tackbox 0.1.83 → 0.1.89

package/README.md

@@ -169,6 +169,10 @@ past (argparse misuse, and the per-command cases below).
   PostToolUse finding on the edited lines, a non-compiling Go
   package, or an approvals inconsistency anywhere in the worktree,
   which blocks the edit in-loop.
+- **hook-protocol** - `0` whenever a decision was reached, whatever the
+  decision says (it rides the JSON on stdout, never the exit code); `1`
+  plus one stderr line when none was: unreadable stdin, or a request
+  whose protocol version this tackbox does not speak.
 - **escapes** - `0` whenever it runs, entries or not (an inventory,
   not a gate); `1` only for a bad `--since` rev.
 
@@ -569,34 +573,44 @@ specified in [docs/report-contracts.md](docs/report-contracts.md).
 - [Python](py/tackbox_report/README.md)
 - [Java](java/report/README.md)
 
-## Agent hook (Claude Code)
-
-`tackbox hook` wires the rules into an agent's edit loop. It reads a
-Claude Code hook event on stdin and dispatches by `hook_event_name`:
-
-- **PostToolUse** on an Edit/Write re-lints the edited file (Go: its
-  package). On a finding it exits 2 with the finding on stderr, so
-  the model sees it and fixes it in-loop. Every Post event - **Bash**
-  included - also runs the whole-tree approvals consistency check:
-  an unapproved marker, an orphaned entry, or an unresolvable file
-  blocks with the entry named and the fix - add the manifest line,
-  which asks, or revert. Stateless and tree-shaped: a commit changes
-  nothing, and the block repeats on every event until the tree is
-  consistent. The authoritative gate stays pre-commit / CI.
-- **PreToolUse** asks for approval before a new `.tackbox/approvals`
-  line or a new `.tackbox/reporters` line lands, before a positive
-  exclusion line is added to any `.gitattributes`, and before an edit
-  to an attribute-excluded file (see "Generated and vendored code");
-  removing a line is free. Editing markers in code draws no Pre ask -
-  the consistency check owns them.
+## Agent hook
+
+The rules wire into a coding agent's edit loop through one shared core: the
+approval gates, the diff-scoped lint, and the whole-tree consistency check
+are the same whichever host drives them. In host-neutral terms:
+
+- **Post-edit** re-lints the touched files (Go: their package). A finding on
+  the lines the edit added blocks with the finding text. Every post event -
+  including an opaque channel - also runs the whole-tree approvals consistency
+  check: an unapproved marker, an orphaned entry, or an unresolvable file blocks
+  with the named fix. A verified violation is always a tool error. A post event
+  that cannot be verified reports three facts: the mutation may already have
+  landed, why verification did not complete, and that the mutation must not be
+  repeated before `dev.py check`. OMP appends that warning to the model-facing
+  tool result without changing a successful tool state. Claude Code writes it
+  to user-visible PostToolUse stderr with exit 1, so it is not model-visible.
+- **Pre-edit** asks for approval before a new `.tackbox/approvals` line or a
+  new `.tackbox/reporters` line lands, before a positive exclusion line is
+  added to any `.gitattributes`, before editing an attribute-excluded file, and
+  before deleting or moving the root `dev.py`; removing a gate line is free.
+  A known target whose content is ambiguous asks when it reaches a bypass
+  surface. An unclassifiable file mutation or a failed policy dependency blocks
+  before it can run; it is never weakened into an approval prompt.
 
 Only markers in files an engine would lint participate in the check
 (D012): a marker in a Go `testdata/` path or a non-lintable fixture
 extension (a `.java.txt`) is dead text - no entry needed, no
 question - while the `.tackbox/reporters` gate stays unconditional.
 
