@webpieces/ai-hook-rules 0.4.703 → 0.4.705

package/src/adapters/codex-subagent-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-subagent-guard.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/codex-subagent-guard.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAE7B,0DAAqF;AAGrF,yCAA8C;AAEjC,QAAA,mBAAmB,GAAG,wCAAwC,CAAC;AAE5E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,4BAA4B;IACrC;;;OAGG;IACH,KAAK,CAAC,KAAqB,EAAE,IAAY;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAgB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,4BAAa,CAC3B,2BAAmB,EACnB,6EAA6E,OAAO,MAAM;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,yDAAyD,EACzD,SAAS,EACT,SAAS,EACT;YACI,IAAI,qBAAM,CAAC,wGAAwG,QAAQ,cAAc,EAAE,IAAI,CAAC;YAChJ,IAAI,qBAAM,CAAC,wGAAwG,CAAC;SACvH,CACJ,CAAC;QACF,OAAO,IAAI,qBAAa,CAAC,IAAA,kCAAmB,EAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,IAAY;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;CACJ;AAhCD,oEAgCC","sourcesContent":["import * as path from 'path';\n\nimport { Option, RuleFailError, renderRuleFailForAi } from '@webpieces/rules-config';\n\nimport { AgentHookEvent, FileOperation } from '../core/agent-event';\nimport { BlockedResult } from '../core/types';\n\nexport const CODEX_SUBAGENT_RULE = 'codex-subagent-no-write-in-shared-tree';\n\n/**\n * A Codex SUBAGENT may not write into the tree it shares with its coordinator.\n *\n * This exists because of a MEASURED structural gap, not a style preference. Claude Code can hand a\n * subagent its own git worktree (`isolation: \"worktree\"`), so two agents editing at once are editing\n * two different checkouts. Codex cannot: `spawn_agent`'s schema is\n * `{fork_turns?, message, model?, reasoning_effort?, task_name}` — there is no cwd, workdir or\n * worktree parameter — and cwd resets to the repo root before every command, so a subagent cannot even\n * put itself somewhere else. Every Codex subagent therefore writes into the coordinator's checkout,\n * and concurrent subagents write into each other's.\n *\n * Reviewers are unaffected: they only read, and a read arrives as `Bash`.\n *\n * NOT a configurable rule yet, and that is deliberate. A rule registered with the engine must have an\n * entry in webpieces.config.json, and the validator that would accept a new key is a RELEASE behind\n * the source that defines it — adding both at once rejects the key as unknown and blocks every tool\n * call in the repo. So the guard ships here, gated on `aiType === 'codex'`, and becomes a config-keyed\n * rule in the follow-up PR that lands after the publish.\n */\nexport class CodexSubagentSharedTreeGuard {\n    /**\n     * Returns a block when a Codex SUBAGENT's patch targets a file inside `root`, else null.\n     * Claude Code events return null unconditionally — the harness has real isolation.\n     */\n    check(event: AgentHookEvent, root: string): BlockedResult | null {\n        if (event.aiType !== 'codex') return null;\n        if (event.agentId === '') return null;\n        const inside = event.files.filter((f: FileOperation): boolean => this.isInside(f.input.filePath, root));\n        if (inside.length === 0) return null;\n        const targets = inside.map((f: FileOperation): string => path.relative(root, f.input.filePath)).join(', ');\n        const worktree = path.join(path.dirname(root), 'wt-<task-name>');\n        const error = new RuleFailError(\n            CODEX_SUBAGENT_RULE,\n            `A Codex subagent is writing into the tree it shares with its coordinator: ${targets}\\n\\n` +\n            `Codex cannot spawn a subagent into its own checkout — spawn_agent takes no cwd or worktree, ` +\n            `and cwd resets to the repo root before every command — so this edit lands in the same files ` +\n            `the coordinator and every sibling subagent are editing.`,\n            undefined,\n            undefined,\n            [\n                new Option(`Give this agent its own checkout and address every file by ABSOLUTE path inside it: git worktree add ${worktree} -b <branch>`, true),\n                new Option('Hand the edit back to the coordinator and have this agent report what to change instead of changing it'),\n            ],\n        );\n        return new BlockedResult(renderRuleFailForAi(error));\n    }\n\n    private isInside(filePath: string, root: string): boolean {\n        const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;\n        return path.resolve(filePath).startsWith(rootWithSep);\n    }\n}\n"]}

package/src/adapters/detect-ai.d.ts

@@ -0,0 +1,36 @@
+import { AiType } from '../core/agent-event';
+/**
+ * THE discriminator, and the only one. Codex's PreToolUse envelope carries a REQUIRED `turn_id`;
+ * Claude Code's has no such key. Everything else in the two envelopes is the same key names
+ * (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`), which is
+ * exactly why one positive key is the whole test rather than a shape heuristic.
+ *
+ * Exported as a TWIN — an sh fragment and a JS predicate — because L0 has two halves that must
+ * answer the identical question: the rendered POSIX-sh shim (which has no JSON parser and scrapes
+ * text) and this binary (which has the parsed object). That is the same pattern
+ * ../bin/l0-allowlist.ts already uses for `L0_ALLOW_ERE_SH` / `L0_ALLOW_JS`, and detect-ai.spec.ts
+ * asserts the two agree over a corpus the same way.
+ *
+ * The sh half is an APPROXIMATION and says so out loud: it matches the six bytes `"turn_id":` in the
+ * raw payload, so a Claude payload that happened to embed that exact quoted-key-with-colon spelling
+ * inside a string value would be misread as Codex. Matching a JSON key from sh without a JSON parser
+ * cannot do better, the spelling is contrived (an agent grepping for `turn_id` types it bare), and
+ * the consequence of the miss is bounded: the Codex path is a SUPERSET of guards, never fewer.
+ *
+ * NOT WIRED INTO THE RENDERED SHIM IN THIS CHANGE. `committedShimStale()` compares the committed
+ * `.claude/webpieces/ai-hook.sh` against `renderShim()` of the INSTALLED release, so changing the
+ * renderer and regenerating the artifact together makes L0 fault S fire for everyone mid-upgrade.
+ * The constant ships here first; the shim consumes it a release later.
+ */
+export declare const AI_TYPE_TOKEN_SH = "\"turn_id\":";
+/**
+ * Sets `AI` to the literal `AiType` value — `codex` or `claude-code` — from `$PAYLOAD`. The values
+ * are the SAME strings the TypeScript union carries, so the twin test can compare them byte for byte
+ * instead of translating between two vocabularies (translation is where twins drift).
+ */
+export declare const AI_TYPE_SH = "case \"$PAYLOAD\" in *'\"turn_id\":'*) AI=codex ;; *) AI=claude-code ;; esac";
+/**
+ * JS twin of AI_TYPE_SH. Asks the precise question the sh half approximates: is `turn_id` a key of
+ * the top-level envelope?
+ */
+export declare function detectAiType(payload: unknown): AiType;

