@guilz-dev/belay 0.9.2 → 0.9.4

package/dist/core/verdict/launcher-resolve.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { expandMakeExpression, normalizeMakeRecipeLine, parseMakefileVariables, parsePhonyTargets, } from './makefile-expand.js';
+import { expandMakeExpression, normalizeMakeRecipeLine, parseMakefileVariables, } from './makefile-expand.js';
 const MAX_RESOLVE_DEPTH = 8;
 const PNPM_BUILTIN_COMMANDS = new Set([
     'add',
@@ -229,7 +229,6 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     }
     const makefileContent = readFileSync(makefilePath, 'utf8');
     const makefileVars = parseMakefileVariables(makefileContent);
-    const phonyTargets = parsePhonyTargets(makefileContent);
     const targets = parseMakefileRecipeContent(makefileContent);
     if (!targets.has(target)) {
         return { recipes: [], opaque: true, reason: 'make_target_undefined' };
@@ -237,42 +236,34 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
     const recipeLines = [];
     const visiting = new Set();
     const visited = new Set();
-    let opaquePrerequisites = false;
+    let hasDynamicPrerequisite = false;
+    let hasUndefinedPrerequisite = false;
+    let hasDependencyCycle = false;
     const collect = (name) => {
         if (visited.has(name)) {
-            return true;
+            return;
         }
         if (visiting.has(name)) {
-            return false;
+            hasDependencyCycle = true;
+            return;
         }
         const entry = targets.get(name);
         if (!entry) {
-            return true;
+            if (!existsSync(path.resolve(path.dirname(makefilePath), name))) {
+                hasUndefinedPrerequisite = true;
+            }
+            return;
         }
         visiting.add(name);
-        opaquePrerequisites ||= entry.opaquePrerequisites;
+        hasDynamicPrerequisite ||= entry.opaquePrerequisites;
         for (const prerequisite of entry.prerequisites) {
-            if (targets.has(prerequisite) && !collect(prerequisite)) {
-                return false;
-            }
-        }
-        // When the requested target has its own recipes, treat those as the
-        // authorization authority. Skip .PHONY / `_`-prefixed prerequisite
-        // recipes (e.g. `_start_test_deps` docker-compose up) so setup-only
-        // side effects do not obscure the target's direct command.
-        const skipPhonyPrerequisiteRecipes = name !== target &&
-            (phonyTargets.has(name) || name.startsWith('_')) &&
-            (targets.get(target)?.recipes.length ?? 0) > 0;
-        if (!skipPhonyPrerequisiteRecipes) {
-            recipeLines.push(...entry.recipes);
+            collect(prerequisite);
         }
+        recipeLines.push(...entry.recipes);
         visiting.delete(name);
         visited.add(name);
-        return true;
     };
-    if (!collect(target)) {
-        return { recipes: recipeLines, opaque: true, reason: 'make_dependency_cycle' };
-    }
+    collect(target);
     const expandedRecipes = [];
     for (const line of recipeLines) {
         const normalized = normalizeMakeRecipeLine(line);
@@ -287,18 +278,24 @@ function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
             return { recipes: expandedRecipes, opaque: true, reason: 'make_recipe_dynamic' };
         }
     }
-    if (opaquePrerequisites) {
+    if (hasDependencyCycle) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_dependency_cycle' };
+    }
+    if (hasDynamicPrerequisite) {
         return { recipes: expandedRecipes, opaque: true, reason: 'make_prerequisite_dynamic' };
     }
+    if (hasUndefinedPrerequisite) {
+        return { recipes: expandedRecipes, opaque: true, reason: 'make_prerequisite_undefined' };
+    }
     return { recipes: expandedRecipes, opaque: false, reason: 'make_recipe_resolved' };
 }
 export function resolveLauncherRecipe(params) {
-    if (params.depth >= MAX_RESOLVE_DEPTH) {
-        return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
-    }
     const tokens = params.tokens;
     const scriptName = npmScriptName(tokens);
     if (scriptName) {
+        if (params.depth >= MAX_RESOLVE_DEPTH) {
+            return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
+        }
         const resolution = resolveNpmRecipe(params.cwd, params.repoRoot, scriptName, forwardedArgs(tokens));
         if (tokens[0] === 'pnpm' &&
             tokens[1] &&
@@ -313,6 +310,9 @@ export function resolveLauncherRecipe(params) {
         return resolution;
     }
     if (tokens[0] === 'make') {
+        if (params.depth >= MAX_RESOLVE_DEPTH) {
+            return { recipes: [], opaque: true, reason: 'launcher_depth_exceeded' };
+        }
         if (tokens.includes('-n') || tokens.includes('--dry-run')) {
             return null;
         }

