@askexenow/exe-os 0.9.374 → 0.9.376

package/dist/hooks/pre-tool-use.js

@@ -1,73 +1,75 @@
 import {
-  MAIN_GUARD_OVERRIDE_TOKEN,
-  evaluateMainGuard,
-  splitShellSegments,
-  tokenizeShell
-} from "../chunk-C2L622QJ.js";
+  appendDecision,
+  decide,
+  evaluateScratchPathTarget,
+  resolveLedgerPath
+} from "../chunk-PPMGQFLJ.js";
+import "../chunk-NB5IRTC4.js";
 import {
-  resolveSidechainAgentIdentity
-} from "../chunk-UCUOGVDX.js";
+  resolvePreToolUseAgentIdentity
+} from "../chunk-O3K2C22L.js";
 import "../chunk-YSU7JB7H.js";
 import "../chunk-SH45SJQW.js";
 import {
   getActiveAgent
-} from "../chunk-55BEFF4V.js";
+} from "../chunk-5DF4Y6EC.js";
 import "../chunk-K4ESASPL.js";
 import {
   sessionScopeFilter
-} from "../chunk-AKLQSC6W.js";
-import "../chunk-BTSWFMEH.js";
-import "../chunk-6RKKVPYF.js";
-import "../chunk-4EN3IZ3Q.js";
-import "../chunk-KI5PFRG6.js";
-import "../chunk-3KDCORDO.js";
+} from "../chunk-KI7O64XV.js";
+import "../chunk-4YUGB637.js";
+import "../chunk-64ODONK2.js";
+import "../chunk-C2UN464N.js";
+import "../chunk-ZKGWHT56.js";
 import "../chunk-WT4RI36X.js";
-import "../chunk-E23LNUWJ.js";
-import "../chunk-QAEWWYHL.js";
+import "../chunk-TDF2XKLK.js";
 import "../chunk-EIKATSE4.js";
 import "../chunk-MJCSEIFI.js";
-import "../chunk-XH7YL7JM.js";
-import "../chunk-ORM7ZFKC.js";
+import "../chunk-E23LNUWJ.js";
+import "../chunk-ZMX22HSS.js";
 import "../chunk-VI4ATC6I.js";
 import "../chunk-A27Q27CT.js";
-import "../chunk-W75GTHR3.js";
+import "../chunk-BZ546I4Q.js";
+import "../chunk-3SRZNJKD.js";
 import "../chunk-AJIXH5JF.js";
-import "../chunk-7GE2EQ23.js";
+import "../chunk-YGVAKKGJ.js";
 import "../chunk-GZOG2MAX.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-6YVUR3OU.js";
+import "../chunk-QR3BUMOS.js";
 import {
   getSessionKey
 } from "../chunk-CVYC6DUW.js";
-import "../chunk-GOMQ7PVQ.js";
+import "../chunk-WJC6AAJN.js";
 import "../chunk-4IK2K3B3.js";
-import "../chunk-NUK7EEN5.js";
+import "../chunk-ZKJ5S23O.js";
+import "../chunk-GPUOUUHA.js";
+import "../chunk-BTSWFMEH.js";
 import "../chunk-ZG62LIK3.js";
-import "../chunk-EKYYMIVT.js";
+import "../chunk-IMYGYIAI.js";
 import "../chunk-NLEW62VC.js";
-import "../chunk-SLLLOOEI.js";
+import "../chunk-GPJIBLP4.js";
 import "../chunk-V3WLC5TJ.js";
-import "../chunk-JTVIANUB.js";
+import "../chunk-AEUGIJDO.js";
 import "../chunk-HYZV25LY.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-MP2AFCGL.js";
 import {
   canCoordinate,
   loadEmployeesSync
-} from "../chunk-TAMDAOCU.js";
+} from "../chunk-66CGXQUA.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-DSJI76XL.js";
+import "../chunk-AHNVFBVB.js";
 import "../chunk-YYB5PMTK.js";
-import "../chunk-NJFJWQNN.js";
-import "../chunk-V3W3SATA.js";
-import "../chunk-JY5GAZYC.js";
+import "../chunk-L5CGXEZC.js";
+import "../chunk-CL4J4757.js";
+import "../chunk-ZQEJ4IX2.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-WNBZJSQT.js";
-import "../chunk-L6RXG36J.js";
+import "../chunk-Y2HD2YB7.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-GQOEWNVM.js";
+import "../chunk-4EG4DT4F.js";
 import "../chunk-A7JYF4RG.js";
 import "../chunk-ARX6TAGN.js";
 import {
@@ -81,7 +83,7 @@ import "../chunk-MLKGABMK.js";
 // src/adapters/claude/hooks/pre-tool-use.ts
 import { existsSync, writeFileSync, mkdirSync } from "fs";
 import { execFileSync } from "child_process";
-import path2 from "path";
+import path from "path";
 import os from "os";
 
 // src/lib/sidechain-task-guard.ts
@@ -141,308 +143,6 @@ function shouldBlockSidechainTaskMutation(agentId, toolName, action) {
   return isSidechainIdentity(agentId) && isSidechainTaskMutation(toolName, action);
 }
 
-// src/lib/settings-tamper-guard.ts
-import path from "path";
-function normalizeForCompare(filePath, homeDir) {
-  const expanded = filePath.startsWith("~/") ? path.join(homeDir, filePath.slice(2)) : filePath;
-  return path.resolve(expanded);
-}
-function isProtectedAgentSettingsPath(filePath, homeDir) {
-  if (!filePath) return false;
-  const resolved = normalizeForCompare(filePath, homeDir);
-  const claudeSettings = path.join(homeDir, ".claude", "settings.json");
-  const claudeRoot = path.join(homeDir, ".claude.json");
-  return resolved === claudeSettings || resolved === claudeRoot;
-}
-function commandTouchesProtectedAgentSettings(command, homeDir) {
-  if (!command) return false;
-  const escapedHome = homeDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const patterns = [
-    /~\/\.claude\/settings\.json/,
-    /~\/\.claude\.json/,
-    new RegExp(`${escapedHome}/\\.claude/settings\\.json`),
-    new RegExp(`${escapedHome}/\\.claude\\.json`)
-  ];
-  if (!patterns.some((p) => p.test(command))) return false;
-  return /(^|[;&|]\s*|\b)(?:cat\s+>+|tee\b|sed\b.*\s-i\b|python\b|node\b|perl\b|ruby\b|jq\b.*>+|echo\b.*>+|cp\b|mv\b|rm\b)/s.test(command);
-}
-function settingsTamperDenyMessage(target) {
-  return `ACTION BLOCKED: ${target} is protected exe-os/Claude settings. Agents must not edit hook/MCP settings directly. Use exe-os install/update paths or ask the coordinator to approve the settings change.`;
