npm - @mnemonik/codex-hooks - Versions diffs - 0.3.1 → 0.4.1 - Mend

@mnemonik/codex-hooks 0.3.1 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/dist/hook.js +59 -74
package/dist/hook.js.map +1 -1
package/dist/install.js +2 -4
package/dist/install.js.map +1 -1
package/dist/lib/behavior.d.ts +6 -14
package/dist/lib/behavior.js +6 -14
package/dist/lib/behavior.js.map +1 -1
package/dist/lib/http.d.ts +14 -1
package/dist/lib/http.js +31 -0
package/dist/lib/http.js.map +1 -1
package/dist/lib/shellTokens.d.ts +13 -68
package/dist/lib/shellTokens.js +27 -322
package/dist/lib/shellTokens.js.map +1 -1
package/dist/lib/types.d.ts +22 -1
package/dist/lib/types.js.map +1 -1
package/package.json +2 -2

package/dist/hook.js CHANGED Viewed

@@ -5,9 +5,9 @@ import { relative } from 'node:path';
 import { extractToolFileTargets } from './lib/applyPatch.js';
 import { additionalContext, continueStop, denyPreToolUse, systemMessage, trimContext, } from './lib/codexOutput.js';
 import { isNonInteractive, parseBypass, resolveConfig } from './lib/env.js';
-import { PROMPT_CONTEXT, PRE_EDIT_GATE, FORBIDDEN_GATE, MUST_CONFIRM_GATE, CHECKPOINT_PRESSURE, } from './lib/behavior.js';
-import { fetchHookContext, fetchSnapshot, reportBypass, reportGateFired, trackIdeEdit, } from './lib/http.js';
-import { BUILT_IN_FORBIDDEN, BUILT_IN_MUST_CONFIRM, matchCommand, tokenize, } from './lib/shellTokens.js';
+import { PROMPT_CONTEXT, PRE_EDIT_GATE, CHECKPOINT_PRESSURE } from './lib/behavior.js';
+import { fetchHookContext, fetchPolicyReminder, fetchSnapshot, reportBypass, reportGateFired, trackIdeEdit, } from './lib/http.js';
+import { matchIrreducibleDeny } from './lib/shellTokens.js';
 async function readStdin() {
     return new Promise((res) => {
         let buf = '';
@@ -141,87 +141,72 @@ async function handlePreEdit(input, config) {
         'Bypass: MNEMONIK_BYPASS_HOOKS=1 MNEMONIK_BYPASS_TYPE=<typo|formatting|regenerated|already_grounded|other>.',
     ].join('\n')));
 }
+/**
+ * PreToolUse Bash gate (phase 3 simplification, 0.4.x line).
+ *
+ *   1. Local irreducible deny-floor for catastrophic patterns (rm -rf
+ *      root/home, dd to a whole disk, mkfs of a whole disk).
+ *   2. Server policy-reminder fetch — POST tool args to
+ *      /api/v1/hooks/policy-reminder, emit matched policies as a
+ *      systemMessage. Codex PreToolUse can't inject additionalContext
+ *      reliably so systemMessage is the right surface.
+ *   3. Allow on no match / unreachable server.
+ *
+ * Codex only reaches this guard when the host emits a Bash PreToolUse
+ * event. As of 2026-05, OpenAI documents incomplete interception for
+ * the newer unified_exec shell path; coverage is host-dependent.
+ */
 async function handlePreBash(input, config) {
-    // Codex only reaches this guard when the host emits a Bash PreToolUse event.
-    // As of 2026-05, OpenAI documents incomplete interception for the newer
-    // unified_exec shell path; we still gate when the event arrives, but
-    // host coverage is partial.
-    if (FORBIDDEN_GATE === 'off' && MUST_CONFIRM_GATE === 'off') {
-        await emitGateFired(input, config, 'Bash', 'off', 'off');
-        writeAllow();
-    }
     const command = typeof input.tool_input?.command === 'string' ? input.tool_input.command : '';
     if (!command.trim())
         writeAllow();
-    const snapshot = await getSnapshotOrFailOpen(input, config, 'Bash', MUST_CONFIRM_GATE);
-    if (!snapshot)
-        writeAllow();
-    const forbiddenPatterns = FORBIDDEN_GATE === 'off'
-        ? []
-        : [...BUILT_IN_FORBIDDEN, ...snapshot.policies.forbiddenCommand.map((p) => p.pattern)];
