@webpieces/ai-hook-rules 0.4.433 → 0.4.435

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/ai-hook-rules",
-  "version": "0.4.433",
+  "version": "0.4.435",
   "description": "Pluggable write-time validation framework for AI coding agents (@webpieces/ai-hook-rules). Claude Code PreToolUse + openclaw before_tool_call adapters share one rule engine.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -32,7 +32,7 @@
     "directory": "packages/tooling/ai-hook-rules"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.433"
+    "@webpieces/rules-config": "0.4.435"
   },
   "publishConfig": {
     "access": "public"

package/src/adapters/hook-core.d.ts

@@ -1,5 +1,7 @@
 import { HookMode } from '../core/types';
 export type { HookMode };
+export type ShimStaleDecision = 'allow-cure' | 'pass' | 'deny';
+export declare function shimStaleRecoveryDecision(toolName: string, command: string, filePath: string): ShimStaleDecision;
 /**
  * Shared entry point for all three Claude Code PreToolUse adapters. `mode` selects which tool kinds
  * to validate; payloads outside the mode's scope pass through (emitAllow). Blocks by emitting a

package/src/adapters/hook-core.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.shimStaleRecoveryDecision = shimStaleRecoveryDecision;
 exports.runMain = runMain;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
@@ -149,24 +150,36 @@ function handleFileTool(payload, cwd, mode) {
     // already renders red natively for these tools). See claude-code-response.ts.
     (0, claude_code_response_1.emitDeny)(result.report, toolKind);
 }
+// webpieces-disable no-function-outside-class -- pure decision helper beside the adapter's other module-scope functions; exported for direct unit testing.
+function shimStaleRecoveryDecision(toolName, command, filePath) {
+    if (READ_ONLY_TOOLS.has(toolName))
+        return 'pass'; // any read: needed to recover
+    if ((0, shim_1.isShimCureCommand)(command))
+        return 'allow-cure'; // a Bash shim cure
+    if (path.basename(filePath) === load_config_1.CONFIG_FILENAME)
+        return 'pass'; // the always-allowed config edit
+    return 'deny';
+}
 // Committed-shim self-guard, moved here from the rendered shim (2026-07-24). The committed
 // .claude/webpieces/ai-hook.sh is webpieces-MANAGED and generated from renderShim(); if it no longer
 // matches, it was reverted / hand-edited / predates this binary, so its OWN fail-closed logic can't be
 // trusted. We are the CURRENT binary from node_modules — the trustworthy party — so WE decide here
 // instead of the (possibly stale) shim. It used to `cmp` itself inside the shim: a double-edged trap,
 // since the check lived in the very file it guarded and a fix could only ship by regenerating that
-// file. Now: fail closed on EVERY tool (Reads included — nothing is safe until it matches again),
-// allowing ONLY the three cures (isShimCureCommand) so the AI can re-arm it — NOT a deadlock. We deny +
+// file. Now we fail closed on all real WORK while always leaving the recovery path open (see
+// shimStaleRecoveryDecision): the three cures, any Read, and editing webpieces.config.json. We deny +
 // tell the AI; we do NOT silently rewrite the file under it. 'rules' hook skips it (guards owns the
-// shim). `command` is '' for non-Bash tools, so only a Bash cure can match. Returns normally (nothing
-// to do) or exits via emitAllow/emitDeny.
+// shim). Returns normally (pass / nothing to do) or exits via emitAllow/emitDeny.
 // webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design
-function enforceCommittedShim(toolName, command, cwd, mode) {
+function enforceCommittedShim(payload, cwd, mode) {
     if (mode === 'rules' || !(0, shim_1.committedShimStale)(cwd))
         return;
-    if ((0, shim_1.isShimCureCommand)(command))
+    const decision = shimStaleRecoveryDecision(payload.tool_name, payload.tool_input.command ?? '', payload.tool_input.file_path ?? '');
+    if (decision === 'pass')
+        return;
+    if (decision === 'allow-cure')
         (0, claude_code_response_1.emitAllow)();
-    (0, claude_code_response_1.emitDeny)((0, shim_1.shimStaleDenyReason)((0, shim_1.installedShimRulesVersion)()), toolName);
+    (0, claude_code_response_1.emitDeny)((0, shim_1.shimStaleDenyReason)((0, shim_1.installedShimRulesVersion)()), payload.tool_name);
 }
 /**
  * Shared entry point for all three Claude Code PreToolUse adapters. `mode` selects which tool kinds
@@ -192,9 +205,9 @@ async function runMain(mode) {
         // process.cwd(); they match today, but the payload is the authoritative signal and stays
         // correct if the hook is ever invoked from a fixed dir (e.g. via $CLAUDE_PROJECT_DIR).
         const cwd = payload.cwd ?? process.cwd();
-        // Committed-shim self-guard (moved here from the shim, 2026-07-24). Runs BEFORE read handling so
-        // a stale shim blocks EVERY tool, Reads included — see enforceCommittedShim for the full why.
-        enforceCommittedShim(payload.tool_name, payload.tool_input.command ?? '', cwd, mode);
+        // Committed-shim self-guard: blocks real work while the committed shim is stale, but keeps the
+        // recovery path open (cures, reads, config edit). See enforceCommittedShim / shimStaleRecoveryDecision.
+        enforceCommittedShim(payload, cwd, mode);
         // Read-only tools (Read): audit-log, warm the main-sync cache, then run the ONE read-scoped
         // guard (read-stale-guard) and allow. Runs BEFORE the general rule engine — no code-style rule
         // ever sees a Read, and the only way this path can deny is a stale `main`.

