@su-record/vibe 4.2.34 → 4.2.36

package/hooks/notify.js

@@ -19,12 +19,28 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import codeMap from './code-map.cjs';
 import knowledgeAuto from './knowledge-auto.cjs';
+import locations from './locations.cjs';
 import knowledgeJournal from './knowledge-journal.cjs';
 import retest from './retest.cjs';
 import sessionRuntime from './session-state.cjs';
 import sessionFiles from './session-files.cjs';
 import sliceRuntime from './slice-guard.cjs';
 
+const { claudeSettings } = locations;
+
+const NOTIFY_HOOK = 'hooks/notify.js';
+const SETTINGS_MAX_BYTES = 64 * 1024;
+const PROJECT_DIR = '.vibe';
+const STATE_TIMEOUT_MS = 15000;
+// An authorize record counts for this long.
+const MS_PER_MINUTE = 60 * 1000;
+const AUTHORIZE_WINDOW_MS = 10 * MS_PER_MINUTE;
+const DEFAULT_READ_ADVISE_LINES = sliceRuntime.READ_ADVISE_LINES;
+// Exit code that stops a tool call in Claude Code.
+const BLOCK_EXIT = 2;
+// Hook modes that run in a project with or without a .vibe folder.
+const ANYWHERE_MODES = ['stop', 'session', 'pre'];
+
 const mode = process.argv[2] || 'post';
 const asPlugin = process.argv.includes('--plugin');
 const personal = process.argv.includes('--personal');
@@ -38,11 +54,11 @@ if (asPlugin) {
   // The reader refuses a link anywhere in a path; a home under one (macOS /var → /private/var) is the person's own.
   let home = process.env.VIBE_HOME_DIR || os.homedir();
   try { home = fs.realpathSync(home); } catch { /* a missing home has no settings to read */ }
-  for (const file of [path.join(home, '.claude', 'settings.json')]) {
+  for (const file of [claudeSettings(home)]) {
     try {
-      const settings = JSON.parse(sessionFiles.optional(file, 65536) ?? '{}');
+      const settings = JSON.parse(sessionFiles.optional(file, SETTINGS_MAX_BYTES) ?? '{}');
       const owned = Object.values(settings.hooks ?? {}).some(entries => entries.some(entry =>
-        entry.hooks?.some(hook => hook.command?.replaceAll('\\', '/').includes('hooks/notify.js'))));
+        entry.hooks?.some(hook => hook.command?.replaceAll('\\', '/').includes(NOTIFY_HOOK))));
       if (owned) process.exit(0);
     } catch {
       /* no such file — keep going */
@@ -58,19 +74,17 @@ function readPayload() {
   catch { return { session_id: 'invalid payload' }; }
 }
 
-function structuralSession(payload) {
-  const view = sessionRuntime.sessionStatus(payload);
-  return sessionRuntime.message(view, view.status === 'bound' ? 'session status only; run vibe state for the procedure' : `${view.status}; use explicit vibe session bind in the intended worktree`);
-}
+const structuralSession = payload => sessionRuntime.structuralNote(sessionRuntime.sessionStatus(payload));
 function sliceClient() {
   const declared = process.env.VIBE_CLIENT;
   if (declared) return ['codex', 'chatgpt'].includes(declared) ? 'codex' : 'claude';
   return process.env.CODEX_THREAD_ID && !process.env.CLAUDE_SESSION_ID ? 'codex' : 'claude';
 }
 
-function emitContext(text) {
-  process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: mode === 'post' ? 'PostToolUse' : 'PreToolUse', additionalContext: text } })}\n`);
+function emit(hookEventName, additionalContext) {
+  process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName, additionalContext } })}\n`);
 }
+const emitContext = text => emit(mode === 'post' ? 'PostToolUse' : 'PreToolUse', text);
 
 // The same actions the check gate names (src/core/checks/mutation.ts), so a blocked tool call and a blocked
 // check ask for the same `vibe authorize --action`; `send` is the hook's own. A command that only reads —
@@ -91,10 +105,12 @@ const IRREVERSIBLE = [
 ];
 const READS_ONLY = /^\s*(?:grep|rg|cat|head|tail|less|ls|find|wc|echo|printf|sed\s+-n|git\s+(?:log|diff|show|status|grep|blame|branch|ls-files))\b/;
 
