peaks-loop 4.0.0-beta.3 → 4.0.0-beta.31

package/dist/src/cli/commands/final-review-commands.js

@@ -1,161 +0,0 @@
-/**
- * W5 Fix M2 — `peaks prepare-final-review <rid>` CLI wrapper.
- *
- * Exposes the `prepareFinalReview()` service (added in W2 T9 on
- * `feature/slice-topology-multipass`) via the CLI surface. The service
- * depends on an injected `LlmRunner`; this slice wires the CLI route
- * with a `stub` provider that returns a structured "scaffold ready"
- * envelope so CI can verify the route without a real LLM. A follow-up
- * slice will bind a real provider. Until then, non-stub providers fail
- * loudly with `LLM_PROVIDER_NOT_IMPLEMENTED` so callers cannot silently
- * no-op.
- *
- * Per the dev-preference "Default-no on new CLI commands" rule and the
- * W4 T14 spec, this is a NEW top-level command (`prepare-final-review`),
- * not a subcommand of `audit`. The two primitives are distinct:
- *   - `peaks audit goal`   — propose a 6-dim goal from a human need
- *   - `peaks prepare-final-review` — produce a 4-dim review evidence
- *                                  pack for human acceptance
- */
-import { existsSync, statSync } from 'node:fs';
-import { join, resolve } from 'node:path';
-import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
-import { fail, ok } from '../../shared/result.js';
-/** Whitelist of supported `--llm-provider` values for `peaks prepare-final-review`. */
-const SUPPORTED_LLM_PROVIDERS = ['stub'];
-function isSupportedLlmProvider(value) {
-    return SUPPORTED_LLM_PROVIDERS.includes(value);
-}
-/**
- * Empty placeholder used by `fail()` envelopes. `status` is
- * `'not-applicable'` on the error path so consumers can tell
- * "this is a placeholder on a failure" apart from "this is a real
- * scaffold-only success".
- */
-function emptyFinalReviewData(rid, sessionId, auditGoalPath) {
-    return {
-        status: 'not-applicable',
-        rid,
-        sessionId,
-        auditGoalPath,
-        serviceWired: false,
-        providerBinding: 'unknown',
-    };
-}
-function validateProjectRoot(projectArg) {
-    const projectRoot = resolve(projectArg);
-    if (!existsSync(projectRoot)) {
-        return {
-            ok: false,
-            code: 'PROJECT_NOT_FOUND',
-            message: `project path does not exist: ${projectArg}`,
-        };
-    }
-    let stat;
-    try {
-        stat = statSync(projectRoot);
-    }
-    catch (error) {
-        return { ok: false, code: 'INVALID_PROJECT', message: getErrorMessage(error) };
-    }
-    if (!stat.isDirectory()) {
-        return {
-            ok: false,
-            code: 'INVALID_PROJECT',
-            message: `project path is not a directory: ${projectArg}`,
-        };
-    }
-    return { ok: true, projectRoot };
-}
-/**
- * Validate the session id. Rejects empty, path-traversal (`..`), and
- * any segment separator (`/`, `\`) so the caller cannot escape
- * `.peaks/_runtime/<sessionId>/audit-goal/` via CLI flags.
- */
-function validateSessionId(sessionId) {
-    if (sessionId.length === 0) {
-        return {
-            ok: false,
-            code: 'MISSING_REQUIRED_FLAG',
-            message: '`--session-id` is required and must be a non-empty string',
-        };
-    }
-    if (sessionId.includes('..') || sessionId.includes('/') || sessionId.includes('\\')) {
-        return {
-            ok: false,
-            code: 'INVALID_SESSION_ID',
-            message: '`--session-id` must not contain path-traversal or path-separator characters (rejected: "..", "/", "\\")',
-        };
-    }
-    return { ok: true, sessionId };
-}
-export function registerFinalReviewCommands(program, io) {
-    addJsonOption(program
-        .command('prepare-final-review <rid>')
-        .description('Prepare the 4-dimension business review (final-review primitive) for human acceptance (W2 T9 service; CLI surface in W5 M2)')
-        .requiredOption('--project <path>', 'target project root')
-        .requiredOption('--session-id <sid>', 'session id whose .peaks/_runtime/<sid>/audit-goal/<rid>.json is the approved goal source')
-        .option('--llm-provider <name>', 'LLM provider name (default: stub)', 'stub')).action(async (rid, options) => {
-        // 1. Project root must exist and be a directory.
