@winspan/claude-forge 8.54.4 → 9.12.0

package/dist/daemon/services/idle-session-sweeper.js

@@ -0,0 +1,94 @@
+/**
+ * Idle-session sweeper (Phase 9.5 — daemon hardening).
+ *
+ * Background
+ * ----------
+ * Outcome classification normally happens in the Stop hook (see
+ * `daemon/handlers/stop.ts`). However a session can end up with `outcome IS
+ * NULL` forever in pathological scenarios:
+ *   - Claude Code crashed / was force-killed before Stop fired
+ *   - Synthetic UserPromptSubmit events injected by tooling that bypass the
+ *     hook protocol (no matching Stop event)
+ *   - Daemon was down during Stop and the event got dropped from the queue
+ *
+ * Those rows then show up in the Web UI as "in progress" forever, polluting
+ * KPIs and confusing users. The sweeper closes that loop: once a session's
+ * last activity is older than `idleThresholdMs` (default 24h), we run the
+ * existing classifier with whatever signals we have on hand (event_count +
+ * user_violation_count from the sessions row). Typical outcome is
+ * `abandoned/no_work` or `abandoned/too_short` — exactly what we want for
+ * UI surface area.
+ *
+ * Design notes
+ * ------------
+ * - **Pure I/O wrapper** over `classifyOutcome` — no new heuristic, no new
+ *   thresholds. Audited behavior stays in one place (outcome-classifier).
+ * - **Race-safe**: `updateSessionOutcome` only writes when the row's outcome
+ *   is still NULL (SQL `WHERE outcome IS NULL`). If a delayed Stop hook
+ *   beats us to the write, we no-op.
+ * - **Defensive cap**: `maxPerSweep` (default 500) prevents runaway processing
+ *   if the table has a huge backlog after a long daemon outage.
+ * - **No git lookup**: the abandoned path doesn't need commit stats. Skipping
+ *   `collectCommitStats` keeps the sweep fast (no subprocess fork per row).
+ */
+import { logger } from '../../core/utils/logger.js';
+import { classifyOutcome } from './outcome-classifier.js';
+const DEFAULT_IDLE_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_MAX_PER_SWEEP = 500;
+/**
+ * Find sessions whose outcome is NULL but whose last-activity timestamp is
+ * older than `idleThresholdMs`. For each, run the existing `classifyOutcome`
+ * over the data we have (event_count / user_violation_count from the row) and
+ * stamp the result. Returns aggregate counters for logging.
+ *
+ * Idempotent — running twice in a row produces `scanned=0` on the second call
+ * because the first sweep set `outcome` to non-NULL.
+ */
+export function sweepIdleSessions(storage, opts = {}) {
+    const idleMs = opts.idleThresholdMs ?? DEFAULT_IDLE_MS;
+    const maxRows = opts.maxPerSweep ?? DEFAULT_MAX_PER_SWEEP;
+    const cutoff = new Date(Date.now() - idleMs).toISOString();
+    const idleHours = Math.round(idleMs / (60 * 60 * 1000));
+    let candidates = [];
+    try {
+        candidates = storage.queryIdleUnclassifiedSessions(cutoff, maxRows);
+    }
+    catch (err) {
+        logger.warn(`[IdleSweeper] query failed: ${err}`);
+        return { scanned: 0, swept: 0, skipped: 0, errors: 1 };
+    }
+    let swept = 0;
+    let errors = 0;
+    const classifiedAt = new Date().toISOString();
+    for (const sess of candidates) {
+        try {
+            // Build the classifier input from what the sessions row gives us.
+            // Missing signals (commit_count, reverted_commits) default to 0 — these
+            // idle/abandoned sessions almost never have git work attributed to them
+            // and we deliberately skip the subprocess fork.
+            const endTime = sess.last_event_time ?? sess.start_time;
+            const result = classifyOutcome({
+                session_id: sess.session_id,
+                start_time: sess.start_time,
+                end_time: endTime,
+                event_count: sess.event_count ?? 0,
+                violation_count: sess.user_violation_count ?? 0,
+                commit_count: 0,
+                reverted_commits: 0,
+            });
+            const annotatedReason = `${result.reason} (idle-swept after ${idleHours}h)`;
+            storage.updateSessionOutcome(sess.session_id, {
+                outcome: result.outcome,
+                outcome_reason: annotatedReason,
+                classified_at: classifiedAt,
+            });
+            swept++;
+        }
+        catch (err) {
+            logger.warn(`[IdleSweeper] failed for ${sess.session_id}: ${err}`);
+            errors++;
+        }
+    }
+    return { scanned: candidates.length, swept, skipped: 0, errors };
+}
+//# sourceMappingURL=idle-session-sweeper.js.map

