@webpieces/hook-runtime 0.0.1

package/src/core/apply-patch-parse.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplyPatchParser = void 0;
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const protocol_1 = require("../protocol");
+const protocol_2 = require("../protocol");
+const tooling_common_1 = require("@webpieces/tooling-common");
+const BEGIN_PATCH = '*** Begin Patch';
+const END_PATCH = '*** End Patch';
+const ADD_FILE = '*** Add File: ';
+const UPDATE_FILE = '*** Update File: ';
+const DELETE_FILE = '*** Delete File: ';
+const MOVE_TO = '*** Move to: ';
+const HUNK_HEADER = '@@';
+/**
+ * Parses Codex's `apply_patch` envelope into the same `FileOperation[]` the rest of the hook already
+ * understands, so a Codex edit is judged by the identical rules a Claude edit is.
+ *
+ * The grammar is MEASURED from a live codex-cli 0.151.0 session, not inferred from a diff format it
+ * resembles. Two properties of it drive every design choice here:
+ *
+ *  - ONE envelope carries MANY files with MIXED operations, which is why the result is a LIST of
+ *    `FileOperation` (each with its own kind) rather than one kind for the call.
+ *  - Hunk headers are a BARE `@@` with NO line numbers. A unified-diff `@@ -1,3 +1,4 @@` is therefore
+ *    not a stricter spelling of the same thing — it is an envelope we have never seen, and guessing at
+ *    it is how a guard silently judges the wrong bytes. It is rejected.
+ *
+ * Paths are sometimes relative and sometimes absolute (measured: subagents used relative, the
+ * coordinator absolute), so a relative path is resolved against the payload's `cwd`.
+ *
+ * FAIL CLOSED. Every malformed envelope THROWS `InformAiError`, which the hook's one top-level handler
+ * turns into a deny naming the offending line. A parser that "did its best" on an envelope it did not
+ * understand would hand the rule engine a subset of the real edit and allow the rest unjudged, which is
+ * strictly worse than refusing the call.
+ */
+class ApplyPatchParser {
+    parse(command, cwd) {
+        const lines = command.split('\n');
+        const begin = lines.findIndex((l) => l.trim() === BEGIN_PATCH);
+        if (begin < 0) {
+            throw new tooling_common_1.InformAiError(`[apply-patch] envelope has no '${BEGIN_PATCH}' line — refusing to judge a patch this parser does not recognise.`);
+        }
+        const end = lines.findIndex((l) => l.trim() === END_PATCH);
+        if (end < 0 || end < begin) {
+            throw new tooling_common_1.InformAiError(`[apply-patch] envelope has no '${END_PATCH}' line after '${BEGIN_PATCH}' — refusing to judge a truncated patch.`);
+        }
+        const body = lines.slice(begin + 1, end);
+        const ops = [];
+        let index = 0;
+        while (index < body.length) {
+            const line = body[index];
+            if (line.startsWith(ADD_FILE)) {
+                index = this.parseAdd(body, index, cwd, ops);
+            }
+            else if (line.startsWith(DELETE_FILE)) {
+                ops.push(new protocol_1.FileOperation('Delete', new protocol_2.NormalizedToolInput(this.resolve(line.slice(DELETE_FILE.length), cwd), [])));
+                index += 1;
+            }
+            else if (line.startsWith(UPDATE_FILE)) {
+                index = this.parseUpdate(body, index, cwd, ops);
+            }
+            else if (line.trim() === '') {
+                index += 1;
+            }
+            else {
+                throw new tooling_common_1.InformAiError(`[apply-patch] unexpected line outside any file section: ${JSON.stringify(line)}`);
+            }
+        }
+        if (ops.length === 0) {
+            throw new tooling_common_1.InformAiError('[apply-patch] envelope names no files — refusing to allow a patch whose targets could not be read.');
+        }
+        return ops;
+    }
+    /** `*** Add File: <p>` plus a body of `+` lines → a Write of the joined body. */
+    parseAdd(body, start, cwd, ops) {
+        const filePath = this.resolve(body[start].slice(ADD_FILE.length), cwd);
+        const content = [];
+        let index = start + 1;
+        while (index < body.length && !body[index].startsWith('*** ')) {
+            const line = body[index];
+            if (!line.startsWith('+')) {
+                throw new tooling_common_1.InformAiError(`[apply-patch] '${ADD_FILE.trim()}' body line must begin with '+', got ${JSON.stringify(line)}`);
+            }
+            content.push(line.slice(1));
+            index += 1;
+        }
+        ops.push(new protocol_1.FileOperation('Write', new protocol_2.NormalizedToolInput(filePath, [new protocol_2.NormalizedEdit('', content.join('\n'))])));
+        return index;
+    }
+    /**
+     * `*** Update File: <p>`, an optional `*** Move to: <q>`, then one or more bare-`@@` hunks.
