claude-novice 0.2.0

package/scripts/lib/state.js

@@ -0,0 +1,256 @@
+// State layer SSOT for the novice plugin.
+// All persistent state lives under CLAUDE_PLUGIN_DATA — never under CLAUDE_PLUGIN_ROOT.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+
+export const STATE_FILE_MAX_BYTES = 256 * 1024;
+export const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+
+export const BUILTIN_DEFAULTS = Object.freeze({ level: 1, enabled: true });
+
+export function dataDir(env = process.env) {
+  const fromEnv = env.CLAUDE_PLUGIN_DATA;
+  if (fromEnv && fromEnv.trim() !== '') return fromEnv;
+  // Fallback keeps state out of the plugin root even on older runtimes.
+  return path.join(os.homedir(), '.claude', 'novice-plugin-data');
+}
+
+export function projectKey(cwd = process.cwd()) {
+  let canonical;
+  try {
+    canonical = execFileSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 3000,
+    }).trim();
+  } catch {
+    canonical = null;
+  }
+  if (!canonical) {
+    try {
+      canonical = fs.realpathSync(cwd);
+    } catch {
+      canonical = path.resolve(cwd);
+    }
+  }
+  return crypto.createHash('sha256').update(canonical).digest('hex');
+}
+
+export function assertSafeId(id, label) {
+  if (typeof id !== 'string' || id === '' || !/^[A-Za-z0-9_.-]+$/.test(id) || id.includes('..')) {
+    throw new Error(`unsafe ${label}: ${String(id)}`);
+  }
+  return id;
+}
+
+export function projectOverridePath(key, env = process.env) {
+  return path.join(dataDir(env), 'projects', `${assertSafeId(key, 'project key')}.json`);
+}
+
+export function sessionDir(sessionId, env = process.env) {
+  return path.join(dataDir(env), 'sessions', assertSafeId(sessionId, 'session id'));
+}
+
+export function sessionStatePath(sessionId, env = process.env) {
+  return path.join(sessionDir(sessionId, env), 'state.json');
+}
+
+export function sessionEventsDir(sessionId, env = process.env) {
+  return path.join(sessionDir(sessionId, env), 'events');
+}
+
+function isSymlink(file) {
+  try {
+    return fs.lstatSync(file).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
+// Safe read: symlink targets, oversized files, and corrupt JSON all return the fallback.
+export function readJsonSafe(file, fallback = null, maxBytes = STATE_FILE_MAX_BYTES) {
+  try {
+    if (isSymlink(file)) return fallback;
+    const st = fs.statSync(file);
+    if (!st.isFile() || st.size > maxBytes) return fallback;
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+// Atomic write: temp file in the same directory + rename, mode 0600, symlink refusal, size cap.
+export function writeJsonAtomic(file, obj, maxBytes = STATE_FILE_MAX_BYTES) {
+  const payload = JSON.stringify(obj, null, 2);
+  if (Buffer.byteLength(payload, 'utf8') > maxBytes) {
+    throw new Error(`state payload exceeds size cap: ${file}`);
+  }
+  if (isSymlink(file)) {
+    throw new Error(`refusing to write through symlink: ${file}`);
+  }
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (isSymlink(dir)) {
+    throw new Error(`refusing to write into symlinked directory: ${dir}`);
+  }
+  const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
+  fs.writeFileSync(tmp, payload, { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+// Atomic create for per-tool event files: fails if the file already exists (wx flag).
+export function writeJsonExclusive(file, obj, maxBytes = STATE_FILE_MAX_BYTES) {
+  const payload = JSON.stringify(obj);
+  if (Buffer.byteLength(payload, 'utf8') > maxBytes) {
+    throw new Error(`event payload exceeds size cap: ${file}`);
+  }
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(file, payload, { mode: 0o600, flag: 'wx' });
+}
+
+// ---- project mode config ----
+
+function userConfigDefaults(env = process.env) {
+  // Claude Code exposes plugin userConfig values to command hooks via env.
