mainflow 0.43.0 → 0.44.0-alpha.2

package/dist/grant-check.js

@@ -0,0 +1,572 @@
+import { D as SESSION_ID, I as configSchema, ft as describeRequest, gt as hasControl, tt as repoPaths } from "./dist-CXrUfRQp.js";
+import { $t as realPath, Gt as resolveHub, Jt as nodeStorage, M as matchGrants, Ot as formatMismatch, Yt as currentBranch, Zt as gitCheckout, j as grantScope, k as readSession, kt as hubFormatVersion, mt as readYaml } from "./host-C74j2Qox.js";
+import { n as hubWriter, r as writtenLines } from "./operation-CUeOFEaf.js";
+import { OWNER_REPO, githubOrigin, quote, readManifest, resolveFixed, scanCommand, scopedCwd } from "./grant-commands.js";
+import { claudeCodeSessionId, parsePayload } from "./hooks.js";
+import { readFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+//#region src/grant-check.ts
+const none = (reason) => ({
+	decision: "none",
+	reason
+});
+/** A call this cannot judge; its message is the reason. */
+var NotJudged = class extends Error {};
+/** Text that makes a call more than one command, or runs a command inside it; checked before any quote is read. */
+const COMPOUND = [
+	["&&", "&&"],
+	[";", ";"],
+	["|", "|"],
+	["$(", "$("],
+	["`", "反引號"],
+	["\n", "換行"],
+	["\r", "換行"]
+];
+/** Characters the shell gives a meaning to outside quotes. */
+const SHELL_CHARS = /* @__PURE__ */ new Set("\\$`|&;<>(){}[]*?!#~");
+/**
+* Split one simple command into the words the shell passes on: words separated by spaces, each made of plain
+* characters, single-quoted text, and double-quoted text in which the shell expands nothing. Anything else throws.
+*/
+function shellWords(command) {
+	if (hasControl(command)) throw new NotJudged("指令含換行、tab 或其他控制字元");
+	const words = [];
+	let i = 0;
+	while (i < command.length) {
+		if (command[i] === " ") {
+			i++;
+			continue;
+		}
+		let word = "";
+		while (i < command.length && command[i] !== " ") {
+			const c = command[i];
+			if (c === "'" || c === "\"") {
+				const end = command.indexOf(c, i + 1);
+				if (end < 0) throw new NotJudged(`${c === "'" ? "單" : "雙"}引號沒有收尾`);
+				const inner = command.slice(i + 1, end);
+				if (c === "\"" && /[\\$`!]/.test(inner)) throw new NotJudged("雙引號裡有 \\、$、反引號或 !，shell 會展開或轉義它們");
+				word += inner;
+				i = end + 1;
+			} else if (SHELL_CHARS.has(c)) throw new NotJudged(`「${c}」是 shell 語法`);
+			else {
+				word += c;
+				i++;
+			}
+		}
+		words.push(word);
+	}
+	return words;
+}
+/** The push words that send more than one branch's new commits, or rewrite or delete a remote branch. */
+const PUSH_DANGER = /^(?:--force.*|--delete.*|--mirror.*|--all.*|--tags.*|--prune.*|-[A-Za-z]*[fd][A-Za-z]*)$/;
+const MERGE_DANGER = /^(?:--admin.*|--delete-branch.*|-[A-Za-z]*d[A-Za-z]*)$/;
+function readGit(words) {
+	let i = 1;
+	let dir;
+	while (words[i]?.startsWith("-")) {
+		if (words[i] === "-C" && dir === void 0 && words[i + 1] !== void 0) {
+			dir = words[i + 1];
+			i += 2;
+			continue;
+		}
+		throw new NotJudged(`git 的「${quote(words[i])}」不在固定寫法裡，git 之後只接受一個 -C <目錄>`);
+	}
+	const sub = words[i];
+	const rest = words.slice(i + 1);
+	if (sub === "commit") return {
