ashlr-plugin 1.36.4

package/hooks/_nudge-throttle.ts

@@ -0,0 +1,127 @@
+/**
+ * _nudge-throttle.ts — Per-tool nudge throttle for posttooluse-native-nudge.
+ *
+ * Contract: at most 1 missed-save nudge per minute (across all tools) and
+ * at most 1 repeat-offender escalation per minute. State is persisted to
+ * ~/.ashlr/nudge-throttle.json so the limit crosses hook subprocess
+ * boundaries (each PostToolUse invocation is a fresh process).
+ *
+ * Design:
+ *   - Best-effort only. Any I/O error → silent continue (fail open).
+ *   - Kill switch: ASHLR_SESSION_LOG=0 disables nudges.
+ *   - File: ~/.ashlr/nudge-throttle.json — written synchronously so it
+ *     completes before process.exit().
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
+export const THROTTLE_MS = 60_000; // 1 nudge per minute
+export const REPEAT_WINDOW_MS = 10 * 60_000; // 10-minute repeat-offender window
+export const REPEAT_THRESHOLD = 3; // calls before escalation
+
+export interface ThrottleState {
+  /** Epoch ms of the last nudge emitted (any tool). */
+  lastNudgeAt: number;
+  /** Epoch ms of the last repeat-offender escalation. */
+  lastEscalationAt: number;
+  /**
+   * Per-tool call timestamps within the repeat window.
+   * Only tracks native calls that COULD have been redirected.
+   */
+  recentCalls: Record<string, number[]>; // toolName → array of epoch ms
+}
+
+function throttlePath(home: string = process.env.HOME ?? homedir()): string {
+  return join(home, ".ashlr", "nudge-throttle.json");
+}
+
+function readState(home?: string): ThrottleState {
+  try {
+    const p = throttlePath(home);
+    if (!existsSync(p)) {
+      return { lastNudgeAt: 0, lastEscalationAt: 0, recentCalls: {} };
+    }
+    const raw = JSON.parse(readFileSync(p, "utf-8")) as Partial<ThrottleState>;
+    return {
+      lastNudgeAt: typeof raw.lastNudgeAt === "number" ? raw.lastNudgeAt : 0,
+      lastEscalationAt: typeof raw.lastEscalationAt === "number" ? raw.lastEscalationAt : 0,
+      recentCalls: (raw.recentCalls && typeof raw.recentCalls === "object")
+        ? raw.recentCalls as Record<string, number[]>
+        : {},
+    };
+  } catch {
+    return { lastNudgeAt: 0, lastEscalationAt: 0, recentCalls: {} };
+  }
+}
+
+function writeState(state: ThrottleState, home?: string): void {
+  try {
+    const p = throttlePath(home);
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(state), "utf-8");
+  } catch {
+    // Best-effort.
+  }
+}
+
+export interface NudgeDecision {
+  /** Whether to emit a basic missed-save nudge. */
+  emitNudge: boolean;
+  /** Whether to escalate to a repeat-offender message instead. */
+  emitEscalation: boolean;
+  /** How many recent native calls exist for this tool (for escalation message). */
+  recentCallCount: number;
+}
+
+/**
+ * Record a native tool call and decide whether to emit a nudge.
+ *
+ * @param toolName  - e.g. "Read", "Grep", "Edit"
+ * @param now       - injectable for testing (default: Date.now())
+ * @param home      - injectable for testing
+ */
+export function recordNativeCall(
+  toolName: string,
+  now: number = Date.now(),
+  home?: string,
+): NudgeDecision {
+  if (process.env.ASHLR_SESSION_LOG === "0") {
+    return { emitNudge: false, emitEscalation: false, recentCallCount: 0 };
+  }
+
+  const state = readState(home);
+
+  // Prune old entries from recentCalls for this tool.
+  const cutoff = now - REPEAT_WINDOW_MS;
+  const prev = (state.recentCalls[toolName] ?? []).filter((t) => t >= cutoff);
+  prev.push(now);
+  state.recentCalls[toolName] = prev;
+
+  const recentCallCount = prev.length;
+  const timeSinceLastNudge = now - state.lastNudgeAt;
+  const timeSinceLastEscalation = now - state.lastEscalationAt;
+
+  let emitNudge = false;
+  let emitEscalation = false;
+
+  if (recentCallCount >= REPEAT_THRESHOLD && timeSinceLastEscalation >= THROTTLE_MS) {
+    // Repeat offender — escalate.
+    emitEscalation = true;
+    state.lastEscalationAt = now;
+    state.lastNudgeAt = now; // also resets nudge throttle
+  } else if (timeSinceLastNudge >= THROTTLE_MS) {
+    // Simple missed-save nudge.
+    emitNudge = true;
+    state.lastNudgeAt = now;
+  }
+
+  writeState(state, home);
+  return { emitNudge, emitEscalation, recentCallCount };
+}

