#!/usr/bin/env bash
# lib-checks-primitive.sh — SOURCED, never executed.
#
# The structural check suite for the three apm primitives with no
# SKILL.md-shaped container, all authored by primitive-author: hooks
# (.apm/hooks/*.json), instructions (*.instructions.md) and prompts
# (*.prompt.md). validate.sh detects which one it was handed from the path and
# feeds $KYBERFORGE_PRIMITIVE_PY to python3 with the target as argv[1] and the
# primitive kind (hook | instruction | prompt) as argv[2].
#
# Every check here exists because apm itself does not make it. apm 0.28.0
# silently skips invalid hook JSON, only warns on an instruction with no
# description or body, and never validates a prompt's input: names against its
# ${input:x} references — so `apm install` and `apm compile --validate` both exit
# 0 on files that deploy nothing, or deploy something that never fires. The
# checks follow primitive-author's hook, instruction and prompt reference
# checklists (research provenance: source key apm-cli-installed-source in
# references/sources.md), except where references/{hook,instruction,prompt}-flow.md
# documents a deliberate deviation (a tier moved, or a check the author leaves
# audit-only). A Must in primitive-author is a FAIL here, a Should a SUGGESTION.
#
# No boundary resolver and no word budgets: none of these files is routed on a
# description the way a skill is. A prompt's description IS model-visible on
# Claude, which is why it gets the three ADR-0029 description SUGGESTIONs below
# (length, trigger clause, boundary clause) — but whether
# a prompt body carries procedure that belongs in a skill is a judgment call the
# prompt flow makes by reading it, and deliberately has no heuristic here.
#
# Output follows lib-checks-agent.sh: FAIL lines on stderr, SUGGESTION and INFO
# on stdout, exit 1 on any FAIL, 0 otherwise.
#
# Consumed by: validate.sh, hook / instruction / prompt modes.
# shellcheck shell=bash
# shellcheck disable=SC2034

kyberforge_primitive_preflight() {
  # Interpreter and library are checked separately so the message names the
  # thing to install; see lib-checks-agent.sh for the history. PyYAML is needed
  # for the two markdown kinds, and is required for hooks too so that one
  # dependency set covers the whole suite rather than a hook audit passing on a
  # machine where the next instruction audit cannot run.
  if ! command -v python3 > /dev/null 2>&1; then
    echo "Error: python3 is required but was not found on PATH." >&2
    echo "  Why: every primitive check parses the file; without python3 no check runs, and reporting that as a pass would be vacuous." >&2
    echo "  Fix: install python3." >&2
    exit 2
  fi

  if ! python3 -c 'import yaml' > /dev/null 2>&1; then
    echo "Error: PyYAML is required but is not importable by python3." >&2
    echo "  Why: instruction and prompt frontmatter has to be parsed the way apm parses it; a hand-rolled reader would disagree with it on exactly the edge cases these checks exist for." >&2
    echo "  Fix: python3 -m pip install PyYAML   (or your distro's python3-yaml package)." >&2
    exit 2
  fi
}

IFS='' read -r -d '' KYBERFORGE_PRIMITIVE_PY <<'KYBERFORGE_PRIMITIVE' || true
import sys
import os
import re
import json
import shlex

import yaml

for _stream in (sys.stdout, sys.stderr):
    try:
        _stream.reconfigure(encoding='utf-8')
    except AttributeError:  # pragma: no cover — Python < 3.7
        pass

target = os.path.abspath(sys.argv[1])
kind = sys.argv[2]
fname = os.path.basename(target)
parent_dir = os.path.dirname(target)

failed = False
suggestions = []


def fail(msg):
    global failed
    failed = True
    print(f"FAIL  {msg}", file=sys.stderr)


def suggest(msg):
    suggestions.append(msg)


def info(msg):
    print(f"INFO  {msg}")


def read_text(path):
    try:
        with open(path, encoding='utf-8') as f:
            return f.read()
    except UnicodeDecodeError as exc:
        fail(f"not valid UTF-8 ({exc.reason} at byte {exc.start}) — apm reads primitives as UTF-8 — {fname}")
    except OSError as exc:
        fail(f"cannot be read ({exc.strerror}) — {fname}")
    return None


def check_not_linked(hardlinks=True):
    # apm's find_files_by_glob (instructions, prompts) rejects symlinks and
    # hardlinks (link count > 1); find_hook_files skips symlinks only, so hooks
    # pass hardlinks=False. A rejected file is silently never deployed.
    if os.path.islink(target):
        fail(f"is a symlink — apm's discovery skips symlinks, so it is never deployed — {fname}")
        return
    if not hardlinks:
        return
    try:
        if os.stat(target).st_nlink > 1:
            fail(f"is a hardlink (link count > 1) — apm's discovery rejects hardlinks, so it is never deployed — {fname}")
    except OSError:
        pass


def package_root_for(subdir):
    # <pkg>/.apm/<subdir>/<file> -> <pkg>. Returns None for any other layout.
    if os.path.basename(parent_dir) != subdir:
        return None
    apm_dir = os.path.dirname(parent_dir)
    if os.path.basename(apm_dir) != '.apm':
        return None
    return os.path.dirname(apm_dir)


