@sun-asterisk/sungen 3.2.34-beta.1 → 3.3.0-alpha.1

package/dist/hooks/claude-transcript-turn.js

@@ -0,0 +1,143 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.summarizeTurn = summarizeTurn;
+/**
+ * What happened in the turn that just ended, read from the tail of Claude Code's transcript.
+ *
+ * The Stop hook must not nag every turn of every conversation in a sungen project — only a turn
+ * that ran sungen work and then ended without handing back. The transcript (JSONL) answers both:
+ * walk back from its end to the human prompt that opened the turn, noting sungen activity and any
+ * AskUserQuestion that came after it.
+ *
+ * The transcript is untrusted data: each line is JSON-parsed and inspected as strings. Nothing in
+ * it is ever executed.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Enough for any realistic turn; a transcript can be many MB and the hook has a time budget. */
+const TAIL_BYTES = 512 * 1024;
+const SUNGEN_BASH = /(?:^|[\s;&|(])(?:\S*\/)?sungen(?:\.js)?\s+[a-z]/;
+const UNIT_FLAG = /--(?:screen|flow|area|api)[= ]([\w.-]+(?:\/[\w.-]+)?)/g;
+/** `/sungen:<cmd>` typed, or as Claude Code records it; the unit argument is optional. */
+const SLASH = /\/sungen:[a-z-]+(?:(?:<\/command-name>[\s\S]*?<command-args>|[ \t]+)([\w.-]+))?/;
+function readTail(file) {
+    const fd = fs.openSync(file, 'r');
+    try {
+        const size = fs.fstatSync(fd).size;
+        const start = Math.max(0, size - TAIL_BYTES);
+        const buf = Buffer.alloc(size - start);
+        // Only the bytes actually read: a transcript truncated between fstat and read must not leave
+        // zero-filled garbage at the end of the buffer.
+        const read = fs.readSync(fd, buf, 0, buf.length, start);
+        const lines = buf.subarray(0, read).toString('utf8').split('\n');
+        return start > 0 ? lines.slice(1) : lines; // the first line of a cut tail is partial
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+const lastUnitIn = (s) => [...s.matchAll(UNIT_FLAG)].pop()?.[1];
+/** The human prompt's text, or null when this user entry is a tool result or injected meta. */
+function promptText(e) {
+    if (e.type !== 'user' || e.isMeta === true || e.message?.role !== 'user')
+        return null;
+    const c = e.message.content;
+    if (typeof c === 'string')
+        return c;
+    if (!Array.isArray(c))
+        return null;
+    const text = c.filter((b) => b?.type === 'text' && typeof b.text === 'string').map((b) => b.text);
+    return text.length ? text.join('\n') : null;
+}
+/** Summarize the last turn, or null when the transcript cannot be read (callers fail open). */
+function summarizeTurn(transcriptPath) {
+    if (typeof transcriptPath !== 'string' || !path.isAbsolute(transcriptPath))
+        return null;
+    let lines;
+    try {
+        lines = readTail(transcriptPath);
+    }
+    catch {
+        return null;
+    }
+    const turn = { sungenActivity: false, askedAfter: false };
+    // Walking backwards, the first unit seen is the most recently named one.
+    const sawSungen = (unit) => {
+        turn.lastUnit ?? (turn.lastUnit = unit);
+        turn.sungenActivity = true;
+    };
+    for (let i = lines.length - 1; i >= 0; i--) {
+        let e;
+        try {
+            e = JSON.parse(lines[i]);
+        }
+        catch {
+            continue;
+        }
+        if (!e || typeof e !== 'object')
+            continue;
+        const prompt = promptText(e);
+        if (prompt !== null) {
+            const m = prompt.match(SLASH);
+            if (m)
+                sawSungen(m[1]);
+            break; // the turn starts here
+        }
+        if (e.type !== 'assistant' || !Array.isArray(e.message?.content))
+            continue;
+        const blocks = e.message.content;
+        for (let j = blocks.length - 1; j >= 0; j--) {
+            const b = blocks[j];
+            if (b?.type !== 'tool_use' || !b.input || typeof b.input !== 'object')
+                continue;
+            const input = b.input;
+            if (b.name === 'AskUserQuestion') {
+                if (!turn.sungenActivity)
+                    turn.askedAfter = true;
+                continue;
+            }
+            const cmd = typeof input.command === 'string' ? input.command : '';
+            if (b.name === 'Bash' && SUNGEN_BASH.test(cmd))
+                sawSungen(lastUnitIn(cmd));
+            else if (b.name === 'SlashCommand' && cmd.includes('/sungen:'))
+                sawSungen(cmd.match(SLASH)?.[1]);
+            else if (b.name === 'Skill' && typeof input.skill === 'string' && input.skill.startsWith('sungen'))
+                sawSungen();
+        }
+    }
+    return turn;
+}
+//# sourceMappingURL=claude-transcript-turn.js.map