package/hooks/_recent-blocks.ts

@@ -0,0 +1,127 @@
+/**
+ * _recent-blocks.ts — Lightweight append log for PreToolUse redirect events.
+ *
+ * When a pretooluse-*.ts hook blocks a native tool call (redirect mode), it
+ * appends a small record here so the posttooluse-correlate.ts hook can match
+ * a subsequent ashlr__* tool call and emit `tool_called_after_block`.
+ *
+ * Design constraints:
+ *   - Best-effort only. Failure → silent continue. Never block the hook path.
+ *   - File: ~/.ashlr/recent-blocks.jsonl. Capped at ≤200 entries.
+ *   - recordBlock() is APPEND-ONLY — appendFileSync is POSIX-atomic for
+ *     writes smaller than PIPE_BUF (~512B–4KB). Each JSONL line is ≤200B,
+ *     well inside the threshold, so concurrent hook subprocesses cannot
+ *     interleave bytes. Last-write-wins data loss is eliminated.
+ *     Windows note: NT file writes are also atomic for small sequential
+ *     writes below the page size (4KB). Our lines are ~200B, so the same
+ *     guarantee holds.
+ *   - Truncation (MAX_ENTRIES cap) is deferred to readRecentBlocks() — a
+ *     lazy pruneOldBlocks() that rewrites via atomic rename when the file
+ *     grows past MAX_ENTRIES * 1.5. No write contention on the hot path.
+ *   - Synchronous write (hooks are subprocesses; async write + process.exit
+ *     races unless we use appendFileSync or drain a promise before exit).
+ *   - Kill switch: ASHLR_SESSION_LOG=0 disables all telemetry including this.
+ */
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
+export interface RecentBlock {
+  ts: number;          // Date.now() — epoch ms for fast comparison
+  toolName: string;    // native tool that was blocked, e.g. "Grep"
+  pattern?: string;    // grep pattern / file path hint — for correlation
+  filePath?: string;   // for Read / Edit blocks
+}
+
+const MAX_ENTRIES = 200;
+
+function blocksPath(home: string = process.env.HOME ?? homedir()): string {
+  return join(home, ".ashlr", "recent-blocks.jsonl");
+}
+
+/**
+ * Append one block record. Never throws — all errors are swallowed silently.
+ * Must be synchronous so it completes before the hook calls process.exit().
+ *
+ * Race safety: uses appendFileSync which is atomic for writes < PIPE_BUF
+ * (~512B–4KB on POSIX; ~4KB on Windows). Our JSONL lines are ≤200B.
+ * Concurrent hook subprocesses can all call this simultaneously without
+ * losing records — each append is an independent atomic kernel operation.
+ */
+export function recordBlock(block: RecentBlock): void {
+  if (process.env.ASHLR_SESSION_LOG === "0") return;
+  try {
+    const path = blocksPath();
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, JSON.stringify(block) + "\n", "utf-8");
+  } catch {
+    // Silently swallow — telemetry must never break hook critical path.
+  }
+}
+
+/**
+ * Read the recent blocks log, skip malformed lines, and lazily prune if the
+ * file has grown past MAX_ENTRIES * 1.5. Returns an empty array on any error.
+ * Used by posttooluse-correlate.ts to find matches.
+ *
+ * Pruning uses an atomic rename (write → .tmp, rename) so concurrent readers
+ * never observe a partial file.
+ */
+export function readRecentBlocks(home: string = process.env.HOME ?? homedir()): RecentBlock[] {
+  try {
+    const path = blocksPath(home);
+    if (!existsSync(path)) return [];
+    const lines = readFileSync(path, "utf-8").split("\n").filter((l) => l.trim());
+    const records: RecentBlock[] = [];
+    for (const line of lines) {
+      try {
+        records.push(JSON.parse(line) as RecentBlock);
+      } catch {
+        // Skip malformed lines — guards against partial writes during crashes.
+      }
+    }
+    // Lazy prune: rewrite via atomic rename when file exceeds 1.5× cap.
+    // Caller-side: always slice to last MAX_ENTRIES so the public contract
+    // (≤200 blocks) holds even when the file is in the 200–300 sweet spot
+    // where lazy rewrite hasn't kicked in yet.
+    if (records.length > MAX_ENTRIES * 1.5) {
+      const pruned = records.slice(-MAX_ENTRIES);
+      _atomicRewrite(path, pruned);
+      return pruned;
+    }
+    return records.length > MAX_ENTRIES ? records.slice(-MAX_ENTRIES) : records;
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Remove block records older than `windowMs` ms from the file.
+ * Called by posttooluse-correlate.ts after matching so the file stays trim.
+ * Best-effort — never throws.
+ */
+export function pruneOldBlocks(windowMs: number, home: string = process.env.HOME ?? homedir()): void {
+  try {
+    const path = blocksPath(home);
+    if (!existsSync(path)) return;
+    const cutoff = Date.now() - windowMs;
+    const records = readRecentBlocks(home).filter((r) => r.ts >= cutoff);
+    _atomicRewrite(path, records);
+  } catch {
+    // Best-effort.
+  }
+}
+
+/**
+ * Write `records` to `path` atomically by writing to a `.tmp` sibling first,
+ * then renaming. Rename is atomic on POSIX and atomic on NTFS (same volume).
+ */
+function _atomicRewrite(path: string, records: RecentBlock[]): void {
+  const tmp = path + ".tmp";
+  const content = records.length === 0
+    ? ""
+    : records.map((r) => JSON.stringify(r)).join("\n") + "\n";
+  writeFileSync(tmp, content, "utf-8");
+  renameSync(tmp, path);
+}

