@wazir-dev/cli 1.2.0 → 1.4.0

package/exports/hosts/cursor/.cursor/hooks.json

@@ -1,20 +1,20 @@
 {
   "hooks": [
     {
-      "name": "protected-path-write-guard",
-      "command": "./hooks/protected-path-write-guard"
+      "name": "pretooluse-dispatcher",
+      "command": "./hooks/pretooluse-dispatcher"
     },
     {
       "name": "loop-cap-guard",
       "command": "./hooks/loop-cap-guard"
     },
-    {
-      "name": "context-mode-router",
-      "command": "./hooks/context-mode-router"
-    },
     {
       "name": "session-start",
       "command": "./hooks/session-start"
+    },
+    {
+      "name": "stop-pipeline-gate",
+      "command": "./hooks/stop-pipeline-gate"
     }
   ]
 }

package/exports/hosts/cursor/export.manifest.json

@@ -1,7 +1,7 @@
 {
   "host": "cursor",
   "source_hashes": {
-    "wazir.manifest.yaml": "f00776eb08ed3332b8f855001a2fd0b866cd0b81d009c6fbb316149c398c51ca",
+    "wazir.manifest.yaml": "48a188248faf429807b241eb57fbb99afae3c6ddfdf71b24c5c532ca0bc2d33f",
     "roles/clarifier.md": "1e1b8a2c05f1070fdcef485963cfcbffff62c4b2703a8d73fe51ac52d056e573",
     "roles/content-author.md": "cc20b80bd70ab68b3239a9cf56bf1ffc2c06843d38afc6b190844b35a1d73c3e",
     "roles/designer.md": "76cff5bda82975cfb4074de71681e7c8ba284e2e49d0cc98f90208642fef74fc",
@@ -18,23 +18,26 @@
     "workflows/design.md": "7f69758b22f88c12d16846ac1dd444f4e178ab116559ef9f2f26f6daa1a10d62",
     "workflows/discover.md": "0696add486f739a46ed4c2b71b67bdda3ab9fea2d1395e662191282529ed21d2",
     "workflows/execute.md": "33428704476877b2c8cf34c6eda3a56d1fd71e8bbea0f05c122bb3da2c6475a6",
-    "workflows/learn.md": "9b1955a00eb0ea47af08a3639c3cbc2f15b8eab6cc02127e829bc8c83b0a52b5",
-    "workflows/plan-review.md": "8696c472cb4605a171fd4ac8a9c51b7cf337807c4881ed163515dc56e61fd818",
+    "workflows/learn.md": "450bbfbfaa9143365284e13c608f800e94caea47210c57d252d1c9a720160035",
+    "workflows/plan-review.md": "1dfe76dfe4fd9c32409d508e47654ad3b985b5429bd4616adde719b19fd606ac",
     "workflows/plan.md": "fd52737159ab13688af8cbcb1c3fa224b1a9dda441b9ab337ab98cbfb5c68fa5",