package/dist/daemon/services/idle-session-sweeper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-session-sweeper.js","sourceRoot":"","sources":["../../../src/daemon/services/idle-session-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAoB1D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,OAAqB,EAAE;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAExD,IAAI,UAAU,GAMT,EAAE,CAAC;IACR,IAAI,CAAC;QACH,UAAU,GAAG,OAAO,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,gDAAgD;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC;YACxD,MAAM,MAAM,GAAG,eAAe,CAAC;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;gBAClC,eAAe,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;gBAC/C,YAAY,EAAE,CAAC;gBACf,gBAAgB,EAAE,CAAC;aACpB,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,GAAG,MAAM,CAAC,MAAM,sBAAsB,SAAS,IAAI,CAAC;YAC5E,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE;gBAC5C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc,EAAE,eAAe;gBAC/B,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;QACV,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/daemon/services/idle-task-budget.d.ts

@@ -0,0 +1,50 @@
+/**
+ * IdleTaskBudget — Stop-time gate for idle-task outcome classification.
+ *
+ * Background (audit F-medium #3, 2026-05-26):
+ *   OutcomeClassificationService.classifyIdleTasks spawns one
+ *   `git log` subprocess per unclassified task, capped internally at
+ *   `MAX_IDLE_TASKS_PER_RUN = 20`. The calls run *sequentially* (no
+ *   concurrency primitive), so a backlog of 20 tasks can stack ~20 git I/O
+ *   round-trips into the Stop fire-and-forget queue. On a busy machine the
+ *   queue piles up and Stop handling for the *next* session starts behind
+ *   the previous session's tail.
+ *
+ * Fix (stop.ts orchestrator scope):
+ *   Peek the backlog before invoking classifyIdleTasks. When the queue is
+ *   small (<= IDLE_TASK_CLASSIFY_LIMIT) we run as before so steady-state
+ *   sessions still get backfill. When the backlog is large we skip the
+ *   call entirely — degraded UX is acceptable because:
+ *
+ *     1. The tasks stay in `outcome=NULL` and will be picked up by the next
+ *        Stop of the same session (when the backlog has presumably been
+ *        worked off by intervening Stops), and
+ *     2. Skipping is preferable to blocking 20 sequential git subprocesses
+ *        on the fire-and-forget queue when the user just wants to move on.
+ *
+ *   This is the "skip when N > limit" strategy called out in the original
+ *   review. A true concurrency limiter is the cleaner long-term fix; that
+ *   change belongs inside `outcome-classification-service.ts` and is out of
+ *   scope for this audit pass (constraints forbid modifying that file).
+ */
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+/**
+ * Maximum backlog size we'll attempt to classify on a single Stop. Tuned so
+ * the sequential `git log` subprocess fan-out stays bounded (each `git log`
+ * is ~100ms; 5x = ~500ms total Stop-tail). When the backlog exceeds this
+ * we skip and let a future Stop pick it up.
+ */
+export declare const IDLE_TASK_CLASSIFY_LIMIT = 5;
+/**
+ * Decide whether the orchestrator should call
+ * `OutcomeClassificationService.classifyIdleTasks` for the given session.
+ *
+ * Returns true when the backlog is small enough that classification will
+ * complete in a bounded time. Returns false when the backlog is too large;
+ * the caller skips the call entirely (logged at info level).
+ *
+ * Failure mode: never throws. On storage error returns false (the safer
+ * choice — skip rather than fan out unbounded).
+ */
+export declare function shouldClassifyIdleTasks(storage: SQLiteStorage, sessionId: string): boolean;
+//# sourceMappingURL=idle-task-budget.d.ts.map

package/dist/daemon/services/idle-task-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-task-budget.d.ts","sourceRoot":"","sources":["../../../src/daemon/services/idle-task-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAqBT"}

