@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.2

package/dist/hooks/claude-hook-entry.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePayload = parsePayload;
+exports.contextFor = contextFor;
+exports.dispatch = dispatch;
+exports.main = main;
+/**
+ * Claude Code → sungen hook bridge (P0.1). Three ways in, one behaviour:
+ *
+ *   node dist/hooks/claude-hook-entry.js <hook>        executed directly (`require.main` branch)
+ *   .claude/hooks/sungen-hook.cjs <hook>               the project launcher `require`s this, calls main
+ *   sungen hook <hook>                                  the hidden CLI command (debugging, dev checkouts)
+ *
+ * Reads the event JSON on stdin, runs the hook through `runHook` (toggles + fail-open), and prints
+ * the Claude Code JSON on stdout. Exit code is ALWAYS 0 and anything unexpected prints `{}`: a hook
+ * error must never block or derail a session. The payload is untrusted — it is parsed as JSON and
+ * read field by field, never executed.
+ */
+const path = __importStar(require("path"));
+const hook_result_contract_1 = require("./hook-result-contract");
+const hook_registry_1 = require("./hook-registry");
+const hook_toggles_1 = require("./hook-toggles");
+/**
+ * Payloads above this are not parsed. Not a free pass either: a hook declares what an unreadable
+ * payload means (`onUnreadableInput`) — the guard asks, the advisory hooks stay quiet.
+ */
+const MAX_PAYLOAD_BYTES = 5 * 1024 * 1024;
+/** A hook whose stdin never closes still answers (as a no-op) well inside its timeout. */
+const STDIN_TIMEOUT_MS = 2000;
+function parsePayload(raw) {
+    try {
+        const v = JSON.parse(raw);
+        return v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+    }
+    catch {
+        return {};
+    }
+}
+function contextFor(input, env) {
+    const cwd = typeof input.cwd === 'string' && path.isAbsolute(input.cwd) ? input.cwd : env.CLAUDE_PROJECT_DIR || process.cwd();
+    return { env, cwd };
+}
+/**
+ * What to print for this hook and raw payload — pure apart from the hook's own reads. `oversize`
+ * means the payload was too large to read at all.
+ */
+function dispatch(hookName, raw, env, oversize = false) {
+    if ((0, hook_toggles_1.hooksKilled)(env))
+        return '{}';
+    const hook = (0, hook_registry_1.loadHook)(hookName);
+    if (!hook)
+        return '{}';
+    if (oversize)
+        return (0, hook_result_contract_1.toClaudeStdout)(hook.meta.events[0], (0, hook_result_contract_1.runHookOnUnreadableInput)(hook, contextFor({}, env)));
+    const input = parsePayload(raw);
+    const event = typeof input.hook_event_name === 'string' ? input.hook_event_name : hook.meta.events[0];
+    if (!hook.meta.events.includes(event))
+        return '{}';
+    return (0, hook_result_contract_1.toClaudeStdout)(event, (0, hook_result_contract_1.runHook)(hook, input, contextFor(input, env)));
+}
+function readStdin() {
+    return new Promise((resolve) => {
+        if (process.stdin.isTTY) {
+            resolve({ raw: '', oversize: false });
+            return;
+        }
+        let size = 0;
+        const chunks = [];
+        const done = (raw, oversize = false) => {
+            clearTimeout(timer);
+            process.stdin.removeAllListeners();
+            process.stdin.destroy();
+            resolve({ raw, oversize });
+        };
+        const timer = setTimeout(() => done(''), STDIN_TIMEOUT_MS);
+        process.stdin.on('data', (c) => {
+            size += c.length;
+            if (size > MAX_PAYLOAD_BYTES)
+                done('', true);
+            else
+                chunks.push(c);
+        });
+        process.stdin.on('end', () => done(Buffer.concat(chunks).toString('utf8')));
+        process.stdin.on('error', () => done(''));
+    });
+}
+/** Run one hook end to end. Resolves once stdout has flushed; never rejects. */
+async function main(hookName = process.argv[2] ?? '') {
+    let out = '{}';
+    try {
+        const { raw, oversize } = await readStdin();
+        out = dispatch(hookName, raw, process.env, oversize);
+    }
+    catch {
+        out = '{}';
+    }
+    await new Promise((resolve) => process.stdout.write(`${out}\n`, () => resolve()));
+    process.exitCode = 0;
+}
+if (require.main === module) {
+    // Exit explicitly once flushed: a stray handle must not keep a hook alive into its timeout.
+    void main().then(() => process.exit(0), () => process.exit(0));
+}
+//# sourceMappingURL=claude-hook-entry.js.map

