halfcycle 0.3.30 → 0.3.32

package/bin/bin.bundle.mjs

@@ -14652,6 +14652,75 @@ function parseAccountStoreText(raw) {
 // ../core/dist/ci-audience.js
 var HALFCYCLE_OIDC_AUDIENCE = "https://halfcycle.ai";
 
+// ../core/dist/hook-wiring.js
+var SETTINGS_REL = ".claude/settings.json";
+var LOCAL_SETTINGS_REL = ".claude/settings.local.json";
+var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
+var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
+var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
+var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
+var HALFCYCLE_HOOK_WIRING = [
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_START_MARKER_REL}`,
+    script: SESSION_START_MARKER_REL
+  },
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 10,
+    command: `bash ./${GUARD_RUNNER_REL} refresh-credential`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${USER_PROMPT_REMINDER_REL}`,
+    script: USER_PROMPT_REMINDER_REL
+  },
+  {
+    event: "PostToolUse",
+    matcher: WRITE_CAPABLE_TOOLS.join("|"),
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook post-tool-use`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "Stop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SubagentStop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook subagent-stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SessionEnd",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_END_MARKER_REL}`,
+    script: SESSION_END_MARKER_REL
+  }
+];
+var RETIRED_HOOK_COMMANDS = [];
+var HALFCYCLE_HOOK_COMMANDS = /* @__PURE__ */ new Set([
+  ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.command),
+  ...RETIRED_HOOK_COMMANDS
+]);
+var HALFCYCLE_HOOK_WIRING_PATHS = [
+  .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
+];
+
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
 function resolveControlOrigin(env) {
@@ -14809,6 +14878,25 @@ var CLIENT_CAPABILITY_VOCABULARY = Object.keys(diffMetadataSchema.shape).filter(
 function isClientCapability(value) {
   return CLIENT_CAPABILITY_VOCABULARY.includes(value);
 }
+var seatHookSchema = external_exports.object({
+  event: external_exports.string(),
+  matcher: external_exports.string().nullable(),
+  command: external_exports.string(),
+  timeout: external_exports.number().nullable()
+}).strict();
+var seatSettingsFileSchema = external_exports.object({
+  path: external_exports.string(),
+  state: external_exports.enum(["read", "absent", "unreadable"]),
+  hooks: external_exports.array(seatHookSchema)
+}).strict();
+var seatPathSchema = external_exports.object({
+  path: external_exports.string(),
+  state: external_exports.enum(["clean", "modified", "added", "deleted", "untracked", "ignored", "absent", "unknown"])
+}).strict();
+var seatConfigurationSchema = external_exports.object({
+  settingsFiles: external_exports.array(seatSettingsFileSchema),
+  paths: external_exports.array(seatPathSchema)
+}).strict();
 var evaluationRequestSchema = external_exports.object({
   engagementId: external_exports.string(),
   changeSet: changeSetSchema,
@@ -14829,7 +14917,17 @@ var evaluationRequestSchema = external_exports.object({
    *
    * Omitting the field means "unknown": every check runs as it always has.
    */
-  repoHasDeployFiles: external_exports.boolean().optional()
+  repoHasDeployFiles: external_exports.boolean().optional(),
+  /**
+   * The hooks this tool installed that this project's own settings files
+   * register, each with the event, matcher and timeout it is registered
+   * under, and whether each file those hooks rely on is committed and
+   * unchanged. Sent as found: the service decides what it means, and
+   * nothing about it is sent back.
+   *
+   * Omitting the field means "not observed", never "set up".
+   */
+  seatConfiguration: seatConfigurationSchema.optional()
 }).strict();
 
 // ../events/dist/result.js
@@ -15147,21 +15245,49 @@ function emitBlock(reason) {
   process.stdout.write(JSON.stringify({ decision: "block", reason }) + "\n");
   process.exit(0);
 }
-function emitWarning(text) {
-  process.stdout.write(text + "\n");
+function nonBlockingReply(event, text) {
+  if (event === "PostToolUse") {
+    return JSON.stringify({
+      systemMessage: text,
+      hookSpecificOutput: { hookEventName: event, additionalContext: text }
+    });
+  }
+  return JSON.stringify({ systemMessage: text });
 }
-function emitInfraWarning(message) {
-  process.stdout.write(`[Halfcycle] WARNING: Guard service unavailable \u2014 ${message}. Session continues (fail-open).
