qfai 2.1.1 → 2.2.0

package/dist/graph/hook.cjs

@@ -0,0 +1,817 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cli/graphHook.ts
+var graphHook_exports = {};
+__export(graphHook_exports, {
+  runInstalledGraphHook: () => runInstalledGraphHook
+});
+module.exports = __toCommonJS(graphHook_exports);
+var import_node_fs3 = require("fs");
+var import_node_path16 = __toESM(require("path"), 1);
+
+// src/core/init/fsGuards.ts
+var import_node_fs = require("fs");
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+
+// src/core/fs/errno.ts
+function isEnoent(err) {
+  return hasErrnoCode(err) && err.code === "ENOENT";
+}
+function hasErrnoCode(err) {
+  return err !== null && typeof err === "object" && "code" in err && typeof err.code === "string";
+}
+
+// src/core/init/fsGuards.ts
+async function readPinnedRegularFile(filePath, maxBytes) {
+  let handle;
+  try {
+    handle = await (0, import_promises.open)(filePath, OPEN_READ_FLAGS);
+    const pinned = await handle.stat();
+    if (!pinned.isFile() || pinned.size > maxBytes) {
+      return null;
+    }
+    const buffer = Buffer.alloc(maxBytes + 1);
+    let filled = 0;
+    while (filled < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, filled);
+      if (bytesRead === 0) break;
+      filled += bytesRead;
+    }
+    if (filled > maxBytes) return null;
+    return buffer.subarray(0, filled).toString("utf-8");
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENXIO" || code === "EISDIR") return null;
+    throw error;
+  } finally {
+    await handle?.close();
+  }
+}
+async function readPinnedRegularFileBytes(filePath, maxBytes) {
+  let handle;
+  try {
+    handle = await (0, import_promises.open)(filePath, OPEN_READ_FLAGS);
+    const pinned = await handle.stat();
+    if (!pinned.isFile() || pinned.size > maxBytes) return null;
+    const buffer = Buffer.alloc(maxBytes + 1);
+    let filled = 0;
+    while (filled < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, filled);
+      if (bytesRead === 0) break;
+      filled += bytesRead;
+    }
+    if (filled > maxBytes) return null;
+    return {
+      content: Buffer.from(buffer.subarray(0, filled)),
+      mode: pinned.mode & 4095,
+      uid: pinned.uid,
+      gid: pinned.gid,
+      dev: pinned.dev,
+      ino: pinned.ino
+    };
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENXIO" || code === "EISDIR") return null;
+    throw error;
+  } finally {
+    await handle?.close();
+  }
+}
+var OPEN_READ_FLAGS = typeof import_node_fs.constants.O_NONBLOCK === "number" ? import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NONBLOCK : import_node_fs.constants.O_RDONLY;
+async function safeLstat(target) {
+  try {
+    return await (0, import_promises.lstat)(target);
+  } catch {
+    return void 0;
+  }
+}
+async function findUnsafeWrapperComponent(destRoot, relativeDir) {
+  const segments = relativeDir.split("/");
+  for (let depth = 1; depth <= segments.length; depth += 1) {
+    const relativePath = segments.slice(0, depth).join("/");
+    const stats = await safeLstat(import_node_path.default.join(destRoot, ...segments.slice(0, depth)));
+    if (stats === void 0) {
+      return void 0;
+    }
+    if (stats.isSymbolicLink()) {
+      return { relativePath, symlink: true };
+    }
+    if (!stats.isDirectory()) {
+      return { relativePath, symlink: false };
+    }
+  }
+  return void 0;
+}
+async function findUnsafeHostFileComponent(destRoot, segments) {
+  const parent = segments.slice(0, -1).join("/");
+  const unsafeParent = parent === "" ? void 0 : await findUnsafeWrapperComponent(destRoot, parent);
+  if (unsafeParent !== void 0) {
+    return unsafeParent;
+  }
+  const leaf = await safeLstat(import_node_path.default.join(destRoot, ...segments));
+  return leaf?.isSymbolicLink() === true ? { relativePath: segments.join("/"), symlink: true } : void 0;
+}
+
+// src/core/graph/hooks.ts
+function classifyGraphExploration(event, authorize = (decision) => decision) {
+  if (event.tool === "write_stdin") return outsideBoundary();
+  if (["rg", "grep", "grep_search", "search_files", "file_search"].includes(event.tool.toLowerCase())) {
+    return authorize(denyExploration(event.tool, event.path ?? "."));
+  }
+  const shell = /(?:^|[\\/])(?:pwsh|powershell)(?:\.exe)?$/i.test(event.shell ?? "") || event.tool.toLowerCase() === "powershell" || event.tool === "exec_command" && !event.shell && process.platform === "win32" ? "powershell" : /(?:^|[\\/])cmd(?:\.exe)?$/i.test(event.shell ?? "") ? "cmd" : "posix";
+  const commands = shellPipelines(event.command ?? "", shell);
+  if (!commands) return failedGraphHook();
+  return classifyCommands(commands, authorize) ?? {
+    decision: "allow",
+    state: "configured",
+    message: "No direct exploration was classified."
