yt-briefing 0.14.0 → 0.14.2

package/README.md

@@ -148,7 +148,7 @@ valid JSON the installer leaves it alone and says so — add the entry yourself:
   "hooks": {
     "PreToolUse": [
       { "matcher": "AskUserQuestion",
-        "hooks": [ { "type": "command", "command": "node \"node_modules/yt-briefing/dist/yt-summary-gate.js\"" } ] }
+        "hooks": [ { "type": "command", "command": "node \"${CLAUDE_PROJECT_DIR}/node_modules/yt-briefing/dist/yt-summary-gate.js\"" } ] }
     ]
   }
 }

package/dist/lib/skill-install.js

@@ -107,9 +107,16 @@ export function installSkills(root, dist = false) {
 export const CLAUDE_CODE = '1';
 /** Substring identifying our gate inside a settings.json hook command (used to update in place). */
 const GATE_ID = 'yt-summary-gate';
-/** How settings.json must invoke the gate — same portable form as the skill's engine commands. */
+/**
+ * How settings.json must invoke the gate. Like the skill's engine commands it bakes nothing
+ * machine-absolute, but a hook may NOT assume its cwd — Claude Code's hooks reference states the
+ * working directory can vary, so a bare relative path would fail open, silently and invisibly
+ * (the popup appears ungated, which is exactly the bug the gate exists to catch). Hence the
+ * `$CLAUDE_PROJECT_DIR` prefix: still just a placeholder string in the committed JSON, resolved
+ * to the project root at hook time.
+ */
 export const gateCommand = (dist = false) => dist
-    ? `${isBun ? 'bun' : 'node'} "${toProjectRel(join(DIST_DIR, GATE_ID + '.js'))}"`
+    ? `${isBun ? 'bun' : 'node'} "\${CLAUDE_PROJECT_DIR}/${toProjectRel(join(DIST_DIR, GATE_ID + '.js'))}"`
     : `bun run src/${GATE_ID}.ts`;
 /**
  * Put the gate into a settings object: a PreToolUse hook on AskUserQuestion. Merges — every other

package/dist/lib/summary-gate.js

@@ -38,3 +38,31 @@ export function summaryWasPasted(transcript, videoId) {
     }
     return false;
 }
+/**
+ * Same question as `summaryWasPasted`, but tolerant of the harness writing the transcript late.
+ *
+ * The agent pastes the summary and calls the popup in one turn, so the text block and the tool
+ * call are separate JSONL entries written by the harness asynchronously — the hook can run
+ * while only the tool call has reached disk. A single read then reports "not pasted" for a turn
+ * that did paste, and the block fires on every single video (observed 2026-08-30: the same
+ * transcript and pending file that blocked, replayed seconds later, allowed).
+ *
+ * So poll instead of guessing: re-read until the id shows up or the window closes. A turn that
+ * genuinely skipped the paste never produces the line, so the gate still blocks — just later.
+ * `read` returning null (a torn read mid-write) counts as "not yet", not as proof of absence.
+ */
+export async function waitForSummary(read, videoId, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 5000;
+    const intervalMs = opts.intervalMs ?? 200;
+    const now = opts.now ?? (() => Date.now());
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const deadline = now() + timeoutMs;
+    for (;;) {
+        const transcript = read();
+        if (transcript !== null && summaryWasPasted(transcript, videoId))
+            return true;
+        if (now() >= deadline)
+            return false;
+        await sleep(intervalMs);
+    }
+}

package/dist/yt-summary-gate.js

@@ -14,12 +14,16 @@
  * `pending.json`, and neither can see the conversation. The transcript is the one place the
  * evidence exists and only the agent harness exposes it, so the check has to run as a hook.
  *
+ * The transcript is polled for a few seconds rather than read once: the paste and the popup are
+ * a single turn and the harness flushes the JSONL asynchronously, so a single read can miss a
+ * text block that is merely still in flight.
+ *
  * Reads the PreToolUse payload on stdin; exit 0 allows, exit 2 blocks and feeds stderr back to
  * the agent. Anything unexpected — foreign tool, unreadable transcript, no pending video —
  * allows: a gate that misfires on unrelated work would be worse than the bug it guards.
  */
 import { readFileSync, existsSync } from 'node:fs';
-import { isRatingPopup, summaryWasPasted } from "./lib/summary-gate.js";
+import { isRatingPopup, waitForSummary } from "./lib/summary-gate.js";
 const ALLOW = 0;
 const BLOCK = 2;
 const allow = () => process.exit(ALLOW);
@@ -49,13 +53,16 @@ if (!pending.videoId)
 const transcript = payload.transcript_path;
 if (!transcript || !existsSync(transcript))
     allow();
-let seen = false;
-try {
-    seen = summaryWasPasted(readFileSync(transcript, 'utf8'), pending.videoId);
-}
-catch {
-    allow();
-}
+// Poll rather than read once: the paste and this popup are one turn, and the harness writes the
+// transcript asynchronously, so the text block can still be in flight while the hook runs.
+const seen = await waitForSummary(() => {
+    try {
+        return readFileSync(transcript, 'utf8');
+    }
+    catch {
+        return null; // transient (file being written) — treat as "not yet", keep waiting
+    }
+}, pending.videoId);
 if (seen)
     allow();
 process.stderr.write(`/yt step B not done: the summary for ${pending.videoId} ("${pending.title ?? '?'}") is not in your chat text.\n` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yt-briefing",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "A self-learning YouTube briefing engine: it sweeps the channels you follow, filters noise in two stages (title, then transcript), summarizes the rest in your language, and adapts to your ratings — one video at a time.",
   "type": "module",
   "bin": {