package/dist/hooks/claude-transcript-turn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-transcript-turn.js","sourceRoot":"","sources":["../../src/hooks/claude-transcript-turn.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,sCAmCC;AA/FD;;;;;;;;;;GAUG;AACH,uCAAyB;AACzB,2CAA6B;AAW7B,iGAAiG;AACjG,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC;AAC9B,MAAM,WAAW,GAAG,iDAAiD,CAAC;AACtE,MAAM,SAAS,GAAG,wDAAwD,CAAC;AAC3E,0FAA0F;AAC1F,MAAM,KAAK,GAAG,iFAAiF,CAAC;AAKhG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QACvC,6FAA6F;QAC7F,gDAAgD;QAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,0CAA0C;IACvF,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAsB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5F,+FAA+F;AAC/F,SAAS,UAAU,CAAC,CAAQ;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAI,CAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,+FAA+F;AAC/F,SAAgB,aAAa,CAAC,cAAuB;IACnD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAEhE,MAAM,IAAI,GAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvE,yEAAyE;IACzE,MAAM,SAAS,GAAG,CAAC,IAAa,EAAQ,EAAE;QACxC,IAAI,CAAC,QAAQ,KAAb,IAAI,CAAC,QAAQ,GAAK,IAAI,EAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAQ,CAAC;QACb,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAU,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC;gBAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,CAAC,uBAAuB;QAChC,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,SAAS;QAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,OAAQ,CAAC,OAAkB,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAChF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAgC,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,cAAc;oBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjG,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;iBACtE,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS,EAAE,CAAC;QAClH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hooks/guard-delivery-contract-rule.d.ts

@@ -0,0 +1,10 @@
+import type { GuardRule } from './guard-rules';
+interface Invocation {
+    dir: string;
+    names: string[];
+}
+/** Every `sungen delivery …` the command line would run, with the unit names it passes ([] = every unit). */
+export declare function deliveryInvocations(command: string, cwd: string): Invocation[];
+export declare const deliveryContractVerdict: GuardRule;
+export {};
+//# sourceMappingURL=guard-delivery-contract-rule.d.ts.map

package/dist/hooks/guard-delivery-contract-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-delivery-contract-rule.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-delivery-contract-rule.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAY/C,UAAU,UAAU;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE;AA2BrD,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAiB9E;AAYD,eAAO,MAAM,uBAAuB,EAAE,SAmBrC,CAAC"}

