wendkeep 0.68.1 → 0.68.6

package/hooks/change-guard.mjs

@@ -1,86 +1,20 @@
 #!/usr/bin/env node
-// PreToolUse hook (matcher: Bash). O gate mecânico do loop a2 no ponto de execução:
-//   R1 — `wendkeep|wk change archive --force` vindo do AGENTE é negado (deny). Gate vermelho
-//        significa trabalho pendente; --force é decisão do usuário (escape: WENDKEEP_ALLOW_FORCE=1
-//        no ambiente do processo — env inline no texto do comando NÃO conta).
-//   R2 — `git commit` com change ativa E (--no-verify OU sensor crítico vermelho) vira `ask`
-//        (o usuário decide com 1 clique; falso-positivo custa pouco).
-// Fast-path: comando sem wendkeep/wk/git sai sem NENHUM I/O. Ausência normal continua
-// fail-open; corrupção do binding é diagnóstico visível e fail-closed.
+// PreToolUse guard. R1 protects the explicit archive --force decision. The project-scope
+// policy protects mutable Git/filesystem tools before they run, including Codex's raw-string
+// and object-shaped tool_input variants. Host adapters never emit `ask` for Codex: the Codex
+// contract accepts `deny` in PreToolUse, while Claude may still use `ask` for its own approval UI.
 import { pathToFileURL } from 'node:url';
-import { readHookInput, writeHookOutput } from './obsidian-common.mjs';
+import { readHookInput, readSessionRegistry, writeHookOutput } from './obsidian-common.mjs';
 import { activeChange, quickGateState } from './change-core.mjs';
 import { hookProfilePolicy, resolveHookOperatingProfile } from './operating-profile-runtime.mjs';
 import { isProjectVaultIntegrityError } from '../src/project-vault.mjs';
-
-const WK_EXECUTABLES = new Set([
-  'wendkeep', 'wendkeep.cmd', 'wendkeep.exe', 'wendkeep.ps1', 'wendkeep.mjs',
-  'wk', 'wk.cmd', 'wk.exe', 'wk.ps1',
-]);
-const NODE_EXECUTABLES = new Set(['node', 'node.exe']);
-const NPX_EXECUTABLES = new Set(['npx', 'npx.cmd', 'npx.exe']);
-const GIT_EXECUTABLES = new Set(['git', 'git.exe', 'git.cmd']);
-
-function shellSegments(command) {
-  const tokens = String(command || '').match(/"(?:\\.|[^"])*"|'(?:\\.|[^'])*'|&&|\|\||[;|\n]|&|[^\s;&|]+/g) || [];
-  const segments = [];
-  let current = [];
-  const flush = () => {
-    if (current.length) segments.push(current);
-    current = [];
-  };
-  for (const token of tokens) {
-    if (['&&', '||', ';', '|', '\n'].includes(token) || (token === '&' && current.length)) {
-      flush();
-      continue;
-    }
-    current.push(token);
-  }
-  flush();
-  return segments;
-}
-
-function unquote(token) {
-  const value = String(token || '');
-  if (value.length >= 2 && ((value[0] === '"' && value.at(-1) === '"')
-    || (value[0] === "'" && value.at(-1) === "'"))) return value.slice(1, -1);
-  return value;
-}
-
-function executableName(token) {
-  return unquote(token).replaceAll('\\', '/').split('/').at(-1).toLowerCase();
-}
-
-function invocationOf(segment) {
-  let index = 0;
-  while (segment[index] === '&' || /^[A-Za-z_][A-Za-z0-9_]*=/.test(segment[index] || '')) index += 1;
-  const executable = executableName(segment[index]);
-  if (WK_EXECUTABLES.has(executable)) {
-    return { kind: 'wendkeep', args: segment.slice(index + 1).map(unquote) };
-  }
-  if (NODE_EXECUTABLES.has(executable)) {
-    let scriptIndex = index + 1;
-    while (String(segment[scriptIndex] || '').startsWith('-')) scriptIndex += 1;
-    if (executableName(segment[scriptIndex]) === 'wendkeep.mjs') {
-      return { kind: 'wendkeep', args: segment.slice(scriptIndex + 1).map(unquote) };
-    }
-  }
-  if (NPX_EXECUTABLES.has(executable)) {
-    let packageIndex = index + 1;
-    while (String(segment[packageIndex] || '').startsWith('-')) packageIndex += 1;
-    if (WK_EXECUTABLES.has(executableName(segment[packageIndex]))) {
-      return { kind: 'wendkeep', args: segment.slice(packageIndex + 1).map(unquote) };
-    }
-  }
-  if (GIT_EXECUTABLES.has(executable)) {
-    return { kind: 'git', args: segment.slice(index + 1).map(unquote) };
-  }
-  return null;
-}
-
-function commandInvocations(command) {
-  return shellSegments(command).map(invocationOf).filter(Boolean);
-}
+import {
+  captureProjectScope,
+  commandHasUnprovenTarget,
+  extractToolCommand,
+  scopeDecision,
+  scopeForRegistry,
+} from './project-scope.mjs';
 