-        const projectValidation = validateProjectRoot(options.project);
-        if (!projectValidation.ok) {
-            printResult(io, fail('final-review.prepare', projectValidation.code, projectValidation.message, emptyFinalReviewData(rid, options.sessionId, ''), ['Verify the project path exists and is a directory']), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        // 2. Session id must be a safe single-segment string.
-        const sessionValidation = validateSessionId(options.sessionId);
-        if (!sessionValidation.ok) {
-            printResult(io, fail('final-review.prepare', sessionValidation.code, sessionValidation.message, emptyFinalReviewData(rid, options.sessionId, ''), [
-                'Pass a non-empty `--session-id` whose value is a single segment (no "..", "/", or "\\")',
-            ]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        // 3. Compute the audit-goal path the service WOULD read. We do this
-        //    in two places: the pre-flight existence check (here) and the
-        //    stub-path envelope (below). The service computes it identically
-        //    at `src/services/final-review/final-review-service.ts:45-52`.
-        const auditGoalPath = join(projectValidation.projectRoot, '.peaks', '_runtime', sessionValidation.sessionId, 'audit-goal', `${rid}.json`);
-        // 4. Pre-flight: if the audit-goal file is missing, surface a 404
-        //    BEFORE the stub/provider check so the caller learns the real
-        //    reason their request can't proceed.
-        if (!existsSync(auditGoalPath)) {
-            printResult(io, fail('final-review.prepare', 'AUDIT_GOAL_NOT_FOUND', `audit-goal file not found at expected path: ${auditGoalPath}`, emptyFinalReviewData(rid, sessionValidation.sessionId, auditGoalPath), [
-                'Run `peaks audit goal --project <path> --need <text>` first to produce the approved goal JSON.',
-                'Confirm `--session-id` matches the session that wrote the goal.',
-            ]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        // 5. Provider check: only `stub` is wired in this slice.
-        const provider = options.llmProvider ?? 'stub';
-        if (!isSupportedLlmProvider(provider)) {
-            printResult(io, fail('final-review.prepare', 'LLM_PROVIDER_NOT_IMPLEMENTED', `Provider '${provider}' is not yet wired. The CLI surface is in place; real provider binding is a follow-up slice. Use --llm-provider stub to validate the route without invoking the LLM.`, emptyFinalReviewData(rid, sessionValidation.sessionId, auditGoalPath), [
-                'Re-run with `--llm-provider stub` (default) to validate the route.',
-                'Real provider binding is tracked as a follow-up slice.',
-            ]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        // 6. Stub path: surface a structured "scaffold ready" envelope.
-        //    We DO NOT call the service in this slice — the service depends
-        //    on an injected `LlmRunner` interface, and no real provider is
-        //    bound yet. The envelope confirms the route is wired end-to-end
-        //    and reports the audit-goal path the service WOULD read.
