@event4u/agent-config 14.22.0 → 15.0.0

package/src/scripts/hook_manifest.yaml

@@ -44,14 +44,13 @@ concerns:
     fail_closed: false
     severity: advisory
     needs_payload_bodies: [result]
-  # Hot-context working-memory cache (road-to-second-brain Phase 1).
-  # stop: deterministic, redacted 400-word overwrite of
-  # agents/runtime/state/hot-context.md from the chat-history JSONL.
-  # session_start: staleness-checked restore; the dispatcher forwards the
-  # returned `context` block to its own stdout (Claude Code SessionStart
-  # injection; on Claude, source=compact re-injects after compaction).
-  # Runs AFTER chat-history in both slots so the stop-write sees the final
-  # session entries. Never blocks.
+  # Restore persisted memory session index (road-to-memory-retrieval-economy
+  # P5). session_start only: the dispatcher forwards the returned `context`
+  # block to its own stdout (Claude Code SessionStart injection).
+  # The working-memory CACHE this concern used to write on stop / session_end /
+  # pre_compact was retired in road-to-continuity-writer-activation step 3.1;
+  # the id is kept deliberately, so the restore stays a tagged concern rather
+  # than untagged running code. Never blocks.
   hot-context:
     script: src/scripts/hot_context_hook.ts
     args: []
@@ -62,7 +61,7 @@ concerns:
   # agents/runtime/state/handoff-context.md, inject it as spotlighted DATA
   # and DELETE the file (consume-once; a >48h stamp discards instead).
   # Runs directly AFTER hot-context so the handoff lands after the generic
-  # cache. Never blocks.
+  # session-index block. Never blocks.
   handoff-context:
     script: src/scripts/handoff_context_hook.ts
     args: []
@@ -416,8 +415,25 @@ concerns:
   # and 5,037 of those were a leading `VAR=…` assignment — a shape no allowlist
   # pattern can express. It shrinks only by not being written.
   #
-  # Warn-only, once per session, ON by default with `hooks.chain_nudge.enabled:
-  # false` as the opt-out. The inverted default is deliberate and differs from
+  # SECOND SHAPE CLASS (2026-09-10). A Bash command that fills a file — `sed
+  # -i`, `cat > f`, `tee f`, `perl -i`, a `python3 -c` opening a path for
+  # writing — costs a confirmation no allowlist entry removes: the host's own
+  # permission documentation records a permanent saved rule for a read-only
+  # command and a session-lifetime one for a write-shaped command, so the same
+  # shape is confirmed again next session. Edit and Write carry no such expiry
+  # inside the working directory. Measured 2026-09-10 over 7,569 distinct real
+  # Bash calls in 39 transcripts: 306 (4.0 %) wrote a file through the shell,
+  # 216 of them `cat >` — a FLOOR, since the rules are a positive list of five
+  # commands rather than a redirect scanner. Re-measure with
+  # `./scripts-run src/scripts/autonomy_friction_traffic`.
+  #
+  # Warn-only, once per SHAPE CLASS per session, ON by default with
+  # `hooks.chain_nudge.enabled: false` as the opt-out. Per class, not per
+  # call: the anti-nagging decision this concern was written under refuses
+  # repeating a line every call, and a single boolean latch would have let
+  # whichever shape came first silence the other for the rest of the session.
+  #
+  # The inverted default is deliberate and differs from
   # `code-graph-context` below: that one gates on a project capability that may
   # be absent, while the fact this one carries is a property of the HOST's
   # permission matcher and therefore holds in every consumer.
@@ -1262,16 +1278,39 @@ platforms:
   augment:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
-    stop:             [chat-history, hot-context, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
+    stop:             [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
   claude:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register, journal-record]
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush, journal-record]
-    stop:             [chat-history, hot-context, verify-before-complete, team-review-gate, end-review-nudge, turn-end-gate, self-repair, session-register, session-eol, interruption-ledger, roadmap-progress, design-pass-stop, suggestion-capture, journal-record, run-continuation]
+    stop:             [chat-history, verify-before-complete, team-review-gate, end-review-nudge, turn-end-gate, self-repair, session-register, session-eol, interruption-ledger, roadmap-progress, design-pass-stop, suggestion-capture, journal-record, run-continuation]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, delegation-nudge, skill-route, git-authorization, session-canary, self-repair, session-register, rule-inject, suggestion-capture, journal-record]
-    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, rule-inject]
+    # `rule-inject` was bound here and is not any more
+    # (road-to-delivery-for-every-host 3.2, owner ruling E2). E2's strategy is
