@webpieces/ai-hook-rules 0.4.509 → 0.4.510

package/src/core/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/types.ts"],"names":[],"mappings":";;;AAGA,wDAAwH;AAA/G,8GAAA,cAAc,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAe,6GAAA,aAAa,OAAA;AAAE,6GAAA,aAAa,OAAA;AAetF,MAAa,SAAS;IACT,IAAI,CAAS;IACb,OAAO,CAAS;IACzB,yFAAyF;IACzF,yFAAyF;IACzF,iEAAiE;IACxD,OAAO,CAAqB;IACrC,SAAS,CAAqB;IAC9B,SAAS,CAAqB;IAE9B,YAAY,IAAY,EAAE,OAAe,EAAE,OAAgB;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AAjBD,8BAiBC;AAED,MAAa,cAAc;IACd,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,SAAiB,EAAE,SAAiB;QAC5C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AARD,wCAQC;AAED,MAAa,mBAAmB;IACnB,QAAQ,CAAS;IACjB,KAAK,CAA4B;IAE1C,YAAY,QAAgB,EAAE,KAAgC;QAC1D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AARD,kDAQC;AAED,MAAa,mBAAmB;IACnB,OAAO,CAAS;IAEzB,YAAY,OAAe;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;CACJ;AAND,kDAMC;AAED,MAAa,WAAW;IACX,IAAI,CAAW;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,KAAK,CAAoB;IACzB,aAAa,CAAoB;IACjC,cAAc,CAAS;IACvB,cAAc,CAAiB;IACxC,OAAO,CAAc;IAErB,YACI,IAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,aAAqB,EACrB,YAAoB,EACpB,eAAuB,EACvB,KAAwB,EACxB,aAAgC,EAChC,cAAsB,EACtB,cAA8B;QAE9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;CACJ;AA3CD,kCA2CC;AAED,sFAAsF;AACtF,MAAM,YAAY,GAAG,2CAA2C,CAAC;AAEjE,mCAAmC;AACnC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C,MAAa,WAAW;IACX,IAAI,CAAS;IACb,OAAO,CAAS;IACzB;;;;;;;;;;;;;;;OAeG;IACM,WAAW,CAAS;IACpB,aAAa,CAAS;IAC/B,OAAO,CAAc;IAErB,YAAY,OAAe,EAAE,aAAqB;QAC9C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,kGAAkG;IAClG,4FAA4F;IACpF,UAAU,CAAC,OAAe;QAC9B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAa,EAAE,MAAe,EAAE,MAAe,EAAU,EAAE;YACpG,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,IAAI,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAxCD,kCAwCC;AAED,MAAa,WAAW;IACX,IAAI,CAAW;IACf,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IACzB,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,kBAAkB,CAAS;IACpC,OAAO,CAAc;IAErB,YACI,IAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,aAAqB,EACrB,gBAAwB,EACxB,UAAkB,EAClB,YAAoB,EACpB,kBAA0B;QAE1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;CACJ;AA/BD,kCA+BC;AAyBD,MAAa,SAAS;IACT,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,OAAO,CAAU;IACjB,UAAU,CAAuB;IAE1C,YACI,QAAgB,EAChB,eAAuB,EACvB,OAAgB,EAChB,UAAgC;QAEhC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;CACJ;AAjBD,8BAiBC;AAED,MAAa,aAAa;IACb,MAAM,CAAS;IAExB,YAAY,MAAc;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;CACJ;AAND,sCAMC","sourcesContent":["// ResolvedConfig / ResolvedRuleConfig / RuleOptions now live in @webpieces/rules-config\n// so ai-hooks and the Nx validate-code executor share one loader and one config file.\nimport { RuleOptions } from '@webpieces/rules-config';\nexport { ResolvedConfig, ResolvedRuleConfig, RuleOptions, InformAiError, RuleFailError } from '@webpieces/rules-config';\nimport { FixHint } from './fix-hint';\n\n// 'Read' is a first-class member because read-stale-guard is a file-scoped guard that runs on the\n// Read fast path. It is deliberately NOT in HANDLED_FILE_TOOLS (hook-core), so normalizeToolKind()\n// still returns null for it and Read never enters the edit/file rule pipeline — only the one guard\n// that asks for it. Nothing switches exhaustively on this union; it is carried for logging.\nexport type ToolKind = 'Write' | 'Edit' | 'MultiEdit' | 'Read';\nexport type RuleScope = 'edit' | 'file' | 'bash';\n// Which category of built-in rules a hook invocation runs: code-style 'rules', git/PR/branch\n// 'guards' (the hookGuards section), or 'all' (both categories — used by the openclaw plugin adapter,\n// which is a single before_tool_call hook rather than two split PreToolUse hooks).\nexport type HookMode = 'rules' | 'guards' | 'all';\nexport type IsLineDisabled = (lineNum: number, ruleName: string) => boolean;\n\nexport class Violation {\n    readonly line: number;\n    readonly snippet: string;\n    // Optional per-occurrence override for the `→` line. When omitted, the report falls back\n    // to the rule's `FixHint.violation`. Dynamic rules (param name, line count, marker path,\n    // branch/PR) pass a specific message here; static rules omit it.