claude-ide-bridge 2.34.0 → 2.42.2

package/dist/automation.js

@@ -1,56 +1,12 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { minimatch } from "minimatch";
-import { getPrompt } from "./prompts.js";
-/** Maximum length (chars) of a single diagnostic message before truncation */
-const MAX_DIAGNOSTIC_MSG_CHARS = 500;
-const MAX_DIAGNOSTICS_IN_PROMPT = 20;
-/**
- * Wrap an untrusted user-controlled value in delimiters that include a
- * per-trigger nonce so a crafted value cannot forge a closing delimiter.
- * The nonce is stripped from the value itself before insertion.
- */
-function untrustedBlock(label, value, nonce) {
-    if (!/^[A-Z][A-Z0-9 ]*$/.test(label)) {
-        throw new Error(`untrustedBlock: label must be uppercase ASCII, got: ${JSON.stringify(label)}`);
-    }
-    const safe = value.replace(new RegExp(nonce, "g"), "");
-    return `\n--- BEGIN ${label} [${nonce}] (untrusted) ---\n${safe}\n--- END ${label} [${nonce}] ---\n`;
-}
-/** Maximum length (chars) of a file path inserted into prompts */
-const MAX_FILE_PATH_CHARS = 500;
-/**
- * Build a trusted metadata prefix that is prepended to every automation hook
- * prompt BEFORE any untrustedBlock() substitutions. This allows Claude to
- * identify which hook triggered the task and correlate it with IDE context.
- */
-function buildHookMetadata(hookName, file) {
-    // Strip control characters from the file path before embedding in the trusted
-    // metadata prefix — prevents a crafted file name containing \n from injecting
-    // additional lines into the structured header block.
-    const safeFile = file
-        ? file.slice(0, MAX_FILE_PATH_CHARS).replace(/[\x00-\x1F\x7F]/g, "")
-        : "N/A";
-    return `@@ HOOK: ${hookName} | file: ${safeFile} | ts: ${new Date().toISOString()} @@\n`;
-}
+import { executeAutomationPolicy } from "./fp/automationInterpreter.js";
+import { EMPTY_AUTOMATION_STATE, setLatestDiagnostics, setTestRunnerStatus, tasksInLastHour, } from "./fp/automationState.js";
+import { VsCodeBackend } from "./fp/interpreterContext.js";
+import { parsePolicy } from "./fp/policyParser.js";
 /** Maximum length (chars) of an automation policy prompt template (matches runClaudeTask cap) */
 const MAX_POLICY_PROMPT_CHARS = 32_768;
-/**
- * Truncate a final prompt to MAX_POLICY_PROMPT_CHARS at the last newline before
- * the limit and append a truncation notice. Called after all placeholder
- * substitutions and buildHookMetadata() prepends so the cap applies to the
- * fully-assembled string, not just the raw template.
- */
-function truncatePrompt(prompt) {
-    if (prompt.length <= MAX_POLICY_PROMPT_CHARS)
-        return prompt;
-    const cutoff = prompt.lastIndexOf("\n", MAX_POLICY_PROMPT_CHARS);
-    const end = cutoff > 0 ? cutoff : MAX_POLICY_PROMPT_CHARS;
-    return `${prompt.slice(0, end)}\n[... truncated to fit 32KB limit ...]`;
-}
-/** Prune lastTrigger entries older than this to prevent unbounded Map growth */
-const LAST_TRIGGER_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 1 week
 /** Default system prompt for automation subprocesses when none is set in policy. */
 const DEFAULT_AUTOMATION_SYSTEM_PROMPT = "You are a concise automation assistant. " +
     "Respond in \u22645 lines. No preamble. No markdown headers. " +
@@ -171,7 +127,66 @@ export function loadPolicy(filePath) {
             throw new Error(`"defaultEffort" must be one of "low", "medium", "high", "max"`);
         }
     }
-    // Validate onDiagnosticsError
+    const HOOK_SUBJECT_KEY = {
+        onFileSave: "file",
+        onFileChanged: "file",
+        onGitCommit: "message",
+        onGitPush: "branch",
+        onGitPull: "branch",
+        onBranchCheckout: "branch",
+        onPullRequest: "title",
+        onTestPassAfterFailure: "runner",
+        onTaskCreated: "prompt",
+        onTaskSuccess: "output",
+        onPermissionDenied: "tool",
+        onDiagnosticsCleared: "file",
+        onCwdChanged: "cwd",
+        onPreCompact: "session",
+        onPostCompact: "session",
+        onTestRun: "runner",
+        onDebugSessionStart: "sessionName",
+        onDebugSessionEnd: "sessionName",
+    };
+    void HOOK_SUBJECT_KEY; // referenced by callers; kept for documentation
+    // Standard hooks: required cooldownMs, no extra fields
+    const STANDARD_HOOK_KEYS = [
+        "onTestPassAfterFailure",
+        "onGitCommit",
+        "onGitPush",
+        "onGitPull",
+        "onBranchCheckout",
+        "onPullRequest",
+        "onTaskCreated",
+        "onPermissionDenied",
+        "onDiagnosticsCleared",
+        "onTaskSuccess",
+        "onDebugSessionStart",
+        "onDebugSessionEnd",
+        "onCwdChanged",
+        "onPreCompact",
+        "onPostCompact",
+    ];
+    for (const key of STANDARD_HOOK_KEYS) {
+        const cfg = policy[key];
+        if (cfg === undefined)
+            continue;
+        if (typeof cfg !== "object" || cfg === null) {
+            throw new Error(`"${key}" must be an object`);
+        }
+        const rec = cfg;
+        if (typeof rec.enabled !== "boolean") {
+            throw new Error(`"${key}.enabled" must be a boolean`);
+        }
+        validatePromptSource(key, rec);
+        expectType(rec.cooldownMs, "number", `${key}.cooldownMs`);
+        if (!Number.isFinite(rec.cooldownMs)) {
+            throw new Error(`"${key}.cooldownMs" must be a finite number`);
+        }
+        rec.cooldownMs = Math.max(rec.cooldownMs, MIN_COOLDOWN_MS);
+    }
+    // ── Per-hook extras (after generic fold) ─────────────────────────────────
+    // Validate onDiagnosticsError (extra: minSeverity required, diagnosticTypes,
+    // dedupeByContent, dedupeContentCooldownMs)
     if (policy.onDiagnosticsError !== undefined) {
         const d = policy.onDiagnosticsError;
         if (typeof d !== "object" || d === null) {
@@ -188,9 +203,7 @@ export function loadPolicy(filePath) {
         if (!Number.isFinite(d.cooldownMs)) {
             throw new Error(`"onDiagnosticsError.cooldownMs" must be a finite number`);
         }
-        if (d.cooldownMs < MIN_COOLDOWN_MS) {
-            d.cooldownMs = MIN_COOLDOWN_MS;
-        }
+        d.cooldownMs = Math.max(d.cooldownMs, MIN_COOLDOWN_MS);
         if (d.diagnosticTypes !== undefined) {
             if (!Array.isArray(d.diagnosticTypes) ||
                 d.diagnosticTypes.length === 0 ||
@@ -207,12 +220,10 @@ export function loadPolicy(filePath) {
                 !Number.isFinite(d.dedupeContentCooldownMs)) {
                 throw new Error(`"onDiagnosticsError.dedupeContentCooldownMs" must be a number`);
             }
-            if (d.dedupeContentCooldownMs < MIN_COOLDOWN_MS) {
-                d.dedupeContentCooldownMs = MIN_COOLDOWN_MS;
-            }
+            d.dedupeContentCooldownMs = Math.max(d.dedupeContentCooldownMs, MIN_COOLDOWN_MS);
         }
     }
-    // Validate onFileSave
+    // Validate onFileSave (extra: patterns required)
     if (policy.onFileSave !== undefined) {
         const s = policy.onFileSave;
         if (typeof s !== "object" || s === null) {
@@ -231,11 +242,9 @@ export function loadPolicy(filePath) {
         if (!Number.isFinite(s.cooldownMs)) {
             throw new Error(`"onFileSave.cooldownMs" must be a finite number`);
         }
-        if (s.cooldownMs < MIN_COOLDOWN_MS) {
-            s.cooldownMs = MIN_COOLDOWN_MS;
-        }
+        s.cooldownMs = Math.max(s.cooldownMs, MIN_COOLDOWN_MS);
     }
-    // Validate onFileChanged
+    // Validate onFileChanged (extra: patterns required)
     if (policy.onFileChanged !== undefined) {
         const fc = policy.onFileChanged;
         if (typeof fc !== "object" || fc === null) {
@@ -254,65 +263,9 @@ export function loadPolicy(filePath) {
         if (!Number.isFinite(fc.cooldownMs)) {
             throw new Error(`"onFileChanged.cooldownMs" must be a finite number`);
         }
-        if (fc.cooldownMs < MIN_COOLDOWN_MS) {
-            fc.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onCwdChanged
-    if (policy.onCwdChanged !== undefined) {
-        const cw = policy.onCwdChanged;
-        if (typeof cw !== "object" || cw === null) {
-            throw new Error(`"onCwdChanged" must be an object`);
-        }
-        if (typeof cw.enabled !== "boolean") {
-            throw new Error(`"onCwdChanged.enabled" must be a boolean`);
-        }
-        validatePromptSource("onCwdChanged", cw);
-        expectType(cw.cooldownMs, "number", "onCwdChanged.cooldownMs");
-        if (!Number.isFinite(cw.cooldownMs)) {
-            throw new Error(`"onCwdChanged.cooldownMs" must be a finite number`);
-        }
-        if (cw.cooldownMs < MIN_COOLDOWN_MS) {
-            cw.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onPreCompact
-    if (policy.onPreCompact !== undefined) {
-        const p = policy.onPreCompact;
-        if (typeof p !== "object" || p === null) {
-            throw new Error(`"onPreCompact" must be an object`);
-        }
-        if (typeof p.enabled !== "boolean") {
-            throw new Error(`"onPreCompact.enabled" must be a boolean`);
-        }
-        validatePromptSource("onPreCompact", p);
-        expectType(p.cooldownMs, "number", "onPreCompact.cooldownMs");
-        if (!Number.isFinite(p.cooldownMs)) {
-            throw new Error(`"onPreCompact.cooldownMs" must be a finite number`);
-        }
-        if (p.cooldownMs < MIN_COOLDOWN_MS) {
-            p.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onPostCompact
-    if (policy.onPostCompact !== undefined) {
-        const p = policy.onPostCompact;
-        if (typeof p !== "object" || p === null) {
-            throw new Error(`"onPostCompact" must be an object`);
-        }
-        if (typeof p.enabled !== "boolean") {
-            throw new Error(`"onPostCompact.enabled" must be a boolean`);
-        }
-        validatePromptSource("onPostCompact", p);
-        expectType(p.cooldownMs, "number", "onPostCompact.cooldownMs");
-        if (!Number.isFinite(p.cooldownMs)) {
-            throw new Error(`"onPostCompact.cooldownMs" must be a finite number`);
-        }
-        if (p.cooldownMs < MIN_COOLDOWN_MS) {
-            p.cooldownMs = MIN_COOLDOWN_MS;
-        }
+        fc.cooldownMs = Math.max(fc.cooldownMs, MIN_COOLDOWN_MS);
     }
-    // Validate onInstructionsLoaded
+    // Validate onInstructionsLoaded (special: cooldownMs optional, min 5000)
     if (policy.onInstructionsLoaded !== undefined) {
         const il = policy.onInstructionsLoaded;
         if (typeof il !== "object" || il === null) {
@@ -328,7 +281,7 @@ export function loadPolicy(filePath) {
         }
         validatePromptSource("onInstructionsLoaded", il);
