@atlasharness/atlascode 0.1.81 → 0.1.82

package/dist/cli.js

@@ -29154,6 +29154,11 @@ var DEFAULT_HOOK_SHELL = "bash";
 var init_getMatchingHooks = () => {};
 
 // src/hooks/runHooks.ts
+function sessionEndHookTimeoutMs() {
+  const raw = process.env.ATLAS_SESSIONEND_HOOKS_TIMEOUT_MS;
+  const parsed = raw ? Number(raw) : NaN;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : SESSION_END_HOOK_TIMEOUT_MS_DEFAULT;
+}
 function isSimpleModeHooksSkipped() {
   const raw = process.env.ATLAS_SIMPLE;
   if (raw === undefined)
@@ -29273,6 +29278,7 @@ ${r.additionalContext}` : r.additionalContext;
     if (!acc.permissionBehavior || PERMISSION_RANK[r.permissionBehavior] > PERMISSION_RANK[acc.permissionBehavior]) {
       acc.permissionBehavior = r.permissionBehavior;
       acc.permissionDecisionReason = r.permissionDecisionReason;
+      acc.permissionDecisionSource = r.source;
     }
   }
 }
@@ -29290,12 +29296,14 @@ function runOneHook(m, port, env, signal, options) {
     if (result.blockingError && cmd.continueOnBlock === true) {
       result.continueOnBlock = true;
     }
+    result.source = m.source;
     return result;
   }, (e) => ({
     command: cmd.command,
     status: -1,
     succeeded: false,
-    stderr: e instanceof Error ? e.message : String(e)
+    stderr: e instanceof Error ? e.message : String(e),
+    source: m.source
   }));
 }
 async function runHooks(hookEvent, hookInput, options = {}) {
@@ -29350,7 +29358,15 @@ async function runStopHooks(options = {}) {
   const hookInput = { ...base, hook_event_name: "Stop" };
   return runHooks("Stop", hookInput, options);
 }
-var HOOK_EXECUTION_TIMEOUT_MS, PERMISSION_RANK;
+async function runSessionEndHooks(reason, options = {}) {
+  const base = createBaseHookInput(options.permissionMode, options.sessionId, options.agentInfo);
+  const hookInput = { ...base, hook_event_name: "SessionEnd", reason };
+  return runHooks("SessionEnd", hookInput, {
+    ...options,
+    timeoutMs: options.timeoutMs ?? sessionEndHookTimeoutMs()
+  });
+}
+var MAX_HOOK_CONCURRENCY = 12, HOOK_EXECUTION_TIMEOUT_MS, SESSION_END_HOOK_TIMEOUT_MS_DEFAULT = 1500, PERMISSION_RANK;
 var init_runHooks = __esm(() => {
   init_createBaseHookInput();
   init_getMatchingHooks();
@@ -29386,9 +29402,20 @@ async function* runHooksStream(hookEvent, hookInput, options = {}) {
       toolUseID: options.toolUseID
     };
   }
-  const started = matched.map((m) => runOneHook(m, port, env, signal, options));
-  for (const pending of started) {
-    const result = await pending;
+  const slots = [];
+  let nextStart = 0;
+  const startNext = () => {
+    if (nextStart < matched.length) {
+      slots[nextStart] = runOneHook(matched[nextStart], port, env, signal, options);
+      nextStart++;
+    }
+  };
+  for (let i = 0;i < Math.min(MAX_HOOK_CONCURRENCY, matched.length); i++) {
+    startNext();
+  }
+  for (let i = 0;i < matched.length; i++) {
+    const result = await slots[i];
+    startNext();
     results.push(result);
     yield { kind: "hook_result", result };
     mergeAggregated(aggregated, result);
@@ -30543,12 +30570,22 @@ function applyDontAskMode(decision, permissionContext, toolName) {
   }
   return decision;
 }
-var BASH_TOOL_NAME = "Bash", hasPermissionsToUseTool = async (tool, input, context, _assistantMessage, _toolUseID, forceDecision) => {
+var BASH_TOOL_NAME = "Bash", PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES, PLAN_MODE_WRITE_DENIED_MESSAGE = (toolName) => `Plan mode is active — ${toolName} is not allowed to make changes. ` + `Present your plan and use ExitPlanMode, or ask the user to change the permission mode.`, hasPermissionsToUseTool = async (tool, input, context, _assistantMessage, _toolUseID, forceDecision) => {
   const permissionContext = context.getToolPermissionContext?.();
   if (forceDecision !== undefined) {
     return applyDontAskMode(forceDecision, permissionContext, tool.name);
   }
   const sandbox = getSandboxAccess();
+  if (permissionContext?.mode === "plan" && !permissionContext.isBypassPermissionsModeAvailable && !PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES.has(tool.name) && !(tool.isReadOnly?.(input) ?? false)) {
+    return {
+      behavior: "deny",
+      message: PLAN_MODE_WRITE_DENIED_MESSAGE(tool.name),
+      decisionReason: {
+        type: "mode",
+        mode: "plan"
+      }
+    };
+  }
   const denyRule = permissionContext ? getDenyRuleForTool(permissionContext, tool) : null;
   if (denyRule) {
     return {
@@ -30667,6 +30704,10 @@ var init_permissions2 = __esm(() => {
   init_ruleMatching();
   init_sandboxAccess();
   init_denialMessages();
+  PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES = new Set([
+    "EnterPlanMode",
+    "ExitPlanMode"
+  ]);
 });
 
 // src/permissions/permissionMode.ts
@@ -46612,9 +46653,67 @@ var init_bashCommandHelpers = __esm(() => {
 });
 
 // src/engine/tools/bash/bashReadOnly.ts
+function globPatternCouldMatchWriteAction(pattern) {
+  let regex = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") {
+      regex += ".*";
+      i++;
+      continue;
+    }
+    if (c === "?") {
+      regex += ".";
+      i++;
+      continue;
+    }
+    if (c === "[") {
+      const close = pattern.indexOf("]", i + 1);
+      if (close > i) {
+        let cls = pattern.slice(i + 1, close);
+        if (cls.startsWith("!"))
+          cls = `^${cls.slice(1)}`;
+        regex += `[${cls}]`;
+        i = close + 1;
+        continue;
+      }
+    }
+    regex += c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    i++;
+  }
+  regex += "$";
+  let re;
+  try {
+    re = new RegExp(regex);
+  } catch {
+    return true;
+  }
+  for (const action of FIND_WRITE_ACTION_TOKENS) {
+    if (re.test(action))
+      return true;
+  }
+  return false;
+}
+function isAllowedNonStringToken(token) {
+  if (typeof token !== "object" || token === null)
+    return false;
+  const t = token;
+  if (t.comment !== undefined)
+    return true;
+  if (t.op === "<")
+    return true;
+  if (t.op === "glob") {
+    if (typeof t.pattern !== "string")
+      return false;
+    return !globPatternCouldMatchWriteAction(t.pattern);
+  }
+  return false;
+}
 function matchReadOnlyPrefix(command) {
   const trimmed = command.trim();
-  if (trimmed.includes("&&") || trimmed.includes("||") || trimmed.includes(";") || trimmed.includes("|") || trimmed.includes("`") || trimmed.includes("$(") || trimmed.includes(">")) {
+  if (trimmed.includes("&&") || trimmed.includes("||") || trimmed.includes(";") || trimmed.includes("|") || trimmed.includes("`") || trimmed.includes("$(") || trimmed.includes(">") || trimmed.includes(`
+`) || trimmed.includes("\r") || trimmed.includes("-delete") || trimmed.includes("-exec") || trimmed.includes("-ok") || trimmed.includes("-fprint") || trimmed.includes("-fls")) {
     return null;
   }
   let best = null;
@@ -46624,13 +46723,31 @@ function matchReadOnlyPrefix(command) {
         best = p;
     }
   }
+  if (best === null)
+    return null;
+  const parsed = tryParseShellCommand(trimmed, (key) => `$${key}`);
+  if (!parsed.success) {
+    return null;
+  }
+  for (const token of parsed.tokens) {
+    if (typeof token === "string") {
+      if (FIND_WRITE_ACTION_TOKENS.has(token))
+        return null;
+      if (token.includes("[") && globPatternCouldMatchWriteAction(token)) {
+        return null;
+      }
+    } else if (!isAllowedNonStringToken(token)) {
+      return null;
+    }
+  }
   return best;
 }
 function isReadOnlyCommand(command) {
   return matchReadOnlyPrefix(command) !== null;
 }
-var READ_ONLY_PREFIXES;
+var READ_ONLY_PREFIXES, FIND_WRITE_ACTION_TOKENS;
 var init_bashReadOnly = __esm(() => {
+  init_shellQuote();
   READ_ONLY_PREFIXES = [
     "ls",
     "cat",
@@ -46657,6 +46774,17 @@ var init_bashReadOnly = __esm(() => {
     "printenv",
     "type"
   ];
+  FIND_WRITE_ACTION_TOKENS = new Set([
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-ok",
+    "-okdir",
+    "-fprint",
+    "-fprint0",
+    "-fprintf",
+    "-fls"
+  ]);
 });
 
 // src/engine/tools/bash/abortError.ts
@@ -75335,6 +75463,27 @@ var init_tasks3 = __esm(() => {
   init_taskOutputTool();
 });
 
