@claude-flow/cli 3.56.8 → 3.56.9

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.56.8",
+    "version": "3.56.9",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
-      "hook-handler.cjs": "0f855c667b8d2d04cb4fe91b14b351d14c3dfb30516dcd9d7ae156acbe0a689d",
+      "hook-handler.cjs": "bc12b3cae92d5a7c8deef699fa00d0ef07b57625c18dbeac4387f15725b8e09f",
       "intelligence.cjs": "f486be296eb2f0518f34b8f4453d9d0a988845e4aec6d18d8d47725aca6dd38b",
       "statusline.cjs": "d72417ecb38634011a19f095a30e07b9929e6f97663520172ece9be7491b2eaa",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "ld9RNoF9lnGKjlUpofQLwCZgtE9Y5QiNNkYZLGsSQhZGp51JhBnHymH9YWpFC3F1HBslxRnea6U2TVczJKK5Bg==",
+  "signature": "1qMXitpeXl6mUlSGGx2dT68gaou7Uf1Z6YS+eT1K/3h+B//G2GqbgEmHhdfa5mKmcxM6eml2KlsUgMMW/WknAA==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -682,7 +682,8 @@ const handlers = {
     const dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\', ':(){:|:&};:'];
     // Join literal quote fragments and normalize root paths without shell evaluation.
     function hasRootDelete(command, depth = 0) {
-      let word = '', quote = '', started = false, redirect = false
+      // mask has one letter per character of word: 'u' unquoted, 'q' quoted or escaped (only unquoted braces expand).
+      let word = '', mask = '', quote = '', started = false, redirect = false
       let ansiNul = false // a NUL inside $'...' ends that string, as in bash
       let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
       const isRoot = (operand) => {
@@ -712,23 +713,92 @@ const handlers = {
         if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
         return ['\\' + c, at]
       }
-      const finishWord = () => {
-        if (!started) return false
-        // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
-        // Bound rescanning to four levels; beyond that retain its conservative check.
-        if (/[\s;&|()\x60]/.test(word)) {
-          if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
+      // Past the rescan bound (or the brace budget), a string is judged by its tokens: an rm and a possible root operand
+      // anywhere in it deny. Quote characters are dropped first, so r"m" is still rm; a path token with braces may expand to /.
+      const looseRootDelete = (text) => {
+        const tokens = text.replace(/["'\\]/g, '').split(/[\s;&|()\x60$]+/)
+        return tokens.some(t => t === 'rm' || t.endsWith('/rm')) && tokens.some(t => isRoot(t) || (t.includes('/') && /[{}]/.test(t)))
+      }
+      // Bash brace expansion of one word ({a,b} lists, nested or glued to text), and nothing else: no {1..3} sequences, and
+      // nothing inside parameter braces after a dollar sign. Only unquoted braces and commas count. Iterative and bounded:
+      // past BRACE_WORDS words or BRACE_CHARS characters of work in this call it returns undefined.
+      const BRACE_WORDS = 4096
+      let braceChars = 1_000_000
+      // The leftmost expandable group: an unquoted {...} with an unquoted comma at its own level, outside any dollar-brace parameter. One pass.
+      const firstGroup = (text, marks) => {
+        const stack = []
+        let dollars = 0
+        let best
+        for (let k = 0; k < text.length; k++) {
+          if (marks[k] !== 'u') continue
+          const c = text[k]
+          if (c === '{') {
+            const dollar = k > 0 && text[k - 1] === '$' && marks[k - 1] === 'u'
+            if (dollar) dollars++
+            stack.push({ open: k, commas: [], dollar: dollar || dollars > 0 })
+          } else if (c === ',' && stack.length > 0) stack[stack.length - 1].commas.push(k)
+          else if (c === '}' && stack.length > 0) {
+            const top = stack.pop()
+            if (top.dollar && text[top.open - 1] === '$' && marks[top.open - 1] === 'u') dollars--
+            if (!top.dollar && top.commas.length > 0 && (best === undefined || top.open < best[0])) best = [top.open, top.commas, k]
+          }
+        }
+        return best
+      }
+      const braceExpand = (text, marks) => {
+        const out = []
+        const todo = [[text, marks]]
+        while (todo.length > 0) {
+          const [t, m] = todo.pop()
+          if ((braceChars -= t.length) < 0) return undefined
+          const group = firstGroup(t, m)
+          if (group === undefined) {
+            out.push(t)
+            if (out.length > BRACE_WORDS) return undefined
+            continue
+          }
+          const [open, commas, close] = group
+          const cuts = [open, ...commas, close]
+          // Pushed in reverse, so the words come out in bash's left-to-right order.
