create-agent-rig 0.5.0 → 0.6.1

package/templates/agent-os/universal/.claude/agents/prose-reviewer.md

@@ -61,11 +61,16 @@ about it here, so the two gates never file competing opinions on one paragraph.
 
    ⚠ A pointer into a test suite the reader's project does not carry is normally
    item 2, not backing. There is one narrow inherited-snapshot exception from
-   `invariants.md`: a generator-authored hook may point to upstream generator
-   tests that are absent locally **only while the hook is unchanged downstream**
-   and its hook header identifies those tests as absent locally. If that hook is
-   edited downstream or appears as changed in the current diff, the exception
-   expires and the local test is yours; then an absent pointer is item 2 again.
+   `invariants.md`: a generator-authored artifact — rules, hooks, skills,
+   scripts, or agent specs —
+   may point to upstream generator tests that are absent locally only when the
+   pointer explicitly says the suite is absent locally and
+   `.claude/.rig-manifest.json` proves the current artifact's hash matches the
+   installed manifest. A manifest-backed upgrade remains an inherited,
+   generator-owned artifact; a changed file in the upgrade diff does not alone
+   make it downstream-authored. The exception applies **only while the manifest
+   hash matches**. A hash mismatch, missing manifest, or no evidence ends the
+   exception and the local test is yours; then an absent pointer is item 2 again.
 
    🔴 Three things this is not. It is not item 1: that one is about enforcement the
    mechanism does not provide, this one is about any claim with nothing behind it,
@@ -154,7 +159,8 @@ calling gate reads.
     }
   ],
   "advisories": [],
-  "evidence": ["opened .claude/hooks/guard-bash.mjs and quoted the line"]
+  "evidence": ["opened .claude/hooks/guard-bash.mjs and quoted the line"],
+  "headSha": "9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70"
 }
 ```
 
@@ -165,3 +171,9 @@ calling gate reads.
   `node .claude/scripts/verdict.mjs check <report> <this gate>` is what refuses
   them, and the gate name is what stops your answer being read as somebody
   else's.
+- **`headSha` is the commit you reviewed** — `git rev-parse HEAD` in the
+  checkout you read. It is what lets `node .claude/scripts/verdict.mjs coverage
+  <commit>` tell "this gate answered for the commit being merged" from "it
+  answered two pushes ago". A verdict naming no commit is counted as neither
+  covered nor missing, so `pr-ship` holds on it — and only `pr-ship`: no hook
+  runs that check, so a session that skips the gate skips this with it.

package/templates/agent-os/universal/.claude/agents/security-scanner.md

@@ -58,7 +58,8 @@ the human who has to fix the finding.
     }
   ],
   "advisories": [],
-  "evidence": ["grepped for the pattern across services/"]
+  "evidence": ["grepped for the pattern across services/"],
+  "headSha": "9c1f0a7d4b3e2c5a8f6d0b9e7c4a1f2d3e5b6c70"
 }
 ```
 
@@ -71,3 +72,9 @@ the human who has to fix the finding.
   `node .claude/scripts/verdict.mjs check <report> <this gate>` is what refuses
   them, and the gate name is what stops your answer being read as somebody
   else's.
+- **`headSha` is the commit you reviewed** — `git rev-parse HEAD` in the
+  checkout you read. It is what lets `node .claude/scripts/verdict.mjs coverage
+  <commit>` tell "this gate answered for the commit being merged" from "it
+  answered two pushes ago". A verdict naming no commit is counted as neither
+  covered nor missing, so `pr-ship` holds on it — and only `pr-ship`: no hook
+  runs that check, so a session that skips the gate skips this with it.