package/dist/core/verdict/parser.d.ts

@@ -1,3 +1,5 @@
+import { type ShellToken } from '../shell-tokenizer.js';
+import { type RecursiveInvocation } from './recursive-invocation.js';
 import type { VerdictOpacity } from './types.js';
 export interface ParsedSegment {
     tokens: string[];
@@ -16,6 +18,7 @@ export declare function peelTransparentWrappers(tokens: string[]): {
 export declare function isVariableIndirectHead(head: string): boolean;
 export declare function extractEvalBody(tokens: string[]): string | null;
 export declare function extractRecursiveScript(tokens: string[]): string | null;
+export declare function decodeRecursiveInvocationTokens(tokens: readonly ShellToken[]): RecursiveInvocation;
 export declare function extractDockerComposeRunScript(tokens: string[]): string | null;
 /**
  * True when a recursive script is evaluated from a command argument rather

package/dist/core/verdict/parser.js

@@ -2,11 +2,12 @@ import path from 'node:path';
 import { findCommandSubstitutions, findStructuralCommandSubstitutions, } from '../shell-substitution.js';
 import { commandKey, tokenizeShell } from '../shell-tokenizer.js';
 import { detectUnparseableShell } from '../shell-unparseable.js';
+import { decodeDockerComposeRunValues } from './docker-compose-run.js';
+import { decodeRecursiveInvocation, shellTokensFromValues, } from './recursive-invocation.js';
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
 const MAX_WRAPPER_PEEL_DEPTH = 32;
 const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
 const CODE_INTERPRETERS = new Set(['python', 'python3', 'node', 'ruby', 'perl', 'osascript']);
-const SCRIPT_FLAGS = new Set(['-c', '-lc', '-e', '--eval']);
 const INTERPRETER_SCRIPT_EXTENSIONS = new Set([
     '.js',
     '.mjs',
@@ -30,10 +31,6 @@ export function peelTransparentWrappers(tokens) {
     let encounteredXargs = false;
     let peelDepth = 0;
     while (current.length > 0) {
-        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
-            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
-        }
-        peelDepth += 1;
         while (current.length > 0 && ENV_PREFIX_PATTERN.test(current[0] ?? '')) {
             current.shift();
         }
@@ -43,6 +40,10 @@ export function peelTransparentWrappers(tokens) {
         const head = normalizeHead(current[0] ?? '');
         if (head === 'xargs') {
             encounteredXargs = true;
+            if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+                return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+            }
+            peelDepth += 1;
             const wrapper = peelXargsWrapper(current);
             if (wrapper.kind === 'opaque') {
                 xargsStdinOpaque = current.length === 1;
@@ -60,6 +61,10 @@ export function peelTransparentWrappers(tokens) {
         if (!wrapper) {
             break;
         }
+        if (peelDepth >= MAX_WRAPPER_PEEL_DEPTH) {
+            return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
+        }
+        peelDepth += 1;
         if (wrapper.kind === 'opaque') {
             return { tokens: current, xargsStdinOpaque: false, encounteredXargs, opaque: true };
         }
@@ -304,39 +309,19 @@ export function extractRecursiveScript(tokens) {
         const body = filtered.slice(1).join(' ').trim();
         return body || null;
     }
-    if (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) {
-        const flagIndex = filtered.findIndex((token) => SCRIPT_FLAGS.has(token));