-        const data = {
-            status: 'scaffold-only',
-            rid,
-            sessionId: sessionValidation.sessionId,
-            auditGoalPath,
-            serviceWired: true,
-            providerBinding: 'pending-follow-up-slice',
-        };
-        const envelope = ok('final-review.prepare', data, [], [
-            'prepareFinalReview() service is wired and reachable. The stub provider returns a scaffold envelope so CI can verify the route without a real LLM.',
-            `Audit-goal file is present at: ${auditGoalPath}`,
-            'A follow-up slice will bind a real LLM provider; until then, non-stub providers fail loudly with `LLM_PROVIDER_NOT_IMPLEMENTED`.',
-        ]);
-        printResult(io, envelope, options.json);
-    });
-}

package/dist/src/cli/commands/fixture-commands.js

@@ -1,91 +0,0 @@
-import { resolve } from 'node:path';
-import { captureDerivedVariant, captureHistoricalFixture, EDGE_CASE_VARIANTS, ENVELOPE_KINDS } from '../../services/fixture/index.js';
-import { addJsonOption, printResult } from '../cli-helpers.js';
-import { fail, ok } from '../../shared/result.js';
-function isEnvelopeKind(v) {
-    return ENVELOPE_KINDS.includes(v);
-}
-function isEdgeCaseVariant(v) {
-    return EDGE_CASE_VARIANTS.includes(v);
-}
-export function registerFixtureCommands(program, io) {
-    const fixture = program
-        .command('fixture')
-        .description('Fixture capture + replay support (v2.14.0 G1 anti-fake-green)');
-    addJsonOption(fixture
-        .command('capture')
-        .description('Capture a real envelope artifact as a replay fixture. Sanitizes secrets, computes SHA-256, writes fixture.meta.json.')
-        .option('--from-rid <rid>', 'historical rid to capture (requires --sid + --envelope)')
-        .option('--sid <sid>', 'session id under .peaks/_runtime/<sid>/', 'default')
-        .option('--envelope <kind>', `envelope kind: ${ENVELOPE_KINDS.join(' | ')}`)
-        .option('--variant-from <path>', 'parent fixture path (derived-variant mode)')
-        .option('--variant <edge-case>', `edge case: ${EDGE_CASE_VARIANTS.join(' | ')}`)
-        .option('--out <dir>', 'output dir', 'tests/fixtures/replay')
-        .option('--fixture-id <id>', 'override the fixtureId (auto-derived from rid/variant otherwise)')).action((options) => {
-        const out = resolve(process.cwd(), options.out ?? 'tests/fixtures/replay');
-        // Mode 1: derived-variant
-        if (options.variantFrom !== undefined || options.variant !== undefined) {
-            if (options.variantFrom === undefined || options.variant === undefined) {
-                printResult(io, fail('fixture.capture', 'VARIANT_ARGS_REQUIRED', '--variant-from and --variant must be supplied together', {}, ['Rerun with both --variant-from <path> --variant <edge-case>']), options.json);
-                process.exitCode = 1;
-                return;
-            }
-            if (!isEdgeCaseVariant(options.variant)) {
-                printResult(io, fail('fixture.capture', 'VARIANT_UNKNOWN', `unknown variant '${options.variant}'`, { knownVariants: EDGE_CASE_VARIANTS }, [`Use one of: ${EDGE_CASE_VARIANTS.join(', ')}`]), options.json);
-                process.exitCode = 1;
-                return;
-            }
-            const fixtureId = options.fixtureId
-                ?? deriveVariantFixtureId(options.variantFrom, options.variant);
-            try {
-                const captured = captureDerivedVariant({
-                    mode: 'derived-variant',
-                    parentFixturePath: resolve(process.cwd(), options.variantFrom),
-                    variant: options.variant,
-                    fixtureId,
-                    outDir: out
-                });
-                printResult(io, ok('fixture.capture', { mode: 'derived-variant', ...captured }), options.json);
-            }
-            catch (err) {
-                printResult(io, fail('fixture.capture', 'CAPTURE_FAILED', err instanceof Error ? err.message : String(err), {}, ['Verify the parent fixture path exists']), options.json);
-                process.exitCode = 1;
-            }
-            return;
-        }
-        // Mode 2: historical
-        if (options.fromRid === undefined || options.envelope === undefined) {
