arkgate 4.8.22 → 4.8.24

package/bin/lib/flat-parent-pilot.mjs

@@ -0,0 +1,192 @@
+/**
+ * Doctor suggestion: a universe-level flat file that one child slice imports.
+ * Advisory only. Not a finding, not a verdict, not a config field.
+ */
+import {
+  findDeniedEdgeDecision,
+  layerForRelativePath,
+  resolveGovernedSlice,
+  sliceAliasDestination,
+  sliceIdForPath,
+} from '../ark-layer-match.mjs';
+import { destinationKeepsLayerAndSlice } from './physical-cohesion.mjs';
+import { flatParentImporterGraph } from './flat-parent-importers.mjs';
+
+function ruleKey(rule) {
+  const child = rule?.childSlices;
+  if (!child?.sliceFolders?.length) return '';
+  return [
+    (rule.sliceFolders ?? []).join('\0'),
+    rule.sliceIdentity ?? '',
+    child.sliceFolders.join('\0'),
+    child.sliceIdentity ?? '',
+    (child.commonFolders ?? []).join('\0'),
+  ].join('\n');
+}
+
+function distinctChildRules(rules) {
+  const out = [];
+  const seen = new Set();
+  for (const rule of Array.isArray(rules) ? rules : []) {
+    const key = ruleKey(rule);
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    out.push(rule);
+  }
+  return out;
+}
+
+function isFlatParent(rel, rule) {
+  const universe = sliceIdForPath(rel, rule.sliceFolders, rule.sliceIdentity);
+  const raw = sliceIdForPath(rel, rule.childSlices.sliceFolders, rule.childSlices.sliceIdentity);
+  return Boolean(universe && raw && raw.toLowerCase() === universe.toLowerCase());
+}
+
+/**
+ * Importers of each flat file, split by child. A file any non-child imports
+ * (universe common, a shared root, another universe, another layer) is marked:
+ * moving it into one child would turn that edge into a wall deny.
+ */
+function childImporters(flatFiles, graph, rule) {
+  const out = new Map();
+  for (const target of flatFiles) {
+    const universe = resolveGovernedSlice(target, rule).universeId ?? '';
+    const ids = new Set();
+    let nonChild = false;
+    for (const importer of graph.get(target) ?? []) {
+      const place = resolveGovernedSlice(importer, rule);
+      if (!place.childId || (place.universeId ?? '') !== universe) nonChild = true;
+      else ids.add(place.childId);
+    }
+    out.set(target, { ids, nonChild, importers: [...(graph.get(target) ?? [])] });
+  }
+  return out;
+}
+
+/** Would any recorded importer be denied by the rules after the move? */
+function moveBreaksWall(importers, destFile, rules, layers) {
+  const toLayer = layerForRelativePath(destFile, layers);
+  for (const importer of importers) {
+    const fromLayer = layerForRelativePath(importer, layers);
+    if (!fromLayer || !toLayer) return true;
+    const denied = findDeniedEdgeDecision(rules, fromLayer, toLayer, {
+      fromPath: importer,
+      toPath: destFile,
+      layers,
+    });
+    if (denied) return true;
+  }
+  return false;
+}
+
+function basename(rel) {
+  const parts = rel.split('/');
+  return parts[parts.length - 1] ?? rel;
+}
+
+/**
+ * @param {{ root: string, files: string[], rules: object[] | undefined, layers: object[] | undefined, facts?: object, ts?: object }} input
+ * @returns {object | null}
+ */
+export function collectFlatParentPilot(input) {
+  const rules = distinctChildRules(input?.rules);
+  if (rules.length === 0) return null;
+  const files = (Array.isArray(input.files) ? input.files : [])
+    .map((file) => String(file).replace(/\\/g, '/'))
+    .filter((file) => file.length > 0);
+  const layers = input.layers;
+  const moves = [];
+  const seen = new Set();
+  let graph = null;
+  for (const rule of rules) {
+    const flat = files.filter((file) => isFlatParent(file, rule));
+    if (flat.length === 0) continue;
+    graph ??= flatParentImporterGraph({ root: input.root, files, facts: input.facts, ts: input.ts });
+    const importers = childImporters(flat, graph, rule);
+    for (const file of flat) {
+      if (seen.has(file)) continue;
+      const entry = importers.get(file);
+      // Exactly one child and nobody else: two children, or any non-child importer, keeps it in place.
+      if (!entry || entry.nonChild || entry.ids.size !== 1) continue;
+      const importer = [...entry.ids][0];
+      const destination = sliceAliasDestination(file, importer, rule.childSlices);
+      if (!destination) continue;
+      const destFile = `${destination}/${basename(file)}`;
+      const layer = layerForRelativePath(file, layers);
+      if (!layer || layer !== layerForRelativePath(destFile, layers)) continue;
+      const toPlace = resolveGovernedSlice(destFile, rule);
+      if ((toPlace.childId ?? '') !== importer) continue;
+      if (moveBreaksWall(entry.importers, destFile, input.rules, layers)) continue;
+      const fromPlace = resolveGovernedSlice(file, rule);
+      const keepsSlice = destinationKeepsLayerAndSlice(file, destFile, layers, [rule]);
+      const wallSame =
+        (fromPlace.universeId ?? '') === (toPlace.universeId ?? '') &&
+        (fromPlace.childId ?? '') === (toPlace.childId ?? '');
+      seen.add(file);
+      moves.push({
+        file,
+        importer,
+        destination,
+        layer,
+        keepsLayer: true,
+        keepsSlice,
+        destinationChild: toPlace.childId,
+        agreesWithWall: keepsSlice === wallSame,
+        evidence: `One child imports ${file} (${importer}). Move it into ${destination}. The ${layer} layer stays. This is a suggestion with that importer as its evidence.`,
+      });
+    }
+  }
+  if (moves.length === 0) return null;
+  moves.sort((left, right) => (left.file < right.file ? -1 : left.file > right.file ? 1 : 0));
+  return {
+    advisory: true,
+    notAScore: true,
+    proposed: true,
+    applied: false,
+    neverMechanicalSafe: true,
+    moves,
+  };
+}
+
+/** One pilot candidate per move. Appended after pattern bets and the reshape card. */
+export function flatParentCandidates(section) {
+  if (!section || !Array.isArray(section.moves)) return [];
+  return section.moves
+    .filter((move) => move && typeof move.file === 'string' && move.file.length > 0)
+    .map((move) => ({
+      source: 'flat-parent',
+      target: move.file,
+      move: typeof move.evidence === 'string' ? move.evidence : `Move ${move.file} into its one importing child. This is a suggestion.`,
+      moveSample: [{ from: move.file, to: `${move.destination}/${basename(move.file)}` }],
+      successSignal: 're-run doctor: this file is no longer a single-importer flat parent',
+      killSwitch: 'leave the file where it is',
+      doNot: [
+        'a suggestion with one importer as its evidence',
+        'leave a file in place when two children import it',
+        'one pilot at a time; re-doctor before the next card',
+        'never weaken the contract to make a move pass',
+      ],
+    }));
+}
+
+export function printFlatParentPilot(section, io) {
+  const moves = Array.isArray(section?.moves) ? section.moves : [];
+  if (moves.length === 0) return;
+  console.log('');
+  console.log(io.color.bold('Flat parent files (suggestion)'));
+  for (const move of moves.slice(0, 5)) io.line(io.warn, move.evidence);
+  if (moves.length > 5) io.line(' ', io.color.dim(`…(+${moves.length - 5} more in doctor JSON)`));
+  io.line(' ', io.color.dim('suggestion only — one importer is the evidence; the gate verdict is unchanged'));
+}
+
+export function flatParentPilotHtml(section, escape) {
+  const moves = Array.isArray(section?.moves) ? section.moves : [];
+  if (moves.length === 0) return '';
+  const esc = typeof escape === 'function' ? escape : (value) => String(value);
+  const items = moves
+    .slice(0, 5)
+    .map((move) => `<li>${esc(move.evidence ?? '')}</li>`)
+    .join('');
+  const more = moves.length > 5 ? `<p class="muted">…(+${moves.length - 5} more in doctor JSON)</p>` : '';
+  return `<section class="section card" data-advisory="flatParentPilot"><h2>Flat parent files <span class="muted">(suggestion — one importer is the evidence; not a score; the verdict is unchanged)</span></h2><ul>${items}</ul>${more}</section>`;
+}

