@webpieces/ai-hook-rules 0.4.703 → 0.4.705

package/src/adapters/hook-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/ai-hook-rules/src/adapters/hook-app.ts"],"names":[],"mappings":";;;;AAAA,yCAA2D;AAE3D,2CAA0C;AAC1C,qDAAyD;AAEzD,6CAAgF;AAChF,+CAA2C;AAE3C,kGAAkG;AAClG,uGAAuG;AACvG,aAAa;AACb,MAAM,YAAY,GAAG,yDAAyD,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEI,IAAM,OAAO,GAAb,MAAM,OAAO;IACC,KAAK,CAAkB;IACvB,MAAM,CAAiB;IACvB,WAAW,CAAkB;IAE9C,YAAY,KAAsB,EAAE,MAAsB,EAAE,WAA4B;QACpF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAc;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,4FAA4F;QAC5F,6FAA6F;QAC7F,6CAA6C;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,MAAM,CAAC,IAAc;QAC/B,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,IAAA,uBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,IAAA,4BAAW,EAAC,IAAI,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;QAC9E,CAAC;IACL,CAAC;CACJ,CAAA;AA3CY,0BAAO;kBAAP,OAAO;IADnB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAMlB,4BAAe,EAAU,2BAAc,EAAe,4BAAe;GAL/E,OAAO,CA2CnB;AAED;;;;;;;;;;;;GAYG;AACH,MAAa,eAAe;IACxB,8IAA8I;IAC9I,MAAM,CAAC,GAAY;QACf,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,8FAA8F;QAC9F,qFAAqF;QACrF,sPAAsP;QACtP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,yBAAQ,EAAC,IAAI,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/E,mLAAmL;QACnL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACJ;AAXD,0CAWC","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\n\nimport { runPipeline } from './hook-core';\nimport { denyJson, denyOutcome } from './agent-response';\nimport { HookArgs, HookOutcome } from './hook-outcome';\nimport { HookStdinSource, HookStdoutSink, HookProcessExit } from './hook-ports';\nimport { toError } from '../core/to-error';\n\n// The reason text a crash surfaces to the agent. ONE literal, used by both fail-closed boundaries\n// below and worded identically to `denyForCrash`'s so the audit trail reads the same whichever of them\n// caught it.\nconst CRASH_PREFIX = '[ai-hooks] hook crashed unexpectedly — failing closed: ';\n\n/**\n * THE COMPOSITION ROOT'S APP — one PreToolUse invocation, end to end.\n *\n * Production is three lines in `guards-hook.ts` / `rules-hook.ts`:\n *\n *     const container = new Container({ autobind: true });\n *     const app = container.get(HookApp);\n *     await app.run(new HookArgs('guards'));\n *\n * and a test is the SAME three lines with the ports rebound to doubles — canned stdin, a captured\n * stdout, a recorded exit code. That is the whole difference, and it is the point: the test boundary\n * is cut JUST ABOVE the injection point, so the seam a test drives is the seam production drives.\n *\n * What this replaces: `runMain(mode)`, which read stdin itself and reached `process.stdout.write` /\n * `process.exit` from a dozen frames down. `runMain` is DELETED, not kept alongside — two spellings of\n * one entry point is the shim shape this repo rejects outright (see CLAUDE.md, \"NO webpieces surface\n * is released backwards-compatible\"). Nothing outside this file names it any more.\n *\n * The order of observable effects is unchanged from `runMain`: the invocation's audit line is flushed\n * at the emit boundary inside the pipeline, the decision bytes are written next, and the process exits\n * last through the injected exit port.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class HookApp {\n    private readonly stdin: HookStdinSource;\n    private readonly stdout: HookStdoutSink;\n    private readonly processExit: HookProcessExit;\n\n    constructor(stdin: HookStdinSource, stdout: HookStdoutSink, processExit: HookProcessExit) {\n        this.stdin = stdin;\n        this.stdout = stdout;\n        this.processExit = processExit;\n    }\n\n    async run(args: HookArgs): Promise<void> {\n        const outcome = await this.decide(args);\n        // An ALLOW writes NOTHING — a silent exit 0 is the allow in the PreToolUse protocol, and an\n        // empty write would still be a write on a pipe somebody is parsing. Guarded here rather than\n        // in the sink so the sink stays a dumb port.\n        if (outcome.stdout !== '') this.stdout.write(outcome.stdout);\n        this.processExit.exit(outcome.exitCode);\n    }\n\n    /**\n     * THE FAIL-CLOSED BOUNDARY FOR THE READ ITSELF, and the reason this is a separate method.