     "workflows/prepare-next.md": "8769b692be6d9fddf3b3f36fee6888159fb9fb2a5c31360cdbc9402e0f43fc27",
     "workflows/review.md": "aaeaf7ab4515e325084a77e75e18b325295f8d16799f71f8b7cd0ec67c52c0d6",
     "workflows/run-audit.md": "e582f767967dc3fb6aaeb938ad1672e7bed18bf044055ce8c45c2114251b787a",
     "workflows/spec-challenge.md": "dc99137c28c49a6f8312924709afb6077754d128e90466dc911150ce15737897",
     "workflows/specify.md": "53b84e74871f6dbd93cae22a881cc5907e398b29501d0a1fa08c7ed69df705cb",
-    "workflows/verify.md": "45f9c189520dfe9d24c0bc340a15e6a80c988fca1b84dc187627032a6dbaee16",
+    "workflows/verify.md": "4eff7b9b1c94b9a2c4a6f65cae076a3cd5a278a86430109b6033cd958e1e8ab8",
     "hooks/definitions/context_mode_router.yaml": "a10dc927418bc130b447eb33faf0f45669ecd9c7917f56947ddd74850a4e0e37",
     "hooks/definitions/loop_cap_guard.yaml": "f0fd220e028ab6fad3d8fd650602884fe500ca4899eff6e428cf217af058618d",
     "hooks/definitions/post_tool_capture.yaml": "a773cd6e18972dee8eef3b7cb06fd1d319a71de4588897cebfbe643f6781a3b2",
     "hooks/definitions/pre_compact_summary.yaml": "daa0175d79f3e0127c5ce86a7a2f8df0be3f58b5c94fe749da715a17c7b2d04e",
     "hooks/definitions/pre_tool_capture_route.yaml": "3c2663380ff3cd09f09de5b96bcf6123266fa74d8a03dfb2d6fbe40a43fb13cf",
+    "hooks/definitions/pretooluse_dispatcher.yaml": "5b0646ab17704e6f4665bb4c08ead5bcfe2aa6e71395fa5694cb0debcbce69da",
+    "hooks/definitions/pretooluse_pipeline_guard.yaml": "ac89617b91093ff0a39da0e8c48affbcaa71054666fa316a42c32f73f656ae69",
     "hooks/definitions/protected_path_write_guard.yaml": "6683d41778b823e2a4e606065597569aa04363f091e135e165de9732f1fc2171",
     "hooks/definitions/session_start.yaml": "9383fcf1f8304c87e57726478a461706c0fc73dc62bcc4d8661f2eeffa43a82d",
     "hooks/definitions/stop_handoff_harvest.yaml": "67a3c0a8bb7cb66b88e77dc79e748082e964d278c47935662c453922a846482b",
-    "hooks/hooks.json": "f255345793951b5cf6f6d8c9a8b6a6ad2d3140023453410127a6f70d8e110c26"
+    "hooks/definitions/stop_pipeline_gate.yaml": "f27dde7605809aae56ac566b93b8692f5d40db1e11b569010e32d2878b677fcf",
+    "hooks/hooks.json": "65e022a151aa9546a6988581ee62ec853f0df5580aeed4b164e3ccc3dc2e72de"
   }
 }