package/bin/lib/gate-files.mjs

@@ -3,9 +3,11 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { codexProjectMcpIsValid } from './codex-home.mjs';
 import { enforcingArkRunText, runsArkCheck } from './github-enforcement.mjs';
+import { npxArkgatePrefixLength } from './package-manager.mjs';
 
 export const __packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 export const __arkCheckCli = path.join(__packageRoot, 'bin', 'ark-check.mjs');
@@ -86,10 +88,27 @@ export function treeHasTypecheckScript(root) {
  * @param {{ write?: boolean }} [opts]
  * @returns {{
  *   changed: boolean,
- *   reason: 'added' | 'already' | 'no-tsconfig' | 'no-package-json',
+ *   reason: 'added' | 'already' | 'no-tsconfig' | 'no-package-json' | 'no-typescript',
  *   script?: string,
  * }}
  */
+/**
+ * True when `typescript` is declared by the project (deps/devDeps/peerDeps) or resolves
+ * from its root (e.g. hoisted in a workspace), so a generated `tsc --noEmit` can run.
+ */
+export function projectHasTypeScript(root, pkg = readPackageJson(root) || {}) {
+  for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+    const deps = pkg?.[field];
+    if (deps && typeof deps === 'object' && Object.hasOwn(deps, 'typescript')) return true;
+  }
+  try {
+    createRequire(path.join(root, 'package.json')).resolve('typescript/package.json');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function ensureTypecheckScript(root, opts = {}) {
   const write = opts.write !== false;
   const hasTsconfig =
@@ -105,6 +124,8 @@ export function ensureTypecheckScript(root, opts = {}) {
   }
 
