github-router 0.3.249 → 0.3.255

package/dist/stop-gate-hook-DQc2KV7B.js

@@ -0,0 +1,686 @@
+import { r as parseBoolEnv } from "./exec-DTO2oin0.js";
+import { a as isSubagentContext, o as regressions } from "./stop-gate-policy-CHwWbuF_.js";
+import { promises } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+//#region src/lib/orchestration/gate-runner.ts
+async function runGateChecks(checks, cwd, exec) {
+	const results = await Promise.all(checks.map(async (c) => {
+		try {
+			const r = await exec({
+				command: c.command,
+				cwd
+			});
+			return {
+				id: c.id,
+				passed: r.exitCode === 0
+			};
+		} catch {
+			return {
+				id: c.id,
+				passed: false
+			};
+		}
+	}));
+	const passed = /* @__PURE__ */ new Set();
+	const ran = /* @__PURE__ */ new Set();
+	for (const r of results) {
+		ran.add(r.id);
+		if (r.passed) passed.add(r.id);
+	}
+	return {
+		passed,
+		ran
+	};
+}
+//#endregion
+//#region src/lib/orchestration/gate-registry.ts
+/**
+* Built-in sealed gates. Commands follow this repo's TS/Bun conventions (the
+* `bun run <script>` indirection means a repo without that script simply fails
+* the check, which the selector treats as not-passed rather than a crash). New
+* ecosystems get a new sealed id here, never a caller-supplied command.
+*/
+const SEALED_GATES = {
+	"default-ci": [
+		{
+			id: "typecheck",
+			command: "bun run typecheck"
+		},
+		{
+			id: "test",
+			command: "bun test"
+		},
+		{
+			id: "lint",
+			command: "bun run lint"
+		}
+	],
+	"typecheck-test": [{
+		id: "typecheck",
+		command: "bun run typecheck"
+	}, {
+		id: "test",
+		command: "bun test"
+	}],
+	"typecheck-only": [{
+		id: "typecheck",
+		command: "bun run typecheck"
+	}]
+};
+/** The set of sealed gate ids, used as the kernel's `knownGateIds` so the IR
+*  verifier rejects an executable gate that references an unregistered id. */
+function sealedGateIds() {
+	return new Set(Object.keys(SEALED_GATES));
+}
+/**
+* Resolve a sealed gate by id. Returns a DEFENSIVE CLONE (fresh objects) so a
+* caller can never mutate the registry's command set. `undefined` for an
+* unknown id, which `run_workflow` rejects before executing anything.
+*/
+function resolveSealedGate(gateId) {
+	const checks = SEALED_GATES[gateId];
+	if (!checks) return void 0;
+	return {
+		id: gateId,
+		checks: checks.map((c) => ({
+			id: c.id,
+			command: c.command
+		}))
+	};
+}
+//#endregion
+//#region src/lib/orchestration/gate-immutability.ts
+/** Patterns that weaken a gate regardless of language (test exclusivity / focus
+*  idioms shared across JS test runners; kept in COMMON since several languages
+*  reuse them). */
+const COMMON_PATTERNS = [{
+	name: "skipped-test",
+	re: /(\.\s*skip\s*\(|\bxit\s*\(|\bxdescribe\s*\(|\.\s*only\s*\()/
+}];
+/** Language-specific weakening patterns, selected by the added line's file type. */
+const LANG_PATTERNS = {
+	ts: [
+		{
+			name: "ts-suppression",
+			re: /@ts-(ignore|nocheck|expect-error)\b/
+		},
+		{
+			name: "any-cast",
+			re: /\bas\s+any\b|:\s*any\b/
+		},
+		{
+			name: "eslint-disable",
+			re: /eslint-disable\b/
+		}
+	],
+	py: [
+		{
+			name: "py-type-ignore",
+			re: /#\s*type:\s*ignore\b/
+		},
+		{
+			name: "py-noqa",
+			re: /#\s*noqa\b/
+		},
+		{
+			name: "py-skip",
+			re: /@(pytest\.mark\.skip|unittest\.skip)\b/
+		}
+	],
+	go: [{
+		name: "go-skip",
+		re: /\bt\.Skip\s*\(/
+	}, {
+		name: "go-nolint",
+		re: /\/\/\s*nolint\b/
+	}],
+	rust: [{
+		name: "rust-ignore",
+		re: /#\[\s*ignore\b/
+	}, {
+		name: "rust-allow",
+		re: /#\[\s*allow\s*\(/
+	}]
+};
+/** Map a file path to a language key for `LANG_PATTERNS` (null → COMMON only). */
