@zalom/plastic 1.7.1 → 1.9.0

package/scripts/end-intent

@@ -63,6 +63,10 @@
 #      (git status itself failed: corrupt index, git missing, not a repo);
 #      refused before removal; pass --discard-worktree-changes to override
 #      deliberately.
+#   6  the doctor per-intent structure gate refused (checklist incomplete,
+#      links out of projection, intent-file malformed, or a lifecycle artifact
+#      missing/placeholder); named reasons on stderr; authors nothing
+#      (intent 222).
 
 require "fileutils"
 require "date"
@@ -71,6 +75,7 @@ require "pathname"
 require_relative "lib/bridge"
 require_relative "lib/lock"
 require_relative "lib/intent_validator"
+require_relative "lib/outcome_guard"
 
 DISPOSITIONS = %w[delivered abandoned].freeze
 
@@ -143,33 +148,69 @@ def resolve_intent_dir(store, id)
   matches.first
 end
 
-# --- outcome.md guard (D2 step 1a) ------------------------------------------
+# --- structure gate helper (intent 222) -------------------------------------
 #
-# Returns nil when the guard PASSES, or a reason String to refuse with exit 2.
-# Read-only: authors nothing regardless of outcome. Refuses a missing file, a
-# still-placeholder file (first line is the sentinel), or a disposition that
-# does not exactly equal the requested one (this is what naturally refuses a
-# freshly scaffolded outcome.md, whose disposition is the literal
-# "delivered|abandoned" string, not one of the two real values).
-def outcome_guard_reason(intent_dir, disposition)
-  path = File.join(intent_dir, "outcome.md")
-  return "outcome.md is missing at #{path}" unless File.exist?(path)
-
-  content = File.read(path)
-  first_line = content.each_line.first.to_s.chomp
-  if first_line == Bridge::PLACEHOLDER_SENTINEL
-    return "outcome.md is still the scaffold placeholder (first line is the sentinel)"
+# Derive the TRUE plastic_home and this intent's store scope key from the --store
+# directory end-intent was given, so the per-intent doctor gate (below) sees the SAME
+# multi-store universe doctor.rb itself would (needed for its links-projection sub-check,
+# which resolves cross-store refs). --store is either the global store
+# (<plastic_home>/store) or a project store (<plastic_home>/projects/<slug>/store); the two
+# shapes are told apart by whether store's grandparent directory is literally named
+# "projects" (the StoreDiscovery convention, scripts/lib/store_discovery.rb), never by
+# hardcoding ".plastic" as a name.
+def resolve_plastic_home_and_scope(store)
+  parent = File.dirname(store)
+  grandparent = File.dirname(parent)
+  if File.basename(grandparent) == "projects"
+    slug = File.basename(parent)
+    [File.dirname(grandparent), "project:#{slug}"]
+  else
+    [parent, "global"]
   end
+end
 
