@winspan/claude-forge 8.54.4 → 9.2.0

package/dist/daemon/services/intercept-revive.js

@@ -0,0 +1,86 @@
+/**
+ * InterceptRevive — 8-in-1 Phase D (2026-05-27)
+ *
+ * Closes the loop with `InterceptRollbackGuard`:
+ *
+ *   • `InterceptRollbackGuard` flips `pre_tool_intercept.enabled=false` and
+ *     writes `auto_disabled_at` + `auto_disabled_session` audit keys when a
+ *     session triggers ≥3 denies in 60s. Reason: protect the user from a
+ *     mis-tuned rule cascade.
+ *
+ *   • Without revive: that flag stays `false` forever. The user has to
+ *     `cf config set pre_tool_intercept.enabled true` by hand. In practice
+ *     (per the spec's problem statement) the user never remembers.
+ *
+ *   • Revive: on every daemon startup, check if the flag is `false` AND the
+ *     `auto_disabled_at` audit key is present AND > 24h has passed. If yes,
+ *     flip the flag back to `true` and delete the audit keys (clean slate
+ *     for the next rollback to land).
+ *
+ *   • Hysteresis: 24h is the spec default (`hysteresisHours: 24`). Skips the
+ *     revive when the disable is fresh — gives the user a debugging window
+ *     to investigate WHY the rollback fired.
+ *
+ *   • User intent preservation: this service ONLY revives auto-disables.
+ *     If the user manually ran `cf config set pre_tool_intercept.enabled false`,
+ *     no `auto_disabled_at` key was written (that's set ONLY by
+ *     `InterceptRollbackGuard.checkAndMaybeRollback`). The revive sees the
+ *     missing key and does nothing — user wishes respected.
+ *
+ * Called once from `src/daemon/index.ts` after `seedDefaults()`. All errors
+ * are caught and logged at WARN level — revive must never throw and break
+ * daemon boot.
+ */
+import { ROLLBACK_FLAG_KEY, ROLLBACK_AUTO_DISABLED_AT_KEY, ROLLBACK_AUTO_DISABLED_SESSION_KEY, } from './intercept-rollback-guard.js';
+import { logger } from '../../core/utils/logger.js';
+export const DEFAULT_HYSTERESIS_HOURS = 24;
+/**
+ * Decide whether to revive `pre_tool_intercept.enabled=true` after a stale
+ * rollback. Pure: takes ConfigStore + options and returns ReviveOutcome.
+ *
+ * Safe to call repeatedly; subsequent calls after a successful revive are
+ * no-ops (the flag is now `true`).
+ */
+export function reviveInterceptIfStale(configStore, opts = {}) {
+    const hysteresisHours = opts.hysteresisHours ?? DEFAULT_HYSTERESIS_HOURS;
+    const now = (opts.nowProvider ?? (() => new Date()))();
+    try {
+        const flag = configStore.get(ROLLBACK_FLAG_KEY);
+        if (flag === 'true') {
+            return { revived: false, reason: 'already enabled' };
+        }
+        const autoDisabledAt = configStore.get(ROLLBACK_AUTO_DISABLED_AT_KEY);
+        if (!autoDisabledAt) {
+            // No audit key → user manually disabled, respect their choice.
+            return { revived: false, reason: 'no auto_disabled_at — user-disabled, leaving alone' };
+        }
+        const disabledMs = Date.parse(autoDisabledAt);
+        if (!Number.isFinite(disabledMs)) {
+            return {
+                revived: false,
+                reason: `auto_disabled_at not parseable as ISO date: ${autoDisabledAt}`,
+            };
+        }
+        const elapsedHours = (now.getTime() - disabledMs) / (60 * 60 * 1000);
+        if (elapsedHours < hysteresisHours) {
+            return {
+                revived: false,
+                reason: `within hysteresis window (${elapsedHours.toFixed(1)}h elapsed, threshold ${hysteresisHours}h)`,
+            };
+        }
+        // Flip + clean audit keys.
+        configStore.set(ROLLBACK_FLAG_KEY, 'true');
+        configStore.delete(ROLLBACK_AUTO_DISABLED_AT_KEY);
+        configStore.delete(ROLLBACK_AUTO_DISABLED_SESSION_KEY);
+        const msg = `Re-enabled after ${hysteresisHours}h hysteresis since auto-disable ` +
+            `(elapsed ${elapsedHours.toFixed(1)}h, auto_disabled_at=${autoDisabledAt})`;
+        logger.info(`[InterceptRevive] ${msg}`);
+        return { revived: true, reason: msg };
+    }
+    catch (err) {
+        const reason = `revive aborted (config read/write failed): ${err}`;
+        logger.warn(`[InterceptRevive] ${reason}`);
+        return { revived: false, reason };
+    }
+}
+//# sourceMappingURL=intercept-revive.js.map

