@doingdev/opencode-claude-manager-plugin 0.1.35 → 0.1.42

package/dist/claude/claude-agent-sdk-adapter.js

@@ -162,6 +162,7 @@ export class ClaudeAgentSdkAdapter {
             forkSession: input.forkSession,
             persistSession: input.persistSession,
             includePartialMessages: input.includePartialMessages,
+            enableFileCheckpointing: false,
             settingSources: input.settingSources,
             maxTurns: input.maxTurns,
             model: input.model,

package/dist/manager/git-operations.d.ts

@@ -2,10 +2,19 @@ import type { GitDiffResult, GitOperationResult } from '../types/contracts.js';
 export declare class GitOperations {
     private readonly cwd;
     constructor(cwd: string);
-    diff(): Promise<GitDiffResult>;
+    diff(options?: {
+        paths?: string[];
+        staged?: boolean;
+        ref?: string;
+    }): Promise<GitDiffResult>;
     diffStat(): Promise<string>;
     commit(message: string): Promise<GitOperationResult>;
     resetHard(): Promise<GitOperationResult>;
+    status(): Promise<{
+        output: string;
+        isClean: boolean;
+    }>;
+    log(count?: number): Promise<string>;
     currentBranch(): Promise<string>;
     recentCommits(count?: number): Promise<string>;
     private git;

package/dist/manager/git-operations.js

@@ -6,10 +6,15 @@ export class GitOperations {
     constructor(cwd) {
         this.cwd = cwd;
     }
-    async diff() {
+    async diff(options = {}) {
+        const ref = options.staged ? '--cached' : (options.ref ?? 'HEAD');
+        const args = ['diff', ref];
+        if (options.paths && options.paths.length > 0) {
+            args.push('--', ...options.paths);
+        }
         const [diffText, statOutput] = await Promise.all([
-            this.git(['diff', 'HEAD']),
-            this.git(['diff', 'HEAD', '--stat']),
+            this.git(args),
+            this.git([...args, '--stat']),
         ]);
         const stats = parseStatLine(statOutput);
         return {
@@ -50,6 +55,16 @@ export class GitOperations {
             };
         }
     }
+    async status() {
+        const output = await this.git(['status', '-s']);
+        return {
+            output,
+            isClean: output.trim().length === 0,
+        };
+    }
+    async log(count = 5) {
+        return this.git(['log', '--oneline', `-${count}`]);
+    }
     async currentBranch() {
         const branch = await this.git(['rev-parse', '--abbrev-ref', 'HEAD']);
         return branch.trim();

package/dist/manager/persistent-manager.d.ts

@@ -35,11 +35,26 @@ export declare class PersistentManager {
     /**
      * Get the current git diff.
      */
-    gitDiff(): Promise<GitDiffResult>;
+    gitDiff(options?: {
+        paths?: string[];
+        staged?: boolean;
+        ref?: string;
+    }): Promise<GitDiffResult>;
     /**
      * Commit all current changes.
      */
     gitCommit(message: string): Promise<GitOperationResult>;
+    /**
+     * Get git status summary.
+     */
+    gitStatus(): Promise<{
+        output: string;
+        isClean: boolean;
+    }>;
+    /**
+     * Get recent commit log.
+     */
+    gitLog(count?: number): Promise<string>;
     /**
      * Hard reset to discard all uncommitted changes.
      */

package/dist/manager/persistent-manager.js

@@ -35,8 +35,8 @@ export class PersistentManager {
     /**
      * Get the current git diff.
      */
-    async gitDiff() {
-        return this.gitOps.diff();
+    async gitDiff(options = {}) {
+        return this.gitOps.diff(options);
     }
     /**
      * Commit all current changes.
@@ -44,6 +44,18 @@ export class PersistentManager {
     async gitCommit(message) {
         return this.gitOps.commit(message);
     }
+    /**
+     * Get git status summary.
+     */
+    async gitStatus() {
+        return this.gitOps.status();
+    }
+    /**
+     * Get recent commit log.
+     */
+    async gitLog(count = 5) {
+        return this.gitOps.log(count);
+    }
     /**
      * Hard reset to discard all uncommitted changes.
      */

