safeword 0.75.0 → 0.76.0

package/codex-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "safeword",
-  "version": "0.75.0",
+  "version": "0.76.0",
   "description": "Safeword workflow guidance and gates for Codex.",
   "author": {
     "name": "Arcade AI"

package/codex-plugin/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.75.0 hook codex session-start --plugin-hook",
+            "command": "bunx --bun safeword@0.76.0 hook codex session-start --plugin-hook",
             "timeout": 120,
             "statusMessage": "Loading Safeword standing instructions"
           }
@@ -19,7 +19,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.75.0 hook codex pre-tool-use --plugin-hook",
+            "command": "bunx --bun safeword@0.76.0 hook codex pre-tool-use --plugin-hook",
             "timeout": 30,
             "statusMessage": "Checking Safeword edit gates"
           }
@@ -32,7 +32,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.75.0 hook codex post-tool-use --plugin-hook",
+            "command": "bunx --bun safeword@0.76.0 hook codex post-tool-use --plugin-hook",
             "timeout": 30,
             "statusMessage": "Surfacing Safeword post-tool context"
           }
@@ -45,7 +45,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.75.0 hook codex user-prompt-submit --plugin-hook",
+            "command": "bunx --bun safeword@0.76.0 hook codex user-prompt-submit --plugin-hook",
             "timeout": 30,
             "statusMessage": "Checking queued Safeword prompt context"
           }
@@ -58,7 +58,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bunx --bun safeword@0.75.0 hook codex stop --plugin-hook",
+            "command": "bunx --bun safeword@0.76.0 hook codex stop --plugin-hook",
             "timeout": 600,
             "statusMessage": "Checking Safeword stop continuation"
           }

package/dist/{architecture-KKL2LBNN.js → architecture-MLLLP2QN.js}

@@ -25,7 +25,7 @@ import {
   readJson,
   writeJson
 } from "./chunk-7G6OSNIV.js";
-import "./chunk-C7ITU7HB.js";
+import "./chunk-6DKB2H5U.js";
 
 // src/commands/architecture.ts
 import { execFileSync } from "child_process";
@@ -650,4 +650,4 @@ export {
   architectureStage,
   architectureStaged
 };
-//# sourceMappingURL=architecture-KKL2LBNN.js.map
+//# sourceMappingURL=architecture-MLLLP2QN.js.map

package/dist/{architecture-document-3IZGQHGU.js → architecture-document-OFBN5ZAO.js}

@@ -11,7 +11,7 @@ import {
 import "./chunk-YP2V3YUV.js";
 import "./chunk-2MI7M2CO.js";
 import "./chunk-7G6OSNIV.js";
-import "./chunk-C7ITU7HB.js";
+import "./chunk-6DKB2H5U.js";
 export {
   isSafewordOwned,
   isWouldChangeAction,
@@ -22,4 +22,4 @@ export {
   selfHealProject,
   selfHealProjectPreservingProse
 };
-//# sourceMappingURL=architecture-document-3IZGQHGU.js.map
+//# sourceMappingURL=architecture-document-OFBN5ZAO.js.map

package/dist/{architecture-monorepo-RKR4FT2Y.js → architecture-monorepo-MYENEFSR.js}

@@ -5,11 +5,11 @@ import {
   monorepoFingerprintOf
 } from "./chunk-YP2V3YUV.js";
 import "./chunk-7G6OSNIV.js";
-import "./chunk-C7ITU7HB.js";
+import "./chunk-6DKB2H5U.js";
 export {
   discoverUnreadableWorkspaces,
   discoverWorkspaces,
   extractMonorepoArchitectureSnapshot,
   monorepoFingerprintOf
 };
-//# sourceMappingURL=architecture-monorepo-RKR4FT2Y.js.map
+//# sourceMappingURL=architecture-monorepo-MYENEFSR.js.map

package/dist/{boundary-4ETEMTY3.js → boundary-OWTJP7DH.js}

@@ -25,7 +25,7 @@ import {
 import {
   readFileSafe
 } from "./chunk-7G6OSNIV.js";
-import "./chunk-C7ITU7HB.js";
+import "./chunk-6DKB2H5U.js";
 
 // src/commands/boundary.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -628,4 +628,4 @@ function boundary(options) {
 export {
   boundary
 };
-//# sourceMappingURL=boundary-4ETEMTY3.js.map
+//# sourceMappingURL=boundary-OWTJP7DH.js.map

package/dist/{chunk-C7HR7OK2.js → chunk-2MBSWVT2.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-URVJZ4NL.js";
 import {
   setupPythonTooling
-} from "./chunk-IQQO3URI.js";
+} from "./chunk-U5BIKVUL.js";
 import {
   SAFEWORD_PRIMARY_LINT_SCRIPT,
   detect
@@ -876,69 +876,17 @@ function shouldRemoveTextPatchTarget(content, definition) {
   return definition.removeFileIfContentEquals?.some((candidate) => trimmed === candidate.trim()) ?? false;
 }
 