+     *
+     * A `Move to` makes the DESTINATION the judged path. That is the file whose bytes will exist after
+     * the call, so it is the one a path-scoped rule must see; judging the source would let a rename
+     * into a guarded directory land unjudged.
+     */
+    parseUpdate(body, start, cwd, ops) {
+        let index = start + 1;
+        let filePath = this.resolve(body[start].slice(UPDATE_FILE.length), cwd);
+        if (index < body.length && body[index].startsWith(MOVE_TO)) {
+            filePath = this.resolve(body[index].slice(MOVE_TO.length), cwd);
+            index += 1;
+        }
+        const edits = [];
+        while (index < body.length && !body[index].startsWith('*** ')) {
+            const header = body[index];
+            if (header.trim() !== HUNK_HEADER) {
+                throw new tooling_common_1.InformAiError(`[apply-patch] malformed hunk header ${JSON.stringify(header)} — a Codex hunk header is a bare '@@' with no line numbers.`);
+            }
+            index += 1;
+            const oldLines = [];
+            const newLines = [];
+            while (index < body.length && !body[index].startsWith('*** ') && body[index].trim() !== HUNK_HEADER) {
+                const line = body[index];
+                // A bare empty line is a CONTEXT line whose content is empty — the leading space is
+                // routinely stripped by whatever carried the patch, so treating it as malformed would
+                // deny ordinary edits to files with blank lines.
+                if (line === '') {
+                    oldLines.push('');
+                    newLines.push('');
+                }
+                else if (line.startsWith(' ')) {
+                    oldLines.push(line.slice(1));
+                    newLines.push(line.slice(1));
+                }
+                else if (line.startsWith('-')) {
+                    oldLines.push(line.slice(1));
+                }
+                else if (line.startsWith('+')) {
+                    newLines.push(line.slice(1));
+                }
+                else {
+                    throw new tooling_common_1.InformAiError(`[apply-patch] hunk line must begin with ' ', '-' or '+', got ${JSON.stringify(line)}`);
+                }
+                index += 1;
+            }
+            edits.push(new protocol_2.NormalizedEdit(oldLines.join('\n'), newLines.join('\n')));
+        }
+        if (edits.length === 0) {
+            throw new tooling_common_1.InformAiError(`[apply-patch] '${UPDATE_FILE.trim()}' section for ${filePath} carries no '@@' hunk — refusing to allow an edit whose content could not be read.`);
+        }
+        ops.push(new protocol_1.FileOperation('Edit', new protocol_2.NormalizedToolInput(filePath, edits)));
+        return index;
+    }
+    resolve(rawPath, cwd) {
+        const trimmed = rawPath.trim();
+        if (trimmed === '') {
+            throw new tooling_common_1.InformAiError('[apply-patch] a file directive named an empty path.');
+        }
+        return path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);
+    }
+}
+exports.ApplyPatchParser = ApplyPatchParser;
+//# sourceMappingURL=apply-patch-parse.js.map

package/src/core/apply-patch-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-patch-parse.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/core/apply-patch-parse.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAE7B,0CAA4C;AAC5C,0CAAkE;AAClE,8DAA0D;AAE1D,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,OAAO,GAAG,eAAe,CAAC;AAChC,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,gBAAgB;IACzB,KAAK,CAAC,OAAe,EAAE,GAAW;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,CAAC;QAChF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAa,CAAC,kCAAkC,WAAW,oEAAoE,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC;QAC5E,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,8BAAa,CAAC,kCAAkC,SAAS,iBAAiB,WAAW,0CAA0C,CAAC,CAAC;QAC/I,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAoB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAa,CAAC,QAAQ,EAAE,IAAI,8BAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtH,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC5B,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