-        if (flagIndex !== -1) {
-            const body = filtered[flagIndex + 1] ?? '';
-            return body || null;
-        }
-    }
-    return null;
+    const invocation = decodeRecursiveInvocation(shellTokensFromValues(filtered, { detectExpansion: false }));
+    return invocation.kind === 'static' ? invocation.script || null : null;
+}
+export function decodeRecursiveInvocationTokens(tokens) {
+    const values = tokens.map((token) => token.value);
+    const { tokens: filtered, opaque } = peelTransparentWrappers(values);
+    if (opaque)
+        return { kind: 'none' };
+    return decodeRecursiveInvocation(tokens.slice(values.length - filtered.length));
 }
 export function extractDockerComposeRunScript(tokens) {
-    const head = normalizeHead(tokens[0] ?? '');
-    const usesCompose = head === 'docker-compose' || (head === 'docker' && (tokens[1] ?? '') === 'compose');
-    if (!usesCompose) {
-        return null;
-    }
-    if (!tokens.includes('run')) {
-        return null;
-    }
-    const runIndex = tokens.indexOf('run');
-    const tail = tokens.slice(runIndex + 1);
-    for (let index = 0; index < tail.length; index += 1) {
-        const shellHead = normalizeHead(tail[index] ?? '');
-        if (!SHELL_INTERPRETERS.has(shellHead)) {
-            continue;
-        }
-        const flag = tail[index + 1] ?? '';
-        if (flag !== '-lc' && flag !== '-c') {
-            continue;
-        }
-        const body = tail[index + 2] ?? '';
-        return body || null;
-    }
-    return null;
+    const invocation = decodeDockerComposeRunValues(tokens);
+    return invocation.kind === 'recursive' ? invocation.script || null : null;
 }
 /**
  * True when a recursive script is evaluated from a command argument rather
@@ -352,8 +337,7 @@ export function isDynamicRecursiveEvaluation(tokens) {
     if (head === 'eval') {
         return true;
     }
-    return ((SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) &&
-        filtered.some((token) => SCRIPT_FLAGS.has(token)));
+    return decodeRecursiveInvocation(shellTokensFromValues(filtered)).kind !== 'none';
 }
 export function isCommandInspection(tokens) {
     return (normalizeHead(tokens[0] ?? '') === 'command' && peelCommandWrapper(tokens).kind === 'preserve');
@@ -370,8 +354,7 @@ export function isBareInterpreter(tokens) {
     if (!SHELL_INTERPRETERS.has(head) && !CODE_INTERPRETERS.has(head)) {
         return false;
     }
-    const hasScriptFlag = peeled.some((token) => SCRIPT_FLAGS.has(token));
-    if (hasScriptFlag) {
+    if (decodeRecursiveInvocation(shellTokensFromValues(peeled)).kind !== 'none') {
         return false;
     }
     const args = peeled.slice(1);

package/dist/core/verdict/recursive-invocation.d.ts

@@ -0,0 +1,20 @@
+import type { ShellToken } from '../shell-tokenizer.js';
+export type RecursiveInvocation = {
+    kind: 'static';
+    interpreter: string;
+    script: string;
+} | {
+    kind: 'dynamic';
+    interpreter: string;
+    signal: 'shell.script_expanded';
+} | {
+    kind: 'none';
+} | {
+    kind: 'indeterminate';
+    interpreter: string;
+    signal: 'shell.interpreter_argv_incomplete' | 'shell.interpreter_option_unknown';
+};
+export declare function decodeRecursiveInvocation(tokens: readonly ShellToken[]): RecursiveInvocation;
+export declare function shellTokensFromValues(values: readonly string[], options?: {
+    detectExpansion?: boolean;
+}): ShellToken[];

