@rulemetric/hooks 0.7.28 → 0.7.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/hooks",
-  "version": "0.7.28",
+  "version": "0.7.30",
   "publishConfig": {
     "access": "public"
   },

package/scripts/_config.sh

@@ -13,6 +13,15 @@
 # discoverable on hosts that do not have jq installed system-wide.
 if ! command -v jq >/dev/null 2>&1; then
   _rulemetric_scripts_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  # npm normalises tarball file modes to 0644, so the bundled shim arrives
+  # NON-EXECUTABLE from a published install — `command -v jq` then never finds
+  # it on PATH and the fallback silently does not exist at all. Measured on
+  # @rulemetric/hooks@0.7.29: scripts/jq shipped -rw-r--r--. Restore the bit
+  # here; best effort, because a read-only install must stay on the safe
+  # clean-skip path rather than fail the hook.
+  if [ -f "$_rulemetric_scripts_dir/jq" ] && [ ! -x "$_rulemetric_scripts_dir/jq" ]; then
+    chmod +x "$_rulemetric_scripts_dir/jq" 2>/dev/null || true
+  fi
   if [ -x "$_rulemetric_scripts_dir/jq" ]; then
     PATH="$_rulemetric_scripts_dir:$PATH"
     export PATH

package/scripts/_log.sh

@@ -5,6 +5,15 @@
 
 if ! command -v jq >/dev/null 2>&1; then
   _rulemetric_log_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  # npm normalises tarball file modes to 0644, so the bundled shim arrives
+  # NON-EXECUTABLE from a published install — `command -v jq` then never finds
+  # it on PATH and the fallback silently does not exist at all. Measured on
+  # @rulemetric/hooks@0.7.29: scripts/jq shipped -rw-r--r--. Restore the bit
+  # here; best effort, because a read-only install must stay on the safe
+  # clean-skip path rather than fail the hook.
+  if [ -f "$_rulemetric_log_dir/jq" ] && [ ! -x "$_rulemetric_log_dir/jq" ]; then
+    chmod +x "$_rulemetric_log_dir/jq" 2>/dev/null || true
+  fi
   if [ -x "$_rulemetric_log_dir/jq" ]; then
     PATH="$_rulemetric_log_dir:$PATH"
     export PATH

package/scripts/_normalize.sh

@@ -2,6 +2,15 @@
 
 if ! command -v jq >/dev/null 2>&1; then
   _rulemetric_normalize_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  # npm normalises tarball file modes to 0644, so the bundled shim arrives
+  # NON-EXECUTABLE from a published install — `command -v jq` then never finds
+  # it on PATH and the fallback silently does not exist at all. Measured on
+  # @rulemetric/hooks@0.7.29: scripts/jq shipped -rw-r--r--. Restore the bit
+  # here; best effort, because a read-only install must stay on the safe
+  # clean-skip path rather than fail the hook.
+  if [ -f "$_rulemetric_normalize_dir/jq" ] && [ ! -x "$_rulemetric_normalize_dir/jq" ]; then
+    chmod +x "$_rulemetric_normalize_dir/jq" 2>/dev/null || true
+  fi
   if [ -x "$_rulemetric_normalize_dir/jq" ]; then
     PATH="$_rulemetric_normalize_dir:$PATH"
     export PATH

package/scripts/jq

@@ -48,9 +48,22 @@ def parse_args(argv):
     return flags, vars_, filter_ or ".", files
 
 
+class Unsupported(Exception):
+    """
+    A filter this shim does not implement.
+
+    Raised rather than returning EMPTY because EMPTY prints nothing and exits 0,
+    and every hook caller guards on the EXIT CODE (`... || return 0`). So an
+    unsupported filter looked exactly like a successful empty result and the
+    guards never fired — which is how `.memories | length` and
+    `.suggestions | length` both stayed silently dead. Failing loudly turns the
+    next unsupported filter into a clean skip instead of wrong data.
+    """
+
+
 def path_get(obj, expr):
     if not expr.startswith("."):
-        return EMPTY
+        raise Unsupported(expr)
     cur = obj
     rest = expr[1:]
     if rest == "":
@@ -109,7 +122,14 @@ def eval_simple(expr, data, vars_):
     if m:
         return isinstance(data, dict) and m.group(1) in data
 
