@webpieces/hook-runtime 0.0.1

package/src/core/types.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlockedResult = exports.RuleGroup = exports.FileContext = exports.BashContext = exports.EditContext = exports.Violation = void 0;
+const rules_config_1 = require("@webpieces/rules-config");
+class Violation {
+    line;
+    snippet;
+    // Optional per-occurrence override for the `→` line. When omitted, the report falls back
+    // to the rule's `FixHint.violation`. Dynamic rules (param name, line count, marker path,
+    // branch/PR) pass a specific message here; static rules omit it.
+    message;
+    editIndex;
+    editCount;
+    constructor(line, snippet, message) {
+        this.line = line;
+        this.snippet = snippet;
+        this.message = message;
+        this.editIndex = undefined;
+        this.editCount = undefined;
+    }
+}
+exports.Violation = Violation;
+class EditContext {
+    tool;
+    editIndex;
+    editCount;
+    filePath;
+    relativePath;
+    workspaceRoot;
+    addedContent;
+    strippedContent;
+    lines;
+    strippedLines;
+    removedContent;
+    isLineDisabled;
+    options;
+    constructor(tool, editIndex, editCount, filePath, relativePath, workspaceRoot, addedContent, strippedContent, lines, strippedLines, removedContent, isLineDisabled) {
+        this.tool = tool;
+        this.editIndex = editIndex;
+        this.editCount = editCount;
+        this.filePath = filePath;
+        this.relativePath = relativePath;
+        this.workspaceRoot = workspaceRoot;
+        this.addedContent = addedContent;
+        this.strippedContent = strippedContent;
+        this.lines = lines;
+        this.strippedLines = strippedLines;
+        this.removedContent = removedContent;
+        this.isLineDisabled = isLineDisabled;
+        this.options = {};
+    }
+}
+exports.EditContext = EditContext;
+// A heredoc and its body: `<<EOF` / `<<'EOF'` / `<<-EOF` through the terminator line.
+const HEREDOC_BODY = /<<-?\s*(['"]?)(\w+)\1[\s\S]*?^\t*\2\s*$/gm;
+// A single- or double-quoted span.
+const QUOTED_SPAN = /'([^']*)'|"([^"]*)"/g;
+// Shell syntax that a quoted span is explicitly NOT: separators, pipes, subshells, redirection,
+// expansion. Content carrying any of these is data (a jq filter, a regex, a glob), and unquoting it
+// would hand the segment scanner syntax the shell never sees. See stripProse.
+const SHELL_METACHARACTER = /[|;&()<>$`]/;
+class BashContext {
+    tool;
+    command;
+    /**
+     * `command` with heredoc bodies and prose-in-quotes removed — what a guard should MATCH on, while
+     * `command` stays raw for the violation message (a human needs to see what they actually typed).
+     *
+     * A commit message that merely MENTIONS a blocked command is not that command. This repo's whole
+     * subject matter is the git workflow, so its commit messages, docs and the guards' own fix-hint
+     * text are full of `git push` / `gh pr …` strings; matching raw text blocks writing about the
+     * tooling. A guard that cries wolf is a guard someone eventually turns OFF, which costs far more
+     * than the theoretical bypass this opens (`sh -c '<blocked command>'` stops matching). That trade
+     * is deliberate: these guards exist to catch a FORGETFUL agent, not an adversarial one.
+     *
+     * ONLY for blocklist-shaped guards ("if the command matches X, block"), where stripping can only
+     * ever block LESS. Never use it in an allowlist-shaped guard such as merged-branch-bash-guard,
+     * where stripping could turn a permitted recovery command into a blocked one and deadlock the
+     * session — there, match on the raw `command`.
+     */
+    commandCode;
+    /**
+     * The tree this command is JUDGED against — the root of the worktree it actually acts on, which
+     * is NOT the shell's cwd whenever the command carries a leading `cd <path> &&` (see
+     * EffectiveTreeResolver). Guards read git state, the main-sync cache and the decision log from
+     * here, so a command aimed at a linked worktree is judged on that worktree's branch, never the
+     * primary clone's.
+     */
+    workspaceRoot;
+    /** The directory the command really runs in (post-`cd`). Relative paths resolve against THIS. */
+    effectiveCwd;
+    /** The root owning webpieces.config.json. Equals workspaceRoot except in a linked worktree. */
+    governedRoot;
+    options;
+    constructor(command, workspaceRoot, effectiveCwd, governedRoot) {
+        this.tool = 'Bash';
+        this.command = command;
+        this.commandCode = this.stripProse(command);
+        this.workspaceRoot = workspaceRoot;
+        this.effectiveCwd = effectiveCwd ?? workspaceRoot;
+        this.governedRoot = governedRoot ?? workspaceRoot;
+        this.options = {};
+    }
+    /**
+     * A quoted span WITHOUT whitespace is kept: `git checkout "main"` is a real command with a quoted
+     * argument, not prose. One containing whitespace is a sentence, and becomes a single space.
+     *
+     * ONE exception, and it is a false positive that actually fired: a whitespace-free span carrying
+     * SHELL METACHARACTERS is dropped too. Keeping the content strips only the quotes, so a jq filter —
+     * `--jq '[.[]|select(.title|test("x"))]|length'` — was handed to the guards as bare shell syntax.
+     * Every guard then split it on its `|`, `(` and `;` and saw a segment reading exactly `test`, which
+     * whole-repo-build-guard classified as the workspace-wide test script and BLOCKED. There was no
+     * build anywhere in that command; it polled npm and GitHub.
+     *
+     * Quoting is precisely how a shell says "this is DATA, not syntax", so honouring the quotes is the
+     * correct reading. And because commandCode only ever feeds blocklist-shaped guards, dropping more
+     * can only ever block LESS — never turn an allowed command into a refused one.
+     */
+    stripProse(command) {
+        const withoutHeredocs = command.replace(HEREDOC_BODY, ' ');
+        return withoutHeredocs.replace(QUOTED_SPAN, (match, single, double) => {
+            const content = single ?? double ?? '';
+            if (/\s/.test(content))
+                return ' ';
+            return SHELL_METACHARACTER.test(content) ? ' ' : content;
+        });
+    }
+}
+exports.BashContext = BashContext;
+class FileContext {
+    tool;
+    filePath;
+    relativePath;
+    workspaceRoot;
+    /** The git tree that owns filePath. workspaceRoot remains the root that owns policy/config. */
+    targetRoot;
+    /** filePath relative to targetRoot, independent of its governed-root spelling. */
+    targetRelativePath;
+    currentFileLines;
+    linesAdded;
+    linesRemoved;
+    projectedFileLines;
+    options;
+    constructor(tool, filePath, relativePath, workspaceRoot, currentFileLines, linesAdded, linesRemoved, projectedFileLines, targetRoot = workspaceRoot, targetRelativePath = relativePath) {
+        this.tool = tool;
+        this.filePath = filePath;
+        this.relativePath = relativePath;
+        this.workspaceRoot = workspaceRoot;
+        this.targetRoot = targetRoot;
+        this.targetRelativePath = targetRelativePath;
+        this.currentFileLines = currentFileLines;
+        this.linesAdded = linesAdded;
+        this.linesRemoved = linesRemoved;
+        this.projectedFileLines = projectedFileLines;
+        this.options = {};
+    }
+}
+exports.FileContext = FileContext;
+class RuleGroup {
+    ruleName;
+    ruleDescription;
+    fixHint;
+    violations;
+    constructor(ruleName, ruleDescription, fixHint, violations) {
+        this.ruleName = ruleName;
+        this.ruleDescription = ruleDescription;
+        this.fixHint = fixHint;
+        this.violations = violations;
+    }
+}
+exports.RuleGroup = RuleGroup;
+class BlockedResult {
+    report;
+    /**
+     * The L0 fault this block IS, in the codebook's own letter (see core/l0-fault-codes.ts), or `-` for
+     * an ordinary rule block.
+     *
+     * It rides on the result rather than being re-derived from the report text because the block is
+     * decided deep in the runner (fault C in configMissingBlock, fault Y in checkConfigSync) and
+     * STAMPED by the adapter at the terminal boundary, several frames up. Scraping the report for a
+     * fault would be a second answer to a question the producer already knows.
+     */
+    fault;
+    constructor(report, fault = rules_config_1.L0_FAULT_NONE) {
+        this.report = report;
+        this.fault = fault;
+    }
+}
+exports.BlockedResult = BlockedResult;
+//# sourceMappingURL=types.js.map

