@tekmidian/pai 0.42.4 → 0.42.6

package/src/hooks/ts/lib/pai-paths.ts

@@ -2,27 +2,47 @@
  * PAI Path Resolution - Single Source of Truth
  *
  * This module provides consistent path resolution across all PAI hooks.
- * It handles PAI_DIR detection whether set explicitly or defaulting to ~/.claude
  *
- * ALSO loads .env file from PAI_DIR so all hooks get environment variables
- * without relying on Claude Code's settings.json injection.
+ * Two different things live here, and they must not be confused:
+ *
+ * - ADAPTER_DIR (~/.claude by default) is the Claude Code harness adapter —
+ *   fixed, hardcoded paths the harness itself loads from (Hooks/, Skills/,
+ *   Agents/, Commands/, settings.json, statusline-command.sh,
+ *   tab-color-command.sh). It is harness-specific: a future harness would
+ *   need its own adapter directory with its own conventions.
+ * - PAI_HOME (~/.claude/pai by default — see ../../../config/pai-home.ts) is
+ *   where PAI's own state lives: everything hooks WRITE (History/,
+ *   agent-sessions.json, session-routing.json, ...) resolves there, with a
+ *   fallback to the pre-2026-09-19 ADAPTER_DIR location and a one-time
+ *   stderr notice, exactly like every other PAI_HOME file.
+ *
+ * ALSO loads .env file from ADAPTER_DIR so all hooks get environment
+ * variables without relying on Claude Code's settings.json injection.
  *
  * Usage in hooks:
- *   import { PAI_DIR, HOOKS_DIR, SKILLS_DIR } from './lib/pai-paths';
+ *   import { ADAPTER_DIR, HOOKS_DIR, SKILLS_DIR, historyDir } from './lib/pai-paths';
  */
 
 import { homedir } from 'os';
 import { resolve, join } from 'path';
 import { existsSync, readFileSync } from 'fs';
+import {
+  paiHomePath,
+  resolvePaiFile,
+  migratePaiFile,
+  migratePaiDir,
+  type MigrateFileResult,
+  type MigrateDirResult,
+} from '../../../config/pai-home.js';
 
 /**
  * Load .env file and inject into process.env
- * Must run BEFORE PAI_DIR resolution so .env can set PAI_DIR if needed
+ * Must run BEFORE ADAPTER_DIR resolution so .env can set ADAPTER_DIR/PAI_DIR if needed
  */
 function loadEnvFile(): void {
   // Check common locations for .env
   const possiblePaths = [
-    resolve(process.env.PAI_DIR || '', '.env'),
+    resolve(process.env.ADAPTER_DIR || process.env.PAI_DIR || '', '.env'),
     resolve(homedir(), '.claude', '.env'),
   ];
 
@@ -68,40 +88,102 @@ function loadEnvFile(): void {
 // Load .env FIRST, before any other initialization
 loadEnvFile();
 
