@winspan/claude-forge 8.54.3 → 9.2.0

package/dist/daemon/handlers/post-tool-use.js

@@ -1,20 +1,64 @@
 /**
  * PostToolUseHandler — handles PostToolUse hook
  *
- * Simplified: only tracks token usage if available.
- * Also observes Agent tool calls to update routing_events.
+ * Observes Agent tool calls to update routing_events.
  */
+import path from 'node:path';
 import { logger } from '../../core/utils/logger.js';
-import { TokenTracker } from '../../core/utils/token-tracker.js';
 import { getSubagentType } from '../../core/event-fields.js';
+import { appendToExperienceFile, extractExperience, } from '../services/experience-extractor.js';
+/** Phase 5: window (ms) within which a Task spawn can mark a pending rec. */
+const WORKFLOW_REC_WINDOW_MS = 5 * 60 * 1000;
+/**
+ * KPI C8 relax: subagent_type values that count as "tried to comply but
+ * picked a different agent" → marked `partial_accepted` (C8 weight 0.5).
+ * Sourced from `.claude/agents/` filenames + the harness-built-in roster
+ * referenced by CLAUDE.md «工作流升级判定». Values outside this set leave
+ * the rec pending (StopHandler later marks ignored) — protects against
+ * fabricated subagent names polluting the half-credit bucket.
+ */
+const KNOWN_AGENT_TYPES = new Set([
+    'coder',
+    'doc-reviewer',
+    'harness-debug-full',
+    'harness-hotfix',
+    'hybrid-feature-with-safety',
+    'planner',
+    'refactor-specialist',
+    'verify-agent',
+    // Built-in / common Claude Code subagents that appear in real Task spawns.
+    'general-purpose',
+    'researcher',
+    'feature-developer',
+    'Explore',
+]);
+/**
+ * audit F4: window (ms) within which a PostToolUse may back-fill the outcome
+ * of a prior PreToolUse `deny`. 30s matches a typical "agent retries with the
+ * hinted approach" reaction time without overlapping into the next prompt.
+ */
+const INTERCEPT_OUTCOME_WINDOW_MS = 30 * 1000;
+/** Bypass marker — must match PreToolUseHandler.BYPASS_PATTERN. */
+const BYPASS_PATTERN = /forge:bypass=([^\s'"`]*)/;
+/** Phase 6 feature flag — default OFF. */
+export const AGENT_WRITEBACK_FLAG = 'agent_writeback.enabled';
+/**
+ * Match any changelog path under `docs/implementation/`.
+ *
+ * Two layouts supported (the 2026-05-26 naming refactor introduced the second):
+ *   • legacy flat:   docs/implementation/<stem>-changelog-<ts>.md
+ *   • new datedir:   docs/implementation/YYYY-MM-DD/HHMM-<stem>-changelog.md
+ *
+ * The `.*changelog.*` middle portion is intentionally loose (any path under
+ * `docs/implementation/` that has the word `changelog` in the basename).
+ */
+const CHANGELOG_PATH_PATTERN = /docs\/implementation\/.*changelog[^/]*\.md$/;
 export class PostToolUseHandler {
     storage;
-    tokenTracker = null;
-    constructor(storage = null) {
+    configStore;
+    constructor(storage = null, configStore = null) {
         this.storage = storage;
-        if (storage) {
-            this.tokenTracker = new TokenTracker(storage);
-        }
+        this.configStore = configStore;
     }
     async handle(event) {
         // Observe Agent tool calls and update routing_events
@@ -42,7 +86,216 @@ export class PostToolUseHandler {
                 logger.debug(`[PostToolUse] Failed to update routing_event: ${err}`);
             }
         }
+        // Phase 5: mark pending workflow_recommendation outcome on Task spawn.
+        // (Real subagent invocations come through tool_name='Task' in CC; legacy
+        // 'Agent' is also handled for forward compat.)
+        if (this.storage && (event.tool_name === 'Task' || event.tool_name === 'Agent')) {
+            this.markWorkflowRecOutcome(event);
+        }
+        // Phase 6: agent-experience writeback on changelog Write/Edit.
+        // Fire-and-forget — writeback is observability, never a request-blocker.
+        if (event.tool_name === 'Write' || event.tool_name === 'Edit') {
+            void this.maybeWriteExperience(event);
+        }
+        // audit F4: back-fill outcome on any prior 'deny' intercept for this tool.