package/dist/metadata/claude-metadata.service.d.ts

@@ -0,0 +1,12 @@
+import type { ClaudeMetadataSnapshot, ClaudeSettingSource } from '../types/contracts.js';
+import type { ClaudeAgentSdkAdapter } from '../claude/claude-agent-sdk-adapter.js';
+import type { RepoClaudeConfigReader } from './repo-claude-config-reader.js';
+export declare class ClaudeMetadataService {
+    private readonly configReader;
+    private readonly sdkAdapter;
+    constructor(configReader: RepoClaudeConfigReader, sdkAdapter: ClaudeAgentSdkAdapter);
+    collect(cwd: string, options?: {
+        includeSdkProbe?: boolean;
+        settingSources?: ClaudeSettingSource[];
+    }): Promise<ClaudeMetadataSnapshot>;
+}

package/dist/metadata/claude-metadata.service.js

@@ -0,0 +1,38 @@
+export class ClaudeMetadataService {
+    configReader;
+    sdkAdapter;
+    constructor(configReader, sdkAdapter) {
+        this.configReader = configReader;
+        this.sdkAdapter = sdkAdapter;
+    }
+    async collect(cwd, options = {}) {
+        const baseSnapshot = await this.configReader.read(cwd);
+        if (!options.includeSdkProbe) {
+            return dedupeSnapshot(baseSnapshot);
+        }
+        const capabilities = await this.sdkAdapter.probeCapabilities(cwd, options.settingSources);
+        return dedupeSnapshot({
+            ...baseSnapshot,
+            commands: [...baseSnapshot.commands, ...capabilities.commands],
+            agents: capabilities.agents,
+        });
+    }
+}
+function dedupeSnapshot(snapshot) {
+    return {
+        ...snapshot,
+        commands: dedupeByName(snapshot.commands),
+        skills: dedupeByName(snapshot.skills),
+        hooks: dedupeByName(snapshot.hooks),
+        agents: dedupeByName(snapshot.agents),
+    };
+}
+function dedupeByName(items) {
+    const seen = new Map();
+    for (const item of items) {
+        if (!seen.has(item.name)) {
+            seen.set(item.name, item);
+        }
+    }
+    return [...seen.values()].sort((left, right) => left.name.localeCompare(right.name));
+}

package/dist/metadata/repo-claude-config-reader.d.ts

@@ -0,0 +1,7 @@
+import type { ClaudeMetadataSnapshot } from '../types/contracts.js';
+export declare class RepoClaudeConfigReader {
+    read(cwd: string): Promise<ClaudeMetadataSnapshot>;
+    private readSkills;
+    private readCommands;
+    private readSettings;
+}