+const hasProjectDir = () => fs.existsSync(path.join(root, PROJECT_DIR));
+
 function recentAuthorize(action) {
   try {
-    const lines = fs.readFileSync(path.join(root, '.vibe', 'ledger.jsonl'), 'utf-8').trim().split('\n');
-    const cutoff = Date.now() - 10 * 60 * 1000;
+    const lines = fs.readFileSync(path.join(root, PROJECT_DIR, 'ledger.jsonl'), 'utf-8').trim().split('\n');
+    const cutoff = Date.now() - AUTHORIZE_WINDOW_MS;
     return lines.some((line) => {
       try {
         const e = JSON.parse(line);
@@ -108,16 +124,25 @@ function recentAuthorize(action) {
   }
 }
 
-if (!['stop', 'session', 'pre'].includes(mode) && !fs.existsSync(path.join(root, '.vibe'))) process.exit(0);
+if (!ANYWHERE_MODES.includes(mode) && !hasProjectDir()) process.exit(0);
+
+function irreversibleNotice(action, blocking) {
+  return [
+    `[vibe] "${action}" is irreversible and no authorize record exists in the last ${AUTHORIZE_WINDOW_MS / MS_PER_MINUTE} minutes —`,
+    `${blocking ? 'blocked: ' : ''}get a human token with \`vibe ask --needs authorize:${action}\``,
+    'and run `vibe authorize` first, as its own command: the gate reads the ledger before this command runs,',
+    'so an authorize chained in front of the action is not seen',
+  ].join(' ');
+}
 
 function tokenPolicy() {
   try {
-    return JSON.parse(fs.readFileSync(path.join(root, '.vibe', 'config.json'), 'utf-8')).tokens || 'off';
+    return JSON.parse(fs.readFileSync(path.join(root, PROJECT_DIR, 'config.json'), 'utf-8')).tokens || 'off';
   } catch {
     return 'off';
   }
 }
-const READ_ADVISE_LINES = Number(process.env.VIBE_READ_ADVISE_LINES || 400);
+const READ_ADVISE_LINES = Number(process.env.VIBE_READ_ADVISE_LINES || DEFAULT_READ_ADVISE_LINES);
 
 function countLines(file) {
   try {
@@ -134,7 +159,10 @@ function adviseRead(payload) {
   const lines = countLines(path.resolve(root, file));
   if (lines <= READ_ADVISE_LINES) return;
   const shown = (path.isAbsolute(file) ? path.relative(root, file) || file : file).split(path.sep).join('/');
-  emitContext(`[vibe] ${shown} is ${lines} lines — when it only has to be understood, not edited or debugged, \`vibe read ${shown} --ask "<question>"\` lets a low-reasoning model read it and returns the answer with line numbers`);
+  emitContext([
+    `[vibe] ${shown} is ${lines} lines — when it only has to be understood, not edited or debugged,`,
+    `\`vibe read ${shown} --ask "<question>"\` lets a low-reasoning model read it and returns the answer with line numbers`,
+  ].join(' '));
 }
 
 const cli = path.join(here, '..', 'dist', 'cli.js');
@@ -158,14 +186,14 @@ if (mode === 'stop') {
 if (mode === 'session') {
   const payload = readPayload();
   const recall = knowledgeAuto.start(payload);
-  process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: [structuralSession(payload), recall, codeMap.codeMap(root)].filter(Boolean).join('\n') } })}\n`);
+  emit('SessionStart', [structuralSession(payload), recall, codeMap.codeMap(root)].filter(Boolean).join('\n'));
   process.exit(0);
 }
 