package/dist/hooks/claude-hook-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-hook-entry.js","sourceRoot":"","sources":["../../src/hooks/claude-hook-entry.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,oCAKC;AAED,gCAGC;AAMD,4BASC;AAqBD,oBAQC;AA/ED;;;;;;;;;;;GAWG;AACH,2CAA6B;AAC7B,iEAAoI;AACpI,mDAA2C;AAC3C,iDAA6C;AAE7C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,SAAgB,UAAU,CAAC,KAAgB,EAAE,GAAuC;IAClF,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9H,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAgB,EAAE,GAAW,EAAE,GAAuC,EAAE,QAAQ,GAAG,KAAK;IAC/G,IAAI,IAAA,0BAAW,EAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,QAAQ;QAAE,OAAO,IAAA,qCAAc,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAA,+CAAwB,EAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAwB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,IAAA,qCAAc,EAAC,KAAK,EAAE,IAAA,8BAAO,EAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3E,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,QAAQ,GAAG,KAAK,EAAQ,EAAE;YACnD,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/G,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,iBAAiB;gBAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AACzE,KAAK,UAAU,IAAI,CAAC,WAAmB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;IACjE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAC5C,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC;IAAC,CAAC;IACvB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/hooks/claude-transcript-turn.d.ts

@@ -0,0 +1,11 @@
+export interface TurnSummary {
+    /** The turn ran sungen: a `/sungen:` prompt, a Bash call running `sungen`, a sungen skill. */
+    sungenActivity: boolean;
+    /** An AskUserQuestion came AFTER the last sungen activity — the turn already handed back. */
+    askedAfter: boolean;
+    /** The last unit a sungen call named (`--screen x`, `/sungen:create-test x`). */
+    lastUnit?: string;
+}
+/** Summarize the last turn, or null when the transcript cannot be read (callers fail open). */
+export declare function summarizeTurn(transcriptPath: unknown): TurnSummary | null;
+//# sourceMappingURL=claude-transcript-turn.d.ts.map

package/dist/hooks/claude-transcript-turn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-transcript-turn.d.ts","sourceRoot":"","sources":["../../src/hooks/claude-transcript-turn.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,cAAc,EAAE,OAAO,CAAC;IACxB,6FAA6F;IAC7F,UAAU,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAsCD,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,cAAc,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAmCzE"}