+// src/engine/skill/commandNameSafety.ts
+function isUnsafeCommandName(name) {
+  if (name === "")
+    return true;
+  if (name.includes("<") || name.includes(">"))
+    return true;
+  return UNSAFE_NAME_CHARS_RE.test(name);
+}
+function sanitizeDisplayName(displayName, canonicalName) {
+  if (displayName === undefined || !isUnsafeCommandName(displayName)) {
+    return displayName;
+  }
+  logForDebugging(`Discarding unsafe frontmatter display name ${JSON.stringify(displayName)} for ${canonicalName}; falling back to canonical name`);
+  return;
+}
+var UNSAFE_NAME_CHARS_RE;
+var init_commandNameSafety = __esm(() => {
+  init_shared();
+  UNSAFE_NAME_CHARS_RE = /[\u0000-\u001F\u007F-\u00A0\u00AD\u034F\u061C\u070F\u1680\u180E\u2000-\u200F\u2028\u2029\u202A-\u202E\u202F\u205F\u2060-\u2069\u3000\uFE00-\uFE0F\uFEFF\u{E0100}-\u{E01EF}]/u;
+});
+
 // src/engine/skill/types.ts
 function getCommandName(cmd) {
   return cmd.userFacingName?.() ?? cmd.name;
@@ -75457,44 +75606,129 @@ function parseArgumentNames(argumentNames) {
     return [];
   }
   const isValidName = (name) => typeof name === "string" && name.trim() !== "" && !/^\d+$/.test(name);
+  const cap = (names) => names.map((name) => name.slice(0, MAX_ARGUMENT_NAME_CHARS)).slice(0, MAX_ARGUMENT_NAMES);
   if (Array.isArray(argumentNames)) {
-    return argumentNames.filter(isValidName);
+    return cap(argumentNames.filter(isValidName));
   }
   if (typeof argumentNames === "string") {
-    return argumentNames.split(/\s+/).filter(isValidName);
+    return cap(argumentNames.split(/\s+/).filter(isValidName));
   }
   return [];
 }
-function substituteArguments(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+function isWordChar2(c) {
+  return c !== undefined && /[A-Za-z0-9_]/.test(c);
+}
+function matchPlaceholderAt(content, i, argumentNames) {
+  if (content[i] !== "$")
+    return null;
+  for (let n = 0;n < argumentNames.length; n++) {
+    const name = argumentNames[n];
+    if (!name)
+      continue;
+    if (content.startsWith(`$${name}`, i)) {
+      const after = content[i + 1 + name.length];
+      if (after !== "[" && !isWordChar2(after)) {
+        return { length: 1 + name.length, kind: "named", nameIndex: n };
+      }
+    }
+  }
+  INDEXED_PLACEHOLDER_RE.lastIndex = i;
+  const indexed = INDEXED_PLACEHOLDER_RE.exec(content);
+  if (indexed) {
+    return {
+      length: indexed[0].length,
+      kind: "indexed",
+      argIndex: parseInt(indexed[1], 10)
+    };
+  }
+  if (content.startsWith("$ARGUMENTS", i)) {
+    return { length: "$ARGUMENTS".length, kind: "bare" };
+  }
+  SHORTHAND_PLACEHOLDER_RE.lastIndex = i;
+  const shorthand = SHORTHAND_PLACEHOLDER_RE.exec(content);
+  if (shorthand && !isWordChar2(content[i + shorthand[0].length])) {
+    return {
+      length: shorthand[0].length,
+      kind: "shorthand",
+      argIndex: parseInt(shorthand[1], 10)
+    };
+  }
+  return null;
+}
+function countPlaceholderOccurrences(content, argumentNames) {
+  let count = 0;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt(content, i, argumentNames);
+    if (m) {
+      count++;
+      i += m.length;
+    } else {
+      i++;
+    }
+  }
+  return count;
+}
+function substituteArgumentsImpl(content, args, appendIfNoPlaceholder, argumentNames, strict) {
   if (args === undefined || args === null) {
     return content;
   }
-  const parsedArgs = parseArguments(args);
-  const originalContent = content;
-  for (let i = 0;i < argumentNames.length; i++) {
-    const name = argumentNames[i];
-    if (!name)
-      continue;
-    content = content.replace(new RegExp(`\\$${name}(?![\\[\\w])`, "g"), parsedArgs[i] ?? "");
+  const placeholderCount = countPlaceholderOccurrences(content, argumentNames);
+  let effectiveArgs = args;
+  if (placeholderCount > 0 && content.length + placeholderCount * args.length > MAX_SUBSTITUTION_OUTPUT_CHARS) {
+    if (strict)
+      return null;
+    const budgetPerReplacement = Math.max(0, Math.floor((MAX_SUBSTITUTION_OUTPUT_CHARS - content.length) / placeholderCount));
+    effectiveArgs = args.slice(0, budgetPerReplacement);
+  } else if (strict) {
+    const appendLen = appendIfNoPlaceholder && args ? `
+
+ARGUMENTS: `.length + args.length : 0;
+    if (content.length + appendLen > MAX_SUBSTITUTION_OUTPUT_CHARS) {
+      return null;
+    }
   }
-  content = content.replace(/\$ARGUMENTS\[(\d+)\]/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replace(/\$(\d+)(?!\w)/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replaceAll("$ARGUMENTS", args);
-  if (content === originalContent && appendIfNoPlaceholder && args) {
-    content = content + `
+  const parsedArgs = parseArguments(effectiveArgs);
+  let out = "";
+  const appendValue = (value) => {
+    if (out.length + value.length > MAX_SUBSTITUTION_OUTPUT_CHARS) {
+      value = value.slice(0, Math.max(0, MAX_SUBSTITUTION_OUTPUT_CHARS - out.length));
+    }
+    out += value;
+  };
+  let matched = false;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt(content, i, argumentNames);
+    if (m) {
+      matched = true;
+      if (m.kind === "bare")
+        appendValue(effectiveArgs);
+      else if (m.kind === "named")
+        appendValue(parsedArgs[m.nameIndex] ?? "");
+      else
+        appendValue(parsedArgs[m.argIndex] ?? "");
+      i += m.length;
+    } else {
+      out += content[i];
+      i++;
+    }
+  }
+  if (!matched && appendIfNoPlaceholder && args) {
+    out = out + `
 
 ARGUMENTS: ${args}`;
   }
-  return content;
+  return out;
 }
+function substituteArguments(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+  return substituteArgumentsImpl(content, args, appendIfNoPlaceholder, argumentNames, false) ?? content;
+}
+var MAX_ARGUMENT_NAMES = 64, MAX_ARGUMENT_NAME_CHARS = 64, MAX_SUBSTITUTION_OUTPUT_CHARS = 1e6, INDEXED_PLACEHOLDER_RE, SHORTHAND_PLACEHOLDER_RE;
 var init_argumentSubstitution = __esm(() => {
   init_bash();
+  INDEXED_PLACEHOLDER_RE = /\$ARGUMENTS\[(\d+)\]/y;
+  SHORTHAND_PLACEHOLDER_RE = /\$(\d+)/y;
 });
 
 // src/engine/skill/skillModel.ts
@@ -76931,7 +77165,7 @@ function parseSkillFrontmatterFields(frontmatter, markdownContent, resolvedName,
     logForDebugging(`Skill ${resolvedName} has invalid effort '${effortRaw}'. Valid options: ${EFFORT_LEVELS.join(", ")} or an integer`);
   }
   return {
-    displayName: frontmatter.name != null ? String(frontmatter.name) : undefined,
+    displayName: sanitizeDisplayName(frontmatter.name != null ? String(frontmatter.name) : undefined, resolvedName),
     description,
     hasUserSpecifiedDescription: validatedDescription !== null,
     allowedTools: parseSlashCommandToolsFromFrontmatter(frontmatter["allowed-tools"]),
@@ -77042,6 +77276,7 @@ var init_skillCommand = __esm(() => {
   init_frontmatterFields();
   init_markdownLoader();
   init_skillModel();
+  init_commandNameSafety();
   init_promptShellExecution();
 });
 
@@ -77081,6 +77316,10 @@ async function loadSkillsFromSkillsDir(basePath, source) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) {
         return null;
       }
+      if (isUnsafeCommandName(entry.name)) {
+        logForDebugging(`[skills] skipping unsafe skill directory name: ${JSON.stringify(entry.name)}`);
+        return null;
+      }
       const skillDirPath = join32(basePath, entry.name);
       const skillFilePath = join32(skillDirPath, "SKILL.md");
       let content;
@@ -77189,6 +77428,10 @@ async function loadSkillsFromCommandsDir(cwd) {
           content,
           source
         });
+        if (isUnsafeCommandName(cmdName)) {
+          logForDebugging(`[skills] skipping unsafe command name: ${JSON.stringify(cmdName)}`);
+          continue;
+        }
         const parsed = parseSkillFrontmatterFields(frontmatter, content, cmdName, "Custom command");
         skills.push({
           skill: createSkillCommand({
@@ -77228,6 +77471,7 @@ var init_loadSkillsDir = __esm(() => {
   init_memory();
   init_config();
   init_messaging();
+  init_commandNameSafety();
   init_gitignore();
   init_markdownLoader();
   init_skillCommand();
@@ -77643,6 +77887,7 @@ var init_pluginIdentifier = __esm(() => {
 
 // src/engine/skill/index.ts
 var init_skill = __esm(() => {
+  init_commandNameSafety();
   init_frontmatterFields();
   init_argumentSubstitution();
   init_skillModel();
@@ -77696,6 +77941,14 @@ import { randomUUID as randomUUID14 } from "crypto";
 async function getAllCommands() {
   return getCommands(process.cwd());
 }
+function buildUnknownSkillMessage(skillName, commands) {
+  const available = commands.filter((c) => !c.isHidden && !c.disableModelInvocation).map((c) => c.userFacingName?.() ?? c.name);
+  if (available.length === 0)
+    return `Unknown skill: ${skillName}`;
+  const listed = available.slice(0, MAX_UNKNOWN_SKILL_SUGGESTIONS);
+  const more = available.length - listed.length;
+  return `Unknown skill: ${skillName}. Available skills: ${listed.join(", ")}${more > 0 ? ` (and ${more} more)` : ""}`;
+}
 function getToolUseIDFromParentMessage(parentMessage, toolName) {
   if (!parentMessage)
     return;
@@ -77763,7 +78016,7 @@ function skillHasOnlySafeProperties(command) {
   }
   return true;
 }
-var SKILL_TOOL_INPUT_SCHEMA, SAFE_SKILL_PROPERTIES, SkillTool;
+var SKILL_TOOL_INPUT_SCHEMA, MAX_UNKNOWN_SKILL_SUGGESTIONS = 10, SAFE_SKILL_PROPERTIES, SkillTool;
 var init_skillTool = __esm(() => {
   init_shared();
   init_permissions3();
@@ -77935,7 +78188,7 @@ var init_skillTool = __esm(() => {
       if (!foundCommand) {
         return {
           result: false,
-          message: `Unknown skill: ${normalizedCommandName}`,
+          message: buildUnknownSkillMessage(normalizedCommandName, commands),
           errorCode: 2
         };
       }
@@ -79050,6 +79303,24 @@ function classifyToolError(error) {
   return "UnknownError";
 }
 
+// src/engine/pipeline/sanitizeUpdatedInput.ts
+function isPlainObject3(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function sanitizeUpdatedInput(originalInput, updatedInput) {
+  if (!isPlainObject3(originalInput) || !isPlainObject3(updatedInput)) {
+    return originalInput;
+  }
+  const result = {};
+  for (const key of Object.keys(originalInput)) {
+    result[key] = key in updatedInput ? updatedInput[key] : originalInput[key];
+  }
+  return result;
+}
+
 // src/engine/pipeline/schemaValidation.ts
 function typeName(v) {
   if (v === null)
@@ -79210,7 +79481,7 @@ async function runWithToolHeartbeat(opts, fn) {
 var DEFAULT_TOOL_HEARTBEAT_INTERVAL_MS = 30000, MIN_TOOL_HEARTBEAT_INTERVAL_MS = 100;
 
