devflow-kit 2.4.0 → 3.0.0

package/dist/cli/commands/memory.js

@@ -4,12 +4,13 @@ import * as path from 'path';
 import * as p from '@clack/prompts';
 import color from 'picocolors';
 import { getClaudeDirectory, getDevFlowDirectory } from '../../targets/claude-code/claude-paths.js';
-import { syncManifestFeature } from '../../core/manifest.js';
-import { writeFileAtomicExclusive } from '../../core/fs-atomic.js';
+import { writeSettingsFileAtomic } from '../../core/fs-atomic.js';
 import { discoverProjectGitRoots } from '../../targets/claude-code/post-install.js';
 import { getGitRoot } from '../../core/git.js';
 import { getMemoryDir, getPendingTurnsPath, getPendingTurnsProcessingPath, } from '../../core/project-paths.js';
-import { updateFeature, isFeatureEnabled } from '../../core/feature-config.js';
+import { HOOKS_DIR_SUFFIX, devflowHookOwner, endsWithAny, ensureHook, hasHook, removeHooks, runHookCommand, runHookSuffix, } from '../../targets/claude-code/hooks.js';
+import { readMachineFeature, writeMachineFeature } from '../../core/feature-switch.js';
+import { loadSettingsModule, narrowedSwitchLabel, personalConfigTrackedWarning } from '../../core/evidence-policy.js';
 /**
  * Map of hook event type → filename marker for the memory hooks.
  * Three hooks total: Stop, SessionStart, PreCompact.
@@ -19,10 +20,11 @@ import { updateFeature, isFeatureEnabled } from '../../core/feature-config.js';
  * at the hook-registration level), and decisions detection is a SessionStart-spawned
  * detached worker rather than a SessionEnd hook (see legacy-hooks.ts).
  *
- * Stop-array ordering contract: memory-worker MUST be registered AFTER capture-turn
- * in the Stop hook array (append-before-spawn — memory-worker's throttle/spawn
- * decision assumes the current turn was already appended by capture-turn earlier
- * in the same Stop event). Enforced by init.ts's registration order, not here.
+ * Stop-event concurrency: Claude Code runs one event's hooks in parallel, so
+ * memory-worker can spawn background-memory-update before capture-turn has
+ * appended this turn's assistant row. The worker tolerates that — a queue that
+ * holds only user rows is left in place and the LLM run skipped
+ * (D-QUEUE-NO-ORPHAN-DELETE) — so nothing here depends on hook order.
  */
 const MEMORY_HOOK_CONFIG = {
     Stop: 'memory-worker',
@@ -30,14 +32,32 @@ const MEMORY_HOOK_CONFIG = {
     PreCompact: 'pre-compact-memory',
 };
 /**
- * Legacy hook filename markers from prior architectures.
- * Used by removeMemoryHooks to clean up hooks from upgrading users.
+ * The command endings of the memory-era hooks earlier releases registered, per
+ * event. Removed by removeMemoryHooks so an upgrade leaves no hook pointing at a
+ * script that no longer exists; never counted as a current memory hook.
+ *
+ * D-EXACT-HOOK-OWNER (hooks.ts): matched as command ENDINGS under any directory —
+ * the v1 (≤ v1.2) direct `.sh` scripts, then the retired `run-hook` markers of the
+ * prompt-capture, learning, decisions, knowledge-refresh, sidecar and dream
+ * pipelines — never as substrings, so a user's hook that mentions one is theirs.
