@askexenow/exe-os 0.9.372 → 0.9.374

package/dist/hooks/pre-tool-use.js

@@ -1,74 +1,80 @@
 import {
-  evaluateMainGuard
-} from "../chunk-HV6Y6F4X.js";
+  MAIN_GUARD_OVERRIDE_TOKEN,
+  evaluateMainGuard,
+  splitShellSegments,
+  tokenizeShell
+} from "../chunk-C2L622QJ.js";
 import {
   resolveSidechainAgentIdentity
-} from "../chunk-6IWLAQ7O.js";
+} from "../chunk-UCUOGVDX.js";
 import "../chunk-YSU7JB7H.js";
 import "../chunk-SH45SJQW.js";
 import {
   getActiveAgent
-} from "../chunk-KYFFVTGO.js";
-import "../chunk-2ADYTOHQ.js";
+} from "../chunk-55BEFF4V.js";
+import "../chunk-K4ESASPL.js";
 import {
   sessionScopeFilter
-} from "../chunk-XHYHX6F7.js";
+} from "../chunk-AKLQSC6W.js";
 import "../chunk-BTSWFMEH.js";
-import "../chunk-WAEKYKTK.js";
-import "../chunk-44C7QNZS.js";
-import "../chunk-JTWTBX2M.js";
+import "../chunk-6RKKVPYF.js";
+import "../chunk-4EN3IZ3Q.js";
 import "../chunk-KI5PFRG6.js";
+import "../chunk-3KDCORDO.js";
 import "../chunk-WT4RI36X.js";
 import "../chunk-E23LNUWJ.js";
 import "../chunk-QAEWWYHL.js";
 import "../chunk-EIKATSE4.js";
-import "../chunk-MDGYXUOV.js";
-import "../chunk-GBNB4EWD.js";
-import "../chunk-UXLO7VHX.js";
-import "../chunk-DSOQUQTV.js";
-import "../chunk-E2WEFZOR.js";
+import "../chunk-MJCSEIFI.js";
+import "../chunk-XH7YL7JM.js";
+import "../chunk-ORM7ZFKC.js";
+import "../chunk-VI4ATC6I.js";
+import "../chunk-A27Q27CT.js";
+import "../chunk-W75GTHR3.js";
 import "../chunk-AJIXH5JF.js";
-import "../chunk-L6ZNURWN.js";
-import "../chunk-XTWHNLGD.js";
+import "../chunk-7GE2EQ23.js";
+import "../chunk-GZOG2MAX.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-HIIXCAEE.js";
+import "../chunk-6YVUR3OU.js";
 import {
   getSessionKey
 } from "../chunk-CVYC6DUW.js";
-import "../chunk-QZL6E4UB.js";
-import "../chunk-CDUB5Q6J.js";
-import "../chunk-UQUUNGTP.js";
-import "../chunk-IVU3WN7S.js";
-import "../chunk-RIECV7SR.js";
-import "../chunk-LNOS24GV.js";
+import "../chunk-GOMQ7PVQ.js";
+import "../chunk-4IK2K3B3.js";
+import "../chunk-NUK7EEN5.js";
+import "../chunk-ZG62LIK3.js";
+import "../chunk-EKYYMIVT.js";
 import "../chunk-NLEW62VC.js";
-import "../chunk-W2IRQJ6R.js";
+import "../chunk-SLLLOOEI.js";
+import "../chunk-V3WLC5TJ.js";
+import "../chunk-JTVIANUB.js";
 import "../chunk-HYZV25LY.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
 import {
   canCoordinate,
   loadEmployeesSync
-} from "../chunk-5DCCKHDY.js";
-import "../chunk-TKDITWDN.js";
+} from "../chunk-TAMDAOCU.js";
 import "../chunk-BBMTVAE3.js";
+import "../chunk-TKDITWDN.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-UTDMTQNH.js";
+import "../chunk-DSJI76XL.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-NJFJWQNN.js";
 import "../chunk-V3W3SATA.js";
 import "../chunk-JY5GAZYC.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-DKBPCOU4.js";
+import "../chunk-L6RXG36J.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-GB3AHV5F.js";
+import "../chunk-GQOEWNVM.js";
 import "../chunk-A7JYF4RG.js";
 import "../chunk-ARX6TAGN.js";
 import {
   EXE_AI_DIR