 // src/engine/pipeline/toolExecution.ts
-function mergeHookPermission(hookBehavior, gate, hookReason) {
+function mergeHookPermission(hookBehavior, gate, hookReason, hookSource) {
   if (hookBehavior === "defer") {
     return {
       allowed: false,
@@ -79224,7 +79495,8 @@ function mergeHookPermission(hookBehavior, gate, hookReason) {
   if (!gate.allowed)
     return gate;
   if (hookBehavior === "ask") {
-    return { allowed: false, ask: true, reason: "hook requested confirmation" };
+    const reason = hookSource && hookSource !== "settings" ? `hook requested confirmation (from ${hookSource})` : "hook requested confirmation";
+    return { allowed: false, ask: true, reason };
   }
   return gate;
 }
@@ -79295,12 +79567,12 @@ async function executeToolUse(tu, assistantMsg, deps) {
       isError: true
     };
   }
-  const effectiveInput = preOutcome?.updatedInput ?? tu.input;
+  const effectiveInput = preOutcome?.updatedInput !== undefined ? sanitizeUpdatedInput(tu.input, preOutcome.updatedInput) : tu.input;
   const gateVerdict = deps.checkPermission ? await deps.checkPermission(tool, effectiveInput, {
     toolUseId: tu.id,
     assistantMessage: assistantMsg
   }) : { allowed: true };
-  const verdict = mergeHookPermission(preOutcome?.hookBehavior, gateVerdict, preOutcome?.hookPermissionDecisionReason);
+  const verdict = mergeHookPermission(preOutcome?.hookBehavior, gateVerdict, preOutcome?.hookPermissionDecisionReason, preOutcome?.hookSource);
   if (verdict.deferred) {
     return { deferred: true, deferReason: verdict.reason, isError: false };
   }
@@ -83302,6 +83574,7 @@ function createToolHooks(opts = {}) {
         updatedInput: r.updatedInput,
         hookBehavior: r.permissionBehavior,
         hookPermissionDecisionReason: r.permissionDecisionReason,
+        hookSource: r.permissionDecisionSource,
         preventContinuation: r.preventContinuation,
         stopReason: r.stopReason
       };
@@ -83590,6 +83863,7 @@ var init_state2 = () => {};
 var init_hooks2 = __esm(() => {
   init_toolHooks();
   init_hooks();
+  init_hooks();
 });
 
 // src/engine/goal/goalCheckIn.ts
@@ -83678,6 +83952,7 @@ var init_engine = __esm(() => {
   init_permissions4();
   init_hooks2();
   init_hooks2();
+  init_hooks2();
   init_config();
   init_messaging();
   init_messaging();
@@ -87105,6 +87380,19 @@ var init_hooksWiring = __esm(() => {
   init_hooks();
 });
 
+// src/cli/headlessSessionEnd.ts
+async function runHeadlessSessionEndHooks(reason) {
+  try {
+    await runSessionEndHooks(reason);
+  } catch (error) {
+    logForDebugging2(`SessionEnd hooks (headless exit, reason=${reason}) failed: ${String(error)}`, { level: "error" });
+  }
+}
+var init_headlessSessionEnd = __esm(() => {
+  init_hooks();
+  init_debugSink();
+});
+
 // src/cli/print.ts
 import { randomUUID as randomUUID21 } from "crypto";
 import { readFile as readFile12 } from "node:fs/promises";
@@ -87864,6 +88152,7 @@ async function runHeadless(inputPrompt, options) {
     cronScheduler.stop();
     await drainToOutput();
     await drainPendingBackgroundAgents(abortController.signal);
+    await runHeadlessSessionEndHooks("prompt_input_exit");
   } catch (error) {
     cronScheduler.stop();
     logForDebugging2(headlessErrorLine(error), { level: "error" });
@@ -87882,6 +88171,7 @@ async function runHeadless(inputPrompt, options) {
       });
     } catch {}
     abortController.abort();
+    await runHeadlessSessionEndHooks("other");
     process.exitCode = 1;
   }
   await flushDebugSink();
@@ -87932,6 +88222,7 @@ var init_print = __esm(() => {
   init_headlessPrompt();
   init_debugSink();
   init_hooksWiring();
+  init_headlessSessionEnd();
 });
 
 // src/cli/handlers/update.ts
@@ -89320,7 +89611,7 @@ var init_cli = __esm(() => {
 });
 
 // node_modules/is-plain-obj/index.js
-function isPlainObject3(value) {
+function isPlainObject4(value) {
   if (typeof value !== "object" || value === null) {
     return false;
   }
@@ -89342,7 +89633,7 @@ var init_file_url = () => {};
 // node_modules/execa/lib/methods/parameters.js
 var normalizeParameters = (rawFile, rawArguments = [], rawOptions = {}) => {
   const filePath = safeNormalizeFileUrl(rawFile, "First argument");
-  const [commandArguments, options] = isPlainObject3(rawArguments) ? [[], rawArguments] : [rawArguments, rawOptions];
+  const [commandArguments, options] = isPlainObject4(rawArguments) ? [[], rawArguments] : [rawArguments, rawOptions];
   if (!Array.isArray(commandArguments)) {
     throw new TypeError(`Second argument must be either an array of arguments or an options object: ${commandArguments}`);
   }
@@ -89354,7 +89645,7 @@ var normalizeParameters = (rawFile, rawArguments = [], rawOptions = {}) => {
   if (nullByteArgument !== undefined) {
     throw new TypeError(`Arguments cannot contain null bytes ("\\0"): ${nullByteArgument}`);
   }
-  if (!isPlainObject3(options)) {
+  if (!isPlainObject4(options)) {
     throw new TypeError(`Last argument must be an options object: ${options}`);
   }
   return [filePath, normalizedArguments, { __proto__: null, ...options }];
@@ -89476,7 +89767,7 @@ var isTemplateString = (templates) => Array.isArray(templates) && Array.isArray(
   if (typeOfExpression === "number") {
     return String(expression);
   }
-  if (isPlainObject3(expression) && (("stdout" in expression) || ("isMaxBuffer" in expression))) {
+  if (isPlainObject4(expression) && (("stdout" in expression) || ("isMaxBuffer" in expression))) {
     return getSubprocessResult(expression);
   }
   if (expression instanceof ChildProcess || Object.prototype.toString.call(expression) === "[object Promise]") {
@@ -89523,7 +89814,7 @@ var normalizeFdSpecificOptions = (options) => {
   const optionBaseArray = Array.from({ length: stdioLength + 1 });
   const optionArray = normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName, stdioLength);
   return addDefaultValue(optionArray, optionName);
-}, getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length, normalizeFdSpecificValue = (optionValue, optionArray, optionName, stdioLength) => isPlainObject3(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName, stdioLength) : optionArray.fill(optionValue), normalizeOptionObject = (optionValue, optionArray, optionName, stdioLength) => {
+}, getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length, normalizeFdSpecificValue = (optionValue, optionArray, optionName, stdioLength) => isPlainObject4(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName, stdioLength) : optionArray.fill(optionValue), normalizeOptionObject = (optionValue, optionArray, optionName, stdioLength) => {
   for (const fdName of Object.keys(optionValue).sort(compareFdName)) {
     for (const fdNumber of parseFdName(fdName, optionName, stdioLength)) {
       optionArray[fdNumber] = optionValue[fdName];
@@ -92770,7 +93061,7 @@ var getStdioItemType = (value, optionName) => {
   if (value !== undefined && typeof value !== "boolean") {
     throw new TypeError(`The \`${optionName}\` option must use a boolean.`);
   }
-}, isGenerator = (value) => isAsyncGenerator(value) || isSyncGenerator(value), isAsyncGenerator = (value) => Object.prototype.toString.call(value) === "[object AsyncGeneratorFunction]", isSyncGenerator = (value) => Object.prototype.toString.call(value) === "[object GeneratorFunction]", isTransformOptions = (value) => isPlainObject3(value) && (value.transform !== undefined || value.final !== undefined), isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]", isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:", isFilePathObject = (value) => isPlainObject3(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file), FILE_PATH_KEYS, isFilePathString = (file) => typeof file === "string", isStdioValueObject = (value) => isPlainObject3(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => STDIO_VALUE_KEYS.has(key)) && ("value" in value), STDIO_VALUE_KEYS, isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value), KNOWN_STDIO_STRINGS, isReadableStream3 = (value) => Object.prototype.toString.call(value) === "[object ReadableStream]", isWritableStream2 = (value) => Object.prototype.toString.call(value) === "[object WritableStream]", isWebStream = (value) => isReadableStream3(value) || isWritableStream2(value), isTransformStream = (value) => isReadableStream3(value?.readable) && isWritableStream2(value?.writable), isAsyncIterableObject = (value) => isObject2(value) && typeof value[Symbol.asyncIterator] === "function", isIterableObject = (value) => isObject2(value) && typeof value[Symbol.iterator] === "function", isObject2 = (value) => typeof value === "object" && value !== null, TRANSFORM_TYPES, FILE_TYPES, SPECIAL_DUPLICATE_TYPES_SYNC, SPECIAL_DUPLICATE_TYPES, FORBID_DUPLICATE_TYPES, TYPE_TO_MESSAGE;
+}, isGenerator = (value) => isAsyncGenerator(value) || isSyncGenerator(value), isAsyncGenerator = (value) => Object.prototype.toString.call(value) === "[object AsyncGeneratorFunction]", isSyncGenerator = (value) => Object.prototype.toString.call(value) === "[object GeneratorFunction]", isTransformOptions = (value) => isPlainObject4(value) && (value.transform !== undefined || value.final !== undefined), isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]", isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:", isFilePathObject = (value) => isPlainObject4(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file), FILE_PATH_KEYS, isFilePathString = (file) => typeof file === "string", isStdioValueObject = (value) => isPlainObject4(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => STDIO_VALUE_KEYS.has(key)) && ("value" in value), STDIO_VALUE_KEYS, isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value), KNOWN_STDIO_STRINGS, isReadableStream3 = (value) => Object.prototype.toString.call(value) === "[object ReadableStream]", isWritableStream2 = (value) => Object.prototype.toString.call(value) === "[object WritableStream]", isWebStream = (value) => isReadableStream3(value) || isWritableStream2(value), isTransformStream = (value) => isReadableStream3(value?.readable) && isWritableStream2(value?.writable), isAsyncIterableObject = (value) => isObject2(value) && typeof value[Symbol.asyncIterator] === "function", isIterableObject = (value) => isObject2(value) && typeof value[Symbol.iterator] === "function", isObject2 = (value) => typeof value === "object" && value !== null, TRANSFORM_TYPES, FILE_TYPES, SPECIAL_DUPLICATE_TYPES_SYNC, SPECIAL_DUPLICATE_TYPES, FORBID_DUPLICATE_TYPES, TYPE_TO_MESSAGE;
 var init_type = __esm(() => {
   init_uint_array();
   FILE_PATH_KEYS = new Set(["file", "append"]);
@@ -92872,7 +93163,7 @@ var normalizeTransforms = (stdioItems, optionName, direction, options) => [
     value: { transform, writableObjectMode, readableObjectMode }
   };
 }, normalizeTransformStream = ({ stdioItem, stdioItem: { value }, index, newTransforms, direction }) => {
-  const { transform, objectMode } = isPlainObject3(value) ? value : { transform: value };
+  const { transform, objectMode } = isPlainObject4(value) ? value : { transform: value };
   const { writableObjectMode, readableObjectMode } = getTransformObjectModes(objectMode, index, newTransforms, direction);
   return {
     ...stdioItem,
@@ -92885,7 +93176,7 @@ var normalizeTransforms = (stdioItems, optionName, direction, options) => [
     binary: binaryOption = false,
     preserveNewlines = false,
     objectMode
-  } = isPlainObject3(value) ? value : { transform: value };
+  } = isPlainObject4(value) ? value : { transform: value };
   const binary = binaryOption || BINARY_ENCODINGS.has(encoding);
   const { writableObjectMode, readableObjectMode } = getTransformObjectModes(objectMode, index, newTransforms, direction);
   return {
@@ -95580,7 +95871,7 @@ var init_abort2 = __esm(() => {
 