-The hook is a no-op unless the edit's `cwd` is a git repo with a
-`dev.py` at its root. Wire it once, globally, in
+The hook is inactive only when `git rev-parse --show-toplevel` emits C-locale
+stderr containing `not a git repository`, or after its discovered root has no
+`dev.py`. A missing git executable, corrupt Git config, or another discovery
+failure is unverified, not a no-op.
+
+### Claude Code
+
+`tackbox hook` reads a Claude Code hook event on stdin and dispatches by
+`hook_event_name` (`PreToolUse`, `PostToolUse`). Wire it once, globally, in
 `~/.claude/settings.json`:
 
 ```json
@@ -617,6 +631,104 @@ The hook is a no-op unless the edit's `cwd` is a git repo with a
 `uvx tackbox hook` runs the cached tackbox (no `@latest`): the hook is
 fast in-loop feedback, not the authoritative gate.
 
+### Oh My Pi
+
+```bash
+omp plugin install tackbox
+```
+OMP loads the ESM entry point `js/omp/index.mjs`, which delegates to the internal
+CommonJS implementation.
+
+That is the whole wiring: the npm package declares an extension
+(`package.json#omp.extensions`) and OMP loads it. The extension subscribes to
+the public `tool_call` / `tool_result` events and covers all five OMP 18.x
+`edit` modes: `replace`, `patch`, `hashline`, `apply_patch`, and `sloppy`,
+including multi-file edits, clipboard registers, moves, and deletes. Its
+compatibility parser accepts `U+00B6PATH#TAG` headers plus sloppy `[path]`,
+`U+00A7path`, and `U+00A7*path` section openers; bare `U+00A7` forms continue
+the current file.
+
+- a pre-edit ask becomes a confirmation dialog. In a headless or subagent
+  session, where nobody can answer, it blocks with the reason instead of
+  approving itself; a denied ask blocks before the tool runs.
+- a verified post violation becomes a tool error carrying the findings, which
+  keeps the agent in-loop on them.
+- an unverified pre event blocks. The child has a 20-second deadline inside
+  OMP's 30-second handler budget. An unverified post event carries the shared
+  three-fact warning, omits an `isError` override so OMP preserves the host
+  state, and tells the model not to repeat the mutation before `dev.py check`.
+- an opaque write channel (`xd://` tool devices, archive members, SQLite rows),
+  every `bash` call, and every `eval` call name no file, so they run the
+  whole-tree approvals wall alone.
+- MCP tool names are not enumerated by this extension. Their file mutations are
+  an explicit residual outside its pre gate and post wall; review their diff and
+  run `dev.py check`.
+- the post adapter consumes each result-detail record independently. It falls
+  back to a snapshot only for that record when the record is pruned; failed
+  records do not widen the scope of successful landed records. OMP 18.x does
+  not identify a landed subset for a single aggregate error without per-file
+  details, so Tackbox runs its whole-tree wall, preserves the host error, and
+  cannot safely perform targeted lint for that residual.
+
+The extension runs `uvx tackbox@<npm package version> hook-protocol`. A tagged
+wheel is built and protocol-canary tested, published to PyPI, then a successful
+release workflow automatically publishes the matching npm package from its
+immutable completed-run source. If a pending npm job is canceled, rerun `publish`
+from the Actions UI; there is no standalone npm redispatch.
+
+For development against a working tree, name the command explicitly - a JSON array
+of argv, never a shell string:
+
+```bash
+TACKBOX_OMP_COMMAND='["uv","run","--directory","py","python","-m","tackbox.cli"]'
+```
+
+The subcommand is appended by the extension, never taken from the override, so
+a development command cannot answer a different protocol. There is no
+`@latest` fallback: an unpinned wheel could answer a protocol version the
+extension does not speak.
+
+### Other hosts
+
+`tackbox hook-protocol` is the host-neutral wire - one JSON event on stdin,
+one JSON decision on stdout:
+
+```json
+{"protocol": 1, "phase": "pre", "cwd": "/repo", "tool": "edit",
+ "targets": [{"path": "/repo/app/svc.py", "op": "edit",
+              "expectedPresent": true,
+              "added": ["x = 2"], "removed": ["x = 1"]}],
+ "unknown": null}
+```
+
+```json
+{"protocol": 1, "decision": "ask",
+ "reason": "approve suppression marker: app/svc.py: no-report: covered upstream"}
+```
+
+- `cwd` is the host session's non-empty absolute working directory.
+- `phase` is `pre` (before the tool runs, still refusable) or `post` (after it
+  landed). Pre requests omit `succeeded`; post requests require the boolean
+  `succeeded`, so a failed tool is not misreported as a missing landed file.
+- `tool` is one of `edit`, `apply_patch`, `write`, `bash`, or `eval`. `bash` and
+  `eval` are target-free wall-only channels.
+- a **target** is one file mutation with an absolute `path`, `op`, and
+  `expectedPresent`. `edit` and `write` expect the path to exist, `delete`
+  expects it absent, and a move reports an absent source plus a present
+  destination. `content` is a full replacement; otherwise `added` and
+  `removed` are text fragments. `content` and fragments are mutually exclusive.
+  `ambiguous: true` means a known target needs whole-file treatment.
+- **zero targets** is the opaque channel: the whole-tree wall runs, nothing
+  file-scoped does. `unknown` is a non-empty reason only when no concrete
+  target can be named; it blocks pre and warns post.
+- the wire decisions are `allow`, `ask`, `block`, and `warn`. The semantic
+  outcomes are inactive, allow, approval-required, violation, and unverified:
+  unverified maps to `block` pre and `warn` post. Hosts must make a post warning
+  visible without turning a successful mutation into a repeatable tool error.
+- exit is `0` whenever a decision was reached, whatever it says; `1` plus one
+  stderr line means no decision (unreadable stdin, or a protocol version this
+  tackbox does not speak).
+
 ## Escapes inventory
 
 `tackbox escapes` prints the repo's whole bypass surface as JSON on
@@ -728,7 +840,7 @@ exit 1.
 dev.py                                 # lint / test / e2e / check (dev-script)
 hygiene.py                             # dev.py lint hygiene (conflict/yaml/ws/newline)
 go.mod                                 # Go module
-package.json                           # npm package (ESLint plugin + report helper)
+package.json                           # npm package (ESLint plugin + OMP extension + report helper)
 eslint.config.preset.js                # default config used by tackbox-eslint bin
 bin/tackbox-eslint.js                  # ESLint CLI wrapper with bundled preset
 bin/tackbox-mdlint.js                  # markdownlint wrapper with bundled preset
@@ -749,6 +861,7 @@ js/
   rules/                               # 14 frontend rules
   markdownlint-rules/                  # custom markdownlint rules
   report.js                            # browser capture helper (@sentry/browser)
+  omp/                                 # Oh My Pi extension (payload parser + hook-protocol client)
   tests/                               # RuleTester + node:test
 py/
   tackbox/                             # lint / hook / doctor CLI, cache, engines

package/js/README.md

@@ -13,6 +13,14 @@ lint:
 uvx tackbox@latest lint .
 ```
 
+## Oh My Pi extension
+
+The same npm package carries tackbox's Oh My Pi extension, so
+`omp plugin install tackbox` wires the rules into an agent's edit loop
+with nothing else to configure. See
+[Agent hook](../README.md#agent-hook) for what it gates, how a decision
+reaches the agent, and the development command override.
+
 ## Direct ESLint integration
 
