@telora/daemon 0.21.26 → 0.21.82

package/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commitSha": "4e0b0f05b",
-  "builtAt": "2026-08-16T23:57:19.842Z",
+  "commitSha": "d3be59915",
+  "builtAt": "2026-08-18T15:20:51.425Z",
   "expectedMigrations": [
     "20250829113330_create_org_nodes_table.sql",
     "20250829113402_fix_function_security_search_path.sql",
@@ -752,6 +752,7 @@
     "20260816162100_retention_schedule_status_all_horizons.sql",
     "20260816162200_retention_sweep_recording.sql",
     "20260816172138_fix_retention_sweep_ambiguous_column.sql",
-    "20260816181820_retention_enforced_by_heartbeat_derived.sql"
+    "20260816181820_retention_enforced_by_heartbeat_derived.sql",
+    "20260817030910_server_now.sql"
   ]
 }

package/dist/audit/audit-hooks.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Per-worktree git-hook management.
+ *
+ * Two hooks live in a worktree's `.telora-hooks/` directory (a single
+ * `core.hooksPath`):
+ *   - a `commit-msg` hook installed on EVERY writable execution worktree that
+ *     refuses commits lacking a well-formed `Telora-Delivery: <uuid>` trailer
+ *     (`installDeliveryTrailerCommitMsgHook`); and
+ *   - a `pre-commit` hook installed only for read-only audit sessions that
+ *     blocks all commits (`installAuditPreCommitHook`), alongside the Claude
+ *     write-deny + Codex read-only overlays.
+ *
+ * `installExecutionWorktreeGuards` is the single entry point that applies the
+ * right set for a worktree given its read-only flag.
+ */
+/**
+ * Install a pre-commit hook in a worktree that blocks all commits.
+ * Used for read-only audit sessions.
+ */
+export declare function installAuditPreCommitHook(worktreePath: string): void;
+/**
+ * Write (or merge into) the worktree's `.claude/settings.json` a write-deny
+ * overlay so a read-only audit team physically cannot Write/Edit or run
+ * write-shaped Bash.
+ *
+ * The daemon spawns agents with `--dangerously-skip-permissions
+ * --setting-sources project,local`, which reads the worktree's
+ * `.claude/settings.json` (project source). Two properties make this deny
+ * overlay the tool-layer enforcement of read-only mode:
+ *   - `--dangerously-skip-permissions` only auto-approves the *ask* tier;
+ *     explicit `permissions.deny` entries are still enforced.
+ *   - Crucially, `deny` is honored even in an UNTRUSTED worktree -- the case
+ *     that actually matters, because a daemon-created worktree is a fresh path
+ *     and untrusted by default. In an untrusted worktree `permissions.allow` is
+ *     DISCARDED ("this workspace has not been trusted"), so it would be wrong to
+ *     assume `deny` shares that fate: `deny` is a restriction, not a grant, so
+ *     honoring it from an untrusted project is safe, and Claude Code does.
+ *
+ * This is not assumed -- it is verified. See
+ * `__tests__/read-only-deny-enforcement-evidence.test.ts` for the reproduction
+ * (untrusted worktree + deny overlay -> the Write tool is removed from the
+ * session and no file is written; the same untrusted worktree WITHOUT deny ->
+ * Write is available and succeeds while the allow list is ignored), measured
+ * against Claude Code 2.1.221 on 2026-08-04. Re-run that reproduction when
+ * bumping the Claude CLI.
+ *
+ * The pre-commit hook (installAuditPreCommitHook) and the completion-side
+ * revert are retained as defense-in-depth ON TOP of this tool-layer guard --
+ * not as the only guards.
+ *
+ * Idempotent: re-running merges the deny list, deduplicated, producing no diff.
+ * MUST only be called for read-only focuses -- a writable focus's settings
+ * must never carry a `deny` key.