package/src/adapters/hook-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-core.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/hook-core.ts"],"names":[],"mappings":";;AA4MA,0BAqEC;;AAjRD,mDAA6B;AAE7B,2CAAuD;AACvD,yDAAqD;AACrD,uDAAyG;AACzG,iEAAmE;AACnE,qDAAsD;AACtD,0DAAyD;AACzD,yCAAqI;AACrI,+CAA2C;AAC3C,iEAA6D;AAC7D,sCAAoH;AAWpH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEnE,qGAAqG;AACrG,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,mDAAmD;AACnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAwB1C,SAAS,SAAS;IACd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAgC,EAAE,EAAE;QACpD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC1B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAChD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,qBAAa,CAAC,gDAAgD,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAoB,CAAC;IAClE,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkB,EAAE,SAA8B;IAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,IAAI,2BAAmB,CAAC,QAAQ,EAAE;YACrC,IAAI,sBAAc,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;SAClD,CAAC,CAAC;IACP,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,2BAAmB,CAAC,QAAQ,EAAE;YACrC,IAAI,sBAAc,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;SAC7E,CAAC,CAAC;IACP,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,IAAI,sBAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO,IAAI,2BAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B,EAAE,GAAW,EAAE,IAAc;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAA,gBAAO,EAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAC7B,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,MAAM,IAAI,GAAG,IAAI,6BAAc,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvD,IAAA,+BAAgB,EAAC,IAAI,EAAE,IAAI,4BAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,IAAA,2BAAY,EAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3H,kGAAkG;IAClG,gGAAgG;IAChG,IAAA,+BAAQ,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,0JAA0J;AAC1J,SAAS,UAAU,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAc;IAC7D,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO;IAC5B,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,GAAG,IAAA,gBAAO,EAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;QACX,OAAO,CAAC,kCAAkC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAA,4BAAY,EAAC,MAAM,EAAE,IAAI,2BAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzE,IAAA,+BAAQ,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B,EAAE,GAAW,EAAE,IAAc;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAE5B,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,6BAAe,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACnB,wFAAwF;YACxF,sFAAsF;YACtF,oCAAoC;YACpC,MAAM,IAAI,GAAG,IAAI,6BAAc,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACvD,IAAA,+BAAgB,EACZ,IAAI,EACJ,IAAI,4BAAa,CAAC,sBAAsB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAA,2BAAY,EAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8CAA8C,CAAC,CACnJ,CAAC;YACF,yFAAyF;YACzF,sFAAsF;YACtF,qEAAqE;YACrE,IAAA,0CAAsB,EAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,IAAA,gCAAS,GAAE,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAE7B,IAAA,4BAAY,EAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,kGAAkG;IAClG,8EAA8E;IAC9E,IAAA,+BAAQ,EAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,2FAA2F;AAC3F,qGAAqG;AACrG,uGAAuG;AACvG,mGAAmG;AACnG,sGAAsG;AACtG,mGAAmG;AACnG,kGAAkG;AAClG,wGAAwG;AACxG,oGAAoG;AACpG,sGAAsG;AACtG,0CAA0C;AAC1C,0JAA0J;AAC1J,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,IAAc;IACxF,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAA,yBAAkB,EAAC,GAAG,CAAC;QAAE,OAAO;IACzD,IAAI,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAAE,IAAA,gCAAS,GAAE,CAAC;IAC5C,IAAA,+BAAQ,EAAC,IAAA,0BAAmB,EAAC,IAAA,gCAAyB,GAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,OAAO,CAAC,IAAc;IACxC,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,IAAA,gCAAS,GAAE,CAAC;QAAC,CAAC;QAC9B,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QAE7B,sFAAsF;QACtF,yFAAyF;QACzF,uFAAuF;QACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAEzC,iGAAiG;QACjG,8FAA8F;QAC9F,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAErF,4FAA4F;QAC5F,+FAA+F;QAC/F,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnB,IAAA,iCAAkB,EAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACrD,qFAAqF;gBACrF,iFAAiF;gBACjF,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,IAAA,gCAAS,GAAE,CAAC;QAChB,CAAC;QAED,wFAAwF;QACxF,8FAA8F;QAC9F,+FAA+F;QAC/F,0EAA0E;QAC1E,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACxH,IAAA,iCAAkB,EAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,qEAAqE;YACrE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAAC,IAAA,gCAAS,GAAE,CAAC;YAAC,CAAC;YACtC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,OAAO;QACX,CAAC;QAED,+EAA+E;QAC/E,8EAA8E;QAC9E,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,sFAAsF;QACtF,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,KAAK,YAAY,qBAAa,EAAE,CAAC;YACjC,IAAA,+BAAQ,EAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,KAAK,YAAY,qBAAa,EAAE,CAAC;YACxC,IAAA,+BAAQ,EAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,IAAA,+BAAQ,EAAC,0DAA0D,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClG,CAAC;IACL,CAAC;AACL,CAAC","sourcesContent":["import * as path from 'path';\n\nimport { run, runBash, runRead } from '../core/runner';\nimport { logRejection } from '../core/rejection-log';\nimport { logGuardDecision, GuardDecision, branchForLog, logGuardInvocation } from '../core/decision-log';\nimport { triggerMainSyncRefresh } from '../core/main-sync-refresh';\nimport { CONFIG_FILENAME } from '../core/load-config';\nimport { RepoRootFinder } from '@webpieces/rules-config';\nimport { NormalizedToolInput, NormalizedEdit, ToolKind, InformAiError, RuleFailError, HookMode, BlockedResult } from '../core/types';\nimport { toError } from '../core/to-error';\nimport { emitDeny, emitAllow } from './claude-code-response';\nimport { committedShimStale, isShimCureCommand, shimStaleDenyReason, installedShimRulesVersion } from '../bin/shim';\n\n// Which category of rules this hook invocation runs. The hook is split into two independently\n// installable PreToolUse hooks; each runs ONE category (the runner filters by it), and both can\n// receive file AND bash payloads:\n//  - 'rules'  → code-style rules (file/edit scope). Bash payloads pass through (no code rules apply).