+  };
+}
+function classifyCommands(commands, authorize, depth = 0) {
+  const changesDirectory = commands.some(changesGraphDirectory);
+  const scopedAuthorization = changesDirectory ? (decision) => graphFallbackUnavailable(
+    decision,
+    "The command changes its working directory.",
+    "Run a single search from this project worktree, then retry the denied action."
+  ) : authorize;
+  let boundary;
+  let allowed;
+  for (const words of commands) {
+    const decision = classifyCommand(words, scopedAuthorization, depth);
+    if (decision?.decision === "deny") return decision;
+    if (decision?.state === "outside-boundary") boundary = decision;
+    else if (decision) allowed = decision;
+  }
+  return boundary ?? allowed;
+}
+function changesGraphDirectory(words) {
+  let offset = 0;
+  while (offset < words.length) {
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[offset] ?? "")) {
+      offset += 1;
+      continue;
+    }
+    if (!["command", "builtin", "env"].includes(words[offset]?.toLowerCase() ?? "")) break;
+    offset += 1;
+    if (words[offset] === "-v" || words[offset] === "-V") return false;
+    while (words[offset]?.startsWith("-")) offset += 1;
+  }
+  return ["cd", "chdir", "pushd", "popd", "set-location", "sl"].includes(
+    words[offset]?.toLowerCase() ?? ""
+  );
+}
+function classifyCommand(words, authorize, depth = 0) {
+  if (depth > 16) return failedGraphHook();
+  let offset = 0;
+  while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[offset] ?? "")) offset += 1;
+  if (offset > 0) return classifyCommand(words.slice(offset), authorize, depth + 1);
+  const operation = words[0]?.split(/[\\/]/).at(-1)?.replace(/\.exe$/i, "").toLowerCase();
+  if (operation === "env" || operation === "command" || operation === "builtin") {
+    let offset2 = 1;
+    while (words[offset2]?.startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[offset2] ?? "")) {
+      offset2 += 1;
+    }
+    return classifyCommand(words.slice(offset2), authorize, depth + 1);
+  }
+  if (["bash", "sh", "zsh", "pwsh", "powershell", "cmd"].includes(operation ?? "")) {
+    const switchIndex = words.findIndex((word) => /^(?:-[a-z]*c|\/c|-command)$/i.test(word));
+    const inner = switchIndex >= 0 ? words[switchIndex + 1] : void 0;
+    if (!inner) return outsideBoundary();
+    const shell = operation === "pwsh" || operation === "powershell" ? "powershell" : operation === "cmd" ? "cmd" : "posix";
+    const commands = shellPipelines(inner, shell);
+    return commands ? classifyCommands(commands, authorize, depth + 1) : failedGraphHook();
+  }
+  if (operation === "rg" || operation === "grep" || operation === "findstr") {
+    let offset2 = 1;
+    while (/^(?:-[RrinlIHsvwxcFoq]+|--(?:hidden|line-number|ignore-case|fixed-strings|recursive)|\/[SIMOPVNLR]+)$/i.test(
+      words[offset2] ?? ""
+    ))
+      offset2 += 1;
+    if (words[offset2] === "--") offset2 += 1;
+    const positional = words.slice(offset2);
+    const eligible = positional.length > 0 && positional.length <= 2 && !positional.some((word) => word.startsWith("-") || /[$%`<>]/.test(word));
+    const target = eligible ? positional[1] ?? "." : JSON.stringify(positional);
+    return authorize({ ...denyExploration(operation, target), exceptionEligible: eligible });
+  }
+  let gitCommand = 1;