     }
-    // Validate onTestRun
+    // Validate onTestRun (extra: onFailureOnly required, minDuration optional)
     if (policy.onTestRun !== undefined) {
         const tr = policy.onTestRun;
         if (typeof tr !== "object" || tr === null) {
@@ -345,9 +298,7 @@ export function loadPolicy(filePath) {
         if (!Number.isFinite(tr.cooldownMs)) {
             throw new Error(`"onTestRun.cooldownMs" must be a finite number`);
         }
-        if (tr.cooldownMs < MIN_COOLDOWN_MS) {
-            tr.cooldownMs = MIN_COOLDOWN_MS;
-        }
+        tr.cooldownMs = Math.max(tr.cooldownMs, MIN_COOLDOWN_MS);
         if (tr.minDuration !== undefined) {
             if (typeof tr.minDuration !== "number" ||
                 !Number.isFinite(tr.minDuration) ||
@@ -356,222 +307,6 @@ export function loadPolicy(filePath) {
             }
         }
     }
-    // Validate onTestPassAfterFailure
-    if (policy.onTestPassAfterFailure !== undefined) {
-        const tpaf = policy.onTestPassAfterFailure;
-        if (typeof tpaf !== "object" || tpaf === null) {
-            throw new Error(`"onTestPassAfterFailure" must be an object`);
-        }
-        if (typeof tpaf.enabled !== "boolean") {
-            throw new Error(`"onTestPassAfterFailure.enabled" must be a boolean`);
-        }
-        validatePromptSource("onTestPassAfterFailure", tpaf);
-        expectType(tpaf.cooldownMs, "number", "onTestPassAfterFailure.cooldownMs");
-        if (!Number.isFinite(tpaf.cooldownMs)) {
-            throw new Error(`"onTestPassAfterFailure.cooldownMs" must be a finite number`);
-        }
-        if (tpaf.cooldownMs < MIN_COOLDOWN_MS) {
-            tpaf.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onGitCommit
-    if (policy.onGitCommit !== undefined) {
-        const gc = policy.onGitCommit;
-        if (typeof gc !== "object" || gc === null) {
-            throw new Error(`"onGitCommit" must be an object`);
-        }
-        if (typeof gc.enabled !== "boolean") {
-            throw new Error(`"onGitCommit.enabled" must be a boolean`);
-        }
-        validatePromptSource("onGitCommit", gc);
-        expectType(gc.cooldownMs, "number", "onGitCommit.cooldownMs");
-        if (!Number.isFinite(gc.cooldownMs)) {
-            throw new Error(`"onGitCommit.cooldownMs" must be a finite number`);
-        }
-        if (gc.cooldownMs < MIN_COOLDOWN_MS) {
-            gc.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onGitPush
-    if (policy.onGitPush !== undefined) {
-        const gp = policy.onGitPush;
-        if (typeof gp !== "object" || gp === null) {
-            throw new Error(`"onGitPush" must be an object`);
-        }
-        if (typeof gp.enabled !== "boolean") {
-            throw new Error(`"onGitPush.enabled" must be a boolean`);
-        }
-        validatePromptSource("onGitPush", gp);
-        expectType(gp.cooldownMs, "number", "onGitPush.cooldownMs");
-        if (!Number.isFinite(gp.cooldownMs)) {
-            throw new Error(`"onGitPush.cooldownMs" must be a finite number`);
-        }
-        if (gp.cooldownMs < MIN_COOLDOWN_MS) {
-            gp.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onGitPull
-    if (policy.onGitPull !== undefined) {
-        const gpl = policy.onGitPull;
-        if (typeof gpl !== "object" || gpl === null) {
-            throw new Error(`"onGitPull" must be an object`);
-        }
-        if (typeof gpl.enabled !== "boolean") {
-            throw new Error(`"onGitPull.enabled" must be a boolean`);
-        }
-        validatePromptSource("onGitPull", gpl);
-        expectType(gpl.cooldownMs, "number", "onGitPull.cooldownMs");
-        if (!Number.isFinite(gpl.cooldownMs)) {
-            throw new Error(`"onGitPull.cooldownMs" must be a finite number`);
-        }
-        if (gpl.cooldownMs < MIN_COOLDOWN_MS) {
-            gpl.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onBranchCheckout
-    if (policy.onBranchCheckout !== undefined) {
-        const bc = policy.onBranchCheckout;
-        if (typeof bc !== "object" || bc === null) {
-            throw new Error(`"onBranchCheckout" must be an object`);
-        }
-        if (typeof bc.enabled !== "boolean") {
-            throw new Error(`"onBranchCheckout.enabled" must be a boolean`);
-        }
-        validatePromptSource("onBranchCheckout", bc);
-        expectType(bc.cooldownMs, "number", "onBranchCheckout.cooldownMs");
-        if (!Number.isFinite(bc.cooldownMs)) {
-            throw new Error(`"onBranchCheckout.cooldownMs" must be a finite number`);
-        }
-        if (bc.cooldownMs < MIN_COOLDOWN_MS) {
-            bc.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onPullRequest
-    if (policy.onPullRequest !== undefined) {
-        const pr = policy.onPullRequest;
-        if (typeof pr !== "object" || pr === null) {
-            throw new Error(`"onPullRequest" must be an object`);
-        }
-        if (typeof pr.enabled !== "boolean") {
-            throw new Error(`"onPullRequest.enabled" must be a boolean`);
-        }
-        validatePromptSource("onPullRequest", pr);
-        expectType(pr.cooldownMs, "number", "onPullRequest.cooldownMs");
-        if (!Number.isFinite(pr.cooldownMs)) {
-            throw new Error(`"onPullRequest.cooldownMs" must be a finite number`);
-        }
-        if (pr.cooldownMs < MIN_COOLDOWN_MS) {
-            pr.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onTaskCreated
-    if (policy.onTaskCreated !== undefined) {
-        const tc = policy.onTaskCreated;
-        if (typeof tc !== "object" || tc === null) {
-            throw new Error(`"onTaskCreated" must be an object`);
-        }
-        if (typeof tc.enabled !== "boolean") {
-            throw new Error(`"onTaskCreated.enabled" must be a boolean`);
-        }
-        validatePromptSource("onTaskCreated", tc);
-        expectType(tc.cooldownMs, "number", "onTaskCreated.cooldownMs");
-        if (!Number.isFinite(tc.cooldownMs)) {
-            throw new Error(`"onTaskCreated.cooldownMs" must be a finite number`);
-        }
-        if (tc.cooldownMs < MIN_COOLDOWN_MS) {
-            tc.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onPermissionDenied
-    if (policy.onPermissionDenied !== undefined) {
-        const pd = policy.onPermissionDenied;
-        if (typeof pd !== "object" || pd === null) {
-            throw new Error(`"onPermissionDenied" must be an object`);
-        }
-        if (typeof pd.enabled !== "boolean") {
-            throw new Error(`"onPermissionDenied.enabled" must be a boolean`);
-        }
-        validatePromptSource("onPermissionDenied", pd);
-        expectType(pd.cooldownMs, "number", "onPermissionDenied.cooldownMs");
-        if (!Number.isFinite(pd.cooldownMs)) {
-            throw new Error(`"onPermissionDenied.cooldownMs" must be a finite number`);
-        }
-        if (pd.cooldownMs < MIN_COOLDOWN_MS) {
-            pd.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onDiagnosticsCleared
-    if (policy.onDiagnosticsCleared !== undefined) {
-        const dc = policy.onDiagnosticsCleared;
-        if (typeof dc !== "object" || dc === null) {
-            throw new Error(`"onDiagnosticsCleared" must be an object`);
-        }
-        if (typeof dc.enabled !== "boolean") {
-            throw new Error(`"onDiagnosticsCleared.enabled" must be a boolean`);
-        }
-        validatePromptSource("onDiagnosticsCleared", dc);
-        expectType(dc.cooldownMs, "number", "onDiagnosticsCleared.cooldownMs");
-        if (!Number.isFinite(dc.cooldownMs)) {
-            throw new Error(`"onDiagnosticsCleared.cooldownMs" must be a finite number`);
-        }
-        if (dc.cooldownMs < MIN_COOLDOWN_MS) {
-            dc.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onTaskSuccess
-    if (policy.onTaskSuccess !== undefined) {
-        const ts = policy.onTaskSuccess;
-        if (typeof ts !== "object" || ts === null) {
-            throw new Error(`"onTaskSuccess" must be an object`);
-        }
-        if (typeof ts.enabled !== "boolean") {
-            throw new Error(`"onTaskSuccess.enabled" must be a boolean`);
-        }
-        validatePromptSource("onTaskSuccess", ts);
-        expectType(ts.cooldownMs, "number", "onTaskSuccess.cooldownMs");
-        if (!Number.isFinite(ts.cooldownMs)) {
-            throw new Error(`"onTaskSuccess.cooldownMs" must be a finite number`);
-        }
-        if (ts.cooldownMs < MIN_COOLDOWN_MS) {
-            ts.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onDebugSessionStart
-    if (policy.onDebugSessionStart !== undefined) {
-        const dss = policy.onDebugSessionStart;
-        if (typeof dss !== "object" || dss === null) {
-            throw new Error(`"onDebugSessionStart" must be an object`);
-        }
-        if (typeof dss.enabled !== "boolean") {
-            throw new Error(`"onDebugSessionStart.enabled" must be a boolean`);
-        }
-        validatePromptSource("onDebugSessionStart", dss);
-        expectType(dss.cooldownMs, "number", "onDebugSessionStart.cooldownMs");
-        if (!Number.isFinite(dss.cooldownMs)) {
-            throw new Error(`"onDebugSessionStart.cooldownMs" must be a finite number`);
-        }
-        if (dss.cooldownMs < MIN_COOLDOWN_MS) {
-            dss.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
-    // Validate onDebugSessionEnd
-    if (policy.onDebugSessionEnd !== undefined) {
-        const dse = policy.onDebugSessionEnd;
-        if (typeof dse !== "object" || dse === null) {
-            throw new Error(`"onDebugSessionEnd" must be an object`);
-        }
-        if (typeof dse.enabled !== "boolean") {
-            throw new Error(`"onDebugSessionEnd.enabled" must be a boolean`);
-        }
-        validatePromptSource("onDebugSessionEnd", dse);
-        expectType(dse.cooldownMs, "number", "onDebugSessionEnd.cooldownMs");
-        if (!Number.isFinite(dse.cooldownMs)) {
-            throw new Error(`"onDebugSessionEnd.cooldownMs" must be a finite number`);
-        }
-        if (dse.cooldownMs < MIN_COOLDOWN_MS) {
-            dse.cooldownMs = MIN_COOLDOWN_MS;
-        }
-    }
     return policy;
 }
 /**
@@ -634,254 +369,88 @@ export function checkCcHookWiring() {
 // ── AutomationHooks ───────────────────────────────────────────────────────────
 export class AutomationHooks {
     policy;
-    orchestrator;
     log;
-    extensionClient;
-    workspace;
-    /** Last trigger time per "trigger key" (e.g. "diagnostics:/path/to/file"). */
-    lastTrigger = new Map();
-    /**
-     * Active task IDs per file for the diagnostics handler.
