chore(fleet): refresh mirrors from bundle 1.0.13

Author: jdalton

.claude/hooks/fleet/_dispatch/dispatch.mts

@@ -138,7 +138,8 @@ export interface DispatchHookEntry {
   /**
    * Legacy pure entry: returns reminder text to surface on stderr, or
    * `undefined`. Mutually exclusive with `check` — exactly one is set per entry.
-   * (bundle-stale-reminder style.)
+   * No current hook uses it — every bundled hook is a `defineHook` `check`;
+   * the seam stays for a future legacy port.
    */
   readonly run?: (payload: DispatchPayload) => string | undefined
   /**
@@ -177,7 +178,7 @@ export const SINGLE_HOOK_NOT_FOUND_EXIT = 3
  * source).
  */
 export function hookInTable(event: string, hookName: string): boolean {
-  const entries = DISPATCH_TABLE[event] ?? []
+  const entries: readonly DispatchHookEntry[] = DISPATCH_TABLE[event] ?? []
   return entries.some(entry => entry.name === hookName)
 }
 
@@ -234,7 +235,7 @@ export async function dispatch(
   payload: DispatchPayload,
   onlyHook?: string | undefined,
 ): Promise<DispatchResult> {
-  const all = DISPATCH_TABLE[event] ?? []
+  const all: readonly DispatchHookEntry[] = DISPATCH_TABLE[event] ?? []
   const entries =
     onlyHook === undefined ? all : all.filter(entry => entry.name === onlyHook)
   const reminders: string[] = []

.claude/hooks/fleet/_shared/ast/core.mts

@@ -52,6 +52,16 @@ export interface ParseOptions {
    * model.
    */
   comments?: boolean | undefined
+  /**
+   * Attach a 1-based `loc` object (start/end line + column) to every node.
+   * Honored by the underlying parser at runtime; default `false`.
+   */
+  locations?: boolean | undefined
+  /**
+   * Attach a `range` `[start, end]` tuple to every node. Honored by the
+   * underlying parser at runtime; default `false`.
+   */
+  ranges?: boolean | undefined
 }
 
 export interface CallSite {
@@ -73,6 +83,8 @@ export const DEFAULT_PARSE_OPTIONS: Required<ParseOptions> = {
   comments: false,
   ecmaVersion: 2026,
   jsx: false,
+  locations: false,
+  ranges: false,
   sourceType: 'module',
   typescript: true,
 }

.claude/hooks/fleet/_shared/es-polyfills.mts

@@ -426,7 +426,7 @@ function validateTypedArrayReceiver(receiver: unknown): TypedArrayInstance {
   if (!ArrayBuffer.isView(receiver) || receiver instanceof DataView) {
     throw new TypeError('Receiver must be a TypedArray')
   }
-  return receiver as TypedArrayInstance
+  return receiver as unknown as TypedArrayInstance
 }
 
 // 23.2.3.32 %TypedArray%.prototype.toReversed.

.claude/hooks/fleet/alpha-sort-nudge/index.mts

@@ -49,7 +49,7 @@ function isAscadSorted(keys: readonly string[]): boolean {
 function indentOf(line: string): number {
   const m = line.match(/^(?<indent>\s*)/)
   /* c8 ignore next - regex always matches, fallback is unreachable */
-  return m ? m.groups!.indent!.length : 0
+  return m ? m.groups!['indent']!.length : 0
 }
 
 // Walk lines, grouping maximal runs of lines that (a) match `keyFor` to a
@@ -94,7 +94,7 @@ function scanRuns(
 // JSON / JSONC object keys: `"name": ...` (allow trailing comma).
 function jsonKey(line: string): string | undefined {
   const m = line.match(/^\s*"(?<key>[^"]+)"\s*:/)
-  return m ? m.groups?.key : undefined
+  return m ? m.groups?.['key'] : undefined
 }
 
 // YAML mapping keys: `name:` at line start (not a `- ` sequence item, not a
@@ -104,7 +104,7 @@ function yamlKey(line: string): string | undefined {
     return undefined
   }
   const m = line.match(/^\s*(?<key>[A-Za-z0-9_.-]+)\s*:(?:\s|$)/)
-  return m ? m.groups?.key : undefined
+  return m ? m.groups?.['key'] : undefined
 }
 
