chore(wheelhouse): cascade template@d44822f7

Author: jdalton

.claude/hooks/fleet/minimum-release-age-guard/README.md

@@ -29,7 +29,10 @@ emergency CVE patches.
 
 Type the canonical phrase in a new message:
 
-    Allow minimumReleaseAge bypass
+    Allow soak-time bypass
+
+`Allow minimumReleaseAge bypass` still works as an alias. The matcher folds
+hyphens to spaces, so `Allow soak time bypass` matches too.
 
 Use sparingly. The legitimate cases are:
 

.claude/hooks/fleet/minimum-release-age-guard/index.mts

@@ -15,9 +15,11 @@
 //   - For Write: compares against current contents (absent file = empty
 //     exclude array).
 //
-// Bypass: `Allow minimumReleaseAge bypass` typed verbatim in a recent user
-// turn — for emergency CVE patches where a legitimately-published-yesterday
-// fix must be installed before the 7-day window closes.
+// Bypass: `Allow soak-time bypass` (alias: `Allow minimumReleaseAge bypass`)
+// typed verbatim in a recent user turn — for emergency CVE patches where a
+// legitimately-published-yesterday fix must be installed before the 7-day
+// window closes. The matcher folds hyphens to spaces, so `soak-time` and
+// `soak time` both match the same phrase.
 //
 // Fails open on parse errors (better to under-block than to brick edits
 // when the file isn't parseable YAML).
@@ -33,7 +35,13 @@ import { bypassPhrasePresent } from '../_shared/transcript.mts'
 
 const logger = getDefaultLogger()
 
-const BYPASS_PHRASE = 'Allow minimumReleaseAge bypass'
+// `soak-time` is the canonical phrase; `minimumReleaseAge` is kept as an alias
+// so older transcripts / muscle memory still authorize the bypass. Both fold
+// through normalizeBypassText, so spacing/hyphen variants of each also match.
+const BYPASS_PHRASES = [
+  'Allow soak-time bypass',
+  'Allow minimumReleaseAge bypass',
+]
 
 // Permissive YAML extraction tailored to the `minimumReleaseAge.exclude`
 // block. We don't pull in a full YAML library — the block shape is narrow:
@@ -148,7 +156,7 @@ await withEditGuard((filePath, content, payload) => {
 
   if (
     payload.transcript_path &&
-    bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASE)
+    bypassPhrasePresent(payload.transcript_path, BYPASS_PHRASES)
   ) {
     return
   }
@@ -175,7 +183,7 @@ await withEditGuard((filePath, content, payload) => {
       '    node scripts/soak-bypass.mts <pkg>@<version>',
       '  (the daily updating-daily job removes the entry once its soak clears).',
       '',
-      `  Bypass (to hand-edit anyway): type "${BYPASS_PHRASE}" in a new message, then retry.`,
+      `  Bypass (to hand-edit anyway): type "${BYPASS_PHRASES[0]}" in a new message, then retry.`,
       '',
     ].join('\n'),
   )

.claude/hooks/fleet/minimum-release-age-guard/test/index.test.mts

@@ -109,18 +109,18 @@ test('Write adds a fresh exclude — blocked', async () => {
   assert.ok(String(r.stderr).includes('sketchy-pkg'))
 })
 
-test('Edit with bypass phrase in transcript — passes', async () => {
+async function runBypassCase(bypassText: string): Promise<{ code: number }> {
   const filePath = tmpYaml('minimumReleaseAge:\n  exclude:\n    - pkg-a\n')
   const dir = mkdtempSync(path.join(os.tmpdir(), 'mra-guard-tx-'))
   const transcriptPath = path.join(dir, 'session.jsonl')
   writeFileSync(
     transcriptPath,
     JSON.stringify({
       type: 'user',
-      message: { content: 'Allow minimumReleaseAge bypass' },
+      message: { content: bypassText },
     }) + '\n',
   )
-  const r = await runHook({
+  return await runHook({
     tool_name: 'Edit',
     tool_input: {
       file_path: filePath,
@@ -129,5 +129,19 @@ test('Edit with bypass phrase in transcript — passes', async () => {
     },
     transcript_path: transcriptPath,
   })
+}
+
+test('Edit with canonical soak-time bypass phrase — passes', async () => {
+  const r = await runBypassCase('Allow soak-time bypass')
+  assert.strictEqual(r.code, 0)
+})
+
+test('Edit with hyphen-folded "Allow soak time bypass" — passes', async () => {
+  const r = await runBypassCase('Allow soak time bypass')
+  assert.strictEqual(r.code, 0)
+})
+
+test('Edit with legacy minimumReleaseAge bypass alias — passes', async () => {
+  const r = await runBypassCase('Allow minimumReleaseAge bypass')
   assert.strictEqual(r.code, 0)
 })

.claude/hooks/fleet/prefer-pipx-over-pip-guard/index.mts

@@ -17,7 +17,6 @@
 // user turn. Fails open on regex / parse errors.
 
 import { readFileSync } from 'node:fs'
-import path from 'node:path'
 import process from 'node:process'
 
 import { bypassPhrasePresent, readStdin } from '../_shared/transcript.mts'