package/templates/agent-os/universal/.claude/hooks/gate-stop-dod.mjs

@@ -34,9 +34,9 @@
 // a per-step budget is how three checks quietly cost three times the wall
 // clock the wiring allows (`.claude/rules/invariants.md` — "an explicit total
 // budget rather than a per-step one").
-//   see hooks.test.ts › "gates the stop when a check outruns the budget — unmeasured is not a pass"
-//   see hooks.test.ts › "spends one budget across the whole suite, not a fresh one per check"
-//   see hooks.test.ts › "gives the stop gate a harness timeout its own budget finishes inside"
+//   see hooks.test.ts (absent in a generated rig) › "gates the stop when a check outruns the budget — unmeasured is not a pass"
+//   see hooks.test.ts (absent in a generated rig) › "spends one budget across the whole suite, not a fresh one per check"
+//   see hooks.test.ts (absent in a generated rig) › "gives the stop gate a harness timeout its own budget finishes inside"
 //
 // ⚠ This rests on ONE assumption about the harness that nothing in this
 // repository can prove or falsify: that a hook outrunning its timeout is
@@ -48,24 +48,44 @@
 // Limits, each with the test that pins it:
 //   - a check whose output outgrows the buffer is UNMEASURED, and blocks like
 //     any other unmeasured check —
-//     see hooks.test.ts › "gates the stop when a check drowns its own buffer — a pass nobody watched is not a pass"
+//     see hooks.test.ts (absent in a generated rig) › "gates the stop when a check drowns its own buffer — a pass nobody watched is not a pass"
 //   - below that buffer, output volume is not a verdict: a chatty check that
 //     passes, passes —
-//     see hooks.test.ts › "does not read a chatty passing check as a failure (the ENOBUFS false gate)"
+//     see hooks.test.ts (absent in a generated rig) › "does not read a chatty passing check as a failure (the ENOBUFS false gate)"
 //   - the RIG_DOD_BUDGET_MS override may only LOWER the budget, and an
 //     override this hook did not honour is announced rather than ignored —
-//     see hooks.test.ts › "clamps a budget override that would outlive the harness, and names the budget it used"
+//     see hooks.test.ts (absent in a generated rig) › "clamps a budget override that would outlive the harness, and names the budget it used"
 //   - a fail-open is announced on stderr, because a silent exit 0 and a clean
 //     pass are the same observation from outside —
-//     see hooks.test.ts › "announces a fail-open instead of returning a silent clean pass"
+//     see hooks.test.ts (absent in a generated rig) › "announces a fail-open instead of returning a silent clean pass"
 //   - an ABSENT config is not a failure and says nothing; only a config that
 //     exists and cannot be used announces —
-//     see hooks.test.ts › "stays silent when there is no config at all — nothing to gate is the design, not a swallowed error"
+//     see hooks.test.ts (absent in a generated rig) › "stays silent when there is no config at all — nothing to gate is the design, not a swallowed error"
 import { execSync, spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { readFileSync, realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
 
 import { withoutGitLocation } from '../scripts/git-env.mjs';
 
+// 🔴 The tree this gate measures is the project the hook BELONGS to — the
+// directory above `.claude/hooks/` — never the directory the session happens
+// to be in. Observed twice in one session (AR-119): reviewing another branch
+// in a worktree under `.claude/worktrees/`, the gate ran the suite in the
+// worktree the shell had last cd-ed into and reported THAT branch's failing
+// test as this session's own Definition-of-Done failure. Reviewing a foreign
+// branch in a worktree is a first-class motion here, so an inherited cwd is
+// the wrong tree often enough to matter. `git status` and every check run
+// with this as their `cwd`, and both refusals name it, so a failure that is
+// still foreign is visible at a glance. It is the session's ROOT, not its
+// branch: a session started at the main checkout whose own task lives in a
+// `worktree-task` worktree is measured at the main checkout, and the refusal
+// says so. Resolved inside `main()`, so a throw here reaches the backstop
+// and announces itself like every other fault of the gate's own.
+//   see hooks.test.ts (absent in a generated rig) › "runs the checks in the project root, so a check reading the tree sees the session project"
+//   see hooks.test.ts (absent in a generated rig) › "asks "is the tree clean?" about the project, not about the cwd"
+//   see hooks.test.ts (absent in a generated rig) › "names the tree it measured in the refusal, so a foreign failure is visible at a glance"
+const projectRootOf = () => realpathSync(fileURLToPath(new URL('../..', import.meta.url)));
+
 // The default total budget, and the allowance for everything that happens
 // OUTSIDE it.
 //
@@ -80,8 +100,8 @@ import { withoutGitLocation } from '../scripts/git-env.mjs';
 // So the preamble gets a number and a leash: `git status` below is given this
 // as its own timeout, which turns the allowance from a guess into a bound.
 // Both numbers are read from this file and compared against the wiring —
-//   see hooks.test.ts › "gives the stop gate a harness timeout its own budget finishes inside"
-//   see hooks.test.ts › "bounds its own preamble: the git status call carries a timeout derived from the declared margin"
+//   see hooks.test.ts (absent in a generated rig) › "gives the stop gate a harness timeout its own budget finishes inside"
+//   see hooks.test.ts (absent in a generated rig) › "bounds its own preamble: the git status call carries a timeout derived from the declared margin"
 const DEFAULT_BUDGET_MS = 600_000;
 const PREAMBLE_MARGIN_MS = 60_000;
 