+          for (let c = cuts.length - 2; c >= 0; c--) {
+            const from = cuts[c] + 1, to = cuts[c + 1]
+            todo.push([t.slice(0, open) + t.slice(from, to) + t.slice(close + 1), m.slice(0, open) + m.slice(from, to) + m.slice(close + 1)])
+          }
+          if (todo.length > BRACE_WORDS) return undefined
         }
-        if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
-        else if (!optionsEnded && word === '--') optionsEnded = true
-        else if (!optionsEnded && word.startsWith('-')) {
+        return out
+      }
+      const takeWord = (w) => {
+        if (!inRm) inRm = w === 'rm' || w.endsWith('/rm')
+        else if (!optionsEnded && w === '--') optionsEnded = true
+        else if (!optionsEnded && w.startsWith('-')) {
           // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
-          recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
-          force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
-        } else root = root || isRoot(word)
-        word = ''; started = false
+          recursive = recursive || (w.length > 2 && '--recursive'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('r'))
+          force = force || (w.length > 2 && '--force'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('f'))
+        } else root = root || isRoot(w)
         return inRm && recursive && force && root
       }
+      const finishWord = () => {
+        if (!started) return false
+        const text = word, marks = mask
+        word = ''; mask = ''; started = false
+        // Literal shell strings (e.g. sh -c 'rm -rf /', or sh -c '{rm,-rf,/}') also carried the old guard.
+        // Bound rescanning to four levels; beyond that judge the string by its tokens.
+        if (/[\s;&|()\x60{]/.test(text)) {
+          if (depth < 4 ? hasRootDelete(text, depth + 1) : looseRootDelete(text)) return true
+        }
+        // An unquoted {a,b} becomes separate words, as bash expands it: rm -rf {/*,} is rm -rf /*.
+        const words = text.includes('{') ? braceExpand(text, marks) : [text]
+        if (words === undefined) {
+          // Too many alternatives to check: one of them may be the root (an rm in progress fails closed), or the
+          // list itself may spell the rm: judge its tokens.
+          if (inRm) root = true
+          if (looseRootDelete(text.replace(/[{},]/g, ' '))) return true
+          return takeWord(text)
+        }
+        for (const w of words) if (w !== '' && takeWord(w)) return true
+        return false
+      }
       // A command substitution's body, from just after its opening backtick. Bash removes a
       // backslash only before $, a backtick or a backslash (and " inside double quotes) and
       // drops backslash-newline; any other backslash stays for the nested scan.
@@ -742,7 +812,7 @@ const handlers = {
           }
           body += command[j]
         }
-        return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+        return [j, depth < 4 ? hasRootDelete(body, depth + 1) : looseRootDelete(body)]
       }
       const finishCommand = () => {
         const denied = inRm && recursive && force && root
@@ -759,8 +829,8 @@ const handlers = {
             else if (char === '\\' && i + 1 < command.length) {
               const [text, last] = ansiEscape(command, i + 1)
               i = last
-              if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
-            } else if (!ansiNul) word += char
+              if (!ansiNul) { const nul = text.indexOf('\0'); const kept = nul < 0 ? text : text.slice(0, nul); word += kept; mask += 'q'.repeat(kept.length); if (nul >= 0) ansiNul = true }
+            } else if (!ansiNul) { word += char; mask += 'q' }
             continue
           }
           if (char === quote) quote = ''
@@ -770,20 +840,20 @@ const handlers = {
             // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
             // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
             // from reading it as the start of a comment.