+  if (operation === "git") {
+    while (words[gitCommand]?.startsWith("-")) {
+      const option = words[gitCommand];
+      gitCommand += ["-C", "-c", "--git-dir", "--work-tree"].includes(option ?? "") ? 2 : 1;
+    }
+  }
+  if (operation === "git" && words[gitCommand]?.toLowerCase() === "grep") {
+    const paths = words.indexOf("--");
+    const targets = paths >= 0 ? words.slice(paths + 1) : [];
+    const eligible = gitCommand === 1 && targets.length <= 1 && (paths >= 0 || words.length === 3) && !targets.some((word) => /[$%`<>]/.test(word));
+    return authorize({
+      ...denyExploration(
+        "git grep",
+        eligible ? targets[0] ?? "." : JSON.stringify(words.slice(1))
+      ),
+      exceptionEligible: eligible
+    });
+  }
+  if (operation === "select-string") {
+    const path17 = words.findIndex((word) => /^-(?:literalpath|path)$/i.test(word));
+    const targets = [];
+    for (let offset2 = path17 + 1; path17 >= 0 && offset2 < words.length; offset2 += 1) {
+      const word = words[offset2];
+      if (word === void 0 || word.startsWith("-")) break;
+      targets.push(word);
+    }
+    const eligible = targets.length === 1 && !targets.some((word) => /[,$%`<>]/.test(word));
+    return authorize({
+      ...denyExploration("Select-String", eligible ? targets[0] ?? "." : JSON.stringify(targets)),
+      exceptionEligible: eligible
+    });
+  }
+  if (!operation || [
+    "echo",
+    "printf",
+    "write-output",
+    "cat",
+    "get-content",
+    "pnpm",
+    "npm",
+    "npx",
+    "corepack",
+    "node",
+    "nodejs",
+    "python",
+    "python3",
+    "uv",
+    "git",
+    "pwd",
+    "get-location",
+    "ls",
+    "dir",
+    "sort"
+  ].includes(operation)) {
+    return void 0;
+  }
+  return outsideBoundary();
+}
+function outsideBoundary() {
+  return {
+    decision: "allow",
+    state: "outside-boundary",
+    message: "Search inside scripts, aliases or continuing input is not verified by this pre-tool boundary."
+  };
+}
+function shellPipelines(command, shell) {
+  const commands = [];
+  let words = [];
+  let word = "";
+  let quote;
+  const flushWord = () => {
+    if (word.length) words.push(word);
+    word = "";
+  };
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    if (character === void 0) continue;
+    const next = command[index + 1];
+    const escaped = next !== void 0 && (shell === "posix" && character === "\\" && (!quote || quote === '"' && ['"', "\\", "$", "`", "\n"].includes(next)) || shell === "powershell" && character === "`" && quote !== "'" || shell === "cmd" && character === "^" && !quote);
+    if (escaped) {
+      if (next !== "\n") word += next;
+      index += 1;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = void 0;
+      else word += character;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+    } else if (character === "|" || character === ";" || character === "&" || character === "\n") {
+      flushWord();
+      if (words.length) commands.push(words);
+      words = [];
+    } else if (/\s/.test(character)) {
+      flushWord();
+    } else {
+      word += character;
+    }
+  }
+  if (quote) return void 0;
+  flushWord();
+  if (words.length) commands.push(words);
+  return commands;
+}
+function denyExploration(operation, target) {
