agentwrangler 0.1.0

package/dist/evidence/r3/score.js

@@ -0,0 +1,341 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { loadApprovedEvidenceInput, publishApprovedOutput, } from "../common/approved-input.js";
+import { canonicalJson, sha256Bytes, sha256Canonical } from "../common/canonical.js";
+const SHA256_RE = /^[0-9a-f]{64}$/u;
+const COVERAGE_THRESHOLD = 0.8;
+const PRECISION_THRESHOLD = 0.95;
+const VERDICTS = new Set(["CORRECT", "INCORRECT", "UNCERTAIN"]);
+const REASONS = new Set([
+    "TIMELINE",
+    "COMMIT_SIGNAL",
+    "KNOWN_WORK_ITEM",
+    "CONFLICT",
+    "INSUFFICIENT",
+]);
+function refuse(code) {
+    throw new Error(code);
+}
+function retainedFailure(error) {
+    const message = error instanceof Error && /^[a-z0-9_]+$/u.test(error.message)
+        ? error.message
+        : "r3_score_failure";
+    return new Error(`${message}_scratch_verification_retained`);
+}
+function exactKeys(value, expected, code) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    if (actual.length !== wanted.length || actual.some((key, i) => key !== wanted[i]))
+        refuse(code);
+}
+function record(value, code) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        refuse(code);
+    return value;
+}
+function readJson(state, file, digest, code) {
+    if (!SHA256_RE.test(digest))
+        refuse(`${code}_digest_invalid`);
+    const stateReal = fs.realpathSync.native(state);
+    const fileReal = fs.realpathSync.native(file);
+    if (path.dirname(fileReal) !== stateReal)
+        refuse(`${code}_path_invalid`);
+    const bytes = fs.readFileSync(fileReal);
+    if (sha256Bytes(bytes) !== digest)
+        refuse(`${code}_digest_mismatch`);
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        refuse(`${code}_json_invalid`);
+    }
+}
+function parseAggregate(value) {
+    const parsed = record(value, "r3_score_aggregate_invalid");
+    exactKeys(parsed, [
+        "campaign",
+        "status",
+        "identity",
+        "backfill",
+        "denominator",
+        "shadow",
+        "adjudication",
+        "projected",
+        "byRepoAlias",
+        "deterministicRerun",
+        "privacy",
+    ], "r3_score_aggregate_keys_invalid");
+    if (parsed.campaign !== "R3_U4_BRANCH_LINKAGE" ||
+        (parsed.status !== "PREPARED" && parsed.status !== "DATA_INSUFFICIENT") ||
+        !Array.isArray(parsed.byRepoAlias))
+        refuse("r3_score_aggregate_value_invalid");
+    const denominator = record(parsed.denominator, "r3_score_denominator_invalid");
+    exactKeys(denominator, [
+        "reconciledSessionsN",
+        "outcomeBearingSessionsN",
+        "baselineLinkedOutcomeBearingN",
+        "excludedNotReconciledN",
+        "excludedNoBashN",
+        "excludedNoWorkItemsN",
+    ], "r3_score_denominator_keys_invalid");
+    for (const count of Object.values(denominator)) {
+        if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+            refuse("r3_score_denominator_value_invalid");
+    }
+    const privacy = record(parsed.privacy, "r3_score_privacy_invalid");
+    exactKeys(privacy, ["linkTableUnchanged", "rawRefN", "transcriptPathN", "tokenN"], "r3_score_privacy_keys_invalid");
+    if (typeof privacy.linkTableUnchanged !== "boolean" ||
+        privacy.rawRefN !== 0 ||
+        privacy.transcriptPathN !== 0 ||
+        privacy.tokenN !== 0)
+        refuse("r3_score_privacy_value_invalid");
+    const shadow = record(parsed.shadow, "r3_score_shadow_invalid");
+    exactKeys(shadow, [
+        "candidateReasonN",
+        "dispositionReasonN",
+        "uniqueUpliftCandidatesN",
+        "higherPrecedenceCandidatesN",
+        "backtestEligibleN",
+        "backtestAgreementN",
+        "backtestDisagreementN",
+        "transcriptSucceededN",
+        "transcriptFailureReasonN",
+    ], "r3_score_shadow_keys_invalid");