package/dist/daemon/services/intercept-revive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-revive.js","sourceRoot":"","sources":["../../../src/daemon/services/intercept-revive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAoB3C;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAwB,EACxB,OAAsB,EAAE;IAExB,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACzE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,+DAA+D;YAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,+CAA+C,cAAc,EAAE;aACxE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACrE,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,6BAA6B,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,eAAe,IAAI;aACxG,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC3C,WAAW,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAClD,WAAW,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACvD,MAAM,GAAG,GACP,oBAAoB,eAAe,kCAAkC;YACrE,YAAY,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,cAAc,GAAG,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,8CAA8C,GAAG,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/daemon/services/intercept-rollback-guard.d.ts

@@ -0,0 +1,105 @@
+/**
+ * InterceptRollbackGuard — Phase 2c safety-net #3.
+ *
+ * Detect "enforcement misfire" by counting how many `deny` rows the same
+ * session produced within a sliding window (5min by default). When the deny
+ * count crosses `ROLLBACK_DENY_THRESHOLD` AND the window contains at least
+ * `ROLLBACK_DISTINCT_RULES_REQUIRED` distinct `rule_id`s, automatically flip
+ * `pre_tool_intercept.enabled` back to `'false'` so the user is not stuck.
+ *
+ * Why SQL instead of in-memory Map (doc-reviewer P0 Sub-3):
+ *   • daemon restart would wipe an in-memory counter — a flaky session that
+ *     restarted the daemon mid-sequence would bypass the guard.
+ *   • `tool_intercepts` already has every deny row with timestamp & session_id
+ *     — re-using it is single source of truth.
+ *
+ * The guard is intentionally light:
+ *   • Single SQL read per PreToolUseHandler deny decision.
+ *   • Rollback writes 3 forge_config keys + emits an additionalContext blob.
+ *   • Once rollback fires it does NOT re-arm until the user manually
+ *     `cf config set pre_tool_intercept.enabled true` — the new ON event
+ *     starts a fresh window because the SQL count only looks at the last
+ *     window length.
+ *
+ * 2026-05-27 (Spec 4) tuning:
+ *   • Window widened 60s → 5min and threshold lifted 3 → 10. The old
+ *     "3 denies in 60s" tripped on normal BMAD multi-file edit bursts that
+ *     legitimately re-hit the same rule.
+ *   • Added `ROLLBACK_DISTINCT_RULES_REQUIRED=2` — a single rule slamming the
+ *     counter is "rules working as designed", not misfire; we now require
+ *     ≥2 distinct rule_ids in the window before rolling back. Multi-rule
+ *     storms remain a credible "registry-level misfire" signal.
+ */
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+import type { ConfigStore } from '../config-store.js';
+/** Sliding window length used by the guard (ms). 5min default (was 60s). */
+export declare const ROLLBACK_WINDOW_MS: number;
+/** Number of denies inside the window that triggers rollback. 10 default (was 3). */
+export declare const ROLLBACK_DENY_THRESHOLD = 10;
+/**
+ * Minimum number of distinct rule_ids whose deny rows must appear in the
+ * window before rollback can trigger. Single-rule storms (e.g. user
+ * legitimately editing many files and tripping `edit-multi-file-hard`
+ * repeatedly) are NOT misfire and should not roll back enforcement.
+ * Multi-rule storms (≥2 distinct rules denying in 5min) is the real "rule
+ * registry misfire" signal we want to catch.
+ */
+export declare const ROLLBACK_DISTINCT_RULES_REQUIRED = 2;
+/** ConfigStore keys written by the guard on rollback. */
+export declare const ROLLBACK_FLAG_KEY = "pre_tool_intercept.enabled";
+export declare const ROLLBACK_AUTO_DISABLED_AT_KEY = "pre_tool_intercept.auto_disabled_at";
+export declare const ROLLBACK_AUTO_DISABLED_SESSION_KEY = "pre_tool_intercept.auto_disabled_session";
+export interface RollbackOutcome {
+    /** True when this call flipped the flag OFF (first crossing of threshold). */
+    triggered: boolean;
+    /** Number of deny rows within the window AFTER this call (incl. the current one). */
+    denyCount: number;
+    /** Distinct rule_ids contributing to the window — surfaced in the user warning. */
+    ruleIds: string[];
+    /**
+     * Human-facing context string. Non-null only when `triggered === true`;
+     * PreToolUseHandler appends this to its HookResponse.additionalContext.
+     */
+    additionalContext: string | null;
+}
+/**
+ * Service object. Stateless aside from its dependencies — safe to instantiate
+ * once in daemon/index.ts and share across all PreToolUse events.
+ */
+export declare class InterceptRollbackGuard {
+    private storage;
+    private configStore;
+    private windowMs;
+    private threshold;
+    /**
+     * Minimum distinct rule_ids the window must contain before rollback
+     * fires. Override only in tests; production keeps the constant default.
+     */
+    private distinctRulesRequired;
+    constructor(storage: SQLiteStorage, configStore: ConfigStore, windowMs?: number, threshold?: number, 
+    /**
+     * Minimum distinct rule_ids the window must contain before rollback
+     * fires. Override only in tests; production keeps the constant default.
+     */
+    distinctRulesRequired?: number);
+    /**
+     * Called by PreToolUseHandler right after it persists a deny row. Returns
+     * `RollbackOutcome.triggered === true` exactly on the call that first
+     * crosses the threshold; subsequent denies in the same window will still
+     * return triggered=false because we early-exit when the flag is already
+     * disabled.
+     *
+     * The caller is responsible for surfacing `additionalContext` back to
+     * Claude Code. The current event is NOT blocked — letting one extra deny
+     * through is preferable to maintaining write-then-rollback transactionality
+     * here.
+     *
+     * Failures are swallowed (logged at warn): the enforcement pipeline must
+     * never throw because a rollback guard misfired.
+     */
+    checkAndMaybeRollback(args: {
+        sessionId: string;
+        nowIso: string;
+    }): RollbackOutcome;
+}
+//# sourceMappingURL=intercept-rollback-guard.d.ts.map