,8BAAa,CAAC,2DAA2D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAa,CAAC,oGAAoG,CAAC,CAAC;QAClI,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,iFAAiF;IACzE,QAAQ,CAAC,IAAuB,EAAE,KAAa,EAAE,GAAW,EAAE,GAAoB;QACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACtB,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,8BAAa,CAAC,kBAAkB,QAAQ,CAAC,IAAI,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,KAAK,IAAI,CAAC,CAAC;QACf,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAa,CAAC,OAAO,EAAE,IAAI,8BAAmB,CAAC,QAAQ,EAAE,CAAC,IAAI,yBAAc,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtH,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,IAAuB,EAAE,KAAa,EAAE,GAAW,EAAE,GAAoB;QACzF,IAAI,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;QACtB,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,KAAK,IAAI,CAAC,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;gBAChC,MAAM,IAAI,8BAAa,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;YACxJ,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;gBAClG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,oFAAoF;gBACpF,sFAAsF;gBACtF,iDAAiD;gBACjD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBACd,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACJ,MAAM,IAAI,8BAAa,CAAC,gEAAgE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpH,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACf,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,yBAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAa,CAAC,kBAAkB,WAAW,CAAC,IAAI,EAAE,iBAAiB,QAAQ,oFAAoF,CAAC,CAAC;QAC/K,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAa,CAAC,MAAM,EAAE,IAAI,8BAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,OAAO,CAAC,OAAe,EAAE,GAAW;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAa,CAAC,qDAAqD,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;CACJ;AAhHD,4CAgHC","sourcesContent":["import * as path from 'path';\n\nimport { FileOperation } from '../protocol';\nimport { NormalizedEdit, NormalizedToolInput } from '../protocol';\nimport { InformAiError } from '@webpieces/tooling-common';\n\nconst BEGIN_PATCH = '*** Begin Patch';\nconst END_PATCH = '*** End Patch';\nconst ADD_FILE = '*** Add File: ';\nconst UPDATE_FILE = '*** Update File: ';\nconst DELETE_FILE = '*** Delete File: ';\nconst MOVE_TO = '*** Move to: ';\nconst HUNK_HEADER = '@@';\n\n/**\n * Parses Codex's `apply_patch` envelope into the same `FileOperation[]` the rest of the hook already\n * understands, so a Codex edit is judged by the identical rules a Claude edit is.\n *\n * The grammar is MEASURED from a live codex-cli 0.151.0 session, not inferred from a diff format it\n * resembles. Two properties of it drive every design choice here:\n *\n *  - ONE envelope carries MANY files with MIXED operations, which is why the result is a LIST of\n *    `FileOperation` (each with its own kind) rather than one kind for the call.\n *  - Hunk headers are a BARE `@@` with NO line numbers. A unified-diff `@@ -1,3 +1,4 @@` is therefore\n *    not a stricter spelling of the same thing — it is an envelope we have never seen, and guessing at\n *    it is how a guard silently judges the wrong bytes. It is rejected.\n *\n * Paths are sometimes relative and sometimes absolute (measured: subagents used relative, the\n * coordinator absolute), so a relative path is resolved against the payload's `cwd`.\n *\n * FAIL CLOSED. Every malformed envelope THROWS `InformAiError`, which the hook's one top-level handler\n * turns into a deny naming the offending line. A parser that \"did its best\" on an envelope it did not\n * understand would hand the rule engine a subset of the real edit and allow the rest unjudged, which is\n * strictly worse than refusing the call.\n */\nexport class ApplyPatchParser {\n    parse(command: string, cwd: string): readonly FileOperation[] {\n        const lines = command.split('\\n');\n        const begin = lines.findIndex((l: string): boolean => l.trim() === BEGIN_PATCH);\n        if (begin < 0) {\n            throw new InformAiError(`[apply-patch] envelope has no '${BEGIN_PATCH}' line — refusing to judge a patch this parser does not recognise.