vigiles 15.0.2 → 15.0.3

package/dist/core/hook-program.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.defineReact = exports.nothing = exports.notice = exports.run = exports.defineInject = exports.inject = exports.tools = exports.HookCompileError = exports.tool = exports.ask = exports.deny = exports.allow = void 0;
 exports.gateAction = gateAction;
+exports.trimTrailingSeparators = trimTrailingSeparators;
 exports.commandView = commandView;
 exports.defineHook = defineHook;
 exports.decideProgram = decideProgram;
@@ -15,6 +16,8 @@ exports.compileHookProgram = compileHookProgram;
 exports.stampHook = stampHook;
 exports.verifyHookStamp = verifyHookStamp;
 exports.pathView = pathView;
+exports.projectRootOf = projectRootOf;
+exports.undecidablePathWarning = undecidablePathWarning;
 exports.defineFileGate = defineFileGate;
 exports.decideFileGate = decideFileGate;
 exports.definePromptGate = definePromptGate;
@@ -24,8 +27,11 @@ exports.decideStopGate = decideStopGate;
 exports.runInject = runInject;
 exports.responseView = responseView;
 exports.runReact = runReact;
+exports.rememberHookSource = rememberHookSource;
+exports.hookSource = hookSource;
 exports.runHookProgram = runHookProgram;
 exports.isStampRepairEvent = isStampRepairEvent;
+exports.isLoadPathRepairEvent = isLoadPathRepairEvent;
 /**
  * Compiled hooks — a hook as a CONSTRAINED TYPED PROGRAM, not arbitrary shell.
  *
@@ -61,6 +67,7 @@ const bash_effects_js_1 = require("./bash-effects.js");
 const hash_js_1 = require("./hash.js");
 const toml_1 = require("@iarna/toml");
 const hook_events_js_1 = require("./hook-events.js");
+const merge_conflict_js_1 = require("./merge-conflict.js");
 const hook_providers_js_1 = require("./hook-providers.js");
 const allow = () => ({ kind: "allow" });
 exports.allow = allow;
@@ -104,10 +111,191 @@ function runsSeq(argv, tokens) {
     }
     return i === tokens.length;
 }
-/** Does a single token name a path at/under `prefix` (boundary-aware)? */
-function tokenUnder(token, prefix) {
-    const t = token.replace(/^\.\//, "");
-    return t === prefix || t.startsWith(prefix + "/") || t.endsWith("/" + prefix);
+/**
+ * Collapse a {@link PrefixVerdict} to the boolean a matcher returns.
+ *
+ * `onUndecidable` HAS NO DEFAULT ON PURPOSE. The two callers need opposite
+ * values, and the one that guesses wrong (`"miss"` for a denylist) fails OPEN —
+ * the failure mode that made this refactor necessary. A default here would make
+ * that bug reachable by omission, which is how it was reachable before.
+ */
+const matchesPrefix = (verdict, onUndecidable) => verdict === "under" ||
+    (verdict === "undecidable" && onUndecidable === "match");
+/**
+ * Trailing separators removed — EXCEPT the one that is the path itself.
+ *
+ * 🔴 THE CARVE-OUT IS THE RULE, NOT AN EDGE CASE, and skipping it fails
+ * SILENTLY. Strip every trailing separator and the POSIX root `"/"` becomes
+ * `""`, the Windows drive root `"C:/"` becomes `"C:"` — and `isAbsoluteRef`
+ * reads a bare drive letter as RELATIVE. Nothing throws: an allowlist prefix of
+ * `"C:/"` simply stops matching, so a confinement gate denies every path and a
+ * react hook goes quiet, both looking like a correct decision.
+ *
+ * This lives here, in one place, because the same normalisation is applied to
+ * two different things — the PREFIX being matched against, and the project ROOT
+ * a path is resolved against (`run-hook.ts` imports it for the latter). Round 28
+ * fixed the root and left the prefix; round 29 found the prefix. Two copies of a
+ * rule is how the second one survives the fix to the first.
+ */
+function trimTrailingSeparators(path) {
+    const sep = /[/\\]+$/.exec(path)?.[0];
+    const trimmed = sep === undefined ? path : path.slice(0, -sep.length);
+    return trimmed === "" || /^[A-Za-z]:$/.test(trimmed)
+        ? trimmed + (sep?.[0] ?? "/")
+        : trimmed;
+}
+/**
+ * A prefix with its glob tail and trailing slash removed — `"src/**"`, `"src/"`
+ * and `"src"` all mean the same directory.
+ *
+ * The trailing slash is not cosmetic: a prefix of `"papers/"` used to compare
+ * against `"papers//"` and match NOTHING, a trap a shipped guard's own header
+ * records having fallen into.
+ */
+const normalizePrefix = (prefix) => {
+    const stripped = prefix.replace(/\\/g, "/").replace(/\/?\*+$/, "");
+    // 🔴 THE CATCH-ALL IS A SENTINEL, NOT A ROOT — and conflating them is a
+    // regression I shipped in the previous commit. `"**"`, `"*"` and `"/"` all
+    // reduce to an EMPTY base, which `prefixVerdict` answers `"under"` for
+    // outright, no root required. Handing that empty string to
+    // `trimTrailingSeparators` turned it into `"/"` — a genuine POSIX root — so a
+    // catch-all suddenly demanded an absolute spelling and `under(["**"])` went
+    // FALSE for every relative path with no root. A catch-all that denies
+    // everything is the loudest possible version of this bug and it still
+    // type-checked and passed the drive-root test beside it, because that test
+    // supplied a root.
+    //
+    // The drive-letter carve-out below is the opposite case: `"C:"` is not a
+    // catch-all, it is a real absolute root that must keep its separator to stay
+    // absolute. Same helper, and only the empty case differs.
+    if (/^[/\\]*$/.test(stripped))
+        return "";
+    return trimTrailingSeparators(stripped);
+};
+/**
+ * Case-insensitivity is a property of the FILESYSTEM, so it is decided by the
+ * root — never by the operand being compared.
+ *
+ * 🔴 KEYING IT ON THE OPERAND COST A P1, and the shape is worth keeping in view.
+ * The first version asked "does this string look drive-rooted?", which is true of
+ * a root (`C:/repo`) and of an absolute prefix (`C:/repo/secrets`) but FALSE of a
+ * repo-relative prefix (`secrets`). So under a Windows root, `C:/REPO/SECRETS/x`
+ * resolved to the remainder `SECRETS/x`, was compared against `secrets`
+ * case-sensitively, and `writesTo(["secrets"])` returned false — a denylist
+ * allowing the protected write. The drive letter was known; it just never reached
+ * the comparison that needed it.