 To wire the plugin into your own ESLint run instead, install it from

package/js/omp/hook.js

@@ -0,0 +1,213 @@
+// Spawn the pinned tackbox wheel and translate its protocol response.
+
+const { spawn } = require('node:child_process')
+
+const PROTOCOL = 1
+const SUBCOMMAND = 'hook-protocol'
+const TIMEOUT_MS = 20000
+const COMMAND_ENV = 'TACKBOX_OMP_COMMAND'
+
+const ALLOW = 'allow'
+const ASK = 'ask'
+const BLOCK = 'block'
+const UNVERIFIED = 'unverified'
+const WIRE_WARN = 'warn'
+const WIRE_KINDS = new Set([ALLOW, ASK, BLOCK, WIRE_WARN])
+const DEFAULT_TIMERS = { set: setTimeout, clear: clearTimeout }
+
+function request(phase, cwd, normalized) {
+  const event = {
+    protocol: PROTOCOL,
+    phase,
+    cwd,
+    tool: normalized.tool,
+    targets: normalized.targets,
+    unknown: normalized.unknown,
+  }
+  if (normalized.targetless !== undefined) event.targetless = normalized.targetless
+  if (phase === 'post') event.succeeded = normalized.succeeded
+  return event
+}
+
+async function decide(event, options) {
+  const argv = resolveArgv(options.env, options.version)
+  if (argv.error !== null) return unverified(argv.error)
+  const run = await execute(argv.value, event, options.timers || DEFAULT_TIMERS)
+  if (run.failure !== null) return unverified(run.failure)
+  if (run.code !== 0) {
+    const detail = firstLine(run.stderr) || `${argv.value[0]} exited with ${run.code}`
+    return unverified(detail)
+  }
+  const decoded = parseJson(run.stdout.trim())
+  if (decoded.error !== null) return unverified(`unreadable hook decision (${decoded.error})`)
+  return asDecision(decoded.value)
+}
+
+function resolveArgv(env, version) {
+  const override = env[COMMAND_ENV]
+  if (typeof override !== 'string' || override.trim() === '') {
+    return { value: ['uvx', `tackbox@${version}`, SUBCOMMAND], error: null }
+  }
+  const decoded = parseJson(override)
+  const argv = decoded.value
+  const usable =
+    Array.isArray(argv) &&
+    argv.length > 0 &&
+    argv.every(value => typeof value === 'string' && value.trim() !== '')
+  if (!usable) {
+    return {
+      value: null,
+      error: `${COMMAND_ENV} must be a JSON array of argv strings; the tackbox hook did not run`,
+    }
+  }
+  return { value: [...argv, SUBCOMMAND], error: null }
+}
+
+function execute(argv, event, timers, spawnChild = spawn) {
+  return new Promise(resolve => {
+    let child
+    // no-report: synchronous spawn failure resolves the protocol failure outcome.
+    try {
+      child = spawnChild(argv[0], argv.slice(1), {
+        cwd: event.cwd,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        windowsHide: true,
+      })
+    } catch (error) {
+      resolve({ code: null, stdout: '', stderr: '', failure: `cannot run ${argv[0]}: ${message(error)}` })
+      return
+    }
+    if (!child.stdin || !child.stdout || !child.stderr) {
+      resolve({ code: null, stdout: '', stderr: '', failure: `cannot run ${argv[0]}: missing protocol stream` })
+      return
+    }
+    let stdout = ''
+    let stderr = ''
+    let timer = null
+    let settled = false
+    let closed = false
+    let closeCode = null
+    let stdinFinished = false
+    const finish = (failure, code) => {
+      if (settled) return
+      settled = true
+      if (timer !== null) timers.clear(timer)
+      resolve({ code, stdout, stderr, failure })
+    }
+    const stop = failure => {
+      let detail = failure
+      if (!child.kill()) detail += '; child had already exited'
+      finish(detail, null)
+    }
+    const finishClose = () => {
+      if (closed && stdinFinished) finish(null, closeCode)
+    }
+    timer = timers.set(() => {
+      stop(`the tackbox hook timed out after ${TIMEOUT_MS / 1000}s`)
+    }, TIMEOUT_MS)
+    child.stdout.setEncoding('utf8')
+    child.stdout.on('data', chunk => {
+      stdout += chunk
+    })
+    child.stdout.on('error', error => {
+      stop(`the tackbox hook stdout stream failed: ${message(error)}`)
+    })
+    child.stderr.setEncoding('utf8')
+    child.stderr.on('data', chunk => {
+      stderr += chunk
+    })
+    child.stderr.on('error', error => {
+      stop(`the tackbox hook stderr stream failed: ${message(error)}`)
+    })
+    child.on('error', error => finish(`cannot run ${argv[0]}: ${message(error)}`, null))
+    child.on('close', code => {
+      closed = true
+      closeCode = code
+      finishClose()
+    })
+    child.stdin.on('finish', () => {
+      stdinFinished = true
+      finishClose()
+    })
+    child.stdin.on('error', error => {
+      stop(`the tackbox hook stdin stream failed: ${message(error)}`)
+    })
+    // no-report: a synchronous stdin failure has the same unverified outcome as EPIPE.
+    try {
+      child.stdin.end(JSON.stringify(event))
+    } catch (error) {
+      stop(`the tackbox hook stdin stream failed: ${message(error)}`)
+    }
+  })
+}
+
+function asDecision(payload) {
+  if (!isObject(payload)) return unverified('the hook decision was not a JSON object')
+  if (!Number.isInteger(payload.protocol) || payload.protocol !== PROTOCOL) {
+    return unverified(
+      `the hook decision speaks protocol ${JSON.stringify(payload.protocol)}; this extension speaks ${PROTOCOL}`,
+    )
+  }
+  if (!WIRE_KINDS.has(payload.decision)) {
+    return unverified(`unknown hook decision ${JSON.stringify(payload.decision)}`)
+  }
+  if (typeof payload.reason !== 'string') {
+    return unverified('the hook decision carried a non-string reason')
+  }
+  if (payload.decision === ALLOW && payload.reason !== '') {
+    return unverified('the hook allow decision unexpectedly carried a reason')
+  }
+  if (payload.decision !== ALLOW && payload.reason.trim() === '') {
+    return unverified('the hook decision omitted its required reason')
+  }
+  if (payload.decision === WIRE_WARN) return unverified(payload.reason)
+  return { kind: payload.decision, reason: payload.reason }
+}
+
+function parseJson(text) {
+  // parse-skip: protocol JSON is intentionally parsed only at this boundary.
+  // no-report: malformed JSON becomes an explicit unverified outcome.
+  try {
+    return { value: JSON.parse(text), error: null }
+  } catch (error) {
+    return { value: null, error: message(error) }
+  }
+}
+
+function unverified(reason) {
+  const text = String(reason)
+  return {
+    kind: UNVERIFIED,
+    reason: text.startsWith('tackbox') ? text : `tackbox: ${text}`,
+  }
+}
+
+function firstLine(text) {
+  for (const line of String(text || '').split('\n')) {
+    if (line.trim() !== '') return line.trim()
+  }
+  return ''
+}
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function message(error) {
+  return String((error && error.message) || error)
+}
+
+module.exports = {
+  ALLOW,
+  ASK,
+  BLOCK,
+  UNVERIFIED,
+  COMMAND_ENV,
+  TIMEOUT_MS,
+  decide,
+  execute,
+  request,
+  resolveArgv,
+  asDecision,
+  unverified,
+}