package/dist/hooks/guard-delivery-contract-rule.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliveryContractVerdict = void 0;
+exports.deliveryInvocations = deliveryInvocations;
+/**
+ * Guard rule `delivery-contract-verdict` (phase 06, OES-12.3, DOS-14.4, takumi T4): Claude Code may
+ * not run `sungen delivery` while a delivered unit's Test Contract verdict is not `pass`.
+ *
+ *   - the verdict is REBUILT from .feature + lock + git HEAD (buildContractVerdict); the report file
+ *     is never read, so a hand-edited "pass" there is ignored
+ *   - which units: those `delivery` itself would deliver (contract-units.ts) — every candidate of an
+ *     ambiguous name, api flows included; bare `delivery`, a runner (`npx`, `pnpm dlx`, `tsx`, `node`…)
+ *     whose sungen cannot be named, or a `bash -c` / `eval` wrapper → every unit
+ *   - recognized: `sungen`, `sungen.js`, `@scope/sungen@1.2.3`, `sungen@latest`; `delivery --check`
+ *     (writes nothing) is allowed; a unit with no lock in the tree or in HEAD is skipped
+ *   - git runs with a ≈3 s timeout (the hook's own budget is 5 s); git failing while a lock exists,
+ *     or any other read error, → `ask` (onError), never a silent pass
+ *   - the command is only tokenized, never executed; unit names are matched against directories
+ *
+ * The contract module loads only when a command mentions both `sungen` (or a runner) and `delivery`,
+ * so every other Edit/Write/Bash call pays nothing for this rule.
+ */
+const path = __importStar(require("path"));
+const bash_write_targets_1 = require("./bash-write-targets");
+const sungen_project_root_1 = require("./sungen-project-root");
+const SUNGEN = /^sungen(?:\.js)?(?:@[^/]*)?$/;
+const RUNNERS = new Set(['npx', 'pnpm', 'yarn', 'bunx', 'bun', 'npm', 'tsx', 'ts-node', 'node', 'deno']);
+/** delivery options that take a value (commander would consume the next word). */
+const VALUE_OPTS = new Set(['--env', '--format', '--approve']);
+const READ_ONLY_OPTS = new Set(['--check', '--help', '-h']);
+const WRAPPED = /\b(?:bash|sh|zsh|dash|eval|xargs)\b/;
+const MENTION = /\bsungen\b[^\n]*\bdelivery\b/;
+const GUARD_GIT_TIMEOUT_MS = 3000;
+function namesAfter(args) {
+    const names = [];
+    for (let i = 0; i < args.length; i++) {
+        if (VALUE_OPTS.has(args[i])) {
+            i++;
+            continue;
+        }
+        if (!args[i].startsWith('-'))
+            names.push(args[i]);
+    }
+    return names;
+}
+/**
+ * Where `delivery` sits as sungen's subcommand, or -1. Only options, and a word that may be an
+ * option's value (`--env staging`), may precede it — so `sungen --env x delivery` is caught while
+ * `sungen add --screen delivery` (a unit named delivery) is not a delivery call.
+ */
+function deliverySubcommandAt(rest) {
+    for (let i = 0; i < rest.length; i++) {
+        if (rest[i] === 'delivery')
+            return i;
+        if (rest[i].startsWith('-'))
+            continue;
+        const prev = rest[i - 1];
+        if (prev && prev.startsWith('--') && !prev.includes('='))
+            continue;
+        return -1;
+    }
+    return -1;
+}
+/** Every `sungen delivery …` the command line would run, with the unit names it passes ([] = every unit). */
+function deliveryInvocations(command, cwd) {
+    const out = [];
+    for (const seg of (0, bash_write_targets_1.bashSegments)(command, cwd)) {
+        const words = [seg.cmd, ...seg.words];
+        const at = words.findIndex((w) => SUNGEN.test(path.basename(w)));
+        if (at >= 0) {
+            const rest = words.slice(at + 1);
+            const sub = deliverySubcommandAt(rest);
+            if (sub < 0)
+                continue;
+            const args = rest.slice(sub + 1);
+            if (!args.some((a) => READ_ONLY_OPTS.has(a)))
+                out.push({ dir: seg.dir, names: namesAfter(args) });
+        }
+        else if (RUNNERS.has(seg.cmd) && seg.words.includes('delivery') && !seg.words.some((a) => READ_ONLY_OPTS.has(a))) {
+            out.push({ dir: seg.dir, names: [] }); // `tsx src/cli/index.ts delivery`, `node dist/cli/index.js delivery`
+        }
+    }
+    if (!out.length && MENTION.test(command) && WRAPPED.test(command))
+        out.push({ dir: cwd, names: [] });
+    return out;
+}
+function denyFor(blockers) {
+    const lines = blockers.slice(0, 5).map((b) => `\`${b.unit}\` is ${b.verdict}: ${b.headline} — see \`sungen contract check --screen ${b.unit}\``);
+    return {
+        status: 'deny',
+        denyReason: `sungen: delivery is blocked — the Test Contract does not pass.\n${lines.join('\n')}${blockers.length > 5 ? `\n(+${blockers.length - 5} more)` : ''}\n`
+            + 'Restore the approved checks in the .feature, or ask QA to approve the change themselves on a terminal (`sungen contract approve --screen <unit>`). '
+            + 'Do not edit the lock or the report.',
+    };
+}
+exports.deliveryContractVerdict = {
+    id: 'delivery-contract-verdict',
+    onError: 'ask',
+    check(call) {
+        const cmd = call.tool === 'Bash' ? call.bashCommand : undefined;
+        if (!cmd || !cmd.includes('delivery'))
+            return null;
+        const invocations = deliveryInvocations(cmd, call.cwd);
+        if (!invocations.length)
+            return null;
+        const units = require('../contract/contract-units');
+        const { contractBlockers } = require('../contract/project-contract-blockers');
+        const blockers = [];
+        for (const inv of invocations) {
+            const root = (0, sungen_project_root_1.findSungenRoot)(inv.dir);
+            if (!root)
+                continue;
+            const targets = inv.names.length ? inv.names.flatMap((n) => units.deliveryUnitsNamed(root, n)) : units.allContractUnits(root);
+            blockers.push(...contractBlockers(root, targets, { gitTimeoutMs: GUARD_GIT_TIMEOUT_MS }));
+        }
+        return blockers.length ? denyFor(blockers) : null;
+    },
+};
+//# sourceMappingURL=guard-delivery-contract-rule.js.map