-} from "../chunk-QMSEL5YS.js";
+} from "../chunk-ZIG7VPJV.js";
 import "../chunk-HSGBZSCA.js";
+import "../chunk-RH4AH3YB.js";
 import "../chunk-JKKZGDLP.js";
 import "../chunk-MLKGABMK.js";
 
@@ -164,6 +170,279 @@ function settingsTamperDenyMessage(target) {
   return `ACTION BLOCKED: ${target} is protected exe-os/Claude settings. Agents must not edit hook/MCP settings directly. Use exe-os install/update paths or ask the coordinator to approve the settings change.`;
 }
 
+// src/lib/remote-ref-delete-guard.ts
+var REF_DELETE_OVERRIDE_ENV = "EXE_FORCE_ALLOW_REMOTE_REF_DELETE";
+var REF_DELETE_OVERRIDE_TOKEN = `${REF_DELETE_OVERRIDE_ENV}=1`;
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+var HTTP_CLIENTS = /* @__PURE__ */ new Set(["curl", "wget", "http", "https", "httpie"]);
+function basename(tok) {
+  return tok.split("/").pop() ?? tok;
+}
+function isProgram(tok, name) {
+  return basename(tok) === name;
+}
+function isShellProgram(tok) {
+  return SHELLS.has(basename(tok));
+}
+function isDashC(tok) {
+  return /^-[a-z]*c[a-z]*$/i.test(tok) && tok.includes("c");
+}
+function methodFlagValue(tok, next) {
+  let m = /^(?:-X|--method|--request)=(.+)$/i.exec(tok);
+  if (m) return m[1];
+  m = /^-X(.+)$/.exec(tok);
+  if (m) return m[1];
+  if (/^(?:-X|--method|--request)$/i.test(tok)) return next ?? null;
+  return null;
+}
+function hasDeleteMethod(tokens) {
+  for (let i = 0; i < tokens.length; i++) {
+    const v = methodFlagValue(tokens[i], tokens[i + 1]);
+    if (v && v.trim().toUpperCase() === "DELETE") return true;
+  }
+  return false;
+}
+function refPathOf(tok) {
+  const m = /(?:^|[/\s])git\/refs\/([^\s?#'"]+)/.exec(tok);
+  if (!m) return null;
+  return m[1].replace(/\/+$/, "");
+}
+function isTagRef(refPath) {
+  return /^tags\//.test(refPath);
+}
+function firstNonTagRef(tokens) {
+  for (const t of tokens) {
+    const ref = refPathOf(t);
+    if (ref && !isTagRef(ref)) return ref;
+  }
+  return null;
+}
+function looksLikeGitHubApi(tok) {
+  return /api\.github\.com|\/api\/v3\/|\/api\/graphql/.test(tok);
+}
+function mentionsDeleteRefMutation(text) {
+  return /\bdeleteRef\b/.test(text);
+}
+function hasStdinRedirect(segment) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inSingle) {
+      if (ch === "'") inSingle = false;
+      continue;
+    }
+    if (inDouble) {
+      if (ch === '"') inDouble = false;
+      continue;
+    }
+    if (ch === "'") {
+      inSingle = true;
+      continue;
+    }
+    if (ch === '"') {
+      inDouble = true;
+      continue;
+    }
+    if (ch === "<") return true;
+  }
+  return false;
+}
+function hasExternalPayload(tokens) {
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (/^(?:--input|-T|--upload-file)$/.test(t)) return true;
+    if (/^--input=/.test(t)) return true;
+    if (t.startsWith("@")) return true;
+    if (/=@/.test(t)) return true;
+    if (t.startsWith("-") && t.includes("@")) return true;
+  }
+  return false;
+}
+var WRAPPERS = /* @__PURE__ */ new Set(["env", "command", "builtin", "exec", "nohup", "time", "stdbuf", "nice", "ionice", "setsid", "timeout", "caffeinate"]);
