fix(hooks): resolve open(var) paths in inline scripts; stop reporting read-only opens as edits

.coldstart/notebook/.raw/hooks-evidence-mjs-147e7dd5.jsonl

@@ -3,3 +3,4 @@
 {"aliasesVerified":true,"id":"hooks-evidence-mjs-147e7dd5","type":"file","op":"put","anchors":[{"path":"hooks/evidence.mjs","symbols":["extractEvidence","extractCursorEvidence","extractCodexEvidence","classifyBash","codexCmdStrings","makeCollector","contentReadFiles","segmentStats","segmentStatsCursor","normRel"]}],"verified":[],"v":1,"ts":"2026-08-02T18:19:44.291Z","head":"8d5cc74d3cb9"}
 {"summary":"Per-host transcript-to-evidence extractors with tier classification (edit/read/gs/mention). Host gotchas verified on real transcripts: Cursor's conversation JSONL has NO tool_result records, so its extractor trusts calls and compensates with a stat-existence check on EVERY claim; Codex pairs custom_tool_call to output by call_id (result-confirmed) and its exec input embeds shell as tools.exec_command with the cmd key appearing BOTH quoted and unquoted across rollout versions. Default-deny: an unknown bash verb contributes at most a mention. Reading through the SHELL counts as reading: read verbs by name, plus inline scripts in any language (node -e, python3 -c, php -r, heredocs) matched on the file-open call in their body, since with an inline flag that body is in the command string; a script FILE stays a mention because its body is invisible. Measured on 2961 local transcripts while adding this: attributing the whole command would have over-tiered 50.6% of real inline reads (they carry unrelated path tokens), and output VOLUME was rejected as a precision criterion because cat's median output is 18 lines against an inline script's 10 — the distributions do not separate.","identityAliases":["inline script read detection","bashContentRead"],"incidentAliases":["cat not counted as read","node -e read invisible","script read not captured"],"anchors":[{"path":"hooks/evidence.mjs","symbols":["extractEvidence","extractCursorEvidence","extractCodexEvidence","classifyBash","codexCmdStrings","makeCollector","contentReadFiles","segmentStats","segmentStatsCursor","normRel","inlineScriptTier","bashContentRead"],"hash":"sha256:d8b68b9a4e7f","head":"69c1416ff12d"}],"id":"hooks-evidence-mjs-147e7dd5","type":"file","op":"put","verified":["hooks/evidence.mjs"],"character":"single","v":1,"ts":"2026-08-25T18:44:33.058Z","head":"69c1416ff12d"}
 {"summary":"Per-host transcript-to-evidence extractors with tier classification (edit/read/gs/mention), and the one table deciding what shell activity counts as reading or writing a file. Host gotchas verified on real transcripts: Cursor's conversation JSONL has NO tool_result records, so its extractor trusts calls and compensates with a stat-existence check on EVERY claim; Codex pairs custom_tool_call to output by call_id and its exec input embeds shell with the cmd key appearing BOTH quoted and unquoted across rollout versions. Default-deny: an unknown bash verb contributes at most a mention. Reading through the SHELL counts as reading (read verbs, plus inline scripts in any language matched on the file-open call in their body); writing through the shell counts as writing (bashEditTargets: redirect, tee, sed -i, literal write arg). A heredoc tag is an ARBITRARY identifier — the old EOF/PY/JS whitelist missed PATCH, TS and MSG and made those scripts invisible to both surfaces. redirectTargets overrides the verb table so `cat > x <<EOF` is an edit, not a read. Measured while building this: attributing a whole command would over-tier 50.6% of inline reads; output VOLUME does not separate reads from searches (cat's median is 18 lines vs an inline script's 10); and the deterministic write rules cover 89.2% of shell writes, so the single-literal guess for computed paths was rejected at 5.8% marginal gain.","identityAliases":["bashEditTargets","shell write detection","heredoc tag arbitrary"],"incidentAliases":["cat redirect tiered as read","heredoc tag not recognized"],"anchors":[{"path":"hooks/evidence.mjs","symbols":["extractEvidence","extractCursorEvidence","extractCodexEvidence","classifyBash","codexCmdStrings","makeCollector","contentReadFiles","segmentStats","segmentStatsCursor","normRel","inlineScriptTier","bashContentRead","redirectTargets","bashEditTargets"],"hash":"sha256:9fbcfb9db13e","head":"9e2523a4b6bf"}],"id":"hooks-evidence-mjs-147e7dd5","type":"file","op":"put","verified":["hooks/evidence.mjs"],"character":"single","v":1,"ts":"2026-08-25T18:54:16.712Z","head":"9e2523a4b6bf"}