package/src/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../packages/tooling/hook-runtime/src/core/types.ts"],"names":[],"mappings":";;;AAKA,0DAAwD;AAmBxD,MAAa,SAAS;IACT,IAAI,CAAS;IACb,OAAO,CAAS;IACzB,yFAAyF;IACzF,yFAAyF;IACzF,iEAAiE;IACxD,OAAO,CAAqB;IACrC,SAAS,CAAqB;IAC9B,SAAS,CAAqB;IAE9B,YAAY,IAAY,EAAE,OAAe,EAAE,OAAgB;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AAjBD,8BAiBC;AAED,MAAa,WAAW;IACX,IAAI,CAAW;IACf,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,KAAK,CAAoB;IACzB,aAAa,CAAoB;IACjC,cAAc,CAAS;IACvB,cAAc,CAAiB;IACxC,OAAO,CAAc;IAErB,YACI,IAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,aAAqB,EACrB,YAAoB,EACpB,eAAuB,EACvB,KAAwB,EACxB,aAAgC,EAChC,cAAsB,EACtB,cAA8B;QAE9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;CACJ;AA3CD,kCA2CC;AAED,sFAAsF;AACtF,MAAM,YAAY,GAAG,2CAA2C,CAAC;AAEjE,mCAAmC;AACnC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C,gGAAgG;AAChG,oGAAoG;AACpG,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAE1C,MAAa,WAAW;IACX,IAAI,CAAS;IACb,OAAO,CAAS;IACzB;;;;;;;;;;;;;;;OAeG;IACM,WAAW,CAAS;IAC7B;;;;;;OAMG;IACM,aAAa,CAAS;IAC/B,iGAAiG;IACxF,YAAY,CAAS;IAC9B,+FAA+F;IACtF,YAAY,CAAS;IAC9B,OAAO,CAAc;IAErB,YAAY,OAAe,EAAE,aAAqB,EAAE,YAAqB,EAAE,YAAqB;QAC5F,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,aAAa,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,aAAa,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,UAAU,CAAC,OAAe;QAC9B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAa,EAAE,MAAe,EAAE,MAAe,EAAU,EAAE;YACpG,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,IAAI,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC;YACnC,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAnED,kCAmEC;AAED,MAAa,WAAW;IACX,IAAI,CAAW;IACf,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,aAAa,CAAS;IAC/B,+FAA+F;IACtF,UAAU,CAAS;IAC5B,kFAAkF;IACzE,kBAAkB,CAAS;IAC3B,gBAAgB,CAAS;IACzB,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,kBAAkB,CAAS;IACpC,OAAO,CAAc;IAErB,YACI,IAAc,EACd,QAAgB,EAChB,YAAoB,EACpB,aAAqB,EACrB,gBAAwB,EACxB,UAAkB,EAClB,YAAoB,EACpB,kBAA0B,EAC1B,aAAqB,aAAa,EAClC,qBAA6B,YAAY;QAEzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACtB,CAAC;CACJ;AAvCD,kCAuCC;AAoCD,MAAa,SAAS;IACT,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,OAAO,CAAU;IACjB,UAAU,CAAuB;IAE1C,YACI,QAAgB,EAChB,eAAuB,EACvB,OAAgB,EAChB,UAAgC;QAEhC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;CACJ;AAjBD,8BAiBC;AAED,MAAa,aAAa;IACb,MAAM,CAAS;IACxB;;;;;;;;OAQG;IACM,KAAK,CAAS;IAEvB,YAAY,MAAc,EAAE,QAAgB,4BAAa;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAjBD,sCAiBC","sourcesContent":["// ResolvedConfig / ResolvedRuleConfig / RuleOptions now live in @webpieces/rules-config\n// so ai-hooks and the Nx validate-code executor share one loader and one config file.\nimport { RuleOptions } from '@webpieces/rules-config';\nimport { HookMode, NormalizedBashInput, NormalizedEdit, NormalizedToolInput, ToolKind } from '../protocol';\nimport { FixHint } from './fix-hint';\nimport { L0_FAULT_NONE } from '@webpieces/rules-config';\n\n// 'Read' is a first-class member because read-stale-guard is a file-scoped guard that runs on the\n// Read fast path. It is deliberately NOT in HANDLED_FILE_TOOLS (adapters/claude-code-adapter.ts), so\n// ClaudeCodeAdapter.kindOf() maps it to the 'Read' routing kind and Read never enters the edit/file\n// rule pipeline — only the one guard that asks for it. Nothing switches exhaustively on this union;\n// it is carried for logging.\n//\n// 'Delete' arrives ONLY from a Codex `apply_patch` carrying a `*** Delete File:` directive — no Claude\n// Code tool produces it. Every existing rule DEFAULTS TO NOT FIRING on it (see DeleteScopedRules in\n// ./delete-scoped-rules.ts): a rule written to judge the bytes an edit ADDS has nothing to say about a file going\n// away, and inventing a verdict for it would be guessing. Rules for which a delete IS meaningful — a\n// barrel export disappearing, a doc that documents a deleted file — opt in there, deliberately.\nexport type RuleScope = 'edit' | 'file' | 'bash';\n// Which category of built-in rules a hook invocation runs: code-style 'rules', git/PR/branch\n// 'guards' (the hookGuards section), or 'all' (both categories — used by the openclaw plugin adapter,\n// which is a single before_tool_call hook rather than two split PreToolUse hooks).\nexport type IsLineDisabled = (lineNum: number, ruleName: string) => boolean;\n\nexport class Violation {\n    readonly line: number;\n    readonly snippet: string;\n    // Optional per-occurrence override for the `→` line. When omitted, the report falls back\n    // to the rule's `FixHint.violation`. Dynamic rules (param name, line count, marker path,\n    // branch/PR) pass a specific message here; static rules omit it.\n    readonly message: string | undefined;\n    editIndex: number | undefined;\n    editCount: number | undefined;\n\n    constructor(line: number, snippet: string, message?: string) {\n        this.line = line;\n        this.snippet = snippet;\n        this.message = message;\n        this.editIndex = undefined;\n        this.editCount = undefined;\n    }\n}\n\nexport class EditContext {\n    readonly tool: ToolKind;\n    readonly editIndex: number;\n    readonly editCount: number;\n    readonly filePath: string;\n    readonly relativePath: string;\n    readonly workspaceRoot: string;\n    readonly addedContent: string;\n    readonly strippedContent: string;\n    readonly lines: readonly string[];\n    readonly strippedLines: readonly string[];\n    readonly removedContent: string;\n    readonly isLineDisabled: IsLineDisabled;\n    options: RuleOptions;\n\n    constructor(\n        tool: ToolKind,\n        editIndex: number,\n        editCount: number,\n        filePath: string,\n        relativePath: string,\n        workspaceRoot: string,\n        addedContent: string,\n        strippedContent: string,\n        lines: readonly string[],\n        strippedLines: readonly string[],\n        removedContent: string,\n        isLineDisabled: IsLineDisabled,\n    ) {\n        this.tool = tool;\n        this.editIndex = editIndex;\n        this.editCount = editCount;\n        this.filePath = filePath;\n        this.relativePath = relativePath;\n        this.workspaceRoot = workspaceRoot;\n        this.addedContent = addedContent;\n        this.strippedContent = strippedContent;\n        this.lines = lines;\n        this.strippedLines = strippedLines;\n        this.removedContent = removedContent;\n        this.isLineDisabled = isLineDisabled;\n        this.options = {};\n    }\n}\n\n// A heredoc and its body: `<<EOF` / `<<'EOF'` / `<<-EOF` through the terminator line.\nconst HEREDOC_BODY = /<<-?\\s*(['\"]?)(\\w+)\\1[\\s\\S]*?^\\t*\\2\\s*$/gm;\n\n// A single- or double-quoted span.\nconst QUOTED_SPAN = /'([^']*)'|\"([^\"]*)\"/g;\n\n// Shell syntax that a quoted span is explicitly NOT: separators, pipes, subshells, redirection,\n// expansion. Content carrying any of these is data (a jq filter, a regex, a glob), and unquoting it\n// would hand the segment scanner syntax the shell never sees. See stripProse.\nconst SHELL_METACHARACTER = /[|;&()<>$`]/;\n\nexport class BashContext {\n    readonly tool: 'Bash';\n    readonly command: string;\n    /**\n     * `command` with heredoc bodies and prose-in-quotes removed — what a guard should MATCH on, while\n     * `command` stays raw for the violation message (a human needs to see what they actually typed).\n     *\n     * A commit message that merely MENTIONS a blocked command is not that command. This repo's whole\n     * subject matter is the git workflow, so its commit messages, docs and the guards' own fix-hint\n     * text are full of `git push` / `gh pr …` strings; matching raw text blocks writing about the\n     * tooling. A guard that cries wolf is a guard someone eventually turns OFF, which costs far more\n     * than the theoretical bypass this opens (`sh -c '<blocked command>'` stops matching). That trade\n     * is deliberate: these guards exist to catch a FORGETFUL agent, not an adversarial one.