 // node_modules/execa/lib/pipe/setup.js
 var pipeToSubprocess = (sourceInfo, ...pipeArguments) => {
-  if (isPlainObject3(pipeArguments[0])) {
+  if (isPlainObject4(pipeArguments[0])) {
     return pipeToSubprocess.bind(undefined, {
       ...sourceInfo,
       boundOptions: { ...sourceInfo.boundOptions, ...pipeArguments[0] }
@@ -96489,7 +96780,7 @@ var mergeOptions = (boundOptions, options) => {
   ]));
   return { ...safeBoundOptions, ...mergedOptions };
 }, mergeOption = (optionName, boundOptionValue, optionValue) => {
-  if (DEEP_OPTIONS.has(optionName) && isPlainObject3(boundOptionValue) && isPlainObject3(optionValue)) {
+  if (DEEP_OPTIONS.has(optionName) && isPlainObject4(boundOptionValue) && isPlainObject4(optionValue)) {
     return { ...boundOptionValue, ...optionValue };
   }
   return optionValue;
@@ -96514,7 +96805,7 @@ var createExeca = (mapArguments, boundOptions, deepOptions, setBoundExeca) => {
   }
   return boundExeca;
 }, callBoundExeca = ({ mapArguments, deepOptions = {}, boundOptions = {}, setBoundExeca, createNested }, firstArgument, ...nextArguments) => {
-  if (isPlainObject3(firstArgument)) {
+  if (isPlainObject4(firstArgument)) {
     return createNested(mapArguments, mergeOptions(boundOptions, firstArgument), setBoundExeca);
   }
   const { file, commandArguments, options, isSync } = parseArguments2({
@@ -98578,7 +98869,7 @@ var init_isArrayLikeObject = __esm(() => {
 });
 
 // node_modules/lodash-es/isPlainObject.js
-function isPlainObject4(value) {
+function isPlainObject5(value) {
   if (!isObjectLike_default(value) || _baseGetTag_default(value) != objectTag4) {
     return false;
   }
@@ -98599,7 +98890,7 @@ var init_isPlainObject = __esm(() => {
   funcToString3 = funcProto3.toString;
   hasOwnProperty11 = objectProto14.hasOwnProperty;
   objectCtorString = funcToString3.call(Object);
-  isPlainObject_default = isPlainObject4;
+  isPlainObject_default = isPlainObject5;
 });
 
 // node_modules/lodash-es/_safeGet.js
@@ -102730,9 +103021,9 @@ function merge2(...objs) {
     }
     const targetKey = caseless && typeof key === "string" && findKey(result, key) || key;
     const existing = hasOwnProperty14(result, targetKey) ? result[targetKey] : undefined;
-    if (isPlainObject5(existing) && isPlainObject5(val)) {
+    if (isPlainObject6(existing) && isPlainObject6(val)) {
       result[targetKey] = merge2(existing, val);
-    } else if (isPlainObject5(val)) {
+    } else if (isPlainObject6(val)) {
       result[targetKey] = merge2({}, val);
     } else if (isArray3(val)) {
       result[targetKey] = val.slice();
@@ -102835,7 +103126,7 @@ var toString3, getPrototypeOf, iterator, toStringTag, hasOwnProperty14, isUnsafe
 }, kindOf, kindOfTest = (type) => {
   type = type.toLowerCase();
   return (thing) => kindOf(thing) === type;
-}, typeOfTest = (type) => (thing) => typeof thing === type, isArray3, isUndefined, isArrayBuffer3, isString, isFunction2, isNumber, isObject4 = (thing) => thing !== null && typeof thing === "object", isBoolean = (thing) => thing === true || thing === false, isPlainObject5 = (val) => {
+}, typeOfTest = (type) => (thing) => typeof thing === type, isArray3, isUndefined, isArrayBuffer3, isString, isFunction2, isNumber, isObject4 = (thing) => thing !== null && typeof thing === "object", isBoolean = (thing) => thing === true || thing === false, isPlainObject6 = (val) => {
   if (!isObject4(val)) {
     return false;
   }
@@ -103111,7 +103402,7 @@ var init_utils3 = __esm(() => {
     isNumber,
     isBoolean,
     isObject: isObject4,
-    isPlainObject: isPlainObject5,
+    isPlainObject: isPlainObject6,
     isEmptyObject,
     isReadableStream: isReadableStream4,
     isRequest,
@@ -181149,6 +181440,7 @@ __export(exports_engineCompat, {
   MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES: () => MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES,
   MAX_GOAL_CHECKINS: () => MAX_GOAL_CHECKINS,
   MAX_GOAL_CONDITION_CHARS: () => MAX_GOAL_CONDITION_CHARS,
+  MAX_HOOK_CONCURRENCY: () => MAX_HOOK_CONCURRENCY,
   MAX_PTL_RETRIES: () => MAX_PTL_RETRIES,
   MAX_TRANSCRIPT_READ_BYTES: () => MAX_TRANSCRIPT_READ_BYTES,
   MAX_WORKER_SPAWN_DEPTH: () => MAX_WORKER_SPAWN_DEPTH,
@@ -182435,11 +182727,12 @@ function parseArgumentNames2(argumentNames) {
     return [];
   }
   const isValidName = (name) => typeof name === "string" && name.trim() !== "" && !/^\d+$/.test(name);
+  const cap = (names) => names.map((name) => name.slice(0, MAX_ARGUMENT_NAME_CHARS2)).slice(0, MAX_ARGUMENT_NAMES2);
   if (Array.isArray(argumentNames)) {
-    return argumentNames.filter(isValidName);
+    return cap(argumentNames.filter(isValidName));
   }
   if (typeof argumentNames === "string") {
-    return argumentNames.split(/\s+/).filter(isValidName);
+    return cap(argumentNames.split(/\s+/).filter(isValidName));
   }
   return [];
 }
@@ -182449,36 +182742,144 @@ function generateProgressiveArgumentHint2(argNames, typedArgs) {
     return;
   return remaining.map((name) => `[${name}]`).join(" ");
 }
-function substituteArguments2(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+function isWordChar3(c) {
+  return c !== undefined && /[A-Za-z0-9_]/.test(c);
+}
+function matchPlaceholderAt2(content, i, argumentNames) {
+  if (content[i] !== "$")
+    return null;
+  for (let n = 0;n < argumentNames.length; n++) {
+    const name = argumentNames[n];
+    if (!name)
+      continue;
+    if (content.startsWith(`$${name}`, i)) {
+      const after = content[i + 1 + name.length];
+      if (after !== "[" && !isWordChar3(after)) {
+        return { length: 1 + name.length, kind: "named", nameIndex: n };
+      }
+    }
+  }
+  INDEXED_PLACEHOLDER_RE2.lastIndex = i;
+  const indexed = INDEXED_PLACEHOLDER_RE2.exec(content);
+  if (indexed) {
+    return {
+      length: indexed[0].length,
+      kind: "indexed",
+      argIndex: parseInt(indexed[1], 10)
+    };
+  }
+  if (content.startsWith("$ARGUMENTS", i)) {
+    return { length: "$ARGUMENTS".length, kind: "bare" };
+  }
+  SHORTHAND_PLACEHOLDER_RE2.lastIndex = i;
+  const shorthand = SHORTHAND_PLACEHOLDER_RE2.exec(content);
+  if (shorthand && !isWordChar3(content[i + shorthand[0].length])) {
+    return {
+      length: shorthand[0].length,
+      kind: "shorthand",
+      argIndex: parseInt(shorthand[1], 10)
+    };
+  }
+  return null;
+}
+function countPlaceholderOccurrences2(content, argumentNames) {
+  let count = 0;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt2(content, i, argumentNames);
+    if (m) {
+      count++;
+      i += m.length;
+    } else {
+      i++;
+    }
+  }
+  return count;
+}
+function substituteArgumentsImpl2(content, args, appendIfNoPlaceholder, argumentNames, strict) {
   if (args === undefined || args === null) {
     return content;
   }
-  const parsedArgs = parseArguments3(args);
-  const originalContent = content;
-  for (let i = 0;i < argumentNames.length; i++) {
-    const name = argumentNames[i];
-    if (!name)
-      continue;
-    content = content.replace(new RegExp(`\\$${name}(?![\\[\\w])`, "g"), parsedArgs[i] ?? "");
+  const placeholderCount = countPlaceholderOccurrences2(content, argumentNames);
+  let effectiveArgs = args;
+  if (placeholderCount > 0 && content.length + placeholderCount * args.length > MAX_SUBSTITUTION_OUTPUT_CHARS2) {
+    if (strict)
+      return null;
+    const budgetPerReplacement = Math.max(0, Math.floor((MAX_SUBSTITUTION_OUTPUT_CHARS2 - content.length) / placeholderCount));
+    effectiveArgs = args.slice(0, budgetPerReplacement);
+  } else if (strict) {
+    const appendLen = appendIfNoPlaceholder && args ? `
+
+ARGUMENTS: `.length + args.length : 0;
+    if (content.length + appendLen > MAX_SUBSTITUTION_OUTPUT_CHARS2) {
+      return null;
+    }
   }
-  content = content.replace(/\$ARGUMENTS\[(\d+)\]/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replace(/\$(\d+)(?!\w)/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replaceAll("$ARGUMENTS", args);
-  if (content === originalContent && appendIfNoPlaceholder && args) {
-    content = content + `
+  const parsedArgs = parseArguments3(effectiveArgs);
+  let out = "";
+  const appendValue = (value) => {
+    if (out.length + value.length > MAX_SUBSTITUTION_OUTPUT_CHARS2) {
+      value = value.slice(0, Math.max(0, MAX_SUBSTITUTION_OUTPUT_CHARS2 - out.length));
+    }
+    out += value;
+  };
+  let matched = false;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt2(content, i, argumentNames);
+    if (m) {
+      matched = true;
+      if (m.kind === "bare")
+        appendValue(effectiveArgs);
+      else if (m.kind === "named")
+        appendValue(parsedArgs[m.nameIndex] ?? "");
+      else
+        appendValue(parsedArgs[m.argIndex] ?? "");
+      i += m.length;
+    } else {
+      out += content[i];
+      i++;
+    }
+  }
+  if (!matched && appendIfNoPlaceholder && args) {
+    out = out + `
 