-     * Kept separate from activeSaveTasks so a running save task does not suppress
-     * the diagnostics trigger (and vice-versa) for the same file.
-     */
-    activeDiagnosticsTasks = new Map();
-    /** Active task IDs per file for the file-saved handler. */
-    activeSaveTasks = new Map();
-    /** Active task IDs per file for the file-changed handler. */
-    activeFileChangedTasks = new Map();
-    /** Active task ID for the test-run handler (workspace-global). */
-    activeTestRunTaskId = null;
-    /** Active task ID for the test-pass-after-failure handler (workspace-global). */
-    activeTestPassAfterFailureTaskId = null;
+    /** Compiled AST for the functional interpreter. Null if parse failed. */
+    _programAST = null;
+    /** Backend instance for the functional interpreter. */
+    _interpreterBackend = null;
     /**
-     * Per-runner last outcome — used to detect fail→pass transitions.
-     * Key: runner name (e.g. "vitest", "jest"). Value: "pass" | "fail".
-     * Stored separately per runner so a vitest pass doesn't incorrectly trigger
-     * when a jest run was the one that previously failed.
+     * Pure-value state holding cooldown timestamps, diagnostic error counts, and
+     * test outcomes.  Mutations go through the pure-function helpers from
+     * `src/fp/automationState.ts`; the class re-assigns `_automationState` on
+     * each "write" to maintain immutability semantics at the value level.
      */
-    lastTestOutcomeByRunner = new Map();
-    /** Active task ID for the git-commit handler (workspace-global). */
-    activeGitCommitTaskId = null;
-    /** Active task ID for the git-push handler (workspace-global). */
-    activeGitPushTaskId = null;
-    /** Active task ID for the git-pull handler (workspace-global). */
-    activeGitPullTaskId = null;
-    /** Active task ID for the branch-checkout handler (workspace-global). */
-    activeBranchCheckoutTaskId = null;
-    /** Active task ID for the pull-request handler (workspace-global). */
-    activePullRequestTaskId = null;
-    /** Active task ID for the task-created handler (workspace-global). */
-    activeTaskCreatedTaskId = null;
-    /** Active task ID for the permission-denied handler (workspace-global). */
-    activePermissionDeniedTaskId = null;
-    /** Active task IDs per file for the diagnostics-cleared handler. */
-    activeDiagnosticsClearedTasks = new Map();
+    _automationState = EMPTY_AUTOMATION_STATE;
     /** Tracks previous error count per normalized file path for zero-transition detection. */
     prevDiagnosticErrors = new Map();
-    /** Latest diagnostics by file — used by _evaluateWhen() for conditional hooks. */
-    latestDiagnosticsByFile = new Map();
-    /** Last test runner outcome per runner name — used by _evaluateWhen(). */
-    lastTestRunnerStatusByRunner = new Map();
-    /** Active task ID for the task-success handler (workspace-global). */
-    activeTaskSuccessTaskId = null;
-    /** Active task ID for the debug-session-end handler (workspace-global). */
-    activeDebugSessionEndTaskId = null;
-    /** Active task ID for the debug-session-start handler (workspace-global). */
-    activeDebugSessionStartTaskId = null;
-    /** Active task ID for the post-compact handler (workspace-global). */
-    activePostCompactTaskId = null;
-    /** Active task ID for the pre-compact handler (workspace-global). */
-    activePreCompactTaskId = null;
-    /** Active task ID for the instructions-loaded handler (workspace-global). */
-    activeInstructionsLoadedTaskId = null;
     /**
-     * Rolling window of task enqueue timestamps for maxTasksPerHour enforcement.
-     * Entries older than 60 minutes are pruned on each enqueue.
+     * Per-runner last outcome — used to detect fail→pass transitions for onTestPassAfterFailure.
+     * Key: runner name. Value: "pass" | "fail".
      */
-    taskTimestamps = [];
+    lastTestOutcomeByRunner = new Map();
     _lastFiredAt = null;
-    constructor(policy, orchestrator, log, extensionClient, workspace) {
+    /** Last interpreter run promise — allows tests to await completion. */
+    _lastRunPromise = Promise.resolve();
+    constructor(policy, orchestrator, log, _extensionClient, _workspace) {
         this.policy = policy;
-        this.orchestrator = orchestrator;
         this.log = log;
-        this.extensionClient = extensionClient;
-        this.workspace = workspace;
-    }
-    /**
-     * Central enqueue for all automation-triggered tasks.
-     * Applies defaultModel (Haiku by default) and enforces maxTasksPerHour.
-     * Throws with the same "Task queue is full" message on rate-limit breach so
-     * callers can handle it identically.
-     */
-    _enqueueAutomationTask(opts) {
-        const maxPerHour = this.policy.maxTasksPerHour ?? 20;
-        if (maxPerHour > 0) {
-            const now = Date.now();
-            const cutoff = now - 60 * 60 * 1_000;
-            // Prune old timestamps
-            let i = 0;
-            while (i < this.taskTimestamps.length &&
-                (this.taskTimestamps[i] ?? 0) < cutoff)
-                i++;
-            if (i > 0)
-                this.taskTimestamps.splice(0, i);
-            if (this.taskTimestamps.length >= maxPerHour) {
-                throw new Error(`Automation rate limit reached (max ${maxPerHour} tasks/hour)`);
+        // Phase 4: always initialise interpreter (primary path)
+        {
+            const parseResult = parsePolicy(policy);
+            if (parseResult.ok) {
+                this._programAST = parseResult.value;
+                this._interpreterBackend = new VsCodeBackend(orchestrator, {
+                    info: this.log.bind(this),
+                });
+            }
+            else {
+                this.log(`[automation] interpreter parse failed: ${parseResult.message}`);
             }
         }
-        const model = opts.hookCfg?.model ??
-            this.policy.defaultModel ??
-            "claude-haiku-4-5-20251001";
-        const effort = opts.hookCfg?.effort ?? this.policy.defaultEffort ?? "low";
-        const systemPrompt = this.policy.automationSystemPrompt ?? DEFAULT_AUTOMATION_SYSTEM_PROMPT;
-        const taskId = this.orchestrator.enqueue({
-            prompt: opts.prompt,
-            sessionId: "",
-            isAutomationTask: true,
-            triggerSource: opts.triggerSource,
-            model,
-            effort,
-            systemPrompt,
-        });
-        // Push timestamp only after successful enqueue so tasksThisHour never
-        // diverges from the actual task row count (F3 phantom-increment fix).
-        if (maxPerHour > 0) {
-            this.taskTimestamps.push(Date.now());
-        }
-        this._lastFiredAt = new Date().toISOString();
-        // Schedule retry watcher if retryCount > 0.
-        const retryCount = opts.hookCfg?.retryCount ?? 0;
-        const retryAttempt = opts._retryAttempt ?? 0;
-        if (retryCount > 0) {
-            const retryDelayMs = Math.max(5_000, opts.hookCfg?.retryDelayMs ?? 30_000);
-            this._watchForRetry(taskId, opts, retryAttempt, retryCount, retryDelayMs);
-        }
-        return taskId;
     }
-    /**
-     * Poll a task until it reaches a terminal state. If the task ends with
-     * status "error" and retries remain, re-enqueue after `retryDelayMs`.