+function langForFile(file) {
+	if (!file) return null;
+	switch (file.slice(file.lastIndexOf(".")).toLowerCase()) {
+		case ".ts":
+		case ".tsx":
+		case ".mts":
+		case ".cts":
+		case ".js":
+		case ".jsx":
+		case ".mjs":
+		case ".cjs": return "ts";
+		case ".py":
+		case ".pyi": return "py";
+		case ".go": return "go";
+		case ".rs": return "rust";
+		default: return null;
+	}
+}
+/** Union of COMMON + every language — the pre-header default (no file known yet),
+*  so a header-less diff is matched permissively, exactly as before this became
+*  language-scoped. Once a real file header appears, the set narrows to that
+*  file's language (or COMMON only for an unknown extension → fail open). */
+const ALL_PATTERNS = [...COMMON_PATTERNS, ...Object.values(LANG_PATTERNS).flat()];
+/** A `diff --git a/x b/x` or `+++ b/x` header → the current file path. */
+function fileFromHeader(line) {
+	const git = /^diff --git a\/.+ b\/(.+)$/.exec(line);
+	if (git) return git[1];
+	const plus = /^\+\+\+ b\/(.+)$/.exec(line);
+	if (plus) return plus[1];
+}
+function detectGateWeakening(diff) {
+	const findings = [];
+	let file;
+	let patterns = ALL_PATTERNS;
+	for (const raw of diff.split("\n")) {
+		const headerFile = fileFromHeader(raw);
+		if (headerFile !== void 0) {
+			file = headerFile;
+			const lang = langForFile(file);
+			patterns = lang ? [...COMMON_PATTERNS, ...LANG_PATTERNS[lang]] : COMMON_PATTERNS;
+			continue;
+		}
+		if (!raw.startsWith("+") || raw.startsWith("+++")) continue;
+		const added = raw.slice(1);
+		for (const p of patterns) if (p.re.test(added)) findings.push(file === void 0 ? {
+			pattern: p.name,
+			line: added.trim()
+		} : {
+			pattern: p.name,
+			line: added.trim(),
+			file
+		});
+	}
+	return {
+		weakened: findings.length > 0,
+		findings
+	};
+}
+//#endregion
+//#region src/lib/orchestration/stop-gate.ts
+/**
+* The Phase-0 structural-gate decision — the cheap, CERTAIN floor win. It blocks
+* marking work "done" when any canonical gate fails OR the diff weakens a gate.
+* A non-model check that fires every run and never ships broken or gate-gamed
+* code; per the floor analysis it is the only component that raises the
+* worst-case floor BY CONSTRUCTION (the orchestration on top is a conditional
+* bet).
+*
+* This is the logic behind the spawned-session Stop-hook AND the kernel runner's
+* pre-accept check. The process exec and the diff are inputs, so the decision is
+* pure + unit-testable; the hook script that runs `git diff` + invokes this is a
+* thin wrapper.
+*/
+async function evaluateStopGate(input) {
+	const gate = await runGateChecks(input.checks, input.cwd, input.exec);
+	const weak = detectGateWeakening(input.diff);
+	const failedChecks = input.checks.map((c) => c.id).filter((id) => !gate.passed.has(id));
+	const block = failedChecks.length > 0 || weak.weakened;
+	const parts = [];
+	if (failedChecks.length > 0) parts.push(`failing gates: ${failedChecks.join(", ")}`);
+	if (weak.weakened) {
+		const pats = [...new Set(weak.findings.map((f) => f.pattern))].join(", ");
+		parts.push(`gate-weakening in the diff: ${pats}`);
+	}
+	return {
+		block,
+		reason: block ? parts.join("; ") : "all canonical gates pass; no gate-weakening in the diff",
+		failedChecks,
+		weakening: weak.findings
+	};
+}
+//#endregion
+//#region src/lib/orchestration/stop-gate-hook.ts
+/**
+* The Phase-0 structural-gate Stop-hook glue. `runStopGateForLaunch` resolves a
+* SEALED gate by id and evaluates it against the working-tree diff, returning the
+* block decision a spawned-session Stop hook (or a manual check) acts on.