-            printResult(io, fail('fixture.capture', 'CAPTURE_ARGS_REQUIRED', 'Either --variant-from/--variant OR --from-rid/--envelope must be supplied', { envelopeKinds: ENVELOPE_KINDS, edgeCases: EDGE_CASE_VARIANTS }, ['Rerun with --from-rid <rid> --envelope <kind>', 'OR --variant-from <path> --variant <edge-case>']), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        if (!isEnvelopeKind(options.envelope)) {
-            printResult(io, fail('fixture.capture', 'ENVELOPE_UNKNOWN', `unknown envelope kind '${options.envelope}'`, { knownKinds: ENVELOPE_KINDS }, [`Use one of: ${ENVELOPE_KINDS.join(', ')}`]), options.json);
-            process.exitCode = 1;
-            return;
-        }
-        const fixtureId = options.fixtureId ?? deriveHistoricalFixtureId(options.fromRid, options.envelope);
-        try {
-            const captured = captureHistoricalFixture({
-                mode: 'historical',
-                sessionId: options.sid ?? 'default',
-                envelopeKind: options.envelope,
-                fixtureId,
-                outDir: out,
-                requireSource: true
-            });
-            printResult(io, ok('fixture.capture', { mode: 'historical', ...captured }), options.json);
-        }
-        catch (err) {
-            printResult(io, fail('fixture.capture', 'CAPTURE_FAILED', err instanceof Error ? err.message : String(err), {}, ['Verify --sid / --envelope point to an existing session artifact']), options.json);
-            process.exitCode = 1;
-        }
-    });
-}
-function deriveHistoricalFixtureId(rid, envelope) {
-    return `${rid}-${envelope}`.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 80);
-}
-function deriveVariantFixtureId(parentPath, variant) {
-    const base = parentPath.replace(/\.(md|json)$/, '').split(/[/\\]/).pop() ?? 'parent';
-    return `${base}--${variant}`.toLowerCase().replace(/[^a-z0-9-]+/g, '-').slice(0, 80);
-}

package/dist/src/cli/commands/fork-commands.js

@@ -1,163 +0,0 @@
-/**
- * v2.15.0 follow-up — G11: fork sync CLI.
- *
- *   - `peaks fork status`               — show baseline + drift + last sync
- *   - `peaks fork upstream-check`       — recommend next stable tag
- *   - `peaks fork sync-plan`            — generate a sync plan
- *   - `peaks fork sync`                 — record a sync execution
- *   - `peaks fork sync-verify`          — mark a sync as verified / failed
- *
- * All 5 commands are pure local reads/writes against
- * `.peaks/fork-state.json`. The actual git fetch + merge is out of
- * scope for this slice (deferred to 2.15.x).
- */
-import { findProjectRoot } from '../../services/config/config-safety.js';
-import { appendSyncRecord, buildForkStatusReport, makeSyncId, readForkState, recommendStableTags, updateSyncRecordStatus, writeForkState } from '../../services/fork/fork-sync-state.js';
-import { fail, ok } from '../../shared/result.js';
-import { addJsonOption, printResult } from '../cli-helpers.js';
-export function registerForkCommands(program, io) {
-    const fork = program
-        .command('fork')
-        .description('v2.15.0 follow-up G11: manage upstream tag sync for forked projects (hermes-style).');
-    // 1. status
-    addJsonOption(fork
-        .command('status')
-        .description('Show the current fork baseline (upstream + tag + drift) and the most recent sync. ' +
-        'Pure read of `.peaks/fork-state.json`.')
-        .option('--project <path>', 'project root (default: cwd)')).action((opts) => {
-        const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        const state = readForkState(projectRoot);
-        const report = buildForkStatusReport(state);
-        printResult(io, ok('fork.status', { projectRoot, report: serializeReport(report) }, [], [
-            report.driftWarning
-                ? 'Drift exceeds 30 commits — consider `peaks fork upstream-check` to plan a sync.'
-                : 'No sync action recommended at this time.'
-        ]), opts.json ?? false);
-    });
-    // 2. upstream-check
-    addJsonOption(fork
-        .command('upstream-check')
-        .description('Recommend stable upstream tags to sync to, given a list of available tags. ' +
-        '`--tags` is a comma-separated list; pre-release tags (alpha/beta/rc/dev/preview) are filtered out. ' +
-        'Returns the list of stable tags newer than the current baseline.')
