@zalom/plastic 2.0.0-alpha.22 → 2.0.0-alpha.24

package/scripts/lib/day_summary.rb

@@ -12,6 +12,7 @@ require "time"
 require_relative "session_ledger"
 require_relative "handoff"
 require_relative "lock"
+require_relative "active_delivery"
 require_relative "report_screen"
 
 module DaySummary
@@ -43,7 +44,7 @@ module DaySummary
       open: open_items(store, day),
       done: last_done(store, day),
       live: live_intents(home, now: now),
-      others: active_sessions(store, session, now: now, ttl: heartbeat_ttl),
+      others: active_sessions(store, session, now: now, ttl: heartbeat_ttl, home: home),
     }
     hidden = Hash.new(0)
     cap!(lists, hidden, :open, OPEN_CAP, keep: :newest)
@@ -142,7 +143,7 @@ module DaySummary
     "(no savepoint yet)"
   end
 
-  def active_sessions(store, session, now:, ttl:)
+  def active_sessions(store, session, now:, ttl:, home: nil)
     tmp_root = SessionLedger.tmp_root(store)
     return [] unless File.directory?(tmp_root)
 
@@ -155,7 +156,7 @@ module DaySummary
       age = heartbeat_age(dir, now)
       next if age.nil? || age > ttl
 
-      "- #{sid} (#{(age / 60).floor}m ago, on #{pointer_of(dir)})"
+      "- #{sid} (#{(age / 60).floor}m ago, on #{delivering_label(store, home, sid, now)})"
     end
   rescue SystemCallError
     []
@@ -178,14 +179,21 @@ module DaySummary
     nil
   end
 
-  def pointer_of(dir)
-    path = File.join(dir, "current")
-    return "?" unless File.file?(path)
-
-    value = File.read(path).strip
-    value.empty? ? "?" : value[0, 80]
-  rescue SystemCallError
-    "?"
+  # The delivering intent's id, or "day ledger" (344 n2, D4-D7): the
+  # basename before "--" of ActiveDelivery.resolve_by_short_session's
+  # match, else the session records into today's day ledger.
+  def delivering_label(store, home, sid, now)
+    return "day ledger" if home.to_s.empty?
+
+    dir = ActiveDelivery.resolve_by_short_session(
+      global_store: store,
+      project_roots: ActiveDelivery.project_roots(home),
+      short_session: sid,
+      now: now
+    )
+    dir ? File.basename(dir).split("--", 2).first : "day ledger"
+  rescue StandardError
+    "day ledger"
   end
 
   # --- rendering, pure -------------------------------------------------------------

package/scripts/lib/doctor_core.rb

@@ -27,11 +27,16 @@ class Doctor
     "hermes" => { name: "Hermes",      dir: File.join(Dir.home, ".hermes") },
   }.freeze
 
-  # The Claude events hooks_registered expects in settings.json: the six-event map of
+  # The Claude events hooks_registered expects in settings.json: the eight-event map of
   # cut-inventory 3b (intent 309 added SessionEnd, registered for close since intent 301;
-  # intent 316a added MessageDisplay, registered for message-display, Claude only).
+  # intent 316a added MessageDisplay, registered for message-display, Claude only; intent
+  # 355 added PreToolUse, registered for call-budget, Claude only; intent 340b added Stop,
+  # registered for stop, Claude only). Stop's registration is static (D5/D7) even though
+  # its runtime arm defaults off (D9, runner.stop_hook), so an install missing it is
+  # exactly as broken as one missing PreCompact, and this list keeps hooks_registered and
+  # hooks_match_registry agreeing on that (row 4.32).
   CLAUDE_HOOK_EVENTS = %w[SessionStart PreToolUse PreCompact PostToolUse UserPromptSubmit SessionEnd
-                          MessageDisplay].freeze
+                          MessageDisplay Stop].freeze
 
   # Launchers the installer places in the agent's hooks dir that are NOT hooks
   # (intent 204): plastic-statusline is the settings["statusLine"] command, wired

package/scripts/lib/doctor_session_ledger.rb

@@ -15,21 +15,12 @@ require_relative "session_ledger"
 # heartbeat is only refreshed on prompts and edits, so an old heartbeat is evidence, not
 # proof, that the session is gone. Fail-open: an unreadable directory is skipped, never
 # raised. Depends on the including class for `plastic_home` and `check`.
+#
+# Intent 344 (G11, D10): the third check this category used to carry,
+# `no_pointer_session_tmp`, is retired along with the per-session state it read.
 module DoctorSessionLedger
   ORPHAN_TTL_SECONDS = 24 * 60 * 60
 