 if (mode === 'pre') {
   const payload = readPayload();
   if (payload.tool_name === 'Read') {
-    if (fs.existsSync(path.join(root, '.vibe'))) adviseRead(payload);
+    if (hasProjectDir()) adviseRead(payload);
     process.exit(0);
   }
   const raw = payload.tool_input && payload.tool_input.command;
@@ -176,13 +204,13 @@ if (mode === 'pre') {
   const leave = (code) => { if (notes.length) emitContext(notes.join('\n')); process.exit(code); };
   let gate = null;
   try { gate = retest.before(payload, process.env.VIBE_HOME_DIR || os.homedir()); } catch { /* the command runs */ }
-  if (gate?.decision === 'block') { process.stderr.write(`${gate.message}\n`); process.exit(2); }
+  if (gate?.decision === 'block') { process.stderr.write(`${gate.message}\n`); process.exit(BLOCK_EXIT); }
   if (gate?.decision === 'warn') notes.push(gate.message);
   if (personal && tokenPolicy() === 'off') leave(0);
   const slice = personal ? { decision: 'allow' } : sliceRuntime.sliceGuard(root, command, sliceClient(), cwd);
-  if (slice.decision === 'block') { process.stderr.write(`${slice.message}\n`); process.exit(2); }
+  if (slice.decision === 'block') { process.stderr.write(`${slice.message}\n`); process.exit(BLOCK_EXIT); }
   if (slice.decision === 'warn') notes.push(slice.message);
-  if (!fs.existsSync(path.join(root, '.vibe'))) leave(0);
+  if (!hasProjectDir()) leave(0);
   // Every segment is judged — `echo x && git push`, `ls; rm -rf build`, `cat x | git push` carry the action in a later one
   // Vibe gates its own execution; its approval and inbox commands must remain reachable.
   const segments = command.split(/&&|\|\||;|\||\n/).map((s) => s.trim()).filter((s) => s && !READS_ONLY.test(s) && !/^vibe(?:\s|$)/.test(s));
@@ -190,8 +218,8 @@ if (mode === 'pre') {
   for (const [action, re] of IRREVERSIBLE) {
     if (segments.some((s) => re.test(s)) && !recentAuthorize(action)) {
       const blocking = tokenPolicy() !== 'off';
-      process.stderr.write(`[vibe] "${action}" is irreversible and no authorize record exists in the last 10 minutes — ${blocking ? 'blocked: ' : ''}get a human token with \`vibe ask --needs authorize:${action}\` and run \`vibe authorize\` first, as its own command: the gate reads the ledger before this command runs, so an authorize chained in front of the action is not seen\n`);
-      if (blocking) process.exit(2);
+      process.stderr.write(`${irreversibleNotice(action, blocking)}\n`);
+      if (blocking) process.exit(BLOCK_EXIT);
       leave(0);
     }
   }
@@ -200,8 +228,8 @@ if (mode === 'pre') {
 
 // Inside the npm package dist/cli.js sits next to us; inside a plugin tree it does not, so fall back to `vibe` on PATH.
 const result = fs.existsSync(cli)
-  ? spawnSync(process.execPath, [cli, 'state', '--json'], { cwd: root, encoding: 'utf-8', timeout: 15000 })
-  : spawnSync('vibe', ['state', '--json'], { cwd: root, encoding: 'utf-8', timeout: 15000, shell: process.platform === 'win32' });
+  ? spawnSync(process.execPath, [cli, 'state', '--json'], { cwd: root, encoding: 'utf-8', timeout: STATE_TIMEOUT_MS })
+  : spawnSync('vibe', ['state', '--json'], { cwd: root, encoding: 'utf-8', timeout: STATE_TIMEOUT_MS, shell: process.platform === 'win32' });
 if (result.status !== 0 || !result.stdout) process.exit(0);
 try {
   const view = JSON.parse(result.stdout);

package/hooks/obsidian.cjs

@@ -4,16 +4,22 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { createHash, randomBytes } = require('node:crypto');
 
+const REGISTRY_FILE = 'obsidian.json';
+const VAULT_ID_CHARS = 16;
+const TEMP_SUFFIX_BYTES = 6;
+
 function readJson(file) {
   try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
 }
 
 /** Where Obsidian keeps its vault list on each platform, including the Flatpak build on Linux. */
 function obsidianRegistries(home, platform = process.platform, env = process.env) {
-  if (platform === 'darwin') return [path.join(home, 'Library', 'Application Support', 'obsidian', 'obsidian.json')];
-  if (platform === 'win32') return [path.join(env.APPDATA || path.join(home, 'AppData', 'Roaming'), 'obsidian', 'obsidian.json')];
-  return [path.join(env.XDG_CONFIG_HOME || path.join(home, '.config'), 'obsidian', 'obsidian.json'),
-    path.join(home, '.var', 'app', 'md.obsidian.Obsidian', 'config', 'obsidian', 'obsidian.json')];
+  if (platform === 'darwin') return [path.join(home, 'Library', 'Application Support', 'obsidian', REGISTRY_FILE)];
+  if (platform === 'win32') return [path.join(env.APPDATA || path.join(home, 'AppData', 'Roaming'), 'obsidian', REGISTRY_FILE)];
+  return [
+    path.join(env.XDG_CONFIG_HOME || path.join(home, '.config'), 'obsidian', REGISTRY_FILE),
+    path.join(home, '.var', 'app', 'md.obsidian.Obsidian', 'config', 'obsidian', REGISTRY_FILE),
+  ];
 }
 
