harness-everything 0.2.1 → 0.3.6

package/hooks/scripts/contract-test.js

@@ -1,79 +1,79 @@
-#!/usr/bin/env node
-/**
- * Contract Test (PostToolUse: Bash|PowerShell)
- * Resolves fable-mode stage contracts. fable-orchestrator's discipline says
- * every stage check must be "re-run or spot-checked... before building on
- * its output" - but a verbal claim of "I re-ran it" isn't auditable. So the
- * orchestrator now writes .claude/harness-state/contracts/<stageId>.json with
- * status:"pending" and the exact checkCommand BEFORE running it. This hook
- * watches every shell call; when the command matches a pending contract's
- * checkCommand verbatim, it records pass/fail into that manifest using the
- * same exitCode-or-stderr heuristic as rule-of-3-tracker.js.
- * Contracts are shared across sessions, not scoped to one - the orchestrator
- * writes them proactively (not in response to a hook message) and has no
- * clean way to learn its own session_id, so a collision only matters if two
- * fable-mode orchestrations run in the same repo at once.
- * Contracts are audit trail, not synchronous enforcement - EXCEPT when a
- * check this hook just resolved comes back FAILED, it surfaces that loudly
- * (exit 2) so silently building on a failed stage doesn't slip through.
- * Fails open on any parse/lookup error.
- */
-const fs = require('fs');
-const path = require('path');
-const { getWorkspaceRoot, getStateRoot } = require('./lib/harness-state');
-
-let inputData = '';
-process.stdin.on('data', chunk => { inputData += chunk; });
-process.stdin.on('end', () => {
-  try {
-    const payload = JSON.parse(inputData);
-    if (payload.tool_name !== 'Bash' && payload.tool_name !== 'PowerShell') process.exit(0);
-
-    const command = ((payload.tool_input && payload.tool_input.command) || '').trim();
-    if (!command) process.exit(0);
-
-    const contractsDir = path.join(getStateRoot(getWorkspaceRoot()), 'contracts');
-    if (!fs.existsSync(contractsDir)) process.exit(0);
-
-    const toolResponse = payload.tool_response || {};
-    const stdout = toolResponse.stdout ?? payload.stdout ?? '';
-    const stderr = toolResponse.stderr ?? payload.stderr ?? '';
-    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
-    const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
-    const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
-    const failed = (exitCode !== undefined && exitCode !== 0) || (exitCode === undefined && stderrSignal);
-
-    const files = fs.readdirSync(contractsDir).filter(f => f.endsWith('.json'));
-    let firstFailure = null;
-
-    for (const file of files) {
-      const manifestPath = path.join(contractsDir, file);
-      let manifest;
-      try {
-        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-      } catch (e) {
-        continue;
-      }
-      if (manifest.status !== 'pending') continue;
-      if (!manifest.checkCommand || manifest.checkCommand.trim() !== command) continue;
-
-      manifest.status = failed ? 'fail' : 'pass';
-      manifest.evidence = ((stderrSignal ? stderr : stdout) || '').slice(-500).trim();
-      manifest.verifiedAt = new Date().toISOString();
-      fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), 'utf8');
-
-      if (failed && !firstFailure) firstFailure = manifest;
-    }
-
-    if (firstFailure) {
-      console.error(`[Contract Test] Stage "${firstFailure.stageId}" FAILED its named check: ${firstFailure.checkCommand}`);
-      console.error(`Evidence: ${firstFailure.evidence || '(no output captured)'}`);
-      console.error(`Do not build on this stage's output until it passes. Artifact: ${firstFailure.outputPath || '(no path recorded)'}`);
-      process.exit(2);
-    }
-
-    process.exit(0);
-  } catch (err) {
-    process.exit(0);
-  }
-});
+#!/usr/bin/env node
+/**
+ * Contract Test (PostToolUse: Bash|PowerShell)
+ * Resolves fable-mode stage contracts. fable-orchestrator's discipline says
+ * every stage check must be "re-run or spot-checked... before building on
+ * its output" - but a verbal claim of "I re-ran it" isn't auditable. So the
+ * orchestrator now writes .claude/harness-everything/state/contracts/<stageId>.json with
+ * status:"pending" and the exact checkCommand BEFORE running it. This hook
+ * watches every shell call; when the command matches a pending contract's
+ * checkCommand verbatim, it records pass/fail into that manifest using the
+ * same exitCode-or-stderr heuristic as rule-of-3-tracker.js.