+ *
+ * The asymmetry is unchanged and load-bearing: fold only when the ROOT is
+ * drive-rooted. POSIX is case-sensitive, so folding there would judge a path from
+ * `/REPO` to be inside `/repo` — a silent FALSE GRANT, the direction never taken.
+ * With no root known, nothing is folded: an unprovable answer must not be turned
+ * into a match by a guess about someone else's filesystem.
+ */
+const WINDOWS_ROOT = 
+// Drive: `C:/x`, `C:\x`. UNC share: `//server/share`, `\\server\share`.
+// Extended-length prefixes `//?/C:/x` and `//?/UNC/server/share` reduce to the
+// two above once `//?/` (and its `UNC/` marker) is consumed — which is why
+// they are alternatives here rather than separate cases.
+/^(?:[A-Za-z]:|[/\\]{2}(?:\?[/\\]+(?:UNC[/\\]+)?)?(?:[A-Za-z]:|[^/\\]+[/\\]+[^/\\]+))/;
+/**
+ * HOW THIS LIST IS DECIDED, because a table without that note is how the last
+ * three rounds happened: Windows absolute paths have exactly two root forms —
+ * a drive (`C:`) and a UNC share (`//server/share`) — plus the extended-length
+ * `//?/` prefix, which is a spelling OF those two, not a third. Anything else
+ * (a relative path, a POSIX absolute path) is not a Windows root.
+ *
+ * ⚠️ The miss direction is stated rather than implied: an unrecognised root means
+ * NO folding, so a denylist can miss on casing alone. That is the wrong
+ * direction, and it is accepted only because the alternative — folding whenever
+ * we are unsure — is a false GRANT on Linux, where `/repo/Secrets` and
+ * `/repo/secrets` are two different files. If a genuine third root form turns
+ * up, it belongs in the regex above, not in a caller.
+ */
+const caseInsensitiveFs = (root) => root !== undefined && WINDOWS_ROOT.test(root);
+const foldWhen = (value, insensitive) => insensitive ? value.toLowerCase() : value;
+/** Is `candidate` the prefix itself, or something below it? Boundary-aware. */
+const isAtOrUnder = (rawCandidate, rawBase, insensitive = false) => {
+    // An absolute drive-rooted BASE names a Windows filesystem by itself, even when
+    // the caller could not say so (`under(["C:/x"])` with no root).
+    const fold = insensitive || WINDOWS_ROOT.test(rawBase);
+    const base = foldWhen(rawBase, fold);
+    const candidate = foldWhen(rawCandidate, fold);
+    return (candidate === base ||
+        // A base that IS a separator (`"/"`, `"C:/"` — see `trimTrailingSeparators`)
+        // already carries the boundary, so appending another looks for `"C://"` and
+        // matches nothing. Keeping the carve-out without this line trades one silent
+        // never-match for another.
+        candidate.startsWith(/[/\\]$/.test(base) ? base : base + "/"));
+};
+/**
+ * Could this path be under this prefix under SOME root or working directory?
+ *
+ * The tractable stand-in for "unprovable": the prefix's segments occur as a whole
+ * contiguous run somewhere in the path. `/home/u/mine/migratsiya/papers/x.tex`
+ * could be `migratsiya/papers/x.tex` in a repo rooted at `/home/u/mine`; the
+ * leading directories are exactly what we cannot rule out without a root.
+ *
+ * A leading `/` is stripped from the prefix first, so an ABSOLUTE prefix can
+ * still be recognized inside a relative token (`/etc` vs `etc/passwd` under an
+ * unknown `cd`).
+ *
+ * ⚠️ WHAT THIS STILL MISSES, stated rather than implied — in both cases the
+ * verdict is `"outside"`, so the denylist misses too:
+ *
+ * 1. The segments must be PRESENT. `cd migratsiya && sed -i s/a/b/ papers/x.tex`
+ *    names only `papers/x.tex`, so a prefix of `migratsiya/papers` finds nothing.
+ *    Resolving a leaf's argument against a preceding `cd` is a parser change, not
+ *    a matcher one; it is the blind spot both shipped guards already document.
+ * 2. An ABSOLUTE prefix against a RELATIVE token with NO root — `touches(["/r/
+ *    health/data/dna"])` vs the token `health/data/dna/g.txt`. The needle is the
+ *    longer string, so containment cannot see it. Deliberately not chased: the
+ *    runtime always supplies a root ({@link projectRootOf} falls back to the
+ *    event's `cwd`, which Claude Code sends on every payload), and a gate that
+ *    builds absolute prefixes at all builds them FROM a root, so by construction
+ *    it has one. Widening this arm would also cost precision in the case that
+ *    matters — a token that IS placeable would start matching on segments alone.
+ */
+const mightBeUnder = (path, base, insensitive = false) => {
+    const needle = base.replace(/^\/+/, "").replace(/^[A-Za-z]:\//, "");
+    if (needle === "")
+        return true;
+    const raw = path.replace(/\\/g, "/").replace(/^\.\//, "");
+    // Same fold, same rule: keyed on the BASE, which is what decides whether a
+    // Windows filesystem is in play. Left case-sensitive here, the denylist's
+    // "could this be under it?" fallback misses on casing alone.
+    const fold = insensitive || WINDOWS_ROOT.test(base);
+    const p = foldWhen(raw, fold);
+    const n = foldWhen(needle, fold);
+    return (isAtOrUnder(p, n, fold) || p.endsWith("/" + n) || p.includes("/" + n + "/"));
+};
+/**
+ * The verdict for ONE path against ONE prefix, given the project root.
+ *
+ * A prefix is matched in ITS OWN spelling — a repo-relative prefix against the
+ * path made repo-relative, an absolute prefix against the path made absolute —
+ * because those are the only two comparisons that mean anything. When the needed
+ * spelling cannot be produced (an absolute path with no root, a path resolving
+ * outside the root, a relative path with no root to absolutize it), the path was
+ * not PLACED, and the answer falls to {@link mightBeUnder}.
+ *
+ * Note what does NOT happen: a placed path that is not under the prefix comes
+ * back `"under"`-less but is still offered to `mightBeUnder`, so a denylist
+ * over-blocks a sibling checkout's `…/migratsiya/papers/…` rather than silently
+ * allowing it. That over-block is the chosen error direction, not an oversight —
+ * `under` never sees it, because `under` accepts `"under"` only.