package/dist/daemon/services/intercept-rollback-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-rollback-guard.d.ts","sourceRoot":"","sources":["../../../src/daemon/services/intercept-rollback-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,QAAgB,CAAC;AAChD,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAC9D,eAAO,MAAM,6BAA6B,wCAAwC,CAAC;AACnF,eAAO,MAAM,kCAAkC,6CAA6C,CAAC;AAE7F,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,SAAS;IACjB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;gBARrB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,WAAW,EACxB,QAAQ,GAAE,MAA2B,EACrC,SAAS,GAAE,MAAgC;IACnD;;;OAGG;IACK,qBAAqB,GAAE,MAAyC;IAG1E;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,IAAI,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,eAAe;CAqDpB"}

package/dist/daemon/services/intercept-rollback-guard.js

@@ -0,0 +1,152 @@
+/**
+ * InterceptRollbackGuard — Phase 2c safety-net #3.
+ *
+ * Detect "enforcement misfire" by counting how many `deny` rows the same
+ * session produced within a sliding window (5min by default). When the deny
+ * count crosses `ROLLBACK_DENY_THRESHOLD` AND the window contains at least
+ * `ROLLBACK_DISTINCT_RULES_REQUIRED` distinct `rule_id`s, automatically flip
+ * `pre_tool_intercept.enabled` back to `'false'` so the user is not stuck.
+ *
+ * Why SQL instead of in-memory Map (doc-reviewer P0 Sub-3):
+ *   • daemon restart would wipe an in-memory counter — a flaky session that
+ *     restarted the daemon mid-sequence would bypass the guard.
+ *   • `tool_intercepts` already has every deny row with timestamp & session_id
+ *     — re-using it is single source of truth.
+ *
+ * The guard is intentionally light:
+ *   • Single SQL read per PreToolUseHandler deny decision.
+ *   • Rollback writes 3 forge_config keys + emits an additionalContext blob.
+ *   • Once rollback fires it does NOT re-arm until the user manually
+ *     `cf config set pre_tool_intercept.enabled true` — the new ON event
+ *     starts a fresh window because the SQL count only looks at the last
+ *     window length.
+ *
+ * 2026-05-27 (Spec 4) tuning:
+ *   • Window widened 60s → 5min and threshold lifted 3 → 10. The old
+ *     "3 denies in 60s" tripped on normal BMAD multi-file edit bursts that
+ *     legitimately re-hit the same rule.
+ *   • Added `ROLLBACK_DISTINCT_RULES_REQUIRED=2` — a single rule slamming the
+ *     counter is "rules working as designed", not misfire; we now require
+ *     ≥2 distinct rule_ids in the window before rolling back. Multi-rule
+ *     storms remain a credible "registry-level misfire" signal.
+ */
+import { logger } from '../../core/utils/logger.js';
+/** Sliding window length used by the guard (ms). 5min default (was 60s). */
+export const ROLLBACK_WINDOW_MS = 5 * 60 * 1000;
+/** Number of denies inside the window that triggers rollback. 10 default (was 3). */
+export const ROLLBACK_DENY_THRESHOLD = 10;
+/**
+ * Minimum number of distinct rule_ids whose deny rows must appear in the
+ * window before rollback can trigger. Single-rule storms (e.g. user
+ * legitimately editing many files and tripping `edit-multi-file-hard`
+ * repeatedly) are NOT misfire and should not roll back enforcement.
+ * Multi-rule storms (≥2 distinct rules denying in 5min) is the real "rule
+ * registry misfire" signal we want to catch.
+ */
+export const ROLLBACK_DISTINCT_RULES_REQUIRED = 2;
+/** ConfigStore keys written by the guard on rollback. */
+export const ROLLBACK_FLAG_KEY = 'pre_tool_intercept.enabled';
+export const ROLLBACK_AUTO_DISABLED_AT_KEY = 'pre_tool_intercept.auto_disabled_at';
+export const ROLLBACK_AUTO_DISABLED_SESSION_KEY = 'pre_tool_intercept.auto_disabled_session';
+/**
+ * Service object. Stateless aside from its dependencies — safe to instantiate
+ * once in daemon/index.ts and share across all PreToolUse events.
+ */
+export class InterceptRollbackGuard {
+    storage;
+    configStore;
+    windowMs;
+    threshold;
+    distinctRulesRequired;
+    constructor(storage, configStore, windowMs = ROLLBACK_WINDOW_MS, threshold = ROLLBACK_DENY_THRESHOLD, 
+    /**
+     * Minimum distinct rule_ids the window must contain before rollback
+     * fires. Override only in tests; production keeps the constant default.
+     */
+    distinctRulesRequired = ROLLBACK_DISTINCT_RULES_REQUIRED) {
+        this.storage = storage;
+        this.configStore = configStore;