+ * Contracts are shared across sessions, not scoped to one - the orchestrator
+ * writes them proactively (not in response to a hook message) and has no
+ * clean way to learn its own session_id, so a collision only matters if two
+ * fable-mode orchestrations run in the same repo at once.
+ * Contracts are audit trail, not synchronous enforcement - EXCEPT when a
+ * check this hook just resolved comes back FAILED, it surfaces that loudly
+ * (exit 2) so silently building on a failed stage doesn't slip through.
+ * Fails open on any parse/lookup error.
+ */
+const fs = require('fs');
+const path = require('path');
+const { getWorkspaceRoot, getStateRoot } = require('./lib/harness-state');
+
+let inputData = '';
+process.stdin.on('data', chunk => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const payload = JSON.parse(inputData);
+    if (payload.tool_name !== 'Bash' && payload.tool_name !== 'PowerShell') process.exit(0);
+
+    const command = ((payload.tool_input && payload.tool_input.command) || '').trim();
+    if (!command) process.exit(0);
+
+    const contractsDir = path.join(getStateRoot(getWorkspaceRoot()), 'contracts');
+    if (!fs.existsSync(contractsDir)) process.exit(0);
+
+    const toolResponse = payload.tool_response || {};
+    const stdout = toolResponse.stdout ?? payload.stdout ?? '';
+    const stderr = toolResponse.stderr ?? payload.stderr ?? '';
+    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
+    const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
+    const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
+    const failed = (exitCode !== undefined && exitCode !== 0) || (exitCode === undefined && stderrSignal);
+
+    const files = fs.readdirSync(contractsDir).filter(f => f.endsWith('.json'));
+    let firstFailure = null;
+
+    for (const file of files) {
+      const manifestPath = path.join(contractsDir, file);
+      let manifest;
+      try {
+        manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+      } catch (e) {
+        continue;
+      }
+      if (manifest.status !== 'pending') continue;
+      if (!manifest.checkCommand || manifest.checkCommand.trim() !== command) continue;
+
+      manifest.status = failed ? 'fail' : 'pass';
+      manifest.evidence = ((stderrSignal ? stderr : stdout) || '').slice(-500).trim();
+      manifest.verifiedAt = new Date().toISOString();
+      fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), 'utf8');
+
+      if (failed && !firstFailure) firstFailure = manifest;
+    }
+
+    if (firstFailure) {
+      console.error(`[Contract Test] Stage "${firstFailure.stageId}" FAILED its named check: ${firstFailure.checkCommand}`);
+      console.error(`Evidence: ${firstFailure.evidence || '(no output captured)'}`);
+      console.error(`Do not build on this stage's output until it passes. Artifact: ${firstFailure.outputPath || '(no path recorded)'}`);
+      process.exit(2);
+    }
+
+    process.exit(0);
+  } catch (err) {
+    process.exit(0);
+  }
+});

package/hooks/scripts/depth-guard.js

@@ -1,65 +1,65 @@
-#!/usr/bin/env node
-/**
- * Depth Guard (PreToolUse: Edit|Write)
- * Claude Code already refuses to Edit a file that wasn't Read first in the
- * same session - that's native behavior, not something this hook needs to
- * re-check. The gap is Write: it happily overwrites an existing file with
- * no prior Read at all. This hook closes that gap: blocks Write on a file
- * that already exists on disk unless a Read of that exact path shows up
- * earlier in this session's transcript.
- * Fails open on any parse/lookup error - never blocks due to a bug here.