-// src/packs/config.ts
-import nodePath2 from "path";
-import process from "process";
-var CONFIG_PATH = ".safeword/config.json";
-function readConfig(cwd) {
-  const configPath = nodePath2.join(cwd, CONFIG_PATH);
-  const content = readFileSafe(configPath);
-  if (!content) return void 0;
-  return JSON.parse(content);
-}
-function writeConfig(cwd, config) {
-  const configPath = nodePath2.join(cwd, CONFIG_PATH);
-  writeFile(configPath, JSON.stringify(config, void 0, 2));
-}
-function getInstalledPacks(cwd) {
-  const config = readConfig(cwd);
-  return config?.installedPacks ?? [];
-}
-function isPackInstalled(cwd, packId) {
-  return getInstalledPacks(cwd).includes(packId);
-}
-function addInstalledPack(cwd, packId) {
-  const config = readConfig(cwd) ?? { installedPacks: [] };
-  if (!config.installedPacks.includes(packId)) {
-    config.installedPacks.push(packId);
-    writeConfig(cwd, config);
-  }
-}
-
-// src/packs/golang/setup.ts
-function setupGoTooling() {
-  return { files: [] };
-}
-
-// src/packs/golang/index.ts
-var golangPack = {
-  id: "golang",
-  name: "Go",
-  extensions: [".go"],
-  detect(cwd) {
-    return existsInTree(cwd, "go.mod");
-  },
-  setup(_cwd, _ctx) {
-    return setupGoTooling();
-  }
-};
-
-// src/packs/python/index.ts
-var pythonPack = {
-  id: "python",
-  name: "Python",
-  extensions: [".py", ".pyi"],
-  detect(cwd) {
-    return existsInTree(cwd, "pyproject.toml") || existsInTree(cwd, "requirements.txt");
-  },
-  setup(_cwd, _ctx) {
-    return setupPythonTooling();
-  }
-};
-
 // src/packs/rust/setup.ts
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "fs";
-import nodePath3 from "path";
+import {
+  existsSync,
+  lstatSync as lstatSync2,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync
+} from "fs";
+import nodePath2 from "path";
+import { parse } from "smol-toml";
 var SAFEWORD_CLIPPY_LINTS = `[lints.clippy]
 # Enable pedantic for stricter linting (priority -1 allows individual overrides)
 pedantic = { level = "deny", priority = -1 }
@@ -957,6 +905,25 @@ module_name_repetitions = "allow"
 # Deny unsafe code by default (LLMs shouldn't write unsafe)
 unsafe_code = "deny"
 `;
+function isContainedPath(root, candidate) {
+  const relative = nodePath2.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${nodePath2.sep}`) && !nodePath2.isAbsolute(relative);
+}
+function containedWorkspaceMember(cwd, member) {
+  if (nodePath2.isAbsolute(member)) return void 0;
+  const root = nodePath2.resolve(cwd);
+  const candidate = nodePath2.resolve(root, member);
+  if (!isContainedPath(root, candidate)) return void 0;
+  if (existsSync(candidate) && !isContainedPath(realpathSync(root), realpathSync(candidate))) {
+    return void 0;
+  }
+  return nodePath2.relative(root, candidate);
+}
+function isSafeCargoManifest(cwd, cargoPath) {
+  if (!existsSync(cargoPath)) return false;
+  const stat = lstatSync2(cargoPath);
+  return stat.isFile() && !stat.isSymbolicLink() && isContainedPath(realpathSync(cwd), realpathSync(cargoPath));
+}
 var SAFEWORD_WORKSPACE_LINTS = `[workspace.lints.clippy]
 # Enable pedantic for stricter linting (priority -1 allows individual overrides)
 pedantic = { level = "deny", priority = -1 }
@@ -976,53 +943,97 @@ module_name_repetitions = "allow"
 unsafe_code = "deny"
 `;
 function detectWorkspaceType(cargoContent) {
-  const hasWorkspace = cargoContent.includes("[workspace]");
-  const hasPackage = cargoContent.includes("[package]");
+  const hasWorkspace = hasExactTableHeader(cargoContent, "workspace");
+  const hasPackage = hasExactTableHeader(cargoContent, "package");
   if (hasWorkspace && !hasPackage) return "virtual";
   if (hasWorkspace && hasPackage) return "root-package";
   return "single-crate";
 }
+function hasExactTableHeader(content, table) {
+  let multilineDelimiter;
+  const header = `[${table}]`;
+  for (const line of content.split(/\r?\n/u)) {
+    if (multilineDelimiter !== void 0) {
+      if (hasOddOccurrences(line, multilineDelimiter)) multilineDelimiter = void 0;
+      continue;
+    }
+    const trimmed = line.trim();
+    if (trimmed === header || trimmed.startsWith(`${header} #`)) return true;
+    multilineDelimiter = openingMultilineDelimiter(line);
+  }
+  return false;
+}
+function hasOddOccurrences(line, delimiter) {
+  return line.split(delimiter).length % 2 === 0;
+}
+function openingMultilineDelimiter(line) {
+  const candidates = ['"""', "'''"];
+  return candidates.filter((delimiter) => hasOddOccurrences(line, delimiter)).toSorted((left, right) => line.indexOf(left) - line.indexOf(right))[0];
+}
 function hasExistingLints(cargoContent) {
