safeword 0.56.0 → 0.57.0

package/dist/{check-OD4QHC2P.js → check-IV6KC65F.js}

@@ -1,17 +1,20 @@
+import {
+  buildIndexConflictListMessage
+} from "./chunk-ZESHX2BU.js";
 import {
   isNewerVersion
 } from "./chunk-FJYRWU2V.js";
 import {
   checkHealth,
   reportHealthSummary
-} from "./chunk-FZVYR37T.js";
+} from "./chunk-O3QF6QHX.js";
 import "./chunk-YXNI7W5D.js";
 import "./chunk-XTLCJKGE.js";
-import "./chunk-RQBSXETC.js";
+import "./chunk-HGOG5ZLC.js";
 import "./chunk-GS3TBFXU.js";
 import {
   syncTickets
-} from "./chunk-EUSXT3MN.js";
+} from "./chunk-HTDMZQKA.js";
 import "./chunk-NHXVS5FL.js";
 import "./chunk-P2IC575P.js";
 import "./chunk-PHR2K2Y3.js";
@@ -79,6 +82,9 @@ function regenerateTicketIndex(cwd) {
     if (result.wrote) {
       info("Regenerated ticket index (INDEX.md / INDEX-completed.md)");
     }
+    if (result.indexConflicts.length > 0) {
+      warn(buildIndexConflictListMessage(result.indexConflicts));
+    }
   } catch (error) {
     if (process.env.DEBUG) {
       console.error("[check] ticket index regen failed:", error);
@@ -111,4 +117,4 @@ async function check(options) {
 export {
   check
 };
-//# sourceMappingURL=check-OD4QHC2P.js.map
+//# sourceMappingURL=check-IV6KC65F.js.map