\n//  - 'guards' → hookGuards section: bash git/PR guards on Bash AND file guards (feature-branch-guard)\n//               on Write/Edit, PLUS a log-and-allow audit of Read. Matcher is Write|Edit|MultiEdit|Bash|Read.\n//  - 'all'    → both categories, used by the openclaw plugin adapter (a single before_tool_call hook).\nexport type { HookMode };\n\nconst HANDLED_FILE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);\n\n// Read-only tools carry NO guard or code rule, but the guards hook owns the per-invocation audit log\n// (guard-invocations.log). When the guards matcher includes these (see setup.ts GUARDS_HOOK), a\n// log-and-allow fast path records every file the AI opens — so a human can later inspect whether it\n// read a project's design.json BEFORE editing the project. Never blocked. Scoped to Read for now;\n// widen (Grep/Glob/NotebookRead) later if desired.\nconst READ_ONLY_TOOLS = new Set(['Read']);\n\ninterface ClaudeCodePayload {\n    tool_name: string;\n    tool_input: ClaudeCodeToolInput;\n    // Claude Code sends the session's current working directory (follows a persisted `cd`). Used to\n    // scope guards to the git repo the AI is actually in — see runner git-repo-boundary governance.\n    cwd?: string;\n}\n\ninterface ClaudeCodeToolInput {\n    file_path?: string;\n    content?: string;\n    old_string?: string;\n    new_string?: string;\n    edits?: ClaudeCodeEditEntry[];\n    command?: string;\n}\n\ninterface ClaudeCodeEditEntry {\n    old_string?: string;\n    new_string?: string;\n}\n\nfunction readStdin(): Promise<string> {\n    return new Promise((resolve: (value: string) => void) => {\n        let data = '';\n        process.stdin.setEncoding('utf8');\n        process.stdin.on('data', (chunk: string) => { data += chunk; });\n        process.stdin.on('end', () => resolve(data));\n        process.stdin.on('error', () => resolve(''));\n        if (process.stdin.isTTY) resolve('');\n    });\n}\n\nfunction safeParse(raw: string): ClaudeCodePayload | null {\n    if (!raw || raw.trim() === '') return null;\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        return JSON.parse(raw) as ClaudeCodePayload;\n    } catch (err: unknown) {\n        const error = toError(err);\n        throw new InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });\n    }\n}\n\nfunction normalizeToolKind(toolName: string): ToolKind | null {\n    if (HANDLED_FILE_TOOLS.has(toolName)) return toolName as ToolKind;\n    return null;\n}\n\nfunction normalizeToolInput(toolKind: ToolKind, toolInput: ClaudeCodeToolInput): NormalizedToolInput | null {\n    const filePath = toolInput.file_path;\n    if (!filePath) return null;\n\n    if (toolKind === 'Write') {\n        return new NormalizedToolInput(filePath, [\n            new NormalizedEdit('', toolInput.content || ''),\n        ]);\n    }\n    if (toolKind === 'Edit') {\n        return new NormalizedToolInput(filePath, [\n            new NormalizedEdit(toolInput.old_string || '', toolInput.new_string || ''),\n        ]);\n    }\n    if (toolKind === 'MultiEdit') {\n        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];\n        const edits = raw.map((e: ClaudeCodeEditEntry) => new NormalizedEdit(e.old_string || '', e.new_string || ''));\n        return new NormalizedToolInput(filePath, edits);\n    }\n    return null;\n}\n\nfunction handleBash(payload: ClaudeCodePayload, cwd: string, mode: HookMode): void {\n    const command = payload.tool_input.command;\n    if (!command || command.trim() === '') { emitAllow(); }\n    const result = runBash(command, cwd, mode);\n    if (!result) { emitAllow(); }\n    // Persist the block + WHY. File-tool denies go to hook-rejection.log via logRejection, but a Bash\n    // deny had no audit trail — record it in guard-sync-decisions.log so \"blocked and why\" is complete\n    // for Bash too. `.webpieces` lives at the repo root, resolved from cwd. Best-effort; never blocks.\n    const root = new RepoRootFinder().resolveRepoRoot(cwd);\n    logGuardDecision(root, new GuardDecision('bash-guard', 'Bash', command ?? '', branchForLog(root), 'BLOCK', result.report));\n    // Bash deny → pass 'Bash' so denyJson adds the ANSI-red systemMessage (the only field a Bash deny\n    // shows the human; permissionDecisionReason is invisible on Bash). See claude-code-response.ts.\n    emitDeny(result.report, 'Bash');\n}\n\n/**\n * The read-scoped guard pass. Returns normally to ALLOW; only calls emitDeny when the guard fires.\n *\n * Wrapped in its own catch that swallows into an allow. Every other path in this hook fails CLOSED,\n * and that is right for edits and shell commands — but a crash here would block the agent from\n * READING, which includes reading webpieces.config.json to turn the offending guard off. So this one\n * path deliberately inverts the policy: a broken read-guard degrades to a no-op, never to a wedge.\n */\n// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design\nfunction handleRead(filePath: string, cwd: string, mode: HookMode): void {\n    if (filePath === '') return;\n    let result: BlockedResult | null = null;\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        result = runRead(filePath, cwd, mode);\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n        return; // fail OPEN — see the doc comment\n    }\n    if (!result) return;\n    logRejection('Read', new NormalizedToolInput(filePath, []), result, cwd);\n    emitDeny(result.report, 'Read');\n}\n\nfunction handleFileTool(payload: ClaudeCodePayload, cwd: string, mode: HookMode): void {\n    const toolKind = normalizeToolKind(payload.tool_name);\n    if (!toolKind) { emitAllow(); }\n\n    const input = normalizeToolInput(toolKind, payload.tool_input);\n    if (!input) { emitAllow(); }\n\n    // Always allow edits to webpieces.config.json — it's the fix target when the config is broken.