-  fm = IntentValidator.parse_frontmatter_text(content)
-  actual = fm.is_a?(Hash) ? fm["disposition"] : nil
-  unless DISPOSITIONS.include?(actual) && actual == disposition
-    return "outcome.md frontmatter disposition is #{actual.inspect}, expected #{disposition.inspect}"
+# Doctor's per-intent structure gate (intent 222), a pre-write step: FAIL refuses the close
+# (exit 6, authors nothing), WARN prints an advisory note and proceeds, PASS proceeds
+# silently, and an unexpected exception from the gate call itself is rescued and treated as
+# a skipped gate (fail-open on a crash: a broken gate must never wedge a close).
+#
+# `gate:` is an injected seam (mirrors run_disarm's own bridge_reader:/disarm: pattern
+# below) defaulting to the real Doctor.new(...).run_intent_check(...) call; tests load this
+# script in-process (as test/end_intent_disarm_toctou_test.rb already does for run_disarm)
+# and inject a raising stub to prove the fail-open contract, with no eval/ENV/global seam.
+#
+# Disposition is deliberately NOT passed to the real gate call (intent 222 executor
+# decision): the existing outcome-only guard immediately following this call already owns
+# disposition-matching (exit 2), and intent_lifecycle_artifacts unconditionally checks
+# outcome.md PRESENCE via Bridge.stage_file_present? regardless of disposition, so passing
+# it here would make this gate re-check the SAME disposition match the old guard already
+# owns, needlessly widening which exit-2 fixtures become exit-6. doctor.rb --intent called
+# directly (with --disposition) still exercises the fold-in per D2/acceptance criteria.
+def run_structure_gate(id, store:, gate: ->(gate_home, gate_scope) {
+  require_relative "doctor"
+  Doctor.new(plastic_home: gate_home).run_intent_check(id, store: gate_scope)
+})
+  gate_home, gate_scope = resolve_plastic_home_and_scope(store)
+  gate_verdict = gate.call(gate_home, gate_scope)
+  case gate_verdict[:status]
+  when "fail"
+    gate_verdict[:checks].select { |c| c[:status] == "fail" }.each do |c|
+      detail = Array(c[:details]).any? ? " (#{Array(c[:details]).join("; ")})" : ""
+      warn "end-intent: structure gate refused: #{c[:name]}: #{c[:message]}#{detail}"
+    end
+    exit 6
+  when "warn"
+    gate_verdict[:checks].select { |c| c[:status] == "warn" }.each do |c|
+      detail = Array(c[:details]).any? ? " (#{Array(c[:details]).join("; ")})" : ""
+      warn "end-intent: structure gate warning (proceeding): #{c[:name]}: #{c[:message]}#{detail}"
+    end
   end
-
-  nil
+rescue StandardError => e
+  warn "end-intent: structure gate crashed (#{e.message}); proceeding without it"
 end
 
+# outcome.md guard: see OutcomeGuard.reason (scripts/lib/outcome_guard.rb, extracted intent 222)
+
 # --- intent-file `## Outcome` summary stamp (D2 step 1b) --------------------
 #
 # Replace the body of the intent file's `## Outcome` section with `summary`,
@@ -580,7 +621,9 @@ def main(argv)
     exit 4
   end
 
-  reason = outcome_guard_reason(intent_dir, disposition)
+  run_structure_gate(id, store: store)
+
+  reason = OutcomeGuard.reason(intent_dir, disposition)
   if reason
     warn "end-intent: #{reason}"
     exit 2

package/scripts/hook-code-gate

@@ -2,7 +2,7 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
-# Usage: hook-code-gate <file_path>
+# Usage: hook-code-gate <file_path> [session_id] [content]
 # PreToolUse gate. Composes two independent block rules; EITHER blocks the edit:
 #   - Stage rule (intent 27): when auto mode is armed and the active intent has not
 #     reached How (plan.md + checklist.md), block edits to project code outside the store.
@@ -12,39 +12,24 @@
 #
 # Exit 0 = allow. Exit 2 = block (reason on stderr, shown to the agent).
 # No bridge = allow. Each rule fails open on its own conditions (see bridge.rb).
+#
+# Thin CLI wrapper (intent 244): the gate logic itself lives in
+# scripts/lib/edit_gates.rb, shared with the merged Claude dispatcher
+# (scripts/hook-edit-gates) so the two harnesses cannot drift.
 
-require_relative "lib/bridge"
+require_relative "lib/edit_gates"
 
 file_path = ARGV[0]
 exit 0 unless file_path && !file_path.empty?
 
 session = (ARGV[1] unless ARGV[1].to_s.empty?) || ENV["CLAUDE_CODE_SESSION_ID"]
 