+    # `user_prompt_submit` + `pre_compact`; this slot is the hottest one in the
+    # manifest and its measured gate-open p90 for the concern is 19,649 B against
+    # a 2,048-byte slot sum cap E2 keeps unchanged. The three rules that were
+    # reachable ONLY from this slot — design-review-after-ui-write,
+    # source-of-truth, ui-audit-gate — lose nothing: `project_thin_rules.path_only_ids`
+    # keeps a path-only rule full-bodied, the same exemption a trigger-less rule
+    # already had, so they are projected eagerly instead of delivered.
+    #
+    # WHAT "LOSE NOTHING" DOES NOT COVER, added 2026-09-08 after R2 finding 1 read
+    # the sentence above as covering more than those three. It is accurate for the
+    # three and silent about the class next to them: 18 rules carry BOTH path and
+    # non-path triggers, `path_only_ids` uses `every`, so all 18 are THINNED and
+    # their path-shaped half has no carrier once this binding is gone. They keep
+    # every keyword / phrase / command route through the concern, and on this host
+    # they never had a separate host-native path route — `_claude_paths_plan` emits
+    # no `paths:` for a mixed-trigger rule on purpose — so what is lost is the
+    # difference between loading unconditionally and being delivered on a prompt
+    # match. The names, the measurement and the reason the exemption is not widened
+    # (+16,329 GPT tok, +69 % on the thin rule layer) are in
+    # `project_thin_rules.path_only_ids`; the receiver is
+    # `agents/roadmaps/stubs/road-to-a-path-route-under-delivery.md`.
+    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, language-mirror, design-pass, journal-record]
     # `language-mirror` — round-5 § 6.1. `pre_compact` sets a pin-lost marker;
     # the `post_tool_use` entry above re-emits the pin exactly once while that
@@ -1281,15 +1320,7 @@ platforms:
     # Claude Code transcript fact. (It was the ONLY binding on this slot until
     # the entry below; that sentence is retired rather than left to rot.)
     #
-    # `hot-context` — road-to-inbox-harvest-2026-08-d-context-ledger Step 2.1.
-    # This is the one slot that fires WHILE state is being destroyed, and it
-    # carried no WRITER at all: the cache a post-compaction `session_start`
-    # restores was written at the last `stop`, so everything the session did
-    # between that stop and the compaction was lost with it. The concern is
-    # already bound on `stop` and `session_start`; this adds the write at the
-    # moment the loss actually happens. Deterministic rebuild, emits nothing
-    # here — the 4,096-byte row it carries is for its session_start restore.
-    pre_compact:      [language-mirror, hot-context, rule-inject, journal-record]
+    pre_compact:      [language-mirror, rule-inject, journal-record]
     # road-to-subagent-lifecycle-integrity Phase 1 Step 1. `claude` is the only
     # platform where both native events were measured present on the installed
     # binary (2.1.229 — see the evidence page cited on the alias rows below).
@@ -1323,7 +1354,7 @@ platforms:
     # is later verified to forward it. Binding them here would be dead
     # weight: the concern still runs (git diff, transcript scan, classifier),
     # still costs the dispatch, and its entire output is thrown away.
-    stop:             [chat-history, hot-context, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
+    stop:             [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
@@ -1348,7 +1379,7 @@ platforms:
   cursor:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
-    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
+    stop:               [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
@@ -1363,7 +1394,7 @@ platforms:
   cline:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
-    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
+    stop:               [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
@@ -1381,7 +1412,7 @@ platforms:
   # minimal-safe-diff is omitted entirely on Windsurf for the same reason.
   windsurf:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness, surface-probe, session-register]
-    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register, design-pass-stop]
+    stop:               [chat-history, verify-before-complete, self-repair, session-register, design-pass-stop]
     # language-mirror IS bound here: unlike minimal-safe-diff it needs only the
     # user_prompt_submit slot, which Windsurf has.
     user_prompt_submit: [chat-history, verify-before-complete, language-mirror, git-authorization, session-canary, self-repair, session-register]
@@ -1399,7 +1430,7 @@ platforms:
   gemini:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
-    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
+    stop:               [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 