 /** Registered vaults that still exist, by real path: the open one first, then the most recently used. */
@@ -29,7 +35,11 @@ function obsidianVaults(home, platform, env) {
   return [...found.values()].sort((a, b) => Number(b.open) - Number(a.open) || b.ts - a.ts);
 }
 
-const CLOUD = [['Mobile Documents', 'iCloud'], ['iCloud', 'iCloud'], ['Dropbox', 'Dropbox'], ['OneDrive', 'OneDrive'], ['Google Drive', 'Google Drive'], ['CloudStorage', 'a cloud drive']];
+// A folder name in a path, and the service whose sync folder carries it.
+const CLOUD = [
+  ['Mobile Documents', 'iCloud'], ['iCloud', 'iCloud'], ['Dropbox', 'Dropbox'], ['OneDrive', 'OneDrive'],
+  ['Google Drive', 'Google Drive'], ['CloudStorage', 'a cloud drive'],
+];
 
 /** The service that copies this folder off the computer, when its path or Obsidian's own Sync plugin shows one. */
 function syncedBy(folder) {
@@ -76,9 +86,9 @@ function connectVault(folder, home, platform, env) {
   if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return 'waiting';
   const real = fs.realpathSync(folder);
   if (obsidianVaults(home, platform, env).some(v => real === v.path || real.startsWith(`${v.path}${path.sep}`))) return 'in-vault';
-  const id = createHash('sha256').update(real).digest('hex').slice(0, 16);
+  const id = createHash('sha256').update(real).digest('hex').slice(0, VAULT_ID_CHARS);
   const next = { ...doc, vaults: { ...(doc.vaults ?? {}), [id]: { path: real, ts: Date.now() } } };
-  const temporary = `${registry}.${randomBytes(6).toString('hex')}.tmp`;
+  const temporary = `${registry}.${randomBytes(TEMP_SUFFIX_BYTES).toString('hex')}.tmp`;
   fs.writeFileSync(temporary, JSON.stringify(next));
   fs.renameSync(temporary, registry);
   return 'connected';

package/hooks/private-store.cjs

@@ -3,31 +3,44 @@ const os = require('node:os');
 const path = require('node:path');
 const { randomBytes } = require('node:crypto');
 