- */
-const fs = require('fs');
-const path = require('path');
-
-let inputData = '';
-process.stdin.on('data', chunk => { inputData += chunk; });
-process.stdin.on('end', () => {
-  try {
-    const payload = JSON.parse(inputData);
-    if (payload.tool_name !== 'Write') {
-      process.exit(0);
-    }
-
-    const filePath = payload.tool_input && payload.tool_input.file_path;
-    if (!filePath || !fs.existsSync(filePath)) {
-      // New file - nothing to have read first.
-      process.exit(0);
-    }
-
-    const transcriptPath = payload.transcript_path;
-    if (!transcriptPath || !fs.existsSync(transcriptPath)) {
-      // Can't verify either way - fail open.
-      process.exit(0);
-    }
-
-    const target = path.resolve(filePath).toLowerCase();
-    const lines = fs.readFileSync(transcriptPath, 'utf8').split('\n').filter(Boolean);
-
-    const wasRead = lines.some(line => {
-      try {
-        const entry = JSON.parse(line);
-        const content = entry && entry.message && entry.message.content;
-        if (!Array.isArray(content)) return false;
-        return content.some(block => {
-          if (!block || block.type !== 'tool_use' || block.name !== 'Read') return false;
-          const readPath = block.input && block.input.file_path;
-          return readPath && path.resolve(readPath).toLowerCase() === target;
-        });
-      } catch (e) {
-        return false;
-      }
-    });
-
-    if (!wasRead) {
-      console.error(`[Depth Guard] BLOCKED: "${filePath}" already exists but hasn't been Read in this session.`);
-      console.error(`Write() overwrites the whole file - doing that blind risks destroying content you never looked at.`);
-      console.error(`Read the file first (even a quick pass), then retry the Write, or use Edit for a targeted change.`);
-      process.exit(2);
-    }
-
-    process.exit(0);
-  } catch (err) {
-    process.exit(0);
-  }
-});
+#!/usr/bin/env node
+/**
+ * Depth Guard (PreToolUse: Edit|Write)
+ * Claude Code already refuses to Edit a file that wasn't Read first in the
+ * same session - that's native behavior, not something this hook needs to
+ * re-check. The gap is Write: it happily overwrites an existing file with
+ * no prior Read at all. This hook closes that gap: blocks Write on a file
+ * that already exists on disk unless a Read of that exact path shows up
+ * earlier in this session's transcript.
+ * Fails open on any parse/lookup error - never blocks due to a bug here.
+ */
+const fs = require('fs');
+const path = require('path');
+
+let inputData = '';
+process.stdin.on('data', chunk => { inputData += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const payload = JSON.parse(inputData);
+    if (payload.tool_name !== 'Write') {
+      process.exit(0);
+    }
+
+    const filePath = payload.tool_input && payload.tool_input.file_path;
+    if (!filePath || !fs.existsSync(filePath)) {
+      // New file - nothing to have read first.
+      process.exit(0);
+    }
+
+    const transcriptPath = payload.transcript_path;
+    if (!transcriptPath || !fs.existsSync(transcriptPath)) {
+      // Can't verify either way - fail open.
+      process.exit(0);
+    }
+
+    const target = path.resolve(filePath).toLowerCase();
+    const lines = fs.readFileSync(transcriptPath, 'utf8').split('\n').filter(Boolean);
+
+    const wasRead = lines.some(line => {
+      try {
+        const entry = JSON.parse(line);
+        const content = entry && entry.message && entry.message.content;
+        if (!Array.isArray(content)) return false;
+        return content.some(block => {
+          if (!block || block.type !== 'tool_use' || block.name !== 'Read') return false;
+          const readPath = block.input && block.input.file_path;
+          return readPath && path.resolve(readPath).toLowerCase() === target;
+        });
+      } catch (e) {
+        return false;
+      }
+    });
+
+    if (!wasRead) {
+      console.error(`[Depth Guard] BLOCKED: "${filePath}" already exists but hasn't been Read in this session.`);
+      console.error(`Write() overwrites the whole file - doing that blind risks destroying content you never looked at.`);
+      console.error(`Read the file first (even a quick pass), then retry the Write, or use Edit for a targeted change.`);
+      process.exit(2);
+    }
+
+    process.exit(0);
+  } catch (err) {
+    process.exit(0);
+  }
+});