+ */
+export declare function writeReadOnlyDenyOverlay(worktreePath: string): void;
+/**
+ * Write Codex's read-only audit overlay into the worktree-local project config.
+ *
+ * Codex project config is a durable record for the worktree; spawn-time `-c`
+ * overrides still select `default_permissions="telora_read_only"` so read-only
+ * enforcement does not depend on project trust. The profile itself is kept here
+ * for parity, inspection, and trusted-project runs.
+ */
+export declare function writeCodexReadOnlyOverlay(worktreePath: string): void;
+/**
+ * Install all read-only audit enforcement in a worktree: the commit-blocking
+ * pre-commit hook, Claude's write-deny settings overlay, and Codex's
+ * read-only permission profile. Single entry point so every read-only
+ * worktree-setup site gets identical coverage.
+ */
+export declare function installReadOnlyAuditGuards(worktreePath: string): void;
+/**
+ * Install a `commit-msg` hook in a worktree that REFUSES any commit whose
+ * message lacks a well-formed `Telora-Delivery: <uuid>` trailer.
+ *
+ * The trailer is the one durable per-commit fact every delivery-attribution
+ * read rests on (`readDeliveryTrailer` in resolvers/shared/git-diff.ts reads it
+ * via `git show -s --format=%(trailers:key=Telora-Delivery,valueonly)`). Prose
+ * in the execution prompt + agent CLAUDE.md asks agents to stamp it, but prose
+ * has already failed silently once (2026-08-13: the daemon's own recommended
+ * `-m` form voided the trailer when `Co-Authored-By` was appended). This hook
+ * makes the mandate mechanical at commit time.
+ *
+ * The hook validates SHAPE via git's OWN trailer parse, not a substring match:
+ *   - It uses `git interpret-trailers --parse` on the message file, so the value
+ *     it reads is exactly what the read side reads. A `Telora-Delivery:` line
+ *     sitting in the commit BODY (separated from the trailer block by a blank
+ *     line) is VOIDED by git and does not parse -- the read side rejects it, so
+ *     the hook must too. A naive `grep 'Telora-Delivery'` on the raw message
+ *     would wrongly PASS such a voided commit; this does not.
+ *   - A trailing `Co-Authored-By:` (or any other trailer) in the same block
+ *     still parses, so the commit PASSES -- the 2026-08-13 failure mode.
+ *   - The value must be a well-formed UUID (8-4-4-4-12 hex); a malformed or
+ *     truncated id FAILS.
+ *
+ * The failure message names the missing trailer and prints the exact line +
+ * the mandated `git commit --trailer` form, so an agent self-corrects without
+ * escalating.
+ *
+ * The hook lives in the SAME `.telora-hooks/` directory as any audit
+ * `pre-commit` hook, because `core.hooksPath` is a single value -- git runs
+ * every hook file in that one dir by name. So this coexists with the read-only
+ * audit pre-commit block (which runs first and blocks the commit outright)
+ * without weakening it.
+ */
+export declare function installDeliveryTrailerCommitMsgHook(worktreePath: string): void;
+/**
+ * Install the execution-worktree git guards: the delivery-trailer `commit-msg`
+ * hook on EVERY writable worktree, plus -- when the focus is read-only -- the
+ * full audit guard set (commit-blocking pre-commit hook + Claude/Codex
+ * read-only overlays). Single entry point so every worktree create/reuse site
+ * gets identical, idempotent coverage.
+ *
+ * The hook FILES live under the worktree's `.telora-hooks/` (not tracked tree
+ * content) and `core.hooksPath` is set PER-WORKTREE via `git config --worktree`
+ * (backed by repo-global `extensions.worktreeConfig=true`), so this must be
+ * RE-ASSERTED on every reuse/spawn (it is idempotent -- re-running produces the
+ * same files + config). Per-worktree scoping is deliberate: a plain
+ * `git config core.hooksPath` writes the SHARED `.git/config` and would let one
+ * worktree govern -- and, on removal, silently disable -- hook enforcement for
+ * every checkout of the repo (the 2026-08-17 wedge). A read-only worktree still
+ * gets the trailer hook, but its pre-commit block runs first and refuses the
+ * commit outright, so the two coexist without the trailer hook weakening the
+ * read-only guarantee.
