halfcycle 0.3.31 → 0.3.33

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "halfcycle",
-  "version": "0.3.31",
+  "version": "0.3.33",
   "description": "Halfcycle Method bundle — resolution-stub slash commands, remote method-delivery registration, and governance-hook wiring for a Halfcycle engagement repo. It ships NO worker role files: a project's roles are authored from that project's own recorded decisions at orchestration kickoff (FX-2, W3-F-27).",
   "commands": [
     {

package/bin/bin.bundle.mjs

@@ -14652,6 +14652,100 @@ function parseAccountStoreText(raw) {
 // ../core/dist/ci-audience.js
 var HALFCYCLE_OIDC_AUDIENCE = "https://halfcycle.ai";
 
+// ../core/dist/hook-wiring.js
+var SETTINGS_REL = ".claude/settings.json";
+var LOCAL_SETTINGS_REL = ".claude/settings.local.json";
+var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
+var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
+var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
+var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
+var HALFCYCLE_HOOK_WIRING = [
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_START_MARKER_REL}`,
+    script: SESSION_START_MARKER_REL
+  },
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 10,
+    command: `bash ./${GUARD_RUNNER_REL} refresh-credential`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${USER_PROMPT_REMINDER_REL}`,
+    script: USER_PROMPT_REMINDER_REL
+  },
+  {
+    event: "PostToolUse",
+    matcher: WRITE_CAPABLE_TOOLS.join("|"),
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook post-tool-use`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "Stop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SubagentStop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook subagent-stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SessionEnd",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_END_MARKER_REL}`,
+    script: SESSION_END_MARKER_REL
+  }
+];
+var RETIRED_HOOK_COMMANDS = [];
+var HALFCYCLE_HOOK_COMMANDS = /* @__PURE__ */ new Set([
+  ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.command),
+  ...RETIRED_HOOK_COMMANDS
+]);
+var HALFCYCLE_HOOK_WIRING_PATHS = [
+  .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
+];
+
+// ../core/dist/secret-shape.js
+var SECRET_SHAPE_PATTERNS = [
+  // Assignment to a credential-named identifier: `apiKey = "..."`, `secret: '...'`,
+  // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
+  /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
+  // Connection strings that embed credentials: `scheme://user:pass@host`.
+  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/i,
+  // Bearer / authorization header values.
+  /\bauthorization\b\s*[:=]\s*['"]?\s*bearer\s+\S+/i,
+  // PEM / private-key block headers.
+  /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+)?PRIVATE\s+KEY-----/,
+  // JWT shape: three base64url segments separated by dots.
+  /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/,
+  // A long high-entropy hex/base64 run adjacent to a credential-ish word on the
+  // same line — a raw key literal. Kept last (broadest, most likely false-drop).
+  /\b(?:key|token|secret|credential)\b[\s\S]{0,40}[A-Za-z0-9+/_-]{32,}/i
+];
+function looksLikeSecret(text) {
+  for (const pattern of SECRET_SHAPE_PATTERNS) {
+    if (pattern.test(text))
+      return true;
+  }
+  return false;
+}
+
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
 function resolveControlOrigin(env) {
@@ -14809,6 +14903,25 @@ var CLIENT_CAPABILITY_VOCABULARY = Object.keys(diffMetadataSchema.shape).filter(
 function isClientCapability(value) {
   return CLIENT_CAPABILITY_VOCABULARY.includes(value);
 }
+var seatHookSchema = external_exports.object({
+  event: external_exports.string(),
+  matcher: external_exports.string().nullable(),
+  command: external_exports.string(),
+  timeout: external_exports.number().nullable()
+}).strict();
+var seatSettingsFileSchema = external_exports.object({
+  path: external_exports.string(),
+  state: external_exports.enum(["read", "absent", "unreadable"]),
+  hooks: external_exports.array(seatHookSchema)
+}).strict();
+var seatPathSchema = external_exports.object({
+  path: external_exports.string(),
+  state: external_exports.enum(["clean", "modified", "added", "deleted", "untracked", "ignored", "absent", "unknown"])
+}).strict();
+var seatConfigurationSchema = external_exports.object({
+  settingsFiles: external_exports.array(seatSettingsFileSchema),
+  paths: external_exports.array(seatPathSchema)
+}).strict();
 var evaluationRequestSchema = external_exports.object({
   engagementId: external_exports.string(),
   changeSet: changeSetSchema,
@@ -14829,7 +14942,17 @@ var evaluationRequestSchema = external_exports.object({
    *
    * Omitting the field means "unknown": every check runs as it always has.
    */
-  repoHasDeployFiles: external_exports.boolean().optional()
+  repoHasDeployFiles: external_exports.boolean().optional(),
+  /**
+   * The hooks this tool installed that this project's own settings files
+   * register, each with the event, matcher and timeout it is registered
+   * under, and whether each file those hooks rely on is committed and
+   * unchanged. Sent as found: the service decides what it means, and
+   * nothing about it is sent back.
+   *
+   * Omitting the field means "not observed", never "set up".
+   */
+  seatConfiguration: seatConfigurationSchema.optional()
 }).strict();
 