package/src/scripts/hooks/block_speaking_inbox_dir.ts

@@ -22,7 +22,13 @@
  *
  * Refuses: a Write/Edit/NotebookEdit (or cross-platform equivalent) whose
  * target path introduces a **new** first-level directory under `agents/tmp/`
- * or `agents/tmp.old/` whose name is not an opaque round identifier.
+ * or `agents/tmp.old/` whose name is not an opaque round identifier — and a
+ * shell command carrying its path. Two narrowings bring the code closer to
+ * that sentence without classifying commands: a read tool's `file_path` is
+ * filtered by `_READ_ONLY_TOOLS`, and a directory name that is a GLOB over an
+ * acceptable one is not a creatable literal
+ * ({@link isGlobOverAcceptableInboxDir}). Both were judged unconditionally
+ * before, which is what refused a read command in this guard's own workflow.
  *
  * Allowed, deliberately:
  *
@@ -62,6 +68,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { isNonHarvestTmpDir, isOpaqueRoundId } from '../_lib/source_shape.js';
+import { invokedSegments } from './git_command_classifier.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -76,10 +83,146 @@ const _PATH_KEYS: readonly string[] = [
     'file_path', 'path', 'target_file', 'filename', 'filePath', 'notebook_path',
 ];
 
+/**
+ * Tools whose `file_path` names something to READ, never something to write.
+ *
+ * `_PATH_KEYS` covers `file_path` and `path`, which is exactly what a Read,
+ * Grep or Glob call carries — so a search under a speaking round that does not
+ * exist yet was refused by a guard whose own docstring scopes itself to
+ * `Write/Edit/NotebookEdit`. Filtering here rather than through the manifest's
+ * `tools:` key on purpose: that key is an exact match on the host's own tool
+ * name, so an allowlist written in Claude's vocabulary would silence this
+ * guard on every host that spells its write tools differently. A DENY-list of
+ * read tools fails the other way — an unrecognised tool is still judged.
+ *
+ * An envelope with no tool name is judged too, for the same reason
+ * `_concern_matches_tool` runs a concern when the field is absent: a key that
+ * cannot decide must not be what silences a blocking guard.
+ */
+const _READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+    'read', 'grep', 'glob', 'notebookread', 'ls', 'view', 'search',
+    'codebase-retrieval', 'codebase_retrieval', 'file_search', 'grep_search',
+    'read_file', 'list_dir', 'semantic_search',
+]);
+
 function _isObject(v: JsonValue | undefined): v is JsonObject {
     return v !== null && v !== undefined && typeof v === 'object' && !Array.isArray(v);
 }
 