+*
+* Safety posture (deliberately different from the kernel): a Stop hook that
+* blocks on a MISCONFIGURATION would wedge the user's session (they could not
+* stop). So this fails OPEN on config problems (unknown gate id) and blocks ONLY
+* on a genuine red gate or a gate-weakening diff. The kernel, by contrast, fails
+* CLOSED to the baseline. Both are correct for their context.
+*
+* The sealed gate + diff + exec are inputs, so the decision is pure and
+* unit-testable; the thin live wrapper (capture `git diff`, spawn the checks,
+* map the result to an exit code) is the only part that needs a real process.
+*/
+async function runStopGateForLaunch(input) {
+	const gate = resolveSealedGate(input.gateId);
+	if (!gate) return {
+		block: false,
+		reason: `stop-gate: unknown gateId "${input.gateId}" (not blocking)`,
+		failedChecks: [],
+		weakening: []
+	};
+	return evaluateStopGate({
+		checks: gate.checks,
+		cwd: input.workspace,
+		exec: input.exec,
+		diff: input.diff
+	});
+}
+/**
+* The launch-stable baseline key for the dynamic gate path: keyed by the
+* workdir + the descriptor's check set + a per-launch token, NOT the session id
+* and NOT HEAD. The LAUNCHER generates the token (passed to the child via env),
+* computes this key, and seeds the baseline (the set of checks already failing at
+* launch, BEFORE the agent mutates the tree); the runtime hook recomputes the
+* same key (reading the token from its env) and reads that baseline, so an
+* agent-introduced failure is a REGRESSION rather than being silently adopted as
+* the baseline at first stop. The per-launch token isolates concurrent sessions
+* on the same repo (they don't clobber each other's baseline). HEAD is
+* deliberately NOT in the key: an agent that COMMITS its work mid-session must
+* still be judged against the pre-session baseline (a HEAD-keyed baseline would
+* vanish on the commit — the exact moment it matters). A changed check set (the
+* agent edited the harness) yields a different key → the launch baseline no
+* longer matches and the hook degrades to first-stop baselining.
+*/
+function launchBaselineKey(workdir, descriptorKey, token) {
+	return JSON.stringify([
+		"launch",
+		path.resolve(workdir),
+		descriptorKey,
+		token ?? ""
+	]);
+}
+/**
+* Run the resolved checks ONCE at launch (pre-mutation) and record the failing
+* set as the baseline under `launchBaselineKey`. Best-effort: any failure is
+* swallowed (the hook then degrades to first-stop baselining). The launcher MUST
+* pass the SAME check set the hook will run (same `includeTests`) so a
+* pre-existing test failure isn't later miscounted as a regression.
+*
+* NOTE: capture is best-effort pre-mutation — the launcher fires it before the
+* child can edit, and in practice the agent does not mutate until well after a
+* user prompt, so the checks see the clean tree. If the agent somehow mutates
+* before this completes, the worst case is the legacy first-stop baseline (no
+* regression, never a wedge).
+*/
+async function captureLaunchBaseline(input) {
+	if (input.checks.length === 0) return;
+	try {
+		const gate = await runGateChecks(input.checks, input.workdir, input.exec);
+		const failed = input.checks.map((c) => c.id).filter((id) => !gate.passed.has(id));
+		await input.baseline.set(launchBaselineKey(input.workdir, input.descriptorKey, input.token), failed);
+	} catch {}
+}
+/**
+* The advisory background review (hook V2) is ON by default whenever the Stop
+* gate runs; it is the cross-lab accountability layer. Opt out with
+* `GH_ROUTER_DISABLE_STOP_REVIEW=1` to keep the deterministic gate but drop the
+* LLM review. (Disabling the whole gate with `GH_ROUTER_DISABLE_STOP_GATE=1`
+* also drops the review, since the review only ever fires from the gate's green
+* path.)