  */
-const LEGACY_HOOK_MARKERS = {
-    UserPromptSubmit: ['prompt-capture-memory', 'sidecar-dispatch', 'dream-dispatch'],
-    Stop: ['stop-update-memory', 'stop-update-learning', 'sidecar-capture', 'dream-capture'],
-    SessionEnd: ['session-end-learning', 'session-end-decisions', 'session-end-knowledge-refresh', 'sidecar-evaluate', 'dream-evaluate'],
+const LEGACY_HOOK_SUFFIXES = {
+    UserPromptSubmit: ['prompt-capture-memory', 'sidecar-dispatch', 'dream-dispatch'].map(runHookSuffix),
+    Stop: [
+        `${HOOKS_DIR_SUFFIX}stop-update-memory.sh`,
+        ...['stop-update-memory', 'stop-update-learning', 'sidecar-capture', 'dream-capture'].map(runHookSuffix),
+    ],
+    SessionStart: [`${HOOKS_DIR_SUFFIX}session-start-memory.sh`],
+    PreCompact: [`${HOOKS_DIR_SUFFIX}pre-compact-memory.sh`],
+    SessionEnd: [
+        'session-end-learning', 'session-end-decisions', 'session-end-knowledge-refresh',
+        'sidecar-evaluate', 'dream-evaluate',
+    ].map(runHookSuffix),
 };
+/** D-EXACT-HOOK-OWNER: the current memory hook for `marker` (hooks.ts). */
+function isMemoryHook(marker) {
+    return devflowHookOwner([marker]);
+}
 /**
  * Add all 3 memory hooks (Stop, SessionStart, PreCompact) to settings JSON.
  * Idempotent — skips hooks that already exist. Returns unchanged JSON if all 3 present.
@@ -47,28 +67,10 @@ export function addMemoryHooks(settingsJson, devflowDir) {
     if (hasMemoryHooks(settings)) {
         return settingsJson;
     }
-    if (!settings.hooks) {
-        settings.hooks = {};
-    }
     for (const [hookType, marker] of Object.entries(MEMORY_HOOK_CONFIG)) {
-        const existing = settings.hooks[hookType] ?? [];
-        const alreadyPresent = existing.some((matcher) => matcher.hooks.some((h) => h.command.includes(marker)));
-        if (!alreadyPresent) {
-            const hookCommand = path.join(devflowDir, 'scripts', 'hooks', 'run-hook') + ` ${marker}`;
-            const newEntry = {
-                hooks: [
-                    {
-                        type: 'command',
-                        command: hookCommand,
-                        timeout: 10,
-                    },
-                ],
-            };
-            if (!settings.hooks[hookType]) {
-                settings.hooks[hookType] = [];
-            }
-            settings.hooks[hookType].push(newEntry);
-        }
+        ensureHook(settings, hookType, isMemoryHook(marker), {
+            hooks: [{ type: 'command', command: runHookCommand(devflowDir, marker), timeout: 10 }],
+        });
     }
     return JSON.stringify(settings, null, 2) + '\n';
 }
@@ -81,36 +83,16 @@ export function addMemoryHooks(settingsJson, devflowDir) {
 export function removeMemoryHooks(input) {
     const settingsJson = typeof input === 'string' ? input : JSON.stringify(input);
     const settings = typeof input === 'string' ? JSON.parse(input) : structuredClone(input);
-    if (!settings.hooks) {
-        return settingsJson;
-    }
+    // Evaluate every removal into a local — never short-circuit (PF-015).
     let changed = false;
     for (const [hookType, marker] of Object.entries(MEMORY_HOOK_CONFIG)) {
-        if (!settings.hooks[hookType]) {
-            continue;
-        }
-        const before = settings.hooks[hookType].length;
-        settings.hooks[hookType] = settings.hooks[hookType].filter((matcher) => !matcher.hooks.some((h) => h.command.includes(marker)));
-        if (settings.hooks[hookType].length !== before) {
-            changed = true;
-        }
-        if (settings.hooks[hookType].length === 0) {
-            delete settings.hooks[hookType];
-        }
-    }
-    // Remove legacy pre-dream hooks from upgrading users
-    for (const [hookType, markers] of Object.entries(LEGACY_HOOK_MARKERS)) {
-        if (!settings.hooks[hookType])
-            continue;
-        const before = settings.hooks[hookType].length;
-        settings.hooks[hookType] = settings.hooks[hookType].filter((matcher) => !matcher.hooks.some((h) => markers.some((m) => h.command.includes(m))));
-        if (settings.hooks[hookType].length !== before)
-            changed = true;
-        if (settings.hooks[hookType].length === 0)
-            delete settings.hooks[hookType];
+        const removed = removeHooks(settings, hookType, isMemoryHook(marker));
+        changed = changed || removed;
     }
-    if (settings.hooks && Object.keys(settings.hooks).length === 0) {
-        delete settings.hooks;
+    // Remove the memory-era hooks of earlier releases from upgrading users
+    for (const [hookType, suffixes] of Object.entries(LEGACY_HOOK_SUFFIXES)) {
+        const removed = removeHooks(settings, hookType, endsWithAny(suffixes));
+        changed = changed || removed;
     }
     if (!changed) {
         return settingsJson;
@@ -129,18 +111,48 @@ export function hasMemoryHooks(input) {
  */
 export function countMemoryHooks(input) {
     const settings = typeof input === 'string' ? JSON.parse(input) : input;
-    if (!settings.hooks) {
-        return 0;
-    }
     let count = 0;
     for (const [hookType, marker] of Object.entries(MEMORY_HOOK_CONFIG)) {
-        const matchers = settings.hooks[hookType] ?? [];
-        if (matchers.some((matcher) => matcher.hooks.some((h) => h.command.includes(marker)))) {
+        if (hasHook(settings, hookType, isMemoryHook(marker)))
             count++;
-        }
     }
     return count;
 }
+/**
+ * Converge the memory hooks in a settings JSON string to `enabled`. Pure.