package/dist/hooks/guard-delivery-contract-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-delivery-contract-rule.js","sourceRoot":"","sources":["../../src/hooks/guard-delivery-contract-rule.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,kDAiBC;AA9ED;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAA6B;AAE7B,6DAAoD;AAEpD,+DAAuD;AAEvD,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACzG,kFAAkF;AAClF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAC/C,MAAM,oBAAoB,GAAG,IAAK,CAAC;AAInC,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAc;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACnE,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,6GAA6G;AAC7G,SAAgB,mBAAmB,CAAC,OAAe,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAA,iCAAY,EAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,GAAG,GAAG,CAAC;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAG,qEAAqE;QAChH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,QAAoE;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,2CAA2C,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACjJ,OAAO;QACL,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,mEAAmE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI;cAC/J,qJAAqJ;cACrJ,qCAAqC;KAC1C,CAAC;AACJ,CAAC;AAEY,QAAA,uBAAuB,GAAc;IAChD,EAAE,EAAE,2BAA2B;IAC/B,OAAO,EAAE,KAAK;IACd,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,4BAA4B,CAAgD,CAAC;QACnG,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,uCAAuC,CAA2D,CAAC;QACxI,MAAM,QAAQ,GAA+D,EAAE,CAAC;QAChF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC9H,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;CACF,CAAC"}

package/dist/hooks/guard-protected-paths.d.ts

@@ -0,0 +1,9 @@
+/** `abs` relative to its sungen project, when it is an approval record (lock, decision, approval state); else null. */
+export declare function approvalRecordPath(abs: string): string | null;
+/** `abs` relative to its sungen project, when it is a trace evidence store; else null. */
+export declare function traceEvidencePath(abs: string): string | null;
+/** The hook-control file `abs` is (as its project-relative name), or null. */
+export declare function hookControlPath(abs: string): string | null;
+/** Does this command word name a protected path — as text, or once resolved against `dir`? */
+export declare function mentionsProtectedPath(word: string, dir: string): boolean;
+//# sourceMappingURL=guard-protected-paths.d.ts.map

package/dist/hooks/guard-protected-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-protected-paths.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":"AA0CA,uHAAuH;AACvH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIxE"}