package/dist/daemon/services/idle-task-budget.js

@@ -0,0 +1,72 @@
+/**
+ * IdleTaskBudget — Stop-time gate for idle-task outcome classification.
+ *
+ * Background (audit F-medium #3, 2026-05-26):
+ *   OutcomeClassificationService.classifyIdleTasks spawns one
+ *   `git log` subprocess per unclassified task, capped internally at
+ *   `MAX_IDLE_TASKS_PER_RUN = 20`. The calls run *sequentially* (no
+ *   concurrency primitive), so a backlog of 20 tasks can stack ~20 git I/O
+ *   round-trips into the Stop fire-and-forget queue. On a busy machine the
+ *   queue piles up and Stop handling for the *next* session starts behind
+ *   the previous session's tail.
+ *
+ * Fix (stop.ts orchestrator scope):
+ *   Peek the backlog before invoking classifyIdleTasks. When the queue is
+ *   small (<= IDLE_TASK_CLASSIFY_LIMIT) we run as before so steady-state
+ *   sessions still get backfill. When the backlog is large we skip the
+ *   call entirely — degraded UX is acceptable because:
+ *
+ *     1. The tasks stay in `outcome=NULL` and will be picked up by the next
+ *        Stop of the same session (when the backlog has presumably been
+ *        worked off by intervening Stops), and
+ *     2. Skipping is preferable to blocking 20 sequential git subprocesses
+ *        on the fire-and-forget queue when the user just wants to move on.
+ *
+ *   This is the "skip when N > limit" strategy called out in the original
+ *   review. A true concurrency limiter is the cleaner long-term fix; that
+ *   change belongs inside `outcome-classification-service.ts` and is out of
+ *   scope for this audit pass (constraints forbid modifying that file).
+ */
+import { logger } from '../../core/utils/logger.js';
+import { truncateSessionId } from '../../core/utils/session.js';
+import { formatError } from '../../core/utils/format.js';
+/**
+ * Maximum backlog size we'll attempt to classify on a single Stop. Tuned so
+ * the sequential `git log` subprocess fan-out stays bounded (each `git log`
+ * is ~100ms; 5x = ~500ms total Stop-tail). When the backlog exceeds this
+ * we skip and let a future Stop pick it up.
+ */
+export const IDLE_TASK_CLASSIFY_LIMIT = 5;
+/**
+ * Decide whether the orchestrator should call
+ * `OutcomeClassificationService.classifyIdleTasks` for the given session.
+ *
+ * Returns true when the backlog is small enough that classification will
+ * complete in a bounded time. Returns false when the backlog is too large;
+ * the caller skips the call entirely (logged at info level).
+ *
+ * Failure mode: never throws. On storage error returns false (the safer
+ * choice — skip rather than fan out unbounded).
+ */
+export function shouldClassifyIdleTasks(storage, sessionId) {
+    try {
+        const backlog = storage.queryIdleUnclassifiedTasks(sessionId);
+        if (backlog.length === 0) {
+            // Nothing to classify; the service would no-op anyway, but
+            // short-circuit here so the orchestrator log line is clearer.
+            return false;
+        }
+        if (backlog.length > IDLE_TASK_CLASSIFY_LIMIT) {
+            logger.info(`[Stop] Skipping idle-task classification for session ` +
+                `${truncateSessionId(sessionId)} — backlog ${backlog.length} > ` +
+                `${IDLE_TASK_CLASSIFY_LIMIT} (will retry on next Stop)`);
+            return false;
+        }
+        return true;
+    }
+    catch (err) {
+        logger.debug(`[Stop] idle-task budget check failed: ${formatError(err)}`);
+        return false;
+    }
+}
+//# sourceMappingURL=idle-task-budget.js.map

package/dist/daemon/services/idle-task-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idle-task-budget.js","sourceRoot":"","sources":["../../../src/daemon/services/idle-task-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsB,EACtB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,2DAA2D;YAC3D,8DAA8D;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CACT,uDAAuD;gBACrD,GAAG,iBAAiB,CAAC,SAAS,CAAC,cAAc,OAAO,CAAC,MAAM,KAAK;gBAChE,GAAG,wBAAwB,4BAA4B,CAC1D,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,yCAAyC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/daemon/services/intercept-revive.d.ts