@@ -117,7 +137,7 @@ const SPAWN_NEVER_STARTED = new Set(['ENOENT', 'EACCES', 'EPERM', 'EMFILE', 'ENF
  * it. `Number.isSafeInteger` is the test rather than `isFinite`, because
  * `spawnSync` throws on a fractional `timeout` — and a throw here would land in
  * the backstop and open the gate completely.
- *   see hooks.test.ts › "runs the gate on the default budget when the override is unusable, instead of not running it"
+ *   see hooks.test.ts (absent in a generated rig) › "runs the gate on the default budget when the override is unusable, instead of not running it"
  */
 function budgetMs(env) {
   const raw = env.RIG_DOD_BUDGET_MS;
@@ -155,6 +175,8 @@ function main() {
   if (input.hook_event_name !== 'Stop' && input.hook_event_name !== 'SubagentStop') return 0;
   if (input.stop_hook_active) return 0;
 
+  const PROJECT_ROOT = projectRootOf();
+
   try {
     // The environment loses the variables that locate a repository first. A
     // process started under a git hook inherits an absolute GIT_DIR, and this
@@ -183,6 +205,7 @@ function main() {
     // and the reason the bound can be generous. The options object stays terse
     // on purpose; a sibling test matches it by a bounded window.
     const status = execSync('git status --porcelain', {
+      cwd: PROJECT_ROOT,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       env: withoutGitLocation(),
@@ -212,13 +235,13 @@ function main() {
   // still ended green. Both were shipped here, one after the other, and both
   // are closed the same way — every usable entry runs, and a skipped entry is
   // a check with no verdict, which blocks.
-  //   see hooks.test.ts › "never lets an unusable config entry hide a failing check behind it (an empty string)"
-  //   see hooks.test.ts › "refuses the stop for an empty config entry it skipped, even though every check it could run passed"
+  //   see hooks.test.ts (absent in a generated rig) › "never lets an unusable config entry hide a failing check behind it (an empty string)"
+  //   see hooks.test.ts (absent in a generated rig) › "refuses the stop for an empty config entry it skipped, even though every check it could run passed"
   //
   // The predicate is exactly the three shapes `spawnSync` throws on, and no
   // wider: the shell answers every other unrunnable string with 127, which is
   // a verdict. Filtering past these three converts a real block into a skip.
-  //   see hooks.test.ts › "refuses the stop for a config it could read but cannot use, and names the file to fix"
+  //   see hooks.test.ts (absent in a generated rig) › "refuses the stop for a config it could read but cannot use, and names the file to fix"
   const runnable = (command) =>
     typeof command === 'string' && command !== '' && !command.includes('\0');
   const usable = checks.filter(runnable);
@@ -252,6 +275,7 @@ function main() {
     // that did not fit instead of blaming it for spending what an earlier one
     // spent. One path, and no branch that only a race can reach.
     const result = spawnSync(command, {
+      cwd: PROJECT_ROOT,
       shell: true,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -277,7 +301,8 @@ function main() {
       // unknown, and an unmeasured Definition of Done is not a passed one.
       const timedOut = result.error.code === 'ETIMEDOUT';
       process.stderr.write(
-        `STOP GATED — \`${command}\` produced no verdict: ${result.error.message}\n` +
+        `STOP GATED — \`${command}\` produced no verdict (measured in ${PROJECT_ROOT}): ` +
+          `${result.error.message}\n` +
           (timedOut
             ? `It did not finish inside the ${budget.ms} ms budget for the whole suite ` +
               `(RIG_DOD_BUDGET_MS lowers it; raising it means raising this hook's default ` +
@@ -297,7 +322,7 @@ function main() {
         .slice(-15)
         .join('\n');
       process.stderr.write(
-        `STOP GATED — a Definition of Done check fails: ${command}\n` +
+        `STOP GATED — a Definition of Done check fails (measured in ${PROJECT_ROOT}): ${command}\n` +
           (tail.trim() ? `${tail}\n` : '') +
           `Fix the failure before ending the session. If this failure has resisted ` +
           `repeated attempts, follow the stop rules instead: end with a written ` +

