@zalom/plastic 1.7.1 → 1.9.0

package/scripts/lib/edit_gates.rb

@@ -0,0 +1,342 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# EditGates (intent 244): the five Claude PreToolUse edit-path gates as plain
+# functions over one parsed payload. Two callers share these functions so the
+# harnesses cannot drift: scripts/hook-edit-gates (the merged Claude dispatcher)
+# and the retained scripts/hook-code-gate / hook-lock-gate / hook-savepoint-pre
+# CLI wrappers that scripts/codex-hook still popens per file op.
+#
+# A gate returns nil to allow, or a Deny. Two deny shapes coexist deliberately
+# (spec D-b): :stderr (stderr lines plus exit 2, code-gate / links-gate /
+# create-gate) and :json (stdout JSON plus exit 0, lock-gate, which reserves a
+# non-zero exit for hook-internal errors). Nothing here normalizes them.
+
+require "json"
+require "time"
+require_relative "hook_registry"
+require_relative "bridge"
+require_relative "lock"
+require_relative "links_gate"
+require_relative "intent_validator"
+
+module EditGates
+  module_function
+
+  ALLOW = nil
+
+  Deny = Struct.new(:shape, :lines, :stdout, keyword_init: true)
+
+  # Everything the five gates read out of one PreToolUse payload (spec D-g).
+  #   gate_path  - code-gate and lock-gate: file_path || notebook_path ||
+  #                relative_path, absolutized against tool_input.project_root ||
+  #                payload.cwd when relative. Exactly what the old Bash shims
+  #                computed with their `ruby -rjson -e` one-liners.
+  #   file_path  - savepoint-pre, links-gate, create-gate: tool_input.file_path
+  #                only, raw. Preserving this narrower extraction is what keeps
+  #                create-gate's dormant Serena gap byte-for-byte intact.
+  #   content    - the RAW tool_input.content (nil when the key is absent, ""
+  #                when it is explicitly empty). Kept unmixed with new_string so
+  #                links-gate and create-gate's `!content.nil?` branch keeps its
+  #                exact original meaning; code-gate computes its own combined
+  #                content-or-new_string-or-"" value locally, mirroring what its
+  #                old Bash shim computed independently for ARGV[2].
+  Context = Struct.new(:tool_name, :session, :gate_path, :file_path, :savepoint_path,
+                       :content, :old_string, :new_string, :replace_all, :harness,
+                       keyword_init: true) do
+    # links-gate and create-gate branch on content.nil? (key absent) vs content
+    # present (even ""). This is the raw field already, kept as a named reader
+    # so both gates read intent, not a struct field, at the call site.
+    def content_or_nil
+      content
+    end
+  end
+
+  # Per-key tool_input/tool_params fallback (post-review fix, intent 244): old
+  # links-gate and create-gate read
+  # `payload.dig("tool_input", key) || payload.dig("tool_params", key)`, each
+  # key falling back independently, NOT the whole-object pick `input =
+  # tool_input || tool_params` used for gate_path/content/etc below. This
+  # matters for a payload shaped tool_input: {} plus
+  # tool_params: { file_path: X }: the whole-object read stops at the (empty)
+  # tool_input and never sees X; the per-key read still finds it. `prefer`
+  # flips which object wins when BOTH carry the key, since savepoint-pre alone
+  # read tool_params FIRST (see savepoint_path below).
+  def per_key_field(payload, key, prefer: "tool_input")
+    other = prefer == "tool_input" ? "tool_params" : "tool_input"
+    a = payload[prefer]
+    b = payload[other]
+    (a.is_a?(Hash) ? a[key] : nil) || (b.is_a?(Hash) ? b[key] : nil)
+  end
+
+  def context_from(payload, env: ENV)
+    input = payload["tool_input"] || payload["tool_params"] || {}
+    input = {} unless input.is_a?(Hash)
+
+    raw = input["file_path"] || input["notebook_path"] || input["relative_path"] || ""
+    if !raw.empty? && !raw.start_with?("/")
+      root = input["project_root"] || payload["cwd"] || ""
+      raw = File.join(root, raw) unless root.empty?