+  const domain = /(?:^|[\\/])(?:docs?|spec|adr|requirements)(?:[\\/]|$)|\.md$/i.test(target) ? "documents" : "code";
+  return {
+    decision: "deny",
+    state: "configured",
+    operation,
+    target,
+    domain,
+    message: `Exploration redirected: ${operation} over ${JSON.stringify(target)} was denied. Use ${domain === "code" ? 'CodeGraph for symbols, callers and change impact: node .qfai/tools/graph-cli.mjs code "<question>"' : 'Graphify for document concepts and rationale: node .qfai/tools/graph-cli.mjs documents "<question>"'}. Prepare the required analysis through the CLI. For AI-decided scoped search, run node .qfai/tools/graph-cli.mjs fallback --attempt-id <observed-UUID> --question "<unresolved question>" --reason "<graph limitation>". The fallback command attempts the relevant graph before granting a matching search. Human approval is not required for this search.`
+  };
+}
+function graphFallbackUnavailable(decision, cause, recovery) {
+  return {
+    ...decision,
+    exceptionEligible: false,
+    fallbackUnavailable: true,
+    message: `Exploration redirected: ${decision.operation ?? "search"} was denied. Search fallback unavailable: ${cause} ${recovery} Use node .qfai/tools/graph-cli.mjs ${decision.domain === "documents" ? "documents" : "code"} "<question>" for graph exploration.`
+  };
+}
+function decodeGraphHookEvent(input) {
+  if (!object(input)) return void 0;
+  const snake = ["tool_name", "tool_input", "session_id"].some((key) => key in input);
+  const camel = ["toolName", "toolArgs", "sessionId"].some((key) => key in input);
+  if (snake && camel) return void 0;
+  const tool = input.tool_name ?? input.toolName;
+  let payload = input.tool_input ?? input.toolArgs;
+  if (typeof payload === "string") {
+    try {
+      payload = JSON.parse(payload);
+    } catch {
+      return void 0;
+    }
+  }
+  if (typeof tool !== "string" || !tool.trim() || !object(payload)) return void 0;
+  const session = input.session_id ?? input.sessionId;
+  if (session !== void 0 && (typeof session !== "string" || !session.trim()) || input.session_id !== void 0 && input.sessionId !== void 0 && input.session_id !== input.sessionId)
+    return void 0;
+  const command = payload.command ?? payload.cmd;
+  const target = payload.path ?? payload.includePattern;
+  const workdir = payload.workdir;
+  const shell = payload.shell;
+  if (target !== void 0 && (typeof target !== "string" || !target.trim())) return void 0;
+  if (workdir !== void 0 && (typeof workdir !== "string" || !workdir.trim())) return void 0;
+  if (shell !== void 0 && (typeof shell !== "string" || !shell.trim())) return void 0;
+  if (["bash", "powershell", "exec_command"].includes(tool.toLowerCase()) && typeof command !== "string")
+    return void 0;
+  return {
+    tool,
+    ...typeof command === "string" ? { command } : {},
+    ...typeof target === "string" ? { path: target } : {},
+    ...typeof workdir === "string" ? { workdir } : {},
+    ...typeof shell === "string" ? { shell } : {},
+    ...typeof input.cwd === "string" ? { cwd: input.cwd } : {},
+    ...typeof session === "string" ? { session } : {}
+  };
+}
+function failedGraphHook() {
+  return {
+    decision: "deny",
+    state: "failed",
+    message: "Graph protection failed: invalid pre-tool input. Repair hook configuration before direct exploration."