\n     *\n     * ONLY for blocklist-shaped guards (\"if the command matches X, block\"), where stripping can only\n     * ever block LESS. Never use it in an allowlist-shaped guard such as merged-branch-bash-guard,\n     * where stripping could turn a permitted recovery command into a blocked one and deadlock the\n     * session — there, match on the raw `command`.\n     */\n    readonly commandCode: string;\n    /**\n     * The tree this command is JUDGED against — the root of the worktree it actually acts on, which\n     * is NOT the shell's cwd whenever the command carries a leading `cd <path> &&` (see\n     * EffectiveTreeResolver). Guards read git state, the main-sync cache and the decision log from\n     * here, so a command aimed at a linked worktree is judged on that worktree's branch, never the\n     * primary clone's.\n     */\n    readonly workspaceRoot: string;\n    /** The directory the command really runs in (post-`cd`). Relative paths resolve against THIS. */\n    readonly effectiveCwd: string;\n    /** The root owning webpieces.config.json. Equals workspaceRoot except in a linked worktree. */\n    readonly governedRoot: string;\n    options: RuleOptions;\n\n    constructor(command: string, workspaceRoot: string, effectiveCwd?: string, governedRoot?: string) {\n        this.tool = 'Bash';\n        this.command = command;\n        this.commandCode = this.stripProse(command);\n        this.workspaceRoot = workspaceRoot;\n        this.effectiveCwd = effectiveCwd ?? workspaceRoot;\n        this.governedRoot = governedRoot ?? workspaceRoot;\n        this.options = {};\n    }\n\n    /**\n     * A quoted span WITHOUT whitespace is kept: `git checkout \"main\"` is a real command with a quoted\n     * argument, not prose. One containing whitespace is a sentence, and becomes a single space.\n     *\n     * ONE exception, and it is a false positive that actually fired: a whitespace-free span carrying\n     * SHELL METACHARACTERS is dropped too. Keeping the content strips only the quotes, so a jq filter —\n     * `--jq '[.[]|select(.title|test(\"x\"))]|length'` — was handed to the guards as bare shell syntax.\n     * Every guard then split it on its `|`, `(` and `;` and saw a segment reading exactly `test`, which\n     * whole-repo-build-guard classified as the workspace-wide test script and BLOCKED. There was no\n     * build anywhere in that command; it polled npm and GitHub.\n     *\n     * Quoting is precisely how a shell says \"this is DATA, not syntax\", so honouring the quotes is the\n     * correct reading. And because commandCode only ever feeds blocklist-shaped guards, dropping more\n     * can only ever block LESS — never turn an allowed command into a refused one.\n     */\n    private stripProse(command: string): string {\n        const withoutHeredocs = command.replace(HEREDOC_BODY, ' ');\n        return withoutHeredocs.replace(QUOTED_SPAN, (match: string, single?: string, double?: string): string => {\n            const content = single ?? double ?? '';\n            if (/\\s/.test(content)) return ' ';\n            return SHELL_METACHARACTER.test(content) ? ' ' : content;\n        });\n    }\n}\n\nexport class FileContext {\n    readonly tool: ToolKind;\n    readonly filePath: string;\n    readonly relativePath: string;\n    readonly workspaceRoot: string;\n    /** The git tree that owns filePath. workspaceRoot remains the root that owns policy/config. */\n    readonly targetRoot: string;\n    /** filePath relative to targetRoot, independent of its governed-root spelling. */\n    readonly targetRelativePath: string;\n    readonly currentFileLines: number;\n    readonly linesAdded: number;\n    readonly linesRemoved: number;\n    readonly projectedFileLines: number;\n    options: RuleOptions;\n\n    constructor(\n        tool: ToolKind,\n        filePath: string,\n        relativePath: string,\n        workspaceRoot: string,\n        currentFileLines: number,\n        linesAdded: number,\n        linesRemoved: number,\n        projectedFileLines: number,\n        targetRoot: string = workspaceRoot,\n        targetRelativePath: string = relativePath,\n    ) {\n        this.tool = tool;\n        this.filePath = filePath;\n        this.relativePath = relativePath;\n        this.workspaceRoot = workspaceRoot;\n        this.targetRoot = targetRoot;\n        this.targetRelativePath = targetRelativePath;\n        this.currentFileLines = currentFileLines;\n        this.linesAdded = linesAdded;\n        this.linesRemoved = linesRemoved;\n        this.projectedFileLines = projectedFileLines;\n        this.options = {};\n    }\n}\n\n/**\n * The shape of a custom rule loaded from a `rulesDir` (a plain object returned by require()).\n * It carries only metadata + a `check` method — no on/off logic of its own.\n */\nexport interface PlainRule {\n    readonly name: string;\n    readonly description: string;\n    readonly scope: RuleScope;\n    readonly files: readonly string[];\n    readonly defaultOptions: RuleOptions;\n    readonly fixHint: FixHint;\n    check(ctx: EditContext | FileContext | BashContext): readonly Violation[];\n}\n\n/**\n * The runtime contract the runner iterates. Both the built-in rule classes (which extend\n * EditRuleBase/FileRuleBase/BashRuleBase) and the custom-rule adapter satisfy this: they add\n * `shouldRun()` (mode + escape-hatch decision) on top of the PlainRule metadata.\n */\nexport interface Rule extends PlainRule {\n    /**\n     * The webpieces.config.json key whose entry configures this rule — NOT necessarily `name`.\n     *\n     * `name` is the operator identity (what a decision-log line and a deny report carry); `configKey`\n     * is the switch. They differ wherever several classes implement one POLICY: all four branch-state\n     * guards read `branch-state-guard`, all four PR-lifecycle guards read `pr-lifecycle-guard`. Every\n     * consumer that asks \"which section does this live in?\" (filterByMode) or \"does this have an\n     * entry?\" (the fault-Y config-sync check) must read THIS field, because asking for `name` there\n     * demands entries under keys the validator rejects as retired.\n     */\n    readonly configKey: string;\n    shouldRun(): boolean;\n}\n\nexport class RuleGroup {\n    readonly ruleName: string;\n    readonly ruleDescription: string;\n    readonly fixHint: FixHint;\n    readonly violations: readonly Violation[];\n\n    constructor(\n        ruleName: string,\n        ruleDescription: string,\n        fixHint: FixHint,\n        violations: readonly Violation[],\n    ) {\n        this.ruleName = ruleName;\n        this.ruleDescription = ruleDescription;\n        this.fixHint = fixHint;\n        this.violations = violations;\n    }\n}\n\nexport class BlockedResult {\n    readonly report: string;\n    /**\n     * The L0 fault this block IS, in the codebook's own letter (see core/l0-fault-codes.ts), or `-` for\n     * an ordinary rule block.\n     *\n     * It rides on the result rather than being re-derived from the report text because the block is\n     * decided deep in the runner (fault C in configMissingBlock, fault Y in checkConfigSync) and\n     * STAMPED by the adapter at the terminal boundary, several frames up. Scraping the report for a\n     * fault would be a second answer to a question the producer already knows.\n     */\n    readonly fault: string;\n\n    constructor(report: string, fault: string = L0_FAULT_NONE) {\n        this.report = report;\n        this.fault = fault;\n    }\n}\n"]}