+function hookReply(event) {
+  const queued = [];
+  return {
+    notice(text) {
+      queued.push(text);
+    },
+    block(reason) {
+      const carried = queued.splice(0);
+      return emitBlock(carried.length === 0 ? reason : [reason, ...carried].join("\n"));
+    },
+    flush() {
+      if (queued.length === 0)
+        return;
+      const text = queued.splice(0).join("\n");
+      const code = process.exitCode;
+      if (code !== void 0 && code !== null && Number(code) !== 0) {
+        writeSync(2, `${text}
 `);
-}
-function emitLocalFault(message) {
-  process.stdout.write(`[Halfcycle] WARNING: Local fault \u2014 ${message}. The guard service was not contacted. Session continues (fail-open).
+        return;
+      }
+      process.stdout.write(`${nonBlockingReply(event, text)}
 `);
+    }
+  };
 }
-function emitContractFault(message) {
-  process.stdout.write(`[Halfcycle] WARNING: Guard response could not be understood \u2014 ${message}
-This is not a service outage: the guard service answered. The suspect is this repository's own installed halfcycle runner, which is out of date with what the service now sends. Update it: run "npx halfcycle" in this repository, then retry. Session continues (fail-open).
-`);
+function infraWarningText(message) {
+  return `[Halfcycle] WARNING: Guard service unavailable \u2014 ${message}. Session continues (fail-open).`;
+}
+function localFaultText(message) {
+  return `[Halfcycle] WARNING: Local fault \u2014 ${message}. The guard service was not contacted. Session continues (fail-open).`;
+}
+function contractFaultText(message) {
+  return `[Halfcycle] WARNING: Guard response could not be understood \u2014 ${message}
+This is not a service outage: the guard service answered. The suspect is this repository's own installed halfcycle runner, which is out of date with what the service now sends. Update it: run "npx halfcycle" in this repository, then retry. Session continues (fail-open).`;
 }
 var UNCONFIGURED_EXIT_TOOL_USE = 2;
 var UNCONFIGURED_EXIT_STOP_FAMILY = 1;
@@ -15480,8 +15606,12 @@ async function attempt(url2, token, request, fetchFn, retry) {
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
-function git(args2, cwd) {
-  const result = spawnSync("git", args2, { cwd, encoding: "utf-8" });
+function git(args2, cwd, timeoutMs) {
+  const result = spawnSync("git", args2, {
+    cwd,
+    encoding: "utf-8",
+    ...timeoutMs === void 0 ? {} : { timeout: timeoutMs }
+  });
   if (result.error) {
     return { ok: false, message: `git error: ${result.error.message}` };
   }
@@ -15625,6 +15755,20 @@ function refExists(ref, repoRoot) {
   const result = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], repoRoot);
   return result.ok && result.value.trim().length > 0;
 }
+var WIRING_STATUS_TIMEOUT_MS = 2e3;
+function getWiringStatus(pathspecs, cwd) {
+  return git([
+    "--no-optional-locks",
+    "status",
+    "--porcelain=v1",
+    "-z",
+    "--no-renames",
+    "--ignored=traditional",
+    "--untracked-files=all",
+    "--",
+    ...pathspecs
+  ], cwd, WIRING_STATUS_TIMEOUT_MS);
+}
 
 // dist/screen/secret-shape.js
 var SECRET_SHAPE_PATTERNS = [
@@ -16586,13 +16730,14 @@ function deriveClientCapabilities(changeSet) {
   }
   return [...seen];
 }
-function buildEvaluationRequest(engagementId, changeSet, context) {
+function buildEvaluationRequest(engagementId, changeSet, context, seatConfiguration) {
   const hasDeployFiles = repoHasDeployFiles(context);
   return {
     engagementId,
     changeSet,
     clientCapabilities: deriveClientCapabilities(changeSet),
-    ...hasDeployFiles === void 0 ? {} : { repoHasDeployFiles: hasDeployFiles }
+    ...hasDeployFiles === void 0 ? {} : { repoHasDeployFiles: hasDeployFiles },
+    ...seatConfiguration === void 0 ? {} : { seatConfiguration }
   };
 }
 function produceExcerpts(diffContent, descriptors, caps) {
@@ -17209,9 +17354,165 @@ async function evaluateWithRefresh(opts) {
   return { result: retry, token: refreshed.token, remedy: HOOK_REMEDY };
 }
 
+// dist/seat-configuration.js
+import { existsSync as existsSync2, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join6, relative as relative3, resolve } from "node:path";
+function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
+  try {
+    const facts = read(repoRoot);
