@webpieces/ai-hook-rules 0.3.201 → 0.3.203

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/ai-hook-rules",
-  "version": "0.3.201",
+  "version": "0.3.203",
   "description": "Pluggable write-time validation framework for AI coding agents (@webpieces/ai-hook-rules). Claude Code PreToolUse + openclaw before_tool_call adapters share one rule engine.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -35,7 +35,7 @@
     "directory": "packages/tooling/ai-hook-rules"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.3.201"
+    "@webpieces/rules-config": "0.3.203"
   },
   "publishConfig": {
     "access": "public"

package/src/core/load-rules.js

@@ -19,13 +19,12 @@ const require_return_type_1 = require("./rules/require-return-type");
 const no_unmanaged_exceptions_1 = require("./rules/no-unmanaged-exceptions");
 const catch_error_pattern_1 = require("./rules/catch-error-pattern");
 const throw_cause_required_1 = require("./rules/throw-cause-required");
-const no_shell_substitution_1 = require("./rules/no-shell-substitution");
 const no_symbol_di_tokens_1 = require("./rules/no-symbol-di-tokens");
 const branch_creation_guard_1 = require("./rules/branch-creation-guard");
 const pr_creation_guard_1 = require("./rules/pr-creation-guard");
 const merge_in_progress_guard_1 = require("./rules/merge-in-progress-guard");
 const pr_merge_cleanup_1 = require("./rules/pr-merge-cleanup");
-const no_direct_main_update_1 = require("./rules/no-direct-main-update");
+const redirect_how_to_merge_main_1 = require("./rules/redirect-how-to-merge-main");
 const no_js_files_1 = require("./rules/no-js-files");
 const feature_branch_guard_1 = require("./rules/feature-branch-guard");
 const REQUIRED_FIELDS = ['name', 'description', 'scope', 'files', 'check'];
@@ -40,13 +39,12 @@ const BUILT_IN_RULE_MAP = {
     'no-unmanaged-exceptions': (c) => new no_unmanaged_exceptions_1.NoUnmanagedExceptionsRule(c),
     'catch-error-pattern': (c) => new catch_error_pattern_1.CatchErrorPatternRule(c),
     'throw-cause-required': (c) => new throw_cause_required_1.ThrowCauseRequiredRule(c),
-    'no-shell-substitution': (c) => new no_shell_substitution_1.NoShellSubstitutionRule(c),
     'no-symbol-di-tokens': (c) => new no_symbol_di_tokens_1.NoSymbolDiTokensRule(c),
     'branch-creation-guard': (c) => new branch_creation_guard_1.BranchCreationGuardRule(c),
     'pr-creation-guard': (c) => new pr_creation_guard_1.PrCreationGuardRule(c),
     'merge-in-progress-guard': (c) => new merge_in_progress_guard_1.MergeInProgressGuardRule(c),
     'pr-merge-cleanup': (c) => new pr_merge_cleanup_1.PrMergeCleanupRule(c),
-    'no-direct-main-update': (c) => new no_direct_main_update_1.NoDirectMainUpdateRule(c),
+    'redirect-how-to-merge-main': (c) => new redirect_how_to_merge_main_1.RedirectHowToMergeMainRule(c),
     'no-js-files': (c) => new no_js_files_1.NoJsFilesRule(c),
     'feature-branch-guard': (c) => new feature_branch_guard_1.FeatureBranchGuardRule(c),
 };