package/hooks/audit-upload.ts

@@ -0,0 +1,86 @@
+#!/usr/bin/env bun
+// Make this a proper module so top-level await is allowed.
+export {};
+
+/**
+ * audit-upload.ts — PostToolUse hook.
+ *
+ * Fires after any non-read tool call. If ASHLR_PRO_TOKEN is set and the user's
+ * tier includes audit logging, POSTs the event to /audit/event on the ashlr
+ * backend. Fire-and-forget with a 3s timeout — failure never blocks the tool.
+ *
+ * Registered in hooks.json:
+ *   PostToolUse matcher: Edit|MultiEdit|Write|Bash|mcp__plugin_ashlr_ashlr__ashlr__edit|mcp__plugin_ashlr_ashlr__ashlr__multi_edit|mcp__plugin_ashlr_ashlr__ashlr__edit_structural
+ */
+
+const token   = process.env["ASHLR_PRO_TOKEN"];
+const baseUrl = process.env["ASHLR_API_URL"] ?? "https://api.ashlr.ai";
+
+if (!token) {
+  // No pro token — silently exit
+  process.exit(0);
+}
+
+// Claude Code passes the hook payload on stdin as JSON
+let payload: Record<string, unknown> = {};
+try {
+  const raw = await Bun.stdin.text();
+  if (raw.trim()) {
+    payload = JSON.parse(raw) as Record<string, unknown>;
+  }
+} catch (e) {
+  // Malformed stdin — exit cleanly, but leave a stderr trace.
+  process.stderr.write("[ashlr-audit-upload] stdin parse failed: " + (e instanceof Error ? e.message : String(e)) + "\n");
+  process.exit(0);
+}
+
+const tool      = (payload["tool_name"] as string | undefined) ?? "unknown";
+const toolInput = (payload["tool_input"] as Record<string, unknown> | undefined) ?? {};
+const cwd       = (payload["cwd"] as string | undefined) ?? "";
+
+// Best-effort git commit from env or cwd
+let gitCommit = process.env["GIT_COMMIT"] ?? "";
+if (!gitCommit && cwd) {
+  try {
+    const proc = Bun.spawnSync(["git", "-C", cwd, "rev-parse", "--short", "HEAD"], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    gitCommit = proc.stdout.toString().trim();
+  } catch (e) {
+    // Not in a git repo — ignore, but leave a stderr trace.
+    process.stderr.write("[ashlr-audit-upload] git rev-parse failed: " + (e instanceof Error ? e.message : String(e)) + "\n");
+  }
+}
+
+const body = {
+  tool,
+  args: toolInput,
+  userId: "", // server resolves from Bearer token
+  cwd,
+  gitCommit,
+  timestamp: new Date().toISOString(),
+};
+
+try {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3000);
+
+  await fetch(`${baseUrl}/audit/event`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify(body),
+    signal: controller.signal,
+  });
+
+  clearTimeout(timeout);
+} catch (e) {
+  // Fire-and-forget — any network or timeout error is silently dropped, but
+  // we leave a stderr trace so production failures can be grepped.
+  process.stderr.write("[ashlr-audit-upload] POST /audit/event failed: " + (e instanceof Error ? e.message : String(e)) + "\n");
+}
+
+process.exit(0);