package/src/adapters/detect-ai.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_TYPE_SH = exports.AI_TYPE_TOKEN_SH = void 0;
+exports.detectAiType = detectAiType;
+/**
+ * THE discriminator, and the only one. Codex's PreToolUse envelope carries a REQUIRED `turn_id`;
+ * Claude Code's has no such key. Everything else in the two envelopes is the same key names
+ * (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`), which is
+ * exactly why one positive key is the whole test rather than a shape heuristic.
+ *
+ * Exported as a TWIN — an sh fragment and a JS predicate — because L0 has two halves that must
+ * answer the identical question: the rendered POSIX-sh shim (which has no JSON parser and scrapes
+ * text) and this binary (which has the parsed object). That is the same pattern
+ * ../bin/l0-allowlist.ts already uses for `L0_ALLOW_ERE_SH` / `L0_ALLOW_JS`, and detect-ai.spec.ts
+ * asserts the two agree over a corpus the same way.
+ *
+ * The sh half is an APPROXIMATION and says so out loud: it matches the six bytes `"turn_id":` in the
+ * raw payload, so a Claude payload that happened to embed that exact quoted-key-with-colon spelling
+ * inside a string value would be misread as Codex. Matching a JSON key from sh without a JSON parser
+ * cannot do better, the spelling is contrived (an agent grepping for `turn_id` types it bare), and
+ * the consequence of the miss is bounded: the Codex path is a SUPERSET of guards, never fewer.
+ *
+ * NOT WIRED INTO THE RENDERED SHIM IN THIS CHANGE. `committedShimStale()` compares the committed
+ * `.claude/webpieces/ai-hook.sh` against `renderShim()` of the INSTALLED release, so changing the
+ * renderer and regenerating the artifact together makes L0 fault S fire for everyone mid-upgrade.
+ * The constant ships here first; the shim consumes it a release later.
+ */
+exports.AI_TYPE_TOKEN_SH = '"turn_id":';
+/**
+ * Sets `AI` to the literal `AiType` value — `codex` or `claude-code` — from `$PAYLOAD`. The values
+ * are the SAME strings the TypeScript union carries, so the twin test can compare them byte for byte
+ * instead of translating between two vocabularies (translation is where twins drift).
+ */
+exports.AI_TYPE_SH = `case "$PAYLOAD" in *'${exports.AI_TYPE_TOKEN_SH}'*) AI=codex ;; *) AI=claude-code ;; esac`;
+/**
+ * JS twin of AI_TYPE_SH. Asks the precise question the sh half approximates: is `turn_id` a key of
+ * the top-level envelope?
+ */
+// webpieces-disable no-any-unknown -- the argument IS unparsed JSON from another process's stdout; naming a type here would assert a shape we have not yet established, which is the question this function exists to answer
+// webpieces-disable no-function-outside-class -- twin of an sh fragment in the dependency-free adapter layer; it must stay callable on a tree too broken to build a DI container, exactly like isAllowed()
+function detectAiType(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return 'claude-code';
+    // webpieces-disable no-any-unknown -- narrowing the same unparsed JSON; the index signature is the widest true statement about it
+    return 'turn_id' in payload ? 'codex' : 'claude-code';
+}
+//# sourceMappingURL=detect-ai.js.map

package/src/adapters/detect-ai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-ai.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/detect-ai.ts"],"names":[],"mappings":";;;AAwCA,oCAIC;AA1CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;GAIG;AACU,QAAA,UAAU,GAAG,wBAAwB,wBAAgB,2CAA2C,CAAC;AAE9G;;;GAGG;AACH,6NAA6N;AAC7N,2MAA2M;AAC3M,SAAgB,YAAY,CAAC,OAAgB;IACzC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IAC1E,kIAAkI;IAClI,OAAO,SAAS,IAAK,OAAmC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;AACvF,CAAC","sourcesContent":["import { AiType } from '../core/agent-event';\n\n/**\n * THE discriminator, and the only one. Codex's PreToolUse envelope carries a REQUIRED `turn_id`;\n * Claude Code's has no such key. Everything else in the two envelopes is the same key names\n * (`hook_event_name`, `tool_name`, `tool_input`, `cwd`, `session_id`, `transcript_path`), which is\n * exactly why one positive key is the whole test rather than a shape heuristic.\n *\n * Exported as a TWIN — an sh fragment and a JS predicate — because L0 has two halves that must\n * answer the identical question: the rendered POSIX-sh shim (which has no JSON parser and scrapes\n * text) and this binary (which has the parsed object). That is the same pattern\n * ../bin/l0-allowlist.ts already uses for `L0_ALLOW_ERE_SH` / `L0_ALLOW_JS`, and detect-ai.spec.ts\n * asserts the two agree over a corpus the same way.\n *\n * The sh half is an APPROXIMATION and says so out loud: it matches the six bytes `\"turn_id\":` in the\n * raw payload, so a Claude payload that happened to embed that exact quoted-key-with-colon spelling\n * inside a string value would be misread as Codex. Matching a JSON key from sh without a JSON parser\n * cannot do better, the spelling is contrived (an agent grepping for `turn_id` types it bare), and\n * the consequence of the miss is bounded: the Codex path is a SUPERSET of guards, never fewer.\n *\n * NOT WIRED INTO THE RENDERED SHIM IN THIS CHANGE. `committedShimStale()` compares the committed\n * `.claude/webpieces/ai-hook.sh` against `renderShim()` of the INSTALLED release, so changing the\n * renderer and regenerating the artifact together makes L0 fault S fire for everyone mid-upgrade.\n * The constant ships here first; the shim consumes it a release later.\n */\nexport const AI_TYPE_TOKEN_SH = '\"turn_id\":';\n\n/**\n * Sets `AI` to the literal `AiType` value — `codex` or `claude-code` — from `$PAYLOAD`. The values\n * are the SAME strings the TypeScript union carries, so the twin test can compare them byte for byte\n * instead of translating between two vocabularies (translation is where twins drift).\n */\nexport const AI_TYPE_SH = `case \"$PAYLOAD\" in *'${AI_TYPE_TOKEN_SH}'*) AI=codex ;; *) AI=claude-code ;; esac`;\n\n/**\n * JS twin of AI_TYPE_SH. Asks the precise question the sh half approximates: is `turn_id` a key of\n * the top-level envelope?\n */\n// webpieces-disable no-any-unknown -- the argument IS unparsed JSON from another process's stdout; naming a type here would assert a shape we have not yet established, which is the question this function exists to answer\n// webpieces-disable no-function-outside-class -- twin of an sh fragment in the dependency-free adapter layer; it must stay callable on a tree too broken to build a DI container, exactly like isAllowed()\nexport function detectAiType(payload: unknown): AiType {\n    if (payload === null || typeof payload !== 'object') return 'claude-code';\n    // webpieces-disable no-any-unknown -- narrowing the same unparsed JSON; the index signature is the widest true statement about it\n    return 'turn_id' in (payload as Record<string, unknown>) ? 'codex' : 'claude-code';\n}\n"]}

package/src/adapters/guards-hook.d.ts

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
+import 'reflect-metadata';
 export declare function main(): Promise<void>;

package/src/adapters/guards-hook.js

@@ -2,13 +2,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = main;
-// Claude Code PreToolUse adapter for the GIT/PR/BRANCH GUARDS hook (matcher Bash).
-// File-edit payloads pass through untouched — code-style validation is the separate rules hook.
-const hook_core_1 = require("./hook-core");
-function main() {
-    return (0, hook_core_1.runMain)('guards');
+// Claude Code / Codex PreToolUse adapter for the GIT/PR/BRANCH GUARDS hook (matcher Bash|Write|Edit|
+// MultiEdit|Read). Code-style validation is the separate rules hook.
+//
+// COMPOSITION ROOT, and deliberately nothing else: build the container, get the app, run it. Every
+// decision this binary makes lives behind HookApp; the only thing that distinguishes it from
+// rules-hook.ts is the one HookArgs it constructs.
+require("reflect-metadata");
+const inversify_1 = require("inversify");
+const hook_app_1 = require("./hook-app");
+const hook_outcome_1 = require("./hook-outcome");
+// webpieces-disable no-function-outside-class -- this IS the bin's process entry point, named in package.json `exports` as ./claude-code-guards / ./claude-code-rules; a class here would be a namespace around one call and could not be the module's callable entry.
+async function main() {
+    const container = new inversify_1.Container({ autobind: true });
+    const app = container.get(hook_app_1.HookApp);
+    await app.run(new hook_outcome_1.HookArgs('guards'));
 }
+// `.catch` and not a bare `void main()`: a container that cannot be built throws BEFORE any HookApp
+// exists, and an unhandled rejection exits non-zero — which PreToolUse reads as a non-blocking error
+// and lets the tool call through. See HookBootFailure. `main` is async so a synchronous throw inside it
+// arrives here as a rejection too.
 if (require.main === module) {
-    void main();
+    // webpieces-disable no-any-unknown -- a rejection value is `unknown` by construction; HookBootFailure narrows it through toError(), which is the one place that job belongs
+    void main().catch((err) => { new hook_app_1.HookBootFailure().report(err); });
 }
 //# sourceMappingURL=guards-hook.js.map