+ *
+ * D-FEATURES-NARROW-ONLY: the ONE settings transform for the memory feature,
+ * shared by `devflow init` (inside its single settings read-modify-write pass)
+ * and `devflow memory --enable/--disable`, so the two controls of the same
+ * machine-wide switch leave settings.json byte-for-byte alike. Always
+ * remove-then-add, which also upgrades an older hook format (e.g. `.sh` →
+ * `run-hook`) in place.
+ *
+ * Stop-array position (AC-C2): memory-worker is appended after whatever the
+ * Stop array already holds, so it lands after capture-turn — init registers the
+ * capture hooks earlier in the same pass, and on a standalone toggle they are
+ * already present. The position keeps settings.json identical across init and
+ * the toggle; it sequences nothing at run time, where the Stop hooks run in
+ * parallel.
+ */
+export function convergeMemoryHooks(settingsJson, enabled, devflowDir) {
+    const cleaned = removeMemoryHooks(settingsJson);
+    return enabled ? addMemoryHooks(cleaned, devflowDir) : cleaned;
+}
+/**
+ * Drain a project's pending memory queue (and a claimed batch) so stale turns
+ * are not processed when memory is next switched on. Shared by `devflow init
+ * --no-memory` and `devflow memory --disable`. ENOENT-tolerant; any other
+ * error propagates to the command boundary, like drainLearningQueue.
+ */
+export async function drainMemoryQueue(projectRoot) {
+    const ignoreMissing = (e) => { if (e.code !== 'ENOENT')
+        throw e; };
+    await Promise.all([
+        fs.unlink(getPendingTurnsPath(projectRoot)).catch(ignoreMissing),
+        fs.unlink(getPendingTurnsProcessingPath(projectRoot)).catch(ignoreMissing),
+    ]);
+}
 /**
  * Returns true if the given project root contains a `.devflow/memory/` directory.
  * Treats unexpected errors (e.g. EACCES) as absent to avoid false positives.
@@ -195,16 +207,16 @@ export async function cleanQueueFiles(projectPaths) {
 }
 export const memoryCommand = new Command('memory')
     .description('Enable, disable, or clean up working memory (session context preservation)')
-    .option('--enable', 'Enable working memory')
-    .option('--disable', 'Disable working memory')
+    .option('--enable', 'Enable working memory in every project (a repository can opt out)')
+    .option('--disable', 'Disable working memory in every project')
     .option('--status', 'Show current state')
     .option('--clear', 'Clean up queue files from projects')
     .action(async (options) => {
     const hasFlag = options.enable || options.disable || options.status || options.clear;
     if (!hasFlag) {
         p.intro(color.bgCyan(color.white(' Working Memory ')));
-        p.note(`${color.cyan('devflow memory --enable')}   Add memory hooks\n` +
-            `${color.cyan('devflow memory --disable')}  Remove memory hooks\n` +
+        p.note(`${color.cyan('devflow memory --enable')}   Enable working memory (every project; a repository can opt out)\n` +
+            `${color.cyan('devflow memory --disable')}  Disable working memory (every project)\n` +
             `${color.cyan('devflow memory --status')}   Check current state\n` +
             `${color.cyan('devflow memory --clear')}    Clean up queue files`, 'Usage');
         p.outro(color.dim('Memory hooks provide automatic session context preservation'));
@@ -213,7 +225,7 @@ export const memoryCommand = new Command('memory')
     if (options.clear) {
         p.intro(color.bgCyan(color.white(' Memory Cleanup ')));
         // Discover current project and all known projects in parallel
-        const [gitRoots, gitRoot] = await Promise.all([discoverProjectGitRoots(), getGitRoot()]);