+		action: "commit",
+		...dir !== void 0 ? { dir } : {}
+	};
+	if (sub !== "push") throw new NotJudged(`git ${quote(sub ?? "")} 不是可判斷的動作，只判斷 commit 與 push`);
+	const danger = rest.find((w) => PUSH_DANGER.test(w));
+	if (danger) throw new NotJudged(`push 帶 ${danger}，會強制推送、刪除或推送不只一個分支`);
+	const positional = [];
+	for (const word of rest) {
+		if (word === "-u" || word === "--set-upstream") continue;
+		if (word.startsWith("-")) throw new NotJudged(`push 的「${quote(word)}」不在固定寫法裡`);
+		if (word.startsWith("+")) throw new NotJudged(`refspec ${quote(word)} 以 + 開頭，會強制推送`);
+		if (word.includes(":")) throw new NotJudged(`refspec ${quote(word)} 含 :，會推到別的名稱或刪除遠端分支`);
+		positional.push(word);
+	}
+	if (positional.length > 2) throw new NotJudged("push 最多一個遠端與一個分支");
+	const [remote, branch] = positional;
+	return {
+		action: "push",
+		...dir !== void 0 ? { dir } : {},
+		...remote !== void 0 ? { remote } : {},
+		...branch !== void 0 ? { branch } : {}
+	};
+}
+function readMerge(rest) {
+	const danger = rest.find((w) => MERGE_DANGER.test(w));
+	if (danger) throw new NotJudged(`merge 帶 ${danger}，會略過審查規則或刪除分支`);
+	let number;
+	let method;
+	let repo;
+	for (let i = 0; i < rest.length; i++) {
+		const word = rest[i];
+		if (word === "--squash" || word === "--merge" || word === "--rebase") {
+			if (method) throw new NotJudged("只能選一種合併方式");
+			method = word;
+		} else if (word === "-R") {
+			if (repo !== void 0 || rest[i + 1] === void 0) throw new NotJudged("-R 要寫一次 <owner/repo>");
+			repo = rest[++i];
+			if (!OWNER_REPO.test(repo)) throw new NotJudged(`-R ${quote(repo)} 不是 owner/repo`);
+		} else if (/^\d+$/.test(word) && number === void 0) number = word;
+		else throw new NotJudged(`merge 的「${quote(word)}」不在固定寫法裡`);
+	}
+	if (repo !== void 0 && number === void 0) throw new NotJudged("帶 -R 時要寫 PR 編號");
+	return {
+		action: "merge-pr",
+		...number !== void 0 ? { number } : {},
+		...repo !== void 0 ? { repo } : {}
+	};
+}
+/** The words after `promptex build`. */
+function readPromptex(rest, via) {
+	let install = false;
+	let dryRun = false;
+	let dir;
+	let unit;
+	for (let i = 0; i < rest.length; i++) {
+		const word = rest[i];
+		if (word === "--install" && !install) install = true;
+		else if (word === "--dry-run") dryRun = true;
+		else if (word === "--unit" && unit === void 0 && rest[i + 1] !== void 0) unit = rest[++i];
+		else if (word.startsWith("-")) throw new NotJudged(`promptex build 的「${quote(word)}」不在固定寫法裡`);
+		else if (dir === void 0) dir = word;
+		else throw new NotJudged("promptex build 只接受一個目錄");
+	}
+	if (dryRun) throw new NotJudged("帶 --dry-run 只列出變更、不寫入，不需授權");
+	if (!install) throw new NotJudged("沒有 --install，不會安裝");
+	return {
+		action: "install-prompts",
+		via,
+		...dir !== void 0 ? { dir } : {},
+		...unit !== void 0 ? { unit } : {}
+	};
+}
+/** Read a command as one of the forms; throws NotJudged for anything else. */
+function readCall(command) {
+	const words = shellWords(command);
+	const [first, second, third] = words;
+	if (first === "git") return readGit(words);
+	if (first === "gh" && second === "pr" && third === "merge") return readMerge(words.slice(3));