-}
-
-// src/lib/remote-ref-delete-guard.ts
-var REF_DELETE_OVERRIDE_ENV = "EXE_FORCE_ALLOW_REMOTE_REF_DELETE";
-var REF_DELETE_OVERRIDE_TOKEN = `${REF_DELETE_OVERRIDE_ENV}=1`;
-var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-var HTTP_CLIENTS = /* @__PURE__ */ new Set(["curl", "wget", "http", "https", "httpie"]);
-function basename(tok) {
-  return tok.split("/").pop() ?? tok;
-}
-function isProgram(tok, name) {
-  return basename(tok) === name;
-}
-function isShellProgram(tok) {
-  return SHELLS.has(basename(tok));
-}
-function isDashC(tok) {
-  return /^-[a-z]*c[a-z]*$/i.test(tok) && tok.includes("c");
-}
-function methodFlagValue(tok, next) {
-  let m = /^(?:-X|--method|--request)=(.+)$/i.exec(tok);
-  if (m) return m[1];
-  m = /^-X(.+)$/.exec(tok);
-  if (m) return m[1];
-  if (/^(?:-X|--method|--request)$/i.test(tok)) return next ?? null;
-  return null;
-}
-function hasDeleteMethod(tokens) {
-  for (let i = 0; i < tokens.length; i++) {
-    const v = methodFlagValue(tokens[i], tokens[i + 1]);
-    if (v && v.trim().toUpperCase() === "DELETE") return true;
-  }
-  return false;
-}
-function refPathOf(tok) {
-  const m = /(?:^|[/\s])git\/refs\/([^\s?#'"]+)/.exec(tok);
-  if (!m) return null;
-  return m[1].replace(/\/+$/, "");
-}
-function isTagRef(refPath) {
-  return /^tags\//.test(refPath);
-}
-function firstNonTagRef(tokens) {
-  for (const t of tokens) {
-    const ref = refPathOf(t);
-    if (ref && !isTagRef(ref)) return ref;
-  }
-  return null;
-}
-function looksLikeGitHubApi(tok) {
-  return /api\.github\.com|\/api\/v3\/|\/api\/graphql/.test(tok);
-}
-function mentionsDeleteRefMutation(text) {
-  return /\bdeleteRef\b/.test(text);
-}
-function hasStdinRedirect(segment) {
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0; i < segment.length; i++) {
-    const ch = segment[i];
-    if (ch === "\\") {
-      i++;
-      continue;
-    }
-    if (inSingle) {
-      if (ch === "'") inSingle = false;
-      continue;
-    }
-    if (inDouble) {
-      if (ch === '"') inDouble = false;
-      continue;
-    }
-    if (ch === "'") {
-      inSingle = true;
-      continue;
-    }
-    if (ch === '"') {
-      inDouble = true;
-      continue;
-    }
-    if (ch === "<") return true;
-  }
-  return false;
-}
-function hasExternalPayload(tokens) {
-  for (let i = 0; i < tokens.length; i++) {
-    const t = tokens[i];
-    if (/^(?:--input|-T|--upload-file)$/.test(t)) return true;
-    if (/^--input=/.test(t)) return true;
-    if (t.startsWith("@")) return true;
-    if (/=@/.test(t)) return true;
-    if (t.startsWith("-") && t.includes("@")) return true;
-  }
-  return false;
-}
-var WRAPPERS = /* @__PURE__ */ new Set(["env", "command", "builtin", "exec", "nohup", "time", "stdbuf", "nice", "ionice", "setsid", "timeout", "caffeinate"]);
-function stripWrappers(tokens, depth = 0) {
-  if (depth > 6) return { kind: "argv", argv: [...tokens] };
-  let i = 0;
-  while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
-  const head = tokens[i];
-  if (head === void 0) return { kind: "argv", argv: [] };
-  if (!WRAPPERS.has(basename(head))) return { kind: "argv", argv: tokens.slice(i) };
-  let j = i + 1;
-  while (j < tokens.length) {
-    const t = tokens[j];
-    if (t.startsWith("-")) {
-      const inlineSplit = /^--split-string=(.*)$/.exec(t) ?? /^-S(.+)$/.exec(t);
-      if (inlineSplit) return { kind: "nested", script: inlineSplit[1] };
-      if (/^(?:-S|--split-string)$/.test(t)) {
-        const script = tokens[j + 1];
-        if (script !== void 0) return { kind: "nested", script };
-        return { kind: "argv", argv: tokens.slice(i) };
-      }
-      if (/^(?:-u|--unset|-n|-k|--kill-after|-s|--signal)$/.test(t)) j++;
-      j++;
-      continue;
-    }
-    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
-      j++;
-      continue;
-    }
-    if (basename(head) === "timeout" && /^[0-9]+(?:\.[0-9]+)?[smhd]?$/.test(t)) {
-      j++;
-      continue;
-    }
-    break;
-  }
-  if (j >= tokens.length) return { kind: "argv", argv: tokens.slice(i) };
-  return stripWrappers(tokens.slice(j), depth + 1);
-}
-function shellScripts(tokens) {
-  const out = [];
-  for (let i = 0; i < tokens.length; i++) {
-    if (!isShellProgram(tokens[i])) continue;
-    for (let j = i + 1; j < tokens.length; j++) {
-      if (!isDashC(tokens[j])) continue;
-      const script = tokens[j + 1];
-      if (script !== void 0) out.push(script);
-    }
-  }
-  return out;
-}
-function positionalsAfter(tokens, startIndex) {
-  const out = [];
-  for (let i = startIndex; i < tokens.length; i++) {
-    const t = tokens[i];
-    if (t.startsWith("-")) {
-      if (/^(?:-X|--method|--request|-f|-F|--field|--raw-field|-H|--header|--input|--hostname|--jq|-q|--template|-t|-d|--data|--data-raw|--data-binary|-o|--output|-u|--user|-A|--user-agent|-e|--referer)$/i.test(t)) i++;
-      continue;
-    }
-    if (/^[A-Za-z_][A-Za-z0-9_.-]*=/.test(t)) continue;
-    out.push(t);
-  }
-  return out;
-}
-function blockMessage(spelling, target) {
-  return `\u{1F6D1} BLOCKED: remote ref DELETION via ${spelling}.