+{"summary":"Per-host transcript-to-evidence extractors with tier classification (edit/read/gs/mention), and the one table deciding what shell activity counts as reading or writing a file. Inline scripts (heredoc, -e, -c) are classified before the shell segment split; inlineCalls then names, per open call, the file (quoted literal, or a bare identifier resolved one hop to the last literal assignment before the call) and that call's OWN tier — WRITE_API_RE/WRITE_CALL_NAMES/a mode string after the first arg decide write vs read, never the whole command. Loops, argv, concatenation and `${}` paths stay unattributed (default-deny). Host gotchas verified on real transcripts: Cursor's conversation JSONL has NO tool_result records, so its extractor trusts calls and compensates with a stat-existence check on EVERY claim; Codex pairs custom_tool_call to output by call_id. A heredoc tag is an ARBITRARY identifier. redirectTargets overrides the verb table so `cat > x <<EOF` is an edit. Measured: 38% of inline file opens use a bare identifier (1,838 of 4,243 across 752 transcripts have a preceding literal assignment, +40% attributed commands); attributing a whole command over-tiers 50.6% of inline reads; the single-source-path guess for computed paths was rejected at 5.8% gain.","identityAliases":["inline script read detection","bashContentRead","bashEditTargets","shell write detection","heredoc tag arbitrary","sed -i is an edit","tool_result confirmation","cursor no tool results"],"incidentAliases":["open(var) path not attributed","read-only open reported as edit"],"anchors":[{"path":"hooks/evidence.mjs","symbols":["extractEvidence","extractCursorEvidence","extractCodexEvidence","classifyBash","codexCmdStrings","makeCollector","contentReadFiles","segmentStats","segmentStatsCursor","normRel","inlineScriptTier","bashContentRead","redirectTargets","bashEditTargets","inlineCalls","WRITE_API_RE","OPEN_CALL_RE"],"hash":"sha256:3eea2d0a365d","head":"207d015b7aad"}],"id":"hooks-evidence-mjs-147e7dd5","type":"file","op":"put","verified":["hooks/evidence.mjs"],"character":"single","v":1,"ts":"2026-09-29T16:41:02.544Z","head":"207d015b7aad"}

.coldstart/notebook/.raw/how-a-shell-mediated-file-read-reaches-the-nudge-and-the-cap.jsonl

@@ -1 +1,2 @@
 {"title":"how a shell-mediated file read reaches the nudge and the capture worklist","summary":"One table in hooks/evidence.mjs decides what counts as reading a file, and it deliberately gives two different answers to two consumers: the PostToolUse nudge asks only whether content was put in front of the agent (bashContentRead), while the capture worklist asks which NAMED file was read (the tier attached to each path token). The same command can therefore clear the grep-spiral nudge while anchoring no note at all — `python3 -c 'print(open(sys.argv[1]).read())' src/cli.ts` is a real read with no literal path to attribute. Both surfaces reach that one table by three different host routes, so a fix applied to Claude's path alone leaves Codex and Cursor silently broken.","identityAliases":["shell read classification","reading via bash","inline script read","intent vs attribution"],"incidentAliases":["cat counted as grep spiral","shell reads invisible to capture"],"steps":[{"path":"hooks/evidence.mjs","symbols":["classifyBash","inlineScriptTier","bashContentRead"],"role":"the single classification table: read verbs, inline-script file-open APIs, and per-token tier"},{"path":"hooks/nudge-handler.mjs","symbols":["handle"],"role":"Claude PostToolUse consumer — asks INTENT only, via bashContentRead"},{"path":"hooks/codex-nudge-handler.mjs","symbols":["handle"],"role":"Codex consumer, a verbatim twin of the Claude handler"},{"path":"hooks/cursor-nudge-handler.mjs","symbols":["handle"],"role":"Cursor consumer — delegates to the Codex handler through adaptCursorInput, so it inherits fixes without its own patch"},{"path":"hooks/cursor-input.mjs","symbols":["adaptCursorInput"],"role":"renames Cursor's Shell tool to Bash so the shared detectors match unchanged"},{"path":"tests/shell-read-evidence.test.ts","role":"pins all three hosts x both surfaces, because a one-host fix fails silently"}],"invariants":["`cat` must never go back into SEARCH_RE in either nudge handler — it prints a whole file, which is a Read by another name","hooks/nudge-handler.mjs and hooks/codex-nudge-handler.mjs are verbatim twins apart from their header comment; patch both in the same change","inline scripts are classified BEFORE the segment split — the splitter cuts on `;`/`|` that are the script's own syntax, not shell operators","the read tier attaches only to