package/dist/hooks/guard-protected-paths.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.approvalRecordPath = approvalRecordPath;
+exports.traceEvidencePath = traceEvidencePath;
+exports.hookControlPath = hookControlPath;
+exports.mentionsProtectedPath = mentionsProtectedPath;
+/**
+ * Which paths the pre-tool guard protects, and how (P0.1 + review fixes H2, L5).
+ *
+ *   approval records — DENY an agent write:
+ *     qa/**\/contracts.lock.yaml
+ *     qa/decisions/<id>.yaml                       (project decisions, phase 03)
+ *     qa/<screens|flows|api[/flows]>/<unit>/decisions/<id>.yaml   (unit decisions)
+ *     .sungen/journey/<slug>.state.json            (legacy waivers and their dual-written copy, DOS-13.5)
+ *     .sungen/viewpoint-baseline.json              (the accepted viewpoint declaration)
+ *     — the CLI still writes the last two itself; the guard only judges an agent's tool calls
+ *   trace evidence — DENY an agent write (phase 08; the verdict trusts it only as far as this guard and git review):
+ *     .sungen/trace-identity/**                    (the driver's identity answers — written by the CLI)
+ *     test-results/sungen-run-record*.json         (run id + test-file hashes — written by the Playwright reporter)
+ *   hook control — ASK before an agent write (the agent must not switch its own guard off):
+ *     qa/sungen.config.yaml · .claude/settings.json · .claude/settings.local.json ·
+ *     .claude/hooks/sungen-hook.cjs
+ *
+ * The human path for the hook-control files is editing them by hand, then `sungen update`.
+ * A `decisions/` folder anywhere else (e.g. `requirements/decisions/notes.md`) is not a record.
+ */
+const path = __importStar(require("path"));
+const sungen_project_root_1 = require("./sungen-project-root");
+const LOCK = /^qa\/(?:.+\/)?contracts\.lock\.yaml$/i;
+const DECISION = /^qa\/(?:(?:screens|flows|api(?:\/flows)?)\/[^/]+\/)?decisions\/[^/]+/i;
+const APPROVAL_STATE = /^\.sungen\/(?:journey\/[^/]+\.state\.json|viewpoint-baseline\.json)$/i;
+/** Trace evidence (phase 08, DOS-14.6): the driver's identity answers and the run records. */
+const TRACE_EVIDENCE = /^(?:\.sungen\/trace-identity\/.+|test-results\/sungen-run-record(?:\.[A-Za-z0-9._-]+)?\.json)$/i;
+const HOOK_CONTROL = ['qa/sungen.config.yaml', '.claude/settings.json', '.claude/settings.local.json', '.claude/hooks/sungen-hook.cjs'];
+/** The same paths as they appear INSIDE a command string (e.g. in `bash -c "…"` or `python -c "…"`). */
+const MENTIONS = [
+    /contracts\.lock\.yaml/i,
+    /(?:^|[^\w.-])qa\/(?:(?:screens|flows|api(?:\/flows)?)\/[^/\s'"]+\/)?decisions\//i,
+    /\.sungen\/(?:journey\/[^/\s'"]+\.state\.json|viewpoint-baseline\.json)/i,
+    /(?:^|[/\s'"=])(?:qa\/sungen\.config\.yaml|\.claude\/settings(?:\.local)?\.json|\.claude\/hooks\/sungen-hook\.cjs)/i,
+    /\.sungen\/trace-identity\//i,
+    /(?:^|[/\s'"=])sungen-run-record(?:\.[A-Za-z0-9._-]+)?\.json/i,
+];
+const posix = (p) => p.split(path.sep).join('/');
+/** `abs` relative to its sungen project, when it is an approval record (lock, decision, approval state); else null. */
+function approvalRecordPath(abs) {
+    const root = (0, sungen_project_root_1.findSungenRoot)(path.dirname(abs));
+    if (!root)
+        return null;
+    const rel = posix(path.relative(root, abs));
+    return LOCK.test(rel) || DECISION.test(rel) || APPROVAL_STATE.test(rel) ? rel : null;
+}
+/** `abs` relative to its sungen project, when it is a trace evidence store; else null. */
+function traceEvidencePath(abs) {
+    const root = (0, sungen_project_root_1.findSungenRoot)(path.dirname(abs));
+    if (!root)
+        return null;
+    const rel = posix(path.relative(root, abs));
+    return TRACE_EVIDENCE.test(rel) ? rel : null;
+}
+/** The hook-control file `abs` is (as its project-relative name), or null. */
+function hookControlPath(abs) {
+    const p = posix(path.resolve(abs)).toLowerCase();
+    return HOOK_CONTROL.find((rel) => p.endsWith(`/${rel}`)) ?? null;
+}
+/** Does this command word name a protected path — as text, or once resolved against `dir`? */
+function mentionsProtectedPath(word, dir) {
+    if (MENTIONS.some((re) => re.test(word)))
+        return true;
+    const abs = path.resolve(dir, word);
+    return approvalRecordPath(abs) !== null || traceEvidencePath(abs) !== null || hookControlPath(abs) !== null;
+}
+//# sourceMappingURL=guard-protected-paths.js.map