package/js/omp/index.js

@@ -0,0 +1,118 @@
+// Tackbox as an OMP extension over the strict shared hook protocol.
+
+const payload = require('./payload')
+const hook = require('./hook')
+const manifest = require('../../package.json')
+
+const CONFIRM_TITLE = 'tackbox approval'
+const HEADLESS_NOTE =
+  'tackbox cannot ask here (no interactive session), so the call is blocked' +
+  ' instead of approved. Re-issue it interactively, or drop the gated line.'
+const DENIED = 'tackbox: approval denied.'
+const BLOCKED = 'tackbox blocked this change:'
+
+module.exports = function tackbox(pi) {
+  pi.setLabel('tackbox')
+
+  pi.on('tool_call', async (event, ctx) => {
+    const normalized = payload.normalize(event && event.toolName, event && event.input, ctx && ctx.cwd)
+    if (normalized === null) return undefined
+    if (normalized.failure) return applyPre(hook.unverified(normalized.failure), ctx)
+    if (normalized.unknown === null && normalized.targets.length === 0 && normalized.targetless === 'opaque') {
+      return undefined
+    }
+    const decision = await hook.decide(hook.request('pre', ctx.cwd, normalized), options(ctx))
+    return applyPre(decision, ctx)
+  })
+
+  pi.on('tool_result', async (event, ctx) => {
+    const normalized = payload.normalizeResult(
+      event && event.toolName,
+      event && event.details,
+      event && event.input,
+      ctx && ctx.cwd,
+      event && event.isError,
+    )
+    if (normalized === null) return undefined
+    const decision = normalized.failure
+      ? hook.unverified(normalized.failure)
+      : await hook.decide(hook.request('post', ctx.cwd, normalized), options(ctx))
+    return applyPost(decision, event)
+  })
+}
+
+async function applyPre(decision, ctx) {
+  if (decision.kind === hook.BLOCK || decision.kind === hook.UNVERIFIED) {
+    return { block: true, reason: decision.reason }
+  }
+  if (decision.kind === hook.ALLOW) return undefined
+  if (decision.kind !== hook.ASK) {
+    return { block: true, reason: `tackbox: unrecognized pre decision ${String(decision.kind)}` }
+  }
+  if (!ctx || !ctx.hasUI || !ctx.ui || typeof ctx.ui.confirm !== 'function') {
+    return { block: true, reason: `${decision.reason}\n\n${HEADLESS_NOTE}` }
+  }
+  const approved = await ctx.ui.confirm(CONFIRM_TITLE, decision.reason)
+  if (approved === true) return undefined
+  return { block: true, reason: `${DENIED}\n${decision.reason}` }
+}
+
+function applyPost(decision, event) {
+  const kind = decision && decision.kind
+  if (kind === hook.BLOCK) {
+    return {
+      content: appended(event, `${BLOCKED}\n${decision.reason}`),
+      isError: true,
+    }
+  }
+  if (kind === hook.UNVERIFIED) {
+    return {
+      content: appended(event, unverifiedPostMessage(decision.reason)),
+    }
+  }
+  if (kind === hook.ALLOW) return undefined
+  return {
+    content: appended(
+      event,
+      unverifiedPostMessage(`tackbox returned an unrecognized post decision ${String(kind)}`),
+    ),
+  }
+}
+
+function unverifiedPostMessage(reason) {
+  const text = typeof reason === 'string' ? reason : String(reason)
+  if (
+    text.includes('The mutation may already have landed.') &&
+    text.includes('Do not repeat the mutation; dev.py check remains required.')
+  ) {
+    return text
+  }
+  return [
+    'The mutation may already have landed.',
+    `Tackbox verification did not complete: ${text}`,
+    'Do not repeat the mutation; dev.py check remains required.',
+  ].join('\n')
+}
+
+function appended(event, text) {
+  const content = Array.isArray(event && event.content) ? event.content : []
+  return [...content, { type: 'text', text }]
+}
+
+function options(ctx) {
+  return {
+    env: process.env,
+    version: manifest.version,
+    timers: managedTimers(ctx),
+  }
+}
+
+function managedTimers(ctx) {
+  if (!ctx || typeof ctx.setTimeout !== 'function' || typeof ctx.clearTimer !== 'function') {
+    return null
+  }
+  return {
+    set: (fn, ms) => ctx.setTimeout(fn, ms),
+    clear: handle => ctx.clearTimer(handle),
+  }
+}