+*/
+function stopReviewEnabled(env = process.env) {
+	return parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_REVIEW) !== true;
+}
+/** The sealed gate the Stop hook runs, overridable via `GH_ROUTER_STOP_GATE_ID`
+*  (must be a registered sealed id; the live wrapper falls open on an unknown
+*  id). Defaults to `default-ci`. */
+function stopGateId(env = process.env) {
+	const v = (env.GH_ROUTER_STOP_GATE_ID ?? "").trim();
+	return v.length > 0 ? v : "default-ci";
+}
+/**
+* PLAN-MODE env fallback. When the session is in plan mode, plan/memory scratch
+* edits should not trip the gate-WEAKENING scan (a plan/memory markdown file may
+* legitimately quote `it.skip` / `as any` while describing work). The launcher
+* sets `GH_ROUTER_STOP_GATE_PLAN_MODE` for a plan-mode session; the payload may
+* ALSO carry a forward-compat `plan_mode` field (see `decideStopHook`). Either
+* signal being present activates the scoping — the executable gate STILL runs
+* and non-plan hunks are STILL scanned.
+*/
+function stopGatePlanMode(env = process.env) {
+	return parseBoolEnv(env.GH_ROUTER_STOP_GATE_PLAN_MODE) === true;
+}
+/**
+* Is a unified-diff file path confined to a `plans/` or `memory/` directory?
+* Windows-safe (normalizes `\` → `/`). Matches only when a DIRECTORY segment of
+* the path is exactly `plans` or `memory`, so `plans/x.md`, `memory/y.md`, and
+* `a/plans/z` match while the filenames `docs/plans.md` / `myplans/x` do not.
+*/
+function isPlanMemoryDiffPath(p) {
+	const segs = p.replace(/\\/g, "/").split("/");
+	for (let i = 0; i < segs.length - 1; i++) if (segs[i] === "plans" || segs[i] === "memory") return true;
+	return false;
+}
+/**
+* Drop the file sections of a unified `git diff` whose NEW path (the `b/…` side)
+* is confined to `plans/` or `memory/` — used for the gate-WEAKENING scan when
+* plan mode is active. Sections for other files (e.g. `src/…`) are preserved
+* verbatim, so a MIXED diff keeps its non-plan hunks and `src/` weakening is
+* still caught. The executable gate does not read the diff, so filtering it here
+* never affects which checks run. A diff with no `diff --git` sections (or an
+* empty one) is returned unchanged.
+*/
+function stripPlanMemoryDiffHunks(diff) {
+	if (diff.length === 0) return diff;
+	const out = [];
+	let dropping = false;
+	for (const line of diff.split("\n")) {
+		if (line.startsWith("diff --git ")) {
+			const bPath = /^diff --git a\/.+ b\/(.+)$/.exec(line)?.[1];
+			dropping = bPath !== void 0 && isPlanMemoryDiffPath(bPath);
+			if (!dropping) out.push(line);
+			continue;
+		}
+		if (!dropping) out.push(line);
+	}
+	return out.join("\n");
+}
+/**
+* C3: whether the structural Stop-gate is disabled for THIS launch. True when the
+* `GH_ROUTER_DISABLE_STOP_GATE` env is set OR the `--no-stop-gate` launcher flag was
+* passed (`args["no-stop-gate"] === true`). A DRIVEN session sets the flag so a
+* blocking Stop hook never hangs its turn-end (~10 min) waiting on the fleet driver.
+* Pure so it is unit-testable without the live launch path.
+*/
+function stopGateDisabled(args, env = process.env) {
+	return parseBoolEnv(env.GH_ROUTER_DISABLE_STOP_GATE) === true || args["no-stop-gate"] === true;
+}
+/** True when a settings `Stop` entry already registers `command` (so the merge
+*  is idempotent across re-launches). */
+function entryHasCommand(entry, command) {
+	if (!entry || typeof entry !== "object") return false;
+	const hooks = entry.hooks;
+	if (!Array.isArray(hooks)) return false;
+	return hooks.some((h) => h && typeof h === "object" && h.command === command);
+}
+/**
+* Idempotently merge a hook running `command` for `event` (default `Stop`) into
+* an existing Claude Code settings object WITHOUT clobbering other hook events or
+* other entries. Returns a new object (never mutates the input). Re-running the
+* launcher with the same command+event does not duplicate the hook.