package/src/adapters/guards-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards-hook.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/guards-hook.ts"],"names":[],"mappings":";;;AAKA,oBAEC;AAND,mFAAmF;AACnF,gGAAgG;AAChG,2CAAsC;AAEtC,SAAgB,IAAI;IAChB,OAAO,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1B,KAAK,IAAI,EAAE,CAAC;AAChB,CAAC","sourcesContent":["#!/usr/bin/env node\n// Claude Code PreToolUse adapter for the GIT/PR/BRANCH GUARDS hook (matcher Bash).\n// File-edit payloads pass through untouched — code-style validation is the separate rules hook.\nimport { runMain } from './hook-core';\n\nexport function main(): Promise<void> {\n    return runMain('guards');\n}\n\nif (require.main === module) {\n    void main();\n}\n"]}
+{"version":3,"file":"guards-hook.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/guards-hook.ts"],"names":[],"mappings":";;;AAcA,oBAIC;AAjBD,qGAAqG;AACrG,qEAAqE;AACrE,EAAE;AACF,mGAAmG;AACnG,6FAA6F;AAC7F,mDAAmD;AACnD,4BAA0B;AAC1B,yCAAsC;AAEtC,yCAAsD;AACtD,iDAA0C;AAE1C,uQAAuQ;AAChQ,KAAK,UAAU,IAAI;IACtB,MAAM,SAAS,GAAG,IAAI,qBAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,kBAAO,CAAC,CAAC;IACnC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,uBAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,oGAAoG;AACpG,qGAAqG;AACrG,wGAAwG;AACxG,mCAAmC;AACnC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC1B,4KAA4K;IAC5K,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAQ,EAAE,GAAG,IAAI,0BAAe,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["#!/usr/bin/env node\n// Claude Code / Codex PreToolUse adapter for the GIT/PR/BRANCH GUARDS hook (matcher Bash|Write|Edit|\n// MultiEdit|Read). Code-style validation is the separate rules hook.\n//\n// COMPOSITION ROOT, and deliberately nothing else: build the container, get the app, run it. Every\n// decision this binary makes lives behind HookApp; the only thing that distinguishes it from\n// rules-hook.ts is the one HookArgs it constructs.\nimport 'reflect-metadata';\nimport { Container } from 'inversify';\n\nimport { HookApp, HookBootFailure } from './hook-app';\nimport { HookArgs } from './hook-outcome';\n\n// webpieces-disable no-function-outside-class -- this IS the bin's process entry point, named in package.json `exports` as ./claude-code-guards / ./claude-code-rules; a class here would be a namespace around one call and could not be the module's callable entry.\nexport async function main(): Promise<void> {\n    const container = new Container({ autobind: true });\n    const app = container.get(HookApp);\n    await app.run(new HookArgs('guards'));\n}\n\n// `.catch` and not a bare `void main()`: a container that cannot be built throws BEFORE any HookApp\n// exists, and an unhandled rejection exits non-zero — which PreToolUse reads as a non-blocking error\n// and lets the tool call through. See HookBootFailure. `main` is async so a synchronous throw inside it\n// arrives here as a rejection too.\nif (require.main === module) {\n    // webpieces-disable no-any-unknown -- a rejection value is `unknown` by construction; HookBootFailure narrows it through toError(), which is the one place that job belongs\n    void main().catch((err: unknown): void => { new HookBootFailure().report(err); });\n}\n"]}

package/src/adapters/hook-app-fixtures.d.ts

@@ -0,0 +1,68 @@
+import { HookMode } from '../core/types';
+/**
+ * THE WIRE BYTES the golden tests drive, and the throwaway repo they are judged against.
+ *
+ * Everything here exists so a reader can see EXACTLY what a harness sends: the payloads are built from
+ * the measured envelope key sets (see the fixture docs on GoldenFixture below), not from anything the
+ * hook itself produces, and the repo is a real `git init` with a frozen webpieces.config.json rather
+ * than whatever tree the suite happens to be running in. A golden computed against the live repo would
+ * change verdict with the branch you are standing on.
+ *
+ * This is NOT a spec file, deliberately: `tsconfig.lib.json` excludes `*.spec.ts`, so a payload builder
+ * living in one would never be type-checked by the build.
+ */
+/** How one PreToolUse call is presented to the hook. Data class per CLAUDE.md rule 1. */
+export declare class GoldenFixture {
+    /** Stable key into `__goldens__/hook-app-goldens.json`. */
+    readonly name: string;
+    /** Which hook binary's mode — `guards` or `rules`. */
+    readonly mode: HookMode;
+    /**
+     * The raw stdin bytes. A STRING, never an object, because malformed stdin is one of the fixtures
+     * and a shape that cannot express "not JSON" would quietly drop the case that matters most.
+     */
+    readonly stdin: string;
+    /** True ⇒ the fixture repo also gets a `rulesDir` whose one module throws when required. */
+    readonly crashingRulesDir: boolean;
+    constructor(name: string, mode: HookMode, stdin: string, crashingRulesDir?: boolean);
+}
+/** A built fixture repo: where it lives, and the stdin bytes with `<REPO>` resolved into it. */
+export declare class PreparedFixture {
+    readonly repo: string;
+    readonly root: string;
+    readonly stdin: string;
+    constructor(repo: string, root: string, stdin: string);
+}
+/**
+ * The placeholder that stands for the fixture repo's absolute path, in BOTH directions: payloads are
+ * written with it and it is substituted in before the run; golden bytes are compared with the real
+ * path substituted back out. Guard reports legitimately name absolute paths (the git-workflow doc
+ * pointer, the blocked file), and a golden that hard-coded one machine's `/var/folders/...` would be
+ * a golden nobody else could run.
+ */
+export declare const REPO_TOKEN = "<REPO>";
+/**
+ * ONE fixture per row of the coverage the composed pipeline had none of before: for BOTH harnesses a
+ * Bash deny (the ANSI-red systemMessage), a file-tool deny (NO systemMessage), an allow, a read-only
+ * tool, malformed stdin, and a fail-closed crash.
+ */
+export declare const GOLDEN_FIXTURES: readonly GoldenFixture[];
+/**
+ * Builds ONE throwaway git repo per fixture and returns it with the payload's `<REPO>` resolved.
+ *
+ * A FRESH repo per fixture, not one shared: the hook writes `.webpieces/` state (the decision log, the
+ * main-sync cache) as it runs, so a shared tree would let fixture N's leftovers decide fixture N+1's
+ * verdict — an order-dependent suite, which is the one kind of golden test worse than none.
+ *
+ * `realpathSync` matters on macOS: `os.tmpdir()` hands back `/var/folders/...` which resolves to
+ * `/private/var/...`, and the L1 location guard compares the payload's cwd against the resolved repo
+ * root. Without it every fixture denies with "run git from the repo root" instead of the verdict under
+ * test.
+ */
+export declare class GoldenRepoBuilder {
+    private readonly configJson;
+    constructor();
+    build(fixture: GoldenFixture): PreparedFixture;
+    private repoConfig;
+    private git;
+}