+/**
+ * A directory name that is a GLOB over an already-acceptable name.
+ *
+ * READING IS NOT CREATING, AND THE COMMAND SCAN DID NOT KNOW IT. Measured
+ * twice in one session while running the inbox flow over a real round:
+ * `ls -d agents/tmp/inbox-2026-09-*` — the command the naming rule tells an
+ * operator to run to find a free round identifier — was refused, because the
+ * scan in `main` offered every whitespace token to the same verdict that judges
+ * a Write target and `inbox-2026-09-*` is not an opaque identifier: the `*`
+ * fails the 1-3 char disambiguator. So the guard stood between the operator and
+ * the rule it exists to enforce.
+ *
+ * WHY THIS AXIS AND NOT THE VERB. The first two attempts classified the
+ * COMMAND — an allowlist of read-only verbs, then per-verb writing markers.
+ * Two rounds of neutral review took that apart from both ends: round 1 found
+ * `sed -i`, `find -exec` and `awk system()` allowed where the plain token scan
+ * had blocked them; round 2 found the siblings the resulting deny-list did not
+ * reach (`sed`'s `s///w`, `awk`'s output pipe, `sort -o`, `yq -i`), a false
+ * positive the awk marker reintroduced by running past the program into a shell
+ * redirect, mention-blocking on heredoc bodies, and a fail-OPEN when the
+ * segmenter returned nothing. Its handoff named the shape of the problem:
+ * *"3 and 5 pull in opposite directions, so patching them one probe at a time
+ * will keep oscillating."*
+ *
+ * It was the wrong axis, and the measured defect never needed it. What is
+ * actually decidable from the token alone is whether the name could be created
+ * AS WRITTEN, and a glob cannot: the shell expands it against what exists. The
+ * one thing that could — `mkdir 'inbox-2026-09-*'`, creating a literal
+ * directory with a `*` in it — produces a name this predicate accepts anyway,
+ * because its non-glob part is opaque and carries no source. So the carve-out
+ * is safe by construction rather than by enumeration, and every writing form
+ * above is judged again by the unchanged token scan.
+ *
+ * A pattern over a SPEAKING name (`my-source-*`) is not accepted: the glob
+ * characters are removed and the remainder must itself pass.
+ */
+function isGlobOverAcceptableInboxDir(name: string): boolean {
+    if (!/[*?[\]]/.test(name)) {
+        return false;
+    }
+    const literal = name.replace(/[*?]|\[[^\]]*\]/g, '');
+    const trimmed = literal.replace(/-+$/, '');
+    return trimmed !== '' && isAcceptableInboxDir(trimmed);
+}
+
+/**
+ * The paths a redirect inside one segment would create.
+ *
+ * `splitOutsideQuotes` treats `;`, `|`, `&` and newline as separators and `>`
+ * as ordinary text, so a redirect target stays inside its segment. Collected
+ * separately from the token scan because the quotes matter: the token split
+ * removes them, this does not, and both inbox regexes need `agents` at a `/`
+ * or at the start — so `> "agents/tmp/<name>/x"` read as not-an-inbox-path
+ * until the strip below. Also run over the RAW command, because the heredoc
+ * regex in `invokedSegments` swallows a redirect that follows the delimiter.
+ */
+function _redirectTargets(segment: string): string[] {
+    const out: string[] = [];
+    const re = /(?:^|[^0-9<>&])[0-9]*>>?\s*([^\s|&;<>]+)/g;
+    let m: RegExpExecArray | null = re.exec(segment);
+    while (m !== null) {
+        // The character class stops at whitespace and separators but NOT at a
+        // quote, while both inbox regexes require `agents` at a `/` or at the
+        // start of the string. So `> "agents/tmp/<name>/x"` came back as
+        // `"agents/tmp/…` and read as not-an-inbox-path — allowed, where the
+        // unquoted form blocked. A neutral review probed it; stripping the
+        // quotes is the whole fix.
+        const target = (m[1] ?? '').replace(/^['"`]+|['"`]+$/g, '');
+        if (target) {
+            out.push(target);
+        }
+        m = re.exec(segment);
+    }
+    return out;
+}
+
+/**
+ * The tokens of a shell command whose CREATION this guard should judge.
+ *
+ * Every whitespace token, exactly as before this change — the classification
+ * that tried to be cleverer than this is gone, and the docstring on
+ * {@link isGlobOverAcceptableInboxDir} records why. The two things kept are
+ * the ones no review disputed: the RAW command is scanned as well, because
+ * `invokedSegments` strips heredoc bodies as data and a `python3 - <<PY` body
+ * calling `makedirs` is precisely this guard's input; and redirect targets are
+ * collected separately with their quotes stripped, because `>` is not a
+ * segment separator and `> "path"` otherwise read as not-a-path.
+ *
+ * Scanning the raw command in addition to the segments is deliberately
+ * redundant rather than conditional: a heredoc predicate is one more thing to
+ * get wrong, the extra tokens can only ever matter if one of them names a
+ * speaking inbox directory, and the mention-blocking a review found came from
+ * the read-only SKIP being dropped for heredocs — not from the extra scan.
+ *
+ * Exported so the harness can pin the polarity pair on the tokens themselves,
+ * without an envelope.
+ */
+export function creatableTokens(command: string): string[] {
+    const out: string[] = [];
+    const segments = invokedSegments(command);
+    for (const seg of segments) {
+        out.push(..._redirectTargets(seg));
+    }
+    out.push(..._redirectTargets(command));
+    for (const text of [...segments, command]) {
+        for (const tok of text.split(/[\s"'`(){};|&<>]+/)) {
+            if (tok) {
+                out.push(tok);
+            }
+        }
+    }
+    return out;
+}
+
 /** `agents/tmp/<name>/…` or `agents/tmp.old/<name>/…`, after normalisation. */
 const INBOX_RE = /(?:^|\/)agents\/tmp(?:\.old)?\/([^/]+)\/./;
 