+    for (const key of [
+        "uniqueUpliftCandidatesN",
+        "higherPrecedenceCandidatesN",
+        "backtestEligibleN",
+        "backtestAgreementN",
+        "backtestDisagreementN",
+        "transcriptSucceededN",
+    ]) {
+        if (typeof shadow[key] !== "number" || !Number.isSafeInteger(shadow[key]) || shadow[key] < 0)
+            refuse("r3_score_shadow_value_invalid");
+    }
+    const rerun = record(parsed.deterministicRerun, "r3_score_rerun_invalid");
+    exactKeys(rerun, ["firstCanonicalSha256", "secondCanonicalSha256", "equal"], "r3_score_rerun_keys_invalid");
+    if (typeof rerun.firstCanonicalSha256 !== "string" ||
+        !SHA256_RE.test(rerun.firstCanonicalSha256) ||
+        typeof rerun.secondCanonicalSha256 !== "string" ||
+        !SHA256_RE.test(rerun.secondCanonicalSha256) ||
+        typeof rerun.equal !== "boolean")
+        refuse("r3_score_rerun_value_invalid");
+    const aliases = new Set();
+    for (const raw of parsed.byRepoAlias) {
+        const cohort = record(raw, "r3_score_cohort_invalid");
+        exactKeys(cohort, [
+            "repoAlias",
+            "outcomeBearingSessionsN",
+            "baselineLinkedOutcomeBearingN",
+            "candidateReasonN",
+            "dispositionReasonN",
+            "requiredAdjudicationN",
+            "adjudicatedN",
+            "correctN",
+            "incorrectN",
+            "uncertainN",
+        ], "r3_score_cohort_keys_invalid");
+        if (typeof cohort.repoAlias !== "string" ||
+            cohort.repoAlias.length === 0 ||
+            aliases.has(cohort.repoAlias))
+            refuse("r3_score_cohort_alias_invalid");
+        aliases.add(cohort.repoAlias);
+    }
+    return value;
+}
+function parseKey(value) {
+    const parsed = record(value, "r3_score_key_invalid");
+    exactKeys(parsed, [
+        "campaignId",
+        "packetVersion",
+        "scorerVersion",
+        "randomizationSeed",
+        "randomizationSeedCommitment",
+        "aggregateSha256",
+        "entries",
+    ], "r3_score_key_keys_invalid");
+    if (typeof parsed.campaignId !== "string" ||
+        parsed.campaignId.length === 0 ||
+        parsed.packetVersion !== "r3-u4-blinded-v1" ||
+        parsed.scorerVersion !== "r3-u4-score-v1" ||
+        typeof parsed.randomizationSeed !== "string" ||
+        !/^[0-9a-f]{64,}$/u.test(parsed.randomizationSeed) ||
+        typeof parsed.randomizationSeedCommitment !== "string" ||
+        !SHA256_RE.test(parsed.randomizationSeedCommitment) ||
+        typeof parsed.aggregateSha256 !== "string" ||
+        !SHA256_RE.test(parsed.aggregateSha256) ||
+        !Array.isArray(parsed.entries))
+        refuse("r3_score_key_value_invalid");
+    const ids = new Set();
+    for (const raw of parsed.entries) {
+        const entry = record(raw, "r3_score_key_entry_invalid");
+        exactKeys(entry, [
+            "candidateId",
+            "sessionId",
+            "candidateWorkItemId",
+            "repoAlias",
+            "cohort",
+            "backtestCorrect",
+            "redactionFailed",
+        ], "r3_score_key_entry_keys_invalid");
+        if (typeof entry.candidateId !== "string" ||
+            entry.candidateId.length === 0 ||
+            ids.has(entry.candidateId) ||
+            typeof entry.sessionId !== "string" ||
+            entry.sessionId.length === 0 ||
+            typeof entry.candidateWorkItemId !== "string" ||
+            entry.candidateWorkItemId.length === 0 ||
+            typeof entry.repoAlias !== "string" ||
+            entry.repoAlias.length === 0 ||
+            (entry.cohort !== "UPLIFT" && entry.cohort !== "BACKTEST") ||
+            !(typeof entry.backtestCorrect === "boolean" || entry.backtestCorrect === null) ||
+            typeof entry.redactionFailed !== "boolean")