package/dist/metadata/repo-claude-config-reader.js

@@ -0,0 +1,154 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import JSON5 from 'json5';
+export class RepoClaudeConfigReader {
+    async read(cwd) {
+        const claudeDirectory = path.join(cwd, '.claude');
+        const skillsDirectory = path.join(claudeDirectory, 'skills');
+        const commandsDirectory = path.join(claudeDirectory, 'commands');
+        const claudeMdCandidates = [
+            path.join(cwd, 'CLAUDE.md'),
+            path.join(claudeDirectory, 'CLAUDE.md'),
+        ];
+        const collectedAt = new Date().toISOString();
+        const [skills, commands, settingsResult, claudeMdPath] = await Promise.all([
+            this.readSkills(skillsDirectory),
+            this.readCommands(commandsDirectory),
+            this.readSettings(claudeDirectory),
+            findFirstExistingPath(claudeMdCandidates),
+        ]);
+        return {
+            collectedAt,
+            cwd,
+            commands: [...skillsToCommands(skills), ...commands],
+            skills,
+            hooks: settingsResult.hooks,
+            agents: [],
+            claudeMdPath: claudeMdPath ?? undefined,
+            settingsPaths: settingsResult.settingsPaths,
+        };
+    }
+    async readSkills(directory) {
+        if (!(await pathExists(directory))) {
+            return [];
+        }
+        const entries = await fs.readdir(directory, { withFileTypes: true });
+        const skills = await Promise.all(entries
+            .filter((entry) => entry.isDirectory())
+            .map(async (entry) => {
+            const skillPath = path.join(directory, entry.name, 'SKILL.md');
+            if (!(await pathExists(skillPath))) {
+                return null;
+            }
+            const content = await fs.readFile(skillPath, 'utf8');
+            return {
+                name: entry.name,
+                description: extractMarkdownDescription(content),
+                path: skillPath,
+                source: 'skill',
+            };
+        }));
+        return skills.filter((skill) => skill !== null);
+    }
+    async readCommands(directory) {
+        if (!(await pathExists(directory))) {
+            return [];
+        }
+        const commandFiles = await collectMarkdownFiles(directory);
+        const commands = await Promise.all(commandFiles.map(async (commandPath) => {
+            const content = await fs.readFile(commandPath, 'utf8');
+            return {
+                name: path.basename(commandPath, path.extname(commandPath)),
+                description: extractMarkdownDescription(content),
+                source: 'command',
+                path: commandPath,
+            };
+        }));
+        return commands.sort((left, right) => left.name.localeCompare(right.name));
+    }
+    async readSettings(claudeDirectory) {
+        const candidatePaths = [
+            path.join(claudeDirectory, 'settings.json'),
+            path.join(claudeDirectory, 'settings.local.json'),
+        ];
+        const settingsPaths = [];
+        const hooks = [];
+        for (const candidatePath of candidatePaths) {
+            if (!(await pathExists(candidatePath))) {
+                continue;
+            }
+            settingsPaths.push(candidatePath);
+            const content = await fs.readFile(candidatePath, 'utf8');
+            const parsed = JSON5.parse(content);
+            const hookEntries = Object.entries(parsed.hooks ?? {});
+            for (const [hookName, hookValue] of hookEntries) {
+                const hookMatchers = Array.isArray(hookValue) ? hookValue : [hookValue];
+                for (const hookMatcher of hookMatchers) {
+                    if (!hookMatcher || typeof hookMatcher !== 'object') {
+                        continue;
+                    }
+                    const matcher = typeof hookMatcher.matcher === 'string'
+                        ? hookMatcher.matcher
+                        : undefined;
+                    const commandCount = Array.isArray(hookMatcher.hooks)
+                        ? (hookMatcher.hooks?.length ?? 0)
+                        : 0;
+                    hooks.push({
+                        name: hookName,
+                        matcher,
+                        sourcePath: candidatePath,
+                        commandCount,
+                    });
+                }
+            }
+        }
+        return {
+            settingsPaths,
+            hooks,
+        };
+    }
+}
+function extractMarkdownDescription(markdown) {
+    const lines = markdown
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const descriptionLine = lines.find((line) => !line.startsWith('#') && !line.startsWith('---'));
+    return descriptionLine ?? 'No description provided.';
+}
+async function collectMarkdownFiles(directory) {
+    const entries = await fs.readdir(directory, { withFileTypes: true });
+    const files = await Promise.all(entries.map(async (entry) => {
+        const resolvedPath = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+            return collectMarkdownFiles(resolvedPath);
+        }
+        return entry.name.endsWith('.md') ? [resolvedPath] : [];
+    }));
+    return files.flat();
+}
+async function pathExists(candidatePath) {
+    try {
+        await fs.access(candidatePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function findFirstExistingPath(candidatePaths) {
+    for (const candidatePath of candidatePaths) {
+        if (await pathExists(candidatePath)) {
+            return candidatePath;
+        }
+    }
+    return null;
+}
+function skillsToCommands(skills) {
+    return skills.map((skill) => ({
+        name: skill.name,
+        description: skill.description,
+        source: 'skill',
+        path: skill.path,
+    }));
+}

package/dist/plugin/agent-hierarchy.d.ts

@@ -11,7 +11,7 @@ export declare const AGENT_CTO = "cto";
 export declare const AGENT_ENGINEER_PLAN = "engineer_plan";
 export declare const AGENT_ENGINEER_BUILD = "engineer_build";
 /** All restricted tool IDs (union of all domain groups) */
-export declare const ALL_RESTRICTED_TOOL_IDS: readonly ["explore", "implement", "compact_context", "clear_session", "session_health", "list_transcripts", "list_history", "git_diff", "git_commit", "git_reset", "approval_policy", "approval_decisions", "approval_update"];
+export declare const ALL_RESTRICTED_TOOL_IDS: readonly ["explore", "implement", "compact_context", "clear_session", "session_health", "list_transcripts", "list_history", "git_diff", "git_commit", "git_reset", "git_status", "git_log", "approval_policy", "approval_decisions", "approval_update"];
 type ToolPermission = 'allow' | 'ask' | 'deny';
 type AgentPermission = {
     '*'?: ToolPermission;