-  # Row H (spec D9): a `.tmp/<sid>/` directory with no `current` pointer is a
-  # DIFFERENT orphan class than ORPHAN_TTL_SECONDS's -- a session where
-  # session start never ran at all (a `-p` print session, a resumed
-  # background job, an unregistered SessionStart hook), not a session that
-  # ran and then never closed. No choice of session id ever creates a
-  # pointer for that class, so it would otherwise stay invisible for the
-  # full 24 hours (or forever, once hook-capture/hook-record stop creating
-  # it at all). Short relative to ORPHAN_TTL_SECONDS on purpose: a session
-  # between its own start and its first pointer write is normal and must not
-  # be flagged, but that window is seconds, not hours.
-  NO_POINTER_TTL_SECONDS = 5 * 60
-
   # Seconds since the session's last heartbeat: the ISO-8601 content of `heartbeat`,
   # else that file's mtime, else the directory's mtime.
   def heartbeat_age(dir, now)
@@ -49,7 +40,6 @@ module DoctorSessionLedger
 
     store_dir = File.join(plastic_home, "store")
     orphans = orphaned_session_dirs(store_dir, now)
-    no_pointer = no_pointer_session_dirs(store_dir, now)
     shape = day_ledger_shape_problems(store_dir)
 
     checks = []
@@ -67,20 +57,6 @@ module DoctorSessionLedger
                                 "session is gone: a live session rewrites its heartbeat on every " \
                                 "prompt and edit, so only a listed directory may be removed, by hand.")
               end
-    checks << if no_pointer.empty?
-                check(category: "session_ledger", name: "no_pointer_session_tmp", status: "pass",
-                      message: "No .tmp/<session>/ directory has gone without a `current` pointer for " \
-                               "longer than #{NO_POINTER_TTL_SECONDS} seconds")
-              else
-                check(category: "session_ledger", name: "no_pointer_session_tmp", status: "warn",
-                      message: "#{no_pointer.size} .tmp/<session>/ director#{no_pointer.size == 1 ? "y" : "ies"} " \
-                               "with no `current` pointer for longer than #{NO_POINTER_TTL_SECONDS} seconds " \
-                               "(session start never ran for this session)",
-                      details: no_pointer, fixable: true,
-                      fix_hint: "Remove each listed .tmp/<session>/ directory after confirming that " \
-                                "session never started: no `current` pointer means session start never " \
-                                "ran for it, so this is not a live session missing a checklist entry.")
-              end
     checks << if shape.empty?
                 check(category: "session_ledger", name: "day_ledger_shape", status: "pass",
                       message: "Every .sessions/ entry is a YYYYMMDD day directory with its <day>.md file")
@@ -113,31 +89,6 @@ module DoctorSessionLedger
     [] # unreadable .tmp/: nothing to report, never a crash
   end
 
-  # Row H (spec D9): `.tmp/<sid>/` directories with no `current` pointer, past
-  # NO_POINTER_TTL_SECONDS. A different signal than #orphaned_session_dirs:
-  # that one is age-only and blind to whether a pointer exists at all, so a
-  # young no-pointer dir (a session between its start and its first pointer
-  # write) must not appear here even though it may well appear there once it
-  # ages past ORPHAN_TTL_SECONDS -- the two checks answer different questions
-  # and a dir can legitimately show up in neither, either, or both.
-  def no_pointer_session_dirs(store_dir, now)
-    tmp_root = SessionLedger.tmp_root(store_dir)
-    return [] unless File.directory?(tmp_root)
-
-    Dir.children(tmp_root).sort.filter_map do |name|
-      dir = File.join(tmp_root, name)
-      next unless File.directory?(dir)
-      next if File.exist?(File.join(dir, "current"))
-
-      age = heartbeat_age(dir, now)
-      next if age <= NO_POINTER_TTL_SECONDS
-
-      "global: #{dir} (session #{name}, no `current` pointer, last heartbeat #{age.round}s ago)"
-    end
-  rescue SystemCallError
-    [] # unreadable .tmp/: nothing to report, never a crash
-  end
-
   def day_ledger_shape_problems(store_dir)
     root = SessionLedger.sessions_root(store_dir)
     return [] unless File.directory?(root)

