@rulemetric/hooks 0.7.27 → 0.7.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/hooks",
-  "version": "0.7.27",
+  "version": "0.7.29",
   "publishConfig": {
     "access": "public"
   },

package/scripts/_ensure-session.sh

@@ -117,16 +117,46 @@ _rulemetric_ensure_session() {
     is_headless="true"
   fi
 
+  # Harness version, read from the transcript the hook was handed.
+  #
+  # `claudeCodeVersion` used to arrive ONLY on the SessionEnd transcript
+  # reimport, so any session that never ended cleanly — still running, crashed,
+  # or killed by a "Hook cancelled" — never got one. Measured 2026-07-27:
+  # harness_version was null on 96 of 326 claude_code sessions over 14 days
+  # (~30%), including long-lived live sessions, which is what blocks
+  # version-scoped segment comparisons (§6c.f attribution depth).
+  #
+  # Claude Code stamps `version` on every transcript entry from the first user
+  # message onward, so scanning the head of the file finds it. The first line is
+  # an `operation` record with no version, hence the scan rather than a
+  # first-line read. Reposts merge metadata server-side (jsonb ||), so if the
+  # transcript had no entries yet at SessionStart, a later hook call fills it in.
+  # Extracted with grep, NOT jq, on purpose: the bundled `jq` shim supports only
+  # the narrow filter subset already used here and returns EMPTY for anything
+  # else (verified — `select(.version != null) | .version` and even `.version`
+  # yield nothing). On a host without real jq that would silently capture no
+  # version at all, which is the exact failure being fixed. The semver-shaped
+  # pattern keeps prose in message content from matching.
+  local harness_version=""
+  if [ -n "${HOOK_TRANSCRIPT_PATH:-}" ] && [ -f "$HOOK_TRANSCRIPT_PATH" ]; then
+    harness_version=$(head -n 50 "$HOOK_TRANSCRIPT_PATH" 2>/dev/null \
+      | grep -oE '"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+[0-9A-Za-z.-]*"' \
+      | head -n 1 \
+      | sed -E 's/.*"([0-9][^"]*)"$/\1/') || harness_version=""
+  fi
+
   local metadata
   metadata=$(jq -n \
     --arg gitRemote "$git_remote" \
     --arg gitRootCommit "$git_root_commit" \
     --arg launchProjectPath "$launch_project_path" \
+    --arg claudeCodeVersion "$harness_version" \
     --argjson isWorktree "$is_worktree" \
     --argjson isHeadless "$is_headless" \
     '{} + (if $gitRemote != "" then {gitRemote: $gitRemote} else {} end)
         + (if $gitRootCommit != "" then {gitRootCommit: $gitRootCommit} else {} end)
         + (if $launchProjectPath != "" then {launchProjectPath: $launchProjectPath} else {} end)
+        + (if $claudeCodeVersion != "" then {claudeCodeVersion: $claudeCodeVersion} else {} end)
         + {isWorktree: $isWorktree, headless: $isHeadless}')
 
   # Optional org attribution (Phase 8.1). RULEMETRIC_ORG_ID is exported by

package/scripts/jq

@@ -48,9 +48,22 @@ def parse_args(argv):
     return flags, vars_, filter_ or ".", files
 
 
+class Unsupported(Exception):
+    """
+    A filter this shim does not implement.
+
+    Raised rather than returning EMPTY because EMPTY prints nothing and exits 0,
+    and every hook caller guards on the EXIT CODE (`... || return 0`). So an
+    unsupported filter looked exactly like a successful empty result and the
+    guards never fired — which is how `.memories | length` and
+    `.suggestions | length` both stayed silently dead. Failing loudly turns the
+    next unsupported filter into a clean skip instead of wrong data.
+    """
+
+
 def path_get(obj, expr):
     if not expr.startswith("."):
-        return EMPTY
+        raise Unsupported(expr)
     cur = obj
     rest = expr[1:]
     if rest == "":
@@ -109,7 +122,14 @@ def eval_simple(expr, data, vars_):
     if m:
         return isinstance(data, dict) and m.group(1) in data
 
-    m = re.fullmatch(r"(.+)\\|\\s*length", expr)
+    # NOT r"(.+)\\|\\s*length" — in a RAW string that is a literal backslash,
+    # so the pattern read as "(.+)\" OR "\s*length" and never matched a real
+    # `.foo | length`. It silently fell through to path_get(".memories | length"),
+    # which returns EMPTY, which prints nothing with exit 0 — so
+    # `count=$(... | jq -r '.memories | length')` came back empty and every
+    # caller's `|| return 0` guard saw success. That is the whole reason memory
+    # injection was a silent no-op on hosts without real jq.
+    m = re.fullmatch(r"(.+)\|\s*length", expr)
     if m:
         value = eval_filter(m.group(1), data, vars_)
         if value is EMPTY or value is None:
@@ -129,6 +149,19 @@ def eval_simple(expr, data, vars_):
     if expr.startswith("{") and expr.endswith("}"):
         return eval_object_literal(expr, data, vars_, drop_null=False)
 
