fix(hooks): fail-closed freeze + shared extractor + careful HIGH tier

Freeze boundary hook had four verified bugs: the grep-first JSON extractor
truncated at escaped quotes and failed OPEN on unparseable payloads; the deny
JSON was printf-interpolated so a quote- or newline-bearing path silently
no-oped the block; the freeze path read stripped INTERNAL spaces (a boundary
like ~/My Project could never match); and the path resolver skipped the final
component, letting an in-boundary symlink write through to an out-of-boundary
target.

Fixes, structurally: one shared sourced helper (careful/bin/hook-extract.sh)
now owns JSON extraction and JSON-encoded decision envelopes for BOTH hooks --
the two-copy drift is how freeze kept a broken extractor after careful's was
fixed. Freeze is now deny-tier fail-closed (unparseable payload denies,
parsed-but-no-file_path still allows), trims only leading/trailing whitespace,
and resolves symlinks through the final path component.

Careful gains a HIGH tier (hard deny, simple commands only): recursive delete
of /, ~, or $HOME, and force-push to the repo's default branch. Compound
commands always fall through to the MEDIUM ask; --force-with-lease is never
HIGH. Documented as a best-effort advisory hard-stop, not a policy boundary.
Plus additive-only project patterns (~/.gstack/careful-patterns.txt +
per-project file): config can only ADD warn rules, never suppress a baseline
family.

test/hook-scripts.test.ts: 89 tests incl. malformed-payload deny, parseable
deny JSON for hostile paths, space-bearing boundaries, symlink escape, HIGH
tier splits, additive invariant, invalid-regex resilience.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

freeze/SKILL.md

@@ -76,14 +76,22 @@ again. To remove it, run `/unfreeze` or end the session."
 
 ## How it works
 
-The hook reads `file_path` from the Edit/Write tool input JSON, then checks
-whether the path starts with the freeze directory. If not, it returns a
+The hook reads `file_path` from the Edit/Write tool input JSON (shared
+real-JSON extractor with /careful — one copy, sourced by both hooks), then
+checks whether the path starts with the freeze directory. If not, it returns a
 `hookSpecificOutput` payload with `permissionDecision: "deny"` to block the
 operation (nested under `hookSpecificOutput` — Claude Code ignores a top-level
 `permissionDecision`).
 
+Polarity is fail-closed: a tool payload the hook cannot parse is DENIED, not
+allowed — a boundary that fails open is not a boundary. A payload that parses
+but has no `file_path` (a non-file tool) is allowed. Symlinks are resolved
+through their FINAL component, so an in-boundary symlink pointing outside the
+boundary is checked against its target.
+
 The freeze boundary persists for the session via the state file. The hook
-script reads it on every Edit/Write invocation.
+script reads it on every Edit/Write invocation. Boundaries containing spaces
+are supported.
 
 ## Notes
 

freeze/SKILL.md.tmpl

@@ -71,14 +71,22 @@ again. To remove it, run `/unfreeze` or end the session."
 
 ## How it works
 
-The hook reads `file_path` from the Edit/Write tool input JSON, then checks
-whether the path starts with the freeze directory. If not, it returns a
+The hook reads `file_path` from the Edit/Write tool input JSON (shared
+real-JSON extractor with /careful — one copy, sourced by both hooks), then
+checks whether the path starts with the freeze directory. If not, it returns a
 `hookSpecificOutput` payload with `permissionDecision: "deny"` to block the
 operation (nested under `hookSpecificOutput` — Claude Code ignores a top-level
 `permissionDecision`).
 
+Polarity is fail-closed: a tool payload the hook cannot parse is DENIED, not
+allowed — a boundary that fails open is not a boundary. A payload that parses
+but has no `file_path` (a non-file tool) is allowed. Symlinks are resolved
+through their FINAL component, so an in-boundary symlink pointing outside the
+boundary is checked against its target.
+
 The freeze boundary persists for the session via the state file. The hook
-script reads it on every Edit/Write invocation.
+script reads it on every Edit/Write invocation. Boundaries containing spaces
+are supported.
 
 ## Notes
 

freeze/bin/check-freeze.sh

@@ -4,11 +4,24 @@
 # Returns a PreToolUse hookSpecificOutput with permissionDecision "deny" to block,
 # or {} to allow. The decision MUST be nested under hookSpecificOutput — Claude
 # Code ignores a top-level permissionDecision, which silently no-ops the block.
+#
+# Polarity: freeze is a DENY-tier hook, so an unreadable payload DENIES
+# (fail closed). A payload that parses but has no file_path is a non-file
+# tool — allow. This is the opposite edge-handling from careful's ask-tier
+# and intentionally so: /guard runs both, and a boundary that fails open is
+# not a boundary.
 set -euo pipefail
 
