sawbuck 0.1.28 → 0.1.30

package/contract.mjs

@@ -53,6 +53,12 @@ export function mandatesInForce(repo, ref = 'HEAD') {
   return [...wt, ...committed];
 }
 
+// the paths among `paths` that a mandate in force covers (any rule, working tree or committed)
+export function protectedAmong(repo, paths) {
+  const res = mandatesInForce(repo).flatMap((m) => pathsOf(m).map(globToRe));
+  return paths.filter((f) => res.some((re) => re.test(f)));
+}
+
 // a working-tree file's content hash as git would store it; 'deleted' when it is gone
 export function hashOf(repo, file) {
   try { return gitOut(repo, ['hash-object', '--', file]).trim(); } catch { return 'deleted'; }
@@ -92,7 +98,12 @@ export function mandateHits(repo, changedPaths, opts = {}) {
     const files = changedPaths.filter((f) => res.some((re) => re.test(f)));
     if (!files.length) continue;
     const prev = out.find((h) => h.name === String(m.name));
-    if (prev) { prev.files = [...new Set([...prev.files, ...files])].slice(0, 20); if (!prev.reason && m.reason) prev.reason = String(m.reason).slice(0, 300); continue; }
+    if (prev) {
+      prev.files = [...new Set([...prev.files, ...files])].slice(0, 20);
+      if (!prev.reason && m.reason) prev.reason = String(m.reason).slice(0, 300);
+      if (m.committed) prev.committed = true;   // the committed version of the rule hit too: say so
+      continue;
+    }
     out.push({ name: String(m.name), reason: m.reason ? String(m.reason).slice(0, 300) : '', files: files.slice(0, 20), ...(m.committed ? { committed: true } : {}) });
   }
   return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sawbuck",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "Sign your agent to a contract: a deterministic, zero-LLM check re-proves every win from the agent's source edits alone, so a green that came from editing the test, grader, or config is caught and sent back. Works in Claude Code, Codex, git hooks, and CI.",
   "type": "module",
   "license": "Apache-2.0",

package/sawbuck-hook.mjs

@@ -10,7 +10,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-import { mandateHits, hashOf } from './contract.mjs';
+import { mandateHits, hashOf, protectedDirty, protectedAmong } from './contract.mjs';
 const flag = (n, d) => { const i = process.argv.indexOf(n); return i > -1 ? process.argv[i + 1] : d; };
 const repo = flag('--repo', process.cwd());
 const by = flag('--by', '');   // attribution from the harness wiring: the Claude hook passes 'claude', the raw-git hook passes nothing
@@ -53,25 +53,40 @@ const saveState = () => { try { mkdirSync(stDir, { recursive: true }); writeFile
 // and send the agent back to undo its protected edits and make the fix elsewhere. The rules are the
 // working tree's AND the committed contract's (editing the config in the same turn lifts nothing),
 // and a protected file that was already dirty with the same content when the prompt began (the
-// baseline `sawbuck turn` recorded) is the person's own work and does not count.
+// baseline `sawbuck turn --hook` recorded) is the person's own work and does not count. A protected
+// edit COMMITTED since the baseline's commit counts too: a commit mid-turn does not walk through.
 if (stop && !process.env.SAWBUCK_NO_ENFORCE) {
+  const now = new Date().toISOString();
   const dirty = [...new Set([...git('diff', '--name-only', 'HEAD').split('\n'), ...git('ls-files', '--others', '--exclude-standard').split('\n')].filter(Boolean))];
-  const baseline = (st.turnBaseline && st.turnBaseline.files && typeof st.turnBaseline.files === 'object') ? st.turnBaseline.files : {};
-  const untouched = (f) => Object.prototype.hasOwnProperty.call(baseline, f) && hashOf(repo, f) === baseline[f];
-  const changed = dirty.filter((f) => !untouched(f));
+  const base = (st.turnBaseline && typeof st.turnBaseline === 'object') ? st.turnBaseline : null;
+  const baseline = (base && base.files && typeof base.files === 'object') ? base.files : {};
+  const committedSince = (base && base.sha && head && base.sha !== head) ? git('diff', '--name-only', base.sha, 'HEAD').split('\n').filter(Boolean) : [];
+  const hashNow = {}; for (const f of dirty) if (Object.prototype.hasOwnProperty.call(baseline, f)) hashNow[f] = hashOf(repo, f);
+  const untouched = (f) => Object.prototype.hasOwnProperty.call(baseline, f) && hashNow[f] === baseline[f];
+  const changed = [...new Set([...dirty.filter((f) => !untouched(f)), ...committedSince])];
   const leftAlone = dirty.filter(untouched);
   const hits = changed.length ? mandateHits(repo, changed) : [];
+  st.lastStopAt = now;   // the next prompt may take a fresh baseline only because this stop happened
+  if (hits.length) {
+    // remember EVERY changed protected path (dirty or committed since the baseline) and what it holds,
+    // uncapped, and the commit the baseline stood at, so the next prompt cannot adopt any of it
+    const files = protectedDirty(repo);
+    for (const f of protectedAmong(repo, committedSince)) if (!Object.prototype.hasOwnProperty.call(files, f)) files[f] = hashOf(repo, f);
+    st.lastViolation = { at: now, sha: (base && base.sha) || null, files };
+  } else if (st.lastViolation) { delete st.lastViolation; }
+  saveState();
   if (hits.length) {
     const MAX_BLOCKS = +(cfg.enforce?.maxBlocks) || 3;
     const promptId = hookInput.prompt_id || 'none';
     if (st.mandatePromptId !== promptId) { st.mandatePromptId = promptId; st.mandateBlocks = 0; }
     const desc = hits.map((h) => `"${h.name}"${h.reason ? ' (' + h.reason + ')' : ''}: ${h.files.join(', ')}${h.committed ? ' [this rule is in the committed contract; editing promptwheel.config.json in the working tree does not lift it]' : ''}`).join('; ');
     const spared = leftAlone.length ? ` Edits that were already there before this prompt were left out of this check and must stay as they are: ${leftAlone.join(', ')}.` : '';
+    const upgrade = base ? '' : ' (No prompt baseline is recorded in this repo, so edits a person made before the prompt cannot be told apart from yours: ask them to run sawbuck attach --claude again, which upgrades the hooks.)';
     try { mkdirSync(stDir, { recursive: true }); appendFileSync(join(stDir, 'activity.jsonl'), JSON.stringify({ at: new Date().toISOString(), kind: 'mandate', file: hits[0].files[0], reason: `mandate ${hits[0].name} violated in the working tree`, by: by || 'hook' }) + '\n'); } catch {}
     if ((st.mandateBlocks || 0) < MAX_BLOCKS) {
       st.mandateBlocks = (st.mandateBlocks || 0) + 1;
       saveState();
-      process.stdout.write(JSON.stringify({ decision: 'block', reason: `Sawbuck: a mandate in the contract was violated, the turn is not done. Protected paths changed in this turn: ${desc}. Undo the changes YOU made under the protected paths and make the fix elsewhere; do not revert anything you did not change (the rule is a wall, not a reminder; the gate fails any change that touches them).${spared}` }));
+      process.stdout.write(JSON.stringify({ decision: 'block', reason: `Sawbuck: a mandate in the contract was violated, the turn is not done. Protected paths changed in this turn: ${desc}. Undo the changes YOU made under the protected paths and make the fix elsewhere; do not revert anything you did not change (the rule is a wall, not a reminder; the gate fails any change that touches them).${spared}${upgrade}` }));
       process.exit(0);
     }
     saveState();