package/dist/hooks/claude-transcript-turn.js

@@ -0,0 +1,143 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.summarizeTurn = summarizeTurn;
+/**
+ * What happened in the turn that just ended, read from the tail of Claude Code's transcript.
+ *
+ * The Stop hook must not nag every turn of every conversation in a sungen project — only a turn
+ * that ran sungen work and then ended without handing back. The transcript (JSONL) answers both:
+ * walk back from its end to the human prompt that opened the turn, noting sungen activity and any
+ * AskUserQuestion that came after it.
+ *
+ * The transcript is untrusted data: each line is JSON-parsed and inspected as strings. Nothing in
+ * it is ever executed.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Enough for any realistic turn; a transcript can be many MB and the hook has a time budget. */
+const TAIL_BYTES = 512 * 1024;
+const SUNGEN_BASH = /(?:^|[\s;&|(])(?:\S*\/)?sungen(?:\.js)?\s+[a-z]/;
+const UNIT_FLAG = /--(?:screen|flow|area|api)[= ]([\w.-]+(?:\/[\w.-]+)?)/g;
+/** `/sungen:<cmd>` typed, or as Claude Code records it; the unit argument is optional. */
+const SLASH = /\/sungen:[a-z-]+(?:(?:<\/command-name>[\s\S]*?<command-args>|[ \t]+)([\w.-]+))?/;
+function readTail(file) {
+    const fd = fs.openSync(file, 'r');
+    try {
+        const size = fs.fstatSync(fd).size;
+        const start = Math.max(0, size - TAIL_BYTES);
+        const buf = Buffer.alloc(size - start);
+        // Only the bytes actually read: a transcript truncated between fstat and read must not leave
+        // zero-filled garbage at the end of the buffer.
+        const read = fs.readSync(fd, buf, 0, buf.length, start);
+        const lines = buf.subarray(0, read).toString('utf8').split('\n');
+        return start > 0 ? lines.slice(1) : lines; // the first line of a cut tail is partial
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+const lastUnitIn = (s) => [...s.matchAll(UNIT_FLAG)].pop()?.[1];
+/** The human prompt's text, or null when this user entry is a tool result or injected meta. */
+function promptText(e) {
+    if (e.type !== 'user' || e.isMeta === true || e.message?.role !== 'user')
+        return null;
+    const c = e.message.content;
+    if (typeof c === 'string')
+        return c;
+    if (!Array.isArray(c))
+        return null;
+    const text = c.filter((b) => b?.type === 'text' && typeof b.text === 'string').map((b) => b.text);
+    return text.length ? text.join('\n') : null;
+}
+/** Summarize the last turn, or null when the transcript cannot be read (callers fail open). */
+function summarizeTurn(transcriptPath) {
+    if (typeof transcriptPath !== 'string' || !path.isAbsolute(transcriptPath))
+        return null;
+    let lines;
+    try {
+        lines = readTail(transcriptPath);
+    }
+    catch {
+        return null;
+    }
+    const turn = { sungenActivity: false, askedAfter: false };
+    // Walking backwards, the first unit seen is the most recently named one.
+    const sawSungen = (unit) => {
+        turn.lastUnit ?? (turn.lastUnit = unit);
+        turn.sungenActivity = true;
+    };
+    for (let i = lines.length - 1; i >= 0; i--) {
+        let e;
+        try {
+            e = JSON.parse(lines[i]);
+        }
+        catch {
+            continue;
+        }
+        if (!e || typeof e !== 'object')
+            continue;
+        const prompt = promptText(e);
+        if (prompt !== null) {
+            const m = prompt.match(SLASH);
+            if (m)
+                sawSungen(m[1]);
+            break; // the turn starts here
+        }
+        if (e.type !== 'assistant' || !Array.isArray(e.message?.content))
+            continue;
+        const blocks = e.message.content;
+        for (let j = blocks.length - 1; j >= 0; j--) {
+            const b = blocks[j];
+            if (b?.type !== 'tool_use' || !b.input || typeof b.input !== 'object')
+                continue;
+            const input = b.input;
+            if (b.name === 'AskUserQuestion') {
+                if (!turn.sungenActivity)
+                    turn.askedAfter = true;
+                continue;
+            }
+            const cmd = typeof input.command === 'string' ? input.command : '';
+            if (b.name === 'Bash' && SUNGEN_BASH.test(cmd))
+                sawSungen(lastUnitIn(cmd));
+            else if (b.name === 'SlashCommand' && cmd.includes('/sungen:'))
+                sawSungen(cmd.match(SLASH)?.[1]);
+            else if (b.name === 'Skill' && typeof input.skill === 'string' && input.skill.startsWith('sungen'))
+                sawSungen();
+        }
+    }
+    return turn;
+}
+//# sourceMappingURL=claude-transcript-turn.js.map

package/dist/hooks/claude-transcript-turn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-transcript-turn.js","sourceRoot":"","sources":["../../src/hooks/claude-transcript-turn.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,sCAmCC;AA/FD;;;;;;;;;;GAUG;AACH,uCAAyB;AACzB,2CAA6B;AAW7B,iGAAiG;AACjG,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC;AAC9B,MAAM,WAAW,GAAG,iDAAiD,CAAC;AACtE,MAAM,SAAS,GAAG,wDAAwD,CAAC;AAC3E,0FAA0F;AAC1F,MAAM,KAAK,GAAG,iFAAiF,CAAC;AAKhG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QACvC,6FAA6F;QAC7F,gDAAgD;QAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,0CAA0C;IACvF,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAsB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5F,+FAA+F;AAC/F,SAAS,UAAU,CAAC,CAAQ;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAI,CAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,+FAA+F;AAC/F,SAAgB,aAAa,CAAC,cAAuB;IACnD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAEhE,MAAM,IAAI,GAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvE,yEAAyE;IACzE,MAAM,SAAS,GAAG,CAAC,IAAa,EAAQ,EAAE;QACxC,IAAI,CAAC,QAAQ,KAAb,IAAI,CAAC,QAAQ,GAAK,IAAI,EAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAQ,CAAC;QACb,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAU,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC;gBAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,CAAC,uBAAuB;QAChC,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,SAAS;QAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,OAAQ,CAAC,OAAkB,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAChF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAgC,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,cAAc;oBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjG,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;iBACtE,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS,EAAE,CAAC;QAClH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hooks/guard-delivery-contract-rule.d.ts