 function bindingFailureDecision(diagnostic) {
   const code = diagnostic?.code || 'WENDKEEP_VAULT_CONFIG_INVALID';
@@ -92,54 +26,150 @@ function bindingFailureDecision(diagnostic) {
   };
 }
 
-export function guardDecision(command, { vaultBase, env = process.env, profile = 'GOVERN' } = {}) {
+function hostFor({ host, provider } = {}) {
+  if (host) return host;
+  if (provider === 'codex') return 'codex';
+  // Pure callers historically represented Claude's approval UI without a provider field.
+  return 'claude';
+}
+
+function scopeGuardDecision(command, {
+  input = {},
+  host,
+  provider,
+  expectedScope,
+  actualScope,
+  activeSessions = [],
+  projectRoot = '',
+  projectId = '',
+  sessionId = '',
+} = {}) {
+  if (!expectedScope && input?.project_scope) expectedScope = input.project_scope;
+  if (!expectedScope && input?.projectScope) expectedScope = input.projectScope;
+  const actual = actualScope || captureProjectScope({
+    input,
+    projectRoot,
+    projectId,
+    provider,
+    sessionId,
+  });
+  const commandTargetKnown = !commandHasUnprovenTarget(command);
+  return scopeDecision({
+    command,
+    input,
+    expectedScope,
+    actualScope: actual,
+    host: hostFor({ host, provider }),
+    commandTargetKnown,
+    activeSessions,
+    currentSessionId: sessionId,
+  });
+}
+
+export function guardDecision(command, {
+  vaultBase,
+  env = process.env,
+  profile = 'GOVERN',
+  input = {},
+  host,
+  provider,
+  expectedScope,
+  actualScope,
+  projectRoot = '',
+  projectId = '',
+  sessionId = '',
+} = {}) {
   if (!hookProfilePolicy(profile).harness) return null;
   const cmd = String(command || '');
-  const invocations = commandInvocations(cmd);
-  if (!invocations.length) return null; // fast-path: parsing puro, zero I/O para o caso comum
 
