@rulemetric/hooks 0.18.1 → 0.19.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/hooks",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "publishConfig": {
     "access": "public"
   },

package/scripts/scoped-live.mjs

@@ -3,7 +3,7 @@ import { readFileSync, lstatSync, realpathSync } from 'node:fs';
 import { resolve, join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { execFileSync, spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const hash = bytes => createHash('sha256').update(bytes).digest('hex');
 export function readArtifact(root, path, maxBytes = 200_000) {
@@ -65,6 +65,18 @@ export function observeEnvironment(root) {
   };
 }
 
+/** Worktree-specific paths are identity, not instruction content. Retain every
+ * actual ancestor/global hash and normalize only this checkout's root keys. */
+export function observeScopedEnvironment(root, protocol) {
+  const environment = observeEnvironment(root);
+  if (!protocol.execution) return environment;
+  const prefix = resolve(root) + '/';
+  for (const name of ['scoped-live.mjs', 'scoped-start.mjs']) environment.contextHashes['@collector/' + name] = hash(readFileSync(join(dirname(fileURLToPath(import.meta.url)), name)));
+  return { ...environment, contextHashes: Object.fromEntries(Object.entries(environment.contextHashes)
+    .map(([path, value]) => [path.startsWith(prefix) ? '@project/' + path.slice(prefix.length) : path, value])
+    .sort(([a], [b]) => a.localeCompare(b))) };
+}
+
 // .claude.json mixes session counters/history with configuration. Retain only
 // configuration here; settings files are separately hashed in full above.
 export function stableClaudeConfig(config, root) {
@@ -94,7 +106,7 @@ export function transcriptEvidence(path, sessionId) {
 export function transcriptModels(path, sessionId) { return transcriptEvidence(path, sessionId).observedModels; }
 
 export function collectScopedOutcome(protocol, taskId, sessionId, root, transcriptPath) {
-    const environment = observeEnvironment(root);
+    const environment = observeScopedEnvironment(root, protocol);
     const task = protocol.verification.tasks.find(task => task.taskId === taskId);
     if (!task) throw new Error('Unknown task');
     const artifacts = [...new Set(task.checks.map(check => check.path))].map(path => {
@@ -114,7 +126,7 @@ export async function runScopedHook(mode, sessionId, root, model, transcriptPath
   const request = async (path, body) => {
     const response = await fetch(`${api}/api${path}`, { method: body ? 'POST' : 'GET',
       headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-      ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(5000) });
+      ...(body ? { body: JSON.stringify(body) } : {}), signal: AbortSignal.timeout(process.env.RULEMETRIC_SCOPED_ISOLATED === '1' ? 30000 : 5000) });
     if (!response.ok) {
       const detail = await response.text();
       throw new Error(`Scoped ${mode} refused (${response.status}): ${detail.slice(0, 1000)}`);
@@ -123,9 +135,9 @@ export async function runScopedHook(mode, sessionId, root, model, transcriptPath
   };
   const { confirmation } = await request(`/scoped-live-confirmations/${id}/contract`);
   const protocol = confirmation.protocol;
-  const environment = protocol.verification ? observeEnvironment(root) : undefined;
+  const environment = protocol.verification ? observeScopedEnvironment(root, protocol) : undefined;
   if (mode === 'start') {
-    if (!model && protocol.research?.enrollment === 'prospective-launches') {
+    if (!model && (protocol.execution || protocol.research?.enrollment === 'prospective-launches')) {
       // SessionStart's model is optional. A requested model is not an observed
       // outcome: retain the launch pin and verify actual transcript models later.
       const requested = process.env.RULEMETRIC_SCOPED_REQUESTED_MODEL;
@@ -142,7 +154,7 @@ export async function runScopedHook(mode, sessionId, root, model, transcriptPath
       process.stderr.write('[rulemetric] Enrollment uses the requested launch model; actual model remains subject to transcript verification.\n');
     }
     const configurationHash = environment ? hash(JSON.stringify({ harnessVersion: environment.harnessVersion, repositoryRevision: protocol.research?.enrollment === 'prospective-launches' ? protocol.verification.environment.repositoryRevision : environment.repositoryRevision, contextHashes: environment.contextHashes })) : process.env.RULEMETRIC_SCOPED_CONFIGURATION_HASH;
-    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment, collectorVersion: 2 });
+    const rendered = await request(`/scoped-live-confirmations/${id}/hook-render`, { taskId, externalSessionId: sessionId, model, projectPath: root, configurationHash, environment, collectorVersion: protocol.execution ? 3 : 2 });
     const content = Buffer.from(rendered.contentBase64, 'base64');
     if (hash(content) !== rendered.deliveryHash) throw new Error('Scoped delivery hash mismatch');
     // No unhashed headings or wrappers are added to the treatment.

package/scripts/scoped-start.mjs

@@ -0,0 +1,9 @@
+// Dedicated hook for isolated launched work. The worker owns final transcript
+// capture and independent verification after exit, even if SessionEnd is cancelled.
+import { readFileSync } from 'node:fs';
+import { runScopedHook } from './scoped-live.mjs';
+const input = readFileSync(0, 'utf8');
+if (Buffer.byteLength(input) > 100000) throw new Error('Oversized scoped hook input');
+const event = JSON.parse(input);
+process.env.RULEMETRIC_SCOPED_ISOLATED = '1';
+await runScopedHook('start', event.session_id, event.cwd, event.model, event.transcript_path);