+        const [gitRoots, gitRoot] = await Promise.all([discoverProjectGitRoots(getClaudeDirectory()), getGitRoot()]);
         const [projectsWithMemory, currentProjectHasMem] = await Promise.all([
             filterProjectsWithMemory(gitRoots),
             gitRoot ? hasMemoryDir(gitRoot) : Promise.resolve(false),
@@ -260,90 +272,77 @@ export const memoryCommand = new Command('memory')
             : 'No queue files found to clean');
         return;
     }
-    const claudeDir = getClaudeDirectory();
-    const settingsPath = path.join(claudeDir, 'settings.json');
+    const settingsPath = path.join(getClaudeDirectory(), 'settings.json');
+    const devflowDir = getDevFlowDirectory();
     let settingsContent;
     try {
         settingsContent = await fs.readFile(settingsPath, 'utf-8');
     }
     catch {
-        if (options.status) {
-            p.log.info('Working memory: disabled (no settings.json found)');
-            return;
-        }
-        // Create minimal settings.json
         settingsContent = '{}';
     }
-    // Resolve current project root for feature config
-    const gitRoot = await getGitRoot();
     if (options.status) {
-        if (!gitRoot) {
-            p.log.info(`Working memory: ${color.dim('disabled')} (not in a git project)`);
-            return;
-        }
+        // D-FEATURES-NARROW-ONLY: the machine switch, the manifest's, is reported
+        // first. The hook count is reported beside it because the hooks are how that
+        // switch takes effect. A repository layer can only narrow it, and says so on
+        // a line of its own — only when it does, so the output is otherwise unchanged.
+        const enabled = await readMachineFeature(devflowDir, 'memory');
         const count = countMemoryHooks(settingsContent);
         const total = Object.keys(MEMORY_HOOK_CONFIG).length;
-        // Also check feature config: hooks may be registered but feature toggled off
-        const featureEnabled = await isFeatureEnabled(gitRoot, 'memory');
-        if (count === total && featureEnabled) {
+        if (enabled && count === total) {
             p.log.info(`Working memory: ${color.green('enabled')} (${total}/${total} hooks)`);
         }
-        else if (count === 0 || !featureEnabled) {
+        else if (!enabled) {
             p.log.info(`Working memory: ${color.dim('disabled')}`);
         }
         else {
-            p.log.info(`Working memory: ${color.yellow(`partial (${count}/${total} hooks)`)} — run --enable to fix`);
+            p.log.info(`Working memory: ${color.yellow(`enabled, but ${count}/${total} hooks registered`)} — ` +
+                `run ${color.cyan('devflow memory --enable')} to fix`);
         }
+        const settingsModule = loadSettingsModule();
+        const narrowed = enabled ? narrowedSwitchLabel(settingsModule, { dir: process.cwd() }, 'memory') : null;
+        if (narrowed !== null)
+            p.log.info(`Effective here: ${color.yellow(narrowed)}`);
+        const trackedWarning = personalConfigTrackedWarning(settingsModule, { dir: process.cwd() });
+        if (trackedWarning !== null)
+            p.log.warn(trackedWarning);
         return;
     }
-    const devflowDir = getDevFlowDirectory();
-    if (options.enable) {
-        // D: --enable both installs hooks AND writes feature config, while --disable only
-        // writes feature config. This asymmetry is intentional: capture hooks are shared
-        // across features (memory, learning, decisions) and must never be removed by a
-        // single-feature disable. --enable must still install them on first use.
