@cybedefend/vibedefend 1.4.2 → 1.4.3

package/dist/hook-runner.js

@@ -39,6 +39,411 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/quote.js
+var require_quote = __commonJS({
+  "node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/quote.js"(exports, module) {
+    "use strict";
+    var OPS = (
+      /** @type {const} */
+      [
+        "||",
+        "&&",
+        ";;",
+        "|&",
+        "<(",
+        "<<<",
+        ">>",
+        ">&",
+        "<&",
+        "&",
+        ";",
+        "(",
+        ")",
+        "|",
+        "<",
+        ">"
+      ]
+    );
+    var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+    var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+    module.exports = function quote(xs) {
+      return xs.map(function(s) {
+        if (s === "") {
+          return (
+            /** @type {const} */
+            "''"
+          );
+        }
+        if (s && typeof s === "object") {
+          if ("op" in s && s.op === "glob") {
+            if (typeof s.pattern !== "string") {
+              throw new TypeError("glob token requires a string `pattern`");
+            }
+            if (LINE_TERMINATORS.test(s.pattern)) {
+              throw new TypeError("glob `pattern` must not contain line terminators");
+            }
+            return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
+          }
+          if ("op" in s && typeof s.op === "string") {
+            if (OPS.indexOf(s.op) < 0) {
+              throw new TypeError("invalid `op` value: " + JSON.stringify(s.op));
+            }
+            return s.op.replace(/[\s\S]/g, "\\$&");
+          }
+          if ("comment" in s && typeof s.comment === "string") {
+            if (LINE_TERMINATORS.test(s.comment)) {
+              throw new TypeError("`comment` must not contain line terminators");
+            }
+            return "#" + s.comment;
+          }
+          throw new TypeError("unrecognized object token shape");
+        }
+        if (/["\s\\]/.test(s) && !/'/.test(s)) {
+          return "'" + s.replace(/(['])/g, "\\$1") + "'";
+        }
+        if (/["'\s]/.test(s)) {
+          return '"' + s.replace(/(["\\$`!])/g, "\\$1") + '"';
+        }
+        return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
+      }).join(" ");
+    };
+  }
+});
+
+// node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/parse.js
+var require_parse = __commonJS({
+  "node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/parse.js"(exports, module) {
+    "use strict";
+    var CONTROL = (
+      /** @type {const} */
+      "(?:" + /** @type {const} */
+      [
+        "\\|\\|",
+        "\\&\\&",
+        ";;",
+        "\\|\\&",
+        "\\<\\(",
+        "\\<\\<\\<",
+        ">>",
+        ">\\&",
+        "<\\&",
+        "[&;()|<>]"
+      ].join(
+        /** @type {const} */
+        "|"
+      ) + /** @type {const} */
+      ")"
+    );
+    var controlRE = new RegExp("^" + CONTROL + "$");
+    var META = (
+      /** @type {const} */
+      "|&;()<> \\t"
+    );
+    var SINGLE_QUOTE = (
+      /** @type {const} */
+      "'([^']*?)'"
+    );
+    var DOUBLE_QUOTE = (
+      /** @type {const} */
+      '"((\\\\"|[^"])*?)"'
+    );
+    var hash = /^#$/;
+    var SQ = (
+      /** @type {const} */
+      "'"
+    );
+    var DQ = (
+      /** @type {const} */
+      '"'
+    );
+    var DS = (
+      /** @type {const} */
+      "$"
+    );
+    var TOKEN = "";
+    var mult = (
+      /** @type {const} */
+      4294967296
+    );
+    for (i = 0; i < 4; i++) {
+      TOKEN += (mult * Math.random()).toString(16);
+    }
+    var i;
+    var startsWithToken = new RegExp("^" + TOKEN);
+    function matchAll(s, r) {
+      var origIndex = r.lastIndex;
+      var matches = [];
+      var matchObj;
+      while (matchObj = r.exec(s)) {
+        matches[matches.length] = matchObj;
+        if (r.lastIndex === matchObj.index) {
+          r.lastIndex += 1;
+        }
+      }
+      r.lastIndex = origIndex;
+      return matches;
+    }
+    function getVar(env, pre, key) {
+      var r = typeof env === "function" ? env(key) : env[key];
+      if (typeof r === "undefined" && key != "") {
+        r = "";
+      } else if (typeof r === "undefined") {
+        r = "$";
+      }
+      if (typeof r === "object") {
+        return pre + TOKEN + JSON.stringify(r) + TOKEN;
+      }
+      return pre + r;
+    }
+    function parseInternal(string, env, opts) {
+      if (!opts) {
+        opts = {};
+      }
+      var BS = opts.escape || "\\";
+      var ifs = opts.splitUnquoted === true ? " 	\n" : typeof opts.splitUnquoted === "string" ? opts.splitUnquoted : "";
+      var BAREWORD = "(\\" + BS + `['"` + META + `]|[^\\s'"` + META + "])+";
+      var chunker = new RegExp([
+        "(" + CONTROL + ")",
+        // control chars
+        "(" + BAREWORD + "|" + DOUBLE_QUOTE + "|" + SINGLE_QUOTE + ")+"
+      ].join("|"), "g");
+      var matches = matchAll(string, chunker);
+      if (matches.length === 0) {
+        return [];
+      }
+      if (!env) {
+        env = {};
+      }
+      var commented = false;
+      return matches.map(function(match) {
+        var s = match[0];
+        if (!s || commented) {
+          return void 0;
+        }
+        if (controlRE.test(s)) {
+          return (
+            /** @type {ControlOperator} */
+            { op: s }
+          );
+        }
+        var quote = false;
+        var esc = false;
+        var out = "";
+        var words = [];
+        var sawQuote = false;
+        var pendingNw = null;
+        var isGlob = false;
+        var i2;
+        function parseEnvVar() {
+          i2 += 1;
+          var varend;
+          var varname;
+          var char = s.charAt(i2);
+          if (char === "{") {
+            i2 += 1;
+            if (s.charAt(i2) === "}") {
+              throw new Error("Bad substitution: " + s.slice(i2 - 2, i2 + 1));
+            }
+            var depth = 1;
+            varend = i2;
+            while (depth > 0 && varend < s.length) {
+              if (s.charAt(varend) === "{" && s.charAt(varend - 1) === "$") {
+                depth += 1;
+              } else if (s.charAt(varend) === "}") {
+                depth -= 1;
+              }
+              varend += 1;
+            }
+            if (depth !== 0) {
+              throw new Error("Bad substitution: " + s.slice(i2));
+            }
+            varend -= 1;
+            varname = s.slice(i2, varend);
+            i2 = varend;
+          } else if (/[*@#?$!_-]/.test(char)) {
+            varname = char;
+            i2 += 1;
+          } else {
+            var slicedFromI = s.slice(i2);
+            varend = slicedFromI.match(/[^\w\d_]/);
+            if (!varend) {
+              varname = slicedFromI;
+              i2 = s.length;
+            } else {
+              varname = slicedFromI.slice(0, varend.index);
+              i2 += /** @type {number} */
+              varend.index - 1;
+            }
+          }
+          return getVar(
+            /** @type {NonNullable<typeof env>} */
+            env,
+            "",
+            varname
+          );
+        }
+        function flushRun() {
+          if (pendingNw === null) {
+            return;
+          }
+          if (pendingNw === 0) {
+            if (out !== "") {
+              words[words.length] = out;
+              out = "";
+            }
+          } else {
+            words[words.length] = out;
+            out = "";
+            for (var fe = 1; fe < pendingNw; fe += 1) {
+              words[words.length] = "";
+            }
+          }
+          pendingNw = null;
+        }
+        for (i2 = 0; i2 < s.length; i2++) {
+          var c = s.charAt(i2);
+          if (ifs && c !== DS) {
+            flushRun();
+          }
+          isGlob = isGlob || !quote && (c === "*" || c === "?");
+          if (esc) {
+            out += c;
+            esc = false;
+          } else if (quote) {
+            if (c === quote) {
+              quote = false;
+            } else if (quote == SQ) {
+              out += c;
+            } else {
+              if (c === BS) {
+                i2 += 1;
+                c = s.charAt(i2);
+                if (c === DQ || c === BS || c === DS) {
+                  out += c;
+                } else {
+                  out += BS + c;
+                }
+              } else if (c === DS) {
+                out += parseEnvVar();
+              } else {
+                out += c;
+              }
+            }
+          } else if (c === DQ || c === SQ) {
+            quote = c;
+            sawQuote = true;
+          } else if (controlRE.test(c)) {
+            return (
+              /** @type {ControlOperator} */
+              { op: s }
+            );
+          } else if (hash.test(c)) {
+            commented = true;
+            var commentObj = { comment: string.slice(match.index + i2 + 1) };
+            if (out.length) {
+              return (
+                /** @type {const} */
+                [out, commentObj]
+              );
+            }
+            return (
+              /** @type {const} */
+              [commentObj]
+            );
+          } else if (c === BS) {
+            esc = true;
+          } else if (c === DS) {
+            var value = parseEnvVar();
+            if (!ifs) {
+              out += value;
+            } else {
+              for (var vi = 0; vi < value.length; vi += 1) {
+                var vc = value.charAt(vi);
+                if (ifs.indexOf(vc) < 0) {
+                  flushRun();
+                  out += vc;
+                } else if (pendingNw === null) {
+                  pendingNw = vc === " " || vc === "	" || vc === "\n" ? 0 : 1;
+                } else if (vc !== " " && vc !== "	" && vc !== "\n") {
+                  pendingNw += 1;
+                }
+              }
+            }
+          } else {
+            out += c;
+          }
+        }
+        if (isGlob) {
+          return (
+            /** @type {GlobPattern} */
+            { op: "glob", pattern: out }
+          );
+        }
+        if (ifs) {
+          if (pendingNw !== null && pendingNw > 0) {
+            words[words.length] = out;
+            out = "";
+            for (var te = 1; te < pendingNw; te += 1) {
+              words[words.length] = "";
+            }
+          }
+          if (out !== "" || sawQuote && words.length === 0) {
+            words[words.length] = out;
+          }
+          return words;