+        if (this.storage) {
+            this.maybeMarkInterceptOutcome(event);
+        }
         return { allow: true };
     }
+    /**
+     * audit F4 back-fill (KPI relax: dry_run also back-filled). Pipeline:
+     *   1. Query last 30s of `deny` + `dry_run` intercepts for this session.
+     *      dry_run rows are the "would-have-been-denied" rehearsal that fires
+     *      when `pre_tool_intercept.enabled=false`. Including them lets C4
+     *      compute a meaningful obeyed-ratio BEFORE the flag is flipped on —
+     *      otherwise C4 stays 0 forever in dry_run mode.
+     *   2. If any candidate matches `event.tool_name` → the main loop re-invoked
+     *      the SAME tool despite the deny/dry_run hint → mark 'override'.
+     *   3. Else, the main loop switched tools (most commonly Bash deny → Read /
+     *      Grep / Agent) → mark all candidates 'obeyed'.
+     *
+     * For dry_run rows specifically the verdict is a *pseudo-outcome* — the
+     * rule didn't actually enforce anything, but the main loop's reaction in
+     * the same 30s window still proxies "would they have obeyed?". UI surfaces
+     * this distinction in the C4 tooltip; the SQL aggregation treats both the
+     * same.
+     *
+     * Silently swallows errors — back-fill is observability, never a blocker.
+     * Multiple candidates within the window all get the same verdict; that's
+     * acceptable because the AI's reaction is a single response either way.
+     */
+    maybeMarkInterceptOutcome(event) {
+        if (!this.storage)
+            return;
+        try {
+            const sinceIso = new Date(Date.now() - INTERCEPT_OUTCOME_WINDOW_MS).toISOString();
+            const candidates = this.storage.queryToolIntercepts({
+                session_id: event.session_id,
+                decisions: ['deny', 'dry_run'],
+                since: sinceIso,
+                limit: 10,
+            });
+            const pending = candidates.filter((c) => c.outcome === null);
+            if (pending.length === 0)
+                return;
+            for (const row of pending) {
+                const verdict = row.tool_name === event.tool_name ? 'override' : 'obeyed';
+                this.storage.updateToolInterceptOutcome(row.id, verdict);
+                logger.debug(`[PostToolUse] intercept ${row.id} (rule=${row.rule_id} tool=${row.tool_name}) → ${verdict} (now ran ${event.tool_name})`);
+            }
+        }
+        catch (err) {
+            logger.debug(`[PostToolUse] maybeMarkInterceptOutcome failed: ${err}`);
+        }
+    }
+    /**
+     * Phase 6 writeback. Pipeline:
+     *   1. Flag gate (`agent_writeback.enabled`). Default OFF → silent skip.
+     *   2. Path filter — only changelog paths under `docs/implementation/`
+     *      (matches both the legacy `*-changelog-*.md` and the post-2026-05-26
+     *      datedir layout `YYYY-MM-DD/HHMM-*-changelog.md`).
+     *   3. Run `extractExperience` on the resolved absolute path.
+     *   4. Append each extracted entry to `<projectRoot>/.forge-knowledge/
+     *      agents-experience/<topic>.md`.
+     *
+     * All errors are swallowed (warn-level log) — writeback is best-effort.
+     */
+    async maybeWriteExperience(event) {
+        if (!this.configStore)
+            return;
+        let flagEnabled = false;
+        try {
+            flagEnabled = this.configStore.isEnabled(AGENT_WRITEBACK_FLAG);
+        }
+        catch {
+            return;
+        }
+        if (!flagEnabled)
+            return;
+        const rawPath = pickFilePath(event.tool_input);
+        if (!rawPath)
+            return;
+        if (!CHANGELOG_PATH_PATTERN.test(rawPath))
+            return;
+        const absPath = path.isAbsolute(rawPath)
+            ? rawPath
+            : path.join(event.project_path, rawPath);
+        try {
+            const experiences = await extractExperience(absPath);
+            if (experiences.length === 0)
+                return;
+            let written = 0;
+            for (const exp of experiences) {
+                const ok = await appendToExperienceFile(event.project_path, exp);
+                if (ok)
+                    written++;
+            }
+            if (written > 0) {
+                logger.info(`[PostToolUse] writeback: ${written}/${experiences.length} entries from ${path.basename(absPath)}`);
+            }
+        }
+        catch (err) {
+            logger.warn(`[PostToolUse] experience writeback failed: ${err}`);
+        }
+    }
+    /**
+     * Phase 5 outcome marking. Pipeline:
+     *   1. Find the most recent PENDING workflow_recommendations row for the
+     *      session within the 5 min window. Return early if none.