package/scripts/lib/engine_permissions.rb

@@ -0,0 +1,88 @@
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# EnginePermissions: the engine deny rule (intent 340b, G7c, n3). A permissions.deny
+# block merged into settings.json at install so the engine directories are not
+# editable by a dispatched agent (C25's self-preservation half).
+#
+# Claude Code accepts a Write(...) path rule and never consults it: Edit(...) is the
+# rule that covers Write, MultiEdit and NotebookEdit. Every entry below names Edit,
+# never Write, and every entry ends in /** because a bare directory path matches the
+# directory itself, not the files under it.
+#
+# This is a second ownership mechanism, deliberately not a reuse of HookRegistry's
+# merge, which knows its own entries by a plastic- launcher basename inside a command
+# string. A deny entry is a bare string with no marker in it, so ownership here is
+# exact-string membership in ENTRIES. The consequence is deliberate: an entry the
+# owner has edited no longer matches the frozen string, so it is the owner's from
+# that point on - the merge appends Plastic's own alongside it, and removal leaves
+# the edited one in place untouched.
+#
+# Pure functions only: no file I/O here. InstallerCore#merge_engine_permissions and
+# #remove_engine_permissions own the read-modify-write against settings.json,
+# mirroring the split HookRegistry keeps from merge_claude_hooks.
+module EnginePermissions
+  module_function
+
+  ENTRIES = [
+    "Edit(~/.plastic/scripts/**)",
+    "Edit(~/.plastic/skills/**)",
+    "Edit(~/.plastic/hooks/**)",
+    "Edit(~/.plastic/templates/**)",
+  ].freeze
+
+  # Returns a new settings hash with ENTRIES merged into permissions.deny, appended
+  # (never duplicated) alongside whatever is already there. Survives a permissions
+  # or deny value that is not the shape expected (row 3.12): a non-Hash permissions
+  # value or a non-Array deny value is replaced rather than raised on. Never
+  # mutates the argument.
+  def merge_into(settings)
+    settings = settings.is_a?(Hash) ? settings.dup : {}
+
+    permissions = settings["permissions"]
+    permissions = permissions.is_a?(Hash) ? permissions.dup : {}
+
+    deny = permissions["deny"]
+    deny = deny.is_a?(Array) ? deny.dup : []
+
+    ENTRIES.each { |entry| deny << entry unless deny.include?(entry) }
+
+    permissions["deny"] = deny
+    settings["permissions"] = permissions
+    settings
+  end
+
+  # Returns a new settings hash with exactly the ENTRIES strings removed from
+  # permissions.deny, leaving every other entry (the owner's own deny rules, and
+  # any Plastic entry the owner has since edited) untouched. Prunes the deny array
+  # once it is empty, and the whole permissions block once nothing else remains
+  # under it (row 3.10). A settings/permissions/deny shape that is not what is
+  # expected is left alone rather than raised on (row 3.12's uninstall side).
+  def remove_from(settings)
+    return settings unless settings.is_a?(Hash)
+
+    permissions = settings["permissions"]
+    return settings unless permissions.is_a?(Hash)
+
+    deny = permissions["deny"]
+    return settings unless deny.is_a?(Array)
+
+    settings = settings.dup
+    permissions = permissions.dup
+    deny = deny.reject { |entry| ENTRIES.include?(entry) }
+
+    if deny.empty?
+      permissions.delete("deny")
+    else
+      permissions["deny"] = deny
+    end
+
+    if permissions.empty?
+      settings.delete("permissions")
+    else
+      settings["permissions"] = permissions
+    end
+
+    settings
+  end
+end