\n    readonly message: string | undefined;\n    editIndex: number | undefined;\n    editCount: number | undefined;\n\n    constructor(line: number, snippet: string, message?: string) {\n        this.line = line;\n        this.snippet = snippet;\n        this.message = message;\n        this.editIndex = undefined;\n        this.editCount = undefined;\n    }\n}\n\nexport class NormalizedEdit {\n    readonly oldString: string;\n    readonly newString: string;\n\n    constructor(oldString: string, newString: string) {\n        this.oldString = oldString;\n        this.newString = newString;\n    }\n}\n\nexport class NormalizedToolInput {\n    readonly filePath: string;\n    readonly edits: readonly NormalizedEdit[];\n\n    constructor(filePath: string, edits: readonly NormalizedEdit[]) {\n        this.filePath = filePath;\n        this.edits = edits;\n    }\n}\n\nexport class NormalizedBashInput {\n    readonly command: string;\n\n    constructor(command: string) {\n        this.command = command;\n    }\n}\n\nexport class EditContext {\n    readonly tool: ToolKind;\n    readonly editIndex: number;\n    readonly editCount: number;\n    readonly filePath: string;\n    readonly relativePath: string;\n    readonly workspaceRoot: string;\n    readonly addedContent: string;\n    readonly strippedContent: string;\n    readonly lines: readonly string[];\n    readonly strippedLines: readonly string[];\n    readonly removedContent: string;\n    readonly isLineDisabled: IsLineDisabled;\n    options: RuleOptions;\n\n    constructor(\n        tool: ToolKind,\n        editIndex: number,\n        editCount: number,\n        filePath: string,\n        relativePath: string,\n        workspaceRoot: string,\n        addedContent: string,\n        strippedContent: string,\n        lines: readonly string[],\n        strippedLines: readonly string[],\n        removedContent: string,\n        isLineDisabled: IsLineDisabled,\n    ) {\n        this.tool = tool;\n        this.editIndex = editIndex;\n        this.editCount = editCount;\n        this.filePath = filePath;\n        this.relativePath = relativePath;\n        this.workspaceRoot = workspaceRoot;\n        this.addedContent = addedContent;\n        this.strippedContent = strippedContent;\n        this.lines = lines;\n        this.strippedLines = strippedLines;\n        this.removedContent = removedContent;\n        this.isLineDisabled = isLineDisabled;\n        this.options = {};\n    }\n}\n\n// A heredoc and its body: `<<EOF` / `<<'EOF'` / `<<-EOF` through the terminator line.\nconst HEREDOC_BODY = /<<-?\\s*(['\"]?)(\\w+)\\1[\\s\\S]*?^\\t*\\2\\s*$/gm;\n\n// A single- or double-quoted span.\nconst QUOTED_SPAN = /'([^']*)'|\"([^\"]*)\"/g;\n\nexport class BashContext {\n    readonly tool: 'Bash';\n    readonly command: string;\n    /**\n     * `command` with heredoc bodies and prose-in-quotes removed — what a guard should MATCH on, while\n     * `command` stays raw for the violation message (a human needs to see what they actually typed).\n     *\n     * A commit message that merely MENTIONS a blocked command is not that command. This repo's whole\n     * subject matter is the git workflow, so its commit messages, docs and the guards' own fix-hint\n     * text are full of `git push` / `gh pr …` strings; matching raw text blocks writing about the\n     * tooling. A guard that cries wolf is a guard someone eventually turns OFF, which costs far more\n     * than the theoretical bypass this opens (`sh -c '<blocked command>'` stops matching). That trade\n     * is deliberate: these guards exist to catch a FORGETFUL agent, not an adversarial one.\n     *\n     * ONLY for blocklist-shaped guards (\"if the command matches X, block\"), where stripping can only\n     * ever block LESS. Never use it in an allowlist-shaped guard such as merged-branch-bash-guard,\n     * where stripping could turn a permitted recovery command into a blocked one and deadlock the\n     * session — there, match on the raw `command`.\n     */\n    readonly commandCode: string;\n    readonly workspaceRoot: string;\n    options: RuleOptions;\n\n    constructor(command: string, workspaceRoot: string) {\n        this.tool = 'Bash';\n        this.command = command;\n        this.commandCode = this.stripProse(command);\n        this.workspaceRoot = workspaceRoot;\n        this.options = {};\n    }\n\n    // A quoted span WITHOUT whitespace is kept: `git checkout \"main\"` is a real command with a quoted\n    // argument, not prose. One containing whitespace is a sentence, and becomes a single space.