+*/
+function mergeStopHookIntoSettings(existing, command, event = "Stop", timeoutSec, matcher) {
+	const base = existing && typeof existing === "object" ? { ...existing } : {};
+	const hooks = base.hooks && typeof base.hooks === "object" ? { ...base.hooks } : {};
+	const arr = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+	if (!arr.some((e) => entryHasCommand(e, command))) {
+		const hook = {
+			type: "command",
+			command
+		};
+		if (typeof timeoutSec === "number" && Number.isFinite(timeoutSec) && timeoutSec > 0) hook.timeout = timeoutSec;
+		arr.push(matcher ? {
+			matcher,
+			hooks: [hook]
+		} : { hooks: [hook] });
+	}
+	hooks[event] = arr;
+	base.hooks = hooks;
+	return base;
+}
+async function decideStopHook(input) {
+	const maxBlocks = input.maxBlocks ?? 2;
+	let payload = {};
+	let parsed = false;
+	try {
+		const p = JSON.parse(input.stdin);
+		if (p && typeof p === "object") {
+			payload = p;
+			parsed = true;
+		}
+	} catch {}
+	if (!parsed) return { exitCode: 0 };
+	if (isSubagentContext(payload)) return { exitCode: 0 };
+	const sessionId = typeof payload.session_id === "string" && payload.session_id.length > 0 ? payload.session_id : "";
+	if (!sessionId) return { exitCode: 0 };
+	const cwdRaw = typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : input.fallbackCwd;
+	let cwd = cwdRaw;
+	try {
+		cwd = await promises.realpath(cwdRaw);
+	} catch {}
+	let enabled;
+	try {
+		enabled = await input.isEnabledForRepo(cwd);
+	} catch {
+		return { exitCode: 0 };
+	}
+	if (!enabled) return { exitCode: 0 };
+	let priorBlocks;
+	try {
+		priorBlocks = await input.budget.count(sessionId);
+	} catch {
+		return { exitCode: 0 };
+	}
+	if (priorBlocks >= maxBlocks) return {
+		exitCode: 0,
+		stderr: `structural gate: reached the ${maxBlocks}-block limit for this prompt; allowing the stop WITHOUT re-running the checks. If the failures from the last block are unfixed, they are shipping — run the checks manually to verify.`
+	};
+	let resolvedKey = input.gateId;
+	let dynamicBaselineKey;
+	const planMode = input.planMode === true || payload.plan_mode === true;
+	const scanDiff = (diff) => planMode ? stripPlanMemoryDiffHunks(diff) : diff;
+	const capturedDiff = async (workdir) => {
+		try {
+			return {
+				diff: await input.captureDiff(workdir),
+				captured: true
+			};
+		} catch {
+			return {
+				diff: "",
+				captured: false
+			};
+		}
+	};
+	const runGate = async () => {
+		if (input.resolveChecks) {
+			const resolved = await input.resolveChecks(cwd).catch(() => null);
+			if (!resolved || resolved.checks.length === 0) return null;
+			resolvedKey = resolved.descriptorKey;
+			dynamicBaselineKey = resolved.baselineKey;
+			const workdir = resolved.workdir || cwd;
+			const { diff, captured } = await capturedDiff(workdir);
+			if (captured && diff.length === 0) return {
+				kind: "no-diff",
+				diff
+			};
+			const result = await evaluateStopGate({
+				checks: resolved.checks,
+				cwd: workdir,
+				exec: input.exec,
+				diff: captured ? scanDiff(diff) : ""
+			});
+			return {
+				kind: "evaluated",
+				failedChecks: [...result.failedChecks],
+				weakeningPatterns: [...new Set(result.weakening.map((w) => w.pattern))],
+				diff
+			};
+		}
+		const { diff, captured } = await capturedDiff(cwd);
+		if (captured && diff.length === 0) return {
+			kind: "no-diff",
+			diff
+		};
+		const result = await runStopGateForLaunch({
+			workspace: cwd,
+			gateId: input.gateId,
+			exec: input.exec,
+			diff: captured ? scanDiff(diff) : ""
+		});
+		return {
+			kind: "evaluated",
+			failedChecks: [...result.failedChecks],