package/exports/hosts/cursor/host-package.json

@@ -32,9 +32,12 @@
     "hooks/definitions/post_tool_capture.yaml",
     "hooks/definitions/pre_compact_summary.yaml",
     "hooks/definitions/pre_tool_capture_route.yaml",
+    "hooks/definitions/pretooluse_dispatcher.yaml",
+    "hooks/definitions/pretooluse_pipeline_guard.yaml",
     "hooks/definitions/protected_path_write_guard.yaml",
     "hooks/definitions/session_start.yaml",
     "hooks/definitions/stop_handoff_harvest.yaml",
+    "hooks/definitions/stop_pipeline_gate.yaml",
     "hooks/hooks.json"
   ],
   "files": [

package/exports/hosts/gemini/export.manifest.json

@@ -1,7 +1,7 @@
 {
   "host": "gemini",
   "source_hashes": {
-    "wazir.manifest.yaml": "f00776eb08ed3332b8f855001a2fd0b866cd0b81d009c6fbb316149c398c51ca",
+    "wazir.manifest.yaml": "48a188248faf429807b241eb57fbb99afae3c6ddfdf71b24c5c532ca0bc2d33f",
     "roles/clarifier.md": "1e1b8a2c05f1070fdcef485963cfcbffff62c4b2703a8d73fe51ac52d056e573",
     "roles/content-author.md": "cc20b80bd70ab68b3239a9cf56bf1ffc2c06843d38afc6b190844b35a1d73c3e",
     "roles/designer.md": "76cff5bda82975cfb4074de71681e7c8ba284e2e49d0cc98f90208642fef74fc",
@@ -18,23 +18,26 @@
     "workflows/design.md": "7f69758b22f88c12d16846ac1dd444f4e178ab116559ef9f2f26f6daa1a10d62",
     "workflows/discover.md": "0696add486f739a46ed4c2b71b67bdda3ab9fea2d1395e662191282529ed21d2",
     "workflows/execute.md": "33428704476877b2c8cf34c6eda3a56d1fd71e8bbea0f05c122bb3da2c6475a6",
-    "workflows/learn.md": "9b1955a00eb0ea47af08a3639c3cbc2f15b8eab6cc02127e829bc8c83b0a52b5",
-    "workflows/plan-review.md": "8696c472cb4605a171fd4ac8a9c51b7cf337807c4881ed163515dc56e61fd818",
+    "workflows/learn.md": "450bbfbfaa9143365284e13c608f800e94caea47210c57d252d1c9a720160035",
+    "workflows/plan-review.md": "1dfe76dfe4fd9c32409d508e47654ad3b985b5429bd4616adde719b19fd606ac",
     "workflows/plan.md": "fd52737159ab13688af8cbcb1c3fa224b1a9dda441b9ab337ab98cbfb5c68fa5",
     "workflows/prepare-next.md": "8769b692be6d9fddf3b3f36fee6888159fb9fb2a5c31360cdbc9402e0f43fc27",
     "workflows/review.md": "aaeaf7ab4515e325084a77e75e18b325295f8d16799f71f8b7cd0ec67c52c0d6",
     "workflows/run-audit.md": "e582f767967dc3fb6aaeb938ad1672e7bed18bf044055ce8c45c2114251b787a",
     "workflows/spec-challenge.md": "dc99137c28c49a6f8312924709afb6077754d128e90466dc911150ce15737897",
     "workflows/specify.md": "53b84e74871f6dbd93cae22a881cc5907e398b29501d0a1fa08c7ed69df705cb",
-    "workflows/verify.md": "45f9c189520dfe9d24c0bc340a15e6a80c988fca1b84dc187627032a6dbaee16",
+    "workflows/verify.md": "4eff7b9b1c94b9a2c4a6f65cae076a3cd5a278a86430109b6033cd958e1e8ab8",
     "hooks/definitions/context_mode_router.yaml": "a10dc927418bc130b447eb33faf0f45669ecd9c7917f56947ddd74850a4e0e37",
     "hooks/definitions/loop_cap_guard.yaml": "f0fd220e028ab6fad3d8fd650602884fe500ca4899eff6e428cf217af058618d",
     "hooks/definitions/post_tool_capture.yaml": "a773cd6e18972dee8eef3b7cb06fd1d319a71de4588897cebfbe643f6781a3b2",
     "hooks/definitions/pre_compact_summary.yaml": "daa0175d79f3e0127c5ce86a7a2f8df0be3f58b5c94fe749da715a17c7b2d04e",
     "hooks/definitions/pre_tool_capture_route.yaml": "3c2663380ff3cd09f09de5b96bcf6123266fa74d8a03dfb2d6fbe40a43fb13cf",
+    "hooks/definitions/pretooluse_dispatcher.yaml": "5b0646ab17704e6f4665bb4c08ead5bcfe2aa6e71395fa5694cb0debcbce69da",
+    "hooks/definitions/pretooluse_pipeline_guard.yaml": "ac89617b91093ff0a39da0e8c48affbcaa71054666fa316a42c32f73f656ae69",
     "hooks/definitions/protected_path_write_guard.yaml": "6683d41778b823e2a4e606065597569aa04363f091e135e165de9732f1fc2171",
     "hooks/definitions/session_start.yaml": "9383fcf1f8304c87e57726478a461706c0fc73dc62bcc4d8661f2eeffa43a82d",
     "hooks/definitions/stop_handoff_harvest.yaml": "67a3c0a8bb7cb66b88e77dc79e748082e964d278c47935662c453922a846482b",
-    "hooks/hooks.json": "f255345793951b5cf6f6d8c9a8b6a6ad2d3140023453410127a6f70d8e110c26"
+    "hooks/definitions/stop_pipeline_gate.yaml": "f27dde7605809aae56ac566b93b8692f5d40db1e11b569010e32d2878b677fcf",
+    "hooks/hooks.json": "65e022a151aa9546a6988581ee62ec853f0df5580aeed4b164e3ccc3dc2e72de"
   }
 }