+function defaultAdapterDir(): string {
+  return resolve(homedir(), '.claude');
+}
+
+/**
+ * Never print when stdout/stderr is a data channel, not a human: hook
+ * bundles and worker-status-line.mjs set PAI_QUIET_NOTICES=1 via their
+ * esbuild banner (scripts/build-hooks.mjs), and a `pai worker run
+ * --output-format json` invocation is detected directly off argv since its
+ * env can't be set before this module's static imports resolve.
+ */
+function suppressDeprecationNotices(): boolean {
+  if (process.env.PAI_QUIET_NOTICES === '1') return true;
+  const idx = process.argv.indexOf('--output-format');
+  return idx !== -1 && process.argv[idx + 1] === 'json';
+}
+
+/**
+ * At most once per process — a `globalThis` flag rather than a module-level
+ * `let` because hooks and the CLI can end up with more than one instance of
+ * this module loaded into the same process (separate bundles), each with its
+ * own module scope; only a property on the shared global survives that.
+ */
+function warnPaiDirDeprecatedOnce(message: string): void {
+  const g = globalThis as typeof globalThis & { __paiDirNoticePrinted?: boolean };
+  if (g.__paiDirNoticePrinted || suppressDeprecationNotices()) return;
+  g.__paiDirNoticePrinted = true;
+  process.stderr.write(`pai: ${message}\n`);
+}
+
 /**
- * Smart PAI_DIR detection with fallback
+ * Smart ADAPTER_DIR detection with fallback
  * Priority:
- * 1. PAI_DIR environment variable (if set)
- * 2. ~/.claude (standard location)
+ * 1. ADAPTER_DIR environment variable (if set) — warns once if PAI_DIR is
+ *    ALSO set and resolves to a different path (naming both).
+ * 2. PAI_DIR environment variable (deprecated alias, one release) — warns
+ *    once only when it differs from the default adapter root; PAI_DIR set to
+ *    the same value as the default is the operator's current, correct
+ *    setting and stays silent.
+ * 3. ~/.claude (standard location)
  */
-export const PAI_DIR = process.env.PAI_DIR
-  ? resolve(process.env.PAI_DIR)
-  : resolve(homedir(), '.claude');
+function resolveAdapterDir(): string {
+  if (process.env.ADAPTER_DIR) {
+    const adapterDir = resolve(process.env.ADAPTER_DIR);
+    if (process.env.PAI_DIR) {
+      const paiDir = resolve(process.env.PAI_DIR);
+      if (paiDir !== adapterDir) {
+        warnPaiDirDeprecatedOnce(
+          `ADAPTER_DIR (${adapterDir}) and PAI_DIR (${paiDir}) are both set and differ — ADAPTER_DIR wins. PAI_DIR still works for one release.`
+        );
+      }
+    }
+    return adapterDir;
+  }
+  if (process.env.PAI_DIR) {
+    const paiDir = resolve(process.env.PAI_DIR);
+    if (paiDir !== defaultAdapterDir()) {
+      warnPaiDirDeprecatedOnce(
+        'PAI_DIR is deprecated — use ADAPTER_DIR for the harness adapter root (~/.claude). PAI_DIR still works for one release.'
+      );
+    }
+    return paiDir;
+  }
+  return defaultAdapterDir();
+}
+
+/** The Claude Code harness adapter root — NOT PAI's state home. See module doc above. */
+export const ADAPTER_DIR = resolveAdapterDir();
+
+/** @deprecated alias for ADAPTER_DIR, kept for one release. Prefer ADAPTER_DIR. */
+export const PAI_DIR = ADAPTER_DIR;
 
 /**
- * Common PAI directories
+ * Adapter directories — fixed paths the Claude Code harness itself loads
+ * from. These stay under ADAPTER_DIR; they are not PAI state.
  */
-export const HOOKS_DIR = join(PAI_DIR, 'Hooks');
-export const SKILLS_DIR = join(PAI_DIR, 'Skills');
-export const AGENTS_DIR = join(PAI_DIR, 'Agents');
-export const HISTORY_DIR = join(PAI_DIR, 'History');
-export const COMMANDS_DIR = join(PAI_DIR, 'Commands');
+export const HOOKS_DIR = join(ADAPTER_DIR, 'Hooks');
+export const SKILLS_DIR = join(ADAPTER_DIR, 'Skills');
+export const AGENTS_DIR = join(ADAPTER_DIR, 'Agents');
+export const COMMANDS_DIR = join(ADAPTER_DIR, 'Commands');
 
 /**
  * Validate PAI directory structure on first import
  * This fails fast with a clear error if PAI is misconfigured
  */
 function validatePAIStructure(): void {
-  if (!existsSync(PAI_DIR)) {
-    console.error(`PAI_DIR does not exist: ${PAI_DIR}`);
-    console.error(`   Expected ~/.claude or set PAI_DIR environment variable`);
+  if (!existsSync(ADAPTER_DIR)) {
+    console.error(`ADAPTER_DIR does not exist: ${ADAPTER_DIR}`);
+    console.error(`   Expected ~/.claude or set ADAPTER_DIR environment variable`);
     process.exit(1);
   }
 