-  // R1: archive --force — parser puro, ainda sem I/O. Reason fala com o AGENTE (deny).
-  const forcedArchive = invocations.find(({ kind, args }) => kind === 'wendkeep'
-    && args[0]?.toLowerCase() === 'change'
-    && args[1]?.toLowerCase() === 'archive'
-    && args.some((arg) => /^--force(?:=|$)/i.test(arg)));
-  if (forcedArchive) {
-    if (env.WENDKEEP_ALLOW_FORCE === '1') return null;
-    return {
-      permissionDecision: 'deny',
-      permissionDecisionReason: '`change archive --force` é decisão do usuário, não sua. Gate vermelho = trabalho pendente: rode `wendkeep change status` e conclua as tarefas, ou `wendkeep change abandon <slug>` se a change não vai adiante. Se o usuário pediu o force explicitamente, peça a ele para rodar com WENDKEEP_ALLOW_FORCE=1.',
-    };
+  // R1: archive --force — parser/policy only, no scope is needed to deny the bypass.
+  if (/\b(?:wendkeep|wk)\b.*\bchange\s+archive\b.*--force(?:=|\b)/i.test(cmd)
+    || /(?:wendkeep\.mjs|wendkeep\.cmd)\s+change\s+archive\b.*--force(?:=|\b)/i.test(cmd)) {
+    if (env.WENDKEEP_ALLOW_FORCE !== '1') {
+      return {
+        permissionDecision: 'deny',
+        permissionDecisionReason: '`change archive --force` é decisão do usuário, não sua. Gate vermelho = trabalho pendente: rode `wendkeep change status` e conclua as tarefas, ou `wendkeep change abandon <slug>` se a change não vai adiante. Se o usuário pediu o force explicitamente, peça a ele para rodar com WENDKEEP_ALLOW_FORCE=1.',
+      };
+    }
   }
 
-  // R2: git commit — 1ª leitura de fs só acontece aqui. Reason fala com o USUÁRIO (ask).
-  const gitCommit = invocations.find(({ kind, args }) => kind === 'git'
-    && args.some((arg) => arg.toLowerCase() === 'commit'));
-  if (gitCommit) {
+  const scoped = scopeGuardDecision(cmd, {
+    input,
+    host,
+    provider,
+    expectedScope,
+    actualScope,
+    projectRoot,
+    projectId,
+    sessionId,
+  });
+  if (scoped) return scoped;
+
+  // R2: commit with an active change and a bypass/red sensor. This branch is reached only
+  // after the project scope is proven. Codex gets deny because PreToolUse cannot ask.
+  if (/\bgit(?:\.exe|\.cmd)?\b[^;&|\n]*\bcommit\b/i.test(cmd)) {
     const slug = activeChange(vaultBase);
     if (!slug) return null;
-    const noVerify = gitCommit.args.some((arg) => /^--no-verify(?:=|$)/i.test(arg));
+    const noVerify = /(?:^|\s)--no-verify(?:=|\s|$)/i.test(cmd);
     const gate = noVerify ? null : quickGateState(vaultBase);
     if (noVerify || (gate && gate.redCritical)) {
+      const selectedHost = hostFor({ host, provider });
+      const reason = noVerify
+        ? `git commit --no-verify com a change "${slug}" ativa — commitar pulando os hooks?`
+        : `A change ativa "${slug}" tem sensor crítico vermelho (wendkeep verify falhou). Commitar mesmo assim?`;
       return {
-        permissionDecision: 'ask',
-        permissionDecisionReason: noVerify
-          ? `git commit --no-verify com a change "${slug}" ativa — commitar pulando os hooks?`
-          : `A change ativa "${slug}" tem sensor crítico vermelho (wendkeep verify falhou). Commitar mesmo assim?`,
+        permissionDecision: selectedHost === 'codex' ? 'deny' : 'ask',
+        permissionDecisionReason: selectedHost === 'codex'
+          ? `${reason} O Codex exige uma autorização explícita fora do PreToolUse; execute a ação conscientemente após corrigir o gate.`
+          : reason,
       };
     }
   }
   return null;
 }
 