package/exports/hosts/gemini/host-package.json

@@ -32,9 +32,12 @@
     "hooks/definitions/post_tool_capture.yaml",
     "hooks/definitions/pre_compact_summary.yaml",
     "hooks/definitions/pre_tool_capture_route.yaml",
+    "hooks/definitions/pretooluse_dispatcher.yaml",
+    "hooks/definitions/pretooluse_pipeline_guard.yaml",
     "hooks/definitions/protected_path_write_guard.yaml",
     "hooks/definitions/session_start.yaml",
     "hooks/definitions/stop_handoff_harvest.yaml",
+    "hooks/definitions/stop_pipeline_gate.yaml",
     "hooks/hooks.json"
   ],
   "files": [

package/hooks/definitions/pretooluse_dispatcher.yaml

@@ -0,0 +1,26 @@
+id: pretooluse_dispatcher
+trigger: pretooluse_dispatcher
+description: Consolidated PreToolUse dispatcher. Evaluates protected paths, phase restrictions, and context-mode routing in a single hook. Replaces protected_path_write_guard, pretooluse_pipeline_guard, and context_mode_router.
+input_contract:
+  required:
+    - tool
+  optional:
+    - input
+allowed_side_effects:
+  - read_pipeline_state
+  - read_manifest
+  - read_routing_matrix
+  - append_routing_log
+output_contract:
+  produces:
+    - decision (allow|deny)
+    - reason
+    - routing_decision
+failure_behavior:
+  mode: block
+  exit_code: 1
+host_fallback:
+  claude: native_hook
+  codex: wrapper_command
+  gemini: wrapper_command
+  cursor: native_or_wrapper

package/hooks/definitions/pretooluse_pipeline_guard.yaml

@@ -0,0 +1,22 @@
+id: pretooluse_pipeline_guard
+trigger: pretooluse_pipeline_guard
+description: Enforces phase-specific tool restrictions by reading pipeline-state.json. Blocks Write/Edit in read-only phases and git mutations outside execute phase.
+input_contract:
+  required:
+    - tool
+  optional:
+    - input
+allowed_side_effects:
+  - read_pipeline_state
+output_contract:
+  produces:
+    - decision (allow|deny)
+    - reason
+failure_behavior:
+  mode: block
+  exit_code: 1
+host_fallback:
+  claude: native_hook
+  codex: wrapper_command
+  gemini: wrapper_command
+  cursor: native_or_wrapper

package/hooks/definitions/stop_pipeline_gate.yaml

@@ -0,0 +1,22 @@
+id: stop_pipeline_gate
+trigger: stop_pipeline_gate
+description: Blocks conversation completion when the pipeline has incomplete phases. Reads pipeline-state.json and returns block/allow decision.
+input_contract:
+  required: []
+  optional:
+    - stop_reason
+allowed_side_effects:
+  - read_pipeline_state
+  - write_stop_hook_active_flag
+output_contract:
+  produces:
+    - decision (allow|block)
+    - reason
+failure_behavior:
+  mode: block
+  exit_code: 1
+host_fallback:
+  claude: native_hook
+  codex: wrapper_command
+  gemini: wrapper_command
+  cursor: native_or_wrapper

package/hooks/hooks.json

@@ -1,21 +1,22 @@
 {
   "hooks": {
-    "PreToolUse": [
+    "Stop": [
       {
-        "matcher": "Write|Edit",
         "hooks": [
           {
             "type": "command",
-            "command": "./hooks/protected-path-write-guard"
+            "command": "./hooks/stop-pipeline-gate"
           }
         ]
-      },
+      }
+    ],
+    "PreToolUse": [
       {
-        "matcher": "Bash",
+        "matcher": "Write|Edit|Bash",
         "hooks": [
           {
             "type": "command",
-            "command": "./hooks/context-mode-router"
+            "command": "./hooks/pretooluse-dispatcher"
           }
         ]
       }

