@integrity-labs/agt-cli 0.28.1100 → 0.28.1102

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-BCIY67GX.js";
+} from "../chunk-P5GRCGQ5.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5474,7 +5474,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.1100" : "dev";
+var cliVersion = true ? "0.28.1102" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6734,7 +6734,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.1100" : "dev";
+var cliVersion2 = true ? "0.28.1102" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-BCIY67GX.js → chunk-P5GRCGQ5.js}

@@ -4214,6 +4214,402 @@ exit 0
   settings["hooks"] = hooks;
   writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
+var LONG_COMMAND_BOUNDED_TIMEOUT_MS = 12e4;
+var LONG_COMMAND_HOOK_FILENAME = "agt-long-command-hook.sh";
+var LONG_COMMAND_HOOK_JS_FILENAME = "agt-long-command-hook.mjs";
+var LONG_COMMAND_HOOK_JS = String.raw`'use strict';
+// ENG-11393 long-command hook. Generated by provisionLongCommandHook; see index.ts.
+// Exit 2 + stderr refuses a foreground Bash call (Claude Code shows the reason);
+// exit 0 allows. Any internal error ALLOWS: a crashing guard must not block
+// every Bash call.
+const BOUND = __BOUND__;
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh']);
+const TURBO_META = new Set(['login', 'logout', 'link', 'unlink', 'prune', 'daemon', 'telemetry', 'gen', 'generate', 'info', 'ls', 'query', 'bin', 'scan', 'completion', 'boundaries']);
+const PREFIX_CMDS = new Set(['sudo', 'nice', 'time', 'nohup', 'command', 'exec', 'stdbuf', 'ionice']);
+const KEYWORDS = new Set(['if', 'do', 'then', 'else', 'elif', '{', '!']);
+const FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?(:\d+)?$/;
+
+let raw = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (d) => { raw += d; });
+process.stdin.on('end', () => {
+  let code = 0;
+  try { code = main(raw); } catch (e) { code = 0; }
+  process.exit(code);
+});
+
+function main(text) {
+  let input;
+  try { input = JSON.parse(text); } catch (e) { return 0; }
+  if (!input || input.tool_name !== 'Bash') return 0;
+  const ti = input.tool_input || {};
+  if (ti.run_in_background === true) return 0;
+  const t = Number(ti.timeout);
+  if (ti.timeout !== undefined && ti.timeout !== null && Number.isFinite(t) && t <= BOUND) return 0;
+  const cmd = typeof ti.command === 'string' ? ti.command : '';
+  if (!cmd) return 0;
+  const reason = classify(cmd, 0);
+  if (!reason) return 0;
+  process.stderr.write('agt-long-command-hook: this looks like ' + reason + ', which can block you for minutes, and you cannot answer anyone while a foreground command runs. Re-run this exact command with the Bash tool parameter run_in_background: true. You are notified when it finishes, and you stay responsive meanwhile. Do NOT use a trailing & or nohup instead: that detaches it with no completion notification. If you are sure it is quick, pass an explicit timeout of ' + BOUND + ' ms or less.\n');
+  return 2;
+}
+
+// 1. Heredocs. A body is DATA unless the command that READS it is a shell
+// (Obi Wan 6159f6f97145 on #6845): each unquoted << operator is tied to the
+// command word of its own segment, not to the first word of the line, and a
+// "<<WORD" inside quotes opens nothing. A body piped into a shell
+// ("cat <<EOF | bash") is executed too (Obi Wan bf1bec45130a): every heredoc
+// in a pipeline becomes exec when a later stage of that pipeline is a shell.
+// The command word that reads a segment's stdin: shell keywords ("if", "do",
+// "!", ...) and prefixes (sudo, env, timeout) are stripped first, exactly as
+// classify does (Obi Wan 7a32094bc1df).
+function readerOf(seg) {
+  let w = seg;
+  while (w.length && KEYWORDS.has(w[0])) w = w.slice(1);
+  return skipPrefixes(w)[0] || '';
+}
+
+function heredocOps(line) {
+  const ops = [];
+  let q = null;
+  let seg = [];
+  let word = '';
+  let pipeline = [];
+  let piped = false;
+  // Command substitutions opened INSIDE double quotes ("$(cat <<'EOF' ...").