   if (!existsSync(HOOKS_DIR)) {
     console.error(`PAI hooks directory not found: ${HOOKS_DIR}`);
-    console.error(`   Your PAI_DIR may be misconfigured`);
-    console.error(`   Current PAI_DIR: ${PAI_DIR}`);
+    console.error(`   Your ADAPTER_DIR may be misconfigured`);
+    console.error(`   Current ADAPTER_DIR: ${ADAPTER_DIR}`);
     process.exit(1);
   }
 }
@@ -110,6 +192,68 @@ function validatePAIStructure(): void {
 // This ensures any hook that imports this module will fail fast if paths are wrong
 validatePAIStructure();
 
+// ---------------------------------------------------------------------------
+// PAI state written by hooks — resolves under PAI_HOME, falling back to the
+// pre-2026-09-19 ADAPTER_DIR location (one-time stderr notice) until
+// `pai config migrate --history` moves it. Actively written on every hook
+// event across every session, so unlike most PAI_HOME files the live move is
+// deliberately NOT automatic — see `pai config migrate --history`.
+// ---------------------------------------------------------------------------
+
+function oldHistoryDir(): string {
+  return join(ADAPTER_DIR, 'History');
+}
+
+/** Read/write location for hook-captured history: PAI_HOME/History if
+ *  present, else the old ADAPTER_DIR/History (one-time stderr notice). */
+export function historyDir(): string {
+  return resolvePaiFile(paiHomePath('History'), [oldHistoryDir()], 'pai config migrate --history');
+}
+
+export function migrateHistoryDir(opts: { dryRun?: boolean } = {}): MigrateDirResult {
+  return migratePaiDir(paiHomePath('History'), [oldHistoryDir()], opts);
+}
+
+function oldAgentSessionsPath(): string {
+  return join(ADAPTER_DIR, 'agent-sessions.json');
+}
+
+export function agentSessionsPath(): string {
+  return resolvePaiFile(paiHomePath('agent-sessions.json'), [oldAgentSessionsPath()], 'pai config migrate --history');
+}
+
+export function migrateAgentSessions(opts: { dryRun?: boolean } = {}): MigrateFileResult {
+  return migratePaiFile(paiHomePath('agent-sessions.json'), [oldAgentSessionsPath()], opts);
+}
+
+function oldSecurityEventsPath(): string {
+  return join(ADAPTER_DIR, 'history', 'security', 'security-events.jsonl');
+}
+
+export function securityEventsPath(): string {
+  return resolvePaiFile(
+    paiHomePath('History', 'security', 'security-events.jsonl'),
+    [oldSecurityEventsPath()],
+    'pai config migrate --history'
+  );
+}
+
+export function migrateSecurityEvents(opts: { dryRun?: boolean } = {}): MigrateFileResult {
+  return migratePaiFile(paiHomePath('History', 'security', 'security-events.jsonl'), [oldSecurityEventsPath()], opts);
+}
+
+function oldSessionRoutingPath(): string {
+  return join(ADAPTER_DIR, 'session-routing.json');
+}
+
+export function sessionRoutingPath(): string {
+  return resolvePaiFile(paiHomePath('session-routing.json'), [oldSessionRoutingPath()], 'pai config migrate --history');
+}
+
+export function migrateSessionRouting(opts: { dryRun?: boolean } = {}): MigrateFileResult {
+  return migratePaiFile(paiHomePath('session-routing.json'), [oldSessionRoutingPath()], opts);
+}
+
 /**
  * Helper to get history file path with date-based organization
  */
@@ -120,5 +264,5 @@ export function getHistoryFilePath(subdir: string, filename: string): string {
   const year = localDate.getFullYear();
   const month = String(localDate.getMonth() + 1).padStart(2, '0');
 