@@ -0,0 +1,60 @@
+/**
+ * InterceptRevive — 8-in-1 Phase D (2026-05-27)
+ *
+ * Closes the loop with `InterceptRollbackGuard`:
+ *
+ *   • `InterceptRollbackGuard` flips `pre_tool_intercept.enabled=false` and
+ *     writes `auto_disabled_at` + `auto_disabled_session` audit keys when a
+ *     session triggers ≥3 denies in 60s. Reason: protect the user from a
+ *     mis-tuned rule cascade.
+ *
+ *   • Without revive: that flag stays `false` forever. The user has to
+ *     `cf config set pre_tool_intercept.enabled true` by hand. In practice
+ *     (per the spec's problem statement) the user never remembers.
+ *
+ *   • Revive: on every daemon startup, check if the flag is `false` AND the
+ *     `auto_disabled_at` audit key is present AND > 24h has passed. If yes,
+ *     flip the flag back to `true` and delete the audit keys (clean slate
+ *     for the next rollback to land).
+ *
+ *   • Hysteresis: 24h is the spec default (`hysteresisHours: 24`). Skips the
+ *     revive when the disable is fresh — gives the user a debugging window
+ *     to investigate WHY the rollback fired.
+ *
+ *   • User intent preservation: this service ONLY revives auto-disables.
+ *     If the user manually ran `cf config set pre_tool_intercept.enabled false`,
+ *     no `auto_disabled_at` key was written (that's set ONLY by
+ *     `InterceptRollbackGuard.checkAndMaybeRollback`). The revive sees the
+ *     missing key and does nothing — user wishes respected.
+ *
+ * Called once from `src/daemon/index.ts` after `seedDefaults()`. All errors
+ * are caught and logged at WARN level — revive must never throw and break
+ * daemon boot.
+ */
+import type { ConfigStore } from '../config-store.js';
+export declare const DEFAULT_HYSTERESIS_HOURS = 24;
+export interface ReviveOutcome {
+    /** True if the flag was flipped back to 'true' on this call. */
+    revived: boolean;
+    /**
+     * Human-readable reason recorded in the daemon log on each call. Stays
+     * non-null even when `revived === false` so the test suite can lock down
+     * the decision path.
+     */
+    reason: string;
+}
+export interface ReviveOptions {
+    /** Hours that must have elapsed since auto-disable before revive fires. */
+    hysteresisHours?: number;
+    /** Inject `now` for tests; defaults to `new Date()`. */
+    nowProvider?: () => Date;
+}
+/**
+ * Decide whether to revive `pre_tool_intercept.enabled=true` after a stale
+ * rollback. Pure: takes ConfigStore + options and returns ReviveOutcome.
+ *
+ * Safe to call repeatedly; subsequent calls after a successful revive are
+ * no-ops (the flag is now `true`).
+ */
+export declare function reviveInterceptIfStale(configStore: ConfigStore, opts?: ReviveOptions): ReviveOutcome;
+//# sourceMappingURL=intercept-revive.d.ts.map

package/dist/daemon/services/intercept-revive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-revive.d.ts","sourceRoot":"","sources":["../../../src/daemon/services/intercept-revive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQtD,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,WAAW,EACxB,IAAI,GAAE,aAAkB,GACvB,aAAa,CA8Cf"}