+        }
+        return out;
+      }).reduce(
+        function(prev, arg) {
+          if (typeof arg === "undefined") {
+            return prev;
+          }
+          [].concat(arg).forEach(function(entry) {
+            prev[prev.length] = entry;
+          });
+          return prev;
+        },
+        /** @type {ParseEntry[]} */
+        []
+      );
+    }
+    module.exports = function parse(s, env, opts) {
+      var mapped = parseInternal(s, env, opts);
+      if (typeof env !== "function") {
+        return mapped;
+      }
+      return mapped.reduce(
+        function(acc, s2) {
+          if (typeof s2 === "object") {
+            acc[acc.length] = s2;
+            return acc;
+          }
+          var xs = s2.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
+          if (xs.length === 1) {
+            acc[acc.length] = xs[0];
+            return acc;
+          }
+          xs.filter(Boolean).forEach(function(x) {
+            acc[acc.length] = startsWithToken.test(x) ? JSON.parse(x.split(TOKEN)[1]) : x;
+          });
+          return acc;
+        },
+        /** @type {ParseEntry[]} */
+        []
+      );
+    };
+  }
+});
+
+// node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/index.js
+var require_shell_quote = __commonJS({
+  "node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/index.js"(exports) {
+    "use strict";
+    exports.quote = require_quote();
+    exports.parse = require_parse();
+  }
+});
+
 // node_modules/.pnpm/re2-wasm@1.0.2/node_modules/re2-wasm/build/wasm/re2.js
 var require_re2 = __commonJS({
   "node_modules/.pnpm/re2-wasm@1.0.2/node_modules/re2-wasm/build/wasm/re2.js"(exports, module) {
@@ -3890,676 +4295,499 @@ var require_re22 = __commonJS({
       get unicode() {
         return this._unicode;
       }
-      get sticky() {
-        return this._sticky;
-      }
-      toString() {
-        return `/${this.pattern}/${this.flags}`;
-      }
-      getMaybeStickyIndex() {
-        if (this._global || this._sticky) {
-          return this.lastIndex;
-        } else {
-          return 0;
-        }
-      }
-      isMatchSuccessful(match, searchStart) {
-        return match.index === searchStart || !this._sticky && match.index >= 0;
-      }
-      maybeUpdateLastIndex(match, start) {
-        if (this._global || this._sticky) {
-          if (this.isMatchSuccessful(match, start)) {
-            this.lastIndex = match.index + match.match.length;
-          } else {
-            this.lastIndex = 0;
-          }
-        }
-      }
-      getNamedGroups(match) {
-        const groups = {};
-        for (const [groupName, groupNum] of Object.entries(this.namedGroups)) {
-          if (match.groups[groupNum - 1] !== void 0) {
-            groups[groupName] = match.groups[groupNum - 1];
-          }
-        }
-        return groups;
-      }
-      exec(input) {
-        if (typeof input !== "string") {
-          input = input + "";
-        }
-        const startIndex = this.getMaybeStickyIndex();
-        const match = this.wrapper.match(input, startIndex, true);
-        this.maybeUpdateLastIndex(match, startIndex);
-        if (!this.isMatchSuccessful(match, startIndex)) {
-          return null;
-        }
-        const result = [match.match, ...match.groups];
-        result.index = match.index;
-        result.input = input;
-        const groups = this.getNamedGroups(match);
-        if (Object.keys(groups).length > 0) {
-          result.groups = groups;
-        }
-        return result;
-      }
-      test(input) {
-        if (typeof input !== "string") {
-          input = input + "";
-        }
-        const startIndex = this.getMaybeStickyIndex();
-        const match = this.wrapper.match(input, this.getMaybeStickyIndex(), false);
-        this.maybeUpdateLastIndex(match, startIndex);
-        return this.isMatchSuccessful(match, startIndex);
-      }
-      compile() {
-        throw new Error("Deprecated RegExp method compile is not implemented in RE2.");
-      }
-      [Symbol.match](input) {
-        if (typeof input !== "string") {
-          input = input + "";
-        }
-        if (this._global) {
-          const result = [];
-          let nextIndex = 0;
-          let success;
-          do {
-            const match = this.wrapper.match(input, nextIndex, false);
-            success = match.index === nextIndex || !this._sticky && match.index >= 0;
-            if (success) {
-              result.push(match.match);
-              nextIndex = match.index + match.match.length;
-            }
-          } while (success);
-          if (result.length === 0) {
-            return null;
-          } else {
-            return result;
-          }
-        } else {
-          const startIndex = this.getMaybeStickyIndex();
-          const match = this.wrapper.match(input, startIndex, true);
-          this.maybeUpdateLastIndex(match, startIndex);
-          if (!this.isMatchSuccessful(match, startIndex)) {
-            return null;
-          }
-          const result = [match.match, ...match.groups];
-          result.index = match.index;
-          result.input = input;
-          const groups = this.getNamedGroups(match);
-          if (Object.keys(groups).length > 0) {
-            result.groups = groups;
-          }
-          return result;
-        }
-      }
-      match(input) {
-        return this[Symbol.match](input);
-      }
-      /**
-       * Outputs the replacement for the matched part of the string
-       * @param input
-       * @param match
-       * @param replacer
-       */
-      replaceMatch(input, match, replacer) {
-        var _a, _b;
-        if (typeof replacer === "string") {
-          let result = "";
-          for (let i = 0; i < replacer.length; i++) {
-            if (replacer[i] === "$") {
-              switch (replacer[i + 1]) {
-                case "$":
-                  result += "$";
-                  i++;
-                  break;
-                case "&":
-                  result += match.match;
-                  i++;
-                  break;
-                case "`":
-                  result += input.substring(0, match.index);
-                  i++;
-                  break;
-                case "'":
-                  result += input.substring(match.index + match.match.length);
-                  i++;
-                  break;
-                case "<": {
-                  const endCaret = replacer.indexOf(">", i);
-                  if (endCaret < 0) {
-                    throw new Error("Invalid named group replacement");
-                  }
-                  const groupName = replacer.substring(i + 2, endCaret);
-                  if (groupName in this.namedGroups) {
-                    result += (_a = match.groups[this.namedGroups[groupName] - 1]) !== null && _a !== void 0 ? _a : "";
-                  }
-                  i = endCaret;
-                  break;
-                }
-                default: {
-                  let groupNum;
-                  if ("123456789".includes(replacer[i + 1])) {
-                    if ("0123456789".includes(replacer[i + 2])) {
-                      groupNum = Number.parseInt(replacer.substring(i + 1, i + 3)) - 1;
-                      i += 2;
-                    } else {
-                      groupNum = Number.parseInt(replacer[i + 1]) - 1;
-                      i++;
-                    }
-                  } else {
-                    throw new Error("Invalid replacement string");
-                  }
-                  if (groupNum < match.groups.length) {
-                    result += (_b = match.groups[groupNum]) !== null && _b !== void 0 ? _b : "";
-                  } else {
-                    result += "$" + groupNum;
-                  }
-                }
-              }
-            } else {
-              result += replacer[i];
-            }
-          }
-          return result;
-        } else {
-          return replacer(match.match, ...match.groups, match.index, input, this.getNamedGroups(match));
-        }
-      }
-      [Symbol.replace](input, replacer) {
-        if (typeof input !== "string") {
-          input = input + "";
-        }
-        if (typeof replacer !== "function") {
-          replacer = replacer + "";
-        }
-        if (this._global) {
-          let result = "";
-          let nextIndex = 0;
-          let success;
-          do {
-            const match = this.wrapper.match(input, nextIndex, true);
-            success = match.index === nextIndex || !this._sticky && match.index >= 0;
-            if (success) {
-              result += input.substring(nextIndex, match.index) + this.replaceMatch(input, match, replacer);
-              nextIndex = match.index + match.match.length;
-            }
-          } while (success);
-          result += input.substring(nextIndex);
-          this.lastIndex = 0;
-          return result;
-        } else {
-          const startIndex = this.getMaybeStickyIndex();
-          const match = this.wrapper.match(input, startIndex, true);
-          this.maybeUpdateLastIndex(match, startIndex);
-          if (this.isMatchSuccessful(match, startIndex)) {
-            return input.substring(0, match.index) + this.replaceMatch(input, match, replacer) + input.substring(match.index + match.match.length);
-          } else {
-            return input;
-          }
-        }
-      }
-      replace(input, replacer) {
-        return this[Symbol.replace](input, replacer);
+      get sticky() {
+        return this._sticky;
       }
-      [Symbol.search](input) {
-        if (typeof input !== "string") {
-          input = input + "";
-        }
-        const result = this.wrapper.match(input, 0, false).index;
-        if (this._sticky && result !== 0) {
-          return -1;
+      toString() {
+        return `/${this.pattern}/${this.flags}`;
+      }
+      getMaybeStickyIndex() {
+        if (this._global || this._sticky) {
+          return this.lastIndex;
         } else {
-          return result;
+          return 0;
         }
       }
-      search(input) {
-        return this[Symbol.search](input);
+      isMatchSuccessful(match, searchStart) {
+        return match.index === searchStart || !this._sticky && match.index >= 0;
       }
-      [Symbol.split](input, limit) {
-        if (typeof input !== "string") {
-          input = input + "";
-        }
-        const output = [];
-        let nextIndex = 0;
-        limit = limit !== null && limit !== void 0 ? limit : Infinity;