package/dist/hooks/guard-protected-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-protected-paths.js","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,gDAKC;AAGD,8CAKC;AAGD,0CAGC;AAGD,sDAIC;AArED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,2CAA6B;AAC7B,+DAAuD;AAEvD,MAAM,IAAI,GAAG,uCAAuC,CAAC;AACrD,MAAM,QAAQ,GAAG,uEAAuE,CAAC;AACzF,MAAM,cAAc,GAAG,uEAAuE,CAAC;AAC/F,8FAA8F;AAC9F,MAAM,cAAc,GAAG,iGAAiG,CAAC;AACzH,MAAM,YAAY,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;AAExI,wGAAwG;AACxG,MAAM,QAAQ,GAAG;IACf,wBAAwB;IACxB,kFAAkF;IAClF,yEAAyE;IACzE,oHAAoH;IACpH,6BAA6B;IAC7B,8DAA8D;CAC/D,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEjE,uHAAuH;AACvH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AACnE,CAAC;AAED,8FAA8F;AAC9F,SAAgB,qBAAqB,CAAC,IAAY,EAAE,GAAW;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9G,CAAC"}

package/dist/hooks/guard-rules.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The pre-tool guard's rules. Each looks at one normalized tool call and returns a decision or
+ * null; pre-tool-guard-hook.ts runs them in order (first deny wins, else first ask).
+ *
+ *   protected-approval-paths  DENY  a precise write (Edit/Write/MultiEdit, or Bash `>`, `tee`,
+ *                                   `sed -i`) to a contract lock, a decision record, approval state or
+ *                                   trace evidence (.sungen/trace-identity, test-results/sungen-run-record*)
+ *   protected-hook-control    ASK   the same writes to the files that control the hooks, so the
+ *                                   agent cannot switch its own guard off unasked
+ *   bash-protected-mention    ASK   any other Bash segment that names a protected path and does not
+ *                                   start with a read-only command (cp, mv, ln, install, rm,
+ *                                   bash -c, python -c, perl -i…)
+ *
+ * A floor, not a sandbox: a path built at runtime, a symlink, or a script file that writes without
+ * naming the path on the command line is out of reach by design. Each rule only matches strings,
+ * so each fails open (`onError: 'no-op'`); a rule that READS project state must declare `'ask'`.
+ */
+import type { HookContext, HookResult } from './hook-result-contract';
+/** One tool call, normalized from the untrusted payload. */
+export interface GuardedCall {
+    tool: string;
+    /** Absolute target paths of a file tool (Edit/Write/MultiEdit). */
+    filePaths: string[];
+    bashCommand?: string;
+    cwd: string;
+}
+export interface GuardRule {
+    id: string;
+    /** What a throw inside `check` becomes: `ask` for a rule that reads state, `no-op` otherwise. */
+    onError: 'ask' | 'no-op';
+    /** A decision for this call, or null when the rule has nothing to say about it. */
+    check(call: GuardedCall, ctx: HookContext): HookResult | null;
+}
+export declare const protectedApprovalPaths: GuardRule;
+export declare const protectedHookControl: GuardRule;
+export declare const bashProtectedMention: GuardRule;
+//# sourceMappingURL=guard-rules.d.ts.map