+  const raw = env.CLAUDE_PLUGIN_CONFIG;
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    const out = {};
+    if (parsed.default_level !== undefined) {
+      const lvl = Number(parsed.default_level);
+      if ([1, 2, 3].includes(lvl)) out.level = lvl;
+    }
+    if (typeof parsed.novice_enabled === 'boolean') out.enabled = parsed.novice_enabled;
+    return out;
+  } catch {
+    return {};
+  }
+}
+
+// Precedence: project override in CLAUDE_PLUGIN_DATA → userConfig default → built-in Level 1.
+export function getProjectConfig(cwd = process.cwd(), env = process.env) {
+  const key = projectKey(cwd);
+  const override = readJsonSafe(projectOverridePath(key, env), {});
+  const user = userConfigDefaults(env);
+  const merged = { ...BUILTIN_DEFAULTS, ...user, ...sanitizeOverride(override) };
+  return {
+    key,
+    level: merged.level,
+    enabled: merged.enabled,
+    protected_branches_extra: merged.protected_branches_extra ?? [],
+    muted_terms: merged.muted_terms ?? [],
+  };
+}
+
+function sanitizeOverride(override) {
+  const out = {};
+  if (override && typeof override === 'object') {
+    if ([1, 2, 3].includes(Number(override.level))) out.level = Number(override.level);
+    if (typeof override.enabled === 'boolean') out.enabled = override.enabled;
+    if (Array.isArray(override.protected_branches_extra)) {
+      out.protected_branches_extra = override.protected_branches_extra.filter((b) => typeof b === 'string');
+    }
+    if (Array.isArray(override.muted_terms)) {
+      out.muted_terms = override.muted_terms.filter((t) => typeof t === 'string');
+    }
+  }
+  return out;
+}
+
+export function setProjectMode(cwd, mode, env = process.env) {
+  const key = projectKey(cwd);
+  const file = projectOverridePath(key, env);
+  const current = sanitizeOverride(readJsonSafe(file, {}));
+  let next;
+  if (mode === 'off') {
+    next = { ...current, enabled: false };
+  } else {
+    const lvl = Number(mode);
+    if (![1, 2, 3].includes(lvl)) throw new Error(`invalid mode: ${mode}`);
+    next = { ...current, enabled: true, level: lvl };
+  }
+  next.updated_at = new Date().toISOString();
+  writeJsonAtomic(file, next);
+  return next;
+}
+
+// Project-scoped mute list (persists across sessions, unlike per-session term counters).
+function updateMutedTerms(cwd, env, mutate) {
+  const key = projectKey(cwd);
+  const file = projectOverridePath(key, env);
+  const current = sanitizeOverride(readJsonSafe(file, {}));
+  const set = new Set(current.muted_terms || []);
+  mutate(set);
+  const next = { ...current, muted_terms: [...set], updated_at: new Date().toISOString() };
+  writeJsonAtomic(file, next);
+  return next;
+}
+
+export function muteProjectTerm(cwd, term, env = process.env) {
+  return updateMutedTerms(cwd, env, (set) => set.add(term));
+}
+
+export function unmuteProjectTerm(cwd, term, env = process.env) {
+  return updateMutedTerms(cwd, env, (set) => set.delete(term));
+}
+
+// ---- session state ----
+
+export function defaultSessionState() {
+  return {
+    schema_version: 1,
+    term_counts: {},
+    reset_terms: [],
+    last_message_hash: null,
+    capsule_revision: null,
+    glossary_revision: null,
+    skip_next_submit: false,
+    off_tombstone_emitted: false,
+    updated_at: null,
+  };
+}
+
+export function loadSession(sessionId, env = process.env) {
+  const state = readJsonSafe(sessionStatePath(sessionId, env), null);
+  if (!state || typeof state !== 'object' || state.schema_version !== 1) {
+    return defaultSessionState();
+  }
+  return { ...defaultSessionState(), ...state };
+}
+
+export function saveSession(sessionId, state, env = process.env) {
+  state.updated_at = new Date().toISOString();
+  writeJsonAtomic(sessionStatePath(sessionId, env), state);
+}
+
+export function deleteSession(sessionId, env = process.env) {
+  try {
+    fs.rmSync(sessionDir(sessionId, env), { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+}
+
+export function cleanupExpiredSessions(env = process.env, ttlMs = SESSION_TTL_MS, now = Date.now()) {
+  const root = path.join(dataDir(env), 'sessions');
+  let entries;
+  try {
+    entries = fs.readdirSync(root);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const dir = path.join(root, entry);
+    try {
+      const st = fs.lstatSync(dir);
+      if (!st.isDirectory()) continue;
+      if (now - st.mtimeMs > ttlMs) fs.rmSync(dir, { recursive: true, force: true });
+    } catch {
+      // skip entries we cannot stat
+    }
+  }
+}

package/scripts/post-tool-batch.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+// PostToolBatch: single writer over the per-tool event files. Aggregates
+// success/failure fingerprints into session state, deletes processed events,
+// and injects AT MOST ONE novice intervention per batch when the same work
+// keeps failing past the level's threshold. novice off → aggregation still
+// happens, intervention text does not.