FRONTMATTER_RE = re.compile(r'\A---[ \t]*\r?\n(.*?)\r?\n---[ \t]*(?:\r?\n|\Z)', re.DOTALL)


def split_frontmatter(content):
    """Return (frontmatter dict | None, body, ok). ok is False on a parse FAIL."""
    if content.startswith('\ufeff'):
        content = content[1:]
    m = FRONTMATTER_RE.match(content)
    if not m:
        fail(f"has no YAML frontmatter block (--- ... ---) — description and every other key live there — {fname}")
        return None, content, False
    try:
        fm = yaml.safe_load(m.group(1))
    except yaml.YAMLError as exc:
        mark = getattr(exc, 'problem_mark', None)
        where = f" at line {mark.line + 2}" if mark is not None else ''
        fail(f"frontmatter is not valid YAML{where} — apm cannot read any key from it — {fname}")
        return None, content[m.end():], False
    if fm is None:
        fm = {}
    if not isinstance(fm, dict):
        fail(f"frontmatter is not a YAML mapping — {fname}")
        return None, content[m.end():], False
    return fm, content[m.end():], True


def check_description(fm):
    desc = fm.get('description')
    if not isinstance(desc, str) or not desc.strip():
        fail(f"'description' is missing or empty — apm does not require it, so nothing else will catch this — {fname}")
        return None
    return desc.strip()


# ---------------------------------------------------------------------------
# Hooks
# ---------------------------------------------------------------------------

ROUTING_TOKENS = ('copilot', 'vscode', 'cursor', 'claude', 'codex', 'gemini',
                  'antigravity', 'windsurf', 'kiro')
_TOK = '|'.join(ROUTING_TOKENS)
ROUTING_STEM_RE = re.compile(rf'^hooks-(?:{_TOK})$|(?:^|-)(?:{_TOK})-hooks$')

# apm 0.28.0 _HOOK_EVENT_MAP (apm_cli/integration/hook_integrator.py): the
# rename each target applies before deploying. A name absent from a target's
# map deploys to it verbatim, with no warning for an all-lowercase name.
_STOP_ALIASES = ('Stop', 'AgentStop', 'agentStop')
HOOK_EVENT_MAP = {
    'copilot': {
        'PreToolUse': 'preToolUse', 'preToolUse': 'preToolUse',
        'PostToolUse': 'postToolUse', 'postToolUse': 'postToolUse',
        'UserPromptSubmit': 'userPromptSubmit', 'userPromptSubmit': 'userPromptSubmit',
        'SessionStart': 'sessionStart', 'sessionStart': 'sessionStart',
        **dict.fromkeys(_STOP_ALIASES, 'agentStop'),
        'PreTaskExecution': 'preTaskExecution', 'preTaskExecution': 'preTaskExecution',
        'PostTaskExecution': 'postTaskExecution', 'postTaskExecution': 'postTaskExecution',
    },
    'claude': {
        'preToolUse': 'PreToolUse', 'postToolUse': 'PostToolUse',
        'SessionStart': 'SessionStart', 'sessionStart': 'SessionStart',
        **dict.fromkeys(_STOP_ALIASES, 'Stop'),
    },
    'gemini': {
        'PreToolUse': 'BeforeTool', 'preToolUse': 'BeforeTool',
        'PostToolUse': 'AfterTool', 'postToolUse': 'AfterTool',
        'Stop': 'SessionEnd',
    },
    'kiro': {
        'PreToolUse': 'PreToolUse', 'preToolUse': 'PreToolUse',
        'PostToolUse': 'PostToolUse', 'postToolUse': 'PostToolUse',
        'UserPromptSubmit': 'UserPromptSubmit', 'userPromptSubmit': 'UserPromptSubmit',
        'promptSubmit': 'UserPromptSubmit',
        'Stop': 'Stop', 'stop': 'Stop', 'AgentStop': 'Stop', 'agentStop': 'Stop',
        'SessionStart': 'SessionStart', 'sessionStart': 'SessionStart',
        'PreTaskExecution': 'PreTaskExec', 'preTaskExecution': 'PreTaskExec',
        'PreTaskExec': 'PreTaskExec',
        'PostTaskExecution': 'PostTaskExec', 'postTaskExecution': 'PostTaskExec',
        'PostTaskExec': 'PostTaskExec',
        'PostFileCreate': 'PostFileCreate', 'PostFileSave': 'PostFileSave',
        'PostFileDelete': 'PostFileDelete',
    },
}

# apm's target aliases (core/target_catalog.py): vscode and agents are copilot.
TARGET_ALIASES = {'vscode': 'copilot', 'agents': 'copilot'}
# The targets apm 0.28.0 deploys hooks to (KNOWN_TARGETS with a hooks primitive).
HOOK_TARGETS = {'copilot', 'claude', 'cursor', 'kiro', 'gemini', 'antigravity',
                'codex', 'windsurf'}