+        this.windowMs = windowMs;
+        this.threshold = threshold;
+        this.distinctRulesRequired = distinctRulesRequired;
+    }
+    /**
+     * Called by PreToolUseHandler right after it persists a deny row. Returns
+     * `RollbackOutcome.triggered === true` exactly on the call that first
+     * crosses the threshold; subsequent denies in the same window will still
+     * return triggered=false because we early-exit when the flag is already
+     * disabled.
+     *
+     * The caller is responsible for surfacing `additionalContext` back to
+     * Claude Code. The current event is NOT blocked — letting one extra deny
+     * through is preferable to maintaining write-then-rollback transactionality
+     * here.
+     *
+     * Failures are swallowed (logged at warn): the enforcement pipeline must
+     * never throw because a rollback guard misfired.
+     */
+    checkAndMaybeRollback(args) {
+        const empty = { triggered: false, denyCount: 0, ruleIds: [], additionalContext: null };
+        try {
+            // If the flag is already OFF, nothing to do — caller already saw
+            // dry_run behavior on this deny (the deny was persisted but allow=true).
+            // The handler still calls us because it's cheaper than reading the flag
+            // twice; we short-circuit here instead.
+            if (!this.configStore.isEnabled(ROLLBACK_FLAG_KEY))
+                return empty;
+            const sinceIso = new Date(Date.parse(args.nowIso) - this.windowMs).toISOString();
+            const rows = this.storage.queryToolIntercepts({
+                session_id: args.sessionId,
+                decision: 'deny',
+                since: sinceIso,
+                limit: Math.max(this.threshold * 2, 10),
+            });
+            const denyCount = rows.length;
+            // Order-insensitive distinct rule list (Set preserves insertion order in JS).
+            const ruleIds = Array.from(new Set(rows.map((r) => r.rule_id)));
+            if (denyCount < this.threshold) {
+                return { triggered: false, denyCount, ruleIds, additionalContext: null };
+            }
+            // B3 (Spec 4) — single-rule storms are not misfire. Require at least
+            // `distinctRulesRequired` rule_ids in the window before flipping.
+            if (ruleIds.length < this.distinctRulesRequired) {
+                return { triggered: false, denyCount, ruleIds, additionalContext: null };
+            }
+            // Threshold reached AND multi-rule storm — flip flag OFF and write audit keys.
+            try {
+                this.configStore.set(ROLLBACK_FLAG_KEY, 'false');
+                this.configStore.set(ROLLBACK_AUTO_DISABLED_AT_KEY, args.nowIso);
+                this.configStore.set(ROLLBACK_AUTO_DISABLED_SESSION_KEY, args.sessionId);
+            }
+            catch (err) {
+                logger.warn(`[InterceptRollbackGuard] config write failed: ${err}`);
+                return { triggered: false, denyCount, ruleIds, additionalContext: null };
+            }
+            const windowMinutes = Math.round(this.windowMs / 60_000);
+            const ctx = buildRollbackMessage(denyCount, ruleIds, windowMinutes);
+            logger.warn(`[InterceptRollbackGuard] AUTO-DISABLED enforcement for session ${args.sessionId} ` +
+                `(${denyCount} denies in ${windowMinutes}min from ${ruleIds.length} distinct rules; ` +
+                `rules=${ruleIds.join(',')})`);
+            return { triggered: true, denyCount, ruleIds, additionalContext: ctx };
+        }
+        catch (err) {
+            logger.warn(`[InterceptRollbackGuard] check failed: ${err}`);
+            return empty;
+        }
+    }
+}
+/**
+ * Pretty-printed user-facing context appended on rollback. Kept in module
+ * scope so tests can match against the exact phrasing.
+ */
+function buildRollbackMessage(denyCount, ruleIds, windowMinutes) {
+    const ruleList = ruleIds.length > 0 ? ruleIds.join(', ') : '(unknown)';
+    return [
+        '⚠️ [forge enforcement auto-disabled]',
+        `${windowMinutes}min 内此 session 触发 ${denyCount} 次 deny，涉及 ${ruleIds.length} 条规则` +
+            `（rules: ${ruleList}）→ 已自动关闭强制档。`,
+        '重新启用：cf config set pre_tool_intercept.enabled true',
+        '反馈误杀：cf logs --tail | grep tool_intercepts',
+    ].join('\n');
+}
+//# sourceMappingURL=intercept-rollback-guard.js.map