-        while (output.length < limit) {
-          const nextMatch = this.wrapper.match(input, nextIndex, true);
-          if (nextMatch.index >= 0) {
-            if (nextMatch.match.length === 0) {
-              output.push(input.substring(nextIndex, nextIndex + 1));
-              nextIndex = nextIndex + 1;
-            } else {
-              output.push(input.substring(nextIndex, nextMatch.index));
-              nextIndex = nextMatch.index + nextMatch.match.length;
-            }
-            for (const group of nextMatch.groups) {
-              if (output.length >= limit) {
-                break;
-              }
-              output.push(group);
-            }
+      maybeUpdateLastIndex(match, start) {
+        if (this._global || this._sticky) {
+          if (this.isMatchSuccessful(match, start)) {
+            this.lastIndex = match.index + match.match.length;
           } else {
-            output.push(input.substring(nextIndex));
-            break;
+            this.lastIndex = 0;
           }
         }
-        return output;
-      }
-      split(input, limit) {
-        return this[Symbol.split](input, limit);
       }
-    };
-    exports.RE2 = RE2;
-  }
-});
-
-// node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/quote.js
-var require_quote = __commonJS({
-  "node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/quote.js"(exports, module) {
-    "use strict";
-    var OPS = (
-      /** @type {const} */
-      [
-        "||",
-        "&&",
-        ";;",
-        "|&",
-        "<(",
-        "<<<",
-        ">>",
-        ">&",
-        "<&",
-        "&",
-        ";",
-        "(",
-        ")",
-        "|",
-        "<",
-        ">"
-      ]
-    );
-    var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
-    var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
-    module.exports = function quote(xs) {
-      return xs.map(function(s) {
-        if (s === "") {
-          return (
-            /** @type {const} */
-            "''"
-          );
-        }
-        if (s && typeof s === "object") {
-          if ("op" in s && s.op === "glob") {
-            if (typeof s.pattern !== "string") {
-              throw new TypeError("glob token requires a string `pattern`");
-            }
-            if (LINE_TERMINATORS.test(s.pattern)) {
-              throw new TypeError("glob `pattern` must not contain line terminators");
-            }
-            return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
-          }
-          if ("op" in s && typeof s.op === "string") {
-            if (OPS.indexOf(s.op) < 0) {
-              throw new TypeError("invalid `op` value: " + JSON.stringify(s.op));
-            }
-            return s.op.replace(/[\s\S]/g, "\\$&");
-          }
-          if ("comment" in s && typeof s.comment === "string") {
-            if (LINE_TERMINATORS.test(s.comment)) {
-              throw new TypeError("`comment` must not contain line terminators");
-            }
-            return "#" + s.comment;
+      getNamedGroups(match) {
+        const groups = {};
+        for (const [groupName, groupNum] of Object.entries(this.namedGroups)) {
+          if (match.groups[groupNum - 1] !== void 0) {
+            groups[groupName] = match.groups[groupNum - 1];
           }
-          throw new TypeError("unrecognized object token shape");
         }
-        if (/["\s\\]/.test(s) && !/'/.test(s)) {
-          return "'" + s.replace(/(['])/g, "\\$1") + "'";
+        return groups;
+      }
+      exec(input) {
+        if (typeof input !== "string") {
+          input = input + "";
         }
-        if (/["'\s]/.test(s)) {
-          return '"' + s.replace(/(["\\$`!])/g, "\\$1") + '"';
+        const startIndex = this.getMaybeStickyIndex();
+        const match = this.wrapper.match(input, startIndex, true);
+        this.maybeUpdateLastIndex(match, startIndex);
+        if (!this.isMatchSuccessful(match, startIndex)) {
+          return null;
         }
-        return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
-      }).join(" ");
-    };
-  }
-});
-
-// node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/parse.js
-var require_parse = __commonJS({
-  "node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/parse.js"(exports, module) {
-    "use strict";
-    var CONTROL = (
-      /** @type {const} */
-      "(?:" + /** @type {const} */
-      [
-        "\\|\\|",
-        "\\&\\&",
-        ";;",
-        "\\|\\&",
-        "\\<\\(",
-        "\\<\\<\\<",
-        ">>",
-        ">\\&",
-        "<\\&",
-        "[&;()|<>]"
-      ].join(
-        /** @type {const} */
-        "|"
-      ) + /** @type {const} */
-      ")"
-    );
-    var controlRE = new RegExp("^" + CONTROL + "$");
-    var META = (
-      /** @type {const} */
-      "|&;()<> \\t"
-    );
-    var SINGLE_QUOTE = (
-      /** @type {const} */
-      "'([^']*?)'"
-    );
-    var DOUBLE_QUOTE = (
-      /** @type {const} */
-      '"((\\\\"|[^"])*?)"'
-    );
-    var hash = /^#$/;
-    var SQ = (
-      /** @type {const} */
-      "'"
-    );
-    var DQ = (
-      /** @type {const} */
-      '"'
-    );
-    var DS = (
-      /** @type {const} */
-      "$"
-    );
-    var TOKEN = "";
-    var mult = (
-      /** @type {const} */
-      4294967296
-    );
-    for (i = 0; i < 4; i++) {
-      TOKEN += (mult * Math.random()).toString(16);
-    }
-    var i;
-    var startsWithToken = new RegExp("^" + TOKEN);
-    function matchAll(s, r) {
-      var origIndex = r.lastIndex;
-      var matches = [];
-      var matchObj;
-      while (matchObj = r.exec(s)) {
-        matches[matches.length] = matchObj;
-        if (r.lastIndex === matchObj.index) {
-          r.lastIndex += 1;
+        const result = [match.match, ...match.groups];
+        result.index = match.index;
+        result.input = input;
+        const groups = this.getNamedGroups(match);
+        if (Object.keys(groups).length > 0) {
+          result.groups = groups;
         }
+        return result;
       }
-      r.lastIndex = origIndex;
-      return matches;
-    }
-    function getVar(env, pre, key) {
-      var r = typeof env === "function" ? env(key) : env[key];
-      if (typeof r === "undefined" && key != "") {
-        r = "";
-      } else if (typeof r === "undefined") {
-        r = "$";
-      }
-      if (typeof r === "object") {
-        return pre + TOKEN + JSON.stringify(r) + TOKEN;
-      }
-      return pre + r;
-    }
-    function parseInternal(string, env, opts) {
-      if (!opts) {
-        opts = {};
-      }
-      var BS = opts.escape || "\\";
-      var ifs = opts.splitUnquoted === true ? " 	\n" : typeof opts.splitUnquoted === "string" ? opts.splitUnquoted : "";
-      var BAREWORD = "(\\" + BS + `['"` + META + `]|[^\\s'"` + META + "])+";
-      var chunker = new RegExp([
-        "(" + CONTROL + ")",
-        // control chars
-        "(" + BAREWORD + "|" + DOUBLE_QUOTE + "|" + SINGLE_QUOTE + ")+"
-      ].join("|"), "g");
-      var matches = matchAll(string, chunker);
-      if (matches.length === 0) {
-        return [];
+      test(input) {
+        if (typeof input !== "string") {
+          input = input + "";
+        }
+        const startIndex = this.getMaybeStickyIndex();
+        const match = this.wrapper.match(input, this.getMaybeStickyIndex(), false);
+        this.maybeUpdateLastIndex(match, startIndex);
+        return this.isMatchSuccessful(match, startIndex);
       }
-      if (!env) {
-        env = {};
+      compile() {
+        throw new Error("Deprecated RegExp method compile is not implemented in RE2.");
       }
-      var commented = false;
-      return matches.map(function(match) {
-        var s = match[0];
-        if (!s || commented) {
-          return void 0;
-        }
-        if (controlRE.test(s)) {
-          return (
-            /** @type {ControlOperator} */
-            { op: s }
-          );
+      [Symbol.match](input) {
+        if (typeof input !== "string") {
+          input = input + "";
         }
-        var quote = false;
-        var esc = false;
-        var out = "";
-        var words = [];
-        var sawQuote = false;
-        var pendingNw = null;
-        var isGlob = false;
-        var i2;
-        function parseEnvVar() {
-          i2 += 1;
-          var varend;
-          var varname;
-          var char = s.charAt(i2);
-          if (char === "{") {
-            i2 += 1;
-            if (s.charAt(i2) === "}") {
-              throw new Error("Bad substitution: " + s.slice(i2 - 2, i2 + 1));
-            }
-            var depth = 1;
-            varend = i2;
-            while (depth > 0 && varend < s.length) {
-              if (s.charAt(varend) === "{" && s.charAt(varend - 1) === "$") {
-                depth += 1;
-              } else if (s.charAt(varend) === "}") {
-                depth -= 1;
-              }
-              varend += 1;
-            }
-            if (depth !== 0) {
-              throw new Error("Bad substitution: " + s.slice(i2));
+        if (this._global) {
+          const result = [];
+          let nextIndex = 0;
+          let success;
+          do {
+            const match = this.wrapper.match(input, nextIndex, false);
+            success = match.index === nextIndex || !this._sticky && match.index >= 0;
+            if (success) {
+              result.push(match.match);
+              nextIndex = match.index + match.match.length;
             }
-            varend -= 1;
-            varname = s.slice(i2, varend);
-            i2 = varend;
-          } else if (/[*@#?$!_-]/.test(char)) {
-            varname = char;
-            i2 += 1;
+          } while (success);
+          if (result.length === 0) {
+            return null;
           } else {
-            var slicedFromI = s.slice(i2);
-            varend = slicedFromI.match(/[^\w\d_]/);
-            if (!varend) {
-              varname = slicedFromI;
-              i2 = s.length;
-            } else {
-              varname = slicedFromI.slice(0, varend.index);
-              i2 += /** @type {number} */
-              varend.index - 1;
-            }
+            return result;
           }
-          return getVar(
-            /** @type {NonNullable<typeof env>} */
-            env,
-            "",
-            varname
-          );
-        }
-        function flushRun() {
-          if (pendingNw === null) {
-            return;
+        } else {
+          const startIndex = this.getMaybeStickyIndex();