+ */
+export declare function installExecutionWorktreeGuards(worktreePath: string, readOnly: boolean): void;
+//# sourceMappingURL=audit-hooks.d.ts.map

package/dist/audit/audit-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-hooks.d.ts","sourceRoot":"","sources":["../../src/audit/audit-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA4EH;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAmCpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CA0BnE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CA8BpE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mCAAmC,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAuE9E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAK5F"}

package/dist/audit/audit-hooks.js

@@ -0,0 +1,346 @@
+/**
+ * Per-worktree git-hook management.
+ *
+ * Two hooks live in a worktree's `.telora-hooks/` directory (a single
+ * `core.hooksPath`):
+ *   - a `commit-msg` hook installed on EVERY writable execution worktree that
+ *     refuses commits lacking a well-formed `Telora-Delivery: <uuid>` trailer
+ *     (`installDeliveryTrailerCommitMsgHook`); and
+ *   - a `pre-commit` hook installed only for read-only audit sessions that
+ *     blocks all commits (`installAuditPreCommitHook`), alongside the Claude
+ *     write-deny + Codex read-only overlays.
+ *
+ * `installExecutionWorktreeGuards` is the single entry point that applies the
+ * right set for a worktree given its read-only flag.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runGitSync } from '../git/index.js';
+import { buildClaudeSettings, mergeClaudeSettings } from '../templates/claude-settings.js';
+import { ensureCodexConfigIgnoredInWorktree } from '../worktree/provision.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'audit-hooks' });
+const CODEX_READ_ONLY_BLOCK_START = '# BEGIN TELORA CODEX READ-ONLY';
+const CODEX_READ_ONLY_BLOCK_END = '# END TELORA CODEX READ-ONLY';
+/**
+ * Point THIS worktree's git hooks at its own `.telora-hooks/` dir, scoped so it
+ * cannot depend on -- or govern -- any OTHER worktree of the same repository.
+ *
+ * A plain `git config core.hooksPath ...` writes the SHARED `.git/config`
+ * (verified 2026-08-18 on git 2.47.3: a value set from a linked worktree reads
+ * back from the main checkout), so one focus's ephemeral worktree would govern
+ * hook execution for the whole repo -- and when that worktree is removed, git
+ * runs NO hooks anywhere and the attribution guard silently disappears. Instead
+ * we enable `extensions.worktreeConfig` (repo-global, idempotent) and write
+ * core.hooksPath with `git config --worktree`, so each worktree carries its own
+ * hooksPath and another worktree's create/reuse/removal cannot touch it.
+ *
+ * After writing, verifies the scoping is actually in effect and logs a loud WARN
+ * if it is not -- a guard must never fail OPEN in silence.
+ */
+function configureWorktreeHooksPath(worktreePath, hooksDir) {
+    // extensions.worktreeConfig must be enabled before `git config --worktree`
+    // will accept a write; enabling it is repo-global and idempotent.
+    const enable = runGitSync(['config', 'extensions.worktreeConfig', 'true'], worktreePath);
+    if (!enable.success) {
+        log.warn(`[audit-hooks] Could not enable extensions.worktreeConfig for ${worktreePath}: ` +
+            `${enable.error}. Falling back to shared core.hooksPath (repo-global) -- ` +
+            `hook enforcement may leak across worktrees.`);
+        runGitSync(['config', 'core.hooksPath', hooksDir], worktreePath);
+        return;
+    }
+    const set = runGitSync(['config', '--worktree', 'core.hooksPath', hooksDir], worktreePath);
+    if (!set.success) {
+        log.warn(`[audit-hooks] Could not set per-worktree core.hooksPath for ${worktreePath}: ` +
+            `${set.error}. Falling back to shared core.hooksPath.`);
+        runGitSync(['config', 'core.hooksPath', hooksDir], worktreePath);
+    }
+    verifyHookEnforcementInEffect(worktreePath, hooksDir);
+}
+/**
+ * Confirm the commit-msg guard is actually in force for a worktree: its resolved
+ * core.hooksPath points at the expected dir and an executable commit-msg hook
+ * exists there. When enforcement is EXPECTED but not in effect, log a loud WARN
+ * -- the guard must not fail open unnoticed.