+const STORE_DIR = '.vibe-runtime';
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+// Any group or other permission bit.
+const OTHERS_MASK = 0o077;
+const DEFAULT_MAX_BYTES = 2 * 1024 * 1024;
+const TEMP_SUFFIX_BYTES = 12;
+const ENTRY_NAME = /^[a-z0-9.-]+$/i;
+const LINKED_ENTRY = 'local store entry must be a real private directory or regular file, never linked';
+const PERMISSIONS = 'local store permissions must be owner-private (0700 directory, 0600 file)';
+const CHANGED_ENTRY = 'local store entry changed or exceeds its read limit';
+
 function inside(parent, file) {
   const relative = path.relative(parent, file);
   return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
 }
 function privateEntry(stat, directory) {
-  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile()) || (!directory && stat.nlink !== 1)) throw new Error('local store entry must be a real private directory or regular file, never linked');
-  if (process.platform !== 'win32' && (stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)) throw new Error('local store permissions must be owner-private (0700 directory, 0600 file)');
+  const wrongKind = directory ? !stat.isDirectory() : !stat.isFile();
+  if (stat.isSymbolicLink() || wrongKind || (!directory && stat.nlink !== 1)) throw new Error(LINKED_ENTRY);
+  if (process.platform !== 'win32' && (stat.uid !== process.getuid?.() || (stat.mode & OTHERS_MASK) !== 0)) throw new Error(PERMISSIONS);
   return stat;
 }
 function privateStat(file, directory) { return privateEntry(fs.lstatSync(file), directory); }
 function privateDirectory(root, create, homeDirectory = os.homedir()) {
   const home = fs.realpathSync(homeDirectory);
-  const dir = path.join(home, '.vibe-runtime');
+  const dir = path.join(home, STORE_DIR);
   if (inside(fs.realpathSync(root), dir)) throw new Error('local execution consent storage must be outside the project');
   if (!fs.lstatSync(dir, { throwIfNoEntry: false })) {
     if (!create) return dir;
-    fs.mkdirSync(dir, { mode: 0o700 });
+    fs.mkdirSync(dir, { mode: DIRECTORY_MODE });
   }
   privateStat(dir, true);
   return dir;
 }
 function entryName(name) {
-  if (!/^[a-z0-9.-]+$/i.test(name)) throw new Error('invalid local store entry name');
+  if (!ENTRY_NAME.test(name)) throw new Error('invalid local store entry name');
 }
-function readPrivate(root, name, maxBytes = 2097152, homeDirectory) {
+function readPrivate(root, name, maxBytes = DEFAULT_MAX_BYTES, homeDirectory) {
   entryName(name);
   const dir = privateDirectory(root, false, homeDirectory);
   if (!fs.existsSync(dir)) return null;
@@ -37,11 +50,13 @@ function readPrivate(root, name, maxBytes = 2097152, homeDirectory) {
   const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
   try {
     const actual = privateEntry(fs.fstatSync(fd), false);
-    if (actual.dev !== before.dev || actual.ino !== before.ino || actual.size > maxBytes) throw new Error('local store entry changed or exceeds its read limit');
+    if (actual.dev !== before.dev || actual.ino !== before.ino || actual.size > maxBytes) throw new Error(CHANGED_ENTRY);
     const buffer = Buffer.alloc(maxBytes + 1);
     const length = fs.readSync(fd, buffer, 0, buffer.length, 0);
     const after = privateStat(file, false);
-    if (length > maxBytes || length !== actual.size || after.ino !== actual.ino || after.dev !== actual.dev || after.size !== actual.size || after.mtimeMs !== actual.mtimeMs || after.ctimeMs !== actual.ctimeMs) throw new Error('local store entry changed or exceeds its read limit');
+    const same = after.ino === actual.ino && after.dev === actual.dev && after.size === actual.size
+      && after.mtimeMs === actual.mtimeMs && after.ctimeMs === actual.ctimeMs;
+    if (length > maxBytes || length !== actual.size || !same) throw new Error(CHANGED_ENTRY);
     return buffer.subarray(0, length).toString('utf8');
   } finally { fs.closeSync(fd); }
 }
@@ -50,8 +65,8 @@ function writePrivate(root, name, text, homeDirectory) {
   const dir = privateDirectory(root, true, homeDirectory);
   const file = path.join(dir, name);
   if (fs.lstatSync(file, { throwIfNoEntry: false })) privateStat(file, false);
-  const temporary = path.join(dir, `${name}.${randomBytes(12).toString('hex')}.tmp`);
-  fs.writeFileSync(temporary, text, { flag: 'wx', mode: 0o600 });
+  const temporary = path.join(dir, `${name}.${randomBytes(TEMP_SUFFIX_BYTES).toString('hex')}.tmp`);
+  fs.writeFileSync(temporary, text, { flag: 'wx', mode: FILE_MODE });
   try { privateStat(dir, true); fs.renameSync(temporary, file); }
   finally { if (fs.existsSync(temporary)) fs.unlinkSync(temporary); }
   return file;

package/hooks/retest.cjs

@@ -5,19 +5,32 @@
 // in front of a command lets one run through when the user asked for it or the test depends on more than files.
 const fs = require('node:fs');
 const path = require('node:path');
+const { vibeConfig, SETTINGS } = require('./locations.cjs');
 const { spawnSync } = require('node:child_process');
 const { createHash } = require('node:crypto');
-const { segments, runOutcome } = require('./knowledge-journal.cjs');
+const { DAY, segments, runOutcome } = require('./knowledge-journal.cjs');
 const { readPrivate, writePrivate } = require('./private-store.cjs');
 