 // Markdown bullets: `- text` / `* text`. Returns the text after the marker.
@@ -114,13 +114,13 @@ function mdBullet(line: string): string | undefined {
     return undefined
   }
   // Skip task-list checkboxes and nested numbered intent.
-  return m.groups!.text!.toLowerCase()
+  return m.groups!['text']!.toLowerCase()
 }
 
 // Bash all-caps assignments: `NAME=...` (cache-key var style).
 function bashAssign(line: string): string | undefined {
   const m = line.match(/^\s*(?<name>[A-Z][A-Z0-9_]+)=/)
-  return m ? m.groups?.name : undefined
+  return m ? m.groups?.['name'] : undefined
 }
 
 /**

.claude/hooks/fleet/avoid-cd-nudge/index.mts

@@ -42,7 +42,7 @@ function detectsBareCd(command: string): boolean {
   const cdRe = /(?:^|[\s;&|])cd\s+(?<target>\S+)/g
   let m: RegExpExecArray | null
   while ((m = cdRe.exec(flat)) !== null) {
-    const target = m.groups!.target!
+    const target = m.groups!['target']!
 
     // Skip `cd -` (intentional return).
     if (target === '-') {

.claude/hooks/fleet/broken-hook-detector/index.mts

@@ -317,11 +317,11 @@ export function parseMissingPackages(stderr: string): readonly string[] {
   const pkgs = new Set<string>()
   // ESM form: Cannot find package '<name>' …
   for (const m of stderr.matchAll(/Cannot find package '(?<pkg>[^']+)'/g)) {
-    pkgs.add(m.groups!.pkg!)
+    pkgs.add(m.groups!['pkg']!)
   }
   // CJS form: Cannot find module '<name>'
   for (const m of stderr.matchAll(/Cannot find module '(?<pkg>[^']+)'/g)) {
-    const name = m.groups!.pkg!
+    const name = m.groups!['pkg']!
     // Skip relative + absolute paths (those are import-path bugs, not
     // missing-dep bugs, and the user can't `pnpm i` a relative path).
     if (!name.startsWith('.') && !name.startsWith('/')) {

.claude/hooks/fleet/bundle-stale-reminder/README.md

@@ -12,7 +12,7 @@ After any `Edit` or `Write`:
 
 1. Decide whether the edited path is a hook-bundle source.
 2. Compare the source's mtime against `_dist/bundle.cjs` — a missing bundle counts as stale.
-3. If stale, print a rebuild reminder to stderr. It never blocks (PostToolUse can't reject the prior call); it always exits 0.
+3. If stale, return a `notify` verdict — the reminder lands on stderr. It never blocks (PostToolUse can't reject the prior call); it always exits 0.
 
 Rebuild with:
 
@@ -22,7 +22,7 @@ node scripts/fleet/build-hook-bundle.mts
 
 ## Bypass
 
-Type `Allow hook-bundle-current bypass` to silence the reminder when the rebuild is genuinely deferred.
+Type `Allow hook-bundle-current bypass` to silence the reminder when the rebuild is genuinely deferred. The slug is declared as `bypass` metadata on the hook's `defineHook` spec, so the framework wires phrase detection and appends the uniform footer naming the exact phrase — the message never hand-writes it.
 
 ## Test
 

.claude/hooks/fleet/bundle-stale-reminder/index.mts

@@ -3,43 +3,33 @@
 //
 // renamed-from: bundle-stale-guard
 //
-// Mirrors extension-build-current-reminder. Fires after an Edit/Write whose
-// path is a hook-bundle SOURCE: the `_dispatch/` dispatcher, the generated
-// `dispatch-table.mts`, any bundled hook's `index.mts`, or anything under
-// `_shared/`. When the edited source is NEWER than the built
-// `_dist/bundle.cjs`, the bundle is stale and the operator is reminded to
-// rebuild it with `node scripts/fleet/build-hook-bundle.mts`.
+// Fires after an Edit/Write whose path is a hook-bundle SOURCE: the
+// `_dispatch/` dispatcher, the generated `dispatch-table.mts`, any bundled
+// hook's `index.mts`, or anything under `_shared/`. When the edited source is
+// NEWER than the built `_dist/bundle.cjs`, the bundle is stale and the
+// operator is reminded to rebuild it with
+// `node scripts/fleet/build-hook-bundle.mts`.
 //
-// The hook is a REMINDER, never a block: it only writes to stderr and always
-// exits 0. PostToolUse can't reject the prior tool call anyway.
+// The hook is a REMINDER, never a block: it returns a notify verdict, so the
+// tool call always proceeds. PostToolUse can't reject the prior tool call
+// anyway.
 //
-// Bypass: `Allow hook-bundle-current bypass` (silences the reminder when the
-// rebuild is genuinely deferred). See docs/agents.md/fleet/hook-bundle.md.
+// Bypass: the `hook-bundle-current` slug is declared as `bypass` metadata on
+// defineHook — the framework wires phrase detection and the uniform footer
+// from that one array, so typing the phrase silences the reminder when the
+// rebuild is genuinely deferred. See docs/agents.md/fleet/hook-bundle.md.
 