package/dist/core/verdict/recursive-invocation.js

@@ -0,0 +1,224 @@
+import path from 'node:path';
+const SHELL_INTERPRETERS = new Set(['bash', 'sh', 'zsh', 'dash', 'fish']);
+const PYTHON_INTERPRETERS = new Set(['python', 'python3']);
+const SHELL_SHORT_OPTIONS = new Set(['c', 'l', 'e', 'x', 'u']);
+const SHELL_NON_SCRIPT_SHORT_OPTIONS = new Set(['n']);
+const SHELL_TERMINAL_OPTIONS = new Map([
+    ['bash', new Set(['--help', '--version'])],
+    ['zsh', new Set(['--version'])],
+    ['fish', new Set(['-h', '--help', '-v', '--version'])],
+]);
+const SHELL_VALUE_OPTIONS = new Set(['-O', '+O', '--init-file', '--rcfile']);
+const NODE_TERMINAL_OPTIONS = new Set(['-h', '--help', '--help-all', '-v', '--version']);
+const NODE_FILE_OPTIONS = new Set(['-c', '--check']);
+const PYTHON_PROFILE = {
+    scriptOptions: new Set(['-c']),
+    terminalOptions: new Set(['-h', '--help', '-V', '-VV', '--version']),
+    terminalValueOptions: new Set(['-m']),
+    flagOptions: new Set([
+        '-b',
+        '-bb',
+        '-B',
+        '-d',
+        '-E',
+        '-I',
+        '-O',
+        '-OO',
+        '-P',
+        '-q',
+        '-s',
+        '-S',
+        '-u',
+        '-v',
+        '-x',
+    ]),
+    valueOptions: new Set(['-W', '-X']),
+    attachedValuePrefixes: ['-W', '-X'],
+};
+const RUBY_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help', '-v', '--version', '--copyright']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set(['-d', '--debug', '-w']),
+    valueOptions: new Set(['-I']),
+    attachedValuePrefixes: ['-I'],
+};
+const PERL_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help', '-v', '--version']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set([]),
+    valueOptions: new Set(['-I']),
+    attachedValuePrefixes: ['-I'],
+};
+const OSASCRIPT_PROFILE = {
+    scriptOptions: new Set(['-e']),
+    terminalOptions: new Set(['-h', '--help']),
+    terminalValueOptions: new Set([]),
+    flagOptions: new Set([]),
+    valueOptions: new Set(['-l']),
+    attachedValuePrefixes: [],
+};
+function normalizeInterpreter(value) {
+    return path.basename(value);
+}
+function scriptResult(interpreter, token) {
+    if (!token) {
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_argv_incomplete' };
+    }
+    if (token.parts.some((part) => part.hasExpansion)) {
+        return { kind: 'dynamic', interpreter, signal: 'shell.script_expanded' };
+    }
+    return { kind: 'static', interpreter, script: token.value };
+}
+function decodeShell(words, interpreter) {
+    for (let index = 1; index < words.length; index += 1) {
+        const option = words[index]?.value ?? '';
+        if (option === '--')
+            return { kind: 'none' };
+        if (SHELL_TERMINAL_OPTIONS.get(interpreter)?.has(option))
+            return { kind: 'none' };
+        if (interpreter === 'bash' && SHELL_VALUE_OPTIONS.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            index += 1;
+            continue;
+        }
+        if (!option.startsWith('-') || option === '-')
+            return { kind: 'none' };
+        const flags = [...option.slice(1)];
+        if (flags.length === 0) {
+            return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+        }
+        if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag))) {
+            if (!flags.includes('c'))
+                continue;
+            return scriptResult(interpreter, words[index + 1]);
+        }
+        if (flags.every((flag) => SHELL_SHORT_OPTIONS.has(flag) || SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag)) &&
+            flags.some((flag) => SHELL_NON_SCRIPT_SHORT_OPTIONS.has(flag))) {
+            return { kind: 'none' };
+        }
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+    }
+    return { kind: 'none' };
+}
+function decodeSeparated(words, interpreter, profile) {
+    for (let index = 1; index < words.length; index += 1) {
+        const option = words[index]?.value ?? '';
+        if (option === '--' || !option.startsWith('-') || option === '-')
+            return { kind: 'none' };