`);\n        }\n        const end = lines.findIndex((l: string): boolean => l.trim() === END_PATCH);\n        if (end < 0 || end < begin) {\n            throw new InformAiError(`[apply-patch] envelope has no '${END_PATCH}' line after '${BEGIN_PATCH}' — refusing to judge a truncated patch.`);\n        }\n\n        const body = lines.slice(begin + 1, end);\n        const ops: FileOperation[] = [];\n        let index = 0;\n        while (index < body.length) {\n            const line = body[index];\n            if (line.startsWith(ADD_FILE)) {\n                index = this.parseAdd(body, index, cwd, ops);\n            } else if (line.startsWith(DELETE_FILE)) {\n                ops.push(new FileOperation('Delete', new NormalizedToolInput(this.resolve(line.slice(DELETE_FILE.length), cwd), [])));\n                index += 1;\n            } else if (line.startsWith(UPDATE_FILE)) {\n                index = this.parseUpdate(body, index, cwd, ops);\n            } else if (line.trim() === '') {\n                index += 1;\n            } else {\n                throw new InformAiError(`[apply-patch] unexpected line outside any file section: ${JSON.stringify(line)}`);\n            }\n        }\n        if (ops.length === 0) {\n            throw new InformAiError('[apply-patch] envelope names no files — refusing to allow a patch whose targets could not be read.');\n        }\n        return ops;\n    }\n\n    /** `*** Add File: <p>` plus a body of `+` lines → a Write of the joined body. */\n    private parseAdd(body: readonly string[], start: number, cwd: string, ops: FileOperation[]): number {\n        const filePath = this.resolve(body[start].slice(ADD_FILE.length), cwd);\n        const content: string[] = [];\n        let index = start + 1;\n        while (index < body.length && !body[index].startsWith('*** ')) {\n            const line = body[index];\n            if (!line.startsWith('+')) {\n                throw new InformAiError(`[apply-patch] '${ADD_FILE.trim()}' body line must begin with '+', got ${JSON.stringify(line)}`);\n            }\n            content.push(line.slice(1));\n            index += 1;\n        }\n        ops.push(new FileOperation('Write', new NormalizedToolInput(filePath, [new NormalizedEdit('', content.join('\\n'))])));\n        return index;\n    }\n\n    /**\n     * `*** Update File: <p>`, an optional `*** Move to: <q>`, then one or more bare-`@@` hunks.\n     *\n     * A `Move to` makes the DESTINATION the judged path. That is the file whose bytes will exist after\n     * the call, so it is the one a path-scoped rule must see; judging the source would let a rename\n     * into a guarded directory land unjudged.\n     */\n    private parseUpdate(body: readonly string[], start: number, cwd: string, ops: FileOperation[]): number {\n        let index = start + 1;\n        let filePath = this.resolve(body[start].slice(UPDATE_FILE.length), cwd);\n        if (index < body.length && body[index].startsWith(MOVE_TO)) {\n            filePath = this.resolve(body[index].slice(MOVE_TO.length), cwd);\n            index += 1;\n        }\n        const edits: NormalizedEdit[] = [];\n        while (index < body.length && !body[index].startsWith('*** ')) {\n            const header = body[index];\n            if (header.trim() !== HUNK_HEADER) {\n                throw new InformAiError(`[apply-patch] malformed hunk header ${JSON.stringify(header)} — a Codex hunk header is a bare '@@' with no line numbers.`);\n            }\n            index += 1;\n            const oldLines: string[] = [];\n            const newLines: string[] = [];\n            while (index < body.length && !body[index].startsWith('*** ') && body[index].trim() !== HUNK_HEADER) {\n                const line = body[index];\n                // A bare empty line is a CONTEXT line whose content is empty — the leading space is\n                // routinely stripped by whatever carried the patch, so treating it as malformed would\n                // deny ordinary edits to files with blank lines.