\n    private stripProse(command: string): string {\n        const withoutHeredocs = command.replace(HEREDOC_BODY, ' ');\n        return withoutHeredocs.replace(QUOTED_SPAN, (match: string, single?: string, double?: string): string => {\n            const content = single ?? double ?? '';\n            return /\\s/.test(content) ? ' ' : content;\n        });\n    }\n}\n\nexport class FileContext {\n    readonly tool: ToolKind;\n    readonly filePath: string;\n    readonly relativePath: string;\n    readonly workspaceRoot: string;\n    readonly currentFileLines: number;\n    readonly linesAdded: number;\n    readonly linesRemoved: number;\n    readonly projectedFileLines: number;\n    options: RuleOptions;\n\n    constructor(\n        tool: ToolKind,\n        filePath: string,\n        relativePath: string,\n        workspaceRoot: string,\n        currentFileLines: number,\n        linesAdded: number,\n        linesRemoved: number,\n        projectedFileLines: number,\n    ) {\n        this.tool = tool;\n        this.filePath = filePath;\n        this.relativePath = relativePath;\n        this.workspaceRoot = workspaceRoot;\n        this.currentFileLines = currentFileLines;\n        this.linesAdded = linesAdded;\n        this.linesRemoved = linesRemoved;\n        this.projectedFileLines = projectedFileLines;\n        this.options = {};\n    }\n}\n\n/**\n * The shape of a custom rule loaded from a `rulesDir` (a plain object returned by require()).\n * It carries only metadata + a `check` method — no on/off logic of its own.\n */\nexport interface PlainRule {\n    readonly name: string;\n    readonly description: string;\n    readonly scope: RuleScope;\n    readonly files: readonly string[];\n    readonly defaultOptions: RuleOptions;\n    readonly fixHint: FixHint;\n    check(ctx: EditContext | FileContext | BashContext): readonly Violation[];\n}\n\n/**\n * The runtime contract the runner iterates. Both the built-in rule classes (which extend\n * EditRuleBase/FileRuleBase/BashRuleBase) and the custom-rule adapter satisfy this: they add\n * `shouldRun()` (mode + escape-hatch decision) on top of the PlainRule metadata.\n */\nexport interface Rule extends PlainRule {\n    shouldRun(): boolean;\n}\n\nexport class RuleGroup {\n    readonly ruleName: string;\n    readonly ruleDescription: string;\n    readonly fixHint: FixHint;\n    readonly violations: readonly Violation[];\n\n    constructor(\n        ruleName: string,\n        ruleDescription: string,\n        fixHint: FixHint,\n        violations: readonly Violation[],\n    ) {\n        this.ruleName = ruleName;\n        this.ruleDescription = ruleDescription;\n        this.fixHint = fixHint;\n        this.violations = violations;\n    }\n}\n\nexport class BlockedResult {\n    readonly report: string;\n\n    constructor(report: string) {\n        this.report = report;\n    }\n}\n\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/core/types.ts"],"names":[],"mappings":";;;AAGA,wDAAwH;AAA/G,8GAAA,cAAc,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAe,6GAAA,aAAa,OAAA;AAAE,6GAAA,aAAa,OAAA;AAetF,MAAa,SAAS;IACT,IAAI,CAAS;IACb,OAAO,CAAS;IACzB,yFAAyF;IACzF,yFAAyF;IACzF,iEAAiE;IACxD,OAAO,CAAqB;IACrC,SAAS,CAAqB;IAC9B,SAAS,CAAqB;IAE9B,YAAY,IAAY,EAAE,OAAe,EAAE,OAAgB;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AAjBD,8BAiBC;AAED,MAAa,cAAc;IACd,SAAS,CAAS;IAClB,SAAS,CAAS;IAE3B,YAAY,SAAiB,EAAE,SAAiB;QAC5C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AARD,wCAQC;AAED,MAAa,mBAAmB;IACnB,QAAQ,CAAS;IACjB,KAAK,CAA4B;IAE1C,YAAY,QAAgB,EAAE,KAAgC;QAC1D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AARD,kDAQC;AAED,MAAa,mBAAmB;IACnB,OAAO,CAAS;IAEzB,YAAY,OAAe;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;CACJ;AAND,kDAMC;AAED,MAAa,WAAW;IACX,IAAI,CAAW;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,KAAK,CAAoB;IACzB,aAAa,CAAoB;IACjC,cAAc,CAAS;IACvB,cAAc,CAAiB;IACxC,OAAO,CAAc;IAErB,YACI,IAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,aAAqB,EACrB,YAAoB,EACpB,eAAuB,EACvB,KAAwB,EACxB,aAAgC,EAChC,cAAsB,EACtB,cAA8B;QAE9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;CACJ;AA3CD,kCA2CC;AAED,sFAAsF;AACtF,MAAM,YAAY,GAAG,2CAA2C,CAAC;AAEjE,mCAAmC;AACnC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C,MAAa,WAAW;IACX,IAAI,CAAS;IACb,OAAO,CAAS;IACzB;;;;;;;;;;;;;;;OAeG;IACM,WAAW,CAAS;IAC7B;;;;;;OAMG;IACM,aAAa,CAAS;IAC/B,iGAAiG;IACxF,YAAY,CAAS;IAC9B,+FAA+F;IACtF,YAAY,CAAS;IAC9B,OAAO,CAAc;IAErB,YAAY,OAAe,EAAE,aAAqB,EAAE,YAAqB,EAAE,YAAqB;QAC5F,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,aAAa,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,aAAa,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,kGAAkG;IAClG,4FAA4F;IACpF,UAAU,CAAC,OAAe;QAC9B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAa,EAAE,MAAe,EAAE,MAAe,EAAU,EAAE;YACpG,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,IAAI,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AArDD,kCAqDC;AAED