-  return join(HISTORY_DIR, subdir, `${year}-${month}`, filename);
+  return join(historyDir(), subdir, `${year}-${month}`, filename);
 }

package/src/hooks/ts/lib/project-utils/index.ts

@@ -4,6 +4,7 @@
  */
 
 export {
+  ADAPTER_DIR,
   PAI_DIR,
   PROJECTS_DIR,
   isProbeSession,

package/src/hooks/ts/lib/project-utils/paths.ts

@@ -4,11 +4,12 @@
 
 import { existsSync, mkdirSync, readdirSync, linkSync, copyFileSync } from 'fs';
 import { join, basename } from 'path';
-import { PAI_DIR } from '../pai-paths.js';
+import { ADAPTER_DIR, PAI_DIR } from '../pai-paths.js';
 
-// Re-export PAI_DIR for consumers
-export { PAI_DIR };
-export const PROJECTS_DIR = join(PAI_DIR, 'projects');
+// Re-export for consumers. PROJECTS_DIR is a harness-adjacent data dir, not
+// PAI_HOME state — out of scope for the PAI_DIR→PAI_HOME fold (see pai-paths.ts).
+export { ADAPTER_DIR, PAI_DIR };
+export const PROJECTS_DIR = join(ADAPTER_DIR, 'projects');
 
 /**
  * Directories known to be automated health-check / probe sessions.

package/src/hooks/ts/lib/project-utils.ts

@@ -4,6 +4,7 @@
  */
 export type { WorkItem, TodoItem } from "./project-utils/index.js";
 export {
+  ADAPTER_DIR,
   PAI_DIR,
   PROJECTS_DIR,
   isProbeSession,

package/src/hooks/ts/post-tool-use/capture-tool-output.ts

@@ -9,7 +9,7 @@
 
 import { appendFileSync, mkdirSync, existsSync } from 'fs';
 import { join } from 'path';
-import { PAI_DIR, HISTORY_DIR } from '../lib/pai-paths';
+import { historyDir } from '../lib/pai-paths';
 
 interface ToolUseData {
   tool_name: string;
@@ -20,7 +20,7 @@ interface ToolUseData {
 }
 
 // Configuration
-const CAPTURE_DIR = join(HISTORY_DIR, 'raw-outputs');
+const CAPTURE_DIR = join(historyDir(), 'raw-outputs');
 const INTERESTING_TOOLS = ['Bash', 'Edit', 'Write', 'Read', 'Task', 'NotebookEdit'];
 
 async function main() {

package/src/hooks/ts/pre-compact/context-compression-hook.ts

@@ -707,7 +707,7 @@ async function main() {
       // BUG (live): a production digest was found with NO "HANDOVER SOURCE:"
       // line at all — its cause was never pinned down for certain (the
       // deployed hook is a compiled dist/ artifact reached through
-      // ${PAI_DIR}/Hooks/..., a separate build step from editing this
+      // ${ADAPTER_DIR}/Hooks/..., a separate build step from editing this
       // source, which is itself a plausible way for "works when I run the
       // .ts source" and "missing in production" to diverge). Regardless of
       // cause: sourceLabel and handoverBlock are now computed in their own

package/src/hooks/ts/pre-tool-use/route-agents-to-worker.ts

@@ -1,51 +1,42 @@
 #!/usr/bin/env node
 
 /**
- * route-agents-to-worker.ts — PreToolUse hook on the Agent tool.
+ * route-agents-to-worker.ts — PreToolUse hook on the in-process subagent tool.
  *
- * Denies every in-process subagent when worker providers are configured, so no
- * worker ever runs on Anthropic. The deny reason tells the orchestrator how to
- * delegate through `pai worker run` instead — same idea as the old
- * route-agents-to-glm.sh, but provider-neutral and ledgered in the workers
- * log dir.
+ * Denies every in-process subagent, in every project, so that delegated work
+ * always goes through `pai worker run` and therefore shows up in
+ * `pai worker ps`, in the status line and in the worker log dir. The deny
+ * reason names the replacement command, `--provider anthropic` included, so
+ * there is never a reason to reach for the built-in tool.
  *
- * Allows (and does not touch) when:
- *   - the tool is not the Agent tool (this hook is Agent-matched, but stay safe)
- *   - ALLOW_ANTHROPIC_AGENTS=1 is in the environment (one-session bypass)
- *   - workers are off or no provider is configured
+ * This file is only I/O: read stdin, ask lib/agent-gate for the decision,
+ * ledger it, print it. The decision itself lives in lib/agent-gate.ts and is
+ * tested there.
  *
- * Every decision is appended to the routing ledger read by `pai worker log`.
+ * Registered in ~/.claude/settings.json under a PreToolUse matcher that covers
+ * both tool names ("Agent|Task") — see src/workers/install.ts, which owns that
+ * registration.
  */
 