 ARGUMENTS: ${args}`;
   }
-  return content;
+  return out;
 }
+function substituteArguments2(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+  return substituteArgumentsImpl2(content, args, appendIfNoPlaceholder, argumentNames, false) ?? content;
+}
+function substituteArgumentsStrict2(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+  return substituteArgumentsImpl2(content, args, appendIfNoPlaceholder, argumentNames, true);
+}
+var MAX_ARGUMENT_NAMES2 = 64, MAX_ARGUMENT_NAME_CHARS2 = 64, MAX_SUBSTITUTION_OUTPUT_CHARS2 = 1e6, INDEXED_PLACEHOLDER_RE2, SHORTHAND_PLACEHOLDER_RE2;
 var init_argumentSubstitution2 = __esm(() => {
   init_shellQuote2();
+  INDEXED_PLACEHOLDER_RE2 = /\$ARGUMENTS\[(\d+)\]/y;
+  SHORTHAND_PLACEHOLDER_RE2 = /\$(\d+)/y;
+});
+
+// src/tui/utils/commandNameSafety.ts
+function isUnsafeCommandName2(name) {
+  if (name === "")
+    return true;
+  if (name.includes("<") || name.includes(">"))
+    return true;
+  return UNSAFE_NAME_CHARS_RE2.test(name);
+}
+function sanitizeDisplayName2(displayName, canonicalName) {
+  if (displayName === undefined || !isUnsafeCommandName2(displayName)) {
+    return displayName;
+  }
+  logForDebugging3(`Discarding unsafe frontmatter display name ${JSON.stringify(displayName)} for ${canonicalName}; falling back to canonical name`);
+  return;
+}
+var UNSAFE_NAME_CHARS_RE2;
+var init_commandNameSafety2 = __esm(() => {
+  init_debug();
+  UNSAFE_NAME_CHARS_RE2 = /[\u0000-\u001F\u007F-\u00A0\u00AD\u034F\u061C\u070F\u1680\u180E\u2000-\u200F\u2028\u2029\u202A-\u202E\u202F\u205F\u2060-\u2069\u3000\uFE00-\uFE0F\uFEFF\u{E0100}-\u{E01EF}]/u;
 });
 
 // src/tui/utils/generatedFiles.ts
@@ -184911,7 +185312,7 @@ class Protocol {
     };
   }
 }
-function isPlainObject6(value) {
+function isPlainObject7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeCapabilities(base, additional) {
@@ -184922,7 +185323,7 @@ function mergeCapabilities(base, additional) {
     if (addValue === undefined)
       continue;
     const baseValue = result[k];
-    if (isPlainObject6(baseValue) && isPlainObject6(addValue)) {
+    if (isPlainObject7(baseValue) && isPlainObject7(addValue)) {
       result[k] = { ...baseValue, ...addValue };
     } else {
       result[k] = addValue;
@@ -201476,10 +201877,10 @@ function parseProxyResponse(socket) {
     read();
   });
 }
-var import_debug53, debug;
+var import_debug54, debug;
 var init_parse_proxy_response = __esm(() => {
-  import_debug53 = __toESM(require_src(), 1);
-  debug = import_debug53.default("https-proxy-agent:parse-proxy-response");
+  import_debug54 = __toESM(require_src(), 1);
+  debug = import_debug54.default("https-proxy-agent:parse-proxy-response");
 });
 
 // node_modules/proxy-agent-negotiate/dist/index.js
@@ -201532,7 +201933,7 @@ function omit2(obj, ...keys) {
   }
   return ret;
 }
-var import_debug54, debug2, setServernameFromNonIpHost = (options) => {
+var import_debug55, debug2, setServernameFromNonIpHost = (options) => {
   if (options.servername === undefined && options.host && !net2.isIP(options.host)) {
     return {
       ...options,
@@ -201544,8 +201945,8 @@ var import_debug54, debug2, setServernameFromNonIpHost = (options) => {
 var init_dist7 = __esm(() => {
   init_dist6();
   init_parse_proxy_response();
-  import_debug54 = __toESM(require_src(), 1);
-  debug2 = import_debug54.default("https-proxy-agent");
+  import_debug55 = __toESM(require_src(), 1);
+  debug2 = import_debug55.default("https-proxy-agent");
   HttpsProxyAgent2 = class HttpsProxyAgent2 extends Agent2 {
     constructor(proxy, opts) {
       super(opts);
@@ -263020,6 +263421,9 @@ function convertToHookMatchers(sessionMatchers) {
   return sessionMatchers.map((sm) => ({
     matcher: sm.matcher,
     skillRoot: sm.skillRoot,
+    pluginRoot: sm.pluginRoot,
+    pluginName: sm.pluginName,
+    pluginId: sm.pluginId,
     hooks: sm.hooks.map((h) => h.hook).filter((h) => h.type !== "function")
   }));
 }
@@ -273799,6 +274203,19 @@ async function toArray2(generator) {
   }
   return result;
 }
+async function runWithConcurrencyLimit(tasks, limit) {
+  const results = new Array(tasks.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < tasks.length) {
+      const index = next++;
+      results[index] = await tasks[index]();
+    }
+  };
+  const workers = Math.max(1, Math.min(limit, tasks.length));
+  await Promise.all(Array.from({ length: workers }, worker));
+  return results;
+}
 var NO_VALUE;
 var init_generators = __esm(() => {
   NO_VALUE = Symbol("NO_VALUE");
@@ -303702,11 +304119,11 @@ function byteAt2(L, charIdx) {
   L.byteTable = t;
   return t[charIdx];
 }
-function isWordChar2(c) {
+function isWordChar4(c) {
   return c >= "a" && c <= "z" || c >= "A" && c <= "Z" || c >= "0" && c <= "9" || c === "_" || c === "/" || c === "." || c === "-" || c === "+" || c === ":" || c === "@" || c === "%" || c === "," || c === "~" || c === "^" || c === "?" || c === "*" || c === "!" || c === "=" || c === "[" || c === "]";
 }
 function isWordStart2(c) {
-  return isWordChar2(c) || c === "\\";
+  return isWordChar4(c) || c === "\\";
 }
 function isIdentStart2(c) {
   return c >= "a" && c <= "z" || c >= "A" && c <= "Z" || c === "_";
@@ -304016,7 +304433,7 @@ function nextToken2(L, ctx = "arg") {
         advance2(L);
         continue;
       }
-      if (!isWordChar2(ch) && ch !== "{" && ch !== "}") {
+      if (!isWordChar4(ch) && ch !== "{" && ch !== "}") {
         break;
       }
       advance2(L);
@@ -325621,7 +326038,7 @@ function parseSkillFrontmatterFields2(frontmatter, markdownContent, resolvedName
     logForDebugging3(`Skill ${resolvedName} has invalid effort '${effortRaw}'. Valid options: ${EFFORT_LEVELS2.join(", ")} or an integer`);
   }
   return {
-    displayName: frontmatter.name != null ? String(frontmatter.name) : undefined,
+    displayName: sanitizeDisplayName2(frontmatter.name != null ? String(frontmatter.name) : undefined, resolvedName),
     description,
     hasUserSpecifiedDescription: validatedDescription !== null,
     allowedTools: parseSlashCommandToolsFromFrontmatter2(frontmatter["allowed-tools"]),
@@ -325737,6 +326154,10 @@ async function loadSkillsFromSkillsDir2(basePath, source) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) {
         return null;
       }
+      if (isUnsafeCommandName2(entry.name)) {
+        logForDebugging3(`[skills] skipping unsafe skill directory name: ${JSON.stringify(entry.name)}`);
+        return null;
+      }
       const skillDirPath = join108(basePath, entry.name);
       const skillFilePath = join108(skillDirPath, "SKILL.md");
       let content;
@@ -325847,6 +326268,10 @@ async function loadSkillsFromCommandsDir2(cwd) {
           content,
           source
         });
+        if (isUnsafeCommandName2(cmdName)) {
+          logForDebugging3(`[skills] skipping unsafe command name: ${JSON.stringify(cmdName)}`);
+          continue;
+        }
         const parsed = parseSkillFrontmatterFields2(frontmatter, content, cmdName, "Custom command");
         skills.push({
           skill: createSkillCommand2({
@@ -325985,6 +326410,7 @@ var init_loadSkillsDir2 = __esm(() => {
   init_bootstrapState();
   init_tokenEstimation();
   init_argumentSubstitution2();
+  init_commandNameSafety2();
   init_debug();
   init_effort2();
   init_envUtils2();
@@ -330406,7 +330832,7 @@ function createPluginCommand(commandName, file, sourceName, pluginManifest, plug
     const argumentNames = parseArgumentNames2(frontmatter.arguments);
     const whenToUse = frontmatter["when-to-use"] ?? frontmatter.when_to_use;
     const version = frontmatter.version;
-    const displayName = frontmatter.name;
+    const displayName = sanitizeDisplayName2(frontmatter.name, commandName);
     const model = frontmatter.model === "inherit" ? undefined : frontmatter.model ? parseUserSpecifiedModel2(frontmatter.model) : undefined;
     const effortRaw = frontmatter["effort"];
     const effort = effortRaw !== undefined ? parseEffortValue2(effortRaw) : undefined;
@@ -330591,6 +331017,7 @@ var init_loadPluginCommands = __esm(() => {
   init_bootstrapState();
   init_argumentSubstitution2();
   init_debug();
+  init_commandNameSafety2();
   init_effort2();
   init_envUtils2();
   init_errors4();
@@ -330742,8 +331169,15 @@ var init_loadPluginCommands = __esm(() => {
       return pluginCommands;
     }));
     const allCommands = perPluginCommands.flat();
-    logForDebugging3(`Total plugin commands loaded: ${allCommands.length}`);
-    return allCommands;
+    const safeCommands = allCommands.filter((cmd) => {
+      if (isUnsafeCommandName2(cmd.name)) {
+        logForDebugging3(`Skipping unsafe plugin command name: ${JSON.stringify(cmd.name)}`);
+        return false;
+      }
+      return true;
+    });
+    logForDebugging3(`Total plugin commands loaded: ${safeCommands.length}`);
+    return safeCommands;
   });
   getPluginSkills = memoize_default(async () => {
     if (isBareMode() && getInlinePlugins().length === 0) {
@@ -330788,8 +331222,15 @@ var init_loadPluginCommands = __esm(() => {
       return pluginSkills;
     }));
     const allSkills = perPluginSkills.flat();
-    logForDebugging3(`Total plugin skills loaded: ${allSkills.length}`);
-    return allSkills;
+    const safeSkills = allSkills.filter((cmd) => {
+      if (isUnsafeCommandName2(cmd.name)) {
+        logForDebugging3(`Skipping unsafe plugin skill name: ${JSON.stringify(cmd.name)}`);
+        return false;
+      }
+      return true;
+    });
+    logForDebugging3(`Total plugin skills loaded: ${safeSkills.length}`);
+    return safeSkills;
   });
 });
 