package/js/omp/index.mjs

@@ -0,0 +1,3 @@
+import factory from './index.js'
+
+export default factory

package/js/omp/payload.js

@@ -0,0 +1,749 @@
+// OMP public tool events reduced to strict host-neutral hook protocol targets.
+
+const path = require('node:path')
+
+const TAGGED = /^\[(.+)#[0-9A-Fa-f]{4}\]\s*$/
+const ENVELOPE = /^\*\*\* (?:Begin|End) Patch\s*$/
+const FILE_SENTINEL = /^\*\*\* (Update|Add|Delete) File:\s*(.+?)\s*$/
+const MOVE_SENTINEL = /^\*\*\* Move to:\s*(.+?)\s*$/
+const MV_OP = /^MV\s+(.+?)\s*$/
+const CUT_OP = /^CUT\b/
+const REM_OP = /^REM\s*$/
+const PUT_OP = /^PUT\b/
+const HUNK = /^@@/
+const PILCROW_HEADER = /^\s*\u00b6+(.*)$/u
+const SLOPPY_HEADER = /^\[([^\]\n]+)\]\s*$/
+const SLOPPY_SECTION = /^\u00a7(\*?)(.*)$/u
+const SLOPPY_OPERATION = /^\u00ab/u
+const URI_TARGET = /^[a-zA-Z][a-zA-Z0-9+.-]+:\/\//
+const CONTAINER_TARGET = /\.(?:tar|tar\.gz|tgz|zip|jar|war|ear|apk|sqlite|sqlite3|db|db3):/i
+const MESSAGE_CLIP = 120
+
+function normalize(toolName, input, cwd) {
+  const tool = checkedTool(toolName)
+  if (tool.failure) return tool
+  if (tool.value === null) return null
+  const root = checkedRoot(cwd)
+  if (root.failure) return root
+  if (!isObject(input)) return unknown(tool.value, 'a non-object input')
+  if (tool.value === 'bash' || tool.value === 'eval') {
+    return normalized(tool.value, [], null, undefined, 'opaque')
+  }
+  if (tool.value === 'write') return normalizeWrite(tool.value, input, root.value)
+  return normalizeEdit(tool.value, input, root.value)
+}
+
+function normalizeResult(toolName, details, input, cwd, isError) {
+  const tool = checkedTool(toolName)
+  if (tool.failure) return tool
+  if (tool.value === null) return null
+  const root = checkedRoot(cwd)
+  if (root.failure) return root
+  if (typeof isError !== 'boolean') {
+    return failure('OMP supplied a non-boolean tool-result isError flag')
+  }
+  if (tool.value === 'bash' || tool.value === 'eval') {
+    return normalized(tool.value, [], null, !isError, 'opaque')
+  }
+  if (tool.value === 'write' && isOpaqueWrite(input)) {
+    return normalized(tool.value, [], null, !isError, 'opaque')
+  }
+  if (!isObject(details)) {
+    if (isError) return normalized(tool.value, [], null, false, 'failed')
+    return failure('OMP supplied no object result details for a successful file mutation')
+  }
+  const records = detailRecords(details)
+  if (records.failure) return records
+  // Pinned single-path aggregate errors do not identify which entries landed.
+  if (isError && !records.perFile) return normalized(tool.value, [], null, false, 'failed')
+  const decoded = []
+  for (const record of records.value) {
+    const parsed = detailTargets(record, root.value, tool.value)
+    if (parsed.failure) return parsed
+    if (parsed.failed) {
+      if (!isError) return failure('OMP reported a failed per-file result without an aggregate error')
+      continue
+    }
+    decoded.push(parsed)
+  }
+  let targets = decoded.flatMap(result => result.targets)
+  if (decoded.some(result => result.snapshotsPruned)) {
+    const fallback = normalize(tool.value, input, root.value)
+    if (
+      fallback === null ||
+      fallback.failure ||
+      fallback.unknown !== null ||
+      fallback.targetless !== undefined
+    ) {
+      return failure('OMP pruned result snapshots and the original input cannot be matched safely')
+    }
+    const unused = new Set(fallback.targets.map((_, index) => index))
+    targets = []
+    for (const parsed of decoded) {
+      if (!parsed.snapshotsPruned) {
+        targets.push(...parsed.targets)
+        continue
+      }
+      const merged = mergePrunedTargets(parsed.targets, fallback.targets, unused)
+      if (merged.failure) return merged
+      targets.push(...merged.value)
+    }
+    if (!records.perFile && unused.size > 0) {
+      return failure('OMP result details omitted one or more mutated input targets')
+    }
+  }
+  if (targets.length === 0) {
+    const targetless = isError
+      ? 'failed'
+      : decoded.every(result => result.targetless === 'no-op')
+        ? 'no-op'
+        : null
+    if (targetless === null) return failure('OMP result details name no landed target')
+    return normalized(tool.value, [], null, !isError, targetless)
+  }
+  return normalized(tool.value, targets, null, !isError)
+}
+
+function checkedTool(toolName) {
+  if (typeof toolName !== 'string' || toolName.trim() === '') {
+    return failure('OMP supplied a malformed toolName')
+  }
+  if (!['edit', 'apply_patch', 'write', 'bash', 'eval'].includes(toolName)) {
+    return { value: null }
+  }
+  return { value: toolName }
+}
+
+function checkedRoot(cwd) {
+  if (typeof cwd !== 'string' || cwd === '' || !path.isAbsolute(cwd)) {
+    return failure('OMP supplied no absolute session cwd')
+  }
+  return { value: cwd }
+}
+
+function sessionRoot(cwd) {
+  const root = checkedRoot(cwd)
+  return root.failure ? null : root.value
+}
+
+function normalizeWrite(tool, input, cwd) {
+  const raw = untag(stringOrNull(input.path))
+  if (raw === null) return unknown(tool, 'a write with no string path')
+  if (isOpaquePath(raw)) return normalized(tool, [], null, undefined, 'opaque')
+  const content = stringOrNull(input.content)
+  if (content === null) return unknown(tool, `a write to ${clip(raw)} with no string content`)
+  return normalized(tool, [target(path.resolve(cwd, raw), 'write', true, { content })], null)
+}
+
+function normalizeEdit(tool, input, cwd) {
+  const patchInput = stringOrNull(input.input) || stringOrNull(input._input)
+  if (patchInput !== null) return parsePatchText(tool, patchInput, cwd)
+  if (typeof input.old_string === 'string' || typeof input.new_string === 'string') {
+    return normalizeReplace(tool, input, cwd)
+  }
+  if (Array.isArray(input.edits)) return normalizeEdits(tool, input, cwd)
+  return normalizePublicPaths(tool, input, cwd)
+}
+function normalizePublicPaths(tool, input, cwd) {
+  if (input.paths !== undefined) {
+    if (!Array.isArray(input.paths) || input.paths.length === 0) {
+      return unknown(tool, 'an OMP paths compatibility field that is not a non-empty array')
+    }
+    const paths = []
+    const seen = new Set()
+    for (const value of input.paths) {
+      const raw = untag(stringOrNull(value))
+      if (raw === null) return unknown(tool, 'an OMP paths compatibility field with a non-string path')
+      if (!seen.has(raw)) {
+        seen.add(raw)
+        paths.push(raw)
+      }
+    }
+    const direct = untag(stringOrNull(input.path))
+    if (direct !== null && !seen.has(direct)) {
+      return unknown(tool, 'conflicting OMP path and paths compatibility fields')
+    }
+    return normalized(
+      tool,
+      paths.map(raw => target(path.resolve(cwd, raw), 'edit', true, { ambiguous: true })),
+      null,