+            refuse("r3_score_key_entry_value_invalid");
+        ids.add(entry.candidateId);
+    }
+    return value;
+}
+function parseVerdicts(value) {
+    if (!Array.isArray(value))
+        refuse("r3_verdicts_invalid");
+    const ids = new Set();
+    return value.map((raw) => {
+        const row = record(raw, "r3_verdict_invalid");
+        exactKeys(row, ["candidateId", "verdict", "adjudicatorAlias", "reasonCode"], "r3_verdict_keys_invalid");
+        if (typeof row.candidateId !== "string" ||
+            row.candidateId.length === 0 ||
+            ids.has(row.candidateId) ||
+            typeof row.verdict !== "string" ||
+            !VERDICTS.has(row.verdict) ||
+            typeof row.adjudicatorAlias !== "string" ||
+            row.adjudicatorAlias.length === 0 ||
+            typeof row.reasonCode !== "string" ||
+            !REASONS.has(row.reasonCode))
+            refuse("r3_verdict_value_invalid");
+        ids.add(row.candidateId);
+        return row;
+    });
+}
+/** Score one exact packet key and complete one-adjudicator verdict set. */
+export async function scoreR3(request) {
+    const approved = await loadApprovedEvidenceInput(request.approvedInput);
+    try {
+        const aggregate = parseAggregate(readJson(approved.scratchStatePath, request.aggregatePath, request.aggregateSha256, "r3_aggregate"));
+        const key = parseKey(readJson(approved.scratchStatePath, request.sealedKeyPath, request.sealedKeySha256, "r3_key"));
+        const verdicts = parseVerdicts(readJson(approved.scratchStatePath, request.verdictsPath, request.verdictsSha256, "r3_verdicts"));
+        if (key.aggregateSha256 !== request.aggregateSha256)
+            refuse("r3_score_aggregate_binding_mismatch");
+        const expectedCampaignId = sha256Canonical({
+            identity: aggregate.identity,
+            aggregate: request.aggregateSha256,
+        }).slice(0, 32);
+        if (key.campaignId !== expectedCampaignId)
+            refuse("r3_score_campaign_binding_mismatch");
+        if (sha256Bytes(Buffer.from(key.randomizationSeed, "hex")) !== key.randomizationSeedCommitment)
+            refuse("r3_score_seed_commitment_mismatch");
+        const entries = new Map(key.entries.map((entry) => [entry.candidateId, entry]));
+        const upliftEntryN = key.entries.filter((entry) => entry.cohort === "UPLIFT").length;
+        const backtestEntryN = key.entries.length - upliftEntryN;
+        if (upliftEntryN !== aggregate.shadow.uniqueUpliftCandidatesN ||
+            backtestEntryN !== Math.min(aggregate.shadow.backtestEligibleN, 100))
+            refuse("r3_score_packet_population_mismatch");
+        const verdictMap = new Map();
+        const adjudicators = new Set();
+        for (const verdict of verdicts) {
+            if (!entries.has(verdict.candidateId))
+                refuse("r3_score_unknown_verdict");
+            verdictMap.set(verdict.candidateId, verdict);
+            adjudicators.add(verdict.adjudicatorAlias);
+        }
+        if (verdicts.length > 0 && adjudicators.size !== 1)
+            refuse("r3_score_adjudicator_count_invalid");
+        let correctN = 0;
+        let incorrectN = 0;
+        let uncertainN = 0;
+        let correctUpliftN = 0;
+        let redactionViolation = false;
+        const cohortByAlias = new Map(aggregate.byRepoAlias.map((cohort) => [
+            cohort.repoAlias,
+            {
+                ...cohort,
+                requiredAdjudicationN: 0,
+                adjudicatedN: 0,
+                correctN: 0,
+                incorrectN: 0,
+                uncertainN: 0,
+            },
+        ]));
+        for (const entry of key.entries) {
+            const verdict = verdictMap.get(entry.candidateId);
+            const effective = entry.redactionFailed ? "UNCERTAIN" : verdict?.verdict;