+	if (first === "gh" && second === "release" || (first === "npm" || first === "pnpm") && second === "publish") return { action: first === "gh" ? "release" : "publish" };
+	if (first === "pnpm" && second === "install:prompts") {
+		if (words.length > 2) throw new NotJudged("pnpm install:prompts 不能再帶參數，因為 pnpm 會把它們接到腳本後面");
+		return {
+			action: "install-prompts",
+			via: "script"
+		};
+	}
+	if (first === "pnpm" && second === "exec" && third === "promptex" && words[3] === "build") return readPromptex(words.slice(4), "exec");
+	if (first === "promptex" && second === "build") return readPromptex(words.slice(2), "bare");
+	throw new NotJudged(`「${quote(command.trim())}」不是可判斷的動作，只判斷 ${Object.keys(FORM_ACTIONS).join("、")} 的固定寫法`);
+}
+/** The actions a single command can be judged for. */
+const FORM_ACTIONS = {
+	commit: true,
+	push: true,
+	"merge-pr": true,
+	publish: true,
+	release: true,
+	"install-prompts": true
+};
+/** The config.yaml names whose checkout holds `dir`: its repository or a linked worktree of it. */
+function repoNamesOf(dir, place) {
+	const checkout = gitCheckout(dir);
+	if (!checkout) return [];
+	const roots = [checkout.current, checkout.main].flatMap((p) => p ? [realPath(p) ?? p] : []);
+	return Object.entries(place.repos).filter(([, path]) => {
+		const real = realPath(resolve(place.root, path));
+		return real !== null && roots.includes(real);
+	}).map(([name]) => name);
+}
+/** A directory the call names, resolved against its cwd, symbolic links resolved; throws when it does not exist. */
+function existing(place, dir) {
+	const real = realPath(resolve(place.cwd, dir ?? "."));
+	if (!real) throw new NotJudged(`目錄 ${quote(dir ?? place.cwd)} 不存在`);
+	return real;
+}
+function repoAt(dir, place) {
+	const repos = repoNamesOf(dir, place);
+	if (repos.length === 0) throw new NotJudged(`${quote(dir)} 不是 config.yaml 登記的倉庫或它的 worktree`);
+	return repos;
+}
+/** A git setting at `dir`, every value of it; empty when it is not set. */
+function gitConfig(dir, key) {
+	const result = spawnSync("git", [
+		"-C",
+		dir,
+		"config",
+		"--get-all",
+		key
+	], { encoding: "utf8" });
+	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
+}
+const gitHas = (dir, ref) => spawnSync("git", [
+	"-C",
+	dir,
+	"show-ref",
+	"--verify",
+	"--quiet",
+	ref
+]).status === 0;
+function resolvePush(call, place) {
+	const dir = existing(place, call.dir);
+	const repos = repoAt(dir, place);
+	const current = currentBranch(dir);
+	const remote = call.remote ?? (current && gitConfig(dir, `branch.${current}.pushRemote`)[0]) ?? gitConfig(dir, "remote.pushDefault")[0] ?? (current && gitConfig(dir, `branch.${current}.remote`)[0]) ?? "origin";
+	if (remote !== "origin") throw new NotJudged(`遠端是 ${quote(remote)}，只放行推到 origin`);
+	if (gitConfig(dir, "remote.origin.mirror").some((v) => v === "true")) throw new NotJudged("remote.origin.mirror 是 true，會鏡像推送全部 ref");
+	if (gitConfig(dir, "remote.origin.push").length > 0) throw new NotJudged("設了 remote.origin.push，推送的對象由設定決定");
+	let branch;
+	if (call.branch === void 0) {
+		if (!current) throw new NotJudged("沒有寫分支，目前又不在任何分支上");