+function stripWrappers(tokens, depth = 0) {
+  if (depth > 6) return { kind: "argv", argv: [...tokens] };
+  let i = 0;
+  while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
+  const head = tokens[i];
+  if (head === void 0) return { kind: "argv", argv: [] };
+  if (!WRAPPERS.has(basename(head))) return { kind: "argv", argv: tokens.slice(i) };
+  let j = i + 1;
+  while (j < tokens.length) {
+    const t = tokens[j];
+    if (t.startsWith("-")) {
+      const inlineSplit = /^--split-string=(.*)$/.exec(t) ?? /^-S(.+)$/.exec(t);
+      if (inlineSplit) return { kind: "nested", script: inlineSplit[1] };
+      if (/^(?:-S|--split-string)$/.test(t)) {
+        const script = tokens[j + 1];
+        if (script !== void 0) return { kind: "nested", script };
+        return { kind: "argv", argv: tokens.slice(i) };
+      }
+      if (/^(?:-u|--unset|-n|-k|--kill-after|-s|--signal)$/.test(t)) j++;
+      j++;
+      continue;
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+      j++;
+      continue;
+    }
+    if (basename(head) === "timeout" && /^[0-9]+(?:\.[0-9]+)?[smhd]?$/.test(t)) {
+      j++;
+      continue;
+    }
+    break;
+  }
+  if (j >= tokens.length) return { kind: "argv", argv: tokens.slice(i) };
+  return stripWrappers(tokens.slice(j), depth + 1);
+}
+function shellScripts(tokens) {
+  const out = [];
+  for (let i = 0; i < tokens.length; i++) {
+    if (!isShellProgram(tokens[i])) continue;
+    for (let j = i + 1; j < tokens.length; j++) {
+      if (!isDashC(tokens[j])) continue;
+      const script = tokens[j + 1];
+      if (script !== void 0) out.push(script);
+    }
+  }
+  return out;
+}
+function positionalsAfter(tokens, startIndex) {
+  const out = [];
+  for (let i = startIndex; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t.startsWith("-")) {
+      if (/^(?:-X|--method|--request|-f|-F|--field|--raw-field|-H|--header|--input|--hostname|--jq|-q|--template|-t|-d|--data|--data-raw|--data-binary|-o|--output|-u|--user|-A|--user-agent|-e|--referer)$/i.test(t)) i++;
+      continue;
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_.-]*=/.test(t)) continue;
+    out.push(t);
+  }
+  return out;
+}
+function blockMessage(spelling, target) {
+  return `\u{1F6D1} BLOCKED: remote ref DELETION via ${spelling}.
+
+` + (target ? `TARGET: refs/${target}
+
+` : "") + `WHY: deleting a remote ref destroys the only copy of any work that lives only on it, and this repo's policy allows remote deletes only for TAGS. Blocking the git spelling while leaving the REST/GraphQL spelling open made the guard bypassable in one step (bug c0547f31), so the gate is on the OPERATION now, whatever tool performs it.
+
+INSTEAD:
+  \u2022 Prove the work landed first: exe-os repo-truth
+  \u2022 Keep a recovery point:        git fetch origin <branch> && git branch keep/<branch> FETCH_HEAD
+  \u2022 Ask the ref's owner, or delete it in the GitHub UI where the act is attributable.
+
+OVERRIDE (deliberate, audited): prefix the command with ${REF_DELETE_OVERRIDE_TOKEN}.