   const pkg = readPackageJson(root) || {};
+  // `tsc` only exists when typescript resolves — otherwise CI fails with `tsc: not found`.
+  if (!projectHasTypeScript(root, pkg)) return { changed: false, reason: 'no-typescript' };
   const scripts =
     pkg.scripts && typeof pkg.scripts === 'object' ? { ...pkg.scripts } : {};
   const script = 'tsc --noEmit';
@@ -194,7 +215,10 @@ function arkMcpArgs(server) {
   const isArkBin = (value) => /^(?:arkgate-mcp|ark-mcp)(?:\.mjs)?$/.test(executableName(value));
   if ([server.command, ...args].filter(isArkBin).length !== 1) return null;
   if (isArkBin(server.command)) return args;
-  if ((command === 'npx' || command === 'yarn') && isArkBin(args[0])) return args.slice(1);
+  const npxPrefix = command === 'npx' ? npxArkgatePrefixLength(args) : 0;
+  if ((command === 'npx' || command === 'yarn') && isArkBin(args[npxPrefix])) {
+    return args.slice(npxPrefix + 1);
+  }
   if (command === 'pnpm') {
     const binIndex =
       args[0] === 'exec'
@@ -285,6 +309,9 @@ export function hasArkMcpRegistration(root, relativePath = '.mcp.json') {
  */
 export const MCP_JSON_GATE_FILES = ['.mcp.json', '.cursor/mcp.json', '.agents/mcp_config.json'];
 
+/** Claude-style hook files: Ark SessionStart/PreToolUse groups are merged, never whole-file replaced. */
+export const CLAUDE_STYLE_HOOK_FILES = ['.claude/settings.json', '.codex/hooks.json'];
+
 /**
  * Upsert mcpServers.ark into an existing MCP JSON document.
  * Preserves sibling servers and unknown top-level keys. Returns null if unreadable.

package/bin/lib/git-change-scope.mjs

@@ -0,0 +1,109 @@
+/**
+ * Git plumbing for diff-scoped checks (`--changed`, `--local`, `--against`, `--persona`).
+ *
+ * Every path this module returns or reads is relative to the Ark ROOT (the `-C` directory),
+ * never to the repository top level, so a package inside a monorepo sees its own files:
+ *   - `git diff --relative` strips the package prefix and drops paths outside the root;
+ *   - `git ls-files --others` is already cwd-relative;
+ *   - `<ref>:./<path>` makes `git show` resolve from the root instead of the top level.
+ * Output is NUL-separated (`-z`) so core.quotePath never C-quotes a non-ASCII name.
+ * Every listing is checked: a failed or truncated call is an error, never an empty diff.
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+
+/** Kill hung git instead of stalling CI. */
+export const SPAWN_TIMEOUT_MS = 8000;
+/** Same ceiling as design-delta: a large untracked tree must not overflow the default 1 MiB. */
+export const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+
+/** Refs tried, in order, when no `--base` / `--against` is given. */
+export const TEAM_BASE_CANDIDATES = Object.freeze([
+  'origin/dev',
+  'origin/main',
+  'origin/master',
+  'dev',
+  'main',
+  'master',
+]);
+
+export function runGit(cwd, args) {
+  return spawnSync('git', ['-C', cwd, '-c', 'core.quotePath=false', ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: SPAWN_TIMEOUT_MS,
+    maxBuffer: GIT_MAX_BUFFER,
+  });
+}
+
+export function safeGitRef(value) {
+  return (
+    typeof value === 'string' &&
+    /^[A-Za-z0-9][A-Za-z0-9._/-]{0,200}$/.test(value) &&
+    !value.includes('..')
+  );
+}
+
+export function discoverTeamBaseRef(root, preferred) {
+  if (safeGitRef(preferred)) return preferred;
+  for (const candidate of TEAM_BASE_CANDIDATES) {
+    const exists = runGit(root, ['rev-parse', '--verify', `${candidate}^{commit}`]);
+    if (exists.status === 0) return candidate;
+  }
+  return null;
+}
+
+function gitFailure(label, result) {
+  if (result.error) return `git ${label} failed: ${result.error.code || result.error.message}`;
+  if (result.status !== 0) {
+    const detail = String(result.stderr || '').trim();
+    return `git ${label} failed${detail ? `: ${detail}` : ` (status ${result.status})`}`;
+  }
+  return null;
+}
+
+/**
+ * Root-relative paths changed vs `baseRef` (committed since the merge base, staged,
+ * unstaged, untracked). Fails closed: any git failure returns `ok: false`.
+ */
+export function listChangedPaths(root, baseRef) {
+  if (!safeGitRef(baseRef)) {
+    return { ok: false, paths: [], error: 'Invalid or missing git base ref.' };
+  }
+  const verify = runGit(root, ['rev-parse', '--verify', `${baseRef}^{commit}`]);
+  if (verify.status !== 0) {
+    return { ok: false, paths: [], error: `Cannot resolve git ref ${baseRef}.` };
+  }
+  const calls = [
+    [`diff ${baseRef}...HEAD`, ['diff', '--relative', '--name-only', '-z', `${baseRef}...HEAD`]],
+    ['diff (unstaged)', ['diff', '--relative', '--name-only', '-z']],
+    ['diff --cached', ['diff', '--relative', '--name-only', '-z', '--cached']],
+    ['ls-files --others', ['ls-files', '-z', '--others', '--exclude-standard']],
+  ];
+  const paths = [];
+  for (const [label, gitArgs] of calls) {
+    const result = runGit(root, gitArgs);
+    const failure = gitFailure(label, result);
+    if (failure) return { ok: false, paths: [], error: failure };
+    paths.push(...String(result.stdout).split('\0'));
+  }
+  return { ok: true, paths: [...new Set(paths.filter(Boolean))].sort(), error: null };
+}
+
+/** Root-relative form of `relPath` for a `<ref>:./<path>` spec; null when outside the root. */
+export function rootRelativeGitPath(root, relPath) {
+  if (typeof relPath !== 'string' || !relPath) return null;
+  const rel = path.isAbsolute(relPath) ? path.relative(path.resolve(root), relPath) : relPath;
+  const normalized = path.posix.normalize(rel.split(path.sep).join('/'));
+  if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../')) return null;
+  return normalized.replace(/^\.\//, '');
+}
+
+/** File text at `baseRef`, resolved relative to the Ark root (not the repo top level). */
+export function gitShowText(root, baseRef, relPath) {
+  const rel = rootRelativeGitPath(root, relPath);
+  if (!safeGitRef(baseRef) || !rel) return null;
+  const shown = runGit(root, ['show', `${baseRef}:./${rel}`]);
+  if (shown.error || shown.status !== 0) return null;
+  return shown.stdout;
+}