-
-` + (target ? `TARGET: refs/${target}
-
-` : "") + `WHY: deleting a remote ref destroys the only copy of any work that lives only on it, and this repo's policy allows remote deletes only for TAGS. Blocking the git spelling while leaving the REST/GraphQL spelling open made the guard bypassable in one step (bug c0547f31), so the gate is on the OPERATION now, whatever tool performs it.
-
-INSTEAD:
-  \u2022 Prove the work landed first: exe-os repo-truth
-  \u2022 Keep a recovery point:        git fetch origin <branch> && git branch keep/<branch> FETCH_HEAD
-  \u2022 Ask the ref's owner, or delete it in the GitHub UI where the act is attributable.
-
-OVERRIDE (deliberate, audited): prefix the command with ${REF_DELETE_OVERRIDE_TOKEN}.
-The shared-main guard runs FIRST and independently covers the \`gh api\` REST
-spelling, so for that one you need BOTH tokens: ${MAIN_GUARD_OVERRIDE_TOKEN} ${REF_DELETE_OVERRIDE_TOKEN} <command>`;
-}
-function evaluateSegment(segment, depth) {
-  if (depth > 3) {
-    return {
-      block: true,
-      message: blockMessage("a pathologically nested shell invocation", null),
-      spelling: "nested-shell",
-      target: null
-    };
-  }
-  const { tokens } = tokenizeShell(segment);
-  if (tokens.length === 0) return { block: false };
-  for (const script of shellScripts(tokens)) {
-    const inner = evaluateCommandInternal(script, depth + 1);
-    if (inner.block) return inner;
-  }
-  const unwrapped = stripWrappers(tokens);
-  if (unwrapped.kind === "nested") return evaluateCommandInternal(unwrapped.script, depth + 1);
-  const argv = unwrapped.argv;
-  const program = argv[0];
-  if (!program) return { block: false };
-  if (isProgram(program, "gh")) {
-    const allOperands = positionalsAfter(argv, 1);
-    const apiIndex = allOperands.indexOf("api");
-    if (apiIndex === -1) return { block: false };
-    const operands = allOperands.slice(apiIndex + 1);
-    if (operands.includes("graphql")) {
-      if (mentionsDeleteRefMutation(segment)) {
-        return {
-          block: true,
-          message: blockMessage("a `gh api graphql` deleteRef mutation", null),
-          spelling: "gh-api-graphql-deleteRef",
-          target: null
-        };
-      }
-      if (hasExternalPayload(argv) || hasStdinRedirect(segment)) {
-        return {
-          block: true,
-          message: blockMessage("a `gh api graphql` call whose payload is read from a file, stdin, or a redirect", null),
-          spelling: "gh-api-graphql-opaque-payload",
-          target: null
-        };
-      }
-    }
-    if (!hasDeleteMethod(argv)) return { block: false };
-    const ref = firstNonTagRef(operands);
-    if (!ref) return { block: false };
-    return {
-      block: true,
-      message: blockMessage("a `gh api` DELETE on a git ref", ref),
-      spelling: "gh-api-delete",
-      target: ref
-    };
-  }
-  if (HTTP_CLIENTS.has(basename(program))) {
-    if (!argv.some((t) => looksLikeGitHubApi(t))) return { block: false };
-    if (mentionsDeleteRefMutation(segment)) {
-      return {
-        block: true,
-        message: blockMessage(`a \`${basename(program)}\` GitHub GraphQL deleteRef mutation`, null),
-        spelling: "http-graphql-deleteRef",
-        target: null
-      };
-    }
-    if (argv.some((t) => /\/graphql\b/.test(t)) && (hasExternalPayload(argv) || hasStdinRedirect(segment))) {
-      return {
-        block: true,
-        message: blockMessage(`a \`${basename(program)}\` GitHub GraphQL call whose payload is read from a file, stdin, or a redirect`, null),
-        spelling: "http-graphql-opaque-payload",
-        target: null
-      };
-    }
-    const bareVerb = argv.slice(1).some((t) => t === "DELETE");
-    if (!hasDeleteMethod(argv) && !bareVerb) return { block: false };
-    const ref = firstNonTagRef(argv);
-    if (!ref) return { block: false };
-    return {
-      block: true,
-      message: blockMessage(`a \`${basename(program)}\` DELETE on a GitHub git ref`, ref),
-      spelling: "http-delete",
-      target: ref
-    };
-  }
-  return { block: false };
-}
-function evaluateCommandInternal(command, depth) {
-  for (const segment of splitShellSegments(command)) {
-    const d = evaluateSegment(segment, depth);
-    if (d.block) return d;
-  }
-  return { block: false };
-}
-function evaluateRemoteRefDeleteGuard(command, env = process.env) {
-  try {
-    if (env[REF_DELETE_OVERRIDE_ENV] === "1") return { block: false, overridden: true };
-    if (new RegExp(String.raw`^\s*${REF_DELETE_OVERRIDE_ENV}=1\s`).test(command)) {
-      return { block: false, overridden: true };
-    }