-            if (command[end + 1] === '#') word += '\u0001'
+            if (command[end + 1] === '#') { word += '\u0001'; mask += 'q' }
             i = end
           }
           else if (quote === '"' && char === '\\' && i + 1 < command.length &&
             (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
               command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
             const next = command[++i]
-            if (next !== '\n') word += next
-          } else word += char
+            if (next !== '\n') { word += next; mask += 'q' }
+          } else { word += char; mask += 'q' }
           continue
         }
         if (char === '\\' && i + 1 < command.length) {
           const next = command[++i]
-          if (next !== '\n') { word += next; started = true }
+          if (next !== '\n') { word += next; mask += 'q'; started = true }
         } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
           // Command substitution: scan the body as its own command; the substitution
           // stays inside the enclosing word, so the rm being parsed keeps its state,
@@ -806,13 +876,29 @@ const handlers = {
           redirect = char === '<' || char === '>'
           if (!redirectionAmpersand && (char === '\n' || ';|&()'.includes(char)) && finishCommand()) return true
         } else {
-          word += char; started = true
+          word += char; mask += 'u'; started = true
         }
       }
       return finishWord() || finishCommand()
     }
+
+    // A fork bomb's definition as bash reads it, whatever the spacing or the name: f(){ f|f& }, function f { f|f& },
+    // function f(){ f|f& }. Defining one is the danger: the call may come anywhere later.
+    function hasForkBomb(command) {
+      const s = command.replace(/\s+/g, '')
+      for (let brace = s.indexOf('{'); brace >= 0; brace = s.indexOf('{', brace + 1)) {
+        const end = s.startsWith('()', brace - 2) ? brace - 2 : brace
+        let start = end
+        while (start > 0 && end - start < 72 && /[a-z0-9_:.-]/.test(s[start - 1])) start--
+        const run = s.slice(start, end)
+        for (const name of run.startsWith('function') && run.length > 8 ? [run, run.slice(8)] : [run]) {
+          if (name && s.startsWith(name + '|' + name + '&}', brace + 1)) return true
+        }
+      }
+      return false
+    }
     for (const d of dangerous) {
-      if (d === 'rm -rf /' ? hasRootDelete(cmd) : cmd.includes(d)) {
+      if (d === 'rm -rf /' ? hasRootDelete(cmd) : d === ':(){:|:&};:' ? hasForkBomb(cmd) : cmd.includes(d)) {
         console.error(`[BLOCKED] Dangerous command detected: ${d}`);
         // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.
         process.exit(2);

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-12T17:29:00.623Z",
-  "gitSha": "4f1b3e96",
+  "generatedAt": "2026-10-12T21:03:06.737Z",
+  "gitSha": "55e2c901",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/analyze.js

@@ -97,11 +97,19 @@ const diffCommand = {
         output.printInfo(`Analyzing diff: ${output.highlight(ref)}`);
         try {
             // Call MCP tool for diff analysis
+            // Shape returned by the analyze_diff MCP tool (ruvector/diff-classifier.ts).
+            // Typed from the classifier itself so the renderer cannot drift from it again.
             const result = await callMCPTool('analyze_diff', {
                 ref,
-                includeFileRisks: verbose,
+                // Always request file risks: the handler computes them anyway, and the
+                // high-risk file list below is derived from them.
