simt-dev 0.6.2 → 0.7.0

package/src/agenthooks/policy.mjs

@@ -20,6 +20,7 @@
 // they can ask about.
 
 import { CLI } from '../name.mjs';
+import { HOOKS_DIR, HOOKS_PATH_KEY } from '../hooks/shim.mjs';
 
 /**
  * The events an agent-time hook can answer, normalised across harnesses.
@@ -35,12 +36,29 @@ export const EVENTS = ['pre-tool-use', 'prompt-submit', 'post-tool-use'];
 /** The environment variable that lifts named policies for one session. */
 export const ALLOW_ENV = 'SIMT_ALLOW';
 
+/**
+ * The environment variable that names the session a claim was filed under and the
+ * session an edit is asked for (R54).
+ *
+ * One name in both places on purpose: a denial is only explainable if the session the
+ * hook protected is the same name `simt lease` recorded, and two spellings would drift
+ * into a refusal nobody can reconcile with a claim that exists.
+ */
+export const SESSION_ENV = 'SIMT_SESSION';
+
 /**
  * One row per policy.
  *
- * `inspects` names the fact the matcher is handed, and `match` the condition. The
- * `generated` row has no matcher because what it asks — does this file hold bytes this
- * tool generates — is answered by reading the file, not by the text of a payload.
+ * `inspects` names the fact the matcher is handed, and `match` the condition. A command
+ * row carries two matchers because the facts come in two states: `match` reads the
+ * normalised command - the shell tokenised, wrappers unwrapped, each git invocation
+ * reduced to subcommand and options (ADR-104) - and `regex` is the fallback that runs
+ * when the command cannot be tokenised at all, so a parse failure never weakens a
+ * policy. Facts that were never normalised - a test that hands `decide` a bare command
+ * string - also take the fallback, which is why it stays in the table rather than
+ * beside the tokenizer. The `generated` row has no matcher because what it asks — does
+ * this file hold bytes this tool generates — is answered by reading the file, not by
+ * the text of a payload.
  *
  * Order matters where two policies match one command: `git push --force` is both a
  * push and a rewrite, so both are reported and both have to be lifted before it runs.
@@ -51,7 +69,8 @@ const POLICIES = [
     adr: 'ADR-001',
     event: 'pre-tool-use',
     inspects: 'command',
-    match: /(?:^|[\s;&|(])git\s+push(?:\s|$)/,
+    match: (facts) => facts.shell.facts.some((f) => f.kind === 'git' && (f.sub === 'push' || f.sub === 'send-pack')),
+    regex: /(?:^|[\s;&|(])git\s+push(?:\s|$)/,
     message: `Push needs explicit approval (ADR-001); ask the user.`,
   },
   {
@@ -59,12 +78,50 @@ const POLICIES = [
     adr: 'ADR-017',
     event: 'pre-tool-use',
     inspects: 'command',
-    match:
+    match: (facts) =>
+      facts.shell.facts.some((f) => {
+        if (f.kind !== 'git') return false;
+        if (f.opts.has('--no-verify')) return true;
+        if (f.sub === 'commit' && (f.opts.has('--amend') || f.opts.has('n'))) return true; // -n is --no-verify
+        if (f.sub === 'reset' && f.opts.has('--hard')) return true;
+        if (f.sub === 'rebase') return true;
+        if (f.sub === 'pull' && f.opts.has('--rebase')) return true; // pull --rebase rebases
+        return (
+          (f.sub === 'push' || f.sub === 'send-pack') &&
+          (f.opts.has('--force') || f.opts.has('f') || f.refspecs.some((r) => r.startsWith('+')))
+        );
+      }),
+    regex:
       /--no-verify|git\s+commit\b[^;&|]*\s--amend|git\s+reset\s+--hard|git\s+rebase\b|git\s+push\b[^;&|]*(?:--force\b|\s-f\b)/,
     message:
       `Never amend, rebase, reset --hard, force-push or --no-verify unless asked; ` +
       `each is the escape that turns the declared gates into a suggestion (ADR-017).`,
   },
+  {
+    id: 'hooks-disable',
+    adr: 'ADR-104',
+    event: 'pre-tool-use',
+    inspects: 'command',
+    // No regex fallback: before ADR-104 this policy did not exist, so a command that
+    // cannot be tokenised is judged exactly as it was judged before this row was written.
+    regex: null,
+    match: (facts) => {
+      const dir = (a) => a.replace(/^\.\/+/, '').replace(/\/+$/, '');
+      const key = HOOKS_PATH_KEY.toLowerCase(); // config keys are case-insensitive in git
+      return facts.shell.facts.some((f) => {
+        if (f.kind === 'git') {
+          if (f.globals.c.some((s) => s.toLowerCase().startsWith(`${key}=`))) return true;
+          if (f.sub === 'config' && f.refspecs.some((r) => r.toLowerCase() === key || r.toLowerCase().startsWith(`${key}.`))) return true;
+          return false;
+        }
+        if (f.kind === 'rm') return f.args.some((a) => dir(a) === HOOKS_DIR || dir(a).startsWith(`${HOOKS_DIR}/`));
+        return false;
+      });
+    },
+    message:
+      `That removes or reroutes the git hooks this repository's gates run in, so the gates would stop ` +
+      `running without anyone saying so; if it is deliberate, run \`${CLI} hooks install --yes\` afterwards (ADR-104).`,
+  },
   {
     id: 'generated',
     adr: 'ADR-036',
@@ -75,6 +132,25 @@ const POLICIES = [
       `That file carries bytes this tool generates, so an edit there is overwritten on the next ` +
       `write; edit the source the region comes from, then run \`${CLI} sync --yes\` (ADR-036).`,
   },
+  {
+    id: 'lease',
+    adr: 'ADR-101',
+    event: 'pre-tool-use',
+    inspects: 'lease',
+    match: null,
+    message: `That path is leased by another session (ADR-101); wait for its TTL or ask the holder to release it.`,
+    // The only row whose message is not a constant: what the blocked session needs to
+    // hear — which path, whose, until when — is read from the claim file at decision
+    // time, and a static row cannot carry a timestamp it has never seen.
+    detail: (facts, env) => {
+      if (facts.leaseError) return `${facts.leaseError}; fix or remove it so the claims are readable`;
+      const mine = env[SESSION_ENV] ?? '';
+      const held = (facts.writes ?? [])
+        .filter((w) => w.lease && w.lease.session !== mine)
+        .map((w) => `${w.path} held by ${w.lease.session} until ${new Date(w.lease.expiresAt).toISOString()}`);
+      return held.length > 0 ? `held: ${held.join('; ')}` : '';
+    },
+  },
 ];
 