package/hooks/codex-hooks.json

@@ -0,0 +1,171 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/sessionstart-lean-tools.ts\""
+          },
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/sessionstart-efficient.ts\""
+          },
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/sessionstart-genome-author.ts\""
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/userpromptsubmit-brief-trigger.ts\""
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash|exec_command|functions.exec_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-bash.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "apply_patch|functions.apply_patch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-edit.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-read.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "Grep",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-grep.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "Glob",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-glob.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-write.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-edit.ts\""
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__ashlr__ashlr__read|mcp__ashlr__ashlr__grep|mcp__ashlr__ashlr__tree|mcp__ashlr__ashlr__savings",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/pretooluse-budget-guard.ts\""
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash|exec_command|functions.exec_command|apply_patch|functions.apply_patch|Read|Grep|Glob|Write|Edit|MultiEdit|mcp__ashlr__ashlr__read|mcp__ashlr__ashlr__grep|mcp__ashlr__ashlr__edit|mcp__ashlr__ashlr__multi_edit|mcp__ashlr__ashlr__write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/post-tool-use-genome.ts\""
+          },
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/session-log-append.ts\""
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/session-end-consolidate.ts\""
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/sessionstart-lean-tools.ts\""
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/sessionstart-efficient.ts\""
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/subagent-stop-rollup.ts\""
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs\" \"${CODEX_PLUGIN_ROOT}/hooks/stop-accounting.ts\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/hooks/commit-attribution.ts