+		const mode = gitConfig(dir, "push.default")[0];
+		if (mode !== void 0 && mode !== "simple" && mode !== "current") throw new NotJudged(`push.default 是 ${quote(mode)}，沒寫分支時推送的不一定是目前分支`);
+		branch = current;
+	} else {
+		const named = call.branch === "HEAD" ? current : call.branch.replace(/^refs\/heads\//, "");
+		if (!named) throw new NotJudged("HEAD 不在任何分支上");
+		if (!gitHas(dir, `refs/heads/${named}`)) throw new NotJudged(`${quote(named)} 不是本機的分支`);
+		if (gitHas(dir, `refs/tags/${named}`)) throw new NotJudged(`${quote(named)} 有同名的 tag，推送的可能是 tag`);
+		branch = named;
+	}
+	return {
+		action: "push",
+		repos,
+		branch,
+		dir
+	};
+}
+function resolveMerge(call, place) {
+	let repos;
+	if (call.repo !== void 0) {
+		const slug = `github.com/${call.repo}`.toLowerCase();
+		repos = Object.entries(place.repos).filter(([, path]) => githubOrigin(resolve(place.root, path)) === slug).map(([name]) => name);
+		if (repos.length === 0) throw new NotJudged(`${quote(call.repo)} 不是 config.yaml 裡任何倉庫的 origin`);
+	} else {
+		if (place.env.GH_REPO) throw new NotJudged("設了 GH_REPO，gh 合併的倉庫由它決定");
+		repos = repoAt(place.cwd, place);
+		const remotes = spawnSync("git", [
+			"-C",
+			place.cwd,
+			"remote"
+		], { encoding: "utf8" }).stdout?.split("\n").filter(Boolean) ?? [];
+		if (remotes.length !== 1 || remotes[0] !== "origin") throw new NotJudged("沒帶 -R 時，倉庫只能有 origin 一個遠端，gh 才不會選到別的倉庫");
+		if (!githubOrigin(place.cwd)) throw new NotJudged("origin 不在 github.com 上");
+	}
+	const base = place.prBase({
+		cwd: place.cwd,
+		...call.number !== void 0 ? { number: call.number } : {},
+		...call.repo !== void 0 ? { repo: call.repo } : {}
+	});
+	if (!base) throw new NotJudged("gh pr view 讀不到 PR 的 base 分支");
+	return {
+		action: "merge-pr",
+		repos,
+		branch: base,
+		dir: place.cwd
+	};
+}
+/** The promptex binary `pnpm exec` or a package script runs from `cwd`: the nearest node_modules/.bin/promptex above it. */
+function localPromptex(cwd) {
+	for (let at = cwd;; at = dirname(at)) {
+		const bin = join(at, "node_modules/.bin/promptex");
+		if (realPath(bin)) return bin;
+		if (dirname(at) === at) return null;
+	}
+}
+function resolveInstall(call, place) {
+	let read = call;
+	if (call.via === "script") {
+		const text = readManifest(join(place.cwd, "package.json"));
+		if (text === null) throw new NotJudged(`${quote(place.cwd)} 沒有 1 MB 以內的 package.json`);
+		let scripts;
+		try {
+			scripts = JSON.parse(text).scripts ?? {};
+		} catch {
+			throw new NotJudged("package.json 不是 JSON");
+		}
+		const script = scripts["install:prompts"];
+		if (typeof script !== "string") throw new NotJudged("package.json 沒有 install:prompts 腳本");
+		for (const hook of ["preinstall:prompts", "postinstall:prompts"]) if (scripts[hook] !== void 0) throw new NotJudged(`package.json 有 ${hook}，會另外執行`);
+		const mark = compoundMark(script);
+		if (mark) throw new NotJudged(`install:prompts 腳本含 ${mark}，只判斷單一指令`);
+		const words = shellWords(script);
+		if (words[0] !== "promptex" || words[1] !== "build") throw new NotJudged(`install:prompts 腳本「${quote(script)}」不是 promptex build --install`);