+     *   2. Extract bypass token from Task description / prompt.
+     *      Token present → mark 'bypassed'.
+     *   3. Else compare subagent_type vs recommended_agent_type.
+     *      Match → 'accepted'. Mismatch → leave pending (PreToolUseHandler
+     *      should already have denied unless the user supplied bypass; we
+     *      don't want to mark mismatched-without-bypass as anything other
+     *      than ignored/Stop-handler's job).
+     *
+     * Silently swallows storage errors — outcome marking is observability,
+     * not a request-blocker.
+     */
+    markWorkflowRecOutcome(event) {
+        if (!this.storage)
+            return;
+        try {
+            const sinceIso = new Date(Date.now() - WORKFLOW_REC_WINDOW_MS).toISOString();
+            const pending = this.storage.queryWorkflowRecommendations({
+                session_id: event.session_id,
+                outcome: 'pending',
+                since: sinceIso,
+                limit: 1,
+            });
+            if (pending.length === 0)
+                return;
+            const rec = pending[0];
+            const spawnedType = getSubagentType(event) ?? '';
+            const bypassToken = extractBypassToken(event.tool_input);
+            if (bypassToken !== null) {
+                this.storage.updateWorkflowRecommendationOutcome(rec.id, 'bypassed', event.timestamp);
+                logger.info(`[PostToolUse] workflow_rec ${rec.id} → bypassed (token="${bypassToken || '<no-reason>'}", spawned=${spawnedType})`);
+                return;
+            }
+            if (spawnedType && spawnedType === rec.recommended_agent_type) {
+                this.storage.updateWorkflowRecommendationOutcome(rec.id, 'accepted', event.timestamp);
+                logger.info(`[PostToolUse] workflow_rec ${rec.id} → accepted (spawned=${spawnedType})`);
+                return;
+            }
+            // KPI C8 relax: main thread spawned a recognised subagent_type that just
+            // isn't the recommended one (e.g. `coder` instead of `refactor-specialist`,
+            // `general-purpose` instead of `harness-hotfix`). That's a real "tried to
+            // comply" signal — mark `partial_accepted` so C8 captures it at weight
+            // 0.5. We deliberately scope this to the KNOWN_AGENT_TYPES allow-list to
+            // protect against fabricated/typo subagent names polluting the bucket.
+            if (spawnedType && KNOWN_AGENT_TYPES.has(spawnedType)) {
+                this.storage.updateWorkflowRecommendationOutcome(rec.id, 'partial_accepted', event.timestamp);
+                logger.info(`[PostToolUse] workflow_rec ${rec.id} → partial_accepted (spawned=${spawnedType}, recommended=${rec.recommended_agent_type})`);
+                return;
+            }
+            // Mismatch w/o bypass and unrecognised type: in strict mode PreToolUse
+            // should have denied. If we got here, either flag was OFF or the deny was
+            // bypassed out-of-band; leave the row pending so Stop handler can mark
+            // ignored.
+            logger.debug(`[PostToolUse] workflow_rec ${rec.id} mismatch — spawned=${spawnedType} vs recommended=${rec.recommended_agent_type}; leaving pending`);
+        }
+        catch (err) {
+            logger.debug(`[PostToolUse] markWorkflowRecOutcome failed: ${err}`);
+        }
+    }
+}
+/**
+ * Resolve the target file path of a Write/Edit tool invocation.
+ *
+ * Claude Code's Write/Edit payloads use `file_path`; legacy CLIs occasionally
+ * package it as `path`. Both shapes are accepted; anything else returns null.
+ */
+function pickFilePath(input) {
+    if (!input)
+        return null;
+    const candidates = [input.file_path, input.path];
+    for (const c of candidates) {
+        if (typeof c === 'string' && c.length > 0)
+            return c;
+    }
+    return null;
+}
+/**
+ * Extract `forge:bypass=<reason>` token from any string field in the Task
+ * tool input. Returns the reason (may be empty string) or null when no token.