-const DAY = 86400000;
 const MODES = ['block', 'warn', 'off'];
 const KEEP_PASSED = 100;
 const KEEP_EVENTS = 500;
 const MAX_FILES = 2000;
-const HASH_LIMIT = 16777216;
+// A file larger than this is fingerprinted by size and modification time instead of its content.
+const HASH_LIMIT = 16 * 1024 * 1024;
+const STORE_MAX_BYTES = 1024 * 1024;
+const GIT_TIMEOUT_MS = 3000;
+// How long the gate's own stops and warnings are kept and reported.
+const EVENT_DAYS = 30;
+const STORE_HASH_CHARS = 32;
+const STATE_HASH_CHARS = 16;
+const SUMMARY_COMMANDS = 10;
+// The `HH:MM` part of an ISO time.
+const CLOCK_START = 11;
+const CLOCK_END = 16;
+// `git status --porcelain=v1` puts two status letters and a space before the path.
+const STATUS_PREFIX = 3;
 
-const settingsFile = home => path.join(home, '.config', 'vibe', 'retest.json');
+const settingsFile = home => vibeConfig(home, SETTINGS.retest);
 function mode(home) {
   try { const raw = JSON.parse(fs.readFileSync(settingsFile(home), 'utf8')); return MODES.includes(raw.mode) ? raw.mode : 'block'; } catch { return 'block'; }
 }
@@ -51,7 +64,7 @@ function testCommand(command) {
 const bypassed = command => segments(unwrapped(command)).some(part => /^(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*VIBE_RETEST=1(?:\s|$)/.test(part));
 
 function git(cwd, args) {
-  const r = spawnSync('git', args, { cwd, encoding: 'buffer', timeout: 3000, windowsHide: true });
+  const r = spawnSync('git', args, { cwd, encoding: 'buffer', timeout: GIT_TIMEOUT_MS, windowsHide: true });
   return r.status === 0 ? r.stdout : null;
 }
 function fileId(file) {
@@ -70,17 +83,17 @@ function workState(cwd) {
   const [root, head] = top;
   const status = git(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all', '--no-renames']);
   if (status === null) return null;
-  const files = status.toString('utf8').split('\0').filter(Boolean).map(entry => entry.slice(3)).filter(file => !file.startsWith('.vibe/')).sort();
+  const files = status.toString('utf8').split('\0').filter(Boolean).map(entry => entry.slice(STATUS_PREFIX)).filter(file => !file.startsWith('.vibe/')).sort();
   if (files.length > MAX_FILES) return null;
   const hash = createHash('sha256').update(head);
   for (const file of files) hash.update(`\n${file}:${fileId(path.join(root, file))}`);
-  return { root: fs.realpathSync(root), state: hash.digest('hex').slice(0, 16) };
+  return { root: fs.realpathSync(root), state: hash.digest('hex').slice(0, STATE_HASH_CHARS) };
 }
 
-const storeName = root => `retest-${createHash('sha256').update(root).digest('hex').slice(0, 32)}.json`;
+const storeName = root => `retest-${createHash('sha256').update(root).digest('hex').slice(0, STORE_HASH_CHARS)}.json`;
 function readStore(root, home) {
   try {
-    const raw = JSON.parse(readPrivate(root, storeName(root), 1048576, home) ?? '{}');
+    const raw = JSON.parse(readPrivate(root, storeName(root), STORE_MAX_BYTES, home) ?? '{}');
     return { passed: Array.isArray(raw.passed) ? raw.passed : [], events: Array.isArray(raw.events) ? raw.events : [] };
   } catch { return { passed: [], events: [] }; }
 }
@@ -91,8 +104,18 @@ function where(payload) {
   const cwd = input.cwd ?? input.workdir ?? payload.cwd ?? process.cwd();
   return path.resolve(typeof cwd === 'string' ? cwd : process.cwd());
 }
-const folderOf = (root, cwd) => { try { return path.relative(root, fs.realpathSync(cwd)).split(path.sep).join('/'); } catch { return path.relative(root, cwd); } };
-const clock = at => new Date(at).toISOString().slice(11, 16);
+function folderOf(root, cwd) {
+  let real = cwd;
+  try { real = fs.realpathSync(cwd); } catch { /* a folder that is gone is compared as given */ }
+  return path.relative(root, real).split(path.sep).join('/');
+}
+const clock = at => new Date(at).toISOString().slice(CLOCK_START, CLOCK_END);
+
+const BLOCKED = [
+  'not run again. Use that result.',
+  'Run it again only when the user asks or the test depends on something outside the files (a service, data, the clock):',
+  'put VIBE_RETEST=1 in front of the command.',
+].join(' ');
 