package/src/core/load-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-rules.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/load-rules.ts"],"names":[],"mappings":";;AA0EA,8BAIC;AA2FD,kCAGC;;AA5KD,+CAAyB;AACzB,mDAA6B;AAa7B,mCAAwC;AACxC,yCAAqC;AACrC,2CAA8C;AAC9C,+DAA0D;AAC1D,yCAAiD;AACjD,2DAA0D;AAC1D,6DAA4D;AAC5D,2DAA0D;AAC1D,mEAAiE;AACjE,2DAA2D;AAC3D,qEAAoE;AACpE,6EAA4E;AAC5E,qEAAoE;AACpE,uEAAsE;AACtE,yEAAwE;AACxE,qEAAmE;AACnE,yEAAwE;AACxE,iEAAgE;AAChE,6EAA2E;AAC3E,+DAA8D;AAC9D,yEAAuE;AACvE,qDAAoD;AACpD,uEAAsE;AAEtE,MAAM,eAAe,GAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAOvD,MAAM,iBAAiB,GAAgC;IACnD,gBAAgB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,iCAAgB,CAAC,CAAuB,CAAC;IACtF,iBAAiB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,mCAAiB,CAAC,CAAwB,CAAC;IACzF,gBAAgB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,iCAAgB,CAAC,CAAuB,CAAC;IACtF,oBAAoB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,wCAAmB,CAAC,CAA0B,CAAC;IAChG,gBAAgB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,kCAAiB,CAAC,CAAwB,CAAC;IACxF,qBAAqB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,2CAAqB,CAAC,CAA4B,CAAC;IACrG,yBAAyB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,mDAAyB,CAAC,CAAgC,CAAC;IACjH,qBAAqB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,2CAAqB,CAAC,CAA4B,CAAC;IACrG,sBAAsB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,6CAAsB,CAAC,CAA6B,CAAC;IACxG,uBAAuB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,+CAAuB,CAAC,CAA8B,CAAC;IAC3G,qBAAqB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,0CAAoB,CAAC,CAA2B,CAAC;IACnG,uBAAuB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,+CAAuB,CAAC,CAA8B,CAAC;IAC3G,mBAAmB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,uCAAmB,CAAC,CAA0B,CAAC;IAC/F,yBAAyB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,kDAAwB,CAAC,CAA+B,CAAC;IAC/G,kBAAkB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,qCAAkB,CAAC,CAAyB,CAAC;IAC5F,uBAAuB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,8CAAsB,CAAC,CAA6B,CAAC;IACzG,aAAa,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,2BAAa,CAAC,CAAoB,CAAC;IAC7E,sBAAsB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,6CAAsB,CAAC,CAA6B,CAAC;CAC3G,CAAC;AAEF,6FAA6F;AAC7F,qFAAqF;AACrF,SAAS,WAAW,CAAC,MAA4B;IAC7C,kFAAkF;IAClF,OAAO,MAA+D,CAAC;AAC3E,CAAC;AAED,SAAgB,SAAS,CAAC,MAA4B,EAAE,aAAqB;IACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,wBAAgB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACpE,SAAS;QACb,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,2BAAe,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAA4B,EAAE,aAAqB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACnC,yFAAyF;IACzF,MAAM,GAAG,GAAG,MAA4D,CAAC;IACzE,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,IAAI,uCAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAA4B,EAAE,aAAqB;IAC7E,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,MAAM,IAAI,CAAC,CAAC;YACnE,SAAS;QACb,CAAC;QACD,IAAI,OAAiB,CAAC;QACtB,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,qBAAa,CAAC,uCAAuC,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,8DAA8D;YAC9D,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;gBACrC,IAAI,YAAY,CAAC,SAAS,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,IAAI,qBAAa,CAAC,4BAA4B,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,IAAa;IAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,gFAAgF;IAChF,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,6BAA6B,KAAK,IAAI,CAAC,CAAC;YACrF,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;QACtG,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAgB,WAAW,CAAC,OAAe,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,EAAE,IAAI,IAAI,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACb,CAAC;YACD,EAAE,IAAI,OAAO,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACb,EAAE,IAAI,MAAM,CAAC;YACb,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,EAAE,IAAI,EAAE,CAAC;QACT,CAAC,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport {\n    BaseRuleConfig, RuleOptions, WebpiecesRulesConfig,\n    NoAnyUnknownConfig, NoImplicitAnyConfig, MaxFileLinesConfig, ValidateTsInSrcConfig,\n    NoDestructureConfig, RequireReturnTypeConfig, NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig, ThrowCauseRequiredConfig, NoShellSubstitutionConfig,\n    NoSymbolDiTokensConfig, BranchCreationGuardConfig, PrCreationGuardConfig,\n    MergeInProgressGuardConfig, PrMergeCleanupConfig, NoDirectMainUpdateConfig,\n    NoJsFilesConfig, FeatureBranchGuardConfig,\n} from '@webpieces/rules-config';\n\nimport type { Rule, PlainRule } from './types';\nimport { InformAiError } from './types';\nimport { toError } from './to-error';\nimport { EmptyRuleConfig } from './rule-base';\nimport { CustomRuleAdapter } from './custom-rule-adapter';\nimport { builtInRuleNames } from './rules/index';\nimport { NoAnyUnknownRule } from './rules/no-any-unknown';\nimport { NoImplicitAnyRule } from './rules/no-implicit-any';\nimport { MaxFileLinesRule } from './rules/max-file-lines';\nimport { ValidateTsInSrcRule } from './rules/validate-ts-in-src';\nimport { NoDestructureRule } from './rules/no-destructure';\nimport { RequireReturnTypeRule } from './rules/require-return-type';\nimport { NoUnmanagedExceptionsRule } from './rules/no-unmanaged-exceptions';\nimport { CatchErrorPatternRule } from './rules/catch-error-pattern';\nimport { ThrowCauseRequiredRule } from './rules/throw-cause-required';\nimport { NoShellSubstitutionRule } from './rules/no-shell-substitution';\nimport { NoSymbolDiTokensRule } from './rules/no-symbol-di-tokens';\nimport { BranchCreationGuardRule } from './rules/branch-creation-guard';\nimport { PrCreationGuardRule } from './rules/pr-creation-guard';\nimport { MergeInProgressGuardRule } from './rules/merge-in-progress-guard';\nimport { PrMergeCleanupRule } from './rules/pr-merge-cleanup';\nimport { NoDirectMainUpdateRule } from './rules/no-direct-main-update';\nimport { NoJsFilesRule } from './rules/no-js-files';\nimport { FeatureBranchGuardRule } from './rules/feature-branch-guard';\n\nconst REQUIRED_FIELDS: readonly string[] = ['name', 'description', 'scope', 'files', 'check'];\nconst VALID_SCOPES = new Set(['edit', 'file', 'bash']);\n\n// Each built-in rule is constructed from its typed *Config (the entry in webpieces.config.json).\n// The config arrives as a plain object structurally typed as the *Config class, so the `as`\n// narrows the shared BaseRuleConfig param back to the concrete config the rule consumes.\ntype RuleFactory = (config: BaseRuleConfig) => Rule;\n\nconst BUILT_IN_RULE_MAP: Record<string, RuleFactory> = {\n    'no-any-unknown': (c: BaseRuleConfig) => new NoAnyUnknownRule(c as NoAnyUnknownConfig),\n    'no-implicit-any': (c: BaseRuleConfig) => new NoImplicitAnyRule(c as NoImplicitAnyConfig),\n    'max-file-lines': (c: BaseRuleConfig) => new MaxFileLinesRule(c as MaxFileLinesConfig),\n    'validate-ts-in-src': (c: BaseRuleConfig) => new ValidateTsInSrcRule(c as ValidateTsInSrcConfig),\n    'no-destructure': (c: BaseRuleConfig) => new NoDestructureRule(c as NoDestructureConfig),\n    'require-return-type': (c: BaseRuleConfig) => new RequireReturnTypeRule(c as RequireReturnTypeConfig),\n    'no-unmanaged-exceptions': (c: BaseRuleConfig) => new NoUnmanagedExceptionsRule(c as NoUnmanagedExceptionsConfig),\n    'catch-error-pattern': (c: BaseRuleConfig) => new CatchErrorPatternRule(c as CatchErrorPatternConfig),\n    'throw-cause-required': (c: BaseRuleConfig) => new ThrowCauseRequiredRule(c as ThrowCauseRequiredConfig),\n    'no-shell-substitution': (c: BaseRuleConfig) => new NoShellSubstitutionRule(c as NoShellSubstitutionConfig),\n    'no-symbol-di-tokens': (c: BaseRuleConfig) => new NoSymbolDiTokensRule(c as NoSymbolDiTokensConfig),\n    'branch-creation-guard': (c: BaseRuleConfig) => new BranchCreationGuardRule(c as BranchCreationGuardConfig),\n    'pr-creation-guard': (c: BaseRuleConfig) => new PrCreationGuardRule(c as PrCreationGuardConfig),\n    'merge-in-progress-guard': (c: BaseRuleConfig) => new MergeInProgressGuardRule(c as MergeInProgressGuardConfig),\n    'pr-merge-cleanup': (c: BaseRuleConfig) => new PrMergeCleanupRule(c as PrMergeCleanupConfig),\n    'no-direct-main-update': (c: BaseRuleConfig) => new NoDirectMainUpdateRule(c as NoDirectMainUpdateConfig),\n    'no-js-files': (c: BaseRuleConfig) => new NoJsFilesRule(c as NoJsFilesConfig),\n    'feature-branch-guard': (c: BaseRuleConfig) => new FeatureBranchGuardRule(c as FeatureBranchGuardConfig),\n};\n\n// Index the typed config by rule name. Each value is the rule's *Config (a plain object from\n// JSON), or undefined when the rule has no entry yet (the sync check reports those).\nfunction asConfigMap(config: WebpiecesRulesConfig): Record<string, BaseRuleConfig | undefined> {\n    // webpieces-disable no-any-unknown -- index the typed config by dynamic rule name\n    return config as unknown as Record<string, BaseRuleConfig | undefined>;\n}\n\nexport function loadRules(config: WebpiecesRulesConfig, workspaceRoot: string): readonly Rule[] {\n    const builtIns = loadBuiltInRules(config);\n    const custom = loadCustomRules(config, workspaceRoot);\n    return [...builtIns, ...custom];\n}\n\nfunction loadBuiltInRules(config: WebpiecesRulesConfig): Rule[] {\n    const map = asConfigMap(config);\n    const rules: Rule[] = [];\n    for (const name of builtInRuleNames) {\n        const factory = BUILT_IN_RULE_MAP[name];\n        if (!factory) {\n            process.stderr.write(`[ai-hooks] unknown built-in rule: ${name}\\n`);\n            continue;\n        }\n        const ruleConfig = map[name] ?? new EmptyRuleConfig();\n        rules.push(factory(ruleConfig));\n    }\n    return rules;\n}\n\nfunction loadCustomRules(config: WebpiecesRulesConfig, workspaceRoot: string): Rule[] {\n    const dirs = config.rulesDir ?? [];\n    // webpieces-disable no-any-unknown -- index the typed config by dynamic custom-rule name\n    const map = config as unknown as Record<string, RuleOptions | undefined>;\n    const rules: Rule[] = [];\n    for (const plain of loadCustomPlainRules(dirs, workspaceRoot)) {\n        const rawConfig = map[plain.name] ?? {};\n        rules.push(new CustomRuleAdapter(plain, rawConfig));\n    }\n    return rules;\n}\n\nfunction loadCustomPlainRules(rulesDirs: readonly string[], workspaceRoot: string): PlainRule[] {\n    const modules: PlainRule[] = [];\n    for (const dir of rulesDirs) {\n        const absDir = path.isAbsolute(dir) ? dir : path.join(workspaceRoot, dir);\n        if (!fs.existsSync(absDir)) {\n            process.stderr.write(`[ai-hooks] rulesDir not found: ${absDir}\\n`);\n            continue;\n        }\n        let entries: string[];\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            entries = fs.readdirSync(absDir).filter((e: string) => e.endsWith('.js'));\n        } catch (err: unknown) {\n            const error = toError(err);\n            throw new InformAiError(`Cannot read custom rules directory '${absDir}'`, { cause: error });\n        }\n        for (const entry of entries) {\n            const full = path.join(absDir, entry);\n            // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n            try {\n                const mod = require(full);\n                const candidate = mod.default || mod;\n                if (validateRule(candidate)) modules.push(candidate);\n            } catch (err: unknown) {\n                const error = toError(err);\n                throw new InformAiError(`Cannot load custom rule '${full}'`, { cause: error });\n            }\n        }\n    }\n    return modules;\n}\n\n// webpieces-disable no-any-unknown -- validates untrusted require() output at system boundary\nfunction validateRule(rule: unknown): rule is PlainRule {\n    if (!rule || typeof rule !== 'object') {\n        process.stderr.write('[ai-hooks] rule is not an object, skipping\\n');\n        return false;\n    }\n    // webpieces-disable no-any-unknown -- narrowing from unknown at system boundary\n    const obj = rule as Record<string, unknown>;\n    for (const field of REQUIRED_FIELDS) {\n        if (obj[field] === undefined) {\n            const name = typeof obj['name'] === 'string' ? obj['name'] : '<unnamed>';\n            process.stderr.write(`[ai-hooks] rule \"${name}\" missing required field: ${field}\\n`);\n            return false;\n        }\n    }\n    if (!VALID_SCOPES.has(obj['scope'] as string)) {\n        process.stderr.write(`[ai-hooks] rule \"${obj['name']}\" has invalid scope: ${String(obj['scope'])}\\n`);\n        return false;\n    }\n    if (!Array.isArray(obj['files'])) {\n        process.stderr.write(`[ai-hooks] rule \"${obj['name']}\" files must be an array\\n`);\n        return false;\n    }\n    if (typeof obj['check'] !== 'function') {\n        process.stderr.write(`[ai-hooks] rule \"${obj['name']}\" check must be a function\\n`);\n        return false;\n    }\n    return true;\n}\n\nexport function globMatches(pattern: string, filePath: string): boolean {\n    const regex = globToRegex(pattern);\n    return regex.test(filePath);\n}\n\nfunction globToRegex(pattern: string): RegExp {\n    let re = '';\n    let i = 0;\n    while (i < pattern.length) {\n        const ch = pattern[i];\n        if (ch === '*') {\n            if (pattern[i + 1] === '*') {\n                re += '.*';\n                i += 2;\n                if (pattern[i] === '/') i += 1;\n                continue;\n            }\n            re += '[^/]*';\n            i += 1;\n            continue;\n        }\n        if (ch === '?') {\n            re += '[^/]';\n            i += 1;\n            continue;\n        }\n        if ('.+^$(){}|[]\\\\'.includes(ch)) {\n            re += '\\\\' + ch;\n            i += 1;\n            continue;\n        }\n        re += ch;\n        i += 1;\n    }\n    return new RegExp('^' + re + '$');\n}\n"]}
+{"version":3,"file":"load-rules.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/load-rules.ts"],"names":[],"mappings":";;AAwEA,8BAIC;AA2FD,kCAGC;;AA1KD,+CAAyB;AACzB,mDAA6B;AAa7B,mCAAwC;AACxC,yCAAqC;AACrC,2CAA8C;AAC9C,+DAA0D;AAC1D,yCAAiD;AACjD,2DAA0D;AAC1D,6DAA4D;AAC5D,2DAA0D;AAC1D,mEAAiE;AACjE,2DAA2D;AAC3D,qEAAoE;AACpE,6EAA4E;AAC5E,qEAAoE;AACpE,uEAAsE;AACtE,qEAAmE;AACnE,yEAAwE;AACxE,iEAAgE;AAChE,6EAA2E;AAC3E,+DAA8D;AAC9D,mFAAgF;AAChF,qDAAoD;AACpD,uEAAsE;AAEtE,MAAM,eAAe,GAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAOvD,MAAM,iBAAiB,GAAgC;IACnD,gBAAgB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,iCAAgB,CAAC,CAAuB,CAAC;IACtF,iBAAiB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,mCAAiB,CAAC,CAAwB,CAAC;IACzF,gBAAgB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,iCAAgB,CAAC,CAAuB,CAAC;IACtF,oBAAoB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,wCAAmB,CAAC,CAA0B,CAAC;IAChG,gBAAgB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,kCAAiB,CAAC,CAAwB,CAAC;IACxF,qBAAqB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,2CAAqB,CAAC,CAA4B,CAAC;IACrG,yBAAyB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,mDAAyB,CAAC,CAAgC,CAAC;IACjH,qBAAqB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,2CAAqB,CAAC,CAA4B,CAAC;IACrG,sBAAsB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,6CAAsB,CAAC,CAA6B,CAAC;IACxG,qBAAqB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,0CAAoB,CAAC,CAA2B,CAAC;IACnG,uBAAuB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,+CAAuB,CAAC,CAA8B,CAAC;IAC3G,mBAAmB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,uCAAmB,CAAC,CAA0B,CAAC;IAC/F,yBAAyB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,kDAAwB,CAAC,CAA+B,CAAC;IAC/G,kBAAkB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,qCAAkB,CAAC,CAAyB,CAAC;IAC5F,4BAA4B,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,uDAA0B,CAAC,CAAiC,CAAC;IACtH,aAAa,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,2BAAa,CAAC,CAAoB,CAAC;IAC7E,sBAAsB,EAAE,CAAC,CAAiB,EAAE,EAAE,CAAC,IAAI,6CAAsB,CAAC,CAA6B,CAAC;CAC3G,CAAC;AAEF,6FAA6F;AAC7F,qFAAqF;AACrF,SAAS,WAAW,CAAC,MAA4B;IAC7C,kFAAkF;IAClF,OAAO,MAA+D,CAAC;AAC3E,CAAC;AAED,SAAgB,SAAS,CAAC,MAA4B,EAAE,aAAqB;IACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,wBAAgB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACpE,SAAS;QACb,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,2BAAe,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAA4B,EAAE,aAAqB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACnC,yFAAyF;IACzF,MAAM,GAAG,GAAG,MAA4D,CAAC;IACzE,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,IAAI,uCAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,SAA4B,EAAE,aAAqB;IAC7E,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,MAAM,IAAI,CAAC,CAAC;YACnE,SAAS;QACb,CAAC;QACD,IAAI,OAAiB,CAAC;QACtB,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,qBAAa,CAAC,uCAAuC,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,8DAA8D;YAC9D,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;gBACrC,IAAI,YAAY,CAAC,SAAS,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;gBAC3B,MAAM,IAAI,qBAAa,CAAC,4BAA4B,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,IAAa;IAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,gFAAgF;IAChF,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,6BAA6B,KAAK,IAAI,CAAC,CAAC;YACrF,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;QACtG,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAgB,WAAW,CAAC,OAAe,EAAE,QAAgB;IACzD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,EAAE,IAAI,IAAI,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACb,CAAC;YACD,EAAE,IAAI,OAAO,CAAC;YACd,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACb,EAAE,IAAI,MAAM,CAAC;YACb,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,EAAE,IAAI,EAAE,CAAC;QACT,CAAC,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport {\n    BaseRuleConfig, RuleOptions, WebpiecesRulesConfig,\n    NoAnyUnknownConfig, NoImplicitAnyConfig, MaxFileLinesConfig, ValidateTsInSrcConfig,\n    NoDestructureConfig, RequireReturnTypeConfig, NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig, ThrowCauseRequiredConfig,\n    NoSymbolDiTokensConfig, BranchCreationGuardConfig, PrCreationGuardConfig,\n    MergeInProgressGuardConfig, PrMergeCleanupConfig, RedirectHowToMergeMainConfig,\n    NoJsFilesConfig, FeatureBranchGuardConfig,\n} from '@webpieces/rules-config';\n\nimport type { Rule, PlainRule } from './types';\nimport { InformAiError } from './types';\nimport { toError } from './to-error';\nimport { EmptyRuleConfig } from './rule-base';\nimport { CustomRuleAdapter } from './custom-rule-adapter';\nimport { builtInRuleNames } from './rules/index';\nimport { NoAnyUnknownRule } from './rules/no-any-unknown';\nimport { NoImplicitAnyRule } from './rules/no-implicit-any';\nimport { MaxFileLinesRule } from './rules/max-file-lines';\nimport { ValidateTsInSrcRule } from './rules/validate-ts-in-src';\nimport { NoDestructureRule } from './rules/no-destructure';\nimport { RequireReturnTypeRule } from './rules/require-return-type';\nimport { NoUnmanagedExceptionsRule } from './rules/no-unmanaged-exceptions';\nimport { CatchErrorPatternRule } from './rules/catch-error-pattern';\nimport { ThrowCauseRequiredRule } from './rules/throw-cause-required';\nimport { NoSymbolDiTokensRule } from './rules/no-symbol-di-tokens';\nimport { BranchCreationGuardRule } from './rules/branch-creation-guard';\nimport { PrCreationGuardRule } from './rules/pr-creation-guard';\nimport { MergeInProgressGuardRule } from './rules/merge-in-progress-guard';\nimport { PrMergeCleanupRule } from './rules/pr-merge-cleanup';\nimport { RedirectHowToMergeMainRule } from './rules/redirect-how-to-merge-main';\nimport { NoJsFilesRule } from './rules/no-js-files';\nimport { FeatureBranchGuardRule } from './rules/feature-branch-guard';\n\nconst REQUIRED_FIELDS: readonly string[] = ['name', 'description', 'scope', 'files', 'check'];\nconst VALID_SCOPES = new Set(['edit', 'file', 'bash']);\n\n// Each built-in rule is constructed from its typed *Config (the entry in webpieces.config.json).\n// The config arrives as a plain object structurally typed as the *Config class, so the `as`\n// narrows the shared BaseRuleConfig param back to the concrete config the rule consumes.\ntype RuleFactory = (config: BaseRuleConfig) => Rule;\n\nconst BUILT_IN_RULE_MAP: Record<string, RuleFactory> = {\n    'no-any-unknown': (c: BaseRuleConfig) => new NoAnyUnknownRule(c as NoAnyUnknownConfig),\n    'no-implicit-any': (c: BaseRuleConfig) => new NoImplicitAnyRule(c as NoImplicitAnyConfig),\n    'max-file-lines': (c: BaseRuleConfig) => new MaxFileLinesRule(c as MaxFileLinesConfig),\n    'validate-ts-in-src': (c: BaseRuleConfig) => new ValidateTsInSrcRule(c as ValidateTsInSrcConfig),\n    'no-destructure': (c: BaseRuleConfig) => new NoDestructureRule(c as NoDestructureConfig),\n    'require-return-type': (c: BaseRuleConfig) => new RequireReturnTypeRule(c as RequireReturnTypeConfig),\n    'no-unmanaged-exceptions': (c: BaseRuleConfig) => new NoUnmanagedExceptionsRule(c as NoUnmanagedExceptionsConfig),\n    'catch-error-pattern': (c: BaseRuleConfig) => new CatchErrorPatternRule(c as CatchErrorPatternConfig),\n    'throw-cause-required': (c: BaseRuleConfig) => new ThrowCauseRequiredRule(c as ThrowCauseRequiredConfig),\n    'no-symbol-di-tokens': (c: BaseRuleConfig) => new NoSymbolDiTokensRule(c as NoSymbolDiTokensConfig),\n    'branch-creation-guard': (c: BaseRuleConfig) => new BranchCreationGuardRule(c as BranchCreationGuardConfig),\n    'pr-creation-guard': (c: BaseRuleConfig) => new PrCreationGuardRule(c as PrCreationGuardConfig),\n    'merge-in-progress-guard': (c: BaseRuleConfig) => new MergeInProgressGuardRule(c as MergeInProgressGuardConfig),\n    'pr-merge-cleanup': (c: BaseRuleConfig) => new PrMergeCleanupRule(c as PrMergeCleanupConfig),\n    'redirect-how-to-merge-main': (c: BaseRuleConfig) => new RedirectHowToMergeMainRule(c as RedirectHowToMergeMainConfig),\n    'no-js-files': (c: BaseRuleConfig) => new NoJsFilesRule(c as NoJsFilesConfig),\n    'feature-branch-guard': (c: BaseRuleConfig) => new FeatureBranchGuardRule(c as FeatureBranchGuardConfig),\n};\n\n// Index the typed config by rule name. Each value is the rule's *Config (a plain object from\n// JSON), or undefined when the rule has no entry yet (the sync check reports those).\nfunction asConfigMap(config: WebpiecesRulesConfig): Record<string, BaseRuleConfig | undefined> {\n    // webpieces-disable no-any-unknown -- index the typed config by dynamic rule name\n    return config as unknown as Record<string, BaseRuleConfig | undefined>;\n}\n\nexport function loadRules(config: WebpiecesRulesConfig, workspaceRoot: string): readonly Rule[] {\n    const builtIns = loadBuiltInRules(config);\n    const custom = loadCustomRules(config, workspaceRoot);\n    return [...builtIns, ...custom];\n}\n\nfunction loadBuiltInRules(config: WebpiecesRulesConfig): Rule[] {\n    const map = asConfigMap(config);\n    const rules: Rule[] = [];\n    for (const name of builtInRuleNames) {\n        const factory = BUILT_IN_RULE_MAP[name];\n        if (!factory) {\n            process.stderr.write(`[ai-hooks] unknown built-in rule: ${name}\\n`);\n            continue;\n        }\n        const ruleConfig = map[name] ?? new EmptyRuleConfig();\n        rules.push(factory(ruleConfig));\n    }\n    return rules;\n}\n\nfunction loadCustomRules(config: WebpiecesRulesConfig, workspaceRoot: string): Rule[] {\n    const dirs = config.rulesDir ?? [];\n    // webpieces-disable no-any-unknown -- index the typed config by dynamic custom-rule name\n    const map = config as unknown as Record<string, RuleOptions | undefined>;\n    const rules: Rule[] = [];\n    for (const plain of loadCustomPlainRules(dirs, workspaceRoot)) {\n        const rawConfig = map[plain.name] ?? {};\n        rules.push(new CustomRuleAdapter(plain, rawConfig));\n    }\n    return rules;\n}\n\nfunction loadCustomPlainRules(rulesDirs: readonly string[], workspaceRoot: string): PlainRule[] {\n    const modules: PlainRule[] = [];\n    for (const dir of rulesDirs) {\n        const absDir = path.isAbsolute(dir) ? dir : path.join(workspaceRoot, dir);\n        if (!fs.existsSync(absDir)) {\n            process.stderr.write(`[ai-hooks] rulesDir not found: ${absDir}\\n`);\n            continue;\n        }\n        let entries: string[];\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            entries = fs.readdirSync(absDir).filter((e: string) => e.endsWith('.js'));\n        } catch (err: unknown) {\n            const error = toError(err);\n            throw new InformAiError(`Cannot read custom rules directory '${absDir}'`, { cause: error });\n        }\n        for (const entry of entries) {\n            const full = path.join(absDir, entry);\n            // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n            try {\n                const mod = require(full);\n                const candidate = mod.default || mod;\n                if (validateRule(candidate)) modules.push(candidate);\n            } catch (err: unknown) {\n                const error = toError(err);\n                throw new InformAiError(`Cannot load custom rule '${full}'`, { cause: error });\n            }\n        }\n    }\n    return modules;\n}\n\n// webpieces-disable no-any-unknown -- validates untrusted require() output at system boundary\nfunction validateRule(rule: unknown): rule is PlainRule {\n    if (!rule || typeof rule !== 'object') {\n        process.stderr.write('[ai-hooks] rule is not an object, skipping\\n');\n        return false;\n    }\n    // webpieces-disable no-any-unknown -- narrowing from unknown at system boundary\n    const obj = rule as Record<string, unknown>;\n    for (const field of REQUIRED_FIELDS) {\n        if (obj[field] === undefined) {\n            const name = typeof obj['name'] === 'string' ? obj['name'] : '<unnamed>';\n            process.stderr.write(`[ai-hooks] rule \"${name}\" missing required field: ${field}\\n`);\n            return false;\n        }\n    }\n    if (!VALID_SCOPES.has(obj['scope'] as string)) {\n        process.stderr.write(`[ai-hooks] rule \"${obj['name']}\" has invalid scope: ${String(obj['scope'])}\\n`);\n        return false;\n    }\n    if (!Array.isArray(obj['files'])) {\n        process.stderr.write(`[ai-hooks] rule \"${obj['name']}\" files must be an array\\n`);\n        return false;\n    }\n    if (typeof obj['check'] !== 'function') {\n        process.stderr.write(`[ai-hooks] rule \"${obj['name']}\" check must be a function\\n`);\n        return false;\n    }\n    return true;\n}\n\nexport function globMatches(pattern: string, filePath: string): boolean {\n    const regex = globToRegex(pattern);\n    return regex.test(filePath);\n}\n\nfunction globToRegex(pattern: string): RegExp {\n    let re = '';\n    let i = 0;\n    while (i < pattern.length) {\n        const ch = pattern[i];\n        if (ch === '*') {\n            if (pattern[i + 1] === '*') {\n                re += '.*';\n                i += 2;\n                if (pattern[i] === '/') i += 1;\n                continue;\n            }\n            re += '[^/]*';\n            i += 1;\n            continue;\n        }\n        if (ch === '?') {\n            re += '[^/]';\n            i += 1;\n            continue;\n        }\n        if ('.+^$(){}|[]\\\\'.includes(ch)) {\n            re += '\\\\' + ch;\n            i += 1;\n            continue;\n        }\n        re += ch;\n        i += 1;\n    }\n    return new RegExp('^' + re + '$');\n}\n"]}