package/dist/plugin/agent-hierarchy.js

@@ -30,7 +30,7 @@ const ENGINEER_PLAN_TOOL_IDS = ['explore', ...ENGINEER_SHARED_TOOL_IDS];
 /** Tools for the engineer_build wrapper (build-mode send + shared) */
 const ENGINEER_BUILD_TOOL_IDS = ['implement', ...ENGINEER_SHARED_TOOL_IDS];
 /** Git tools — owned by CTO */
-const GIT_TOOL_IDS = ['git_diff', 'git_commit', 'git_reset'];
+const GIT_TOOL_IDS = ['git_diff', 'git_commit', 'git_reset', 'git_status', 'git_log'];
 /** Approval tools — owned by CTO */
 const APPROVAL_TOOL_IDS = ['approval_policy', 'approval_decisions', 'approval_update'];
 /** All restricted tool IDs (union of all domain groups) */

package/dist/plugin/claude-manager.plugin.js

@@ -283,13 +283,27 @@ export const ClaudeManagerPlugin = async ({ worktree }) => {
                 },
             }),
             git_diff: tool({
-                description: 'Run git diff to see all current changes (staged + unstaged) relative to HEAD.',
+                description: 'Show diff of uncommitted changes. ' +
+                    'Use paths to filter to specific files/dirs. ' +
+                    'Use staged=true to see staged changes. ' +
+                    'Use ref to compare against a branch/tag/commit (e.g., ref="main").',
                 args: {
-                    cwd: tool.schema.string().optional(),
+                    paths: tool.schema.string().array().optional(),
+                    staged: tool.schema.boolean().optional(),
+                    ref: tool.schema.string().optional(),
                 },
-                async execute(_args, context) {
-                    annotateToolRun(context, 'Running git diff', {});
-                    const result = await services.manager.gitDiff();
+                async execute(args, context) {
+                    annotateToolRun(context, 'Running git diff', {
+                        paths: args.paths,
+                        staged: args.staged,
+                        ref: args.ref,
+                    });
+                    const paths = args.paths?.filter((p) => p !== undefined);
+                    const result = await services.manager.gitDiff({
+                        paths,
+                        staged: args.staged,
+                        ref: args.ref,
+                    });
                     return JSON.stringify(result, null, 2);
                 },
             }),
@@ -297,7 +311,6 @@ export const ClaudeManagerPlugin = async ({ worktree }) => {
                 description: 'Stage all changes and commit with the given message.',
                 args: {
                     message: tool.schema.string().min(1),
-                    cwd: tool.schema.string().optional(),
                 },
                 async execute(args, context) {
                     annotateToolRun(context, 'Committing changes', {
@@ -308,16 +321,36 @@ export const ClaudeManagerPlugin = async ({ worktree }) => {
                 },
             }),
             git_reset: tool({
-                description: 'Run git reset --hard HEAD and git clean -fd to discard ALL uncommitted changes and untracked files.',
-                args: {
-                    cwd: tool.schema.string().optional(),
-                },
+                description: 'Discard all uncommitted changes: runs git reset --hard HEAD and git clean -fd.',
+                args: {},
                 async execute(_args, context) {
                     annotateToolRun(context, 'Resetting working directory', {});
                     const result = await services.manager.gitReset();
                     return JSON.stringify(result, null, 2);
                 },
             }),
+            git_status: tool({
+                description: 'Show working tree status — lists changed files in short format. ' +
+                    'Returns isClean=true if nothing changed.',
+                args: {},
+                async execute(_args, context) {
+                    annotateToolRun(context, 'Checking git status', {});
+                    const result = await services.manager.gitStatus();
+                    return JSON.stringify(result, null, 2);
+                },
+            }),
+            git_log: tool({
+                description: 'Show recent commits in short format. ' +
+                    'Default shows last 5 commits. Use count to change.',
+                args: {
+                    count: tool.schema.number().optional(),
+                },
+                async execute(args, context) {
+                    annotateToolRun(context, 'Fetching git log', { count: args.count });
+                    const result = await services.manager.gitLog(args.count ?? 5);
+                    return result;
+                },
+            }),
             clear_session: tool({
                 description: 'Clear the active session to start fresh. ' +
                     'Use when context is full or starting a new task.',