+ */
+function extractBypassToken(input) {
+    if (!input)
+        return null;
+    const candidates = [];
+    for (const key of ['description', 'prompt', 'subagent_type', 'name']) {
+        const v = input[key];
+        if (typeof v === 'string')
+            candidates.push(v);
+    }
+    for (const c of candidates) {
+        const m = c.match(BYPASS_PATTERN);
+        if (m)
+            return m[1] ?? '';
+    }
+    return null;
 }
 //# sourceMappingURL=post-tool-use.js.map

package/dist/daemon/handlers/post-tool-use.js.map

@@ -1 +1 @@
-{"version":3,"file":"post-tool-use.js","sourceRoot":"","sources":["../../../src/daemon/handlers/post-tool-use.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,OAAO,kBAAkB;IAInB;IAHF,YAAY,GAAwB,IAAI,CAAC;IAEjD,YACU,UAAgC,IAAI;QAApC,YAAO,GAAP,OAAO,CAA6B;QAE5C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,qDAAqD;QACrD,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,4EAA4E;gBAC5E,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC;gBAE9D,8DAA8D;gBAC9D,oEAAoE;gBACpE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAChF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE;wBAC9C,cAAc,EAAE,OAAO;wBACvB,cAAc,EAAE,SAAS;wBACzB,MAAM,EAAE,CAAC;wBACT,eAAe,EAAE,OAAO;wBACxB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;qBAC1B,CAAC,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,uCAAuC,WAAW,CAAC,EAAE,gBAAgB,SAAS,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"post-tool-use.js","sourceRoot":"","sources":["../../../src/daemon/handlers/post-tool-use.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,OAAO;IACP,cAAc;IACd,oBAAoB;IACpB,gBAAgB;IAChB,4BAA4B;IAC5B,SAAS;IACT,qBAAqB;IACrB,cAAc;IACd,2EAA2E;IAC3E,iBAAiB;IACjB,YAAY;IACZ,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AACH;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,mEAAmE;AACnE,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAClD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAC9D;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,6CAA6C,CAAC;AAE7E,MAAM,OAAO,kBAAkB;IAEnB;IACA;IAFV,YACU,UAAgC,IAAI,EACpC,cAAkC,IAAI;QADtC,YAAO,GAAP,OAAO,CAA6B;QACpC,gBAAW,GAAX,WAAW,CAA2B;IAC7C,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,qDAAqD;QACrD,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,4EAA4E;gBAC5E,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC;gBAE9D,8DAA8D;gBAC9D,oEAAoE;gBACpE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAChF,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE;wBAC9C,cAAc,EAAE,OAAO;wBACvB,cAAc,EAAE,SAAS;wBACzB,MAAM,EAAE,CAAC;wBACT,eAAe,EAAE,OAAO;wBACxB,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;qBAC1B,CAAC,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,uCAAuC,WAAW,CAAC,EAAE,gBAAgB,SAAS,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,+CAA+C;QAC/C,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,+DAA+D;QAC/D,yEAAyE;QACzE,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC9D,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,2EAA2E;QAC3E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,yBAAyB,CAAC,KAAuB;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,IAAI,CACvB,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,CACzC,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAClD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;gBAC9B,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEjC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,OAAO,GACX,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC5D,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACzD,MAAM,CAAC,KAAK,CACV,2BAA2B,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,SAAS,GAAG,CAC1H,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,oBAAoB,CAAC,KAAuB;QACxD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW;YAAE,OAAO;QAEzB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAElD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACtC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACrC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBACjE,IAAI,EAAE;oBAAE,OAAO,EAAE,CAAC;YACpB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CACT,4BAA4B,OAAO,IAAI,WAAW,CAAC,MAAM,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,8CAA8C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,sBAAsB,CAAC,KAAuB;QACpD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC;gBACxD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAEvB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAEzD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtF,MAAM,CAAC,IAAI,CACT,8BAA8B,GAAG,CAAC,EAAE,uBAAuB,WAAW,IAAI,aAAa,cAAc,WAAW,GAAG,CACpH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,WAAW,IAAI,WAAW,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;gBAC9D,IAAI,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtF,MAAM,CAAC,IAAI,CACT,8BAA8B,GAAG,CAAC,EAAE,wBAAwB,WAAW,GAAG,CAC3E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,yEAAyE;YACzE,4EAA4E;YAC5E,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,WAAW,IAAI,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,OAAO,CAAC,mCAAmC,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC9F,MAAM,CAAC,IAAI,CACT,8BAA8B,GAAG,CAAC,EAAE,gCAAgC,WAAW,iBAAiB,GAAG,CAAC,sBAAsB,GAAG,CAC9H,CAAC;gBACF,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,uEAAuE;YACvE,WAAW;YACX,MAAM,CAAC,KAAK,CACV,8BAA8B,GAAG,CAAC,EAAE,uBAAuB,WAAW,mBAAmB,GAAG,CAAC,sBAAsB,mBAAmB,CACvI,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,gDAAgD,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAA0C;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAA0C;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/daemon/handlers/pre-tool-use.d.ts

@@ -0,0 +1,156 @@
+/**
+ * PreToolUseHandler — Phase 1 strict-mode rule engine + dry_run shim.