+                includeFileRisks: true,
                 includeReviewers: showReviewers || showAll,
             });
+            if (result.error) {
+                output.printError(`Diff analysis failed: ${result.message ?? 'unknown error'}`);
+                return { success: false, exitCode: 1 };
+            }
             // JSON output
             if (formatType === 'json') {
                 output.printJson(result);
@@ -110,13 +118,18 @@ const diffCommand = {
             output.writeln();
             // Summary box
             const files = result.files || [];
-            const risk = result.risk || { overall: 'unknown', score: 0, breakdown: { fileCount: 0, totalChanges: 0, highRiskFiles: [], securityConcerns: [], breakingChanges: [], testCoverage: 'unknown' } };
-            const classification = result.classification || { category: 'unknown', confidence: 0, reasoning: '' };
+            const fileRisks = result.fileRisks || [];
+            const risk = result.risk || { overall: 'low', score: 0, breakdown: { low: 0, medium: 0, high: 0, critical: 0 } };
+            const classification = result.classification;
+            const category = classification?.primary ?? 'unknown';
+            const secondary = classification?.secondary?.length ? classification.secondary.join(', ') : '';
+            const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0);
+            const highRiskFiles = fileRisks.filter((r) => r.risk === 'high' || r.risk === 'critical').map((r) => r.file);
             output.printBox([
                 `Ref: ${result.ref || 'HEAD'}`,
                 `Files: ${files.length}`,
                 `Risk: ${getRiskDisplay(risk.overall)} (${risk.score}/100)`,
-                `Type: ${classification.category}${classification.subcategory ? ` (${classification.subcategory})` : ''}`,
+                `Type: ${category}${secondary ? ` (${secondary})` : ''}`,
                 ``,
                 result.summary || 'No summary available',
             ].join('\n'), 'Diff Analysis');
@@ -128,33 +141,28 @@ const diffCommand = {
                 output.printTable({
                     columns: [
                         { key: 'metric', header: 'Metric', width: 25 },
-                        { key: 'value', header: 'Value', width: 30 },
+                        { key: 'value', header: 'Value', width: 42 },
                     ],
                     data: [
                         { metric: 'Overall Risk', value: getRiskDisplay(risk.overall) },
                         { metric: 'Risk Score', value: `${risk.score}/100` },
-                        { metric: 'Files Changed', value: risk.breakdown.fileCount },
-                        { metric: 'Total Lines Changed', value: risk.breakdown.totalChanges },
-                        { metric: 'Test Coverage', value: risk.breakdown.testCoverage },
+                        { metric: 'Files Changed', value: files.length },
+                        { metric: 'Total Lines Changed', value: totalChanges },
+                        { metric: 'Files by Risk', value: `low ${risk.breakdown.low} / medium ${risk.breakdown.medium} / high ${risk.breakdown.high} / critical ${risk.breakdown.critical}` },
                     ],
                 });
-                // Security concerns
-                if (risk.breakdown.securityConcerns.length > 0) {
-                    output.writeln();
-                    output.writeln(output.bold(output.warning('Security Concerns')));
-                    output.printList(risk.breakdown.securityConcerns.map(c => output.warning(c)));
-                }
-                // Breaking changes
-                if (risk.breakdown.breakingChanges.length > 0) {
+                // Risk factors reported by the classifier
+                const riskFactors = classification?.riskFactors ?? [];
+                if (riskFactors.length > 0) {
                     output.writeln();
-                    output.writeln(output.bold(output.error('Potential Breaking Changes')));
-                    output.printList(risk.breakdown.breakingChanges.map(c => output.error(c)));
+                    output.writeln(output.bold(output.warning('Risk Factors')));
+                    output.printList(riskFactors.map(c => output.warning(c)));
                 }
                 // High risk files
-                if (risk.breakdown.highRiskFiles.length > 0) {
+                if (highRiskFiles.length > 0) {
                     output.writeln();
                     output.writeln(output.bold('High Risk Files'));
-                    output.printList(risk.breakdown.highRiskFiles.map(f => output.warning(f)));
+                    output.printList(highRiskFiles.map(f => output.warning(f)));
                 }
             }
             // Classification
@@ -168,13 +176,16 @@ const diffCommand = {
                         { key: 'value', header: 'Value', width: 40 },