package/dist/check-IV6KC65F.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/check.ts"],"sourcesContent":["/**\n * Check command - Verify project health and configuration\n *\n * The config-health core lives in ../health.ts (shared with the setup/upgrade\n * self-verify, ticket 3293WH). This command adds the standalone-only\n * surfaces: npm update-check, version display, and ticket-index refresh.\n */\n\nimport process from 'node:process';\n\nimport { checkHealth, type HealthStatus, reportHealthSummary } from '../health.js';\nimport { syncTickets } from '../ticket-sync/index.js';\nimport { header, info, keyValue, success, warn } from '../utils/output.js';\nimport { buildIndexConflictListMessage } from '../utils/ticket-index-warnings.js';\nimport { isNewerVersion } from '../utils/version.js';\n\ninterface CheckOptions {\n  offline?: boolean;\n}\n\n/**\n * Check for latest version from npm (with timeout)\n * @param timeout\n */\nasync function checkLatestVersion(timeout = 3000): Promise<string | undefined> {\n  try {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => {\n      controller.abort();\n    }, timeout);\n\n    const response = await fetch('https://registry.npmjs.org/safeword/latest', {\n      signal: controller.signal,\n    });\n\n    clearTimeout(timeoutId);\n\n    if (!response.ok) return undefined;\n\n    const data = (await response.json()) as { version?: string };\n    return data.version ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Check for CLI updates and report status\n * @param health\n */\nasync function reportUpdateStatus(health: HealthStatus): Promise<void> {\n  info('\\nChecking for updates...');\n  const latestVersion = await checkLatestVersion();\n\n  if (!latestVersion) {\n    warn(\"Couldn't check for updates (offline?)\");\n    return;\n  }\n\n  health.latestVersion = latestVersion;\n  health.updateAvailable = isNewerVersion(health.cliVersion, latestVersion);\n\n  if (health.updateAvailable) {\n    warn(`Update available: v${latestVersion}`);\n    info('Run `bunx safeword@latest upgrade` to upgrade');\n  } else {\n    success('CLI is up to date');\n  }\n}\n\n/**\n * Compare project version vs CLI version and report\n * @param health\n */\nfunction reportVersionMismatch(health: HealthStatus): void {\n  if (!health.projectVersion) return;\n\n  if (isNewerVersion(health.cliVersion, health.projectVersion)) {\n    warn(`Project config (v${health.projectVersion}) is newer than CLI (v${health.cliVersion})`);\n    info('Consider upgrading the CLI');\n  } else if (isNewerVersion(health.projectVersion, health.cliVersion)) {\n    info(`\\nUpgrade available for project config`);\n    info(\n      `Run \\`safeword upgrade\\` to update from v${health.projectVersion} to v${health.cliVersion}`,\n    );\n  }\n}\n\n/**\n * Regenerate the ticket discovery index, swallowing any error — index\n * freshness must never block or fail a health check. Reports only when it\n * actually rewrote a file.