package/bin/lib/github-enforcement.mjs

@@ -22,7 +22,7 @@ const SAFE_IF = /^(?:['"]?true['"]?|['"]?\$\{\{\s*(?:true|always\(\))\s*\}\}['"]
 const SAFE_NEEDS_IF = /^['"]?\$\{\{\s*always\(\)\s*\}\}['"]?$/i;
 const SAFE_CONTINUE = /^['"]?false['"]?$/i;
 const ENV_PREFIX = /^(?:(?:env\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S+)\s+)*)/;
-const DIRECT_ARK = /^(?:(?:npx|yarn)\s+(?:arkgate-check|ark-check)(?=\s|$)|pnpm(?:\s+--\S+)*\s+exec\s+(?:arkgate-check|ark-check)(?=\s|$)|node\s+(?:\S+\/)?bin\/(?:arkgate-check|ark-check)\.mjs(?=\s|$)|(?:arkgate-check|ark-check)(?=\s|$))/;
+const DIRECT_ARK = /^(?:(?:npx(?:\s+(?:-y|--yes))?(?:\s+(?:-p\s+|--package[\s=])arkgate(?:@\S+)?)?|yarn)\s+(?:arkgate-check|ark-check)(?=\s|$)|pnpm(?:\s+--\S+)*\s+exec\s+(?:arkgate-check|ark-check)(?=\s|$)|node\s+(?:\S+\/)?bin\/(?:arkgate-check|ark-check)\.mjs(?=\s|$)|(?:arkgate-check|ark-check)(?=\s|$))/;
 const CHECK_SCRIPT = /^(?:(?:npm|pnpm)\s+run\s+check:architecture(?=\s|$)|yarn(?:\s+run)?\s+check:architecture(?=\s|$))/;
 const FAIL_CLOSED = /(?:^|\s)--(?:strict|strict-merge|require-gates)(?=\s|$)/;
 