+    end
+
+    session = payload["session_id"]
+    session = env["CLAUDE_CODE_SESSION_ID"] if session.to_s.empty?
+
+    Context.new(
+      tool_name: payload["tool_name"],
+      session: (session unless session.to_s.empty?),
+      gate_path: raw,
+      file_path: per_key_field(payload, "file_path", prefer: "tool_input"),
+      # savepoint-pre's own historical precedence, inverted from links-gate /
+      # create-gate above: old hooks/savepoint-pre read
+      # `dig("tool_params","file_path") || dig("tool_input","file_path")`.
+      savepoint_path: per_key_field(payload, "file_path", prefer: "tool_params"),
+      content: input["content"],
+      old_string: input["old_string"],
+      new_string: input["new_string"],
+      replace_all: input["replace_all"],
+      harness: "claude",
+    )
+  end
+
+  # --- savepoint-pre (intent 81): never denies; appends the `started` ledger line.
+  def savepoint_pre(ctx)
+    # ctx.savepoint_path carries context_from's tool_params-first read (fix 3);
+    # falls back to ctx.file_path for the thin CLI wrapper (hook-savepoint-pre),
+    # which only ever sets file_path directly and never populates savepoint_path.
+    path = ctx.savepoint_path || ctx.file_path
+    return ALLOW if path.nil? || path.empty?
+
+    abs = File.expand_path(path)
+    intent_dir = Bridge.intent_dir_for(abs)
+    return ALLOW unless intent_dir
+
+    begin
+      Bridge.append_started_savepoint(intent_dir, abs)
+    rescue StandardError
+      # best-effort; the ledger is rebuildable and the post line still lands
+    end
+    ALLOW
+  end
+
+  # --- lock-gate (intent 96, 111): fail-CLOSED delivery lock plus the artifact claim.
+  def lock_gate(ctx)
+    file_path = ctx.gate_path
+    return ALLOW if file_path.nil? || file_path.empty?
+
+    session = ctx.session
+    harness = ctx.harness
+
+    bridge_data = Bridge.discover_bridge(session: session, cwd: Dir.pwd)
+    reason = Bridge.lock_gate_decision(bridge_data, file_path, session: session, harness: harness)
+
+    unless reason
+      begin
+        dir = Bridge.intent_dir_for(file_path)
+        Lock.heartbeat(dir, session: session) if dir && !session.to_s.empty?
+      rescue StandardError
+        # ignore
+      end
+
+      begin
+        dir = Bridge.intent_dir_for(file_path)
+        artifact = File.basename(file_path) if dir
+        if dir && artifact
+          claim_reason = Claim.claim_gate_reason(dir, artifact, session: session, harness: harness)
+          return deny_json(claim_reason) if claim_reason
+
+          if Claim.fail_open?(dir, artifact)
+            $stderr.puts "plastic claim gate: unresolvable claim on #{artifact} in " \
+                         "intent #{Bridge.intent_id_from_dir(dir)} yielded; write " \
+                         "proceeds (see /plastic-lock status)"
+          end
+
+          Claim.heartbeat(dir, artifact, session: session) rescue nil
+        end
+      rescue StandardError
+        # ignore: a claim-gate bug must never block a write (fail open)
+      end
+
+      return ALLOW
+    end
+
+    deny_json(reason)
+  end
+
+  def deny_json(reason)
+    Deny.new(shape: :json, stdout: JSON.generate(
+      "hookSpecificOutput" => {
+        "hookEventName" => "PreToolUse",
+        "permissionDecision" => "deny",
+        "permissionDecisionReason" => reason,
+      }
+    ))
+  end
+
+  # --- code-gate (intents 27, 73c2, 150): stage rule OR worktree rule, first match wins.