 /** The policy ids, in table order: the vocabulary an override is checked against. */

package/src/agenthooks/prompt.mjs

@@ -26,6 +26,7 @@ import { readManifest } from '../projection/manifest.mjs';
 import { DEFAULT_BRIEF_BYTES, PROMPT_CAP_BYTES } from '../brief/packet.mjs';
 import { assembleBrief } from '../brief/assemble.mjs';
 import { deliveryJson, factsFrom, promptText } from './render.mjs';
+import { repoRoot } from '../repo-root.mjs';
 
 /**
  * Whether this repository asked for a delivered packet, and the ceiling it asked for.
@@ -63,8 +64,11 @@ export async function deliverPrompt(row, payload) {
   const task = promptText(row, payload);
   if (task === null) return { skipped: 'the payload carries no prompt this harness documents' };
 
-  // The root is the same dialect fact for both events, so it is read the same way.
-  const root = factsFrom(row, payload).root;
+  // The root is the same dialect fact for both events, so it is read the same way —
+  // and resolved to the repository's top level the same way: the manifest, like the
+  // lease file, is a repository-relative fact, and a prompt submitted from a
+  // subdirectory must find it (review 0003 Q16).
+  const root = repoRoot(factsFrom(row, payload).root);
   const optIn = await promptOptIn(root);
   if (!optIn.optedIn) return { skipped: optIn.why };
 