 // ../events/dist/result.js
@@ -15071,8 +15194,16 @@ var stateRecordSchema = external_exports.discriminatedUnion("recordKind", [
   interventionRecordSchema
 ]);
 
+// ../events/dist/control-characters.js
+var CONTROL_CHARACTER_CLASS = "\\p{Cc}";
+var CONTROL_CHARACTER = new RegExp(CONTROL_CHARACTER_CLASS, "u");
+function hasControlCharacter(text) {
+  return CONTROL_CHARACTER.test(text);
+}
+
 // ../events/dist/phase-identity.js
 var PHASE_SEGMENT_PREFIX = "phase-";
+var PHASE_NAME_MAX_BYTES = 200;
 function isValidPhaseIdentity(identity) {
   if (typeof identity === "number")
     return Number.isInteger(identity) && identity >= 0;
@@ -15084,12 +15215,22 @@ function isValidPhaseIdentity(identity) {
     return false;
   if (identity.includes("\\"))
     return false;
-  if (identity.includes("\0"))
-    return false;
   if (identity.startsWith("."))
     return false;
+  if (hasControlCharacter(identity))
+    return false;
+  if (utf8ByteLength(identity) > PHASE_NAME_MAX_BYTES)
+    return false;
   return true;
 }
+function utf8ByteLength(text) {
+  let bytes = 0;
+  for (const ch of text) {
+    const cp = ch.codePointAt(0);
+    bytes += cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+  }
+  return bytes;
+}
 var InvalidPhaseIdentityError = class extends Error {
   /** The value that was refused, exactly as supplied. */
   identity;
@@ -15508,8 +15649,12 @@ async function attempt(url2, token, request, fetchFn, retry) {
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
-function git(args2, cwd) {
-  const result = spawnSync("git", args2, { cwd, encoding: "utf-8" });
+function git(args2, cwd, timeoutMs) {
+  const result = spawnSync("git", args2, {
+    cwd,
+    encoding: "utf-8",
+    ...timeoutMs === void 0 ? {} : { timeout: timeoutMs }
+  });
   if (result.error) {
     return { ok: false, message: `git error: ${result.error.message}` };
   }
@@ -15653,31 +15798,22 @@ function refExists(ref, repoRoot) {
   const result = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], repoRoot);
   return result.ok && result.value.trim().length > 0;
 }
+var WIRING_STATUS_TIMEOUT_MS = 2e3;
+function getWiringStatus(pathspecs, cwd) {
+  return git([
+    "--no-optional-locks",
+    "status",
+    "--porcelain=v1",
+    "-z",
+    "--no-renames",
+    "--ignored=traditional",
+    "--untracked-files=all",
+    "--",
+    ...pathspecs
+  ], cwd, WIRING_STATUS_TIMEOUT_MS);
+}
 
 // dist/screen/secret-shape.js
-var SECRET_SHAPE_PATTERNS = [
-  // Assignment to a credential-named identifier: `apiKey = "..."`, `secret: '...'`,
-  // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
-  /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
-  // Connection strings that embed credentials: `scheme://user:pass@host`.
-  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:[^\s:/@]+@/i,
-  // Bearer / authorization header values.
-  /\bauthorization\b\s*[:=]\s*['"]?\s*bearer\s+\S+/i,
-  // PEM / private-key block headers.
-  /-----BEGIN\s+(?:RSA\s+|EC\s+|OPENSSH\s+|DSA\s+)?PRIVATE\s+KEY-----/,
-  // JWT shape: three base64url segments separated by dots.
-  /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/,
-  // A long high-entropy hex/base64 run adjacent to a credential-ish word on the
-  // same line — a raw key literal. Kept last (broadest, most likely false-drop).
-  /\b(?:key|token|secret|credential)\b[\s\S]{0,40}[A-Za-z0-9+/_-]{32,}/i
-];
-function looksLikeSecret(text) {
-  for (const pattern of SECRET_SHAPE_PATTERNS) {
-    if (pattern.test(text))
-      return true;
-  }
-  return false;
-}
 function screenExcerpts(excerpts) {
   return excerpts.filter((e) => !looksLikeSecret(e.text));
 }
@@ -16614,13 +16750,14 @@ function deriveClientCapabilities(changeSet) {
   }
   return [...seen];
 }
-function buildEvaluationRequest(engagementId, changeSet, context) {
+function buildEvaluationRequest(engagementId, changeSet, context, seatConfiguration) {
   const hasDeployFiles = repoHasDeployFiles(context);
   return {
     engagementId,
     changeSet,
     clientCapabilities: deriveClientCapabilities(changeSet),
-    ...hasDeployFiles === void 0 ? {} : { repoHasDeployFiles: hasDeployFiles }
+    ...hasDeployFiles === void 0 ? {} : { repoHasDeployFiles: hasDeployFiles },
+    ...seatConfiguration === void 0 ? {} : { seatConfiguration }
   };
 }
 function produceExcerpts(diffContent, descriptors, caps) {
@@ -17237,14 +17374,165 @@ async function evaluateWithRefresh(opts) {
   return { result: retry, token: refreshed.token, remedy: HOOK_REMEDY };
 }
 
+// dist/seat-configuration.js
+import { existsSync as existsSync2, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join6, relative as relative3, resolve } from "node:path";
+function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
+  try {
+    const facts = read(repoRoot);
+    if (facts === void 0)
+      return void 0;
+    const parsed = seatConfigurationSchema.safeParse(facts);
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readSeatConfiguration(repoRoot) {
+  const given = resolve(process.env["CLAUDE_PROJECT_DIR"] || process.cwd());
+  const projectDir = realpathSync2.native(given);
+  const home = homedir3();
+  let realHome = home;
+  try {
+    realHome = realpathSync2.native(home);
+  } catch {
+    realHome = home;
+  }
+  if (projectDir === home || given === home || projectDir === realHome)
+    return void 0;
+  return {
+    settingsFiles: [readSettingsFile(projectDir, SETTINGS_REL), readSettingsFile(projectDir, LOCAL_SETTINGS_REL)],
+    paths: readPathStates(projectDir, repoRoot)
+  };
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readSettingsFile(projectDir, rel) {
+  let raw;
+  try {
+    raw = readFileSync6(join6(projectDir, rel), "utf-8");
+  } catch (err) {
+    const code = err.code;
+    const state = code === "ENOENT" || code === "ENOTDIR" ? "absent" : "unreadable";
+    return { path: rel, state, hooks: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { path: rel, state: "unreadable", hooks: [] };
+  }
+  if (!isPlainObject2(parsed))
+    return { path: rel, state: "unreadable", hooks: [] };
+  return { path: rel, state: "read", hooks: ourHooks(parsed["hooks"]) };
+}
+function ourHooks(hooks) {
+  if (!isPlainObject2(hooks))
+    return [];
+  const rows = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries))
+      continue;
+    for (const entry of entries) {
+      if (!isPlainObject2(entry))
+        continue;
+      let matcher = null;
+      if (Object.hasOwn(entry, "matcher")) {
+        if (typeof entry["matcher"] !== "string")
+          continue;
+        matcher = entry["matcher"];
+      }
+      const commands = entry["hooks"];
+      if (!Array.isArray(commands))
+        continue;
+      for (const hook of commands) {
+        if (!isPlainObject2(hook))
+          continue;
+        const command = hook["command"];
+        if (typeof command !== "string" || !HALFCYCLE_HOOK_COMMANDS.has(command))
+          continue;
+        let timeout = null;
+        if (Object.hasOwn(hook, "timeout")) {
+          const value = hook["timeout"];
+          if (typeof value !== "number" || !Number.isFinite(value))
+            continue;
+          timeout = value;
+        }
+        const key = JSON.stringify([event, matcher, command, timeout]);
+        if (seen.has(key))
+          continue;
+        seen.add(key);
+        rows.push({ event, matcher, command, timeout });
+      }
+    }
+  }
+  return rows;
+}
+function readPathStates(projectDir, repoRoot) {
+  const unknown2 = () => HALFCYCLE_HOOK_WIRING_PATHS.map((path) => ({ path, state: "unknown" }));
+  let projectTop = projectDir;
+  if (repoRoot !== projectDir) {
+    const top = getRepoRoot(projectDir);
+    if (!top.ok)
+      return unknown2();
+    projectTop = top.value;
+  }
+  const prefix = relative3(projectTop, projectDir);
+  const status = getWiringStatus(HALFCYCLE_HOOK_WIRING_PATHS, projectDir);
+  if (!status.ok)
+    return unknown2();
+  const mapped = mapWiringStatus(status.value, prefix, HALFCYCLE_HOOK_WIRING_PATHS, (rel) => existsSync2(join6(projectDir, rel)));
+  return mapped ?? unknown2();
+}
+function mapWiringStatus(output, prefix, paths, onDisk) {
+  const byGitPath = /* @__PURE__ */ new Map();
+  for (const rel of paths)
+    byGitPath.set(prefix === "" ? rel : `${prefix}/${rel}`, rel);
+  const codes = /* @__PURE__ */ new Map();
+  if (output !== "") {
+    if (!output.endsWith("\0"))
+      return null;
+    for (const record2 of output.slice(0, -1).split("\0")) {
+      if (record2.length < 4 || record2[2] !== " ")
+        return null;
+      const rel = byGitPath.get(record2.slice(3));
+      if (rel === void 0)
+        return null;
+      const xy = record2.slice(0, 2);
+      const existing = codes.get(rel);
+      if (existing)
+        existing.push(xy);
+      else
+        codes.set(rel, [xy]);
+    }
+  }
+  return paths.map((path) => {
+    const xys = codes.get(path);
+    if (!xys)
+      return { path, state: onDisk(path) ? "clean" : "absent" };
+    if (xys.some((xy) => xy.includes("D")))
+      return { path, state: "deleted" };
+    if (xys.includes("??"))
+      return { path, state: "untracked" };
+    if (xys.includes("!!"))
+      return { path, state: "ignored" };
+    if (xys.some((xy) => xy[0] === "A"))
+      return { path, state: "added" };
+    return { path, state: "modified" };
+  });
+}
+
 // dist/hooks/post-tool-use.js
 var HANDLED_EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-async function runPostToolUse() {
+async function runPostToolUse(readSeat = readSeatConfiguration) {
   const reply = hookReply("PostToolUse");
-  await evaluateEdit(reply);
+  await evaluateEdit(reply, readSeat);
   reply.flush();
 }
-async function evaluateEdit(reply) {
+async function evaluateEdit(reply, readSeat) {
   let input;
   try {
     const raw = await readStdin();
@@ -17282,11 +17570,12 @@ async function evaluateEdit(reply) {
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
+  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat);
   const evaluation = await evaluateWithRefresh({
     guardServiceUrl,
     token: guardServiceToken,
     engagementId: guardEngagementId,
-    request: buildEvaluationRequest(guardEngagementId, changeSet, context)
+    request: buildEvaluationRequest(guardEngagementId, changeSet, context, seatConfiguration)
   });
   const clientResult = evaluation.result;
   if (!clientResult.ok) {
@@ -17367,19 +17656,19 @@ ${guardLines}${notRunBlock}`);
   }
 }
 function readStdin() {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
 
 // dist/hooks/marker.js
 import { createHash } from "node:crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3, statSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var MARKER_TTL_MS = 24 * 60 * 60 * 1e3;
 var MARKER_PREFIX = "halfcycle-session-";
 var MARKER_SUFFIX = ".ref";
@@ -17397,19 +17686,19 @@ function markerFileName(repoRoot, sessionId) {
   return `${MARKER_PREFIX}${key}${MARKER_SUFFIX}`;
 }
 function markerPath(repoRoot, sessionId) {
-  return join6(markerDir(), markerFileName(repoRoot, sessionId));
+  return join7(markerDir(), markerFileName(repoRoot, sessionId));
 }
 function dedupePath(repoRoot, sessionId) {
   const hash2 = repoHash(repoRoot);
   const key = sessionId && sessionId.length > 0 ? `${hash2}-${sessionId}` : hash2;
-  return join6(markerDir(), `${MARKER_PREFIX}${key}${DEDUPE_SUFFIX}`);
+  return join7(markerDir(), `${MARKER_PREFIX}${key}${DEDUPE_SUFFIX}`);
 }
 function readMarker(repoRoot, sessionId) {
   const path = markerPath(repoRoot, sessionId);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return null;
   try {
-    return readFileSync6(path, "utf-8").trim() || null;
+    return readFileSync7(path, "utf-8").trim() || null;
   } catch {
     return null;
   }
@@ -17417,7 +17706,7 @@ function readMarker(repoRoot, sessionId) {
 function deleteMarker(repoRoot, sessionId) {
   for (const path of [markerPath(repoRoot, sessionId), dedupePath(repoRoot, sessionId)]) {
     try {
-      if (existsSync2(path))
+      if (existsSync3(path))
         unlinkSync3(path);
     } catch {
     }
@@ -17425,10 +17714,10 @@ function deleteMarker(repoRoot, sessionId) {
 }
 function readDedupe(repoRoot, sessionId) {
   const path = dedupePath(repoRoot, sessionId);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
     if (typeof parsed === "object" && parsed !== null && typeof parsed.base === "string" && typeof parsed.digest === "string") {
       return parsed;
     }
@@ -17470,10 +17759,10 @@ function orphanSweep(repoRoot, refKnown, keepSessionId, now = Date.now()) {
       continue;
     if (name === keepName)
       continue;
-    const full = join6(dir, name);
+    const full = join7(dir, name);
     let unusable = false;
     try {
-      const ref = readFileSync6(full, "utf-8").trim();
+      const ref = readFileSync7(full, "utf-8").trim();
       if (!ref || !refKnown(ref))
         unusable = true;
     } catch {
@@ -17531,12 +17820,12 @@ function collectDiff(repoRoot, base) {
     getDiff: (relPath) => getWorkingTreeFileDiff(relPath, repoRoot)
   };
 }
-async function runSessionDiff(input, kind) {
+async function runSessionDiff(input, kind, readSeat = readSeatConfiguration) {
   const reply = hookReply(STOP_HOOK_EVENT[kind]);
-  await evaluateSession(input, kind, reply);
+  await evaluateSession(input, kind, reply, readSeat);
   reply.flush();
 }
-async function evaluateSession(input, kind, reply) {
+async function evaluateSession(input, kind, reply, readSeat) {
   const repoRootResult = getRepoRoot(process.cwd());
   if (!repoRootResult.ok) {
     reply.notice(localFaultText(`Could not find git repo root: ${repoRootResult.message}`));
@@ -17576,11 +17865,12 @@ async function evaluateSession(input, kind, reply) {
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
+  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat);
   const evaluation = await evaluateWithRefresh({
     guardServiceUrl,
     token: guardServiceToken,
     engagementId: guardEngagementId,
-    request: buildEvaluationRequest(guardEngagementId, changeSet, context)
+    request: buildEvaluationRequest(guardEngagementId, changeSet, context, seatConfiguration)
   });
   const clientResult = evaluation.result;
   if (!clientResult.ok) {
@@ -17678,9 +17968,9 @@ async function readHookStdin() {
   }
 }
 function readStdin2() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     if (process.stdin.isTTY) {
-      resolve("");
+      resolve2("");
       return;
     }
     const chunks = [];
@@ -17690,7 +17980,7 @@ function readStdin2() {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve(Buffer.concat(chunks).toString("utf-8"));
+      resolve2(Buffer.concat(chunks).toString("utf-8"));
     };
     const timer = setTimeout(done, 2e3);
     process.stdin.on("data", (chunk) => chunks.push(chunk));
@@ -17712,17 +18002,17 @@ async function runStop() {
 }
 
 // dist/resolve-engagement.js
-import { existsSync as existsSync3, readFileSync as readFileSync7, realpathSync as realpathSync2 } from "node:fs";
-import { join as join7, sep as sep2 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { existsSync as existsSync4, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
+import { join as join8, sep as sep2 } from "node:path";
+import { homedir as homedir4 } from "node:os";
 function defaultRegistryPath() {
-  return join7(homedir3(), ".halfcycle", "registry.json");
+  return join8(homedir4(), ".halfcycle", "registry.json");
 }
 function readRegistry(registryPath = defaultRegistryPath()) {
-  if (!existsSync3(registryPath))
+  if (!existsSync4(registryPath))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync7(registryPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(registryPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const out = {};
@@ -17737,7 +18027,7 @@ function readRegistry(registryPath = defaultRegistryPath()) {
 }
 function canonicalise(p) {
   try {
-    return realpathSync2(p);
+    return realpathSync3(p);
   } catch {
     return p;
   }
@@ -17802,7 +18092,7 @@ async function runRefreshCredential(opts) {
 }
 
 // dist/capture.js
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync4 } from "node:fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync5 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -17870,7 +18160,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync8(fromFile, "utf-8");
+    return readFileSync9(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -17965,10 +18255,10 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
   process.exit(1);
 }
 function readStdin3() {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }

package/dist/bin.d.ts

@@ -8,7 +8,7 @@
  * Subcommands:
  *   halfcycle [install] [target-repo]        — install into target (default: cwd)
  *   halfcycle check-drift <target>           — report bundle drift for the re-sync gate
- *   halfcycle build-record <phase>           — assemble the phase Build Record (D1)
+ *   halfcycle build-record <phase>           — fetch a closed phase's Build Record and write it
  *   halfcycle open-phase <phase>             — open a phase, with its entry decision
  *   halfcycle close-phase <phase>            — record a phase's acceptance and close it
  *   halfcycle uninstall [--remove-credential] — take back what the installer wrote here