                     ],
                     data: [
-                        { field: 'Category', value: classification.category },
-                        { field: 'Subcategory', value: classification.subcategory || '-' },
-                        { field: 'Confidence', value: `${(classification.confidence * 100).toFixed(0)}%` },
+                        { field: 'Category', value: category },
+                        { field: 'Secondary', value: secondary || '-' },
+                        { field: 'Confidence', value: `${((classification?.confidence ?? 0) * 100).toFixed(0)}%` },
+                        { field: 'Impact', value: classification?.impactLevel ?? '-' },
                     ],
                 });
-                output.writeln();
-                output.writeln(output.dim(`Reasoning: ${classification.reasoning}`));
+                if (classification?.testingStrategy?.length) {
+                    output.writeln();
+                    output.writeln(output.dim(`Testing strategy: ${classification.testingStrategy.join(', ')}`));
+                }
             }
             // Reviewers
             if (showReviewers || showAll) {
@@ -190,13 +201,13 @@ const diffCommand = {
                 }
             }
             // Verbose file-level details
-            if (verbose && result.fileRisks) {
+            if (verbose && fileRisks.length > 0) {
                 output.writeln();
                 output.writeln(output.bold('File-Level Analysis'));
                 output.writeln(output.dim('-'.repeat(50)));
                 output.printTable({
                     columns: [
-                        { key: 'path', header: 'File', width: 40 },
+                        { key: 'file', header: 'File', width: 40 },
                         { key: 'risk', header: 'Risk', width: 12, format: (v) => getRiskDisplay(String(v)) },
                         { key: 'score', header: 'Score', width: 8, align: 'right' },
                         { key: 'reasons', header: 'Reasons', width: 30, format: (v) => {
@@ -204,7 +215,7 @@ const diffCommand = {
                                 return reasons.slice(0, 2).join('; ');
                             } },
                     ],
-                    data: result.fileRisks,
+                    data: fileRisks.map((r) => ({ ...r })),
                 });
             }
             // Files changed table
@@ -219,7 +230,7 @@ const diffCommand = {
                         { key: 'additions', header: '+', width: 8, align: 'right', format: (v) => output.success(`+${v}`) },
                         { key: 'deletions', header: '-', width: 8, align: 'right', format: (v) => output.error(`-${v}`) },
                     ],
-                    data: files.slice(0, 20),
+                    data: files.slice(0, 20).map((f) => ({ ...f })),
                 });
                 if (files.length > 20) {
                     output.writeln(output.dim(`  ... and ${files.length - 20} more files`));

package/dist/src/init/helpers-generator.js

@@ -478,7 +478,8 @@ module.exports = commands;
 }
 // Literal-word root guard mirrored in the mod and both shipped classic helpers.
 const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
-  let word = '', quote = '', started = false, redirect = false
+  // mask has one letter per character of word: 'u' unquoted, 'q' quoted or escaped (only unquoted braces expand).
+  let word = '', mask = '', quote = '', started = false, redirect = false
   let ansiNul = false // a NUL inside $'...' ends that string, as in bash
   let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
   const isRoot = (operand) => {
@@ -508,23 +509,92 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
     return ['\\' + c, at]
   }
-  const finishWord = () => {
-    if (!started) return false
-    // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
-    // Bound rescanning to four levels; beyond that retain its conservative check.
-    if (/[\s;&|()\x60]/.test(word)) {
-      if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
+  // Past the rescan bound (or the brace budget), a string is judged by its tokens: an rm and a possible root operand
+  // anywhere in it deny. Quote characters are dropped first, so r"m" is still rm; a path token with braces may expand to /.
+  const looseRootDelete = (text) => {
+    const tokens = text.replace(/["'\\]/g, '').split(/[\s;&|()\x60$]+/)
+    return tokens.some(t => t === 'rm' || t.endsWith('/rm')) && tokens.some(t => isRoot(t) || (t.includes('/') && /[{}]/.test(t)))
+  }
+  // Bash brace expansion of one word ({a,b} lists, nested or glued to text), and nothing else: no {1..3} sequences, and
+  // nothing inside parameter braces after a dollar sign. Only unquoted braces and commas count. Iterative and bounded:
+  // past BRACE_WORDS words or BRACE_CHARS characters of work in this call it returns undefined.