-     */
-    _watchForRetry(taskId, opts, retryAttempt, retryCount, retryDelayMs) {
-        const interval = setInterval(() => {
-            const task = this.orchestrator.getTask(taskId);
-            if (!task) {
-                clearInterval(interval);
-                return;
+    async _runInterpreter(eventType, eventData) {
+        if (!this._programAST || !this._interpreterBackend)
+            return;
+        const ctx = {
+            state: this._automationState,
+            now: Date.now(),
+            eventType,
+            eventData,
+            backend: this._interpreterBackend,
+            log: this.log.bind(this),
+        };
+        const result = await executeAutomationPolicy(this._programAST, ctx);
+        if (result.ok) {
+            this._automationState = result.value.updatedState;
+            if (result.value.taskIds.length > 0) {
+                this.log(`[interpreter] ${eventType}: enqueued ${result.value.taskIds.length} task(s)`);
             }
-            if (task.status === "pending" || task.status === "running")
-                return;
-            clearInterval(interval);
-            if (task.status !== "error")
-                return; // cancelled/done → no retry
-            const nextAttempt = retryAttempt + 1;
-            if (nextAttempt > retryCount) {
-                this.log(`[automation] ${opts.triggerSource}: max retries (${retryCount}) reached, dropping`);
-                return;
+            for (const s of result.value.skipped) {
+                this.log(`[interpreter] ${eventType}: skipped ${s.hook} — ${s.reason}`);
+            }
+            for (const e of result.value.errors) {
+                this.log(`[interpreter] ${eventType}: error in ${e.hook} — ${e.message}`);
             }
-            this.log(`[automation] ${opts.triggerSource}: retry ${nextAttempt}/${retryCount} in ${retryDelayMs}ms`);
-            setTimeout(() => {
-                try {
-                    this._enqueueAutomationTask({
-                        ...opts,
-                        _retryAttempt: nextAttempt,
-                    });
-                }
-                catch (e) {
-                    this.log(`[automation] ${opts.triggerSource}: retry enqueue failed: ${e}`);
-                }
-            }, retryDelayMs);
-        }, 2_000);
-    }
-    /**
-     * Resolve a named prompt, substituting any `{{placeholder}}` tokens in
-     * `promptArgs` values with sanitized event data before calling `getPrompt()`.
-     *
-     * Returns the resolved user-message text, or `null` if the prompt is unknown
-     * or has missing required arguments.
-     */
-    _resolveNamedPrompt(name, args, eventData) {
-        // Substitute event placeholders into promptArgs values.
-        // Sanitize: strip control characters and cap length to prevent injection
-        // via crafted file paths or branch names embedded in args.
-        const resolvedArgs = {};
-        for (const [k, v] of Object.entries(args)) {
-            resolvedArgs[k] = v.replace(/\{\{(\w+)\}\}/g, (_match, placeholder) => {
-                const raw = eventData[placeholder] ?? "";
-                return raw
-                    .replace(/[\x00-\x1F\x7F]/g, "")
-                    .slice(0, MAX_FILE_PATH_CHARS);
-            });
         }
-        const result = getPrompt(name, resolvedArgs);
-        if (!result) {
-            this.log(`[automation] promptName "${name}" could not be resolved — unknown prompt or missing required args`);
-            return null;
+        else {
+            this.log(`[interpreter] ${eventType}: interpreter error — ${result.message}`);
         }
-        return result.messages
-            .filter((m) => m.role === "user")
-            .map((m) => m.content.text)
-            .join("\n\n");
     }
     /**
-     * Evaluate the optional `when` condition block on a hook.
-     * Called after _matchesCondition() succeeds and before cooldown checks.
-     * Returns true if all specified conditions pass (or no `when` block present).
+     * Returns a Promise that resolves once all in-flight interpreter runs finish.
+     * Useful in tests to await async side-effects before asserting on task counts.
      */
-    _evaluateWhen(cfg, file) {
-        const when = cfg.when;
-        if (!when)
-            return true;
-        if (when.minDiagnosticCount !== undefined ||
-            when.diagnosticsMinSeverity !== undefined) {
-            const diags = (file ? this.latestDiagnosticsByFile.get(file) : undefined) ?? [];
-            if (when.minDiagnosticCount !== undefined &&
-                diags.length < when.minDiagnosticCount) {
-                return false;
-            }
-            if (when.diagnosticsMinSeverity !== undefined) {
-                const targetRank = when.diagnosticsMinSeverity === "error" ? 2 : 1;
-                const severityRank = {
-                    error: 2,
-                    warning: 1,
-                    info: 0,
-                    information: 0,
-                    hint: 0,
-                };
-                const hasMatchingSeverity = diags.some((d) => (severityRank[d.severity] ?? 0) >= targetRank);
-                if (!hasMatchingSeverity)
-                    return false;
-            }
-        }
-        if (when.testRunnerLastStatus !== undefined) {
-            // Check any runner's last status (wildcard: first match wins)
-            const statuses = Array.from(this.lastTestRunnerStatusByRunner.values());
-            if (statuses.length === 0)
-                return false;
-            if (when.testRunnerLastStatus !== "any") {
-                const hasMatch = statuses.some((s) => s === when.testRunnerLastStatus);
-                if (!hasMatch)
-                    return false;
-            }
-            // "any" passes as long as at least one runner has reported a status
-        }
-        return true;
+    async flush() {
+        await this._lastRunPromise;
     }
-    _matchesCondition(cfg, primaryValue) {
-        if (!cfg.condition)
-            return true;
-        const pattern = cfg.condition;
-        // Support !-prefixed negation: "!**/*.test.ts" means "fire when NOT matching"
-        if (pattern.startsWith("!")) {
-            return !minimatch(primaryValue, pattern.slice(1), { dot: true });
-        }
-        return minimatch(primaryValue, pattern, { dot: true });
+    /** Tear down the instance: nulls interpreter references. */
+    destroy() {
+        this._programAST = null;
+        this._interpreterBackend = null;
     }
     handleDiagnosticsChanged(file, diagnostics) {
-        // Normalize path before any processing
         const normalizedFile = path.resolve(file);
-        // Track error count for zero-transition detection (needed regardless of which hooks are enabled)
+        // Track error count for zero-transition detection (onDiagnosticsCleared)
         const severityRankForClear = {
             error: 2,
             warning: 1,
@@ -892,126 +461,62 @@ export class AutomationHooks {
         const currentErrorCount = diagnostics.filter((d) => (severityRankForClear[d.severity] ?? 0) >= 1).length;
         const prevErrorCount = this.prevDiagnosticErrors.get(normalizedFile) ?? 0;
         this.prevDiagnosticErrors.set(normalizedFile, currentErrorCount);
-        // Keep latest diagnostics for _evaluateWhen() condition checks
-        this.latestDiagnosticsByFile.set(normalizedFile, diagnostics);
-        // Fire onDiagnosticsCleared if transitioning from non-zero → zero
-        if (prevErrorCount > 0 && currentErrorCount === 0) {
-            this.handleDiagnosticsCleared(normalizedFile);
-        }
-        const cfg = this.policy.onDiagnosticsError;
-        if (!cfg?.enabled)
-            return;
-        // Condition filter
-        if (!this._matchesCondition(cfg, normalizedFile))
-            return;
-        if (!this._evaluateWhen(cfg, normalizedFile))
-            return;
-        // Skip onDiagnosticsError if there are no errors to report
-        if (currentErrorCount === 0)
-            return;
-        // Loop guard: skip if a task for this file is still pending/running
-        const existingId = this.activeDiagnosticsTasks.get(normalizedFile);
-        if (existingId) {
-            const existing = this.orchestrator.getTask(existingId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping diagnostics trigger for ${normalizedFile} — task ${existingId.slice(0, 8)} still active`);
-                return;
-            }
-            // Prune stale entry for completed tasks
-            this.activeDiagnosticsTasks.delete(normalizedFile);
-        }
-        // Severity filter
-        const severityRank = {
-            error: 2,
+        // FIFO cap to bound memory
+        if (this.prevDiagnosticErrors.size > 5_000) {
+            const oldest = this.prevDiagnosticErrors.keys().next().value;
+            if (oldest !== undefined)
+                this.prevDiagnosticErrors.delete(oldest);
+        }
+        // Feed interpreter state using severity numbers where lower = more severe
+        // (error=0, warning=1, info/hint=2+) matching automationState.ts / evaluateWhen convention.
+        const severityToNum = {
+            error: 0,
             warning: 1,
-            info: 0,
-            information: 0,
-            hint: 0,
+            info: 2,
+            information: 2,
+            hint: 3,
         };
-        const minRank = severityRank[cfg.minSeverity] ?? 0;
-        let matching = diagnostics.filter((d) => (severityRank[d.severity] ?? 0) >= minRank);
-        if (matching.length === 0)
-            return;
-        // Optional diagnosticTypes filter: only fire for specific sources/codes
-        if (cfg.diagnosticTypes && cfg.diagnosticTypes.length > 0) {
-            const types = cfg.diagnosticTypes.map((t) => t.toLowerCase());
-            matching = matching.filter((d) => (d.source && types.includes(d.source.toLowerCase())) ||
-                (d.code !== undefined &&
-                    types.includes(String(d.code).toLowerCase())));
-            if (matching.length === 0)
-                return;
-        }
-        // Cooldown check. When dedupeByContent is enabled, extend the key with a
-        // diagnostic-content signature so identical LSP re-emissions collide but
-        // genuinely different errors on the same file still trigger.
-        let key = `diagnostics:${normalizedFile}`;
-        let effectiveCooldownMs = cfg.cooldownMs;
-        if (cfg.dedupeByContent) {
-            const sig = diagnosticSignature(matching);
-            key = `diagnostics:${normalizedFile}:${sig}`;
-            effectiveCooldownMs = cfg.dedupeContentCooldownMs ?? 900_000;
-        }
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < effectiveCooldownMs) {
-            const remaining = effectiveCooldownMs - (now - last);
-            if (cfg.dedupeByContent) {
-                this.log(`[automation] dedupe suppressed onDiagnosticsError for ${normalizedFile} (${remaining}ms remaining, sig=${key.slice(-12)})`);
-            }
-            else {
-                this.log(`[automation] cooldown active for ${normalizedFile} (${remaining}ms remaining)`);
-            }
-            return;
-        }
-        // Note: lastTrigger is set AFTER successful enqueue (below) so a failed
-        // enqueue does not impose a spurious cooldown on the next trigger attempt.