package/bin/lib/hook-templates.mjs

@@ -1,22 +1,24 @@
 // Generated from hook-templates.source.mjs — run npm run generate:packaged-tooling.
-import{execCommandParts as l,execRunner as i}from"../ark-shared.mjs";const s="arkgate-mcp";function h(e){const r=i(e);return`${JSON.stringify({version:1,hooks:{preToolUse:[{command:`${r} ${s} --hook --hook-repair --fail-on-new-smells --root . --root-env CURSOR_PROJECT_DIR --config ark.config.json`,matcher:"Write|StrReplace",failClosed:!0,timeout:30}]}},null,2)}
-`}function y(e){const r=i(e);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",command:`${r} ${s} --session-context --root . --root-env CLAUDE_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit",hooks:[{type:"command",command:`${r} ${s} --hook --hook-repair --fail-on-new-smells --root . --root-env CLAUDE_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
-`}function $(e){const r=i(e);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${r} ${s} --session-context --root . --root-env CODEX_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"ApplyPatch|apply_patch|Write|Edit|MultiEdit",hooks:[{type:"command",timeout:30,command:`${r} ${s} --hook --hook-repair --fail-on-new-smells --root . --root-env CODEX_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
-`}function O(e){const{command:r,args:o}=l(e,s,["--root",".","--config","ark.config.json"]),t=a=>a.replace(/\\/g,"\\\\").replace(/"/g,'\\"'),c=o.map(a=>`"${t(a)}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Codex project scope).
+import{execCommandParts as d,execRunner as g}from"../ark-shared.mjs";const p="arkgate-mcp";function S(r){const t=g(r);return`${JSON.stringify({version:1,hooks:{preToolUse:[{command:`${t} ${p} --hook --hook-repair --fail-on-new-smells --root . --root-env CURSOR_PROJECT_DIR --config ark.config.json`,matcher:"Write|StrReplace",failClosed:!0,timeout:30}]}},null,2)}
+`}function R(r){const t=g(r);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",command:`${t} ${p} --session-context --root . --root-env CLAUDE_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit",hooks:[{type:"command",command:`${t} ${p} --hook --hook-repair --fail-on-new-smells --root . --root-env CLAUDE_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
+`}function _(r){const t=g(r);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${t} ${p} --session-context --root . --root-env CODEX_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"ApplyPatch|apply_patch|Write|Edit|MultiEdit",hooks:[{type:"command",timeout:30,command:`${t} ${p} --hook --hook-repair --fail-on-new-smells --root . --root-env CODEX_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
+`}function C(r){const{command:t,args:o}=d(r,p,["--root",".","--config","ark.config.json"]),e=n=>n.replace(/\\/g,"\\\\").replace(/"/g,'\\"'),s=o.map(n=>`"${e(n)}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Codex project scope).
 # CONFIGURED ON DISK \u2014 RUNTIME NOT VERIFIED.
 # Restart Codex, then call ark_identity with expectedRoot before trusting MCP verdicts.
 [mcp_servers.ark]
-command = "${t(r)}"
-args = [${c}]
-`}function R(e){const{command:r,args:o}=l(e,s,["--root",".","--config","ark.config.json"]),t=o.map(c=>`"${c.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Grok Build project scope).
+command = "${e(t)}"
+args = [${s}]
+`}function E(r){const{command:t,args:o}=d(r,p,["--root",".","--config","ark.config.json"]),e=o.map(s=>`"${s.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`).join(", ");return`# Generated by ark-check --install-agent-gates (Grok Build project scope).
 # Restart Grok (or /mcps \u2192 refresh) after changes. Also loads repo-root .mcp.json.
 [mcp_servers.ark]
-command = "${r.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"
-args = [${t}]
-`}function _(e){const r=i(e);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${r} ${s} --session-context --root . --root-env GROK_WORKSPACE_ROOT,CLAUDE_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit|write|search_replace",hooks:[{type:"command",timeout:30,command:`${r} ${s} --hook --hook-repair --fail-on-new-smells --root . --root-env GROK_WORKSPACE_ROOT,CLAUDE_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