+ */
+function prefixVerdict(path, prefix, root) {
+    const base = normalizePrefix(prefix);
+    if (base === "")
+        return "under"; // `"/"`, `"**"` — everything is under it
+    const slashed = path.replace(/\\/g, "/");
+    const placed = isAbsoluteRef(base)
+        ? absoluteSpelling(slashed, root)
+        : relativeSpelling(slashed, root);
+    const insensitive = caseInsensitiveFs(root);
+    if (placed !== undefined && isAtOrUnder(placed, base, insensitive))
+        return "under";
+    return mightBeUnder(slashed, base, insensitive) ? "undecidable" : "outside";
 }
 /** A leaf whose head is a shell reading stdin (no script-file argument). */
 function isBareShellLeaf(argv) {
@@ -183,7 +371,19 @@ function writeTargetsOf(leaf) {
             return [];
     }
 }
-function commandView(raw) {
+/**
+ * An AST-backed view of a Bash command.
+ *
+ * @param raw - the command line as the tool event carried it.
+ * @param root - the project root repo-relative prefixes resolve against, from
+ *   the runtime ({@link projectRootOf}: `$CLAUDE_PROJECT_DIR`, else the event's
+ *   own `cwd`, never `process.cwd()`). Omitting it does NOT disarm the denylist
+ *   matchers — without a root an absolute token is `"undecidable"` rather than
+ *   placeable, and {@link CommandView.touches} treats that as a match. It does
+ *   cost precision: with a root, `/somewhere-else/notes/x` is provably not this
+ *   repo's `notes`; without one it can only be over-blocked.
+ */
+function commandView(raw, root) {
     const leaves = (0, bash_effects_js_1.leafCommands)(raw);
     // The operation-normalized leaves carry the redirections (and quote-unwrapped,
     // wrapper-resolved argv) that `writesTo` needs; `leafCommands` cannot see them.
@@ -199,8 +399,40 @@ function commandView(raw) {
             return leaves.some((argv) => runsSeq(argv, tokens) && (opts?.force ? hasForce(argv) : true));
         },
         isSideEffecting: () => (0, bash_effects_js_1.classifyBashCommand)(raw) === "side-effecting",
-        touches: (prefixes) => leaves.some((argv) => argv.slice(1).some((tok) => prefixes.some((p) => tokenUnder(tok, p)))),
-        writesTo: (prefixes) => writeTargets.some((t) => prefixes.some((p) => tokenUnder(t, p))),
+        // Both of these are DENYLIST matchers, so both break an undecidable verdict
+        // toward "match" — see the block above `PrefixVerdict` for the measurement
+        // that made the opposite default a security hole.
+        // 🔴 READS THE NORMALIZED ARGV, NOT THE RAW ONE, AND THAT IS THE FIX FOR A
+        // REAL BYPASS. `leafCommands` keeps a word exactly as written, quotes and
+        // all, so a token arrived as `"papers/x.tex"` — with the quote characters —
+        // and matched no prefix at all. MEASURED end-to-end on a shipped guard:
+        // `sed -i s/a/b/ migratsiya/papers/x/paper.tex` exited 2 (blocked) while
+        // `sed -i s/a/b/ "migratsiya/papers/x/paper.tex"` exited 0. Quoting a path
+        // is not an exotic evasion — it is what anyone writes for a path with a
+        // space in it, so every denylist built on `touches` was one quote from open.
+        // `writesTo` was already correct precisely because it reads `normalized`;
+        // this is the same class as the other siblings this PR keeps finding, so
+        // both denylists now read the SAME argv.
+        touches: (prefixes) => 
+        // 🔴 THE UNION IS THE FIX, AND EACH HALF COVERS THE OTHER'S BLIND SPOT.
+        // Raw argv keeps a word exactly as written, so a QUOTED path arrives as
+        // `"papers/x.tex"` and matches nothing — measured end-to-end on a shipped
+        // guard: unquoted exited 2, quoted exited 0. Normalized argv unwraps the
+        // quotes, but `stripWrappers` also CONSUMES wrapper options, so
+        // `env -C secrets cat key` loses `secrets` entirely and a denylist on it
+        // fails open. Reading only one of the two trades one bypass for the other;
+        // that is exactly what the previous commit did, and it earned a P1.
+        // A denylist over-matching costs an argument. Missing costs the write.
+        [...leaves.map((argv) => argv.slice(1)), ...normalized.map((l) => l.args)]
+            .flat()
+            // `--chdir=secrets` is ONE token, so the path is invisible to a whole-token
+            // comparison. Only the tail of an `--opt=value` word can be a path, so the
+            // extra candidate is added rather than replacing the token.
+            .flatMap((tok) => /^-{1,2}[^=]+=/.test(tok)
+            ? [tok, tok.slice(tok.indexOf("=") + 1)]
+            : [tok])
+            .some((tok) => prefixes.some((p) => matchesPrefix(prefixVerdict(tok, p, root), "match"))),
+        writesTo: (prefixes) => writeTargets.some((t) => prefixes.some((p) => matchesPrefix(prefixVerdict(t, p, root), "match"))),
         pipesToShell: () => leaves.some(isBareShellLeaf),
     };
 }
@@ -212,8 +444,20 @@ function defineHook(p) {
 // ---------------------------------------------------------------------------
 // Run the program against a raw PreToolUse event (the runtime half)
 // ---------------------------------------------------------------------------
-/** Build the typed event from a raw PreToolUse event, then decide. */
-function decideProgram(program, rawEvent, ctx = {}) {
+/**
+ * Build the typed event from a raw PreToolUse event, then decide.
+ *
+ * `root` is the project root repo-relative prefixes in the hook resolve against,
+ * threaded exactly as {@link decideFileGate} threads it: omitted, it falls back
+ * to the event's OWN `cwd` (a payload field, so this stays pure and reads no
+ * environment); the CLI passes {@link projectRootOf}, which prefers
+ * `$CLAUDE_PROJECT_DIR`. Until 2026-08-12 no root reached here at all, and the
+ * denylist matchers on {@link CommandView} were bypassable by spelling a path
+ * absolutely — see the block above {@link PrefixVerdict} for the measurement.
+ */
+function decideProgram(program, rawEvent, ctx = {}, root = typeof rawEvent.cwd === "string"
+    ? rawEvent.cwd
+    : undefined) {
     if (rawEvent.tool_name !== program.match.tool)
         return (0, exports.allow)();
     const command = typeof rawEvent.tool_input?.command === "string"
@@ -222,7 +466,7 @@ function decideProgram(program, rawEvent, ctx = {}) {
     return program.decide({
         event: program.on,
         tool: "Bash",
-        command: commandView(command),
+        command: commandView(command, root),
         ctx: ctx,
     });
 }
@@ -368,16 +612,185 @@ function stampHook(source) {
 function verifyHookStamp(source, stamp) {
     return stampHook(source) === stamp;
 }
-function pathView(raw) {
-    const norm = raw.replace(/^\.\//, "");
+/**
+ * A view of a file path, matched against prefixes by {@link PathView.under}.