\n     *\n     * `runMain` had the stdin read INSIDE the try whose catch produced a deny, so a failure there was\n     * still a structured block. Moving the read behind a port would have quietly narrowed that: a\n     * rejected read (or anything else thrown before the pipeline starts) would escape `run`, land as an\n     * unhandled rejection, and exit non-zero — which PreToolUse reads as a NON-BLOCKING error and lets\n     * the tool call THROUGH. That is the exact inversion of \"a broken hook never silently lets an edit\n     * through\", and no golden could catch it, because the goldens substitute this very port.\n     *\n     * So the try is restored one level out, around the read AND the pipeline, and it emits the same\n     * bytes `denyForCrash` emits for a null event.\n     */\n    private async decide(args: HookArgs): Promise<HookOutcome> {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const raw = await this.stdin.read();\n            return runPipeline(raw, args.mode);\n        } catch (err: unknown) {\n            const error = toError(err);\n            return denyOutcome(null, `${CRASH_PREFIX}${error.message}`, 'hook-crash');\n        }\n    }\n}\n\n/**\n * THE LAST-RESORT FAIL-CLOSED BOUNDARY: the composition root itself could not run.\n *\n * `new Container(...)` and `container.get(HookApp)` happen BEFORE any HookApp exists to catch for\n * them, so an unresolvable binding (a missing decorator, a stripped `design:paramtypes`) would exit\n * non-zero with a stack on stderr — and a non-zero exit is a non-blocking error, so every guarded tool\n * call would sail through unjudged for as long as the defect lasted. Low probability; total\n * consequence. One shared class rather than a copy in each bin, so the two can never drift.\n *\n * It writes through `process` directly, and that is correct rather than a leak: by construction there\n * is no container here to have handed it a port, and this is the same designated terminal boundary the\n * ports themselves wrap.\n */\nexport class HookBootFailure {\n    // webpieces-disable no-any-unknown -- a rejection value is `unknown` by construction; toError() below is the one place that narrowing belongs\n    report(err: unknown): void {\n        const error = toError(err);\n        // `null` event ⇒ no `systemMessage`. Deliberate: we never parsed a payload, so we do not know\n        // whether this was a Bash call, and inventing the Bash-shaped deny would be a guess.\n        // webpieces-disable no-process-exit-outside-main -- the hook's exit code IS the Claude Code PreToolUse protocol (exit 0 + JSON = a block); this is the last-resort terminal boundary, reached only when no container could be built to inject a port.\n        process.stdout.write(denyJson(null, `${CRASH_PREFIX}${error.message}`) + '\\n');\n        // webpieces-disable no-process-exit-outside-main -- same terminal boundary; exiting 0 is what makes this a BLOCK rather than a non-blocking error that lets the tool call through.\n        process.exit(0);\n    }\n}\n"]}

package/src/adapters/hook-core.d.ts

@@ -1,12 +1,21 @@
 import { HookMode } from '../core/types';
+import { HookOutcome } from './hook-outcome';
 export type { HookMode };
 export type ShimStaleDecision = 'allow-cure' | 'pass' | 'deny';
 export declare function shimStaleRecoveryDecision(toolName: string, command: string, filePath: string): ShimStaleDecision;
 /**
- * Shared entry point for all three Claude Code PreToolUse adapters. `mode` selects which tool kinds
- * to validate; payloads outside the mode's scope pass through (emitAllow). Blocks by emitting a
- * PreToolUse `permissionDecision:"deny"` JSON on stdout (exit 0) — see claude-code-response.ts. Fails
- * CLOSED on any unexpected crash (emits a deny) so a broken hook never silently lets an edit through,
- * and the reason now surfaces in the Claude Code UI instead of being hidden on a stderr+exit-2 block.
+ * THE PIPELINE, from raw stdin bytes to the decision — the whole of `parse -> adapter -> runner ->
+ * emit`, as ONE function returning ONE value.
+ *
+ * `mode` selects which tool kinds to validate; payloads outside the mode's scope pass through
+ * (emitAllow). A block is a PreToolUse `permissionDecision:"deny"` JSON on stdout with exit 0 — see
+ * agent-response.ts. Fails CLOSED on any unexpected crash (returns a deny) so a broken hook never
+ * silently lets an edit through, and the reason surfaces in the agent's UI instead of being hidden on
+ * a stderr+exit-2 block.
+ *
+ * It reads NO stdin, writes NO stdout and calls NO exit: those three couplings are ports owned by
+ * HookApp (see hook-ports.ts), which is what makes the composed pipeline drivable from a test. This
+ * function is what `runMain` was; it is not a second spelling of it — `runMain` is deleted, and
+ * `HookApp.run()` is the only entry point.