package/dist/daemon/services/intercept-revive.js

@@ -0,0 +1,86 @@
+/**
+ * InterceptRevive — 8-in-1 Phase D (2026-05-27)
+ *
+ * Closes the loop with `InterceptRollbackGuard`:
+ *
+ *   • `InterceptRollbackGuard` flips `pre_tool_intercept.enabled=false` and
+ *     writes `auto_disabled_at` + `auto_disabled_session` audit keys when a
+ *     session triggers ≥3 denies in 60s. Reason: protect the user from a
+ *     mis-tuned rule cascade.
+ *
+ *   • Without revive: that flag stays `false` forever. The user has to
+ *     `cf config set pre_tool_intercept.enabled true` by hand. In practice
+ *     (per the spec's problem statement) the user never remembers.
+ *
+ *   • Revive: on every daemon startup, check if the flag is `false` AND the
+ *     `auto_disabled_at` audit key is present AND > 24h has passed. If yes,
+ *     flip the flag back to `true` and delete the audit keys (clean slate
+ *     for the next rollback to land).
+ *
+ *   • Hysteresis: 24h is the spec default (`hysteresisHours: 24`). Skips the
+ *     revive when the disable is fresh — gives the user a debugging window
+ *     to investigate WHY the rollback fired.
+ *
+ *   • User intent preservation: this service ONLY revives auto-disables.
+ *     If the user manually ran `cf config set pre_tool_intercept.enabled false`,
+ *     no `auto_disabled_at` key was written (that's set ONLY by
+ *     `InterceptRollbackGuard.checkAndMaybeRollback`). The revive sees the
+ *     missing key and does nothing — user wishes respected.
+ *
+ * Called once from `src/daemon/index.ts` after `seedDefaults()`. All errors
+ * are caught and logged at WARN level — revive must never throw and break
+ * daemon boot.
+ */
+import { ROLLBACK_FLAG_KEY, ROLLBACK_AUTO_DISABLED_AT_KEY, ROLLBACK_AUTO_DISABLED_SESSION_KEY, } from './intercept-rollback-guard.js';
+import { logger } from '../../core/utils/logger.js';
+export const DEFAULT_HYSTERESIS_HOURS = 24;
+/**
+ * Decide whether to revive `pre_tool_intercept.enabled=true` after a stale
+ * rollback. Pure: takes ConfigStore + options and returns ReviveOutcome.
+ *
+ * Safe to call repeatedly; subsequent calls after a successful revive are
+ * no-ops (the flag is now `true`).
+ */
+export function reviveInterceptIfStale(configStore, opts = {}) {
+    const hysteresisHours = opts.hysteresisHours ?? DEFAULT_HYSTERESIS_HOURS;
+    const now = (opts.nowProvider ?? (() => new Date()))();
+    try {
+        const flag = configStore.get(ROLLBACK_FLAG_KEY);
+        if (flag === 'true') {
+            return { revived: false, reason: 'already enabled' };
+        }
+        const autoDisabledAt = configStore.get(ROLLBACK_AUTO_DISABLED_AT_KEY);
+        if (!autoDisabledAt) {
+            // No audit key → user manually disabled, respect their choice.
+            return { revived: false, reason: 'no auto_disabled_at — user-disabled, leaving alone' };
+        }
+        const disabledMs = Date.parse(autoDisabledAt);
+        if (!Number.isFinite(disabledMs)) {
+            return {
+                revived: false,
+                reason: `auto_disabled_at not parseable as ISO date: ${autoDisabledAt}`,
+            };
+        }
+        const elapsedHours = (now.getTime() - disabledMs) / (60 * 60 * 1000);
+        if (elapsedHours < hysteresisHours) {
+            return {
+                revived: false,
+                reason: `within hysteresis window (${elapsedHours.toFixed(1)}h elapsed, threshold ${hysteresisHours}h)`,
+            };
+        }
+        // Flip + clean audit keys.
+        configStore.set(ROLLBACK_FLAG_KEY, 'true');
+        configStore.delete(ROLLBACK_AUTO_DISABLED_AT_KEY);
+        configStore.delete(ROLLBACK_AUTO_DISABLED_SESSION_KEY);
+        const msg = `Re-enabled after ${hysteresisHours}h hysteresis since auto-disable ` +
+            `(elapsed ${elapsedHours.toFixed(1)}h, auto_disabled_at=${autoDisabledAt})`;
+        logger.info(`[InterceptRevive] ${msg}`);
+        return { revived: true, reason: msg };
+    }
+    catch (err) {
+        const reason = `revive aborted (config read/write failed): ${err}`;
+        logger.warn(`[InterceptRevive] ${reason}`);
+        return { revived: false, reason };
+    }
+}
+//# sourceMappingURL=intercept-revive.js.map

package/dist/daemon/services/intercept-revive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-revive.js","sourceRoot":"","sources":["../../../src/daemon/services/intercept-revive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAoB3C;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAwB,EACxB,OAAsB,EAAE;IAExB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACzE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,+DAA+D;YAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+CAA+C,cAAc,EAAE;aACxE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACrE,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6BAA6B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,eAAe,IAAI;aACxG,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC3C,WAAW,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAClD,WAAW,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACvD,MAAM,GAAG,GACP,oBAAoB,eAAe,kCAAkC;YACrE,YAAY,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,cAAc,GAAG,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,8CAA8C,GAAG,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/daemon/services/intercept-rollback-guard.d.ts