+ */
+function verifyHookEnforcementInEffect(worktreePath, hooksDir) {
+    const resolved = runGitSync(['config', '--get', 'core.hooksPath'], worktreePath);
+    const resolvedPath = resolved.success ? resolved.output.trim() : '';
+    const hookFile = join(hooksDir, 'commit-msg');
+    const hookPresent = existsSync(hookFile);
+    if (resolvedPath !== hooksDir || !hookPresent) {
+        log.warn(`[audit-hooks] Hook enforcement is NOT in effect for ${worktreePath}: ` +
+            `resolved core.hooksPath='${resolvedPath}' (expected '${hooksDir}'), ` +
+            `commit-msg present=${hookPresent}. The attribution guard is failing OPEN -- ` +
+            `commits in this worktree are not being checked.`);
+    }
+}
+/**
+ * Install a pre-commit hook in a worktree that blocks all commits.
+ * Used for read-only audit sessions.
+ */
+export function installAuditPreCommitHook(worktreePath) {
+    // Create a custom hooks directory inside the worktree
+    const hooksDir = join(worktreePath, '.telora-hooks');
+    if (!existsSync(hooksDir)) {
+        mkdirSync(hooksDir, { recursive: true });
+    }
+    const hookScript = [
+        '#!/bin/bash',
+        'echo ""',
+        'echo "========================================================"',
+        'echo "  READ-ONLY AUDIT SESSION"',
+        'echo "========================================================"',
+        'echo ""',
+        'echo "  Commits are blocked. This session operates in"',
+        'echo "  read-only audit mode by design."',
+        'echo ""',
+        'echo "  Your job is discovery only:"',
+        'echo "  - Log findings as issues via MCP tools"',
+        'echo "  - Create remediation deliveries for fixes"',
+        'echo "  - Do NOT modify or commit code changes"',
+        'echo ""',
+        'echo "========================================================"',
+        'echo ""',
+        'exit 1',
+        '',
+    ].join('\n');
+    const hookPath = join(hooksDir, 'pre-commit');
+    writeFileSync(hookPath, hookScript, { mode: 0o755 });
+    // Point this worktree's git config at the custom hooks directory, scoped to
+    // THIS worktree so it cannot govern another worktree's hooks (see
+    // configureWorktreeHooksPath).
+    configureWorktreeHooksPath(worktreePath, hooksDir);
+}
+/**
+ * Write (or merge into) the worktree's `.claude/settings.json` a write-deny
+ * overlay so a read-only audit team physically cannot Write/Edit or run
+ * write-shaped Bash.
+ *
+ * The daemon spawns agents with `--dangerously-skip-permissions
+ * --setting-sources project,local`, which reads the worktree's
+ * `.claude/settings.json` (project source). Two properties make this deny
+ * overlay the tool-layer enforcement of read-only mode:
+ *   - `--dangerously-skip-permissions` only auto-approves the *ask* tier;
+ *     explicit `permissions.deny` entries are still enforced.
+ *   - Crucially, `deny` is honored even in an UNTRUSTED worktree -- the case
+ *     that actually matters, because a daemon-created worktree is a fresh path
+ *     and untrusted by default. In an untrusted worktree `permissions.allow` is
+ *     DISCARDED ("this workspace has not been trusted"), so it would be wrong to
+ *     assume `deny` shares that fate: `deny` is a restriction, not a grant, so
+ *     honoring it from an untrusted project is safe, and Claude Code does.