+ *
+ * 🔴 `root` IS NOT OPTIONAL IN PRACTICE — WITHOUT IT THIS IS DEAD FOR EVERY REAL
+ * EVENT. Claude Code's Edit/Write/MultiEdit tools always send an ABSOLUTE
+ * `file_path`, and every hook in the wild writes repo-relative prefixes
+ * (`under(["migratsiya/papers/"])`). Before the root existed, the two could
+ * never meet: the comparison ran `"/home/u/repo/migratsiya/papers/x.tex"`
+ * against `"migratsiya/papers"` and returned `false` for all input, forever.
+ * MEASURED 2026-08-12 on the live runtime with one compiled react hook and two
+ * spellings of the same file — the relative one printed its checklist, the
+ * absolute one exited 0 in silence. Three shipped hooks in a consumer repo were
+ * dead by it, all three compiled *specifically to replace hooks that were dead*,
+ * and none of the tests noticed because the harness helper built relative paths.
+ *
+ * ## Which way a miss errs, and why it is not the same answer as `touches`
+ *
+ * `under` is the ALLOWLIST/COVERAGE primitive: its callers spell
+ * `under(P) ? allow() : deny()` (confinement) and `under(P) ? notice() : nothing()`
+ * (a nudge). For both, an unprovable answer must be `false` — a confinement gate
+ * denies (fails closed) and a nudge stays quiet. So:
+ *
+ * - path resolves OUTSIDE the root → `false` for every relative prefix. Not a
+ *   bias, the truth: a repo-relative prefix names nothing in another checkout.
+ *   This is the {@link resolveRef} lesson — the suffix match it replaced handed
+ *   `/home/other-project/package.json` a grant meant for this repo's.
+ * - NO root known and the path is absolute → `false` for every relative prefix.
+ *   Here we genuinely cannot tell, and `false` is the choice: silence, never a
+ *   false grant. It is also the pre-fix behaviour, so nothing regresses.
+ *
+ * ⚠️ THE ASYMMETRY INVERTS FOR A DENYLIST, AND `under` DOES NOT SERVE THAT CASE.
+ * A gate written `under(["secrets"]) ? deny() : allow()` reads an unprovable
+ * `false` as ALLOW — a false grant. The Bash-side counterpart {@link
+ * CommandView.touches} exists precisely for that direction and takes the
+ * opposite bias from the SAME rule ({@link prefixVerdict}), which is why the
+ * resolver {@link matchesPrefix} makes each caller name its own. `PathView` has
+ * no such counterpart; a file-side denylist inherits the allowlist bias.
+ * Reported, not papered over.
+ *
+ * @param raw - the `file_path` the tool event carried, any spelling.
+ * @param root - the project root relative prefixes resolve against. Comes from
+ *   the runtime (`$CLAUDE_PROJECT_DIR`, else the event's own `cwd`), never from
+ *   `process.cwd()` — under a git worktree the process's cwd is a DIFFERENT
+ *   checkout from the one the harness resolved the hook out of, and that exact
+ *   mismatch already wedged a repo once.
+ */
+function pathView(raw, root) {
+    const slashed = raw.replace(/\\/g, "/");
     return {
         raw,
-        under: (prefixes) => prefixes.some((p) => {
-            const base = p.replace(/\/?\*+$/, "").replace(/\/$/, "");
-            return base === "" || norm === base || norm.startsWith(base + "/");
-        }),
+        rel: relativeSpelling(slashed, root),
+        // A prefix is matched only against its OWN spelling, and a path that cannot
+        // be produced in that spelling is a miss — never a silent fallback to the
+        // other one. `"miss"` is the ALLOWLIST bias, named here rather than
+        // inherited: `matchesPrefix` has no default, so the denylist matchers on
+        // `CommandView` cannot pick this one up by accident (and did not, for the
+        // whole time they shared a single boolean helper with it).
+        under: (prefixes) => prefixes.some((p) => matchesPrefix(prefixVerdict(slashed, p, root), "miss")),
     };
 }
+/** The path as an absolute reference, or `undefined` when it cannot be one. */
+/**
+ * A root only relates the two spellings if it is itself ABSOLUTE. A relative one
+ * — `"."`, `"repo"` — is treated as no root at all, and the reason is a wrong
+ * ANSWER rather than tidiness: `resolveRef(".", ".")` collapses to `""`, so
+ * `/etc/passwd` would come back as the repo-relative `etc/passwd` and satisfy
+ * `under(["etc"])` inside a repo that has no such directory. Claude Code always
+ * sends an absolute `cwd` and sets an absolute `$CLAUDE_PROJECT_DIR`, so this
+ * costs nothing real and closes the one input that produced a false grant.
+ */
+const usableRoot = (root) => root !== undefined && isAbsoluteRef(root.replace(/\\/g, "/"))
+    ? root
+    : undefined;
+/** The path as an absolute reference, or `undefined` when it cannot be one. */
+function absoluteSpelling(path, root) {
+    const r = usableRoot(root);
+    if (r !== undefined)
+        return resolveRef(r, path);
+    // No usable root: an already-absolute path just needs its dot segments
+    // collapsed; a relative one has nothing to hang off, so there is no absolute
+    // spelling of it.
+    return isAbsoluteRef(path) ? resolveRef("/", path) : undefined;
+}
+/** The path as a repo-relative reference, or `undefined` when it cannot be one. */
+function relativeSpelling(path, root) {
+    const r = usableRoot(root);
+    if (r !== undefined)
+        return relativeToRoot(r, path);
+    // No usable root: an absolute path is UNKNOWABLE — this is the case that used
+    // to be every real event, and the miss is chosen to cost silence (see
+    // `pathView`).
+    return isAbsoluteRef(path) ? undefined : path.replace(/^\.\//, "");
+}
+/**
+ * `raw` expressed relative to `root`, or `undefined` when it resolves outside it.
+ * Both sides are resolved and compared WHOLE (never by suffix) — see
+ * {@link resolveRef} for the hole that cost.
+ */
+function relativeToRoot(root, raw) {
+    const base = resolveRef(root.replace(/\\/g, "/"), ".");
+    const full = resolveRef(root.replace(/\\/g, "/"), raw);
+    // 🔴 CASE FOLDING IS DRIVE-ROOTED-ONLY, AND THE ASYMMETRY IS THE POINT.