+  };
+}
+function enforceGraphExploration(input, configuration) {
+  if (!object(configuration) || Object.keys(configuration).length !== 2 || configuration.kind !== "graph-enforcement" || configuration.denyExploration !== true)
+    return failedGraphHook();
+  const event = decodeGraphHookEvent(input);
+  return event ? classifyGraphExploration(event) : failedGraphHook();
+}
+function graphHookOutput(host, decision) {
+  if (decision.decision === "allow") return {};
+  return host === "copilot" ? { permissionDecision: "deny", permissionDecisionReason: decision.message } : {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: decision.message
+    }
+  };
+}
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/graph/fallbackState.ts
+var import_node_crypto7 = require("crypto");
+var import_promises13 = require("fs/promises");
+var import_node_path15 = __toESM(require("path"), 1);
+
+// src/core/graph/locks.ts
+var import_node_crypto2 = require("crypto");
+var import_promises4 = require("fs/promises");
+var import_node_path5 = __toESM(require("path"), 1);
+
+// src/core/graph/layout.ts
+var import_node_path2 = __toESM(require("path"), 1);
+function graphExecutionEnvironment() {
+  return { platform: process.platform, architecture: process.arch };
+}
+function graphEnvironmentKey(environment = graphExecutionEnvironment()) {
+  if (!/^[a-z0-9]+$/i.test(environment.platform) || !/^[a-z0-9]+$/i.test(environment.architecture))
+    throw new Error("Unsupported graph execution environment.");
+  return `${environment.platform}-${environment.architecture}`;
+}
+
+// src/core/graph/localFiles.ts
+var import_promises3 = require("fs/promises");
+var import_node_path4 = __toESM(require("path"), 1);
+
+// src/core/graph/storage.ts
+var import_node_crypto = require("crypto");
+var import_promises2 = require("fs/promises");
+var import_node_path3 = __toESM(require("path"), 1);
+async function assertGraphStoragePath(root, directory) {
+  const relative = import_node_path3.default.relative(root, directory);
+  const parts = relative.split(import_node_path3.default.sep);
+  if (import_node_path3.default.isAbsolute(relative) || parts[0] !== ".qfai" || parts[1] !== "tools" || parts.includes("..")) {
+    throw new Error("Graph storage must stay inside project-local .qfai/tools.");
+  }
+  for (let depth = 1; depth <= parts.length; depth += 1) {
+    try {
+      const stats = await (0, import_promises2.lstat)(import_node_path3.default.join(root, ...parts.slice(0, depth)));
+      if (stats.isSymbolicLink() || !stats.isDirectory())
+        throw new Error(
+          "Graph storage has an unsafe path component; retain it and repair the project configuration."
+        );
+    } catch (cause) {
+      if (isEnoent(cause)) return;
+      throw cause;
+    }
+  }
+}
+
+// src/core/graph/localFiles.ts
+var GRAPH_STATE_BYTES = 32768;
+var GRAPH_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var GraphLocalStateError = class extends Error {
+  constructor(message, recovery, options) {
+    super(message, options);
+    this.recovery = recovery;
+  }
+};
+async function graphStateDirectory(root) {
+  const directory = import_node_path4.default.join(root, ".qfai", "tools", "state", graphEnvironmentKey());
+  await assertGraphStoragePath(root, directory);
+  await (0, import_promises3.mkdir)(directory, { recursive: true });
+  await assertGraphStoragePath(root, directory);
+  return directory;
+}
+function invalidGraphState() {
+  return new GraphLocalStateError(
+    "Project graph permission state is invalid.",
+    "Retain the local state and repair .qfai/tools/state before retrying the graph CLI or hook."
+  );
+}
+function graphStateText(value, maximum) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= maximum && !value.includes("\0");
+}
+async function readGraphLocalFile(file) {
+  try {
+    const before = await (0, import_promises3.lstat)(file);
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1)
+      throw invalidGraphState();
+    const pinned = await readPinnedRegularFileBytes(file, GRAPH_STATE_BYTES);
+    const after = await (0, import_promises3.lstat)(file);
+    if (!pinned || before.dev !== pinned.dev || before.ino !== pinned.ino || after.dev !== pinned.dev || after.ino !== pinned.ino || !after.isFile() || after.isSymbolicLink() || after.nlink !== 1)
+      throw invalidGraphState();