package/src/adapters/hook-app-fixtures.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoldenRepoBuilder = exports.GOLDEN_FIXTURES = exports.REPO_TOKEN = exports.PreparedFixture = exports.GoldenFixture = void 0;
+const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
+const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
+/**
+ * THE WIRE BYTES the golden tests drive, and the throwaway repo they are judged against.
+ *
+ * Everything here exists so a reader can see EXACTLY what a harness sends: the payloads are built from
+ * the measured envelope key sets (see the fixture docs on GoldenFixture below), not from anything the
+ * hook itself produces, and the repo is a real `git init` with a frozen webpieces.config.json rather
+ * than whatever tree the suite happens to be running in. A golden computed against the live repo would
+ * change verdict with the branch you are standing on.
+ *
+ * This is NOT a spec file, deliberately: `tsconfig.lib.json` excludes `*.spec.ts`, so a payload builder
+ * living in one would never be type-checked by the build.
+ */
+/** How one PreToolUse call is presented to the hook. Data class per CLAUDE.md rule 1. */
+class GoldenFixture {
+    /** Stable key into `__goldens__/hook-app-goldens.json`. */
+    name;
+    /** Which hook binary's mode — `guards` or `rules`. */
+    mode;
+    /**
+     * The raw stdin bytes. A STRING, never an object, because malformed stdin is one of the fixtures
+     * and a shape that cannot express "not JSON" would quietly drop the case that matters most.
+     */
+    stdin;
+    /** True ⇒ the fixture repo also gets a `rulesDir` whose one module throws when required. */
+    crashingRulesDir;
+    constructor(name, mode, stdin, crashingRulesDir = false) {
+        this.name = name;
+        this.mode = mode;
+        this.stdin = stdin;
+        this.crashingRulesDir = crashingRulesDir;
+    }
+}
+exports.GoldenFixture = GoldenFixture;
+/** A built fixture repo: where it lives, and the stdin bytes with `<REPO>` resolved into it. */
+class PreparedFixture {
+    repo;
+    root;
+    stdin;
+    constructor(repo, root, stdin) {
+        this.repo = repo;
+        this.root = root;
+        this.stdin = stdin;
+    }
+}
+exports.PreparedFixture = PreparedFixture;
+/**
+ * The placeholder that stands for the fixture repo's absolute path, in BOTH directions: payloads are
+ * written with it and it is substituted in before the run; golden bytes are compared with the real
+ * path substituted back out. Guard reports legitimately name absolute paths (the git-workflow doc
+ * pointer, the blocked file), and a golden that hard-coded one machine's `/var/folders/...` would be
+ * a golden nobody else could run.
+ */
+exports.REPO_TOKEN = '<REPO>';
+const CLAUDE_ENVELOPE = { hook_event_name: 'PreToolUse', session_id: 'sess-golden', transcript_path: '/dev/null', cwd: exports.REPO_TOKEN };
+/**
+ * The Codex additions, MEASURED from codex-cli 0.151.0: it uses Claude's key names and merely ADDS
+ * `model`, `turn_id`, `tool_use_id` and `permission_mode`. `turn_id` is the one discriminator (see
+ * detect-ai.ts). `agent_id` empty ⇒ the coordinator, populated ⇒ a subagent — identical semantics in
+ * both harnesses.
+ */
+const CODEX_ENVELOPE = { ...CLAUDE_ENVELOPE, model: 'gpt-5-codex', turn_id: 'turn-golden', tool_use_id: 'call_1', permission_mode: 'default', agent_type: 'default', agent_id: '' };
+// Codex's edit tool. MEASURED: the tool is named `apply_patch`, it carries `tool_input.command` (not
+// file_path), hunk headers are a bare `@@`, and ONE patch may carry many files with mixed operations.
+const PATCH_ADD_JS = '*** Begin Patch\n*** Add File: src/foo.js\n+var x = 1;\n*** End Patch\n';
+const PATCH_ADD_TS = '*** Begin Patch\n*** Add File: scripts/added.ts\n+export const b = 2;\n*** End Patch\n';
+/**
+ * Serializes ONE PreToolUse envelope to the bytes a harness would put on stdin. A class rather than a
+ * module-scope function because that is the repo rule, and the one instance below is built at module
+ * load so the fixture table can stay a plain literal list.
+ */
+class WirePayload {
+    // webpieces-disable no-any-unknown -- these objects ARE the wire envelope; JSON.stringify of a plain object is the payload under test, and naming a type for it would assert a shape the fixtures exist to state literally
+    write(envelope, toolName, toolInput) {
+        return JSON.stringify({ ...envelope, tool_name: toolName, tool_input: toolInput });
+    }
+}
+const WIRE = new WirePayload();
+/**
+ * ONE fixture per row of the coverage the composed pipeline had none of before: for BOTH harnesses a
+ * Bash deny (the ANSI-red systemMessage), a file-tool deny (NO systemMessage), an allow, a read-only
+ * tool, malformed stdin, and a fail-closed crash.
+ */
+exports.GOLDEN_FIXTURES = [
+    // ── Claude Code ────────────────────────────────────────────────────────────────────────────────
+    // A Bash deny. `git merge` is blocked on every branch, so this verdict does not depend on repo
+    // state — and a Bash deny is the ONE case that carries the red `systemMessage`.
+    new GoldenFixture('claude/bash-deny', 'guards', WIRE.write(CLAUDE_ENVELOPE, 'Bash', { command: 'git merge main' })),
+    new GoldenFixture('claude/bash-allow', 'guards', WIRE.write(CLAUDE_ENVELOPE, 'Bash', { command: 'echo hi' })),
+    // The read-only tool: log-and-allow, and the only guard that can deny it is a stale `main`.
+    new GoldenFixture('claude/read-allow', 'guards', WIRE.write(CLAUDE_ENVELOPE, 'Read', { file_path: `${exports.REPO_TOKEN}/f.txt` })),