+    // Windows filesystems are case-insensitive by default, so `C:/Repo` and
+    // `c:/repo/src/x.ts` name the same place — compared exactly, the second reads
+    // as OUTSIDE the first and the gate silently denies a same-repo edit. POSIX is
+    // case-SENSITIVE: `/repo/Secrets` and `/repo/secrets` are two different files,
+    // and folding there would invent a match that does not exist — turning a
+    // silent miss into a silent false grant, which is the worse direction. So the
+    // fold is applied only when the root is drive-rooted, and only for the
+    // comparison; the returned remainder keeps the path's own casing.
+    const insensitive = caseInsensitiveFs(base);
+    const foldedBase = foldWhen(base, insensitive);
+    const foldedFull = foldWhen(full, insensitive);
+    if (foldedFull === foldedBase)
+        return "";
+    if (foldedBase === "/")
+        return full.slice(1);
+    return foldedFull.startsWith(foldedBase + "/")
+        ? full.slice(base.length + 1)
+        : undefined;
+}
+/**
+ * The project root a compiled hook's repo-relative prefixes resolve against.
+ *
+ * Two sources, in order, and `process.cwd()` is deliberately NOT one of them:
+ *
+ * 1. **`$CLAUDE_PROJECT_DIR`** — what the harness itself resolved the hook's own
+ *    path against (`.claude/settings.json` spells the command
+ *    `"$CLAUDE_PROJECT_DIR/.claude/hooks/x.hook.ts"`), so it is the same root the
+ *    hook was loaded from by construction.
+ * 2. **the event's `cwd`** — Claude Code puts the session's working directory in
+ *    every hook payload. A fallback, not a peer: it is where the session is, and
+ *    the two coincide in the ordinary case.
+ *
+ * `process.cwd()` is excluded because under a git worktree it can be a different
+ * checkout than the one the harness is driving, and a root from the wrong
+ * checkout turns every repo-relative prefix into a non-match — the same silent
+ * death this whole function exists to end. When NEITHER source is present the
+ * answer is `undefined` and the miss errs toward silence (see {@link pathView}).
+ */
+function projectRootOf(event, env = {}) {
+    // 🔴 THE FIRST *USABLE* ROOT, NOT THE FIRST NON-EMPTY STRING. A relative
+    // `$CLAUDE_PROJECT_DIR` — `.` is the obvious one — is not a root: `usableRoot`
+    // rejects it downstream, precisely so a relative value cannot turn
+    // `/etc/passwd` into the repo-relative `etc/passwd`. Returning it anyway
+    // MASKED a perfectly good absolute `cwd` from the payload, so absolute paths
+    // stopped matching repo-relative prefixes — and worse, `undecidablePathWarning`
+    // saw a defined root and stayed quiet, removing the one signal that says why.
+    // A source that cannot serve as a root must not consume the slot.
+    for (const candidate of [env.CLAUDE_PROJECT_DIR, event.cwd]) {
+        if (typeof candidate !== "string" || candidate.trim() === "")
+            continue;
+        if (usableRoot(candidate) !== undefined)
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * The one case {@link pathView} cannot answer and must not answer silently: an
+ * ABSOLUTE `file_path` with no project root in sight. Every repo-relative prefix
+ * in the hook returns `false`, so a gate waves everything through and a nudge
+ * never fires — indistinguishable, from the outside, from a hook with nothing to
+ * say. Returns the warning line, or `undefined` when there is nothing wrong.
+ *
+ * Narrow on purpose: a RELATIVE `file_path` is decidable without a root, so it
+ * warns about nothing. That matters because a react hook's `notice` also goes to
+ * stderr, and a warning on every event would read as the hook firing.
+ */
+function undecidablePathWarning(filePath, root) {
+    if (root !== undefined)
+        return undefined;
+    if (typeof filePath !== "string" ||
+        !isAbsoluteRef(filePath.replace(/\\/g, "/")))
+        return undefined;
+    return (`vigiles: no project root — neither $CLAUDE_PROJECT_DIR nor the event's ` +
+        `\`cwd\` was set, and the event carries an ABSOLUTE file_path (${filePath}). ` +
+        `Repo-relative prefixes in this hook cannot match it, so the hook is ` +
+        `deciding on less than it looks like it is. Set CLAUDE_PROJECT_DIR.`);
+}
 const tools = (...names) => ({
     tools: names,
 });
@@ -385,8 +798,16 @@ exports.tools = tools;
 function defineFileGate(p) {
     return { role: "gate", ...p };
 }
-/** Run a file-tool gate against a raw PreToolUse event (reads `file_path`). */
-function decideFileGate(hook, raw, ctx = {}) {
+/**
+ * Run a file-tool gate against a raw PreToolUse event (reads `file_path`).
+ *
+ * `root` is the project root repo-relative prefixes resolve against; omitted, it
+ * falls back to the event's OWN `cwd` (a payload field — this stays pure and
+ * reads no environment). The CLI passes {@link projectRootOf} instead, which
+ * prefers `$CLAUDE_PROJECT_DIR`. Without either, an absolute `file_path` matches
+ * no relative prefix — see {@link pathView} for why that direction was chosen.
+ */
+function decideFileGate(hook, raw, ctx = {}, root = typeof raw.cwd === "string" ? raw.cwd : undefined) {
     const t = raw.tool_name ?? "";
     if (!hook.match.tools.includes(t))
         return (0, exports.allow)();
@@ -396,7 +817,7 @@ function decideFileGate(hook, raw, ctx = {}) {
     return hook.decide({
         event: hook.on,
         tool: t,
-        path: pathView(fp),
+        path: pathView(fp, root),
         ctx: ctx,
     });
 }
@@ -488,8 +909,13 @@ const defineReact = (p) => ({
     ...p,
 });
 exports.defineReact = defineReact;
-/** Run a react hook against a raw PostToolUse event → the (classified) Reaction. */
-function runReact(hook, raw) {
+/**
+ * Run a react hook against a raw PostToolUse event → the (classified) Reaction.
+ *
+ * `root` behaves exactly as in {@link decideFileGate}: the event's own `cwd` by
+ * default, the CLI's {@link projectRootOf} when the runtime supplies one.