+// Observation hook: fail open (exit 0) on any internal error.
+import fs from 'node:fs';
+import path from 'node:path';
+import { readStdinJson, emitAdditionalContext, failOpen } from './lib/hookio.js';
+import { getProjectConfig, loadSession, saveSession, sessionEventsDir, readJsonSafe } from './lib/state.js';
+import { loadLevels } from './lib/capsule.js';
+
+const MAX_TRACKED_FINGERPRINTS = 50;
+
+function readAndClearEvents(sessionId) {
+  const dir = sessionEventsDir(sessionId);
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const events = [];
+  for (const name of names) {
+    if (!name.endsWith('.json')) continue;
+    const file = path.join(dir, name);
+    const event = readJsonSafe(file, null);
+    if (event && typeof event.fingerprint === 'string') events.push(event);
+    try {
+      fs.rmSync(file, { force: true });
+    } catch {
+      // best-effort deletion; a leftover file is re-aggregated next batch at worst
+    }
+  }
+  return events;
+}
+
+function aggregate(session, events) {
+  const stats = session.loop_stats && typeof session.loop_stats === 'object' ? session.loop_stats : {};
+  for (const event of events) {
+    const entry = stats[event.fingerprint] ?? { count: 0, failures: 0, intervened_at_failures: 0 };
+    entry.count += 1;
+    if (event.status === 'failure') entry.failures += 1;
+    entry.last_ts = event.ts ?? Date.now();
+    stats[event.fingerprint] = entry;
+  }
+  // Cap stored fingerprints: drop oldest by last_ts.
+  const keys = Object.keys(stats);
+  if (keys.length > MAX_TRACKED_FINGERPRINTS) {
+    keys
+      .sort((a, b) => (stats[a].last_ts ?? 0) - (stats[b].last_ts ?? 0))
+      .slice(0, keys.length - MAX_TRACKED_FINGERPRINTS)
+      .forEach((k) => delete stats[k]);
+  }
+  session.loop_stats = stats;
+  return stats;
+}
+
+// Pick at most one fingerprint that crossed the threshold since its last intervention.
+function pickIntervention(stats, threshold) {
+  let best = null;
+  for (const [fingerprint, entry] of Object.entries(stats)) {
+    const newFailures = entry.failures - (entry.intervened_at_failures ?? 0);
+    if (newFailures >= threshold && (!best || entry.failures > best.entry.failures)) {
+      best = { fingerprint, entry };
+    }
+  }
+  return best;
+}
+
+function main() {
+  const input = readStdinJson();
+  const sessionId = input.session_id;
+  const cwd = input.cwd || process.cwd();
+  if (typeof sessionId !== 'string' || sessionId === '') return;
+
+  const session = loadSession(sessionId);
+  const events = readAndClearEvents(sessionId);
+  if (events.length === 0) return;
+
+  const stats = aggregate(session, events);
+  const config = getProjectConfig(cwd);
+
+  if (config.enabled) {
+    const levels = loadLevels();
+    const threshold = levels.levels[String(config.level)]?.repeat_failure_threshold ?? 3;
+    const target = pickIntervention(stats, threshold);
+    if (target) {
+      target.entry.intervened_at_failures = target.entry.failures;
+      emitAdditionalContext(
+        'PostToolBatch',
+        `[novice] 같은 작업이 ${target.entry.failures}회 실패했어요. 같은 방법을 반복하면 시간과 사용량만 늘어날 수 있어요. ` +
+          '다음 중 하나를 권해요: (1) 마지막 오류 메시지를 사용자에게 그대로 보여 주고 원인을 함께 확인, ' +
+          '(2) 접근 방법을 바꿔 다시 시도, (3) 지금까지 시도한 내용을 정리하고 사용자 확인을 받기.',
+      );
+    }
+  }
+
+  saveSession(sessionId, session);
+}
+
+try {
+  main();
+  process.exit(0);
+} catch {
+  failOpen();
+}

package/scripts/post-tool-use-failure.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// PostToolUseFailure: records a failure fingerprint event for the batch aggregator.