package/src/core/main-sync-log.d.ts

@@ -0,0 +1,15 @@
+export type SyncPhase = 'SPAWN_ATTEMPT' | 'START' | 'SKIP_INPROGRESS' | 'FINISH' | 'ERROR';
+export declare class SyncLogEvent {
+    phase: SyncPhase;
+    pid: number;
+    branchArg: string;
+    detail: string;
+    constructor(phase: SyncPhase, pid: number, branchArg: string, detail: string);
+}
+/**
+ * Append one tab-separated line per refresher event to `.webpieces/hooks/main-sync.log`. `root` is
+ * the workspace root holding `.webpieces`. Swallows all errors — logging must never block or fail
+ * the refresher (or the hook that spawns it).
+ */
+export declare function logSyncEvent(root: string, event: SyncLogEvent): void;
+export declare function syncStderrLogPath(root: string): string;

package/src/core/main-sync-log.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SyncLogEvent = void 0;
+exports.logSyncEvent = logSyncEvent;
+exports.syncStderrLogPath = syncStderrLogPath;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const to_error_1 = require("./to-error");
+// Observability for the detached background refresher (sync-main.ts). The refresher runs AFTER the
+// spawning hook has exited, with stdio discarded, so when it fails to update main-sync-status.json
+// there is normally no trace at all. This log captures its lifecycle — SPAWN_ATTEMPT (parent side),
+// then START / SKIP_INPROGRESS / FINISH / ERROR (child side) — so we can tell whether the detached
+// child never launched, was killed mid-run (START with no FINISH), or threw. Modeled on
+// decision-log.ts: same .webpieces/hooks dir, 512KB size rotation, toError-compliant catches.
+const HOOKS_DIR = '.webpieces/hooks';
+const LOG_FILE = 'main-sync.log';
+const LOG_FILE_PREV = 'main-sync.1.log';
+const STDERR_FILE = 'main-sync.stderr.log';
+const MAX_LOG_BYTES = 512 * 1024; // 512 KB — rotate when exceeded (mirrors decision-log)
+const MAX_DETAIL_LEN = 300;
+// Data-only record of one refresher lifecycle event (per CLAUDE.md: classes for data).
+class SyncLogEvent {
+    phase;
+    pid;
+    branchArg;
+    detail;
+    constructor(phase, pid, branchArg, detail) {
+        this.phase = phase;
+        this.pid = pid;
+        this.branchArg = branchArg;
+        this.detail = detail;
+    }
+}
+exports.SyncLogEvent = SyncLogEvent;
+/**
+ * Append one tab-separated line per refresher event to `.webpieces/hooks/main-sync.log`. `root` is
+ * the workspace root holding `.webpieces`. Swallows all errors — logging must never block or fail
+ * the refresher (or the hook that spawns it).
+ */
+function logSyncEvent(root, event) {
+    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+    try {
+        const timestamp = new Date().toISOString();
+        const hooksDir = path.join(root, HOOKS_DIR);
+        fs.mkdirSync(hooksDir, { recursive: true });
+        const logPath = path.join(hooksDir, LOG_FILE);
+        rotateLogFile(logPath, path.join(hooksDir, LOG_FILE_PREV));
+        const line = [
+            `[${timestamp}]`,
+            event.phase,
+            `pid=${String(event.pid)}`,
+            event.branchArg,
+            oneLine(event.detail),
+        ].join('\t') + '\n';
+        fs.appendFileSync(logPath, line);
+    }
+    catch (err) {
+        const error = (0, to_error_1.toError)(err);
+        void error;
+    }
+}
+// Absolute path the detached child's stdout/stderr are redirected to (opened with fs.openSync(p,'a')
+// by the spawner), so even a crash BEFORE our own logging runs — e.g. a module-load failure — is
+// captured instead of vanishing into /dev/null. Callers must ensure the hooks dir exists first
+// (logSyncEvent's mkdir, called for SPAWN_ATTEMPT, does that).
+function syncStderrLogPath(root) {
+    return path.join(root, HOOKS_DIR, STDERR_FILE);
+}
+// Collapse newlines/tabs and cap length so one event is always one log line.
+function oneLine(value) {
+    const flat = value.replace(/[\t\r\n]+/g, ' ').trim();
+    return flat.length <= MAX_DETAIL_LEN ? flat : flat.slice(0, MAX_DETAIL_LEN) + '…';
+}
+function rotateLogFile(logPath, prevPath) {
+    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+    try {
+        const stat = fs.statSync(logPath);
+        if (stat.size > MAX_LOG_BYTES) {
+            if (fs.existsSync(prevPath))
+                fs.unlinkSync(prevPath);
+            fs.renameSync(logPath, prevPath);
+        }
+    }
+    catch (err) {
+        const error = (0, to_error_1.toError)(err);
+        void error;
+    }
+}
+//# sourceMappingURL=main-sync-log.js.map