package/src/harness-vocabulary.d.ts

@@ -0,0 +1,2 @@
+export { AI_TYPE_SH } from './adapters/detect-ai';
+export { READ_COMMANDS, SED_RANGE_BODY } from './core/shell-read-parity';

package/src/harness-vocabulary.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SED_RANGE_BODY = exports.READ_COMMANDS = exports.AI_TYPE_SH = void 0;
+// Narrow L0 imports keep shim repair independent of the runtime application and rule evaluator.
+var detect_ai_1 = require("./adapters/detect-ai");
+Object.defineProperty(exports, "AI_TYPE_SH", { enumerable: true, get: function () { return detect_ai_1.AI_TYPE_SH; } });
+var shell_read_parity_1 = require("./core/shell-read-parity");
+Object.defineProperty(exports, "READ_COMMANDS", { enumerable: true, get: function () { return shell_read_parity_1.READ_COMMANDS; } });
+Object.defineProperty(exports, "SED_RANGE_BODY", { enumerable: true, get: function () { return shell_read_parity_1.SED_RANGE_BODY; } });
+//# sourceMappingURL=harness-vocabulary.js.map

package/src/harness-vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-vocabulary.js","sourceRoot":"","sources":["../../../../../packages/tooling/hook-runtime/src/harness-vocabulary.ts"],"names":[],"mappings":";;;AAAA,gGAAgG;AAChG,kDAAkD;AAAzC,uGAAA,UAAU,OAAA;AACnB,8DAAyE;AAAhE,kHAAA,aAAa,OAAA;AAAE,mHAAA,cAAc,OAAA","sourcesContent":["// Narrow L0 imports keep shim repair independent of the runtime application and rule evaluator.\nexport { AI_TYPE_SH } from './adapters/detect-ai';\nexport { READ_COMMANDS, SED_RANGE_BODY } from './core/shell-read-parity';\n"]}

package/src/hook-app.d.ts

@@ -0,0 +1,15 @@
+import { HookEvaluator } from './hook-evaluator';
+import { HookArgs } from './outcome';
+import { HookProcessExit, HookStdinSource, HookStdoutSink } from './hook-ports';
+export declare class HookApp {
+    private readonly stdin;
+    private readonly stdout;
+    private readonly processExit;
+    private readonly evaluator;
+    constructor(stdin: HookStdinSource, stdout: HookStdoutSink, processExit: HookProcessExit, evaluator: HookEvaluator);
+    run(args: HookArgs): Promise<void>;
+    private decide;
+}
+export declare class HookBootFailure {
+    report(err: unknown): void;
+}