@@ -0,0 +1,10 @@
+import type { GuardRule } from './guard-rules';
+interface Invocation {
+    dir: string;
+    names: string[];
+}
+/** Every `sungen delivery …` the command line would run, with the unit names it passes ([] = every unit). */
+export declare function deliveryInvocations(command: string, cwd: string): Invocation[];
+export declare const deliveryContractVerdict: GuardRule;
+export {};
+//# sourceMappingURL=guard-delivery-contract-rule.d.ts.map

package/dist/hooks/guard-delivery-contract-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-delivery-contract-rule.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-delivery-contract-rule.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAY/C,UAAU,UAAU;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE;AA2BrD,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAiB9E;AAYD,eAAO,MAAM,uBAAuB,EAAE,SAmBrC,CAAC"}

package/dist/hooks/guard-delivery-contract-rule.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliveryContractVerdict = void 0;
+exports.deliveryInvocations = deliveryInvocations;
+/**
+ * Guard rule `delivery-contract-verdict` (phase 06, OES-12.3, DOS-14.4, takumi T4): Claude Code may
+ * not run `sungen delivery` while a delivered unit's Test Contract verdict is not `pass`.
+ *
+ *   - the verdict is REBUILT from .feature + lock + git HEAD (buildContractVerdict); the report file
+ *     is never read, so a hand-edited "pass" there is ignored
+ *   - which units: those `delivery` itself would deliver (contract-units.ts) — every candidate of an
+ *     ambiguous name, api flows included; bare `delivery`, a runner (`npx`, `pnpm dlx`, `tsx`, `node`…)
+ *     whose sungen cannot be named, or a `bash -c` / `eval` wrapper → every unit
+ *   - recognized: `sungen`, `sungen.js`, `@scope/sungen@1.2.3`, `sungen@latest`; `delivery --check`
+ *     (writes nothing) is allowed; a unit with no lock in the tree or in HEAD is skipped
+ *   - git runs with a ≈3 s timeout (the hook's own budget is 5 s); git failing while a lock exists,
+ *     or any other read error, → `ask` (onError), never a silent pass
+ *   - the command is only tokenized, never executed; unit names are matched against directories
+ *
+ * The contract module loads only when a command mentions both `sungen` (or a runner) and `delivery`,
+ * so every other Edit/Write/Bash call pays nothing for this rule.
+ */
+const path = __importStar(require("path"));
+const bash_write_targets_1 = require("./bash-write-targets");
+const sungen_project_root_1 = require("./sungen-project-root");
+const SUNGEN = /^sungen(?:\.js)?(?:@[^/]*)?$/;
+const RUNNERS = new Set(['npx', 'pnpm', 'yarn', 'bunx', 'bun', 'npm', 'tsx', 'ts-node', 'node', 'deno']);
+/** delivery options that take a value (commander would consume the next word). */
+const VALUE_OPTS = new Set(['--env', '--format', '--approve']);
+const READ_ONLY_OPTS = new Set(['--check', '--help', '-h']);
+const WRAPPED = /\b(?:bash|sh|zsh|dash|eval|xargs)\b/;
+const MENTION = /\bsungen\b[^\n]*\bdelivery\b/;
+const GUARD_GIT_TIMEOUT_MS = 3000;
+function namesAfter(args) {
+    const names = [];
+    for (let i = 0; i < args.length; i++) {
+        if (VALUE_OPTS.has(args[i])) {
+            i++;
+            continue;
+        }
+        if (!args[i].startsWith('-'))
+            names.push(args[i]);
+    }
+    return names;
+}
+/**
+ * Where `delivery` sits as sungen's subcommand, or -1. Only options, and a word that may be an