+  // In bash a quote inside $(...) does not close the outer one, and the heredoc
+  // inside it is a real heredoc (Obi Wan 17d273c999ef: the usual shape of a
+  // commit or PR body). Each entry saves the ENCLOSING segment and pipeline,
+  // restored when the $( closes (CodeRabbit on #6845: in
+  // cat <<EOF | sed "$(...)" | bash the substitution must not end the outer
+  // pipeline, or the heredoc piped into bash reads as data), plus the
+  // open-paren depth inside that $( .
+  const subst = [];
+  const endWord = () => { if (word) { seg.push(word); word = ''; } };
+  const endSeg = (pipe) => {
+    endWord();
+    if (piped && SHELLS.has(base(readerOf(seg)))) for (const op of pipeline) op.exec = true;
+    seg = [];
+    piped = pipe;
+    if (!pipe) pipeline = [];
+  };
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (q === "'") { if (c === "'") q = null; else word += c; continue; }
+    if (q === '"') {
+      if (c === '\\' && i + 1 < line.length) { word += line[++i]; continue; }
+      if (c === '$' && line[i + 1] === '(') {
+        subst.push({ depth: 0, seg, word, pipeline, piped, q: '"' });
+        seg = []; word = ''; pipeline = []; piped = false; q = null; i++;
+        continue;
+      }
+      if (c === '"') q = null; else word += c;
+      continue;
+    }
+    if (c === '\\' && i + 1 < line.length) { word += line[++i]; continue; }
+    if (c === "'" || c === '"') { q = c; continue; }
+    // An UNQUOTED $( keeps the enclosing pipeline too (CodeRabbit on #6845:
+    // cat <<EOF | sed $(...) | bash), and returns to unquoted text on its ).
+    if (c === '$' && line[i + 1] === '(') {
+      subst.push({ depth: 0, seg, word, pipeline, piped, q: null });
+      seg = []; word = ''; pipeline = []; piped = false; i++;
+      continue;
+    }
+    if (subst.length && c === '(') { subst[subst.length - 1].depth++; endSeg(false); continue; }
+    if (subst.length && c === ')') {
+      endSeg(false);
+      const top = subst[subst.length - 1];
+      if (top.depth > 0) { top.depth--; continue; }
+      subst.pop();
+      // Back in the enclosing word, in the quote state it was opened from.
+      seg = top.seg; word = top.word + '$()'; pipeline = top.pipeline; piped = top.piped; q = top.q;
+      continue;
+    }
+    if (c === '<' && line[i + 1] === '<' && line[i + 2] !== '<' && line[i - 1] !== '<') {
+      endWord();
+      let j = i + 2;
+      let dash = false;
+      if (line[j] === '-') { dash = true; j++; }
+      while (line[j] === ' ' || line[j] === '\t') j++;
+      let qc = '';
+      if (line[j] === "'" || line[j] === '"') { qc = line[j]; j++; }
+      const m = /^[A-Za-z_][A-Za-z0-9_]*/.exec(line.slice(j));
+      if (m) {
+        j += m[0].length;
+        if (qc && line[j] === qc) j++;
+        const op = { word: m[0], dash, exec: SHELLS.has(base(readerOf(seg))) };
+        ops.push(op);
+        pipeline.push(op);
+        i = j - 1;
+        continue;
+      }
+    }
+    if (c === '|') {
+      if (line[i + 1] === '|') { i++; endSeg(false); continue; }
+      if (line[i + 1] === '&') i++;
+      endSeg(true);
+      continue;
+    }
+    if (c === ';' || c === '&' || c === '(' || c === ')') { endSeg(false); continue; }
+    if (c === ' ' || c === '\t') { endWord(); continue; }
+    word += c;
+  }
+  endSeg(false);
+  return ops;
+}
+
+function splitHeredocs(cmd) {
+  const lines = cmd.split('\n');
+  const kept = [];
+  const execBodies = [];
+  let pending = [];
+  let body = [];
+  for (const line of lines) {
+    if (pending.length > 0) {
+      const cur = pending[0];
+      const cmp = cur.dash ? line.replace(/^\t+/, '') : line;
+      if (cmp === cur.word) {
+        if (cur.exec) execBodies.push(body.join('\n'));
+        body = [];
+        pending.shift();
+      } else {
+        body.push(line);
+      }
+      continue;
+    }
+    kept.push(line);
+    for (const op of heredocOps(line)) pending.push(op);
+  }
+  return { text: kept.join('\n'), execBodies };
+}
+
+// 2. Segments: split on ; & | && || newline ( ) respecting quotes and escapes.