package/src/hook-app.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HookBootFailure = exports.HookApp = void 0;
+const tslib_1 = require("tslib");
+const inversify_1 = require("inversify");
+const hook_evaluator_1 = require("./hook-evaluator");
+const outcome_1 = require("./outcome");
+const hook_ports_1 = require("./hook-ports");
+const response_1 = require("./response");
+const to_error_1 = require("./to-error");
+const CRASH_PREFIX = '[ai-hooks] hook crashed unexpectedly — failing closed: ';
+let HookApp = class HookApp {
+    stdin;
+    stdout;
+    processExit;
+    evaluator;
+    constructor(stdin, stdout, processExit, evaluator) {
+        this.stdin = stdin;
+        this.stdout = stdout;
+        this.processExit = processExit;
+        this.evaluator = evaluator;
+    }
+    async run(args) {
+        const outcome = await this.decide(args);
+        if (outcome.stdout !== '')
+            this.stdout.write(outcome.stdout);
+        this.processExit.exit(outcome.exitCode);
+    }
+    async decide(args) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- fail-closed boundary converts port/evaluator faults into an explicit protocol deny.
+        try {
+            return await this.evaluator.evaluate(await this.stdin.read(), args);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            return new outcome_1.HookOutcome(`${(0, response_1.denyJson)(null, `${CRASH_PREFIX}${error.message}`)}\n`, 0);
+        }
+    }
+};
+exports.HookApp = HookApp;
+exports.HookApp = HookApp = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [hook_ports_1.HookStdinSource,
+        hook_ports_1.HookStdoutSink,
+        hook_ports_1.HookProcessExit,
+        hook_evaluator_1.HookEvaluator])
+], HookApp);
+class HookBootFailure {
+    // webpieces-disable no-any-unknown -- a process rejection is unknown by construction and is immediately narrowed through toError().
+    report(err) {
+        const error = (0, to_error_1.toError)(err);
+        process.stdout.write(`${(0, response_1.denyJson)(null, `${CRASH_PREFIX}${error.message}`)}\n`);
+        // webpieces-disable no-process-exit-outside-main -- last-resort protocol boundary before DI exists.
+        process.exit(0);
+    }
+}
+exports.HookBootFailure = HookBootFailure;
+//# sourceMappingURL=hook-app.js.map

package/src/hook-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-app.js","sourceRoot":"","sources":["../../../../../packages/tooling/hook-runtime/src/hook-app.ts"],"names":[],"mappings":";;;;AAAA,yCAA2D;AAE3D,qDAAiD;AACjD,uCAAkD;AAClD,6CAAgF;AAChF,yCAAsC;AACtC,yCAAqC;AAErC,MAAM,YAAY,GAAG,yDAAyD,CAAC;AAGxE,IAAM,OAAO,GAAb,MAAM,OAAO;IAEK;IACA;IACA;IACA;IAJrB,YACqB,KAAsB,EACtB,MAAsB,EACtB,WAA4B,EAC5B,SAAwB;QAHxB,UAAK,GAAL,KAAK,CAAiB;QACtB,WAAM,GAAN,MAAM,CAAgB;QACtB,gBAAW,GAAX,WAAW,CAAiB;QAC5B,cAAS,GAAT,SAAS,CAAe;IAC1C,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,IAAc;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAc;QAC/B,qJAAqJ;QACrJ,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,IAAI,qBAAW,CAAC,GAAG,IAAA,mBAAQ,EAAC,IAAI,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ,CAAA;AAvBY,0BAAO;kBAAP,OAAO;IADnB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGT,4BAAe;QACd,2BAAc;QACT,4BAAe;QACjB,8BAAa;GALpC,OAAO,CAuBnB;AAED,MAAa,eAAe;IACxB,oIAAoI;IACpI,MAAM,CAAC,GAAY;QACf,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,mBAAQ,EAAC,IAAI,EAAE,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/E,oGAAoG;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACJ;AARD,0CAQC","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\n\nimport { HookEvaluator } from './hook-evaluator';\nimport { HookArgs, HookOutcome } from './outcome';\nimport { HookProcessExit, HookStdinSource, HookStdoutSink } from './hook-ports';\nimport { denyJson } from './response';\nimport { toError } from './to-error';\n\nconst CRASH_PREFIX = '[ai-hooks] hook crashed unexpectedly — failing closed: ';\n\n@injectable(bindingScopeValues.Singleton)\nexport class HookApp {\n    constructor(\n        private readonly stdin: HookStdinSource,\n        private readonly stdout: HookStdoutSink,\n        private readonly processExit: HookProcessExit,\n        private readonly evaluator: HookEvaluator,\n    ) {}\n\n    async run(args: HookArgs): Promise<void> {\n        const outcome = await this.decide(args);\n        if (outcome.stdout !== '') this.stdout.write(outcome.stdout);\n        this.processExit.exit(outcome.exitCode);\n    }\n\n    private async decide(args: HookArgs): Promise<HookOutcome> {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- fail-closed boundary converts port/evaluator faults into an explicit protocol deny.\n        try {\n            return await this.evaluator.evaluate(await this.stdin.read(), args);\n        } catch (err: unknown) {\n            const error = toError(err);\n            return new HookOutcome(`${denyJson(null, `${CRASH_PREFIX}${error.message}`)}\\n`, 0);\n        }\n    }\n}\n\nexport class HookBootFailure {\n    // webpieces-disable no-any-unknown -- a process rejection is unknown by construction and is immediately narrowed through toError().\n    report(err: unknown): void {\n        const error = toError(err);\n        process.stdout.write(`${denyJson(null, `${CRASH_PREFIX}${error.message}`)}\\n`);\n        // webpieces-disable no-process-exit-outside-main -- last-resort protocol boundary before DI exists.\n        process.exit(0);\n    }\n}\n"]}

package/src/hook-evaluator.d.ts

@@ -0,0 +1,5 @@
+import { HookArgs, HookOutcome } from './outcome';
+/** Injected product boundary: the runtime never imports a concrete rule registry or evaluator. */
+export declare abstract class HookEvaluator {
+    abstract evaluate(raw: string, args: HookArgs): HookOutcome | Promise<HookOutcome>;
+}

package/src/hook-evaluator.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HookEvaluator = void 0;
+const tslib_1 = require("tslib");
+const inversify_1 = require("inversify");
+/** Injected product boundary: the runtime never imports a concrete rule registry or evaluator. */
+let HookEvaluator = class HookEvaluator {
+};
+exports.HookEvaluator = HookEvaluator;
+exports.HookEvaluator = HookEvaluator = tslib_1.__decorate([
+    (0, inversify_1.injectable)()
+], HookEvaluator);
+//# sourceMappingURL=hook-evaluator.js.map

