fix(3579): ship graphify hook + lib/ helper through build-hooks + install (#3640)

* fix(3579): ship graphify hook + lib/ helper through build-hooks + install

`scripts/build-hooks.js` `HOOKS_TO_COPY` did not include
`gsd-graphify-update.sh` (added in #3347 / PR #3557), so it never landed
in `hooks/dist/` and `bin/install.js` — which `readdirSync`s the dist —
never copied it to `~/.claude/hooks/`. The hook's detached rebuild
helper at `hooks/lib/gsd-graphify-rebuild.sh` was also silently dropped
because both build-hooks.js (flat allowlist) and bin/install.js (readdir
+ isFile filter) only walked top-level files.

The published tarball gap (Gap 3 in the issue body) is not reproduced
on origin/main — `npm pack --dry-run --json` shows both source files
are present today. Only Gaps 1 and 2 are in scope.

Changes:
- Add `gsd-graphify-update.sh` to `HOOKS_TO_COPY`.
- Add `HOOKS_SUBDIRS_TO_COPY = ['lib']` and copy whitelisted hook
  subdirectories (`hooks/<dir>/*` → `hooks/dist/<dir>/*`) in
  build-hooks.js, with the same syntax-check + atomic-rename path the
  top-level loop uses.
- `bin/install.js`: when copying `hooks/dist/`, recurse one level into
  any directory entry so subdir files (e.g. `lib/gsd-graphify-rebuild.sh`)
  land at the mirrored target path the hook's REBUILD_SCRIPT lookup
  expects. Top-level if/else structure for files is unchanged.

Regression test `tests/bug-3579-graphify-hook-publish.test.cjs`:
- Drift guard: every top-level `hooks/*.sh` must appear in
  `HOOKS_TO_COPY`. Generalizes beyond graphify so the next .sh hook
  added cannot regress.
- After build: `hooks/dist/gsd-graphify-update.sh` AND
  `hooks/dist/lib/gsd-graphify-rebuild.sh` exist.
- After install: both files land at the target, and no
  "Missing expected hook: gsd-graphify-update.sh" warning is emitted.

Fixes #3579

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(3579): replace source-grep drift guard with filesystem-behavior assertion

The Gap-1 drift guard read scripts/build-hooks.js as text and regex-parsed the
HOOKS_TO_COPY literal, which tripped lint-no-source-grep and is brittle under
refactors. Replace with a behavior-based assertion: run the build, then for
every top-level hooks/*.sh assert hooks/dist/<name> exists. Strictly stronger
— catches both the original allowlist gap and any future regression that
silently drops a hook for any other reason.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/build-hooks.js

@@ -36,9 +36,18 @@ const HOOKS_TO_COPY = [
   // Community hooks (bash, opt-in via .planning/config.json hooks.community)
   'gsd-session-state.sh',
   'gsd-validate-commit.sh',
-  'gsd-phase-boundary.sh'
+  'gsd-phase-boundary.sh',
+  // Graphify auto-update hook (#3347 / PR #3557 / #3579). Opt-in via
+  // .planning/config.json graphify.auto_update; off by default.
+  'gsd-graphify-update.sh'
 ];
 
+// Subdirectories under hooks/ whose contents must also ship to dist. Each
+// entry is copied as `hooks/<dir>/*` → `hooks/dist/<dir>/*` so detached
+// helpers (e.g. hooks/lib/gsd-graphify-rebuild.sh) resolve from the hook's
+// installed runtime path. See #3579.
+const HOOKS_SUBDIRS_TO_COPY = ['lib'];
+
 // Sync millisecond sleep using Atomics.wait on a throwaway SharedArrayBuffer.
 // Used between Windows rename retries; this script is sync end-to-end so
 // setTimeout would not work. Total worst-case backoff across MAX_ATTEMPTS
@@ -169,6 +178,37 @@ function build() {
     renameAtomicWithRetry(stagedDest, dest, hook);
   }
 
+  // Copy whitelisted hook subdirectories (e.g. hooks/lib/) into dist so the
+  // installer's readdir-and-isFile loop in bin/install.js sees them and
+  // detached hook helpers resolve from the installed runtime path (#3579).
+  for (const subdir of HOOKS_SUBDIRS_TO_COPY) {
+    const srcDir = path.join(HOOKS_DIR, subdir);
+    if (!fs.existsSync(srcDir)) continue;
+    const destDir = path.join(DIST_DIR, subdir);
+    fs.mkdirSync(destDir, { recursive: true });
+    const entries = fs.readdirSync(srcDir, { withFileTypes: true });
+    for (const ent of entries) {
+      if (!ent.isFile()) continue;
+      const srcFile = path.join(srcDir, ent.name);
+      const destFile = path.join(destDir, ent.name);
+      if (ent.name.endsWith('.js')) {
+        const syntaxError = validateSyntax(srcFile);
+        if (syntaxError) {
+          console.error(`\x1b[31m✗ ${subdir}/${ent.name}: SyntaxError — ${syntaxError}\x1b[0m`);
+          hasErrors = true;
+          continue;
+        }
+      }
+      console.log(`\x1b[32m✓\x1b[0m Copying ${subdir}/${ent.name}...`);
+      const stagedDest = path.join(STAGE_DIR, `${subdir}__${ent.name}.${Date.now()}`);
+      fs.copyFileSync(srcFile, stagedDest);
+      if (ent.name.endsWith('.sh')) {
+        try { fs.chmodSync(stagedDest, 0o755); } catch (e) { /* Windows */ }
+      }
+      renameAtomicWithRetry(stagedDest, destFile, `${subdir}/${ent.name}`);
+    }
+  }
+
   // Best-effort cleanup of this process's own staging dir. Since STAGE_DIR
   // is per-PID (`.dist-staging-<pid>/`), no other builder touches it — so
   // rmSync with recursive:true is safe and leaves no race window.