\n                if (line === '') {\n                    oldLines.push('');\n                    newLines.push('');\n                } else if (line.startsWith(' ')) {\n                    oldLines.push(line.slice(1));\n                    newLines.push(line.slice(1));\n                } else if (line.startsWith('-')) {\n                    oldLines.push(line.slice(1));\n                } else if (line.startsWith('+')) {\n                    newLines.push(line.slice(1));\n                } else {\n                    throw new InformAiError(`[apply-patch] hunk line must begin with ' ', '-' or '+', got ${JSON.stringify(line)}`);\n                }\n                index += 1;\n            }\n            edits.push(new NormalizedEdit(oldLines.join('\\n'), newLines.join('\\n')));\n        }\n        if (edits.length === 0) {\n            throw new InformAiError(`[apply-patch] '${UPDATE_FILE.trim()}' section for ${filePath} carries no '@@' hunk — refusing to allow an edit whose content could not be read.`);\n        }\n        ops.push(new FileOperation('Edit', new NormalizedToolInput(filePath, edits)));\n        return index;\n    }\n\n    private resolve(rawPath: string, cwd: string): string {\n        const trimmed = rawPath.trim();\n        if (trimmed === '') {\n            throw new InformAiError('[apply-patch] a file directive named an empty path.');\n        }\n        return path.isAbsolute(trimmed) ? trimmed : path.resolve(cwd, trimmed);\n    }\n}\n"]}

package/src/core/build-context.d.ts

@@ -0,0 +1,11 @@
+import { EffectiveTree } from './effective-tree';
+import { GovernedPath } from './target-tree';
+import { EditContext, FileContext, BashContext } from './types';
+import { ToolKind, NormalizedToolInput } from '../protocol';
+export declare class BuiltContexts {
+    readonly fileContext: FileContext;
+    readonly editContexts: readonly EditContext[];
+    constructor(fileContext: FileContext, editContexts: readonly EditContext[]);
+}
+export declare function buildContexts(toolKind: ToolKind, input: NormalizedToolInput, workspaceRoot: string, governed: GovernedPath): BuiltContexts;
+export declare function buildBashContext(command: string, tree: EffectiveTree): BashContext;

package/src/core/build-context.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BuiltContexts = void 0;
+exports.buildContexts = buildContexts;
+exports.buildBashContext = buildBashContext;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const strip_ts_noise_1 = require("./strip-ts-noise");
+const disable_directives_1 = require("./disable-directives");
+const types_1 = require("./types");
+class BuiltContexts {
+    fileContext;
+    editContexts;
+    constructor(fileContext, editContexts) {
+        this.fileContext = fileContext;
+        this.editContexts = editContexts;
+    }
+}
+exports.BuiltContexts = BuiltContexts;
+// webpieces-disable no-function-outside-class -- existing stateless module helper moved intact with its callers; ownership extraction preserves its functional API
+function buildContexts(toolKind, input, workspaceRoot, governed) {
+    const filePath = input.filePath;
+    const relativePath = governed.relativePath;
+    const edits = input.edits;
+    const currentFileLines = readCurrentFileLines(filePath);
+    let linesAdded = 0;
+    let linesRemoved = 0;
+    for (const e of edits) {
+        linesAdded += countLines(e.newString);
+        linesRemoved += countLines(e.oldString);
+    }
+    const projectedFileLines = toolKind === 'Write'
+        ? countLines(edits.length > 0 ? edits[0].newString : '')
+        : currentFileLines + linesAdded - linesRemoved;
+    const fileContext = new types_1.FileContext(toolKind, filePath, relativePath, workspaceRoot, currentFileLines, linesAdded, linesRemoved, projectedFileLines, governed.treeRoot, governed.treeRelativePath);
+    const editContexts = edits.map((e, idx) => {
+        const addedContent = e.newString;
+        const stripped = (0, strip_ts_noise_1.stripTsNoise)(addedContent);
+        const isLineDisabled = (0, disable_directives_1.createIsLineDisabled)(addedContent);
+        return new types_1.EditContext(toolKind, idx, edits.length, filePath, relativePath, workspaceRoot, addedContent, stripped, addedContent.split('\n'), stripped.split('\n'), e.oldString, isLineDisabled);
+    });
+    return new BuiltContexts(fileContext, editContexts);
+}
+// The bash context is built from the RESOLVED tree, not the shell's cwd: `tree.root` is the worktree
+// the command acts on (what the guards must judge) while `tree.governedRoot` still owns the config.