-    return evaluateCommandInternal(command, 0);
-  } catch {
-    return { block: false };
-  }
-}
-
 // src/adapters/claude/hooks/pre-tool-use.ts
 process.on("uncaughtException", (err) => {
   console.error(`[exe-os:hook:pre-tool-use] FATAL: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
@@ -453,7 +153,7 @@ process.on("unhandledRejection", (err) => {
   process.exit(1);
 });
 try {
-  const { verifyOrBlock } = await import("../hook-integrity-KGAV6ZC2.js");
+  const { verifyOrBlock } = await import("../hook-integrity-6NLSNTXD.js");
   if (!await verifyOrBlock(new URL(import.meta.url).pathname)) process.exit(2);
 } catch (err) {
   const code = err?.code;
@@ -473,23 +173,185 @@ if (!process.env.AGENT_ID) {
 }
 var DELEGATION_TASK_THRESHOLD = 3;
 var CTO_ROLES = ["CTO", "executive"];
-var CACHE_DIR = path2.join(EXE_AI_DIR, "session-cache");
+var CACHE_DIR = path.join(EXE_AI_DIR, "session-cache");
 var PRE_TOOL_SAFEGUARD_MS = Number(process.env.EXE_HOOK_PRE_TOOL_TIMEOUT_MS) || 5e3;
 var hookStdoutWritten = false;
+var degradedSubject;
+var DEGRADED_READ_ONLY_PROGRAMS = /* @__PURE__ */ new Set([
+  "pwd",
+  "cd",
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "stat",
+  "basename",
+  "dirname",
+  "realpath",
+  "readlink",
+  "echo",
+  "printf",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "which",
+  "type",
+  "whoami",
+  "id",
+  "hostname",
+  "uname",
+  "printenv",
+  "ps",
+  "df",
+  "du",
+  "uptime",
+  "free",
+  "cut",
+  "tr",
+  "jq",
+  "diff",
+  "true",
+  "false",
+  "test"
+]);
+var FORBIDDEN_FLAGS = {
+  // ripgrep's --pre / --pre-glob / --hostname-bin run an EXTERNAL program per
+  // file, which would hand execution to something the allow-list never saw.
+  rg: /^(--pre|--pre-glob|--hostname-bin)(=|$)/
+};
+function hasSideEffectingShellSyntax(command) {
+  return /[><]/.test(command) || // redirection, incl. >> and <()
+  /\$\(/.test(command) || // $( ) command substitution
+  /`/.test(command) || // backtick command substitution
+  /\bsudo\b/.test(command);
+}
+function isReadOnlyBashCommand(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return false;
+  if (hasSideEffectingShellSyntax(trimmed)) return false;
+  const segments = trimmed.split(/&&|\|\||[;&|\n\r]/).map((seg) => seg.trim()).filter(Boolean);
+  if (segments.length === 0) return false;
+  return segments.every((segment) => {
+    const tokens = segment.split(/\s+/).filter(Boolean);
+    const program = tokens[0];
+    if (!program) return false;
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(program)) return false;
+    if (program.includes("/")) return false;
+    if (!DEGRADED_READ_ONLY_PROGRAMS.has(program)) return false;
+    const forbidden = FORBIDDEN_FLAGS[program];
+    if (forbidden && tokens.slice(1).some((t) => forbidden.test(t))) return false;
+    return true;
+  });
+}
+var DEGRADED_BLOCKED_NOTICE = [
+  "exe-os PreToolUse hook: THE DAEMON IS DEGRADED, and this is NOT a policy decision about your command.",
+  "",
+  "A DB call inside the hook stalled past its safeguard timeout, so the hook could not finish evaluating",
+  "the guards (worktree ownership, data-loss, main-history-rewrite). Because those guards did not run, the",
+  "hook declines to auto-approve a command that could mutate state \u2014 it is failing closed on purpose.",
+  "",
+  "Read-only commands (pwd, cat, ls, grep, git status/log/diff ...) DO still run while degraded; this",
+  "command was not classified as read-only. Note `git push` is deliberately excluded: the guard that would",
+  "catch a force-push to main is one of the ones currently not running.",
+  "",
+  "WHAT TO DO: do not retry with different syntax \u2014 the hook is not reading your command's semantics.",
+  "Check daemon health (`tail -100 ~/.exe-os/logs/exed-launchd.log`, or /exe-doctor), wait for it to",
+  "recover, and retry. If you have uncommitted work, commit it locally now so it is safe."
+].join("\n");
 function emitDegradedProceedOnce() {
   if (hookStdoutWritten) return;
   hookStdoutWritten = true;
-  process.stdout.write(
-    JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse" } })
+  const isBash = degradedSubject?.toolName === "Bash";
+  const command = degradedSubject?.command ?? "";
+  let readOnly = false;
+  try {
+    readOnly = isBash && isReadOnlyBashCommand(command);
+  } catch {
+    readOnly = false;
+  }
+  if (readOnly) {
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        permissionDecisionReason: "exe-os hook degraded (daemon stalled past the safeguard timeout). Command classified as read-only, so it is allowed \u2014 the skipped guards only govern mutating commands."