+    )
+  }
+  const raw = editPath(input)
+  if (raw === null) {
+    return unknown(tool, `an ${tool} payload with no input, old_string/new_string, edits, path, or paths field`)
+  }
+  return normalized(tool, [target(path.resolve(cwd, raw), 'edit', true, { ambiguous: true })], null)
+}
+
+
+function normalizeReplace(tool, input, cwd) {
+  const raw = editPath(input)
+  if (raw === null) return unknown(tool, 'a replace edit with no string path')
+  return normalized(tool, [
+    target(path.resolve(cwd, raw), 'edit', true, {
+      added: [typeof input.new_string === 'string' ? input.new_string : ''],
+      removed: [typeof input.old_string === 'string' ? input.old_string : ''],
+    }),
+  ], null)
+}
+
+function normalizeEdits(tool, input, cwd) {
+  const raw = editPath(input)
+  if (raw === null) return unknown(tool, 'a patch payload with no string path')
+  if (input.edits.length === 0) return unknown(tool, 'a patch payload with an empty edits list')
+  const drafts = new Map()
+  const source = draftFor(drafts, path.resolve(cwd, raw))
+  for (const entry of input.edits) {
+    if (!isObject(entry)) return unknown(tool, 'a patch edit that is not an object')
+    const op = entry.op === undefined ? 'update' : entry.op
+    if (typeof op !== 'string') return unknown(tool, 'a patch edit with a non-string op')
+    if (entry.rename !== undefined) {
+      const renamed = stringOrNull(entry.rename)
+      if (renamed === null) source.ambiguous = true
+      else markMove(source, draftFor(drafts, path.resolve(cwd, renamed)))
+    }
+    const destination = source.operation === 'move' ? moveDestination(drafts, source) : source
+    if (op === 'delete') {
+      markDelete(source)
+      continue
+    }
+    if (op === 'create') {
+      destination.operation = 'write'
+      destination.expectedPresent = true
+      if (
+        input.edits.length === 1 &&
+        entry.rename === undefined &&
+        typeof entry.diff === 'string' &&
+        entry.diff.length > 0
+      ) {
+        setContent(destination, entry.diff)
+      } else {
+        destination.ambiguous = true
+      }
+      continue
+    }
+    if (op !== 'update' || typeof entry.diff !== 'string' || entry.diff.length === 0) {
+      destination.ambiguous = true
+      continue
+    }
+    appendPatchFragments(destination, entry.diff)
+  }
+  return normalized(tool, finalizeDrafts(drafts), null)
+}
+
+function parsePatchText(tool, text, cwd) {
+  const drafts = new Map()
+  let current = null
+  let run = []
+  const flush = () => {
+    if (run.length > 0 && current !== null) current.added.push(run.join('\n'))
+    run = []
+  }
+  const open = (raw, operation = 'edit') => {
+    flush()
+    current = draftFor(drafts, path.resolve(cwd, unquote(raw)))
+    if (operation === 'write') current.operation = 'write'
+    if (operation === 'delete') markDelete(current)
+  }
+  const lines = text.split('\n')
+  for (let index = 0; index < lines.length; index++) {
+    const rawLine = lines[index]
+    const line = rawLine.endsWith('\r') ? rawLine.slice(0, -1) : rawLine
+    if (line.startsWith('+')) {
+      if (current === null) return unknown(tool, `an added row before any file section: ${clip(line)}`)
+      run.push(line.slice(1))
+      continue
+    }
+    flush()
+    if (line.trim() === '' || ENVELOPE.test(line) || HUNK.test(line)) continue
+    const tagged = TAGGED.exec(line)
+    if (tagged !== null) {
+      open(tagged[1])
+      continue
+    }
+    const pilcrow = PILCROW_HEADER.exec(line)
+    if (pilcrow !== null) {
+      const compatPath = pilcrowPath(pilcrow[1])
+      if (compatPath === null) return unknown(tool, 'a paragraph-sign header with no path')
+      open(compatPath)
+      continue
+    }
+    const sloppy = SLOPPY_SECTION.exec(line)
+    if (sloppy !== null) {
+      const sloppyPath = sloppy[2].trim()
+      if (sloppyPath !== '') {
+        open(sloppyPath)
+      } else if (current === null) {
+        return unknown(tool, 'a sloppy operation before any file section')
+      }
+      current.ambiguous = true
+      continue
+    }
+    const sloppyHeader = SLOPPY_HEADER.exec(line)
+    if (
+      sloppyHeader !== null &&
+      (current === null || startsSloppyOperation(lines, index + 1))
+    ) {
+      const sloppyPath = sloppyHeader[1].trim()
+      if (sloppyPath === '') return unknown(tool, 'a sloppy [path] header with no path')
+      open(sloppyPath)
+      continue
+    }
+    const sentinel = FILE_SENTINEL.exec(line)
+    if (sentinel !== null) {
+      open(sentinel[2], sentinel[1] === 'Add' ? 'write' : sentinel[1] === 'Delete' ? 'delete' : 'edit')
+      continue
+    }
+    const move = MV_OP.exec(line) || MOVE_SENTINEL.exec(line)
+    if (move !== null) {
+      if (current === null) return unknown(tool, 'a move operation before any file section')
+      const destination = draftFor(drafts, path.resolve(cwd, unquote(move[1])))
+      markMove(current, destination)
+      current = destination
+      continue
+    }
+    if (line.startsWith('-') || line.startsWith(' ')) {
+      if (current === null) return unknown(tool, `a patch row before any file section: ${clip(line)}`)
+      continue
+    }
+    if (REM_OP.test(line)) {
+      if (current === null) return unknown(tool, 'a remove operation before any file section')
+      markDelete(current)
+      continue
+    }
+    if (CUT_OP.test(line)) {
+      if (current === null) return unknown(tool, 'a cut operation before any file section')
+      continue
+    }
+    if (PUT_OP.test(line)) {
+      if (current === null) return unknown(tool, 'a put operation before any file section')
+      if (!line.endsWith(':')) current.ambiguous = true
+      continue
+    }
+    if (current === null) return unknown(tool, `an unrecognized patch row before any file section: ${clip(line)}`)
+    current.ambiguous = true
+  }
+  flush()
+  if (drafts.size === 0) {
+    return unknown(tool, 'a patch payload with no [PATH#TAG], paragraph-sign, sloppy, or `*** ... File:` section')
+  }
+  return normalized(tool, finalizeDrafts(drafts), null)
+}
+
+function startsSloppyOperation(lines, from) {
+  for (let index = from; index < lines.length; index++) {
+    const trimmed = lines[index].trim()
+    if (trimmed === '') continue
+    return SLOPPY_SECTION.test(trimmed) || SLOPPY_OPERATION.test(trimmed)
+  }
+  return false
+}
+
+function pilcrowPath(value) {
+  const trimmed = value.trim()
+  if (trimmed === '') return null
+  const tag = /#[0-9A-Fa-f]{4}$/.exec(trimmed)
+  const raw = tag === null ? trimmed : trimmed.slice(0, tag.index)
+  const unquoted = unquote(raw)
+  return unquoted === '' ? null : unquoted
+}
+
+function detailRecords(details) {
+  if (details.perFileResults === undefined) return { value: [details], perFile: false }