+ *
+ * This is not assumed -- it is verified. See
+ * `__tests__/read-only-deny-enforcement-evidence.test.ts` for the reproduction
+ * (untrusted worktree + deny overlay -> the Write tool is removed from the
+ * session and no file is written; the same untrusted worktree WITHOUT deny ->
+ * Write is available and succeeds while the allow list is ignored), measured
+ * against Claude Code 2.1.221 on 2026-08-04. Re-run that reproduction when
+ * bumping the Claude CLI.
+ *
+ * The pre-commit hook (installAuditPreCommitHook) and the completion-side
+ * revert are retained as defense-in-depth ON TOP of this tool-layer guard --
+ * not as the only guards.
+ *
+ * Idempotent: re-running merges the deny list, deduplicated, producing no diff.
+ * MUST only be called for read-only focuses -- a writable focus's settings
+ * must never carry a `deny` key.
+ */
+export function writeReadOnlyDenyOverlay(worktreePath) {
+    const dir = join(worktreePath, '.claude');
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const settingsPath = join(dir, 'settings.json');
+    let existing = null;
+    if (existsSync(settingsPath)) {
+        try {
+            const parsed = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                existing = parsed;
+            }
+        }
+        catch (err) {
+            // Corrupt settings file -- log and overwrite with the deny overlay rather
+            // than leave a read-only worktree without enforcement.
+            log.warn(`[audit-hooks] Existing ${settingsPath} is not valid JSON, overwriting with read-only overlay: ` +
+                `${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const merged = mergeClaudeSettings(existing, buildClaudeSettings({ readOnly: true }));
+    writeFileSync(settingsPath, JSON.stringify(merged, null, 2) + '\n');
+}
+/**
+ * Write Codex's read-only audit overlay into the worktree-local project config.
+ *
+ * Codex project config is a durable record for the worktree; spawn-time `-c`
+ * overrides still select `default_permissions="telora_read_only"` so read-only
+ * enforcement does not depend on project trust. The profile itself is kept here
+ * for parity, inspection, and trusted-project runs.
+ */
+export function writeCodexReadOnlyOverlay(worktreePath) {
+    ensureCodexConfigIgnoredInWorktree(worktreePath);
+    const dir = join(worktreePath, '.codex');
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const configPath = join(dir, 'config.toml');
+    const existing = existsSync(configPath) ? readFileSync(configPath, 'utf-8') : '';
+    const block = [
+        CODEX_READ_ONLY_BLOCK_START,
+        '# Generated by Telora for read-only Codex audit execution.',
+        '# Spawn-time overrides select this permission profile.',
+        '',
+        '[permissions.telora_read_only.filesystem]',
+        '":minimal" = "read"',
+        '":workspace_roots" = { "." = "read" }',
+        '',
+        '[permissions.telora_read_only.network]',
+        'enabled = false',
+        CODEX_READ_ONLY_BLOCK_END,
+    ].join('\n');
+    const markerPattern = new RegExp(`${CODEX_READ_ONLY_BLOCK_START}[\\s\\S]*?${CODEX_READ_ONLY_BLOCK_END}\\n?`, 'm');
+    const withoutOldBlock = existing.replace(markerPattern, '').trimEnd();
+    const separator = withoutOldBlock ? '\n\n' : '';
+    writeFileSync(configPath, `${withoutOldBlock}${separator}${block}\n`, { mode: 0o600 });
+}
+/**
+ * Install all read-only audit enforcement in a worktree: the commit-blocking
+ * pre-commit hook, Claude's write-deny settings overlay, and Codex's
+ * read-only permission profile. Single entry point so every read-only
+ * worktree-setup site gets identical coverage.