 /** PreToolUse(Bash): null to let the command run, or the decision and the message for the model. */
 function before(payload, home, now = Date.now()) {
@@ -107,11 +130,11 @@ function before(payload, home, now = Date.now()) {
   const folder = folderOf(work.root, cwd);
   const hit = store.passed.find(p => p.cmd === key && p.cwd === folder && p.state === work.state);
   if (!hit) return null;
-  store.events = [...store.events.filter(e => e.at >= now - 30 * DAY), { at: now, cmd: key, action: setting }].slice(-KEEP_EVENTS);
+  store.events = [...store.events.filter(e => e.at >= now - EVENT_DAYS * DAY), { at: now, cmd: key, action: setting }].slice(-KEEP_EVENTS);
   writeStore(work.root, store, home);
   const said = `[vibe] \`${key}\` already passed on exactly this code at ${clock(hit.at)} UTC and no file has changed since`;
   return setting === 'block'
-    ? { decision: 'block', message: `${said}: not run again. Use that result. Run it again only when the user asks or the test depends on something outside the files (a service, data, the clock): put VIBE_RETEST=1 in front of the command.` }
+    ? { decision: 'block', message: `${said}: ${BLOCKED}` }
     : { decision: 'warn', message: `${said}; running it again repeats a known result unless the test depends on something outside the files.` };
 }
 
@@ -132,13 +155,13 @@ function after(payload, home, now = Date.now()) {
 function summary(cwd, home, now = Date.now()) {
   let root;
   try { root = fs.realpathSync(git(cwd, ['rev-parse', '--show-toplevel'])?.toString('utf8').trim() || cwd); } catch { root = path.resolve(cwd); }
-  const events = readStore(root, home).events.filter(e => e.at >= now - 30 * DAY);
+  const events = readStore(root, home).events.filter(e => e.at >= now - EVENT_DAYS * DAY);
   const counts = new Map();
   for (const e of events) counts.set(e.cmd, (counts.get(e.cmd) ?? 0) + 1);
   return {
-    mode: mode(home), days: 30,
+    mode: mode(home), days: EVENT_DAYS,
     stopped: events.filter(e => e.action === 'block').length, warned: events.filter(e => e.action === 'warn').length,
-    commands: [...counts].map(([command, count]) => ({ command, count })).sort((a, b) => b.count - a.count).slice(0, 10),
+    commands: [...counts].map(([command, count]) => ({ command, count })).sort((a, b) => b.count - a.count).slice(0, SUMMARY_COMMANDS),
   };
 }
 

package/hooks/session-context.cjs

@@ -1,10 +1,23 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { vibeConfig, FOLDERS } = require('./locations.cjs');
 const { readPrivate } = require('./private-store.cjs');
 const { bounded, digest } = require('./session-files.cjs');
 