+  if (!Array.isArray(details.perFileResults) || details.perFileResults.length === 0) {
+    return failure('OMP supplied malformed perFileResults')
+  }
+  const records = []
+  for (const result of details.perFileResults) {
+    if (!isObject(result)) return failure('OMP supplied a non-object perFileResults entry')
+    records.push({
+      ...result,
+      snapshotsPruned: result.snapshotsPruned === undefined
+        ? details.snapshotsPruned
+        : result.snapshotsPruned,
+    })
+  }
+  return { value: records, perFile: true }
+}
+
+function detailTargets(record, cwd, tool) {
+  const valid = validateDetail(record)
+  if (valid.failure) return valid
+  if (record.isError === true) {
+    return { targets: [], snapshotsPruned: false, targetless: null, failed: true }
+  }
+  const operation = detailOperation(record, tool)
+  if (operation.failure) return operation
+  if (tool === 'write' && operation.value !== 'write') {
+    return failure('OMP write result details carry a non-write operation')
+  }
+  const paths = detailPaths(record, operation.value, cwd, tool)
+  if (paths.failure) return paths
+  const targets = paths.value
+  const snapshotsPruned = record.snapshotsPruned === true
+  const destination = targets.find(item => item.expectedPresent)
+  if (destination !== undefined) {
+    if (typeof record.newText === 'string') {
+      delete destination.added
+      delete destination.removed
+      delete destination.ambiguous
+      destination.content = record.newText
+    } else if (!snapshotsPruned) {
+      destination.ambiguous = true
+    }
+  }
+  return {
+    targets,
+    snapshotsPruned,
+    targetless: paths.targetless || null,
+    failed: false,
+  }
+}
+
+function validateDetail(record) {
+  for (const key of ['path', 'resolvedPath', 'sourcePath', 'op', 'oldText', 'newText', 'diff', 'errorText']) {
+    if (record[key] !== undefined && typeof record[key] !== 'string') {
+      return failure(`OMP supplied a non-string result details.${key}`)
+    }
+  }
+  if (record.isError !== undefined && typeof record.isError !== 'boolean') {
+    return failure('OMP supplied a non-boolean result details.isError')
+  }
+  if (record.errorText !== undefined && record.isError !== true) {
+    return failure('OMP supplied errorText without a failed result record')
+  }
+  if (record.snapshotsPruned !== undefined && typeof record.snapshotsPruned !== 'boolean') {
+    return failure('OMP supplied a non-boolean result details.snapshotsPruned')
+  }
+  if (
+    record.move !== undefined &&
+    typeof record.move !== 'boolean' &&
+    typeof record.move !== 'string' &&
+    !isObject(record.move)
+  ) {
+    return failure('OMP supplied malformed result details.move')
+  }
+  return { value: true }
+}
+
+function detailOperation(record, tool) {
+  const raw = record.op
+  const move = hasMove(record)
+  if (raw === undefined) return { value: move ? 'move' : tool === 'write' ? 'write' : 'edit' }
+  if (['update', 'replace', 'patch', 'edit', 'apply_patch'].includes(raw)) {
+    return { value: move ? 'move' : 'edit' }
+  }
+  if (['create', 'write'].includes(raw)) return { value: 'write' }
+  if (raw === 'delete') return { value: 'delete' }
+  if (['move', 'rename'].includes(raw)) return { value: 'move' }
+  return failure(`OMP supplied an unsupported result details.op ${JSON.stringify(raw)}`)
+}
+
+function detailPaths(record, operation, cwd, tool) {
+  const source = detailString(record, 'sourcePath') || movePath(record.move, 'source')
+  const declaredPath = detailString(record, 'path')
+  const resolvedPath = detailString(record, 'resolvedPath')
+  const destination = tool === 'write'
+    ? resolvedPath || declaredPath || movePath(record.move, 'destination')
+    : declaredPath || resolvedPath || movePath(record.move, 'destination')
+  if (operation === 'delete') {
+    const deleted = source || destination
+    if (deleted === null) return failure('OMP delete result details name no source path')
+    return { value: [target(path.resolve(cwd, deleted), 'delete', false)] }
+  }
+  if (operation === 'move') {
+    if (source === null || destination === null) {
+      return failure('OMP move result details must name both sourcePath and path')
+    }
+    const sourcePath = path.resolve(cwd, source)
+    const destinationPath = path.resolve(cwd, destination)
+    const pair = moveId(sourcePath, destinationPath)
+    return {
+      value: [
+        target(sourcePath, 'move', false, { moveId: pair }),
+        target(destinationPath, 'move', true, { ambiguous: true, moveId: pair }),
+      ],
+    }
+  }
+  const landed = destination || source
+  if (landed === null && operation === 'edit') {
+    if (isExactNoop(record)) return { value: [], targetless: 'no-op' }
+    if (hasPathlessMutation(record)) {
+      return failure('OMP supplied mutating pathless edit result details')
+    }
+    return failure('OMP supplied malformed pathless edit result details')
+  }
+  if (landed === null) return failure('OMP result details name no landed path')
+  return { value: [target(path.resolve(cwd, landed), operation, true, { ambiguous: true })] }
+}
+
+function isExactNoop(record) {
+  return (
+    record.op === 'update' &&
+    record.diff === '' &&
+    record.oldText === undefined &&
+    record.newText === undefined &&
+    record.snapshotsPruned !== true &&
+    !hasMove(record)
+  )
+}
+
+function hasPathlessMutation(record) {
+  return ['diff', 'oldText', 'newText'].some(
+    key => typeof record[key] === 'string' && record[key] !== '',
+  )
+}
+
+function mergePrunedTargets(actual, intended, unused) {
+  const merged = []
+  for (const targetFromResult of actual) {
+    const match = [...unused].find(index => sameTarget(targetFromResult, intended[index]))
+    if (match === undefined) {
+      return failure(`OMP pruned snapshots for ${targetFromResult.path}, which input did not match`)
+    }
+    unused.delete(match)
+    const intent = intended[match]
+    const result = {
+      path: targetFromResult.path,
+      op: targetFromResult.op,
+      expectedPresent: targetFromResult.expectedPresent,
+    }
+    if (targetFromResult.moveId !== undefined) result.moveId = targetFromResult.moveId
+    if (carriesLandedContent(result)) {
+      if (intent.content !== undefined) result.content = intent.content
+      else {
+        result.added = intent.added || []
+        result.removed = intent.removed || []
+        if (intent.ambiguous) result.ambiguous = true
+      }
+    }
+    merged.push(result)
+  }
+  return { value: merged }
+}
+function carriesLandedContent(value) {
+  return value.expectedPresent && value.op !== 'delete'
+}
+
+function sameTarget(left, right) {
+  return left.path === right.path &&
+    left.op === right.op &&
+    left.expectedPresent === right.expectedPresent
+}
+
+function moveId(source, destination) {