+        if (profile.scriptOptions.has(option)) {
+            return scriptResult(interpreter, words[index + 1]);
+        }
+        if (profile.terminalOptions.has(option))
+            return { kind: 'none' };
+        if (profile.terminalValueOptions.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            return { kind: 'none' };
+        }
+        if (profile.flagOptions.has(option)) {
+            continue;
+        }
+        if (profile.valueOptions.has(option)) {
+            const operand = words[index + 1]?.value;
+            if (!operand || operand.startsWith('-')) {
+                return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+            }
+            index += 1;
+            continue;
+        }
+        if (profile.attachedValuePrefixes.some((prefix) => option.startsWith(prefix) && option.length > prefix.length)) {
+            continue;
+        }
+        return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+    }
+    return { kind: 'none' };
+}
+function decodeNode(words, interpreter) {
+    const option = words[1]?.value ?? '';
+    if (option === '--' || !option.startsWith('-') || option === '-')
+        return { kind: 'none' };
+    if (option === '-e' || option === '--eval') {
+        return scriptResult(interpreter, words[2]);
+    }
+    if (option.startsWith('--eval=')) {
+        const script = option.slice('--eval='.length);
+        if (words[1]?.parts.some((part) => part.hasExpansion)) {
+            return { kind: 'dynamic', interpreter, signal: 'shell.script_expanded' };
+        }
+        return { kind: 'static', interpreter, script };
+    }
+    if (NODE_TERMINAL_OPTIONS.has(option))
+        return { kind: 'none' };
+    if (NODE_FILE_OPTIONS.has(option))
+        return { kind: 'none' };
+    return { kind: 'indeterminate', interpreter, signal: 'shell.interpreter_option_unknown' };
+}
+function decodeEval(words) {
+    const arguments_ = words.slice(1);
+    if (arguments_.length === 0)
+        return { kind: 'none' };
+    if (arguments_.some((word) => word.parts.some((part) => part.hasExpansion))) {
+        return { kind: 'dynamic', interpreter: 'eval', signal: 'shell.script_expanded' };
+    }
+    return {
+        kind: 'static',
+        interpreter: 'eval',
+        script: arguments_.map((word) => word.value).join(' '),
+    };
+}
+export function decodeRecursiveInvocation(tokens) {
+    if (tokens.some((token) => token.kind === 'operator'))
+        return { kind: 'none' };
+    const words = tokens.filter((token) => token.kind === 'word');
+    const interpreter = normalizeInterpreter(words[0]?.value ?? '');
+    if (!interpreter)
+        return { kind: 'none' };
+    if (interpreter === 'eval')
+        return decodeEval(words);
+    if (SHELL_INTERPRETERS.has(interpreter))
+        return decodeShell(words, interpreter);
+    if (PYTHON_INTERPRETERS.has(interpreter)) {
+        return decodeSeparated(words, interpreter, PYTHON_PROFILE);
+    }
+    if (interpreter === 'node')
+        return decodeNode(words, interpreter);
+    if (interpreter === 'ruby')
+        return decodeSeparated(words, interpreter, RUBY_PROFILE);
+    if (interpreter === 'perl')
+        return decodeSeparated(words, interpreter, PERL_PROFILE);
+    if (interpreter === 'osascript')
+        return decodeSeparated(words, interpreter, OSASCRIPT_PROFILE);
+    return { kind: 'none' };
+}
+export function shellTokensFromValues(values, options = {}) {
+    let offset = 0;
+    return values.map((value) => {
+        const start = offset;
+        const end = start + value.length;
+        offset = end + 1;
+        return {
+            kind: 'word',
+            value,
+            raw: value,
+            start,
+            end,
+            parts: [
+                {
+                    value,
+                    raw: value,
+                    start,
+                    end,
+                    quote: 'unquoted',
+                    hasExpansion: options.detectExpansion !== false && (value.includes('$') || value.includes('`')),
+                },
+            ],
+        };
+    });
+}