  */
-export declare function runMain(mode: HookMode): Promise<void>;
+export declare function runPipeline(raw: string, mode: HookMode): HookOutcome;

package/src/adapters/hook-core.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.shimStaleRecoveryDecision = shimStaleRecoveryDecision;
-exports.runMain = runMain;
+exports.runPipeline = runPipeline;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const runner_1 = require("../core/runner");
@@ -13,69 +13,19 @@ const load_config_1 = require("../core/load-config");
 const rules_config_1 = require("@webpieces/rules-config");
 const types_1 = require("../core/types");
 const to_error_1 = require("../core/to-error");
-const claude_code_response_1 = require("./claude-code-response");
+const agent_response_1 = require("./agent-response");
+const hook_outcome_1 = require("./hook-outcome");
+const agent_payload_1 = require("./agent-payload");
+const agent_adapters_1 = require("./agent-adapters");
+const codex_subagent_guard_1 = require("./codex-subagent-guard");
 const shim_1 = require("../bin/shim");
-const shim_deny_reason_1 = require("../bin/shim-deny-reason");
 const hook_registration_1 = require("../bin/hook-registration");
+const shim_deny_reason_1 = require("../bin/shim-deny-reason");
 const l0_matrix_1 = require("../core/l0-matrix");
 const log_stream_1 = require("../core/log-stream");
 const l0_fault_codes_1 = require("../core/l0-fault-codes");
-const HANDLED_FILE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit']);
-// Read-only tools carry NO guard or code rule, but the guards hook owns the per-invocation audit log
-// (the `calls/` stream). When the guards matcher includes these (see setup.ts GUARDS_HOOK), a
-// log-and-allow fast path records every file the AI opens — so a human can later inspect whether it
-// read a project's design.json BEFORE editing the project. Never blocked. Scoped to Read for now;
-// widen (Grep/Glob/NotebookRead) later if desired.
-const READ_ONLY_TOOLS = new Set(['Read']);
-function readStdin() {
-    return new Promise((resolve) => {
-        let data = '';
-        process.stdin.setEncoding('utf8');
-        process.stdin.on('data', (chunk) => { data += chunk; });
-        process.stdin.on('end', () => resolve(data));
-        process.stdin.on('error', () => resolve(''));
-        if (process.stdin.isTTY)
-            resolve('');
-    });
-}
-function safeParse(raw) {
-    if (!raw || raw.trim() === '')
-        return null;
-    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
-    try {
-        return JSON.parse(raw);
-    }
-    catch (err) {
-        const error = (0, to_error_1.toError)(err);
-        throw new types_1.InformAiError(`Malformed hook input from Claude Code stdin: ${error.message}`, { cause: error });
-    }
-}
-function normalizeToolKind(toolName) {
-    if (HANDLED_FILE_TOOLS.has(toolName))
-        return toolName;
-    return null;
-}
-function normalizeToolInput(toolKind, toolInput) {
-    const filePath = toolInput.file_path;
-    if (!filePath)
-        return null;
-    if (toolKind === 'Write') {
-        return new types_1.NormalizedToolInput(filePath, [
-            new types_1.NormalizedEdit('', toolInput.content || ''),
-        ]);
-    }
-    if (toolKind === 'Edit') {
-        return new types_1.NormalizedToolInput(filePath, [
-            new types_1.NormalizedEdit(toolInput.old_string || '', toolInput.new_string || ''),
-        ]);
-    }
-    if (toolKind === 'MultiEdit') {
-        const raw = Array.isArray(toolInput.edits) ? toolInput.edits : [];
-        const edits = raw.map((e) => new types_1.NormalizedEdit(e.old_string || '', e.new_string || ''));
-        return new types_1.NormalizedToolInput(filePath, edits);
-    }
-    return null;
-}
+const ADAPTERS = new agent_adapters_1.AgentAdapters();
+const SUBAGENT_GUARD = new codex_subagent_guard_1.CodexSubagentSharedTreeGuard();
 // The rule name for a block's audit line: the FIRST rule the report cites, or `fallback` when the
 // report opens with no `[rule]` header (a hand-written guard message). Comma-joined when a report
 // cites several, so `rule=` never silently drops one.