package/dist/hooks/guard-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-rules.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAItE,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iGAAiG;IACjG,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC;IACzB,mFAAmF;IACnF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC;CAC/D;AAMD,eAAO,MAAM,sBAAsB,EAAE,SAqBpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,SAWlC,CAAC;AAQF,eAAO,MAAM,oBAAoB,EAAE,SAalC,CAAC"}

package/dist/hooks/guard-rules.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bashProtectedMention = exports.protectedHookControl = exports.protectedApprovalPaths = void 0;
+const bash_write_targets_1 = require("./bash-write-targets");
+const guard_protected_paths_1 = require("./guard-protected-paths");
+/** The files a call writes precisely: a file tool's target, or Bash's `>` / `tee` / `sed -i` targets. */
+const preciseWrites = (call) => call.tool === 'Bash' ? (0, bash_write_targets_1.bashSegments)(call.bashCommand ?? '', call.cwd).flatMap((s) => s.writes) : call.filePaths;
+exports.protectedApprovalPaths = {
+    id: 'protected-approval-paths',
+    onError: 'no-op',
+    check(call) {
+        const writes = preciseWrites(call);
+        const rel = writes.map(guard_protected_paths_1.approvalRecordPath).find((r) => r !== null);
+        if (rel) {
+            return {
+                status: 'deny',
+                denyReason: `sungen: \`${rel}\` is an approval record — contract locks, decisions, waivers and the accepted `
+                    + 'viewpoint baseline change only through a human at a terminal, never by an agent edit. If this change is '
+                    + 'intended, stop and ask the user to make it themselves.',
+            };
+        }
+        const evidence = writes.map(guard_protected_paths_1.traceEvidencePath).find((r) => r !== null);
+        return evidence ? {
+            status: 'deny',
+            denyReason: `sungen: \`${evidence}\` is trace evidence — only \`sungen contract check --trace\` / \`contract derive\` `
+                + 'and the Playwright run-record reporter write it. Re-run the free tests or the CLI instead of editing it.',
+        } : null;
+    },
+};
+exports.protectedHookControl = {
+    id: 'protected-hook-control',
+    onError: 'no-op',
+    check(call) {
+        const rel = preciseWrites(call).map(guard_protected_paths_1.hookControlPath).find((r) => r !== null);
+        return rel ? {
+            status: 'ask',
+            askReason: `sungen: \`${rel}\` controls sungen's hooks and guard, so an agent does not change it on its own. `
+                + 'Allow only if you asked for exactly this change — the usual path is to edit it by hand, then run `sungen update`.',
+        } : null;
+    },
+};
+/** Segments that only read: they may name a protected path freely. */
+const READ_ONLY = new Set(['cat', 'ls', 'head', 'tail', 'grep', 'rg', 'wc', 'diff', 'sungen', 'sungen.js']);
+const GIT_READ_ONLY = new Set(['diff', 'log', 'show', 'status']);
+const isReadOnly = (cmd, words) => READ_ONLY.has(cmd) || (cmd === 'git' && GIT_READ_ONLY.has(words.find((w) => !w.startsWith('-')) ?? ''));
+exports.bashProtectedMention = {
+    id: 'bash-protected-mention',
+    onError: 'no-op',
+    check(call) {
+        if (call.tool !== 'Bash' || !call.bashCommand)
+            return null;
+        const seg = (0, bash_write_targets_1.bashSegments)(call.bashCommand, call.cwd)
+            .find((s) => s.cmd && !isReadOnly(s.cmd, s.words) && s.words.some((w) => (0, guard_protected_paths_1.mentionsProtectedPath)(w, s.dir)));
+        return seg ? {
+            status: 'ask',
+            askReason: `sungen: this \`${seg.cmd}\` command names a contract lock, a decision record, approval state or a hook-control file, `
+                + 'and the guard cannot tell whether it writes it. Allow only if you asked for exactly this.',
+        } : null;
+    },
+};
+//# sourceMappingURL=guard-rules.js.map