package/src/agenthooks/render.mjs

@@ -1,6 +1,6 @@
 // One renderer per harness: the payload in, the decision out, and the config written.
 //
-// Five harnesses read a hook and no two agree on anything. The config path, the event
+// Six harnesses read a hook and no two agree on anything. The config path, the event
 // name, the shape of the document, the tool name for a shell command, the key holding
 // the command, and the JSON a hook answers with are all different, and none of them is
 // the same fact. So this module owns the differences and `policy.mjs` owns none of
@@ -11,9 +11,10 @@
 //   cursor       .cursor/hooks.json      preToolUse      {"version":1,"hooks":{E:[h]}}
 //   antigravity  .agents/hooks.json      PreToolUse      {"<name>":{E:[{matcher,hooks:[h]}]}}
 //   gemini       .gemini/settings.json   BeforeTool      {"hooks":{E:[{matcher,hooks:[h]}]}}
+//   opencode     .opencode/plugins/      execute.before  a JS plugin the tool owns whole
 //
 // The prompt-submit event (R29) is a second table, and it is shorter because the vendors
-// are: three of the five document a prompt event that can put text into the model's context,
+// are: four of the six document a prompt event that can put text into the model's context,
 // and a delivery is the only thing this tool does there. None takes a matcher — all
 // document that field for tool events, and a matcher a harness ignores is a matcher the
 // next person believes is filtering something.
@@ -21,6 +22,7 @@
 //   claude       .claude/settings.json   UserPromptSubmit   hookSpecificOutput.additionalContext
 //   codex        .codex/hooks.json       UserPromptSubmit   hookSpecificOutput.additionalContext
 //   gemini       .gemini/settings.json   BeforeAgent        hookSpecificOutput.additionalContext
+//   opencode     .opencode/plugins/      prompt             event.prompt.text, prepended
 //   cursor       .cursor/hooks.json      beforeSubmitPrompt CANNOT INJECT: block-only
 //   antigravity  .agents/hooks.json      (no prompt event documented)
 //
@@ -46,7 +48,9 @@
 
 import { CLI } from '../name.mjs';
 import { LOADERS } from '../projection/loaders.mjs';
+import { renderOpencodePlugin } from './opencode.mjs';
 import { EVENTS } from './policy.mjs';
+import { AGENT_HOOK_SHIM } from './shim.mjs';
 
 /** The seconds a hook is allowed before the harness gives up on it. */
 const TIMEOUT_SECONDS = 10;
@@ -54,13 +58,15 @@ const TIMEOUT_SECONDS = 10;
 /**
  * The hook's own entry point, as it appears inside every harness's config.
  *
- * A repository that has this tool has its binary on PATH, and `--harness` is explicit
- * rather than detected from the payload: a hook that guessed would answer in the wrong
- * harness's dialect when a payload arrived in an unexpected shape, and the harness would
+ * The shim, never the bare binary: a harness does not share the shell's PATH,
+ * so a config naming `simt` runs nothing on Claude and blocks everything on
+ * Cursor (review 0003 Q21). `--harness` stays explicit rather than detected
+ * from the payload: a hook that guessed would answer in the wrong harness's
+ * dialect when a payload arrived in an unexpected shape, and the harness would
  * read a decision it does not understand as no decision at all.
  */
 export function hookCommand(id, event = EVENTS[0]) {
-  return `${CLI} agent-hook ${event} --harness ${id}`;
+  return `${AGENT_HOOK_SHIM} ${event} --harness ${id}`;
 }
 
 /** The path a config file lives at, from the reader table rather than a second list. */
@@ -79,6 +85,104 @@ export function hookRows() {
   }));
 }
 