+The shared-main guard runs FIRST and independently covers the \`gh api\` REST
+spelling, so for that one you need BOTH tokens: ${MAIN_GUARD_OVERRIDE_TOKEN} ${REF_DELETE_OVERRIDE_TOKEN} <command>`;
+}
+function evaluateSegment(segment, depth) {
+  if (depth > 3) {
+    return {
+      block: true,
+      message: blockMessage("a pathologically nested shell invocation", null),
+      spelling: "nested-shell",
+      target: null
+    };
+  }
+  const { tokens } = tokenizeShell(segment);
+  if (tokens.length === 0) return { block: false };
+  for (const script of shellScripts(tokens)) {
+    const inner = evaluateCommandInternal(script, depth + 1);
+    if (inner.block) return inner;
+  }
+  const unwrapped = stripWrappers(tokens);
+  if (unwrapped.kind === "nested") return evaluateCommandInternal(unwrapped.script, depth + 1);
+  const argv = unwrapped.argv;
+  const program = argv[0];
+  if (!program) return { block: false };
+  if (isProgram(program, "gh")) {
+    const allOperands = positionalsAfter(argv, 1);
+    const apiIndex = allOperands.indexOf("api");
+    if (apiIndex === -1) return { block: false };
+    const operands = allOperands.slice(apiIndex + 1);
+    if (operands.includes("graphql")) {
+      if (mentionsDeleteRefMutation(segment)) {
+        return {
+          block: true,
+          message: blockMessage("a `gh api graphql` deleteRef mutation", null),
+          spelling: "gh-api-graphql-deleteRef",
+          target: null
+        };
+      }
+      if (hasExternalPayload(argv) || hasStdinRedirect(segment)) {
+        return {
+          block: true,
+          message: blockMessage("a `gh api graphql` call whose payload is read from a file, stdin, or a redirect", null),
+          spelling: "gh-api-graphql-opaque-payload",
+          target: null
+        };
+      }
+    }
+    if (!hasDeleteMethod(argv)) return { block: false };
+    const ref = firstNonTagRef(operands);
+    if (!ref) return { block: false };
+    return {
+      block: true,
+      message: blockMessage("a `gh api` DELETE on a git ref", ref),
+      spelling: "gh-api-delete",
+      target: ref
+    };
+  }
+  if (HTTP_CLIENTS.has(basename(program))) {
+    if (!argv.some((t) => looksLikeGitHubApi(t))) return { block: false };
+    if (mentionsDeleteRefMutation(segment)) {
+      return {
+        block: true,
+        message: blockMessage(`a \`${basename(program)}\` GitHub GraphQL deleteRef mutation`, null),
+        spelling: "http-graphql-deleteRef",
+        target: null
+      };
+    }
+    if (argv.some((t) => /\/graphql\b/.test(t)) && (hasExternalPayload(argv) || hasStdinRedirect(segment))) {
+      return {
+        block: true,
+        message: blockMessage(`a \`${basename(program)}\` GitHub GraphQL call whose payload is read from a file, stdin, or a redirect`, null),
+        spelling: "http-graphql-opaque-payload",
+        target: null
+      };
+    }
+    const bareVerb = argv.slice(1).some((t) => t === "DELETE");
+    if (!hasDeleteMethod(argv) && !bareVerb) return { block: false };
+    const ref = firstNonTagRef(argv);
+    if (!ref) return { block: false };
+    return {
+      block: true,
+      message: blockMessage(`a \`${basename(program)}\` DELETE on a GitHub git ref`, ref),
+      spelling: "http-delete",
+      target: ref
+    };
+  }
+  return { block: false };
+}
+function evaluateCommandInternal(command, depth) {
+  for (const segment of splitShellSegments(command)) {
+    const d = evaluateSegment(segment, depth);
+    if (d.block) return d;
+  }
+  return { block: false };
+}
+function evaluateRemoteRefDeleteGuard(command, env = process.env) {
+  try {
+    if (env[REF_DELETE_OVERRIDE_ENV] === "1") return { block: false, overridden: true };
+    if (new RegExp(String.raw`^\s*${REF_DELETE_OVERRIDE_ENV}=1\s`).test(command)) {
+      return { block: false, overridden: true };
+    }
+    return evaluateCommandInternal(command, 0);
+  } catch {
+    return { block: false };
+  }
+}
+
 // src/adapters/claude/hooks/pre-tool-use.ts