-import { readWorkersSection, ANTHROPIC_NATIVE } from "../../../workers/config.js";
+import { readWorkersSection } from "../../../workers/config.js";
 import { workersLogDir, ledgerPath } from "../../../workers/paths.js";
 import { appendLedger } from "../../../workers/ledger.js";
+import {
+  decideAgentGate,
+  renderDecision,
+  shortLabel,
+  type AgentGateInput,
+} from "../lib/agent-gate.js";
 
-interface HookInput {
-  session_id?: string;
-  cwd?: string;
-  tool_name?: string;
-  tool_input?: { description?: string; prompt?: string; subagent_type?: string } | string;
-}
-
-const ALLOW = JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } });
-
-function deny(reason: string): string {
-  return JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "deny",
-      permissionDecisionReason: reason,
-    },
-  });
-}
-
-function shortLabel(input: HookInput): string {
-  const desc =
-    typeof input.tool_input === "object" && input.tool_input !== null
-      ? input.tool_input.description ?? ""
-      : "";
-  return desc.replace(/\s+/g, " ").trim().slice(0, 60);
+/**
+ * What to print when the hook cannot read or parse its own input. This hook is
+ * matcher-scoped to the subagent tool, so anything that reaches it *is* a
+ * subagent launch: a broken event denies rather than allows, and the bypass
+ * env var is still honoured. A gate that opens whenever it stumbles is the
+ * failure this hook exists to prevent.
+ */
+function fallback(): string {
+  return renderDecision(decideAgentGate({}, process.env));
 }
 
 async function main(): Promise<void> {
@@ -53,80 +44,36 @@ async function main(): Promise<void> {
   try {
     for await (const chunk of process.stdin) text += chunk;
   } catch {
-    process.stdout.write(ALLOW);
-    return;
-  }
-  if (!text.trim()) {
-    process.stdout.write(ALLOW);
-    return;
-  }
-
-  let input: HookInput;
-  try {
-    input = JSON.parse(text) as HookInput;
-  } catch {
-    process.stdout.write(ALLOW);
+    process.stdout.write(fallback());
     return;
   }
 
-  if (input.tool_name && input.tool_name !== "Agent") {
-    process.stdout.write(ALLOW);
-    return;
+  let input: AgentGateInput = {};
+  if (text.trim()) {
+    try {
+      input = JSON.parse(text) as AgentGateInput;
+    } catch {
+      // A malformed event on a matcher-scoped hook is still a subagent launch;
+      // an empty input denies, which is the safe direction here.
+      input = {};
+    }
   }
 
-  const label = shortLabel(input);
-  const cwd = input.cwd ?? process.cwd();
+  const decision = decideAgentGate(input, process.env);
 
-  const ledger = (event: string): void => {
+  if (decision.ledger) {
+    const label = shortLabel(input);
     try {
-      appendLedger(ledgerPath(workersLogDir(readWorkersSection().workers)), event, {
-        cwd,
+      appendLedger(ledgerPath(workersLogDir(readWorkersSection().workers)), decision.ledger, {
+        cwd: input.cwd ?? process.cwd(),
         ...(label ? { label } : {}),
       });
     } catch {
-      // no config / no log dir yet — the decision below still stands
+      // no config / no log dir yet — the decision still stands
     }
-  };
-
-  if (process.env.ALLOW_ANTHROPIC_AGENTS === "1") {
-    ledger("ALLOWED-ANTHROPIC-AGENT");
-    process.stdout.write(ALLOW);
-    return;
-  }
-
-  let workers: ReturnType<typeof readWorkersSection>["workers"];
-  try {
-    workers = readWorkersSection().workers;
-  } catch {
-    // broken workers config must not break the session
-    process.stdout.write(ALLOW);
-    return;
-  }
-  if (
-    !workers.enabled ||
-    Object.keys(workers.providers).length === 0 ||
-    workers.active === ANTHROPIC_NATIVE
-  ) {
-    process.stdout.write(ALLOW);
-    return;
   }
 