+ *
+ * Pipeline per event:
+ *   1. Build RuleContext (recent_agent_spawn, edited_files, recent_prompt).
+ *   2. Detect explicit bypass marker (`forge:bypass=<reason>`) in tool input.
+ *   3. Find the first matching ToolInterceptRule from RuleRegistry.
+ *   4. Decide & persist:
+ *      - Flag OFF (default): row written with decision='dry_run'; allow=true.
+ *      - Flag ON  + bypass : decision='bypass'; allow=true.
+ *      - Flag ON  + deny   : decision='deny';   allow=false + hookSpecificOutput.
+ *      - Flag ON  + warn   : decision='warn';   allow=true + additionalContext.
+ *
+ * Storage / config failures must never propagate — `tool_intercepts` is a
+ * fact table; missing rows are acceptable, breaking the tool pipeline is not.
+ *
+ * Session-state computed lazily (per-event) instead of cached, to keep the
+ * handler stateless across daemon restarts. Phase 2 will fold this into
+ * sessions.intercept_count etc. so the lazy scan can be replaced.
+ */
+import type { PreToolUseEvent } from '../../core/types.js';
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+import type { ConfigStore } from '../config-store.js';
+import type { HookResponse } from '../server.js';
+import { RuleRegistry } from '../rules/registry.js';
+import { InterceptRollbackGuard } from '../services/intercept-rollback-guard.js';
+export declare class PreToolUseHandler {
+    private storage;
+    private configStore;
+    private registry;
+    /**
+     * Session → edited-files incremental cache (F7).
+     * Cleared per-session on Stop via `clearSession()`.
+     */
+    private readonly editedFilesCache;
+    private readonly rollbackGuard;
+    constructor(storage: SQLiteStorage, configStore: ConfigStore, registry?: RuleRegistry, rollbackGuard?: InterceptRollbackGuard);
+    /**
+     * Drop cached edited-files state for a session. Called from StopHandler so
+     * long-running daemons don't leak per-session Sets forever.
+     */
+    clearSession(sessionId: string): void;
+    handle(event: PreToolUseEvent): Promise<HookResponse>;
+    private isFlagEnabled;
+    private buildContext;
+    /**
+     * v9.x Phase 2 (2026-05-26): probe `question_default_bmad.enforce`. Default
+     * false during the 7-day dry_run window starting 2026-05-26. Storage /
+     * config failures degrade to `false` (fail-safe — keep dry_run behaviour).
+     */
+    private probeQuestionDefaultBmadEnforce;
+    /**
+     * Phase 5: load the most recent PENDING workflow recommendation for the
+     * session so the `workflow-recommendation-mismatch` rule can fire without
+     * doing its own DB lookup. Returns null when:
+     *   • Phase 5 feature flag is OFF (no row should be enforced)
+     *   • no pending row exists
+     *   • lookup throws (degrade silently to "no enforcement")
+     */
+    private fetchPendingWorkflowRec;
+    /**
+     * Distinct file_paths edited in PostToolUse Edit/Write events for the session.
+     *
+     * F7 fix: incremental cache keyed by session_id. First call scans up to
+     * `EDIT_HISTORY_SCAN_LIMIT` events; subsequent calls fetch only events with
+     * `timestamp >= maxTs` (Set dedup absorbs the boundary). A session with N
+     * PreToolUse events now amortizes to O(N) total scan work instead of O(N·200).
+     *
+     * Returns a fresh copy of the Set so rule matchers can't mutate cached state.
+     */
+    private computeEditedFiles;
+    /**
+     * P0-1 fix (2026-05-27): same as `computeEditedFiles` but additionally
+     * surfaces per-file last-edit ISO timestamp so the HARD multi-file rule can
+     * drop pre-spawn entries. The Set is preserved as the legacy `files`
+     * companion for callers (rule matchers, hint factories) that don't need
+     * timing.
+     *
+     * Cache shape was upgraded (added `fileTs: Map<string,string>`) but the
+     * incremental-scan invariant is unchanged: we only fetch events newer than
+     * the cached `maxTs` and merge into the existing fileTs map (`Map.set`
+     * naturally overwrites with the newest ts since queryEvents returns DESC).