,MAAa,WAAW;IACX,IAAI,CAAW;IACf,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IACzB,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,kBAAkB,CAAS;IACpC,OAAO,CAAc;IAErB,YACI,IAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,aAAqB,EACrB,gBAAwB,EACxB,UAAkB,EAClB,YAAoB,EACpB,kBAA0B;QAE1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;CACJ;AA/BD,kCA+BC;AAyBD,MAAa,SAAS;IACT,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,OAAO,CAAU;IACjB,UAAU,CAAuB;IAE1C,YACI,QAAgB,EAChB,eAAuB,EACvB,OAAgB,EAChB,UAAgC;QAEhC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;CACJ;AAjBD,8BAiBC;AAED,MAAa,aAAa;IACb,MAAM,CAAS;IAExB,YAAY,MAAc;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;CACJ;AAND,sCAMC","sourcesContent":["// ResolvedConfig / ResolvedRuleConfig / RuleOptions now live in @webpieces/rules-config\n// so ai-hooks and the Nx validate-code executor share one loader and one config file.\nimport { RuleOptions } from '@webpieces/rules-config';\nexport { ResolvedConfig, ResolvedRuleConfig, RuleOptions, InformAiError, RuleFailError } from '@webpieces/rules-config';\nimport { FixHint } from './fix-hint';\n\n// 'Read' is a first-class member because read-stale-guard is a file-scoped guard that runs on the\n// Read fast path. It is deliberately NOT in HANDLED_FILE_TOOLS (hook-core), so normalizeToolKind()\n// still returns null for it and Read never enters the edit/file rule pipeline — only the one guard\n// that asks for it. Nothing switches exhaustively on this union; it is carried for logging.\nexport type ToolKind = 'Write' | 'Edit' | 'MultiEdit' | 'Read';\nexport type RuleScope = 'edit' | 'file' | 'bash';\n// Which category of built-in rules a hook invocation runs: code-style 'rules', git/PR/branch\n// 'guards' (the hookGuards section), or 'all' (both categories — used by the openclaw plugin adapter,\n// which is a single before_tool_call hook rather than two split PreToolUse hooks).\nexport type HookMode = 'rules' | 'guards' | 'all';\nexport type IsLineDisabled = (lineNum: number, ruleName: string) => boolean;\n\nexport class Violation {\n    readonly line: number;\n    readonly snippet: string;\n    // Optional per-occurrence override for the `→` line. When omitted, the report falls back\n    // to the rule's `FixHint.violation`. Dynamic rules (param name, line count, marker path,\n    // branch/PR) pass a specific message here; static rules omit it.\n    readonly message: string | undefined;\n    editIndex: number | undefined;\n    editCount: number | undefined;\n\n    constructor(line: number, snippet: string, message?: string) {\n        this.line = line;\n        this.snippet = snippet;\n        this.message = message;\n        this.editIndex = undefined;\n        this.editCount = undefined;\n    }\n}\n\nexport class NormalizedEdit {\n    readonly oldString: string;\n    readonly newString: string;\n\n    constructor(oldString: string, newString: string) {\n        this.oldString = oldString;\n        this.newString = newString;\n    }\n}\n\nexport class NormalizedToolInput {\n    readonly filePath: string;\n    readonly edits: readonly NormalizedEdit[];\n\n    constructor(filePath: string, edits: readonly NormalizedEdit[]) {\n        this.filePath = filePath;\n        this.edits = edits;\n    }\n}\n\nexport class NormalizedBashInput {\n    readonly command: string;\n\n    constructor(command: string) {\n        this.command = command;\n    }\n}\n\nexport class EditContext {\n    readonly tool: ToolKind;\n    readonly editIndex: number;\n    readonly editCount: number;\n    readonly filePath: string;\n    readonly relativePath: string;\n    readonly workspaceRoot: string;\n    readonly addedContent: string;\n    readonly strippedContent: string;\n    readonly lines: readonly string[];\n    readonly strippedLines: readonly string[];\n    readonly removedContent: string;\n    readonly isLineDisabled: IsLineDisabled;\n    options: RuleOptions;\n\n    constructor(\n        tool: ToolKind,\n        editIndex: number,\n        editCount: number,\n        filePath: string,\n        relativePath: string,\n        workspaceRoot: string,\n        addedContent: string,\n        strippedContent: string,\n        lines: readonly string[],\n        strippedLines: readonly string[],\n        removedContent: string,\n        isLineDisabled: IsLineDisabled,\n    ) {\n        this.tool = tool;\n        this.editIndex = editIndex;\n        this.editCount = editCount;\n        this.filePath = filePath;\n        this.relativePath = relativePath;\n        this.workspaceRoot = workspaceRoot;\n        this.addedContent = addedContent;\n        this.strippedContent = strippedContent;\n        this.lines = lines;\n        this.strippedLines = strippedLines;\n        this.removedContent = removedContent;\n        this.isLineDisabled = isLineDisabled;\n        this.options = {};\n    }\n}\n\n// A heredoc and its body: `<<EOF` / `<<'EOF'` / `<<-EOF` through the terminator line.