\n * @param cwd\n */\nfunction regenerateTicketIndex(cwd: string): void {\n  try {\n    const result = syncTickets(cwd);\n    if (result.wrote) {\n      info('Regenerated ticket index (INDEX.md / INDEX-completed.md)');\n    }\n    if (result.indexConflicts.length > 0) {\n      warn(buildIndexConflictListMessage(result.indexConflicts));\n    }\n  } catch (error: unknown) {\n    // Best-effort: index freshness must never fail the health check. Surface\n    // under DEBUG, then return — the deliberate swallow point.\n    if (process.env.DEBUG) {\n      console.error('[check] ticket index regen failed:', error);\n    }\n    return;\n  }\n}\n\n/**\n *\n * @param options\n */\nexport async function check(options: CheckOptions): Promise<void> {\n  const cwd = process.cwd();\n\n  header('Safeword Health Check');\n\n  const health = await checkHealth(cwd);\n\n  // Not configured\n  if (!health.configured) {\n    info('Not configured. Run `safeword setup` to initialize.');\n    return;\n  }\n\n  // Keep the ticket discovery index fresh at this checkpoint (best-effort —\n  // never fail the health check on index regen). Ticket 1GGD28.\n  regenerateTicketIndex(cwd);\n\n  // Show versions\n  keyValue('Safeword CLI', `v${health.cliVersion}`);\n  keyValue('Project config', health.projectVersion ? `v${health.projectVersion}` : 'unknown');\n\n  // Check for updates (unless offline)\n  if (options.offline) {\n    info('\\nSkipped update check (offline mode)');\n  } else {\n    await reportUpdateStatus(health);\n  }\n\n  reportVersionMismatch(health);\n  const hasIssues = reportHealthSummary(health);\n\n  if (hasIssues) {\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,OAAO,aAAa;AAgBpB,eAAe,mBAAmB,UAAU,KAAmC;AAC7E,MAAI;AACF,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM;AACjC,iBAAW,MAAM;AAAA,IACnB,GAAG,OAAO;AAEV,UAAM,WAAW,MAAM,MAAM,8CAA8C;AAAA,MACzE,QAAQ,WAAW;AAAA,IACrB,CAAC;AAED,iBAAa,SAAS;AAEtB,QAAI,CAAC,SAAS,GAAI,QAAO;AAEzB,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,KAAK,WAAW;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAe,mBAAmB,QAAqC;AACrE,OAAK,2BAA2B;AAChC,QAAM,gBAAgB,MAAM,mBAAmB;AAE/C,MAAI,CAAC,eAAe;AAClB,SAAK,uCAAuC;AAC5C;AAAA,EACF;AAEA,SAAO,gBAAgB;AACvB,SAAO,kBAAkB,eAAe,OAAO,YAAY,aAAa;AAExE,MAAI,OAAO,iBAAiB;AAC1B,SAAK,sBAAsB,aAAa,EAAE;AAC1C,SAAK,+CAA+C;AAAA,EACtD,OAAO;AACL,YAAQ,mBAAmB;AAAA,EAC7B;AACF;AAMA,SAAS,sBAAsB,QAA4B;AACzD,MAAI,CAAC,OAAO,eAAgB;AAE5B,MAAI,eAAe,OAAO,YAAY,OAAO,cAAc,GAAG;AAC5D,SAAK,oBAAoB,OAAO,cAAc,yBAAyB,OAAO,UAAU,GAAG;AAC3F,SAAK,4BAA4B;AAAA,EACnC,WAAW,eAAe,OAAO,gBAAgB,OAAO,UAAU,GAAG;AACnE,SAAK;AAAA,qCAAwC;AAC7C;AAAA,MACE,4CAA4C,OAAO,cAAc,QAAQ,OAAO,UAAU;AAAA,IAC5F;AAAA,EACF;AACF;AAQA,SAAS,sBAAsB,KAAmB;AAChD,MAAI;AACF,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,OAAO,OAAO;AAChB,WAAK,0DAA0D;AAAA,IACjE;AACA,QAAI,OAAO,eAAe,SAAS,GAAG;AACpC,WAAK,8BAA8B,OAAO,cAAc,CAAC;AAAA,IAC3D;AAAA,EACF,SAAS,OAAgB;AAGvB,QAAI,QAAQ,IAAI,OAAO;AACrB,cAAQ,MAAM,sCAAsC,KAAK;AAAA,IAC3D;AACA;AAAA,EACF;AACF;AAMA,eAAsB,MAAM,SAAsC;AAChE,QAAM,MAAM,QAAQ,IAAI;AAExB,SAAO,uBAAuB;AAE9B,QAAM,SAAS,MAAM,YAAY,GAAG;AAGpC,MAAI,CAAC,OAAO,YAAY;AACtB,SAAK,qDAAqD;AAC1D;AAAA,EACF;AAIA,wBAAsB,GAAG;AAGzB,WAAS,gBAAgB,IAAI,OAAO,UAAU,EAAE;AAChD,WAAS,kBAAkB,OAAO,iBAAiB,IAAI,OAAO,cAAc,KAAK,SAAS;AAG1F,MAAI,QAAQ,SAAS;AACnB,SAAK,uCAAuC;AAAA,EAC9C,OAAO;AACL,UAAM,mBAAmB,MAAM;AAAA,EACjC;AAEA,wBAAsB,MAAM;AAC5B,QAAM,YAAY,oBAAoB,MAAM;AAE5C,MAAI,WAAW;AACb,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":[]}