+    // Write / Edit / MultiEdit denies — all three must emit NO systemMessage.
+    new GoldenFixture('claude/write-deny', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Write', { file_path: `${exports.REPO_TOKEN}/src/foo.js`, content: 'var x = 1;\n' })),
+    new GoldenFixture('claude/edit-deny', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Edit', { file_path: `${exports.REPO_TOKEN}/scripts/ok.ts`, old_string: 'const a = 1;', new_string: 'const { a } = b;' })),
+    new GoldenFixture('claude/multiedit-deny', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'MultiEdit', { file_path: `${exports.REPO_TOKEN}/scripts/ok.ts`, edits: [{ old_string: 'const a = 1;', new_string: 'const { a } = b;' }] })),
+    new GoldenFixture('claude/write-allow', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Write', { file_path: `${exports.REPO_TOKEN}/scripts/ok.ts`, content: 'export const a = 1;\n' })),
+    new GoldenFixture('claude/malformed', 'guards', 'not json at all'),
+    new GoldenFixture('claude/crash', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Write', { file_path: `${exports.REPO_TOKEN}/scripts/ok.ts`, content: 'export const a = 1;\n' }), true),
+    // ── Codex ──────────────────────────────────────────────────────────────────────────────────────
+    new GoldenFixture('codex/bash-deny', 'guards', WIRE.write(CODEX_ENVELOPE, 'Bash', { command: 'git merge main' })),
+    new GoldenFixture('codex/bash-allow', 'guards', WIRE.write(CODEX_ENVELOPE, 'Bash', { command: 'echo hi' })),
+    // Codex has no Read tool: a read arrives as `Bash` running a pager, which read parity turns into a
+    // read-scoped verdict ON TOP of the bash guards.
+    new GoldenFixture('codex/read-allow', 'guards', WIRE.write(CODEX_ENVELOPE, 'Bash', { command: `sed -n '1,240p' ${exports.REPO_TOKEN}/f.txt` })),
+    new GoldenFixture('codex/apply-patch-deny', 'rules', WIRE.write(CODEX_ENVELOPE, 'apply_patch', { command: PATCH_ADD_JS })),
+    new GoldenFixture('codex/apply-patch-allow', 'rules', WIRE.write(CODEX_ENVELOPE, 'apply_patch', { command: PATCH_ADD_TS })),
+    new GoldenFixture('codex/malformed', 'guards', '{"turn_id": broken'),
+    new GoldenFixture('codex/crash', 'rules', WIRE.write(CODEX_ENVELOPE, 'apply_patch', { command: PATCH_ADD_TS }), true),
+];
+// A rules module that blows up the moment it is required — the shortest honest way to reach the hook's
+// fail-closed boundary from OUTSIDE the hook, i.e. without stubbing anything the pipeline owns.
+const CRASHING_RULE_MODULE = "throw new Error('boom from a custom rule module');\n";
+/**
+ * Builds ONE throwaway git repo per fixture and returns it with the payload's `<REPO>` resolved.
+ *
+ * A FRESH repo per fixture, not one shared: the hook writes `.webpieces/` state (the decision log, the
+ * main-sync cache) as it runs, so a shared tree would let fixture N's leftovers decide fixture N+1's
+ * verdict — an order-dependent suite, which is the one kind of golden test worse than none.
+ *
+ * `realpathSync` matters on macOS: `os.tmpdir()` hands back `/var/folders/...` which resolves to
+ * `/private/var/...`, and the L1 location guard compares the payload's cwd against the resolved repo
+ * root. Without it every fixture denies with "run git from the repo root" instead of the verdict under
+ * test.
+ */
+class GoldenRepoBuilder {
+    configJson;
+    constructor() {
+        this.configJson = fs.readFileSync(path.join(__dirname, '__goldens__', 'fixture-webpieces.config.json'), 'utf8');
+    }
+    build(fixture) {
+        const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'wp-hook-golden-')));
+        const repo = path.join(root, 'repo');
+        fs.mkdirSync(repo);
+        this.git(repo, 'init -q -b main');
+        // The developer's own commit hooks would otherwise fire inside this throwaway repo.
+        this.git(repo, 'config core.hooksPath /dev/null');
+        this.git(repo, 'config user.email t@t.co');
+        this.git(repo, 'config user.name tester');
+        fs.writeFileSync(path.join(repo, 'webpieces.config.json'), this.repoConfig(fixture));
+        fs.writeFileSync(path.join(repo, 'f.txt'), 'hello\n');
+        fs.mkdirSync(path.join(repo, 'scripts'));
+        fs.writeFileSync(path.join(repo, 'scripts', 'ok.ts'), 'const a = 1;\n');
+        if (fixture.crashingRulesDir) {
+            fs.mkdirSync(path.join(repo, 'wprules'));
+            fs.writeFileSync(path.join(repo, 'wprules', 'crash.js'), CRASHING_RULE_MODULE);
+        }
+        this.git(repo, 'add -A');
+        this.git(repo, 'commit -qm init');
+        // A local origin/main, so `origin/main..<branch>` resolves exactly as it does in a real clone.
+        this.git(repo, 'update-ref refs/remotes/origin/main HEAD');
+        // A feature branch, because that is where an agent actually works.
+        this.git(repo, 'checkout -q -b dean/fixture');
+        return new PreparedFixture(repo, root, fixture.stdin.split(exports.REPO_TOKEN).join(repo));
+    }
+    repoConfig(fixture) {
+        if (!fixture.crashingRulesDir)
+            return this.configJson;
+        // webpieces-disable no-any-unknown -- the frozen fixture config is data on disk; re-parsing it into a named type here would be a second declaration of a file whose whole point is being literal
+        const parsed = JSON.parse(this.configJson);
+        parsed['rulesDir'] = ['wprules'];
+        return JSON.stringify(parsed, null, 4);
+    }
+    git(repo, args) {
+        (0, child_process_1.execSync)(`git ${args}`, { cwd: repo, encoding: 'utf8' });
+    }
+}
+exports.GoldenRepoBuilder = GoldenRepoBuilder;
+//# sourceMappingURL=hook-app-fixtures.js.map