@@ -84,14 +34,23 @@ function blockingRule(report, fallback) {
     const names = (0, rejection_log_1.extractRuleNames)(report);
     return names.length > 0 ? names.join(',') : fallback;
 }
-function handleBash(payload, cwd, mode) {
-    const command = payload.tool_input.command;
-    if (!command || command.trim() === '') {
-        (0, claude_code_response_1.emitAllow)();
+// webpieces-disable no-function-outside-class -- sibling of handleRead()/handleFileTool() in this module; the adapter is module-scope functions by design
+function handleBash(event, cwd, mode) {
+    const command = event.bash === null ? '' : event.bash.command;
+    if (command.trim() === '') {
+        (0, agent_response_1.emitAllow)();
+    }
+    // READ PARITY, and it can only ever be reached from a Codex event: the adapter leaves `reads`
+    // empty for Claude Code, which has a real `Read` tool and its own fast path. A Codex read arrives
+    // as `Bash` running a pager, so without this the read guard and the `calls/` audit trail see none
+    // of them. The command is STILL run through the bash guards below — this adds a verdict, it never
+    // replaces one.
+    for (const readPath of event.reads) {
+        handleRead(event, readPath, cwd, mode);
     }
     const result = (0, runner_1.runBash)(command, cwd, mode);
     if (!result) {
-        (0, claude_code_response_1.emitAllow)();
+        (0, agent_response_1.emitAllow)();
     }
     // NO DECISION LINE HERE. This used to write a generic `bash-guard` line because a Bash deny once
     // had no audit trail at all — but every layer now records its own: L1 into `L1-location/` with its
@@ -101,9 +60,10 @@ function handleBash(payload, cwd, mode) {
     // the guard actually judged, so a `cd`-relocated command scattered one block across two different
     // `.webpieces` directories.
     //
-    // Bash deny → pass 'Bash' so denyJson adds the ANSI-red systemMessage (the only field a Bash deny
-    // shows the human; permissionDecisionReason is invisible on Bash). See claude-code-response.ts.
-    (0, claude_code_response_1.emitDeny)(result.report, 'Bash', blockingRule(result.report, 'bash-guard'), result.fault);
+    // Bash deny → the event's kind is 'Bash', so denyJson adds the ANSI-red systemMessage (the only
+    // field a Bash deny shows the human; permissionDecisionReason is invisible on Bash). See
+    // agent-response.ts.
+    (0, agent_response_1.emitDeny)(event, result.report, blockingRule(result.report, 'bash-guard'), result.fault);
 }
 /**
  * The read-scoped guard pass. Returns normally to ALLOW; only calls emitDeny when the guard fires.
@@ -114,7 +74,7 @@ function handleBash(payload, cwd, mode) {
  * path deliberately inverts the policy: a broken read-guard degrades to a no-op, never to a wedge.
  */
 // webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design
-function handleRead(filePath, cwd, mode) {
+function handleRead(event, filePath, cwd, mode) {
     if (filePath === '')
         return;
     let result = null;
@@ -130,19 +90,58 @@ function handleRead(filePath, cwd, mode) {
     if (!result)
         return;
     (0, rejection_log_1.logRejection)('Read', new types_1.NormalizedToolInput(filePath, []), result, cwd);
-    (0, claude_code_response_1.emitDeny)(result.report, 'Read', blockingRule(result.report, 'read-guard'), result.fault);
+    (0, agent_response_1.emitDeny)(event, result.report, blockingRule(result.report, 'read-guard'), result.fault);
+}
+/**
+ * Read-only tools (Read): audit-log, warm the main-sync cache, then run the ONE read-scoped guard
+ * (read-stale-guard) and allow. Runs BEFORE the general rule engine — no code-style rule ever sees a
+ * Read, and the only way this path can deny is a stale `main`. The audit trail still records every
+ * file the AI opened (see setup.ts).
+ *
+ * Returns normally ONLY when the event is not a Read; otherwise it ends the invocation.
+ */
+// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design
+function handleReadFastPath(event, cwd, mode) {
+    if (event.kind !== 'Read')
+        return;
+    const readPath = event.reads.length > 0 ? event.reads[0] : '';
+    if (mode !== 'rules') {
+        decision_log_1.invocationLog.begin(cwd, event.rawToolName, readPath);
+        // Reads vastly outnumber edits, so refreshing here is what actually keeps the shared
+        // main-sync cache warm for feature-branch-guard. Detached; never slows the read.
+        (0, main_sync_refresh_1.triggerMainSyncRefresh)(cwd, (0, main_sync_timeout_1.branchStateHangTimeoutFor)(cwd));
+    }
+    handleRead(event, readPath, cwd, mode);
+    (0, agent_response_1.emitAllow)();
 }
-function handleFileTool(payload, cwd, mode) {
-    const toolKind = normalizeToolKind(payload.tool_name);
-    if (!toolKind) {
-        (0, claude_code_response_1.emitAllow)();
+/**
+ * The file/edit pipeline, run once per file the call touches.