package/src/core/main-sync-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-sync-log.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/main-sync-log.ts"],"names":[],"mappings":";;;AAwCA,oCAsBC;AAMD,8CAEC;;AAtED,+CAAyB;AACzB,mDAA6B;AAE7B,yCAAqC;AAErC,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,wFAAwF;AACxF,8FAA8F;AAC9F,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AACjC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,uDAAuD;AACzF,MAAM,cAAc,GAAG,GAAG,CAAC;AAI3B,uFAAuF;AACvF,MAAa,YAAY;IACrB,KAAK,CAAY;IACjB,GAAG,CAAS;IACZ,SAAS,CAAS;IAClB,MAAM,CAAS;IAEf,YAAY,KAAgB,EAAE,GAAW,EAAE,SAAiB,EAAE,MAAc;QACxE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;CACJ;AAZD,oCAYC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAY,EAAE,KAAmB;IAC1D,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG;YACT,IAAI,SAAS,GAAG;YAChB,KAAK,CAAC,KAAK;YACX,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAC1B,KAAK,CAAC,SAAS;YACf,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;SACxB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACpB,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;IACf,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,iGAAiG;AACjG,+FAA+F;AAC/F,+DAA+D;AAC/D,SAAgB,iBAAiB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,KAAa;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,GAAG,GAAG,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,QAAgB;IACpD,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;IACf,CAAC;AACL,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { toError } from './to-error';\n\n// Observability for the detached background refresher (sync-main.ts). The refresher runs AFTER the\n// spawning hook has exited, with stdio discarded, so when it fails to update main-sync-status.json\n// there is normally no trace at all. This log captures its lifecycle — SPAWN_ATTEMPT (parent side),\n// then START / SKIP_INPROGRESS / FINISH / ERROR (child side) — so we can tell whether the detached\n// child never launched, was killed mid-run (START with no FINISH), or threw. Modeled on\n// decision-log.ts: same .webpieces/hooks dir, 512KB size rotation, toError-compliant catches.\nconst HOOKS_DIR = '.webpieces/hooks';\nconst LOG_FILE = 'main-sync.log';\nconst LOG_FILE_PREV = 'main-sync.1.log';\nconst STDERR_FILE = 'main-sync.stderr.log';\nconst MAX_LOG_BYTES = 512 * 1024; // 512 KB — rotate when exceeded (mirrors decision-log)\nconst MAX_DETAIL_LEN = 300;\n\nexport type SyncPhase = 'SPAWN_ATTEMPT' | 'START' | 'SKIP_INPROGRESS' | 'FINISH' | 'ERROR';\n\n// Data-only record of one refresher lifecycle event (per CLAUDE.md: classes for data).\nexport class SyncLogEvent {\n    phase: SyncPhase;\n    pid: number;\n    branchArg: string;\n    detail: string;\n\n    constructor(phase: SyncPhase, pid: number, branchArg: string, detail: string) {\n        this.phase = phase;\n        this.pid = pid;\n        this.branchArg = branchArg;\n        this.detail = detail;\n    }\n}\n\n/**\n * Append one tab-separated line per refresher event to `.webpieces/hooks/main-sync.log`. `root` is\n * the workspace root holding `.webpieces`. Swallows all errors — logging must never block or fail\n * the refresher (or the hook that spawns it).\n */\nexport function logSyncEvent(root: string, event: SyncLogEvent): void {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const timestamp = new Date().toISOString();\n        const hooksDir = path.join(root, HOOKS_DIR);\n        fs.mkdirSync(hooksDir, { recursive: true });\n\n        const logPath = path.join(hooksDir, LOG_FILE);\n        rotateLogFile(logPath, path.join(hooksDir, LOG_FILE_PREV));\n\n        const line = [\n            `[${timestamp}]`,\n            event.phase,\n            `pid=${String(event.pid)}`,\n            event.branchArg,\n            oneLine(event.detail),\n        ].join('\\t') + '\\n';\n        fs.appendFileSync(logPath, line);\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n    }\n}\n\n// Absolute path the detached child's stdout/stderr are redirected to (opened with fs.openSync(p,'a')\n// by the spawner), so even a crash BEFORE our own logging runs — e.g. a module-load failure — is\n// captured instead of vanishing into /dev/null. Callers must ensure the hooks dir exists first\n// (logSyncEvent's mkdir, called for SPAWN_ATTEMPT, does that).\nexport function syncStderrLogPath(root: string): string {\n    return path.join(root, HOOKS_DIR, STDERR_FILE);\n}\n\n// Collapse newlines/tabs and cap length so one event is always one log line.\nfunction oneLine(value: string): string {\n    const flat = value.replace(/[\\t\\r\\n]+/g, ' ').trim();\n    return flat.length <= MAX_DETAIL_LEN ? flat : flat.slice(0, MAX_DETAIL_LEN) + '…';\n}\n\nfunction rotateLogFile(logPath: string, prevPath: string): void {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const stat = fs.statSync(logPath);\n        if (stat.size > MAX_LOG_BYTES) {\n            if (fs.existsSync(prevPath)) fs.unlinkSync(prevPath);\n            fs.renameSync(logPath, prevPath);\n        }\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n    }\n}\n"]}

package/src/core/main-sync-refresh.d.ts

@@ -3,5 +3,10 @@
  * not a bin). The child outlives this hook process (`detached` + `unref`), does the slow
  * merged-PR/fetch/merge-base/overlap work, and writes the cache the feature-branch-guard reads on
  * the NEXT call. This is the first detached spawn in the codebase — every existing hook is synchronous.
+ *
+ * Observability: we log SPAWN_ATTEMPT here and the child logs START/FINISH/ERROR, all to
+ * `.webpieces/hooks/main-sync.log`. The child's stdout/stderr are redirected to a sibling file (not
+ * /dev/null) so a crash before the child's own logging is still captured. If main-sync.log shows
+ * SPAWN_ATTEMPT but never START, the detached child was killed before it ran.
  */
 export declare function triggerMainSyncRefresh(workspaceRoot: string, hangTimeoutMinutes?: number): void;

package/src/core/main-sync-refresh.js

@@ -3,24 +3,43 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.triggerMainSyncRefresh = triggerMainSyncRefresh;
 const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
 const path = tslib_1.__importStar(require("path"));
 const rules_config_1 = require("@webpieces/rules-config");
 const to_error_1 = require("./to-error");
+const main_sync_log_1 = require("./main-sync-log");
 /**
  * Fire-and-forget spawn of the detached refresher (sync-main.js in this same dir — spawned by path,
  * not a bin). The child outlives this hook process (`detached` + `unref`), does the slow
  * merged-PR/fetch/merge-base/overlap work, and writes the cache the feature-branch-guard reads on
  * the NEXT call. This is the first detached spawn in the codebase — every existing hook is synchronous.
+ *
+ * Observability: we log SPAWN_ATTEMPT here and the child logs START/FINISH/ERROR, all to
+ * `.webpieces/hooks/main-sync.log`. The child's stdout/stderr are redirected to a sibling file (not
+ * /dev/null) so a crash before the child's own logging is still captured. If main-sync.log shows
+ * SPAWN_ATTEMPT but never START, the detached child was killed before it ran.
  */
 function triggerMainSyncRefresh(workspaceRoot, hangTimeoutMinutes = rules_config_1.DEFAULT_HANG_TIMEOUT_MINUTES) {
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
     try {
         const refresher = path.join(__dirname, 'sync-main.js');
+        // SPAWN_ATTEMPT first — this also creates .webpieces/hooks so the stderr fd below can open.
+        (0, main_sync_log_1.logSyncEvent)(workspaceRoot, new main_sync_log_1.SyncLogEvent('SPAWN_ATTEMPT', process.pid, '-', `refresher=${refresher}`));
+        // Redirect the detached child's stdout+stderr to a file (not /dev/null) so an uncaught crash
+        // before the child's own logging — e.g. a module-load failure — is still captured.
+        const errFd = fs.openSync((0, main_sync_log_1.syncStderrLogPath)(workspaceRoot), 'a');
         const child = (0, child_process_1.spawn)(process.execPath, [refresher, workspaceRoot, String(hangTimeoutMinutes)], {
             detached: true,
-            stdio: 'ignore',
+            stdio: ['ignore', errFd, errFd],
+        });
+        // spawn errors (e.g. ENOENT) arrive asynchronously; record one if it fires. The hook may exit
+        // before this handler runs, but on POSIX a successful exec has already happened by now.
+        child.once('error', (err) => {
+            (0, main_sync_log_1.logSyncEvent)(workspaceRoot, new main_sync_log_1.SyncLogEvent('ERROR', child.pid ?? -1, '-', `spawn failed: ${err.message}`));
         });
         child.unref();
+        // The child has its own dup'd copy of the fd after spawn; close the parent's copy.
+        fs.closeSync(errFd);
     }
     catch (err) {
         const error = (0, to_error_1.toError)(err);

package/src/core/main-sync-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"main-sync-refresh.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/main-sync-refresh.ts"],"names":[],"mappings":";;AAaA,wDAcC;;AA3BD,iDAAsC;AACtC,mDAA6B;AAE7B,0DAAuE;AAEvE,yCAAqC;AAErC;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,aAAqB,EAAE,qBAA6B,2CAA4B;IACnH,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE;YAC1F,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;QACX,0EAA0E;IAC9E,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'child_process';\nimport * as path from 'path';\n\nimport { DEFAULT_HANG_TIMEOUT_MINUTES } from '@webpieces/rules-config';\n\nimport { toError } from './to-error';\n\n/**\n * Fire-and-forget spawn of the detached refresher (sync-main.js in this same dir — spawned by path,\n * not a bin). The child outlives this hook process (`detached` + `unref`), does the slow\n * merged-PR/fetch/merge-base/overlap work, and writes the cache the feature-branch-guard reads on\n * the NEXT call. This is the first detached spawn in the codebase — every existing hook is synchronous.\n */\nexport function triggerMainSyncRefresh(workspaceRoot: string, hangTimeoutMinutes: number = DEFAULT_HANG_TIMEOUT_MINUTES): void {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const refresher = path.join(__dirname, 'sync-main.js');\n        const child = spawn(process.execPath, [refresher, workspaceRoot, String(hangTimeoutMinutes)], {\n            detached: true,\n            stdio: 'ignore',\n        });\n        child.unref();\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n        // Spawning the background refresh must never block or fail the tool call.\n    }\n}\n"]}
+{"version":3,"file":"main-sync-refresh.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/main-sync-refresh.ts"],"names":[],"mappings":";;AAoBA,wDA2BC;;AA/CD,iDAAsC;AACtC,+CAAyB;AACzB,mDAA6B;AAE7B,0DAAuE;AAEvE,yCAAqC;AACrC,mDAAgF;AAEhF;;;;;;;;;;GAUG;AACH,SAAgB,sBAAsB,CAAC,aAAqB,EAAE,qBAA6B,2CAA4B;IACnH,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACvD,4FAA4F;QAC5F,IAAA,4BAAY,EAAC,aAAa,EAAE,IAAI,4BAAY,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;QAE3G,6FAA6F;QAC7F,mFAAmF;QACnF,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAA,iCAAiB,EAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE;YAC1F,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;SAClC,CAAC,CAAC;QACH,8FAA8F;QAC9F,wFAAwF;QACxF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAQ,EAAE;YACrC,IAAA,4BAAY,EAAC,aAAa,EAAE,IAAI,4BAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,mFAAmF;QACnF,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;QACX,0EAA0E;IAC9E,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\n\nimport { DEFAULT_HANG_TIMEOUT_MINUTES } from '@webpieces/rules-config';\n\nimport { toError } from './to-error';\nimport { logSyncEvent, SyncLogEvent, syncStderrLogPath } from './main-sync-log';\n\n/**\n * Fire-and-forget spawn of the detached refresher (sync-main.js in this same dir — spawned by path,\n * not a bin). The child outlives this hook process (`detached` + `unref`), does the slow\n * merged-PR/fetch/merge-base/overlap work, and writes the cache the feature-branch-guard reads on\n * the NEXT call. This is the first detached spawn in the codebase — every existing hook is synchronous.\n *\n * Observability: we log SPAWN_ATTEMPT here and the child logs START/FINISH/ERROR, all to\n * `.webpieces/hooks/main-sync.log`. The child's stdout/stderr are redirected to a sibling file (not\n * /dev/null) so a crash before the child's own logging is still captured. If main-sync.log shows\n * SPAWN_ATTEMPT but never START, the detached child was killed before it ran.\n */\nexport function triggerMainSyncRefresh(workspaceRoot: string, hangTimeoutMinutes: number = DEFAULT_HANG_TIMEOUT_MINUTES): void {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const refresher = path.join(__dirname, 'sync-main.js');\n        // SPAWN_ATTEMPT first — this also creates .webpieces/hooks so the stderr fd below can open.\n        logSyncEvent(workspaceRoot, new SyncLogEvent('SPAWN_ATTEMPT', process.pid, '-', `refresher=${refresher}`));\n\n        // Redirect the detached child's stdout+stderr to a file (not /dev/null) so an uncaught crash\n        // before the child's own logging — e.g. a module-load failure — is still captured.\n        const errFd = fs.openSync(syncStderrLogPath(workspaceRoot), 'a');\n        const child = spawn(process.execPath, [refresher, workspaceRoot, String(hangTimeoutMinutes)], {\n            detached: true,\n            stdio: ['ignore', errFd, errFd],\n        });\n        // spawn errors (e.g. ENOENT) arrive asynchronously; record one if it fires. The hook may exit\n        // before this handler runs, but on POSIX a successful exec has already happened by now.\n        child.once('error', (err: Error): void => {\n            logSyncEvent(workspaceRoot, new SyncLogEvent('ERROR', child.pid ?? -1, '-', `spawn failed: ${err.message}`));\n        });\n        child.unref();\n        // The child has its own dup'd copy of the fd after spawn; close the parent's copy.\n        fs.closeSync(errFd);\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n        // Spawning the background refresh must never block or fail the tool call.\n    }\n}\n"]}