+    if (facts === void 0)
+      return void 0;
+    const parsed = seatConfigurationSchema.safeParse(facts);
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readSeatConfiguration(repoRoot) {
+  const given = resolve(process.env["CLAUDE_PROJECT_DIR"] || process.cwd());
+  const projectDir = realpathSync2.native(given);
+  const home = homedir3();
+  let realHome = home;
+  try {
+    realHome = realpathSync2.native(home);
+  } catch {
+    realHome = home;
+  }
+  if (projectDir === home || given === home || projectDir === realHome)
+    return void 0;
+  return {
+    settingsFiles: [readSettingsFile(projectDir, SETTINGS_REL), readSettingsFile(projectDir, LOCAL_SETTINGS_REL)],
+    paths: readPathStates(projectDir, repoRoot)
+  };
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readSettingsFile(projectDir, rel) {
+  let raw;
+  try {
+    raw = readFileSync6(join6(projectDir, rel), "utf-8");
+  } catch (err) {
+    const code = err.code;
+    const state = code === "ENOENT" || code === "ENOTDIR" ? "absent" : "unreadable";
+    return { path: rel, state, hooks: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { path: rel, state: "unreadable", hooks: [] };
+  }
+  if (!isPlainObject2(parsed))
+    return { path: rel, state: "unreadable", hooks: [] };
+  return { path: rel, state: "read", hooks: ourHooks(parsed["hooks"]) };
+}
+function ourHooks(hooks) {
+  if (!isPlainObject2(hooks))
+    return [];
+  const rows = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries))
+      continue;
+    for (const entry of entries) {
+      if (!isPlainObject2(entry))
+        continue;
+      let matcher = null;
+      if (Object.hasOwn(entry, "matcher")) {
+        if (typeof entry["matcher"] !== "string")
+          continue;
+        matcher = entry["matcher"];
+      }
+      const commands = entry["hooks"];
+      if (!Array.isArray(commands))
+        continue;
+      for (const hook of commands) {
+        if (!isPlainObject2(hook))
+          continue;
+        const command = hook["command"];
+        if (typeof command !== "string" || !HALFCYCLE_HOOK_COMMANDS.has(command))
+          continue;
+        let timeout = null;
+        if (Object.hasOwn(hook, "timeout")) {
+          const value = hook["timeout"];
+          if (typeof value !== "number" || !Number.isFinite(value))
+            continue;
+          timeout = value;
+        }
+        const key = JSON.stringify([event, matcher, command, timeout]);
+        if (seen.has(key))
+          continue;
+        seen.add(key);
+        rows.push({ event, matcher, command, timeout });
+      }
+    }
+  }
+  return rows;
+}
+function readPathStates(projectDir, repoRoot) {
+  const unknown2 = () => HALFCYCLE_HOOK_WIRING_PATHS.map((path) => ({ path, state: "unknown" }));
+  let projectTop = projectDir;
+  if (repoRoot !== projectDir) {
+    const top = getRepoRoot(projectDir);
+    if (!top.ok)
+      return unknown2();
+    projectTop = top.value;
+  }
+  const prefix = relative3(projectTop, projectDir);
+  const status = getWiringStatus(HALFCYCLE_HOOK_WIRING_PATHS, projectDir);
+  if (!status.ok)
+    return unknown2();
+  const mapped = mapWiringStatus(status.value, prefix, HALFCYCLE_HOOK_WIRING_PATHS, (rel) => existsSync2(join6(projectDir, rel)));
+  return mapped ?? unknown2();
+}
+function mapWiringStatus(output, prefix, paths, onDisk) {
+  const byGitPath = /* @__PURE__ */ new Map();
+  for (const rel of paths)
+    byGitPath.set(prefix === "" ? rel : `${prefix}/${rel}`, rel);
+  const codes = /* @__PURE__ */ new Map();
+  if (output !== "") {
+    if (!output.endsWith("\0"))
+      return null;
+    for (const record2 of output.slice(0, -1).split("\0")) {
+      if (record2.length < 4 || record2[2] !== " ")
+        return null;
+      const rel = byGitPath.get(record2.slice(3));
+      if (rel === void 0)
+        return null;
+      const xy = record2.slice(0, 2);
+      const existing = codes.get(rel);
+      if (existing)
+        existing.push(xy);
+      else
+        codes.set(rel, [xy]);
+    }
+  }
+  return paths.map((path) => {
+    const xys = codes.get(path);
+    if (!xys)
+      return { path, state: onDisk(path) ? "clean" : "absent" };
+    if (xys.some((xy) => xy.includes("D")))
+      return { path, state: "deleted" };
+    if (xys.includes("??"))