package/dist/hooks/guard-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-rules.js","sourceRoot":"","sources":["../../src/hooks/guard-rules.ts"],"names":[],"mappings":";;;AAkBA,6DAAoD;AACpD,mEAAwH;AAmBxH,yGAAyG;AACzG,MAAM,aAAa,GAAG,CAAC,IAAiB,EAAY,EAAE,CACpD,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAA,iCAAY,EAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;AAErG,QAAA,sBAAsB,GAAc;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,0CAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChF,IAAI,GAAG,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,aAAa,GAAG,iFAAiF;sBACzG,0GAA0G;sBAC1G,wDAAwD;aAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,aAAa,QAAQ,sFAAsF;kBACnH,0GAA0G;SAC/G,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC;AAEW,QAAA,oBAAoB,GAAc;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uCAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,aAAa,GAAG,mFAAmF;kBAC1G,mHAAmH;SACxH,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC;AAEF,sEAAsE;AACtE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5G,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,KAAe,EAAW,EAAE,CAC3D,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAE7F,QAAA,oBAAoB,GAAc;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAA,iCAAY,EAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,6CAAqB,EAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7G,OAAO,GAAG,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,kBAAkB,GAAG,CAAC,GAAG,8FAA8F;kBAC9H,2FAA2F;SAChG,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC"}

package/dist/hooks/guard-tty-spoof-rule.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Guard rule `tty-spoof` (phase 06, M5): ASK before an agent runs a human-confirmed sungen command
+ * through a terminal emulator.
+ *
+ * `contract approve`, `journey --waive` and `journey --decide` refuse without a TTY (DOS-13.4), and
+ * an agent's Bash has none — unless it borrows one: `script`, `expect`, `unbuffer`, or a pty from
+ * Python/Perl/zsh. Then the prompt sees a "terminal" and a piped phrase reads as a human typing it.
+ * This rule spots the pair in the raw command (quotes included, so `bash -c "…"` and `expect -c '…'`
+ * are covered) and hands the call to the user. A floor, not a sandbox: a script file that does the
+ * same without naming either on the command line is out of reach by design. String match only, so
+ * it fails open.
+ */
+import type { GuardRule } from './guard-rules';
+export declare const ttySpoof: GuardRule;
+//# sourceMappingURL=guard-tty-spoof-rule.d.ts.map

package/dist/hooks/guard-tty-spoof-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-tty-spoof-rule.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-tty-spoof-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAK/C,eAAO,MAAM,QAAQ,EAAE,SAatB,CAAC"}

package/dist/hooks/guard-tty-spoof-rule.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ttySpoof = void 0;
+const TTY_EMULATOR = /\b(?:script|unbuffer|expect|pty|zpty|openpty|forkpty|ptyprocess)\b/i;
+const HUMAN_GATED = /\bsungen\b[\s\S]*?\b(?:contract['",\s]+approve\b|journey\b[\s\S]*?--(?:waive|decide)\b)/i;
+exports.ttySpoof = {
+    id: 'tty-spoof',
+    onError: 'no-op',
+    check(call) {
+        const cmd = call.tool === 'Bash' ? call.bashCommand : undefined;
+        if (!cmd || !TTY_EMULATOR.test(cmd) || !HUMAN_GATED.test(cmd))
+            return null;
+        return {
+            status: 'ask',
+            askReason: 'sungen: this runs a human-confirmed sungen action (`contract approve` / `journey --waive|--decide`) through a terminal '
+                + 'emulator (script / expect / unbuffer / pty). Those confirmations exist so a PERSON at a terminal decides — allow only if you '
+                + 'are that person and asked for exactly this; otherwise run the command yourself in your own terminal.',
+        };
+    },
+};
+//# sourceMappingURL=guard-tty-spoof-rule.js.map

package/dist/hooks/guard-tty-spoof-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-tty-spoof-rule.js","sourceRoot":"","sources":["../../src/hooks/guard-tty-spoof-rule.ts"],"names":[],"mappings":";;;AAcA,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAC3F,MAAM,WAAW,GAAG,0FAA0F,CAAC;AAElG,QAAA,QAAQ,GAAc;IACjC,EAAE,EAAE,WAAW;IACf,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO;YACL,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,yHAAyH;kBAChI,+HAA+H;kBAC/H,sGAAsG;SAC3G,CAAC;IACJ,CAAC;CACF,CAAC"}