+ * option's value (`--env staging`), may precede it — so `sungen --env x delivery` is caught while
+ * `sungen add --screen delivery` (a unit named delivery) is not a delivery call.
+ */
+function deliverySubcommandAt(rest) {
+    for (let i = 0; i < rest.length; i++) {
+        if (rest[i] === 'delivery')
+            return i;
+        if (rest[i].startsWith('-'))
+            continue;
+        const prev = rest[i - 1];
+        if (prev && prev.startsWith('--') && !prev.includes('='))
+            continue;
+        return -1;
+    }
+    return -1;
+}
+/** Every `sungen delivery …` the command line would run, with the unit names it passes ([] = every unit). */
+function deliveryInvocations(command, cwd) {
+    const out = [];
+    for (const seg of (0, bash_write_targets_1.bashSegments)(command, cwd)) {
+        const words = [seg.cmd, ...seg.words];
+        const at = words.findIndex((w) => SUNGEN.test(path.basename(w)));
+        if (at >= 0) {
+            const rest = words.slice(at + 1);
+            const sub = deliverySubcommandAt(rest);
+            if (sub < 0)
+                continue;
+            const args = rest.slice(sub + 1);
+            if (!args.some((a) => READ_ONLY_OPTS.has(a)))
+                out.push({ dir: seg.dir, names: namesAfter(args) });
+        }
+        else if (RUNNERS.has(seg.cmd) && seg.words.includes('delivery') && !seg.words.some((a) => READ_ONLY_OPTS.has(a))) {
+            out.push({ dir: seg.dir, names: [] }); // `tsx src/cli/index.ts delivery`, `node dist/cli/index.js delivery`
+        }
+    }
+    if (!out.length && MENTION.test(command) && WRAPPED.test(command))
+        out.push({ dir: cwd, names: [] });
+    return out;
+}
+function denyFor(blockers) {
+    const lines = blockers.slice(0, 5).map((b) => `\`${b.unit}\` is ${b.verdict}: ${b.headline} — see \`sungen contract check --screen ${b.unit}\``);
+    return {
+        status: 'deny',
+        denyReason: `sungen: delivery is blocked — the Test Contract does not pass.\n${lines.join('\n')}${blockers.length > 5 ? `\n(+${blockers.length - 5} more)` : ''}\n`
+            + 'Restore the approved checks in the .feature, or ask QA to approve the change themselves on a terminal (`sungen contract approve --screen <unit>`). '
+            + 'Do not edit the lock or the report.',
+    };
+}
+exports.deliveryContractVerdict = {
+    id: 'delivery-contract-verdict',
+    onError: 'ask',
+    check(call) {
+        const cmd = call.tool === 'Bash' ? call.bashCommand : undefined;
+        if (!cmd || !cmd.includes('delivery'))
+            return null;
+        const invocations = deliveryInvocations(cmd, call.cwd);
+        if (!invocations.length)
+            return null;
+        const units = require('../contract/contract-units');
+        const { contractBlockers } = require('../contract/project-contract-blockers');
+        const blockers = [];
+        for (const inv of invocations) {
+            const root = (0, sungen_project_root_1.findSungenRoot)(inv.dir);
+            if (!root)
+                continue;
+            const targets = inv.names.length ? inv.names.flatMap((n) => units.deliveryUnitsNamed(root, n)) : units.allContractUnits(root);
+            blockers.push(...contractBlockers(root, targets, { gitTimeoutMs: GUARD_GIT_TIMEOUT_MS }));
+        }
+        return blockers.length ? denyFor(blockers) : null;
+    },
+};
+//# sourceMappingURL=guard-delivery-contract-rule.js.map