+function tokenize(text) {
+  const segs = [];
+  let words = [];
+  let word = '';
+  let inWord = false;
+  let q = null;
+  const endWord = () => { if (inWord) { words.push(word); word = ''; inWord = false; } };
+  const endSeg = () => { endWord(); if (words.length) segs.push(words); words = []; };
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (q === "'") { if (c === "'") q = null; else word += c; continue; }
+    if (q === '"') {
+      if (c === '\\' && i + 1 < text.length) { word += text[++i]; continue; }
+      if (c === '"') q = null; else word += c;
+      continue;
+    }
+    if (c === '\\' && i + 1 < text.length) { if (text[i + 1] !== '\n') { word += text[i + 1]; inWord = true; } i++; continue; }
+    if (c === "'" || c === '"') { q = c; inWord = true; continue; }
+    if (c === '#' && !inWord) { while (i < text.length && text[i] !== '\n') i++; endSeg(); continue; }
+    if (c === ';' || c === '&' || c === '|' || c === '\n' || c === '(' || c === ')') { endSeg(); continue; }
+    if (c === ' ' || c === '\t') { endWord(); continue; }
+    word += c; inWord = true;
+  }
+  endSeg();
+  return segs;
+}
+
+function base(w) { return String(w).split('/').pop(); }
+
+// 3. Classify.
+function classify(cmd, depth) {
+  if (depth > 4) return null;
+  const { text, execBodies } = splitHeredocs(cmd);
+  for (const b of execBodies) { const r = classify(b, depth + 1); if (r) return r; }
+  let loop = 0;
+  for (let words of tokenize(text)) {
+    while (words.length && KEYWORDS.has(words[0])) words = words.slice(1);
+    if (!words.length) continue;
+    const head = words[0];
+    if (head === 'for' || head === 'while' || head === 'until' || head === 'select') {
+      loop++;
+      if (head === 'for' || head === 'select') continue; // the rest is a word list, not a command
+      words = words.slice(1);
+      if (!words.length) continue;
+    } else if (head === 'done') {
+      if (loop > 0) loop--;
+      continue;
+    }
+    const r = classifyCommand(words, loop, depth);
+    if (r) return r;
+  }
+  return null;
+}
+
+function skipPrefixes(words) {
+  let w = words.slice();
+  for (let guard = 0; guard < 20 && w.length; guard++) {
+    const h = base(w[0]);
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w[0])) { w = w.slice(1); continue; }
+    if (h === 'env') {
+      // CodeRabbit on #6845: GNU env's -u/--unset NAME and -C/--chdir DIR take
+      // a SEPARATE operand, which is not the command. The joined forms
+      // (-uNAME, --unset=NAME, -CDIR, --chdir=DIR) carry their own; "--" ends
+      // the options.
+      w = w.slice(1);
+      while (w.length) {
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w[0])) { w = w.slice(1); continue; }
+        const f = w[0];
+        if (!f.startsWith('-')) break;
+        w = w.slice(1);
+        if (f === '--') break;
+        if ((f === '-u' || f === '--unset' || f === '-C' || f === '--chdir') && w.length) w = w.slice(1);
+      }
+      continue;
+    }
+    if (h === 'timeout') { w = w.slice(1); while (w.length && w[0].startsWith('-')) { const f = w[0]; w = w.slice(1); if ((f === '-s' || f === '-k' || f === '--signal' || f === '--kill-after') && w.length) w = w.slice(1); } if (w.length && /^[0-9.]+[smhd]?$/.test(w[0])) w = w.slice(1); continue; }
+    // "command -v X" / "command -V X" only LOOKS X up (Obi Wan e9e75aab20fb).
+    if (h === 'command' && (w[1] === '-v' || w[1] === '-V')) return [];
+    if (PREFIX_CMDS.has(h)) { w = w.slice(1); while (w.length && w[0].startsWith('-')) { const f = w[0]; w = w.slice(1); if (h === 'nice' && f === '-n' && w.length) w = w.slice(1); } continue; }
+    break;
+  }
+  return w;
+}
+
+// GNU sleep also takes "inf"/"infinity" and float notation (1e3). Anything
+// it would accept that we cannot read is treated as unbounded rather than as
+// zero (Obi Wan 4d961cccc4ba); flags are ignored.