 process.on("uncaughtException", (err) => {
   console.error(`[exe-os:hook:pre-tool-use] FATAL: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
@@ -174,7 +453,7 @@ process.on("unhandledRejection", (err) => {
   process.exit(1);
 });
 try {
-  const { verifyOrBlock } = await import("../hook-integrity-CF567MVN.js");
+  const { verifyOrBlock } = await import("../hook-integrity-KGAV6ZC2.js");
   if (!await verifyOrBlock(new URL(import.meta.url).pathname)) process.exit(2);
 } catch (err) {
   const code = err?.code;
@@ -195,9 +474,19 @@ if (!process.env.AGENT_ID) {
 var DELEGATION_TASK_THRESHOLD = 3;
 var CTO_ROLES = ["CTO", "executive"];
 var CACHE_DIR = path2.join(EXE_AI_DIR, "session-cache");
+var PRE_TOOL_SAFEGUARD_MS = Number(process.env.EXE_HOOK_PRE_TOOL_TIMEOUT_MS) || 5e3;
+var hookStdoutWritten = false;
+function emitDegradedProceedOnce() {
+  if (hookStdoutWritten) return;
+  hookStdoutWritten = true;
+  process.stdout.write(
+    JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse" } })
+  );
+}
 var timeout = setTimeout(() => {
+  emitDegradedProceedOnce();
   process.exit(0);
-}, 5e3);
+}, PRE_TOOL_SAFEGUARD_MS);
 timeout.unref();
 function getDelegationFlagPath() {
   return path2.join(CACHE_DIR, `delegation-checkpoint-${getSessionKey()}.json`);
@@ -322,7 +611,7 @@ process.stdin.on("end", async () => {
     let wroteStdout = false;
     try {
       if (data.tool_name === "Task" || data.tool_name === "Agent") {
-        const { recordSpawnFromPreToolPayload } = await import("../subagent-spawn-ledger-USYZXU3M.js");
+        const { recordSpawnFromPreToolPayload } = await import("../subagent-spawn-ledger-E6U3OY6Z.js");
         recordSpawnFromPreToolPayload(data);
       }
     } catch {
@@ -332,11 +621,11 @@ process.stdin.on("end", async () => {
         const ti = data.tool_input;
         const haystack = `${ti?.description ?? ""}
 ${ti?.prompt ?? ""}`;
-        const { extractWorkRefCandidates } = await import("../work-claims-MNK7PEPW.js");
+        const { extractWorkRefCandidates } = await import("../work-claims-B73X5NE7.js");
         if (extractWorkRefCandidates(haystack).length > 0) {
-          const { fastDbInit } = await import("../fast-db-init-SCTOOIUT.js");
+          const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
           await fastDbInit({ caller: "hook" });
-          const { findConflictsInText, describeConflict, resolveHolderSession } = await import("../work-claims-MNK7PEPW.js");
+          const { findConflictsInText, describeConflict, resolveHolderSession } = await import("../work-claims-B73X5NE7.js");
           const holderSession = await resolveHolderSession();
           if (holderSession) {
             const conflicts = await findConflictsInText(haystack, holderSession);
@@ -371,6 +660,51 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
         );
       }
     }
+    if (data.tool_name === "Task" || data.tool_name === "Agent") {
+      try {
+        const { evaluateNestedSpawnGuard } = await import("../worktree-ownership-guard-OUWJROW2.js");
+        const nestedDecision = evaluateNestedSpawnGuard({
+          toolName: data.tool_name,
+          toolInput: data.tool_input,
+          cwd: data.cwd ?? process.cwd()
+        });
+        if (nestedDecision.outcome === "block") {
+          process.stderr.write(`[pre-tool-use] nested-spawn isolation BLOCKED ${data.tool_name}
+`);
+          process.stdout.write(JSON.stringify({
+            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
+            systemMessage: nestedDecision.reason
+          }));
+          process.exit(0);
+        }
+      } catch (err) {
+        process.stderr.write(`[pre-tool-use] nested-spawn guard degraded (non-fatal): ${err instanceof Error ? err.message : String(err)}
+`);
+      }
+    }
+    if (["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit"].includes(data.tool_name)) {
+      try {
+        const { evaluateWorktreeOwnership } = await import("../worktree-ownership-guard-OUWJROW2.js");