package/dist/daemon/services/intercept-rollback-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-rollback-guard.js","sourceRoot":"","sources":["../../../src/daemon/services/intercept-rollback-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAC9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AACnF,MAAM,CAAC,MAAM,kCAAkC,GAAG,0CAA0C,CAAC;AAgB7F;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAEvB;IACA;IACA;IACA;IAKA;IATV,YACU,OAAsB,EACtB,WAAwB,EACxB,WAAmB,kBAAkB,EACrC,YAAoB,uBAAuB;IACnD;;;OAGG;IACK,wBAAgC,gCAAgC;QARhE,YAAO,GAAP,OAAO,CAAe;QACtB,gBAAW,GAAX,WAAW,CAAa;QACxB,aAAQ,GAAR,QAAQ,CAA6B;QACrC,cAAS,GAAT,SAAS,CAAkC;QAK3C,0BAAqB,GAArB,qBAAqB,CAA2C;IACvE,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,IAGrB;QACC,MAAM,KAAK,GAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACxG,IAAI,CAAC;YACH,iEAAiE;YACjE,yEAAyE;YACzE,wEAAwE;YACxE,wCAAwC;YACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEjE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YACjF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAC5C,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;YAC9B,8EAA8E;YAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEhE,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC3E,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAChD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC3E,CAAC;YAED,+EAA+E;YAC/E,IAAI,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;gBACpE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YACpE,MAAM,CAAC,IAAI,CACT,kEAAkE,IAAI,CAAC,SAAS,GAAG;gBACnF,IAAI,SAAS,cAAc,aAAa,YAAY,OAAO,CAAC,MAAM,mBAAmB;gBACrF,SAAS,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC9B,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAAiB,EAAE,aAAqB;IACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACvE,OAAO;QACL,sCAAsC;QACtC,GAAG,aAAa,qBAAqB,SAAS,cAAc,OAAO,CAAC,MAAM,MAAM;YAC9E,WAAW,QAAQ,cAAc;QACnC,oDAAoD;QACpD,4CAA4C;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/daemon/services/intercept-timeout-sweeper.d.ts