+/**
+ * The files an apply_patch body writes, one per header line.
+ *
+ * `Update`/`Add`/`Delete` name their file on the header itself. A move is the
+ * one header whose target is not on its own line: `*** Move File: <old>` is
+ * followed by the destination on the `+++` line, and a body that spells the
+ * destination as `*** Move to: <new>` says it outright. A move with neither
+ * spelling still writes its source out of the way, so the source is the floor
+ * a move guards.
+ */
+function asString(value) {
+  return typeof value === 'string' && value !== '' ? value : null;
+}
+
+function editFields(input = {}) {
+  const edit = {};
+  const oldString = asString(input.old_string ?? input.oldString ?? input.OldText ?? input.old_text);
+  const newString = asString(input.new_string ?? input.newString ?? input.NewText ?? input.new_text);
+  const content = asString(input.content ?? input.CodeContent ?? input.file_content ?? input.new_source ?? input.newSource);
+  if (oldString !== null) edit.old_string = oldString;
+  if (newString !== null) edit.new_string = newString;
+  if (content !== null) edit.content = content;
+  if (Array.isArray(input.edits)) {
+    const edits = input.edits
+      .filter((e) => e && typeof e === 'object')
+      .map((e) => ({
+        old_string: asString(e.old_string ?? e.oldString),
+        new_string: asString(e.new_string ?? e.newString),
+      }))
+      .filter((e) => e.old_string !== null || e.new_string !== null);
+    if (edits.length > 0) edit.edits = edits;
+  }
+  return edit;
+}
+
+function writeOf(path, input) {
+  if (!path) return null;
+  return { path, ...editFields(input ?? {}) };
+}
+
+/**
+ * The files an apply_patch body writes, one per header line.
+ *
+ * `Update`/`Add`/`Delete` name their file on the header itself. A move is the
+ * one header whose target is not on its own line: `*** Move File: <old>` is
+ * followed by the destination on the `+++` line, and a body that spells the
+ * destination as `*** Move to: <new>` says it outright. A move with neither
+ * spelling still writes its source out of the way, so the source is the floor
+ * a move guards.
+ *
+ * Each entry keeps its hunk text: without it the generated-region check cannot
+ * tell an edit outside the region from one inside it (review 0003 Q17), and
+ * every patch would deny as though it touched the region.
+ */
+function patchWrites(text) {
+  return patchFiles(text).map((f) => ({ path: f.path, patch: f.hunks }));
+}
+
+function patchFiles(text) {
+  const lines = String(text ?? '').split('\n');
+  const files = [];
+  let current = null;
+  const push = () => {
+    if (current !== null) files.push(current);
+    current = null;
+  };
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i].trim();
+    const direct = /^\*\*\* (?:Update|Add|Delete) File: (.+)$/.exec(line);
+    if (direct !== null) {
+      push();
+      current = { path: direct[1].trim(), hunks: '' };
+      continue;
+    }
+    const moveTo = /^\*\*\* Move to: (.+)$/.exec(line);
+    if (moveTo !== null) {
+      push();
+      current = { path: moveTo[1].trim(), hunks: '' };
+      continue;
+    }
+    const moveFile = /^\*\*\* Move File: (.+)$/.exec(line);
+    if (moveFile !== null) {
+      push();
+      const next = lines[i + 1]?.trim();
+      const dest = next !== undefined && next.startsWith('+++ ') ? next.slice(4).trim() : moveFile[1].trim();
+      current = { path: dest, hunks: '' };
+      continue;
+    }
+    if (/^\*\*\* (Begin Patch|End Patch)/.test(line)) {
+      if (line.includes('End Patch')) push();
+      continue;
+    }
+    if (current !== null) current.hunks += `${lines[i]}\n`;
+  }
+  push();
+  return files.filter((f) => f.path !== '');
+}
+
 const ADAPTERS = {
   claude: {
     id: 'claude',
@@ -89,9 +193,15 @@ const ADAPTERS = {
     root: (p) => p.cwd,
     extract: (p) => ({
       command: p.tool_name === 'Bash' ? (p.tool_input?.command ?? null) : null,
-      writes: ['Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(p.tool_name)
-        ? [p.tool_input?.file_path].filter(Boolean)
-        : [],
+      // NotebookEdit spells its target `notebook_path`, not `file_path`: a key list
+      // that misses it is a lease the notebook can walk straight through (review
+      // 0003 Q16). Edit details travel with the path so the generated-region