@@ -0,0 +1,105 @@
+/**
+ * InterceptRollbackGuard — Phase 2c safety-net #3.
+ *
+ * Detect "enforcement misfire" by counting how many `deny` rows the same
+ * session produced within a sliding window (5min by default). When the deny
+ * count crosses `ROLLBACK_DENY_THRESHOLD` AND the window contains at least
+ * `ROLLBACK_DISTINCT_RULES_REQUIRED` distinct `rule_id`s, automatically flip
+ * `pre_tool_intercept.enabled` back to `'false'` so the user is not stuck.
+ *
+ * Why SQL instead of in-memory Map (doc-reviewer P0 Sub-3):
+ *   • daemon restart would wipe an in-memory counter — a flaky session that
+ *     restarted the daemon mid-sequence would bypass the guard.
+ *   • `tool_intercepts` already has every deny row with timestamp & session_id
+ *     — re-using it is single source of truth.
+ *
+ * The guard is intentionally light:
+ *   • Single SQL read per PreToolUseHandler deny decision.
+ *   • Rollback writes 3 forge_config keys + emits an additionalContext blob.
+ *   • Once rollback fires it does NOT re-arm until the user manually
+ *     `cf config set pre_tool_intercept.enabled true` — the new ON event
+ *     starts a fresh window because the SQL count only looks at the last
+ *     window length.
+ *
+ * 2026-05-27 (Spec 4) tuning:
+ *   • Window widened 60s → 5min and threshold lifted 3 → 10. The old
+ *     "3 denies in 60s" tripped on normal BMAD multi-file edit bursts that
+ *     legitimately re-hit the same rule.
+ *   • Added `ROLLBACK_DISTINCT_RULES_REQUIRED=2` — a single rule slamming the
+ *     counter is "rules working as designed", not misfire; we now require
+ *     ≥2 distinct rule_ids in the window before rolling back. Multi-rule
+ *     storms remain a credible "registry-level misfire" signal.
+ */
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+import type { ConfigStore } from '../config-store.js';
+/** Sliding window length used by the guard (ms). 5min default (was 60s). */
+export declare const ROLLBACK_WINDOW_MS: number;
+/** Number of denies inside the window that triggers rollback. 10 default (was 3). */
+export declare const ROLLBACK_DENY_THRESHOLD = 10;
+/**
+ * Minimum number of distinct rule_ids whose deny rows must appear in the
+ * window before rollback can trigger. Single-rule storms (e.g. user
+ * legitimately editing many files and tripping `edit-multi-file-hard`
+ * repeatedly) are NOT misfire and should not roll back enforcement.
+ * Multi-rule storms (≥2 distinct rules denying in 5min) is the real "rule
+ * registry misfire" signal we want to catch.
+ */
+export declare const ROLLBACK_DISTINCT_RULES_REQUIRED = 2;
+/** ConfigStore keys written by the guard on rollback. */
+export declare const ROLLBACK_FLAG_KEY = "pre_tool_intercept.enabled";
+export declare const ROLLBACK_AUTO_DISABLED_AT_KEY = "pre_tool_intercept.auto_disabled_at";
+export declare const ROLLBACK_AUTO_DISABLED_SESSION_KEY = "pre_tool_intercept.auto_disabled_session";
+export interface RollbackOutcome {
+    /** True when this call flipped the flag OFF (first crossing of threshold). */
+    triggered: boolean;
+    /** Number of deny rows within the window AFTER this call (incl. the current one). */
+    denyCount: number;
+    /** Distinct rule_ids contributing to the window — surfaced in the user warning. */
+    ruleIds: string[];
+    /**
+     * Human-facing context string. Non-null only when `triggered === true`;
+     * PreToolUseHandler appends this to its HookResponse.additionalContext.
+     */
+    additionalContext: string | null;
+}
+/**
+ * Service object. Stateless aside from its dependencies — safe to instantiate
+ * once in daemon/index.ts and share across all PreToolUse events.
+ */
+export declare class InterceptRollbackGuard {
+    private storage;
+    private configStore;
+    private windowMs;
+    private threshold;
+    /**
+     * Minimum distinct rule_ids the window must contain before rollback
+     * fires. Override only in tests; production keeps the constant default.
+     */
+    private distinctRulesRequired;
+    constructor(storage: SQLiteStorage, configStore: ConfigStore, windowMs?: number, threshold?: number, 
+    /**
+     * Minimum distinct rule_ids the window must contain before rollback
+     * fires. Override only in tests; production keeps the constant default.
+     */
+    distinctRulesRequired?: number);
+    /**
+     * Called by PreToolUseHandler right after it persists a deny row. Returns
+     * `RollbackOutcome.triggered === true` exactly on the call that first
+     * crosses the threshold; subsequent denies in the same window will still
+     * return triggered=false because we early-exit when the flag is already
+     * disabled.
+     *
+     * The caller is responsible for surfacing `additionalContext` back to
+     * Claude Code. The current event is NOT blocked — letting one extra deny
+     * through is preferable to maintaining write-then-rollback transactionality
+     * here.
+     *
+     * Failures are swallowed (logged at warn): the enforcement pipeline must
+     * never throw because a rollback guard misfired.
+     */
+    checkAndMaybeRollback(args: {
+        sessionId: string;
+        nowIso: string;
+    }): RollbackOutcome;
+}
+//# sourceMappingURL=intercept-rollback-guard.d.ts.map