@@ -335812,6 +336253,12 @@ function mergePluginSources(sources) {
   const marketplacePlugins = sources.marketplace.filter((p) => {
     if (sessionNames.has(p.name)) {
       logForDebugging3(`Plugin "${p.name}" from --plugin-dir overrides installed version`);
+      errors.push({
+        type: "generic-error",
+        source: p.source,
+        plugin: p.name,
+        error: `Installed plugin "${p.name}" excluded (hooks and commands inactive) — overridden by --plugin-dir copy of the same name`
+      });
       return false;
     }
     return true;
@@ -337818,8 +338265,9 @@ function handleMessageFromStream(message, onMessage, onUpdateLength, onSetStream
   }
 }
 function wrapInSystemReminder(content) {
+  const neutralized = content.replaceAll("</system-reminder>", "&lt;/system-reminder&gt;").replaceAll("<system-reminder>", "&lt;system-reminder&gt;");
   return `<system-reminder>
-${content}
+${neutralized}
 </system-reminder>`;
 }
 function wrapMessagesInSystemReminder(messages) {
@@ -340428,6 +340876,16 @@ async function hasPermissionsToUseToolInner(tool, input, context) {
     throw new AbortError2;
   }
   let appState = context.getAppState();
+  if (appState.toolPermissionContext.mode === "plan" && !appState.toolPermissionContext.isBypassPermissionsModeAvailable && !PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES2.has(tool.name) && !(tool.isReadOnly?.(input) ?? false)) {
+    return {
+      behavior: "deny",
+      message: PLAN_MODE_WRITE_DENIED_MESSAGE2(tool.name),
+      decisionReason: {
+        type: "mode",
+        mode: "plan"
+      }
+    };
+  }
   const denyRule = getDenyRuleForTool2(appState.toolPermissionContext, tool);
   if (denyRule) {
     return {
@@ -340608,7 +341066,7 @@ function syncPermissionRulesFromDisk2(toolPermissionContext, rules) {
 function getUpdatedInputOrFallback2(permissionResult, fallback) {
   return ("updatedInput" in permissionResult ? permissionResult.updatedInput : undefined) ?? fallback;
 }
-var classifierDecisionModule, autoModeStateModule3, CLASSIFIER_FAIL_CLOSED_REFRESH_MS, PERMISSION_RULE_SOURCES2, hasPermissionsToUseTool2 = async (tool, input, context, assistantMessage, toolUseID) => {
+var PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES2, PLAN_MODE_WRITE_DENIED_MESSAGE2 = (toolName) => `Plan mode is active — ${toolName} is not allowed to make changes. ` + `Present your plan and use ExitPlanMode, or ask the user to change the permission mode.`, classifierDecisionModule, autoModeStateModule3, CLASSIFIER_FAIL_CLOSED_REFRESH_MS, PERMISSION_RULE_SOURCES2, hasPermissionsToUseTool2 = async (tool, input, context, assistantMessage, toolUseID) => {
   const result = await hasPermissionsToUseToolInner(tool, input, context);
   if (result.behavior === "allow") {
     const appState = context.getAppState();
@@ -340841,6 +341299,10 @@ var init_permissions6 = __esm(() => {
   init_slowOperations();
   init_denialTracking();
   init_yoloClassifier();
+  PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES2 = new Set([
+    "EnterPlanMode",
+    "ExitPlanMode"
+  ]);
   classifierDecisionModule = feature("TRANSCRIPT_CLASSIFIER") ? (init_classifierDecision(), __toCommonJS(exports_classifierDecision)) : null;
   autoModeStateModule3 = feature("TRANSCRIPT_CLASSIFIER") ? __toCommonJS(exports_autoModeState) : null;
   CLASSIFIER_FAIL_CLOSED_REFRESH_MS = 30 * 60 * 1000;
@@ -405071,6 +405533,8 @@ async function searchSkillsAcrossMarketplaces(query) {
         for (const d of dirEntries) {
           if (!d.isDirectory())
             continue;
+          if (isUnsafeCommandName2(d.name))
+            continue;
           const skillFile = join146(skillDir, d.name, "SKILL.md");
           if (seen.has(skillFile))
             continue;
@@ -405082,7 +405546,7 @@ async function searchSkillsAcrossMarketplaces(query) {
             continue;
           }
           const { frontmatter, content: markdown } = parseFrontmatter2(content);
-          const resolvedName = typeof frontmatter.name === "string" ? frontmatter.name : d.name;
+          const resolvedName = d.name;
           const parsed = parseSkillFrontmatterFields2(frontmatter, markdown, resolvedName);
           const installId = createPluginId(entry.name, marketplaceName);
           const skill = {
@@ -405107,6 +405571,7 @@ async function searchSkillsAcrossMarketplaces(query) {
   return results;
 }
 var init_skillSearch = __esm(() => {
+  init_commandNameSafety2();
   init_frontmatterParser2();
   init_loadSkillsDir2();
   init_marketplaceHelpers();
@@ -412471,7 +412936,7 @@ var call45 = async (_args, _context) => {
   reloadSkillsNow();
   return {
     type: "text",
-    value: "Re-scanned skill directories; in-session skill registry refreshed (new/removed/changed skills now active without restart)."
+    value: "Re-scanned skill directories; in-session skill registry refreshed (new/removed/changed skills now active without restart). The complete skill list will be re-sent to the model with your next message."
   };
 };
 var init_reload_skills = __esm(() => {
@@ -428505,9 +428970,144 @@ var init_combinedAbortSignal = __esm(() => {
   init_abortController2();
 });
 