+      }
+    }));
+    return;
+  }
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      additionalContext: DEGRADED_BLOCKED_NOTICE
+    },
+    systemMessage: DEGRADED_BLOCKED_NOTICE
+  }));
+}
+var PRE_PARSE_SAFEGUARD_MS = Math.max(PRE_TOOL_SAFEGUARD_MS, 250);
+function armSafeguard(ms) {
+  const timeout2 = setTimeout(() => {
+    emitDegradedProceedOnce();
+    process.exit(0);
+  }, ms);
+  timeout2.unref();
+  return timeout2;
+}
+var timeout = armSafeguard(PRE_PARSE_SAFEGUARD_MS);
+var restoreProofModule = null;
+try {
+  restoreProofModule = await import("../restore-proof-HR4TXI3X.js");
+} catch (err) {
+  process.stderr.write(
+    `[action-gateway] restore-proof.js failed to import: ${err instanceof Error ? err.stack ?? err.message : String(err)}
+[action-gateway] destructive-data-guard blocking still fully enforced; only the backup-provenance audit note is unavailable.
+`
   );
 }
-var timeout = setTimeout(() => {
-  emitDegradedProceedOnce();
+function enforceActionPolicy(action, worktree) {
+  const ledgerPath = resolveLedgerPath();
+  const decision = decide(action, {
+    env: process.env,
+    homeDir: os.homedir(),
+    ledgerPath,
+    worktree,
+    restoreProof: restoreProofModule ? (storeId) => restoreProofModule.evaluateRestoreProof(storeId) : void 0
+  });
+  if (decision.record) {
+    const written = appendDecision(action, decision, { file: ledgerPath });
+    if (!written.ok) {
+      process.stderr.write(
+        `[action-gateway] AUDIT WRITE FAILED (${written.error}) \u2014 decision is still enforced, but this action is NOT in the ledger. Fix ${ledgerPath}.
+`
+      );
+    }
+  }
+  for (const note of decision.notes) {
+    process.stderr.write(`[action-gateway] ${decision.ruleId ?? "no-rule"}: ${note}
+`);
+  }
+  if (decision.effect === "allow") return;
+  const target = (action.command ?? action.filePath ?? "").split("\n")[0] ?? "";
+  process.stderr.write(
+    `[action-gateway] ${decision.effect.toUpperCase()} by ${decision.ruleId}: ${target.slice(0, 200)}
+`
+  );
+  hookStdoutWritten = true;
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: decision.effect,
+        additionalContext: decision.reason
+      },
+      systemMessage: decision.reason
+    })
+  );
   process.exit(0);
-}, PRE_TOOL_SAFEGUARD_MS);
-timeout.unref();
+}
 function getDelegationFlagPath() {
-  return path2.join(CACHE_DIR, `delegation-checkpoint-${getSessionKey()}.json`);
+  return path.join(CACHE_DIR, `delegation-checkpoint-${getSessionKey()}.json`);
 }
 function hasDelegationFired() {
   try {
@@ -543,15 +405,15 @@ function getWorktreeContext(cwd = process.cwd()) {
   return { isWorktree: false };
 }
 function pathContains(root, candidate) {
-  const relative = path2.relative(path2.resolve(root), path2.resolve(candidate));
-  return relative === "" || relative !== ".." && !relative.startsWith("../") && !path2.isAbsolute(relative);
+  const relative = path.relative(path.resolve(root), path.resolve(candidate));
+  return relative === "" || relative !== ".." && !relative.startsWith("../") && !path.isAbsolute(relative);
 }
 function gitRootOf(filePath) {
-  let probe = path2.resolve(filePath);
-  if (!existsSync(probe)) probe = path2.dirname(probe);
+  let probe = path.resolve(filePath);
+  if (!existsSync(probe)) probe = path.dirname(probe);
   while (true) {
-    if (existsSync(path2.join(probe, ".git"))) return probe;
-    const parent = path2.dirname(probe);
+    if (existsSync(path.join(probe, ".git"))) return probe;
+    const parent = path.dirname(probe);
     if (parent === probe) return null;
     probe = parent;
   }
@@ -559,11 +421,11 @@ function gitRootOf(filePath) {
 function isMainRepoPath(filePath, ctx) {
   if (!pathContains(ctx.repoRoot, filePath) || pathContains(ctx.worktreeRoot, filePath)) return false;
   const targetGitRoot = gitRootOf(filePath);
-  return targetGitRoot === null || path2.resolve(targetGitRoot) === path2.resolve(ctx.repoRoot);
+  return targetGitRoot === null || path.resolve(targetGitRoot) === path.resolve(ctx.repoRoot);
 }
 function rewriteToWorktree(filePath, ctx) {
-  const relative = path2.relative(ctx.repoRoot, filePath);
-  return path2.join(ctx.worktreeRoot, relative);
+  const relative = path.relative(ctx.repoRoot, filePath);
+  return path.join(ctx.worktreeRoot, relative);
 }
 function shouldApplyOuterWorktreeGuard(filePath, ctx) {
   return isMainRepoPath(filePath, ctx);
@@ -607,7 +469,13 @@ process.stdin.on("end", async () => {
       process.exit(0);
     }
     const data = JSON.parse(input);
-    const agent = resolveSidechainAgentIdentity(getActiveAgent(), data.transcript_path);
+    degradedSubject = {
+      toolName: data.tool_name,
+      command: data.tool_input?.command
+    };
+    clearTimeout(timeout);
+    timeout = armSafeguard(PRE_TOOL_SAFEGUARD_MS);
+    const agent = resolvePreToolUseAgentIdentity(getActiveAgent(), data);
     let wroteStdout = false;
     try {
       if (data.tool_name === "Task" || data.tool_name === "Agent") {
@@ -621,11 +489,11 @@ process.stdin.on("end", async () => {
         const ti = data.tool_input;
         const haystack = `${ti?.description ?? ""}
 ${ti?.prompt ?? ""}`;
-        const { extractWorkRefCandidates } = await import("../work-claims-B73X5NE7.js");
+        const { extractWorkRefCandidates } = await import("../work-claims-PDQNLE5K.js");
         if (extractWorkRefCandidates(haystack).length > 0) {
-          const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
+          const { fastDbInit } = await import("../fast-db-init-GWUZ746B.js");
           await fastDbInit({ caller: "hook" });
-          const { findConflictsInText, describeConflict, resolveHolderSession } = await import("../work-claims-B73X5NE7.js");
+          const { findConflictsInText, describeConflict, resolveHolderSession } = await import("../work-claims-PDQNLE5K.js");