package/templates/agent-os/universal/.claude/hooks/guard-bash.mjs

@@ -24,7 +24,8 @@
 //
 // ── The limits, stated exactly — and TESTED ──────────────────────────────────
 //
-// This block is a credibility claim, so `test/template/guard-hardening.test.ts`
+// This block is a credibility claim, so the generator's
+// `test/template/guard-hardening.test.ts` (absent in a generated rig)
 // asserts each line twice: that the limit is documented here, and that the
 // command really does pass. A limits comment nothing checks drifts into fiction,
 // which is what happened the first time — an earlier version of this list was

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+// PreToolUse hook: in an UNATTENDED run, the rulebook is never edited outside
+// the current item's allow-list (AR-51).
+//
+// The rulebook is the set of files that decide what this session may do — hooks
+// and settings wiring, the queue config and selector, all scripts, rules, skills
+// and agents, the `.codex/` configuration, the integrity manifest, `AGENTS.md`
+// and `CLAUDE.md`. Every one of them was editable by the run it governs: a
+// Write to `.claude/hooks/dod-checks.json` with `[]` switched the stop gate
+// off, and nothing refused it until the merge sweep, long after.
+//
+// How it decides — and it is deliberately dumb:
+//   1. No unattended flag on disk (`.claude/scripts/unattended-flag.mjs`) → an
+//      attended session → exit 0 for everything. A human at the keyboard edits
+//      the rulebook on purpose.
+//   2. Flag present and readable → every edit fragment whose repo-relative path
+//      sits under a rulebook prefix is refused (exit 2) unless it also sits
+//      under one of the item's `allow` prefixes. A known path outside the
+//      rulebook is never judged — › "allows a MultiEdit beyond the fragment cap
+//      when its known path is outside the rulebook". A pathless global refusal
+//      for an oversized or unsupported `apply_patch` payload is blocked while
+//      armed because its scope cannot be proved — › "states the pathless
+//      global-refusal limit for oversized and unsupported apply_patch payloads".
+//   3. Flag present and UNREADABLE → a rulebook edit is refused and the reason
+//      names the flag; an edit outside the rulebook still passes. Refusing to
+//      inspect is not allowing (`.claude/rules/invariants.md`).
+//
+// Limits — each stated here and each measured in the generator's
+// `test/template/guard-rulebook.test.ts` (absent in a generated rig), by the
+// test named beside it:
+//   - it sees one edit at a time, as text, before it lands — a rulebook file
+//     rewritten through a Bash redirect (`echo … > .claude/settings.json`), a
+//     generated file, or `git checkout` of another branch is not an edit tool
+//     call and never reaches it, and `guard-bash` does not cover that either —
+//     › "a Bash redirect into the rulebook is not an edit tool call and passes
+//     — guard-bash does not cover it either";
+//   - the flag in either home arms it (the env-derived one and the password
+//     database one, like the kill switch), and ONLY a flag arms it: an
+//     exported variable changes nothing, and an attended session that never
+//     set a flag is exactly as free as before — › "only a flag arms it — an
+//     exported RIG_UNATTENDED=1 with no flag changes nothing";
+//   - it judges paths, not content: a README that merely mentions
+//     `.claude/hooks/guard-bash.mjs` is not a rulebook edit — › "guards the
+//     path, not prose that mentions a guarded path";
+//   - it compares both roots and payload paths in their selected and canonical
+//     spellings, whether selection came from `CLAUDE_PROJECT_DIR` or the
+//     working-directory fallback — › "canonicalizes a differently spelled
+//     checkout root before guarding a canonical payload path", › "blocks when
+//     the checkout root and payload use the same symlink spelling", and
+//     › "blocks an existing rulebook file when only the payload path uses a symlink spelling";
+//   - an `allow` prefix is a string prefix of the repo-relative path and may
+//     not widen the rulebook — an entry that is itself a prefix of a rulebook
+//     prefix (`.`, `.claude/`, `.claude/scripts/`) makes the flag unreadable
+//     and the guard refuses — › "a flag whose allow-list widens the rulebook is
+//     unreadable, so `--allow .` cannot disarm it";
+//   - fail-open on its own errors and on a payload it cannot parse — › "allows
+//     an empty payload object" and › "allows non-JSON stdin" — and fail-closed
+//     on a flag it cannot read — › "blocks a rulebook edit when the flag exists