+  const BRACE_WORDS = 4096
+  let braceChars = 1_000_000
+  // The leftmost expandable group: an unquoted {...} with an unquoted comma at its own level, outside any dollar-brace parameter. One pass.
+  const firstGroup = (text, marks) => {
+    const stack = []
+    let dollars = 0
+    let best
+    for (let k = 0; k < text.length; k++) {
+      if (marks[k] !== 'u') continue
+      const c = text[k]
+      if (c === '{') {
+        const dollar = k > 0 && text[k - 1] === '$' && marks[k - 1] === 'u'
+        if (dollar) dollars++
+        stack.push({ open: k, commas: [], dollar: dollar || dollars > 0 })
+      } else if (c === ',' && stack.length > 0) stack[stack.length - 1].commas.push(k)
+      else if (c === '}' && stack.length > 0) {
+        const top = stack.pop()
+        if (top.dollar && text[top.open - 1] === '$' && marks[top.open - 1] === 'u') dollars--
+        if (!top.dollar && top.commas.length > 0 && (best === undefined || top.open < best[0])) best = [top.open, top.commas, k]
+      }
+    }
+    return best
+  }
+  const braceExpand = (text, marks) => {
+    const out = []
+    const todo = [[text, marks]]
+    while (todo.length > 0) {
+      const [t, m] = todo.pop()
+      if ((braceChars -= t.length) < 0) return undefined
+      const group = firstGroup(t, m)
+      if (group === undefined) {
+        out.push(t)
+        if (out.length > BRACE_WORDS) return undefined
+        continue
+      }
+      const [open, commas, close] = group
+      const cuts = [open, ...commas, close]
+      // Pushed in reverse, so the words come out in bash's left-to-right order.
+      for (let c = cuts.length - 2; c >= 0; c--) {
+        const from = cuts[c] + 1, to = cuts[c + 1]
+        todo.push([t.slice(0, open) + t.slice(from, to) + t.slice(close + 1), m.slice(0, open) + m.slice(from, to) + m.slice(close + 1)])
+      }
+      if (todo.length > BRACE_WORDS) return undefined
     }
-    if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
-    else if (!optionsEnded && word === '--') optionsEnded = true
-    else if (!optionsEnded && word.startsWith('-')) {
+    return out
+  }
+  const takeWord = (w) => {
+    if (!inRm) inRm = w === 'rm' || w.endsWith('/rm')
+    else if (!optionsEnded && w === '--') optionsEnded = true
+    else if (!optionsEnded && w.startsWith('-')) {
       // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
-      recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
-      force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
-    } else root = root || isRoot(word)
-    word = ''; started = false
+      recursive = recursive || (w.length > 2 && '--recursive'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('r'))
+      force = force || (w.length > 2 && '--force'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('f'))
+    } else root = root || isRoot(w)
     return inRm && recursive && force && root
   }
+  const finishWord = () => {
+    if (!started) return false
+    const text = word, marks = mask
+    word = ''; mask = ''; started = false
+    // Literal shell strings (e.g. sh -c 'rm -rf /', or sh -c '{rm,-rf,/}') also carried the old guard.
+    // Bound rescanning to four levels; beyond that judge the string by its tokens.
+    if (/[\s;&|()\x60{]/.test(text)) {
+      if (depth < 4 ? hasRootDelete(text, depth + 1) : looseRootDelete(text)) return true
+    }
+    // An unquoted {a,b} becomes separate words, as bash expands it: rm -rf {/*,} is rm -rf /*.
+    const words = text.includes('{') ? braceExpand(text, marks) : [text]
+    if (words === undefined) {
+      // Too many alternatives to check: one of them may be the root (an rm in progress fails closed), or the
+      // list itself may spell the rm: judge its tokens.