+      return { path, state: "untracked" };
+    if (xys.includes("!!"))
+      return { path, state: "ignored" };
+    if (xys.some((xy) => xy[0] === "A"))
+      return { path, state: "added" };
+    return { path, state: "modified" };
+  });
+}
+
 // dist/hooks/post-tool-use.js
 var HANDLED_EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-async function runPostToolUse() {
+async function runPostToolUse(readSeat = readSeatConfiguration) {
+  const reply = hookReply("PostToolUse");
+  await evaluateEdit(reply, readSeat);
+  reply.flush();
+}
+async function evaluateEdit(reply, readSeat) {
   let input;
   try {
     const raw = await readStdin();
@@ -17228,7 +17529,7 @@ async function runPostToolUse() {
     return;
   const repoRootResult = getRepoRoot(process.cwd());
   if (!repoRootResult.ok) {
-    emitLocalFault(`Could not find git repo root: ${repoRootResult.message}`);
+    reply.notice(localFaultText(`Could not find git repo root: ${repoRootResult.message}`));
     return;
   }
   const repoRoot = repoRootResult.value;
@@ -17249,11 +17550,12 @@ async function runPostToolUse() {
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
+  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat);
   const evaluation = await evaluateWithRefresh({
     guardServiceUrl,
     token: guardServiceToken,
     engagementId: guardEngagementId,
-    request: buildEvaluationRequest(guardEngagementId, changeSet, context)
+    request: buildEvaluationRequest(guardEngagementId, changeSet, context, seatConfiguration)
   });
   const clientResult = evaluation.result;
   if (!clientResult.ok) {
@@ -17280,10 +17582,10 @@ async function runPostToolUse() {
       return;
     }
     if (failure.kind === "contract") {
-      emitContractFault(failure.message);
+      reply.notice(contractFaultText(failure.message));
       return;
     }
-    emitInfraWarning(failure.reason);
+    reply.notice(infraWarningText(failure.reason));
     return;
   }
   const telemetryConfig = readTelemetryConfig();
@@ -17311,42 +17613,42 @@ async function runPostToolUse() {
   }, {
     warn: (msg) => process.stderr.write(msg + "\n")
   });
-  actOnEnvelope2(clientResult.envelope);
+  actOnEnvelope2(clientResult.envelope, reply);
 }
-function actOnEnvelope2(envelope) {
+function actOnEnvelope2(envelope, reply) {
   const notRun = notRunReport(envelope.notRun);
   const notRunBlock = notRun ? `
 ${notRun}` : "";
   if (envelope.guardsFired.length === 0) {
     if (notRun)
-      emitWarning(notRun);
+      reply.notice(notRun);
     return;
   }
   if (envelope.blocking) {
     const guardLines = envelope.guardsFired.map((g) => `  [${g.severity.toUpperCase()}] ${g.patternRef}: ${g.explanation}`).join("\n");
     const reason = `Guard blocked: ${envelope.explanation}
 ${guardLines}${notRunBlock}`;
-    emitBlock(reason);
+    reply.block(reason);
   } else {
     const guardLines = envelope.guardsFired.map((g) => `  [${g.severity.toUpperCase()}] ${g.patternRef}: ${g.explanation}`).join("\n");
-    emitWarning(`[Halfcycle] Guard warning: ${envelope.explanation}
+    reply.notice(`[Halfcycle] Guard warning: ${envelope.explanation}
 ${guardLines}${notRunBlock}`);
   }
 }
 function readStdin() {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
 
 // dist/hooks/marker.js
 import { createHash } from "node:crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var MARKER_TTL_MS = 24 * 60 * 60 * 1e3;
 var MARKER_PREFIX = "halfcycle-session-";
 var MARKER_SUFFIX = ".ref";
@@ -17364,19 +17666,19 @@ function markerFileName(repoRoot, sessionId) {
   return `${MARKER_PREFIX}${key}${MARKER_SUFFIX}`;
 }
 function markerPath(repoRoot, sessionId) {
-  return join6(markerDir(), markerFileName(repoRoot, sessionId));
+  return join7(markerDir(), markerFileName(repoRoot, sessionId));
 }
 function dedupePath(repoRoot, sessionId) {
   const hash2 = repoHash(repoRoot);
   const key = sessionId && sessionId.length > 0 ? `${hash2}-${sessionId}` : hash2;
-  return join6(markerDir(), `${MARKER_PREFIX}${key}${DEDUPE_SUFFIX}`);