 # Read stdin
 INPUT=$(cat)
 
+# Shared JSON helpers (extractor + encoder) — one copy for careful AND freeze.
+# freeze previously carried its own grep-first extractor which truncated at
+# escaped quotes and failed OPEN; the shared file kills that drift class.
+_HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=careful/bin/hook-extract.sh
+. "$_HOOK_DIR/../../careful/bin/hook-extract.sh"
+
 # Locate the freeze directory state file
 STATE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.gstack}"
 FREEZE_FILE="$STATE_DIR/freeze-dir.txt"
@@ -19,7 +32,11 @@ if [ ! -f "$FREEZE_FILE" ]; then
   exit 0
 fi
 
-FREEZE_DIR=$(tr -d '[:space:]' < "$FREEZE_FILE")
+# First line, trimmed of LEADING/TRAILING whitespace only. The previous
+# `tr -d '[:space:]'` deleted INTERNAL spaces too, so a boundary like
+# "~/My Project/src" could never match anything — every edit denied (or the
+# mangled path accidentally allowed the wrong tree).
+FREEZE_DIR=$(head -n 1 "$FREEZE_FILE" 2>/dev/null | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
 
 # If freeze dir is empty, allow
 if [ -z "$FREEZE_DIR" ]; then
@@ -27,16 +44,20 @@ if [ -z "$FREEZE_DIR" ]; then
   exit 0
 fi
 
-# Extract file_path from tool_input JSON
-# Try grep/sed first, fall back to Python for escaped quotes
-FILE_PATH=$(printf '%s' "$INPUT" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"//;s/"$//' || true)
+# Extract file_path from tool_input with the shared real-JSON parser.
+set +e
+FILE_PATH=$(gstack_hook_extract_field "$INPUT" file_path)
+EXTRACT_RC=$?
+set -e
 
-# Python fallback if grep returned empty
-if [ -z "$FILE_PATH" ]; then
-  FILE_PATH=$(printf '%s' "$INPUT" | python3 -c 'import sys,json; print(json.loads(sys.stdin.read()).get("tool_input",{}).get("file_path",""))' 2>/dev/null || true)
+# Unparseable payload (or no parser available): DENY. A boundary hook that
+# allows what it cannot read is not a boundary.
+if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then
+  gstack_hook_decision deny "[freeze] Could not parse the tool payload to check the freeze boundary. Blocked (fail closed). Freeze boundary: $FREEZE_DIR"
+  exit 0
 fi
 
-# If we couldn't extract a file path, allow (don't block on parse failure)
+# Parsed fine but no file_path field: a non-file tool payload — allow.
 if [ -z "$FILE_PATH" ]; then
   echo '{}'
   exit 0
@@ -53,11 +74,26 @@ esac
 # Normalize: remove double slashes and trailing slash
 FILE_PATH=$(printf '%s' "$FILE_PATH" | sed 's|/\+|/|g;s|/$||')
 
-# Resolve symlinks and .. sequences (POSIX-portable, works on macOS)
+# Resolve symlinks and .. sequences (POSIX-portable, works on macOS).
+# The FULL path is resolved, including the FINAL component: the previous
+# version resolved only the parent directory, so an in-boundary symlink
+# pointing at an out-of-boundary target sailed through the check while the
+# actual write landed outside the boundary. A final component that is a
+# symlink is followed (bounded, cycle-safe) so the TARGET gets checked; a
+# final component that does not exist yet (new file) has nothing to follow
+# and parent resolution is the correct behavior.
 _resolve_path() {
-  local _dir _base
-  _dir="$(dirname "$1")"
-  _base="$(basename "$1")"
+  local _p="$1" _dir _base _tgt _i=0
+  while [ -L "$_p" ] && [ "$_i" -lt 40 ]; do
+    _tgt=$(readlink "$_p" 2>/dev/null) || break
+    case "$_tgt" in
+      /*) _p="$_tgt" ;;
+      *) _p="$(dirname "$_p")/$_tgt" ;;
+    esac
+    _i=$((_i + 1))
+  done
+  _dir="$(dirname "$_p")"
+  _base="$(basename "$_p")"
   _dir="$(cd "$_dir" 2>/dev/null && pwd -P || printf '%s' "$_dir")"
   printf '%s/%s' "$_dir" "$_base"
 }
@@ -76,6 +112,9 @@ case "$FILE_PATH" in
     mkdir -p ~/.gstack/analytics 2>/dev/null || true
     echo '{"event":"hook_fire","skill":"freeze","pattern":"boundary_deny","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}' >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true
 
-    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Blocked: %s is outside the freeze boundary (%s). Only edits within the frozen directory are allowed."}}\n' "$FILE_PATH" "$FREEZE_DIR"
+    # The reason is JSON-encoded by the shared helper. Never interpolate paths
+    # into hand-built JSON: a path containing a quote or newline produced
+    # malformed JSON here, and the deny silently no-oped.
+    gstack_hook_decision deny "[freeze] Blocked: $FILE_PATH is outside the freeze boundary ($FREEZE_DIR). Only edits within the frozen directory are allowed."
     ;;
 esac