+            if (entry.redactionFailed && verdict !== undefined && verdict.verdict !== "UNCERTAIN")
+                redactionViolation = true;
+            if (effective === "CORRECT") {
+                correctN += 1;
+                if (entry.cohort === "UPLIFT")
+                    correctUpliftN += 1;
+            }
+            else if (effective === "INCORRECT")
+                incorrectN += 1;
+            else if (effective === "UNCERTAIN")
+                uncertainN += 1;
+            const cohort = cohortByAlias.get(entry.repoAlias);
+            if (cohort === undefined)
+                refuse("r3_score_unknown_repo_alias");
+            cohort.requiredAdjudicationN += 1;
+            cohort.adjudicatedN += verdict === undefined ? 0 : 1;
+            if (effective === "CORRECT")
+                cohort.correctN += 1;
+            else if (effective === "INCORRECT")
+                cohort.incorrectN += 1;
+            else if (effective === "UNCERTAIN")
+                cohort.uncertainN += 1;
+        }
+        const complete = verdictMap.size === entries.size && adjudicators.size === (entries.size === 0 ? 0 : 1);
+        const precisionDenominator = correctN + incorrectN;
+        const precision = complete && uncertainN === 0 && precisionDenominator > 0
+            ? correctN / precisionDenominator
+            : null;
+        const linkedNumerator = aggregate.denominator.baselineLinkedOutcomeBearingN + correctUpliftN;
+        const coverage = aggregate.denominator.outcomeBearingSessionsN > 0
+            ? linkedNumerator / aggregate.denominator.outcomeBearingSessionsN
+            : null;
+        const insufficient = aggregate.status === "DATA_INSUFFICIENT" ||
+            !complete ||
+            uncertainN > 0 ||
+            redactionViolation ||
+            precision === null ||
+            coverage === null;
+        const status = insufficient
+            ? "DATA_INSUFFICIENT"
+            : coverage >= COVERAGE_THRESHOLD && precision >= PRECISION_THRESHOLD
+                ? "PASS"
+                : "FAIL";
+        const report = {
+            ...aggregate,
+            status,
+            adjudication: {
+                requiredN: entries.size,
+                adjudicatedN: verdictMap.size,
+                correctN,
+                incorrectN,
+                uncertainN,
+                precisionNumerator: correctN,
+                precisionDenominator,
+            },
+            projected: {
+                correctUniqueUpliftN: correctUpliftN,
+                linkedNumerator,
+                outcomeBearingDenominator: aggregate.denominator.outcomeBearingSessionsN,
+                coverage,
+                precision,
+            },
+            byRepoAlias: [...cohortByAlias.values()].sort((a, b) => a.repoAlias < b.repoAlias ? -1 : a.repoAlias > b.repoAlias ? 1 : 0),
+        };
+        publishApprovedOutput(approved, request.out, canonicalJson(report));
+        return report;
+    }
+    catch (error) {
+        throw retainedFailure(error);
+    }
+}

package/dist/evidence/r3/transcript.js

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as readline from "node:readline";
+import { Transform } from "node:stream";
+import { fingerprintBranchRef } from "../../outcomes/branch-key.js";
+const MAX_PR_LINKS = 64;
+const MAX_REPOSITORY_BYTES = 255;
+function identityOf(stat) {
+    return {
+        device: stat.dev.toString(),
+        inode: stat.ino.toString(),
+        size: stat.size.toString(),
+    };
+}
+function sameIdentity(left, right) {
+    return left.device === right.device && left.inode === right.inode && left.inode !== "0";
+}
+function classifyReadError(error) {
+    return error?.code === "ENOENT" ? "MISSING" : "UNREADABLE";
+}
+/**
+ * Stream one descriptor-attested transcript and retain only bounded structural signals.
