paqad-ai 1.36.0 → 1.37.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # paqad-ai
 
+## 1.37.0
+
+### Minor Changes
+
+- 0d8b0db: Extend the enforcement record tier from Claude-only to Codex and Gemini, and document the honest cross-provider tier ladder (issue #265).
+
+  The stage writer and pre-edit block are Claude-only by physics (only Claude Code exposes a pre-mutation hook). But the _ledger_ half of the fix is portable to any host with a completion hook, so it now binds on Codex and Gemini too:
+
+  - **Codex / Gemini record their `paqad:stage` markers at turn end.** The record-only completion hook (`verification-record.mjs`, wired on Codex `Stop` and Gemini `AfterAgent`) now parses the agent's stage markers from the turn transcript and writes them to the same stage-evidence ledger the completion verify folds. Each row is attributed to the host that ran (`codex-cli` / `gemini-cli`), passed to the hook as an argv — never mislabelled `claude-code`. Codex reads its `transcript_path`; Gemini falls back to the inline `prompt_response` because its `transcript_path` is currently stubbed empty upstream ([google-gemini/gemini-cli#14715](https://github.com/google-gemini/gemini-cli/issues/14715)). The parser degrades gracefully to a raw-text scan when a transcript format is not the Claude JSONL shape.
+  - **Record-only, by design.** These hooks still always exit 0 and stay silent — there is **no in-chat verdict** on Codex/Gemini, because Codex rejects plain text on `Stop` and Gemini forces a retry on `decision: deny`, so the only non-disruptive channel is the ledger. The verdict is visible via the dashboard / SIEM export, never shoved into the chat.
+  - **No pre-edit block, stated plainly.** Codex/Gemini have no pre-mutation seam, so the hard block stays Claude-only. `docs/verification-enforcement.md` now carries a cross-provider guarantee table (hard block + verdict = Claude; record + ledger = Codex/Gemini; advisory = the 8 remaining hosts) and tracks the non-Claude hard block as a known, physics-bounded, upstream-blocked limitation.
+  - **The mandate holds:** enforcement is never added through an entry-file, prompt, or template edit. A parity test asserts the stage-writer and pre-mutation deny hooks are present for `claude-code` and absent for `codex-cli` / `gemini-cli` and every advisory host.
+
 ## 1.36.0
 
 ### Minor Changes

package/dist/cli/index.js

@@ -9754,8 +9754,9 @@ function hookCommand(hookFile, env = process.env) {
 function capabilityGateCommand(seam, env = process.env) {
   return `${hookCommand("capability-gate.mjs", env)} ${seam}`;
 }
-function completionRecordCommand(env = process.env) {
-  return hookCommand("verification-record.mjs", env);
+function completionRecordCommand(adapterType, env = process.env) {
+  const base = hookCommand("verification-record.mjs", env);
+  return adapterType ? `${base} ${adapterType}` : base;
 }
 var PAQAD_LIVE_HOOKS = [
   {
@@ -10840,22 +10841,20 @@ init_esm_shims();
 init_esm_shims();
 import { readFileSync as readFileSync6 } from "fs";
 import { join as join10 } from "pathe";
-var LEGACY_COMPLETION_COMMANDS = /* @__PURE__ */ new Set([
-  `${PAQAD_RUNTIME_PREFIX}/hooks/verification-record.mjs`
-]);
+var RECORD_HOOK_BASENAME = "verification-record.mjs";
+function isRecordHookCommand(command) {
+  return command.includes(RECORD_HOOK_BASENAME);
+}
 function buildNativeCompletionHookFile(options) {
-  const { projectRoot, settingsPath, completionEvent } = options;
-  const command = completionRecordCommand();
+  const { projectRoot, settingsPath, completionEvent, adapterType } = options;
+  const command = completionRecordCommand(adapterType);
   const existing = readJsonObject(join10(projectRoot, settingsPath));
   const hooks = existing.hooks && typeof existing.hooks === "object" && !Array.isArray(existing.hooks) ? existing.hooks : {};
   const eventGroups = (Array.isArray(hooks[completionEvent]) ? hooks[completionEvent] : []).map((group) => ({
     ...group,
-    hooks: (group?.hooks ?? []).filter((hook) => !LEGACY_COMPLETION_COMMANDS.has(hook.command))
+    hooks: (group?.hooks ?? []).filter((hook) => !isRecordHookCommand(hook.command))
   })).filter((group) => group.hooks.length > 0);
-  const alreadyPresent = eventGroups.some(
-    (group) => group?.hooks?.some((hook) => hook.command === command)
-  );
-  const nextGroups = alreadyPresent ? eventGroups : [...eventGroups, { hooks: [{ type: "command", command }] }];
+  const nextGroups = [...eventGroups, { hooks: [{ type: "command", command }] }];
   const next = {
     ...existing,
     hooks: { ...hooks, [completionEvent]: nextGroups }
@@ -10929,7 +10928,8 @@ var CodexCliAdapter = class extends BaseAdapter {
       buildNativeCompletionHookFile({
         projectRoot: context.projectRoot,
         settingsPath: CODEX_HOOKS_FILE,
-        completionEvent: CODEX_COMPLETION_EVENT
+        completionEvent: CODEX_COMPLETION_EVENT,
+        adapterType: this.type
       })
     ];
   }
@@ -11060,7 +11060,8 @@ var GeminiCliAdapter = class extends BaseAdapter {
       buildNativeCompletionHookFile({
         projectRoot: context.projectRoot,
         settingsPath: GEMINI_SETTINGS_FILE,
-        completionEvent: GEMINI_COMPLETION_EVENT
+        completionEvent: GEMINI_COMPLETION_EVENT,
+        adapterType: this.type
       })
     ];
   }
@@ -25640,7 +25641,7 @@ init_cancelled_error();
 init_events();
 
 // src/index.ts
-var VERSION = "1.36.0";
+var VERSION = "1.37.0";
 
 // src/cli/commands/audit.ts
 init_esm_shims();