-# Auditable escape (intent 150, mirrors the Bash gate's intent 108 D7): a trailing
-# `# plastic-ok` in the new Write/Edit content allows the edit and logs it, so a
-# deliberately sanctioned code edit no longer needs the Bash-funneling workaround.
-new_content = ARGV[2]
-if new_content && Bridge::PLASTIC_OK_RE.match?(new_content.chomp)
-  begin
-    require "fileutils"
-    log = File.join(Dir.home, ".plastic", ".cache", "gate-escapes.log")
-    FileUtils.mkdir_p(File.dirname(log))
-    File.open(log, "a") do |io|
-      io.puts("#{Time.now.utc.iso8601}\t#{session}\t#{file_path}")
-    end
-  rescue StandardError
-    # the escape still applies; logging is best-effort
-  end
-  exit 0
-end
-
-# --- Load bridge (shared resolution; stdin session_id -> CLAUDE_CODE_SESSION_ID -> /tmp scan) ---
-bridge_data = Bridge.discover_bridge(session: session, cwd: file_path, edited_path: file_path)
-exit 0 unless bridge_data
-
-reason = Bridge.code_gate_decision(bridge_data, file_path) ||
-         Bridge.worktree_gate_decision(bridge_data, file_path, current_session: session)
-exit 0 unless reason
+ctx = EditGates::Context.new(
+  tool_name: "Write", session: session, gate_path: file_path, file_path: file_path,
+  content: ARGV[2], harness: "claude",
+)
 
-$stderr.puts "PLASTIC GATE — #{reason}"
+outcome = EditGates.code_gate(ctx)
+exit 0 unless outcome
+outcome.lines.each { |line| $stderr.puts line }
 exit 2

package/scripts/hook-create-gate

@@ -26,9 +26,15 @@
 #   Pathless MCP mutation:  validate the CURRENT on-disk file (the PostToolUse
 #                           gate-check backstop validates the result); a
 #                           missing file blocks (fail-safe).
+#
+# Thin CLI wrapper (intent 244): the gate logic itself lives in
+# scripts/lib/edit_gates.rb, shared with the merged Claude dispatcher
+# (scripts/hook-edit-gates) so the two harnesses cannot drift. Deliberately
+# WITHOUT a top-level rescue, matching this script's behavior before the
+# extraction: an internal exception here has never been caught.
 
 require "json"
-require_relative "lib/intent_validator"
+require_relative "lib/edit_gates"
 
 raw = $stdin.read rescue nil
 exit 0 if raw.nil? || raw.strip.empty?
@@ -36,60 +42,7 @@ exit 0 if raw.nil? || raw.strip.empty?
 payload = JSON.parse(raw) rescue nil
 exit 0 unless payload.is_a?(Hash)
 
-path = payload.dig("tool_input", "file_path") || payload.dig("tool_params", "file_path")
-exit 0 if path.nil? || path.to_s.strip.empty?
-
-# Precise path matcher: the target must be an intent file inside its own
-# equally-named dir. Never matches sibling lifecycle files (spec.md, etc.) or
-# unrelated store files.
-abs = File.expand_path(path)
-dir = File.dirname(abs)
-is_intent_file = dir.match?(%r{/store/[^/]+--[^/]+\z}) &&
-                 File.basename(abs) == "#{File.basename(dir)}.md"
-exit 0 unless is_intent_file
-
-input = payload["tool_input"] || payload["tool_params"] || {}
-content = input["content"]
-old_string = input["old_string"]
-
-def block!(lines)
-  Array(lines).each { |l| $stderr.puts l }
-  exit 2
-end
-
-result =
-  if !content.nil?
-    # Write: validate the proposed content (intent 60b, unchanged).
-    IntentValidator.validate_content(content)
-  elsif !old_string.nil?
-    # Edit (intent 108, D7): simulate the replacement on the on-disk file and
-    # validate the RESULT, so an Edit can no longer sneak an intent file past
-    # the validator.
-    unless File.exist?(abs)
-      block!("PLASTIC CREATE GATE — #{File.basename(abs)} does not exist; " \
-             "create intents via new-intent / plastic-intent-creating.")
-    end
-    current = File.read(abs)
-    unless current.include?(old_string)
-      exit 0 # the Edit tool itself will fail; nothing lands, nothing to judge
-    end
-    simulated = input["replace_all"] ? current.gsub(old_string, input["new_string"].to_s)
-                                     : current.sub(old_string, input["new_string"].to_s)
-    IntentValidator.validate_content(simulated)
-  else
-    # Pathless mutation (MCP symbolic edits): the proposal is not visible at
-    # PreToolUse. Judge the CURRENT file: valid -> allow (the PostToolUse
-    # gate-check backstop validates the result), invalid/missing -> block.
-    unless File.exist?(abs)
-      block!("PLASTIC CREATE GATE — #{File.basename(abs)}: cannot read proposed " \
-             "content and no file exists; refusing to allow an unvalidated intent write.")
-    end
-    IntentValidator.validate_content(File.read(abs))
-  end
-
-exit 0 if result[:ok]
-
-$stderr.puts "PLASTIC CREATE GATE — #{File.basename(abs)} is not a valid intent:"
-result[:errors].each { |e| $stderr.puts "  #{e}" }
-$stderr.puts "Create intents via new-intent / plastic-intent-creating; do not hand-author them."
+outcome = EditGates.create_gate(EditGates.context_from(payload))
+exit 0 unless outcome
+outcome.lines.each { |line| $stderr.puts line }
 exit 2