+ */
+export function installReadOnlyAuditGuards(worktreePath) {
+    installAuditPreCommitHook(worktreePath);
+    writeReadOnlyDenyOverlay(worktreePath);
+    writeCodexReadOnlyOverlay(worktreePath);
+}
+/**
+ * Install a `commit-msg` hook in a worktree that REFUSES any commit whose
+ * message lacks a well-formed `Telora-Delivery: <uuid>` trailer.
+ *
+ * The trailer is the one durable per-commit fact every delivery-attribution
+ * read rests on (`readDeliveryTrailer` in resolvers/shared/git-diff.ts reads it
+ * via `git show -s --format=%(trailers:key=Telora-Delivery,valueonly)`). Prose
+ * in the execution prompt + agent CLAUDE.md asks agents to stamp it, but prose
+ * has already failed silently once (2026-08-13: the daemon's own recommended
+ * `-m` form voided the trailer when `Co-Authored-By` was appended). This hook
+ * makes the mandate mechanical at commit time.
+ *
+ * The hook validates SHAPE via git's OWN trailer parse, not a substring match:
+ *   - It uses `git interpret-trailers --parse` on the message file, so the value
+ *     it reads is exactly what the read side reads. A `Telora-Delivery:` line
+ *     sitting in the commit BODY (separated from the trailer block by a blank
+ *     line) is VOIDED by git and does not parse -- the read side rejects it, so
+ *     the hook must too. A naive `grep 'Telora-Delivery'` on the raw message
+ *     would wrongly PASS such a voided commit; this does not.
+ *   - A trailing `Co-Authored-By:` (or any other trailer) in the same block
+ *     still parses, so the commit PASSES -- the 2026-08-13 failure mode.
+ *   - The value must be a well-formed UUID (8-4-4-4-12 hex); a malformed or
+ *     truncated id FAILS.
+ *
+ * The failure message names the missing trailer and prints the exact line +
+ * the mandated `git commit --trailer` form, so an agent self-corrects without
+ * escalating.
+ *
+ * The hook lives in the SAME `.telora-hooks/` directory as any audit
+ * `pre-commit` hook, because `core.hooksPath` is a single value -- git runs
+ * every hook file in that one dir by name. So this coexists with the read-only
+ * audit pre-commit block (which runs first and blocks the commit outright)
+ * without weakening it.
+ */
+export function installDeliveryTrailerCommitMsgHook(worktreePath) {
+    const hooksDir = join(worktreePath, '.telora-hooks');
+    if (!existsSync(hooksDir)) {
+        mkdirSync(hooksDir, { recursive: true });
+    }
+    const hookScript = [
+        '#!/bin/bash',
+        '# Telora delivery-attribution guard. Every commit must carry a well-formed',
+        '# `Telora-Delivery: <uuid>` git trailer so the verify gate can recover its',
+        '# changed-work evidence from the commit object itself. See audit-hooks.ts.',
+        '#',
+        '# No `set -e`/`pipefail`: a grep that finds no trailer (the reject case) exits',
+        '# non-zero, and we MUST fall through to print the guidance rather than abort.',
+        'msg_file="$1"',
+        '',
+        '# Merge-commit exemption, decided from the commit\'s OWN SHAPE, never the',
+        '# message text: while git is finishing a real merge it has MERGE_HEAD set.',
+        '# A merge is not delivery work and has no single deliveryId -- the per-delivery',
+        '# evidence already lives in the merged commits, each carrying its own trailer.',
+        '# The daemon\'s integration merge-back (git merge --no-ff) is exactly this case.',
+        '# An ordinary commit that merely imitates a merge subject line has no',
+        '# MERGE_HEAD, so it cannot claim the exemption and is still held to the trailer.',