+function runtimeScope(runtime, input) {
+  const identity = runtime.identity || {};
+  const sessionId = identity.canonicalConversationId || input.session_id || input.sessionId || '';
+  const expected = runtime.entry?.project_scope
+    ? {
+      ...runtime.entry.project_scope,
+      conflict: runtime.entry.project_scope_conflict === true,
+    }
+    : null;
+  const actual = captureProjectScope({
+    input,
+    projectRoot: runtime.projectRoot || runtime.resolution?.projectRoot || '',
+    projectId: runtime.resolution?.projectId || '',
+    provider: identity.provider || 'codex',
+    sessionId,
+  });
+  const registry = readSessionRegistry(runtime.vaultBase);
+  const activeSessions = Object.entries(registry.sessions || {})
+    .filter(([, entry]) => entry?.status === 'active');
+  return { expectedScope: expected, actualScope: actual, activeSessions, sessionId };
+}
+
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const input = readHookInput();
     const runtime = resolveHookOperatingProfile({ input });
+    const command = extractToolCommand(input);
+    const scope = runtime.bindingError ? null : runtimeScope(runtime, input);
     const d = runtime.bindingError
       ? bindingFailureDecision(runtime.bindingError)
-      : guardDecision(input.tool_input?.command, {
+      : guardDecision(command, {
         vaultBase: runtime.vaultBase,
         profile: runtime.profile,
+        input,
+        provider: runtime.identity?.provider,
+        host: runtime.identity?.provider,
+        expectedScope: scope.expectedScope,
+        actualScope: scope.actualScope,
+        activeSessions: scope.activeSessions,
+        projectRoot: runtime.projectRoot,
+        projectId: runtime.resolution?.projectId,
+        sessionId: scope.sessionId,
       });
     if (d) writeHookOutput({ hookSpecificOutput: { hookEventName: 'PreToolUse', ...d } });
     // allow implícito: exit 0 sem output
@@ -152,7 +182,16 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
         },
       });
     } else {
-      writeHookOutput({}); // ausência/erro não-corrupto preserva compatibilidade fail-open
+      // A malformed hook envelope cannot prove the target. Return a visible deny rather than
+      // silently permitting a mutable tool with unknown project scope.
+      writeHookOutput({
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          ...bindingFailureDecision({ code: 'WENDKEEP_SCOPE_INPUT_INVALID', message: error.message }),
+        },
+      });
     }
   }
 }
+
+export { scopeForRegistry };

package/hooks/git-snapshot.mjs

@@ -31,6 +31,16 @@ function gitOptional(cwd, args, { spawn = spawnSync } = {}) {
   return result.status === 0 ? String(result.stdout || '').trim() : '';
 }
 
+function parseGitConfigPaths(output) {
+  const values = new Map();
+  for (const line of String(output || '').split(/\r?\n/).filter(Boolean)) {
+    const separator = line.search(/\s/);
+    if (separator < 0) continue;
+    values.set(line.slice(0, separator).toLowerCase(), line.slice(separator + 1).trim());
+  }
+  return values;
+}
+
 function fingerprintFsEntry(path, unsafePaths = [], label = '') {
   let stat;
   try {
@@ -83,10 +93,16 @@ function fingerprintGitIndirection(path, unsafePaths) {
 }
 
 function gitMetadataSnapshot(root, options = {}) {
-  const gitDir = resolveGitPath(root, git(root, ['rev-parse', '--git-dir'], options));
-  const commonDir = resolveGitPath(root, git(root, ['rev-parse', '--git-common-dir'], options));
-  const configuredHooks = gitOptional(root, ['config', '--path', '--get', 'core.hooksPath'], options);
-  const configuredExcludes = gitOptional(root, ['config', '--path', '--get', 'core.excludesFile'], options);
+  const [gitDirValue, commonDirValue] = String(git(root, [
+    'rev-parse', '--git-dir', '--git-common-dir',
+  ], options)).trim().split(/\r?\n/);
+  const gitDir = resolveGitPath(root, gitDirValue);
+  const commonDir = resolveGitPath(root, commonDirValue);
+  const configuredPaths = parseGitConfigPaths(gitOptional(root, [
+    'config', '--path', '--get-regexp', '^core\\.(hooksPath|excludesFile)$',
+  ], options));
+  const configuredHooks = configuredPaths.get('core.hookspath') || '';
+  const configuredExcludes = configuredPaths.get('core.excludesfile') || '';
   const hooksPath = configuredHooks ? resolveGitPath(root, configuredHooks) : join(commonDir, 'hooks');
   const unsafePaths = [];
   const targets = [
@@ -508,7 +524,10 @@ function worktreeFingerprint(root, relPath, options = {}, diagnostics = {
 