-        const alreadyHasHooks = hasMemoryHooks(settingsContent);
-        const alreadyEnabled = alreadyHasHooks && (gitRoot ? await isFeatureEnabled(gitRoot, 'memory') : false);
-        if (alreadyEnabled) {
-            p.log.info('Working memory already enabled');
-        }
-        else if (alreadyHasHooks) {
-            // Hooks are registered but config has memory:false — re-enable via config
-            p.log.success('Working memory enabled — configuration updated');
-            p.log.info(color.dim('Session context will be automatically preserved across conversations'));
-        }
-        else {
-            const updated = addMemoryHooks(settingsContent, devflowDir);
-            await writeFileAtomicExclusive(settingsPath, updated);
-            p.log.success('Working memory enabled — hooks registered');
-            p.log.info(color.dim('Session context will be automatically preserved across conversations'));
-        }
-        // Update config to enable memory feature
-        if (gitRoot) {
-            await updateFeature(gitRoot, 'memory', true);
-        }
-        await syncManifestFeature(getDevFlowDirectory(), 'memory', true);
+    // --enable / --disable: the machine-wide switch, converged exactly as
+    // `devflow init --memory / --no-memory` converges it (D-FEATURES-NARROW-ONLY).
+    // The settings transform runs FIRST: it is the step that can reject its
+    // input (malformed JSON), and the switch must not be recorded unless the
+    // hooks that enact it can follow.
+    const enabled = options.enable === true;
+    let converged;
+    try {
+        converged = convergeMemoryHooks(settingsContent, enabled, devflowDir);
+    }
+    catch (err) {
+        p.log.error(`Could not update ${settingsPath}: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
         return;
     }
-    if (options.disable) {
-        // Hooks remain registered (shared with other features).
-        // Disable by writing memory: false to config only — hooks are not removed.
-        if (gitRoot) {
-            await updateFeature(gitRoot, 'memory', false);
-            // Drain orphaned queue files so stale turns don't process on re-enable
-            await Promise.all([
-                fs.unlink(getPendingTurnsPath(gitRoot)).catch((e) => { if (e.code !== 'ENOENT')
-                    throw e; }),
-                fs.unlink(getPendingTurnsProcessingPath(gitRoot)).catch((e) => { if (e.code !== 'ENOENT')
-                    throw e; }),
-            ]);
-            await syncManifestFeature(getDevFlowDirectory(), 'memory', false);
-            p.log.success('Working memory disabled — configuration updated');
-        }
-        else {
-            p.log.warn('Could not resolve git root — configuration not updated');
-        }
+    const recorded = await writeMachineFeature(devflowDir, 'memory', enabled);
+    if (!recorded.ok) {
+        p.log.error(`Devflow is not installed on this machine — run ${color.cyan('devflow init')} first`);
+        process.exitCode = 1;
         return;
     }
+    if (converged !== settingsContent) {
+        await writeSettingsFileAtomic(settingsPath, converged);
+    }
+    if (enabled) {
+        p.log.success('Working memory enabled in every project (a repository can opt out)');
+        p.log.info(color.dim('Session context will be automatically preserved across conversations'));
+        return;
+    }
+    // Drain the current project's queue, as init does. Outside a git project
+    // there is no project queue to drain, and the switch itself still applies.
+    const gitRoot = await getGitRoot();
+    if (gitRoot) {
+        await drainMemoryQueue(gitRoot);
+    }
+    p.log.success('Working memory disabled in every project');
 });
 //# sourceMappingURL=memory.js.map

package/dist/cli/commands/prompt-io.js

@@ -1,10 +1,10 @@
 /**
  * Shared wizard prompt-IO seam for devflow init wizard steps.
  *
- * ADR-019 corollary (one-definition seam): PromptOutcome and WizardPromptIO
- * were byte-identical duplicates across attribution-prompts.ts and
- * compliance-prompts.ts (architecture-03 / consistency-06). They are defined
- * ONCE here and re-used via import.
+ * One-definition seam: PromptOutcome and WizardPromptIO were byte-identical
+ * duplicates across attribution-prompts.ts and compliance-prompts.ts
+ * (architecture-03 / consistency-06). They are defined ONCE here and re-used
+ * via import.