+  return join7(markerDir(), `${MARKER_PREFIX}${key}${DEDUPE_SUFFIX}`);
 }
 function readMarker(repoRoot, sessionId) {
   const path = markerPath(repoRoot, sessionId);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return null;
   try {
-    return readFileSync6(path, "utf-8").trim() || null;
+    return readFileSync7(path, "utf-8").trim() || null;
   } catch {
     return null;
   }
@@ -17384,7 +17686,7 @@ function readMarker(repoRoot, sessionId) {
 function deleteMarker(repoRoot, sessionId) {
   for (const path of [markerPath(repoRoot, sessionId), dedupePath(repoRoot, sessionId)]) {
     try {
-      if (existsSync2(path))
+      if (existsSync3(path))
         unlinkSync3(path);
     } catch {
     }
@@ -17392,10 +17694,10 @@ function deleteMarker(repoRoot, sessionId) {
 }
 function readDedupe(repoRoot, sessionId) {
   const path = dedupePath(repoRoot, sessionId);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
     if (typeof parsed === "object" && parsed !== null && typeof parsed.base === "string" && typeof parsed.digest === "string") {
       return parsed;
     }
@@ -17437,10 +17739,10 @@ function orphanSweep(repoRoot, refKnown, keepSessionId, now = Date.now()) {
       continue;
     if (name === keepName)
       continue;
-    const full = join6(dir, name);
+    const full = join7(dir, name);
     let unusable = false;
     try {
-      const ref = readFileSync6(full, "utf-8").trim();
+      const ref = readFileSync7(full, "utf-8").trim();
       if (!ref || !refKnown(ref))
         unusable = true;
     } catch {
@@ -17464,6 +17766,10 @@ function orphanSweep(repoRoot, refKnown, keepSessionId, now = Date.now()) {
 }
 
 // dist/hooks/session-diff.js
+var STOP_HOOK_EVENT = {
+  stop: "Stop",
+  "subagent-stop": "SubagentStop"
+};
 function resolveDiffBase2(repoRoot, sessionId) {
   const ref = readMarker(repoRoot, sessionId);
   if (ref === null)
@@ -17494,10 +17800,15 @@ function collectDiff(repoRoot, base) {
     getDiff: (relPath) => getWorkingTreeFileDiff(relPath, repoRoot)
   };
 }
-async function runSessionDiff(input, kind) {
+async function runSessionDiff(input, kind, readSeat = readSeatConfiguration) {
+  const reply = hookReply(STOP_HOOK_EVENT[kind]);
+  await evaluateSession(input, kind, reply, readSeat);
+  reply.flush();
+}
+async function evaluateSession(input, kind, reply, readSeat) {
   const repoRootResult = getRepoRoot(process.cwd());
   if (!repoRootResult.ok) {
-    emitLocalFault(`Could not find git repo root: ${repoRootResult.message}`);
+    reply.notice(localFaultText(`Could not find git repo root: ${repoRootResult.message}`));
     return;
   }
   const repoRoot = repoRootResult.value;
@@ -17507,7 +17818,7 @@ async function runSessionDiff(input, kind) {
   const diffBase = base.kind;
   const collected = collectDiff(repoRoot, base);
   if (!collected.ok) {
-    emitLocalFault(`Could not get session diff: ${collected.message}`);
+    reply.notice(localFaultText(`Could not get session diff: ${collected.message}`));
     return;
   }
   const { getDiff } = collected;
@@ -17534,11 +17845,12 @@ async function runSessionDiff(input, kind) {
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
+  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat);
   const evaluation = await evaluateWithRefresh({
     guardServiceUrl,
     token: guardServiceToken,
     engagementId: guardEngagementId,
-    request: buildEvaluationRequest(guardEngagementId, changeSet, context)
+    request: buildEvaluationRequest(guardEngagementId, changeSet, context, seatConfiguration)
   });
   const clientResult = evaluation.result;
   if (!clientResult.ok) {
@@ -17566,10 +17878,10 @@ async function runSessionDiff(input, kind) {
       return;
     }
     if (failure.kind === "contract") {
-      emitContractFault(failure.message);
+      reply.notice(contractFaultText(failure.message));
       return;
     }
-    emitInfraWarning(failure.reason);
+    reply.notice(infraWarningText(failure.reason));
     return;
   }
   const telemetryConfig = readTelemetryConfig();
@@ -17595,28 +17907,28 @@ async function runSessionDiff(input, kind) {