+function sleepSeconds(arg) {
+  if (!arg || arg.startsWith('-')) return null;
+  if (/^inf(inity)?[smhd]?$/i.test(arg)) return Infinity;
+  const m = /^((?:[0-9]+\.?[0-9]*|\.[0-9]+)(?:[eE][+-]?[0-9]+)?)([smhd]?)$/.exec(arg);
+  if (!m) return Infinity;
+  const n = Number(m[1]);
+  return Number.isFinite(n) ? n * ({ '': 1, s: 1, m: 60, h: 3600, d: 86400 })[m[2]] : Infinity;
+}
+
+function hasFileTarget(args) { return args.some((a) => FILE_RE.test(a)); }
+
+function classifyCommand(words0, loop, depth) {
+  let words = skipPrefixes(words0);
+  if (!words.length) return null;
+  let cw = base(words[0]);
+  let args = words.slice(1);
+
+  // A shell given a command string: judge the string (bash -lc 'pnpm install').
+  if (SHELLS.has(cw)) {
+    const i = args.findIndex((a) => /^-[A-Za-z]*c[A-Za-z]*$/.test(a));
+    if (i >= 0 && i + 1 < args.length) return classify(args[i + 1], depth + 1);
+    return null;
+  }
+  if (cw === 'eval') return classify(args.join(' '), depth + 1);
+
+  // Runners that put the real command after them.
+  if (cw === 'npx' || cw === 'bunx' || cw === 'corepack') {
+    while (args.length && args[0].startsWith('-')) args = args.slice(1);
+    if (!args.length) return null;
+    return classifyCommand(args, loop, depth);
+  }
+
+  if (cw === 'vitest' || cw === 'jest') {
+    if (args.some((a) => a === '--version' || a === '-v' || a === '--help' || a === '-h')) return null;
+    return hasFileTarget(args) ? null : 'a whole test suite';
+  }
+
+  if (cw === 'pnpm' || cw === 'npm' || cw === 'yarn' || cw === 'bun') {
+    let recursive = false;
+    let firstAt = -1;
+    const rest = [];
+    for (let i = 0; i < args.length; i++) {
+      const a = args[i];
+      if (a === '-r' || a === '--recursive' || a === '--workspaces' || a === '-ws') { recursive = true; continue; }
+      if (a === '--filter' || a === '-F' || a === '-C' || a === '--dir' || a === '--prefix' || a === '-w' && cw === 'npm' || a === '--workspace') { i++; continue; }
+      if (a.startsWith('-')) continue;
+      if (!rest.length) firstAt = i;
+      rest.push(a);
+    }
+    let sub = rest[0];
+    // "yarn --version" / "pnpm -v" / "npm --help": a quick lookup, not a bare
+    // "yarn" install (Obi Wan e9e75aab20fb; the loop above dropped the flag).
+    if (sub === undefined) {
+      if (args.some((a) => a === '--version' || a === '-v' || a === '--help' || a === '-h')) return null;
+      return cw === 'yarn' ? 'a dependency install' : null;
+    }
+    if ((sub === 'exec' || sub === 'dlx' || sub === 'x') && rest.length > 1) return classifyCommand(args.slice(args.indexOf(rest[1], firstAt + 1)), loop, depth);
+    const viaRun = sub === 'run' || sub === 'run-script';
+    if (viaRun) sub = rest[1] === undefined ? 'run' : rest[1];
+    // A file after a package "test" SCRIPT does not narrow the run unless the
+    // script forwards its args, and this repo's root one does not (it runs the
+    // whole turbo suite). Only a direct runner (vitest/jest, exec/dlx, a
+    // workspace bin) earns the single-file exemption (Obi Wan f471dc98a67b).
+    if (sub === 'test' || sub === 't') return 'a whole test suite';
+    if (sub === 'install' || sub === 'i' || sub === 'ci' || sub === 'add') return 'a dependency install';
+    if (sub === 'vitest' || sub === 'jest') return hasFileTarget(rest.slice(1)) ? null : 'a whole test suite';
+    // Obi Wan 444c7455aaad: in a turbo monorepo a root "pnpm build" /
+    // "pnpm typecheck" is a workspace-wide build. A quick one in a single
+    // package passes with an explicit short timeout.
+    if (sub === 'build' || sub === 'typecheck' || sub === 'type-check') return 'a workspace-wide build or typecheck';
+    if (recursive) return 'a workspace-wide build or typecheck';
+    // Obi Wan c0646feacb29: "pnpm turbo test", "yarn tsc -b", "pnpm nx run-many"
+    // run a workspace binary, so judge the binary as if it were run directly.
+    // Its own flags must survive (rest drops them): re-read from the original args.