+ * The pathname and raw refs never cross the result boundary.
+ */
+export async function harvestFrozenTranscript(entry) {
+    let handle;
+    try {
+        handle = await fs.promises.open(entry.path, "r");
+    }
+    catch (error) {
+        return { ok: false, reason: classifyReadError(error) };
+    }
+    try {
+        let before;
+        try {
+            before = await handle.stat({ bigint: true });
+        }
+        catch {
+            return { ok: false, reason: "UNREADABLE" };
+        }
+        if (!before.isFile()) {
+            return { ok: false, reason: "UNREADABLE" };
+        }
+        if (!sameIdentity(identityOf(before), entry.identity)) {
+            return { ok: false, reason: "REPLACED" };
+        }
+        if (before.size.toString() !== entry.identity.size) {
+            return { ok: false, reason: "CHANGED" };
+        }
+        const links = [];
+        const branchKeys = new Set();
+        let malformedLines = 0;
+        let projectionLimitExceeded = false;
+        const digest = createHash("sha256");
+        const hashingStream = new Transform({
+            transform(chunk, _encoding, callback) {
+                digest.update(chunk);
+                callback(null, chunk);
+            },
+        });
+        const input = handle.createReadStream({ autoClose: false, encoding: "utf8" });
+        input.pipe(hashingStream);
+        const lines = readline.createInterface({
+            input: hashingStream,
+            crlfDelay: Number.POSITIVE_INFINITY,
+        });
+        try {
+            for await (const line of lines) {
+                const trimmed = line.trim();
+                if (trimmed.length === 0)
+                    continue;
+                let record;
+                try {
+                    const parsed = JSON.parse(trimmed);
+                    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                        malformedLines += 1;
+                        continue;
+                    }
+                    record = parsed;
+                }
+                catch {
+                    malformedLines += 1;
+                    continue;
+                }
+                if (branchKeys.size < 2) {
+                    const branchKey = fingerprintBranchRef(record.gitBranch);
+                    if (branchKey !== null)
+                        branchKeys.add(branchKey);
+                }
+                if (record.type === "pr-link") {
+                    const repository = record.prRepository;
+                    if (typeof record.prNumber === "number" &&
+                        Number.isSafeInteger(record.prNumber) &&
+                        record.prNumber > 0 &&
+                        typeof repository === "string" &&
+                        Buffer.byteLength(repository, "utf8") <= MAX_REPOSITORY_BYTES &&
+                        /^[^/\s]+\/[^/\s]+$/u.test(repository) &&
+                        links.length < MAX_PR_LINKS) {
+                        links.push({ prNumber: record.prNumber, prRepository: repository });
+                    }
+                    else if (typeof record.prNumber === "number" &&
+                        Number.isSafeInteger(record.prNumber) &&
+                        record.prNumber > 0 &&
+                        typeof repository === "string" &&
+                        Buffer.byteLength(repository, "utf8") <= MAX_REPOSITORY_BYTES &&
+                        /^[^/\s]+\/[^/\s]+$/u.test(repository)) {
+                        projectionLimitExceeded = true;
+                    }
+                    else {
+                        malformedLines += 1;
+                    }
+                }
+            }
+        }
+        catch {