-        this._pruneLastTrigger(now);
-        // Truncate file path and each diagnostic message to prevent prompt injection
-        // via crafted file names or linter output embedding instruction-like content.
-        // The diagnosticsText is placed between explicit delimiters in the prompt to
-        // architecturally separate trusted policy instructions from untrusted data.
-        const safeFilePath = normalizedFile.slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { file: safeFilePath });
-            if (resolved === null)
-                return;
-            prompt = resolved;
+        const maxSeverityNum = diagnostics.reduce((min, d) => {
+            const rank = severityToNum[d.severity] ?? 3;
+            return rank < min ? rank : min;
+        }, 4); // 4 = no diagnostics / below hint
+        this._automationState = setLatestDiagnostics(this._automationState, normalizedFile, maxSeverityNum, diagnostics.length);
+        // Build diagnostics text for {{diagnostics}} placeholder (capped at 20)
+        const diagsForPrompt = diagnostics.slice(0, 20);
+        const overflow = diagnostics.length - diagsForPrompt.length;
+        const diagnosticsText = diagsForPrompt
+            .map((d) => `[${d.severity}] ${d.message}${d.source ? ` (${d.source})` : ""}`)
+            .join("\n") + (overflow > 0 ? `\n… and ${overflow} more` : "");
+        // Collect source/code strings for diagnosticTypes filtering
+        const diagnosticSources = diagnostics
+            .flatMap((d) => [
+            d.source?.toLowerCase() ?? "",
+            String(d.code ?? "").toLowerCase(),
+        ])
+            .filter(Boolean)
+            .join(",");
+        const diagnosticSig = diagnosticSignature(diagnostics);
+        // Fire onDiagnosticsCleared if transitioning from non-zero → zero; chain
+        // the interpreter runs so flush() awaits both and state is updated correctly.
+        if (prevErrorCount > 0 && currentErrorCount === 0) {
+            this._lastRunPromise = this._runInterpreter("onDiagnosticsCleared", {
+                file: normalizedFile,
+            }).then(() => this._runInterpreter("onDiagnosticsError", {
+                file: normalizedFile,
+                diagnostics: diagnosticsText,
+                diagnosticSources,
+                diagnosticSig,
+                count: String(diagnostics.length),
+            }));
         }
         else {
-            const displayMatching = matching.slice(0, MAX_DIAGNOSTICS_IN_PROMPT);
-            const omittedCount = matching.length - displayMatching.length;
-            const diagnosticsText = displayMatching
-                .map((d) => `[${d.severity}] ${d.message.slice(0, MAX_DIAGNOSTIC_MSG_CHARS)}`)
-                .join("\n") +
-                (omittedCount > 0 ? `\n… and ${omittedCount} more` : "");
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{file\}\}/g, untrustedBlock("FILE PATH", safeFilePath, nonce))
-                    .replace(/\{\{diagnostics\}\}/g, untrustedBlock("DIAGNOSTIC DATA", diagnosticsText, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onDiagnosticsError", normalizedFile) + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onDiagnosticsError",
-                hookCfg: cfg,
+            this._lastRunPromise = this._runInterpreter("onDiagnosticsError", {
+                file: normalizedFile,
+                diagnostics: diagnosticsText,
+                diagnosticSources,
+                diagnosticSig,
+                count: String(diagnostics.length),
             });
-            this.lastTrigger.set(key, now);
-            this.activeDiagnosticsTasks.set(normalizedFile, taskId);
-            this.log(`[automation] triggered diagnostics task ${taskId.slice(0, 8)} for ${normalizedFile}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue diagnostics task for ${normalizedFile}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    /** Prune lastTrigger entries older than LAST_TRIGGER_MAX_AGE_MS to prevent unbounded growth. */
-    _pruneLastTrigger(now) {
-        for (const [k, t] of this.lastTrigger) {
-            if (now - t > LAST_TRIGGER_MAX_AGE_MS)
-                this.lastTrigger.delete(k);
         }
     }
     /**
@@ -1019,50 +524,9 @@ export class AutomationHooks {
      * Fires when CC's working directory changes — useful for re-snapshotting workspace context.
      */
     handleCwdChanged(newCwd) {
-        const cfg = this.policy.onCwdChanged;
-        if (!cfg?.enabled)
-            return;
-        const safeCwdForCondition = newCwd.slice(0, MAX_FILE_PATH_CHARS);
-        if (!this._matchesCondition(cfg, safeCwdForCondition))
-            return;
-        // Cap path before using as map key to prevent unbounded map growth from
-        // an extension sending unique paths rapidly.
-        const safeCwd = newCwd.slice(0, MAX_FILE_PATH_CHARS);
-        // Cooldown check — keyed on the capped cwd so switching between two known
-        // directories doesn't bypass the global rate but each dir has its own window
-        const key = `cwdChanged:${safeCwd}`;
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for cwd-changed ${newCwd} (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { cwd: safeCwd });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "").replace(/\{\{cwd\}\}/g, untrustedBlock("CWD", safeCwd, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onCwdChanged") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onCwdChanged",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.log(`[automation] triggered cwd-changed task ${taskId.slice(0, 8)} for ${newCwd}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue cwd-changed task for ${newCwd}: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onCwdChanged", {
+            cwd: newCwd,
+        });
     }
     /**
      * Called when Claude Code fires a PreCompact hook.
@@ -1070,237 +534,29 @@ export class AutomationHooks {
      * write a handoff note before Claude loses context.
      */
     handlePreCompact() {
-        const cfg = this.policy.onPreCompact;
-        if (!cfg?.enabled)
-            return;
-        if (this.activePreCompactTaskId) {
-            const existing = this.orchestrator.getTask(this.activePreCompactTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping pre-compact trigger — task ${this.activePreCompactTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activePreCompactTaskId = null;
-        }
-        const key = "pre-compact";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for PreCompact (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        let preCompactPrompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {});
-            if (resolved === null)
-                return;
-            preCompactPrompt = resolved;
-        }
-        else {
-            preCompactPrompt = cfg.prompt ?? "";
-        }
-        preCompactPrompt = truncatePrompt(buildHookMetadata("onPreCompact") + preCompactPrompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt: preCompactPrompt,
-                triggerSource: "onPreCompact",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activePreCompactTaskId = taskId;
-            this.log(`[automation] triggered PreCompact task ${taskId.slice(0, 8)}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue PreCompact task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onPreCompact", {});
     }
     /**
      * Called when Claude Code fires a PostCompact hook (Claude Code 2.1.76+).
      * Re-enqueues the configured prompt so Claude can re-snapshot IDE state after losing context.
      */
     handlePostCompact() {
-        const cfg = this.policy.onPostCompact;
-        if (!cfg?.enabled)
-            return;
-        if (this.activePostCompactTaskId) {
-            const existing = this.orchestrator.getTask(this.activePostCompactTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping post-compact trigger — task ${this.activePostCompactTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activePostCompactTaskId = null;
-        }
-        const key = "post-compact";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for PostCompact (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        let postCompactPrompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {});
-            if (resolved === null)
-                return;
-            postCompactPrompt = resolved;
-        }
-        else {
-            postCompactPrompt = cfg.prompt ?? "";
-        }
-        postCompactPrompt = truncatePrompt(buildHookMetadata("onPostCompact") + postCompactPrompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt: postCompactPrompt,
-                triggerSource: "onPostCompact",
-                hookCfg: cfg,
-            });
-            // Set lastTrigger AFTER successful enqueue so a failed enqueue does not
-            // impose a spurious cooldown on the next trigger attempt.
-            this.lastTrigger.set(key, now);
-            this.activePostCompactTaskId = taskId;
-            this.log(`[automation] triggered PostCompact task ${taskId.slice(0, 8)}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue PostCompact task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onPostCompact", {});
     }
     /**
      * Called when Claude Code fires an InstructionsLoaded hook (Claude Code 2.1.76+).
      * Fires once per session; injects bridge status / tool capability summary at start.
      */
     handleInstructionsLoaded() {
-        const cfg = this.policy.onInstructionsLoaded;
-        if (!cfg?.enabled)
-            return;
-        if (this.activeInstructionsLoadedTaskId) {
-            const existing = this.orchestrator.getTask(this.activeInstructionsLoadedTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping instructions-loaded trigger — task ${this.activeInstructionsLoadedTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeInstructionsLoadedTaskId = null;
-        }
-        // Cross-hook cascade guard: each automation subprocess fires the
-        // InstructionsLoaded CC hook when it starts, which would spawn a second
-        // onInstructionsLoaded task without this check.  Suppress if any
-        // automation task is currently pending or running.
-        const anyAutomationActive = this.orchestrator
-            .list()
-            .some((t) => t.isAutomationTask &&
-            (t.status === "pending" || t.status === "running"));
-        if (anyAutomationActive) {
-            this.log("[automation] skipping instructions-loaded trigger — another automation task is active (cascade guard)");
-            return;
-        }
-        const cooldownMs = cfg.cooldownMs ?? 60_000;
-        const key = "instructions-loaded";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cooldownMs) {
-            this.log(`[automation] cooldown active for InstructionsLoaded (${cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        let instrPrompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {});
-            if (resolved === null)
-                return;
-            instrPrompt = resolved;
-        }
-        else {
-            instrPrompt = cfg.prompt ?? "";
-        }
-        instrPrompt = truncatePrompt(buildHookMetadata("onInstructionsLoaded") + instrPrompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt: instrPrompt,
-                triggerSource: "onInstructionsLoaded",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeInstructionsLoadedTaskId = taskId;
-            this.log(`[automation] triggered InstructionsLoaded task ${taskId.slice(0, 8)}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue InstructionsLoaded task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onInstructionsLoaded", {});
     }
     handleFileSaved(_id, type, file) {
-        const cfg = this.policy.onFileSave;
-        if (!cfg?.enabled)
-            return;
         if (type !== "save")
             return;
-        // Normalize path to prevent loop-guard bypass via equivalent paths
         const normalizedFile = path.resolve(file);
-        // Condition filter
-        if (!this._matchesCondition(cfg, normalizedFile))
-            return;
-        if (!this._evaluateWhen(cfg, normalizedFile))
-            return;
-        // Pattern matching — also try workspace-relative path so patterns like
-        // "src/**/*.ts" work when VS Code sends absolute paths.