           const holderSession = await resolveHolderSession();
           if (holderSession) {
             const conflicts = await findConflictsInText(haystack, holderSession);
@@ -662,7 +530,7 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
     }
     if (data.tool_name === "Task" || data.tool_name === "Agent") {
       try {
-        const { evaluateNestedSpawnGuard } = await import("../worktree-ownership-guard-OUWJROW2.js");
+        const { evaluateNestedSpawnGuard } = await import("../worktree-ownership-guard-4LKMW6PW.js");
         const nestedDecision = evaluateNestedSpawnGuard({
           toolName: data.tool_name,
           toolInput: data.tool_input,
@@ -672,7 +540,11 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
           process.stderr.write(`[pre-tool-use] nested-spawn isolation BLOCKED ${data.tool_name}
 `);
           process.stdout.write(JSON.stringify({
-            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
+            hookSpecificOutput: {
+              hookEventName: "PreToolUse",
+              permissionDecision: "deny",
+              additionalContext: nestedDecision.reason
+            },
             systemMessage: nestedDecision.reason
           }));
           process.exit(0);
@@ -684,19 +556,28 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
     }
     if (["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit"].includes(data.tool_name)) {
       try {
-        const { evaluateWorktreeOwnership } = await import("../worktree-ownership-guard-OUWJROW2.js");
-        const ownershipDecision = evaluateWorktreeOwnership({
+        const { evaluateWorktreeOwnership } = await import("../worktree-ownership-guard-4LKMW6PW.js");
+        const ownershipDecision = await evaluateWorktreeOwnership({
           toolName: data.tool_name,
           cwd: data.cwd ?? process.cwd(),
+          // The Bash command string powers the cwd-deadlock escape hatch: a
+          // `cd` out of a foreign worktree (or a read-only command) must be
+          // allowed even though the PERSISTENT cwd is still inside it.
+          command: data.tool_name === "Bash" ? data.tool_input?.command ?? "" : void 0,
           actorAgentId: data.agent_id ?? null,
           sessionKey: getSessionKey()
         });
         if (ownershipDecision.outcome === "block") {
           process.stderr.write(`[pre-tool-use] worktree-ownership BLOCKED ${data.tool_name}
 `);
+          const reason = ownershipDecision.reason.trim() || `BLOCKED: worktree ownership guard denied this ${data.tool_name} call from ${data.cwd ?? process.cwd()}. Leave the foreign worktree with a cd to the repo root and retry.`;
           process.stdout.write(JSON.stringify({
-            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
-            systemMessage: ownershipDecision.reason
+            hookSpecificOutput: {
+              hookEventName: "PreToolUse",
+              permissionDecision: "deny",
+              additionalContext: reason
+            },
+            systemMessage: reason
           }));
           process.exit(0);
         }
@@ -708,114 +589,20 @@ Session ${holderSession} does not hold this. Two sessions doing the same work is
     if (data.tool_name === "Bash") {
       const command = data.tool_input?.command ?? "";
       const isCoordinator = canCoordinate(agent.agentId, agent.agentRole);
-      {
-        const guard = evaluateMainGuard(command, { cwd: process.cwd(), env: process.env });
-        if (guard.block) {
-          const output = JSON.stringify({
-            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
-            systemMessage: guard.message
-          });
-          process.stdout.write(output);
-          process.exit(0);
-        }
-        if (guard.overridden) {
-          process.stderr.write(
-            `[pre-tool-use] MAIN-GUARD OVERRIDE used \u2014 destructive main-rewrite allowed via EXE_FORCE_ALLOW_MAIN_HISTORY_REWRITE=1: ${command}
-`
-          );
-        }
-      }
-      {
-        const refGuard = evaluateRemoteRefDeleteGuard(command, process.env);
-        if (refGuard.block) {
-          process.stderr.write(
-            `[pre-tool-use] remote-ref-delete BLOCKED (${refGuard.spelling}): ${command}
-`
-          );
-          process.stdout.write(JSON.stringify({
-            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
-            systemMessage: refGuard.message
-          }));
-          process.exit(0);
+      enforceActionPolicy({
+        tool: "Bash",
+        command,
+        cwd: process.cwd(),
+        actor: {
+          agentId: agent.agentId,
+          agentRole: agent.agentRole,
+          isCoordinator,
+          sessionId: process.env.EXE_SESSION_NAME
         }
-        if (refGuard.overridden) {
-          process.stderr.write(
-            `[pre-tool-use] REF-DELETE OVERRIDE used \u2014 remote ref deletion allowed via EXE_FORCE_ALLOW_REMOTE_REF_DELETE=1: ${command}
-`
-          );
-        }
-      }
-      {
-        let decision = null;
-        let guardError = null;
-        try {
-          const { evaluateDestructiveDataGuard, formatAllowAudit } = await import("../destructive-data-guard-BVFWPPIS.js");
-          const result = evaluateDestructiveDataGuard(command, { cwd: process.cwd(), env: process.env });
-          decision = result;
-          if (!result.block && result.ops.length > 0) {
-            const { evaluateRestoreProof } = await import("../restore-proof-HR4TXI3X.js");
-            process.stderr.write(`${formatAllowAudit(result.ops, (id) => evaluateRestoreProof(id))}
-`);
-          }
-        } catch (err) {
-          guardError = err instanceof Error ? err.stack ?? err.message : String(err);
-        }
-        if (guardError !== null) {
-          const msg = `BLOCKED: the irreversible-data-operation guard could not evaluate this command, so it is refused.