+// src/tui/utils/hooks/hookInputDepth.ts
+function exceedsMaxNestingDepth(value) {
+  const stack = [[value, 0]];
+  const visited = new WeakSet;
+  while (stack.length > 0) {
+    const [v, depth] = stack.pop();
+    if (depth > MAX_HOOK_INPUT_NESTING_DEPTH)
+      return true;
+    if (v === null || typeof v !== "object")
+      continue;
+    if (visited.has(v))
+      continue;
+    visited.add(v);
+    let children;
+    try {
+      children = Array.isArray(v) ? v : Object.values(v);
+    } catch {
+      continue;
+    }
+    for (const child of children) {
+      stack.push([child, depth + 1]);
+    }
+  }
+  return false;
+}
+var MAX_HOOK_INPUT_NESTING_DEPTH = 28000;
+
+// src/tui/utils/hooks/hookInputMaterialize.ts
+function materializeHookInput(value) {
+  if (value === null || typeof value !== "object") {
+    return { ok: true, value, droppedKeys: [] };
+  }
+  const droppedKeys = [];
+  const visited = new WeakMap;
+  const root = Array.isArray(value) ? [] : {};
+  visited.set(value, root);
+  const stack = [{ src: value, target: root }];
+  while (stack.length > 0) {
+    const { src, target } = stack.pop();
+    let keys;
+    try {
+      keys = Object.keys(src);
+    } catch {
+      droppedKeys.push("<enumeration-failed>");
+      continue;
+    }
+    for (const key of keys) {
+      let child;
+      try {
+        child = src[key];
+      } catch {
+        droppedKeys.push(key);
+        continue;
+      }
+      if (child === null || typeof child !== "object") {
+        target[key] = child;
+      } else if (visited.has(child)) {
+        target[key] = "[Circular]";
+      } else {
+        const childClone = Array.isArray(child) ? [] : {};
+        visited.set(child, childClone);
+        target[key] = childClone;
+        stack.push({ src: child, target: childClone });
+      }
+    }
+  }
+  return { ok: true, value: root, droppedKeys };
+}
+function stringifyWithGetterFallback(value) {
+  try {
+    return { ok: true, value: jsonStringify5(value), droppedKeys: [] };
+  } catch (error) {
+    const materialized = materializeHookInput(value);
+    if (materialized.ok === false)
+      return { ok: false, error };
+    try {
+      return {
+        ok: true,
+        value: jsonStringify5(materialized.value),
+        droppedKeys: materialized.droppedKeys
+      };
+    } catch {
+      return { ok: false, error };
+    }
+  }
+}
+var init_hookInputMaterialize = __esm(() => {
+  init_slowOperations();
+});
+
+// src/tui/utils/hooks/hookReentrancy.ts
+import { AsyncLocalStorage as AsyncLocalStorage8 } from "async_hooks";
+function getCallbackId(fn) {
+  let id = callbackIds.get(fn);
+  if (id === undefined) {
+    id = nextCallbackId++;
+    callbackIds.set(fn, id);
+  }
+  return id;
+}
+function getHookReentrancyKey(hookEvent, hook, pluginRoot) {
+  const h = hook;
+  const body = typeof h.callback === "function" ? `fn:${getCallbackId(h.callback)}` : String(h.command ?? h.prompt ?? h.url ?? "");
+  return `${hookEvent}:${String(h.type)}:${pluginRoot ?? ""}:${body}`;
+}
+function isReentrantHook(hookEvent, hook, pluginRoot) {
+  const inFlight = hookReentrancyStorage.getStore();
+  if (inFlight === undefined)
+    return false;
+  return inFlight.has(getHookReentrancyKey(hookEvent, hook, pluginRoot));
+}
+function runWithHookReentrancy(hookEvent, hook, pluginRoot, fn) {
+  const store = new Set(hookReentrancyStorage.getStore() ?? []);
+  store.add(getHookReentrancyKey(hookEvent, hook, pluginRoot));
+  return hookReentrancyStorage.run(store, fn);
+}
+var hookReentrancyStorage, callbackIds, nextCallbackId = 1;
+var init_hookReentrancy = __esm(() => {
+  hookReentrancyStorage = new AsyncLocalStorage8;
+  callbackIds = new WeakMap;
+});
+
+// src/tui/utils/hooks/hookFailClosed.ts
+function shouldFailClosePluginHook(hookEvent, pluginRoot) {
+  return pluginRoot !== undefined && GATE_EVENTS.has(hookEvent);
+}
+var GATE_EVENTS;
+var init_hookFailClosed = __esm(() => {
+  GATE_EVENTS = new Set([
+    "PreToolUse",
+    "UserPromptSubmit",
+    "PermissionRequest"
+  ]);
+});
+
 // src/tui/utils/hooks/hookHelpers.ts
 function addArgumentsToPrompt(prompt, jsonInput) {
-  return substituteArguments2(prompt, jsonInput);
+  return substituteArgumentsStrict2(prompt, jsonInput);
 }
 function createStructuredOutputTool() {
   return {
@@ -428555,6 +429155,19 @@ async function execPromptHook(hook, hookName, hookEvent, jsonInput, signal, tool
   const effectiveToolUseID = toolUseID || `hook-${randomUUID41()}`;
   try {
     const processedPrompt = addArgumentsToPrompt(hook.prompt, jsonInput);
+    if (processedPrompt === null) {
+      logForDebugging3(`Hooks: hook input exceeds substitution budget — blocking (fail-closed)`);
+      return {
+        hook,
+        outcome: "blocking",
+        blockingError: {
+          blockingError: "Hook input exceeds substitution budget; refusing to evaluate on truncated input",
+          command: hook.prompt
+        },
+        preventContinuation: true,
+        stopReason: "hook input exceeds substitution budget"
+      };
+    }
     logForDebugging3(`Hooks: Processing prompt hook with prompt: ${processedPrompt}`);
     const userMessage = createUserMessage2({ content: processedPrompt });
     const messagesToQuery = messages && messages.length > 0 ? [...messages, userMessage] : [userMessage];
@@ -428701,6 +429314,17 @@ async function execAgentHook(hook, hookName, hookEvent, jsonInput, signal, toolU
   const hookStartTime = Date.now();
   try {
     const processedPrompt = addArgumentsToPrompt(hook.prompt, jsonInput);
+    if (processedPrompt === null) {
+      logForDebugging3(`Hooks: hook input exceeds substitution budget — blocking (fail-closed)`);
+      return {
+        hook,
+        outcome: "blocking",
+        blockingError: {
+          blockingError: "Hook input exceeds substitution budget; refusing to verify on truncated input",
+          command: hook.prompt
+        }
+      };
+    }
     logForDebugging3(`Hooks: Processing agent hook with prompt: ${processedPrompt}`);
     const userMessage = createUserMessage2({ content: processedPrompt });
     const agentMessages = [userMessage];
@@ -429189,7 +429813,7 @@ import { randomUUID as randomUUID43 } from "crypto";
 function getSessionEndHookTimeoutMs() {
   const raw = process.env.ATLAS_SESSIONEND_HOOKS_TIMEOUT_MS;
   const parsed = raw ? parseInt(raw, 10) : NaN;
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : SESSION_END_HOOK_TIMEOUT_MS_DEFAULT;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : SESSION_END_HOOK_TIMEOUT_MS_DEFAULT2;
 }
 function executeInBackground({
   processId,
@@ -430225,18 +430849,33 @@ async function* executeHooks({
     if (jsonInputResult !== undefined) {
       return jsonInputResult;
     }
-    try {
-      return jsonInputResult = { ok: true, value: jsonStringify5(hookInput) };
-    } catch (error) {
+    if (exceedsMaxNestingDepth(hookInput)) {
+      const error = Error(`Hook input nesting depth exceeds MAX_HOOK_INPUT_NESTING_DEPTH (${MAX_HOOK_INPUT_NESTING_DEPTH}); refusing to serialize`);
       logError3(Error(`Failed to stringify hook ${hookName} input`, { cause: error }));
       return jsonInputResult = { ok: false, error };
     }
+    const serialized = stringifyWithGetterFallback(hookInput);
+    if (serialized.ok !== true) {
+      logError3(Error(`Failed to stringify hook ${hookName} input`, {
+        cause: serialized.error
+      }));
+      return jsonInputResult = { ok: false, error: serialized.error };
+    }
+    if (serialized.droppedKeys.length > 0) {
+      logForDebugging3(`Hooks: ${hookName}: dropped input keys with throwing getters: ${serialized.droppedKeys.join(", ")}`);
+    }
+    return jsonInputResult = { ok: true, value: serialized.value };
   }
   const hookPromises = matchingHooks.map(async function* ({ hook, pluginRoot, pluginId, skillRoot }, hookIndex) {
+    if (isReentrantHook(hookEvent, hook, pluginRoot)) {
+      logForDebugging3(`Hooks: ${hookName}: skipping re-entrant execution of ${getHookDisplayText(hook)}`);
+      yield { outcome: "success", hook };
+      return;
+    }
     if (hook.type === "callback") {
       const callbackTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
       const { signal: abortSignal, cleanup } = createCombinedAbortSignal(signal, { timeoutMs: callbackTimeoutMs });
-      yield executeHookCallback({
+      yield runWithHookReentrancy(hookEvent, hook, pluginRoot, () => executeHookCallback({
         toolUseID,
         hook,
         hookEvent,
@@ -430244,7 +430883,23 @@ async function* executeHooks({
         signal: abortSignal,
         hookIndex,
         toolUseContext
-      }).finally(cleanup);
+      }).catch((error) => {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        return {
+          message: createAttachmentMessage({
+            type: "hook_non_blocking_error",
+            hookName: `${hookEvent}:Callback`,
+            toolUseID,
+            hookEvent,
+            stderr: `Failed to run: ${errorMessage}`,
+            stdout: "",
+            exitCode: 1,
+            command: "callback"
+          }),
+          outcome: "non_blocking_error",
+          hook
+        };
+      }).finally(cleanup));
       return;
     }
     if (hook.type === "function") {
@@ -430262,7 +430917,7 @@ async function* executeHooks({
         };
         return;
       }
-      yield executeFunctionHook({
+      yield runWithHookReentrancy(hookEvent, hook, pluginRoot, () => executeFunctionHook({
         hook,
         messages,
         hookName,
@@ -430270,7 +430925,7 @@ async function* executeHooks({
         hookEvent,
         timeoutMs,
         signal
-      });
+      }));
       return;
     }
     const commandTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
@@ -430283,6 +430938,7 @@ async function* executeHooks({
     try {
       const jsonInputRes = getJsonInput();
       if (!jsonInputRes.ok) {
+        const failClosed = shouldFailClosePluginHook(hookEvent, pluginRoot);
         yield {
           message: createAttachmentMessage({
             type: "hook_error_during_execution",
@@ -430293,7 +430949,13 @@ async function* executeHooks({
             command: hookCommand,
             durationMs: Date.now() - hookStartMs
           }),
-          outcome: "non_blocking_error",
+          ...failClosed ? {
+            blockingError: {
+              blockingError: `Plugin hook input could not be prepared; blocking gated action (fail-closed): ${errorMessage2(jsonInputRes.error)}`,
+              command: hookCommand
+            }
+          } : {},
+          outcome: failClosed ? "blocking" : "non_blocking_error",
           hook
         };
         cleanup();
@@ -430304,7 +430966,7 @@ async function* executeHooks({
         if (!toolUseContext) {
           throw new Error("ToolUseContext is required for prompt hooks. This is a bug.");
         }
-        const promptResult = await execPromptHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, messages, toolUseID);
+        const promptResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execPromptHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, messages, toolUseID));
         if (promptResult.message?.type === "attachment") {
           const att = promptResult.message.attachment;
           if (att.type === "hook_success" || att.type === "hook_non_blocking_error") {
@@ -430323,7 +430985,7 @@ async function* executeHooks({
         if (!messages) {
           throw new Error("Messages are required for agent hooks. This is a bug.");
         }
-        const agentResult = await execAgentHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, toolUseID, messages, "agent_type" in hookInput ? hookInput.agent_type : undefined);
+        const agentResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execAgentHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, toolUseID, messages, "agent_type" in hookInput ? hookInput.agent_type : undefined));
         if (agentResult.message?.type === "attachment") {
           const att = agentResult.message.attachment;
           if (att.type === "hook_success" || att.type === "hook_non_blocking_error") {
@@ -430337,7 +430999,7 @@ async function* executeHooks({
       }
       if (hook.type === "http") {
         emitHookStarted(hookId, hookName, hookEvent);
-        const httpResult = await execHttpHook(hook, hookEvent, jsonInput, signal);
+        const httpResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execHttpHook(hook, hookEvent, jsonInput, signal));
         cleanup?.();
         if (httpResult.aborted) {
           emitHookResponse({
@@ -430465,7 +431127,7 @@ async function* executeHooks({
         return;
       }
       emitHookStarted(hookId, hookName, hookEvent);
-      const result = await execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, hookId, hookIndex, pluginRoot, pluginId, skillRoot, forceSyncExecution, boundRequestPrompt);
+      const result = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, hookId, hookIndex, pluginRoot, pluginId, skillRoot, forceSyncExecution, boundRequestPrompt));
       cleanup?.();
       const durationMs = Date.now() - hookStartMs;
       if (result.backgrounded) {
@@ -430711,7 +431373,7 @@ async function* executeHooks({
     cancelled: 0
   };
   let permissionBehavior;
-  for await (const result of all2(hookPromises)) {
+  for await (const result of all2(hookPromises, MAX_HOOK_CONCURRENCY)) {
     outcomes[result.outcome]++;
     if (result.terminalSequence) {
       try {
@@ -430901,20 +431563,46 @@ async function executeHooksOutsideREPL({
     const pluginHookCounts = getPluginHookCounts(userHooks);
     const hookTypeCounts = getHookTypeCounts(userHooks);
   }
-  let jsonInput;
-  try {
-    jsonInput = jsonStringify5(hookInput);
-  } catch (error) {
-    logError3(error);
-    return [];
+  if (exceedsMaxNestingDepth(hookInput)) {
+    const message = `Hook input nesting depth exceeds MAX_HOOK_INPUT_NESTING_DEPTH (${MAX_HOOK_INPUT_NESTING_DEPTH}); refusing to run hooks`;
+    logForDebugging3(`Hooks: ${hookName}: ${message}`);
+    return matchingHooks.map(({ hook, pluginRoot }) => ({
+      command: getHookDisplayText(hook),
+      succeeded: false,
+      output: message,
+      blocked: shouldFailClosePluginHook(hookEvent, pluginRoot)
+    }));
+  }
+  const serialized = stringifyWithGetterFallback(hookInput);
+  if (serialized.ok !== true) {
+    logError3(serialized.error);
+    return matchingHooks.map(({ hook, pluginRoot }) => ({
+      command: getHookDisplayText(hook),
+      succeeded: false,
+      output: `Failed to serialize hook input: ${errorMessage2(serialized.error)}`,
+      blocked: shouldFailClosePluginHook(hookEvent, pluginRoot)
+    }));
   }
-  const hookPromises = matchingHooks.map(async ({ hook, pluginRoot, pluginId }, hookIndex) => {
+  if (serialized.droppedKeys.length > 0) {
+    logForDebugging3(`Hooks: ${hookName}: dropped input keys with throwing getters: ${serialized.droppedKeys.join(", ")}`);
+  }
+  const jsonInput = serialized.value;
+  const hookTasks = matchingHooks.map(({ hook, pluginRoot, pluginId }, hookIndex) => async () => {
+    if (isReentrantHook(hookEvent, hook, pluginRoot)) {
+      logForDebugging3(`Hooks: ${hookName}: skipping re-entrant execution of ${getHookDisplayText(hook)}`);
+      return {
+        command: getHookDisplayText(hook),
+        succeeded: true,
+        output: "Skipped: re-entrant hook execution (already running in this call chain)",
+        blocked: false
+      };
+    }
     if (hook.type === "callback") {
       const callbackTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
       const { signal: abortSignal, cleanup } = createCombinedAbortSignal(signal, { timeoutMs: callbackTimeoutMs });
       try {
         const toolUseID = randomUUID43();
-        const json = await hook.callback(hookInput, toolUseID, abortSignal, hookIndex);
+        const json = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => hook.callback(hookInput, toolUseID, abortSignal, hookIndex));
         cleanup?.();
         if (isAsyncHookJSONOutput(json)) {
           logForDebugging3(`${hookName} [callback] returned async response, returning empty output`);
@@ -430973,7 +431661,7 @@ async function executeHooksOutsideREPL({
     }
     if (hook.type === "http") {
       try {
-        const httpResult = await execHttpHook(hook, hookEvent, jsonInput, signal);
+        const httpResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execHttpHook(hook, hookEvent, jsonInput, signal));
         if (httpResult.aborted) {
           logForDebugging3(`${hookName} [${hook.url}] cancelled`);
           return {
@@ -431024,7 +431712,7 @@ async function executeHooksOutsideREPL({
     const commandTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
     const { signal: abortSignal, cleanup } = createCombinedAbortSignal(signal, { timeoutMs: commandTimeoutMs });
     try {
-      const result = await execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, randomUUID43(), hookIndex, pluginRoot, pluginId);
+      const result = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, randomUUID43(), hookIndex, pluginRoot, pluginId));
       cleanup?.();
       if (result.aborted) {
         logForDebugging3(`${hookName} [${hook.command}] cancelled`);
@@ -431068,7 +431756,7 @@ async function executeHooksOutsideREPL({
       };
     }
   });
-  return await Promise.all(hookPromises);
+  return await runWithConcurrencyLimit(hookTasks, MAX_HOOK_CONCURRENCY);
 }
 async function* executePermissionDeniedHooks(toolName, toolUseID, toolInput, reason, toolUseContext, permissionMode, signal, timeoutMs = TOOL_HOOK_EXECUTION_TIMEOUT_MS) {
   const appState = toolUseContext.getAppState();
@@ -431868,7 +432556,7 @@ function getHookDefinitionsForTelemetry(matchedHooks) {
     return { type: "unknown" };
   });
 }
-var TOOL_HOOK_EXECUTION_TIMEOUT_MS, SESSION_END_HOOK_TIMEOUT_MS_DEFAULT = 1500;
+var TOOL_HOOK_EXECUTION_TIMEOUT_MS, SESSION_END_HOOK_TIMEOUT_MS_DEFAULT2 = 1500;
 var init_hooks7 = __esm(() => {
   init_file();
   init_ShellCommand2();
@@ -431901,12 +432589,16 @@ var init_hooks7 = __esm(() => {
   init_permissionRuleParser2();
   init_log5();
   init_combinedAbortSignal();
+  init_hookInputMaterialize();
+  init_hookReentrancy();
+  init_hookFailClosed();
   init_AsyncHookRegistry();
   init_messageQueueManager();
   init_messages3();
   init_hookEvents2();
   init_attachments();
   init_generators();
+  init_engine();
   init_Tool();
   init_execPromptHook();
   init_execAgentHook();
@@ -440987,7 +441679,21 @@ function getDestructiveCommandWarning2(command) {
   }
   return null;
 }
-var DESTRUCTIVE_PATTERNS;
+function isStrictInlineShellRmPromptEnabled(env = process.env) {
+  return env[STRICT_INLINE_SHELL_RM_PROMPT_ENV] === "1";
+}
+function getStrictInlineShellRmWarning(command) {
+  if (STRICT_CONCAT_RM_RE.test(command)) {
+    return STRICT_CONCAT_RM_WARNING;
+  }
+  for (const re of STRICT_SCRIPT_INVOCATION_RES) {
+    if (re.test(command)) {
+      return STRICT_SCRIPT_WARNING;
+    }
+  }
+  return null;
+}
+var DESTRUCTIVE_PATTERNS, STRICT_INLINE_SHELL_RM_PROMPT_ENV = "ATLAS_STRICT_INLINE_SHELL_RM_PROMPT", STRICT_CONCAT_RM_RE, STRICT_SCRIPT_INVOCATION_RES, STRICT_CONCAT_RM_WARNING = "Note: may remove files via a non-literal rm invocation", STRICT_SCRIPT_WARNING = "Note: runs a shell script whose contents are not inspected";
 var init_destructiveCommandWarning2 = __esm(() => {
   DESTRUCTIVE_PATTERNS = [
     {
@@ -441055,6 +441761,13 @@ var init_destructiveCommandWarning2 = __esm(() => {
       warning: "Note: may destroy Terraform infrastructure"
     }
   ];
+  STRICT_CONCAT_RM_RE = /\brm\s+(?:-[a-zA-Z]*[rRf]|--recursive|--force)/;
+  STRICT_SCRIPT_INVOCATION_RES = [
+    /(^|[;&|\n]\s*)(?:[^\s;&|]*\/)?(?:bash|zsh|dash|ksh|sh)\b/,
+    /(^|[;&|\n]\s*)source\s+\S/,
+    /(^|[;&|\n]\s*)\.[ \t]*\S/,
+    /(^|[;&|\n]\s*)\S+\.sh\b/
+  ];
 });
 