+    # JSON scalar literals. Without this, a bare `5` in an object literal
+    # (`{..., limit: 5}`) fell through to path_get, which returns None for
+    # anything not starting with ".", so the request body went out carrying
+    # "limit": null — valid JSON with a wrong value, the worst failure shape.
+    if re.fullmatch(r"-?\d+", expr):
+        return int(expr)
+    if re.fullmatch(r"-?\d*\.\d+([eE][-+]?\d+)?|-?\d+[eE][-+]?\d+", expr):
+        return float(expr)
+    if expr == "true":
+        return True
+    if expr == "false":
+        return False
+
     return path_get(data, expr)
 
 
@@ -270,13 +303,55 @@ def build_known_n_filter(filter_, vars_):
     return eval_filter(filter_, {}, vars_)
 
 
+def eval_inputs_filter(filter_, stdin, raw_input=False):
+    """
+    `inputs` — consume the remaining input stream. Supports exactly the shape the
+    hook scripts use, `[inputs | select(length>0)]` under -Rn, which collects the
+    non-empty lines of a file into a JSON array (the seen-ids list).
+
+    Previously unsupported entirely: with -n set, main() went straight to
+    build_known_n_filter, nothing matched, and path_get returned EMPTY — printing
+    nothing with exit 0, so the caller read an empty seen-list and could not tell
+    that from "no ids seen yet".
+    """
+    lines = stdin.split("\n")
+    # A trailing newline is a terminator, not an empty final record — real jq
+    # yields 3 inputs for "a\n\nb\n", not 4.
+    if lines and lines[-1] == "":
+        lines.pop()
+
+    if raw_input:
+        values = lines
+    else:
+        values = []
+        for line in lines:
+            if not line.strip():
+                continue
+            try:
+                values.append(json.loads(line))
+            except Exception:
+                return EMPTY
+
+    compact = " ".join(filter_.strip().split())
+    if "select(length>0)" in compact.replace(" ", ""):
+        values = [v for v in values if v is not None and len(v) > 0]
+
+    # Wrapped in [...] collects into one array; bare `inputs` streams each value.
+    if compact.startswith("[") and compact.endswith("]"):
+        return values
+    return values
+
+
 def emit(value, raw=False, compact=False):
     if value is EMPTY:
         return
     if raw and isinstance(value, str):
         sys.stdout.write(value + "\n")
     elif raw and value is None:
-        sys.stdout.write("\n")
+        # `jq -r` prints the four characters "null" for a null result; only
+        # `empty` produces no output. Writing a bare newline here diverged from
+        # real jq, and invisible divergence is what made this shim dangerous.
+        sys.stdout.write("null\n")
     elif raw and isinstance(value, bool):
         sys.stdout.write(("true" if value else "false") + "\n")
     else:
@@ -284,6 +359,21 @@ def emit(value, raw=False, compact=False):
 
 
 def main():
+    try:
+        run()
+    except Unsupported as err:
+        # Exit 3 = jq's own "compile error" code, i.e. "this program is not one I
+        # can run" — distinct from 4 (bad input) and from 0 with empty output.
+        sys.stderr.write(
+            "rulemetric jq shim: unsupported filter %r. This is a narrow fallback, "
+            "not a jq implementation — install real jq, or add support in "
+            "packages/hooks/scripts/jq and cover it in test/jq-fallback.test.ts.\n"
+            % (str(err),)
+        )
+        sys.exit(3)
+
+
+def run():
     flags, vars_, filter_, files = parse_args(sys.argv[1:])
     if files:
         with open(files[0], "r", encoding="utf-8") as handle:
@@ -295,6 +385,16 @@ def main():
         emit(stdin, raw=False, compact="c" in flags)
         return
 
+    # `inputs` reads the stream even under -n, so it must be handled before the
+    # -n fast path (which assumes the filter is built purely from --arg vars).
+    if "n" in flags and re.search(r"\binputs\b", filter_):
+        emit(
+            eval_inputs_filter(filter_, stdin, raw_input="R" in flags),
+            raw="r" in flags,
+            compact="c" in flags,
+        )
+        return
+
     if "n" in flags:
         emit(build_known_n_filter(filter_, vars_), raw="r" in flags, compact="c" in flags)
         return