-        const relFile = this.workspace && path.isAbsolute(normalizedFile)
-            ? path.relative(this.workspace, normalizedFile)
-            : normalizedFile;
-        const matched = cfg.patterns.some((pattern) => minimatch(normalizedFile, pattern, { dot: true }) ||
-            (relFile !== normalizedFile &&
-                minimatch(relFile, pattern, { dot: true })));
-        if (!matched)
-            return;
-        // Loop guard
-        const existingId = this.activeSaveTasks.get(normalizedFile);
-        if (existingId) {
-            const existing = this.orchestrator.getTask(existingId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping save trigger for ${normalizedFile} — task ${existingId.slice(0, 8)} still active`);
-                return;
-            }
-            // Prune stale entry for completed tasks
-            this.activeSaveTasks.delete(normalizedFile);
-        }
-        // Cooldown check
-        const key = `save:${normalizedFile}`;
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for save ${normalizedFile} (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeFilePath = normalizedFile.slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { file: safeFilePath });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "").replace(/\{\{file\}\}/g, untrustedBlock("FILE PATH", safeFilePath, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onFileSave", normalizedFile) + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onFileSave",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeSaveTasks.set(normalizedFile, taskId);
-            this.log(`[automation] triggered onFileSave task ${taskId.slice(0, 8)} for ${normalizedFile}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue save task for ${normalizedFile}: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onFileSave", {
+            file: normalizedFile,
+        });
     }
     /**
      * Called when the VS Code extension reports a file-changed event (type === "change").
@@ -1308,72 +564,12 @@ export class AutomationHooks {
      * Useful for triggering tasks on unsaved edits (e.g. lint-as-you-type workflows).
      */
     handleFileChanged(_id, type, file) {
-        const cfg = this.policy.onFileChanged;
-        if (!cfg?.enabled)
-            return;
         if (type !== "change")
             return;
         const normalizedFile = path.resolve(file);
-        // Condition filter
-        if (!this._matchesCondition(cfg, normalizedFile))
-            return;
-        // Pattern matching — also try workspace-relative path so patterns like
-        // "src/**/*.ts" work when VS Code sends absolute paths.
-        const relFile = this.workspace && path.isAbsolute(normalizedFile)
-            ? path.relative(this.workspace, normalizedFile)
-            : normalizedFile;
-        const matched = cfg.patterns.some((pattern) => minimatch(normalizedFile, pattern, { dot: true }) ||
-            (relFile !== normalizedFile &&
-                minimatch(relFile, pattern, { dot: true })));
-        if (!matched)
-            return;
-        // Loop guard
-        const existingId = this.activeFileChangedTasks.get(normalizedFile);
-        if (existingId) {
-            const existing = this.orchestrator.getTask(existingId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping file-changed trigger for ${normalizedFile} — task ${existingId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeFileChangedTasks.delete(normalizedFile);
-        }
-        // Cooldown check
-        const key = `fileChanged:${normalizedFile}`;
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for file-changed ${normalizedFile} (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeFilePath = normalizedFile.slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { file: safeFilePath });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "").replace(/\{\{file\}\}/g, untrustedBlock("FILE PATH", safeFilePath, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onFileChanged", normalizedFile) + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onFileChanged",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeFileChangedTasks.set(normalizedFile, taskId);
-            this.log(`[automation] triggered file-changed task ${taskId.slice(0, 8)} for ${normalizedFile}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue file-changed task for ${normalizedFile}: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onFileChanged", {
+            file: normalizedFile,
+        });
     }
     /**
      * Called after every runTests tool invocation completes.
@@ -1381,167 +577,39 @@ export class AutomationHooks {
      */
     handleTestRun(result) {
         const failureCount = result.summary.failed + result.summary.errored;
+        const current = failureCount === 0 ? "pass" : "fail";
         // Update per-runner outcome state unconditionally so onTestPassAfterFailure
         // can detect fail→pass transitions even when onTestRun is disabled/absent.
-        const testStatus = failureCount === 0 ? "passed" : "failed";
+        const passAfterFailRunners = [];
         for (const runner of result.runners) {
             const prev = this.lastTestOutcomeByRunner.get(runner);
-            const current = failureCount === 0 ? "pass" : "fail";
             this.lastTestOutcomeByRunner.set(runner, current);
-            // Update lastTestRunnerStatusByRunner for _evaluateWhen() condition checks
-            this.lastTestRunnerStatusByRunner.set(runner, testStatus);
+            // Feed interpreter state
+            this._automationState = setTestRunnerStatus(this._automationState, runner, current);
             if (prev === "fail" && current === "pass") {
-                this._handleTestPassAfterFailure(result, runner);
-            }
-        }
-        const cfg = this.policy.onTestRun;
-        if (!cfg?.enabled)
-            return;
-        // Honour onFailureOnly: skip trigger when all tests pass
-        if (cfg.onFailureOnly && failureCount === 0)
-            return;
-        // Skip if test run was shorter than the configured minimum duration
-        // Only skip when durationMs is known and below the threshold.
-        // If durationMs is absent (runner didn't report timing), let the hook fire —
-        // silently suppressing based on missing data would be surprising behaviour.
-        if (cfg.minDuration !== undefined &&
-            result.summary.durationMs !== undefined &&
-            result.summary.durationMs < cfg.minDuration) {
-            this.log(`[automation] skipping test-run trigger — duration ${result.summary.durationMs}ms < minDuration ${cfg.minDuration}ms`);
-            return;
-        }
-        // Evaluate optional when condition
-        if (!this._evaluateWhen(cfg))
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeTestRunTaskId) {
-            const existing = this.orchestrator.getTask(this.activeTestRunTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping test-run trigger — task ${this.activeTestRunTaskId.slice(0, 8)} still active`);
-                return;
+                passAfterFailRunners.push(runner);
             }
-            this.activeTestRunTaskId = null;
-        }
-        // Cooldown check (workspace-global key)
-        const key = "testRun:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for test-run (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const runnerStr = result.runners.join(", ") || "unknown";
-        const failureLines = result.failures
-            .slice(0, 10)
-            .map((f) => {
-            const loc = f.file ? ` (${f.file.slice(0, MAX_FILE_PATH_CHARS)})` : "";
-            const msg = f.message
-                ? `: ${f.message.slice(0, MAX_DIAGNOSTIC_MSG_CHARS)}`
-                : "";
-            return `- ${f.name}${loc}${msg}`;
-        })
-            .join("\n");
-        const failuresText = result.failures.length > 10
-            ? `${failureLines}\n… and ${result.failures.length - 10} more`
-            : failureLines;
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                runner: runnerStr,
-                failed: String(failureCount),
-                passed: String(result.summary.passed),
-                total: String(result.summary.total),
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
         }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{runner\}\}/g, untrustedBlock("TEST RUNNER", runnerStr, nonce))
-                    .replace(/\{\{failed\}\}/g, String(failureCount))
-                    .replace(/\{\{passed\}\}/g, String(result.summary.passed))
-                    .replace(/\{\{total\}\}/g, String(result.summary.total))
-                    .replace(/\{\{failures\}\}/g, untrustedBlock("TEST FAILURES", failuresText, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onTestRun") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onTestRun",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeTestRunTaskId = taskId;
-            this.log(`[automation] triggered test-run task ${taskId.slice(0, 8)} (${failureCount} failure(s))`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue test-run task: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    /**
-     * Internal — fires onTestPassAfterFailure when a specific runner transitions
-     * from failing → passing. Called from handleTestRun after outcome state update.
-     */
-    _handleTestPassAfterFailure(result, runner) {
-        const cfg = this.policy.onTestPassAfterFailure;
-        if (!cfg?.enabled)
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeTestPassAfterFailureTaskId) {
-            const existing = this.orchestrator.getTask(this.activeTestPassAfterFailureTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping test-pass-after-failure — task ${this.activeTestPassAfterFailureTaskId.slice(0, 8)} still active`);
-                return;
+        const testRunEventData = {
+            runner: result.runners.join(", ") || "",
+            failed: String(failureCount),
+            passed: String(result.summary.passed),
+            total: String(result.summary.total),
+            failures: JSON.stringify(result.failures.slice(0, 100)),
+            durationMs: String(result.summary.durationMs ?? ""),
+        };
+        // Chain interpreter runs so flush() awaits all of them and state is updated
+        // sequentially. If any runner had a fail→pass transition, run that first so
+        // its cooldown state is visible to subsequent runs within the same flush.
+        if (passAfterFailRunners.length > 0) {
+            let chain = Promise.resolve();
+            for (const runner of passAfterFailRunners) {
+                chain = chain.then(() => this._runInterpreter("onTestPassAfterFailure", { runner }));
             }
-            this.activeTestPassAfterFailureTaskId = null;
-        }
-        // Cooldown check (workspace-global key)
-        const key = "testPassAfterFailure:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for test-pass-after-failure (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                runner,
-                passed: String(result.summary.passed),
-                total: String(result.summary.total),
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
+            this._lastRunPromise = chain.then(() => this._runInterpreter("onTestRun", testRunEventData));
         }
         else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{runner\}\}/g, untrustedBlock("TEST RUNNER", runner, nonce))
-                    .replace(/\{\{passed\}\}/g, String(result.summary.passed))
-                    .replace(/\{\{total\}\}/g, String(result.summary.total)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onTestPassAfterFailure") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onTestPassAfterFailure",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeTestPassAfterFailureTaskId = taskId;
-            this.log(`[automation] triggered test-pass-after-failure task ${taskId.slice(0, 8)} (runner: ${runner})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue test-pass-after-failure task: ${err instanceof Error ? err.message : String(err)}`);
+            this._lastRunPromise = this._runInterpreter("onTestRun", testRunEventData);
         }
     }
     /**
@@ -1549,704 +617,109 @@ export class AutomationHooks {
      * Fires the onGitCommit automation hook if configured.