+		read = readPromptex(words.slice(2), "script");
+	}
+	const project = existing(place, read.dir);
+	if (!scopedCwd(project, place.root, place.repos).ok && repoNamesOf(project, place).length === 0) throw new NotJudged(`${quote(project)} 不在 hub 或登記的倉庫內`);
+	const command = call.via === "bare" ? "promptex" : localPromptex(place.cwd);
+	if (!command) throw new NotJudged(`${quote(place.cwd)} 往上找不到 node_modules/.bin/promptex`);
+	const args = [
+		"build",
+		read.dir ?? ".",
+		"--install",
+		...read.unit !== void 0 ? ["--unit", read.unit] : [],
+		"--dry-run",
+		"--json"
+	];
+	const units = place.listUnits({
+		command,
+		args,
+		cwd: place.cwd
+	});
+	if (!units || units.length === 0) throw new NotJudged("列不出這次安裝的單元（promptex build --install --dry-run --json 失敗或沒有單元）");
+	const repos = repoNamesOf(project, place);
+	return units.map((unit) => ({
+		action: "install-prompts",
+		unit,
+		repos,
+		dir: project
+	}));
+}
+function resolveCall(call, command, place) {
+	try {
+		switch (call.action) {
+			case "publish":
+			case "release": {
+				const scan = scanCommand(command);
+				if (scan.kind === "none") return {
+					ok: false,
+					reason: "不是可判斷的動作"
+				};
+				if (scan.kind === "refused") return {
+					ok: false,
+					reason: scan.reason
+				};
+				const where = scopedCwd(place.cwd, place.root, place.repos);
+				if (!where.ok) return {
+					ok: false,
+					reason: where.reason
+				};
+				const resolved = resolveFixed(scan.call, {
+					cwd: where.dir,
+					root: place.root,
+					repos: place.repos
+				});
+				return resolved.ok ? {
+					ok: true,
+					requests: [resolved.request],
+					text: command
+				} : resolved;
+			}
+			case "commit": {
+				const dir = existing(place, call.dir);
+				return {
+					ok: true,
+					requests: [{
+						action: "commit",
+						repos: repoAt(dir, place),
+						branch: currentBranch(dir),
+						dir
+					}],
+					text: command
+				};
+			}
+			case "push": return {
+				ok: true,
+				requests: [resolvePush(call, place)],
+				text: command
+			};
+			case "merge-pr": return {
+				ok: true,
+				requests: [resolveMerge(call, place)],
+				text: command
+			};
+			case "install-prompts": return {
+				ok: true,
+				requests: resolveInstall(call, place),
+				text: command
+			};
+		}
+	} catch (error) {
+		if (error instanceof NotJudged) return {
+			ok: false,
+			reason: error.message
+		};
+		throw error;
+	}
+}
+const defaultPrBase = ({ cwd, number, repo }) => {
+	const args = [
+		"pr",
+		"view",
+		...number !== void 0 ? [number] : [],
+		...repo !== void 0 ? ["-R", repo] : [],
+		"--json",
+		"baseRefName"
+	];
+	const result = spawnSync("gh", args, {
+		cwd,
+		encoding: "utf8",
+		timeout: 2e4
+	});
+	if (result.status !== 0) return null;
+	try {
+		const base = JSON.parse(result.stdout).baseRefName;
+		return typeof base === "string" && base ? base : null;
+	} catch {
+		return null;
+	}
+};
+/**
+* The units of promptex's dry run: it prints one JSON object per unit and platform, each naming its `unit`, and writes
+* nothing. Running it evaluates the project's promptex config, as the install itself would.