\nconst HEREDOC_BODY = /<<-?\\s*(['\"]?)(\\w+)\\1[\\s\\S]*?^\\t*\\2\\s*$/gm;\n\n// A single- or double-quoted span.\nconst QUOTED_SPAN = /'([^']*)'|\"([^\"]*)\"/g;\n\nexport class BashContext {\n    readonly tool: 'Bash';\n    readonly command: string;\n    /**\n     * `command` with heredoc bodies and prose-in-quotes removed — what a guard should MATCH on, while\n     * `command` stays raw for the violation message (a human needs to see what they actually typed).\n     *\n     * A commit message that merely MENTIONS a blocked command is not that command. This repo's whole\n     * subject matter is the git workflow, so its commit messages, docs and the guards' own fix-hint\n     * text are full of `git push` / `gh pr …` strings; matching raw text blocks writing about the\n     * tooling. A guard that cries wolf is a guard someone eventually turns OFF, which costs far more\n     * than the theoretical bypass this opens (`sh -c '<blocked command>'` stops matching). That trade\n     * is deliberate: these guards exist to catch a FORGETFUL agent, not an adversarial one.\n     *\n     * ONLY for blocklist-shaped guards (\"if the command matches X, block\"), where stripping can only\n     * ever block LESS. Never use it in an allowlist-shaped guard such as merged-branch-bash-guard,\n     * where stripping could turn a permitted recovery command into a blocked one and deadlock the\n     * session — there, match on the raw `command`.\n     */\n    readonly commandCode: string;\n    /**\n     * The tree this command is JUDGED against — the root of the worktree it actually acts on, which\n     * is NOT the shell's cwd whenever the command carries a leading `cd <path> &&` (see\n     * EffectiveTreeResolver). Guards read git state, the main-sync cache and the decision log from\n     * here, so a command aimed at a linked worktree is judged on that worktree's branch, never the\n     * primary clone's.\n     */\n    readonly workspaceRoot: string;\n    /** The directory the command really runs in (post-`cd`). Relative paths resolve against THIS. */\n    readonly effectiveCwd: string;\n    /** The root owning webpieces.config.json. Equals workspaceRoot except in a linked worktree. */\n    readonly governedRoot: string;\n    options: RuleOptions;\n\n    constructor(command: string, workspaceRoot: string, effectiveCwd?: string, governedRoot?: string) {\n        this.tool = 'Bash';\n        this.command = command;\n        this.commandCode = this.stripProse(command);\n        this.workspaceRoot = workspaceRoot;\n        this.effectiveCwd = effectiveCwd ?? workspaceRoot;\n        this.governedRoot = governedRoot ?? workspaceRoot;\n        this.options = {};\n    }\n\n    // A quoted span WITHOUT whitespace is kept: `git checkout \"main\"` is a real command with a quoted\n    // argument, not prose. One containing whitespace is a sentence, and becomes a single space.\n    private stripProse(command: string): string {\n        const withoutHeredocs = command.replace(HEREDOC_BODY, ' ');\n        return withoutHeredocs.replace(QUOTED_SPAN, (match: string, single?: string, double?: string): string => {\n            const content = single ?? double ?? '';\n            return /\\s/.test(content) ? ' ' : content;\n        });\n    }\n}\n\nexport class FileContext {\n    readonly tool: ToolKind;\n    readonly filePath: string;\n    readonly relativePath: string;\n    readonly workspaceRoot: string;\n    readonly currentFileLines: number;\n    readonly linesAdded: number;\n    readonly linesRemoved: number;\n    readonly projectedFileLines: number;\n    options: RuleOptions;\n\n    constructor(\n        tool: ToolKind,\n        filePath: string,\n        relativePath: string,\n        workspaceRoot: string,\n        currentFileLines: number,\n        linesAdded: number,\n        linesRemoved: number,\n        projectedFileLines: number,\n    ) {\n        this.tool = tool;\n        this.filePath = filePath;\n        this.relativePath = relativePath;\n        this.workspaceRoot = workspaceRoot;\n        this.currentFileLines = currentFileLines;\n        this.linesAdded = linesAdded;\n        this.linesRemoved = linesRemoved;\n        this.projectedFileLines = projectedFileLines;\n        this.options = {};\n    }\n}\n\n/**\n * The shape of a custom rule loaded from a `rulesDir` (a plain object returned by require()).