-  ledger("DENIED-ANTHROPIC-AGENT");
-  process.stdout.write(
-    deny(
-      "Agent tool is disabled: subagents run on the configured worker provider, not Anthropic. " +
-        "Delegate with Bash instead, in the background:\n\n" +
-        `pai worker run --label "${label || "task"}" --class research -p '<full, self-contained task spec>' ` +
-        "--allowedTools 'Read,Edit,Write,Bash,Grep,Glob' --output-format json\n\n" +
-        "- Run it with run_in_background: true and always with a timeout.\n" +
-        "- Use --class spotcheck (or implement) as the task demands.\n" +
-        "- Web research: add WebSearch,WebFetch to --allowedTools.\n" +
-        "- The answer is in the `result` field of the JSON it prints. Review the diff yourself.\n" +
-        "- pai worker ps lists running workers; pai worker follow <id> shows one live.\n" +
-        "Keep only orchestration, review and synthesis in this session. " +
-        "To run subagents on Anthropic for one session: start it with ALLOW_ANTHROPIC_AGENTS=1."
-    )
-  );
+  process.stdout.write(renderDecision(decision));
 }
 
-main().catch(() => process.stdout.write(ALLOW));
+main().catch(() => process.stdout.write(fallback()));

package/src/hooks/ts/pre-tool-use/route-edits-to-worker.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from "vitest";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+
+// The entry does its own stdin read and calls main() unconditionally at
+// module scope — importing it in-process would run that read against the
+// test runner's own stdin. Run it as a real subprocess with its own piped
+// stdin, exactly like session-start/session-start-worker-guard.test.ts.
+//
+// Uses this checkout as the git work tree (it already has a .git dir), not a
+// tmp-created one: a repo under os.tmpdir() would itself match the hook's
+// /tmp exemption and mask the "inside a git work tree" case being tested.
+describe("route-edits-to-worker", () => {
+  const ENTRYPOINT = "src/hooks/ts/pre-tool-use/route-edits-to-worker.ts";
+  const repo = process.cwd();
+
+  function runHook(filePath: string, env: NodeJS.ProcessEnv = {}): string {
+    // This test may itself run as a worker (PAI_WORKER=1 in its own env),
+    // which must not leak into the child and mask the case under test.
+    const { PAI_WORKER: _drop, ...baseEnv } = process.env;
+    return execFileSync("bun", [ENTRYPOINT], {
+      input: JSON.stringify({
+        cwd: repo,
+        tool_name: "Edit",
+        tool_input: { file_path: filePath, old_string: "a", new_string: "b" },
+      }),
+      encoding: "utf8",
+      timeout: 15_000,
+      env: { ...baseEnv, ...env },
+    });
+  }
+
+  it("allows a Notes/TODO.md edit (prints nothing)", () => {
+    expect(runHook(join(repo, "Notes/TODO.md"))).toBe("");
+  });
+
+  it("blocks a source file edit with the standing message", () => {
+    const out = runHook(join(repo, "src/workers/run.ts"));
+    const parsed = JSON.parse(out);
+    expect(parsed.decision).toBe("block");
+    expect(parsed.reason).toContain("main session does not edit code");
+  });
+
+  it("allows a source file edit when PAI_WORKER=1", () => {
+    expect(runHook(join(repo, "src/workers/run.ts"), { PAI_WORKER: "1" })).toBe("");
+  });
+});