 export function captureGitSnapshot(projectRoot, options = {}) {
   const start = resolve(projectRoot);
-  const root = realpathSync.native(resolve(String(git(start, ['rev-parse', '--show-toplevel'], options)).trim()));
+  const [rootValue, headValue] = String(git(start, [
+    'rev-parse', '--show-toplevel', '--verify', 'HEAD',
+  ], options)).trim().split(/\r?\n/);
+  const root = realpathSync.native(resolve(rootValue));
   const canonicalRoot = canonicalFsPath(root);
   const expectedRoot = options._expectedGitlinkRoot ? canonicalFsPath(options._expectedGitlinkRoot) : '';
   if (expectedRoot && canonicalRoot !== expectedRoot) {
@@ -525,7 +544,7 @@ export function captureGitSnapshot(projectRoot, options = {}) {
   }
   seen.add(canonicalRoot);
   options = { ...options, _gitlinkDepth: depth, _gitlinkSeen: [...seen] };
-  const head = String(git(root, ['rev-parse', '--verify', 'HEAD'], options)).trim();
+  const head = String(headValue || '').trim();
   const status = git(root, ['status', '--porcelain=v2', '-z', '--untracked-files=all'], { ...options, binary: true });
   const fingerprints = {};
   const dirtyPaths = new Set();

package/hooks/obsidian-common.mjs

@@ -565,6 +565,46 @@ export function applyStopActivation(registry, stop = {}) {
   return stopResult(next, 'applied', true);
 }
 
+// Finalization is a second causal transition: Stop first acknowledges the turn and publishes
+// observability while the activation is still addressable, then closes that same activation. The
+// explicit id check prevents a late Stop from closing a newer activation opened meanwhile.
+export function closeSessionActivation(registry, stop = {}) {
+  const next = cloneRegistry(registry);
+  const sessionId = stop.session_id || stop.canonical_session_id || '';
+  const current = next.sessions[sessionId];
+  const requestedActivationId = String(stop.activation_id || '');
+  const activeId = String(current?.active_activation_id || '');
+  const stopTurnId = String(stop.turn_id || '');
+  if (!current || !requestedActivationId) return stopResult(next, 'ambiguous');
+  if (!activeId && current.status === 'done' && current.last_turn_id === stopTurnId) {
+    return stopResult(next, 'duplicate');
+  }
+  if (!activeId || activeId !== requestedActivationId) return stopResult(next, 'superseded');
+
+  const active = current.activations?.[activeId];
+  if (!active || active.status !== 'active') return stopResult(next, 'ambiguous');
+
+  const endedAt = String(stop.ended_at || '');
+  const activations = {
+    ...(current.activations || {}),
+    [activeId]: {
+      ...active,
+      status: 'done',
+      ...(endedAt ? { ended_at: endedAt } : {}),
+      ...(stopTurnId ? { last_stop_turn_id: stopTurnId } : {}),
+    },
+  };
+  next.sessions[sessionId] = {
+    ...current,
+    status: 'done',
+    active_activation_id: '',
+    ...(endedAt ? { ended_at: endedAt } : {}),
+    ...(stopTurnId ? { last_turn_id: stopTurnId } : {}),
+    activations,
+  };
+  return stopResult(next, 'finalized', true);
+}
+
 // Remove one registry entry, but ONLY when its transcript matches the given path — this is
 // self-healing for entries wendkeep itself mis-wrote (a subagent rollout registered as a
 // top-level session by import <=0.46.1), never generic registry cleanup. An entry with the