@@ -0,0 +1,58 @@
+/**
+ * InterceptTimeoutSweeper — Karpathy #4 C4 hotfix (2026-05-26).
+ *
+ * Why this exists:
+ *   PostToolUseHandler.maybeMarkInterceptOutcome only fires when ANOTHER tool
+ *   call lands within 30s of an intercept; it classifies the prior deny /
+ *   dry_run row as `obeyed` (different tool) or `override` (same tool re-run).
+ *   When the main thread instead STOPS — stops to ask the user, switches
+ *   plans, or just sits idle — no PostToolUse ever fires, and the
+ *   `tool_intercepts.outcome` column stays NULL forever. Live triage on a 7d
+ *   window found 1088 such NULL rows (1083 dry_run + 5 deny), draining the
+ *   C4 numerator to 0.01.
+ *
+ * Semantic interpretation:
+ *   "Main thread saw the hint and chose not to run any further tool inside
+ *   the classification window" === passive obey. We backfill those rows as
+ *   `outcome='obeyed'` after a generous 1h grace beyond the 30s window so
+ *   the active classifier always wins on close-to-the-edge races.
+ *
+ * Eligibility:
+ *   • decision IN ('deny', 'dry_run')   — `warn` is not a real enforcement
+ *                                          signal; `bypass` was already a
+ *                                          user opt-out (treated as override
+ *                                          intent — but we don't touch it).
+ *   • outcome IS NULL                   — the classifier never ran.
+ *   • timestamp <= now - graceMs        — fully out of any active window.
+ *
+ * The sweep is idempotent (only NULL rows match), cheap (single UPDATE …
+ * WHERE … with an index hint on idx_tool_intercepts_ts), and safe to call
+ * from any maintenance interval.
+ */
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+/**
+ * Grace window past the 30s PostToolUse classification before a NULL row is
+ * considered abandoned. 1h is generous on purpose — a row sitting NULL for
+ * an hour means the main thread either crashed, switched session, or stopped
+ * to think and never came back to the same intercept.
+ */
+export declare const INTERCEPT_TIMEOUT_GRACE_MS: number;
+export interface InterceptTimeoutSweepOptions {
+    /** Override the grace window; mainly used by tests. */
+    graceMs?: number;
+}
+export interface InterceptTimeoutSweepResult {
+    /** Rows that matched the eligibility predicate before update. */
+    scanned: number;
+    /** Rows actually flipped to `outcome='obeyed'`. Equals `scanned` on success. */
+    swept: number;
+}
+/**
+ * Run one sweep. Safe to call from any setInterval / startup hook.
+ *
+ * Returns counters so callers can decide whether to emit a log line — the
+ * daemon's maintenance loop only logs when something actually moved, to keep
+ * steady-state output quiet.
+ */
+export declare function sweepInterceptTimeouts(storage: SQLiteStorage, options?: InterceptTimeoutSweepOptions): InterceptTimeoutSweepResult;
+//# sourceMappingURL=intercept-timeout-sweeper.d.ts.map

package/dist/daemon/services/intercept-timeout-sweeper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-timeout-sweeper.d.ts","sourceRoot":"","sources":["../../../src/daemon/services/intercept-timeout-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAGlE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD,MAAM,WAAW,4BAA4B;IAC3C,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,4BAAiC,GACzC,2BAA2B,CA0C7B"}