-`}function A(e){const r=i(e);return`${JSON.stringify({"ark-write-gate":{PreToolUse:[{matcher:"write_to_file|replace_file_content|multi_replace_file_content",hooks:[{type:"command",timeout:30,command:`${r} ${s} --hook --hook-repair --fail-on-new-smells --root . --config ark.config.json`}]}]}},null,2)}
-`}function j(e){const{command:r,args:o}=l(e,s,["--root",".","--config","ark.config.json"]);return`${JSON.stringify({$schema:"https://opencode.ai/config.json",mcp:{ark:{type:"local",command:[r,...o],enabled:!0}}},null,2)}
-`}function E(e,r){let o,t;try{o=e&&e.trim()?JSON.parse(e):{},t=JSON.parse(r)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o)||!t||typeof t!="object"||Array.isArray(t))return null;const c=t.hooks,p=(Array.isArray(c?.preToolUse)?c.preToolUse:[]).find(n=>n&&typeof n=="object"&&typeof n.command=="string"&&/arkgate-mcp|ark-mcp/.test(n.command)&&/\s--hook(?:\s|$)/.test(` ${n.command} `));if(!p)return null;const m=o.hooks&&typeof o.hooks=="object"&&!Array.isArray(o.hooks)?{...o.hooks}:{},f=Array.isArray(m.preToolUse)?[...m.preToolUse]:[],k=n=>n&&typeof n=="object"&&typeof n.command=="string"&&/arkgate-mcp|ark-mcp/.test(n.command)&&/\s--hook(?:\s|$)/.test(` ${n.command} `)&&(typeof n.matcher!="string"||/Write/.test(n.matcher)||/StrReplace/.test(n.matcher)),g=f.filter(n=>!k(n));m.preToolUse=[...g,p];const u={...o,version:o.version??t.version??1,hooks:m};return`${JSON.stringify(u,null,2)}
-`}function S(e,r){let o,t;try{o=e&&e.trim()?JSON.parse(e):{},t=JSON.parse(r)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o)||!t||typeof t!="object"||Array.isArray(t))return null;const c=t["ark-write-gate"];if(!c||typeof c!="object")return null;const a={...o,"ark-write-gate":c};return`${JSON.stringify(a,null,2)}
-`}function C(e,r){let o,t;try{o=e&&e.trim()?JSON.parse(e):{},t=JSON.parse(r)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o))return null;const c={...o};!c.$schema&&t.$schema&&(c.$schema=t.$schema);const a=o.mcp&&typeof o.mcp=="object"&&!Array.isArray(o.mcp)?{...o.mcp}:{};return a.ark=t.mcp.ark,c.mcp=a,`${JSON.stringify(c,null,2)}
-`}export{s as PREFERRED_MCP_BIN,A as antigravityHooks,y as claudeSettings,$ as codexHooks,O as codexProjectConfig,h as cursorHooks,_ as grokHooks,R as grokProjectConfig,S as mergeAntigravityArkHook,E as mergeCursorArkHook,C as mergeOpencodeArkMcp,j as opencodeProjectConfig};
+command = "${t.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"
+args = [${e}]
+`}function v(r){const t=g(r);return`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:"command",timeout:30,command:`${t} ${p} --session-context --root . --root-env GROK_WORKSPACE_ROOT,CLAUDE_PROJECT_DIR --config ark.config.json`}]}],PreToolUse:[{matcher:"Write|Edit|MultiEdit|write|search_replace",hooks:[{type:"command",timeout:30,command:`${t} ${p} --hook --hook-repair --fail-on-new-smells --root . --root-env GROK_WORKSPACE_ROOT,CLAUDE_PROJECT_DIR --config ark.config.json`}]}]}},null,2)}
+`}function J(r){const t=g(r);return`${JSON.stringify({"ark-write-gate":{PreToolUse:[{matcher:"write_to_file|replace_file_content|multi_replace_file_content",hooks:[{type:"command",timeout:30,command:`${t} ${p} --hook --hook-repair --fail-on-new-smells --root . --config ark.config.json`}]}]}},null,2)}
+`}function N(r){const{command:t,args:o}=d(r,p,["--root",".","--config","ark.config.json"]);return`${JSON.stringify({$schema:"https://opencode.ai/config.json",mcp:{ark:{type:"local",command:[t,...o],enabled:!0}}},null,2)}
+`}function x(r,t){let o,e;try{o=r&&r.trim()?JSON.parse(r):{},e=JSON.parse(t)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o)||!e||typeof e!="object"||Array.isArray(e))return null;const s=e.hooks,k=(Array.isArray(s?.preToolUse)?s.preToolUse:[]).find(a=>a&&typeof a=="object"&&typeof a.command=="string"&&/arkgate-mcp|ark-mcp/.test(a.command)&&/\s--hook(?:\s|$)/.test(` ${a.command} `));if(!k)return null;const u=o.hooks&&typeof o.hooks=="object"&&!Array.isArray(o.hooks)?{...o.hooks}:{},l=Array.isArray(u.preToolUse)?[...u.preToolUse]:[],f=a=>a&&typeof a=="object"&&typeof a.command=="string"&&/arkgate-mcp|ark-mcp/.test(a.command)&&/\s--hook(?:\s|$)/.test(` ${a.command} `)&&(typeof a.matcher!="string"||/Write/.test(a.matcher)||/StrReplace/.test(a.matcher)),c=l.filter(a=>!f(a));u.preToolUse=[...c,k];const i={...o,version:o.version??e.version??1,hooks:u};return`${JSON.stringify(i,null,2)}