package/src/core/rules/index.js

@@ -12,13 +12,12 @@ exports.builtInRuleNames = [
     'no-unmanaged-exceptions',
     'catch-error-pattern',
     'throw-cause-required',
-    'no-shell-substitution',
     'no-symbol-di-tokens',
     'branch-creation-guard',
     'pr-creation-guard',
     'merge-in-progress-guard',
     'pr-merge-cleanup',
-    'no-direct-main-update',
+    'redirect-how-to-merge-main',
     'feature-branch-guard',
 ];
 //# sourceMappingURL=index.js.map

package/src/core/rules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/ai-hook-rules/src/core/rules/index.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAsB;IAC/C,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,uBAAuB;IACvB,mBAAmB;IACnB,yBAAyB;IACzB,kBAAkB;IAClB,uBAAuB;IACvB,sBAAsB;CACzB,CAAC","sourcesContent":["export const builtInRuleNames: readonly string[] = [\n    'no-any-unknown',\n    'no-implicit-any',\n    'max-file-lines',\n    'validate-ts-in-src',\n    'no-js-files',\n    'no-destructure',\n    'require-return-type',\n    'no-unmanaged-exceptions',\n    'catch-error-pattern',\n    'throw-cause-required',\n    'no-shell-substitution',\n    'no-symbol-di-tokens',\n    'branch-creation-guard',\n    'pr-creation-guard',\n    'merge-in-progress-guard',\n    'pr-merge-cleanup',\n    'no-direct-main-update',\n    'feature-branch-guard',\n];\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/ai-hook-rules/src/core/rules/index.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAsB;IAC/C,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,uBAAuB;IACvB,mBAAmB;IACnB,yBAAyB;IACzB,kBAAkB;IAClB,4BAA4B;IAC5B,sBAAsB;CACzB,CAAC","sourcesContent":["export const builtInRuleNames: readonly string[] = [\n    'no-any-unknown',\n    'no-implicit-any',\n    'max-file-lines',\n    'validate-ts-in-src',\n    'no-js-files',\n    'no-destructure',\n    'require-return-type',\n    'no-unmanaged-exceptions',\n    'catch-error-pattern',\n    'throw-cause-required',\n    'no-symbol-di-tokens',\n    'branch-creation-guard',\n    'pr-creation-guard',\n    'merge-in-progress-guard',\n    'pr-merge-cleanup',\n    'redirect-how-to-merge-main',\n    'feature-branch-guard',\n];\n"]}

package/src/core/rules/{no-direct-main-update.d.ts → redirect-how-to-merge-main.d.ts}

@@ -1,8 +1,8 @@
-import { NoDirectMainUpdateConfig } from '@webpieces/rules-config';
+import { RedirectHowToMergeMainConfig } from '@webpieces/rules-config';
 import type { BashContext, Violation } from '../types';
 import { BashRuleBase } from '../rule-base';
-export declare class NoDirectMainUpdateRule extends BashRuleBase<NoDirectMainUpdateConfig> {
-    constructor(config: NoDirectMainUpdateConfig);
+export declare class RedirectHowToMergeMainRule extends BashRuleBase<RedirectHowToMergeMainConfig> {
+    constructor(config: RedirectHowToMergeMainConfig);
     readonly description = "Block direct git merge/rebase/pull from main on feature branches. Use the squash-update process instead.";
     readonly fixHint: readonly string[];
     check(ctx: BashContext): readonly Violation[];

package/src/core/rules/{no-direct-main-update.js → redirect-how-to-merge-main.js}

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NoDirectMainUpdateRule = void 0;
+exports.RedirectHowToMergeMainRule = void 0;
 const child_process_1 = require("child_process");
 const types_1 = require("../types");
 const rule_base_1 = require("../rule-base");
@@ -16,8 +16,8 @@ function truncate(s) {
     const MAX = 120;
     return s.length <= MAX ? s : s.slice(0, MAX) + '…';
 }
-class NoDirectMainUpdateRule extends rule_base_1.BashRuleBase {
-    constructor(config) { super(config, 'no-direct-main-update'); }
+class RedirectHowToMergeMainRule extends rule_base_1.BashRuleBase {
+    constructor(config) { super(config, 'redirect-how-to-merge-main'); }
     description = 'Block direct git merge/rebase/pull from main on feature branches. Use the squash-update process instead.';
     fixHint = FIX_HINT;
     check(ctx) {
@@ -44,5 +44,5 @@ class NoDirectMainUpdateRule extends rule_base_1.BashRuleBase {
             ].join('\n'))];
     }
 }
-exports.NoDirectMainUpdateRule = NoDirectMainUpdateRule;
-//# sourceMappingURL=no-direct-main-update.js.map
+exports.RedirectHowToMergeMainRule = RedirectHowToMergeMainRule;
+//# sourceMappingURL=redirect-how-to-merge-main.js.map

package/src/core/rules/redirect-how-to-merge-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-how-to-merge-main.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/ai-hook-rules/src/core/rules/redirect-how-to-merge-main.ts"],"names":[],"mappings":";;;AAAA,iDAAyC;AAKzC,oCAA0C;AAC1C,4CAA4C;AAE5C,MAAM,QAAQ,GAAsB;IAChC,gNAAgN;CACnN,CAAC;AAEF,MAAM,qBAAqB,GAAa;IACpC,qCAAqC;IACrC,sCAAsC;IACtC,8BAA8B;CACjC,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAS;IACvB,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC;AACvD,CAAC;AAED,MAAa,0BAA2B,SAAQ,wBAA0C;IACtF,YAAY,MAAoC,IAAI,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC;IAEzF,WAAW,GAAG,0GAA0G,CAAC;IACzH,OAAO,GAAG,QAAQ,CAAC;IAE5B,KAAK,CAAC,GAAgB;QAClB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExB,0GAA0G;QAC1G,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,IAAA,wBAAQ,EAAC,iCAAiC,EAAE;YAC9D,GAAG,EAAE,GAAG,CAAC,aAAa;YACtB,QAAQ,EAAE,MAAM;SACnB,CAAC,CAAC,IAAI,EAAE,CAAC;QAEV,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,CAAC,IAAI,iBAAC,CACT,CAAC,EACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EACrB;gBACI,4CAA4C,aAAa,eAAe;gBACxE,4CAA4C;gBAC5C,wCAAwC;gBACxC,sBAAsB;gBACtB,uCAAuC;aAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC,CAAC;IACP,CAAC;CACJ;AApCD,gEAoCC","sourcesContent":["import { execSync } from 'child_process';\n\nimport { RedirectHowToMergeMainConfig } from '@webpieces/rules-config';\n\nimport type { BashContext, Violation } from '../types';\nimport { Violation as V } from '../types';\nimport { BashRuleBase } from '../rule-base';\n\nconst FIX_HINT: readonly string[] = [\n    \"Run 'pnpm wp-git-update' to squash-update from main. This preserves the 3-point fork-point system (fork-point=A, feature-HEAD=B, main-HEAD=C) needed for clean PR diffs. See docs/git-workflow.md for details.\",\n];\n\nconst WRONG_UPDATE_PATTERNS: RegExp[] = [\n    /git\\s+merge\\s+(origin\\/main|main)\\b/,\n    /git\\s+rebase\\s+(origin\\/main|main)\\b/,\n    /git\\s+pull\\s+origin\\s+main\\b/,\n];\n\nfunction truncate(s: string): string {\n    const MAX = 120;\n    return s.length <= MAX ? s : s.slice(0, MAX) + '…';\n}\n\nexport class RedirectHowToMergeMainRule extends BashRuleBase<RedirectHowToMergeMainConfig> {\n    constructor(config: RedirectHowToMergeMainConfig) { super(config, 'redirect-how-to-merge-main'); }\n\n    readonly description = 'Block direct git merge/rebase/pull from main on feature branches. Use the squash-update process instead.';\n    readonly fixHint = FIX_HINT;\n\n    check(ctx: BashContext): readonly Violation[] {\n        const matched = WRONG_UPDATE_PATTERNS.some((p: RegExp) => p.test(ctx.command));\n        if (!matched) return [];\n\n        // Allow 'git checkout main && git pull origin main' — switching to main first is the recommended workflow\n        if (/git\\s+(?:checkout|switch)\\s+main\\b/.test(ctx.command)) {\n            return [];\n        }\n\n        const currentBranch = execSync('git rev-parse --abbrev-ref HEAD', {\n            cwd: ctx.workspaceRoot,\n            encoding: 'utf8',\n        }).trim();\n\n        if (currentBranch === 'main') {\n            return [];\n        }\n\n        return [new V(\n            1,\n            truncate(ctx.command),\n            [\n                `Direct merge/rebase from main on branch '${currentBranch}' is blocked.`,\n                'This breaks the 3-point fork-point system.',\n                'Use the squash-update process instead:',\n                '  pnpm wp-git-update',\n                'See docs/git-workflow.md for details.',\n            ].join('\\n'),\n        )];\n    }\n}\n"]}

