FabledScribe/plugin/hooks/scribe_record_opened.sh

#!/usr/bin/env bash
# Scribe — record that this session OPENED a rule, not merely saw it named (#4100).
#
# WHAT THIS CLOSES
#
# The rule arms keep a ledger of every id they have NAMED, and the injected
# line used to tell the reader "You saw it earlier this session". That claim
# was never checked. The line those arms emit is a TEASER — title, trigger,
# `get_rule(N)` — so a session can be named a rule twenty times and never read
# one word of it, and after a compaction the teaser is summarised away leaving
# nothing at all. The server was asserting something about the reader's
# context that it had no way to know.
#
# This is the observable half. PostToolUse fires for MCP tools (the event's own
# output schema carries `updatedMCPToolOutput`, which would be meaningless
# otherwise), so the `get_rule` CALL can be watched directly.
#
# WHY THIS IS NOT THE SELF-REPORT MILESTONE 386 REJECTED
#
# 386 ruled out asking the session whether it holds a rule, because a model
# asked "do you still hold rule 156?" will say yes and the answer is
# unverifiable self-report. That objection is about ASKING. This asks nobody:
# a tool call happened or it did not, and the harness reports it either way.
# Recording what a session DID is a different kind of evidence from believing
# what it says about itself.
#
# WHAT IT DELIBERATELY DOES NOT DO
#
# It does not prove the rule is still in context — nothing can, and a
# compaction can drop it moments later. That is why `.opened.ids` ages exactly
# like `.rules.ids` and is cleared on the same events (#3749): both ledgers
# describe a context that no longer exists once the context is destroyed. The
# claim it supports is only ever "you opened this, pull it again if you no
# longer hold it", which stays true in every case and carries its own remedy.
#
# EXIT 0, ALWAYS. This decorates a ledger; a bookkeeping failure must never
# turn a successful tool call into a hook error. Worst case the id is missed
# and the reader is offered a rule it already read — the cost of a wrong guess
# here is one extra line, in the direction that shows more rather than less.
set -uo pipefail

event=$(cat 2>/dev/null || true)
[ -n "$event" ] || exit 0

# No jq, no ledger — and no complaint. Every other hook degrades the same way
# rather than printing a tooling error in front of the operator's work (#4107
# tracks making that dependency honest; this is not the place to diverge).
command -v jq >/dev/null 2>&1 || exit 0

session_id=$(printf '%s' "$event" | jq -r '.session_id // empty' 2>/dev/null) || session_id=""
[ -n "$session_id" ] || exit 0

# The matcher in hooks.json already narrows to the get_rule tools, but the
# server segment of an MCP tool name varies with how the plugin was installed,
# so the id is read from whichever field is actually present rather than from
# an assumed tool name. An event that carries none simply records nothing.
rule_id=$(printf '%s' "$event" \
  | jq -r '(.tool_input.rule_id // empty) | tostring' 2>/dev/null) || rule_id=""
rule_id=$(printf '%s' "$rule_id" | tr -cd '0-9')
[ -n "$rule_id" ] || exit 0

# The same directory the naming ledger uses. One session keeps its state in one
# place, and the prior-art name is kept for the reason scribe_tool_rules.sh
# gives: renaming it would orphan every live session's state for a cosmetic
# gain.
state_dir="${TMPDIR:-/tmp}/scribe-priorart"
mkdir -p "$state_dir" 2>/dev/null || true
safe_sid=$(printf '%s' "$session_id" | tr -c 'A-Za-z0-9._-' '_')

# shellcheck source=plugin/hooks/scribe_defs.sh
. "$(dirname "${BASH_SOURCE[0]}")/scribe_defs.sh"

# Stamped and append-only, exactly like the naming ledger — so the same reader
# (`scribe_rules_live`) ages both, and the last entry for an id wins.
printf '%s\n' "$rule_id" | scribe_rules_append "$state_dir/${safe_sid}.opened.ids"
exit 0