package/dist/plugin/orchestrator.plugin.d.ts

@@ -0,0 +1,2 @@
+import type { Plugin } from '@opencode-ai/plugin';
+export declare const OrchestratorPlugin: Plugin;

package/dist/plugin/orchestrator.plugin.js

@@ -0,0 +1,116 @@
+import { prompts } from '../prompts/registry.js';
+import { evaluateBashCommand, extractBashCommand, } from '../safety/bash-safety.js';
+/**
+ * Thin OpenCode orchestrator plugin with Claude Code specialist subagents.
+ *
+ * - Registers `claude-code` provider via a local shim over ai-sdk-provider-claude-code.
+ * - Creates one orchestrator agent (uses the user's default OpenCode model).
+ * - Creates 4 Claude Code subagents: planning + build × opus + sonnet.
+ * - Enforces bash safety via the permission.ask hook.
+ *
+ * NOTE: Claude Code `effort` is not configurable through OpenCode provider/model
+ * options at this time. The subagent prompts compensate by setting high-quality
+ * expectations directly.
+ */
+// Resolve the shim path at module load time so it is stable for the lifetime
+// of the process. The compiled output for this file sits at dist/plugin/ and
+// the shim at dist/providers/, so we walk up one level.
+const claudeCodeShimUrl = new URL('../providers/claude-code-wrapper.js', import.meta.url).href;
+export const OrchestratorPlugin = async () => {
+    return {
+        config: async (config) => {
+            config.provider ??= {};
+            config.agent ??= {};
+            // ── Provider ──────────────────────────────────────────────────────
+            // Uses a file:// shim so OpenCode's factory-finder heuristic sees only
+            // createClaudeCode and not createAPICallError from the upstream package.
+            config.provider['claude-code'] ??= {
+                npm: claudeCodeShimUrl,
+                models: {
+                    opus: {
+                        id: 'opus',
+                        name: 'Claude Code Opus 4.6',
+                    },
+                    sonnet: {
+                        id: 'sonnet',
+                        name: 'Claude Code Sonnet 4.6',
+                    },
+                },
+            };
+            // ── Orchestrator (uses user's default model — no model set) ───────
+            config.agent['opencode-orchestrator'] ??= {
+                description: 'CTO-level orchestrator that gathers context and delegates coding to Claude Code specialists.',
+                mode: 'primary',
+                color: '#D97757',
+                prompt: prompts.orchestrator,
+                permission: {
+                    '*': 'deny',
+                    read: 'allow',
+                    grep: 'allow',
+                    glob: 'allow',
+                    list: 'allow',
+                    webfetch: 'allow',
+                    question: 'allow',
+                    todowrite: 'allow',
+                    todoread: 'allow',
+                    task: 'allow',
+                    bash: 'deny',
+                    edit: 'deny',
+                    skill: 'deny',
+                },
+            };
+            // ── Planning subagents ────────────────────────────────────────────
+            // Claude Code tools (Bash, Read, Write, Edit, …) are executed internally
+            // by the claude CLI subprocess and streamed back with providerExecuted:true.
+            // OpenCode's own tools must not be advertised to these agents.
+            const claudeCodePermissions = {
+                '*': 'deny',
+            };
+            config.agent['claude-code-planning-opus'] ??= {
+                description: 'Claude Code Opus specialist for investigation, architecture, and planning.',
+                model: 'claude-code/opus',
+                mode: 'subagent',
+                color: 'info',
+                prompt: prompts.planningAgent,
+                permission: { ...claudeCodePermissions },
+            };
+            config.agent['claude-code-planning-sonnet'] ??= {
+                description: 'Claude Code Sonnet specialist for lighter investigation and planning.',
+                model: 'claude-code/sonnet',
+                mode: 'subagent',
+                color: 'info',
+                prompt: prompts.planningAgent,
+                permission: { ...claudeCodePermissions },
+            };
+            // ── Build subagents ───────────────────────────────────────────────
+            config.agent['claude-code-build-opus'] ??= {
+                description: 'Claude Code Opus specialist for implementation and validation.',
+                model: 'claude-code/opus',
+                mode: 'subagent',
+                color: 'success',
+                prompt: prompts.buildAgent,
+                permission: { ...claudeCodePermissions },
+            };
+            config.agent['claude-code-build-sonnet'] ??= {
+                description: 'Claude Code Sonnet specialist for lighter implementation tasks.',
+                model: 'claude-code/sonnet',
+                mode: 'subagent',
+                color: 'success',
+                prompt: prompts.buildAgent,
+                permission: { ...claudeCodePermissions },
+            };
+        },
+        // ── Bash safety via permission.ask hook ────────────────────────────
+        // Handles both v1 Permission ({ type, pattern }) and v2 PermissionRequest
+        // ({ permission, patterns }) via runtime narrowing in extractBashCommand.
+        'permission.ask': async (input, output) => {
+            const command = extractBashCommand(input);
+            if (command === null)
+                return;
+            const result = evaluateBashCommand(command);
+            if (!result.allowed) {
+                output.status = 'deny';
+            }
+        },
+    };
+};