\n    // This exits BEFORE run(), so feature-branch-guard never sees a config edit; record that so the\n    // audit trail explains why a config edit on a bad branch was not blocked (see decision-log.ts).\n    if (path.basename(input.filePath) === CONFIG_FILENAME) {\n        if (mode !== 'rules') {\n            // `.webpieces/` (the decision log + sync cache these two calls write) lives at the repo\n            // root, not the AI's cwd — resolve it so a config edit from a subdir doesn't create a\n            // stray `<subdir>/.webpieces` tree.\n            const root = new RepoRootFinder().resolveRepoRoot(cwd);\n            logGuardDecision(\n                root,\n                new GuardDecision('feature-branch-guard', toolKind, input.filePath, branchForLog(root), 'ALLOW', 'config-bypass (feature-branch-guard skipped)'),\n            );\n            // The guard's own refresh trigger lives inside its check(), which we skip here — so warm\n            // the cache directly, otherwise a session that only edits webpieces.config.json never\n            // refreshes the sync status. Fire-and-forget; never blocks the edit.\n            triggerMainSyncRefresh(root);\n        }\n        emitAllow();\n    }\n\n    const result = run(toolKind, input, cwd, mode);\n    if (!result) { emitAllow(); }\n\n    logRejection(toolKind, input, result, cwd);\n    // File-tool deny → pass the Write/Edit/MultiEdit kind so denyJson omits systemMessage (the reason\n    // already renders red natively for these tools). See claude-code-response.ts.\n    emitDeny(result.report, toolKind);\n}\n\n// Committed-shim self-guard, moved here from the rendered shim (2026-07-24). The committed\n// .claude/webpieces/ai-hook.sh is webpieces-MANAGED and generated from renderShim(); if it no longer\n// matches, it was reverted / hand-edited / predates this binary, so its OWN fail-closed logic can't be\n// trusted. We are the CURRENT binary from node_modules — the trustworthy party — so WE decide here\n// instead of the (possibly stale) shim. It used to `cmp` itself inside the shim: a double-edged trap,\n// since the check lived in the very file it guarded and a fix could only ship by regenerating that\n// file. Now: fail closed on EVERY tool (Reads included — nothing is safe until it matches again),\n// allowing ONLY the three cures (isShimCureCommand) so the AI can re-arm it — NOT a deadlock. We deny +\n// tell the AI; we do NOT silently rewrite the file under it. 'rules' hook skips it (guards owns the\n// shim). `command` is '' for non-Bash tools, so only a Bash cure can match. Returns normally (nothing\n// to do) or exits via emitAllow/emitDeny.\n// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design\nfunction enforceCommittedShim(toolName: string, command: string, cwd: string, mode: HookMode): void {\n    if (mode === 'rules' || !committedShimStale(cwd)) return;\n    if (isShimCureCommand(command)) emitAllow();\n    emitDeny(shimStaleDenyReason(installedShimRulesVersion()), toolName);\n}\n\n/**\n * Shared entry point for all three Claude Code PreToolUse adapters. `mode` selects which tool kinds\n * to validate; payloads outside the mode's scope pass through (emitAllow). Blocks by emitting a\n * PreToolUse `permissionDecision:\"deny\"` JSON on stdout (exit 0) — see claude-code-response.ts. Fails\n * CLOSED on any unexpected crash (emits a deny) so a broken hook never silently lets an edit through,\n * and the reason now surfaces in the Claude Code UI instead of being hidden on a stderr+exit-2 block.\n */\nexport async function runMain(mode: HookMode): Promise<void> {\n    // Captured from the payload as soon as it parses so the fail-closed catch below can tell denyJson\n    // which tool it is denying — a crash on a Bash call still gets the visible red systemMessage, a\n    // crash on a file tool does not. Empty (before parse / malformed input) → treated as non-Bash.\n    let toolName = '';\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const raw = await readStdin();\n        const payload = safeParse(raw);\n        if (!payload) { emitAllow(); }\n        toolName = payload.tool_name;\n\n        // Prefer the payload cwd (the AI's actual working dir, follows a persisted `cd`) over\n        // process.cwd(); they match today, but the payload is the authoritative signal and stays\n        // correct if the hook is ever invoked from a fixed dir (e.g. via $CLAUDE_PROJECT_DIR).\n        const cwd = payload.cwd ?? process.cwd();\n\n        // Committed-shim self-guard (moved here from the shim, 2026-07-24). Runs BEFORE read handling so\n        // a stale shim blocks EVERY tool, Reads included — see enforceCommittedShim for the full why.\n        enforceCommittedShim(payload.tool_name, payload.tool_input.command ?? '', cwd, mode);\n\n        // Read-only tools (Read): audit-log, warm the main-sync cache, then run the ONE read-scoped\n        // guard (read-stale-guard) and allow. Runs BEFORE the general rule engine — no code-style rule\n        // ever sees a Read, and the only way this path can deny is a stale `main`.\n        // The audit trail still records every file the AI opened (see setup.ts).\n        if (READ_ONLY_TOOLS.has(payload.tool_name)) {\n            const readPath = payload.tool_input.file_path ?? '';\n            if (mode !== 'rules') {\n                logGuardInvocation(cwd, payload.tool_name, readPath);\n                // Reads vastly outnumber edits, so refreshing here is what actually keeps the shared\n                // main-sync cache warm for feature-branch-guard. Detached; never slows the read.