@@ -0,0 +1,179 @@
+#!/usr/bin/env bun
+/**
+ * commit-attribution.ts
+ *
+ * Claude Code PreToolUse hook (matched on Bash). Reads the tool call JSON
+ * from stdin; if the command is a `git commit -m/--message=` invocation,
+ * append an `Assisted-By: ashlr-plugin` trailer so commits made through
+ * Claude Code are honestly attributed.
+ *
+ * Pure local — no telemetry, no network. Honors `~/.claude/settings.json`
+ * `ashlr.attribution` (default true). Designed to never block a commit:
+ * any parsing failure falls through to a pass-through.
+ */
+
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+export const TRAILER = "Assisted-By: ashlr-plugin <https://plugin.ashlr.ai>";
+
+interface HookInput {
+  tool_name?: string;
+  tool_input?: { command?: string; [k: string]: unknown };
+  [k: string]: unknown;
+}
+
+interface HookResult {
+  /** The (possibly rewritten) command to run, or null to leave it alone. */
+  rewrittenCommand: string | null;
+  /** True iff we modified the original command. */
+  modified: boolean;
+}
+
+export function isAttributionEnabled(settingsPath = join(homedir(), ".claude", "settings.json")): boolean {
+  try {
+    const raw = readFileSync(settingsPath, "utf8");
+    const parsed = JSON.parse(raw);
+    const ashlr = parsed?.ashlr;
+    if (ashlr && typeof ashlr === "object" && "attribution" in ashlr) {
+      return ashlr.attribution !== false;
+    }
+    return true;
+  } catch {
+    // Missing file / malformed settings → default ON.
+    return true;
+  }
+}
+
+export function alreadyAttributed(message: string): boolean {
+  return /Assisted-By:|Co-Authored-By:/i.test(message);
+}
+
+/**
+ * Rewrite a single quoted message (preserving the original quote style) by
+ * appending the trailer, unless already attributed.
+ */
+function appendToMessage(message: string): string {
+  if (alreadyAttributed(message)) return message;
+  // Two blank lines between body and trailer block per git convention.
+  // If the message already ends with one newline, we still want a blank line.
+  const sep = message.endsWith("\n\n") ? "" : message.endsWith("\n") ? "\n" : "\n\n";
+  return message + sep + TRAILER;
+}
+
+/**
+ * Find a `-m`/`--message=` argument in a `git commit` command and rewrite
+ * the message in-place. Returns the rewritten command, or null if we can't
+ * confidently rewrite (in which case the caller should pass through).
+ *
+ * Handles:
+ *   git commit -m "msg"
+ *   git commit -m 'msg'
+ *   git commit --message="msg"
+ *   git commit --message='msg'
+ *
+ * Punts on:
+ *   git commit               (opens editor — nothing to rewrite)
+ *   git commit -F file       (message lives in a file; rewriting would
+ *                             require disk I/O on a user-owned path)
+ *   git commit -m msg        (unquoted — ambiguous tokenization)
+ */
+export function rewriteGitCommit(command: string): HookResult {
+  const trimmed = command.trim();
+
+  // Cheap pre-check: must contain `git commit` as a recognizable token.
+  // Allow leading env vars / pipes by just searching.
+  if (!/\bgit\s+commit\b/.test(trimmed)) {
+    return { rewrittenCommand: null, modified: false };
+  }
+
+  // -m "..." / -m '...'
+  // Use a lazy match across the whole string so escaped quotes inside
+  // double-quoted strings (\") are tolerated.
+  const reDouble = /(\bgit\s+commit\b[^]*?)(-m\s+)"((?:\\.|[^"\\])*)"/;
+  const reSingle = /(\bgit\s+commit\b[^]*?)(-m\s+)'((?:[^'\\]|\\.)*)'/;
+  const reLongDouble = /(\bgit\s+commit\b[^]*?)(--message=)"((?:\\.|[^"\\])*)"/;
+  const reLongSingle = /(\bgit\s+commit\b[^]*?)(--message=)'((?:[^'\\]|\\.)*)'/;
+
+  for (const [re, quote] of [
+    [reDouble, '"'],
+    [reSingle, "'"],
+    [reLongDouble, '"'],
+    [reLongSingle, "'"],
+  ] as const) {
+    const m = trimmed.match(re);
+    if (!m) continue;
+    const [, prefix, flag, body] = m;
+    // Decode escapes for the duplicate check, but re-emit body literally
+    // and just append the trailer to the literal body.
+    const decoded = quote === '"' ? body.replace(/\\(["\\$`])/g, "$1") : body.replace(/\\(['\\])/g, "$1");
+    if (alreadyAttributed(decoded)) {
+      return { rewrittenCommand: null, modified: false };
+    }
+    // Append the trailer inside the quotes. Use literal newlines — both
+    // bash double and single quotes preserve them.
+    const newBody = body + (body.endsWith("\n\n") ? "" : body.endsWith("\n") ? "\n" : "\n\n") + TRAILER;
+    const matched = m[0];
+    const replacement = `${prefix}${flag}${quote}${newBody}${quote}`;
+    const rewritten = trimmed.replace(matched, replacement);
+    return { rewrittenCommand: rewritten, modified: true };
+  }
+
+  // Fell through — bare `git commit`, `-F`, `-m unquoted`, etc. Pass through.
+  return { rewrittenCommand: null, modified: false };
+}
+
+/** Pass-through hook output: tells Claude Code to run the command unchanged. */
+function passThrough(): string {
+  return JSON.stringify({});
+}
+
+/**
+ * Build the PreToolUse hook output that rewrites the Bash command.
+ * Claude Code's PreToolUse hook supports `hookSpecificOutput` with an
+ * updated `tool_input` shape; we emit that so the agent runs the rewritten
+ * git commit instead of the original.
+ */
+function rewriteOutput(newCommand: string): string {
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      updatedInput: { command: newCommand },
+    },
+  });
+}
+
+export function processHookInput(stdin: string, settingsPath?: string): string {
+  let input: HookInput;
+  try {
+    input = JSON.parse(stdin);
+  } catch {
+    return passThrough();
+  }
+  if (input?.tool_name !== "Bash") return passThrough();
+  const command = input?.tool_input?.command;
+  if (typeof command !== "string" || command.length === 0) return passThrough();
+
+  if (!isAttributionEnabled(settingsPath)) return passThrough();
+
+  const { rewrittenCommand, modified } = rewriteGitCommit(command);
+  if (!modified || !rewrittenCommand) return passThrough();
+  return rewriteOutput(rewrittenCommand);
+}
+
+// Entry point — only run when executed as a script, not when imported by tests.
+if (import.meta.main) {
+  const chunks: Buffer[] = [];
+  process.stdin.on("data", (c: Buffer) => chunks.push(c));
+  process.stdin.on("end", () => {
+    const stdin = Buffer.concat(chunks).toString("utf8");
+    process.stdout.write(processHookInput(stdin));
+    process.exit(0);
+  });
+  // If stdin is closed (no data piped), exit pass-through immediately.
+  process.stdin.on("error", () => {
+    process.stdout.write(passThrough());
+    process.exit(0);
+  });
+}