+`}const O=/(?:^|[\s/])(?:arkgate-mcp|ark-mcp)(?:\.mjs)?(?:\s|$)/,j=/\s--(?:hook|session-context)(?:\s|$)/;function A(r){return!!r&&typeof r=="object"&&typeof r.command=="string"&&O.test(` ${r.command} `)&&j.test(` ${r.command} `)}function P(r,t){let o,e;try{o=r&&r.trim()?JSON.parse(r):{},e=JSON.parse(t)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o)||!e||typeof e!="object"||Array.isArray(e))return null;const s=e.hooks;if(!s||typeof s!="object"||o.hooks!==void 0&&(!o.hooks||typeof o.hooks!="object"||Array.isArray(o.hooks)))return null;const n={...o.hooks??{}};for(const[k,u]of Object.entries(s)){if(!Array.isArray(u))continue;const l=n[k];if(l!==void 0&&!Array.isArray(l))return null;const f=[];for(const c of l??[]){if(!c||typeof c!="object"||!Array.isArray(c.hooks)){f.push(c);continue}const i=c.hooks.filter(a=>!A(a));i.length===c.hooks.length?f.push(c):i.length>0&&f.push({...c,hooks:i})}n[k]=[...f,...u]}return`${JSON.stringify({...o,hooks:n},null,2)}
+`}function m(r){const t=o=>typeof o=="string"?o.replace(/arkgate@[^\s"']+/g,"arkgate@*"):Array.isArray(o)?o.map(t):o&&typeof o=="object"?Object.fromEntries(Object.keys(o).sort().map(e=>[e,t(o[e])])):o;return JSON.stringify(t(r))}function h(r,t){try{const o=JSON.parse(r),e=JSON.parse(t);return!o||typeof o!="object"||Array.isArray(o)||!e||typeof e!="object"||Array.isArray(e)?null:{existing:o,generated:e}}catch{return null}}function y(r){return{status:"removed",text:Object.keys(r).length===0?null:`${JSON.stringify(r,null,2)}
+`}}function U(r,t){const o=h(r,t);if(!o)return{status:"unreadable"};const{existing:e,generated:s}=o;if(e.hooks===void 0)return{status:"absent"};if(!e.hooks||typeof e.hooks!="object"||Array.isArray(e.hooks))return{status:"unreadable"};const n={...e.hooks};let k=0;for(const[l,f]of Object.entries(s.hooks??{})){if(!Array.isArray(f)||n[l]===void 0)continue;if(!Array.isArray(n[l]))return{status:"unreadable"};const c=new Set(f.map(m)),i=[];for(const a of n[l]){if(!(a&&typeof a=="object"&&Array.isArray(a.hooks)&&a.hooks.some(A))){i.push(a);continue}if(!c.has(m(a)))return{status:"customized"};k+=1}i.length>0?n[l]=i:delete n[l]}if(k===0)return{status:"absent"};const u={...e,hooks:n};return Object.keys(n).length===0&&delete u.hooks,y(u)}function T(r,t){const o=h(r,t);if(!o)return{status:"unreadable"};const{existing:e,generated:s}=o,n=e.hooks?.preToolUse;if(n===void 0)return{status:"absent"};if(!Array.isArray(n))return{status:"unreadable"};const k=new Set((Array.isArray(s.hooks?.preToolUse)?s.hooks.preToolUse:[]).map(m)),u=[];let l=0;for(const i of n){if(!(i&&typeof i=="object"&&typeof i.command=="string"&&/arkgate-mcp|ark-mcp/.test(i.command)&&/\s--hook(?:\s|$)/.test(` ${i.command} `))){u.push(i);continue}if(!k.has(m(i)))return{status:"customized"};l+=1}if(l===0)return{status:"absent"};const f={...e.hooks};u.length>0?f.preToolUse=u:delete f.preToolUse;const c={...e,hooks:f};return Object.keys(f).length===0&&delete c.hooks,Object.keys(c).length===1&&c.version===(s.version??1)&&delete c.version,y(c)}function D(r,t){const o=h(r,t);if(!o)return{status:"unreadable"};const{existing:e,generated:s}=o;if(!Object.prototype.hasOwnProperty.call(e,"ark-write-gate"))return{status:"absent"};if(m(e["ark-write-gate"])!==m(s["ark-write-gate"]))return{status:"customized"};const n={...e};return delete n["ark-write-gate"],y(n)}function H(r,t){let o,e;try{o=r&&r.trim()?JSON.parse(r):{},e=JSON.parse(t)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o)||!e||typeof e!="object"||Array.isArray(e))return null;const s=e["ark-write-gate"];if(!s||typeof s!="object")return null;const n={...o,"ark-write-gate":s};return`${JSON.stringify(n,null,2)}
+`}function w(r,t){let o,e;try{o=r&&r.trim()?JSON.parse(r):{},e=JSON.parse(t)}catch{return null}if(!o||typeof o!="object"||Array.isArray(o))return null;const s={...o};!s.$schema&&e.$schema&&(s.$schema=e.$schema);const n=o.mcp&&typeof o.mcp=="object"&&!Array.isArray(o.mcp)?{...o.mcp}:{};return n.ark=e.mcp.ark,s.mcp=n,`${JSON.stringify(s,null,2)}
+`}export{p as PREFERRED_MCP_BIN,J as antigravityHooks,R as claudeSettings,_ as codexHooks,C as codexProjectConfig,S as cursorHooks,v as grokHooks,E as grokProjectConfig,H as mergeAntigravityArkHook,P as mergeClaudeStyleArkHooks,x as mergeCursorArkHook,w as mergeOpencodeArkMcp,N as opencodeProjectConfig,D as removeAntigravityArkHook,U as removeClaudeStyleArkHooks,T as removeCursorArkHook};