+    return pinned.content.toString("utf8");
+  } catch (cause) {
+    if (isEnoent(cause)) return void 0;
+    throw cause;
+  }
+}
+async function writeGraphLocalFile(file, value) {
+  const text = JSON.stringify(value);
+  if (Buffer.byteLength(text) > GRAPH_STATE_BYTES) throw invalidGraphState();
+  const handle = await (0, import_promises3.open)(file, "wx", 384);
+  try {
+    await handle.writeFile(text, "utf8");
+  } finally {
+    await handle.close();
+  }
+}
+
+// src/core/graph/locks.ts
+async function withGraphLock(root, kind, action) {
+  const directory = await graphStateDirectory(root);
+  const file = import_node_path5.default.join(directory, `${kind}.lock`);
+  const owner = {
+    kind: "graph-lock",
+    pid: process.pid,
+    createdAt: Date.now(),
+    token: (0, import_node_crypto2.randomUUID)()
+  };
+  try {
+    await writeGraphLocalFile(file, owner);
+  } catch (cause) {
+    if (!hasErrnoCode(cause) || cause.code !== "EEXIST") throw cause;
+    const text = await readGraphLocalFile(file);
+    let active = false;
+    try {
+      const existing = text === void 0 ? void 0 : JSON.parse(text);
+      if (typeof existing !== "object" || existing === null || Array.isArray(existing))
+        throw new Error("Invalid graph lock metadata.", { cause });
+      const value = existing;
+      if (Object.keys(value).length !== 4 || value.kind !== "graph-lock" || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0 || typeof value.createdAt !== "number" || !Number.isSafeInteger(value.createdAt) || value.createdAt < 0 || typeof value.token !== "string" || !GRAPH_UUID.test(value.token))
+        throw new Error("Invalid graph lock metadata.", { cause });
+      try {
+        process.kill(value.pid, 0);
+        active = true;
+      } catch (liveness) {
+        if (!hasErrnoCode(liveness) || liveness.code !== "ESRCH") active = true;
+      }
+    } catch {
+    }
+    throw new GraphLocalStateError(
+      `Project graph ${kind} lock ${active ? "is contended" : "requires manual recovery"}.`,
+      active ? `Retry after the active worktree ${kind} operation finishes; retain its lock.` : `Retain and inspect .qfai/tools/state/${graphEnvironmentKey()}/${kind}.lock; remove only a confirmed abandoned worktree lock before retrying.`,
+      { cause }
+    );
+  }
+  try {
+    return await action();
+  } finally {
+    await releaseGraphLock(file, JSON.stringify(owner));
+  }
+}
+async function releaseGraphLock(file, owner) {
+  const text = await readGraphLocalFile(file);
+  if (text !== owner)
+    throw new GraphLocalStateError(
+      "Project graph lock ownership changed.",
+      "Retain the lock and repair the worktree graph state before retrying."
+    );
+  await (0, import_promises4.unlink)(file);
+}
+
+// src/core/graph/permissionRecords.ts
+var import_promises5 = require("fs/promises");
+var import_node_path6 = __toESM(require("path"), 1);
+async function readGraphSearchRecords(root, directory) {
+  const records = [];
+  const entries = await (0, import_promises5.opendir)(directory);
+  for await (const entry of entries) {
+    if (entry.name === "state.lock" || entry.name === "analysis.lock") continue;
+    if (records.length >= 128) throw fullGraphState();
+    const match = /^(.+)\.(pending|grant|draft)\.json$/.exec(entry.name);
+    if (!match || !GRAPH_UUID.test(match[1] ?? "")) throw invalidGraphState();
+    const file = import_node_path6.default.join(directory, entry.name);
+    const text = await readGraphLocalFile(file);
+    if (text === void 0) throw invalidGraphState();
+    let input;
+    try {
+      input = JSON.parse(text);
+    } catch {
+      throw invalidGraphState();
+    }
+    const record = parseGraphSearchRecord(input, root);
+    if (!record || record.id !== match[1] || (match[2] === "pending" ? record.kind !== "pending" : record.kind !== "grant"))
+      throw invalidGraphState();
+    records.push({ file, record, draft: match[2] === "draft" });
+  }
+  const current = [];
+  for (const item of records) {
+    if (Date.now() >= item.record.expiresAt) await (0, import_promises5.unlink)(item.file);
+    else current.push(item);
+  }
+  return current;
+}
+function fullGraphState() {
+  return new GraphLocalStateError(
+    "Project graph permission state is full.",
+    "Retry after pending attempts or search grants expire; retain valid worktree state."