package/src/hook-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-evaluator.js","sourceRoot":"","sources":["../../../../../packages/tooling/hook-runtime/src/hook-evaluator.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AAGvC,kGAAkG;AAE3F,IAAe,aAAa,GAA5B,MAAe,aAAa;CAElC,CAAA;AAFqB,sCAAa;wBAAb,aAAa;IADlC,IAAA,sBAAU,GAAE;GACS,aAAa,CAElC","sourcesContent":["import { injectable } from 'inversify';\nimport { HookArgs, HookOutcome } from './outcome';\n\n/** Injected product boundary: the runtime never imports a concrete rule registry or evaluator. */\n@injectable()\nexport abstract class HookEvaluator {\n    abstract evaluate(raw: string, args: HookArgs): HookOutcome | Promise<HookOutcome>;\n}\n"]}

package/src/hook-ports.d.ts

@@ -0,0 +1,9 @@
+export declare class HookStdinSource {
+    read(): Promise<string>;
+}
+export declare class HookStdoutSink {
+    write(bytes: string): void;
+}
+export declare class HookProcessExit {
+    exit(code: number): void;
+}

package/src/hook-ports.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HookProcessExit = exports.HookStdoutSink = exports.HookStdinSource = void 0;
+const tslib_1 = require("tslib");
+const inversify_1 = require("inversify");
+let HookStdinSource = class HookStdinSource {
+    read() {
+        return new Promise((resolve) => {
+            let data = '';
+            process.stdin.setEncoding('utf8');
+            process.stdin.on('data', (chunk) => { data += chunk; });
+            process.stdin.on('end', () => { resolve(data); });
+            process.stdin.on('error', () => { resolve(''); });
+            if (process.stdin.isTTY)
+                resolve('');
+        });
+    }
+};
+exports.HookStdinSource = HookStdinSource;
+exports.HookStdinSource = HookStdinSource = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+], HookStdinSource);
+let HookStdoutSink = class HookStdoutSink {
+    write(bytes) { process.stdout.write(bytes); }
+};
+exports.HookStdoutSink = HookStdoutSink;
+exports.HookStdoutSink = HookStdoutSink = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+], HookStdoutSink);
+let HookProcessExit = class HookProcessExit {
+    exit(code) {
+        // webpieces-disable no-process-exit-outside-main -- this port is the hook protocol's terminal boundary.
+        process.exit(code);
+    }
+};
+exports.HookProcessExit = HookProcessExit;
+exports.HookProcessExit = HookProcessExit = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+], HookProcessExit);
+//# sourceMappingURL=hook-ports.js.map

package/src/hook-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-ports.js","sourceRoot":"","sources":["../../../../../packages/tooling/hook-runtime/src/hook-ports.ts"],"names":[],"mappings":";;;;AAAA,yCAA2D;AAGpD,IAAM,eAAe,GAArB,MAAM,eAAe;IACxB,IAAI;QACA,OAAO,IAAI,OAAO,CAAC,CAAC,OAAgC,EAAE,EAAE;YACpD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;gBAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AAXY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,eAAe,CAW3B;AAGM,IAAM,cAAc,GAApB,MAAM,cAAc;IACvB,KAAK,CAAC,KAAa,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAA;AAFY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,cAAc,CAE1B;AAGM,IAAM,eAAe,GAArB,MAAM,eAAe;IACxB,IAAI,CAAC,IAAY;QACb,wGAAwG;QACxG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;CACJ,CAAA;AALY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,eAAe,CAK3B","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\n\n@injectable(bindingScopeValues.Singleton)\nexport class HookStdinSource {\n    read(): Promise<string> {\n        return new Promise((resolve: (value: string) => void) => {\n            let data = '';\n            process.stdin.setEncoding('utf8');\n            process.stdin.on('data', (chunk: string) => { data += chunk; });\n            process.stdin.on('end', () => { resolve(data); });\n            process.stdin.on('error', () => { resolve(''); });\n            if (process.stdin.isTTY) resolve('');\n        });\n    }\n}\n\n@injectable(bindingScopeValues.Singleton)\nexport class HookStdoutSink {\n    write(bytes: string): void { process.stdout.write(bytes); }\n}\n\n@injectable(bindingScopeValues.Singleton)\nexport class HookProcessExit {\n    exit(code: number): void {\n        // webpieces-disable no-process-exit-outside-main -- this port is the hook protocol's terminal boundary.\n        process.exit(code);\n    }\n}\n"]}

package/src/index.d.ts

@@ -0,0 +1,31 @@
+export { AiType, AI_TYPES, AI_TYPE_UNKNOWN, HookMode, ToolKind, AgentEventKind, NormalizedEdit, NormalizedToolInput, NormalizedBashInput, FileOperation, AgentHookEvent, } from './protocol';
+export { HookOutcome, HookArgs, HookTerminated } from './outcome';
+export { denyJson } from './response';
+export { HookStdinSource, HookStdoutSink, HookProcessExit } from './hook-ports';
+export { HookEvaluator } from './hook-evaluator';
+export { HookApp, HookBootFailure } from './hook-app';
+export { RuleScope, IsLineDisabled, Violation, EditContext, FileContext, BashContext, Rule, PlainRule, RuleGroup, BlockedResult } from './core/types';
+export * from './core/fix-hint';
+export * from './core/rule-base';
+export * from './core/custom-rule-adapter';
+export * from './core/strip-ts-noise';
+export * from './core/disable-directives';
+export * from './core/build-context';
+export * from './core/report';
+export * from './core/effective-tree';
+export * from './core/command-scan';
+export * from './core/target-tree';
+export * from './core/excluded-paths';
+export * from './core/delete-scoped-rules';
+export * from './core/apply-patch-parse';
+export * from './core/shell-read-parity';
+export * from './core/glob';
+export * from './adapters/agent-payload';
+export * from './adapters/detect-ai';
+export * from './adapters/agent-adapters';
+export * from './adapters/claude-code-adapter';
+export * from './adapters/codex-adapter';
+export * from './core/root-manifest';
+export * from './core/rule-evaluation';
+export * from './core/rules/shell-segment-scan';
+export * from './core/file-evaluation';

