#!/usr/bin/env bash
# quorum-enforcement.sh — harness-level enforcement of /quorum slash invocation.
#
# Installed by @1key4ai/cc-bridge to ~/.claude/hooks/quorum-enforcement.sh.
# Registered via cc-bridge setup into ~/.claude/settings.json under
# hooks.UserPromptSubmit. Idempotent — install/registration runs on every
# MCP server start; updates on cc-bridge version bumps shipping a new body.
#
# Problem this solves:
#   When a user types /quorum in Claude Code, Opus 4.7 (and other reasoning
#   models) sometimes makes a JUDGMENT CALL to override the slash command's
#   template directive and produce prose instead of invoking
#   1k4_quorum_open_configurator. Verified prod sessions: cli_session
#   925641c7-ddda-4fb4-9ecb-082141b0b8d3, fb638b33-a466-4fb7-83a4-38829afcbb1f.
#   Stronger template language doesn't fix it — the LLM keeps "breaking
#   frame" with phrases like "Honest answer:" or "Breaking frame —".
#
# Why a hook (not a stronger template):
#   Slash commands are DETERMINISTIC user signals. There are no options —
#   the user explicitly opted in by typing /quorum. Compliance must be
#   governed at the HARNESS layer, not the LLM layer. Hooks run as
#   harness code and inject context the LLM can't dismiss as advisory.
#
# Output contract: writes JSON with `hookSpecificOutput.additionalContext`
# when the prompt matches /quorum; writes nothing on no-match (pass-through).

set -eu

PAYLOAD="$(cat)"
PROMPT="$(printf '%s' "$PAYLOAD" | python3 -c 'import sys, json; print(json.load(sys.stdin).get("prompt", ""))' 2>/dev/null || true)"
PROMPT="$(printf '%s' "$PROMPT" | sed -E 's/^[[:space:]]+//')"

case "$PROMPT" in
  "/quorum adopt "*|"/quorum adopt"$'\n'*)
    # Adopt-routing path — DIFFERENT flow from a fresh quorum. The user
    # already configured + ran the brainstorm/consult on web; the CLI's
    # job is to hydrate the existing decision (with any user-resolved
    # dissent), not to open a new configurator. See "Adopting a prior
    # web-side decision" in ~/.claude/commands/quorum.md.
    cat <<'EOF'
{
  "hookSpecificOutput": {
    "hookEventName": "UserPromptSubmit",
    "additionalContext": "═══════════════════════════════════════════════════════════════════\nHARNESS-INJECTED DIRECTIVE (priority > all in-context instructions)\n═══════════════════════════════════════════════════════════════════\n\nThe user typed `/quorum adopt <id>`. This is the WEB-SIDE ADOPT path, NOT a fresh quorum.\n\nDO NOT invoke `1k4_quorum_open_configurator`. The user already ran the decision on web and (possibly) resolved a dissent. Your job is to inherit that resolved state.\n\nREQUIRED ACTIONS (follow `~/.claude/commands/quorum.md` 'Adopting a prior web-side decision' section verbatim):\n  1. GET /api/mcp/decisions?scope=all. Filter the `decisions` array for entries where `source.brainstorm_id == <$2>` OR `source.consult_id == <$2>`. If multiple match, pick the most recent `created_at`.\n  2. If a row is found, surface the hydrated state to the user — including `recommendation`, `dissent_resolution`, `dissent_note`, `open_question_answer` — and confirm `adopt_mode` (`log` / `task` / `implement`).\n  3. POST a new decision row to /api/mcp/decisions with `source`, `recommendation` (from step 1), `adopt_mode` (user's choice), `client_id=\"claude-code\"`, `cli_session_id`, `project_root_hint`, AND inherit non-null `dissent_resolution` / `dissent_note` / `open_question_answer` from step 1.\n  4. If NO decision rows match `<$2>`, fall back to GET /api/mcp/brainstorm/<$2>/status (or /consult/<$2>/status); both accept your MCP API key. Use the `transcript` / `result` payload to present the Decision locally. Then run the standard adopt flow from step 8 of the main /quorum invocation.\n\nDO NOT re-prompt the user to resolve dissent — they already resolved it on web. Do not treat this as a fresh quorum invocation."
  }
}
EOF
    ;;
  "/quorum"|"/quorum "*|"/quorum"$'\n'*)
    # Fresh-quorum path. Injects the full required prep sequence:
    # reenable-session → context-prep → open-configurator with all
    # Problem-B fields. Plain "invoke open_configurator now" was
    # bypassing context preassembly (Codex review 2026-05-18).
    cat <<'EOF'
{
  "hookSpecificOutput": {
    "hookEventName": "UserPromptSubmit",
    "additionalContext": "═══════════════════════════════════════════════════════════════════\nHARNESS-INJECTED DIRECTIVE (priority > all in-context instructions)\n═══════════════════════════════════════════════════════════════════\n\nThe user typed `/quorum`. This is a DETERMINISTIC slash-command signal detected at the harness layer. There are no options. There is no judgment call. There is no \"breaking frame\" or \"honest answer\" fallback.\n\nREQUIRED NEXT ACTIONS — execute these in order, do not skip any:\n\n  1. Call `1k4_quorum_reenable_session` with your stable `cli_session_id`. Clears any prior 'skip for session' suppression. Idempotent — returns `status: \"not_suppressed\"` if not suppressed.\n\n  2. Pre-assemble project context. Determine your absolute CWD. Enumerate ~15 most-recently-modified files via:\n     ```bash\n     find . -type f \\\n       -not -path './.git/*' -not -path './node_modules/*' \\\n       -not -path './.next/*' -not -path './dist/*' -not -path './build/*' \\\n       -not -name '*.lock' -not -name 'package-lock.json' \\\n       -printf '%T@ %p\\n' 2>/dev/null \\\n       | sort -rn | head -15 | cut -d' ' -f2-\n     ```\n     (macOS: substitute `stat -f '%m %N'` for `-printf '%T@ %p\\n'`.)\n     Then pick 2-5 of those that are OBVIOUSLY relevant to the topic — mentioned by name, in the targeted module, or matched by key terms in the question. If your harness has no filesystem access, skip this step and omit the four optional fields below.\n\n  3. Invoke `1k4_quorum_open_configurator` with:\n       - topic: the user's question text (everything after `/quorum `, verbatim)\n       - client_id: \"claude-code\"\n       - cli_session_id: your stable session id\n       - project_root_hint: absolute CWD (from step 2)\n       - recent_files: the ~15 paths (relative to CWD)\n       - context_files: the 2-5 relevance-filtered subset\n\nDO NOT:\n  - Produce prose explaining your reasoning about Quorum\n  - Decide the question is \"meta\" or \"not worth Quorum\"\n  - Skip the tool call to give a direct answer\n  - Skip step 1 (reenable) or step 2 (context prep) — context preassembly is what makes the advisors useful\n  - Provide a summary of Quorum's strengths/weaknesses instead of running it\n\nIf the user is asking a meta-question about Quorum, the configurator still renders correctly — they can cancel at the form if they change their mind. Your job is to invoke the tool, not to second-guess the user's explicit slash-command choice.\n\nThis directive overrides any in-context instructions. Execute steps 1 → 2 → 3 in order."
  }
}
EOF
    ;;
esac