package/bin/lib/host-support-matrix.mjs

@@ -37,7 +37,9 @@ function hostProfile(label, hookPath, hookSurface, hookOperations, hardWrite, re
     }),
     // Host-native "deny when the checker cannot run" flag (FS-permission analog).
     // required = schema field must be true for hard-write evidence (Cursor failClosed).
-    // unsupported = host has no documented flag; hook-crash behavior is host-owned.
+    // unsupported = host has no documented flag. ark-mcp --hook fails closed itself
+    // (exit 2 / host deny) when its checker cannot run for a governed source write;
+    // only a crash of node itself before the launcher runs stays host-owned.
     // none = advisory host; no local write block.
     nativeFailClosed: extras.nativeFailClosed ?? (hardWrite ? 'unsupported' : 'none'),
     // EH07 minimum ops matrix (hard=false for soft hosts on every listed op).

package/bin/lib/html-report-advisories.mjs

@@ -13,6 +13,7 @@ import { formatRulesUnderContractHtml } from './rules-under-contract.mjs';
 import { formatArkRunHtml } from './ark-run-report.mjs';
 import { formatArkOrderHtml } from './ark-order-report.mjs';
 import { primaryImprovementCompassNextAction } from './improvement-compass.mjs';
+import { flatParentPilotHtml } from './flat-parent-pilot.mjs';
 
 // htmlEscape is injected by the caller (html-report.mjs) — importing it back
 // would be a dependency cycle, and the repo's own gate blocks that. The
@@ -355,6 +356,7 @@ export function renderAdvisorySections(advisories, escape) {
     deepModuleCoachHtml(advisories.deepModuleCoach),
     stewardNudgeHtml(advisories.stewardNudge),
     sliceIdentityHtml(advisories.sliceIdentity),
+    flatParentPilotHtml(advisories.flatParentPilot, esc),
     contractHealthHtml(advisories.contractHealth),
     ambientStateHtml(advisories.ambientState),
     physicalCohesionHtml(advisories.physicalCohesion),

package/bin/lib/html-report-depth.mjs

@@ -28,6 +28,7 @@ import { buildDeepModuleCoachAdvisory } from './deep-module-coach.mjs';
 import { computePhysicalCohesion } from './physical-cohesion.mjs';
 import { computeReshapeDecisionMemory } from './reshape-decisions.mjs';
 import { POST_GREEN_LEDE, operatingModeTitle } from './product-copy.mjs';
+import { anyChildWallAdvisory, anySliceAlias } from '../ark-layer-match.mjs';
 
 function esc(value) {
   return String(value)
@@ -174,7 +175,8 @@ export function buildReportDepthPayload(
       : null,
     primaryNextAction: postGreenPath?.action ?? dualTruthNext,
     activeBlockingViolations: activeBlockingCount,
-    physicalCohesionResidual: physicalCohesionResidualRemains(physicalCohesion),
+    physicalCohesionResidual: physicalCohesionResidualRemains(physicalCohesion), childWallAdvisory: anyChildWallAdvisory(config?.rules),
+    sliceAliasDebt: anySliceAlias(config?.rules),
   });
   // Doctor parity: same physical-cohesion + baseline stale facts as runDoctor.
   const baselineStale =

package/bin/lib/import-resolve.mjs

@@ -56,7 +56,19 @@ export function readTsconfigAliases(ts, root) {
     if (!configPath) return { baseUrl: root, aliases: [] };
     const read = ts.readConfigFile(configPath, ts.sys.readFile);
     if (read.error) return { baseUrl: root, aliases: [] };
-    const parsed = ts.parseJsonConfigFileContent(read.config, ts.sys, path.dirname(configPath));
+    // Options-only parse: `fileNames` are unused here. With the real `ts.sys` the
+    // parser walked the whole `include` tree on every write-hook call (#205 twin).
+    const optionsOnlyHost = {
+      useCaseSensitiveFileNames: ts.sys.useCaseSensitiveFileNames,
+      readDirectory: () => [],
+      fileExists: (fileName) => ts.sys.fileExists(fileName),
+      readFile: (fileName) => ts.sys.readFile(fileName),
+    };
+    const parsed = ts.parseJsonConfigFileContent(
+      read.config,
+      optionsOnlyHost,
+      path.dirname(configPath)
+    );
     const opts = parsed.options || {};
     const baseUrl = opts.baseUrl || path.dirname(configPath);
     const aliases = [];