersion: environment.harnessVersion, repositoryRevision: protocol.research?.enrollment === 'prospective-launches' ? protocol.verification.environment.repositoryRevision : environment.repositoryRevision, contextHashes: environment.contextHashes })) : process.env.RULEMETRIC_SCOPED_CONFIGURATION_HASH;
+    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment, collectorVersion: 2 });
     const content = Buffer.from(rendered.contentBase64, 'base64');
     if (hash(content) !== rendered.deliveryHash) throw new Error('Scoped delivery hash mismatch');
     // No unhashed headings or wrappers are added to the treatment.
     await new Promise((resolve, reject) => process.stdout.write(content, error => error ? reject(error) : resolve()));
     await request(`/scoped-live-confirmations/${id}/assignments/${rendered.assignment.id}/delivery`, { deliveryHash: rendered.deliveryHash });
   } else if (mode === 'end' && protocol.verification) {
-    const task = protocol.verification.tasks.find(task => task.taskId === taskId);
-    if (!task) throw new Error('Unknown task');
-    const artifacts = [...new Set(task.checks.map(check => check.path))].map(path => {
-      try { return { path, content: readArtifact(root, path) }; }
-      catch (error) { return { path, content: null, error: error.message }; }
-    });
-    await request(`/scoped-live-confirmations/${id}/verify`, { externalSessionId: sessionId, projectPath: root, environment, ...transcriptEvidence(transcriptPath, sessionId), artifacts });
+    await request(`/scoped-live-confirmations/${id}/verify`, collectScopedOutcome(protocol, taskId, sessionId, root, transcriptPath));
     // A non-final task legitimately returns 409; its receipt is already durable.
     await request(`/scoped-live-confirmations/${id}/decide`, {}).catch(() => {});
   }