+// webpieces-disable no-function-outside-class -- sibling of buildContexts() above; this module is a pair of module-scope context factories and a lone class for one of them would break its shape
+function buildBashContext(command, tree) {
+    return new types_1.BashContext(command, tree.root, tree.effectiveCwd, tree.governedRoot);
+}
+// webpieces-disable no-function-outside-class -- existing stateless module helper moved intact with its callers; ownership extraction preserves its functional API
+function readCurrentFileLines(filePath) {
+    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        return countLines(content);
+    }
+    catch (err) {
+        // eslint-disable-next-line @webpieces/catch-error-pattern -- file-not-found is expected for new Write targets
+        void err;
+        return 0;
+    }
+}
+// webpieces-disable no-function-outside-class -- existing stateless module helper moved intact with its callers; ownership extraction preserves its functional API
+function countLines(s) {
+    if (!s)
+        return 0;
+    return s.split('\n').length;
+}
+//# sourceMappingURL=build-context.js.map

package/src/core/build-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-context.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/core/build-context.ts"],"names":[],"mappings":";;;AAoBA,sCAyDC;AAKD,4CAEC;;AApFD,+CAAyB;AAIzB,qDAAgD;AAChD,6DAA4D;AAC5D,mCAAgE;AAGhE,MAAa,aAAa;IACb,WAAW,CAAc;IACzB,YAAY,CAAyB;IAE9C,YAAY,WAAwB,EAAE,YAAoC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACrC,CAAC;CACJ;AARD,sCAQC;AAED,mKAAmK;AACnK,SAAgB,aAAa,CACzB,QAAkB,EAClB,KAA0B,EAC1B,aAAqB,EACrB,QAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE1B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtC,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,kBAAkB,GACpB,QAAQ,KAAK,OAAO;QAChB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,CAAC,CAAC,gBAAgB,GAAG,UAAU,GAAG,YAAY,CAAC;IAEvD,MAAM,WAAW,GAAG,IAAI,mBAAW,CAC/B,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,kBAAkB,EAClB,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,gBAAgB,CAC5B,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,YAAY,GAAG,CAAC,CAAC,SAAS,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,6BAAY,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,cAAc,GAAG,IAAA,yCAAoB,EAAC,YAAY,CAAC,CAAC;QAC1D,OAAO,IAAI,mBAAW,CAClB,QAAQ,EACR,GAAG,EACH,KAAK,CAAC,MAAM,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EACxB,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EACpB,CAAC,CAAC,SAAS,EACX,cAAc,CACjB,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,aAAa,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,qGAAqG;AACrG,oGAAoG;AACpG,kMAAkM;AAClM,SAAgB,gBAAgB,CAAC,OAAe,EAAE,IAAmB;IACjE,OAAO,IAAI,mBAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;AACrF,CAAC;AAED,mKAAmK;AACnK,SAAS,oBAAoB,CAAC,QAAgB;IAC1C,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,8GAA8G;QAC9G,KAAK,GAAG,CAAC;QACT,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAED,mKAAmK;AACnK,SAAS,UAAU,CAAC,CAAS;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC","sourcesContent":["import * as fs from 'fs';\n\nimport { EffectiveTree } from './effective-tree';\nimport { GovernedPath } from './target-tree';\nimport { stripTsNoise } from './strip-ts-noise';\nimport { createIsLineDisabled } from './disable-directives';\nimport { EditContext, FileContext, BashContext } from './types';\nimport { ToolKind, NormalizedToolInput, NormalizedEdit } from '../protocol';\n\nexport class BuiltContexts {\n    readonly fileContext: FileContext;\n    readonly editContexts: readonly EditContext[];\n\n    constructor(fileContext: FileContext, editContexts: readonly EditContext[]) {\n        this.fileContext = fileContext;\n        this.editContexts = editContexts;\n    }\n}\n\n// webpieces-disable no-function-outside-class -- existing stateless module helper moved intact with its callers; ownership extraction preserves its functional API\nexport function buildContexts(\n    toolKind: ToolKind,\n    input: NormalizedToolInput,\n    workspaceRoot: string,\n    governed: GovernedPath,\n): BuiltContexts {\n    const filePath = input.filePath;\n    const relativePath = governed.relativePath;\n    const edits = input.edits;\n\n    const currentFileLines = readCurrentFileLines(filePath);\n    let linesAdded = 0;\n    let linesRemoved = 0;\n    for (const e of edits) {\n        linesAdded += countLines(e.newString);\n        linesRemoved += countLines(e.oldString);\n    }\n\n    const projectedFileLines =\n        toolKind === 'Write'\n            ? countLines(edits.length > 0 ? edits[0].newString : '')\n            : currentFileLines + linesAdded - linesRemoved;\n\n    const fileContext = new FileContext(\n        toolKind,\n        filePath,\n        relativePath,\n        workspaceRoot,\n        currentFileLines,\n        linesAdded,\n        linesRemoved,\n        projectedFileLines,\n        governed.treeRoot,\n        governed.treeRelativePath,\n    );\n\n    const editContexts = edits.map((e, idx) => {\n        const addedContent = e.newString;\n        const stripped = stripTsNoise(addedContent);\n        const isLineDisabled = createIsLineDisabled(addedContent);\n        return new EditContext(\n            toolKind,\n            idx,\n            edits.length,\n            filePath,\n            relativePath,\n            workspaceRoot,\n            addedContent,\n            stripped,\n            addedContent.split('\\n'),\n            stripped.split('\\n'),\n            e.oldString,\n            isLineDisabled,\n        );\n    });\n\n    return new BuiltContexts(fileContext, editContexts);\n}\n\n// The bash context is built from the RESOLVED tree, not the shell's cwd: `tree.root` is the worktree\n// the command acts on (what the guards must judge) while `tree.governedRoot` still owns the config.\n// webpieces-disable no-function-outside-class -- sibling of buildContexts() above; this module is a pair of module-scope context factories and a lone class for one of them would break its shape\nexport function buildBashContext(command: string, tree: EffectiveTree): BashContext {\n    return new BashContext(command, tree.root, tree.effectiveCwd, tree.governedRoot);\n}\n\n// webpieces-disable no-function-outside-class -- existing stateless module helper moved intact with its callers; ownership extraction preserves its functional API\nfunction readCurrentFileLines(filePath: string): number {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const content = fs.readFileSync(filePath, 'utf8');\n        return countLines(content);\n    } catch (err: unknown) {\n        // eslint-disable-next-line @webpieces/catch-error-pattern -- file-not-found is expected for new Write targets\n        void err;\n        return 0;\n    }\n}\n\n// webpieces-disable no-function-outside-class -- existing stateless module helper moved intact with its callers; ownership extraction preserves its functional API\nfunction countLines(s: string): number {\n    if (!s) return 0;\n    return s.split('\\n').length;\n}\n"]}

package/src/core/command-scan.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Shared shell-command scanning for the bash guards.
+ *
+ * A guard that bans a command family (`git merge`, `git push`, …) must answer one question
+ * precisely: *does this command actually invoke `git <subcommand>`?* A bare
+ * `/\bgit\s+merge\b/.test(command)` gets that wrong in both directions:
+ *
+ *  - False positive: `grep 'git merge main' notes.md` or `echo "git rebase main"` merely MENTION
+ *    the phrase. A diagnostic grep was blocked this way while triaging the incident that motivated
+ *    the merge/rebase ban.
+ *  - False positive: `\b` sits between `e` and `-`, so `/\bgit\s+merge\b/` matches the read-only
+ *    `git merge-base origin/main HEAD` — which appears in this repo's own documented build command.
+ *
+ * Both classes vanish if you tokenize instead of substring-match: a command invokes git only when a
+ * segment's first word IS `git`, and the subcommand is then an exact token (`merge-base` is simply
+ * not the token `merge`). No lookahead regex needed.
+ */
+/**
+ * The shell operator that JOINED one segment to the one before it. `'none'` for the first segment.
+ *
+ * This used to be a single boolean, `pipedInto`, and the widening is what makes composition
+ * judgeable. A pipe is only one of the joins whose MEANING differs: `cure && work` short-circuits, so
+ * the work cannot run when the cure failed, while `cure ; work` discards the cure's exit code and
+ * runs the work anyway. A boolean that answered only "was it a pipe?" threw that distinction away,
+ * and a guard cannot refuse the dangerous join while allowing the safe one without it.
+ */
+export type SegmentJoin = 'none' | '|' | '&&' | '||' | ';' | '&' | '\n' | '(' | ')';
+/**
+ * One invoked segment of a command, plus the operator that joined it to its predecessor.
+ *
+ * `join === '|'` is what separates `git log | grep foo` (grep consumes the pipe — reads no file) from
+ * `grep foo src/` (grep reads the working tree). A guard that cares about which FILES a command
+ * reads cannot tell those apart from the segment text alone, because splitting on `|` throws exactly
+ * that fact away. `join === '&&'` vs `';'` is the same argument one operator over — see
+ * {@link SegmentJoin}. Data-only, so a class (per CLAUDE.md).
+ */
+export declare class CommandSegment {
+    text: string;
+    join: SegmentJoin;
+    constructor(text: string, join: SegmentJoin);
+}
+export declare class CommandScanner {
+    /**
+     * Split a raw command into individually-invoked segments.
+     *
+     * Splits on `&&`, `||`, `;`, `|`, `&`, newline, and the `(`/`)` of subshells and `$(…)` command
+     * substitution — the last of these matters, since it means `--base=$(git rebase main)` is scanned
+     * as its own `git rebase main` segment rather than hiding inside a `pnpm …` segment.