-        .requiredOption('--tags <list>', 'comma-separated list of available upstream tags')
-        .option('--project <path>', 'project root (default: cwd)')).action((opts) => {
-        const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        const availableTags = opts.tags.split(',').map((s) => s.trim()).filter((s) => s.length > 0);
-        const state = readForkState(projectRoot);
-        const baselineTag = state.baseline?.basedOn ?? null;
-        const recommended = recommendStableTags(availableTags, baselineTag);
-        printResult(io, ok('fork.upstream-check', {
-            projectRoot,
-            currentBaseline: baselineTag,
-            totalAvailableTags: availableTags.length,
-            recommendedTags: recommended,
-            nextRecommended: recommended[0] ?? null
-        }, [], [
-            recommended.length === 0
-                ? 'No stable tags newer than the current baseline.'
-                : `Recommended next sync target: ${recommended[0]}`
-        ]), opts.json ?? false);
-    });
-    // 3. sync-plan
-    addJsonOption(fork
-        .command('sync-plan')
-        .description('Generate a sync plan for the given upstream tag. Records the plan in `.peaks/fork-state.json`. ' +
-        'Returns the plan id used to invoke `peaks fork sync`. Pure local write; no git operations.')
-        .requiredOption('--upstream <tag>', 'target upstream tag (e.g. v1.20.0)')
-        .option('--conflicts <list>', 'comma-separated predicted conflict file globs')
-        .option('--patches <list>', 'comma-separated business patch identifiers to replay')
-        .option('--project <path>', 'project root (default: cwd)')).action((opts) => {
-        const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        const state = readForkState(projectRoot);
-        const syncId = makeSyncId(opts.upstream);
-        const conflicts = opts.conflicts ? opts.conflicts.split(',').map((s) => s.trim()).filter((s) => s.length > 0) : [];
-        const patches = opts.patches ? opts.patches.split(',').map((s) => s.trim()).filter((s) => s.length > 0) : [];
-        const record = {
-            syncId,
-            targetTag: opts.upstream,
-            plannedAt: new Date().toISOString(),
-            predictedConflicts: conflicts,
-            businessPatches: patches,
-            status: 'planned'
-        };
-        const next = appendSyncRecord(state, record);
-        writeForkState(projectRoot, next);
-        printResult(io, ok('fork.sync-plan', { projectRoot, syncId, record }, [], [
-            `Run \`peaks fork sync --sync-id ${syncId}\` to mark execution start.`,
-            `Run \`peaks fork sync-verify --sync-id ${syncId} --status verified\` after the sync completes.`
-        ]), opts.json ?? false);
-    });
-    // 4. sync (mark execution)
-    addJsonOption(fork
-        .command('sync')
-        .description('Mark a planned sync as in-progress. Records the execution start. ' +
-        'This slice does NOT perform the actual git fetch + merge — the LLM / operator runs those, ' +
-        'then calls `sync-verify` to record the result.')
-        .requiredOption('--sync-id <id>', 'sync plan id from `peaks fork sync-plan`')
-        .option('--project <path>', 'project root (default: cwd)')).action((opts) => {
-        const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        const state = readForkState(projectRoot);
-        const target = state.history.find((r) => r.syncId === opts.syncId);
-        if (!target) {
-            printResult(io, fail('fork.sync', 'NOT_FOUND', `sync id "${opts.syncId}" not found in fork-state.json`, { projectRoot }, [
-                'Run `peaks fork sync-plan` first to generate a plan.'
-            ]), opts.json ?? false);
-            return;
-        }
-        const next = updateSyncRecordStatus(state, opts.syncId, 'in-progress');
-        writeForkState(projectRoot, next);
-        printResult(io, ok('fork.sync', { projectRoot, syncId: opts.syncId, status: 'in-progress', targetTag: target.targetTag }, [], [
-            'Now run the actual git fetch + merge, then call `peaks fork sync-verify` to record the result.'
-        ]), opts.json ?? false);
-    });
-    // 5. sync-verify
-    addJsonOption(fork
-        .command('sync-verify')
-        .description('Mark a sync as verified (success) or failed. Optionally records verification notes. ' +
-        'On success, the current baseline is also updated to the synced tag.')