+  def code_gate(ctx)
+    file_path = ctx.gate_path
+    return ALLOW if file_path.nil? || file_path.empty?
+
+    session = ctx.session
+    # Auditable escape (intent 150): mirrors the old Bash shim's independent
+    # ti["content"] || ti["new_string"] || "" computation for ARGV[2]. Kept
+    # local to code-gate; links-gate and create-gate never read it.
+    new_content = ctx.content || ctx.new_string || ""
+
+    if new_content && Bridge::PLASTIC_OK_RE.match?(new_content.chomp)
+      log_escape(session, file_path)
+      return ALLOW
+    end
+
+    bridge_data = Bridge.discover_bridge(session: session, cwd: file_path, edited_path: file_path)
+    return ALLOW unless bridge_data
+
+    reason = Bridge.code_gate_decision(bridge_data, file_path) ||
+             Bridge.worktree_gate_decision(bridge_data, file_path, current_session: session)
+    return ALLOW unless reason
+
+    Deny.new(shape: :stderr, lines: ["PLASTIC GATE — #{reason}"])
+  end
+
+  def log_escape(session, file_path)
+    require "fileutils"
+    log = File.join(Dir.home, ".plastic", ".cache", "gate-escapes.log")
+    FileUtils.mkdir_p(File.dirname(log))
+    File.open(log, "a") do |io|
+      io.puts("#{Time.now.utc.iso8601}\t#{session}\t#{file_path}")
+    end
+  rescue StandardError
+    # the escape still applies; logging is best-effort
+  end
+
+  # --- links-gate (intent 192): the write-time belt for the ## Links contract.
+  def links_gate(ctx)
+    path = ctx.file_path
+    return ALLOW if path.to_s.strip.empty?
+
+    abs = File.expand_path(path)
+    return ALLOW unless LinksGate.intent_file?(abs)
+
+    content = ctx.content_or_nil
+    old_string = ctx.old_string
+
+    before_content = File.exist?(abs) ? File.read(abs) : ""
+
+    after_content =
+      if !content.nil?
+        content
+      elsif !old_string.nil?
+        return ALLOW unless before_content.include?(old_string)
+        ctx.replace_all ? before_content.gsub(old_string, ctx.new_string.to_s)
+                        : before_content.sub(old_string, ctx.new_string.to_s)
+      else
+        return ALLOW # pathless mutation (no visible proposal); cannot judge, allow
+      end
+
+    plastic_home = ENV.fetch("PLASTIC_HOME") { File.join(Dir.home, ".plastic") }
+
+    reason = LinksGate.decision(file_path: abs, before_content: before_content,
+                                 after_content: after_content, plastic_home: plastic_home)
+    return ALLOW unless reason
+
+    Deny.new(shape: :stderr, lines: [reason])
+  end
+
+  # --- create-gate (intents 60b, 108 D7): validate the PROPOSED intent file content.
+  def create_gate(ctx)
+    path = ctx.file_path
+    return ALLOW if path.nil? || path.to_s.strip.empty?
+
+    abs = File.expand_path(path)
+    dir = File.dirname(abs)
+    is_intent_file = dir.match?(%r{/store/[^/]+--[^/]+\z}) &&
+                     File.basename(abs) == "#{File.basename(dir)}.md"
+    return ALLOW unless is_intent_file
+
+    content = ctx.content_or_nil
+    old_string = ctx.old_string
+
+    result =
+      if !content.nil?
+        IntentValidator.validate_content(content)
+      elsif !old_string.nil?