+          const match = this.wrapper.match(input, startIndex, true);
+          this.maybeUpdateLastIndex(match, startIndex);
+          if (!this.isMatchSuccessful(match, startIndex)) {
+            return null;
           }
-          if (pendingNw === 0) {
-            if (out !== "") {
-              words[words.length] = out;
-              out = "";
-            }
-          } else {
-            words[words.length] = out;
-            out = "";
-            for (var fe = 1; fe < pendingNw; fe += 1) {
-              words[words.length] = "";
-            }
+          const result = [match.match, ...match.groups];
+          result.index = match.index;
+          result.input = input;
+          const groups = this.getNamedGroups(match);
+          if (Object.keys(groups).length > 0) {
+            result.groups = groups;
           }
-          pendingNw = null;
+          return result;
         }
-        for (i2 = 0; i2 < s.length; i2++) {
-          var c = s.charAt(i2);
-          if (ifs && c !== DS) {
-            flushRun();
-          }
-          isGlob = isGlob || !quote && (c === "*" || c === "?");
-          if (esc) {
-            out += c;
-            esc = false;
-          } else if (quote) {
-            if (c === quote) {
-              quote = false;
-            } else if (quote == SQ) {
-              out += c;
-            } else {
-              if (c === BS) {
-                i2 += 1;
-                c = s.charAt(i2);
-                if (c === DQ || c === BS || c === DS) {
-                  out += c;
-                } else {
-                  out += BS + c;
+      }
+      match(input) {
+        return this[Symbol.match](input);
+      }
+      /**
+       * Outputs the replacement for the matched part of the string
+       * @param input
+       * @param match
+       * @param replacer
+       */
+      replaceMatch(input, match, replacer) {
+        var _a, _b;
+        if (typeof replacer === "string") {
+          let result = "";
+          for (let i = 0; i < replacer.length; i++) {
+            if (replacer[i] === "$") {
+              switch (replacer[i + 1]) {
+                case "$":
+                  result += "$";
+                  i++;
+                  break;
+                case "&":
+                  result += match.match;
+                  i++;
+                  break;
+                case "`":
+                  result += input.substring(0, match.index);
+                  i++;
+                  break;
+                case "'":
+                  result += input.substring(match.index + match.match.length);
+                  i++;
+                  break;
+                case "<": {
+                  const endCaret = replacer.indexOf(">", i);
+                  if (endCaret < 0) {
+                    throw new Error("Invalid named group replacement");
+                  }
+                  const groupName = replacer.substring(i + 2, endCaret);
+                  if (groupName in this.namedGroups) {
+                    result += (_a = match.groups[this.namedGroups[groupName] - 1]) !== null && _a !== void 0 ? _a : "";
+                  }
+                  i = endCaret;
+                  break;
                 }
-              } else if (c === DS) {
-                out += parseEnvVar();
-              } else {
-                out += c;
-              }
-            }
-          } else if (c === DQ || c === SQ) {
-            quote = c;
-            sawQuote = true;
-          } else if (controlRE.test(c)) {
-            return (
-              /** @type {ControlOperator} */
-              { op: s }
-            );
-          } else if (hash.test(c)) {
-            commented = true;
-            var commentObj = { comment: string.slice(match.index + i2 + 1) };
-            if (out.length) {
-              return (
-                /** @type {const} */
-                [out, commentObj]
-              );
-            }
-            return (
-              /** @type {const} */
-              [commentObj]
-            );
-          } else if (c === BS) {
-            esc = true;
-          } else if (c === DS) {
-            var value = parseEnvVar();
-            if (!ifs) {
-              out += value;
-            } else {
-              for (var vi = 0; vi < value.length; vi += 1) {
-                var vc = value.charAt(vi);
-                if (ifs.indexOf(vc) < 0) {
-                  flushRun();
-                  out += vc;
-                } else if (pendingNw === null) {
-                  pendingNw = vc === " " || vc === "	" || vc === "\n" ? 0 : 1;
-                } else if (vc !== " " && vc !== "	" && vc !== "\n") {
-                  pendingNw += 1;
+                default: {
+                  let groupNum;
+                  if ("123456789".includes(replacer[i + 1])) {
+                    if ("0123456789".includes(replacer[i + 2])) {
+                      groupNum = Number.parseInt(replacer.substring(i + 1, i + 3)) - 1;
+                      i += 2;
+                    } else {
+                      groupNum = Number.parseInt(replacer[i + 1]) - 1;
+                      i++;
+                    }
+                  } else {
+                    throw new Error("Invalid replacement string");
+                  }
+                  if (groupNum < match.groups.length) {
+                    result += (_b = match.groups[groupNum]) !== null && _b !== void 0 ? _b : "";
+                  } else {
+                    result += "$" + groupNum;
+                  }
                 }
               }
+            } else {
+              result += replacer[i];
+            }
+          }
+          return result;
+        } else {
+          return replacer(match.match, ...match.groups, match.index, input, this.getNamedGroups(match));
+        }
+      }
+      [Symbol.replace](input, replacer) {
+        if (typeof input !== "string") {
+          input = input + "";
+        }
+        if (typeof replacer !== "function") {
+          replacer = replacer + "";
+        }
+        if (this._global) {
+          let result = "";
+          let nextIndex = 0;
+          let success;
+          do {
+            const match = this.wrapper.match(input, nextIndex, true);
+            success = match.index === nextIndex || !this._sticky && match.index >= 0;
+            if (success) {
+              result += input.substring(nextIndex, match.index) + this.replaceMatch(input, match, replacer);
+              nextIndex = match.index + match.match.length;
             }
+          } while (success);
+          result += input.substring(nextIndex);
+          this.lastIndex = 0;
+          return result;
+        } else {
+          const startIndex = this.getMaybeStickyIndex();
+          const match = this.wrapper.match(input, startIndex, true);
+          this.maybeUpdateLastIndex(match, startIndex);
+          if (this.isMatchSuccessful(match, startIndex)) {
+            return input.substring(0, match.index) + this.replaceMatch(input, match, replacer) + input.substring(match.index + match.match.length);
           } else {
-            out += c;
+            return input;
           }
         }
-        if (isGlob) {
-          return (
-            /** @type {GlobPattern} */
-            { op: "glob", pattern: out }
-          );
+      }
+      replace(input, replacer) {
+        return this[Symbol.replace](input, replacer);
+      }
+      [Symbol.search](input) {
+        if (typeof input !== "string") {
+          input = input + "";
         }
-        if (ifs) {
-          if (pendingNw !== null && pendingNw > 0) {
-            words[words.length] = out;
-            out = "";
-            for (var te = 1; te < pendingNw; te += 1) {
-              words[words.length] = "";
+        const result = this.wrapper.match(input, 0, false).index;
+        if (this._sticky && result !== 0) {
+          return -1;
+        } else {
+          return result;
+        }
+      }
+      search(input) {
+        return this[Symbol.search](input);
+      }
+      [Symbol.split](input, limit) {
+        if (typeof input !== "string") {
+          input = input + "";
+        }
+        const output = [];
+        let nextIndex = 0;
+        limit = limit !== null && limit !== void 0 ? limit : Infinity;
+        while (output.length < limit) {
+          const nextMatch = this.wrapper.match(input, nextIndex, true);
+          if (nextMatch.index >= 0) {
+            if (nextMatch.match.length === 0) {
+              output.push(input.substring(nextIndex, nextIndex + 1));
+              nextIndex = nextIndex + 1;
+            } else {
+              output.push(input.substring(nextIndex, nextMatch.index));
+              nextIndex = nextMatch.index + nextMatch.match.length;
             }
+            for (const group of nextMatch.groups) {
+              if (output.length >= limit) {
+                break;
+              }
+              output.push(group);
+            }
+          } else {
+            output.push(input.substring(nextIndex));
+            break;
           }
-          if (out !== "" || sawQuote && words.length === 0) {
-            words[words.length] = out;
-          }
-          return words;
         }
-        return out;
-      }).reduce(
-        function(prev, arg) {
-          if (typeof arg === "undefined") {
-            return prev;
-          }
-          [].concat(arg).forEach(function(entry) {
-            prev[prev.length] = entry;
-          });
-          return prev;
-        },
-        /** @type {ParseEntry[]} */
-        []
-      );
-    }
-    module.exports = function parse(s, env, opts) {
-      var mapped = parseInternal(s, env, opts);
-      if (typeof env !== "function") {
-        return mapped;
+        return output;
+      }
+      split(input, limit) {
+        return this[Symbol.split](input, limit);
       }
-      return mapped.reduce(
-        function(acc, s2) {
-          if (typeof s2 === "object") {
-            acc[acc.length] = s2;
-            return acc;
-          }
-          var xs = s2.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
-          if (xs.length === 1) {
-            acc[acc.length] = xs[0];
-            return acc;
-          }
-          xs.filter(Boolean).forEach(function(x) {
-            acc[acc.length] = startsWithToken.test(x) ? JSON.parse(x.split(TOKEN)[1]) : x;
-          });
-          return acc;
-        },
-        /** @type {ParseEntry[]} */
-        []
-      );
     };
+    exports.RE2 = RE2;
   }
 });
 