+*/
+const defaultListUnits = ({ command, args, cwd }) => {
+	const result = spawnSync(command, args, {
+		cwd,
+		encoding: "utf8",
+		timeout: 6e4,
+		maxBuffer: 67108864
+	});
+	if (result.status !== 0 || typeof result.stdout !== "string") return null;
+	const units = /* @__PURE__ */ new Set();
+	for (const line of result.stdout.split("\n")) {
+		if (!line.startsWith("{")) continue;
+		try {
+			const entry = JSON.parse(line);
+			if (entry.verb === "build" && typeof entry.unit === "string" && entry.unit) units.add(entry.unit);
+		} catch {
+			return null;
+		}
+	}
+	return units.size > 0 ? [...units] : null;
+};
+function compoundMark(command) {
+	return COMPOUND.find(([text]) => command.includes(text))?.[1] ?? null;
+}
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The mainflow session a host's session id stands for: the id itself when such a session exists, else Claude Code's. */
+function sessionIdOf(dirs, raw) {
+	if (SESSION_ID.test(raw) && readSession(dirs, raw)) return raw;
+	return claudeCodeSessionId(raw);
+}
+/** The ops log's fields cannot hold its separator, so text that contains one is written with a broken bar. */
+const opsText = (text) => text.replace(/\s\|\s/g, " ¦ ").replace(/\s+/g, " ").slice(0, 200);
+function opsTarget(request) {
+	switch (request.action) {
+		case "publish": return `npm ${request.name}`;
+		case "release": return `github release ${request.repos.join("/")}`;
+		case "merge-pr": return `github pr ${request.repos.join("/")}`;
+		case "install-prompts": return `prompts ${request.repos.join("/") || "(unlisted project)"}`;
+		default: return `git ${request.repos.join("/")}`;
+	}
+}
+async function logGranted(ctx, dirs, scope, text, matches, summary) {
+	const first = matches[0];
+	try {
+		const written = await (ctx.write ?? hubWriter(dirs, ctx.env ?? process.env, { hook: true }))("ops.add", {
+			target: opsText(opsTarget(first.request)),
+			operation: opsText(text),
+			result: opsText(`授權放行 ${summary}`),
+			ref: scope.served[first.grant.owner]
+		});
+		for (const line of writtenLines(written)) if (line.startsWith("!")) ctx.warn?.(`mainflow grant check: ${line.slice(2)}`);
+	} catch (error) {
+		ctx.warn?.(`mainflow grant check: allowed by ${first.grant.ref} but could not write the ops log: ${error.message}`);
+	}
+}
+async function judge(input, ctx) {
+	if (!isObject(input)) return none("輸入不是 JSON 物件");
+	if (typeof input.tool !== "string" || input.tool.toLowerCase() !== "bash") return none("只判斷 Bash 呼叫");
+	const command = isObject(input.input) ? input.input.command : void 0;
+	if (typeof command !== "string") return none("input.command 不是字串");
+	const mark = compoundMark(command);
+	if (mark) return none(`指令含 ${mark}，只判斷單一指令`);
+	const { dirs } = ctx;
+	if (!dirs) return none("不在 mainflow hub 裡，沒有授權可用");
+	const format = hubFormatVersion(nodeStorage(dirs));
+	const mismatch = format === null ? null : formatMismatch(format);
+	if (mismatch) return none(`hub 的資料格式不符：${mismatch}`);
+	if (typeof input.sessionId !== "string" || !input.sessionId) return none("沒有字串的 sessionId");
+	if (typeof input.cwd !== "string" || !isAbsolute(input.cwd)) return none("cwd 不是絕對路徑");
+	const cwd = realPath(input.cwd);
+	if (!cwd) return none(`目錄 ${quote(input.cwd)} 不存在`);
+	let call;
+	try {
+		call = readCall(command);
+	} catch (error) {
+		if (error instanceof NotJudged) return none(error.message);
+		throw error;
+	}
+	const scoped = grantScope(dirs, readSession(dirs, sessionIdOf(dirs, input.sessionId)));
+	if (!scoped.ok) return none(scoped.reason);
+	if (![...scoped.scope.grants, ...scoped.scope.outOfScope.map((o) => o.grant)].some((g) => g.grant.action === call.action)) return none(`${Object.keys(scoped.scope.served).join("、")} 沒有 ${call.action} 的授權`);
+	const config = readYaml(join(dirs.data, "config.yaml"), configSchema).data;
+	const place = {
+		root: realPath(dirs.root) ?? dirs.root,
+		repos: repoPaths(config.repos),
+		cwd,
+		env: ctx.env ?? process.env,
+		prBase: ctx.prBase ?? defaultPrBase,
+		listUnits: ctx.listUnits ?? defaultListUnits