+        'if git rev-parse -q --verify MERGE_HEAD >/dev/null 2>&1; then',
+        '  exit 0',
+        'fi',
+        '',
+        '# Read the trailer through git\'s own parser (--parse == --only-trailers',
+        '# --only-input --unfold), so a BODY-paragraph line that git voids does not',
+        '# count and a trailing Co-Authored-By in the same block does not break it.',
+        'value="$(git interpret-trailers --parse "$msg_file" 2>/dev/null \\',
+        '  | grep -i \'^Telora-Delivery:\' | head -n1 | sed \'s/^[^:]*:[[:space:]]*//\' | tr -d \'[:space:]\')"',
+        '',
+        'uuid_re=\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'',
+        '',
+        'if [[ ! "$value" =~ $uuid_re ]]; then',
+        '  echo "" >&2',
+        '  echo "========================================================" >&2',
+        '  echo "  COMMIT REFUSED: missing Telora-Delivery trailer" >&2',
+        '  echo "========================================================" >&2',
+        '  echo "" >&2',
+        '  echo "  Every commit must carry a well-formed delivery trailer:" >&2',
+        '  echo "" >&2',
+        '  echo "      Telora-Delivery: <deliveryId>" >&2',
+        '  echo "" >&2',
+        '  echo "  Add it as a git TRAILER (not a body line) so an appended" >&2',
+        '  echo "  Co-Authored-By cannot void it:" >&2',
+        '  echo "" >&2',
+        '  echo "      git commit --trailer \\"Telora-Delivery: <deliveryId>\\" -m \\"<subject>\\"" >&2',
+        '  echo "" >&2',
+        '  echo "  To fix the commit you just attempted:" >&2',
+        '  echo "" >&2',
+        '  echo "      git commit --amend --no-edit --trailer \\"Telora-Delivery: <deliveryId>\\"" >&2',
+        '  echo "" >&2',
+        '  echo "========================================================" >&2',
+        '  echo "" >&2',
+        '  exit 1',
+        'fi',
+        '',
+        'exit 0',
+        '',
+    ].join('\n');
+    const hookPath = join(hooksDir, 'commit-msg');
+    writeFileSync(hookPath, hookScript, { mode: 0o755 });
+    // Point this worktree's git config at the custom hooks directory, scoped to
+    // THIS worktree (git config --worktree) so it cannot govern the whole repo.
+    // Same dir as the audit pre-commit hook -- core.hooksPath is a single value,
+    // so both hook files coexist here.
+    configureWorktreeHooksPath(worktreePath, hooksDir);
+}
+/**
+ * Install the execution-worktree git guards: the delivery-trailer `commit-msg`
+ * hook on EVERY writable worktree, plus -- when the focus is read-only -- the
+ * full audit guard set (commit-blocking pre-commit hook + Claude/Codex
+ * read-only overlays). Single entry point so every worktree create/reuse site
+ * gets identical, idempotent coverage.
+ *
+ * The hook FILES live under the worktree's `.telora-hooks/` (not tracked tree
+ * content) and `core.hooksPath` is set PER-WORKTREE via `git config --worktree`
+ * (backed by repo-global `extensions.worktreeConfig=true`), so this must be
+ * RE-ASSERTED on every reuse/spawn (it is idempotent -- re-running produces the
+ * same files + config). Per-worktree scoping is deliberate: a plain
+ * `git config core.hooksPath` writes the SHARED `.git/config` and would let one
+ * worktree govern -- and, on removal, silently disable -- hook enforcement for
+ * every checkout of the repo (the 2026-08-17 wedge). A read-only worktree still
+ * gets the trailer hook, but its pre-commit block runs first and refuses the
+ * commit outright, so the two coexist without the trailer hook weakening the
+ * read-only guarantee.