@@ -145,6 +288,9 @@ export function verdictFor(
     if (isAcceptableInboxDir(dir)) {
         return { block: false, dir, reason: 'opaque round identifier or named working set' };
     }
+    if (isGlobOverAcceptableInboxDir(dir)) {
+        return { block: false, dir, reason: 'glob over an acceptable name — not a creatable literal' };
+    }
     // Already created — a rename is the fix, and refusing every later write
     // would wedge the round without removing the name.
     //
@@ -153,17 +299,36 @@ export function verdictFor(
     // `agents/tmp-notes/` and `agents/tmpfiles/`, and taking the FIRST
     // occurrence meant a path carrying a decoy earlier segment probed the wrong
     // directory — in either direction. Found by the R2 review of this branch.
+    // THE CAPTURE CARRIES THE PATH'S OWN PREFIX, and it did not. Anchoring the
+    // group at `agents/` discarded everything before it, so a nested inbox —
+    // `app/Modules/<m>/agents/tmp/<round>/…`, the shape a module-per-package
+    // tree produces — probed `<repoRoot>/agents/tmp/<round>`, a directory that
+    // does not exist. The already-exists carve-out could therefore never fire
+    // there, and every write into a nested speaking round was refused forever
+    // instead of once.
+    //
+    // The prefix group is `??` — optional AND preferring ABSENT — and that is
+    // the half a neutral review had to point out. A greedy `(?:.*\/)?`
+    // resolves to the LAST inbox segment in the path while `inboxDirName`
+    // reads the FIRST, so a path carrying two of them judged one directory and
+    // probed another, reporting "already exists" for a name that does not.
+    // Making only `.*` lazy is NOT enough: `(...)?` still prefers one
+    // repetition, so the engine grows the prefix rather than trying the
+    // no-prefix branch, and the long match wins anyway — the test for this
+    // caught exactly that. `??` tries no-prefix first, so both reads agree.
+    // The decoy case below still resolves: `agents/tmp-notes/` fails the `/`
+    // after `tmp`, so the no-prefix branch is rejected and the match advances.
     const normalized = filePath.replace(/\\/g, '/').replace(/^(\.\/)+/, '');
     const m =
-        /(?:^|\/)(agents\/tmp(?:\.old)?\/[^/]+)\//.exec(normalized) ??
-        /(?:^|\/)(agents\/tmp(?:\.old)?\/[^/.]+)\/?$/.exec(normalized);
+        /^((?:.*?\/)??agents\/tmp(?:\.old)?\/[^/]+)\//.exec(normalized) ??
+        /^((?:.*?\/)??agents\/tmp(?:\.old)?\/[^/.]+)\/?$/.exec(normalized);
     if (m === null) {
         // `inboxDirName` matched but this did not — treat as unattributable and
         // BLOCK, since the name is speaking and we cannot prove it pre-exists.
         return { block: true, dir, reason: 'new inbox directory with a speaking name (path not re-anchorable)' };
     }
     const upto = m[1] as string;
-    const probe = repoRoot === '' ? upto : path.join(repoRoot, upto);
+    const probe = repoRoot === '' || path.isAbsolute(upto) ? upto : path.join(repoRoot, upto);
     if (exists(probe)) {
         return { block: false, dir, reason: 'directory already exists — rename, do not re-refuse' };
     }
@@ -216,11 +381,15 @@ export function main(): number {
             return 0;
         }
         const repoRoot = typeof envelope['project_dir'] === 'string' ? envelope['project_dir'] : '';
+        const rawTool = payload['tool_name'] ?? envelope['tool_name'];
+        const toolName = typeof rawTool === 'string' ? rawTool.trim().toLowerCase() : '';
         const candidates: string[] = [];
-        for (const key of _PATH_KEYS) {
-            const v = ti[key];
-            if (typeof v === 'string' && v) {
-                candidates.push(v);
+        if (!_READ_ONLY_TOOLS.has(toolName)) {
+            for (const key of _PATH_KEYS) {
+                const v = ti[key];
+                if (typeof v === 'string' && v) {
+                    candidates.push(v);
+                }
             }
         }
         // A shell command creates the directory just as effectively as a Write,
@@ -228,16 +397,13 @@ export function main(): number {
         // agents/tmp/<speaking-name>`, a `git mv` into one, or a redirect
         // bypassed it entirely. Both siblings on this slot (`block_no_verify`,
         // `block_kernel_rule_writes`) parse the command string; this one did
-        // not, and the R2 review of this branch caught it. Every whitespace
-        // token of the command is offered to the same pure verdict, so the
-        // decision logic is shared rather than duplicated.
+        // not, and the R2 review of this branch caught it. The tokens that
+        // could CREATE something are offered to the same pure verdict, so the
+        // decision logic is shared rather than duplicated — see
+        // `creatableTokens` for why "every whitespace token" was too many.
         const cmd = ti['command'] ?? (_isObject(envelope['payload']) ? (envelope['payload'] as JsonObject)['command'] : undefined);
         if (typeof cmd === 'string' && cmd) {
-            for (const tok of cmd.split(/[\s"'`(){};|&<>]+/)) {
-                if (tok) {
-                    candidates.push(tok);
-                }
-            }
+            candidates.push(...creatableTokens(cmd));
         }
         for (const v of candidates) {
             const verdict = verdictFor(v, (p) => fs.existsSync(p), repoRoot);

package/src/scripts/hooks/category_a.ts

@@ -57,7 +57,7 @@ const PATH_KEYS: readonly string[] = [
  * tries to parse past them is a shell parser with a security boundary attached.
  * Refusing the whole shape is both smaller and correct.
  */
-const SHELL_METACHARACTERS = /[;&|`$><\n\r(){}\\]/;
+export const SHELL_METACHARACTERS = /[;&|`$><\n\r(){}\\]/;
 
 /**
  * Words naming a consequence operation, matched as whole tokens anywhere in