+	};
+	const resolved = resolveCall(call, command, place);
+	if (!resolved.ok) return none(resolved.reason);
+	const match = matchGrants(scoped.scope, resolved.requests);
+	if (!match.ok) return none(match.reason);
+	const refs = [...new Set(match.matches.map((m) => m.grant.ref))];
+	const summary = `${refs.join("、")}（${match.matches.map((m) => describeRequest(m.request)).join("、")}）`;
+	if (!ctx.dryRun) await logGranted(ctx, dirs, scoped.scope, resolved.text, match.matches, summary);
+	return {
+		decision: "allow",
+		reason: `授權 ${refs.join("、")} 涵蓋 ${match.matches.map((m) => describeRequest(m.request)).join("、")}`,
+		grant: refs[0],
+		...refs.length > 1 ? { grants: refs } : {}
+	};
+}
+/** Judge one call; any failure is `none`, so a caller that cannot be told otherwise keeps its own decision. */
+async function grantCheck(input, ctx) {
+	try {
+		return await judge(input, ctx);
+	} catch (error) {
+		return none(`判斷授權時出錯：${error.message}`);
+	}
+}
+/**
+* The hub grant check judges against: the one of $CLAUDE_PROJECT_DIR, then of the call's cwd, then of the current
+* directory, as the PreToolUse hook finds it, since a publish runs in a repository another hub may own.
+*/
+function hubOf(dirs, env) {
+	for (const dir of dirs) {
+		if (!dir || !isAbsolute(dir)) continue;
+		try {
+			const hub = resolveHub(dir, {
+				env,
+				waitForLock: false
+			});
+			if (hub) return hub;
+		} catch {}
+	}
+	return null;
+}
+/** `mainflow grant check`: read the call from stdin, print the verdict as one JSON line, exit 0. */
+async function runGrantCheck(cwd, dryRun) {
+	let text = "";
+	try {
+		text = readFileSync(0, "utf8");
+	} catch {}
+	const input = parsePayload(text);
+	const warnings = [];
+	const verdict = input ? await grantCheck(input, {
+		dirs: hubOf([
+			process.env.CLAUDE_PROJECT_DIR,
+			typeof input.cwd === "string" ? input.cwd : void 0,
+			cwd
+		], process.env),
+		dryRun,
+		warn: (m) => warnings.push(m)
+	}) : none("標準輸入不是單一 JSON 物件");
+	for (const line of warnings) console.error(line);
+	console.log(JSON.stringify(verdict));
+	return 0;
+}
+//#endregion
+export { grantCheck, runGrantCheck, shellWords };

package/dist/grant-commands.d.ts

@@ -1,7 +1,7 @@
-import "./index-BqPQp6TF.js";
+import "./index-l8QUG80k.js";
 //#region ../schema/dist/grants.d.ts
 /** An operation about to run, resolved to what a grant is written against. */
-type GrantRequest = {
+type GrantRequest = ({
   action: 'publish';
   name: string;
   version: string;
@@ -11,6 +11,24 @@ type GrantRequest = {
   action: 'release';
   repos: string[];
   tag: string;
+} |
+/** `branch` is the branch committed on, pushed to, or merged into; null on a detached HEAD */
+{
+  action: 'commit' | 'push' | 'merge-pr';
+  repos: string[];
+  branch: string | null;
+} |
+/**
+ * One request per unit the install writes; `repos` holds the config.yaml names of the repository the promptex project
+ * is in, for the ops log, and may be empty
+ */
+{
+  action: 'install-prompts';
+  unit: string;
+  repos: string[];
+}) & {
+  /** The directory the call works in, symbolic links resolved; a grant limited to paths covers the request only when it lies in them */
+  dir?: string;
 };
 //#endregion
 //#region src/grant-commands.d.ts
@@ -38,6 +56,7 @@ export type Scan = {
 };
 /** A git tag a release may create: no path separators, no `..`. */
 export declare const TAG: RegExp;
+export declare const OWNER_REPO: RegExp;
 /** Whether a Bash call is one this hook decides and, if so, whether it is in a fixed form. */
 export declare function scanCommand(command: string): Scan;
 export interface ResolveContext {
@@ -66,8 +85,17 @@ export declare function scopedCwd(cwd: unknown, root: string, repos: Record<stri
   ok: false;
   reason: string;
 };
+/**
+ * Read a file only when it is a regular file of at most MAX_MANIFEST bytes, following symlinks. It is opened
+ * without blocking and checked on the open descriptor, so a FIFO or a device such as /dev/zero is refused rather
+ * than waited on, and the file checked is the file read.