+        unless File.exist?(abs)
+          return Deny.new(shape: :stderr, lines: [
+            "PLASTIC CREATE GATE — #{File.basename(abs)} does not exist; " \
+            "create intents via new-intent / plastic-intent-creating.",
+          ])
+        end
+        current = File.read(abs)
+        return ALLOW unless current.include?(old_string)
+        simulated = ctx.replace_all ? current.gsub(old_string, ctx.new_string.to_s)
+                                    : current.sub(old_string, ctx.new_string.to_s)
+        IntentValidator.validate_content(simulated)
+      else
+        unless File.exist?(abs)
+          return Deny.new(shape: :stderr, lines: [
+            "PLASTIC CREATE GATE — #{File.basename(abs)}: cannot read proposed " \
+            "content and no file exists; refusing to allow an unvalidated intent write.",
+          ])
+        end
+        IntentValidator.validate_content(File.read(abs))
+      end
+
+    return ALLOW if result[:ok]
+
+    lines = ["PLASTIC CREATE GATE — #{File.basename(abs)} is not a valid intent:"]
+    result[:errors].each { |e| lines << "  #{e}" }
+    lines << "Create intents via new-intent / plastic-intent-creating; do not hand-author them."
+    Deny.new(shape: :stderr, lines: lines)
+  end
+
+  # Applicability (post-review fixes 1+2, intent 244): reproduces the Claude
+  # harness's OWN matcher semantics, not the dispatcher's earlier string
+  # equality. Two corrections:
+  #   - the harness matches an UNANCHORED REGEX (`"Write|Edit"` matches
+  #     "NotebookEdit" by substring), so applicability must too, or a gate
+  #     whose table entry never listed NotebookEdit explicitly stops firing on
+  #     it even though the old per-gate matcher group DID fire (a coverage
+  #     narrowing the byte-identical-behavior bar exists to catch);
+  #   - a missing/unrecognized tool_name means "the harness matched, but did
+  #     not name the tool", not "not our tool": the five old wrappers never
+  #     read tool_name at all, so they ALL ran on such a payload. Skipping
+  #     every gate here would be a coverage WEAKENING (the gate-weakening
+  #     direction is the dangerous one; see intent 203).
+  def tool_applies?(tool_name, tools)
+    return true if tool_name.to_s.empty?
+    Regexp.new(tools.join("|")).match?(tool_name.to_s)
+  end
+
+  # --- the ordered evaluation (spec D-a, D-i) -------------------------------
+  # `route` is injected so a test can supply a raising gate and prove isolation
+  # without eval, an ENV seam, or a global. `gate_tools` is injected for the same
+  # reason and defaults to the single source of truth.
+  # Returns the process exit code.
+  def dispatch(ctx:, route:, gate_tools: HookRegistry::GATE_TOOLS, out: $stdout, err: $stderr)
+    gate_tools.each do |gate, tools|
+      next unless tool_applies?(ctx.tool_name, tools)
+
+      begin
+        outcome = route.call(gate, ctx)
+        next unless outcome
+
+        if outcome.shape == :json
+          out.print outcome.stdout
+          return 0
+        else
+          outcome.lines.each { |line| err.puts line }
+          return 2
+        end
+      rescue StandardError => e
+        # Fix 7: outcome.shape / out.print / err.puts now live INSIDE the same
+        # rescue as route.call, so a malformed outcome or a stream write
+        # failure (e.g. EPIPE) is isolated exactly like a raising gate, and
+        # never aborts the gates still to come.
+        err.puts "plastic #{gate} error: #{e.message}"
+        next
+      end
+    end
+    0
+  end
+end

package/scripts/lib/hook_registry.rb

@@ -23,7 +23,37 @@ module HookRegistry
   ].freeze
 
   WRITE_MATCHER = (%w[Write Edit NotebookEdit] + SERENA_EDIT_TOOLS).join("|")
-  CREATE_MATCHER = (%w[Write Edit] + SERENA_EDIT_TOOLS).join("|")
+
+  # Per-gate tool applicability for the merged edit-path dispatcher (intent 244,
+  # spec D-d/D-l). Registration collapses to ONE PreToolUse hook on WRITE_MATCHER
+  # (a strict superset of the three former matcher groups), and this table is what
+  # keeps each gate's own coverage exactly what it was: scripts/hook-edit-gates
+  # reads tool_name off the payload and skips any gate whose list excludes it.