 // src/tui/utils/shell/specPrefix.ts
@@ -445115,7 +445828,7 @@ function BashPermissionRequestInner({
     sandboxingEnabled: sandboxingEnabled_0,
     isSandboxed: isSandboxed_0
   } = import_react193.useMemo(() => {
-    const destructiveWarning = getFeatureValue_CACHED_MAY_BE_STALE("atlas_destructive_command_warning", false) ? getDestructiveCommandWarning2(command) : null;
+    const destructiveWarning = getFeatureValue_CACHED_MAY_BE_STALE("atlas_destructive_command_warning", false) ? getDestructiveCommandWarning2(command) ?? (isStrictInlineShellRmPromptEnabled() ? getStrictInlineShellRmWarning(command) : null) : null;
     const sandboxingEnabled = getSandboxManager().isSandboxingEnabled();
     const isSandboxed = sandboxingEnabled && shouldUseSandbox2(toolUseConfirm.input);
     return {
@@ -470075,41 +470788,28 @@ async function processUserInput({
   if (mode === "prompt" && inputString !== null && !isMeta) {
     setUserInputOnProcessing?.(inputString);
   }
-  queryCheckpoint("query_process_user_input_base_start");
   const appState = context.getAppState();
-  const result = await processUserInputBase(input, mode, setToolJSX, context, pastedContents, ideSelection, messages, uuid, isAlreadyProcessing, querySource, canUseTool, appState.toolPermissionContext.mode, skipSlashCommands, bridgeOrigin, isMeta, skipAttachments, preExpansionInput);
-  queryCheckpoint("query_process_user_input_base_end");
-  if (!result.shouldQuery) {
-    return result;
-  }
   queryCheckpoint("query_hooks_start");
   const inputMessage = getContentText(input) || "";
+  let hookBlockingMessage = null;
+  let hookStopped = false;
+  let hookStopReason;
+  const hookMessages = [];
   for await (const hookResult of executeUserPromptSubmitHooks(inputMessage, appState.toolPermissionContext.mode, context, context.requestPrompt)) {
     if (hookResult.message?.type === "progress") {
       continue;
     }
     if (hookResult.blockingError) {
-      const blockingMessage = getUserPromptSubmitHookBlockingMessage(hookResult.blockingError);
-      return {
-        messages: [
-          createSystemMessage(`${blockingMessage}
-
-Original prompt: ${input}`, "warning")
-        ],
-        shouldQuery: false,
-        allowedTools: result.allowedTools
-      };
+      hookBlockingMessage = getUserPromptSubmitHookBlockingMessage(hookResult.blockingError);
+      break;
     }
     if (hookResult.preventContinuation) {
-      const message = hookResult.stopReason ? `Operation stopped by hook: ${hookResult.stopReason}` : "Operation stopped by hook";
-      result.messages.push(createUserMessage2({
-        content: message
-      }));
-      result.shouldQuery = false;
-      return result;
+      hookStopped = true;
+      hookStopReason = hookResult.stopReason;
+      continue;
     }
     if (hookResult.additionalContexts && hookResult.additionalContexts.length > 0) {
-      result.messages.push(createAttachmentMessage({
+      hookMessages.push(createAttachmentMessage({
         type: "hook_additional_context",
         content: hookResult.additionalContexts.map(applyTruncation),
         hookName: "UserPromptSubmit",
@@ -470123,7 +470823,7 @@ Original prompt: ${input}`, "warning")
           if (!hookResult.message.attachment.content) {
             break;
           }
-          result.messages.push({
+          hookMessages.push({
             ...hookResult.message,
             attachment: {
               ...hookResult.message.attachment,
@@ -470132,12 +470832,38 @@ Original prompt: ${input}`, "warning")
           });
           break;
         default:
-          result.messages.push(hookResult.message);
+          hookMessages.push(hookResult.message);
           break;
       }
     }
   }
   queryCheckpoint("query_hooks_end");
+  if (hookBlockingMessage !== null) {
+    return {
+      messages: [
+        createSystemMessage(`${hookBlockingMessage}
+
+Original prompt: ${input}`, "warning")
+      ],
+      shouldQuery: false,
+      allowedTools: []
+    };
+  }
+  queryCheckpoint("query_process_user_input_base_start");
+  const result = await processUserInputBase(input, mode, setToolJSX, context, pastedContents, ideSelection, messages, uuid, isAlreadyProcessing, querySource, canUseTool, appState.toolPermissionContext.mode, skipSlashCommands, bridgeOrigin, isMeta, skipAttachments, preExpansionInput);
+  queryCheckpoint("query_process_user_input_base_end");
+  if (hookStopped && result.shouldQuery) {
+    const message = hookStopReason ? `Operation stopped by hook: ${hookStopReason}` : "Operation stopped by hook";
+    result.messages.push(createUserMessage2({
+      content: message
+    }));
+    result.shouldQuery = false;
+    return result;
+  }
+  if (!result.shouldQuery) {
+    return result;
+  }
+  result.messages.push(...hookMessages);
   return result;
 }
 function applyTruncation(content) {