-        .requiredOption('--sync-id <id>', 'sync plan id')
-        .requiredOption('--status <verified|failed>', 'sync verification outcome')
-        .option('--notes <text>', 'optional verification notes')
-        .option('--project <path>', 'project root (default: cwd)')).action((opts) => {
-        if (opts.status !== 'verified' && opts.status !== 'failed') {
-            printResult(io, fail('fork.sync-verify', 'INVALID_STATUS', `status must be "verified" or "failed" (got "${opts.status}")`, { projectRoot: opts.project ?? '' }, [
-                'Pass --status verified on success, --status failed on failure.'
-            ]), opts.json ?? false);
-            return;
-        }
-        const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        const state = readForkState(projectRoot);
-        const target = state.history.find((r) => r.syncId === opts.syncId);
-        if (!target) {
-            printResult(io, fail('fork.sync-verify', 'NOT_FOUND', `sync id "${opts.syncId}" not found`, { projectRoot }, []), opts.json ?? false);
-            return;
-        }
-        let next = updateSyncRecordStatus(state, opts.syncId, opts.status, opts.notes);
-        if (opts.status === 'verified') {
-            const baseline = {
-                upstream: state.baseline?.upstream ?? 'unknown',
-                basedOn: target.targetTag,
-                recordedAt: new Date().toISOString(),
-                commitsAhead: 0,
-                filesChanged: 0
-            };
-            next = { ...next, baseline };
-        }
-        writeForkState(projectRoot, next);
-        printResult(io, ok('fork.sync-verify', {
-            projectRoot,
-            syncId: opts.syncId,
-            status: opts.status,
-            notes: opts.notes ?? null,
-            newBaseline: next.baseline
-        }, [], [
-            opts.status === 'verified'
-                ? 'Baseline updated to the synced tag.'
-                : 'Sync marked as failed. Re-run `peaks fork sync-plan` to retry.'
-        ]), opts.json ?? false);
-    });
-}
-function serializeReport(r) {
-    return r;
-}

package/dist/src/cli/commands/gate-commands.js

@@ -1,117 +0,0 @@
-import { enforceBashCommand, recordGateBypass, GateBypassError } from '../../services/sop/gate-enforce-service.js';
-import { fail, ok } from '../../shared/result.js';
-import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
-import { detectIdeFromContext, parseClaudeShapeStdin } from '../../services/ide/hook-translator.js';
-import { getAdapter } from '../../services/ide/ide-registry.js';
-import { emitBlock, emitHint } from '../../services/hooks/output.js';
-/**
- * Read the PreToolUse hook payload. `PEAKS_HOOK_STDIN` is a test seam; production
- * reads stdin. The CLI-side stdin reader is intentionally kept here (not in
- * `hook-translator.ts`) because it owns the `process.stdin` lifecycle and the
- * test-seam env var. The translator operates on already-parsed payloads.
- */
-async function readHookPayload() {
-    const override = process.env.PEAKS_HOOK_STDIN;
-    if (override !== undefined) {
-        return override;
-    }
-    if (process.stdin.isTTY) {
-        return '';
-    }
-    return new Promise((resolveStdin) => {
-        let data = '';
-        process.stdin.setEncoding('utf8');
-        process.stdin.on('data', (chunk) => {
-            data += chunk;
-        });
-        process.stdin.on('end', () => resolveStdin(data));
-        process.stdin.on('error', () => resolveStdin(data));
-    });
-}
-export function registerGateCommands(program, io) {
-    const gate = program.command('gate').description('SOP gate enforcement (PreToolUse hook handler and bypass)');
-    addJsonOption(gate
-        .command('enforce')
-        .description('PreToolUse hook handler: deny a Bash command guarded by an unsatisfied SOP gate')
-        .option('--project <path>', 'project the gates evaluate against (default: current directory)', '.')).action(async (options) => {
-        // Trust red line: this runs on (potentially) every Bash call. Any failure to
-        // decide must FAIL-OPEN (allow), never block the user's Claude Code.