-// node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/index.js
-var require_shell_quote = __commonJS({
-  "node_modules/.pnpm/shell-quote@1.10.0/node_modules/shell-quote/index.js"(exports) {
-    "use strict";
-    exports.quote = require_quote();
-    exports.parse = require_parse();
+// src/hooks/runtime/sniff.ts
+import { homedir } from "node:os";
+import { isAbsolute, resolve as resolvePath } from "node:path";
+
+// src/hooks/runtime/shell-writes.ts
+var import_shell_quote = __toESM(require_shell_quote(), 1);
+var SEGMENT_OPS = /* @__PURE__ */ new Set([";", "&&", "||", "|", "|&", "&", "(", ")"]);
+var SHELL_INTERPRETERS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "ksh"]);
+var TRANSPARENT_PREFIXES = /* @__PURE__ */ new Set(["sudo", "doas", "nohup", "command", "time", "nice", "env"]);
+var HEREDOC_OPEN = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/;
+function isOp(tok, op) {
+  return typeof tok === "object" && "op" in tok && (op === void 0 || tok.op === op);
+}
+function tokenText(tok) {
+  if (typeof tok === "string") return tok;
+  if (typeof tok === "object" && "pattern" in tok) return tok.pattern;
+  return null;
+}
+function stripHeredocBodies(command) {
+  const lines = command.split("\n");
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    out.push(line);
+    const m = HEREDOC_OPEN.exec(line);
+    i++;
+    if (!m) continue;
+    const delimiter = m[2];
+    while (i < lines.length) {
+      const body = lines[i];
+      i++;
+      if (body.trim() === delimiter) break;
+    }
   }
-});
+  return out.join("\n");
+}
+function isNoiseTarget(target) {
+  if (target.length === 0) return true;
+  if (target === "-") return true;
+  if (target.startsWith("/dev/")) return true;
+  if (/^&?\d+$/.test(target)) return true;
+  return false;
+}
+function targetsFromArgv(argv, depth) {
+  let i = 0;
+  while (i < argv.length) {
+    const tok = argv[i];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tok)) {
+      i++;
+      continue;
+    }
+    if (TRANSPARENT_PREFIXES.has(tok)) {
+      i++;
+      if (tok === "env") {
+        while (i < argv.length && (argv[i].startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i]))) {
+          if (argv[i] === "-u" || argv[i] === "--unset") i++;
+          i++;
+        }
+      }
+      continue;
+    }
+    break;
+  }
+  const cmd = argv[i] ?? "";
+  const args = argv.slice(i + 1);
+  const base = cmd.split("/").pop() ?? cmd;
+  if (SHELL_INTERPRETERS.has(base)) {
+    const c = args.indexOf("-c");
+    if (c >= 0 && typeof args[c + 1] === "string" && depth < 1) {
+      return extractShellWriteTargetsAt(args[c + 1], depth + 1);
+    }
+    return [];
+  }
+  if (base === "tee") {
+    return args.filter((a) => !a.startsWith("-") && !isNoiseTarget(a));
+  }
+  if (base === "sed" || base === "gsed") {
+    return sedTargets(args);
+  }
+  if (base === "perl") {
+    return perlTargets(args);
+  }
+  if (base === "cp" || base === "mv" || base === "install") {
+    const positional = args.filter((a) => !a.startsWith("-") || a === "-");
+    if (positional.length >= 2) {
+      const tFlag = args.findIndex((a) => a === "-t" || a === "--target-directory");
+      if (tFlag >= 0 && args[tFlag + 1]) return [args[tFlag + 1]];
+      return [positional[positional.length - 1]];
+    }
+    return [];
+  }
+  if (base === "dd") {
+    return args.filter((a) => a.startsWith("of=")).map((a) => a.slice(3)).filter((a) => !isNoiseTarget(a));
+  }
+  return [];
+}
+function sedTargets(args) {
+  let inPlace = false;
+  let scriptGiven = false;
+  const files = [];
+  let i = 0;
+  while (i < args.length) {
+    const a = args[i];
+    if (a === "--") {
+      files.push(...args.slice(i + 1).filter((f) => f.length > 0));
+      break;
+    }
+    if (a === "-i" || a === "--in-place") {
+      inPlace = true;
+      const next = args[i + 1];
+      if (typeof next === "string" && (next === "" || /^\.[A-Za-z0-9_-]+$/.test(next))) i++;
+      i++;
+      continue;
+    }
+    if (/^-i/.test(a) || a.startsWith("--in-place=")) {
+      inPlace = true;
+      i++;
+      continue;
+    }
+    if (a === "-e" || a === "--expression" || a === "-f" || a === "--file") {
+      scriptGiven = true;
+      i += 2;
+      continue;
+    }
+    if (a.startsWith("--expression=") || a.startsWith("--file=")) {
+      scriptGiven = true;
+      i++;
+      continue;
+    }
+    if (a.startsWith("-") && a.length > 1) {
+      if (/^-[A-Za-z]*i/.test(a)) inPlace = true;
+      i++;
+      continue;
+    }
+    if (!scriptGiven) {
+      scriptGiven = true;
+      i++;
+      continue;
+    }
+    if (a.length > 0) files.push(a);
+    i++;
+  }
+  return inPlace ? files : [];
+}
+function perlTargets(args) {
+  let inPlace = false;
+  const files = [];
+  let i = 0;
+  while (i < args.length) {
+    const a = args[i];
+    if (a === "-e" || a === "-E") {
+      i += 2;
+      continue;
+    }
+    if (a.startsWith("-")) {
+      if (/^-[A-Za-z0-9]*i/.test(a)) inPlace = true;
+      if (/e$/.test(a) && !/^-i/.test(a)) i++;
+      i++;
+      continue;
+    }
+    files.push(a);
+    i++;
+  }
+  return inPlace ? files : [];
+}
+function extractShellWriteTargetsAt(command, depth) {
+  let tokens;
+  try {
+    tokens = (0, import_shell_quote.parse)(stripHeredocBodies(command), (key) => `$${key}`);
+  } catch {
+    return [];
+  }
+  const targets = [];
+  let argv = [];
+  const flush = () => {
+    if (argv.length > 0) targets.push(...targetsFromArgv(argv, depth));
+    argv = [];
+  };
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (isOp(tok)) {
+      if (tok.op === "&" && isOp(tokens[i + 1], ">")) continue;
+      if (tok.op === ">" || tok.op === ">>") {
+        const next = tokens[i + 1];
+        const text2 = next === void 0 ? null : tokenText(next);
+        if (text2 !== null) {
+          if (!isNoiseTarget(text2)) targets.push(text2);
+          i++;
+        }
+        if (/^\d+$/.test(argv[argv.length - 1] ?? "")) argv.pop();
+        continue;
+      }
+      if (tok.op === ">&") {
+        i++;
+        if (/^\d+$/.test(argv[argv.length - 1] ?? "")) argv.pop();
+        continue;
+      }
+      if (tok.op === "<") {
+        const next = tokens[i + 1];
+        if (!isOp(next, "<") && !isOp(tokens[i - 1], "<")) i++;
+        else if (isOp(tokens[i - 1], "<")) i++;
+        continue;
+      }
+      if (SEGMENT_OPS.has(tok.op)) {
+        flush();
+        continue;
+      }
+      continue;
+    }
+    const text = tokenText(tok);
+    if (text !== null) argv.push(text);
+  }
+  flush();
+  return Array.from(new Set(targets));
+}
+function extractShellWriteTargets(command) {
+  if (typeof command !== "string" || command.trim().length === 0) return [];
+  return extractShellWriteTargetsAt(command, 0);
+}
 