-Guard error: ${guardError}
-This gate fails CLOSED by design \u2014 "the check did not run" is never "the operation is safe".
-Fix the guard (src/lib/destructive-data-guard.ts) rather than routing around it.`;
-          process.stderr.write(`[pre-tool-use] destructive-data-guard ERROR \u2192 fail-closed block: ${guardError}
-`);
-          process.stdout.write(
-            JSON.stringify({
-              hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", additionalContext: msg },
-              systemMessage: msg
-            })
-          );
-          process.exit(0);
-        }
-        if (decision?.block) {
-          process.stderr.write(`[pre-tool-use] destructive-data-guard BLOCKED: ${command}
-`);
-          process.stdout.write(
-            JSON.stringify({
-              hookSpecificOutput: {
-                hookEventName: "PreToolUse",
-                permissionDecision: "deny",
-                additionalContext: decision.message
-              },
-              systemMessage: decision.message
-            })
-          );
-          process.exit(0);
-        }
-      }
-      if (!isCoordinator && commandTouchesProtectedAgentSettings(command, os.homedir())) {
-        const output = JSON.stringify({
-          hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
-          systemMessage: settingsTamperDenyMessage("Claude/exe-os settings")
-        });
-        process.stdout.write(output);
-        process.exit(0);
-      }
-      if (/tmux\s+send-keys/i.test(command)) {
-        if (!isCoordinator) {
-          const output = JSON.stringify({
-            hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
-            systemMessage: `\u274C BLOCKED: tmux send-keys is not allowed for non-coordinator agents.
-Use MCP tools to communicate:
-- create_task to assign work (auto-spawns + sends intercom)
-- send_message for context
-- update_task to report status
-- task(action="resume") to respawn a dead session
-Read-only tmux (capture-pane, list-sessions) is fine for monitoring.
-If MCP is down, tell the user: "MCP disconnected. Run /mcp to reconnect."`
-          });
-          process.stdout.write(output);
-          process.exit(0);
-        }
-      }
+      }, (() => {
+        const wt = getWorktreeContext();
+        return { isWorktree: wt.isWorktree, root: wt.isWorktree ? wt.worktreeRoot : null };
+      })());
     }
     if (data.tool_name === "Bash") {
       const cmd = data.tool_input?.command ?? "";
@@ -884,7 +671,7 @@ NEVER write to the main repo from a worktree. The main repo belongs to the coord
         const targetDir = targetSegments[0];
         const currentProject = process.cwd().split("/").pop();
         if (targetDir && currentProject && targetDir !== currentProject && !command.includes("worktree")) {
-          const expandHome = (p) => p.startsWith("~/") ? path2.join(os.homedir(), p.slice(2)) : p;
+          const expandHome = (p) => p.startsWith("~/") ? path.join(os.homedir(), p.slice(2)) : p;
           const gitRootOf2 = (dir) => {
             try {
               return execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
@@ -897,7 +684,7 @@ NEVER write to the main repo from a worktree. The main repo belongs to the coord
             }
           };
           const currentRepoRoot = gitRootOf2(process.cwd());
-          const absTarget = path2.resolve(process.cwd(), expandHome(cdTarget));
+          const absTarget = path.resolve(process.cwd(), expandHome(cdTarget));
           let probe = absTarget;
           let targetRepoRoot = null;
           for (let depth = 0; depth < 12 && probe && probe !== "/"; depth++) {
@@ -906,7 +693,7 @@ NEVER write to the main repo from a worktree. The main repo belongs to the coord
               targetRepoRoot = root;
               break;
             }
-            probe = path2.dirname(probe);
+            probe = path.dirname(probe);
           }
           const currentRepoName = currentRepoRoot?.split("/").pop() ?? null;
           const isMonorepoNavigation = currentRepoRoot !== null && targetRepoRoot !== null && currentRepoRoot === targetRepoRoot || currentRepoName !== null && targetDir === currentRepoName;
@@ -971,12 +758,36 @@ Rerun ${data.tool_name} with this worktree path instead: ${rewritten}`
         process.exit(0);
       }
     }
-    if (/^(Write|Edit)$/.test(data.tool_name) && !canCoordinate(agent.agentId, agent.agentRole)) {
-      const filePath = data.tool_input?.file_path ?? "";
-      if (isProtectedAgentSettingsPath(filePath, os.homedir())) {
+    if (/^(Write|Edit|MultiEdit|NotebookEdit)$/.test(data.tool_name)) {
+      const filePath = data.tool_input?.file_path ?? data.tool_input?.notebook_path ?? "";
+      if (filePath) {
+        enforceActionPolicy({
+          tool: data.tool_name,
+          filePath,
+          cwd: process.cwd(),
+          actor: {
+            agentId: agent.agentId,
+            agentRole: agent.agentRole,
+            isCoordinator: canCoordinate(agent.agentId, agent.agentRole),
+            sessionId: process.env.EXE_SESSION_NAME
+          }
+        });
+      }
+    }
+    if (/^(Write|Edit|NotebookEdit)$/.test(data.tool_name)) {
+      const filePath = data.tool_input?.file_path ?? data.tool_input?.notebook_path ?? "";
+      const wtCtxScratch = getWorktreeContext();
+      const scratch = evaluateScratchPathTarget(filePath, {
+        cwd: process.cwd(),
+        surface: "tool",
+        worktreeRoot: wtCtxScratch.isWorktree ? wtCtxScratch.worktreeRoot : null
+      });
+      if (scratch.block) {
+        process.stderr.write(`[pre-tool-use] lesson-guard BLOCKED (shared-scratch-path): ${filePath}
+`);
         const output = JSON.stringify({
           hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny" },
-          systemMessage: settingsTamperDenyMessage(filePath)
+          systemMessage: scratch.message
         });
         process.stdout.write(output);
         process.exit(0);
@@ -1018,7 +829,7 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
         process.exit(0);
       }
     }
-    const { getGatedAgent } = await import("../cto-delegation-gate-LQHVLEMW.js");
+    const { getGatedAgent } = await import("../cto-delegation-gate-O6XPGECP.js");
     const gatedAgent = getGatedAgent();
     if (agent.agentId === gatedAgent) {
       const isStructured = /^(Write|Edit|MultiEdit|NotebookEdit)$/.test(data.tool_name);
@@ -1030,7 +841,7 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
             evaluateDelegationGate,
             evaluateBashWriteGate,
             GATE_BLOCK_MESSAGE
-          } = await import("../cto-delegation-gate-LQHVLEMW.js");
+          } = await import("../cto-delegation-gate-O6XPGECP.js");
           let decision = null;
           let surfaceLabel = data.tool_name;
           let targetLabel = "";
@@ -1039,7 +850,7 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
             const filePath = data.tool_name === "NotebookEdit" ? ti.notebook_path ?? "" : ti.file_path ?? "";
             const content = data.tool_name === "MultiEdit" ? (ti.edits ?? []).map((e) => e.new_string ?? "").filter(Boolean) : data.tool_name === "NotebookEdit" ? ti.new_source : ti.content ?? ti.new_string;
             if (filePath) {
-              const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
+              const { fastDbInit } = await import("../fast-db-init-GWUZ746B.js");
               await fastDbInit({ caller: "hook" });
               targetLabel = filePath;
               decision = await evaluateDelegationGate({
@@ -1052,10 +863,10 @@ Do NOT report this as successful. No file was changed. If you are a sub-agent, r
             }
           } else {
             const command = data.tool_input?.command ?? "";
-            const { detectBashSourceWrites } = await import("../cto-delegation-gate-LQHVLEMW.js");
+            const { detectBashSourceWrites } = await import("../cto-delegation-gate-O6XPGECP.js");
             const targets = detectBashSourceWrites(command, process.cwd());
             if (targets.length > 0) {
-              const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
+              const { fastDbInit } = await import("../fast-db-init-GWUZ746B.js");
               await fastDbInit({ caller: "hook" });
               surfaceLabel = "Bash-write";
               targetLabel = targets.join(", ");
@@ -1132,7 +943,7 @@ Reason: ${decision.reason ?? "engineer-delegatable edit"}`;
     const isUpdateTaskDone = (data.tool_name === "mcp__exe-os__update_task" || data.tool_name === "mcp__exe-mem__update_task") && toolInput.status === "done" && CTO_ROLES.includes(agent.agentRole);
     if (isUpdateTaskDone) {
       try {
-        const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
+        const { fastDbInit } = await import("../fast-db-init-GWUZ746B.js");
         const client = await fastDbInit({ caller: "hook" });
         const taskId = String(toolInput.task_id ?? "");
         const ptScope = sessionScopeFilter();
@@ -1190,7 +1001,7 @@ Reason: ${decision.reason ?? "engineer-delegatable edit"}`;
     }
     if (data.agent_type == null && CTO_ROLES.includes(agent.agentRole) && !hasDelegationFired()) {
       try {
-        const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
+        const { fastDbInit } = await import("../fast-db-init-GWUZ746B.js");
         const client = await fastDbInit({ caller: "hook" });
         const dlScope = sessionScopeFilter();
         const result = await client.execute({
@@ -1262,7 +1073,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
     }
     if (!wroteStdout && data.agent_type != null) {
       try {
-        const { buildSubagentBootstrapContext } = await import("../subagent-brief-injection-ED36PLYY.js");
+        const { buildSubagentBootstrapContext } = await import("../subagent-brief-injection-HCKZQZBF.js");
         const subagentBrief = await buildSubagentBootstrapContext(data);
         if (subagentBrief) {
           const output = JSON.stringify({
@@ -1285,8 +1096,8 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
           selectUrgentUnsurfaced,
           formatInRunInboxBanner
         } = await import("../inrun-inbox-DRKVDPLY.js");
-        const throttlePath = path2.join(CACHE_DIR, `inrun-inbox-check-${getSessionKey()}.json`);
-        const seenPath = path2.join(CACHE_DIR, `inrun-inbox-seen-${getSessionKey()}.json`);
+        const throttlePath = path.join(CACHE_DIR, `inrun-inbox-check-${getSessionKey()}.json`);
+        const seenPath = path.join(CACHE_DIR, `inrun-inbox-seen-${getSessionKey()}.json`);
         let lastCheckMs = null;
         try {
           const { readFileSync } = await import("fs");
@@ -1299,7 +1110,7 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
             writeFileSync(throttlePath, JSON.stringify({ ts: Date.now() }));
           } catch {
           }
-          const { fastDbInit } = await import("../fast-db-init-L2RGKJWH.js");
+          const { fastDbInit } = await import("../fast-db-init-GWUZ746B.js");
           const client = await fastDbInit({ daemonOnly: true, caller: "hook" });
           const { isInitialized } = await import("../lib/database.js");
           if (isInitialized()) {
@@ -1339,3 +1150,6 @@ Do NOT attempt workarounds \u2014 direct DB access bypasses encryption, breaks d
   clearTimeout(timeout);
   process.exit(0);
 });
+export {
+  isReadOnlyBashCommand
+};