+ */
+export function installExecutionWorktreeGuards(worktreePath, readOnly) {
+    installDeliveryTrailerCommitMsgHook(worktreePath);
+    if (readOnly) {
+        installReadOnlyAuditGuards(worktreePath);
+    }
+}
+//# sourceMappingURL=audit-hooks.js.map

package/dist/audit/audit-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-hooks.js","sourceRoot":"","sources":["../../src/audit/audit-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAGpD,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AACrE,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;;;;GAeG;AACH,SAAS,0BAA0B,CAAC,YAAoB,EAAE,QAAgB;IACxE,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,2BAA2B,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CACN,gEAAgE,YAAY,IAAI;YAC9E,GAAG,MAAM,CAAC,KAAK,2DAA2D;YAC1E,6CAA6C,CAChD,CAAC;QACF,UAAU,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3F,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CACN,+DAA+D,YAAY,IAAI;YAC7E,GAAG,GAAG,CAAC,KAAK,0CAA0C,CACzD,CAAC;QACF,UAAU,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC;IACD,6BAA6B,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,YAAoB,EAAE,QAAgB;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,YAAY,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,YAAY,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CACN,uDAAuD,YAAY,IAAI;YACrE,4BAA4B,YAAY,gBAAgB,QAAQ,MAAM;YACtE,sBAAsB,WAAW,6CAA6C;YAC9E,iDAAiD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAoB;IAC5D,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa;QACb,SAAS;QACT,iEAAiE;QACjE,kCAAkC;QAClC,iEAAiE;QACjE,SAAS;QACT,wDAAwD;QACxD,0CAA0C;QAC1C,SAAS;QACT,sCAAsC;QACtC,iDAAiD;QACjD,oDAAoD;QACpD,iDAAiD;QACjD,SAAS;QACT,iEAAiE;QACjE,SAAS;QACT,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC9C,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,4EAA4E;IAC5E,kEAAkE;IAClE,+BAA+B;IAC/B,0BAA0B,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAEhD,IAAI,QAAQ,GAAmC,IAAI,CAAC;IACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,QAAQ,GAAG,MAAiC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,uDAAuD;YACvD,GAAG,CAAC,IAAI,CACN,0BAA0B,YAAY,0DAA0D;gBAC9F,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,YAAoB;IAC5D,kCAAkC,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG;QACZ,2BAA2B;QAC3B,4DAA4D;QAC5D,wDAAwD;QACxD,EAAE;QACF,2CAA2C;QAC3C,qBAAqB;QACrB,uCAAuC;QACvC,EAAE;QACF,wCAAwC;QACxC,iBAAiB;QACjB,yBAAyB;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,aAAa,GAAG,IAAI,MAAM,CAC9B,GAAG,2BAA2B,aAAa,yBAAyB,MAAM,EAC1E,GAAG,CACJ,CAAC;IACF,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,aAAa,CAAC,UAAU,EAAE,GAAG,eAAe,GAAG,SAAS,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,YAAoB;IAC7D,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACxC,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACvC,yBAAyB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,mCAAmC,CAAC,YAAoB;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,aAAa;QACb,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,GAAG;QACH,gFAAgF;QAChF,+EAA+E;QAC/E,eAAe;QACf,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,uEAAuE;QACvE,kFAAkF;QAClF,+DAA+D;QAC/D,UAAU;QACV,IAAI;QACJ,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,oEAAoE;QACpE,wGAAwG;QACxG,EAAE;QACF,2FAA2F;QAC3F,EAAE;QACF,uCAAuC;QACvC,eAAe;QACf,uEAAuE;QACvE,gEAAgE;QAChE,uEAAuE;QACvE,eAAe;QACf,wEAAwE;QACxE,eAAe;QACf,kDAAkD;QAClD,eAAe;QACf,yEAAyE;QACzE,+CAA+C;QAC/C,eAAe;QACf,gGAAgG;QAChG,eAAe;QACf,sDAAsD;QACtD,eAAe;QACf,+FAA+F;QAC/F,eAAe;QACf,uEAAuE;QACvE,eAAe;QACf,UAAU;QACV,IAAI;QACJ,EAAE;QACF,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC9C,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,mCAAmC;IACnC,0BAA0B,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAiB;IACpF,mCAAmC,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}