package/scripts/hook-edit-gates

@@ -0,0 +1,58 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# The merged Claude PreToolUse edit-path dispatcher (intent 244). One registered
+# hook, one Ruby process, one stdin parse, five gates in-process, in the fixed
+# order savepoint-pre, lock-gate, code-gate, links-gate, create-gate (spec D-a).
+# The first deny ends evaluation and its own shape is reproduced exactly: stderr
+# plus exit 2 for code-gate/links-gate/create-gate, stdout permissionDecision
+# JSON plus exit 0 for lock-gate (spec D-b). savepoint-pre runs first so its
+# `started` ledger append stays unconditional, including on a call another gate
+# then blocks (spec D-c).
+#
+# Fail-open everywhere (spec D-i): each gate runs inside its own rescue in
+# EditGates.dispatch, and this file's top level rescues to exit 0, so a gate bug
+# never denies and never silences a sibling gate.
+#
+# LOAD-BEARING SHAPE: doctor's claude_hooks_implemented_check reads THIS FILE as
+# plain text and extracts the `when "<gate>"` labels of the `case gate` statement
+# below, because a script with top-level side effects can never be required to
+# introspect it (the same technique intent 200 used for scripts/codex-hook). If
+# the case statement is reshaped, update that check in scripts/doctor.rb in the
+# same change, or it will fail loudly by design.
+
+require "json"
+require_relative "lib/edit_gates"
+
+def route(gate, ctx)
+  case gate
+  when "savepoint-pre" then EditGates.savepoint_pre(ctx)
+  when "lock-gate"     then EditGates.lock_gate(ctx)
+  when "code-gate"     then EditGates.code_gate(ctx)
+  when "links-gate"    then EditGates.links_gate(ctx)
+  when "create-gate"   then EditGates.create_gate(ctx)
+  end
+end
+
+begin
+  raw = begin
+    $stdin.read
+  rescue StandardError
+    nil
+  end
+  exit 0 if raw.nil? || raw.strip.empty?
+
+  payload = begin
+    JSON.parse(raw)
+  rescue StandardError
+    nil
+  end
+  exit 0 unless payload.is_a?(Hash)
+
+  exit EditGates.dispatch(ctx: EditGates.context_from(payload), route: method(:route))
+rescue StandardError => e
+  # Dispatcher-internal failure: never impersonate a deny (spec D-i).
+  $stderr.puts "plastic edit-gates error: #{e.message}"
+  exit 0
+end

package/scripts/hook-links-gate

@@ -13,9 +13,13 @@
 #   { "tool_input": { "file_path":, "content": | "old_string"/"new_string"/"replace_all": } }
 # Exit 0 = allow (including every "cannot judge" case). Exit 2 = deny (message
 # on stderr).
+#
+# Thin CLI wrapper (intent 244): the gate logic itself lives in
+# scripts/lib/edit_gates.rb, shared with the merged Claude dispatcher
+# (scripts/hook-edit-gates) so the two harnesses cannot drift.
 
 require "json"
-require_relative "lib/links_gate"
+require_relative "lib/edit_gates"
 
 begin
   raw = begin
@@ -32,36 +36,9 @@ begin
   end
   exit 0 unless payload.is_a?(Hash)
 