-  return cargoContent.includes("[lints.clippy]") || cargoContent.includes("[lints.rust]") || cargoContent.includes("[lints]") || cargoContent.includes("[workspace.lints.clippy]") || cargoContent.includes("[workspace.lints.rust]");
+  const manifest = parseCargoManifest(cargoContent);
+  const workspace = isTomlTable(manifest?.workspace) ? manifest.workspace : void 0;
+  return isTomlTable(manifest?.lints) || isTomlTable(workspace?.lints);
+}
+function isTomlTable(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseCargoManifest(content) {
+  try {
+    const manifest = parse(content);
+    return isTomlTable(manifest) ? manifest : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function rustToolingTargets(cwd) {
+  const rootTarget = "Cargo.toml";
+  const cargoPath = nodePath2.join(cwd, rootTarget);
+  if (!isSafeCargoManifest(cwd, cargoPath)) return [];
+  const content = readFileSync(cargoPath, "utf8");
+  const targets = hasExistingLints(content) ? [] : [rootTarget];
+  if (detectWorkspaceType(content) === "single-crate") return targets;
+  for (const member of parseWorkspaceMembers(content, cwd)) {
+    const target = nodePath2.join(member, "Cargo.toml");
+    const memberPath = nodePath2.join(cwd, target);
+    if (!isSafeCargoManifest(cwd, memberPath)) continue;
+    if (!hasExistingLints(readFileSync(memberPath, "utf8"))) targets.push(target);
+  }
+  return targets;
 }
 function expandMemberPattern(cwd, pattern) {
   if (pattern.endsWith("/*")) {
-    const baseDirectory = pattern.slice(0, -2);
-    const fullPath = nodePath3.join(cwd, baseDirectory);
+    const baseDirectory = containedWorkspaceMember(cwd, pattern.slice(0, -2));
+    if (baseDirectory === void 0) return [];
+    const fullPath = nodePath2.join(cwd, baseDirectory);
     if (!existsSync(fullPath)) return [];
     try {
       const entries = readdirSync(fullPath, { withFileTypes: true });
       return entries.filter((entry) => {
         if (!entry.isDirectory()) return false;
-        const cargoPath = nodePath3.join(fullPath, entry.name, "Cargo.toml");
+        const cargoPath = nodePath2.join(fullPath, entry.name, "Cargo.toml");
         return existsSync(cargoPath);
-      }).map((entry) => nodePath3.join(baseDirectory, entry.name));
+      }).map((entry) => nodePath2.join(baseDirectory, entry.name));
     } catch {
       return [];
     }
   }
-  return [pattern];
+  const member = containedWorkspaceMember(cwd, pattern);
+  return member === void 0 ? [] : [member];
 }
 function parseWorkspaceMembers(cargoContent, cwd) {
-  const membersMatch = /\[workspace\][^[]*members\s*=\s*\[([\s\S]*?)\]/.exec(cargoContent);
-  if (!membersMatch?.[1]) return [];
-  const membersBlock = membersMatch[1];
-  const rawMembers = [];
-  const stringRegex = /"([^"]+)"/g;
-  let match;
-  while ((match = stringRegex.exec(membersBlock)) !== null) {
-    if (match[1]) {
-      rawMembers.push(match[1]);
-    }
-  }
+  const manifest = parseCargoManifest(cargoContent);
+  const members = isTomlTable(manifest?.workspace) ? manifest.workspace.members : void 0;
+  if (!Array.isArray(members)) return [];
+  const rawMembers = members.filter((member) => typeof member === "string");
   const expandedMembers = [];
   for (const member of rawMembers) {
     expandedMembers.push(...expandMemberPattern(cwd, member));
   }
   return expandedMembers;
 }
-function addWorkspaceLints(memberCargoPath) {
-  if (!existsSync(memberCargoPath)) return;
+function addWorkspaceLints(cwd, memberCargoPath) {
+  if (!isSafeCargoManifest(cwd, memberCargoPath)) return;
   const content = readFileSync(memberCargoPath, "utf8");
   if (hasExistingLints(content)) return;
   const lintsSection = `[lints]
@@ -1044,13 +1055,13 @@ ${lintsToAdd}`;
 function addMemberLints(cwd, content) {
   const members = parseWorkspaceMembers(content, cwd);
   for (const member of members) {
-    const memberCargoPath = nodePath3.join(cwd, member, "Cargo.toml");
-    addWorkspaceLints(memberCargoPath);
+    const memberCargoPath = nodePath2.join(cwd, member, "Cargo.toml");
+    addWorkspaceLints(cwd, memberCargoPath);
   }
 }
 function setupRustTooling(cwd) {
-  const cargoPath = nodePath3.join(cwd, "Cargo.toml");
-  if (!existsSync(cargoPath)) return { files: [] };
+  const cargoPath = nodePath2.join(cwd, "Cargo.toml");
+  if (!isSafeCargoManifest(cwd, cargoPath)) return { files: [] };
   const content = readFileSync(cargoPath, "utf8");
   const workspaceType = detectWorkspaceType(content);
   const isWorkspace = workspaceType !== "single-crate";
@@ -1061,6 +1072,66 @@ function setupRustTooling(cwd) {
   return { files: [] };
 }
 