package/src/adapters/hook-app-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-app-fixtures.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/hook-app-fixtures.ts"],"names":[],"mappings":";;;;AAAA,iDAAyC;AACzC,+CAAyB;AACzB,+CAAyB;AACzB,mDAA6B;AAI7B;;;;;;;;;;;GAWG;AAEH,yFAAyF;AACzF,MAAa,aAAa;IACtB,2DAA2D;IAClD,IAAI,CAAS;IACtB,sDAAsD;IAC7C,IAAI,CAAW;IACxB;;;OAGG;IACM,KAAK,CAAS;IACvB,4FAA4F;IACnF,gBAAgB,CAAU;IAEnC,YAAY,IAAY,EAAE,IAAc,EAAE,KAAa,EAAE,mBAA4B,KAAK;QACtF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC7C,CAAC;CACJ;AAnBD,sCAmBC;AAED,gGAAgG;AAChG,MAAa,eAAe;IACf,IAAI,CAAS;IACb,IAAI,CAAS;IACb,KAAK,CAAS;IAEvB,YAAY,IAAY,EAAE,IAAY,EAAE,KAAa;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAVD,0CAUC;AAED;;;;;;GAMG;AACU,QAAA,UAAU,GAAG,QAAQ,CAAC;AAEnC,MAAM,eAAe,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,kBAAU,EAAE,CAAC;AAEpI;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAEpL,qGAAqG;AACrG,sGAAsG;AACtG,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAC/F,MAAM,YAAY,GAAG,wFAAwF,CAAC;AAE9G;;;;GAIG;AACH,MAAM,WAAW;IACb,2NAA2N;IAC3N,KAAK,CAAC,QAAiC,EAAE,QAAgB,EAAE,SAAkC;QACzF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC;CACJ;AAED,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACU,QAAA,eAAe,GAA6B;IACrD,kGAAkG;IAClG,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,aAAa,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACnH,IAAI,aAAa,CAAC,mBAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7G,4FAA4F;IAC5F,IAAI,aAAa,CAAC,mBAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,kBAAU,QAAQ,EAAE,CAAC,CAAC;IAC3H,0EAA0E;IAC1E,IAAI,aAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,kBAAU,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IACzJ,IAAI,aAAa,CAAC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,kBAAU,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7L,IAAI,aAAa,CAAC,uBAAuB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,kBAAU,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IACpN,IAAI,aAAa,CAAC,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,kBAAU,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACtK,IAAI,aAAa,CAAC,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,CAAC;IAClE,IAAI,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,kBAAU,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,IAAI,CAAC;IAEtK,kGAAkG;IAClG,IAAI,aAAa,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjH,IAAI,aAAa,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3G,mGAAmG;IACnG,iDAAiD;IACjD,IAAI,aAAa,CAAC,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,mBAAmB,kBAAU,QAAQ,EAAE,CAAC,CAAC;IACvI,IAAI,aAAa,CAAC,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1H,IAAI,aAAa,CAAC,yBAAyB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3H,IAAI,aAAa,CAAC,iBAAiB,EAAE,QAAQ,EAAE,oBAAoB,CAAC;IACpE,IAAI,aAAa,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;CACxH,CAAC;AAEF,uGAAuG;AACvG,gGAAgG;AAChG,MAAM,oBAAoB,GAAG,sDAAsD,CAAC;AAEpF;;;;;;;;;;;GAWG;AACH,MAAa,iBAAiB;IACT,UAAU,CAAS;IAEpC;QACI,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,+BAA+B,CAAC,EAAE,MAAM,CAAC,CAAC;IACpH,CAAC;IAED,KAAK,CAAC,OAAsB;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,oFAAoF;QACpF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACrF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;QACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC3B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClC,+FAA+F;QAC/F,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,0CAA0C,CAAC,CAAC;QAC3D,mEAAmE;QACnE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAC9C,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,CAAC;IAEO,UAAU,CAAC,OAAsB;QACrC,IAAI,CAAC,OAAO,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QACtD,iMAAiM;QACjM,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAA4B,CAAC;QACtE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IAEO,GAAG,CAAC,IAAY,EAAE,IAAY;QAClC,IAAA,wBAAQ,EAAC,OAAO,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;CACJ;AA5CD,8CA4CC","sourcesContent":["import { execSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as os from 'os';\nimport * as path from 'path';\n\nimport { HookMode } from '../core/types';\n\n/**\n * THE WIRE BYTES the golden tests drive, and the throwaway repo they are judged against.\n *\n * Everything here exists so a reader can see EXACTLY what a harness sends: the payloads are built from\n * the measured envelope key sets (see the fixture docs on GoldenFixture below), not from anything the\n * hook itself produces, and the repo is a real `git init` with a frozen webpieces.config.json rather\n * than whatever tree the suite happens to be running in. A golden computed against the live repo would\n * change verdict with the branch you are standing on.\n *\n * This is NOT a spec file, deliberately: `tsconfig.lib.json` excludes `*.spec.ts`, so a payload builder\n * living in one would never be type-checked by the build.\n */\n\n/** How one PreToolUse call is presented to the hook. Data class per CLAUDE.md rule 1. */\nexport class GoldenFixture {\n    /** Stable key into `__goldens__/hook-app-goldens.json`. */\n    readonly name: string;\n    /** Which hook binary's mode — `guards` or `rules`. */\n    readonly mode: HookMode;\n    /**\n     * The raw stdin bytes. A STRING, never an object, because malformed stdin is one of the fixtures\n     * and a shape that cannot express \"not JSON\" would quietly drop the case that matters most.\n     */\n    readonly stdin: string;\n    /** True ⇒ the fixture repo also gets a `rulesDir` whose one module throws when required. */\n    readonly crashingRulesDir: boolean;\n\n    constructor(name: string, mode: HookMode, stdin: string, crashingRulesDir: boolean = false) {\n        this.name = name;\n        this.mode = mode;\n        this.stdin = stdin;\n        this.crashingRulesDir = crashingRulesDir;\n    }\n}\n\n/** A built fixture repo: where it lives, and the stdin bytes with `<REPO>` resolved into it. */\nexport class PreparedFixture {\n    readonly repo: string;\n    readonly root: string;\n    readonly stdin: string;\n\n    constructor(repo: string, root: string, stdin: string) {\n        this.repo = repo;\n        this.root = root;\n        this.stdin = stdin;\n    }\n}\n\n/**\n * The placeholder that stands for the fixture repo's absolute path, in BOTH directions: payloads are\n * written with it and it is substituted in before the run; golden bytes are compared with the real\n * path substituted back out. Guard reports legitimately name absolute paths (the git-workflow doc\n * pointer, the blocked file), and a golden that hard-coded one machine's `/var/folders/...` would be\n * a golden nobody else could run.\n */\nexport const REPO_TOKEN = '<REPO>';\n\nconst CLAUDE_ENVELOPE = { hook_event_name: 'PreToolUse', session_id: 'sess-golden', transcript_path: '/dev/null', cwd: REPO_TOKEN };\n\n/**\n * The Codex additions, MEASURED from codex-cli 0.151.0: it uses Claude's key names and merely ADDS\n * `model`, `turn_id`, `tool_use_id` and `permission_mode`. `turn_id` is the one discriminator (see\n * detect-ai.ts). `agent_id` empty ⇒ the coordinator, populated ⇒ a subagent — identical semantics in\n * both harnesses.\n */\nconst CODEX_ENVELOPE = { ...CLAUDE_ENVELOPE, model: 'gpt-5-codex', turn_id: 'turn-golden', tool_use_id: 'call_1', permission_mode: 'default', agent_type: 'default', agent_id: '' };\n\n// Codex's edit tool. MEASURED: the tool is named `apply_patch`, it carries `tool_input.command` (not\n// file_path), hunk headers are a bare `@@`, and ONE patch may carry many files with mixed operations.