+     *
+     * Quoted spans are opaque: a separator inside quotes is literal text, so
+     * `git commit -m "fix; ship it"` stays one segment. (Corollary: a `$(…)` nested inside double
+     * quotes is not split out. Bash would expand it; we do not scan it. Contrived enough to accept.)
+     */
+    commandSegments(command: string): readonly string[];
+    /**
+     * commandSegments, but each segment also carries the OPERATOR that joined it to its predecessor.
+     * Only a guard reasoning about which files a segment reads, or about whether a failed first
+     * segment can stop the rest, needs that; everything else uses commandSegments, which is this
+     * method with the join dropped.
+     */
+    segmentsWithJoins(command: string): readonly CommandSegment[];
+    /**
+     * One segment's shell words, with wrappers/env-assignments stripped, so `words('sudo cat a b')`
+     * is `['cat', 'a', 'b']`. The public view of the same tokenizer gitSubcommand uses — a guard that
+     * must inspect a NON-git command's arguments (which paths does this `grep` actually read?) needs
+     * the tokens, and re-splitting on whitespace in the guard would get quoting wrong.
+     */
+    words(segment: string): readonly string[];
+    /**
+     * The git subcommand a segment invokes, or null when the segment does not invoke git at all
+     * (a different program, a mere mention inside quotes, an empty segment).
+     *
+     * Returns the subcommand as an EXACT token: `git merge-base …` yields `'merge-base'`, never `'merge'`.
+     */
+    gitSubcommand(segment: string): string | null;
+    /**
+     * gitSubcommand, for a caller that already holds the segment's effective words (ShellSegmentScan
+     * strips leading shell keywords, so `do git status` must be resolved from ITS words, not from the
+     * raw segment text where `do` is the command).
+     */
+    gitSubcommandOf(words: readonly string[]): string | null;
+    /**
+     * The ARGUMENTS following `git <subcommand>` in this segment, or null when the segment does not
+     * invoke that subcommand.
+     *
+     * `gitSubcommand` answers *which* subcommand; a guard that judges the subcommand's own flags needs
+     * the tokens after it, and slicing them in the guard would mean re-deriving where the subcommand
+     * sits — i.e. re-deriving the `sudo` / `env VAR=x` / `-C <path>` skipping this class exists to own.
+     * `git -C /x commit -m "msg"` yields `['-m', 'msg']`, never `['/x', 'commit', '-m', 'msg']`.
+     *
+     * The tokens are QUOTE-STRIPPED (see tokenize), so a quoted argument arrives as ONE token holding
+     * its literal text — newlines, backticks and all. That is what makes an argument's CONTENT
+     * inspectable at all.
+     */
+    gitSubcommandArgs(segment: string, subcommand: string): readonly string[] | null;
+    /** Index of the subcommand token in already-prefix-stripped words, or -1 when git is not invoked. */
+    private gitSubcommandIndex;
+    /**
+     * The segment's words with the package-manager WRAPPER stripped, so `pnpm exec vitest run` and
+     * `vitest run` reduce to the same words. `pnpm --silent run build-all` → `['build-all']`.
+     *
+     * Lives HERE rather than in a guard because two guards now need it and they must agree: one blocks a
+     * whole-repo build, the other blocks piping a build's output. If they disagreed about whether
+     * `npx wp-build` is `wp-build`, one of them would have a spelling-shaped side door — which is exactly
+     * the failure mode the runner stripping exists to close.
+     */
+    runnerStrippedWords(segment: string): readonly string[];
+    /** `./node_modules/.bin/nx` and `/usr/local/bin/pnpm.cmd` are the programs `nx` and `pnpm`. */
+    programName(token: string): string;
+    /** True when a package-manager runner precedes the program (`pnpm …`, `npx …`). */
+    viaRunner(segment: string): boolean;
+    /** True when this segment actually invokes `git <subcommand>`. */
+    invokesGit(segment: string, subcommand: string): boolean;
+    /** True when ANY segment of the command invokes one of `subcommands`. */
+    commandInvokesAnyGit(command: string, subcommands: readonly string[]): boolean;
+    /**
+     * Split one segment into shell words, dropping quote characters (so the ARGUMENT of
+     * `echo "git merge main"` is the single word `git merge main`, never the word `git`).
+     */
+    private tokenize;
+    private stripPrefixes;
+}