+      // check can tell an edit outside the region from one inside it (Q17).
+      writes: ['Edit', 'Write', 'MultiEdit'].includes(p.tool_name)
+        ? [writeOf(p.tool_input?.file_path, p.tool_input)].filter(Boolean)
+        : p.tool_name === 'NotebookEdit'
+          ? [writeOf(p.tool_input?.notebook_path, p.tool_input)].filter(Boolean)
+          : [],
     }),
     deny: (message) => ({
       hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: message },
@@ -124,11 +234,13 @@ const ADAPTERS = {
     root: (p) => p.cwd,
     extract: (p) => ({
       command: p.tool_name === 'Bash' ? (p.tool_input?.command ?? null) : null,
-      // apply_patch carries its targets inside the patch text, one header line per file.
+      // apply_patch carries its targets inside the patch text, one header line per file;
+      // a move names its destination on the `+++` line after `*** Move File:`, and the
+      // destination is the file the move writes (review 0003 Q16).
       writes:
         p.tool_name === 'apply_patch'
-          ? [...String(p.tool_input?.command ?? '').matchAll(/^\*\*\* (?:Update|Add|Delete) File: (.+)$/gm)].map((m) => m[1].trim())
-          : [],
+          ? patchWrites(String(p.tool_input?.command ?? ''))
+          : [], // entries carry {path, patch} so the region check maps hunks (Q17)
     }),
     deny: (message) => ({
       hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: message },
@@ -155,7 +267,7 @@ const ADAPTERS = {
     extract: (p) => ({
       command: p.tool_name === 'Shell' ? (p.tool_input?.command ?? null) : null,
       writes: ['Write', 'Edit'].includes(p.tool_name)
-        ? [p.tool_input?.file_path ?? p.tool_input?.path].filter(Boolean)
+        ? [writeOf(p.tool_input?.file_path ?? p.tool_input?.path, p.tool_input)].filter(Boolean)
         : [],
     }),
     deny: (message) => ({ permission: 'deny', user_message: message, agent_message: message }),
@@ -181,8 +293,8 @@ const ADAPTERS = {
       return {
         command: call.name === 'run_command' ? (args.CommandLine ?? null) : null,
         writes: ['write_to_file', 'replace_file_content', 'multi_replace_file_content'].includes(call.name)
-          ? [args.TargetFile].filter(Boolean)
-          : [],
+          ? [writeOf(args.TargetFile, args)].filter(Boolean)
+          : [], // CodeContent/old/new travel with the path for the region check (Q17)
       };
     },
     deny: (message) => ({ decision: 'deny', reason: message }),
@@ -207,7 +319,9 @@ const ADAPTERS = {
     root: (p) => p.cwd,
     extract: (p) => ({
       command: p.tool_name === 'run_shell_command' ? (p.tool_input?.command ?? null) : null,
-      writes: ['write_file', 'replace'].includes(p.tool_name) ? [p.tool_input?.file_path].filter(Boolean) : [],
+      writes: ['write_file', 'replace'].includes(p.tool_name)
+        ? [writeOf(p.tool_input?.file_path, p.tool_input)].filter(Boolean)
+        : [],
     }),
     deny: (message) => ({ decision: 'deny', reason: message }),
     // BeforeAgent appends text to the prompt for this turn only — the same lifetime as a
@@ -225,9 +339,34 @@ const ADAPTERS = {
       context: (text) => ({ hookSpecificOutput: { additionalContext: text } }),
     },
   },
+  opencode: {
+    id: 'opencode',
+    event: 'execute.before',
+    matcher: 'shell|write|edit',
+    // The plugin is a file the tool owns whole, not a config entry to merge:
+    // `file` routes `rendered` and `hookDocument` to its source (opencode.mjs).
+    file: true,
+    // A thrown error is the block; exit 2 is how the entry point signals it,
+    // and the reason the plugin throws is what `deny` prints.
+    denyExit: 2,
+    verified: 'opencode.ai/v2/docs/build/plugins/server, read 2026-10-29',
+    root: (p) => p.cwd,
+    extract: (p) => ({
+      command: p.tool === 'shell' ? (p.input?.command ?? null) : null,
+      writes: ['write', 'edit'].includes(p.tool) ? [writeOf(p.input?.path, p.input)].filter(Boolean) : [],
+    }),
+    deny: (message) => ({ reason: message }),
+    // session.hook('prompt') admits the prompt; the packet goes in front of it.
+    prompt: {
+      event: 'prompt',
+      verified: 'opencode.ai/v2/docs/build/plugins/server, read 2026-10-29',
+      context: (text) => ({ text }),
+    },
+    post: null,
+  },
 };
 