+ *
+ * `event.files` is a LIST because ONE Codex `apply_patch` carries many files with mixed operations.
+ * A Claude Code event always has exactly one entry, so the loop runs once and the behaviour is the
+ * single-file behaviour it has always had.
+ */
+// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleRead() in this module; the adapter is module-scope functions by design
+function handleFileTool(event, cwd, mode) {
+    if (event.files.length === 0) {
+        (0, agent_response_1.emitAllow)();
+    }
+    // A Codex SUBAGENT writing into the tree it shares with its coordinator. Returns null for every
+    // Claude Code event — that harness can hand a subagent its own worktree, and does.
+    const subagentBlock = SUBAGENT_GUARD.check(event, new rules_config_1.RepoRootFinder().resolveRepoRoot(cwd));
+    if (subagentBlock) {
+        (0, agent_response_1.emitDeny)(event, subagentBlock.report, codex_subagent_guard_1.CODEX_SUBAGENT_RULE, subagentBlock.fault);
     }
-    const input = normalizeToolInput(toolKind, payload.tool_input);
-    if (!input) {
-        (0, claude_code_response_1.emitAllow)();
+    for (const file of event.files) {
+        handleOneFile(event, file, cwd, mode);
     }
+    (0, agent_response_1.emitAllow)();
+}
+// webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design
+function handleOneFile(event, file, cwd, mode) {
+    const input = file.input;
     // Always allow edits to webpieces.config.json — it's the fix target when the config is broken.
-    // This exits BEFORE run(), so feature-branch-guard never sees a config edit; record that so the
+    // This returns BEFORE run(), so feature-branch-guard never sees a config edit; record that so the
     // audit trail explains why a config edit on a bad branch was not blocked (see decision-log.ts).
     if (path.basename(input.filePath) === load_config_1.CONFIG_FILENAME) {
         if (mode !== 'rules') {
@@ -150,22 +149,21 @@ function handleFileTool(payload, cwd, mode) {
             // root, not the AI's cwd — resolve it so a config edit from a subdir doesn't create a
             // stray `<subdir>/.webpieces` tree.
             const root = new rules_config_1.RepoRootFinder().resolveRepoRoot(cwd);
-            (0, decision_log_1.logGuardDecision)(root, new decision_log_1.GuardDecision('feature-branch-guard', toolKind, input.filePath, (0, decision_log_1.branchForLog)(root), 'ALLOW_EXEMPT', 'config-bypass (feature-branch-guard skipped)', '-', l0_fault_codes_1.L0_FAULT_NONE, (0, decision_log_1.matrixL2Row)('config-bypass (feature-branch-guard skipped)')));
+            (0, decision_log_1.logGuardDecision)(root, new decision_log_1.GuardDecision('feature-branch-guard', file.toolKind, input.filePath, (0, decision_log_1.branchForLog)(root), 'ALLOW_EXEMPT', 'config-bypass (feature-branch-guard skipped)', '-', l0_fault_codes_1.L0_FAULT_NONE, (0, decision_log_1.matrixL2Row)('config-bypass (feature-branch-guard skipped)')));
             // The guard's own refresh trigger lives inside its check(), which we skip here — so warm
             // the cache directly, otherwise a session that only edits webpieces.config.json never
             // refreshes the sync status. Fire-and-forget; never blocks the edit.
             (0, main_sync_refresh_1.triggerMainSyncRefresh)(root, (0, main_sync_timeout_1.branchStateHangTimeoutFor)(cwd));
         }
-        (0, claude_code_response_1.emitAllow)();
-    }
-    const result = (0, runner_1.run)(toolKind, input, cwd, mode);
-    if (!result) {
-        (0, claude_code_response_1.emitAllow)();
+        return;
     }
-    (0, rejection_log_1.logRejection)(toolKind, input, result, cwd);
-    // File-tool deny → pass the Write/Edit/MultiEdit kind so denyJson omits systemMessage (the reason
-    // already renders red natively for these tools). See claude-code-response.ts.
-    (0, claude_code_response_1.emitDeny)(result.report, toolKind, blockingRule(result.report, 'file-guard'), result.fault);
+    const result = (0, runner_1.run)(file.toolKind, input, cwd, mode);
+    if (!result)
+        return;
+    (0, rejection_log_1.logRejection)(file.toolKind, input, result, cwd);
+    // File-tool deny → the event's kind is 'File', so denyJson omits systemMessage (the reason
+    // already renders red natively for these tools). See agent-response.ts.