\n * It carries only metadata + a `check` method — no on/off logic of its own.\n */\nexport interface PlainRule {\n    readonly name: string;\n    readonly description: string;\n    readonly scope: RuleScope;\n    readonly files: readonly string[];\n    readonly defaultOptions: RuleOptions;\n    readonly fixHint: FixHint;\n    check(ctx: EditContext | FileContext | BashContext): readonly Violation[];\n}\n\n/**\n * The runtime contract the runner iterates. Both the built-in rule classes (which extend\n * EditRuleBase/FileRuleBase/BashRuleBase) and the custom-rule adapter satisfy this: they add\n * `shouldRun()` (mode + escape-hatch decision) on top of the PlainRule metadata.\n */\nexport interface Rule extends PlainRule {\n    shouldRun(): boolean;\n}\n\nexport class RuleGroup {\n    readonly ruleName: string;\n    readonly ruleDescription: string;\n    readonly fixHint: FixHint;\n    readonly violations: readonly Violation[];\n\n    constructor(\n        ruleName: string,\n        ruleDescription: string,\n        fixHint: FixHint,\n        violations: readonly Violation[],\n    ) {\n        this.ruleName = ruleName;\n        this.ruleDescription = ruleDescription;\n        this.fixHint = fixHint;\n        this.violations = violations;\n    }\n}\n\nexport class BlockedResult {\n    readonly report: string;\n\n    constructor(report: string) {\n        this.report = report;\n    }\n}\n\n"]}

package/templates/ai-hook.sh

@@ -121,14 +121,14 @@ wp_log() {                   # $1 = decision label (ALLOW-INSTALL | DENY | DENY-
 DENY_LABEL="DENY"
 [ -n "$DRIFT_PKG" ] && DENY_LABEL="DENY-STALE"        # version drift, not a missing bin
 [ -n "$BROKEN_BIN" ] && DENY_LABEL="DENY-BROKEN"      # bin present but CRASHED (corrupt node_modules)
-if printf '%s' "$CMD" | grep -Eq '^(pnpm|npm)[[:space:]]+(install|i)([[:space:]]+--[A-Za-z][A-Za-z0-9=._/@:-]*)*([[:space:]]+2>(&1|/dev/null))?([[:space:]]*\|[[:space:]]*(tail|head)([[:space:]]+-(n[[:space:]]+)?[0-9]+)?)?[[:space:]]*$' || printf '%s' "$CMD" | grep -Eq '^rm[[:space:]]+-rf[[:space:]]+(\./)?node_modules/?([[:space:]]*&&[[:space:]]*(pnpm|npm)[[:space:]]+(install|i)([[:space:]]+--[A-Za-z][A-Za-z0-9=._/@:-]*)*)?([[:space:]]+2>(&1|/dev/null))?([[:space:]]*\|[[:space:]]*(tail|head)([[:space:]]+-(n[[:space:]]+)?[0-9]+)?)?[[:space:]]*$'; then
+if printf '%s' "$CMD" | grep -Eq '^(cd[[:space:]]+[A-Za-z0-9._/@~+-]+[[:space:]]*&&[[:space:]]*)?(pnpm|npm)[[:space:]]+(install|i)([[:space:]]+--[A-Za-z][A-Za-z0-9=._/@:-]*)*([[:space:]]+2>(&1|/dev/null))?([[:space:]]*\|[[:space:]]*(tail|head)([[:space:]]+-(n[[:space:]]+)?[0-9]+)?)?[[:space:]]*$' || printf '%s' "$CMD" | grep -Eq '^(cd[[:space:]]+[A-Za-z0-9._/@~+-]+[[:space:]]*&&[[:space:]]*)?rm[[:space:]]+-rf[[:space:]]+(\./)?node_modules/?([[:space:]]*&&[[:space:]]*(pnpm|npm)[[:space:]]+(install|i)([[:space:]]+--[A-Za-z][A-Za-z0-9=._/@:-]*)*)?([[:space:]]+2>(&1|/dev/null))?([[:space:]]*\|[[:space:]]*(tail|head)([[:space:]]+-(n[[:space:]]+)?[0-9]+)?)?[[:space:]]*$'; then
   wp_log ALLOW-INSTALL       # record the self-heal we let through (re-enables the guards)
   exit 0                     # allow the installer/recovery so the assistant can break the deadlock
 fi
 # DRIFT ONLY: let the git sync commands through. When the PIN is the stale side (a checkout behind
 # origin), 'pnpm install' DOWNGRADES and 'git pull' is the only cure — denying it deadlocks the
 # assistant against its own fix. Pointless for a missing/broken bin, so it stays gated on drift.
-if [ -n "$DRIFT_PKG" ] && printf '%s' "$CMD" | grep -Eq '^git[[:space:]]+(pull|fetch|merge)([[:space:]]+(--)?[A-Za-z0-9][A-Za-z0-9=._/@:-]*)*([[:space:]]+2>(&1|/dev/null))?([[:space:]]*\|[[:space:]]*(tail|head)([[:space:]]+-(n[[:space:]]+)?[0-9]+)?)?[[:space:]]*$'; then
+if [ -n "$DRIFT_PKG" ] && printf '%s' "$CMD" | grep -Eq '^(cd[[:space:]]+[A-Za-z0-9._/@~+-]+[[:space:]]*&&[[:space:]]*)?git[[:space:]]+(pull|fetch|merge)([[:space:]]+(--)?[A-Za-z0-9][A-Za-z0-9=._/@:-]*)*([[:space:]]+2>(&1|/dev/null))?([[:space:]]*\|[[:space:]]*(tail|head)([[:space:]]+-(n[[:space:]]+)?[0-9]+)?)?[[:space:]]*$'; then
   wp_log ALLOW-SYNC          # record the git sync we let through (may be what re-syncs the pin)
   exit 0
 fi
@@ -142,7 +142,7 @@ if [ -n "$BROKEN_BIN" ]; then
   if [ "${STAGING_N:-0}" -gt 0 ] 2>/dev/null; then
     STAGING_NOTE=" Also found $STAGING_N orphaned pnpm staging dirs (name_pid_hash) under node_modules - the fingerprint of an install that was killed mid-write."