+ */
+function runReact(hook, raw, root = typeof raw.cwd === "string" ? raw.cwd : undefined) {
     const t = raw.tool_name ?? "";
     if (!hook.match.tools.includes(t))
         return (0, exports.nothing)();
@@ -499,28 +925,59 @@ function runReact(hook, raw) {
     return hook.react({
         event: hook.on,
         tool: t,
-        path: pathView(fp),
+        path: pathView(fp, root),
         response: responseView(raw.tool_response),
     });
 }
+/**
+ * The file a hook program was LOADED from — the one coverage attribution in this
+ * codebase that needs no parsing at all.
+ *
+ * 🔴 BY CONSTRUCTION, NOT BEST-EFFORT, and a reader should not treat this source
+ * as equivalent to the parsed one. `commandRefs` (coverage-probe.ts) infers what
+ * executed from an arbitrary command STRING — interpreter grammars, option
+ * bundles, shell short-circuits — and has been wrong in five review rounds
+ * because that grammar is unbounded. Here the path is the argument `loadHook`
+ * was called with and resolved itself. There is nothing to guess.
+ *
+ * A `WeakMap`, not a property on the hook: the object is the USER's, it is
+ * `export default`-ed from their module, and stamping a field on it would show
+ * up in their serialization and their equality checks. The map also lets the
+ * entry die with the hook.
+ *
+ * ⚠️ REMEMBERING IS NOT RECORDING. `loadHook(file)` calls this and nothing else —
+ * loading a hook to inspect its shape is not running it, and attributing a load
+ * would be the "an empty file counts" disease the execution tier exists to cure.
+ * The probe is emitted by `harness-assert.ts` at the moment the hook is
+ * EVALUATED, which is the only place both facts are in hand.
+ */
+const HOOK_SOURCE = new WeakMap();
+/** Record where a hook program was loaded from. Called by `loadHook` ONLY. */
+function rememberHookSource(hook, file) {
+    HOOK_SOURCE.set(hook, file);
+}
+/** The file a hook was loaded from, or `undefined` for one built in-process. */
+function hookSource(hook) {
+    return HOOK_SOURCE.get(hook);
+}
 /**
  * Evaluate a compiled hook against a raw event, in-process, dispatching by role:
  * a gate → its `Decision`, an inject → the injected context text, a react → its
  * (effect-classified) `Reaction`. Pure — no subprocess, no model. The ergonomic
  * base for testing a compiled hook (see `assertHookDenies` / `assertHookAllows`).
  */
-function runHookProgram(hook, event, ctx = {}) {
+function runHookProgram(hook, event, ctx = {}, root = event.cwd) {
     const kind = dispatchKind(hook);
     switch (kind) {
         case "bash-gate":
             return {
                 kind: "decision",
-                decision: decideProgram(hook, event, ctx),
+                decision: decideProgram(hook, event, ctx, root),
             };
         case "file-gate":
             return {
                 kind: "decision",
-                decision: decideFileGate(hook, event, ctx),
+                decision: decideFileGate(hook, event, ctx, root),
             };
         case "prompt-gate":
             return {
@@ -539,7 +996,10 @@ function runHookProgram(hook, event, ctx = {}) {
                     .additionalContext,
             };
         case "react":
-            return { kind: "reaction", reaction: runReact(hook, event) };
+            return {
+                kind: "reaction",
+                reaction: runReact(hook, event, root),
+            };
         default:
             return (0, hash_js_1.assertNever)(kind);
     }
@@ -563,40 +1023,274 @@ function runHookProgram(hook, event, ctx = {}) {
 // otherwise use. What the stamp buys is that a smuggled capability can never run
 // SILENTLY, and that is unchanged.
 // ---------------------------------------------------------------------------
-/** Compare two path references without node:path (core stays dependency-free). */
-function samePathRef(a, b) {
-    const norm = (p) => p.replace(/\\/g, "/").replace(/^\.\//, "");
-    const [x, y] = [norm(a), norm(b)];
-    return x === y || x.endsWith("/" + y) || y.endsWith("/" + x);
+/** A reference that already names a root — POSIX `/x` or Windows `C:/x`. */
+function isAbsoluteRef(ref) {
+    return ref.startsWith("/") || /^[A-Za-z]:\//.test(ref);
 }
-/** The basename of a path token, for matching `npx vigiles` / `./bin/vigiles`. */
+/**
+ * Resolve a path reference against a root, without node:path (core stays
+ * dependency-free). Mirrors `resolve(root, ref)`: an absolute ref wins, a
+ * relative one hangs off the root, and `.` / `..` / `//` collapse.
+ *
+ * 🔴 THIS REPLACED A SUFFIX COMPARISON, and the difference is SCOPE, not
+ * spelling. The old helper accepted `a.endsWith("/" + b)`, so a write to
+ * `/home/another-project/package.json` counted as a repair of THIS repo's
+ * `package.json` — one wedged checkout handed out a write in every other
+ * checkout on the disk. The tolerance that motivated the looseness is real (the
+ * harness sends an absolute `file_path` while settings carry a relative one) and
+ * survives untouched: both sides resolve against the same root and compare
+ * whole, so `/repo/package.json` and `package.json` still match while a sibling
+ * repo's never can.
+ */
+function resolveRef(root, ref) {
+    const slashes = (s) => s.replace(/\\/g, "/");
+    const r = slashes(ref);
+    const joined = isAbsoluteRef(r)
+        ? r
+        : `${slashes(root).replace(/\/+$/, "")}/${r}`;
+    const out = [];
+    for (const seg of joined.split("/")) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (seg === "..") {
+            out.pop();
+            continue;
+        }
+        out.push(seg);
+    }
+    // 🔴 A UNC LEADER IS TWO SLASHES AND BOTH ARE LOAD-BEARING. Collapsing
+    // `//server/share/x` to `/server/share/x` makes this function disagree with
+    // `normalizePrefix`, which keeps the pair — so a UNC path and a UNC prefix
+    // never compared equal, and an allowlist gate denied every valid edit on a
+    // Windows network share while a react hook stayed silent. Two functions
+    // normalising the SAME string differently is the defect class this PR keeps
+    // finding; here it is inside one call.
+    // ⚠️ AND THE PAIR IS KEPT ONLY WHEN THE ROOT SAYS THIS IS WINDOWS — the same
+    // lesson as the case fold, relearned one commit later. Judged from the STRING,
+    // `//repo/src/x.ts` looks like UNC; on Linux it is just `/repo/src/x.ts` with a
+    // stutter, so preserving the pair unconditionally made it stop resolving
+    // against a POSIX root and an allowlist gate denied a valid edit. Semantics
+    // belong to the filesystem, and only the root knows which one that is.