+        const ownershipDecision = evaluateWorktreeOwnership({
+          toolName: data.tool_name,
+          cwd: data.cwd ?? process.cwd(),
+          actorAgentId: data.agent_id ?? null,
+          sessionKey: getSessionKey()
+        });
+        if (ownershipDecision.outcome === "block") {
+          process.stderr.write(`[pre-tool-use] worktree-ownership BLOCKED ${data.tool_name}
+`);
+          process.stdout.write(JSON.stringify({
+            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
+            systemMessage: ownershipDecision.reason
+          }));
+          process.exit(0);
+        }
+      } catch (err) {
+        process.stderr.write(`[pre-tool-use] worktree-ownership guard degraded (non-fatal): ${err instanceof Error ? err.message : String(err)}
+`);
+      }
+    }
     if (data.tool_name === "Bash") {
       const command = data.tool_input?.command ?? "";
       const isCoordinator = canCoordinate(agent.agentId, agent.agentRole);
@@ -387,6 +721,26 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
         if (guard.overridden) {
           process.stderr.write(
             `[pre-tool-use] MAIN-GUARD OVERRIDE used \u2014 destructive main-rewrite allowed via EXE_FORCE_ALLOW_MAIN_HISTORY_REWRITE=1: ${command}
+`
+          );
+        }
+      }
+      {
+        const refGuard = evaluateRemoteRefDeleteGuard(command, process.env);
+        if (refGuard.block) {
+          process.stderr.write(
+            `[pre-tool-use] remote-ref-delete BLOCKED (${refGuard.spelling}): ${command}
+`
+          );
+          process.stdout.write(JSON.stringify({
+            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
+            systemMessage: refGuard.message
+          }));
+          process.exit(0);
+        }
+        if (refGuard.overridden) {
+          process.stderr.write(
+            `[pre-tool-use] REF-DELETE OVERRIDE used \u2014 remote ref deletion allowed via EXE_FORCE_ALLOW_REMOTE_REF_DELETE=1: ${command}
 `
           );
         }
@@ -395,7 +749,7 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
         let decision = null;
         let guardError = null;
         try {
-          const { evaluateDestructiveDataGuard, formatAllowAudit } = await import("../destructive-data-guard-6I5MDFVD.js");
+          const { evaluateDestructiveDataGuard, formatAllowAudit } = await import("../destructive-data-guard-BVFWPPIS.js");
           const result = evaluateDestructiveDataGuard(command, { cwd: process.cwd(), env: process.env });
           decision = result;
           if (!result.block && result.ops.length > 0) {
@@ -664,7 +1018,7 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
         process.exit(0);
       }
     }
-    const { getGatedAgent } = await import("../cto-delegation-gate-SZCE34LB.js");
+    const { getGatedAgent } = await import("../cto-delegation-gate-LQHVLEMW.js");
     const gatedAgent = getGatedAgent();
     if (agent.agentId === gatedAgent) {
       const isStructured = /^(Write|Edit|MultiEdit|NotebookEdit)$/.test(data.tool_name);
@@ -676,7 +1030,7 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
             evaluateDelegationGate,
             evaluateBashWriteGate,
             GATE_BLOCK_MESSAGE
-          } = await import("../cto-delegation-gate-SZCE34LB.js");
+          } = await import("../cto-delegation-gate-LQHVLEMW.js");
           let decision = null;
           let surfaceLabel = data.tool_name;
           let targetLabel = "";
@@ -685,7 +1039,7 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
             const filePath = data.tool_name === "NotebookEdit" ? ti.notebook_path ?? "" : ti.file_path ?? "";
             const content = data.tool_name === "MultiEdit" ? (ti.edits ?? []).map((e) => e.new_string ?? "").filter(Boolean) : data.tool_name === "NotebookEdit" ? ti.new_source : ti.content ?? ti.new_string;
             if (filePath) {
-              const { fastDbInit } = await import("../fast-db-init-SCTOOIUT.js");
+              const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