package/src/core/sync-main.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
 const rules_config_1 = require("@webpieces/rules-config");
 const to_error_1 = require("./to-error");
+const main_sync_log_1 = require("./main-sync-log");
 /**
  * The detached, fire-and-forget refresher spawned (by file path, not a bin) from
  * main-sync-refresh.ts. It does the SLOW work (merged-PR lookup + git fetch + merge-base +
@@ -19,16 +20,24 @@ const to_error_1 = require("./to-error");
 function main() {
     const repoRoot = process.argv[2] ?? process.cwd();
     const hangTimeoutMinutes = Number(process.argv[3]) || rules_config_1.DEFAULT_HANG_TIMEOUT_MINUTES;
+    const startedMs = Date.now();
+    // First action: prove the detached child actually started. If main-sync.log has no START line
+    // for a spawn, the child never launched (or died before this point).
+    (0, main_sync_log_1.logSyncEvent)(repoRoot, new main_sync_log_1.SyncLogEvent('START', process.pid, '-', `argv=${process.argv.slice(2).join(' ')}`));
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
     try {
-        if ((0, rules_config_1.isRefreshInProgress)(repoRoot, hangTimeoutMinutes))
+        if ((0, rules_config_1.isRefreshInProgress)(repoRoot, hangTimeoutMinutes)) {
+            (0, main_sync_log_1.logSyncEvent)(repoRoot, new main_sync_log_1.SyncLogEvent('SKIP_INPROGRESS', process.pid, '-', 'another refresh is in progress'));
             return;
+        }
         const lock = (0, rules_config_1.inProcessLock)();
         (0, rules_config_1.writeMainSyncLock)(repoRoot, lock);
         // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
         try {
             const status = (0, rules_config_1.computeMainSyncStatus)(repoRoot);
             (0, rules_config_1.writeMainSyncStatus)(repoRoot, status);
+            // FINISH after a successful write — START-without-FINISH means we were killed mid-run.
+            (0, main_sync_log_1.logSyncEvent)(repoRoot, new main_sync_log_1.SyncLogEvent('FINISH', process.pid, status.branch, `merged=${String(status.branchAlreadyMerged)} mergedPr=${status.mergedPr} forkPoint=${String(status.hasForkPoint)} conflict=${String(status.conflict)} ms=${String(Date.now() - startedMs)}`));
         }
         finally {
             // Always flip the lock off so a compute failure can't wedge the guard until the
@@ -38,9 +47,9 @@ function main() {
     }
     catch (err) {
         const error = (0, to_error_1.toError)(err);
-        void error;
-        // Detached: swallow so a transient git/fs error never leaves poison state. The next hook
-        // call spawns a fresh refresher.
+        // Detached: swallow so a transient git/fs error never leaves poison state (the next hook call
+        // spawns a fresh refresher) — but record WHY it died so the failure isn't invisible.
+        (0, main_sync_log_1.logSyncEvent)(repoRoot, new main_sync_log_1.SyncLogEvent('ERROR', process.pid, '-', `${error.message} | ${error.stack ?? ''}`));
     }
 }
 if (require.main === module) {

package/src/core/sync-main.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-main.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/sync-main.ts"],"names":[],"mappings":";;AAyBA,oBAyBC;AAlDD,0DAQiC;AAEjC,yCAAqC;AAErC;;;;;;;;;;;;GAYG;AACH,SAAgB,IAAI;IAChB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,2CAA4B,CAAC;IAEnF,8DAA8D;IAC9D,IAAI,CAAC;QACD,IAAI,IAAA,kCAAmB,EAAC,QAAQ,EAAE,kBAAkB,CAAC;YAAE,OAAO;QAE9D,MAAM,IAAI,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC7B,IAAA,gCAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,oCAAqB,EAAC,QAAQ,CAAC,CAAC;YAC/C,IAAA,kCAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACP,gFAAgF;YAChF,8BAA8B;YAC9B,IAAA,gCAAiB,EAAC,QAAQ,EAAE,IAAA,2BAAY,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;QACX,yFAAyF;QACzF,iCAAiC;IACrC,CAAC;AACL,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC;AACX,CAAC","sourcesContent":["import {\n    DEFAULT_HANG_TIMEOUT_MINUTES,\n    computeMainSyncStatus,\n    writeMainSyncStatus,\n    writeMainSyncLock,\n    isRefreshInProgress,\n    inProcessLock,\n    finishedLock,\n} from '@webpieces/rules-config';\n\nimport { toError } from './to-error';\n\n/**\n * The detached, fire-and-forget refresher spawned (by file path, not a bin) from\n * main-sync-refresh.ts. It does the SLOW work (merged-PR lookup + git fetch + merge-base +\n * same-file-overlap) and writes `.webpieces/main-sync-status.json` so the next hook call reads it\n * instantly. Nobody reads our exit code or output — we run after the spawning hook has returned.\n *\n * Concurrency: a lock file (`.webpieces/main-sync.lock.json`) holds `inprocess`/`finished` + a start\n * epoch. If another refresher is already `inprocess` and younger than hangTimeoutMinutes, we exit\n * immediately (don't pile up `git fetch`es). If it's `inprocess` but older than hangTimeoutMinutes,\n * we assume it hung and proceed anyway.\n *\n * argv: [, , repoRoot, hangTimeoutMinutes]\n */\nexport function main(): void {\n    const repoRoot = process.argv[2] ?? process.cwd();\n    const hangTimeoutMinutes = Number(process.argv[3]) || DEFAULT_HANG_TIMEOUT_MINUTES;\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        if (isRefreshInProgress(repoRoot, hangTimeoutMinutes)) return;\n\n        const lock = inProcessLock();\n        writeMainSyncLock(repoRoot, lock);\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const status = computeMainSyncStatus(repoRoot);\n            writeMainSyncStatus(repoRoot, status);\n        } finally {\n            // Always flip the lock off so a compute failure can't wedge the guard until the\n            // staleness reclaim kicks in.\n            writeMainSyncLock(repoRoot, finishedLock(lock.started));\n        }\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n        // Detached: swallow so a transient git/fs error never leaves poison state. The next hook\n        // call spawns a fresh refresher.\n    }\n}\n\nif (require.main === module) {\n    main();\n}\n"]}
+{"version":3,"file":"sync-main.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/sync-main.ts"],"names":[],"mappings":";;AA0BA,oBAsCC;AAhED,0DAQiC;AAEjC,yCAAqC;AACrC,mDAA6D;AAE7D;;;;;;;;;;;;GAYG;AACH,SAAgB,IAAI;IAChB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,2CAA4B,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,8FAA8F;IAC9F,qEAAqE;IACrE,IAAA,4BAAY,EAAC,QAAQ,EAAE,IAAI,4BAAY,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/G,8DAA8D;IAC9D,IAAI,CAAC;QACD,IAAI,IAAA,kCAAmB,EAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACpD,IAAA,4BAAY,EAAC,QAAQ,EAAE,IAAI,4BAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAChH,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC7B,IAAA,gCAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,oCAAqB,EAAC,QAAQ,CAAC,CAAC;YAC/C,IAAA,kCAAmB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtC,uFAAuF;YACvF,IAAA,4BAAY,EAAC,QAAQ,EAAE,IAAI,4BAAY,CACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EACpC,UAAU,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,aAAa,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,CAC/L,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,gFAAgF;YAChF,8BAA8B;YAC9B,IAAA,gCAAiB,EAAC,QAAQ,EAAE,IAAA,2BAAY,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,8FAA8F;QAC9F,qFAAqF;QACrF,IAAA,4BAAY,EAAC,QAAQ,EAAE,IAAI,4BAAY,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACnH,CAAC;AACL,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,CAAC;AACX,CAAC","sourcesContent":["import {\n    DEFAULT_HANG_TIMEOUT_MINUTES,\n    computeMainSyncStatus,\n    writeMainSyncStatus,\n    writeMainSyncLock,\n    isRefreshInProgress,\n    inProcessLock,\n    finishedLock,\n} from '@webpieces/rules-config';\n\nimport { toError } from './to-error';\nimport { logSyncEvent, SyncLogEvent } from './main-sync-log';\n\n/**\n * The detached, fire-and-forget refresher spawned (by file path, not a bin) from\n * main-sync-refresh.ts. It does the SLOW work (merged-PR lookup + git fetch + merge-base +\n * same-file-overlap) and writes `.webpieces/main-sync-status.json` so the next hook call reads it\n * instantly. Nobody reads our exit code or output — we run after the spawning hook has returned.\n *\n * Concurrency: a lock file (`.webpieces/main-sync.lock.json`) holds `inprocess`/`finished` + a start\n * epoch. If another refresher is already `inprocess` and younger than hangTimeoutMinutes, we exit\n * immediately (don't pile up `git fetch`es). If it's `inprocess` but older than hangTimeoutMinutes,\n * we assume it hung and proceed anyway.\n *\n * argv: [, , repoRoot, hangTimeoutMinutes]\n */\nexport function main(): void {\n    const repoRoot = process.argv[2] ?? process.cwd();\n    const hangTimeoutMinutes = Number(process.argv[3]) || DEFAULT_HANG_TIMEOUT_MINUTES;\n    const startedMs = Date.now();\n\n    // First action: prove the detached child actually started. If main-sync.log has no START line\n    // for a spawn, the child never launched (or died before this point).\n    logSyncEvent(repoRoot, new SyncLogEvent('START', process.pid, '-', `argv=${process.argv.slice(2).join(' ')}`));\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        if (isRefreshInProgress(repoRoot, hangTimeoutMinutes)) {\n            logSyncEvent(repoRoot, new SyncLogEvent('SKIP_INPROGRESS', process.pid, '-', 'another refresh is in progress'));\n            return;\n        }\n\n        const lock = inProcessLock();\n        writeMainSyncLock(repoRoot, lock);\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const status = computeMainSyncStatus(repoRoot);\n            writeMainSyncStatus(repoRoot, status);\n            // FINISH after a successful write — START-without-FINISH means we were killed mid-run.\n            logSyncEvent(repoRoot, new SyncLogEvent(\n                'FINISH', process.pid, status.branch,\n                `merged=${String(status.branchAlreadyMerged)} mergedPr=${status.mergedPr} forkPoint=${String(status.hasForkPoint)} conflict=${String(status.conflict)} ms=${String(Date.now() - startedMs)}`,\n            ));\n        } finally {\n            // Always flip the lock off so a compute failure can't wedge the guard until the\n            // staleness reclaim kicks in.\n            writeMainSyncLock(repoRoot, finishedLock(lock.started));\n        }\n    } catch (err: unknown) {\n        const error = toError(err);\n        // Detached: swallow so a transient git/fs error never leaves poison state (the next hook call\n        // spawns a fresh refresher) — but record WHY it died so the failure isn't invisible.\n        logSyncEvent(repoRoot, new SyncLogEvent('ERROR', process.pid, '-', `${error.message} | ${error.stack ?? ''}`));\n    }\n}\n\nif (require.main === module) {\n    main();\n}\n"]}

package/src/index.d.ts

@@ -10,13 +10,12 @@ export { RequireReturnTypeRule } from './core/rules/require-return-type';
 export { NoUnmanagedExceptionsRule } from './core/rules/no-unmanaged-exceptions';
 export { CatchErrorPatternRule } from './core/rules/catch-error-pattern';
 export { ThrowCauseRequiredRule } from './core/rules/throw-cause-required';
-export { NoShellSubstitutionRule } from './core/rules/no-shell-substitution';
 export { NoSymbolDiTokensRule } from './core/rules/no-symbol-di-tokens';
 export { BranchCreationGuardRule } from './core/rules/branch-creation-guard';
 export { PrCreationGuardRule } from './core/rules/pr-creation-guard';
 export { MergeInProgressGuardRule } from './core/rules/merge-in-progress-guard';
 export { PrMergeCleanupRule } from './core/rules/pr-merge-cleanup';
-export { NoDirectMainUpdateRule } from './core/rules/no-direct-main-update';
+export { RedirectHowToMergeMainRule } from './core/rules/redirect-how-to-merge-main';
 export { NoJsFilesRule } from './core/rules/no-js-files';
 export { FeatureBranchGuardRule } from './core/rules/feature-branch-guard';
 export { run } from './core/runner';