package/dist/daemon/services/intercept-timeout-sweeper.js

@@ -0,0 +1,83 @@
+/**
+ * InterceptTimeoutSweeper — Karpathy #4 C4 hotfix (2026-05-26).
+ *
+ * Why this exists:
+ *   PostToolUseHandler.maybeMarkInterceptOutcome only fires when ANOTHER tool
+ *   call lands within 30s of an intercept; it classifies the prior deny /
+ *   dry_run row as `obeyed` (different tool) or `override` (same tool re-run).
+ *   When the main thread instead STOPS — stops to ask the user, switches
+ *   plans, or just sits idle — no PostToolUse ever fires, and the
+ *   `tool_intercepts.outcome` column stays NULL forever. Live triage on a 7d
+ *   window found 1088 such NULL rows (1083 dry_run + 5 deny), draining the
+ *   C4 numerator to 0.01.
+ *
+ * Semantic interpretation:
+ *   "Main thread saw the hint and chose not to run any further tool inside
+ *   the classification window" === passive obey. We backfill those rows as
+ *   `outcome='obeyed'` after a generous 1h grace beyond the 30s window so
+ *   the active classifier always wins on close-to-the-edge races.
+ *
+ * Eligibility:
+ *   • decision IN ('deny', 'dry_run')   — `warn` is not a real enforcement
+ *                                          signal; `bypass` was already a
+ *                                          user opt-out (treated as override
+ *                                          intent — but we don't touch it).
+ *   • outcome IS NULL                   — the classifier never ran.
+ *   • timestamp <= now - graceMs        — fully out of any active window.
+ *
+ * The sweep is idempotent (only NULL rows match), cheap (single UPDATE …
+ * WHERE … with an index hint on idx_tool_intercepts_ts), and safe to call
+ * from any maintenance interval.
+ */
+import { logger } from '../../core/utils/logger.js';
+/**
+ * Grace window past the 30s PostToolUse classification before a NULL row is
+ * considered abandoned. 1h is generous on purpose — a row sitting NULL for
+ * an hour means the main thread either crashed, switched session, or stopped
+ * to think and never came back to the same intercept.
+ */
+export const INTERCEPT_TIMEOUT_GRACE_MS = 60 * 60 * 1000;
+/**
+ * Run one sweep. Safe to call from any setInterval / startup hook.
+ *
+ * Returns counters so callers can decide whether to emit a log line — the
+ * daemon's maintenance loop only logs when something actually moved, to keep
+ * steady-state output quiet.
+ */
+export function sweepInterceptTimeouts(storage, options = {}) {
+    const graceMs = options.graceMs ?? INTERCEPT_TIMEOUT_GRACE_MS;
+    const cutoffIso = new Date(Date.now() - graceMs).toISOString();
+    try {
+        // Single transaction: count + update atomically so the scanned figure
+        // matches what we actually flipped.
+        const db = storage.getDatabase();
+        const scanned = db
+            .prepare(`SELECT COUNT(*) AS n FROM tool_intercepts
+         WHERE outcome IS NULL
+           AND decision IN ('deny','dry_run')
+           AND timestamp <= ?`)
+            .get(cutoffIso)?.n ?? 0;
+        if (scanned === 0) {
+            return { scanned: 0, swept: 0 };
+        }
+        const info = db
+            .prepare(`UPDATE tool_intercepts
+            SET outcome = 'obeyed'
+          WHERE outcome IS NULL
+            AND decision IN ('deny','dry_run')
+            AND timestamp <= ?`)
+            .run(cutoffIso);
+        const swept = Number(info.changes ?? 0);
+        if (swept > 0) {
+            logger.debug(`[InterceptTimeoutSweeper] swept ${swept} NULL-outcome row(s) ` +
+                `older than ${graceMs / 60000}min → obeyed (passive obey by silence)`);
+        }
+        return { scanned, swept };
+    }
+    catch (err) {
+        // Sweeps are observability — never a request blocker.
+        logger.warn(`[InterceptTimeoutSweeper] sweep failed: ${err}`);
+        return { scanned: 0, swept: 0 };
+    }
+}
+//# sourceMappingURL=intercept-timeout-sweeper.js.map

package/dist/daemon/services/intercept-timeout-sweeper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intercept-timeout-sweeper.js","sourceRoot":"","sources":["../../../src/daemon/services/intercept-timeout-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAczD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAsB,EACtB,UAAwC,EAAE;IAE1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,CAAC;QACH,sEAAsE;QACtE,oCAAoC;QACpC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,OAAO,GAAI,EAAE;aAChB,OAAO,CACN;;;8BAGsB,CACvB;aACA,GAAG,CAAC,SAAS,CAA+B,EAAE,CAAC,IAAI,CAAC,CAAC;QAExD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CACN;;;;+BAIuB,CACxB;aACA,GAAG,CAAC,SAAS,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CACV,mCAAmC,KAAK,uBAAuB;gBAC/D,cAAc,OAAO,GAAG,KAAK,wCAAwC,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sDAAsD;QACtD,MAAM,CAAC,IAAI,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/daemon/services/kb-injector.d.ts