-const ENVIRONMENT = ['HOME', 'USERPROFILE', 'VIBE_HOME_DIR', 'VIBE_REVIEW_CMD', 'VIBE_REVIEW_CLIENT', 'VIBE_REVIEWER_MODEL', 'VIBE_REVIEWER_EFFORT'];
+const WINDOWS_SHELL = 'C:\\Windows\\System32\\cmd.exe';
+const POSIX_SHELL = '/bin/sh';
+const MAX_CHECKS = 1000;
+const MAX_VERIFIERS = 512;
+const VERIFIER_FILE_MAX_BYTES = 1024 * 1024;
+const VERIFIER_TOTAL_MAX_BYTES = 32 * 1024 * 1024;
+const VERIFIER_DEADLINE_MS = 1000;
+const VERIFIER_LIMIT = 'verifier limit';
+const SHA256 = /^[a-f0-9]{64}$/;
+// The environment a recorded plan must still see unchanged.
+const ENVIRONMENT = [
+  'HOME', 'USERPROFILE', 'VIBE_HOME_DIR', 'VIBE_REVIEW_CMD', 'VIBE_REVIEW_CLIENT', 'VIBE_REVIEWER_MODEL', 'VIBE_REVIEWER_EFFORT',
+];
 const fingerprint = value => digest(JSON.stringify(value));
 function resolvedDirectory(directory) {
   let existing = path.resolve(directory);
@@ -13,31 +26,35 @@ function resolvedDirectory(directory) {
   return path.join(fs.realpathSync(existing), ...suffix);
 }
 function runtimeMatches(root, plan) {
-  const shell = process.platform === 'win32' ? process.env.ComSpec ?? 'C:\\Windows\\System32\\cmd.exe' : '/bin/sh';
-  if (plan.project !== fs.realpathSync(root) || plan.platform !== process.platform || plan.shell !== fs.realpathSync(shell) || plan.node !== fs.realpathSync(process.execPath)) return false;
+  const shell = process.platform === 'win32' ? process.env.ComSpec ?? WINDOWS_SHELL : POSIX_SHELL;
+  const sameRuntime = plan.project === fs.realpathSync(root) && plan.platform === process.platform
+    && plan.shell === fs.realpathSync(shell) && plan.node === fs.realpathSync(process.execPath);
+  if (!sameRuntime) return false;
   if (plan.path !== (process.env.PATH ?? '') || plan.pathExt !== (process.env.PATHEXT ?? '')) return false;
   if (!plan.environment || ENVIRONMENT.some(key => plan.environment[key] !== (process.env[key] ?? null))) return false;
-  const reviewerCwd = process.env.VIBE_REVIEW_CMD ? root : resolvedDirectory(path.join(process.env.VIBE_HOME_DIR ?? os.homedir(), '.config', 'vibe', 'reader'));
+  const readerFolder = vibeConfig(process.env.VIBE_HOME_DIR ?? os.homedir(), FOLDERS.reader);
+  const reviewerCwd = process.env.VIBE_REVIEW_CMD ? root : resolvedDirectory(readerFolder);
   if (!plan.reviewer || plan.reviewer.cwd !== reviewerCwd) return false;
   return plan.checks.every(item => {
-    const expected = item.check.type === 'review' ? reviewerCwd : fs.realpathSync(item.check.type === 'run' && item.check.cwd ? path.resolve(root, item.check.cwd) : root);
+    const { type, cwd } = item.check;
+    const expected = type === 'review' ? reviewerCwd : fs.realpathSync(type === 'run' && cwd ? path.resolve(root, cwd) : root);
     return item.cwd === expected;
   });
 }
 function verifiersMatch(plan) {
   const seen = new Map();
-  const deadline = Date.now() + 1000;
+  const deadline = Date.now() + VERIFIER_DEADLINE_MS;
   let bytes = 0;
   for (const item of plan.checks) {
-    if (!Array.isArray(item.verifiers) || item.verifiers.length > 512) throw new Error('verifier limit');
+    if (!Array.isArray(item.verifiers) || item.verifiers.length > MAX_VERIFIERS) throw new Error(VERIFIER_LIMIT);
     for (const verifier of item.verifiers) {
-      if (Date.now() > deadline) throw new Error('verifier limit');
-      if (typeof verifier.file !== 'string' || !path.isAbsolute(verifier.file) || !/^[a-f0-9]{64}$/.test(verifier.sha256)) return false;
+      if (Date.now() > deadline) throw new Error(VERIFIER_LIMIT);
+      if (typeof verifier.file !== 'string' || !path.isAbsolute(verifier.file) || !SHA256.test(verifier.sha256)) return false;
       if (!seen.has(verifier.file)) {
-        if (seen.size >= 512) throw new Error('verifier limit');
-        const content = bounded(verifier.file, 1048576);
+        if (seen.size >= MAX_VERIFIERS) throw new Error(VERIFIER_LIMIT);
+        const content = bounded(verifier.file, VERIFIER_FILE_MAX_BYTES);
         bytes += content.length;
-        if (bytes > 33554432) throw new Error('verifier limit');
+        if (bytes > VERIFIER_TOTAL_MAX_BYTES) throw new Error(VERIFIER_LIMIT);
         seen.set(verifier.file, digest(content));
       }
       if (seen.get(verifier.file) !== verifier.sha256) return false;
@@ -47,7 +64,7 @@ function verifiersMatch(plan) {
 }
 function contextStatus(root, plan) {
   try {
-    if (!plan || plan.schemaVersion !== 1 || !Array.isArray(plan.checks) || plan.checks.length > 1000) return 'unavailable';
+    if (!plan || plan.schemaVersion !== 1 || !Array.isArray(plan.checks) || plan.checks.length > MAX_CHECKS) return 'unavailable';
     const receipt = readPrivate(root, `consent-${fingerprint(root)}.json`);
     if (receipt === null) return 'stale';
     const saved = JSON.parse(receipt);