package/src/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.formatReport = exports.createIsLineDisabled = exports.DirectiveIndex = exports.parseDirectives = exports.stripTsNoise = exports.run = exports.FeatureBranchGuardRule = exports.NoJsFilesRule = exports.NoDirectMainUpdateRule = exports.PrMergeCleanupRule = exports.MergeInProgressGuardRule = exports.PrCreationGuardRule = exports.BranchCreationGuardRule = exports.NoSymbolDiTokensRule = exports.NoShellSubstitutionRule = exports.ThrowCauseRequiredRule = exports.CatchErrorPatternRule = exports.NoUnmanagedExceptionsRule = exports.RequireReturnTypeRule = exports.NoDestructureRule = exports.ValidateTsInSrcRule = exports.MaxFileLinesRule = exports.NoImplicitAnyRule = exports.NoAnyUnknownRule = exports.CustomRuleAdapter = exports.EmptyRuleConfig = exports.BashRuleBase = exports.FileRuleBase = exports.EditRuleBase = exports.ResolvedRuleConfig = exports.ResolvedConfig = exports.BlockedResult = exports.RuleGroup = exports.BashContext = exports.FileContext = exports.EditContext = exports.NormalizedToolInput = exports.NormalizedEdit = exports.Violation = void 0;
+exports.formatReport = exports.createIsLineDisabled = exports.DirectiveIndex = exports.parseDirectives = exports.stripTsNoise = exports.run = exports.FeatureBranchGuardRule = exports.NoJsFilesRule = exports.RedirectHowToMergeMainRule = exports.PrMergeCleanupRule = exports.MergeInProgressGuardRule = exports.PrCreationGuardRule = exports.BranchCreationGuardRule = exports.NoSymbolDiTokensRule = exports.ThrowCauseRequiredRule = exports.CatchErrorPatternRule = exports.NoUnmanagedExceptionsRule = exports.RequireReturnTypeRule = exports.NoDestructureRule = exports.ValidateTsInSrcRule = exports.MaxFileLinesRule = exports.NoImplicitAnyRule = exports.NoAnyUnknownRule = exports.CustomRuleAdapter = exports.EmptyRuleConfig = exports.BashRuleBase = exports.FileRuleBase = exports.EditRuleBase = exports.ResolvedRuleConfig = exports.ResolvedConfig = exports.BlockedResult = exports.RuleGroup = exports.BashContext = exports.FileContext = exports.EditContext = exports.NormalizedToolInput = exports.NormalizedEdit = exports.Violation = void 0;
 // Pluggable write-time validation framework for AI coding agents
 var types_1 = require("./core/types");
 Object.defineProperty(exports, "Violation", { enumerable: true, get: function () { return types_1.Violation; } });
@@ -40,8 +40,6 @@ var catch_error_pattern_1 = require("./core/rules/catch-error-pattern");
 Object.defineProperty(exports, "CatchErrorPatternRule", { enumerable: true, get: function () { return catch_error_pattern_1.CatchErrorPatternRule; } });
 var throw_cause_required_1 = require("./core/rules/throw-cause-required");
 Object.defineProperty(exports, "ThrowCauseRequiredRule", { enumerable: true, get: function () { return throw_cause_required_1.ThrowCauseRequiredRule; } });
-var no_shell_substitution_1 = require("./core/rules/no-shell-substitution");
-Object.defineProperty(exports, "NoShellSubstitutionRule", { enumerable: true, get: function () { return no_shell_substitution_1.NoShellSubstitutionRule; } });
 var no_symbol_di_tokens_1 = require("./core/rules/no-symbol-di-tokens");
 Object.defineProperty(exports, "NoSymbolDiTokensRule", { enumerable: true, get: function () { return no_symbol_di_tokens_1.NoSymbolDiTokensRule; } });
 var branch_creation_guard_1 = require("./core/rules/branch-creation-guard");
@@ -52,8 +50,8 @@ var merge_in_progress_guard_1 = require("./core/rules/merge-in-progress-guard");
 Object.defineProperty(exports, "MergeInProgressGuardRule", { enumerable: true, get: function () { return merge_in_progress_guard_1.MergeInProgressGuardRule; } });
 var pr_merge_cleanup_1 = require("./core/rules/pr-merge-cleanup");
 Object.defineProperty(exports, "PrMergeCleanupRule", { enumerable: true, get: function () { return pr_merge_cleanup_1.PrMergeCleanupRule; } });
-var no_direct_main_update_1 = require("./core/rules/no-direct-main-update");
-Object.defineProperty(exports, "NoDirectMainUpdateRule", { enumerable: true, get: function () { return no_direct_main_update_1.NoDirectMainUpdateRule; } });
+var redirect_how_to_merge_main_1 = require("./core/rules/redirect-how-to-merge-main");
+Object.defineProperty(exports, "RedirectHowToMergeMainRule", { enumerable: true, get: function () { return redirect_how_to_merge_main_1.RedirectHowToMergeMainRule; } });
 var no_js_files_1 = require("./core/rules/no-js-files");
 Object.defineProperty(exports, "NoJsFilesRule", { enumerable: true, get: function () { return no_js_files_1.NoJsFilesRule; } });
 var feature_branch_guard_1 = require("./core/rules/feature-branch-guard");

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/ai-hook-rules/src/index.ts"],"names":[],"mappings":";;;AAAA,iEAAiE;AACjE,sCAOsB;AALlB,kGAAA,SAAS,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,4GAAA,mBAAmB,OAAA;AAC9C,oGAAA,WAAW,OAAA;AAAE,oGAAA,WAAW,OAAA;AAAE,oGAAA,WAAW,OAAA;AAErC,kGAAA,SAAS,OAAA;AAAE,sGAAA,aAAa,OAAA;AACxB,uGAAA,cAAc,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAGtC,gGAAgG;AAChG,8CAA6F;AAApF,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,4GAAA,eAAe,OAAA;AAClE,kEAA+D;AAAtD,wHAAA,iBAAiB,OAAA;AAE1B,+FAA+F;AAC/F,8DAA+D;AAAtD,kHAAA,gBAAgB,OAAA;AACzB,gEAAiE;AAAxD,oHAAA,iBAAiB,OAAA;AAC1B,8DAA+D;AAAtD,kHAAA,gBAAgB,OAAA;AACzB,sEAAsE;AAA7D,yHAAA,mBAAmB,OAAA;AAC5B,8DAAgE;AAAvD,mHAAA,iBAAiB,OAAA;AAC1B,wEAAyE;AAAhE,4HAAA,qBAAqB,OAAA;AAC9B,gFAAiF;AAAxE,oIAAA,yBAAyB,OAAA;AAClC,wEAAyE;AAAhE,4HAAA,qBAAqB,OAAA;AAC9B,0EAA2E;AAAlE,8HAAA,sBAAsB,OAAA;AAC/B,4EAA6E;AAApE,gIAAA,uBAAuB,OAAA;AAChC,wEAAwE;AAA/D,2HAAA,oBAAoB,OAAA;AAC7B,4EAA6E;AAApE,gIAAA,uBAAuB,OAAA;AAChC,oEAAqE;AAA5D,wHAAA,mBAAmB,OAAA;AAC5B,gFAAgF;AAAvE,mIAAA,wBAAwB,OAAA;AACjC,kEAAmE;AAA1D,sHAAA,kBAAkB,OAAA;AAC3B,4EAA4E;AAAnE,+HAAA,sBAAsB,OAAA;AAC/B,wDAAyD;AAAhD,4GAAA,aAAa,OAAA;AACtB,0EAA2E;AAAlE,8HAAA,sBAAsB,OAAA;AAE/B,wCAAoC;AAA3B,6FAAA,GAAG,OAAA;AACZ,wDAAqD;AAA5C,8GAAA,YAAY,OAAA;AACrB,gEAAkG;AAAzF,qHAAA,eAAe,OAAA;AAAE,oHAAA,cAAc,OAAA;AAAE,0HAAA,oBAAoB,OAAA;AAC9D,wCAA6C;AAApC,sGAAA,YAAY,OAAA","sourcesContent":["// Pluggable write-time validation framework for AI coding agents\nexport {\n    ToolKind, RuleScope, RuleOptions, IsLineDisabled,\n    Violation, NormalizedEdit, NormalizedToolInput,\n    EditContext, FileContext, BashContext,\n    Rule, PlainRule,\n    RuleGroup, BlockedResult,\n    ResolvedConfig, ResolvedRuleConfig,\n} from './core/types';\n\n// Scope-specific rule bases (each extends the shared AbstractRule from @webpieces/rules-config)\nexport { EditRuleBase, FileRuleBase, BashRuleBase, EmptyRuleConfig } from './core/rule-base';\nexport { CustomRuleAdapter } from './core/custom-rule-adapter';\n\n// Built-in rule classes — each constructed with its typed *Config from @webpieces/rules-config\nexport { NoAnyUnknownRule } from './core/rules/no-any-unknown';\nexport { NoImplicitAnyRule } from './core/rules/no-implicit-any';\nexport { MaxFileLinesRule } from './core/rules/max-file-lines';\nexport { ValidateTsInSrcRule } from './core/rules/validate-ts-in-src';\nexport { NoDestructureRule } from './core/rules/no-destructure';\nexport { RequireReturnTypeRule } from './core/rules/require-return-type';\nexport { NoUnmanagedExceptionsRule } from './core/rules/no-unmanaged-exceptions';\nexport { CatchErrorPatternRule } from './core/rules/catch-error-pattern';\nexport { ThrowCauseRequiredRule } from './core/rules/throw-cause-required';\nexport { NoShellSubstitutionRule } from './core/rules/no-shell-substitution';\nexport { NoSymbolDiTokensRule } from './core/rules/no-symbol-di-tokens';\nexport { BranchCreationGuardRule } from './core/rules/branch-creation-guard';\nexport { PrCreationGuardRule } from './core/rules/pr-creation-guard';\nexport { MergeInProgressGuardRule } from './core/rules/merge-in-progress-guard';\nexport { PrMergeCleanupRule } from './core/rules/pr-merge-cleanup';\nexport { NoDirectMainUpdateRule } from './core/rules/no-direct-main-update';\nexport { NoJsFilesRule } from './core/rules/no-js-files';\nexport { FeatureBranchGuardRule } from './core/rules/feature-branch-guard';\n\nexport { run } from './core/runner';\nexport { stripTsNoise } from './core/strip-ts-noise';\nexport { parseDirectives, DirectiveIndex, createIsLineDisabled } from './core/disable-directives';\nexport { formatReport } from './core/report';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/ai-hook-rules/src/index.ts"],"names":[],"mappings":";;;AAAA,iEAAiE;AACjE,sCAOsB;AALlB,kGAAA,SAAS,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,4GAAA,mBAAmB,OAAA;AAC9C,oGAAA,WAAW,OAAA;AAAE,oGAAA,WAAW,OAAA;AAAE,oGAAA,WAAW,OAAA;AAErC,kGAAA,SAAS,OAAA;AAAE,sGAAA,aAAa,OAAA;AACxB,uGAAA,cAAc,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAGtC,gGAAgG;AAChG,8CAA6F;AAApF,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,4GAAA,eAAe,OAAA;AAClE,kEAA+D;AAAtD,wHAAA,iBAAiB,OAAA;AAE1B,+FAA+F;AAC/F,8DAA+D;AAAtD,kHAAA,gBAAgB,OAAA;AACzB,gEAAiE;AAAxD,oHAAA,iBAAiB,OAAA;AAC1B,8DAA+D;AAAtD,kHAAA,gBAAgB,OAAA;AACzB,sEAAsE;AAA7D,yHAAA,mBAAmB,OAAA;AAC5B,8DAAgE;AAAvD,mHAAA,iBAAiB,OAAA;AAC1B,wEAAyE;AAAhE,4HAAA,qBAAqB,OAAA;AAC9B,gFAAiF;AAAxE,oIAAA,yBAAyB,OAAA;AAClC,wEAAyE;AAAhE,4HAAA,qBAAqB,OAAA;AAC9B,0EAA2E;AAAlE,8HAAA,sBAAsB,OAAA;AAC/B,wEAAwE;AAA/D,2HAAA,oBAAoB,OAAA;AAC7B,4EAA6E;AAApE,gIAAA,uBAAuB,OAAA;AAChC,oEAAqE;AAA5D,wHAAA,mBAAmB,OAAA;AAC5B,gFAAgF;AAAvE,mIAAA,wBAAwB,OAAA;AACjC,kEAAmE;AAA1D,sHAAA,kBAAkB,OAAA;AAC3B,sFAAqF;AAA5E,wIAAA,0BAA0B,OAAA;AACnC,wDAAyD;AAAhD,4GAAA,aAAa,OAAA;AACtB,0EAA2E;AAAlE,8HAAA,sBAAsB,OAAA;AAE/B,wCAAoC;AAA3B,6FAAA,GAAG,OAAA;AACZ,wDAAqD;AAA5C,8GAAA,YAAY,OAAA;AACrB,gEAAkG;AAAzF,qHAAA,eAAe,OAAA;AAAE,oHAAA,cAAc,OAAA;AAAE,0HAAA,oBAAoB,OAAA;AAC9D,wCAA6C;AAApC,sGAAA,YAAY,OAAA","sourcesContent":["// Pluggable write-time validation framework for AI coding agents\nexport {\n    ToolKind, RuleScope, RuleOptions, IsLineDisabled,\n    Violation, NormalizedEdit, NormalizedToolInput,\n    EditContext, FileContext, BashContext,\n    Rule, PlainRule,\n    RuleGroup, BlockedResult,\n    ResolvedConfig, ResolvedRuleConfig,\n} from './core/types';\n\n// Scope-specific rule bases (each extends the shared AbstractRule from @webpieces/rules-config)\nexport { EditRuleBase, FileRuleBase, BashRuleBase, EmptyRuleConfig } from './core/rule-base';\nexport { CustomRuleAdapter } from './core/custom-rule-adapter';\n\n// Built-in rule classes — each constructed with its typed *Config from @webpieces/rules-config\nexport { NoAnyUnknownRule } from './core/rules/no-any-unknown';\nexport { NoImplicitAnyRule } from './core/rules/no-implicit-any';\nexport { MaxFileLinesRule } from './core/rules/max-file-lines';\nexport { ValidateTsInSrcRule } from './core/rules/validate-ts-in-src';\nexport { NoDestructureRule } from './core/rules/no-destructure';\nexport { RequireReturnTypeRule } from './core/rules/require-return-type';\nexport { NoUnmanagedExceptionsRule } from './core/rules/no-unmanaged-exceptions';\nexport { CatchErrorPatternRule } from './core/rules/catch-error-pattern';\nexport { ThrowCauseRequiredRule } from './core/rules/throw-cause-required';\nexport { NoSymbolDiTokensRule } from './core/rules/no-symbol-di-tokens';\nexport { BranchCreationGuardRule } from './core/rules/branch-creation-guard';\nexport { PrCreationGuardRule } from './core/rules/pr-creation-guard';\nexport { MergeInProgressGuardRule } from './core/rules/merge-in-progress-guard';\nexport { PrMergeCleanupRule } from './core/rules/pr-merge-cleanup';\nexport { RedirectHowToMergeMainRule } from './core/rules/redirect-how-to-merge-main';\nexport { NoJsFilesRule } from './core/rules/no-js-files';\nexport { FeatureBranchGuardRule } from './core/rules/feature-branch-guard';\n\nexport { run } from './core/runner';\nexport { stripTsNoise } from './core/strip-ts-noise';\nexport { parseDirectives, DirectiveIndex, createIsLineDisabled } from './core/disable-directives';\nexport { formatReport } from './core/report';\n"]}