@@ -0,0 +1,57 @@
+/**
+ * KbInjector — queries the project knowledge base for a prompt and renders
+ * the additionalContext block.
+ *
+ * Extracted from `UserPromptHandler` (D-3 step 3). Single responsibility:
+ *   1. Probe `.forge-knowledge/` presence (cheap).
+ *   2. Run `queryKnowledge` (augmented with optional intent keywords).
+ *   3. Apply score threshold + return `{ block, hits }`.
+ *
+ * Caching: per-(session_id, prompt[:200]) LRU+TTL to dedupe consecutive
+ * Enter re-fires within 5 minutes. Bounded by 500 entries.
+ *
+ * The cache key includes `session_id` so different sessions never collide,
+ * but `kbQueryCache` is intentionally NOT cleared at Stop time — D-1 in the
+ * refactor spec resolved this: the 5-min TTL + 500-entry LRU bound is
+ * sufficient (worst case ~500KB held briefly), and enumerating session-
+ * prefixed keys would require a second index map.
+ */
+import type { UserPromptSubmitEvent } from '../../core/types.js';
+import type { SQLiteStorage } from '../../core/storage/sqlite.js';
+import type { QueryHit } from '../../knowledge/query.js';
+export declare class KbInjector {
+    private readonly storage;
+    static readonly KB_SCORE_THRESHOLD = 5;
+    /** Cap on KB pages injected per prompt to avoid context bloat. */
+    static readonly KB_MAX_RESULTS = 2;
+    /** Per-page content truncation (chars) — keeps the additionalContext modest. */
+    static readonly KB_CONTENT_TRUNCATE = 800;
+    /** LRU+TTL cache TTL for de-duping Enter re-fires of the same prompt. */
+    static readonly KB_CACHE_TTL_MS: number;
+    /** Cache capacity (entries). */
+    static readonly KB_CACHE_MAX = 500;
+    private kbQueryCache;
+    constructor(storage?: SQLiteStorage | null);
+    /**
+     * Query the KB and (if any qualifying hits) return a formatted block ready
+     * to push onto `additionalContext`. Always fail-silent — KB failures must
+     * not break the prompt path.
+     *
+     * Returns `null` block when there are zero qualifying hits.
+     */
+    inject(event: UserPromptSubmitEvent, prompt: string, extraKeywords?: string[]): Promise<{
+        block: string | null;
+        hits: QueryHit[];
+    }>;
+    /**
+     * Query the project knowledge base, returning only hits at or above the
+     * MVP1 score threshold. Always fail-silent — KB failures must not break
+     * the UserPrompt pipeline (resume / convention / skill remain unaffected).
+     *
+     * Cache key is `${session_id}:${sha1(prompt[:200])}` with a 5-minute TTL.
+     * This dedupes consecutive Enter re-fires of the same prompt without
+     * leaking memory across sessions.
+     */
+    private queryKbForPrompt;
+}
+//# sourceMappingURL=kb-injector.d.ts.map

package/dist/daemon/services/kb-injector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-injector.d.ts","sourceRoot":"","sources":["../../../src/daemon/services/kb-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAIlE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAOzD,qBAAa,UAAU;IAuBT,OAAO,CAAC,QAAQ,CAAC,OAAO;IAdpC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,KAAK;IACvC,kEAAkE;IAClE,MAAM,CAAC,QAAQ,CAAC,cAAc,KAAK;IACnC,gFAAgF;IAChF,MAAM,CAAC,QAAQ,CAAC,mBAAmB,OAAO;IAC1C,yEAAyE;IACzE,MAAM,CAAC,QAAQ,CAAC,eAAe,SAAiB;IAChD,gCAAgC;IAChC,MAAM,CAAC,QAAQ,CAAC,YAAY,OAAO;IAEnC,OAAO,CAAC,YAAY,CAElB;gBAE2B,OAAO,GAAE,aAAa,GAAG,IAAW;IAEjE;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAM,EAAO,GAC3B,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,QAAQ,EAAE,CAAA;KAAE,CAAC;IAYtD;;;;;;;;OAQG;YACW,gBAAgB;CA2C/B"}