# The events each harness fires, for the harnesses with a published list.
# Claude: code.claude.com/docs/en/hooks. Copilot: docs.github.com hooks
# configuration reference, which also accepts each event in PascalCase (its
# "VS Code compatible" format), plus the camelCase names apm's own Copilot map
# emits — a rename the author cannot route around is not a finding here.
# No list is published in apm's source or this repo's research for cursor,
# kiro, gemini, antigravity, codex or windsurf, so those are judged by
# convention only (hook-flow.md). Checked 2026-09.
_COPILOT_CAMEL = {'sessionStart', 'sessionEnd', 'userPromptSubmitted', 'preToolUse',
                  'postToolUse', 'postToolUseFailure', 'preCompact', 'agentStop',
                  'subagentStart', 'subagentStop', 'errorOccurred',
                  'permissionRequest', 'notification'}
KNOWN_EVENTS = {
    'claude': {'SessionStart', 'Setup', 'UserPromptSubmit', 'UserPromptExpansion',
               'PreToolUse', 'PermissionRequest', 'PermissionDenied', 'PostToolUse',
               'PostToolUseFailure', 'PostToolBatch', 'Notification', 'MessageDisplay',
               'SubagentStart', 'SubagentStop', 'TaskCreated', 'TaskCompleted', 'Stop',
               'StopFailure', 'TeammateIdle', 'InstructionsLoaded', 'ConfigChange',
               'CwdChanged', 'DirectoryAdded', 'FileChanged', 'WorktreeCreate',
               'WorktreeRemove', 'PreCompact', 'PostCompact', 'PreModelSwitch',
               'PostModelSwitch', 'Elicitation', 'ElicitationResult', 'SessionEnd'},
    'copilot': (_COPILOT_CAMEL | {e[0].upper() + e[1:] for e in _COPILOT_CAMEL}
                | {'Stop', 'UserPromptSubmit'} | set(HOOK_EVENT_MAP['copilot'].values())),
}

HOOK_COMMAND_KEYS = ('command', 'bash', 'powershell', 'windows', 'linux', 'osx')
ROOT_TOKENS = ('PLUGIN_ROOT', 'CLAUDE_PLUGIN_ROOT', 'CURSOR_PLUGIN_ROOT', 'KIRO_PLUGIN_ROOT')
ROOT_TOKEN_RE = re.compile(r'\$\{(' + '|'.join(ROOT_TOKENS) + r')\}')
# apm 0.28.0's own patterns, hook_integrator.py _rewrite_command_for_target:
# the path must follow the token directly and ends at whitespace or a quote.
# The ./ pattern is applied with finditer over the whole command, so it
# matches after an interpreter (`bash ./x.sh`) too.
APM_ROOT_REF_RE = re.compile(r'\$\{(?:' + '|'.join(ROOT_TOKENS) + r')\}([\\/][^\s"\']+)')
APM_REL_REF_RE = re.compile(r'(\.[\\/][^\s"\']+)')


# An interpreter whose first operand is the script it runs. A reference in
# that operand slot is in command position just as a first token is.
INTERPRETERS = {'bash', 'sh', 'zsh', 'python', 'python3', 'node', 'pwsh', 'ruby', 'perl'}
SH_FAMILY = {'bash', 'sh', 'zsh'}
# Options that consume the next token as their value, per interpreter.
VALUE_OPTS = {
    'bash': {'-o', '+o', '-O', '+O'}, 'sh': {'-o', '+o'}, 'zsh': {'-o', '+o'},
    'python': {'-W', '-X'}, 'python3': {'-W', '-X'},
    'node': {'-r', '--require', '--import'}, 'ruby': {'-I', '-r'}, 'perl': {'-I', '-M'},
}
# Options after which the rest is inline code or a module, never a script path.
CODE_OPTS = {
    'python': {'-c', '-m'}, 'python3': {'-c', '-m'},
    'node': {'-e', '-p', '--eval', '--print'}, 'ruby': {'-e'}, 'perl': {'-e', '-E'},
    'pwsh': {'-c', '-command', '-encodedcommand'},
}


def _prefix_tokens(prefix):
    return [t.strip('"\'') for t in prefix.split()]


def _interp_arg_index(tokens):
    """(index, is_command_string) of the script operand after a known
    interpreter (optionally behind `env`), or None when the command does not
    open with one. Option flags are skipped (`bash -e x.sh`, `python3 -u x.py`);
    for a sh-family `-c` the operand is the command string, whose own first
    token is the script (`sh -c 'scripts/x.sh'`). Inline code (`python3 -c`,
    `node -e`) has no script operand."""
    i = 0
    if tokens and os.path.basename(tokens[0]) == 'env':
        i = 1
    if not (len(tokens) > i and os.path.basename(tokens[i]) in INTERPRETERS):
        return None
    interp = os.path.basename(tokens[i])
    j = i + 1
    while j < len(tokens):
        tok = tokens[j]
        low = tok.lower()
        if tok == '--':
            return j + 1, False
        if not tok.startswith(('-', '+')) or tok in ('-', '+'):
            return j, False
        if interp in SH_FAMILY and not tok.startswith('--') and 'c' in tok[1:]:
            return j + 1, True
        if interp == 'pwsh' and low in ('-file', '-f'):
            return j + 1, False
        if low in CODE_OPTS.get(interp, ()):
            return None
        j += 2 if tok in VALUE_OPTS.get(interp, ()) else 1
    return j, False


def _position(prefix):
    """(is_first_token, is_interpreter_arg) for a reference preceded by prefix."""
    toks = [t for t in _prefix_tokens(prefix) if t]
    if not toks:
        return True, False
    slot = _interp_arg_index(toks)
    return False, slot is not None and slot[0] == len(toks)


def is_handler(h):
    # A handler runs something: a command key, or a non-command handler type
    # (Claude's prompt/agent/http hooks) whose payload is not a script.
    if not isinstance(h, dict):
        return False
    if any(isinstance(h.get(k), str) and h.get(k).strip() for k in HOOK_COMMAND_KEYS):
        return True
    return h.get('type') not in (None, 'command')