package/src/core/rules/no-direct-main-update.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"no-direct-main-update.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/ai-hook-rules/src/core/rules/no-direct-main-update.ts"],"names":[],"mappings":";;;AAAA,iDAAyC;AAKzC,oCAA0C;AAC1C,4CAA4C;AAE5C,MAAM,QAAQ,GAAsB;IAChC,gNAAgN;CACnN,CAAC;AAEF,MAAM,qBAAqB,GAAa;IACpC,qCAAqC;IACrC,sCAAsC;IACtC,8BAA8B;CACjC,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAS;IACvB,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC;AACvD,CAAC;AAED,MAAa,sBAAuB,SAAQ,wBAAsC;IAC9E,YAAY,MAAgC,IAAI,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAEhF,WAAW,GAAG,0GAA0G,CAAC;IACzH,OAAO,GAAG,QAAQ,CAAC;IAE5B,KAAK,CAAC,GAAgB;QAClB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExB,0GAA0G;QAC1G,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,IAAA,wBAAQ,EAAC,iCAAiC,EAAE;YAC9D,GAAG,EAAE,GAAG,CAAC,aAAa;YACtB,QAAQ,EAAE,MAAM;SACnB,CAAC,CAAC,IAAI,EAAE,CAAC;QAEV,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,CAAC,IAAI,iBAAC,CACT,CAAC,EACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EACrB;gBACI,4CAA4C,aAAa,eAAe;gBACxE,4CAA4C;gBAC5C,wCAAwC;gBACxC,sBAAsB;gBACtB,uCAAuC;aAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,CAAC,CAAC;IACP,CAAC;CACJ;AApCD,wDAoCC","sourcesContent":["import { execSync } from 'child_process';\n\nimport { NoDirectMainUpdateConfig } from '@webpieces/rules-config';\n\nimport type { BashContext, Violation } from '../types';\nimport { Violation as V } from '../types';\nimport { BashRuleBase } from '../rule-base';\n\nconst FIX_HINT: readonly string[] = [\n    \"Run 'pnpm wp-git-update' to squash-update from main. This preserves the 3-point fork-point system (fork-point=A, feature-HEAD=B, main-HEAD=C) needed for clean PR diffs. See docs/git-workflow.md for details.\",\n];\n\nconst WRONG_UPDATE_PATTERNS: RegExp[] = [\n    /git\\s+merge\\s+(origin\\/main|main)\\b/,\n    /git\\s+rebase\\s+(origin\\/main|main)\\b/,\n    /git\\s+pull\\s+origin\\s+main\\b/,\n];\n\nfunction truncate(s: string): string {\n    const MAX = 120;\n    return s.length <= MAX ? s : s.slice(0, MAX) + '…';\n}\n\nexport class NoDirectMainUpdateRule extends BashRuleBase<NoDirectMainUpdateConfig> {\n    constructor(config: NoDirectMainUpdateConfig) { super(config, 'no-direct-main-update'); }\n\n    readonly description = 'Block direct git merge/rebase/pull from main on feature branches. Use the squash-update process instead.';\n    readonly fixHint = FIX_HINT;\n\n    check(ctx: BashContext): readonly Violation[] {\n        const matched = WRONG_UPDATE_PATTERNS.some((p: RegExp) => p.test(ctx.command));\n        if (!matched) return [];\n\n        // Allow 'git checkout main && git pull origin main' — switching to main first is the recommended workflow\n        if (/git\\s+(?:checkout|switch)\\s+main\\b/.test(ctx.command)) {\n            return [];\n        }\n\n        const currentBranch = execSync('git rev-parse --abbrev-ref HEAD', {\n            cwd: ctx.workspaceRoot,\n            encoding: 'utf8',\n        }).trim();\n\n        if (currentBranch === 'main') {\n            return [];\n        }\n\n        return [new V(\n            1,\n            truncate(ctx.command),\n            [\n                `Direct merge/rebase from main on branch '${currentBranch}' is blocked.`,\n                'This breaks the 3-point fork-point system.',\n                'Use the squash-update process instead:',\n                '  pnpm wp-git-update',\n                'See docs/git-workflow.md for details.',\n            ].join('\\n'),\n        )];\n    }\n}\n"]}

package/src/core/rules/no-shell-substitution.d.ts

@@ -1,9 +0,0 @@
-import { NoShellSubstitutionConfig } from '@webpieces/rules-config';
-import type { BashContext, Violation } from '../types';
-import { BashRuleBase } from '../rule-base';
-export declare class NoShellSubstitutionRule extends BashRuleBase<NoShellSubstitutionConfig> {
-    constructor(config: NoShellSubstitutionConfig);
-    readonly description = "Reject Bash commands containing shell substitutions ($(...), backticks, $VAR).";
-    readonly fixHint: readonly string[];
-    check(ctx: BashContext): readonly Violation[];
-}

package/src/core/rules/no-shell-substitution.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NoShellSubstitutionRule = void 0;
-const types_1 = require("../types");
-const rule_base_1 = require("../rule-base");
-const FIX_HINT = [
-    'Build a payload file with the Write tool and pass it as stdin: node script.js < /path/to/payload.json',
-    'Use the Read, Grep, or Glob tools directly instead of capturing output with $(...)',
-    'Write a small script file with the Write tool and execute it directly: bash /path/to/script.sh',
-];
-function stripSingleQuoted(cmd) {
-    return cmd.replace(/'[^']*'/g, "''");
-}
-function hasUnescapedBacktick(cmd) {
-    for (let i = 0; i < cmd.length; i += 1) {
-        if (cmd[i] === '`' && (i === 0 || cmd[i - 1] !== '\\'))
-            return true;
-    }
-    return false;
-}
-function hasBareVarExpansion(cmd) {
-    const re = /(^|[^\\])\$([A-Za-z_][A-Za-z0-9_]*)/g;
-    return re.test(cmd);
-}
-function truncate(s) {
-    const MAX = 120;
-    if (s.length <= MAX)
-        return s;
-    return s.slice(0, MAX) + '…';
-}
-class NoShellSubstitutionRule extends rule_base_1.BashRuleBase {
-    constructor(config) { super(config, 'no-shell-substitution'); }
-    description = 'Reject Bash commands containing shell substitutions ($(...), backticks, $VAR).';
-    fixHint = FIX_HINT;
-    check(ctx) {
-        const scanned = stripSingleQuoted(ctx.command);
-        const violations = [];
-        if (/\$\(/.test(scanned)) {
-            violations.push(new types_1.Violation(1, truncate(ctx.command), 'Command contains `$(...)` command substitution.'));
-        }
-        if (hasUnescapedBacktick(scanned)) {
-            violations.push(new types_1.Violation(1, truncate(ctx.command), 'Command contains backtick command substitution.'));
-        }
-        if (/\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(scanned) || hasBareVarExpansion(scanned)) {
-            violations.push(new types_1.Violation(1, truncate(ctx.command), 'Command contains `$VAR` or `${VAR}` variable expansion.'));
-        }
-        return violations;
-    }
-}
-exports.NoShellSubstitutionRule = NoShellSubstitutionRule;
-//# sourceMappingURL=no-shell-substitution.js.map

package/src/core/rules/no-shell-substitution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"no-shell-substitution.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/ai-hook-rules/src/core/rules/no-shell-substitution.ts"],"names":[],"mappings":";;;AAGA,oCAA0C;AAC1C,4CAA4C;AAE5C,MAAM,QAAQ,GAAsB;IAChC,uGAAuG;IACvG,oFAAoF;IACpF,gGAAgG;CACnG,CAAC;AAEF,SAAS,iBAAiB,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACpC,MAAM,EAAE,GAAG,sCAAsC,CAAC;IAClD,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACvB,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC;AACjC,CAAC;AAED,MAAa,uBAAwB,SAAQ,wBAAuC;IAChF,YAAY,MAAiC,IAAI,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAEjF,WAAW,GAAG,gFAAgF,CAAC;IAC/F,OAAO,GAAG,QAAQ,CAAC;IAE5B,KAAK,CAAC,GAAgB;QAClB,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAgB,EAAE,CAAC;QAEnC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAC,CACjB,CAAC,EACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EACrB,iDAAiD,CACpD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAC,CACjB,CAAC,EACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EACrB,iDAAiD,CACpD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAC,CACjB,CAAC,EACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EACrB,yDAAyD,CAC5D,CAAC,CAAC;QACP,CAAC;QACD,OAAO,UAAU,CAAC;IACtB,CAAC;CACJ;AAjCD,0DAiCC","sourcesContent":["import { NoShellSubstitutionConfig } from '@webpieces/rules-config';\n\nimport type { BashContext, Violation } from '../types';\nimport { Violation as V } from '../types';\nimport { BashRuleBase } from '../rule-base';\n\nconst FIX_HINT: readonly string[] = [\n    'Build a payload file with the Write tool and pass it as stdin: node script.js < /path/to/payload.json',\n    'Use the Read, Grep, or Glob tools directly instead of capturing output with $(...)',\n    'Write a small script file with the Write tool and execute it directly: bash /path/to/script.sh',\n];\n\nfunction stripSingleQuoted(cmd: string): string {\n    return cmd.replace(/'[^']*'/g, \"''\");\n}\n\nfunction hasUnescapedBacktick(cmd: string): boolean {\n    for (let i = 0; i < cmd.length; i += 1) {\n        if (cmd[i] === '`' && (i === 0 || cmd[i - 1] !== '\\\\')) return true;\n    }\n    return false;\n}\n\nfunction hasBareVarExpansion(cmd: string): boolean {\n    const re = /(^|[^\\\\])\\$([A-Za-z_][A-Za-z0-9_]*)/g;\n    return re.test(cmd);\n}\n\nfunction truncate(s: string): string {\n    const MAX = 120;\n    if (s.length <= MAX) return s;\n    return s.slice(0, MAX) + '…';\n}\n\nexport class NoShellSubstitutionRule extends BashRuleBase<NoShellSubstitutionConfig> {\n    constructor(config: NoShellSubstitutionConfig) { super(config, 'no-shell-substitution'); }\n\n    readonly description = 'Reject Bash commands containing shell substitutions ($(...), backticks, $VAR).';\n    readonly fixHint = FIX_HINT;\n\n    check(ctx: BashContext): readonly Violation[] {\n        const scanned = stripSingleQuoted(ctx.command);\n        const violations: Violation[] = [];\n\n        if (/\\$\\(/.test(scanned)) {\n            violations.push(new V(\n                1,\n                truncate(ctx.command),\n                'Command contains `$(...)` command substitution.',\n            ));\n        }\n        if (hasUnescapedBacktick(scanned)) {\n            violations.push(new V(\n                1,\n                truncate(ctx.command),\n                'Command contains backtick command substitution.',\n            ));\n        }\n        if (/\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}/.test(scanned) || hasBareVarExpansion(scanned)) {\n            violations.push(new V(\n                1,\n                truncate(ctx.command),\n                'Command contains `$VAR` or `${VAR}` variable expansion.',\n            ));\n        }\n        return violations;\n    }\n}\n"]}