      */
     async handleGitCommit(result) {
-        const cfg = this.policy.onGitCommit;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.branch))
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeGitCommitTaskId) {
-            const existing = this.orchestrator.getTask(this.activeGitCommitTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping git-commit trigger — task ${this.activeGitCommitTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeGitCommitTaskId = null;
-        }
-        // Cooldown check (workspace-global)
-        const key = "gitCommit:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for git-commit (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeHash = result.hash.slice(0, 64);
-        const safeBranchCommit = result.branch.slice(0, MAX_FILE_PATH_CHARS);
-        const safeMessage = result.message.slice(0, MAX_DIAGNOSTIC_MSG_CHARS);
-        const fileList = result.files
-            .slice(0, 20)
-            .map((f) => `- ${f.slice(0, MAX_FILE_PATH_CHARS)}`)
-            .join("\n");
-        const filesText = result.files.length > 20
-            ? `${fileList}\n… and ${result.files.length - 20} more`
-            : fileList;
-        // B1: Fetch changeImpact if extensionClient is connected and files exist
-        // Uses getDiagnostics as a lightweight proxy: summarizes error/warning count
-        // across changed files as a blast-radius indicator.
-        let changeImpact;
-        if (this.extensionClient?.isConnected() && result.files.length > 0) {
-            try {
-                const diagResult = await Promise.race([
-                    this.extensionClient.getDiagnostics(),
-                    new Promise((resolve) => setTimeout(() => resolve(null), 2000)),
-                ]);
-                if (diagResult) {
-                    const diagArr = Array.isArray(diagResult) ? diagResult : [];
-                    const errorCount = diagArr.filter((d) => d.severity === "error" || d.severity === "warning").length;
-                    changeImpact = `${result.count} file(s) changed; ${errorCount} diagnostic(s) in workspace`;
-                }
-            }
-            catch {
-                // best-effort — changeImpact remains undefined
-            }
-        }
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                hash: safeHash,
-                branch: safeBranchCommit,
-                message: safeMessage,
-                count: String(result.count),
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{hash\}\}/g, untrustedBlock("COMMIT HASH", safeHash, nonce))
-                    .replace(/\{\{branch\}\}/g, untrustedBlock("BRANCH", safeBranchCommit, nonce))
-                    .replace(/\{\{message\}\}/g, untrustedBlock("COMMIT MESSAGE", safeMessage, nonce))
-                    .replace(/\{\{count\}\}/g, untrustedBlock("COMMIT COUNT", String(result.count), nonce))
-                    .replace(/\{\{files\}\}/g, untrustedBlock("COMMITTED FILES", filesText, nonce))
-                    .replace(/\{\{changeImpact\}\}/g, changeImpact
-                    ? untrustedBlock("CHANGE IMPACT", changeImpact, nonce)
-                    : "(change impact unavailable)") ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onGitCommit") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onGitCommit",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeGitCommitTaskId = taskId;
-            this.log(`[automation] triggered git-commit task ${taskId.slice(0, 8)} (hash: ${result.hash}, ${result.count} file(s))`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue git-commit task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onGitCommit", {
+            hash: result.hash,
+            branch: result.branch,
+            message: result.message,
+            count: String(result.count),
+            files: result.files.join(", "),
+        });
     }
     /**
      * Called after a successful gitPush tool call.
      * Fires the onGitPush automation hook if configured.
      */
     handleGitPush(result) {
-        const cfg = this.policy.onGitPush;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.branch))
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeGitPushTaskId) {
-            const existing = this.orchestrator.getTask(this.activeGitPushTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping git-push trigger — task ${this.activeGitPushTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeGitPushTaskId = null;
-        }
-        // Cooldown check (workspace-global)
-        const key = "gitPush:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for git-push (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeRemote = result.remote.slice(0, MAX_FILE_PATH_CHARS);
-        const safeBranch = result.branch.slice(0, MAX_FILE_PATH_CHARS);
-        const safeHash = result.hash.slice(0, 64);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { remote: safeRemote, branch: safeBranch, hash: safeHash });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{remote\}\}/g, untrustedBlock("REMOTE", safeRemote, nonce))
-                    .replace(/\{\{branch\}\}/g, untrustedBlock("BRANCH", safeBranch, nonce))
-                    .replace(/\{\{hash\}\}/g, untrustedBlock("COMMIT HASH", safeHash, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onGitPush") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onGitPush",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeGitPushTaskId = taskId;
-            this.log(`[automation] triggered git-push task ${taskId.slice(0, 8)} (${result.remote}/${result.branch} @ ${result.hash})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue git-push task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onGitPush", {
+            branch: result.branch,
+            remote: result.remote,
+            hash: result.hash,
+        });
     }
     /**
      * Fires the onGitPull automation hook if configured.
      */
     handleGitPull(result) {
-        const cfg = this.policy.onGitPull;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.branch))
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeGitPullTaskId) {
-            const existing = this.orchestrator.getTask(this.activeGitPullTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping git-pull trigger — task ${this.activeGitPullTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeGitPullTaskId = null;
-        }
-        // Cooldown check (workspace-global)
-        const key = "gitPull:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for git-pull (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeRemote = result.remote.slice(0, MAX_FILE_PATH_CHARS);
-        const safeBranch = result.branch.slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { remote: safeRemote, branch: safeBranch });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{remote\}\}/g, untrustedBlock("REMOTE", safeRemote, nonce))
-                    .replace(/\{\{branch\}\}/g, untrustedBlock("BRANCH", safeBranch, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onGitPull") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onGitPull",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeGitPullTaskId = taskId;
-            this.log(`[automation] triggered git-pull task ${taskId.slice(0, 8)} (${result.remote}/${result.branch}, alreadyUpToDate=${result.alreadyUpToDate})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue git-pull task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onGitPull", {
+            branch: result.branch,
+            remote: result.remote,
+        });
     }
     /**
      * Called after a successful gitCheckout tool call.
      * Fires the onBranchCheckout automation hook if configured.
      */
     handleBranchCheckout(result) {
-        const cfg = this.policy.onBranchCheckout;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.branch))
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeBranchCheckoutTaskId) {
-            const existing = this.orchestrator.getTask(this.activeBranchCheckoutTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping branch-checkout trigger — task ${this.activeBranchCheckoutTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeBranchCheckoutTaskId = null;
-        }
-        // Cooldown check (workspace-global)
-        const key = "branchCheckout:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for branch-checkout (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeBranch = result.branch.slice(0, MAX_FILE_PATH_CHARS);
-        const safePreviousBranch = (result.previousBranch ?? "(detached HEAD)").slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                branch: safeBranch,
-                previousBranch: safePreviousBranch,
-                created: String(result.created),
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{branch\}\}/g, untrustedBlock("BRANCH", safeBranch, nonce))
-                    .replace(/\{\{previousBranch\}\}/g, untrustedBlock("PREVIOUS BRANCH", safePreviousBranch, nonce))
-                    .replace(/\{\{created\}\}/g, String(result.created)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onBranchCheckout") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onBranchCheckout",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeBranchCheckoutTaskId = taskId;
-            this.log(`[automation] triggered branch-checkout task ${taskId.slice(0, 8)} (${result.created ? "created" : "switched to"} ${result.branch})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue branch-checkout task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onBranchCheckout", {
+            branch: result.branch,
+            previousBranch: result.previousBranch ?? "(detached HEAD)",
+            created: String(result.created),
+        });
     }
     /**
      * Fires the onPullRequest automation hook if configured.
      */
     handlePullRequest(result) {
-        const cfg = this.policy.onPullRequest;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.branch))
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activePullRequestTaskId) {
-            const existing = this.orchestrator.getTask(this.activePullRequestTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping pull-request trigger — task ${this.activePullRequestTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activePullRequestTaskId = null;
-        }
-        const key = "pullRequest:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] skipping pull-request trigger — cooldown active (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeUrl = result.url.slice(0, MAX_FILE_PATH_CHARS);
-        const safeTitle = result.title.slice(0, MAX_DIAGNOSTIC_MSG_CHARS);
-        const safeBranch = result.branch.slice(0, MAX_FILE_PATH_CHARS);
-        const safeNumber = result.number !== null ? String(result.number) : "(unknown)";
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                url: safeUrl,
-                title: safeTitle,
-                branch: safeBranch,
-                number: safeNumber,
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{url\}\}/g, untrustedBlock("PR URL", safeUrl, nonce))
-                    .replace(/\{\{number\}\}/g, safeNumber)
-                    .replace(/\{\{title\}\}/g, untrustedBlock("PR TITLE", safeTitle, nonce))
-                    .replace(/\{\{branch\}\}/g, untrustedBlock("BRANCH", safeBranch, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onPullRequest") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onPullRequest",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activePullRequestTaskId = taskId;
-            this.log(`[automation] triggered pull-request task ${taskId.slice(0, 8)} (PR #${result.number ?? "?"}: ${result.title})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue pull-request task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onPullRequest", {
+            title: result.title,
+            url: result.url,
+            branch: result.branch,
+            number: result.number != null ? String(result.number) : "",
+        });
     }
     handleTaskCreated(result) {
-        const cfg = this.policy.onTaskCreated;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.taskId))
-            return;
-        if (this.activeTaskCreatedTaskId) {
-            const existing = this.orchestrator.getTask(this.activeTaskCreatedTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping task-created trigger — task ${this.activeTaskCreatedTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeTaskCreatedTaskId = null;
-        }
-        const key = "taskCreated:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] skipping task-created trigger — cooldown active (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeTaskId = result.taskId.slice(0, MAX_FILE_PATH_CHARS);
-        const safePrompt = result.prompt.slice(0, MAX_DIAGNOSTIC_MSG_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { taskId: safeTaskId, prompt: safePrompt });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{taskId\}\}/g, untrustedBlock("TASK ID", safeTaskId, nonce))
-                    .replace(/\{\{prompt\}\}/g, untrustedBlock("TASK PROMPT", safePrompt, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onTaskCreated") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onTaskCreated",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeTaskCreatedTaskId = taskId;
-            this.log(`[automation] triggered task-created task ${taskId.slice(0, 8)} (spawned task: ${result.taskId.slice(0, 8)})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue task-created task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onTaskCreated", {
+            taskId: result.taskId,
+            prompt: result.prompt,
+        });
     }
     handlePermissionDenied(result) {
-        const cfg = this.policy.onPermissionDenied;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.tool))
-            return;
-        if (this.activePermissionDeniedTaskId) {
-            const existing = this.orchestrator.getTask(this.activePermissionDeniedTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping permission-denied trigger — task ${this.activePermissionDeniedTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activePermissionDeniedTaskId = null;
-        }
-        const key = "permissionDenied:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] skipping permission-denied trigger — cooldown active (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeTool = result.tool.slice(0, MAX_FILE_PATH_CHARS);
-        const safeReason = result.reason.slice(0, MAX_DIAGNOSTIC_MSG_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { tool: safeTool, reason: safeReason });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{tool\}\}/g, untrustedBlock("TOOL NAME", safeTool, nonce))
-                    .replace(/\{\{reason\}\}/g, untrustedBlock("DENIAL REASON", safeReason, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onPermissionDenied") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onPermissionDenied",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activePermissionDeniedTaskId = taskId;
-            this.log(`[automation] triggered permission-denied task ${taskId.slice(0, 8)} (tool: ${result.tool})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue permission-denied task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onPermissionDenied", {
+            tool: result.tool,
+            reason: result.reason,
+        });
     }
     /**
      * Fires the onDiagnosticsCleared hook when a file transitions from non-zero to zero errors.