\nconst PATCH_ADD_JS = '*** Begin Patch\\n*** Add File: src/foo.js\\n+var x = 1;\\n*** End Patch\\n';\nconst PATCH_ADD_TS = '*** Begin Patch\\n*** Add File: scripts/added.ts\\n+export const b = 2;\\n*** End Patch\\n';\n\n/**\n * Serializes ONE PreToolUse envelope to the bytes a harness would put on stdin. A class rather than a\n * module-scope function because that is the repo rule, and the one instance below is built at module\n * load so the fixture table can stay a plain literal list.\n */\nclass WirePayload {\n    // webpieces-disable no-any-unknown -- these objects ARE the wire envelope; JSON.stringify of a plain object is the payload under test, and naming a type for it would assert a shape the fixtures exist to state literally\n    write(envelope: Record<string, unknown>, toolName: string, toolInput: Record<string, unknown>): string {\n        return JSON.stringify({ ...envelope, tool_name: toolName, tool_input: toolInput });\n    }\n}\n\nconst WIRE = new WirePayload();\n\n/**\n * ONE fixture per row of the coverage the composed pipeline had none of before: for BOTH harnesses a\n * Bash deny (the ANSI-red systemMessage), a file-tool deny (NO systemMessage), an allow, a read-only\n * tool, malformed stdin, and a fail-closed crash.\n */\nexport const GOLDEN_FIXTURES: readonly GoldenFixture[] = [\n    // ── Claude Code ────────────────────────────────────────────────────────────────────────────────\n    // A Bash deny. `git merge` is blocked on every branch, so this verdict does not depend on repo\n    // state — and a Bash deny is the ONE case that carries the red `systemMessage`.\n    new GoldenFixture('claude/bash-deny', 'guards', WIRE.write(CLAUDE_ENVELOPE, 'Bash', { command: 'git merge main' })),\n    new GoldenFixture('claude/bash-allow', 'guards', WIRE.write(CLAUDE_ENVELOPE, 'Bash', { command: 'echo hi' })),\n    // The read-only tool: log-and-allow, and the only guard that can deny it is a stale `main`.\n    new GoldenFixture('claude/read-allow', 'guards', WIRE.write(CLAUDE_ENVELOPE, 'Read', { file_path: `${REPO_TOKEN}/f.txt` })),\n    // Write / Edit / MultiEdit denies — all three must emit NO systemMessage.\n    new GoldenFixture('claude/write-deny', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Write', { file_path: `${REPO_TOKEN}/src/foo.js`, content: 'var x = 1;\\n' })),\n    new GoldenFixture('claude/edit-deny', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Edit', { file_path: `${REPO_TOKEN}/scripts/ok.ts`, old_string: 'const a = 1;', new_string: 'const { a } = b;' })),\n    new GoldenFixture('claude/multiedit-deny', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'MultiEdit', { file_path: `${REPO_TOKEN}/scripts/ok.ts`, edits: [{ old_string: 'const a = 1;', new_string: 'const { a } = b;' }] })),\n    new GoldenFixture('claude/write-allow', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Write', { file_path: `${REPO_TOKEN}/scripts/ok.ts`, content: 'export const a = 1;\\n' })),\n    new GoldenFixture('claude/malformed', 'guards', 'not json at all'),\n    new GoldenFixture('claude/crash', 'rules', WIRE.write(CLAUDE_ENVELOPE, 'Write', { file_path: `${REPO_TOKEN}/scripts/ok.ts`, content: 'export const a = 1;\\n' }), true),\n\n    // ── Codex ──────────────────────────────────────────────────────────────────────────────────────\n    new GoldenFixture('codex/bash-deny', 'guards', WIRE.write(CODEX_ENVELOPE, 'Bash', { command: 'git merge main' })),\n    new GoldenFixture('codex/bash-allow', 'guards', WIRE.write(CODEX_ENVELOPE, 'Bash', { command: 'echo hi' })),\n    // Codex has no Read tool: a read arrives as `Bash` running a pager, which read parity turns into a\n    // read-scoped verdict ON TOP of the bash guards.\n    new GoldenFixture('codex/read-allow', 'guards', WIRE.write(CODEX_ENVELOPE, 'Bash', { command: `sed -n '1,240p' ${REPO_TOKEN}/f.txt` })),\n    new GoldenFixture('codex/apply-patch-deny', 'rules', WIRE.write(CODEX_ENVELOPE, 'apply_patch', { command: PATCH_ADD_JS })),\n    new GoldenFixture('codex/apply-patch-allow', 'rules', WIRE.write(CODEX_ENVELOPE, 'apply_patch', { command: PATCH_ADD_TS })),\n    new GoldenFixture('codex/malformed', 'guards', '{\"turn_id\": broken'),\n    new GoldenFixture('codex/crash', 'rules', WIRE.write(CODEX_ENVELOPE, 'apply_patch', { command: PATCH_ADD_TS }), true),\n];\n\n// A rules module that blows up the moment it is required — the shortest honest way to reach the hook's\n// fail-closed boundary from OUTSIDE the hook, i.e. without stubbing anything the pipeline owns.\nconst CRASHING_RULE_MODULE = \"throw new Error('boom from a custom rule module');\\n\";\n\n/**\n * Builds ONE throwaway git repo per fixture and returns it with the payload's `<REPO>` resolved.\n *\n * A FRESH repo per fixture, not one shared: the hook writes `.webpieces/` state (the decision log, the\n * main-sync cache) as it runs, so a shared tree would let fixture N's leftovers decide fixture N+1's\n * verdict — an order-dependent suite, which is the one kind of golden test worse than none.\n *\n * `realpathSync` matters on macOS: `os.tmpdir()` hands back `/var/folders/...` which resolves to\n * `/private/var/...`, and the L1 location guard compares the payload's cwd against the resolved repo\n * root. Without it every fixture denies with \"run git from the repo root\" instead of the verdict under\n * test.\n */\nexport class GoldenRepoBuilder {\n    private readonly configJson: string;\n\n    constructor() {\n        this.configJson = fs.readFileSync(path.join(__dirname, '__goldens__', 'fixture-webpieces.config.json'), 'utf8');\n    }\n\n    build(fixture: GoldenFixture): PreparedFixture {\n        const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'wp-hook-golden-')));\n        const repo = path.join(root, 'repo');\n        fs.mkdirSync(repo);\n        this.git(repo, 'init -q -b main');\n        // The developer's own commit hooks would otherwise fire inside this throwaway repo.\n        this.git(repo, 'config core.hooksPath /dev/null');\n        this.git(repo, 'config user.email t@t.co');\n        this.git(repo, 'config user.name tester');\n        fs.writeFileSync(path.join(repo, 'webpieces.config.json'), this.repoConfig(fixture));\n        fs.writeFileSync(path.join(repo, 'f.txt'), 'hello\\n');\n        fs.mkdirSync(path.join(repo, 'scripts'));\n        fs.writeFileSync(path.join(repo, 'scripts', 'ok.ts'), 'const a = 1;\\n');\n        if (fixture.crashingRulesDir) {\n            fs.mkdirSync(path.join(repo, 'wprules'));\n            fs.writeFileSync(path.join(repo, 'wprules', 'crash.js'), CRASHING_RULE_MODULE);\n        }\n        this.git(repo, 'add -A');\n        this.git(repo, 'commit -qm init');\n        // A local origin/main, so `origin/main..<branch>` resolves exactly as it does in a real clone.\n        this.git(repo, 'update-ref refs/remotes/origin/main HEAD');\n        // A feature branch, because that is where an agent actually works.\n        this.git(repo, 'checkout -q -b dean/fixture');\n        return new PreparedFixture(repo, root, fixture.stdin.split(REPO_TOKEN).join(repo));\n    }\n\n    private repoConfig(fixture: GoldenFixture): string {\n        if (!fixture.crashingRulesDir) return this.configJson;\n        // webpieces-disable no-any-unknown -- the frozen fixture config is data on disk; re-parsing it into a named type here would be a second declaration of a file whose whole point is being literal\n        const parsed = JSON.parse(this.configJson) as Record<string, unknown>;\n        parsed['rulesDir'] = ['wprules'];\n        return JSON.stringify(parsed, null, 4);\n    }\n\n    private git(repo: string, args: string): void {\n        execSync(`git ${args}`, { cwd: repo, encoding: 'utf8' });\n    }\n}\n"]}