\n                triggerMainSyncRefresh(cwd);\n            }\n            handleRead(readPath, cwd, mode);\n            emitAllow();\n        }\n\n        // Per-invocation guard log (guard-invocations.log): tool + command/file + live branch +\n        // main-sync-status snapshot, on EVERY guards call, for later cleanup automation. Best-effort;\n        // never blocks the call. (The committed shim is no longer silently healed here — a mismatch is\n        // reported by the self-guard above, not rewritten out from under the AI.)\n        if (mode !== 'rules') {\n            const target = payload.tool_name === 'Bash' ? (payload.tool_input.command ?? '') : (payload.tool_input.file_path ?? '');\n            logGuardInvocation(cwd, payload.tool_name, target);\n        }\n\n        if (payload.tool_name === 'Bash') {\n            // No code-style rule is bash-scoped, so the rules hook ignores Bash.\n            if (mode === 'rules') { emitAllow(); }\n            handleBash(payload, cwd, mode);\n            return;\n        }\n\n        // File payloads run in 'rules' (code-style), 'guards' (file-scoped guards like\n        // feature-branch-guard), and 'all'. The runner filters to the right category.\n        handleFileTool(payload, cwd, mode);\n    } catch (err: unknown) {\n        const error = toError(err);\n        // An escaped RuleFailError (a rule that threw past the runner's per-rule catch) or an\n        // InformAiError (bad config/stdin) both carry an AI-readable message; anything else is an\n        // unexpected bug. All three deny (fail closed) and surface their reason to the AI.\n        if (error instanceof RuleFailError) {\n            emitDeny(error.aiMessage, toolName);\n        } else if (error instanceof InformAiError) {\n            emitDeny(error.message, toolName);\n        } else {\n            emitDeny(`[ai-hooks] hook crashed unexpectedly — failing closed: ${error.message}`, toolName);\n        }\n    }\n}\n"]}
+{"version":3,"file":"hook-core.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/hook-core.ts"],"names":[],"mappings":";;AAiMA,8DAKC;AA4BD,0BAqEC;;AAvSD,mDAA6B;AAE7B,2CAAuD;AACvD,yDAAqD;AACrD,uDAAyG;AACzG,iEAAmE;AACnE,qDAAsD;AACtD,0DAAyD;AACzD,yCAAqI;AACrI,+CAA2C;AAC3C,iEAA6D;AAC7D,sCAAoH;AAWpH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAEnE,qGAAqG;AACrG,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,mDAAmD;AACnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAwB1C,SAAS,SAAS;IACd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAgC,EAAE,EAAE;QACpD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC1B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,8DAA8D;IAC9D,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAChD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,qBAAa,CAAC,gDAAgD,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/G,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAoB,CAAC;IAClE,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAkB,EAAE,SAA8B;IAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,IAAI,2BAAmB,CAAC,QAAQ,EAAE;YACrC,IAAI,sBAAc,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;SAClD,CAAC,CAAC;IACP,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,2BAAmB,CAAC,QAAQ,EAAE;YACrC,IAAI,sBAAc,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;SAC7E,CAAC,CAAC;IACP,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,IAAI,sBAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9G,OAAO,IAAI,2BAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B,EAAE,GAAW,EAAE,IAAc;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAA,gBAAO,EAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAC7B,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,MAAM,IAAI,GAAG,IAAI,6BAAc,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvD,IAAA,+BAAgB,EAAC,IAAI,EAAE,IAAI,4BAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,IAAA,2BAAY,EAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3H,kGAAkG;IAClG,gGAAgG;IAChG,IAAA,+BAAQ,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,0JAA0J;AAC1J,SAAS,UAAU,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAc;IAC7D,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO;IAC5B,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,GAAG,IAAA,gBAAO,EAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,KAAK,CAAC;QACX,OAAO,CAAC,kCAAkC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAA,4BAAY,EAAC,MAAM,EAAE,IAAI,2BAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzE,IAAA,+BAAQ,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B,EAAE,GAAW,EAAE,IAAc;IAC3E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAE5B,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,6BAAe,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACnB,wFAAwF;YACxF,sFAAsF;YACtF,oCAAoC;YACpC,MAAM,IAAI,GAAG,IAAI,6BAAc,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACvD,IAAA,+BAAgB,EACZ,IAAI,EACJ,IAAI,4BAAa,CAAC,sBAAsB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAA,2BAAY,EAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8CAA8C,CAAC,CACnJ,CAAC;YACF,yFAAyF;YACzF,sFAAsF;YACtF,qEAAqE;YACrE,IAAA,0CAAsB,EAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,IAAA,gCAAS,GAAE,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,IAAA,gCAAS,GAAE,CAAC;IAAC,CAAC;IAE7B,IAAA,4BAAY,EAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,kGAAkG;IAClG,8EAA8E;IAC9E,IAAA,+BAAQ,EAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC;AAeD,2JAA2J;AAC3J,SAAgB,yBAAyB,CAAC,QAAgB,EAAE,OAAe,EAAE,QAAgB;IACzF,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,CAAuB,8BAA8B;IACtG,IAAI,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC,CAAoB,mBAAmB;IAC3F,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,6BAAe;QAAE,OAAO,MAAM,CAAC,CAAS,iCAAiC;IACzG,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,qGAAqG;AACrG,uGAAuG;AACvG,mGAAmG;AACnG,sGAAsG;AACtG,mGAAmG;AACnG,6FAA6F;AAC7F,sGAAsG;AACtG,oGAAoG;AACpG,kFAAkF;AAClF,0JAA0J;AAC1J,SAAS,oBAAoB,CAAC,OAA0B,EAAE,GAAW,EAAE,IAAc;IACjF,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAA,yBAAkB,EAAC,GAAG,CAAC;QAAE,OAAO;IACzD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACpI,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO;IAChC,IAAI,QAAQ,KAAK,YAAY;QAAE,IAAA,gCAAS,GAAE,CAAC;IAC3C,IAAA,+BAAQ,EAAC,IAAA,0BAAmB,EAAC,IAAA,gCAAyB,GAAE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,OAAO,CAAC,IAAc;IACxC,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,IAAA,gCAAS,GAAE,CAAC;QAAC,CAAC;QAC9B,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QAE7B,sFAAsF;QACtF,yFAAyF;QACzF,uFAAuF;QACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAEzC,+FAA+F;QAC/F,wGAAwG;QACxG,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEzC,4FAA4F;QAC5F,+FAA+F;QAC/F,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnB,IAAA,iCAAkB,EAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACrD,qFAAqF;gBACrF,iFAAiF;gBACjF,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,IAAA,gCAAS,GAAE,CAAC;QAChB,CAAC;QAED,wFAAwF;QACxF,8FAA8F;QAC9F,+FAA+F;QAC/F,0EAA0E;QAC1E,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACxH,IAAA,iCAAkB,EAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,qEAAqE;YACrE,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAAC,IAAA,gCAAS,GAAE,CAAC;YAAC,CAAC;YACtC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,OAAO;QACX,CAAC;QAED,+EAA+E;QAC/E,8EAA8E;QAC9E,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,sFAAsF;QACtF,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,KAAK,YAAY,qBAAa,EAAE,CAAC;YACjC,IAAA,+BAAQ,EAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,KAAK,YAAY,qBAAa,EAAE,CAAC;YACxC,IAAA,+BAAQ,EAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACJ,IAAA,+BAAQ,EAAC,0DAA0D,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClG,CAAC;IACL,CAAC;AACL,CAAC","sourcesContent":["import * as path from 'path';\n\nimport { run, runBash, runRead } from '../core/runner';\nimport { logRejection } from '../core/rejection-log';\nimport { logGuardDecision, GuardDecision, branchForLog, logGuardInvocation } from '../core/decision-log';\nimport { triggerMainSyncRefresh } from '../core/main-sync-refresh';\nimport { CONFIG_FILENAME } from '../core/load-config';\nimport { RepoRootFinder } from '@webpieces/rules-config';\nimport { NormalizedToolInput, NormalizedEdit, ToolKind, InformAiError, RuleFailError, HookMode, BlockedResult } from '../core/types';\nimport { toError } from '../core/to-error';\nimport { emitDeny, emitAllow } from './claude-code-response';\nimport { committedShimStale, isShimCureCommand, shimStaleDenyReason, installedShimRulesVersion } from '../bin/shim';\n\n// Which category of rules this hook invocation runs. The hook is split into two independently\n// installable PreToolUse hooks; each runs ONE category (the runner filters by it), and both can\n// receive file AND bash payloads:\n//  - 'rules'  → code-style rules (file/edit scope). Bash payloads pass through (no code rules apply).\n//  - 'guards' → hookGuards section: bash git/PR guards on Bash AND file guards (feature-branch-guard)\n//               on Write/Edit, PLUS a log-and-allow audit of Read. Matcher is Write|Edit|MultiEdit|Bash|Read.\n//  - 'all'    → both categories, used by the openclaw plugin adapter (a single before_tool_call hook).\nexport type { HookMode };\n\nconst HANDLED_FILE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);\n\n// Read-only tools carry NO guard or code rule, but the guards hook owns the per-invocation audit log\n// (guard-invocations.log). When the guards matcher includes these (see setup.ts GUARDS_HOOK), a\n// log-and-allow fast path records every file the AI opens — so a human can later inspect whether it\n// read a project's design.json BEFORE editing the project. Never blocked. Scoped to Read for now;\n// widen (Grep/Glob/NotebookRead) later if desired.\nconst READ_ONLY_TOOLS = new Set(['Read']);\n\ninterface ClaudeCodePayload {\n    tool_name: string;\n    tool_input: ClaudeCodeToolInput;\n    // Claude Code sends the session's current working directory (follows a persisted `cd`). Used to\n    // scope guards to the git repo the AI is actually in — see runner git-repo-boundary governance.\n    cwd?: string;\n}\n\ninterface ClaudeCodeToolInput {\n    file_path?: string;\n    content?: string;\n    old_string?: string;\n    new_string?: string;\n    edits?: ClaudeCodeEditEntry[];\n    command?: string;\n}\n\ninterface ClaudeCodeEditEntry {\n    old_string?: string;\n    new_string?: string;\n}\n\nfunction readStdin(): Promise<string> {\n    return new Promise((resolve: (value: string) => void) => {\n        let data = '';\n        process.stdin.setEncoding('utf8');\n        process.stdin.on('data', (chunk: string) => { data += chunk; });\n        process.stdin.on('end', () => resolve(data));\n        process.stdin.on('error', () => resolve(''));\n        if (process.stdin.isTTY) resolve('');\n    });\n}\n\nfunction safeParse(raw: string): ClaudeCodePayload | null {\n    if (!raw || raw.trim() === '') return null;\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        return JSON.parse(raw) as ClaudeCodePayload;\n    } catch (err: unknown) {\n        const error = toError(err);\n        throw new InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });\n    }\n}\n\nfunction normalizeToolKind(toolName: string): ToolKind | null {\n    if (HANDLED_FILE_TOOLS.has(toolName)) return toolName as ToolKind;\n    return null;\n}\n\nfunction normalizeToolInput(toolKind: ToolKind, toolInput: ClaudeCodeToolInput): NormalizedToolInput | null {\n    const filePath = toolInput.file_path;\n    if (!filePath) return null;\n\n    if (toolKind === 'Write') {\n        return new NormalizedToolInput(filePath, [\n            new NormalizedEdit('', toolInput.content || ''),\n        ]);\n    }\n    if (toolKind === 'Edit') {\n        return new NormalizedToolInput(filePath, [\n            new NormalizedEdit(toolInput.old_string || '', toolInput.new_string || ''),\n        ]);\n    }\n    if (toolKind === 'MultiEdit') {\n        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];\n        const edits = raw.map((e: ClaudeCodeEditEntry) => new NormalizedEdit(e.old_string || '', e.new_string || ''));\n        return new NormalizedToolInput(filePath, edits);\n    }\n    return null;\n}\n\nfunction handleBash(payload: ClaudeCodePayload, cwd: string, mode: HookMode): void {\n    const command = payload.tool_input.command;\n    if (!command || command.trim() === '') { emitAllow(); }\n    const result = runBash(command, cwd, mode);\n    if (!result) { emitAllow(); }\n    // Persist the block + WHY. File-tool denies go to hook-rejection.log via logRejection, but a Bash\n    // deny had no audit trail — record it in guard-sync-decisions.log so \"blocked and why\" is complete\n    // for Bash too. `.webpieces` lives at the repo root, resolved from cwd. Best-effort; never blocks.