+//     but cannot be read, and names the file": the guard targets drift, not an
+//     adversary.
+//
+// The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
+import { readFileSync, realpathSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { editFragments } from './lib/edit-input.mjs';
+import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
+
+export { RULEBOOK_PREFIXES, isRulebookPath };
+
+const EDIT_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
+
+const toPosix = (value) => String(value ?? '').replaceAll('\\', '/');
+
+const canonicalRoot = (root) => {
+  try {
+    return realpathSync(root);
+  } catch {
+    return root;
+  }
+};
+
+/** Resolve symlinks in the nearest existing ancestor, preserving a missing tail. */
+const canonicalPath = (filePath) => {
+  let cursor = resolve(filePath);
+  const tail = [];
+  for (;;) {
+    try {
+      return join(realpathSync(cursor), ...tail);
+    } catch {
+      const parent = dirname(cursor);
+      if (parent === cursor) return filePath;
+      tail.unshift(basename(cursor));
+      cursor = parent;
+    }
+  }
+};
+
+/** The repo-relative tail of an absolute path, or the path itself when it is not under the root. */
+export const relativeTo = (root, filePath) => {
+  const dir = toPosix(root).replace(/\/+$/, '');
+  const file = toPosix(filePath);
+  if (dir !== '' && file.startsWith(`${dir}/`)) return file.slice(dir.length + 1);
+  return file.replace(/^\.\//, '');
+};
+
+export const isAllowed = (rel, allow) =>
+  (Array.isArray(allow) ? allow : []).some((prefix) => prefix !== '' && (rel === prefix || rel.startsWith(prefix)));
+
+const protectedRelative = (roots, filePath) =>
+  [...new Set([filePath, canonicalPath(filePath)])]
+    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)))
+    .find(isRulebookPath);
+
+function main() {
+  let input;
+  try {
+    input = JSON.parse(readFileSync(0, 'utf8'));
+  } catch {
+    return 0; // unparseable payload: not ours to judge
+  }
+  if (!EDIT_TOOLS.has(input?.tool_name)) return 0;
+
+  const selectedRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = canonicalRoot(selectedRoot);
+  const comparisonRoots = [...new Set([root, selectedRoot])];
+  const unattendedEnv = { ...process.env, CLAUDE_PROJECT_DIR: root };
+  const fragments = editFragments(input);
+  const globalRefusal = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
+  );
+  if (globalRefusal) {
+    if (globalRefusal.filePath) {
+      const rel = protectedRelative(comparisonRoots, globalRefusal.filePath);
+      if (rel === undefined) return 0;
+    }
+    const mode = readUnattended(unattendedEnv);
+    if (!mode.on) return 0;
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this unattended edit: ${globalRefusal.inspectionRefusal}\n` +
+        `${globalRefusal.remedy ?? 'Split it into a smaller edit and retry.'}\n`,
+    );
+    return 2;
+  }
+  const paths = [];
+  for (const { filePath } of fragments) {
+    if (typeof filePath !== 'string' || filePath === '') continue;
+    const rel = protectedRelative(comparisonRoots, filePath);
+    if (rel !== undefined && !paths.includes(rel)) paths.push(rel);
+  }
+  if (paths.length === 0) return 0; // nothing under the rulebook: never judged
+
+  const mode = readUnattended(unattendedEnv);
+  if (!mode.on) return 0; // attended session
+
+  if (mode.unreadable) {
+    process.stderr.write(
+      `BLOCKED — "${paths[0]}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
+        'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
+    );
+    return 2;
+  }
+
+  const refused = paths.filter(
+    (rel) => rel === '.claude/queue.board' || !isAllowed(rel, mode.allow),
+  );
+  if (refused.length === 0) return 0;
+  if (refused[0] === '.claude/queue.board') {
+    process.stderr.write(
+      'BLOCKED — ".claude/queue.board" is the checkout board selector and cannot be changed while unattended, even through an item allow-list. ' +
+        'Disarm unattended mode before deliberately switching queues.\n',
+    );
+    return 2;
+  }
+  process.stderr.write(
+    `BLOCKED — "${refused[0]}" is part of the rulebook, and an unattended run never edits the rulebook outside its item's allow-list ` +
+      `(item ${mode.item ?? '(none)'}; allowed prefixes: ${mode.allow.length === 0 ? 'none' : mode.allow.join(', ')}). ` +
+      'If the item really needs this path, it belongs in the allow-list the loop wrote at claim time — a decision, not a default. ' +
+      'See .claude/rules/autonomy.md, "Never".\n',
+  );
+  return 2;
+}
+
+try {
+  process.exit(main());
+} catch {
+  process.exit(0); // a crashed guard must not block the session
+}