 // src/hooks/runtime/sniff.ts
+function resolveWriteTarget(cwd, target) {
+  if (target.includes("$")) return target;
+  if (target === "~" || target.startsWith("~/")) {
+    return resolvePath(homedir(), target.slice(2));
+  }
+  return isAbsolute(target) ? resolvePath(target) : resolvePath(cwd, target);
+}
 function filePathFromPatch(patch) {
   const lines = patch.split("\n");
   for (const line of lines) {
@@ -4591,7 +4819,14 @@ function sniff(input) {
     } else if (action === "pre_read_code" || action === "post_read_code") {
       toolName = "Read";
     }
-    return { client: "windsurf", toolName, filePath, newContent, raw: input };
+    return {
+      client: "windsurf",
+      toolName,
+      filePath,
+      filePaths: filePath ? [filePath] : [],
+      newContent,
+      raw: input
+    };
   }
   if ("hookEventName" in input) {
     return extractToolInputShape(input, "vscode");
@@ -4603,7 +4838,7 @@ function sniff(input) {
       client = "cursor";
     } else {
       const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
-      client = toolName === "apply_patch" ? "codex" : "claude-code";
+      client = toolName === "apply_patch" || "turn_id" in input ? "codex" : "claude-code";
     }
     return extractToolInputShape(input, client);
   }
@@ -4611,6 +4846,7 @@ function sniff(input) {
     client: "unknown",
     toolName: "",
     filePath: "",
+    filePaths: [],
     newContent: "",
     raw: input
   };
@@ -4619,8 +4855,19 @@ function extractToolInputShape(input, client) {
   const toolName = typeof input.tool_name === "string" ? input.tool_name : "";
   const toolInput = input.tool_input ?? {};
   let filePath = typeof toolInput.file_path === "string" ? toolInput.file_path : "";
+  let filePaths = [];
   let newContent = "";
   switch (toolName) {
+    case "Bash": {
+      const command = typeof toolInput.command === "string" ? toolInput.command : "";
+      newContent = command;
+      const cwd = typeof input.cwd === "string" && input.cwd.length > 0 ? input.cwd : process.cwd();
+      filePaths = extractShellWriteTargets(command).map(
+        (t) => resolveWriteTarget(cwd, t)
+      );
+      filePath = filePaths[0] ?? "";
+      break;
+    }
     case "Write":
       newContent = typeof toolInput.content === "string" ? toolInput.content : "";
       break;
@@ -4633,13 +4880,18 @@ function extractToolInputShape(input, client) {
       );
       break;
     case "apply_patch": {
-      const patch = typeof toolInput.patch === "string" ? toolInput.patch : "";
+      const patch = typeof toolInput.patch === "string" ? toolInput.patch : typeof toolInput.command === "string" ? toolInput.command : "";
       newContent = patch;
       if (!filePath) filePath = filePathFromPatch(patch);
       break;
     }
   }
-  return { client, toolName, filePath, newContent, raw: input };
+  if (typeof input.cwd === "string" && input.cwd.length > 0) {
+    if (filePath) filePath = resolveWriteTarget(input.cwd, filePath);
+    filePaths = filePaths.map((f) => resolveWriteTarget(input.cwd, f));
+  }
+  if (filePaths.length === 0 && filePath) filePaths = [filePath];
+  return { client, toolName, filePath, filePaths, newContent, raw: input };
 }
 