\n    const root = new RepoRootFinder().resolveRepoRoot(cwd);\n    logGuardDecision(root, new GuardDecision('bash-guard', 'Bash', command ?? '', branchForLog(root), 'BLOCK', result.report));\n    // Bash deny → pass 'Bash' so denyJson adds the ANSI-red systemMessage (the only field a Bash deny\n    // shows the human; permissionDecisionReason is invisible on Bash). See claude-code-response.ts.\n    emitDeny(result.report, 'Bash');\n}\n\n/**\n * The read-scoped guard pass. Returns normally to ALLOW; only calls emitDeny when the guard fires.\n *\n * Wrapped in its own catch that swallows into an allow. Every other path in this hook fails CLOSED,\n * and that is right for edits and shell commands — but a crash here would block the agent from\n * READING, which includes reading webpieces.config.json to turn the offending guard off. So this one\n * path deliberately inverts the policy: a broken read-guard degrades to a no-op, never to a wedge.\n */\n// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design\nfunction handleRead(filePath: string, cwd: string, mode: HookMode): void {\n    if (filePath === '') return;\n    let result: BlockedResult | null = null;\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        result = runRead(filePath, cwd, mode);\n    } catch (err: unknown) {\n        const error = toError(err);\n        void error;\n        return; // fail OPEN — see the doc comment\n    }\n    if (!result) return;\n    logRejection('Read', new NormalizedToolInput(filePath, []), result, cwd);\n    emitDeny(result.report, 'Read');\n}\n\nfunction handleFileTool(payload: ClaudeCodePayload, cwd: string, mode: HookMode): void {\n    const toolKind = normalizeToolKind(payload.tool_name);\n    if (!toolKind) { emitAllow(); }\n\n    const input = normalizeToolInput(toolKind, payload.tool_input);\n    if (!input) { emitAllow(); }\n\n    // Always allow edits to webpieces.config.json — it's the fix target when the config is broken.\n    // This exits BEFORE run(), so feature-branch-guard never sees a config edit; record that so the\n    // audit trail explains why a config edit on a bad branch was not blocked (see decision-log.ts).\n    if (path.basename(input.filePath) === CONFIG_FILENAME) {\n        if (mode !== 'rules') {\n            // `.webpieces/` (the decision log + sync cache these two calls write) lives at the repo\n            // root, not the AI's cwd — resolve it so a config edit from a subdir doesn't create a\n            // stray `<subdir>/.webpieces` tree.\n            const root = new RepoRootFinder().resolveRepoRoot(cwd);\n            logGuardDecision(\n                root,\n                new GuardDecision('feature-branch-guard', toolKind, input.filePath, branchForLog(root), 'ALLOW', 'config-bypass (feature-branch-guard skipped)'),\n            );\n            // The guard's own refresh trigger lives inside its check(), which we skip here — so warm\n            // the cache directly, otherwise a session that only edits webpieces.config.json never\n            // refreshes the sync status. Fire-and-forget; never blocks the edit.\n            triggerMainSyncRefresh(root);\n        }\n        emitAllow();\n    }\n\n    const result = run(toolKind, input, cwd, mode);\n    if (!result) { emitAllow(); }\n\n    logRejection(toolKind, input, result, cwd);\n    // File-tool deny → pass the Write/Edit/MultiEdit kind so denyJson omits systemMessage (the reason\n    // already renders red natively for these tools). See claude-code-response.ts.\n    emitDeny(result.report, toolKind);\n}\n\n// What a stale committed shim lets through. Pure (no cwd / no emit) so it is unit-testable — the\n// RECOVERY carve-out is the load-bearing part. A stale shim must NEVER trap the actions needed to\n// recover: the original \"block everything but the cures\" version also shadowed the always-allowed\n// webpieces.config.json edit (handleFileTool) and blocked reads, so a repo that ALSO needed its config\n// fixed would deadlock — blocked from editing the one file whose edit is normally always allowed, and\n// blocked from reading it to know how. So on a stale shim we block real WORK but keep recovery open:\n//   - 'allow-cure' → a Bash shim cure (wp-install-ai-hooks / wp-upgrade-shim / cp): emitAllow directly,\n//                    bypassing the git guards, exactly as the old shim did for the cures.\n//   - 'pass'       → a recovery action the normal flow already permits, so fall THROUGH and let it: ANY\n//                    Read (you must read to know how to fix — see handleRead, which itself fails open),\n//                    or an edit to webpieces.config.json (the always-allowed recovery target).\n//   - 'deny'       → all OTHER work: blocked until the committed shim matches renderShim() again.\nexport type ShimStaleDecision = 'allow-cure' | 'pass' | 'deny';\n// webpieces-disable no-function-outside-class -- pure decision helper beside the adapter's other module-scope functions; exported for direct unit testing.