package/templates/agent-os/universal/.claude/hooks/guard-secret-file.mjs

@@ -22,18 +22,25 @@
 // so plainly where none does — a limits comment nothing checks drifts into
 // overstatement, which is the direction that gets a reader hurt. ⚠ Those tests live in the GENERATOR this rig came from, not here;
 // `.claude/rules/invariants.md` ("About the hooks you were given") says the same
-// of this hook's own tests, and the moment you edit it they are yours.
+// of this hook's own tests. A manifest-backed generator upgrade remains inherited
+// while `.claude/.rig-manifest.json` matches; once the hash differs, the local test
+// is yours.
 //
-// There are FOUR:
+// There are FIVE:
 //
 //   - It sees ONE edit fragment, not the resulting file. A credential assembled
-//     across two edits is not seen — see guard-secret-file.test.ts › "does not
+//     across two edits is not seen — see guard-secret-file.test.ts (absent in a generated rig) › "does not
 //     see a credential split across two edits, because it is shown one fragment
 //     at a time". This is the same limit every guard in this directory has,
 //     stated in full in `.claude/rules/invariants.md`, "What the enforcement
 //     actually is — stated exactly".
+//   - A `MultiEdit` is capped at 256 fragments and REFUSES before mapping a
+//     longer list, so the tail is never silently dropped — see
+//     guard-secret-file.test.ts (absent in a generated rig) › "refuses a
+//     MultiEdit beyond the fragment cap instead of silently dropping the tail".
 //   - It sees only what the AGENT writes. The `toolName` branch in `main` below
-//     names the complete surface: `Write`, `Edit`, and `apply_patch`; every other
+//     names the complete surface: `Write`, `Edit`, `MultiEdit`, `NotebookEdit`,
+//     and `apply_patch`; every other
 //     tool returns before inspection. A human editing the file, or a
 //     `git commit` of something already on disk, never reaches a PreToolUse hook
 //     at all, and no test here can show that: it is a property of the harness,
@@ -51,15 +58,16 @@
 //     `findSecretValues` applies by default so a fail-open guard cannot be made
 //     to hang. A credential past that point is not seen. ⚠ No test here pins
 //     this one: the case is pinned one layer down, on the module, by
-//     secrets-lib.test.ts › "has a limit even when the caller names none". The CI sweep lifts the
+//     secrets-lib.test.ts (absent in a generated rig) › "has a limit even when the caller names none". The CI sweep lifts the
 //     cap; this hook cannot, and that asymmetry is the point.
 //   - It FAILS OPEN on what it cannot understand — see guard-secret-file.test.ts
+//     (absent in a generated rig)
 //     › "allows a payload that is not JSON at all" and its neighbours. An
 //     unparseable payload, a missing field, or an internal throw all allow the
 //     edit; a crashed guard that blocks everything gets deleted within the hour.
 //
 //     ⚠ **An `apply_patch` command that is PRESENT and is not a shape this guard
-//     reads is the other case, and it now REFUSES** — see codex.test.ts ›
+//     reads is the other case, and it now REFUSES** — see codex.test.ts (absent in a generated rig) ›
 //     "refuses, rather than failing open, when apply_patch command is supplied
 //     as %s". The line between them is whether the guard can tell: an absent
 //     field is a payload it does not understand, a container it detects and
@@ -92,40 +100,27 @@ function main() {
     return 0; // unparseable payload: not ours to judge
   }
 