package/dist/prompts/registry.js

@@ -90,9 +90,11 @@ export const managerPromptRegistry = {
         'After each delegation:',
         '1. git_diff — read the FULL diff. Check for unintended changes, missing tests,',
         '   style violations.',
-        '2. If correct: spawn `engineer_build` to run tests/lint/typecheck.',
-        '3. If tests pass: git_commit to checkpoint.',
-        '4. If wrong: spawn `engineer_build` with a specific correction.',
+        '2. git_status — check what files changed (quick overview)',
+        '3. git_log -n 5 — see recent commits (understand context)',
+        '4. If correct: spawn `engineer_build` to run tests/lint/typecheck.',
+        '5. If tests pass: git_commit to checkpoint.',
+        '6. If wrong: spawn `engineer_build` with a specific correction.',
         '   On second failure: git_reset and rewrite the prompt from scratch.',
         '   Never send three corrections for the same problem.',
         '',
@@ -116,7 +118,9 @@ export const managerPromptRegistry = {
         '## Tools reference',
         'todowrite / todoread — track multi-step work',
         'question             — ask the user structured questions with options',
-        'git_diff             — review all uncommitted changes',
+        'git_diff             — review changes (filter with paths, staged, ref args)',
+        'git_status           — quick overview of changed files',
+        'git_log              — recent commits (default: last 5)',
         'git_commit           — stage all + commit',
         'git_reset            — hard reset + clean (destructive)',
         'approval_policy      — view tool approval rules',

package/dist/providers/claude-code-wrapper.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Thin re-export shim for ai-sdk-provider-claude-code.
+ *
+ * OpenCode's provider loader finds the provider factory by scanning
+ * `Object.keys(module).find(key => key.startsWith("create"))`. The upstream
+ * package exports `createAPICallError` before `createClaudeCode`, so OpenCode
+ * picks the wrong function and `.languageModel` ends up undefined.
+ *
+ * This shim re-exports only `createClaudeCode`, making it the sole "create*"
+ * export. The plugin references this file via a `file://` URL so the upstream
+ * package is still the actual implementation.
+ */
+export { createClaudeCode } from 'ai-sdk-provider-claude-code';

package/dist/providers/claude-code-wrapper.js

@@ -0,0 +1,13 @@
+/**
+ * Thin re-export shim for ai-sdk-provider-claude-code.
+ *
+ * OpenCode's provider loader finds the provider factory by scanning
+ * `Object.keys(module).find(key => key.startsWith("create"))`. The upstream
+ * package exports `createAPICallError` before `createClaudeCode`, so OpenCode
+ * picks the wrong function and `.languageModel` ends up undefined.
+ *
+ * This shim re-exports only `createClaudeCode`, making it the sole "create*"
+ * export. The plugin references this file via a `file://` URL so the upstream
+ * package is still the actual implementation.
+ */
+export { createClaudeCode } from 'ai-sdk-provider-claude-code';

package/dist/safety/bash-safety.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Minimal bash command safety layer.
+ * Denies known-dangerous patterns; allows everything else.
+ */
+export type BashSafetyResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+export declare function evaluateBashCommand(command: string): BashSafetyResult;
+/**
+ * Extract the bash command string from a permission hook input,
+ * handling both SDK payload shapes:
+ *
+ *   v1 Permission:       { type: string, pattern?: string | string[], metadata }
+ *   v2 PermissionRequest: { permission: string, patterns: string[], metadata }
+ *
+ * Returns `null` when the input is not a bash permission request.
+ */
+export declare function extractBashCommand(input: Record<string, unknown>): string | null;