 // src/hooks/runtime/resolve.ts
@@ -4648,7 +4900,7 @@ import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:f
 
 // src/auth/auth-store.ts
 import { execFileSync } from "node:child_process";
-import { homedir } from "node:os";
+import { homedir as homedir2 } from "node:os";
 import { join } from "node:path";
 import {
   existsSync,
@@ -4764,10 +5016,10 @@ function readMacOSKeychain(mcpName) {
   }
 }
 function fileFallbackPath() {
-  return join(homedir(), ".cybedefend", "auth.json");
+  return join(homedir2(), ".cybedefend", "auth.json");
 }
 function storeFileFallback(blob) {
-  const dir = join(homedir(), ".cybedefend");
+  const dir = join(homedir2(), ".cybedefend");
   mkdirSync(dir, { recursive: true });
   const p = fileFallbackPath();
   writeFileSync(p, blob, { mode: 384 });
@@ -4995,7 +5247,7 @@ import { dirname as dirname2 } from "node:path";
 // src/utils.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname, join as join2 } from "node:path";
-import { homedir as homedir2, platform } from "node:os";
+import { homedir as homedir3, platform } from "node:os";
 
 // node_modules/.pnpm/kleur@4.1.5/node_modules/kleur/index.mjs
 var FORCE_COLOR;
@@ -5098,7 +5350,7 @@ function init(open, close) {
 
 // src/utils.ts
 function home(...parts) {
-  return join2(homedir2(), ...parts);
+  return join2(homedir3(), ...parts);
 }
 function ensureDirFor(filePath) {
   const dir = dirname(filePath);
@@ -5173,10 +5425,10 @@ function writeCachedRepoLink(key, entry, deps = {}) {
 
 // src/hooks/runtime/config.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { join as join3 } from "node:path";
 function runtimeConfigPath() {
-  return join3(homedir3(), ".cybedefend", "runtime-config.json");
+  return join3(homedir4(), ".cybedefend", "runtime-config.json");
 }
 function loadRuntimeConfig(path) {
   const p = path ?? runtimeConfigPath();
@@ -5205,7 +5457,7 @@ async function readStdinJson() {
 
 // src/hooks/runtime/trusted-api-base.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join4 } from "node:path";
 
 // src/config.ts
@@ -5234,7 +5486,7 @@ var REGIONS = [
 
 // src/hooks/runtime/trusted-api-base.ts
 function userRegionsPath() {
-  return join4(homedir4(), ".cybedefend", "regions.json");
+  return join4(homedir5(), ".cybedefend", "regions.json");
 }
 function normalizeOrigin(candidate) {
   if (typeof candidate !== "string") return null;
@@ -5584,6 +5836,10 @@ async function fetchProposalsCount(opts) {
 }
 
 // src/hooks/runtime/emit.ts
+var ENVELOPE_CLIENTS = {
+  SessionStart: /* @__PURE__ */ new Set(["codex"]),
+  PreToolUse: /* @__PURE__ */ new Set(["claude-code", "codex"])
+};
 function emit(body, client) {
   if (!body) return;
   if (client === "cursor") {
@@ -5597,16 +5853,16 @@ function emit(body, client) {
   process.stdout.write(body);
   if (!body.endsWith("\n")) process.stdout.write("\n");
 }
-function emitContext(body, client) {
+function emitContext(body, client, hookEventName) {
   if (!body) return;
-  if (client === "codex") {
+  if (ENVELOPE_CLIENTS[hookEventName].has(client)) {
     const payload = JSON.stringify({
       hookSpecificOutput: {
-        hookEventName: "SessionStart",
+        hookEventName,
         additionalContext: body
       }
     });
-    process.stdout.write(payload);
+    process.stdout.write(payload + "\n");
     return;
   }
   emit(body, client);
@@ -5626,11 +5882,15 @@ function emitStop(body, client, reason) {
 }
 
 // src/hooks/runtime/fetch-rules.ts
+function emitPreToolUseContext(body, client) {
+  emitContext(body, client, "PreToolUse");
+}
 var INTERESTED_TOOLS = /* @__PURE__ */ new Set([
   "Edit",
   "Write",
   "MultiEdit",
-  "apply_patch"
+  "apply_patch",
+  "Bash"
 ]);
 async function fetchRulesHook(deps = {}) {
   const readStdin = deps.readStdin ?? readStdinJson;
@@ -5639,7 +5899,7 @@ async function fetchRulesHook(deps = {}) {
   const resolveTok = deps.resolveTokenFn ?? resolveToken;
   const fetchRules = deps.fetchRulesFn ?? fetchBusinessRules;
   const fetchSecRules = deps.fetchSecurityRulesFn ?? fetchSecurityRules;
-  const emitFn = deps.emitFn ?? emit;
+  const emitFn = deps.emitFn ?? emitPreToolUseContext;
   const stdin = await readStdin();
   const event = sniff(stdin);
   if (!INTERESTED_TOOLS.has(event.toolName)) return;
@@ -5652,11 +5912,13 @@ async function fetchRulesHook(deps = {}) {
   const token = resolveTok(config.region.mcpName);
   if (!token) return;
   const intent = buildIntent(event);
+  const files = event.filePaths.length > 0 ? event.filePaths : [event.filePath];
+  const fileLabel = files.join(", ");
   const fetchOpts = {
     apiBase,
     projectId,
     token,
-    files: [event.filePath],
+    files,
     intent,
     topK: 5
   };
@@ -5664,24 +5926,25 @@ async function fetchRulesHook(deps = {}) {
     fetchRules(fetchOpts),
     fetchSecRules(fetchOpts)
   ]);
+  const blocks = [];
   if (businessResult) {
     const body = composeBody(
       businessResult.markdown,
       businessResult.total,
-      event.filePath
+      fileLabel
     );
-    if (body) emitFn(body, event.client);
+    if (body) blocks.push(body);
   }
   if (securityResult && securityResult.total > 0 && securityResult.markdown && securityResult.markdown.length > 0) {
-    emitFn(
+    blocks.push(
       composeSecurityBody(
         securityResult.markdown,
         securityResult.total,
-        event.filePath
-      ),
-      event.client
+        fileLabel
+      )
     );
   }
+  if (blocks.length > 0) emitFn(blocks.join("\n"), event.client);
 }
 function buildIntent(event) {
   const limit = parseInt(process.env.CYBEDEFEND_INTENT_BYTES ?? "800", 10);
@@ -5693,7 +5956,7 @@ function visibleCalloutTemplate(kind, total, filePath) {
   return [
     "---",
     "",
-    `**\u{1F6E1}\uFE0F REQUIRED USER-VISIBLE MARKER** \u2014 you MUST include this exact block as the FIRST paragraph of your next assistant reply, BEFORE the Edit/Write tool call. Do not paraphrase, do not skip \u2014 without it, the user cannot see CybeDefend is influencing the change.`,
+    `**\u{1F6E1}\uFE0F REQUIRED USER-VISIBLE MARKER** \u2014 you MUST include this exact block as the FIRST paragraph of your next assistant reply, BEFORE the tool call that writes the file. Do not paraphrase, do not skip \u2014 without it, the user cannot see CybeDefend is influencing the change.`,
     "",
     `> \u{1F6E1}\uFE0F **CybeDefend ${kind} Rules** \u2014 ${total} rule${total === 1 ? "" : "s"} for \`${filePath}\``,
     `> - **<rule-title>** [<severity> \xB7 <category>] \u2014 applies because <one-sentence reason>`,
@@ -5740,7 +6003,7 @@ function composeSecurityBody(markdown, total, filePath) {
 // src/hooks/runtime/self-update-check.ts
 import { spawn } from "node:child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { join as join5 } from "node:path";
 