+  );
+}
+function parseGraphSearchRecord(input, root) {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+  const value = input;
+  const fields = [
+    "id",
+    "kind",
+    "domain",
+    "target",
+    "operation",
+    "worktree",
+    "session",
+    "createdAt",
+    "expiresAt"
+  ];
+  if (value.kind === "grant") fields.push("reason");
+  if (Object.keys(value).length !== fields.length || fields.some((field) => !Object.hasOwn(value, field)) || typeof value.id !== "string" || !GRAPH_UUID.test(value.id) || value.kind !== "pending" && value.kind !== "grant" || value.domain !== "code" && value.domain !== "documents" || !graphStateText(value.target, 4096) || !graphStateText(value.operation, 128) || !graphStateText(value.worktree, 4096) || value.worktree !== import_node_path6.default.resolve(root) || !graphStateText(value.session, 4096) || typeof value.createdAt !== "number" || typeof value.expiresAt !== "number" || !Number.isSafeInteger(value.createdAt) || value.createdAt < 0 || value.createdAt > Date.now() || !Number.isSafeInteger(value.expiresAt) || value.expiresAt !== value.createdAt + (value.kind === "pending" ? 6e5 : 6e4))
+    return void 0;
+  const scope = {
+    id: value.id,
+    domain: value.domain,
+    target: value.target,
+    operation: value.operation,
+    worktree: value.worktree,
+    session: value.session,
+    createdAt: value.createdAt,
+    expiresAt: value.expiresAt
+  };
+  if (value.kind === "pending") return { ...scope, kind: "pending" };
+  return graphStateText(value.reason, 2048) ? { ...scope, kind: "grant", reason: value.reason } : void 0;
+}
+
+// src/core/graph/codePreparation.ts
+var import_node_crypto4 = require("crypto");
+var import_promises9 = require("fs/promises");
+var import_node_path11 = __toESM(require("path"), 1);
+
+// src/shared/assets.ts
+var import_node_fs2 = require("fs");
+var import_node_path7 = __toESM(require("path"), 1);
+var import_node_url = require("url");
+var INIT_ASSETS_SENTINELS = [
+  import_node_path7.default.join(".qfai", "assistant"),
+  import_node_path7.default.join("root", "qfai.config.yaml")
+];
+
+// src/core/graph/process.ts
+var import_node_child_process = require("child_process");
+var import_promises6 = require("fs/promises");
+var import_node_path8 = __toESM(require("path"), 1);
+var import_node_util = require("util");
+var execute = (0, import_node_util.promisify)(import_node_child_process.execFile);
+
+// src/core/graph/reuse.ts
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path10 = __toESM(require("path"), 1);
+var import_node_crypto3 = require("crypto");
+var import_promises8 = require("fs/promises");
+
+// src/core/graph/analysis.ts
+var import_node_path9 = __toESM(require("path"), 1);
+var import_promises7 = require("fs/promises");
+
+// src/core/graph/documents.ts
+var import_promises11 = require("fs/promises");
+var import_node_crypto6 = require("crypto");
+
+// src/core/graph/documentReuse.ts
+var import_node_crypto5 = require("crypto");
+var import_promises10 = require("fs/promises");
+var import_node_path12 = __toESM(require("path"), 1);
+
+// src/core/graph/documents.ts
+var import_node_path13 = __toESM(require("path"), 1);
+
+// src/core/graph/query.ts
+var import_promises12 = require("fs/promises");
+var import_node_path14 = __toESM(require("path"), 1);
+
+// src/core/graph/fallbackState.ts
+async function classifyStoredGraphExploration(root, event) {
+  const decision = classifyGraphExploration(event);
+  if (decision.decision !== "deny" || decision.state !== "configured") return decision;
+  if (decision.exceptionEligible === false)
+    return decision.fallbackUnavailable ? decision : graphFallbackUnavailable(
+      decision,
+      "The search target or operation cannot be scoped.",
+      "Run a single search with one explicit project-relative target, then retry the denied action."
+    );
+  if (!event.cwd || !graphStateText(event.session, 4096))
+    return graphFallbackUnavailable(
+      decision,
+      "Observed session and worktree are required.",
+      "Enable session and cwd in the host event, run qfai init, then retry the denied action from this project worktree."
+    );
+  if (import_node_path15.default.resolve(event.cwd) !== import_node_path15.default.resolve(root))
+    return graphFallbackUnavailable(
+      decision,
+      "The observed worktree differs from this project worktree.",
+      "Run the denied action from this project worktree, or run qfai init in the intended worktree before retrying."
+    );
+  if (event.workdir && import_node_path15.default.resolve(event.cwd, event.workdir) !== import_node_path15.default.resolve(root))
+    return graphFallbackUnavailable(
+      decision,
+      "The requested workdir differs from this project worktree.",
+      "Set workdir to this project worktree and retry the denied action."