package/dist/daemon/services/intercept-rollback-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-rollback-guard.d.ts","sourceRoot":"","sources":["../../../src/daemon/services/intercept-rollback-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,QAAgB,CAAC;AAChD,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAC9D,eAAO,MAAM,6BAA6B,wCAAwC,CAAC;AACnF,eAAO,MAAM,kCAAkC,6CAA6C,CAAC;AAE7F,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,SAAS;IACjB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;gBARrB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EACxB,QAAQ,GAAE,MAA2B,EACrC,SAAS,GAAE,MAAgC;IACnD;;;OAGG;IACK,qBAAqB,GAAE,MAAyC;IAG1E;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,IAAI,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,eAAe;CAqDpB"}

package/dist/daemon/services/intercept-rollback-guard.js

@@ -0,0 +1,152 @@
+/**
+ * InterceptRollbackGuard — Phase 2c safety-net #3.
+ *
+ * Detect "enforcement misfire" by counting how many `deny` rows the same
+ * session produced within a sliding window (5min by default). When the deny
+ * count crosses `ROLLBACK_DENY_THRESHOLD` AND the window contains at least
+ * `ROLLBACK_DISTINCT_RULES_REQUIRED` distinct `rule_id`s, automatically flip
+ * `pre_tool_intercept.enabled` back to `'false'` so the user is not stuck.
+ *
+ * Why SQL instead of in-memory Map (doc-reviewer P0 Sub-3):
+ *   • daemon restart would wipe an in-memory counter — a flaky session that
+ *     restarted the daemon mid-sequence would bypass the guard.
+ *   • `tool_intercepts` already has every deny row with timestamp & session_id
+ *     — re-using it is single source of truth.
+ *
+ * The guard is intentionally light:
+ *   • Single SQL read per PreToolUseHandler deny decision.
+ *   • Rollback writes 3 forge_config keys + emits an additionalContext blob.
+ *   • Once rollback fires it does NOT re-arm until the user manually
+ *     `cf config set pre_tool_intercept.enabled true` — the new ON event
+ *     starts a fresh window because the SQL count only looks at the last
+ *     window length.
+ *
+ * 2026-05-27 (Spec 4) tuning:
+ *   • Window widened 60s → 5min and threshold lifted 3 → 10. The old
+ *     "3 denies in 60s" tripped on normal BMAD multi-file edit bursts that
+ *     legitimately re-hit the same rule.
+ *   • Added `ROLLBACK_DISTINCT_RULES_REQUIRED=2` — a single rule slamming the
+ *     counter is "rules working as designed", not misfire; we now require
+ *     ≥2 distinct rule_ids in the window before rolling back. Multi-rule
+ *     storms remain a credible "registry-level misfire" signal.
+ */
+import { logger } from '../../core/utils/logger.js';
+/** Sliding window length used by the guard (ms). 5min default (was 60s). */
+export const ROLLBACK_WINDOW_MS = 5 * 60 * 1000;
+/** Number of denies inside the window that triggers rollback. 10 default (was 3). */
+export const ROLLBACK_DENY_THRESHOLD = 10;
+/**
+ * Minimum number of distinct rule_ids whose deny rows must appear in the
+ * window before rollback can trigger. Single-rule storms (e.g. user
+ * legitimately editing many files and tripping `edit-multi-file-hard`
+ * repeatedly) are NOT misfire and should not roll back enforcement.
+ * Multi-rule storms (≥2 distinct rules denying in 5min) is the real "rule
+ * registry misfire" signal we want to catch.
+ */
+export const ROLLBACK_DISTINCT_RULES_REQUIRED = 2;
+/** ConfigStore keys written by the guard on rollback. */
+export const ROLLBACK_FLAG_KEY = 'pre_tool_intercept.enabled';
+export const ROLLBACK_AUTO_DISABLED_AT_KEY = 'pre_tool_intercept.auto_disabled_at';
+export const ROLLBACK_AUTO_DISABLED_SESSION_KEY = 'pre_tool_intercept.auto_disabled_session';
+/**
+ * Service object. Stateless aside from its dependencies — safe to instantiate
+ * once in daemon/index.ts and share across all PreToolUse events.
+ */
+export class InterceptRollbackGuard {
+    storage;
+    configStore;
+    windowMs;
+    threshold;
+    distinctRulesRequired;
+    constructor(storage, configStore, windowMs = ROLLBACK_WINDOW_MS, threshold = ROLLBACK_DENY_THRESHOLD, 
+    /**
+     * Minimum distinct rule_ids the window must contain before rollback
+     * fires. Override only in tests; production keeps the constant default.
+     */
+    distinctRulesRequired = ROLLBACK_DISTINCT_RULES_REQUIRED) {
+        this.storage = storage;
+        this.configStore = configStore;