package/scripts/lib/exec_worktree.rb

@@ -2,7 +2,6 @@
 # frozen_string_literal: true
 
 require "open3"
-require_relative "bridge"
 require_relative "arm"
 require_relative "lock"
 require_relative "worktree"
@@ -29,8 +28,8 @@ require_relative "scaffold_intent"
 # fail-open, see the merge-verification note below), `finisher:` (defaults to
 # `Worktree.method(:finish)`), `status_checker:` (defaults to a `git status --porcelain`
 # lambda). Every seam exists so
-# tests run with no real git, no real worktree removal, and no real bridge file outside a
-# tmpdir.
+# tests run with no real git, no real worktree removal, and no real delivery-lock file
+# outside a tmpdir.
 #
 # MERGE VERIFICATION (delivered disposition only). `Worktree.merge_branch` is deliberately
 # fail-open: on a conflict it runs `git merge --abort`, warns, and returns false, and
@@ -39,7 +38,7 @@ require_relative "scaffold_intent"
 # module never trusts the discarded return value; it asks git directly, AFTER finish, whether
 # the intent's code branch is now an ancestor of the repo's current HEAD
 # (`merged_into_current_branch?` below). `repo` and `branch` are captured BEFORE the finisher
-# runs, because finish deletes the bridge's `worktree` block.
+# runs, because finish deletes the delivery's `worktree` block.
 #
 # DOES NOT RUN A TEST SUITE, in any form. `verify-intent` owns test execution; one concern
 # per script (spec D8).
@@ -60,6 +59,10 @@ module ExecWorktree
   # [stdout, stderr, status] triple Open3.capture3 returns (status responds to
   # success?). A raised error (git missing, corrupt repo) is caught and reported as a
   # nil status, so the caller can fail closed the same way a failed exit status would.
+  def blank?(value)
+    value.nil? || value.to_s.strip.empty?
+  end
+
   def default_status_checker
     lambda do |worktree_code|
       Open3.capture3("git", "-C", worktree_code, "status", "--porcelain")
@@ -85,7 +88,7 @@ module ExecWorktree
   # `<repo>/.claude/worktrees/<name>` (scripts/lib/worktree.rb:75), so walking up three
   # directories recovers `<repo>` deterministically, with no I/O and no git.
   def repo_from_worktree_code(worktree_code)
-    return nil if Bridge.blank?(worktree_code)
+    return nil if blank?(worktree_code)
     File.dirname(File.dirname(File.dirname(worktree_code.to_s)))
   end
 
@@ -94,7 +97,7 @@ module ExecWorktree
   # i.e. the merge actually landed. Fails CLOSED (not merged) on a blank repo/branch or a
   # raising runner, so an inconclusive check is never reported as a success.
   def merged_into_current_branch?(runner, repo:, branch:)
-    return false if Bridge.blank?(repo) || Bridge.blank?(branch)
+    return false if blank?(repo) || blank?(branch)
     runner.run("-C", repo, "merge-base", "--is-ancestor", branch, "HEAD").success?
   rescue StandardError
     false
@@ -106,12 +109,12 @@ module ExecWorktree
   # The lock-owner fallback is correct here: this is a teardown step on an intent this
   # session has been delivering.
   def resolve_session(explicit, env_session, intent_dir)
-    return explicit.to_s.strip unless Bridge.blank?(explicit)
-    return env_session.to_s.strip unless Bridge.blank?(env_session)
+    return explicit.to_s.strip unless blank?(explicit)
+    return env_session.to_s.strip unless blank?(env_session)
     lock = Lock.read(intent_dir)
     return nil unless lock
     owner = lock["owner_session"].to_s
-    Bridge.blank?(owner) ? nil : owner
+    blank?(owner) ? nil : owner
   end
 
   # --- result builders (the exit_code/stdout/stderr shape the thin CLIs share) --------
@@ -181,7 +184,7 @@ module ExecWorktree
     merge_line =
       if disposition != "delivered"
         "not attempted (abandoned)"
-      elsif Bridge.blank?(target_branch)
+      elsif blank?(target_branch)
         "merged (integration target branch could not be resolved)"
       else
         "merged into #{target_branch}"
@@ -202,10 +205,10 @@ module ExecWorktree
           runner: Worktree::ShellRunner.new,
           finisher: Worktree.method(:finish),
           status_checker: default_status_checker)
-    return usage_result("--store is required") if Bridge.blank?(store)
-    return usage_result("--id is required") if Bridge.blank?(id)
-    return usage_result("--home is required") if Bridge.blank?(home)
-    return usage_result("--disposition is required") if Bridge.blank?(disposition)
+    return usage_result("--store is required") if blank?(store)
+    return usage_result("--id is required") if blank?(id)
+    return usage_result("--home is required") if blank?(home)
+    return usage_result("--disposition is required") if blank?(disposition)
     unless DISPOSITIONS.include?(disposition)
       return usage_result("--disposition must be one of #{DISPOSITIONS.join('|')} (got #{disposition.inspect})")
     end
@@ -220,16 +223,16 @@ module ExecWorktree
 
     # Step 0: session resolution + pre-flight refusal (D3-mirroring; see resolve_session).
     key_session = resolve_session(session, env_session, intent_dir)
-    if Bridge.blank?(key_session) && File.exist?(Lock.path(intent_dir))
+    if blank?(key_session) && File.exist?(Lock.path(intent_dir))
       return deny_result(EXIT_UNRESOLVED, no_session_message(intent_dir))
     end
 
-    bridge_data = Arm.bridge_hash(intent_dir: intent_dir, home: normalized_home)
-    worktree_code = bridge_data.dig("worktree", "code")
-    return ok_result(nothing_provisioned_message(intent_dir)) if Bridge.blank?(worktree_code)
+    delivery = Arm.delivery(intent_dir: intent_dir, home: normalized_home)
+    worktree_code = delivery.dig("worktree", "code")
+    return ok_result(nothing_provisioned_message(intent_dir)) if blank?(worktree_code)
 