+    if (!viaRun) return classifyCommand(args.slice(firstAt), loop, depth);
+    return null;
+  }
+
+  if (cw === 'tsc') return args.some((a) => a === '-b' || a === '--build') ? 'a workspace-wide build or typecheck' : null;
+  if (cw === 'turbo') {
+    // "turbo build" runs a task exactly like "turbo run build" (Obi Wan 444c7455aaad).
+    const first = args.find((a) => !a.startsWith('-'));
+    if (first === undefined || TURBO_META.has(first)) return null;
+    return 'a workspace-wide build or typecheck';
+  }
+  if (cw === 'nx') return args.includes('run-many') ? 'a workspace-wide build or typecheck' : null;
+
+  if (cw === 'gh') {
+    if (args[0] === 'run' && args[1] === 'watch') return 'a watch or poll loop';
+    if (args[0] === 'pr' && args[1] === 'checks' && args.includes('--watch')) return 'a watch or poll loop';
+    return null;
+  }
+  if (cw === 'watch') return 'a watch or poll loop';
+  if (cw === 'tail' && args.some((a) => a === '-f' || a === '-F' || a === '--follow' || /^-[A-Za-z]*[fF]$/.test(a))) return 'a watch or poll loop';
+  if (cw === 'inotifywait' && args.some((a) => a === '-m' || a === '--monitor')) return 'a watch or poll loop';
+
+  if (cw === 'sleep') {
+    if (loop > 0) return 'a watch or poll loop';
+    const s = args.reduce((acc, a) => { const v = sleepSeconds(a); return v === null ? acc : acc + v; }, 0);
+    return s >= 30 ? 'a watch or poll loop' : null;
+  }
+  return null;
+}
+`;
+var LONG_COMMAND_MAX_FOREGROUND_TIMEOUT_MS = 18e4;
+function provisionLongCommandHook(codeName) {
+  const projectDir = getProjectDir2(codeName);
+  const claudeDir = join4(projectDir, ".claude");
+  mkdirSync3(claudeDir, { recursive: true });
+  const hookScriptPath = join4(claudeDir, LONG_COMMAND_HOOK_FILENAME);
+  const jsPath = join4(claudeDir, LONG_COMMAND_HOOK_JS_FILENAME);
+  writeFileSync4(jsPath, LONG_COMMAND_HOOK_JS.replace("__BOUND__", String(LONG_COMMAND_BOUNDED_TIMEOUT_MS)), { mode: 420 });
+  const hookScript = [
+    "#!/usr/bin/env bash",
+    "# ENG-11393: refuse known-slow foreground shell commands; see index.ts.",
+    "# Fail open: no node, or any error in the matcher, allows the call.",
+    "command -v node >/dev/null 2>&1 || exit 0",
+    `exec node '${jsPath.replace(/'/g, `'\\''`)}'`
+  ].join("\n") + "\n";
+  writeFileSync4(hookScriptPath, hookScript, { mode: 493 });
+  const settingsPath = join4(claudeDir, "settings.local.json");
+  let settings = {};
+  try {
+    settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+  } catch {
+  }
+  const hooks = settings["hooks"] ?? {};
+  const groups = Array.isArray(hooks["PreToolUse"]) ? hooks["PreToolUse"] : [];
+  const already = groups.some((g) => (g.hooks ?? []).some((h) => h.command === hookScriptPath));
+  if (!already) {
+    groups.push({ matcher: "Bash", hooks: [{ type: "command", command: hookScriptPath }] });
+  }
+  hooks["PreToolUse"] = groups;
+  settings["hooks"] = hooks;
+  const env = settings["env"] ?? {};
+  env["BASH_MAX_TIMEOUT_MS"] = String(LONG_COMMAND_MAX_FOREGROUND_TIMEOUT_MS);
+  settings["env"] = env;
+  writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
+}
 function provisionOrientHook(codeName) {
   const projectDir = getProjectDir2(codeName);
   const claudeDir = join4(projectDir, ".claude");
@@ -7122,7 +7518,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.1100" : "dev";
+var agtCliVersion = true ? "0.28.1102" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -12008,6 +12404,7 @@ export {
   provisionIsolationHook,
   provisionAutoKanbanProgressHook,
   provisionChannelProgressHook,
+  provisionLongCommandHook,
   provisionOrientHook,
   provisionPreCompactHook,
   provisionSessionStateHook,
@@ -12095,4 +12492,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-BCIY67GX.js.map
+//# sourceMappingURL=chunk-P5GRCGQ5.js.map