package/hooks/pretooluse-dispatcher

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+
+import { dirname, join, resolve } from 'node:path';
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { appendFileSync, mkdirSync } from 'node:fs';
+
+import { evaluateDispatch } from '../tooling/src/hooks/pretooluse-dispatcher.js';
+
+const hooksDir = dirname(fileURLToPath(import.meta.url));
+const projectRoot = dirname(hooksDir);
+
+// ---------------------------------------------------------------------------
+// Derive state root from manifest (same logic as context-mode-router)
+// ---------------------------------------------------------------------------
+
+function deriveStateRoot() {
+  if (process.env.WAZIR_STATE_ROOT) return process.env.WAZIR_STATE_ROOT;
+  try {
+    const manifestPath = join(projectRoot, 'wazir.manifest.yaml');
+    const raw = readFileSync(manifestPath, 'utf8');
+    const nameMatch = raw.match(/^\s+name:\s*(.+)$/m);
+    const templateMatch = raw.match(/state_root_default:\s*(.+)$/m);
+    if (nameMatch && templateMatch) {
+      const slug = nameMatch[1].trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'wazir-project';
+      const template = templateMatch[1].trim();
+      const expanded = template.startsWith('~/') ? join(homedir(), template.slice(2)) : template;
+      return resolve(expanded.replace('{project_slug}', slug));
+    }
+  } catch { /* fall through */ }
+  return join(homedir(), '.wazir', 'projects', '_default');
+}
+
+// ---------------------------------------------------------------------------
+// Logging (preserves context-mode routing log)
+// ---------------------------------------------------------------------------
+
+function logDecision(stateRoot, decision) {
+  const logDir = join(stateRoot, 'logs');
+  try {
+    if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+    const entry = JSON.stringify({
+      ts: new Date().toISOString(),
+      hook: 'pretooluse_dispatcher',
+      ...decision,
+    });
+    appendFileSync(join(logDir, 'routing.ndjson'), entry + '\n');
+  } catch {
+    // Logging is best-effort
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+try {
+  const stdin = readFileSync(0, 'utf8');
+  const hookInput = stdin.trim() ? JSON.parse(stdin) : {};
+
+  const stateRoot = deriveStateRoot();
+  const result = evaluateDispatch(stateRoot, projectRoot, hookInput);
+
+  logDecision(stateRoot, {
+    tool: hookInput.tool,
+    decision: result.decision,
+    reason: result.reason,
+    routing: result.routing_decision,
+  });
+
+  process.stdout.write(JSON.stringify(result) + '\n');
+
+  // Exit non-zero when context-mode routing is active (preserves old
+  // context-mode-router behavior where exit 1 = route to context-mode)
+  if (result.routing_decision?.route === 'context-mode') {
+    process.exit(1);
+  }
+  process.exit(0);
+} catch (error) {
+  process.stderr.write(`[pretooluse-dispatcher] ${error.message}\n`);
+  process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny' }, systemMessage: `[pretooluse-dispatcher] Hook error: ${error.message}. Blocking to be safe.` }) + '\n');
+  process.exit(2); // fail-closed on errors
+}

package/hooks/pretooluse-pipeline-guard

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# PreToolUse hook: enforces phase-specific tool restrictions.
+# Reads pipeline-state.json for current phase, blocks disallowed tools.
+set -euo pipefail
+
+STATE_ROOT="${WAZIR_STATE_ROOT:-$HOME/.wazir/projects/wazir}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+node "$SCRIPT_DIR/../tooling/src/hooks/pretooluse-pipeline-guard.js" "$STATE_ROOT"

package/hooks/stop-pipeline-gate

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Stop hook: blocks conversation completion when pipeline is incomplete.
+# Reads pipeline-state.json to determine if all phases are done.
+set -euo pipefail
+
+STATE_ROOT="${WAZIR_STATE_ROOT:-$HOME/.wazir/projects/wazir}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+node "$SCRIPT_DIR/../tooling/src/hooks/stop-pipeline-gate.js" "$STATE_ROOT"