+// src/packs/config.ts
+import nodePath3 from "path";
+import process from "process";
+var CONFIG_PATH = ".safeword/config.json";
+function readConfig(cwd) {
+  const configPath = nodePath3.join(cwd, CONFIG_PATH);
+  const content = readFileSafe(configPath);
+  if (!content) return void 0;
+  return JSON.parse(content);
+}
+function writeConfig(cwd, config) {
+  const configPath = nodePath3.join(cwd, CONFIG_PATH);
+  writeFile(configPath, JSON.stringify(config, void 0, 2));
+}
+function getInstalledPacks(cwd) {
+  const config = readConfig(cwd);
+  return config?.installedPacks ?? [];
+}
+function isPackInstalled(cwd, packId) {
+  return getInstalledPacks(cwd).includes(packId);
+}
+function addInstalledPack(cwd, packId) {
+  const config = readConfig(cwd) ?? { installedPacks: [] };
+  if (!config.installedPacks.includes(packId)) {
+    config.installedPacks.push(packId);
+    writeConfig(cwd, config);
+  }
+}
+
+// src/packs/golang/setup.ts
+function setupGoTooling() {
+  return { files: [] };
+}
+
+// src/packs/golang/index.ts
+var golangPack = {
+  id: "golang",
+  name: "Go",
+  extensions: [".go"],
+  detect(cwd) {
+    return existsInTree(cwd, "go.mod");
+  },
+  setup(_cwd, _ctx) {
+    return setupGoTooling();
+  }
+};
+
+// src/packs/python/index.ts
+var pythonPack = {
+  id: "python",
+  name: "Python",
+  extensions: [".py", ".pyi"],
+  detect(cwd) {
+    return existsInTree(cwd, "pyproject.toml") || existsInTree(cwd, "requirements.txt");
+  },
+  setup(_cwd, _ctx) {
+    return setupPythonTooling();
+  }
+};
+
 // src/packs/rust/index.ts
 var rustPack = {
   id: "rust",
@@ -1249,7 +1320,9 @@ var CUCUMBER_TEMPLATE_REVISION_HASHES = /* @__PURE__ */ new Set([
   // 56JCFZ — runtime paths.features/paths.steps config read (current)
   "929014fb4ce6ca1483b292757b6044be89932028f5bb21ba82c28ffd66b09e53",
   // 4DK9H4 — live profile excludes @manual while selecting @live scenarios
-  "1295e832b1b3bdd0faa963e218bd489c9c252a981fc8e315d4814d4208384a5f"
+  "1295e832b1b3bdd0faa963e218bd489c9c252a981fc8e315d4814d4208384a5f",
+  // ECGEP9 — automated lane distinguishes Vitest-backed proof from unfinished work
+  "0ec4cb6d65b39e01f8aff27c4ca3841e0271a43b5435492676450f0fb3cfac27"
 ]);
 function isShippedCucumberTemplateRevision(content) {
   const hash = createHash("sha256").update(content).digest("hex");
@@ -1563,6 +1636,7 @@ function createProjectContext(cwd) {
 export {
   isPackInstalled,
   addInstalledPack,
+  rustToolingTargets,
   LANGUAGE_PACKS,
   getMissingPacks,
   reconcile,
@@ -1572,4 +1646,4 @@ export {
   LEFTHOOK_CONFIGS,
   createProjectContext
 };
-//# sourceMappingURL=chunk-C7HR7OK2.js.map
+//# sourceMappingURL=chunk-2MBSWVT2.js.map