+			weakeningPatterns: [...new Set(result.weakening.map((w) => w.pattern))],
+			diff
+		};
+	};
+	const timeoutMs = input.timeoutMs ?? 3e5;
+	let timer;
+	const raced = await Promise.race([runGate(), new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
+	})]);
+	if (timer) clearTimeout(timer);
+	if (raced === "timeout") return { exitCode: 0 };
+	if (raced === null) return { exitCode: 0 };
+	if (raced.kind === "no-diff") return { exitCode: 0 };
+	const baselineKey = dynamicBaselineKey ?? JSON.stringify([
+		sessionId,
+		cwd,
+		resolvedKey
+	]);
+	const recorded = await input.baseline.get(baselineKey).catch(() => null);
+	if (recorded === null) await input.baseline.set(baselineKey, raced.failedChecks).catch(() => {});
+	const regressed = regressions(raced.failedChecks, recorded);
+	const weakened = raced.weakeningPatterns.length > 0;
+	if (regressed.length === 0 && !weakened) {
+		await maybeSpawnReview(input, sessionId, cwd, raced.diff);
+		return { exitCode: 0 };
+	}
+	try {
+		await input.budget.record(sessionId);
+	} catch {
+		return { exitCode: 0 };
+	}
+	const parts = [];
+	if (regressed.length > 0) parts.push(`regressed gates: ${regressed.join(", ")}`);
+	if (weakened) parts.push(`gate-weakening in the diff: ${raced.weakeningPatterns.join(", ")}`);
+	return {
+		exitCode: 2,
+		stderr: `structural gate failed (block ${priorBlocks + 1}/${maxBlocks}): ${parts.join("; ")}. Fix the failing checks and revert any gate-weakening (no new .skip / as any / lint-disable) before finishing.`
+	};
+}
+/**
+* The advisory-review side-effect on a GREEN stop: debounce by diff hash, then
+* fire the detached background reviewer. ADVISORY-ONLY — it returns void, never
+* throws (every step is swallowed), and the caller does not await its result for
+* the exit decision. A no-op when the review layer isn't wired (no debounce /
+* spawn injected, e.g. GH_ROUTER_DISABLE_STOP_REVIEW) or the diff is empty.
+*
+* `markReviewed` runs BEFORE the spawn so a crashing spawn still records the
+* debounce (an identical tree won't re-trigger on the next stop). The review is
+* gated on the diff CHANGING since the last review — without it, every stop of
+* an unchanged tree would re-spend a background gpt-5.6-sol review.
+*
+* The whole body is bounded by a short timeout (the stores are local temp files
+* that complete in well under a millisecond in practice, so the timeout never
+* fires normally — but if the debounce read/write ever stalled, the stop must
+* still proceed promptly; the advisory layer never delays a clean stop).
+*/
+const REVIEW_SIDE_EFFECT_BUDGET_MS = 2e3;
+async function maybeSpawnReview(input, sessionId, cwd, diff) {
+	if (!input.reviewDebounce || !input.spawnReview) return;
+	if (diff.trim().length === 0) return;
+	let timer;
+	try {
+		const work = (async () => {
+			const diffHash = createHash("sha256").update(diff).digest("hex");
+			if (!await input.reviewDebounce.shouldReview(sessionId, diffHash)) return;
+			await input.reviewDebounce.markReviewed(sessionId, diffHash);
+			input.spawnReview({
+				sessionId,
+				cwd,
+				diff,
+				diffHash
+			});
+		})();
+		await Promise.race([work, new Promise((resolve) => {
+			timer = setTimeout(resolve, REVIEW_SIDE_EFFECT_BUDGET_MS);
+		})]);
+	} catch {} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+/**
+* A file-backed `BlockBudget` under `stateDir`, keyed by a hash of the session id
+* (so a session id is never written verbatim to a predictable path). Best-effort:
+* a read miss counts as 0; `record` increments. A write/read error propagates so
+* `decideStopHook` stands down (it can't guarantee termination without the
+* budget).