 import { existsSync, statSync } from 'node:fs'
 import path from 'node:path'
-import process from 'node:process'
 
 import { normalizePath } from '@socketsecurity/lib-stable/paths/normalize'
 
-import { isHookEntrypoint } from '../_shared/entrypoint.mts'
-import { bypassPhrasePresent } from '../_shared/transcript.mts'
+import { defineHook, notify, runHook } from '../_shared/guard.mts'
+import type { GuardResult } from '../_shared/guard.mts'
+import { readFilePath } from '../_shared/payload.mts'
+import type { ToolCallPayload } from '../_shared/payload.mts'
 import { resolveProjectDir } from '../_shared/project-dir.mts'
 
-export interface BundleStalePayload {
-  readonly cwd?: string | undefined
-  readonly hook_event_name?: string | undefined
-  readonly tool_input?: { readonly file_path?: unknown | undefined } | undefined
-  readonly tool_name?: string | undefined
-  readonly transcript_path?: string | undefined
-}
-
-// Read by scripts/fleet/gen/hook-dispatch.mts to place this hook in the
-// static dispatch table (the bundled fast-path). PostToolUse, Edit|Write.
-export const DISPATCH_EVENT = 'PostToolUse'
-export const DISPATCH_TOOLS: readonly string[] = ['Edit', 'Write']
-
-const BYPASS_PHRASE = 'Allow hook-bundle-current bypass'
 const BUNDLE_REL = '.claude/hooks/fleet/_dist/bundle.cjs'
 // The wheelhouse holds TWO bundles: the live one (above) and the cascaded
 // canonical under template/base/. A hook-source edit leaves both stale until
@@ -144,47 +134,40 @@ export function bundleIsStale(
 }
 
 /**
- * Builds the multi-line stderr reminder.
+ * Builds the multi-line reminder. The bypass instruction is NOT part of the
+ * message — defineHook appends the uniform footer from the `bypass` metadata.
  */
 export function formatReminder(sourceRel: string): string {
-  return (
-    [
-      `[bundle-stale-reminder] Edited a hook-bundle source without rebuilding the bundle.`,
-      ``,
-      `  Source:  ${sourceRel}`,
-      `  Bundle:  ${BUNDLE_REL}`,
-      `           (+ ${TEMPLATE_BUNDLE_REL} in the wheelhouse) — missing or older than the source`,
-      ``,
-      `  Rebuild so warm hook dispatch loads current code:`,
-      `    node scripts/fleet/build-hook-bundle.mts`,
-      ``,
-      `  Deferring the rebuild on purpose? Type "${BYPASS_PHRASE}".`,
-    ].join('\n') + '\n'
-  )
+  return [
+    `[bundle-stale-reminder] Edited a hook-bundle source without rebuilding the bundle.`,
+    ``,
+    `  Source:  ${sourceRel}`,
+    `  Bundle:  ${BUNDLE_REL}`,
+    `           (+ ${TEMPLATE_BUNDLE_REL} in the wheelhouse) — missing or older than the source`,
+    ``,
+    `  Rebuild so warm hook dispatch loads current code:`,
+    `    node scripts/fleet/build-hook-bundle.mts`,
+  ].join('\n')
 }
 