+      if (inRm) root = true
+      if (looseRootDelete(text.replace(/[{},]/g, ' '))) return true
+      return takeWord(text)
+    }
+    for (const w of words) if (w !== '' && takeWord(w)) return true
+    return false
+  }
   // A command substitution's body, from just after its opening backtick. Bash removes a
   // backslash only before $, a backtick or a backslash (and " inside double quotes) and
   // drops backslash-newline; any other backslash stays for the nested scan.
@@ -538,7 +608,7 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
       }
       body += command[j]
     }
-    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : looseRootDelete(body)]
   }
   const finishCommand = () => {
     const denied = inRm && recursive && force && root
@@ -555,8 +625,8 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
         else if (char === '\\' && i + 1 < command.length) {
           const [text, last] = ansiEscape(command, i + 1)
           i = last
-          if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
-        } else if (!ansiNul) word += char
+          if (!ansiNul) { const nul = text.indexOf('\0'); const kept = nul < 0 ? text : text.slice(0, nul); word += kept; mask += 'q'.repeat(kept.length); if (nul >= 0) ansiNul = true }
+        } else if (!ansiNul) { word += char; mask += 'q' }
         continue
       }
       if (char === quote) quote = ''
@@ -566,20 +636,20 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
         // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
         // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
         // from reading it as the start of a comment.
-        if (command[end + 1] === '#') word += '\u0001'
+        if (command[end + 1] === '#') { word += '\u0001'; mask += 'q' }
         i = end
       }
       else if (quote === '"' && char === '\\' && i + 1 < command.length &&
         (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
           command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
         const next = command[++i]
-        if (next !== '\n') word += next
-      } else word += char
+        if (next !== '\n') { word += next; mask += 'q' }
+      } else { word += char; mask += 'q' }
       continue
     }
     if (char === '\\' && i + 1 < command.length) {
       const next = command[++i]
-      if (next !== '\n') { word += next; started = true }
+      if (next !== '\n') { word += next; mask += 'q'; started = true }
     } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
       // Command substitution: scan the body as its own command; the substitution
       // stays inside the enclosing word, so the rm being parsed keeps its state,
@@ -602,10 +672,26 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
       redirect = char === '<' || char === '>'
       if (!redirectionAmpersand && (char === '\n' || ';|&()'.includes(char)) && finishCommand()) return true
     } else {
-      word += char; started = true
+      word += char; mask += 'u'; started = true
     }
   }
   return finishWord() || finishCommand()
+}
+
+// A fork bomb's definition as bash reads it, whatever the spacing or the name: f(){ f|f& }, function f { f|f& },
+// function f(){ f|f& }. Defining one is the danger: the call may come anywhere later.
+function hasForkBomb(command) {
+  const s = command.replace(/\s+/g, '')
+  for (let brace = s.indexOf('{'); brace >= 0; brace = s.indexOf('{', brace + 1)) {
+    const end = s.startsWith('()', brace - 2) ? brace - 2 : brace
+    let start = end
+    while (start > 0 && end - start < 72 && /[a-z0-9_:.-]/.test(s[start - 1])) start--
+    const run = s.slice(start, end)
+    for (const name of run.startsWith('function') && run.length > 8 ? [run, run.slice(8)] : [run]) {
+      if (name && s.startsWith(name + '|' + name + '&}', brace + 1)) return true
+    }
+  }
+  return false
 }`;
 /**
  * Generate hook-handler.cjs (cross-platform hook dispatcher)
@@ -816,7 +902,7 @@ export function generateHookHandler() {
         "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
         ROOT_DELETE_CHECK_SOURCE.split('\n').map((line) => '    ' + line).join('\n'),
         '    for (var i = 0; i < dangerous.length; i++) {',
-        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : cmd.includes(dangerous[i])) {",
+        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : dangerous[i] === ':(){:|:&};:' ? hasForkBomb(cmd) : cmd.includes(dangerous[i])) {",
         "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
         '        // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.',
         '        process.exit(2);',