+  # Key order IS the evaluation order (spec D-a): savepoint-pre first because it
+  # never denies and its ledger append must stay unconditional; lock-gate leads
+  # the deniers because holding the delivery lock is the precondition the other
+  # rules assume. A test pins this table against today's three matcher groups, so
+  # no gate's coverage can widen or narrow silently.
+  GATE_TOOLS = {
+    "savepoint-pre" => %w[Write Edit].freeze,
+    "lock-gate"     => (%w[Write Edit NotebookEdit] + SERENA_EDIT_TOOLS).freeze,
+    "code-gate"     => (%w[Write Edit NotebookEdit] + SERENA_EDIT_TOOLS).freeze,
+    "links-gate"    => %w[Write Edit].freeze,
+    "create-gate"   => (%w[Write Edit] + SERENA_EDIT_TOOLS).freeze,
+  }.freeze
+
+  # Per-gate statusMessage, kept as its own source because these five names stop
+  # appearing in `events` once registration collapses, while Codex still
+  # registers all five per-gate entries and must keep emitting today's exact
+  # statusMessage strings (intent 244, spec D-e). codex_hooks_json merges this
+  # under the names it derives from `events`.
+  GATE_STATUS = {
+    "code-gate"     => "Checking lifecycle gate...",
+    "lock-gate"     => "Checking lock gate...",
+    "savepoint-pre" => "Recording stage start...",
+    "links-gate"    => "Checking Links gate...",
+    "create-gate"   => "Checking create gate...",
+  }.freeze
 
   # event => ordered list of { "matcher" =>, "hooks" => [{ "name" =>, "status" => }] }
   # The name is the hooks/<name> launcher; the flat install ships it as
@@ -42,23 +72,16 @@ module HookRegistry
         ] },
       ],
       "PreToolUse" => [
+        # ONE registered edit-path hook (intent 244, spec D-d). WRITE_MATCHER is a
+        # strict superset of the three matcher groups this replaces; per-gate tool
+        # applicability lives in GATE_TOOLS above and is read by
+        # scripts/hook-edit-gates, so no gate's coverage widened or narrowed.
         { "matcher" => WRITE_MATCHER, "hooks" => [
-          { "name" => "code-gate", "status" => "Checking lifecycle gate..." },
-          { "name" => "lock-gate", "status" => "Checking lock gate..." },
-        ] },
-        { "matcher" => "Write|Edit", "hooks" => [
-          { "name" => "savepoint-pre", "status" => "Recording stage start..." },
-          { "name" => "links-gate", "status" => "Checking Links gate..." },
-        ] },
-        { "matcher" => CREATE_MATCHER, "hooks" => [
-          { "name" => "create-gate", "status" => "Checking create gate..." },
+          { "name" => "edit-gates", "status" => "Checking Plastic gates..." },
         ] },
         { "matcher" => "Bash", "hooks" => [
           { "name" => "bash-gate", "status" => "Checking lifecycle gate..." },
         ] },
-        { "matcher" => "Bash|Read|Grep|Glob", "hooks" => [
-          { "name" => "retrieval-gate", "status" => "Checking retrieval gate..." },
-        ] },
       ],
       "PostToolUse" => [
         { "matcher" => "Write|Edit", "hooks" => [
@@ -70,7 +93,7 @@ module HookRegistry
           { "name" => "continue", "status" => "Checking for continue..." },
           { "name" => "future-intent-check", "status" => "Checking future intents..." },
           { "name" => "auto-arm", "status" => "Checking auto mode..." },
-          { "name" => "qmd-search", "status" => "Searching QMD..." },
+          { "name" => "power-tools", "status" => "Checking power tools..." },
         ] },
       ],
     }
@@ -89,16 +112,14 @@ module HookRegistry
   CODEX_POST_HOOKS = %w[gate-check].freeze
 
   # Codex's shell-tool gate hole (intent 203): bash-gate (denies a shell write to
-  # project code before How) and retrieval-gate (advisory, never denies) both
-  # belong on the Bash matcher, and ONLY Bash: the official Codex hooks doc's
-  # PreToolUse event catalog enumerates exactly Bash, apply_patch, and MCP tool
-  # calls, and neither it nor the two prior Codex research passes (198's
-  # official-docs research, 181's deep research) documents a discrete Read,
-  # Grep, or Glob tool name (D3). So this does NOT copy Claude's four-name
-  # "Bash|Read|Grep|Glob" retrieval-gate matcher; registering a tool name Codex
-  # never reports would be dead weight that looks alive, the exact defect this
-  # intent exists to fix.