package/src/adapters/hook-app.d.ts

@@ -0,0 +1,61 @@
+import { HookArgs } from './hook-outcome';
+import { HookStdinSource, HookStdoutSink, HookProcessExit } from './hook-ports';
+/**
+ * THE COMPOSITION ROOT'S APP — one PreToolUse invocation, end to end.
+ *
+ * Production is three lines in `guards-hook.ts` / `rules-hook.ts`:
+ *
+ *     const container = new Container({ autobind: true });
+ *     const app = container.get(HookApp);
+ *     await app.run(new HookArgs('guards'));
+ *
+ * and a test is the SAME three lines with the ports rebound to doubles — canned stdin, a captured
+ * stdout, a recorded exit code. That is the whole difference, and it is the point: the test boundary
+ * is cut JUST ABOVE the injection point, so the seam a test drives is the seam production drives.
+ *
+ * What this replaces: `runMain(mode)`, which read stdin itself and reached `process.stdout.write` /
+ * `process.exit` from a dozen frames down. `runMain` is DELETED, not kept alongside — two spellings of
+ * one entry point is the shim shape this repo rejects outright (see CLAUDE.md, "NO webpieces surface
+ * is released backwards-compatible"). Nothing outside this file names it any more.
+ *
+ * The order of observable effects is unchanged from `runMain`: the invocation's audit line is flushed
+ * at the emit boundary inside the pipeline, the decision bytes are written next, and the process exits
+ * last through the injected exit port.
+ */
+export declare class HookApp {
+    private readonly stdin;
+    private readonly stdout;
+    private readonly processExit;
+    constructor(stdin: HookStdinSource, stdout: HookStdoutSink, processExit: HookProcessExit);
+    run(args: HookArgs): Promise<void>;
+    /**
+     * THE FAIL-CLOSED BOUNDARY FOR THE READ ITSELF, and the reason this is a separate method.
+     *
+     * `runMain` had the stdin read INSIDE the try whose catch produced a deny, so a failure there was
+     * still a structured block. Moving the read behind a port would have quietly narrowed that: a
+     * rejected read (or anything else thrown before the pipeline starts) would escape `run`, land as an
+     * unhandled rejection, and exit non-zero — which PreToolUse reads as a NON-BLOCKING error and lets
+     * the tool call THROUGH. That is the exact inversion of "a broken hook never silently lets an edit
+     * through", and no golden could catch it, because the goldens substitute this very port.
+     *
+     * So the try is restored one level out, around the read AND the pipeline, and it emits the same
+     * bytes `denyForCrash` emits for a null event.
+     */
+    private decide;
+}
+/**
+ * THE LAST-RESORT FAIL-CLOSED BOUNDARY: the composition root itself could not run.
+ *
+ * `new Container(...)` and `container.get(HookApp)` happen BEFORE any HookApp exists to catch for
+ * them, so an unresolvable binding (a missing decorator, a stripped `design:paramtypes`) would exit
+ * non-zero with a stack on stderr — and a non-zero exit is a non-blocking error, so every guarded tool
+ * call would sail through unjudged for as long as the defect lasted. Low probability; total
+ * consequence. One shared class rather than a copy in each bin, so the two can never drift.
+ *
+ * It writes through `process` directly, and that is correct rather than a leak: by construction there
+ * is no container here to have handed it a port, and this is the same designated terminal boundary the
+ * ports themselves wrap.
+ */
+export declare class HookBootFailure {
+    report(err: unknown): void;
+}

package/src/adapters/hook-app.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HookBootFailure = exports.HookApp = void 0;
+const tslib_1 = require("tslib");
+const inversify_1 = require("inversify");
+const hook_core_1 = require("./hook-core");
+const agent_response_1 = require("./agent-response");
+const hook_ports_1 = require("./hook-ports");
+const to_error_1 = require("../core/to-error");
+// The reason text a crash surfaces to the agent. ONE literal, used by both fail-closed boundaries
+// below and worded identically to `denyForCrash`'s so the audit trail reads the same whichever of them
+// caught it.
+const CRASH_PREFIX = '[ai-hooks] hook crashed unexpectedly — failing closed: ';
+/**
+ * THE COMPOSITION ROOT'S APP — one PreToolUse invocation, end to end.
+ *
+ * Production is three lines in `guards-hook.ts` / `rules-hook.ts`:
+ *
+ *     const container = new Container({ autobind: true });
+ *     const app = container.get(HookApp);
+ *     await app.run(new HookArgs('guards'));
+ *
+ * and a test is the SAME three lines with the ports rebound to doubles — canned stdin, a captured
+ * stdout, a recorded exit code. That is the whole difference, and it is the point: the test boundary
+ * is cut JUST ABOVE the injection point, so the seam a test drives is the seam production drives.
+ *
+ * What this replaces: `runMain(mode)`, which read stdin itself and reached `process.stdout.write` /
+ * `process.exit` from a dozen frames down. `runMain` is DELETED, not kept alongside — two spellings of
+ * one entry point is the shim shape this repo rejects outright (see CLAUDE.md, "NO webpieces surface
+ * is released backwards-compatible"). Nothing outside this file names it any more.
+ *
+ * The order of observable effects is unchanged from `runMain`: the invocation's audit line is flushed
+ * at the emit boundary inside the pipeline, the decision bytes are written next, and the process exits
+ * last through the injected exit port.
+ */
+let HookApp = class HookApp {
+    stdin;
+    stdout;
+    processExit;
+    constructor(stdin, stdout, processExit) {
+        this.stdin = stdin;
+        this.stdout = stdout;
+        this.processExit = processExit;
+    }
+    async run(args) {
+        const outcome = await this.decide(args);
+        // An ALLOW writes NOTHING — a silent exit 0 is the allow in the PreToolUse protocol, and an
+        // empty write would still be a write on a pipe somebody is parsing. Guarded here rather than
+        // in the sink so the sink stays a dumb port.
+        if (outcome.stdout !== '')
+            this.stdout.write(outcome.stdout);
+        this.processExit.exit(outcome.exitCode);
+    }
+    /**
+     * THE FAIL-CLOSED BOUNDARY FOR THE READ ITSELF, and the reason this is a separate method.
+     *
+     * `runMain` had the stdin read INSIDE the try whose catch produced a deny, so a failure there was
+     * still a structured block. Moving the read behind a port would have quietly narrowed that: a
+     * rejected read (or anything else thrown before the pipeline starts) would escape `run`, land as an
+     * unhandled rejection, and exit non-zero — which PreToolUse reads as a NON-BLOCKING error and lets
+     * the tool call THROUGH. That is the exact inversion of "a broken hook never silently lets an edit
+     * through", and no golden could catch it, because the goldens substitute this very port.
+     *
+     * So the try is restored one level out, around the read AND the pipeline, and it emits the same
+     * bytes `denyForCrash` emits for a null event.
+     */
+    async decide(args) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const raw = await this.stdin.read();
+            return (0, hook_core_1.runPipeline)(raw, args.mode);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            return (0, agent_response_1.denyOutcome)(null, `${CRASH_PREFIX}${error.message}`, 'hook-crash');
+        }
+    }
+};
+exports.HookApp = HookApp;
+exports.HookApp = HookApp = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [hook_ports_1.HookStdinSource, hook_ports_1.HookStdoutSink, hook_ports_1.HookProcessExit])
+], HookApp);
+/**
+ * THE LAST-RESORT FAIL-CLOSED BOUNDARY: the composition root itself could not run.
+ *
+ * `new Container(...)` and `container.get(HookApp)` happen BEFORE any HookApp exists to catch for
+ * them, so an unresolvable binding (a missing decorator, a stripped `design:paramtypes`) would exit
+ * non-zero with a stack on stderr — and a non-zero exit is a non-blocking error, so every guarded tool
+ * call would sail through unjudged for as long as the defect lasted. Low probability; total
+ * consequence. One shared class rather than a copy in each bin, so the two can never drift.
+ *
+ * It writes through `process` directly, and that is correct rather than a leak: by construction there
+ * is no container here to have handed it a port, and this is the same designated terminal boundary the
+ * ports themselves wrap.
+ */
+class HookBootFailure {
+    // webpieces-disable no-any-unknown -- a rejection value is `unknown` by construction; toError() below is the one place that narrowing belongs
+    report(err) {
+        const error = (0, to_error_1.toError)(err);
+        // `null` event ⇒ no `systemMessage`. Deliberate: we never parsed a payload, so we do not know
+        // whether this was a Bash call, and inventing the Bash-shaped deny would be a guess.
+        // webpieces-disable no-process-exit-outside-main -- the hook's exit code IS the Claude Code PreToolUse protocol (exit 0 + JSON = a block); this is the last-resort terminal boundary, reached only when no container could be built to inject a port.
+        process.stdout.write((0, agent_response_1.denyJson)(null, `${CRASH_PREFIX}${error.message}`) + '\n');
+        // webpieces-disable no-process-exit-outside-main -- same terminal boundary; exiting 0 is what makes this a BLOCK rather than a non-blocking error that lets the tool call through.
+        process.exit(0);
+    }
+}
+exports.HookBootFailure = HookBootFailure;
+//# sourceMappingURL=hook-app.js.map