-  path = payload.dig("tool_input", "file_path") || payload.dig("tool_params", "file_path")
-  exit 0 if path.to_s.strip.empty?
-
-  abs = File.expand_path(path)
-  exit 0 unless LinksGate.intent_file?(abs)
-
-  input = payload["tool_input"] || payload["tool_params"] || {}
-  content = input["content"]
-  old_string = input["old_string"]
-
-  before_content = File.exist?(abs) ? File.read(abs) : ""
-
-  after_content =
-    if !content.nil?
-      content
-    elsif !old_string.nil?
-      exit 0 unless before_content.include?(old_string) # the Edit tool itself will fail; nothing to judge
-      input["replace_all"] ? before_content.gsub(old_string, input["new_string"].to_s)
-                            : before_content.sub(old_string, input["new_string"].to_s)
-    else
-      exit 0 # pathless mutation (no visible proposal); cannot judge, allow
-    end
-
-  plastic_home = ENV.fetch("PLASTIC_HOME") { File.join(Dir.home, ".plastic") }
-
-  reason = LinksGate.decision(file_path: abs, before_content: before_content,
-                               after_content: after_content, plastic_home: plastic_home)
-  exit 0 unless reason
-
-  $stderr.puts reason
+  outcome = EditGates.links_gate(EditGates.context_from(payload))
+  exit 0 unless outcome
+  outcome.lines.each { |line| $stderr.puts line }
   exit 2
 rescue => e
   # Hook-internal failure only: do NOT impersonate a user-deny. Log and fail open

package/scripts/hook-lock-gate

@@ -8,9 +8,12 @@
 # gated here (D2). Emits the PreToolUse JSON deny contract at exit 0; reserves
 # non-zero exit for hook-internal errors only. Matcher Write|Edit|NotebookEdit, so
 # reads never reach here.
-require "json"
-require_relative "lib/bridge"
-require_relative "lib/lock"
+#
+# Thin CLI wrapper (intent 244): the gate logic itself lives in
+# scripts/lib/edit_gates.rb, shared with the merged Claude dispatcher
+# (scripts/hook-edit-gates) so the two harnesses cannot drift.
+
+require_relative "lib/edit_gates"
 
 begin
   file_path = ARGV[0]
@@ -22,62 +25,14 @@ begin
   # "codex" here (intent 201 D2).
   harness = (ARGV[2] unless ARGV[2].to_s.empty?) || "claude"
 
-  bridge_data = Bridge.discover_bridge(session: session, cwd: Dir.pwd)   # nil = no bridge cache
-  reason = Bridge.lock_gate_decision(bridge_data, file_path, session: session, harness: harness)
-  unless reason
-    # Allow path: refresh the lease for the session that holds this target's
-    # lock (owner or delegate). Best-effort, never blocks.
-    begin
-      dir = Bridge.intent_dir_for(file_path)
-      Lock.heartbeat(dir, session: session) if dir && !session.to_s.empty?
-    rescue StandardError
-      # ignore
-    end
-
-    # Second, independent gate (intent 111 D7): the artifact-grain claim.
-    # Composes UNDER the delivery lock above; only reached once the delivery
-    # lock already allows. Dormant (nil) unless a claim file exists for this
-    # artifact, so AC7 (existing single-owner flows) is unaffected.
-    begin
-      dir = Bridge.intent_dir_for(file_path)
-      artifact = File.basename(file_path) if dir
-      if dir && artifact
-        claim_reason = Claim.claim_gate_reason(dir, artifact, session: session, harness: harness)
-        if claim_reason
-          print JSON.generate(
-            "hookSpecificOutput" => {
-              "hookEventName" => "PreToolUse",
-              "permissionDecision" => "deny",
-              "permissionDecisionReason" => claim_reason,
-            }
-          )
-          exit 0
-        end
-
-        # Fail-open surface (AC3): allow, but make the yielded/stale claim visible.
-        if Claim.fail_open?(dir, artifact)
-          $stderr.puts "plastic claim gate: unresolvable claim on #{artifact} in " \
-                       "intent #{Bridge.intent_id_from_dir(dir)} yielded; write " \
-                       "proceeds (see /plastic-lock status)"
-        end
-
-        # Heartbeat the session's own claim on the allow path (best-effort).
-        Claim.heartbeat(dir, artifact, session: session) rescue nil
-      end
-    rescue StandardError
-      # ignore: a claim-gate bug must never block a write (fail open)
-    end
-
-    exit 0
-  end
-
-  print JSON.generate(
-    "hookSpecificOutput" => {
-      "hookEventName" => "PreToolUse",
-      "permissionDecision" => "deny",
-      "permissionDecisionReason" => reason   # "run /plastic-intent-starting to lock and begin"
-    }
+  ctx = EditGates::Context.new(
+    tool_name: "Write", session: session, gate_path: file_path, file_path: file_path,
+    harness: harness,
   )
+
+  outcome = EditGates.lock_gate(ctx)
+  exit 0 unless outcome
+  print outcome.stdout
   exit 0
 rescue => e
   # Hook-internal failure only: do NOT impersonate a user-deny. Log and fail open