package/dist/defaults.d.ts

@@ -5,13 +5,17 @@ export type ManagedHookDefinition = {
     command: string;
     placement: 'prepend' | 'append';
     matcher?: string;
+    failClosed?: boolean;
 };
-export declare function getManagedHookEntries(platform?: NodeJS.Platform, hooksDir?: string, repoRoot?: string): Array<{
+export type CursorManagedHookDefinition = ManagedHookDefinition & {
+    failClosed: true;
+};
+export declare function getManagedHookEntries(platform?: NodeJS.Platform, hooksDir?: string, repoRoot?: string, runnerPathMode?: 'absolute' | 'legacy-relative' | 'legacy-absolute' | 'legacy-quoted-absolute' | 'legacy-bare-powershell-absolute'): Array<{
     event: string;
-    definition: ManagedHookDefinition;
+    definition: CursorManagedHookDefinition;
 }>;
 /** @deprecated Use getManagedHookEntries instead. */
-export declare function getManagedHookEvents(platform?: NodeJS.Platform): Record<string, ManagedHookDefinition>;
+export declare function getManagedHookEvents(platform?: NodeJS.Platform): Record<string, CursorManagedHookDefinition>;
 export declare const EMPTY_APPROVALS: {
     readonly version: 1;
     readonly approvals: readonly [];

package/dist/defaults.js

@@ -1,29 +1,41 @@
 import path from 'node:path';
 import { cursorLayout } from './adapters/layouts/cursor.js';
-import { buildRunnerInvocation } from './adapters/layouts/scope.js';
+import { buildAbsoluteRunnerInvocation, buildLegacyAbsoluteRunnerInvocation, buildLegacyBarePowerShellRunnerInvocation, buildLegacyQuotedAbsoluteRunnerInvocation, buildRunnerInvocation, } from './adapters/layouts/scope.js';
 import { DEFAULT_CONFIG_V3 } from './core/config.js';
 export { PACKAGE_NAME } from './branding.js';
 export const DEFAULT_CONFIG = DEFAULT_CONFIG_V3;
-function runnerCommand(platform, hooksDir, repoRoot, hookScript, ...args) {
-    return buildRunnerInvocation(platform, hooksDir, repoRoot, hookScript, ...args);
+function runnerCommand(platform, hooksDir, _repoRoot, hookScript, runnerPathMode, ...args) {
+    if (runnerPathMode === 'absolute') {
+        return buildAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args);
+    }
+    if (runnerPathMode === 'legacy-absolute') {
+        return buildLegacyAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args);
+    }
+    if (runnerPathMode === 'legacy-quoted-absolute') {
+        return buildLegacyQuotedAbsoluteRunnerInvocation(platform, hooksDir, hookScript, ...args);
+    }
+    if (runnerPathMode === 'legacy-bare-powershell-absolute') {
+        return buildLegacyBarePowerShellRunnerInvocation(platform, hooksDir, hookScript, ...args);
+    }
+    return buildRunnerInvocation(platform, hooksDir, _repoRoot, hookScript, ...args);
 }
-export function getManagedHookEntries(platform = process.platform, hooksDir, repoRoot) {
+export function getManagedHookEntries(platform = process.platform, hooksDir, repoRoot, runnerPathMode = 'absolute') {
     const resolvedRepo = path.resolve(repoRoot ?? process.cwd());
     const resolvedHooksDir = hooksDir ?? cursorLayout.hooksDir(resolvedRepo);
-    const toolGate = runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-tool-gate', 'preToolUse');
-    const subagentGate = runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-tool-gate', 'subagentStart');
-    return [
+    const toolGate = runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-tool-gate', runnerPathMode, 'preToolUse');
+    const subagentGate = runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-tool-gate', runnerPathMode, 'subagentStart');
+    const entries = [
         {
             event: 'beforeSubmitPrompt',
             definition: {
-                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-before-submit'),
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-before-submit', runnerPathMode),
                 placement: 'prepend',
             },
         },
         {
             event: 'beforeShellExecution',
             definition: {
-                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-shell-gate'),
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-shell-gate', runnerPathMode),
                 placement: 'prepend',
             },
         },
@@ -59,15 +71,6 @@ export function getManagedHookEntries(platform = process.platform, hooksDir, rep
                 matcher: 'Delete',
             },
         },
-        {
-            event: 'preToolUse',
-            definition: {
-                command: toolGate,
-                placement: 'prepend',
-                // Agent Shell tool (preToolUse) — distinct from terminal beforeShellExecution.
-                matcher: 'Shell',
-            },
-        },
         {
             event: 'subagentStart',
             definition: {
@@ -119,25 +122,36 @@ export function getManagedHookEntries(platform = process.platform, hooksDir, rep
         {
             event: 'postToolUse',
             definition: {
-                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', 'postToolUse'),
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', runnerPathMode, 'postToolUse'),
+                placement: 'append',
+            },
+        },
+        {
+            event: 'postToolUseFailure',
+            definition: {
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', runnerPathMode, 'postToolUseFailure'),
                 placement: 'append',
             },
         },
         {
             event: 'stop',
             definition: {
-                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', 'stop'),
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', runnerPathMode, 'stop'),
                 placement: 'append',
             },
         },
         {
             event: 'sessionEnd',
             definition: {
-                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', 'sessionEnd'),
+                command: runnerCommand(platform, resolvedHooksDir, resolvedRepo, 'belay-audit', runnerPathMode, 'sessionEnd'),
                 placement: 'append',
             },
         },
     ];
+    return entries.map(({ event, definition }) => ({
+        event,
+        definition: { ...definition, failClosed: true },
+    }));
 }
 /** @deprecated Use getManagedHookEntries instead. */
 export function getManagedHookEvents(platform = process.platform) {