-/** The five adapters, in the order the reader table lists them. */
+/** The six adapters, in the order the reader table lists them. */
 export function adapters() {
   return hookRows()
     .filter((r) => r.path !== null)
@@ -240,6 +379,17 @@ export function adapter(id) {
   return row && hookPath(id) !== null ? row : null;
 }
 
+/**
+ * The session a payload claims, when it names one. Harness hook processes rarely
+ * carry `SIMT_SESSION`, so an agent is session `''` and is blocked by its own
+ * lease — the payload's own session id is the fallback (review 0003 Q20).
+ */
+export function payloadSession(payload) {
+  if (!payload || typeof payload !== 'object') return null;
+  const direct = payload.session_id ?? payload.sessionId ?? payload.session?.id ?? payload.tool_input?.session_id ?? null;
+  return typeof direct === 'string' && direct.trim() !== '' ? direct : null;
+}
+
 /**
  * The facts a payload carries, and the root it names. An unknown shape yields none.
  *
@@ -252,7 +402,11 @@ export function adapter(id) {
  */
 export function factsFrom(row, payload, { root } = {}) {
   const override = typeof root === 'string' && root.trim() !== '' ? root : null;
-  return { root: override ?? row.root(payload) ?? process.cwd(), ...row.extract(payload ?? {}) };
+  return {
+    root: override ?? row.root(payload) ?? process.cwd(),
+    session: payloadSession(payload),
+    ...row.extract(payload ?? {}),
+  };
 }
 
 /** The document to print for a decision, or null when there is nothing to say. */
@@ -352,6 +506,9 @@ function group(row, event = EVENTS[0], command = hookCommand(row.id, event)) {
     // failClosed is set because a hooks file this tool wrote should not silently
     // degrade to fail-open on its own crash: the vendor's default turns a broken hook
     // into an absent one, and the whole point of writing it is that it runs.
+    // It is set only because the command is the repo shim (review 0003 Q21):
+    // failClosed on a bare-PATH binary would block every tool call on the machines
+    // where the binary is not installed, which is exactly the machines the shim exists for.
     return { command, timeout, matcher: row.matcher, failClosed: true };
   }
   return { matcher: row.matcher, hooks: [{ type: 'command', command, timeout }] };
@@ -359,7 +516,10 @@ function group(row, event = EVENTS[0], command = hookCommand(row.id, event)) {
 
 /** Whether a group is this tool's, judged by the command it runs and not by position. */
 function ours(entry) {
-  return JSON.stringify(entry).includes(`${CLI} agent-hook`);
+  const text = JSON.stringify(entry);
+  // The shim spelling first; the bare-binary spelling is the pre-shim install,
+  // still recognised (and migrated on the next install) for one release.
+  return text.includes(AGENT_HOOK_SHIM) || text.includes(`${CLI} agent-hook`);
 }
 
 function entries(row, config, event = EVENTS[0]) {
@@ -399,6 +559,12 @@ function withHook(row, config, { prompt = false, post = false, command } = {}) {
 
 /** The text `install` would write, or the reason the existing file cannot be read. */
 export function rendered(row, existing, options = {}) {
+  if (row.file) {
+    // The tool owns this file whole, so there is nothing to merge: the text is
+    // the plugin source and `updated` means only that the bytes differ.
+    const text = renderOpencodePlugin({ command: options.command ?? hookCommand(row.id), prompt: options.prompt });
+    return { text, action: existing === null ? 'created' : text === existing ? 'unchanged' : 'updated' };
+  }
   if (existing === null) return { text: `${JSON.stringify(withHook(row, {}, options), null, 2)}\n`, action: 'created' };
   let config;
   try {
@@ -422,6 +588,7 @@ export function rendered(row, existing, options = {}) {
 export function hookDocument(id, { command, prompt = false, post = false } = {}) {
   const row = adapter(id);
   if (!row) return null;
+  if (row.file) return renderOpencodePlugin({ command: command ?? hookCommand(id), prompt });
   const config = withHook(row, {}, { prompt, post, command });
   return `${JSON.stringify(config, null, 2)}\n`;
 }