-  const toolName = input?.tool_name;
-  if (toolName !== 'Write' && toolName !== 'Edit' && toolName !== 'apply_patch') return 0;
+  const editTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
+  if (!editTools.has(input?.tool_name)) return 0;
 
-  if (toolName === 'apply_patch') {
-    let refused = false;
-    for (const { filePath, fragment, inspectionRefusal, remedy, appliesToAll } of editFragments(input)) {
-      if (inspectionRefusal) {
-        refused = true;
-        process.stderr.write(
-          `BLOCKED — cannot safely inspect this edit: ${inspectionRefusal}\n` +
-            // The remedy has to match the refusal: splitting cannot change a
-            // container shape, and a fixed line sent the agent into a retry loop
-            // on the one path it could not retry out of.
-            `${remedy ?? 'Split it into a smaller patch and retry.'}\n`,
-        );
-        continue;
-      }
-      if (isCredentialPath(filePath)) {
-        refused = true;
-        process.stderr.write(`BLOCKED — "${filePath}" is a credential file, and this repository never carries one.\n${WHERE_CREDENTIALS_BELONG}\n`);
-        continue;
-      }
-      const findings = findSecretValues(fragment);
-      if (findings.length > 0 || appliesToAll) {
-        refused = true;
-        if (findings.length > 0) process.stderr.write(`BLOCKED — this edit writes a credential value into "${filePath}".\n${WHERE_CREDENTIALS_BELONG}\n`);
-      }
-    }
-    return refused ? 2 : 0;
+  const fragments = editFragments(input);
+  const globalRefusal = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
+  );
+  if (globalRefusal) {
+    const fallbackRemedy = input?.tool_name === 'apply_patch'
+      ? 'Split it into a smaller patch and retry.'
+      : 'Split it into a smaller edit and retry.';
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this edit: ${globalRefusal.inspectionRefusal}\n` +
+        `${globalRefusal.remedy ?? fallbackRemedy}\n`,
+    );
+    return 2;
   }
 
-  const toolInput = input?.tool_input ?? {};
-  const filePath = String(toolInput.file_path ?? '').replaceAll('\\', '/');
-  if (filePath === '') return 0; // nothing to judge; fail open
+  if (fragments.length === 0 || fragments.every(({ filePath }) => filePath === '')) {
+    return 0; // nothing to judge; fail open
+  }
 
   // The tool sends an absolute path. Judge the repo-relative tail so a checkout
   // living under a directory literally called `secrets` does not make every edit
@@ -134,41 +129,53 @@ function main() {
   // below never matches, every path stays absolute, and a checkout that happens
   // to live under a directory called `secrets` has EVERY edit refused. That is
   // the "deleted within the hour" outcome `.claude/rules/invariants.md` warns
-  // about — see guard-secret-file.test.ts › "judges the repo-relative path even
-  // when the project directory is given with a trailing slash".
+  // about — see guard-secret-file.test.ts (absent in a generated rig) ›
+  // "judges the repo-relative path even when the project directory is given %s".
   const projectDir = String(process.env.CLAUDE_PROJECT_DIR ?? '')
     .replaceAll('\\', '/')
     .replace(/\/+$/, '');
-  const relativePath =
-    projectDir !== '' && filePath.startsWith(`${projectDir}/`)
-      ? filePath.slice(projectDir.length + 1)
-      : filePath;
+  let refused = false;
+  for (const { filePath, fragment, inspectionRefusal } of fragments) {
+    const relativePath =
+      projectDir !== '' && filePath.startsWith(`${projectDir}/`)
+        ? filePath.slice(projectDir.length + 1)
+        : filePath;
+    if (relativePath === '') continue;
 