+    const unc = joined.startsWith("//") &&
+        (WINDOWS_ROOT.test(root) || root.startsWith("//"));
+    const leader = unc ? "//" : joined.startsWith("/") ? "/" : "";
+    return leader + out.join("/");
+}
+/** The basename of a path token — the sidecar is keyed by the hook's basename. */
 function basenameOf(token) {
     const parts = token.replace(/\\/g, "/").split("/");
     return parts[parts.length - 1] ?? token;
 }
 /**
- * True when this event IS the author repairing the hook — the only thing a
- * stale-stamp refusal must let through, or the repo wedges (see the note above):
+ * The tool names a repair may arrive under: the ones MEASURED to write a file
+ * and carry `file_path`. Everything else is refused, including a name this list
+ * has never heard of.
  *
- * - a Bash command that invokes `vigiles compile` (however it's launched —
- *   `npx vigiles compile`, `pnpm exec vigiles compile`, `./node_modules/.bin/vigiles compile`),
- *   which is what regenerates the stamp; or
- * - an edit/write whose target IS this hook's own source file, so a FILE gate
- *   over the repo can still be fixed by editing the hook again.
+ * 🔴 THE ESCAPE USED TO IGNORE `tool_name` ENTIRELY, so a `Read` of
+ * `package.json` was a "repair" — and if the wedged hook was registered for
+ * `Read`, that read went through while the gate was refusing everything else. A
+ * read repairs nothing, so it cannot be a repair. The door's whole justification
+ * is "a file write executes nothing"; a predicate blind to which tool is running
+ * cannot make that claim about anything.
  *
- * AST-backed (`leafCommandsNormalized`), so it sees the invocation through a
- * compound command or a wrapper, exactly like every other matcher here.
+ * ## How the list was decided, since an allow-list is the shape that has bitten
+ *
+ * Read off the LIVE harness's own tool schemas rather than from memory or a doc
+ * page (measured 2026-08-12, this Claude Code build):
+ *
+ * ```
+ * Write         file_path            → writes  → ADMITTED
+ * Edit          file_path            → writes  → ADMITTED
+ * MultiEdit     file_path            → writes  → ADMITTED (absent from this
+ *                                                build; a vendored third-party
+ *                                                plugin still matches on it, so
+ *                                                other builds ship it)
+ * Read          file_path            → reads   → refused (the reported hole)
+ * NotebookEdit  notebook_path        → writes, but cannot reach this predicate
+ * Glob / Grep   pattern, path        → no `file_path` at all
+ * Bash          command              → no `file_path` at all
+ * ```
+ *
+ * `NotebookEdit` is deliberately NOT listed. It writes, but its input field is
+ * `notebook_path` — quoted from the live schema: *"notebook_path: The absolute
+ * path to the Jupyter notebook file to edit"* — so it never carries the field
+ * this predicate reads and listing it would be a fragment that can never
+ * execute. If it ever grows `file_path`, this is a one-word change.
+ *
+ * ## What happens to an unrecognised name, and why that is not the wedge
+ *
+ * It is REFUSED. The other direction was weighed first, because "refuse
+ * everything outside cwd" was rejected two rounds ago for making a wedged repo
+ * unrecoverable — and the same objection does not land here. This list does not
+ * have to be COMPLETE; it has to be NON-EMPTY at runtime. A new writing tool
+ * appearing wedges nothing, because the author still repairs with `Write`. Only
+ * the simultaneous disappearance of every name above could strand a repo, and a
+ * release that deletes `Write` and `Edit` together has bigger problems.
+ *
+ * Admitting unknown names was the alternative, and it forfeits the one sentence
+ * this door rests on: with an unrecognised tool we cannot say the call executes
+ * nothing, so the exception would no longer be justified by the argument that
+ * created it.
+ */
+const REPAIR_TOOLS = ["Write", "Edit", "MultiEdit"];
+/**
+ * The file a repair event targets, or `null` when this event is not a repair
+ * shape at all — wrong tool, or no `file_path`. Shared by both doors so the
+ * stamp escape and the load-path escape cannot drift apart (they already did
+ * once: the suffix-match hole was fixed on one and found on the other).
  */
-function isStampRepairEvent(event, hookFile) {
+function repairTargetOf(event) {
+    const tool = event.tool_name;
+    if (typeof tool !== "string" || !REPAIR_TOOLS.includes(tool))
+        return null;
     const filePath = event.tool_input?.file_path;
-    if (typeof filePath === "string" && samePathRef(filePath, hookFile))
+    return typeof filePath === "string" ? filePath : null;
+}
+/**
+ * The stamp sidecar a hook's compile writes, as a repo-relative reference.
+ * Mirrors `hookStampPath` in cli.ts (`.vigiles/hooks/<basename>.json`); kept as a
+ * string here because core takes no `node:path`.
+ */
+function stampSidecarRef(hookFile) {
+    return `.vigiles/hooks/${basenameOf(hookFile)}.json`;
+}
+/**
+ * True when this event IS the author repairing the hook — a FILE WRITE, and only
+ * a file write.
+ *
+ * 🔴 THIS USED TO ADMIT A BASH COMMAND, AND THAT WAS THE WHOLE PROBLEM. The
+ * escape accepted `vigiles compile …`, and recognising a trusted ACTION from an
+ * untrusted STRING produced five findings in a row, each fix correct and each
+ * followed by another: `.some()` over the leaves → the operand (`compile
+ * /tmp/payload.spec.ts`, which `loadSpec` imports) → the executable path
+ * (`/tmp/vigiles compile`) → the working directory (`cd /tmp/evil && vigiles
+ * compile`). The degrees of freedom in a command string are unbounded — argv,
+ * cwd, PATH, `node_modules` resolution, a hostile `.vigilesrc.json`, a shell
+ * function — so no amount of parsing closes the class. Two more constraints
+ * predict two more findings.
+ *
+ * ## Why the command was not needed at all — measured, not argued
+ *
+ * MEASURED 2026-08-12 against the real runtime, on a stale-stamp fixture:
+ * writing `{}` into the stamp sidecar (or deleting it) makes
+ * `verifyStampOrRefuse` return early, so the hook LOADS AND ENFORCES again —
+ * `ls` passed and `git push --force` was still denied with the hook's own reason.
+ * The repo is unwedged by a file write, and the gate is back on duty; the author
+ * then runs `vigiles compile` through the NORMAL gate, needing no escape at all.
+ *
+ * MEASURED the same day on the load-wedge fixture: with `package.json` holding
+ * conflict markers, `vigiles compile <hook>` exits 1 —
+ * `Cannot load hook …: Invalid package config` — because compile has to load the
+ * hook through the same broken resolver the runtime just failed on. The command
+ * the escape existed to permit CANNOT repair that wedge. It was pure liability.