   fi
-  REASON="❌ webpieces guards are DOWN and every OTHER tool call is BLOCKED: ${BIN_NAME} is installed but CRASHED ($CRASH_MSG). Your node_modules is corrupt or partially written, so the guards cannot run - and they must NOT be silently skipped. NOTE: a plain 'pnpm install' will NOT fix this; pnpm sees the correct version on disk and skips the broken package. THIS IS NOT A DEADLOCK: the option below is explicitly ALLOWED through while this guard is up, so run it YOURSELF rather than handing it to the human. OPTION 1 - run EXACTLY this command, then retry: 'rm -rf node_modules && pnpm install'. Type the option you pick EXACTLY as written, character for character, and run NOTHING else on that line. Seriously: do NOT append && anything (not even a harmless && git status), do NOT put a cd in front of it, do NOT wrap it in a subshell. The allowlist is anchored to the ENTIRE command, so anything you bolt on makes it a DIFFERENT command and it WILL be rejected again - which is not the guard refusing its own cure. If an option already contains &&, that && is part of the command: keep it, and still add nothing beyond it. The ONLY additions that are tolerated are a trailing 2>&1 or a pipe into tail/head (e.g. 2>&1 | tail -20).${STAGING_NOTE}"
+  REASON="❌ webpieces guards are DOWN and every OTHER tool call is BLOCKED: ${BIN_NAME} is installed but CRASHED ($CRASH_MSG). Your node_modules is corrupt or partially written, so the guards cannot run - and they must NOT be silently skipped. NOTE: a plain 'pnpm install' will NOT fix this; pnpm sees the correct version on disk and skips the broken package. THIS IS NOT A DEADLOCK: the option below is explicitly ALLOWED through while this guard is up, so run it YOURSELF rather than handing it to the human. OPTION 1 - run EXACTLY this command, then retry: 'rm -rf node_modules && pnpm install'. Type the option you pick EXACTLY as written, character for character, and run NOTHING else on that line. Seriously: do NOT append && anything (not even a harmless && git status), do NOT wrap it in a subshell. The allowlist is anchored to the ENTIRE command, so anything you bolt on makes it a DIFFERENT command and it WILL be rejected again - which is not the guard refusing its own cure. If an option already contains &&, that && is part of the command: keep it, and still add nothing beyond it. The only additions tolerated are a LEADING cd <dir> && (needed to run the cure in a linked worktree, since cd does not persist between tool calls - that one IS accepted), a trailing 2>&1, and a pipe into tail/head (e.g. cd /path/to/worktree && pnpm install 2>&1 | tail -20).${STAGING_NOTE}"
 elif [ -n "$DRIFT_PKG" ]; then
   # The 'how do I get current' half comes from SyncFlowGuidance so it cannot contradict the guards.
   # It used to name 'git merge --ff-only origin/main' and assert that merge is allowed while this guard
@@ -155,7 +155,7 @@ elif [ -n "$DRIFT_PKG" ]; then
   # check is a plain !=, so it fires BOTH ways, and the old text always claimed node_modules was the
   # older side. When it is actually the NEWER side (a checkout behind origin), that text sent people
   # to 'pnpm install', which DOWNGRADES them further from correct.
-  REASON="❌ webpieces version drift: package.json pins $DRIFT_PKG@$DRIFT_DECLARED but node_modules has $DRIFT_INSTALLED. Every OTHER call is blocked until they agree. WHICH ONE IS STALE decides which option is yours - compare the two versions above. OPTION 1 (the pin is NEWER than node_modules - you just pulled or switched to a branch pinning a newer webpieces) - run EXACTLY this command to catch node_modules up: 'pnpm install'. OPTION 2 (the pin is OLDER than node_modules - your checkout is behind origin, so the PIN is the stale side, and 'pnpm install' on its own would DOWNGRADE you) - get the checkout current FIRST, THEN run 'pnpm install'. To get main itself current: ON main, run 'git pull origin main'. In a linked worktree (main is checked out in the primary clone, so checkout main fatals there), run 'git fetch origin main' and branch off origin/main. Do NOT reach for git merge --ff-only / git reset --hard / git checkout -B main: merge and rebase are blocked in EVERY form by redirect-how-to-merge-main, and the reset/-B forms silently throw away commits. To sync a FEATURE branch from main use pnpm wp-start-update (no PR open) or pnpm wp-start-upsert-pr (a PR is open). git pull and git fetch are allowed while this guard is up and are the cure here. Do not reach for git merge: this guard lets it through only because the guards are DOWN, and the moment they come back redirect-how-to-merge-main blocks it in every form. Type the option you pick EXACTLY as written, character for character, and run NOTHING else on that line. Seriously: do NOT append && anything (not even a harmless && git status), do NOT put a cd in front of it, do NOT wrap it in a subshell. The allowlist is anchored to the ENTIRE command, so anything you bolt on makes it a DIFFERENT command and it WILL be rejected again - which is not the guard refusing its own cure. If an option already contains &&, that && is part of the command: keep it, and still add nothing beyond it. The ONLY additions that are tolerated are a trailing 2>&1 or a pipe into tail/head (e.g. 2>&1 | tail -20)."