+     */
+    private computeEditedFilesWithTs;
+    /**
+     * P0-1 fix (2026-05-27): timestamp of the most recent PreToolUse Task/Agent
+     * event within the F6 5-min window. Returns null when no spawn was observed.
+     * Uses the same query shape as `detectRecentAgentSpawn` so callers don't pay
+     * twice (storage layer prepared-stmt cache absorbs the duplicate).
+     */
+    private getLastSpawnTs;
+    /**
+     * Did the session spawn an agent (Task / Agent tool) within the recent
+     * observation window?
+     *
+     * F6 fix (2026-05-27): query `PreToolUse` (spawn-initiated) instead of
+     * `PostToolUse` (spawn-completed). PostToolUse Task events only arrive
+     * 30s–5min+ after spawn (when the sub-agent finishes), so the previous
+     * 30s window was permanently false during the actual post-spawn
+     * coordination period the rule was designed to relax. PreToolUse Task
+     * fires at the spawn instant; combined with the 5-min window (aligned
+     * with Phase 5 `PHASE5_WINDOW_MS`), the main thread now correctly sees
+     * `recent_agent_spawn=true` during BMAD coordination.
+     *
+     * `limit` bumped from 40 → 100 because a 5-min window can hold many more
+     * spawn events than the prior 30s window.
+     */
+    private detectRecentAgentSpawn;
+    /** Most-recent UserPromptSubmit prompt text (best-effort, used for intent relaxation). */
+    private fetchRecentPrompt;
+    private persistIntercept;
+}
+/**
+ * Shape-based secret redaction patterns (audit F-medium #5, 2026-05-26).
+ *
+ * Applied to the `tool_input_summary` string we persist into `tool_intercepts`
+ * for auditing. The raw `tool_input` JSON is NEVER redacted at the rule-engine
+ * level (rules legitimately need to inspect verbatim arguments); we only
+ * scrub the *summary* that gets written to durable storage and surfaced in
+ * the Web UI / weekly report.
+ *
+ * Order matters: longer / more specific patterns first so they're not
+ * partially eaten by a more general regex on the same span.
+ *
+ * Patterns covered:
+ *   1. CLI-flag style: --token=…, --api-key=…, password=…, secret=…
+ *   2. JWT shape:       eyJ<base64>.<base64>.<base64>
+ *   3. Anthropic / OpenAI keys: sk-… (40+ chars)
+ *   4. Slack bot tokens: xoxb-… (40+ chars)
+ *   5. AWS access key IDs: AKIA + 16 alnum uppercase
+ *   6. Long hex strings (>= 32 chars) — catches hex API keys / session tokens
+ *
+ * Exported (under-test) for unit tests in pre-tool-use.test.ts so we can lock
+ * down each shape with a focused assertion.
+ */
+/**
+ * Shared redaction pattern table. Each entry is either:
+ *   • `prefixed: true`  — the regex has a single capture group that names the
+ *                          key (e.g. `--token=`); replacement preserves the
+ *                          prefix and substitutes `<redacted>` for the value.
+ *   • `prefixed: false` — the regex matches the entire secret literal; the
+ *                          whole match is replaced with `<redacted>`.
+ *
+ * Exported so tests can lock down each shape individually.
+ */
+export declare const SECRET_REDACTION_PATTERNS: Array<{
+    name: string;
+    re: RegExp;
+    prefixed: boolean;
+}>;
+/**
+ * Apply all `SECRET_REDACTION_PATTERNS` to a string. Exported for unit tests;
+ * production callers should go through `buildToolInputSummary`.
+ */
+export declare function redactSecrets(s: string): string;
+//# sourceMappingURL=pre-tool-use.d.ts.map

package/dist/daemon/handlers/pre-tool-use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-tool-use.d.ts","sourceRoot":"","sources":["../../../src/daemon/handlers/pre-tool-use.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAoDjF,qBAAa,iBAAiB;IAU1B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ;IAXlB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiD;IAElF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;gBAG7C,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EACxB,QAAQ,GAAE,YAAiC,EACnD,aAAa,CAAC,EAAE,sBAAsB;IAKxC;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI/B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IA2I3D,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAsBpB;;;;OAIG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAwB/B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IA4ChC;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAoBtB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,sBAAsB;IAoB9B,0FAA0F;IAC1F,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,gBAAgB;CAyBzB;AA2BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;CACnB,CAwBA,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/C"}