package/src/index.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlockedResult = exports.RuleGroup = exports.BashContext = exports.FileContext = exports.EditContext = exports.Violation = exports.HookBootFailure = exports.HookApp = exports.HookEvaluator = exports.HookProcessExit = exports.HookStdoutSink = exports.HookStdinSource = exports.denyJson = exports.HookTerminated = exports.HookArgs = exports.HookOutcome = exports.AgentHookEvent = exports.FileOperation = exports.NormalizedBashInput = exports.NormalizedToolInput = exports.NormalizedEdit = exports.AI_TYPE_UNKNOWN = exports.AI_TYPES = void 0;
+const tslib_1 = require("tslib");
+var protocol_1 = require("./protocol");
+Object.defineProperty(exports, "AI_TYPES", { enumerable: true, get: function () { return protocol_1.AI_TYPES; } });
+Object.defineProperty(exports, "AI_TYPE_UNKNOWN", { enumerable: true, get: function () { return protocol_1.AI_TYPE_UNKNOWN; } });
+Object.defineProperty(exports, "NormalizedEdit", { enumerable: true, get: function () { return protocol_1.NormalizedEdit; } });
+Object.defineProperty(exports, "NormalizedToolInput", { enumerable: true, get: function () { return protocol_1.NormalizedToolInput; } });
+Object.defineProperty(exports, "NormalizedBashInput", { enumerable: true, get: function () { return protocol_1.NormalizedBashInput; } });
+Object.defineProperty(exports, "FileOperation", { enumerable: true, get: function () { return protocol_1.FileOperation; } });
+Object.defineProperty(exports, "AgentHookEvent", { enumerable: true, get: function () { return protocol_1.AgentHookEvent; } });
+var outcome_1 = require("./outcome");
+Object.defineProperty(exports, "HookOutcome", { enumerable: true, get: function () { return outcome_1.HookOutcome; } });
+Object.defineProperty(exports, "HookArgs", { enumerable: true, get: function () { return outcome_1.HookArgs; } });
+Object.defineProperty(exports, "HookTerminated", { enumerable: true, get: function () { return outcome_1.HookTerminated; } });
+var response_1 = require("./response");
+Object.defineProperty(exports, "denyJson", { enumerable: true, get: function () { return response_1.denyJson; } });
+var hook_ports_1 = require("./hook-ports");
+Object.defineProperty(exports, "HookStdinSource", { enumerable: true, get: function () { return hook_ports_1.HookStdinSource; } });
+Object.defineProperty(exports, "HookStdoutSink", { enumerable: true, get: function () { return hook_ports_1.HookStdoutSink; } });
+Object.defineProperty(exports, "HookProcessExit", { enumerable: true, get: function () { return hook_ports_1.HookProcessExit; } });
+var hook_evaluator_1 = require("./hook-evaluator");
+Object.defineProperty(exports, "HookEvaluator", { enumerable: true, get: function () { return hook_evaluator_1.HookEvaluator; } });
+var hook_app_1 = require("./hook-app");
+Object.defineProperty(exports, "HookApp", { enumerable: true, get: function () { return hook_app_1.HookApp; } });
+Object.defineProperty(exports, "HookBootFailure", { enumerable: true, get: function () { return hook_app_1.HookBootFailure; } });
+var types_1 = require("./core/types");
+Object.defineProperty(exports, "Violation", { enumerable: true, get: function () { return types_1.Violation; } });
+Object.defineProperty(exports, "EditContext", { enumerable: true, get: function () { return types_1.EditContext; } });
+Object.defineProperty(exports, "FileContext", { enumerable: true, get: function () { return types_1.FileContext; } });
+Object.defineProperty(exports, "BashContext", { enumerable: true, get: function () { return types_1.BashContext; } });
+Object.defineProperty(exports, "RuleGroup", { enumerable: true, get: function () { return types_1.RuleGroup; } });
+Object.defineProperty(exports, "BlockedResult", { enumerable: true, get: function () { return types_1.BlockedResult; } });
+tslib_1.__exportStar(require("./core/fix-hint"), exports);
+tslib_1.__exportStar(require("./core/rule-base"), exports);
+tslib_1.__exportStar(require("./core/custom-rule-adapter"), exports);
+tslib_1.__exportStar(require("./core/strip-ts-noise"), exports);
+tslib_1.__exportStar(require("./core/disable-directives"), exports);
+tslib_1.__exportStar(require("./core/build-context"), exports);
+tslib_1.__exportStar(require("./core/report"), exports);
+tslib_1.__exportStar(require("./core/effective-tree"), exports);
+tslib_1.__exportStar(require("./core/command-scan"), exports);
+tslib_1.__exportStar(require("./core/target-tree"), exports);
+tslib_1.__exportStar(require("./core/excluded-paths"), exports);
+tslib_1.__exportStar(require("./core/delete-scoped-rules"), exports);
+tslib_1.__exportStar(require("./core/apply-patch-parse"), exports);
+tslib_1.__exportStar(require("./core/shell-read-parity"), exports);
+tslib_1.__exportStar(require("./core/glob"), exports);
+tslib_1.__exportStar(require("./adapters/agent-payload"), exports);
+tslib_1.__exportStar(require("./adapters/detect-ai"), exports);
+tslib_1.__exportStar(require("./adapters/agent-adapters"), exports);
+tslib_1.__exportStar(require("./adapters/claude-code-adapter"), exports);
+tslib_1.__exportStar(require("./adapters/codex-adapter"), exports);
+tslib_1.__exportStar(require("./core/root-manifest"), exports);
+tslib_1.__exportStar(require("./core/rule-evaluation"), exports);
+tslib_1.__exportStar(require("./core/rules/shell-segment-scan"), exports);
+tslib_1.__exportStar(require("./core/file-evaluation"), exports);
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/hook-runtime/src/index.ts"],"names":[],"mappings":";;;;AAAA,uCAGoB;AAFR,oGAAA,QAAQ,OAAA;AAAE,2GAAA,eAAe,OAAA;AACjC,0GAAA,cAAc,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,0GAAA,cAAc,OAAA;AAE3F,qCAAkE;AAAzD,sGAAA,WAAW,OAAA;AAAE,mGAAA,QAAQ,OAAA;AAAE,yGAAA,cAAc,OAAA;AAC9C,uCAAsC;AAA7B,oGAAA,QAAQ,OAAA;AACjB,2CAAgF;AAAvE,6GAAA,eAAe,OAAA;AAAE,4GAAA,cAAc,OAAA;AAAE,6GAAA,eAAe,OAAA;AACzD,mDAAiD;AAAxC,+GAAA,aAAa,OAAA;AACtB,uCAAsD;AAA7C,mGAAA,OAAO,OAAA;AAAE,2GAAA,eAAe,OAAA;AAEjC,sCAAsJ;AAAlH,kGAAA,SAAS,OAAA;AAAE,oGAAA,WAAW,OAAA;AAAE,oGAAA,WAAW,OAAA;AAAE,oGAAA,WAAW,OAAA;AAAmB,kGAAA,SAAS,OAAA;AAAE,sGAAA,aAAa,OAAA;AAC/H,0DAAgC;AAChC,2DAAiC;AACjC,qEAA2C;AAC3C,gEAAsC;AACtC,oEAA0C;AAC1C,+DAAqC;AACrC,wDAA8B;AAC9B,gEAAsC;AACtC,8DAAoC;AACpC,6DAAmC;AACnC,gEAAsC;AACtC,qEAA2C;AAC3C,mEAAyC;AACzC,mEAAyC;AACzC,sDAA4B;AAC5B,mEAAyC;AACzC,+DAAqC;AACrC,oEAA0C;AAC1C,yEAA+C;AAC/C,mEAAyC;AACzC,+DAAqC;AACrC,iEAAuC;AACvC,0EAAgD;AAChD,iEAAuC","sourcesContent":["export {\n    AiType, AI_TYPES, AI_TYPE_UNKNOWN, HookMode, ToolKind, AgentEventKind,\n    NormalizedEdit, NormalizedToolInput, NormalizedBashInput, FileOperation, AgentHookEvent,\n} from './protocol';\nexport { HookOutcome, HookArgs, HookTerminated } from './outcome';\nexport { denyJson } from './response';\nexport { HookStdinSource, HookStdoutSink, HookProcessExit } from './hook-ports';\nexport { HookEvaluator } from './hook-evaluator';\nexport { HookApp, HookBootFailure } from './hook-app';\n\nexport { RuleScope, IsLineDisabled, Violation, EditContext, FileContext, BashContext, Rule, PlainRule, RuleGroup, BlockedResult } from './core/types';\nexport * from './core/fix-hint';\nexport * from './core/rule-base';\nexport * from './core/custom-rule-adapter';\nexport * from './core/strip-ts-noise';\nexport * from './core/disable-directives';\nexport * from './core/build-context';\nexport * from './core/report';\nexport * from './core/effective-tree';\nexport * from './core/command-scan';\nexport * from './core/target-tree';\nexport * from './core/excluded-paths';\nexport * from './core/delete-scoped-rules';\nexport * from './core/apply-patch-parse';\nexport * from './core/shell-read-parity';\nexport * from './core/glob';\nexport * from './adapters/agent-payload';\nexport * from './adapters/detect-ai';\nexport * from './adapters/agent-adapters';\nexport * from './adapters/claude-code-adapter';\nexport * from './adapters/codex-adapter';\nexport * from './core/root-manifest';\nexport * from './core/rule-evaluation';\nexport * from './core/rules/shell-segment-scan';\nexport * from './core/file-evaluation';\n"]}