+*/
+function fileBlockBudget(stateDir) {
+	const fileFor = (sid) => path.join(stateDir, `block-${createHash("sha256").update(sid).digest("hex").slice(0, 32)}`);
+	const readCount = async (sid) => {
+		try {
+			const raw = await promises.readFile(fileFor(sid), "utf8");
+			const n = Number.parseInt(raw.trim(), 10);
+			return Number.isFinite(n) && n > 0 ? n : 0;
+		} catch {
+			return 0;
+		}
+	};
+	return {
+		count: readCount,
+		async record(sid) {
+			const next = await readCount(sid) + 1;
+			await promises.mkdir(stateDir, { recursive: true });
+			await promises.writeFile(fileFor(sid), String(next), { mode: 384 });
+		},
+		async reset(sid) {
+			await promises.unlink(fileFor(sid)).catch(() => {});
+		}
+	};
+}
+/**
+* Build the shell command string Claude Code runs for the Stop hook. Invokes the
+* running github-router via its node/bun binary so it works regardless of PATH.
+* Pure (takes the binary + script paths) so the quoting is unit-testable; the
+* cross-platform firing is verified by the gated E2E.
+*/
+function buildStopHookCommand(execPath, scriptPath) {
+	const q = (s) => `"${s}"`;
+	if (scriptPath && scriptPath !== execPath) return `${q(execPath)} ${q(scriptPath)} internal-stop-hook`;
+	return `${q(execPath)} internal-stop-hook`;
+}
+/**
+* Build the shell command Claude Code runs for the SessionStart/SessionEnd hooks
+* (registered only when github-router runs inside an ai-or-die Terminal tab). The
+* sidecar path is baked in as a literal `--out` arg — NOT passed via env — so it
+* survives `AIORDIE_CLAUDE_BIND` being stripped from the child's environment and a
+* nested `github-router claude` can't inherit it. Pure (binary + script + out
+* paths) for unit-testable quoting; the live firing is verified end-to-end.
+*/
+function buildSessionBindHookCommand(execPath, scriptPath, outPath) {
+	const q = (s) => `"${s}"`;
+	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-session-bind --out ${q(outPath)}`;
+}
+/** Command for the `internal-artifact-open` hook (no args — token comes from the
+*  mirror creds file, plan from the plans dir; nothing secret in argv). */
+function buildArtifactOpenHookCommand(execPath, scriptPath) {
+	const q = (s) => `"${s}"`;
+	return `${scriptPath && scriptPath !== execPath ? `${q(execPath)} ${q(scriptPath)}` : q(execPath)} internal-artifact-open`;
+}
+/**
+* Read-merge-atomic-write the Stop hook into a Claude Code `settings.json` file
+* (the mirrored one). A MISSING file (ENOENT) starts from `{}`; any OTHER read or
+* parse error THROWS (the caller's try/catch warns and continues) rather than
+* overwriting a file we couldn't understand with our defaults. Preserves every
+* other setting, is idempotent, and uses temp+rename so Claude Code's mtime
+* watcher never sees a half-written file. Returns the merged object.
+*/
+async function injectStopHookIntoSettingsFile(settingsPath, command, event = "Stop", timeoutSec, matcher) {
+	let existing = {};
+	let raw;
+	try {
+		raw = await promises.readFile(settingsPath, "utf8");
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+		raw = void 0;
+	}
+	if (raw !== void 0) {
+		const parsed = JSON.parse(raw);
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+		else throw new Error(`settings.json at ${settingsPath} is not a JSON object; refusing to overwrite`);
+	}
+	const merged = mergeStopHookIntoSettings(existing, command, event, timeoutSec, matcher);
+	const tmp = `${settingsPath}.${process.pid}.tmp`;
+	await promises.writeFile(tmp, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+	await promises.rename(tmp, settingsPath);
+	return merged;
+}
+//#endregion
+export { decideStopHook as a, launchBaselineKey as c, stopGatePlanMode as d, stopReviewEnabled as f, runGateChecks as h, captureLaunchBaseline as i, stopGateDisabled as l, sealedGateIds as m, buildSessionBindHookCommand as n, fileBlockBudget as o, resolveSealedGate as p, buildStopHookCommand as r, injectStopHookIntoSettingsFile as s, buildArtifactOpenHookCommand as t, stopGateId as u };
+
+//# sourceMappingURL=stop-gate-hook-DQc2KV7B.js.map