-    branch = bridge_data.dig("worktree", "code_branch")
-    # Captured now, before `finisher.call` below (Worktree.finish) deletes the bridge's
+    branch = delivery.dig("worktree", "code_branch")
+    # Captured now, before `finisher.call` below (Worktree.finish) deletes the delivery's
     # `worktree` block, so the post-finish merge verification (BLOCKING 1/2) still has
     # both `repo` and `branch` to work with.
     repo = repo_from_worktree_code(worktree_code)
@@ -254,7 +257,7 @@ module ExecWorktree
     # disposition only, whether the worktree directory still exists on disk (teardown
     # incomplete); second, for a delivered disposition only, whether the branch actually
     # merged (BLOCKING 1/2, see merged_into_current_branch? above).
-    finisher.call(bridge_data, home: normalized_home, runner: runner,
+    finisher.call(delivery, home: normalized_home, runner: runner,
                   merge: disposition == "delivered")
 
     removed = !Dir.exist?(worktree_code)

package/scripts/lib/graph_edges.rb

@@ -4,11 +4,11 @@
 # GraphEdges (intent 334, n1): the shared `needs` syntax and cycle-path check
 # (327 D2r-D4r, D12r). Parses a "## Graph" section's edge lines into a node
 # set and an edge map, the one parser an intent's graph.md and a roadmap's
-# own ## Graph section both use unchanged (C1, fold A5): the same list-item
+# own ## Graph section both use unchanged (C1, review A5): the same list-item
 # grammar, the same root keyword, the same cycle walk. Deliberately loose
 # about what an id looks like - a roadmap id is numeric ("334", "340a"), a
 # node id carries a kind prefix ("n1") - the kind-prefix rule belongs to
-# NodeFile and WorkGraphValidator, never here (D12r, fold A6).
+# NodeFile and WorkGraphValidator, never here (D12r, review A6).
 #
 # Grammar (D2r/D3r): a list item shaped "- <id> needs <target> [<target>
 # ...]", ending at end of line. The single literal target "nothing" declares
@@ -18,7 +18,7 @@
 # all, "nothing" alongside other targets, or a target token carrying
 # sentence punctuation (a period, a colon, ...) rather than the loose
 # id-token charset, is an error naming the line, never a silently
-# mis-parsed edge or an invented node (fold A7).
+# mis-parsed edge or an invented node (review A7).
 #
 # Pure and side-effect-free; never raises across the boundary, matching the
 # Result-hash convention every library in scripts/lib/ follows.
@@ -30,7 +30,7 @@ module GraphEdges
   ROOT_TARGET = "nothing"
 
   # {nodes:, edges:, errors:} - nodes is the declared ids together with every
-  # id any edge targets (fold A5), in first-seen order; edges maps a declared
+  # id any edge targets (review A5), in first-seen order; edges maps a declared
   # id to its target ids (empty for a root); errors names each malformed
   # edge-shaped line. Prose lines contribute nothing and raise nothing.
   def parse(section_text)

package/scripts/lib/graph_file.rb

@@ -7,9 +7,9 @@ require_relative "atomic_write"
 # GraphFile (intent 334, n2): the four graph.md sections (## Goal,
 # ## Decisions, ## Graph, ## Status), the verify:-none directive, and the two
 # writers - write_status and append_decision. Both writers refuse a cyclic
-# graph and both go through AtomicWrite (fold D19r). Fence-aware everywhere a
+# graph and both go through AtomicWrite (review D19r). Fence-aware everywhere a
 # heading is located, so a fenced example carrying a fake "## " line never
-# splits or ends a real section (fold A8's sibling concern, applied to
+# splits or ends a real section (review A8's sibling concern, applied to
 # section boundaries rather than edge lines).
 module GraphFile
   module_function
@@ -19,8 +19,8 @@ module GraphFile
 
   # {ok:, goal:, decisions:, graph:, status:, verify:, errors:}. `graph` is
   # GraphEdges.parse's own Result hash, over the Graph section text with any
-  # verify:-none directive line stripped first (fold A8). A missing ## Graph
-  # section, or one that declares no nodes, is an error naming which (fold
+  # verify:-none directive line stripped first (review A8). A missing ## Graph
+  # section, or one that declares no nodes, is an error naming which (review
   # A10).
   def parse(path)
     return failure(["graph file not found: #{path}"]) unless File.exist?(path)