package/src/outcome.d.ts

@@ -0,0 +1,14 @@
+import { HookMode } from './protocol';
+export declare class HookOutcome {
+    readonly stdout: string;
+    readonly exitCode: number;
+    constructor(stdout: string, exitCode: number);
+}
+export declare class HookArgs {
+    readonly mode: HookMode;
+    constructor(mode: HookMode);
+}
+export declare class HookTerminated extends Error {
+    readonly outcome: HookOutcome;
+    constructor(outcome: HookOutcome);
+}

package/src/outcome.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HookTerminated = exports.HookArgs = exports.HookOutcome = void 0;
+class HookOutcome {
+    stdout;
+    exitCode;
+    constructor(stdout, exitCode) { this.stdout = stdout; this.exitCode = exitCode; }
+}
+exports.HookOutcome = HookOutcome;
+class HookArgs {
+    mode;
+    constructor(mode) { this.mode = mode; }
+}
+exports.HookArgs = HookArgs;
+class HookTerminated extends Error {
+    outcome;
+    constructor(outcome) { super('hook invocation terminated'); this.outcome = outcome; }
+}
+exports.HookTerminated = HookTerminated;
+//# sourceMappingURL=outcome.js.map

package/src/outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.js","sourceRoot":"","sources":["../../../../../packages/tooling/hook-runtime/src/outcome.ts"],"names":[],"mappings":";;;AAEA,MAAa,WAAW;IACX,MAAM,CAAS;IACf,QAAQ,CAAS;IAC1B,YAAY,MAAc,EAAE,QAAgB,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC;CACpG;AAJD,kCAIC;AAED,MAAa,QAAQ;IACR,IAAI,CAAW;IACxB,YAAY,IAAc,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;CACpD;AAHD,4BAGC;AAED,MAAa,cAAe,SAAQ,KAAK;IAC5B,OAAO,CAAc;IAC9B,YAAY,OAAoB,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;CACrG;AAHD,wCAGC","sourcesContent":["import { HookMode } from './protocol';\n\nexport class HookOutcome {\n    readonly stdout: string;\n    readonly exitCode: number;\n    constructor(stdout: string, exitCode: number) { this.stdout = stdout; this.exitCode = exitCode; }\n}\n\nexport class HookArgs {\n    readonly mode: HookMode;\n    constructor(mode: HookMode) { this.mode = mode; }\n}\n\nexport class HookTerminated extends Error {\n    readonly outcome: HookOutcome;\n    constructor(outcome: HookOutcome) { super('hook invocation terminated'); this.outcome = outcome; }\n}\n"]}

package/src/protocol.d.ts

@@ -0,0 +1,40 @@
+/** Coding harness that produced an agent-hook call. */
+export type AiType = 'claude-code' | 'codex';
+export declare const AI_TYPES: readonly AiType[];
+export declare const AI_TYPE_UNKNOWN = "unknown";
+export type HookMode = 'rules' | 'guards' | 'all';
+export type ToolKind = 'Write' | 'Edit' | 'MultiEdit' | 'Read' | 'Delete';
+export type AgentEventKind = 'File' | 'Bash' | 'Read' | 'Ignored';
+export declare class NormalizedEdit {
+    readonly oldString: string;
+    readonly newString: string;
+    constructor(oldString: string, newString: string);
+}
+export declare class NormalizedToolInput {
+    readonly filePath: string;
+    readonly edits: readonly NormalizedEdit[];
+    constructor(filePath: string, edits: readonly NormalizedEdit[]);
+}
+export declare class NormalizedBashInput {
+    readonly command: string;
+    constructor(command: string);
+}
+export declare class FileOperation {
+    readonly toolKind: ToolKind;
+    readonly input: NormalizedToolInput;
+    constructor(toolKind: ToolKind, input: NormalizedToolInput);
+}
+/** One normalized hook event, independent of the source harness and rule product. */
+export declare class AgentHookEvent {
+    readonly aiType: AiType;
+    readonly kind: AgentEventKind;
+    readonly rawToolName: string;
+    readonly cwd: string;
+    readonly sessionId: string;
+    readonly agentId: string;
+    readonly agentType: string;
+    readonly files: readonly FileOperation[];
+    readonly bash: NormalizedBashInput | null;
+    readonly reads: readonly string[];
+    constructor(aiType: AiType, kind: AgentEventKind, rawToolName: string, cwd: string, sessionId: string, agentId: string, agentType: string, files: readonly FileOperation[], bash: NormalizedBashInput | null, reads: readonly string[]);
+}