+ *
+ * So the Bash escape kept only a git whitelist — and a later round measured that
+ * those run `.git/hooks/*` too and deleted them as well. NO command is an escape
+ * now; the repair is what it always should have been: a write
+ * ({@link isLoadPathRepairEvent}).
+ *
+ * ## What is accepted here
+ *
+ * A write whose target is the hook's own source, or its stamp sidecar
+ * (`.vigiles/hooks/<basename>.json`). Both are repo-owned paths derived from the
+ * file the runtime was invoked with, never from the event.
+ *
+ * 🔴 SCOPE IS NOT THE SAME QUESTION AS EXECUTION. A previous round defended a
+ * suffix comparison here on the ground that a write executes nothing — true, and
+ * beside the point: `/home/another-project/.claude/hooks/guard.hook.mjs` ends
+ * the same way as this repo's hook, so a wedge in one checkout granted a write
+ * into another. Both sides now resolve against `repoRoot` and compare whole
+ * ({@link resolveRef}); the absolute-vs-relative tolerance that suffix matching
+ * was reached for is what resolution gives you properly.
+ *
+ * This grants nothing new: a Bash gate never gated file tools in the first place
+ * (the 2026-08-10 incident was fixed by hand-editing JSON while every Bash
+ * command was refused), and a file gate already let the hook's own source be
+ * rewritten, which is strictly more powerful than clearing its stamp.
+ */
+function isStampRepairEvent(event, hookFile, repoRoot) {
+    const filePath = repairTargetOf(event);
+    if (filePath === null)
+        return false;
+    const target = resolveRef(repoRoot, filePath);
+    return (target === resolveRef(repoRoot, hookFile) ||
+        target === resolveRef(repoRoot, stampSidecarRef(hookFile)));
+}
+/**
+ * True when this event is a load-path REPAIR — a file write, and only a file
+ * write, to one of the files whose breakage takes the runtime down.
+ *
+ * 🔴 THE GIT ESCAPE USED TO LIVE HERE AND IT EXECUTED REPO CODE. `git merge
+ * --abort` · `git rebase --abort` · `git checkout -- <path>` were admitted on the
+ * reasoning that they "only move the tree to states git already holds; none
+ * executes a line of repo code". MEASURED against git 2.43.0 with hooks installed
+ * in `.git/hooks/`, and the reasoning is false for ALL THREE:
+ *
+ *   git checkout -- f.txt   → post-checkout          (args `<sha> <sha> 0`)
+ *   git merge --abort       → reference-transaction  (prepared, committed)
+ *   git rebase --abort      → reference-transaction  (×4) + post-checkout
+ *
+ * `reference-transaction` fires on ANY ref update, and every one of these updates
+ * a ref. `.git/hooks/*` is writable by exactly the actor this door assumes —
+ * whoever could wedge the repo in the first place — so the whitelist was an
+ * arbitrary-execution path standing open precisely while the gate enforced
+ * nothing. Same shape as the `vigiles compile` escape one layer down: a command
+ * believed inert because of what it MEANS rather than what it DOES.
+ *
+ * ## Why the replacement is a write, not a safer command
+ *
+ * `git -c core.hooksPath=/nonexistent …` does suppress all three (measured: no
+ * hook ran for any of them). It was rejected anyway. It puts free-form structure
+ * back into the accepted string — the exact thing five findings on the compile
+ * door came from — and it buys nothing, because MEASURED on the load-wedge
+ * fixture a plain file write already restores the gate to ENFORCING:
+ *
+ *   wedged     : `ls` refused
+ *   after Edit : `ls` allowed, `git push --force` DENIED by the hook's own reason
+ *
+ * You do not need to finish recovering, only to stop being wedged. Once the hook
+ * loads, the gate decides normally and `git merge --abort` is an ordinary allowed
+ * command — through the gate, not around it.
+ *
+ * ## What is accepted
+ *
+ * A write to the hook's own source, its stamp sidecar, or one of
+ * {@link HARNESS_CONFIG_FILES}. That set is COMPLETE for a compiled hook rather
+ * than a guess: `checkHookImports` rejects every import but `vigiles/hook`, so the
+ * load path is the hook file plus the config that resolves that specifier —
+ * nothing else can break it.
+ *
+ * A file write executes nothing, which is the property no command on this door
+ * ever had.
+ *
+ * ## …IN THIS REPOSITORY, which is a separate question
+ *
+ * "A write executes nothing" answers the EXECUTION objection and says nothing
+ * about SCOPE. Under the suffix comparison this used to do, a write to
+ * `/home/another-project/package.json` was accepted while THIS repo was wedged —
+ * a file that cannot repair the failure, in a checkout the wedged session has no
+ * business touching. Every candidate is now resolved against
+ * {@link HookRepoPaths.root} and compared whole against the paths the runtime
+ * itself derived ({@link HookRepoPaths.loadPathFiles}, plus this root's
+ * {@link HARNESS_CONFIG_FILES} so the floor case can never be argued away).
+ *
+ * ⚠️ THE HOOK'S OWN PATH DOES NOT GIVE THE ROOT, so the caller passes it. A hook
+ * lives at `.claude/hooks/…`, `.vigiles/hooks/…`, a plugin subdirectory or the
+ * repo root itself; there is no fixed depth to walk up, and finding a `.git`
+ * marker would mean reading disk, which core does not do. Nor would a
+ * git-derived root be RIGHT: `verifyStampOrRefuse` reads the hook and its stamp
+ * sidecar via `process.cwd()`, so any other root would accept writes to files
+ * the runtime does not read — repairs that do not repair. The root is therefore
+ * the one the rest of the runtime already uses, and it is passed in rather than
+ * invented here.
+ */
+function isLoadPathRepairEvent(event, hookFile, repo) {
+    if (isStampRepairEvent(event, hookFile, repo.root))
         return true;
-    const command = event.tool_input?.command;
-    if (typeof command !== "string")
+    const filePath = repairTargetOf(event);
+    if (filePath === null)
         return false;
-    return (0, bash_effects_js_1.leafCommandsNormalized)(command).some((leaf) => {
-        const i = leaf.argv.findIndex((a) => basenameOf(a) === "vigiles");
-        return i !== -1 && leaf.argv.slice(i + 1).includes("compile");
-    });
+    const target = resolveRef(repo.root, filePath);
+    return [...merge_conflict_js_1.HARNESS_CONFIG_FILES, ...repo.loadPathFiles].some((f) => target === resolveRef(repo.root, f));
 }
 //# sourceMappingURL=hook-program.js.map