-        try {
-            const raw = await readHookPayload();
-            let parsedStdin = null;
-            if (raw.trim().length > 0) {
-                try {
-                    parsedStdin = JSON.parse(raw);
-                }
-                catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-                    // Malformed JSON — fail-open. Detect + parse on null fall back to the
-                    // default adapter and yield empty tool/command, which short-circuits
-                    // to the "not a guarded surface" early exit below.
-                }
-            }
-            const ide = detectIdeFromContext({ env: process.env, cwd: process.cwd(), parsedStdin });
-            const adapter = getAdapter(ide);
-            // For slice #1 only the Claude adapter is registered, so the parser is
-            // Claude-shaped. Future slices dispatch on `ide` to pick a per-adapter
-            // parser; the parser entry-point (`parseXxxShapeStdin`) is the only
-            // change required.
-            const { toolName, command } = parseClaudeShapeStdin(parsedStdin);
-            if (toolName !== adapter.toolMatcher || typeof command !== 'string' || command.trim().length === 0) {
-                // Not a guarded surface — allow (no output = normal permission flow).
-                if (options.json === true) {
-                    printResult(io, ok('gate.enforce', { decision: 'allow', skipped: true }), true);
-                }
-                return;
-            }
-            const decision = await enforceBashCommand(options.project, command);
-            if (decision.decision === 'deny') {
-                // PRD#2 (2026-06-16-fact-forcing-gate-format): a true SOP gate failure is
-                // a HARD block. emitBlock writes the Claude Code permissionDecision:"deny"
-                // JSON to stdout (the hook's decision signal), sets process.exitCode = 2
-                // (Claude Code's block exit code), AND surfaces the reason to stderr so
-                // the LLM sees it on the next turn. This prevents the previous behaviour
-                // where Claude Code wrapped the output as "PreToolUse:Bash hook error".
-                emitBlock(io, decision.reason);
-                if (options.json === true) {
-                    emitHint(io, JSON.stringify(ok('gate.enforce', decision)));
-                }
-                return;
-            }
-            if (decision.warnings && decision.warnings.length > 0) {
-                for (const warning of decision.warnings) {
-                    emitHint(io, warning);
-                }
-            }
-            if (options.json === true) {
-                emitHint(io, JSON.stringify(ok('gate.enforce', decision)));
-            }
-            // allow: emit nothing on stdout → normal permission flow.
-        }
-        catch (error) {
-            // Fail-open: a bug in enforcement must not brick Claude Code.
-            emitHint(io, `gate enforce: internal error, allowing command (${getErrorMessage(error)})`);
-        }
-    });
-    addJsonOption(gate
-        .command('bypass')
-        .description('Record a one-shot bypass so the next guarded Bash command is allowed once')
-        .requiredOption('--sop <id>', 'SOP id whose guard to bypass')
-        .requiredOption('--phase <phase>', 'phase whose gate to bypass')
-        .requiredOption('--reason <text>', 'justification recorded for the bypass')
-        .option('--project <path>', 'project whose run-state holds the token (default: current directory)', '.')).action((options) => {
-        try {
-            if (options.reason.trim().length === 0) {
-                printResult(io, fail('gate.bypass', 'BYPASS_REASON_REQUIRED', '--reason must not be empty', { sop: options.sop, phase: options.phase }, ['Provide --reason "<why>"']), options.json);
-                process.exitCode = 1;
-                return;
-            }
-            const result = recordGateBypass(options.project, options.sop, options.phase, options.reason);
-            printResult(io, ok('gate.bypass', { sop: options.sop, phase: options.phase, count: result.count }, [], ['The next guarded Bash command for this transition will be allowed once']), options.json);
-        }
-        catch (error) {
-            const code = error instanceof GateBypassError ? error.code : 'GATE_BYPASS_FAILED';
-            printResult(io, fail('gate.bypass', code, getErrorMessage(error), { sop: options.sop, phase: options.phase }, ['Satisfy the gate instead of bypassing']), options.json);
-            process.exitCode = 1;
-        }
-    });
-}