+// Stores only a hash fingerprint and a coarse error class — never the raw error,
+// argv, or output. Atomic-create per tool_use_id; PostToolBatch is the single
+// writer that aggregates and deletes these events.
+// Observation hook: fail open (exit 0) on any internal error.
+import path from 'node:path';
+import { readStdinJson, failOpen } from './lib/hookio.js';
+import { sessionEventsDir, writeJsonExclusive } from './lib/state.js';
+import { computeFingerprint, TOOL_USE_ID_RE } from './lib/fingerprint.js';
+
+// Coarse classification only — the raw error text is never persisted.
+function classifyError(input) {
+  const text = [input.error, input.tool_response && JSON.stringify(input.tool_response)]
+    .filter((x) => typeof x === 'string')
+    .join(' ')
+    .toLowerCase();
+  if (/timed?[ _-]?out/.test(text)) return 'timeout';
+  if (/(enoent|not found|no such file|command not found|404)/.test(text)) return 'not_found';
+  if (/(eacces|eperm|permission|denied|401|403)/.test(text)) return 'permission';
+  if (/(syntaxerror|parse error|unexpected token|invalid syntax)/.test(text)) return 'syntax';
+  return 'other';
+}
+
+function main() {
+  const input = readStdinJson();
+  const { session_id: sessionId, tool_name: toolName, tool_input: toolInput, tool_use_id: toolUseId } = input;
+  if (typeof sessionId !== 'string' || sessionId === '') return;
+  if (typeof toolUseId !== 'string' || !TOOL_USE_ID_RE.test(toolUseId)) return;
+
+  const file = path.join(sessionEventsDir(sessionId), `${toolUseId}.json`);
+  writeJsonExclusive(file, {
+    schema_version: 1,
+    tool_use_id: toolUseId,
+    tool_name: toolName,
+    status: 'failure',
+    error_class: classifyError(input),
+    fingerprint: computeFingerprint(toolName, toolInput),
+    ts: Date.now(),
+  });
+}
+
+try {
+  main();
+  process.exit(0);
+} catch {
+  failOpen();
+}

package/scripts/post-tool-use.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+// PostToolUse: redacts known secret patterns out of Bash/MCP tool output before it
+// reaches the model, and records a success fingerprint event for cost/repeat-loop
+// detection. This hook never writes shared session state directly — it only
+// atomic-creates an event file that PostToolBatch later aggregates and deletes.
+// It fails open on any internal error: it must never block the tool call.
+import path from 'node:path';
+import { readStdinJson, emit, failOpen } from './lib/hookio.js';
+import { sessionEventsDir, writeJsonExclusive } from './lib/state.js';
+import { scanText, redactText } from './lib/secrets.js';
+import { computeFingerprint, TOOL_USE_ID_RE } from './lib/fingerprint.js';
+
+const FULL_REDACTION_FALLBACK = '[novice: 출력에 비밀값 패턴이 감지되어 전체를 가렸습니다]';
+
+// Extract candidate text fields from the tool_response shapes the harness uses:
+// a bare string, {output}, {stdout}/{stderr}, or MCP-style {content:[{type:"text",text}]}.
+// path === null means the whole response IS the text (bare string case).