+  return JSON.stringify([source, destination])
+}
+
+
+function hasMove(record) {
+  return record.move === true || typeof record.move === 'string' || isObject(record.move)
+}
+
+function detailString(record, key) {
+  return typeof record[key] === 'string' && record[key].trim() !== '' ? record[key] : null
+}
+
+function movePath(move, side) {
+  if (typeof move === 'string') return side === 'destination' ? move : null
+  if (!isObject(move)) return null
+  const keys = side === 'source' ? ['sourcePath', 'source', 'from'] : ['path', 'destination', 'to']
+  for (const key of keys) {
+    if (typeof move[key] === 'string' && move[key].trim() !== '') return move[key]
+  }
+  return null
+}
+
+function target(file, operation, expectedPresent, fields = {}) {
+  return { path: file, op: operation, expectedPresent, ...fields }
+}
+
+function draftFor(drafts, file) {
+  const existing = drafts.get(file)
+  if (existing !== undefined) return existing
+  const draft = {
+    path: file,
+    operation: 'edit',
+    expectedPresent: true,
+    added: [],
+    removed: [],
+    ambiguous: false,
+    moveDestination: null,
+    moveId: null,
+  }
+  drafts.set(file, draft)
+  return draft
+}
+
+function markDelete(draft) {
+  draft.operation = 'delete'
+  draft.expectedPresent = false
+  draft.added = []
+  draft.content = undefined
+  draft.ambiguous = false
+  draft.moveDestination = null
+  draft.moveId = null
+}
+
+function markMove(source, destination) {
+  const pair = moveId(source.path, destination.path)
+  source.operation = 'move'
+  source.expectedPresent = false
+  source.added = []
+  source.content = undefined
+  source.ambiguous = false
+  source.moveDestination = destination.path
+  source.moveId = pair
+  destination.operation = 'move'
+  destination.expectedPresent = true
+  destination.ambiguous = true
+  destination.moveId = pair
+}
+
+function moveDestination(drafts, source) {
+  return source.moveDestination === null ? source : draftFor(drafts, source.moveDestination)
+}
+
+function setContent(draft, content) {
+  draft.content = content.endsWith('\n') ? content : `${content}\n`
+  draft.added = []
+  draft.removed = []
+  draft.ambiguous = false
+}
+
+
+function finalizeDrafts(drafts) {
+  return [...drafts.values()].map(finalizeDraft)
+}
+
+function finalizeDraft(draft) {
+  const value = target(draft.path, draft.operation, draft.expectedPresent)
+  if (draft.operation === 'move' && draft.moveId !== null) value.moveId = draft.moveId
+  if (draft.content !== undefined) {
+    value.content = draft.content
+    return value
+  }
+  if (draft.operation !== 'delete' && !(draft.operation === 'move' && !draft.expectedPresent)) {
+    value.added = draft.added
+    value.removed = draft.removed
+  }
+  if (draft.ambiguous) value.ambiguous = true
+  return value
+}
+
+function appendPatchFragments(targetDraft, diff) {
+  let inHunk = false
+  let added = []
+  let removed = []
+  const flush = () => {
+    if (added.length > 0) targetDraft.added.push(added.join('\n'))
+    if (removed.length > 0) targetDraft.removed.push(removed.join('\n'))
+    added = []
+    removed = []
+  }
+  const lines = diff.split('\n')
+  for (let index = 0; index < lines.length; index += 1) {
+    const raw = lines[index]
+    const line = raw.endsWith('\r') ? raw.slice(0, -1) : raw
+    if (line.startsWith('@@')) {
+      flush()
+      inHunk = true
+      continue
+    }
+    if (line === '' && index === lines.length - 1) continue
+    if (!inHunk) {
+      targetDraft.ambiguous = true
+      continue
+    }
+    if (line.startsWith('+')) {
+      if (removed.length > 0) {
+        targetDraft.removed.push(removed.join('\n'))
+        removed = []
+      }
+      added.push(line.slice(1))
+      continue
+    }
+    if (line.startsWith('-')) {
+      if (added.length > 0) {
+        targetDraft.added.push(added.join('\n'))
+        added = []
+      }
+      removed.push(line.slice(1))
+      continue
+    }
+    if (line.startsWith(' ')) {
+      flush()
+      continue
+    }
+    targetDraft.ambiguous = true
+  }
+  flush()
+  if (!inHunk) targetDraft.ambiguous = true
+}
+
+
+function editPath(input) {
+  return stringOrNull(input.path) || stringOrNull(input._path) || stringOrNull(input.file_path)
+}
+
+function stringOrNull(value) {
+  if (typeof value !== 'string' || value.trim() === '') return null
+  return value
+}
+
+function untag(value) {
+  if (value === null) return null
+  const tagged = TAGGED.exec(value)
+  return tagged === null ? value : tagged[1].trim()
+}
+
+function unquote(value) {
+  const trimmed = value.trim()
+  if (
+    trimmed.length >= 2 &&
+    ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+      (trimmed.startsWith("'") && trimmed.endsWith("'")))
+  ) {
+    return trimmed.slice(1, -1)
+  }
+  return trimmed
+}
+
+function normalized(tool, targets, unknown, succeeded, targetless) {
+  const value = { tool, targets, unknown }
+  if (succeeded !== undefined) value.succeeded = succeeded
+  if (targetless !== undefined) value.targetless = targetless
+  return value
+}
+
+function unknown(tool, detail) {
+  return normalized(
+    tool,
+    [],
+    `tackbox cannot classify this ${tool} call (${detail}). Re-issue it in a documented form; dev.py check remains required.`,
+  )
+}
+
+function failure(reason) {
+  return { failure: `tackbox cannot verify this hook event: ${reason}` }
+}
+
+function isOpaqueWrite(input) {
+  return isObject(input) && isOpaquePath(untag(stringOrNull(input.path)))
+}
+
+function isOpaquePath(value) {
+  return value !== null && (URI_TARGET.test(value) || CONTAINER_TARGET.test(value))
+}
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function clip(text) {
+  const flat = text.replace(/\s+/g, ' ').trim()
+  return flat.length > MESSAGE_CLIP ? `${flat.slice(0, MESSAGE_CLIP)}...` : flat
+}
+
+module.exports = { normalize, normalizeResult, sessionRoot }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tackbox",
-  "version": "0.1.83",
-  "description": "ESLint and Markdown lint plugins plus direct error-reporting helpers for JavaScript and TypeScript.",
+  "version": "0.1.89",
+  "description": "ESLint and Markdown lint plugins, an Oh My Pi extension, plus direct error-reporting helpers for JavaScript and TypeScript.",
   "license": "MIT",
   "main": "./js/eslint-plugin.js",
   "exports": {
@@ -12,11 +12,20 @@
     "tackbox-eslint": "./bin/tackbox-eslint.js",
     "tackbox-mdlint": "./bin/tackbox-mdlint.js"
   },
+  "omp": {
+    "extensions": [
+      "./js/omp/index.mjs"
+    ]
+  },
   "files": [
     "js/eslint-plugin.js",
     "js/report.js",
     "js/rules/",
     "js/markdownlint-rules/",
+    "js/omp/index.mjs",
+    "js/omp/index.js",
+    "js/omp/hook.js",
+    "js/omp/payload.js",
     "js/README.md",
     "bin/",
     "eslint.config.preset.js"