the path named inside the read call; other path tokens in the same command stay mentions"],"verified":["hooks/evidence.mjs","hooks/nudge-handler.mjs","hooks/codex-nudge-handler.mjs","hooks/cursor-nudge-handler.mjs","hooks/cursor-input.mjs","tests/shell-read-evidence.test.ts"],"id":"how-a-shell-mediated-file-read-reaches-the-nudge-and-the-cap","type":"flow","op":"put","v":1,"ts":"2026-08-25T18:44:33.030Z","head":"69c1416ff12d","anchors":[{"path":"hooks/evidence.mjs","hash":"sha256:d8b68b9a4e7f","head":"69c1416ff12d"},{"path":"hooks/nudge-handler.mjs","hash":"sha256:2eefdfc34529","head":"69c1416ff12d"},{"path":"hooks/codex-nudge-handler.mjs","hash":"sha256:59c42aa2b899","head":"69c1416ff12d"},{"path":"hooks/cursor-nudge-handler.mjs","hash":"sha256:745090ec3b11","head":"69c1416ff12d"},{"path":"hooks/cursor-input.mjs","hash":"sha256:8fb374fcd6b4","head":"69c1416ff12d"},{"path":"tests/shell-read-evidence.test.ts","hash":"sha256:233464173f1c","head":"69c1416ff12d"}]}
+{"title":"how a shell-mediated file read reaches the nudge and the capture worklist","identityAliases":["shell read classification","reading via bash","inline script read","intent vs attribution"],"incidentAliases":["open(var) path not attributed","read-only open reported as edit"],"summary":"One table in hooks/evidence.mjs decides what counts as reading a file, and it deliberately gives two different answers to two consumers: the PostToolUse nudge asks only whether content was put in front of the agent (bashContentRead), while the capture worklist asks which NAMED file was read (the tier attached to each path token). The same command can therefore clear the grep-spiral nudge while anchoring no note at all — `python3 -c 'print(open(sys.argv[1]).read())' src/cli.ts` is a real read with no literal path to attribute. The path named is a quoted literal OR a bare identifier resolved ONE hop to the last literal assignment before the call (`p='a.json'` then `open(p)`, inlineCalls, #176); and each open call is tiered on its OWN (a script that reads a.json and writes b.json is a read of one and an edit of the other), not once for the whole command. Both surfaces reach that one table by three different host routes, so a fix applied to Claude's path alone leaves Codex and Cursor silently broken.","steps":[{"path":"hooks/evidence.mjs","symbols":["classifyBash","inlineScriptTier","inlineCalls","bashContentRead"],"role":"the single classification table: read verbs, inline-script file-open APIs, per-call path resolution and tier"},{"path":"hooks/nudge-handler.mjs","symbols":["handle"],"role":"Claude PostToolUse consumer — asks INTENT only, via bashContentRead"},{"path":"hooks/codex-nudge-handler.mjs","symbols":["handle"],"role":"Codex consumer, a verbatim twin of the Claude handler"},{"path":"hooks/cursor-nudge-handler.mjs","symbols":["handle"],"role":"Cursor consumer — delegates to the Codex handler through adaptCursorInput, so it inherits fixes without its own patch"},{"path":"hooks/cursor-input.mjs","symbols":["adaptCursorInput"],"role":"renames Cursor's Shell tool to Bash so the shared detectors match unchanged"},{"path":"tests/shell-read-evidence.test.ts","role":"pins all three hosts x both surfaces, plus one-hop variable resolution and per-call tiering (fixtures must START with a/w/x to exercise the mode-letter bug)"}],"invariants":["`cat` must never go back into SEARCH_RE in either nudge handler — it prints a whole file, which is a Read by another name","hooks/nudge-handler.mjs and hooks/codex-nudge-handler.mjs are verbatim twins apart from their header comment; patch both in the same change","inline scripts are classified BEFORE the segment split — the splitter cuts on `;`/`|` that are the script's own syntax, not shell operators","the tier attaches only to the path the open call itself names (literal, or one-hop literal variable); other path tokens in the same command stay mentions","loops (`for p in [...]`), argv, concatenation, `${}` templates and globs stay unattributed on purpose — silence is the safe failure","open/fopen is a write only when a MODE STRING follows the first argument; matching quote+[wax] anywhere made open('assets/x.json') an edit"],"verified":["hooks/evidence.mjs","tests/shell-read-evidence.test.ts"],"id":"how-a-shell-mediated-file-read-reaches-the-nudge-and-the-cap","type":"flow","op":"put","v":1,"ts":"2026-09-29T16:41:02.503Z","head":"207d015b7aad","anchors":[{"path":"hooks/evidence.mjs","hash":"sha256:3eea2d0a365d","head":"207d015b7aad"},{"path":"tests/shell-read-evidence.test.ts","hash":"sha256:75dab8c2b245","head":"207d015b7aad"}]}