+function extractTextFields(toolResponse) {
+  const fields = [];
+  if (typeof toolResponse === 'string') {
+    fields.push({ path: null, value: toolResponse });
+    return fields;
+  }
+  if (toolResponse && typeof toolResponse === 'object' && !Array.isArray(toolResponse)) {
+    if (typeof toolResponse.output === 'string') fields.push({ path: ['output'], value: toolResponse.output });
+    if (typeof toolResponse.stdout === 'string') fields.push({ path: ['stdout'], value: toolResponse.stdout });
+    if (typeof toolResponse.stderr === 'string') fields.push({ path: ['stderr'], value: toolResponse.stderr });
+    if (Array.isArray(toolResponse.content)) {
+      toolResponse.content.forEach((item, idx) => {
+        if (item && typeof item === 'object' && item.type === 'text' && typeof item.text === 'string') {
+          fields.push({ path: ['content', idx], value: item.text });
+        }
+      });
+    }
+  }
+  return fields;
+}
+
+// Rebuild tool_response with each text field redacted, preserving the original
+// structure as closely as possible (string in -> string out, object in -> same
+// object shape with text fields replaced).
+function applyRedactedFields(toolResponse, fields) {
+  if (fields.length === 1 && fields[0].path === null) {
+    return redactText(fields[0].value).text;
+  }
+  const clone = { ...toolResponse };
+  if (Array.isArray(toolResponse.content)) clone.content = toolResponse.content.slice();
+  for (const f of fields) {
+    const redacted = redactText(f.value).text;
+    if (f.path[0] === 'content') {
+      const idx = f.path[1];
+      clone.content[idx] = { ...clone.content[idx], text: redacted };
+    } else {
+      clone[f.path[0]] = redacted;
+    }
+  }
+  return clone;
+}
+
+function main() {
+  let input;
+  try {
+    input = readStdinJson();
+  } catch {
+    failOpen();
+    return;
+  }
+
+  // (a) Redaction — only touches output text, never logs the original anywhere.
+  try {
+    const fields = extractTextFields(input.tool_response);
+    const scanView = fields.map((f) => f.value).join('\n');
+    if (scanView.length > 0) {
+      const findings = scanText(scanView);
+      if (findings.length > 0) {
+        let updatedToolOutput;
+        try {
+          updatedToolOutput = applyRedactedFields(input.tool_response, fields);
+        } catch {
+          // Secrets were confirmed present (pre-scan found candidates) but
+          // structured redaction failed — never let the original leak through.
+          updatedToolOutput = FULL_REDACTION_FALLBACK;
+        }
+        emit({ hookSpecificOutput: { hookEventName: 'PostToolUse', updatedToolOutput } });
+      }
+    }
+  } catch {
+    // Could not even determine whether secrets are present (extraction/scan
+    // itself failed). No pre-scan hit was confirmed, so fail open silently.
+  }
+
+  // (b) Fingerprint event — best-effort, independent of the redaction outcome.
+  try {
+    const { session_id: sessionId, tool_name: toolName, tool_input: toolInput, tool_use_id: toolUseId } = input;
+    if (typeof sessionId === 'string' && sessionId !== '' && typeof toolUseId === 'string' && TOOL_USE_ID_RE.test(toolUseId)) {
+      const file = path.join(sessionEventsDir(sessionId), `${toolUseId}.json`);
+      writeJsonExclusive(file, {
+        schema_version: 1,
+        tool_use_id: toolUseId,
+        tool_name: toolName,
+        status: 'success',
+        fingerprint: computeFingerprint(toolName, toolInput),
+        ts: Date.now(),
+      });
+    }
+  } catch {
+    // EEXIST (duplicate delivery) or any other issue — event write is best-effort
+    // observation and must never crash or block the tool.
+  }
+
+  process.exit(0);
+}
+
+main();

package/scripts/pre-tool-use.js

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// PreToolUse safety gate: destructive commands, git history damage, secret
+// commit/deploy, and destructive MCP tools. Runs regardless of novice level/off
+// while the plugin is enabled.
+//
+// This hook is a thin wrapper: stdin/stdout I/O + fail-closed behavior. The
+// analysis lives in scripts/lib/safety.js (Bash/PowerShell grammar, git subgrammar,
+// secret scan, target classification).
+//
+// Deny-only: safety.js emits a deny decision solely for positively-identified
+// catastrophic actions and exposed secret values; everything else (including any
+// command it cannot fully parse) gets no opinion and is delegated to Claude Code's
+// native permission prompt. There is no "ask" tier.
+//
+// FAIL CLOSED: invalid JSON stdin, internal exceptions, and input-cap overflows
+// deny the tool call (exit 2 or an explicit deny decision).