+            return { ok: false, reason: "UNREADABLE" };
+        }
+        let after;
+        try {
+            after = await handle.stat({ bigint: true });
+        }
+        catch {
+            return { ok: false, reason: "UNREADABLE" };
+        }
+        if (!sameIdentity(identityOf(after), entry.identity)) {
+            return { ok: false, reason: "REPLACED" };
+        }
+        if (after.size !== before.size ||
+            after.mtimeNs !== before.mtimeNs ||
+            after.ctimeNs !== before.ctimeNs ||
+            digest.digest("hex") !== entry.sha256) {
+            return { ok: false, reason: "CHANGED" };
+        }
+        let pathnameAfter;
+        try {
+            pathnameAfter = await fs.promises.stat(entry.path, { bigint: true });
+        }
+        catch (error) {
+            return { ok: false, reason: classifyReadError(error) };
+        }
+        if (!sameIdentity(identityOf(pathnameAfter), entry.identity)) {
+            return { ok: false, reason: "REPLACED" };
+        }
+        if (pathnameAfter.size.toString() !== entry.identity.size) {
+            return { ok: false, reason: "CHANGED" };
+        }
+        if (projectionLimitExceeded) {
+            return { ok: false, reason: "LIMIT_EXCEEDED" };
+        }
+        return { ok: true, projection: { links, branchKeys, malformedLines } };
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}

package/dist/evidence/r3/types.js

@@ -0,0 +1,4 @@
+export const R3_RUNNER_VERSION = "r3-u4-runner-v1";
+export const R3_PACKET_VERSION = "r3-u4-blinded-v1";
+export const R3_SCORER_VERSION = "r3-u4-score-v1";
+export const R3_REASON_VOCABULARY_VERSION = "r3-shadow-reasons-v1";

package/dist/hook/context-budget-hook.mjs

@@ -0,0 +1,138 @@
+/**
+ * Fail-open Claude Code PreToolUse hook for AgentWrangler context budgets.
+ * It intentionally has no package dependencies, never exits non-zero, and never
+ * denies a tool call — both thresholds are warn-only (a deny at the hard threshold
+ * would block the very checkpoint/clear it prescribes).
+ */
+
+import * as fs from "node:fs";
+import * as http from "node:http";
+import * as os from "node:os";
+import * as path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const REQUEST_TIMEOUT_MS = 500;
+const SOFT_DEBOUNCE_MS = 60_000;
+
+/** Convert an endpoint stage to the only hook output it may emit. */
+export function stageToStdout(stage) {
+  if (stage === "hard") {
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        permissionDecisionReason: "Context budget at its urgent threshold.",
+      },
+      additionalContext:
+        "Context budget is at its urgent threshold. Checkpoint now, then run /clear.",
+      systemMessage:
+        "AgentWrangler: context budget at its urgent threshold. Checkpoint now, then run /clear.",
+    });
+  }
+  if (stage === "soft") {
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        permissionDecisionReason: "Context budget approaching its limit.",
+      },
+      additionalContext:
+        "Context budget is approaching its limit. Checkpoint, then run /clear or /compact soon.",
+      systemMessage:
+        "AgentWrangler: context budget is approaching its limit. Checkpoint, then run /clear or /compact soon.",
+    });
+  }
+  return "";
+}
+
+function markerPath(sessionId) {
+  const markerRoot =
+    process.env.AW_HOOK_MARKER_DIR ?? path.join(os.homedir(), ".agentwrangler", "hook-markers");
+  return path.join(markerRoot, `context-budget-${encodeURIComponent(sessionId)}.marker`);
+}
+
+function shouldEmitSoft(sessionId) {
+  const file = markerPath(sessionId);
+  const now = Date.now();
+  try {
+    const previous = Number(fs.readFileSync(file, "utf8"));