 /**
  * Core hook logic, decoupled from process I/O so the dispatcher bundle can
- * call it directly. Returns the reminder text when the bundle is stale, or
- * undefined when there is nothing to say.
+ * call it via the `check` seam. Returns a notify verdict when the bundle is
+ * stale, or undefined when there is nothing to say.
  */
-export function run(payload: BundleStalePayload): string | undefined {
-  if (payload.hook_event_name && payload.hook_event_name !== 'PostToolUse') {
+export const check = (payload: ToolCallPayload): GuardResult => {
+  const eventName = (payload as { hook_event_name?: unknown | undefined })
+    .hook_event_name
+  if (eventName && eventName !== 'PostToolUse') {
     return undefined
   }
   if (payload.tool_name !== 'Edit' && payload.tool_name !== 'Write') {
     return undefined
   }
-  const filePath =
-    typeof payload.tool_input?.file_path === 'string'
-      ? payload.tool_input.file_path
-      : ''
+  const filePath = readFilePath(payload)
   if (!filePath || !isBundledSource(filePath)) {
     return undefined
   }
-  if (bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASE)) {
-    return undefined
-  }
   const cwd = resolveProjectDir(
     typeof payload.cwd === 'string' ? payload.cwd : undefined,
   )
@@ -199,50 +182,14 @@ export function run(payload: BundleStalePayload): string | undefined {
     return undefined
   }
   const sourceRel = path.relative(repoRoot, sourceAbs) || filePath
-  return formatReminder(sourceRel)
-}
-
-/* c8 ignore start - process-entrypoint I/O; only reachable when invoked as main script */
-async function readStdin(): Promise<string> {
-  let raw = ''
-  for await (const chunk of process.stdin) {
-    raw += chunk
-  }
-  return raw
-}
-
-async function main(): Promise<void> {
-  let raw: string
-  try {
-    raw = await readStdin()
-  } catch {
-    process.exit(0)
-  }
-  if (!raw.trim()) {
-    process.exit(0)
-  }
-  let payload: BundleStalePayload
-  try {
-    payload = JSON.parse(raw) as BundleStalePayload
-  } catch {
-    process.exit(0)
-  }
-  const reminder = run(payload)
-  if (reminder) {
-    process.stderr.write(reminder)
-  }
-  // Reminder-only: never blocks.
-  process.exit(0)
+  return notify(formatReminder(sourceRel))
 }
 
-// Entrypoint-guarded: run main() only when invoked directly, NOT when the test
-// or the dispatch bundle imports this module for its pure `run` helper.
-// `isHookEntrypoint` also short-circuits inside a snapshot build pass, where the
-// absolute-`--build-snapshot`-path coincidence would otherwise fire this guard
-// during the build and abort serialization (see _shared/entrypoint.mts).
-if (isHookEntrypoint(import.meta.url)) {
-  main().catch(() => {
-    process.exit(0)
-  })
-}
-/* c8 ignore stop */
+export const hook = defineHook({
+  bypass: ['hook-bundle-current'],
+  check,
+  event: 'PostToolUse',
+  matcher: ['Edit', 'Write'],
+  type: 'nudge',
+})
+void runHook(hook, import.meta.url)

.claude/hooks/fleet/c8-ignore-reason-guard/index.mts

@@ -57,11 +57,11 @@ export function findUnexplainedIgnores(source: string): Finding[] {
     IGNORE_DIRECTIVE_RE.lastIndex = 0
     let match: RegExpExecArray | null
     while ((match = IGNORE_DIRECTIVE_RE.exec(line)) !== null) {
-      const kind = match.groups!.kind!
+      const kind = match.groups!['kind']!
       if (kind === 'stop') {
         continue
       }
-      const rawTail = match.groups!.tail!
+      const rawTail = match.groups!['tail']!
       // A multi-line `next N` (N >= 2) is broken even WITH a reason: c8/v8
       // count physical lines, not statements, so `next 3` silently drops
       // covered lines. Require a start/stop bracket instead. Bare `next`
@@ -70,7 +70,7 @@ export function findUnexplainedIgnores(source: string): Finding[] {
       if (
         kind === 'next' &&
         countMatch &&
-        Number(countMatch.groups!.count) >= 2
+        Number(countMatch.groups!['count']) >= 2
       ) {
         findings.push({ line: i + 1, text: line.trim(), kind: 'next-n' })
         continue

.claude/hooks/fleet/catch-message-guard/index.mts

@@ -125,7 +125,7 @@ export function findCatchMessageViolations(after: string): Finding[] {
     CATCH_OPEN_RE.lastIndex = 0
     const pending: string[] = []
     while ((m = CATCH_OPEN_RE.exec(code)) !== null) {
-      pending.push(m.groups!.binding!)
+      pending.push(m.groups!['binding']!)
     }
     // Look for ${<binding>.message} for any currently-open binding
     // BEFORE updating depth, so the line that closes the catch
@@ -261,6 +261,7 @@ function escapeRegex(s: string): string {
 }
 
 export const check = editGuard((filePath, content, payload) => {
+  void content
   if (!isJsOrTs(filePath) || isTestTree(filePath)) {
     return undefined
   }