package/dist/hooks/guard-delivery-contract-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-delivery-contract-rule.js","sourceRoot":"","sources":["../../src/hooks/guard-delivery-contract-rule.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,kDAiBC;AA9ED;;;;;;;;;;;;;;;;;GAiBG;AACH,2CAA6B;AAE7B,6DAAoD;AAEpD,+DAAuD;AAEvD,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACzG,kFAAkF;AAClF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAC/C,MAAM,oBAAoB,GAAG,IAAK,CAAC;AAInC,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAc;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACnE,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,6GAA6G;AAC7G,SAAgB,mBAAmB,CAAC,OAAe,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAA,iCAAY,EAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,GAAG,GAAG,CAAC;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAG,qEAAqE;QAChH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,QAAoE;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,2CAA2C,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACjJ,OAAO;QACL,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,mEAAmE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI;cAC/J,qJAAqJ;cACrJ,qCAAqC;KAC1C,CAAC;AACJ,CAAC;AAEY,QAAA,uBAAuB,GAAc;IAChD,EAAE,EAAE,2BAA2B;IAC/B,OAAO,EAAE,KAAK;IACd,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,4BAA4B,CAAgD,CAAC;QACnG,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,uCAAuC,CAA2D,CAAC;QACxI,MAAM,QAAQ,GAA+D,EAAE,CAAC;QAChF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC9H,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;CACF,CAAC"}

package/dist/hooks/guard-protected-paths.d.ts

@@ -0,0 +1,9 @@
+/** `abs` relative to its sungen project, when it is an approval record (lock, decision, approval state); else null. */
+export declare function approvalRecordPath(abs: string): string | null;
+/** `abs` relative to its sungen project, when it is a trace evidence store; else null. */
+export declare function traceEvidencePath(abs: string): string | null;
+/** The hook-control file `abs` is (as its project-relative name), or null. */
+export declare function hookControlPath(abs: string): string | null;
+/** Does this command word name a protected path — as text, or once resolved against `dir`? */
+export declare function mentionsProtectedPath(word: string, dir: string): boolean;
+//# sourceMappingURL=guard-protected-paths.d.ts.map

package/dist/hooks/guard-protected-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-protected-paths.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":"AA2CA,uHAAuH;AACvH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIxE"}