def extract_script_refs(cmd, pkg_root, where):
    """Return (kind, relpath, is_first_token, is_interpreter_arg) for each
    package-relative reference apm would rewrite, reading the command exactly
    as apm does. kind is 'root' for a ${*_PLUGIN_ROOT} token, 'rel' for a
    ./path, 'up' for a ../path. A token apm reads wrongly — split-quoted, or a
    path with a space — is a FAIL here, because apm leaves it unrewritten or
    cuts it short."""
    refs = []
    masked = cmd
    for m in ROOT_TOKEN_RE.finditer(cmd):
        start, end = m.start(), m.end()
        if end < len(cmd) and cmd[end] in '"\'' and cmd[end + 1:end + 2] in ('/', '\\'):
            fail(f"script path '{cmd[start:]}' splits the quote after ${{{m.group(1)}}} — apm rewrites only a path that follows the token directly, so this one deploys unrewritten and unbundled; quote the whole token: \"${{PLUGIN_ROOT}}/<path>\" — {where}")
    for m in APM_ROOT_REF_RE.finditer(cmd):
        start, end = m.start(), m.end()
        opener = cmd[start - 1] if start > 0 and cmd[start - 1] in '"\'' else None
        path = m.group(1)
        nxt = cmd[end:end + 1]
        # A backslash-escaped space, or a quoted token whose script name only
        # completes past the whitespace apm stopped at ("…/my hook.sh").
        # A path apm read that exists as a file is exactly what apm bundles, so
        # a later argument inside the same quotes (`bash -c "…/tool --x a.sh"`)
        # is an argument, not the rest of a spaced name.
        spaced = nxt.isspace() and path.endswith('\\')
        if not spaced and opener is not None and nxt.isspace():
            quoted = cmd[start:].split(opener, 1)[0]
            exists = os.path.isfile(os.path.join(pkg_root, path.replace('\\', '/').lstrip('/')))
            spaced = (not exists and bool(SCRIPT_EXT_RE.search(quoted))
                      and not SCRIPT_EXT_RE.search(path))
        if spaced:
            fail(f"script path '{cmd[start:]}' contains a space — apm reads a ${{PLUGIN_ROOT}} path only up to the first whitespace or quote, so it bundles the wrong file and the hook fails; rename the script without spaces — {where}")
        else:
            prefix = cmd[:start - 1] if opener else cmd[:start]
            refs.append(('root', path.replace('\\', '/').lstrip('/')) + _position(prefix))
        masked = masked[:start] + ' ' * (end - start) + masked[end:]
    for m in APM_REL_REF_RE.finditer(masked):
        start = m.start()
        ref = m.group(1)
        kind_ = 'rel'
        if start > 0 and masked[start - 1] == '.':
            kind_, start = 'up', start - 1
        opener = masked[start - 1] if start > 0 and masked[start - 1] in '"\'' else None
        prefix = masked[:start - 1] if opener else masked[:start]
        refs.append((kind_, ref[2:].replace('\\', '/')) + _position(prefix))
    return refs


SCRIPT_EXT_RE = re.compile(r'\.(?:sh|bash|zsh|py|js|mjs|cjs|ts|ps1|rb|pl)$', re.IGNORECASE)


def command_tokens(cmd):
    """The command's leading whitespace-delimited tokens, quotes removed."""
    try:
        return shlex.split(cmd)
    except ValueError:
        return _prefix_tokens(cmd)


def check_unanchored_script(cmd, pkg_root, where):
    # apm rewrites and bundles only ${*_PLUGIN_ROOT}/... and ./... references;
    # a bare command (`npx foo`, `echo hi`) passes through untouched, which is
    # fine. An absolute script path, or a bare relative path to a file in the
    # package, also passes through untouched — so the script is not bundled
    # and the deployed hook points at a path that does not exist on the
    # consumer's machine. Checked in command position only: the first token,
    # and the first operand after a known interpreter, past its options
    # (`bash -e scripts/x.sh`); a sh-family `-c` string is checked as a command
    # of its own. A later argument is data, not a script apm is asked to run.
    toks = command_tokens(cmd)
    if not toks:
        return
    slots = [0]
    arg = _interp_arg_index(toks)
    if arg is not None and arg[0] < len(toks):
        if arg[1]:
            check_unanchored_script(toks[arg[0]], pkg_root, where)
        else:
            slots.append(arg[0])
    for idx in slots:
        tok = toks[idx]
        if not tok or tok.startswith(('./', '../', '~', '-')) or '$' in tok:
            continue
        if tok.startswith('/'):
            real_root = os.path.realpath(pkg_root)
            inside = os.path.realpath(tok).startswith(real_root + os.sep)
            # In the first slot an extension-less absolute path outside the
            # package (`/usr/bin/env`, `/bin/bash`) is the host's interpreter;
            # in the interpreter-argument slot it is the script being run.
            if inside or SCRIPT_EXT_RE.search(tok) or idx > 0:
                fail(f"script '{tok}' is an absolute path — apm neither bundles nor rewrites it, so it breaks on every other machine; reference it as ${{PLUGIN_ROOT}}/<path> — {where}")
            continue
        if '/' in tok:
            for base in (parent_dir, pkg_root):
                if os.path.isfile(os.path.join(base, tok)):
                    fail(f"script '{tok}' is a bare relative path — apm bundles and rewrites only ${{PLUGIN_ROOT}}/... and ./... references, so this one deploys unbundled; prefix it with ${{PLUGIN_ROOT}}/ or ./ — {where}")
                    break