\nexport function shimStaleRecoveryDecision(toolName: string, command: string, filePath: string): ShimStaleDecision {\n    if (READ_ONLY_TOOLS.has(toolName)) return 'pass';                       // any read: needed to recover\n    if (isShimCureCommand(command)) return 'allow-cure';                    // a Bash shim cure\n    if (path.basename(filePath) === CONFIG_FILENAME) return 'pass';         // the always-allowed config edit\n    return 'deny';\n}\n\n// Committed-shim self-guard, moved here from the rendered shim (2026-07-24). The committed\n// .claude/webpieces/ai-hook.sh is webpieces-MANAGED and generated from renderShim(); if it no longer\n// matches, it was reverted / hand-edited / predates this binary, so its OWN fail-closed logic can't be\n// trusted. We are the CURRENT binary from node_modules — the trustworthy party — so WE decide here\n// instead of the (possibly stale) shim. It used to `cmp` itself inside the shim: a double-edged trap,\n// since the check lived in the very file it guarded and a fix could only ship by regenerating that\n// file. Now we fail closed on all real WORK while always leaving the recovery path open (see\n// shimStaleRecoveryDecision): the three cures, any Read, and editing webpieces.config.json. We deny +\n// tell the AI; we do NOT silently rewrite the file under it. 'rules' hook skips it (guards owns the\n// shim). Returns normally (pass / nothing to do) or exits via emitAllow/emitDeny.\n// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design\nfunction enforceCommittedShim(payload: ClaudeCodePayload, cwd: string, mode: HookMode): void {\n    if (mode === 'rules' || !committedShimStale(cwd)) return;\n    const decision = shimStaleRecoveryDecision(payload.tool_name, payload.tool_input.command ?? '', payload.tool_input.file_path ?? '');\n    if (decision === 'pass') return;\n    if (decision === 'allow-cure') emitAllow();\n    emitDeny(shimStaleDenyReason(installedShimRulesVersion()), payload.tool_name);\n}\n\n/**\n * Shared entry point for all three Claude Code PreToolUse adapters. `mode` selects which tool kinds\n * to validate; payloads outside the mode's scope pass through (emitAllow). Blocks by emitting a\n * PreToolUse `permissionDecision:\"deny\"` JSON on stdout (exit 0) — see claude-code-response.ts. Fails\n * CLOSED on any unexpected crash (emits a deny) so a broken hook never silently lets an edit through,\n * and the reason now surfaces in the Claude Code UI instead of being hidden on a stderr+exit-2 block.\n */\nexport async function runMain(mode: HookMode): Promise<void> {\n    // Captured from the payload as soon as it parses so the fail-closed catch below can tell denyJson\n    // which tool it is denying — a crash on a Bash call still gets the visible red systemMessage, a\n    // crash on a file tool does not. Empty (before parse / malformed input) → treated as non-Bash.\n    let toolName = '';\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const raw = await readStdin();\n        const payload = safeParse(raw);\n        if (!payload) { emitAllow(); }\n        toolName = payload.tool_name;\n\n        // Prefer the payload cwd (the AI's actual working dir, follows a persisted `cd`) over\n        // process.cwd(); they match today, but the payload is the authoritative signal and stays\n        // correct if the hook is ever invoked from a fixed dir (e.g. via $CLAUDE_PROJECT_DIR).\n        const cwd = payload.cwd ?? process.cwd();\n\n        // Committed-shim self-guard: blocks real work while the committed shim is stale, but keeps the\n        // recovery path open (cures, reads, config edit). See enforceCommittedShim / shimStaleRecoveryDecision.\n        enforceCommittedShim(payload, cwd, mode);\n\n        // Read-only tools (Read): audit-log, warm the main-sync cache, then run the ONE read-scoped\n        // guard (read-stale-guard) and allow. Runs BEFORE the general rule engine — no code-style rule\n        // ever sees a Read, and the only way this path can deny is a stale `main`.\n        // The audit trail still records every file the AI opened (see setup.ts).\n        if (READ_ONLY_TOOLS.has(payload.tool_name)) {\n            const readPath = payload.tool_input.file_path ?? '';\n            if (mode !== 'rules') {\n                logGuardInvocation(cwd, payload.tool_name, readPath);\n                // Reads vastly outnumber edits, so refreshing here is what actually keeps the shared\n                // main-sync cache warm for feature-branch-guard. Detached; never slows the read.\n                triggerMainSyncRefresh(cwd);\n            }\n            handleRead(readPath, cwd, mode);\n            emitAllow();\n        }\n\n        // Per-invocation guard log (guard-invocations.log): tool + command/file + live branch +\n        // main-sync-status snapshot, on EVERY guards call, for later cleanup automation. Best-effort;\n        // never blocks the call. (The committed shim is no longer silently healed here — a mismatch is\n        // reported by the self-guard above, not rewritten out from under the AI.)\n        if (mode !== 'rules') {\n            const target = payload.tool_name === 'Bash' ? (payload.tool_input.command ?? '') : (payload.tool_input.file_path ?? '');\n            logGuardInvocation(cwd, payload.tool_name, target);\n        }\n\n        if (payload.tool_name === 'Bash') {\n            // No code-style rule is bash-scoped, so the rules hook ignores Bash.\n            if (mode === 'rules') { emitAllow(); }\n            handleBash(payload, cwd, mode);\n            return;\n        }\n\n        // File payloads run in 'rules' (code-style), 'guards' (file-scoped guards like\n        // feature-branch-guard), and 'all'. The runner filters to the right category.\n        handleFileTool(payload, cwd, mode);\n    } catch (err: unknown) {\n        const error = toError(err);\n        // An escaped RuleFailError (a rule that threw past the runner's per-rule catch) or an\n        // InformAiError (bad config/stdin) both carry an AI-readable message; anything else is an\n        // unexpected bug. All three deny (fail closed) and surface their reason to the AI.\n        if (error instanceof RuleFailError) {\n            emitDeny(error.aiMessage, toolName);\n        } else if (error instanceof InformAiError) {\n            emitDeny(error.message, toolName);\n        } else {\n            emitDeny(`[ai-hooks] hook crashed unexpectedly — failing closed: ${error.message}`, toolName);\n        }\n    }\n}\n"]}