 // src/hooks/runtime/semver.ts
@@ -5818,7 +6081,7 @@ function isValidRegistryVersion(value) {
 }
 async function selfUpdateCheck(deps) {
   const now = deps.now ?? (() => Date.now());
-  const dir = deps.cybeDir ?? join5(process.env.CYBEDEFEND_HOME ?? homedir5(), ".cybedefend");
+  const dir = deps.cybeDir ?? join5(process.env.CYBEDEFEND_HOME ?? homedir6(), ".cybedefend");
   const throttlePath = join5(dir, "update-check.json");
   const logPath = join5(dir, "last-update.log");
   const installMode = deps.installMode ?? (deps.runnerSource ? detectInstallMode(deps.runnerSource) : detectInstallMode(resolveScriptPath()));
@@ -5967,10 +6230,13 @@ function readPackageMeta(opts = {}) {
   }
 }
 var pkg = readPackageMeta({
-  bakedVersion: true ? "1.4.2" : void 0
+  bakedVersion: true ? "1.4.3" : void 0
 });
 
 // src/hooks/runtime/session-start.ts
+function emitSessionStartContext(body, client) {
+  emitContext(body, client, "SessionStart");
+}
 async function sessionStartHook(deps = {}) {
   const readStdin = deps.readStdin ?? readStdinJson;
   const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
@@ -5978,7 +6244,7 @@ async function sessionStartHook(deps = {}) {
   const resolveTok = deps.resolveTokenFn ?? resolveToken;
   const fetchProposals = deps.fetchProposalsFn ?? fetchProposalsCount;
   const selfUpdateCheckFn = deps.selfUpdateCheckFn ?? selfUpdateCheck;
-  const emitFn = deps.emitFn ?? emitContext;
+  const emitFn = deps.emitFn ?? emitSessionStartContext;
   const stdin = await readStdin();
   const event = sniff(stdin);
   const config = loadConfig();
@@ -6408,11 +6674,11 @@ async function preCompactHook(deps = {}) {
 
 // src/hooks/runtime/user-prompt-submit.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { join as join7 } from "node:path";
 var SESSIONS_CAP = 100;
 function defaultSessionsFile() {
-  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join7(homedir6(), ".cybedefend");
+  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join7(homedir7(), ".cybedefend");
   return join7(dir, "user-prompt-seen-sessions.json");
 }
 function defaultSessionTracker(file = defaultSessionsFile()) {
@@ -6719,7 +6985,7 @@ function bucketRules(rules) {
 }
 
 // src/guards-evaluator/preprocess.ts
-var import_shell_quote = __toESM(require_shell_quote(), 1);
+var import_shell_quote2 = __toESM(require_shell_quote(), 1);
 var PLACEHOLDER = "<DATA>";
 var DATA_BEARING_CONTEXTS = {
   git: /* @__PURE__ */ new Set(["commit", "tag", "notes", "stash", "merge", "cherry-pick", "revert"]),
@@ -6738,7 +7004,7 @@ var DATA_FLAGS_VALUE = /* @__PURE__ */ new Set([
 ]);
 var DATA_FLAGS_EQUAL = ["--message=", "--file=", "--body=", "--body-file="];
 var SHELL_OPS = /* @__PURE__ */ new Set([";", "&&", "||", "|", "|&", "&", ">", ">>", "<", "(", ")"]);
-var HEREDOC_OPEN = /^<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/;
+var HEREDOC_OPEN2 = /^<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/;
 function isExecutableValue(tok) {
   return tok.startsWith("$(") || tok.startsWith("<(") || tok.startsWith(">(") || tok.includes("`");
 }
@@ -6751,7 +7017,7 @@ function stripDataArgs(command) {
     tokens = command.slice();
   } else {
     try {
-      tokens = (0, import_shell_quote.parse)(command, (key) => "$" + key);
+      tokens = (0, import_shell_quote2.parse)(command, (key) => "$" + key);
     } catch {
       return command;
     }
@@ -6792,7 +7058,7 @@ function stripDataArgs(command) {
     const contextSubcommands = segmentTopCmd ? DATA_BEARING_CONTEXTS[segmentTopCmd] : void 0;
     const inDataBearingContext = contextSubcommands === null || contextSubcommands !== void 0 && segmentSubCmd !== null && contextSubcommands.has(segmentSubCmd);
     if (inDataBearingContext) {
-      const heredoc = HEREDOC_OPEN.exec(tok);
+      const heredoc = HEREDOC_OPEN2.exec(tok);
       if (heredoc) {
         const delim = heredoc[2];
         const closes = (t) => t === delim || t.endsWith("\n" + delim);
@@ -7502,7 +7768,7 @@ function nearMiss(req, rule) {
 // src/hooks/runtime/guard-rules-cache.ts
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync6, existsSync as existsSync11, mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { join as join8 } from "node:path";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
@@ -11616,7 +11882,7 @@ function parseRuleFields(raw) {
 
 // src/hooks/runtime/guard-rules-cache.ts
 var DEFAULT_CACHE_FILE = join8(
-  homedir7(),
+  homedir8(),
   ".cybedefend",
   "guards-cache.json"
 );
@@ -11885,9 +12151,9 @@ function detectPromptInjection(text) {
 // src/hooks/runtime/judge-cache.ts
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync6 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 var DEFAULT_JUDGE_CACHE_FILE = join9(
-  homedir8(),
+  homedir9(),
   ".cybedefend",
   "guards-judge-cache.json"
 );
@@ -11933,7 +12199,7 @@ function ensureDirFor3(filePath) {
 }
 
 // src/hooks/runtime/guard-check.ts
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 import { join as join11 } from "node:path";
 
 // src/hooks/runtime/guard-violations-buffer.ts
@@ -11945,10 +12211,10 @@ import {
   mkdirSync as mkdirSync7
 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 import { join as join10 } from "node:path";
 var DEFAULT_BUFFER_FILE = join10(
-  homedir9(),
+  homedir10(),
   ".cybedefend",
   "guards-violations-buffer.jsonl"
 );
@@ -12578,7 +12844,7 @@ function emitAgentMessage(verdict, message) {
 }
 function makeProductionJudgeDeps() {
   const cache = makeJudgeCache();
-  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join11(homedir10(), ".cybedefend");
+  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join11(homedir11(), ".cybedefend");
   const warnTracker = defaultSessionTracker(
     join11(warnDir, "guards-judge-warned-sessions.json")
   );