def check_script(kind_, rel, first, interp_arg, pkg_root, where):
    if not rel:
        return
    # apm's ./ pattern also matches plain arguments — a cwd directory
    # (`npx prettier --check ./src`), a printf escape (`'.\\n'`), a sibling path.
    # apm only warns on those and they run against the consumer's cwd as
    # meant, so a ./ or ../ match is held to the script rules only in command
    # position or when it names a script by extension (or a package entry that
    # is not a file).
    strong = kind_ == 'root' or first or interp_arg or bool(SCRIPT_EXT_RE.search(rel))
    if kind_ == 'up':
        in_pkg = os.path.exists(os.path.join(pkg_root, rel)) and not os.path.isfile(os.path.join(pkg_root, rel))
        if strong or in_pkg:
            fail(f"script path '../{rel}' starts with ../ — apm reads it as ./{rel} from the hook directory, not the parent, so the wrong file (or none) is bundled; reference it as ${{PLUGIN_ROOT}}/<path> — {where}")
        else:
            suggest(f"argument '../{rel}' matches apm's ./ script pattern — apm will warn 'Hook script not found' and leave it unrewritten; harmless if it is a path in the consumer's working directory — {where}")
        return
    if '$' in rel or '`' in rel:
        fail(f"script path '{rel}' contains '$' or a backtick — apm refuses to rewrite it for Claude — {where}")
        return
    candidates = []
    if kind_ == 'root':
        candidates.append(os.path.join(pkg_root, rel))
    else:
        candidates.append(os.path.join(parent_dir, rel))
        candidates.append(os.path.join(pkg_root, rel))
    real_root = os.path.realpath(pkg_root)
    found = None
    for c in candidates:
        real = os.path.realpath(c)
        if real != real_root and not real.startswith(real_root + os.sep):
            fail(f"script '{rel}' resolves outside the package — apm confines hook scripts to the package root — {where}")
            return
        if os.path.isfile(c):
            found = c
            break
    if found is None:
        not_a_file = any(os.path.exists(c) for c in candidates)
        if strong or not_a_file:
            what = "exists in the package but is not a regular file" if not_a_file else "does not exist in the package"
            fail(f"script '{rel}' {what} — apm only warns, then deploys a hook that fails every time it fires — {where}")
        else:
            suggest(f"argument './{rel}' matches apm's ./ script pattern but names no package file — apm will warn 'Hook script not found' and leave it unrewritten; harmless if it is a path in the consumer's working directory — {where}")
        return
    if first and not os.access(found, os.X_OK):
        fail(f"script '{rel}' is run directly but is not executable — chmod +x it, or invoke it through an interpreter — {where}")


# apm's package manifests (apm.yml, and utils/helpers.py find_plugin_json): a
# directory holding any of these is a package root, and its hooks/*.json is
# hook source. A Claude plugin needs no apm.yml.
PACKAGE_MANIFESTS = ('apm.yml', 'plugin.json', os.path.join('.github', 'plugin', 'plugin.json'),
                     os.path.join('.claude-plugin', 'plugin.json'),
                     os.path.join('.cursor-plugin', 'plugin.json'))


def is_package_root(d):
    return any(os.path.isfile(os.path.join(d, m)) for m in PACKAGE_MANIFESTS)


def package_targets(pkg_root):
    """The hook targets apm renders this package to, aliases folded. No
    target:/targets: (or no apm.yml, as in a plain Claude plugin) means every
    target, and 'all' folds to every target. An unreadable apm.yml is treated
    as every target, the reading that keeps the stricter checks on."""
    every = set(HOOK_TARGETS)
    path = os.path.join(pkg_root, 'apm.yml')
    if not os.path.isfile(path):
        return every
    try:
        with open(path, encoding='utf-8') as f:
            data = yaml.safe_load(f)
    except (OSError, UnicodeDecodeError, yaml.YAMLError):
        return every
    if not isinstance(data, dict):
        return every
    raw = data.get('targets', data.get('target'))
    if raw is None:
        return every
    if isinstance(raw, list):
        tokens = [str(t).strip().lower() for t in raw]
    else:
        tokens = [t.strip().lower() for t in str(raw).split(',')]
    tokens = {TARGET_ALIASES.get(t, t) for t in tokens if t}
    if not tokens or 'all' in tokens:
        return every
    return tokens & HOOK_TARGETS


def check_event(event, deploys_to):
    """hook.md Must 4: the event fires on every target the package deploys
    to, after apm's rename for that target. A target with a published event
    list (KNOWN_EVENTS) that does not fire the rendered name is a FAIL. A
    target without one is judged by apm's own expectation (PascalCase), and at
    most a SUGGESTION: a harness's native spelling (Cursor's `stop`, Windsurf's
    snake_case) may be exactly right there."""
    broken, unverified = [], []
    for t in sorted(deploys_to):
        name = HOOK_EVENT_MAP.get(t, {}).get(event, event)
        if t in KNOWN_EVENTS:
            if name not in KNOWN_EVENTS[t]:
                broken.append(f"{t} (as '{name}')" if name != event else t)
        elif not name[:1].isupper():
            unverified.append(t)
    if broken:
        fail(f"event '{event}' never fires on {', '.join(broken)} — after apm's rename it is not an event that harness fires, and apm never warns; write the harness's PascalCase name (PreToolUse, UserPromptSubmit, Stop, …), or narrow targets: in apm.yml to the harnesses that fire it — {fname}")
    elif unverified:
        suggest(f"event '{event}' reaches {', '.join(unverified)} verbatim and is not PascalCase — this audit has no published event list for that harness; confirm it is the harness's own spelling — {fname}")