+    (0, agent_response_1.emitDeny)(event, result.report, blockingRule(result.report, 'file-guard'), result.fault);
 }
 // webpieces-disable no-function-outside-class -- pure decision helper beside the adapter's other module-scope functions; exported for direct unit testing.
 function shimStaleRecoveryDecision(toolName, command, filePath) {
@@ -187,8 +185,13 @@ function shimStaleRecoveryDecision(toolName, command, filePath) {
 // shimStaleRecoveryDecision): the whole L0 allowlist, any Read, and editing webpieces.config.json. We deny +
 // tell the AI; we do NOT silently rewrite the file under it. 'rules' hook skips it (guards owns the
 // shim). Returns normally (pass / nothing to do) or exits via emitAllow/emitDeny.
+//
+// It asks the allowlist about the RAW WIRE FIELDS, not about the normalized event, and that ordering is
+// deliberate: L0 has to hold on a tree too broken to trust anything above it, including the adapters.
+// The raw fields are the same key names in both harnesses (measured), so one reading serves both, and
+// the answer cannot change because a normalizer changed. `event` is here only to decorate the deny.
 // webpieces-disable no-function-outside-class -- sibling of handleBash()/handleFileTool() in this module; the adapter is module-scope functions by design
-function enforceCommittedShim(payload, cwd, mode) {
+function enforceCommittedShim(payload, event, cwd, mode) {
     // ONE root for the whole decision, resolved from the RUNNING MODULE (governingShimRoot), never from
     // `cwd`: the shim file we compare and the renderShim() we compare it TO must come from the same
     // install, or the check straddles two trees and can never converge (see governingShimRoot's header).
@@ -210,7 +213,7 @@ function enforceCommittedShim(payload, cwd, mode) {
     if (decision === 'pass')
         return;
     if (decision === 'allow-cure')
-        (0, claude_code_response_1.emitAllow)();
+        (0, agent_response_1.emitAllow)();
     // Drop the L0 matrix doc where the AI can read it and point the deny at it — a Read is entry 1 of
     // the same allowlist, so the pointer is always followable. Best-effort: no doc → no pointer.
     const root = new rules_config_1.RepoRootFinder().resolveRepoRoot(cwd);
@@ -224,96 +227,111 @@ function enforceCommittedShim(payload, cwd, mode) {
     // L0 fault S in GUARD_MATRIX.md's codebook — named as the blocking rule so the invocation line
     // says WHAT stopped the call, not merely that something did, and stamped as `fault=S` so the same
     // grep finds it here as in the sh half's `L0-shim/` stream.
-    // A subagent is discriminated by `agent_id`, which Claude Code populates on stdin only off the main
-    // loop (main falls back to the session id, so the field is absent). Its cure differs: the hooks
+    // A subagent is discriminated by `agent_id`, which BOTH harnesses populate on stdin only off the
+    // main loop (main falls back to the session id / leaves it empty). Its cure differs: the hooks
     // blocking it resolve through CLAUDE_PROJECT_DIR, which names the MAIN tree.
-    const inSubagent = (payload.agent_id ?? '') !== '';
-    (0, claude_code_response_1.emitDeny)((0, shim_deny_reason_1.shimStaleDenyReason)((0, shim_1.installedShimRulesVersion)(), shimRoot ?? '', drifted, inSubagent) + (0, l0_matrix_1.guardMatrixPointer)(docPath), payload.tool_name, 'committed-shim-stale', l0_fault_codes_1.L0_FAULT_SHIM_STALE);
+    const inSubagent = event.agentId !== '';
+    (0, agent_response_1.emitDeny)(event, (0, shim_deny_reason_1.shimStaleDenyReason)((0, shim_1.installedShimRulesVersion)(), shimRoot ?? '', drifted, inSubagent) + (0, l0_matrix_1.guardMatrixPointer)(docPath), 'committed-shim-stale', l0_fault_codes_1.L0_FAULT_SHIM_STALE);
 }
 /**
- * Shared entry point for all three Claude Code PreToolUse adapters. `mode` selects which tool kinds
- * to validate; payloads outside the mode's scope pass through (emitAllow). Blocks by emitting a
- * PreToolUse `permissionDecision:"deny"` JSON on stdout (exit 0) — see claude-code-response.ts. Fails
- * CLOSED on any unexpected crash (emits a deny) so a broken hook never silently lets an edit through,
- * and the reason now surfaces in the Claude Code UI instead of being hidden on a stderr+exit-2 block.
+ * THE PIPELINE, from raw stdin bytes to the decision — the whole of `parse -> adapter -> runner ->
+ * emit`, as ONE function returning ONE value.