package/dist/hooks/guard-protected-paths.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.approvalRecordPath = approvalRecordPath;
+exports.traceEvidencePath = traceEvidencePath;
+exports.hookControlPath = hookControlPath;
+exports.mentionsProtectedPath = mentionsProtectedPath;
+/**
+ * Which paths the pre-tool guard protects, and how (P0.1 + review fixes H2, L5).
+ *
+ *   approval records — DENY an agent write:
+ *     qa/**\/contracts.lock.yaml
+ *     qa/decisions/<id>.yaml                       (project decisions, phase 03)
+ *     qa/<screens|flows|api[/flows]>/<unit>/decisions/<id>.yaml   (unit decisions)
+ *     .sungen/journey/<slug>.state.json            (legacy waivers and their dual-written copy, DOS-13.5)
+ *     .sungen/viewpoint-baseline.json              (the accepted viewpoint declaration)
+ *     — the CLI still writes the last two itself; the guard only judges an agent's tool calls
+ *   trace evidence — DENY an agent write (phase 08; the verdict trusts it only as far as this guard and git review):
+ *     .sungen/trace-identity/**                    (the driver's identity answers — written by the CLI)
+ *     test-results[-free]/sungen-run-record*.json  (run id + test-file hashes — written by the Playwright reporter;
+ *                                                  test-results-free/ is the free run's own outputDir, #941)
+ *   hook control — ASK before an agent write (the agent must not switch its own guard off):
+ *     qa/sungen.config.yaml · .claude/settings.json · .claude/settings.local.json ·
+ *     .claude/hooks/sungen-hook.cjs
+ *
+ * The human path for the hook-control files is editing them by hand, then `sungen update`.
+ * A `decisions/` folder anywhere else (e.g. `requirements/decisions/notes.md`) is not a record.
+ */
+const path = __importStar(require("path"));
+const sungen_project_root_1 = require("./sungen-project-root");
+const LOCK = /^qa\/(?:.+\/)?contracts\.lock\.yaml$/i;
+const DECISION = /^qa\/(?:(?:screens|flows|api(?:\/flows)?)\/[^/]+\/)?decisions\/[^/]+/i;
+const APPROVAL_STATE = /^\.sungen\/(?:journey\/[^/]+\.state\.json|viewpoint-baseline\.json)$/i;
+/** Trace evidence (phase 08, DOS-14.6): the driver's identity answers and the run records. */
+const TRACE_EVIDENCE = /^(?:\.sungen\/trace-identity\/.+|test-results(?:-free)?\/sungen-run-record(?:\.[A-Za-z0-9._-]+)?\.json)$/i;
+const HOOK_CONTROL = ['qa/sungen.config.yaml', '.claude/settings.json', '.claude/settings.local.json', '.claude/hooks/sungen-hook.cjs'];
+/** The same paths as they appear INSIDE a command string (e.g. in `bash -c "…"` or `python -c "…"`). */
+const MENTIONS = [
+    /contracts\.lock\.yaml/i,
+    /(?:^|[^\w.-])qa\/(?:(?:screens|flows|api(?:\/flows)?)\/[^/\s'"]+\/)?decisions\//i,
+    /\.sungen\/(?:journey\/[^/\s'"]+\.state\.json|viewpoint-baseline\.json)/i,
+    /(?:^|[/\s'"=])(?:qa\/sungen\.config\.yaml|\.claude\/settings(?:\.local)?\.json|\.claude\/hooks\/sungen-hook\.cjs)/i,
+    /\.sungen\/trace-identity\//i,
+    /(?:^|[/\s'"=])sungen-run-record(?:\.[A-Za-z0-9._-]+)?\.json/i,
+];
+const posix = (p) => p.split(path.sep).join('/');
+/** `abs` relative to its sungen project, when it is an approval record (lock, decision, approval state); else null. */
+function approvalRecordPath(abs) {
+    const root = (0, sungen_project_root_1.findSungenRoot)(path.dirname(abs));
+    if (!root)
+        return null;
+    const rel = posix(path.relative(root, abs));
+    return LOCK.test(rel) || DECISION.test(rel) || APPROVAL_STATE.test(rel) ? rel : null;
+}
+/** `abs` relative to its sungen project, when it is a trace evidence store; else null. */
+function traceEvidencePath(abs) {
+    const root = (0, sungen_project_root_1.findSungenRoot)(path.dirname(abs));
+    if (!root)
+        return null;
+    const rel = posix(path.relative(root, abs));
+    return TRACE_EVIDENCE.test(rel) ? rel : null;
+}
+/** The hook-control file `abs` is (as its project-relative name), or null. */
+function hookControlPath(abs) {
+    const p = posix(path.resolve(abs)).toLowerCase();
+    return HOOK_CONTROL.find((rel) => p.endsWith(`/${rel}`)) ?? null;
+}
+/** Does this command word name a protected path — as text, or once resolved against `dir`? */
+function mentionsProtectedPath(word, dir) {
+    if (MENTIONS.some((re) => re.test(word)))
+        return true;
+    const abs = path.resolve(dir, word);
+    return approvalRecordPath(abs) !== null || traceEvidencePath(abs) !== null || hookControlPath(abs) !== null;
+}
+//# sourceMappingURL=guard-protected-paths.js.map

package/dist/hooks/guard-protected-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-protected-paths.js","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,gDAKC;AAGD,8CAKC;AAGD,0CAGC;AAGD,sDAIC;AAtED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,2CAA6B;AAC7B,+DAAuD;AAEvD,MAAM,IAAI,GAAG,uCAAuC,CAAC;AACrD,MAAM,QAAQ,GAAG,uEAAuE,CAAC;AACzF,MAAM,cAAc,GAAG,uEAAuE,CAAC;AAC/F,8FAA8F;AAC9F,MAAM,cAAc,GAAG,2GAA2G,CAAC;AACnI,MAAM,YAAY,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;AAExI,wGAAwG;AACxG,MAAM,QAAQ,GAAG;IACf,wBAAwB;IACxB,kFAAkF;IAClF,yEAAyE;IACzE,oHAAoH;IACpH,6BAA6B;IAC7B,8DAA8D;CAC/D,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEjE,uHAAuH;AACvH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AACnE,CAAC;AAED,8FAA8F;AAC9F,SAAgB,qBAAqB,CAAC,IAAY,EAAE,GAAW;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9G,CAAC"}