# The directories apm deploys hooks into for each harness. A hook file under
# one of them is install output, not package source.
DEPLOY_ROOTS = ('.github', '.claude', '.cursor', '.codex', '.kiro', '.windsurf',
                '.gemini', '.vscode', '.antigravity', '.copilot')
PLACEHOLDER_RE = re.compile(r'FILL IN|FILL_IN_')


def check_placeholders(content):
    m = PLACEHOLDER_RE.search(content)
    if m:
        line = content.count('\n', 0, m.start()) + 1
        fail(f"unfilled template placeholder '{m.group(0)}' at line {line} — primitive-author Step 3 fills every FILL IN and FILL_IN_ placeholder before the file ships — {fname}")


def audit_hook():
    check_not_linked(hardlinks=False)
    stem = fname[:-len('.json')]
    # validate.sh dispatches only a .json directly under a hooks/ directory.
    # apm discovers package source at .apm/hooks/*.json and at a package-root
    # hooks/*.json; anything else under a hooks/ directory is apm's deployed
    # output (.github/hooks/, .cursor/hooks/, ...) or not a package at all.
    above = os.path.dirname(parent_dir)
    if os.path.basename(above) == '.apm':
        pkg_root = os.path.dirname(above)
        if not os.path.isfile(os.path.join(pkg_root, 'apm.yml')):
            info(f"no apm.yml at the inferred package root {pkg_root} — script paths are resolved against it anyway — {fname}")
    elif os.path.basename(above) not in DEPLOY_ROOTS and is_package_root(above):
        pkg_root = above
    else:
        kind_of = (f"apm's deployed output ({os.path.basename(above)}/hooks/)"
                   if os.path.basename(above) in DEPLOY_ROOTS else 'no package source')
        fail(f"is {kind_of} — apm reads hook source only from <package>/.apm/hooks/*.json or a package-root hooks/*.json beside apm.yml or a plugin.json manifest; audit the source file in the package's .apm/hooks/ instead — {fname}")
        return

    # apm lowercases the stem before routing (hook_file_routing.py).
    if ROUTING_STEM_RE.search(stem.lower()):
        suggest(f"filename stem '{stem}' uses deprecated hook filename routing — name it plainly and narrow reach with target:/targets: in the package's apm.yml — {fname}")

    content = read_text(target)
    if content is None:
        return
    check_placeholders(content)
    try:
        doc = json.loads(content)
    except json.JSONDecodeError as exc:
        fail(f"is not valid JSON (line {exc.lineno}, column {exc.colno}) — apm skips an unparseable hook file silently — {fname}")
        return
    if not isinstance(doc, dict):
        fail(f"top level is not a JSON object — {fname}")
        return

    if 'hooks' in doc:
        events = doc['hooks']
        if not isinstance(events, dict):
            fail(f"'hooks' is not an object — apm skips the file, and the Copilot install fails outright — {fname}")
            return
    else:
        stray = [k for k, v in doc.items() if not isinstance(v, list)]
        if stray:
            fail(f"naked settings-slice shape with non-list top-level key(s) {', '.join(sorted(stray))} — apm does not promote it, Claude gets nothing and Copilot gets a junk file; wrap events in {{\"hooks\": {{...}}}} — {fname}")
            return
        events = doc

    if not events:
        fail(f"contributes no hook entries — apm warns and deploys nothing — {fname}")
        return

    shape_ok = True
    for event, entries in events.items():
        if not isinstance(entries, list):
            fail(f"event '{event}' is not a list — the Copilot install fails on this payload — {fname}")
            shape_ok = False
            continue
        for i, entry in enumerate(entries):
            if not isinstance(entry, dict):
                fail(f"event '{event}' entry {i} is not an object — the Copilot install fails on this payload — {fname}")
                shape_ok = False
                continue
            if 'hooks' in entry:
                nested = entry['hooks']
                if not isinstance(nested, list) or not all(isinstance(h, dict) for h in nested):
                    fail(f"event '{event}' entry {i}: nested 'hooks' is not a list of objects — the Copilot install fails on this payload — {fname}")
                    shape_ok = False

    if shape_ok:
        # hook.md Must 3: the file contributes at least one entry. An empty
        # event list, or an entry with no handler, deploys nothing runnable.
        total = 0
        for event, entries in events.items():
            for i, entry in enumerate(entries):
                total += 1
                handlers = entry['hooks'] if 'hooks' in entry else [entry]
                if not any(is_handler(h) for h in handlers):
                    fail(f"event '{event}' entry {i} has no handler — no command (or other handler type) to run, so it deploys nothing — {fname}")
        if total == 0:
            fail(f"contributes no hook entries — every event list is empty, so apm deploys nothing — {fname}")

    deploys_to = package_targets(pkg_root)
    for event in events:
        if not event.strip():
            fail(f"empty event name — {fname}")
        else:
            check_event(event, deploys_to)

    if not shape_ok:
        return

    uses_claude_token = False
    for event, entries in events.items():
        for i, entry in enumerate(entries):
            handlers = entry['hooks'] if 'hooks' in entry else [entry]
            for j, handler in enumerate(handlers):
                where = f"{fname} {event}[{i}]" + (f".hooks[{j}]" if 'hooks' in entry else '')
                for key in HOOK_COMMAND_KEYS:
                    cmd = handler.get(key)
                    if not isinstance(cmd, str):
                        continue
                    if '${CLAUDE_PLUGIN_ROOT}' in cmd:
                        uses_claude_token = True
                    for kind_, rel, first, interp_arg in extract_script_refs(cmd, pkg_root, where):
                        check_script(kind_, rel, first, interp_arg, pkg_root, where)
                    check_unanchored_script(cmd, pkg_root, where)

    if uses_claude_token:
        suggest(f"uses ${{CLAUDE_PLUGIN_ROOT}} — apm documents the target-neutral ${{PLUGIN_ROOT}}, which it rewrites identically for every target — {fname}")