package/scripts/hook-power-tools

@@ -0,0 +1,38 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# power-tools UserPromptSubmit hook (intents 66, 66b, 187, 246). Emits the
+# PowerTools mandate, one recommendation line per present tool, as
+# hookSpecificOutput. Silent no-op (exit 0) when no power tool is present or
+# anything goes wrong. It parses no prompt: the mandate depends on tool presence
+# alone, so there is nothing to gate on prompt triviality. Intent 246 removed the
+# qmd hit search this hook used to run first.
+require "json"
+require "timeout"
+require_relative "lib/qmd_hook"
+
+# Drain stdin so the caller's write never blocks or breaks on a closed pipe. The
+# payload is deliberately not parsed.
+begin
+  STDIN.read
+rescue StandardError
+  nil
+end
+
+context = begin
+  Timeout.timeout(2) do
+    QmdHook.run(cwd: Dir.pwd)
+  end
+rescue Exception
+  nil
+end
+
+exit 0 if context.nil? || context.strip.empty?
+
+puts JSON.generate(
+  "hookSpecificOutput" => {
+    "hookEventName" => "UserPromptSubmit",
+    "additionalContext" => context,
+  }
+)

package/scripts/hook-savepoint-pre

@@ -13,20 +13,17 @@
 # write: any non-match or failure exits 0. The append is idempotent and only
 # fires while the stage is genuinely starting (the artifact is not yet a real,
 # non-placeholder file), so re-edits add nothing.
+#
+# Thin CLI wrapper (intent 244): the gate logic itself lives in
+# scripts/lib/edit_gates.rb, shared with the merged Claude dispatcher
+# (scripts/hook-edit-gates) so the two harnesses cannot drift.
 
-require_relative "lib/bridge"
+require_relative "lib/edit_gates"
 
 file_path = ARGV[0]
 exit 0 if file_path.nil? || file_path.empty?
 
-file_path_abs = File.expand_path(file_path)
-intent_dir = Bridge.intent_dir_for(file_path_abs)
-exit 0 unless intent_dir
-
-begin
-  Bridge.append_started_savepoint(intent_dir, file_path_abs)
-rescue StandardError
-  # best-effort; the ledger is rebuildable and the post line still lands
-end
-
+EditGates.savepoint_pre(
+  EditGates::Context.new(tool_name: "Write", file_path: file_path, harness: "claude")
+)
 exit 0

package/scripts/lib/bridge.rb

@@ -1598,8 +1598,8 @@ module Bridge
   end
 
   # A TRAILING `# plastic-ok` shell comment: the auditable escape for
-  # sanctioned bash/interpreter writes (mirrors the retrieval gate's
-  # `# qmd-ok`). The hook logs every use to ~/.plastic/.cache/gate-escapes.log.
+  # sanctioned bash/interpreter writes. The hook logs every use to
+  # ~/.plastic/.cache/gate-escapes.log.
   PLASTIC_OK_RE = /(?:\A|\s)#\s*plastic-ok\s*\z/.freeze
 
   def self.bash_escape?(command)