+ *
+ * `mode` selects which tool kinds to validate; payloads outside the mode's scope pass through
+ * (emitAllow). A block is a PreToolUse `permissionDecision:"deny"` JSON on stdout with exit 0 — see
+ * agent-response.ts. Fails CLOSED on any unexpected crash (returns a deny) so a broken hook never
+ * silently lets an edit through, and the reason surfaces in the agent's UI instead of being hidden on
+ * a stderr+exit-2 block.
+ *
+ * It reads NO stdin, writes NO stdout and calls NO exit: those three couplings are ports owned by
+ * HookApp (see hook-ports.ts), which is what makes the composed pipeline drivable from a test. This
+ * function is what `runMain` was; it is not a second spelling of it — `runMain` is deleted, and
+ * `HookApp.run()` is the only entry point.
  */
-async function runMain(mode) {
-    // Captured from the payload as soon as it parses so the fail-closed catch below can tell denyJson
-    // which tool it is denying — a crash on a Bash call still gets the visible red systemMessage, a
-    // crash on a file tool does not. Empty (before parse / malformed input) → treated as non-Bash.
-    let toolName = '';
+// webpieces-disable no-function-outside-class -- the module-scope hook body itself, sibling of handleBash()/handleFileTool(); the adapter is module-scope functions by design and must stay callable from a tree too broken to build a DI container
+function runPipeline(raw, mode) {
+    // Captured as soon as the ENVELOPE parses so the fail-closed catch below can tell denyJson which
+    // kind of call it is denying — a crash on a Bash call still gets the visible red systemMessage, a
+    // crash on a file tool does not. Null (before parse / malformed input) → treated as non-Bash.
+    let event = null;
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
     try {
-        const raw = await readStdin();
-        const payload = safeParse(raw);
+        const payload = new agent_payload_1.AgentPayloadParser().parse(raw);
         if (!payload) {
-            (0, claude_code_response_1.emitAllow)();
+            (0, agent_response_1.emitAllow)();
         }
-        toolName = payload.tool_name;
+        // The envelope shape first: it reads only `tool_name` and the identity fields, so it cannot
+        // fail, and it is what the crash path needs. The full normalization below reads `tool_input`
+        // and CAN fail (a malformed Codex patch envelope denies rather than being half-understood).
+        event = ADAPTERS.envelope(payload);
         // BEFORE enforceCommittedShim(), which can itself write a BLOCK line. See LogStream for why
         // all three of session/agent/hook are needed to keep concurrent writers off one file.
-        log_stream_1.logStream.identify(new log_stream_1.StreamIdentity(payload.session_id ?? '', payload.agent_id ?? '', mode));
+        log_stream_1.logStream.identify(new log_stream_1.StreamIdentity(event.sessionId, event.agentId, mode));
         // Prefer the payload cwd (the AI's actual working dir, follows a persisted `cd`) over
         // process.cwd(); they match today, but the payload is the authoritative signal and stays
         // correct if the hook is ever invoked from a fixed dir (e.g. via $CLAUDE_PROJECT_DIR).
         const cwd = payload.cwd ?? process.cwd();
         // Committed-shim self-guard: blocks real work while the committed shim is stale, but keeps the
         // recovery path open (cures, reads, config edit). See enforceCommittedShim / shimStaleRecoveryDecision.
-        enforceCommittedShim(payload, cwd, mode);
-        // Read-only tools (Read): audit-log, warm the main-sync cache, then run the ONE read-scoped
-        // guard (read-stale-guard) and allow. Runs BEFORE the general rule engine — no code-style rule
-        // ever sees a Read, and the only way this path can deny is a stale `main`.
-        // The audit trail still records every file the AI opened (see setup.ts).
-        if (READ_ONLY_TOOLS.has(payload.tool_name)) {
-            const readPath = payload.tool_input.file_path ?? '';
-            if (mode !== 'rules') {
-                decision_log_1.invocationLog.begin(cwd, payload.tool_name, readPath);
-                // Reads vastly outnumber edits, so refreshing here is what actually keeps the shared
-                // main-sync cache warm for feature-branch-guard. Detached; never slows the read.
-                (0, main_sync_refresh_1.triggerMainSyncRefresh)(cwd, (0, main_sync_timeout_1.branchStateHangTimeoutFor)(cwd));
-            }
-            handleRead(readPath, cwd, mode);
-            (0, claude_code_response_1.emitAllow)();
-        }
+        enforceCommittedShim(payload, event, cwd, mode);
+        event = ADAPTERS.toEvent(payload, cwd);
+        // Read-only tools: their own fast path, which never returns when it applies.