+import { readStdinJson, emitPreToolDecision, failClosed } from './lib/hookio.js';
+import { getProjectConfig } from './lib/state.js';
+import { loadSafetyRules } from './lib/secrets.js';
+import { analyzeBash, analyzeMcp } from './lib/safety.js';
+
+function main() {
+  let input;
+  try {
+    input = readStdinJson();
+  } catch (err) {
+    failClosed(`novice safety gate: invalid hook input (${err.code ?? 'parse error'})`);
+    return;
+  }
+
+  const rules = loadSafetyRules();
+  const cwd = typeof input.cwd === 'string' && input.cwd !== '' ? input.cwd : process.cwd();
+  const toolName = input.tool_name;
+
+  let verdict = null;
+  if (toolName === 'Bash') {
+    let extraProtected = [];
+    try {
+      extraProtected = getProjectConfig(cwd).protected_branches_extra;
+    } catch {
+      // config unavailable → builtin protected branches only
+    }
+    verdict = analyzeBash(input.tool_input?.command, cwd, rules, extraProtected);
+  } else if (typeof toolName === 'string' && /^mcp__/.test(toolName)) {
+    verdict = analyzeMcp(toolName, input.tool_input ?? {}, rules);
+  }
+
+  if (verdict) {
+    emitPreToolDecision(verdict.decision, verdict.reason);
+  }
+  process.exit(0);
+}
+
+try {
+  main();
+} catch (err) {
+  failClosed(`novice safety gate: internal error (${err?.message ?? 'unknown'})`);
+}

package/scripts/session-end.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// SessionEnd: session cache lifecycle. `/clear` deletes the session state;
+// resumable sessions are kept until the 30-day TTL sweep.
+// Learning hook: fail open (exit 0, no output) on any internal error.
+import { readStdinJson, failOpen } from './lib/hookio.js';
+import { deleteSession, cleanupExpiredSessions } from './lib/state.js';
+
+function main() {
+  const input = readStdinJson();
+  if (input.reason === 'clear' && typeof input.session_id === 'string' && input.session_id !== '') {
+    deleteSession(input.session_id);
+  }
+  cleanupExpiredSessions();
+}
+
+try {
+  main();
+  process.exit(0);
+} catch {
+  failOpen();
+}

package/scripts/session-start.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// SessionStart: restore the current novice state after startup/resume/clear/compact.
+// Active project → inject one capsule + glossary and prime skip_next_submit so the
+// immediately following UserPromptSubmit does not duplicate the same capsule_revision.
+// Off project that previously injected capsules → inject one OFF tombstone.
+// Learning hook: fail open (exit 0, no output) on any internal error.
+import { readStdinJson, emitAdditionalContext, failOpen } from './lib/hookio.js';
+import { getProjectConfig, loadSession, saveSession } from './lib/state.js';
+import { loadTerms, buildGlossary, glossaryRevision, buildTombstone, capsuleForState } from './lib/capsule.js';
+
+function main() {
+  const input = readStdinJson();
+  const sessionId = input.session_id;
+  const cwd = input.cwd || process.cwd();
+  if (typeof sessionId !== 'string' || sessionId === '') return;
+
+  const config = getProjectConfig(cwd);
+  const session = loadSession(sessionId);
+
+  if (config.enabled) {
+    const { revision, capsule } = capsuleForState(config.level, session, config.muted_terms);
+    const terms = loadTerms();
+    const glossary = buildGlossary(terms);
+    emitAdditionalContext('SessionStart', `${capsule}\n\n${glossary}`);
+    session.capsule_revision = revision;
+    session.glossary_revision = glossaryRevision(terms);
+    session.skip_next_submit = true;
+    session.off_tombstone_emitted = false;
+    saveSession(sessionId, session);
+    return;
+  }
+
+  // Disabled: only speak once, and only if a capsule was previously injected this session.
+  if (session.capsule_revision != null && session.off_tombstone_emitted !== true) {
+    emitAdditionalContext('SessionStart', buildTombstone());
+    session.off_tombstone_emitted = true;
+    session.capsule_revision = null;
+    session.skip_next_submit = false;
+    saveSession(sessionId, session);
+  }
+}
+
+try {
+  main();
+  process.exit(0);
+} catch {
+  failOpen();
+}