package/src/hooks/ts/pre-tool-use/route-edits-to-worker.ts

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+
+/**
+ * route-edits-to-worker.ts — PreToolUse (Edit|MultiEdit|Write)
+ *
+ * The outer orchestrator session does not edit code files; code changes go
+ * through `pai worker run`. Allowed through silently:
+ *   - worker sessions (the runner sets PAI_WORKER=1)
+ *   - paths outside any git work tree
+ *   - the exempt scratch prefixes (.claude incl. memory dirs, the local
+ *     notes/tasks/scratchpad dirs, the OS temp dir)
+ *   - prose: notes, session logs, handovers — see lib/edit-gate.ts isProseEdit
+ * Everything else inside a git work tree is blocked with the worker command.
+ *
+ * This file is only I/O: read stdin, resolve the path, ask lib/edit-gate for
+ * the decision, print it. The decision itself lives in lib/edit-gate.ts and
+ * is tested there.
+ */
+
+import { existsSync } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { decideEditGate, type EditGateContext } from "../lib/edit-gate.js";
+
+function isUnder(p: string, prefix: string): boolean {
+  return p === prefix || p.startsWith(prefix + sep);
+}
+
+// A .git entry in any ancestor marks a git work tree (.git is a directory in
+// a normal repo, a file in a linked worktree — existsSync covers both).
+function inGitWorkTree(p: string): boolean {
+  let dir = resolve(p);
+  for (;;) {
+    if (existsSync(join(dir, ".git"))) return true;
+    const parent = dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+
+function exemptPrefixes(): string[] {
+  const home = homedir();
+  return [
+    join(home, ".claude"),
+    join(home, "colibri", "Notes"),
+    join(home, "colibri", "tasks"),
+    join(home, "colibri", "scratchpad"),
+    tmpdir(),
+    "/tmp",
+  ];
+}
+
+function allow(): void {
+  process.exit(0);
+}
+
+function block(reason: string): void {
+  process.stdout.write(JSON.stringify({ decision: "block", reason }) + "\n");
+  process.exit(0);
+}
+
+async function main(): Promise<void> {
+  let text = "";
+  try {
+    for await (const chunk of process.stdin) text += chunk;
+  } catch {
+    return allow();
+  }
+  if (!text.trim()) return allow();
+
+  let input: { cwd?: string; tool_input?: { file_path?: string } };
+  try {
+    input = JSON.parse(text);
+  } catch {
+    return allow();
+  }
+
+  const filePath =
+    input.tool_input && typeof input.tool_input.file_path === "string" ? input.tool_input.file_path : "";
+  if (!filePath) return allow();
+
+  const abs = resolve(input.cwd ?? process.cwd(), filePath);
+
+  const ctx: EditGateContext = {
+    filePath: abs,
+    isPaiWorker: process.env.PAI_WORKER === "1",
+    isExemptPrefix: exemptPrefixes().some((p) => isUnder(abs, p)),
+    isGitWorkTree: inGitWorkTree(abs),
+  };
+
+  const decision = decideEditGate(ctx);
+  if (decision.decision === "block") return block(decision.reason);
+  return allow();
+}
+
+main().catch(() => process.exit(0));

package/src/hooks/ts/pre-tool-use/security-validator.ts

@@ -19,6 +19,7 @@
 
 import { appendFileSync, mkdirSync, existsSync } from 'fs';
 import { dirname } from 'path';
+import { securityEventsPath } from '../lib/pai-paths.js';
 
 // ============================================================================
 // ATTACK PATTERNS - CUSTOMIZE THESE FOR YOUR ENVIRONMENT
@@ -130,7 +131,7 @@ function detectAttack(content: string): DetectionResult {
 // ============================================================================
 
 function logSecurityEvent(event: Record<string, unknown>): void {
-  const logPath = `${process.env.PAI_DIR || '~/.claude'}/history/security/security-events.jsonl`;
+  const logPath = securityEventsPath();
   const entry = JSON.stringify({ timestamp: new Date().toISOString(), ...event }) + '\n';
 
   try {