      * Called internally by handleDiagnosticsChanged.
      */
     handleDiagnosticsCleared(normalizedFile) {
-        const cfg = this.policy.onDiagnosticsCleared;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, normalizedFile))
-            return;
-        // Loop guard: skip if a task for this file is still pending/running
-        const existingId = this.activeDiagnosticsClearedTasks.get(normalizedFile);
-        if (existingId) {
-            const existing = this.orchestrator.getTask(existingId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping diagnostics-cleared trigger for ${normalizedFile} — task ${existingId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeDiagnosticsClearedTasks.delete(normalizedFile);
-        }
-        const key = `diagnosticsCleared:${normalizedFile}`;
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for diagnostics-cleared ${normalizedFile} (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeFilePath = normalizedFile.slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { file: safeFilePath });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "").replace(/\{\{file\}\}/g, untrustedBlock("FILE PATH", safeFilePath, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onDiagnosticsCleared", normalizedFile) + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onDiagnosticsCleared",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeDiagnosticsClearedTasks.set(normalizedFile, taskId);
-            this.log(`[automation] triggered diagnostics-cleared task ${taskId.slice(0, 8)} for ${normalizedFile}`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue diagnostics-cleared task for ${normalizedFile}: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onDiagnosticsCleared", {
+            file: normalizedFile,
+            diagnosticSig: "",
+        });
     }
     /**
      * Fires the onTaskSuccess hook when a Claude orchestrator task completes with status "done".
      * Call from bridge.ts when a task transitions to done.
      */
     handleTaskSuccess(result) {
-        const cfg = this.policy.onTaskSuccess;
-        if (!cfg?.enabled)
-            return;
-        if (!this._matchesCondition(cfg, result.taskId))
-            return;
-        // Loop guard: skip if a prior task-success task is still active
-        if (this.activeTaskSuccessTaskId) {
-            const existing = this.orchestrator.getTask(this.activeTaskSuccessTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping task-success trigger — task ${this.activeTaskSuccessTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeTaskSuccessTaskId = null;
-        }
-        const key = "taskSuccess:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] skipping task-success trigger — cooldown active (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeTaskId = result.taskId.slice(0, MAX_FILE_PATH_CHARS);
-        const safeOutput = result.output.slice(0, 500);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, { taskId: safeTaskId, output: safeOutput });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{taskId\}\}/g, untrustedBlock("TASK ID", safeTaskId, nonce))
-                    .replace(/\{\{output\}\}/g, untrustedBlock("TASK OUTPUT", safeOutput, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onTaskSuccess") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onTaskSuccess",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeTaskSuccessTaskId = taskId;
-            this.log(`[automation] triggered task-success task ${taskId.slice(0, 8)} (completed task: ${result.taskId.slice(0, 8)})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue task-success task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onTaskSuccess", {
+            taskId: result.taskId,
+            output: result.output,
+        });
     }
     /**
      * Called when a VS Code debug session ends (hasActiveSession transitions true→false).
      * Fires the onDebugSessionEnd automation hook if configured.
      */
     async handleDebugSessionEnd(result) {
-        const cfg = this.policy.onDebugSessionEnd;
-        if (!cfg?.enabled)
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeDebugSessionEndTaskId) {
-            const existing = this.orchestrator.getTask(this.activeDebugSessionEndTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping debug-session-end trigger — task ${this.activeDebugSessionEndTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeDebugSessionEndTaskId = null;
-        }
-        // Cooldown check (workspace-global)
-        const key = "debugSessionEnd:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for debug-session-end (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeSessionName = result.sessionName.slice(0, MAX_FILE_PATH_CHARS);
-        const safeSessionType = result.sessionType.slice(0, MAX_FILE_PATH_CHARS);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                sessionName: safeSessionName,
-                sessionType: safeSessionType,
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{sessionName\}\}/g, untrustedBlock("SESSION NAME", safeSessionName, nonce))
-                    .replace(/\{\{sessionType\}\}/g, untrustedBlock("SESSION TYPE", safeSessionType, nonce)) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onDebugSessionEnd") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onDebugSessionEnd",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeDebugSessionEndTaskId = taskId;
-            this.log(`[automation] triggered debug-session-end task ${taskId.slice(0, 8)} (session: ${result.sessionName}, type: ${result.sessionType})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue debug-session-end task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onDebugSessionEnd", {
+            sessionName: result.sessionName,
+            sessionType: result.sessionType,
+        });
     }
     /**
      * Called when a VS Code debug session starts (hasActiveSession transitions false→true).
      * Fires the onDebugSessionStart automation hook if configured.
      */
     async handleDebugSessionStart(result) {
-        const cfg = this.policy.onDebugSessionStart;
-        if (!cfg?.enabled)
-            return;
-        // Loop guard: skip if a task is still pending/running
-        if (this.activeDebugSessionStartTaskId) {
-            const existing = this.orchestrator.getTask(this.activeDebugSessionStartTaskId);
-            if (existing &&
-                (existing.status === "pending" || existing.status === "running")) {
-                this.log(`[automation] skipping debug-session-start trigger — task ${this.activeDebugSessionStartTaskId.slice(0, 8)} still active`);
-                return;
-            }
-            this.activeDebugSessionStartTaskId = null;
-        }
-        // Cooldown check (workspace-global)
-        const key = "debugSessionStart:global";
-        const now = Date.now();
-        const last = this.lastTrigger.get(key) ?? 0;
-        if (now - last < cfg.cooldownMs) {
-            this.log(`[automation] cooldown active for debug-session-start (${cfg.cooldownMs - (now - last)}ms remaining)`);
-            return;
-        }
-        this._pruneLastTrigger(now);
-        const safeSessionName = result.sessionName.slice(0, MAX_FILE_PATH_CHARS);
-        const safeSessionType = result.sessionType.slice(0, MAX_FILE_PATH_CHARS);
-        const safeActiveFile = result.activeFile.slice(0, MAX_FILE_PATH_CHARS);
-        const breakpointCount = String(result.breakpointCount);
-        let prompt;
-        if (cfg.promptName) {
-            const resolved = this._resolveNamedPrompt(cfg.promptName, cfg.promptArgs ?? {}, {
-                sessionName: safeSessionName,
-                sessionType: safeSessionType,
-                activeFile: safeActiveFile,
-                breakpointCount,
-            });
-            if (resolved === null)
-                return;
-            prompt = resolved;
-        }
-        else {
-            const nonce = crypto.randomBytes(6).toString("hex");
-            prompt =
-                (cfg.prompt ?? "")
-                    .replace(/\{\{sessionName\}\}/g, untrustedBlock("SESSION NAME", safeSessionName, nonce))
-                    .replace(/\{\{sessionType\}\}/g, untrustedBlock("SESSION TYPE", safeSessionType, nonce))
-                    .replace(/\{\{activeFile\}\}/g, untrustedBlock("ACTIVE FILE", safeActiveFile, nonce))
-                    .replace(/\{\{breakpointCount\}\}/g, breakpointCount) ?? "";
-        }
-        prompt = truncatePrompt(buildHookMetadata("onDebugSessionStart") + prompt);
-        try {
-            const taskId = this._enqueueAutomationTask({
-                prompt,
-                triggerSource: "onDebugSessionStart",
-                hookCfg: cfg,
-            });
-            this.lastTrigger.set(key, now);
-            this.activeDebugSessionStartTaskId = taskId;
-            this.log(`[automation] triggered debug-session-start task ${taskId.slice(0, 8)} (session: ${result.sessionName}, type: ${result.sessionType}, breakpoints: ${result.breakpointCount})`);
-        }
-        catch (err) {
-            this.log(`[automation] failed to enqueue debug-session-start task: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        this._lastRunPromise = this._runInterpreter("onDebugSessionStart", {
+            sessionName: result.sessionName,
+            sessionType: result.sessionType,
+            breakpointCount: String(result.breakpointCount),
+            activeFile: result.activeFile,
+        });
     }
     /** Summary of automation policy for getBridgeStatus. */
     getStatus() {
@@ -2380,7 +853,7 @@ export class AutomationHooks {
             unwiredEnabledHooks,
             defaultModel: p.defaultModel ?? "claude-haiku-4-5-20251001",
             maxTasksPerHour: p.maxTasksPerHour ?? 20,
-            tasksThisHour: this.taskTimestamps.filter((t) => t >= Date.now() - 60 * 60 * 1_000).length,
+            tasksThisHour: tasksInLastHour(this._automationState, Date.now()),
             defaultEffort: p.defaultEffort ?? "low",
             automationSystemPrompt: (p.automationSystemPrompt ?? DEFAULT_AUTOMATION_SYSTEM_PROMPT).slice(0, 80),
         };