package/sawbuck.mjs

@@ -209,14 +209,31 @@ switch (cmd) {
     // When a PROMPT begins (the UserPromptSubmit hook, never the SessionStart[compact] one, which
     // fires mid-turn), remember which protected paths were already dirty and what they held, so the
     // Stop hook's wall counts only what this turn changes and leaves a person's own edits alone.
+    // Only under --hook (the wiring passes it) is stdin read for the hook's JSON, so a plain
+    // `sawbuck turn` never waits on a pipe. Three rules keep the baseline honest: a new baseline is
+    // taken only when the previous turn actually reached a Stop (an interrupt, a crash, or a re-run of
+    // this command mid-turn leaves the last one standing, so nothing the agent left behind is adopted);
+    // a file still carrying the content the last violation flagged is never baselined; and the
+    // baseline's commit does not advance past a flagged commit until a clean stop.
     let hookEvent = '';
-    if (!process.stdin.isTTY) { try { hookEvent = String(JSON.parse(readFileSync(0, 'utf8') || '{}').hook_event_name || ''); } catch {} }
+    if (flags.has('--hook') && !process.stdin.isTTY) { try { hookEvent = String(JSON.parse(readFileSync(0, 'utf8') || '{}').hook_event_name || ''); } catch {} }
     if (hookEvent === 'UserPromptSubmit') {
       try {
         if (mandatesInForce(repo).length) {
           const stDir = join(repo, '.sawbuck'); const stPath = join(stDir, 'state.json');
           let st = {}; try { st = JSON.parse(readFileSync(stPath, 'utf8')); } catch {}
-          st.turnBaseline = { at: new Date().toISOString(), files: protectedDirty(repo) };
+          const now = new Date().toISOString();
+          const prev = st.turnBaseline && typeof st.turnBaseline === 'object' ? st.turnBaseline : null;
+          const stoppedSince = st.lastStopAt && st.lastPromptAt && Date.parse(st.lastStopAt) >= Date.parse(st.lastPromptAt);
+          const unfinished = !!prev && !!st.lastPromptAt && !stoppedSince;
+          if (!unfinished) {
+            const flagged = (st.lastViolation && st.lastViolation.files && typeof st.lastViolation.files === 'object') ? st.lastViolation.files : {};
+            const files = protectedDirty(repo);
+            for (const f of Object.keys(files)) if (flagged[f] === files[f]) delete files[f];   // the agent's un-reverted edit stays on the wall
+            let sha = ''; try { sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch {}
+            st.turnBaseline = { at: now, sha: (st.lastViolation && st.lastViolation.sha) || sha, files };
+          }
+          st.lastPromptAt = now;
           mkdirSync(stDir, { recursive: true }); writeFileSync(stPath, JSON.stringify(st, null, 2) + '\n');
         }
       } catch { /* the frame never fails a prompt */ }
@@ -459,7 +476,7 @@ function wireClaude(repo, opts) {
   const fileExisted = existsSync(f);
   let cfg = {};
   if (fileExisted) { try { cfg = JSON.parse(readFileSync(f, 'utf8')); } catch { die(`${f} exists but is not valid JSON; I will not overwrite it. Add the hooks by hand.`); } }
-  const ctx = user ? `node ${JSON.stringify(SELF)} turn` : `node ${JSON.stringify(SELF)} turn ${JSON.stringify(repo)}`;
+  const ctx = user ? `node ${JSON.stringify(SELF)} turn --hook` : `node ${JSON.stringify(SELF)} turn --hook ${JSON.stringify(repo)}`;
   const chk = user ? `node ${JSON.stringify(SELF)} __hook --by claude --stop` : `node ${JSON.stringify(SELF)} __hook --repo ${JSON.stringify(repo)} --by claude --stop`;
   // attached already? "already attached" only when every hook of THIS version is present; an older
   // attachment (say, without the SessionStart[compact] hook) is upgraded in place, never left stale.