+  REASON="❌ webpieces version drift: package.json pins $DRIFT_PKG@$DRIFT_DECLARED but node_modules has $DRIFT_INSTALLED. Every OTHER call is blocked until they agree. WHICH ONE IS STALE decides which option is yours - compare the two versions above. OPTION 1 (the pin is NEWER than node_modules - you just pulled or switched to a branch pinning a newer webpieces) - run EXACTLY this command to catch node_modules up: 'pnpm install'. OPTION 2 (the pin is OLDER than node_modules - your checkout is behind origin, so the PIN is the stale side, and 'pnpm install' on its own would DOWNGRADE you) - get the checkout current FIRST, THEN run 'pnpm install'. To get main itself current: ON main, run 'git pull origin main'. In a linked worktree (main is checked out in the primary clone, so checkout main fatals there), run 'git fetch origin main' and branch off origin/main. Do NOT reach for git merge --ff-only / git reset --hard / git checkout -B main: merge and rebase are blocked in EVERY form by redirect-how-to-merge-main, and the reset/-B forms silently throw away commits. To sync a FEATURE branch from main use pnpm wp-start-update (no PR open) or pnpm wp-start-upsert-pr (a PR is open). git pull and git fetch are allowed while this guard is up and are the cure here. Do not reach for git merge: this guard lets it through only because the guards are DOWN, and the moment they come back redirect-how-to-merge-main blocks it in every form. Type the option you pick EXACTLY as written, character for character, and run NOTHING else on that line. Seriously: do NOT append && anything (not even a harmless && git status), do NOT wrap it in a subshell. The allowlist is anchored to the ENTIRE command, so anything you bolt on makes it a DIFFERENT command and it WILL be rejected again - which is not the guard refusing its own cure. If an option already contains &&, that && is part of the command: keep it, and still add nothing beyond it. The only additions tolerated are a LEADING cd <dir> && (needed to run the cure in a linked worktree, since cd does not persist between tool calls - that one IS accepted), a trailing 2>&1, and a pipe into tail/head (e.g. cd /path/to/worktree && pnpm install 2>&1 | tail -20)."
 else
   # A LINKED WORKTREE is the overwhelmingly common way to land here with a perfectly healthy repo:
   # git gives the new worktree a .git FILE (the primary clone has a .git directory) and copies no
@@ -166,7 +166,7 @@ else
   if [ -f "$ROOT/.git" ]; then
     WORKTREE_NOTE=" NOTE: $ROOT is a LINKED WORKTREE - git does not copy node_modules into a new worktree, so this is expected on a fresh one. Run 'pnpm install' HERE (in this worktree), not in the primary clone."
   fi
-  REASON="❌ @webpieces/ai-hook-rules is declared in package.json but is not installed (${BIN_NAME} not found). OPTION 1 - run EXACTLY this command to enable the webpieces AI guards, then retry: 'pnpm install'. Type the option you pick EXACTLY as written, character for character, and run NOTHING else on that line. Seriously: do NOT append && anything (not even a harmless && git status), do NOT put a cd in front of it, do NOT wrap it in a subshell. The allowlist is anchored to the ENTIRE command, so anything you bolt on makes it a DIFFERENT command and it WILL be rejected again - which is not the guard refusing its own cure. If an option already contains &&, that && is part of the command: keep it, and still add nothing beyond it. The ONLY additions that are tolerated are a trailing 2>&1 or a pipe into tail/head (e.g. 2>&1 | tail -20).${WORKTREE_NOTE} (If you removed @webpieces/ai-hook-rules on purpose, delete its hooks from .claude/settings.json.)"
+  REASON="❌ @webpieces/ai-hook-rules is declared in package.json but is not installed (${BIN_NAME} not found). OPTION 1 - run EXACTLY this command to enable the webpieces AI guards, then retry: 'pnpm install'. Type the option you pick EXACTLY as written, character for character, and run NOTHING else on that line. Seriously: do NOT append && anything (not even a harmless && git status), do NOT wrap it in a subshell. The allowlist is anchored to the ENTIRE command, so anything you bolt on makes it a DIFFERENT command and it WILL be rejected again - which is not the guard refusing its own cure. If an option already contains &&, that && is part of the command: keep it, and still add nothing beyond it. The only additions tolerated are a LEADING cd <dir> && (needed to run the cure in a linked worktree, since cd does not persist between tool calls - that one IS accepted), a trailing 2>&1, and a pipe into tail/head (e.g. cd /path/to/worktree && pnpm install 2>&1 | tail -20).${WORKTREE_NOTE} (If you removed @webpieces/ai-hook-rules on purpose, delete its hooks from .claude/settings.json.)"
 fi
 if [ "$TOOL" = "Bash" ]; then
   BS='\'                     # one literal backslash, so the \u001b escape never sits in this source