+        handleReadFastPath(event, cwd, mode);
         // Per-invocation guard log (the `calls/` stream): tool + command/file + live branch +
         // main-sync-status snapshot, on EVERY guards call, for later cleanup automation. Best-effort;
         // never blocks the call. (The committed shim is no longer silently healed here — a mismatch is
         // reported by the self-guard above, not rewritten out from under the AI.)
         if (mode !== 'rules') {
-            const target = payload.tool_name === 'Bash' ? (payload.tool_input.command ?? '') : (payload.tool_input.file_path ?? '');
-            decision_log_1.invocationLog.begin(cwd, payload.tool_name, target);
+            decision_log_1.invocationLog.begin(cwd, event.rawToolName, logTarget(event));
         }
-        if (payload.tool_name === 'Bash') {
+        if (event.kind === 'Bash') {
             // No code-style rule is bash-scoped, so the rules hook ignores Bash.
             if (mode === 'rules') {
-                (0, claude_code_response_1.emitAllow)();
+                (0, agent_response_1.emitAllow)();
             }
-            handleBash(payload, cwd, mode);
-            return;
+            handleBash(event, cwd, mode);
         }
         // File payloads run in 'rules' (code-style), 'guards' (file-scoped guards like
         // feature-branch-guard), and 'all'. The runner filters to the right category.
-        handleFileTool(payload, cwd, mode);
+        handleFileTool(event, cwd, mode);
     }
     catch (err) {
         const error = (0, to_error_1.toError)(err);
-        denyForCrash(error, toolName);
+        // The pipeline's own terminal control flow, not a failure: emitAllow/emitDeny threw the answer
+        // out to here from wherever they were called. Treating it as a crash would turn every allow
+        // into a deny, so this branch comes FIRST and returns the carried outcome verbatim.
+        if (error instanceof hook_outcome_1.HookTerminated)
+            return error.outcome;
+        return denyForCrash(error, event);
     }
 }
+// What the `calls/` audit line names as the call's target: the command for a shell call, else the first
+// file it touches. A Codex `apply_patch` touching several files names the first — the rejection log and
+// the decision log carry the rest, per file.
+// webpieces-disable no-function-outside-class -- sibling of the module-scope hook entry points in this adapter
+function logTarget(event) {
+    if (event.kind === 'Bash')
+        return event.bash === null ? '' : event.bash.command;
+    return event.files.length > 0 ? event.files[0].input.filePath : '';
+}
 /**
  * The fail-closed boundary for anything that escaped the hook body. An escaped RuleFailError (a rule
- * that threw past the runner's per-rule catch) or an InformAiError (bad config/stdin) both carry an
- * AI-readable message; anything else is an unexpected bug. All three DENY and surface their reason,
- * because a hook that crashed established nothing and must never be read as an allow.
+ * that threw past the runner's per-rule catch) or an InformAiError (bad config/stdin, or a Codex patch
+ * envelope this parser refuses to guess at) both carry an AI-readable message; anything else is an
+ * unexpected bug. All three DENY and surface their reason, because a hook that crashed established
+ * nothing and must never be read as an allow.
+ *
+ * It BUILDS the deny (denyOutcome) rather than throwing it (emitDeny), because it is already inside
+ * the catch that the throw would land in — see HookTerminated. Same bytes either way.
  */
 // webpieces-disable no-function-outside-class -- sibling of the module-scope hook entry points in this adapter; a lone class for one terminal boundary would break the file's shape
-function denyForCrash(error, toolName) {
+function denyForCrash(error, event) {
     if (error instanceof types_1.RuleFailError) {
-        (0, claude_code_response_1.emitDeny)((0, rules_config_1.renderRuleFailForAi)(error), toolName, 'rule-crash');
+        return (0, agent_response_1.denyOutcome)(event, (0, rules_config_1.renderRuleFailForAi)(error), 'rule-crash');
     }
     if (error instanceof types_1.InformAiError) {
-        (0, claude_code_response_1.emitDeny)(error.message, toolName, 'bad-config-or-stdin');
+        return (0, agent_response_1.denyOutcome)(event, error.message, 'bad-config-or-stdin');
     }
-    (0, claude_code_response_1.emitDeny)(`[ai-hooks] hook crashed unexpectedly — failing closed: ${error.message}`, toolName, 'hook-crash');
+    return (0, agent_response_1.denyOutcome)(event, `[ai-hooks] hook crashed unexpectedly — failing closed: ${error.message}`, 'hook-crash');
 }
 //# sourceMappingURL=hook-core.js.map