  *
  * D-PROMPT-IO: WizardPromptIO is the base DI seam for all two-action wizard
  * steps (note + boolean select). Modules that add a third prompt extend this

package/dist/cli/commands/proxy.js

@@ -24,7 +24,7 @@ import * as p from '@clack/prompts';
 import color from 'picocolors';
 import { readProxyState, writeProxyState, buildProxyState, buildRoutingConfigJson, proxyBaseUrl, proxyJsonExists, resolveProxyBin, DEFAULT_PROXY_PORT, } from '../../core/proxy-state.js';
 import { syncManifestFeature, readManifest } from '../../core/manifest.js';
-import { writeFileAtomicExclusive } from '../../core/fs-atomic.js';
+import { writeSettingsFileAtomic } from '../../core/fs-atomic.js';
 import { scrubChildEnv, openProxyLog, rotateProxyLogIfLarge } from '../../core/proxy-log.js';
 import { inspectCodexAuth, classifyCodexAuthReadError } from '../../core/codex-auth-inspect.js';
 import { stripAnsi } from '../../hud/colors.js';
@@ -32,6 +32,7 @@ import { reapplyAgentMapping, revertExternalAgents, countExternalMappedAgents, r
 import { getExternalModelsCached, discoverExternalModels, } from '../../core/model-discovery.js';
 import { modelCacheDir } from '../../core/cache.js';
 import { getClaudeDirectory, getDevFlowDirectory, getHomeDirectory, } from '../../targets/claude-code/claude-paths.js';
+import { devflowHookOwner, ensureHook, hasHook, removeHooks, runHookCommand, } from '../../targets/claude-code/hooks.js';
 function Ok(value) {
     return { ok: true, value };
 }
@@ -39,8 +40,17 @@ function Err(error) {
     return { ok: false, error };
 }
 // ─── Constants ────────────────────────────────────────────────────────────────
-/** Marker used to identify ensure-proxy hook entries. */
+/** The run-hook marker of the ensure-proxy hook. */
 const PROXY_HOOK_MARKER = 'ensure-proxy';
+/**
+ * D-EXACT-HOOK-OWNER: the ensure-proxy hook is devflow's only when its command ends
+ * in `/scripts/hooks/run-hook ensure-proxy` (hooks.ts), under any directory — the one
+ * form it has ever been registered in. A user's hook that merely mentions the word
+ * is theirs.
+ */
+const isProxyHook = devflowHookOwner([PROXY_HOOK_MARKER]);
+/** The events the ensure-proxy hook is registered on. */
+const PROXY_HOOK_EVENTS = ['SessionStart', 'UserPromptSubmit'];
 /** Pattern matching our relay's ANTHROPIC_BASE_URL value. */
 const OUR_BASE_URL_PATTERN = /^http:\/\/127\.0\.0\.1:\d+$/;
 /** Timeout for individual TCP connect probes and HTTP health checks (ms). */
@@ -166,34 +176,6 @@ function _stripProxyEnvFromObject(settings, managedPort) {
         delete s.env;
     return removedUrl || hadWindowVar; // OR the locals — never compose with || inline (PF-015)
 }
-/** Internal: add ensure-proxy hook to one event. Returns true when added. */
-function _ensureProxyHook(settings, eventName, hookCmd) {
-    const existing = settings.hooks?.[eventName];
-    if (existing?.some((m) => m.hooks.some((h) => h.command.includes(PROXY_HOOK_MARKER)))) {
-        return false;
-    }
-    settings.hooks ??= {};
-    settings.hooks[eventName] ??= [];
-    const entry = {
-        hooks: [{ type: 'command', command: hookCmd, timeout: 15 }],
-    };
-    settings.hooks[eventName].push(entry);
-    return true;
-}
-/** Internal: remove ensure-proxy hooks from one event. Returns true when removed. */
-function _filterProxyHooks(settings, eventName) {
-    if (!settings.hooks?.[eventName])
-        return false;
-    const before = settings.hooks[eventName].length;
-    settings.hooks[eventName] = settings.hooks[eventName].filter((m) => !m.hooks.some((h) => h.command.includes(PROXY_HOOK_MARKER)));
-    if (settings.hooks[eventName].length === before)
-        return false;
-    if (settings.hooks[eventName].length === 0)
-        delete settings.hooks[eventName];
-    if (Object.keys(settings.hooks).length === 0)
-        delete settings.hooks;
-    return true;
-}
 // ─── Pure env functions (exported for testing and cross-module reuse) ─────────
 /**
  * Apply ANTHROPIC_BASE_URL=http://127.0.0.1:<port> to settings JSON.