-  if (isCredentialPath(relativePath)) {
+    if (inspectionRefusal) {
+      refused = true;
+      process.stderr.write(
+        `BLOCKED — cannot safely inspect this edit to "${relativePath}": ${inspectionRefusal}\n` +
+          'Split it into a smaller edit and retry.\n',
+      );
+      continue;
+    }
+    if (isCredentialPath(relativePath)) {
+      refused = true;
+      process.stderr.write(
+        `BLOCKED — "${relativePath}" is a credential file, and this repository never carries one.\n` +
+          `${WHERE_CREDENTIALS_BELONG}\n` +
+          `If this file is a documented placeholder, name it .env.example — that form stays committable.\n`,
+      );
+      continue;
+    }
+
+    const findings = findSecretValues(fragment);
+    if (findings.length === 0) continue;
+    refused = true;
     process.stderr.write(
-      `BLOCKED — "${relativePath}" is a credential file, and this repository never carries one.\n` +
-        `${WHERE_CREDENTIALS_BELONG}\n` +
-        `If this file is a documented placeholder, name it .env.example — that form stays committable.\n`,
+      `BLOCKED — this edit writes a credential value into "${relativePath}":\n` +
+        findings
+          .map((finding) => `  - ${finding.id} on line ${finding.line} of the text being written`)
+          .join('\n') +
+        `\n${WHERE_CREDENTIALS_BELONG}\n` +
+        // Deliberately NOT the matched text. A guard that prints what it found has
+        // copied the credential into a hook transcript and a terminal scrollback —
+        // it has leaked the secret in the act of refusing it.
+        `The matched value is deliberately not shown; open the line above to see it.\n`,
     );
-    return 2;
   }
-
-  const fragment = String((toolName === 'Write' ? toolInput.content : toolInput.new_string) ?? '');
-  const findings = findSecretValues(fragment);
-  if (findings.length === 0) return 0;
-
-  process.stderr.write(
-    `BLOCKED — this edit writes a credential value into "${relativePath}":\n` +
-      findings
-        .map((finding) => `  - ${finding.id} on line ${finding.line} of the text being written`)
-        .join('\n') +
-      `\n${WHERE_CREDENTIALS_BELONG}\n` +
-      // Deliberately NOT the matched text. A guard that prints what it found has
-      // copied the credential into a hook transcript and a terminal scrollback —
-      // it has leaked the secret in the act of refusing it.
-      `The matched value is deliberately not shown; open the line above to see it.\n`,
-  );
-  return 2;
+  return refused ? 2 : 0;
 }
 
 let status;

package/templates/agent-os/universal/.claude/hooks/lib/edit-input.mjs

@@ -45,6 +45,8 @@ const MAX_TOTAL_HUNK_LINES = 10_000;
 const MAX_OUTPUT_LINES = 20_000;
 const MAX_SPLICE_OPERATIONS = 1_000;
 const MAX_PATCH_SECTIONS = 128;
+/** A MultiEdit is capped before it is mapped — bounded work, never a spread of input. */
+const MAX_MULTI_EDITS = 256;
 const MAX_PATCH_PATH_COMPONENTS = 512;
 
 export function editFragments(input) {
@@ -60,6 +62,37 @@ export function editFragments(input) {
       },
     ];
   }
+  // Claude Code's other two edit surfaces (AR-51). `MultiEdit` carries one
+  // file and a list of edits — one fragment per edit, same path — and
+  // `NotebookEdit` carries a cell's new source. Before this, both reached every
+  // guard through the unanchored `Write|Edit` matcher and yielded no fragment,
+  // so a `Date.now()` in a MultiEdit to the core passed unchecked.
+  if (toolName === 'MultiEdit') {
+    if (!Array.isArray(toolInput.edits)) return [];
+    const filePath = normalisePath(toolInput.file_path);
+    if (toolInput.edits.length > MAX_MULTI_EDITS) {
+      return [
+        {
+          filePath,
+          fragment: '',
+          inspectionRefusal: `MultiEdit carries more than the ${MAX_MULTI_EDITS}-fragment inspection limit`,
+          appliesToAll: true,
+        },
+      ];
+    }
+    return toolInput.edits.map((edit) => ({
+      filePath,
+      fragment: String(edit?.new_string ?? ''),
+    }));
+  }
+  if (toolName === 'NotebookEdit') {
+    return [
+      {
+        filePath: normalisePath(toolInput.notebook_path),
+        fragment: String(toolInput.new_source ?? ''),
+      },
+    ];
+  }
   if (toolName !== 'apply_patch') return [];
   const rawCommand = toolInput.command;
   // ⚠ **Absent is not malformed, and the difference decides which way this fails.**