-  CODEX_BASH_HOOKS = %w[bash-gate retrieval-gate].freeze
+  # project code before How) belongs on the Bash matcher, and ONLY Bash: the
+  # official Codex hooks doc's PreToolUse event catalog enumerates exactly Bash,
+  # apply_patch, and MCP tool calls, and neither it nor the two prior Codex
+  # research passes (198's official-docs research, 181's deep research)
+  # documents a discrete Read, Grep, or Glob tool name (D3). Registering a tool
+  # name Codex never reports would be dead weight that looks alive, the exact
+  # defect this intent exists to fix.
+  CODEX_BASH_HOOKS = %w[bash-gate].freeze
 
   # Live-state events registered WHOLE (intent 199), unlike CODEX_PRE_HOOKS/
   # CODEX_POST_HOOKS above: Codex's SessionStart/UserPromptSubmit/PreCompact already
@@ -109,10 +130,16 @@ module HookRegistry
   CODEX_LIVE_STATE_EVENTS = %w[SessionStart UserPromptSubmit PreCompact].freeze
 
   def codex_hooks_json(dispatcher_path:)
-    # name => statusMessage, straight from the single `events` source (A8): the
-    # guide Part 3 hooks.json format carries a per-hook statusMessage, so emit it.
-    status_by_name = events.values.flatten.flat_map { |g| g["hooks"] }
-                           .each_with_object({}) { |h, m| m[h["name"]] = h["status"] }
+    # GATE_STATUS first, then `events`, so `events` still wins for every name it
+    # carries. The five edit-path gate names left `events` when Claude's
+    # registration collapsed to one hook (intent 244), but Codex still registers
+    # all five separately and must keep emitting today's exact statusMessage
+    # strings; without this merge every Codex statusMessage would silently become
+    # "" and doctor's command-only diff would never notice.
+    status_by_name = GATE_STATUS.merge(
+      events.values.flatten.flat_map { |g| g["hooks"] }
+            .each_with_object({}) { |h, m| m[h["name"]] = h["status"] }
+    )
     cmd = ->(name) {
       { "type" => "command",
         "command" => "\"#{dispatcher_path}\" #{name}",
@@ -120,7 +147,12 @@ module HookRegistry
     }
     # Preserve the order these hook names appear across the PreToolUse groups in `events`.
     pre_order = events["PreToolUse"].flat_map { |g| g["hooks"].map { |h| h["name"] } }
-    pre = (pre_order & CODEX_PRE_HOOKS).map { |n| cmd.call(n) }
+    # Claude's edit-path groups collapsed to one hook, so the per-gate order can no
+    # longer be read out of `events` (spec D-l). CODEX_PRE_HOOKS is its own literal
+    # order (code-gate lock-gate savepoint-pre links-gate create-gate) and the
+    # intersection with GATE_TOOLS.keys still validates that every Codex gate name
+    # exists in the registry. The emitted JSON is unchanged.
+    pre = (CODEX_PRE_HOOKS & GATE_TOOLS.keys).map { |n| cmd.call(n) }
     bash = (pre_order & CODEX_BASH_HOOKS).map { |n| cmd.call(n) }
     post = CODEX_POST_HOOKS.map { |n| cmd.call(n) }