+        this.windowMs = windowMs;
+        this.threshold = threshold;
+        this.distinctRulesRequired = distinctRulesRequired;
+    }
+    /**
+     * Called by PreToolUseHandler right after it persists a deny row. Returns
+     * `RollbackOutcome.triggered === true` exactly on the call that first
+     * crosses the threshold; subsequent denies in the same window will still
+     * return triggered=false because we early-exit when the flag is already
+     * disabled.
+     *
+     * The caller is responsible for surfacing `additionalContext` back to
+     * Claude Code. The current event is NOT blocked — letting one extra deny
+     * through is preferable to maintaining write-then-rollback transactionality
+     * here.
+     *
+     * Failures are swallowed (logged at warn): the enforcement pipeline must
+     * never throw because a rollback guard misfired.
+     */
+    checkAndMaybeRollback(args) {
+        const empty = { triggered: false, denyCount: 0, ruleIds: [], additionalContext: null };
+        try {
+            // If the flag is already OFF, nothing to do — caller already saw
+            // dry_run behavior on this deny (the deny was persisted but allow=true).
+            // The handler still calls us because it's cheaper than reading the flag
+            // twice; we short-circuit here instead.
+            if (!this.configStore.isEnabled(ROLLBACK_FLAG_KEY))
+                return empty;
+            const sinceIso = new Date(Date.parse(args.nowIso) - this.windowMs).toISOString();
+            const rows = this.storage.queryToolIntercepts({
+                session_id: args.sessionId,
+                decision: 'deny',
+                since: sinceIso,
+                limit: Math.max(this.threshold * 2, 10),
+            });
+            const denyCount = rows.length;
+            // Order-insensitive distinct rule list (Set preserves insertion order in JS).
+            const ruleIds = Array.from(new Set(rows.map((r) => r.rule_id)));
+            if (denyCount < this.threshold) {
+                return { triggered: false, denyCount, ruleIds, additionalContext: null };
+            }
+            // B3 (Spec 4) — single-rule storms are not misfire. Require at least
+            // `distinctRulesRequired` rule_ids in the window before flipping.
+            if (ruleIds.length < this.distinctRulesRequired) {
+                return { triggered: false, denyCount, ruleIds, additionalContext: null };
+            }
+            // Threshold reached AND multi-rule storm — flip flag OFF and write audit keys.
+            try {
+                this.configStore.set(ROLLBACK_FLAG_KEY, 'false');
+                this.configStore.set(ROLLBACK_AUTO_DISABLED_AT_KEY, args.nowIso);
+                this.configStore.set(ROLLBACK_AUTO_DISABLED_SESSION_KEY, args.sessionId);
+            }
+            catch (err) {
+                logger.warn(`[InterceptRollbackGuard] config write failed: ${err}`);
+                return { triggered: false, denyCount, ruleIds, additionalContext: null };
+            }
+            const windowMinutes = Math.round(this.windowMs / 60_000);
+            const ctx = buildRollbackMessage(denyCount, ruleIds, windowMinutes);
+            logger.warn(`[InterceptRollbackGuard] AUTO-DISABLED enforcement for session ${args.sessionId} ` +
+                `(${denyCount} denies in ${windowMinutes}min from ${ruleIds.length} distinct rules; ` +
+                `rules=${ruleIds.join(',')})`);
+            return { triggered: true, denyCount, ruleIds, additionalContext: ctx };
+        }
+        catch (err) {
+            logger.warn(`[InterceptRollbackGuard] check failed: ${err}`);
+            return empty;
+        }
+    }
+}
+/**
+ * Pretty-printed user-facing context appended on rollback. Kept in module
+ * scope so tests can match against the exact phrasing.
+ */
+function buildRollbackMessage(denyCount, ruleIds, windowMinutes) {
+    const ruleList = ruleIds.length > 0 ? ruleIds.join(', ') : '(unknown)';
+    return [
+        '⚠️ [forge enforcement auto-disabled]',
+        `${windowMinutes}min 内此 session 触发 ${denyCount} 次 deny，涉及 ${ruleIds.length} 条规则` +
+            `（rules: ${ruleList}）→ 已自动关闭强制档。`,
+        '重新启用：cf config set pre_tool_intercept.enabled true',
+        '反馈误杀：cf logs --tail | grep tool_intercepts',
+    ].join('\n');
+}
+//# sourceMappingURL=intercept-rollback-guard.js.map