               await fastDbInit({ caller: "hook" });
               targetLabel = filePath;
               decision = await evaluateDelegationGate({
@@ -698,10 +1052,10 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
             }
           } else {
             const command = data.tool_input?.command ?? "";
-            const { detectBashSourceWrites } = await import("../cto-delegation-gate-SZCE34LB.js");
+            const { detectBashSourceWrites } = await import("../cto-delegation-gate-LQHVLEMW.js");
             const targets = detectBashSourceWrites(command, process.cwd());
             if (targets.length > 0) {
-              const { fastDbInit } = await import("../fast-db-init-SCTOOIUT.js");
+              const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
               await fastDbInit({ caller: "hook" });
               surfaceLabel = "Bash-write";
               targetLabel = targets.join(", ");
@@ -778,7 +1132,7 @@ Reason: ${decision.reason ?? "engineer-delegatable edit"}`;
     const isUpdateTaskDone = (data.tool_name === "mcp__exe-os__update_task" || data.tool_name === "mcp__exe-mem__update_task") && toolInput.status === "done" && CTO_ROLES.includes(agent.agentRole);
     if (isUpdateTaskDone) {
       try {
-        const { fastDbInit } = await import("../fast-db-init-SCTOOIUT.js");
+        const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
         const client = await fastDbInit({ caller: "hook" });
         const taskId = String(toolInput.task_id ?? "");
         const ptScope = sessionScopeFilter();
@@ -836,7 +1190,7 @@ Reason: ${decision.reason ?? "engineer-delegatable edit"}`;
     }
     if (data.agent_type == null && CTO_ROLES.includes(agent.agentRole) && !hasDelegationFired()) {
       try {
-        const { fastDbInit } = await import("../fast-db-init-SCTOOIUT.js");
+        const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
         const client = await fastDbInit({ caller: "hook" });
         const dlScope = sessionScopeFilter();
         const result = await client.execute({
@@ -873,6 +1227,7 @@ Reason: ${decision.reason ?? "engineer-delegatable edit"}`;
             });
             process.stdout.write(output);
             wroteStdout = true;
+            hookStdoutWritten = true;
           }
         }
       } catch {
@@ -907,7 +1262,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
     }
     if (!wroteStdout && data.agent_type != null) {
       try {
-        const { buildSubagentBootstrapContext } = await import("../subagent-brief-injection-OHLWLECQ.js");
+        const { buildSubagentBootstrapContext } = await import("../subagent-brief-injection-ED36PLYY.js");
         const subagentBrief = await buildSubagentBootstrapContext(data);
         if (subagentBrief) {
           const output = JSON.stringify({
@@ -918,6 +1273,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
           });
           process.stdout.write(output);
           wroteStdout = true;
+          hookStdoutWritten = true;
         }
       } catch {
       }
@@ -943,7 +1299,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
             writeFileSync(throttlePath, JSON.stringify({ ts: Date.now() }));
           } catch {
           }
-          const { fastDbInit } = await import("../fast-db-init-SCTOOIUT.js");
+          const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
           const client = await fastDbInit({ daemonOnly: true, caller: "hook" });
           const { isInitialized } = await import("../lib/database.js");
           if (isInitialized()) {
@@ -970,6 +1326,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
               });
               process.stdout.write(output);
               wroteStdout = true;
+              hookStdoutWritten = true;
             }
           }
         }
@@ -977,6 +1334,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
       }
     }
   } catch {
+    emitDegradedProceedOnce();
   }
   clearTimeout(timeout);
   process.exit(0);