+    );
+  if (!decision.target || !decision.operation || !decision.domain) return decision;
+  const worktree = import_node_path15.default.resolve(root);
+  const session = event.session;
+  return withGraphLock(root, "state", async () => {
+    const directory = await graphStateDirectory(root);
+    const records = await readGraphSearchRecords(root, directory);
+    const classified = classifyGraphExploration(event, (candidate) => {
+      if (candidate.decision !== "deny" || candidate.exceptionEligible === false) return candidate;
+      const grant = records.find(
+        (item) => !item.draft && item.record.kind === "grant" && item.record.target === candidate.target && item.record.operation === candidate.operation && item.record.domain === candidate.domain && item.record.worktree === worktree && item.record.session === session && Date.now() < item.record.expiresAt
+      );
+      return grant?.record.kind === "grant" ? {
+        ...candidate,
+        decision: "allow",
+        message: `AI-decided search fallback: ${grant.record.reason}`
+      } : candidate;
+    });
+    if (classified.decision !== "deny" || classified.state !== "configured" || classified.exceptionEligible === false || !classified.target || !classified.operation || !classified.domain)
+      return classified;
+    const observed = {
+      target: classified.target,
+      operation: classified.operation,
+      domain: classified.domain,
+      worktree,
+      session
+    };
+    if (records.length >= 128) throw fullGraphState();
+    const createdAt = Date.now();
+    const pending = {
+      ...observed,
+      id: (0, import_node_crypto7.randomUUID)(),
+      kind: "pending",
+      createdAt,
+      expiresAt: createdAt + 6e5
+    };
+    await writeGraphLocalFile(import_node_path15.default.join(directory, `${pending.id}.pending.json`), pending);
+    return { ...classified, message: `${classified.message} Observed attempt: ${pending.id}.` };
+  });
+}
+
+// src/cli/graphHook.ts
+function hostName(value) {
+  return value === "claude" || value === "codex" || value === "copilot" || value === "vscode";
+}
+async function runInstalledGraphHook(root, args, io = {
+  read: () => JSON.parse((0, import_node_fs3.readFileSync)(0, "utf8")),
+  output: (text) => {
+    process.stdout.write(text);
+  },
+  error: (text) => {
+    process.stderr.write(text);
+  },
+  fail: () => {
+    process.exitCode = 2;
+  }
+}) {
+  let input;
+  try {
+    input = io.read();
+  } catch {
+    input = void 0;
+  }
+  const host = args[0] === "shared" ? wireHost(input) : args[0];
+  if (!hostName(host)) {
+    io.error("Graph protection unsupported: select a supported host adapter.\n");
+    io.fail();
+    return;
+  }
+  let decision = failedGraphHook();
+  try {
+    const components = [".qfai", "tools", "graph-enforcement.json"];
+    if (!await findUnsafeHostFileComponent(root, components)) {
+      const text = await readPinnedRegularFile(import_node_path16.default.join(root, ...components), 4096);
+      if (text !== null) decision = enforceGraphExploration(input, JSON.parse(text));
+    }
+  } catch {
+  }
+  if (decision.decision === "deny" && decision.state === "configured") {
+    const event = decodeGraphHookEvent(input);
+    if (event) {
+      try {
+        decision = await classifyStoredGraphExploration(root, event);
+      } catch (cause) {
+        decision = failedGraphHook();
+        if (cause instanceof GraphLocalStateError)
+          decision.message = `${cause.message} ${cause.recovery}`;
+      }
+    }
+  }
+  if (decision.decision === "deny")
+    io.output(JSON.stringify(graphHookOutput(host, decision)) + "\n");
+  if (decision.state === "failed") {
+    io.error("Graph protection failed. Repair the project hook and enforcement configuration.\n");
+    io.fail();
+  }
+}
+function wireHost(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+  const value = input;
+  const snake = ["tool_name", "tool_input", "session_id"].some((key) => key in value);
+  const camel = ["toolName", "toolArgs", "sessionId"].some((key) => key in value);
+  if (snake === camel) return void 0;
+  return camel ? "copilot" : "vscode";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  runInstalledGraphHook
+});
+//# sourceMappingURL=hook.cjs.map