@@ -251,20 +233,21 @@ export function readProxyEnvState(settingsJson, port) {
  * Mutates settings in place. Returns true when any hook was added.
  */
 export function addProxyHooks(settings, devflowDir) {
-    const hookCmd = path.join(devflowDir, 'scripts', 'hooks', 'run-hook') + ' ' + PROXY_HOOK_MARKER;
-    const addedSession = _ensureProxyHook(settings, 'SessionStart', hookCmd);
-    const addedPrompt = _ensureProxyHook(settings, 'UserPromptSubmit', hookCmd);
+    const command = runHookCommand(devflowDir, PROXY_HOOK_MARKER);
+    // Evaluate each event into its own local — never short-circuit (PF-015).
+    const [addedSession, addedPrompt] = PROXY_HOOK_EVENTS.map((event) => ensureHook(settings, event, isProxyHook, { hooks: [{ type: 'command', command, timeout: 15 }] }));
     return addedSession || addedPrompt;
 }
 /**
  * Remove ensure-proxy hooks from all events.
  * Idempotent — no-op when hooks are not present.
- * Preserves other hooks. Cleans empty arrays/objects.
+ * Removes single hooks, so the other hooks of a shared matcher group stay in place
+ * (D-EXACT-HOOK-OWNER). Cleans empty arrays/objects.
  * Mutates settings in place. Returns true when any hook was removed.
  */
 export function removeProxyHooks(settings) {
-    const removedSession = _filterProxyHooks(settings, 'SessionStart');
-    const removedPrompt = _filterProxyHooks(settings, 'UserPromptSubmit');
+    // Evaluate each event into its own local — never short-circuit (PF-015).
+    const [removedSession, removedPrompt] = PROXY_HOOK_EVENTS.map((event) => removeHooks(settings, event, isProxyHook));
     return removedSession || removedPrompt;
 }
 /**
@@ -319,8 +302,7 @@ export function applyProxyTeardownToSettings(settings, managedPort) {
  */
 export function hasProxyHooks(input) {
     const settings = typeof input === 'string' ? JSON.parse(input) : input;
-    const check = (eventName) => settings.hooks?.[eventName]?.some((m) => m.hooks.some((h) => h.command.includes(PROXY_HOOK_MARKER))) === true;
-    return check('SessionStart') || check('UserPromptSubmit');
+    return PROXY_HOOK_EVENTS.some((event) => hasHook(settings, event, isProxyHook));
 }
 // ─── Health-check identity helper ────────────────────────────────────────────
 /**
@@ -747,7 +729,7 @@ export async function runPostSpawnVerification(binPath, configPath, logPath, spa
  * Perform the single atomic settings.json pass for enable:
  * strip old hooks + env, then apply new hooks + env in one write.
  *
- * The writeFileAtomicExclusive call is guarded — ENOSPC/EACCES returns Err
+ * The writeSettingsFileAtomic call is guarded — ENOSPC/EACCES returns Err
  * instead of crashing with an unhandled rejection.
  *
  * Returns Ok(undefined) on success, Err(reason) on hard failure.
@@ -777,7 +759,7 @@ async function applyEnableSettingsPass(settingsPath, devflowDir, port) {
     addProxyHooks(parsedSettings, devflowDir);
     _applyProxyEnvToObject(parsedSettings, port);
     try {
-        await writeFileAtomicExclusive(settingsPath, JSON.stringify(parsedSettings, null, 2) + '\n');
+        await writeSettingsFileAtomic(settingsPath, JSON.stringify(parsedSettings, null, 2) + '\n');
     }
     catch (err) {
         return Err(`Could not write settings.json: ${err instanceof Error ? err.message : String(err)}`);
@@ -1465,7 +1447,7 @@ async function runDisable() {
     if (changed) {
         // Guard ENOSPC/EACCES — unhandled rejection leaves proxy in partial state
         try {
-            await writeFileAtomicExclusive(settingsPath, JSON.stringify(parsedSettings, null, 2) + '\n');
+            await writeSettingsFileAtomic(settingsPath, JSON.stringify(parsedSettings, null, 2) + '\n');
         }
         catch (err) {
             p.log.error(`Could not write settings.json: ${err instanceof Error ? err.message : String(err)}`);