-    m = re.fullmatch(r"(.+)\\|\\s*length", expr)
+    # NOT r"(.+)\\|\\s*length" — in a RAW string that is a literal backslash,
+    # so the pattern read as "(.+)\" OR "\s*length" and never matched a real
+    # `.foo | length`. It silently fell through to path_get(".memories | length"),
+    # which returns EMPTY, which prints nothing with exit 0 — so
+    # `count=$(... | jq -r '.memories | length')` came back empty and every
+    # caller's `|| return 0` guard saw success. That is the whole reason memory
+    # injection was a silent no-op on hosts without real jq.
+    m = re.fullmatch(r"(.+)\|\s*length", expr)
     if m:
         value = eval_filter(m.group(1), data, vars_)
         if value is EMPTY or value is None:
@@ -129,6 +149,19 @@ def eval_simple(expr, data, vars_):
     if expr.startswith("{") and expr.endswith("}"):
         return eval_object_literal(expr, data, vars_, drop_null=False)
 
+    # JSON scalar literals. Without this, a bare `5` in an object literal
+    # (`{..., limit: 5}`) fell through to path_get, which returns None for
+    # anything not starting with ".", so the request body went out carrying
+    # "limit": null — valid JSON with a wrong value, the worst failure shape.
+    if re.fullmatch(r"-?\d+", expr):
+        return int(expr)
+    if re.fullmatch(r"-?\d*\.\d+([eE][-+]?\d+)?|-?\d+[eE][-+]?\d+", expr):
+        return float(expr)
+    if expr == "true":
+        return True
+    if expr == "false":
+        return False
+
     return path_get(data, expr)
 
 
@@ -270,13 +303,55 @@ def build_known_n_filter(filter_, vars_):
     return eval_filter(filter_, {}, vars_)
 
 
+def eval_inputs_filter(filter_, stdin, raw_input=False):
+    """
+    `inputs` — consume the remaining input stream. Supports exactly the shape the
+    hook scripts use, `[inputs | select(length>0)]` under -Rn, which collects the
+    non-empty lines of a file into a JSON array (the seen-ids list).
+
+    Previously unsupported entirely: with -n set, main() went straight to
+    build_known_n_filter, nothing matched, and path_get returned EMPTY — printing
+    nothing with exit 0, so the caller read an empty seen-list and could not tell
+    that from "no ids seen yet".
+    """
+    lines = stdin.split("\n")
+    # A trailing newline is a terminator, not an empty final record — real jq
+    # yields 3 inputs for "a\n\nb\n", not 4.
+    if lines and lines[-1] == "":
+        lines.pop()
+
+    if raw_input:
+        values = lines
+    else:
+        values = []
+        for line in lines:
+            if not line.strip():
+                continue
+            try:
+                values.append(json.loads(line))
+            except Exception:
+                return EMPTY
+
+    compact = " ".join(filter_.strip().split())
+    if "select(length>0)" in compact.replace(" ", ""):
+        values = [v for v in values if v is not None and len(v) > 0]
+
+    # Wrapped in [...] collects into one array; bare `inputs` streams each value.
+    if compact.startswith("[") and compact.endswith("]"):
+        return values
+    return values
+
+
 def emit(value, raw=False, compact=False):
     if value is EMPTY:
         return
     if raw and isinstance(value, str):
         sys.stdout.write(value + "\n")
     elif raw and value is None:
-        sys.stdout.write("\n")
+        # `jq -r` prints the four characters "null" for a null result; only
+        # `empty` produces no output. Writing a bare newline here diverged from
+        # real jq, and invisible divergence is what made this shim dangerous.
+        sys.stdout.write("null\n")
     elif raw and isinstance(value, bool):
         sys.stdout.write(("true" if value else "false") + "\n")
     else:
@@ -284,6 +359,21 @@ def emit(value, raw=False, compact=False):
 
 
 def main():
+    try:
+        run()
+    except Unsupported as err:
+        # Exit 3 = jq's own "compile error" code, i.e. "this program is not one I
+        # can run" — distinct from 4 (bad input) and from 0 with empty output.
+        sys.stderr.write(
+            "rulemetric jq shim: unsupported filter %r. This is a narrow fallback, "
+            "not a jq implementation — install real jq, or add support in "
+            "packages/hooks/scripts/jq and cover it in test/jq-fallback.test.ts.\n"
+            % (str(err),)
+        )
+        sys.exit(3)
+
+
+def run():
     flags, vars_, filter_, files = parse_args(sys.argv[1:])
     if files:
         with open(files[0], "r", encoding="utf-8") as handle:
@@ -295,6 +385,16 @@ def main():
         emit(stdin, raw=False, compact="c" in flags)
         return
 
+    # `inputs` reads the stream even under -n, so it must be handled before the
+    # -n fast path (which assumes the filter is built purely from --arg vars).
+    if "n" in flags and re.search(r"\binputs\b", filter_):
+        emit(
+            eval_inputs_filter(filter_, stdin, raw_input="R" in flags),
+            raw="r" in flags,
+            compact="c" in flags,
+        )
+        return
+
     if "n" in flags:
         emit(build_known_n_filter(filter_, vars_), raw="r" in flags, compact="c" in flags)
         return