# ---------------------------------------------------------------------------
# Instructions
# ---------------------------------------------------------------------------

INSTRUCTION_KEYS = {'description', 'applyTo', 'author', 'version'}


def split_top_level(value):
    # apm's parse_apply_to: split on commas outside {} (and not escaped \,),
    # strip each segment, drop empty ones.
    segs, cur, depth, i = [], '', 0, 0
    while i < len(value):
        c = value[i]
        if c == '\\' and i + 1 < len(value):
            cur += value[i:i + 2]
            i += 2
            continue
        if c == '{':
            depth += 1
        elif c == '}':
            depth -= 1
        if c == ',' and depth == 0:
            segs.append(cur)
            cur = ''
        else:
            cur += c
        i += 1
    segs.append(cur)
    return [s.strip() for s in segs if s.strip()]


def check_apply_to(apply_to):
    if isinstance(apply_to, list):
        entries = [e for e in apply_to if e is not None and str(e).strip()]
        globs = [str(e).strip() for e in entries]
    elif isinstance(apply_to, str):
        globs = split_top_level(apply_to)
    else:
        fail(f"applyTo is neither a string nor a list — apm cannot read a glob from it — {fname}")
        return False
    if not globs:
        fail(f"applyTo is present but empty — remove the key for an intentionally always-on rule, or give it a glob — {fname}")
        return False
    ok = True
    for g in globs:
        if g.count('{') != g.count('}') or g.count('[') != g.count(']'):
            fail(f"applyTo glob '{g}' has unbalanced braces or brackets — it matches nothing, so the rule never fires — {fname}")
            ok = False
    return ok


def audit_instruction():
    check_not_linked()
    stem = fname[:-len('.instructions.md')]
    pkg_root = package_root_for('instructions')
    if pkg_root is None:
        fail(f"is not directly in a .apm/instructions/ directory — that is the authoring source; anything else is either deployed output or a legacy root file — {fname}")
    else:
        dup = os.path.join(pkg_root, fname)
        if os.path.isfile(dup):
            fail(f"stem '{stem}' also exists at the package root ({dup}) — both deploy to the same .claude/rules/{stem}.md, and one overwrites the other — {fname}")

    content = read_text(target)
    if content is None:
        return
    check_placeholders(content)
    fm, body, ok = split_frontmatter(content)
    if not ok:
        return
    check_description(fm)
    if not body.strip():
        fail(f"body is empty — apm deploys an empty rule without complaint — {fname}")

    apply_to = fm.get('applyTo')
    apply_to_ok = apply_to is not None and check_apply_to(apply_to)
    if apply_to is None:
        suggest(f"no applyTo — this loads into every session of every repo that installs the package; confirm always-on is intended, and that a rule for this repo alone is not really an AGENTS.md rule — {fname}")
    elif apply_to_ok and isinstance(apply_to, list):
        suggest(f"applyTo is a YAML list — Copilot receives the file verbatim and its handling of a list is unverified; use one comma-separated string — {fname}")

    extra = sorted(str(k) for k in fm if k not in INSTRUCTION_KEYS)
    if extra:
        suggest(f"frontmatter key(s) {', '.join(extra)} are read by no target and dropped on Claude — keep to description and applyTo (author, version optional) — {fname}")


# ---------------------------------------------------------------------------
# Prompts
# ---------------------------------------------------------------------------

PROMPT_KEYS = {'description', 'allowed-tools', 'model', 'argument-hint', 'input'}
PROMPT_CAMEL_ALIASES = {'allowedTools': 'allowed-tools', 'argumentHint': 'argument-hint'}
INPUT_NAME_RE = re.compile(r'^[A-Za-z][\w-]{0,63}$')
# apm's own rewrite pattern for ${input:x}, command_integrator.py.
INPUT_REF_RE = re.compile(r'\$\{\{?\s*input\s*:\s*([\w-]+)\s*\}?\}')
TRIGGER_RE = re.compile(r'\buse\s+(?:this\s+)?when\b', re.IGNORECASE)
# The skill boundary form `Not <thing> -> <target>` (ASCII or Unicode arrow).
BOUNDARY_RE = re.compile(r'\bnot\b[^.;]*?(?:->|\u2192)', re.IGNORECASE)
PROMPT_DESC_SUGGEST_CHARS = 250


def prompt_input_names(spec):
    """Mirror apm's _extract_input_names, but FAIL on what it rejects or
    misreads instead of warning. Returns the declared names."""
    names = []

    def accept(candidate):
        if not isinstance(candidate, str):
            fail(f"input entry {candidate!r} is not a string name — apm rejects it — {fname}")
            return
        s = candidate.strip()
        if not s:
            return
        if not INPUT_NAME_RE.match(s):
            fail(f"input name '{s}' does not match ^[A-Za-z][\\w-]{{0,63}}$ — apm rejects it, so the argument never exists — {fname}")
            return
        names.append(s)