package/dist/{chunk-64TSNY2M.js → chunk-D5H7VBXQ.js}

@@ -3,7 +3,7 @@ import {
   addInstalledPack,
   isGitRepo,
   isPackInstalled
-} from "./chunk-RQBSXETC.js";
+} from "./chunk-HGOG5ZLC.js";
 import {
   SAFEWORD_PEER_DEPENDENCIES
 } from "./chunk-HSC7TELY.js";
@@ -392,4 +392,4 @@ export {
   getEslintPeerMismatchWarning,
   maybeAutoPatchOrNudge
 };
-//# sourceMappingURL=chunk-64TSNY2M.js.map
+//# sourceMappingURL=chunk-D5H7VBXQ.js.map

package/dist/{chunk-RQBSXETC.js → chunk-HGOG5ZLC.js}

@@ -2149,9 +2149,54 @@ ${prettier.configEntry}
 `;
 }
 var CURSOR_HOOKS = {
+  // Observational: injects standing context. Fail-open — a failed inject must not
+  // block the session from starting.
   sessionStart: [{ command: "bun ./.safeword/hooks/session-safeword-context.ts --agent=cursor" }],
+  // NOTE (F2TKR3): there is deliberately NO beforeSubmitPrompt gate. That hook
+  // fires at prompt-send time, where Cursor exposes only the prompt text — no tool
+  // name or file path — so it cannot tell "create test-definitions.md" from "write
+  // application code". A block there is a catch-22: it would stop the very prompt
+  // that asks the agent to create the scenarios. The phase gate lives at the edit
+  // layer below (preToolUse), which is path-aware (META_PATHS lets scenario/meta
+  // files through) and session-bound — exact parity with the Claude side.
+  //
+  // Blocking edit gate. Matcher limits it to the `Write` tool (Cursor's only edit
+  // tool) so it never spawns on Read/Grep/Task. Denies edits when a feature at the
+  // implement phase has no test-definitions.md, and on LOC blast-radius overflow.
+  //
+  // Done gate (AKNWZK): this same hook also enforces the done gate. Cursor's `stop`
+  // cannot block, so closing a ticket is gated here — a Write that flips ticket.md to
+  // `status: done` is denied unless the evidence holds (tests green, verify.md in
+  // scope, scenarios complete). That makes done the only edit that runs the test
+  // suite, so the timeout is raised to cover a full run (the suite self-caps at 60s).
+  preToolUse: [
+    {
+      command: "bun ./.safeword/hooks/cursor/pre-tool-quality.ts",
+      matcher: "Write",
+      failClosed: true,
+      timeout: 90
+    }
+  ],
+  // Blocking commit gate (a REFACTOR commit may not touch test files).
+  beforeShellExecution: [
+    { command: "bun ./.safeword/hooks/cursor/before-shell-execution.ts", failClosed: true }
+  ],
+  // Observational: triggers lint on edited files. Fail-open — a lint crash must
+  // not block the edit.
   afterFileEdit: [{ command: "bun ./.safeword/hooks/cursor/after-file-edit.ts" }],
-  stop: [{ command: "bun ./.safeword/hooks/cursor/stop.ts" }]
+  // Observational: maintains the per-session quality state (LOC, commit-clears-gate,
+  // ticket binding) the blocking edit gate reads. Matched to edits + shell only.
+  // Fail-open — if it crashes the gate simply lacks fuel and degrades to allow,
+  // which must never block work.
+  postToolUse: [
+    { command: "bun ./.safeword/hooks/cursor/post-tool-quality.ts", matcher: "Write|Shell" }
+  ],
+  // Observational: nudges a quality review. Cursor `stop` cannot block anyway —
+  // the real done enforcement lives in preToolUse (above). loop_limit:1 is
+  // intentional: this is a one-shot reminder (the hook clears its edit marker after
+  // firing), NOT a drive-to-done loop, so a single auto-continue is enough and a
+  // higher cap would just re-nudge noisily.
+  stop: [{ command: "bun ./.safeword/hooks/cursor/stop.ts", loop_limit: 1 }]
 };
 var HOOKS_DIR = '"$CLAUDE_PROJECT_DIR"/.safeword/hooks';
 function hook(command) {
@@ -2932,9 +2977,11 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/lib/lint.ts": { template: "hooks/lib/lint.ts" },
     ".safeword/hooks/lib/quality.ts": { template: "hooks/lib/quality.ts" },
     ".safeword/hooks/lib/quality-state.ts": { template: "hooks/lib/quality-state.ts" },
+    ".safeword/hooks/lib/run-identity.ts": { template: "hooks/lib/run-identity.ts" },
     ".safeword/hooks/lib/dependency-readiness.ts": {
       template: "hooks/lib/dependency-readiness.ts"
     },
+    ".safeword/hooks/lib/done-gate.ts": { template: "hooks/lib/done-gate.ts" },
     ".safeword/hooks/lib/namespace-root.ts": { template: "hooks/lib/namespace-root.ts" },
     ".safeword/hooks/lib/skill-invocation-log.ts": {
       template: "hooks/lib/skill-invocation-log.ts"
@@ -3261,6 +3308,18 @@ var SAFEWORD_SCHEMA = {
     ".safeword/hooks/cursor/after-file-edit.ts": {
       template: "hooks/cursor/after-file-edit.ts"
     },
+    ".safeword/hooks/cursor/gate-adapter.ts": {
+      template: "hooks/cursor/gate-adapter.ts"
+    },
+    ".safeword/hooks/cursor/pre-tool-quality.ts": {
+      template: "hooks/cursor/pre-tool-quality.ts"
+    },
+    ".safeword/hooks/cursor/before-shell-execution.ts": {
+      template: "hooks/cursor/before-shell-execution.ts"
+    },
+    ".safeword/hooks/cursor/post-tool-quality.ts": {
+      template: "hooks/cursor/post-tool-quality.ts"
+    },
     ".safeword/hooks/cursor/stop.ts": { template: "hooks/cursor/stop.ts" }
   },
   // Files created if missing, updated only if content matches current template
@@ -3349,7 +3408,15 @@ var SAFEWORD_SCHEMA = {
     // form is `.jsonc`; yaml/cjs/mjs variants fall back to manual wiring.
     ".markdownlint-cli2.jsonc": MARKDOWNLINT_CLI2_IGNORES_MERGE,
     ".cursor/hooks.json": {
-      keys: ["version", "hooks.sessionStart", "hooks.afterFileEdit", "hooks.stop"],
+      keys: [
+        "version",
+        "hooks.sessionStart",
+        "hooks.preToolUse",
+        "hooks.beforeShellExecution",
+        "hooks.afterFileEdit",
+        "hooks.postToolUse",
+        "hooks.stop"
+      ],
       removeFileIfEmpty: true,
       merge: (existing) => {
         const hooks = existing.hooks ?? {};
@@ -3365,10 +3432,11 @@ var SAFEWORD_SCHEMA = {
       },
       unmerge: (existing) => {
         const result = { ...existing };
-        const hooks = { ...existing.hooks };
-        delete hooks.sessionStart;
-        delete hooks.afterFileEdit;
-        delete hooks.stop;
+        const existingHooks = existing.hooks ?? {};
+        const safewordHookNames = new Set(Object.keys(CURSOR_HOOKS));
+        const hooks = Object.fromEntries(
+          Object.entries(existingHooks).filter(([name]) => !safewordHookNames.has(name))
+        );
         if (!assignOrPrune(result, "hooks", hooks)) {
           delete result.version;
         }
@@ -3778,4 +3846,4 @@ export {
   untrackIgnoredFiles,
   createProjectContext
 };
-//# sourceMappingURL=chunk-RQBSXETC.js.map
+//# sourceMappingURL=chunk-HGOG5ZLC.js.map