+    if (Number.isFinite(previous) && now - previous < SOFT_DEBOUNCE_MS) return false;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, String(now), { encoding: "utf8", mode: 0o600 });
+    return true;
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") {
+      try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, String(now), { encoding: "utf8", mode: 0o600 });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return false;
+  }
+}
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let raw = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      raw += chunk;
+    });
+    process.stdin.on("end", () => resolve(raw));
+    process.stdin.on("error", reject);
+  });
+}
+
+function fetchBudget(sessionId) {
+  return new Promise((resolve, reject) => {
+    const port = process.env.AW_PORT ?? "47821";
+    const request = http.get(
+      `http://127.0.0.1:${port}/api/context-budget?session_id=${encodeURIComponent(sessionId)}`,
+      (response) => {
+        if (response.statusCode !== 200) {
+          response.resume();
+          reject(new Error("non-200 response"));
+          return;
+        }
+        let raw = "";
+        response.setEncoding("utf8");
+        response.on("data", (chunk) => {
+          raw += chunk;
+        });
+        response.on("end", () => {
+          try {
+            const body = JSON.parse(raw);
+            resolve(body?.data);
+          } catch {
+            reject(new Error("invalid response"));
+          }
+        });
+      },
+    );
+    request.setTimeout(REQUEST_TIMEOUT_MS, () => request.destroy(new Error("timeout")));
+    request.on("error", reject);
+  });
+}
+
+async function main() {
+  try {
+    const input = JSON.parse(await readStdin());
+    const sessionId = input?.session_id;
+    if (typeof sessionId !== "string" || sessionId.length === 0) return;
+    const budget = await fetchBudget(sessionId);
+    const stage = budget?.stage;
+    if (stage === "soft" && !shouldEmitSoft(sessionId)) return;
+    const output = stageToStdout(stage);
+    if (output) process.stdout.write(output);
+  } catch {
+    // Hooks must never block Claude Code if AgentWrangler is unavailable.
+  }
+}
+
+const invoked =
+  process.argv[1] !== undefined && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (invoked) void main();

package/dist/hook/danger-guard-denylist.json

@@ -0,0 +1,27 @@
+{
+  "_comment": "AgentWrangler dangerous-command guard deny-list. Extend this file directly; it is data, not code. Each rule has a `pattern` (a JavaScript RegExp source, tested against the Bash command) and a static `reason` (never the command text). `deny` = hard-block via permissionDecision:deny (bypass-mode-proof); `ask` = prompt for confirmation. Deny is checked before ask. An invalid regex or bad shape makes the whole file fall back to the embedded baseline in danger-guard-hook.mjs (fail-closed on the deny tier).",
+  "deny": [
+    {
+      "pattern": "(?:^|[\\s;&|(])rm\\s+(?:-\\S*\\s+)*-\\S*r\\S*\\s+(?:[^;&|]*\\s)?(?:/|~|\\$HOME)(?:\\s|/|\\*|$)",
+      "reason": "recursive delete targeting your home directory or the filesystem root"
+    },
+    {
+      "pattern": "git\\s+push\\b(?=[^;&|]*(?:--force|-f)\\b)(?=[^;&|]*\\b(?:main|master)\\b)",
+      "reason": "force-push to a protected branch (main/master)"
+    },
+    {
+      "pattern": "\\b(?:curl|wget)\\b[^;&|]*\\|\\s*(?:sudo\\s+)?(?:sh|bash|zsh|dash|ksh)\\b",
+      "reason": "piping a downloaded script straight into a shell"
+    }
+  ],
+  "ask": [
+    {
+      "pattern": "(?:^|[\\s;&|(])rm\\s+(?:-\\S*\\s+)*-\\S*r\\S*\\b",
+      "reason": "recursive delete — confirm the target before running"
+    },
+    {
+      "pattern": "git\\s+push\\b(?=[^;&|]*(?:--force|-f)\\b)",
+      "reason": "force-push — confirm the branch before running"
+    }
+  ]
+}