    form = "write each input as `- <name>: \"<description>\"` (primitive-author prompt Must 3)"
    if spec is None:
        return names
    if isinstance(spec, str):
        fail(f"input: is a bare name, not the object form — {form}, so every argument carries its description — {fname}")
        accept(spec)
    elif isinstance(spec, dict):
        fail(f"input: is a map, not the object form — {form} — {fname}")
        for k in spec:
            accept(k)
    elif isinstance(spec, list):
        for item in spec:
            if not isinstance(item, dict):
                fail(f"input entry {item!r} is a bare name, not the object form — {form} — {fname}")
            if isinstance(item, dict):
                if len(item) > 1:
                    keys = ', '.join(str(k) for k in item)
                    hint = (" — this is the upstream docs example's `- name: x` / `description:` form, which yields arguments [name, description]"
                            if 'name' in item else '')
                    fail(f"input entry {{{keys}}} is one map with several keys — apm reads every key as an argument name{hint}; write `- <name>: \"<desc>\"` — {fname}")
                for k in item:
                    accept(k)
            else:
                accept(item)
    else:
        fail(f"input is neither a name, a list nor a map — apm extracts no arguments from it — {fname}")
    return names


def audit_prompt():
    check_not_linked()
    stem = fname[:-len('.prompt.md')]
    segs = stem.replace('\\', '/').split('/')
    if not stem.strip() or any(s in ('.', '..', '') for s in segs) or '/' in stem.replace('\\', '/'):
        fail(f"name '{stem}' is not a safe path segment — apm's validate_path_segments rejects it — {fname}")
    pkg_root = package_root_for('prompts')
    if pkg_root is None:
        fail(f"is not directly in a .apm/prompts/ directory — that is the authoring source; anything else is either deployed output or a legacy root file — {fname}")
    else:
        dup = os.path.join(pkg_root, fname)
        if os.path.isfile(dup):
            fail(f"name '{stem}' also exists at the package root ({dup}) — both deploy as /{stem}, and they collide — {fname}")

    content = read_text(target)
    if content is None:
        return
    check_placeholders(content)
    fm, body, ok = split_frontmatter(content)
    if not ok:
        return

    desc = check_description(fm)
    if desc is not None:
        if len(desc) > PROMPT_DESC_SUGGEST_CHARS:
            suggest(f"description is {len(desc)} characters (> {PROMPT_DESC_SUGGEST_CHARS}) — it is one user-facing sentence (ADR-0029) — {fname}")
        if TRIGGER_RE.search(desc):
            suggest(f"description carries a 'Use when' trigger clause — a prompt is user-triggered (ADR-0029); a trigger clause invites the model to route to it on Claude — {fname}")
        if BOUNDARY_RE.search(desc):
            suggest(f"description carries a 'Not X -> Y' boundary clause — a prompt is user-triggered (ADR-0029, primitive-author prompt Should 6); name the skills it steers instead — {fname}")

    for camel, kebab in PROMPT_CAMEL_ALIASES.items():
        if camel in fm:
            suggest(f"'{camel}' — use the kebab-case spelling '{kebab}' apm documents — {fname}")
    extra = sorted(str(k) for k in fm if k not in PROMPT_KEYS and k not in PROMPT_CAMEL_ALIASES)
    if extra:
        suggest(f"frontmatter key(s) {', '.join(extra)} are dropped on Claude (it keeps only {', '.join(sorted(PROMPT_KEYS))}) — keep them only if the Copilot-only behaviour is intended — {fname}")

    declared = prompt_input_names(fm.get('input'))
    used = []
    for m in INPUT_REF_RE.finditer(body):
        if m.group(1) not in used:
            used.append(m.group(1))
    if used and not declared:
        fail(f"body uses {', '.join('${input:' + u + '}' for u in used)} but no input: is declared — apm rewrites references only when input: names them, so Claude receives the literal text — {fname}")
    else:
        for u in used:
            if u not in declared:
                fail(f"body uses ${{input:{u}}} but input: does not declare '{u}' — {fname}")
        for d in declared:
            if d not in used:
                fail(f"input '{d}' is declared but the body never uses ${{input:{d}}} — the user is asked for an argument that goes nowhere — {fname}")

    if declared and ('argument-hint' in fm or 'argumentHint' in fm):
        suggest(f"argument-hint is set alongside input: — apm synthesises the hint from input: names; drop it unless that form is inadequate — {fname}")


AUDITS = {'hook': lambda: audit_hook(), 'instruction': lambda: audit_instruction(), 'prompt': lambda: audit_prompt()}
if kind not in AUDITS:
    print(f"Error: unknown primitive kind '{kind}'", file=sys.stderr)
    sys.exit(2)
try:
    AUDITS[kind]()
except Exception as exc:  # an input shape no check anticipated
    # Exit 1 means findings; a crash means the checks never completed, which
    # is the never-ran tier, not a verdict on the file.
    print(f"Error: the {kind} checks crashed ({type(exc).__name__}: {exc}) and did not complete — {fname}", file=sys.stderr)
    print("  Why: a partial run reported as findings (exit 1) or as clean (exit 0) would be a verdict the checks never reached.", file=sys.stderr)
    print("  Fix: report ### Structure as unverified, and file the input shape against factory-audit's lib-checks-primitive.sh.", file=sys.stderr)
    sys.exit(2)

for s in suggestions:
    print(f"SUGGESTION  {s}")
sys.exit(1 if failed else 0)
KYBERFORGE_PRIMITIVE
KYBERFORGE_PRIMITIVE_PY="${KYBERFORGE_PRIMITIVE_PY%$'\n'}"