+ */
+export declare function readManifest(file: string): string | null;
 /** The origin remote of a checkout as github.com/owner/repo in lowercase, or null when it is not on github.com. */
 export declare function githubOrigin(dir: string): string | null;
-/** What a fixed-form call would publish or release; refused when the package or repository does not qualify. */
+/**
+ * What a fixed-form call would publish or release, with the directory it runs in for grants limited to paths; refused
+ * when the package or repository does not qualify.
+ */
 export declare function resolveFixed(call: Fixed, ctx: ResolveContext): Resolved;
 //#endregion

package/dist/grant-commands.js

@@ -1,4 +1,4 @@
-import { ut as GRANT_FORMS } from "./dist-D5rZ0MQH.js";
+import { ut as GRANT_FORMS } from "./dist-CXrUfRQp.js";
 import { closeSync, constants, fstatSync, openSync, readFileSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -237,9 +237,19 @@ function resolveRelease(call, ctx) {
 		}
 	};
 }
-/** What a fixed-form call would publish or release; refused when the package or repository does not qualify. */
+/**
+* What a fixed-form call would publish or release, with the directory it runs in for grants limited to paths; refused
+* when the package or repository does not qualify.
+*/
 function resolveFixed(call, ctx) {
-	return call.action === "publish" ? resolvePublish(ctx.cwd) : resolveRelease(call, ctx);
+	const resolved = call.action === "publish" ? resolvePublish(ctx.cwd) : resolveRelease(call, ctx);
+	return resolved.ok ? {
+		ok: true,
+		request: {
+			...resolved.request,
+			dir: ctx.cwd
+		}
+	} : resolved;
 }
 //#endregion
-export { TAG, githubOrigin, quote, resolveFixed, scanCommand, scopedCwd };
+export { OWNER_REPO, TAG, githubOrigin, quote, readManifest, resolveFixed, scanCommand, scopedCwd };

package/dist/hooks.d.ts

@@ -1,21 +1,5 @@
-import { a as Renumbering, i as Notice, n as OperationValue, o as HubDirs, r as OperationName, t as OperationInput } from "./index-DRpamPge.js";
-//#region src/remote/operation.d.ts
-/** What a write reports: the operation's value, and what its caller tells the user about it. */
-interface Written<N extends OperationName = OperationName> {
-  value: OperationValue<N>;
-  /** Waiting in the outbox, not yet answered by the sync server; new entries in `value` have provisional ids */
-  queued: boolean;
-  /** Why nothing sends the outbox for now: no sync client runs and none could be started */
-  stopped?: string;
-  /** Why a sync client was started although one was expected to run */
-  restarted?: string;
-  /** Provisional ids the server gave to other entries, so this write's entries got the ids after the arrow */
-  renumbered: Renumbering[];
-  /** What the operation said about the write although it went through, such as a file it kept */
-  notices: Notice[];
-}
-type HubWrite = <N extends OperationName>(op: N, input: OperationInput<N>) => Promise<Written<N>>;
-//#endregion
+import { o as HubDirs } from "./index-jq7lN8V8.js";
+import { t as HubWrite } from "./operation-BroV98VB.js";
 //#region src/hooks.d.ts
 /** Fields Claude Code sends on stdin to every command hook, plus the ones specific to the events handled here. */
 export interface ClaudeCodePayload {