package/dist/installer/bootstrap.d.ts

@@ -1,5 +1,6 @@
 import type { ScopedPaths } from '../adapters/layouts/scope.js';
 import type { AdapterName } from '../adapters/layouts/types.js';
 import type { BelayConfigV3 } from '../core/config.js';
+export declare const CURSOR_COMMAND_ARTIFACTS: readonly ["belay-approve.md", "belay-why.md", "belay-explain.md", "belay-status.md", "belay-report.md", "belay-recover.md"];
 export declare function bootstrapStateFiles(repoRoot: string, config: BelayConfigV3, paths: ScopedPaths): Promise<void>;
 export declare function writeSkillArtifacts(adapterName: AdapterName, paths: ScopedPaths): Promise<void>;

package/dist/installer/bootstrap.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { approvedApprovalsPath, pendingApprovalsPath } from '../config-io.js';
 import { EMPTY_APPROVALS } from '../defaults.js';
 const BUNDLED_SKILL_TEMPLATE_URL = new URL('../../skills/belay/SKILL.md', import.meta.url);
-const BUNDLED_COMMAND_TEMPLATES = [
+export const CURSOR_COMMAND_ARTIFACTS = [
     'belay-approve.md',
     'belay-why.md',
     'belay-explain.md',
@@ -53,7 +53,7 @@ export async function writeSkillArtifacts(adapterName, paths) {
     await writeFile(path.join(paths.skillsDir, 'SKILL.md'), bundledSkill, 'utf8');
     if (adapterName === 'cursor' && paths.commandsDir) {
         await mkdir(paths.commandsDir, { recursive: true });
-        for (const fileName of BUNDLED_COMMAND_TEMPLATES) {
+        for (const fileName of CURSOR_COMMAND_ARTIFACTS) {
             const bundledCommand = await readBundledTemplate(new URL(`../../skills/belay/${fileName}`, import.meta.url));
             await writeFile(path.join(paths.commandsDir, fileName), bundledCommand, 'utf8');
         }