     warn: (msg) => process.stderr.write(msg + "\n")
   });
   writeDedupe(repoRoot, sessionId, { base: baseKey, digest });
-  actOnEnvelope3(clientResult.envelope, kind, input.stop_hook_active === true);
+  actOnEnvelope3(clientResult.envelope, kind, input.stop_hook_active === true, reply);
 }
-function actOnEnvelope3(envelope, kind, neverBlock) {
+function actOnEnvelope3(envelope, kind, neverBlock, reply) {
   const notRun = notRunReport(envelope.notRun);
   const notRunBlock = notRun ? `
 ${notRun}` : "";
   if (envelope.guardsFired.length === 0) {
     if (notRun)
-      emitWarning(notRun);
+      reply.notice(notRun);
     return;
   }
   const where = kind === "stop" ? "session stop" : "session stop";
   const guardLines = envelope.guardsFired.map((g) => `  [${g.severity.toUpperCase()}] ${g.patternRef}: ${g.explanation}`).join("\n");
   if (envelope.blocking && !neverBlock) {
-    emitBlock(`Guard blocked at ${where}: ${envelope.explanation}
+    reply.block(`Guard blocked at ${where}: ${envelope.explanation}
 ${guardLines}${notRunBlock}`);
   } else if (envelope.blocking && neverBlock) {
-    emitWarning(`[Halfcycle] Guard would block at ${where} but the stop was already continued (stop_hook_active) \u2014 surfacing as a warning:
+    reply.notice(`[Halfcycle] Guard would block at ${where} but the stop was already continued (stop_hook_active) \u2014 surfacing as a warning:
 ${envelope.explanation}
 ${guardLines}${notRunBlock}`);
   } else {
-    emitWarning(`[Halfcycle] Guard warning at ${where}: ${envelope.explanation}
+    reply.notice(`[Halfcycle] Guard warning at ${where}: ${envelope.explanation}
 ${guardLines}${notRunBlock}`);
   }
 }
@@ -17636,9 +17948,9 @@ async function readHookStdin() {
   }
 }
 function readStdin2() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     if (process.stdin.isTTY) {
-      resolve("");
+      resolve2("");
       return;
     }
     const chunks = [];
@@ -17648,7 +17960,7 @@ function readStdin2() {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve(Buffer.concat(chunks).toString("utf-8"));
+      resolve2(Buffer.concat(chunks).toString("utf-8"));
     };
     const timer = setTimeout(done, 2e3);
     process.stdin.on("data", (chunk) => chunks.push(chunk));
@@ -17670,17 +17982,17 @@ async function runStop() {
 }
 
 // dist/resolve-engagement.js
-import { existsSync as existsSync3, readFileSync as readFileSync7, realpathSync as realpathSync2 } from "node:fs";
-import { join as join7, sep as sep2 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { existsSync as existsSync4, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
+import { join as join8, sep as sep2 } from "node:path";
+import { homedir as homedir4 } from "node:os";
 function defaultRegistryPath() {
-  return join7(homedir3(), ".halfcycle", "registry.json");
+  return join8(homedir4(), ".halfcycle", "registry.json");
 }
 function readRegistry(registryPath = defaultRegistryPath()) {
-  if (!existsSync3(registryPath))
+  if (!existsSync4(registryPath))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync7(registryPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(registryPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const out = {};
@@ -17695,7 +18007,7 @@ function readRegistry(registryPath = defaultRegistryPath()) {
 }
 function canonicalise(p) {
   try {
-    return realpathSync2(p);
+    return realpathSync3(p);
   } catch {
     return p;
   }
@@ -17760,7 +18072,7 @@ async function runRefreshCredential(opts) {
 }
 
 // dist/capture.js
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync4 } from "node:fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync5 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -17828,7 +18140,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync8(fromFile, "utf-8");
+    return readFileSync9(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -17923,10 +18235,10 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
   process.exit(1);
 }
 function readStdin3() {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }