halfcycle 0.4.5 → 0.4.7

package/dist/index.js

@@ -118,6 +118,7 @@ var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
 var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
 var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var USER_PROMPT_SCOPE_REL = ".claude/hooks/user-prompt-scope.sh";
 var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
 var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
 function hookCommand(script, verb) {
@@ -146,6 +147,13 @@ var HALFCYCLE_HOOK_WIRING = [
     command: hookCommand(USER_PROMPT_REMINDER_REL),
     script: USER_PROMPT_REMINDER_REL
   },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 10,
+    command: hookCommand(USER_PROMPT_SCOPE_REL),
+    script: USER_PROMPT_SCOPE_REL
+  },
   {
     event: "PostToolUse",
     matcher: WRITE_CAPABLE_TOOLS.join("|"),
@@ -227,6 +235,9 @@ function quoteForShell(value) {
 }
 var HALFCYCLE_COMMAND = "npx halfcycle@latest";
 
+// ../core/dist/release-version.js
+var RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+
 // ../events/dist/result.js
 import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
@@ -293,15 +304,12 @@ function hasLoneSurrogate(text) {
 }
 var LONE_SURROGATE_MESSAGE = "must be valid text: it holds half of a character pair with no other half";
 
-// ../events/dist/build-record.js
-import { z as z4 } from "zod";
-
 // ../events/dist/state.js
 import { z as z3 } from "zod";
 var utcIso8601 = z3.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/, "must be a UTC ISO-8601 timestamp ending in Z");
 var STATE_RECORD_FORMAT = "halfcycle-state-record/v1";
 var stepIdSchema = z3.string().regex(/^(l[0-5](-l[0-5])?|xl)\.[a-z0-9-]+$/);
-var methodVersionSchema = z3.string().regex(/^\d+\.\d+\.\d+$/);
+var methodVersionSchema = z3.string().regex(RELEASE_VERSION_PATTERN);
 var anchorPathRegex = /^(?!\/)(?!.*#)(?!method\/)(?!(.*\/)?docs\/method\/).+$/;
 var recordKindSchema = z3.enum(["artefact", "step-run", "gate", "intervention"]);
 var methodLayerSchema = z3.enum(["l0", "l1", "l2", "l3", "l3-l4", "l4", "l5", "xl"]);
@@ -478,6 +486,9 @@ var stateRecordSchema = z3.discriminatedUnion("recordKind", [
   interventionRecordSchema
 ]);
 
+// ../events/dist/build-record.js
+import { z as z4 } from "zod";
+
 // ../events/dist/control-characters.js
 var CONTROL_CHARACTER_CLASS = "\\p{Cc}";
 var CONTROL_CHARACTER = new RegExp(CONTROL_CHARACTER_CLASS, "u");
@@ -581,9 +592,11 @@ function statementText(max) {
   });
 }
 var closeActorSchema = plainText(ACTOR_MAX);
+var PHASE_NAME_RULE = `must be a phase name: not empty, no slash or backslash, not starting with a dot, no control characters, at most ${PHASE_NAME_MAX_BYTES} bytes`;
 var phaseNameSchema = z4.string().refine((v) => isValidPhaseIdentity(v), {
-  message: `must be a phase name: not empty, no slash or backslash, not starting with a dot, no control characters, at most ${PHASE_NAME_MAX_BYTES} bytes`
+  message: PHASE_NAME_RULE
 });
+var phaseIdentitySchema = z4.union([z4.string(), z4.number()], { error: "must be a phase name or a whole number" }).refine((v) => isValidPhaseIdentity(v), { message: PHASE_NAME_RULE });
 var closeStatementsSchema = z4.object({
   thesis: statementText(STATEMENT_MAX).nullable(),
   outcome: statementText(STATEMENT_MAX).nullable(),
@@ -1356,7 +1369,7 @@ function createProjectIdentityFile(targetRepoRoot) {
 }
 
 // dist/install-manifest.js
-import { Buffer } from "node:buffer";
+import { Buffer as Buffer2 } from "node:buffer";
 import { createHash } from "node:crypto";
 var INSTALL_MANIFEST_REL = ".halfcycle/install-manifest.json";
 var INSTALL_MANIFEST_FORMAT = "halfcycle-install-manifest/v1";
@@ -1367,7 +1380,7 @@ function lineKey(line) {
   return line.endsWith("\r") ? line.slice(0, -1) : line;
 }
 function fileSha256(bytes) {
-  const text = typeof bytes === "string" ? bytes : Buffer.from(bytes).toString("utf-8");
+  const text = typeof bytes === "string" ? bytes : Buffer2.from(bytes).toString("utf-8");
   return sha256Hex(text.split("\n").map(lineKey).join("\n"));
 }
 function canonicalJson(value) {
@@ -1813,6 +1826,8 @@ var WRITE_ALLOWLIST = [
   BUNDLE_PIN_REL,
   ".halfcycle/bin",
   "docs/build-records",
+  // Architecture pictures the draw command writes from Halfcycle's answer. The installer never writes here; keep the entry so this path stays declared as one Halfcycle writes.
+  "docs/diagrams",
   "test/fixtures/captured",
   MCP_REGISTRATION_REL,
   ".gitattributes",
@@ -2381,6 +2396,54 @@ printf '%s\\n' '${USER_PROMPT_REMINDER_SENTENCE}'
 exit 0
 `;
 }
+var GENERATED_USER_PROMPT_SCOPE_HEADER = "# Typed scope approval \u2014 generated by";
+function generateUserPromptScopeHook() {
+  return `#!/usr/bin/env bash
+${GENERATED_USER_PROMPT_SCOPE_HEADER} the Halfcycle installer.
+#
+# Lets the owner of this project approve a phase's scope, or send it back, by
+# typing "approve <phase>" or "send back <phase>: <note>" as the whole prompt in
+# their own Claude Code session.
+#
+# AN ORDINARY PROMPT STARTS NOTHING. This script reads the hook input once and
+# looks only at the start of the prompt's value. Unless the prompt begins, after
+# any whitespace (typed, or escaped in the input), with "approve " or
+# "send back " in any case, it exits 0 with no output, and Node never starts.
+# A quote inside any other field arrives escaped, so no other field (the folder
+# the session is in, for one) can read as the start of the prompt.
+#
+# Otherwise it finds the project root from its own location, never from the
+# folder the session has moved to, and hands the same input to the guard
+# wrapper beside it. That decides whether the line counts and prints at most
+# one plain line. Nothing here ever blocks a prompt.
+#
+# FAILS OPEN up to that hand-over: any error before it exits 0 with no output.
+# After it, the wrapper's own exit stands.
+trap 'exit 0' ERR
+set -e
+
+# Read with the shell's own builtin, so the check below is the only program an
+# ordinary prompt starts.
+HC_INPUT=""
+IFS= read -r -d '' HC_INPUT || true
+
+# What may come before the phrase: whitespace as typed, as a short escape, as a
+# \\u escape, or as the UTF-8 bytes of a Unicode space. Compared byte for byte.
+HC_LEAD='[[:space:]]|\\\\[nrtf]|\\\\u(000[9a-d]|0020|00a0|1680|200[0-9a]|202[89f]|205f|3000|feff)'
+HC_LEAD="$HC_LEAD|"$'\\xc2\\xa0|\\xe1\\x9a\\x80|\\xe2\\x80[\\x80-\\x8a\\xa8\\xa9\\xaf]|\\xe2\\x81\\x9f|\\xe3\\x80\\x80|\\xef\\xbb\\xbf'
+if ! printf '%s' "$HC_INPUT" | LC_ALL=C grep -Eiq "\\"prompt\\"[[:space:]]*:[[:space:]]*\\"($HC_LEAD)*(approve|send back) "; then
+  exit 0
+fi
+
+HC_SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+HC_PROJECT_ROOT=$(CDPATH= cd -- "$HC_SCRIPT_DIR/../.." && pwd)
+export CLAUDE_PROJECT_DIR="$HC_PROJECT_ROOT"
+
+trap - ERR
+set +e
+exec bash "$HC_PROJECT_ROOT/.claude/hooks/guard-runner.sh" hook user-prompt-submit <<<"$HC_INPUT"
+`;
+}
 var CI_STANZA_KNOWN_HEADER_HASHES = [
   "b225800b2d699811f32ac213238cbf81c35b5e6a74114bdf55e39cd9d7e2928f",
   "674181735460f051af7c157222cf851fc3000fb3b8af3a10ea0bde9fe5eaba1f",
@@ -2456,6 +2519,7 @@ function removeRetiredMcpHeadersHelper(targetRepo) {
 var OWNED_GENERATED_HEADERS = {
   ".claude/hooks/guard-runner.sh": GENERATED_GUARD_RUNNER_HEADER,
   ".claude/hooks/user-prompt-reminder.sh": GENERATED_USER_PROMPT_REMINDER_HEADER,
+  ".claude/hooks/user-prompt-scope.sh": GENERATED_USER_PROMPT_SCOPE_HEADER,
   ".claude/hooks/session-end-marker.sh": GENERATED_SESSION_END_HEADER,
   ".claude/hooks/session-start-marker.sh": GENERATED_SESSION_START_HEADER
 };
@@ -2464,6 +2528,7 @@ function hookScriptsThisVersionWrites() {
     [".claude/hooks/guard-runner.sh", generateGuardRunnerWrapper()],
     [".claude/hooks/session-end-marker.sh", generateSessionEndMarker()],
     [".claude/hooks/user-prompt-reminder.sh", generateUserPromptReminderHook()],
+    [".claude/hooks/user-prompt-scope.sh", generateUserPromptScopeHook()],
     [".claude/hooks/session-start-marker.sh", generateSessionStartMarker()]
   ];
 }
@@ -3857,7 +3922,7 @@ function renderBuildRecordV2Markdown(record2) {
     `Phase: ${phase} (the name the client gave it)`,
     OBSERVED_LABEL,
     [
-      `- Method version: ${p.text(record2.observed.methodVersion)}. The Halfcycle method is updated from time to time, and each update has its own version number. This is the one the project was run under; it does not change during a project.`,
+      `- Method version: ${p.text(record2.observed.methodVersion)}. The Halfcycle method is updated from time to time, and each update has its own version number. This is the one the phase was run under. A project moves to a newer version only between phases.`,
       `- Project identifier: ${p.text(record2.observed.engagementId)}. Halfcycle keeps this project's records under this identifier.`,
       `- Record format: ${p.text(record2.format)}. This names the layout this file and the .json file beside it follow, for software that reads them.`
     ].join("\n"),
@@ -3889,10 +3954,14 @@ function assertInsideOutDir(outDir, candidate, identity) {
     throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
   }
 }
-function createExclusiveOnDisk(path, text) {
+function createExclusiveOnDisk(path, data) {
+  const bytes = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
   const fd = openSync(path, "wx");
   try {
-    writeSync(fd, text);
+    let written = 0;
+    while (written < bytes.length) {
+      written += writeSync(fd, bytes, written, bytes.length - written);
+    }
   } catch (err) {
     closeSync(fd);
     rmSync3(path, { force: true });
@@ -4009,6 +4078,22 @@ function replaceOne(io, tmp, finalPath, text) {
 
 // dist/build-record/obtain.js
 import { relative as relative3 } from "node:path";
+
+// dist/missing-route.js
+var MESSAGE = {
+  GET: /^Route GET .* not found\.$/s,
+  POST: /^Route POST .* not found\.$/s
+};
+function isMissingRoute(method, status, body) {
+  if (status !== 404 || typeof body !== "object" || body === null)
+    return false;
+  const { error, message } = body;
+  if (error !== "Not Found" || typeof message !== "string")
+    return false;
+  return MESSAGE[method].test(message);
+}
+
+// dist/build-record/obtain.js
 var REFUSAL_FOLLOW_UP = {
   "still-open": "Nothing was written. The record is produced when the phase closes.",
   "reopened": "Nothing was written. A new record is produced when the phase closes again.",
@@ -4020,12 +4105,6 @@ var REFUSAL_REASONS = phaseRecordRefusalReasonSchema.options;
 function buildRecordUrl(credential, phase) {
   return `${credential.serviceUrl}/engagements/${encodeURIComponent(credential.engagementId)}/phases/${encodeURIComponent(phase)}/build-record`;
 }
-function isMissingRoute(status, body) {
-  if (status !== 404 || typeof body !== "object" || body === null)
-    return false;
-  const { error, message } = body;
-  return error === "Not Found" && typeof message === "string" && /^Route GET .* not found\.$/s.test(message);
-}
 async function obtainBuildRecord(credential, repoRoot, phase, io = NODE_RECORD_PAIR_IO) {
   const url = buildRecordUrl(credential, phase);
   let res;
@@ -4082,7 +4161,7 @@ async function obtainBuildRecord(credential, repoRoot, phase, io = NODE_RECORD_P
       headline: latestCloseHeadline(answer.record)
     };
   }
-  if (isMissingRoute(res.status, raw)) {
+  if (isMissingRoute("GET", res.status, raw)) {
     return { kind: "unavailable", why: "this Halfcycle service does not provide Build Records yet." };
   }
   const message = typeof raw === "object" && raw !== null && typeof raw.message === "string" ? raw.message : null;