-    const mustConfirmPatterns = MUST_CONFIRM_GATE === 'off'
-        ? []
-        : [...BUILT_IN_MUST_CONFIRM, ...snapshot.policies.mustConfirm.map((p) => p.pattern)];
-    const { commands, wasQuoted } = tokenize(command);
-    let forbiddenHit = null;
-    let mustConfirmHit = null;
-    for (let cmdIdx = 0; cmdIdx < commands.length; cmdIdx++) {
-        const tokens = commands[cmdIdx];
-        const quotedFlags = wasQuoted[cmdIdx];
-        forbiddenHit = forbiddenHit ?? matchCommand(tokens, forbiddenPatterns, quotedFlags);
-        mustConfirmHit = mustConfirmHit ?? matchCommand(tokens, mustConfirmPatterns, quotedFlags);
-        if (forbiddenHit && mustConfirmHit)
-            break;
+    // Layer 1: irreducible deny-floor.
+    const denyName = matchIrreducibleDeny(command);
+    if (denyName) {
+        await emitGateFired(input, config, 'Bash', 'enforce', `irreducible_deny_${denyName}`);
+        writeOutput(denyPreToolUse([
+            'MNEMONIK_IRREDUCIBLE_DENY',
+            `Bash blocked: command matches the catastrophic-action floor (${denyName}).`,
+            'These three patterns (rm -rf / | ~ | $HOME, dd of=<whole-disk>, mkfs <whole-disk>) are blocked unconditionally because the cost of a false negative is "your machine."',
+            'Bypass for legitimate one-off use: MNEMONIK_BYPASS_HOOKS=1 + MNEMONIK_BYPASS_TYPE=other + MNEMONIK_BYPASS_DETAIL 50-200 chars.',
+        ].join('\n')));
     }
-    if (forbiddenHit) {
-        await runPolicyGate(input, config, 'forbiddenCommand', forbiddenHit, FORBIDDEN_GATE);
-        return;
+    // Layer 2: server-side policy reminder.
+    if (!config.apiKey) {
+        await emitGateFired(input, config, 'Bash', 'advisory', 'no_api_key');
+        writeAllow();
     }
-    if (mustConfirmHit) {
-        await runPolicyGate(input, config, 'mustConfirm', mustConfirmHit, MUST_CONFIRM_GATE);
-        return;
+    const reminder = await fetchPolicyReminder({
+        server: config.server,
+        apiKey: config.apiKey,
+        cwd: input.cwd,
+        codexSessionId: sessionId(input),
+        tool: 'Bash',
+        context: command,
+    });
+    if (!reminder?.ok || reminder.policies.length === 0) {
+        await emitGateFired(input, config, 'Bash', 'advisory', reminder ? 'no_match' : 'unreachable');
+        writeAllow();
     }
-    await emitGateFired(input, config, 'Bash', MUST_CONFIRM_GATE, 'no_match');
-    writeAllow();
-}
-/**
- * Per-kind gate at the configured mode.
- *
- *   - `off`: allow.
- *   - `advisory`: emit a systemMessage (Codex PreToolUse cannot inject
- *     additionalContext reliably — same constraint as handlePreEdit).
- *     The agent sees the policy text; the user enforces the pause.
- *   - `enforce`: deny via Codex's permissionDecision='deny' shape.
- */
-async function runPolicyGate(input, config, kind, pattern, mode) {
-    if (mode === 'off') {
-        await emitGateFired(input, config, 'Bash', mode, `policy_${kind}_off`);
+    // Inline reminders are interrupt-class. Only emit them when at least one
+    // matched policy is action-class (mustConfirm / forbiddenCommand).
+    // defaultMode policies are tone/style rules already loaded via
+    // session_bootstrap and rotated into the proxy's mid-session reminder pool.
+    const actionClass = reminder.policies.filter((p) => p.kind === 'mustConfirm' || p.kind === 'forbiddenCommand');
+    if (actionClass.length === 0) {
+        await emitGateFired(input, config, 'Bash', 'advisory', 'default_mode_only');
         writeAllow();
     }
-    if (mode === 'advisory') {
-        await emitGateFired(input, config, 'Bash', mode, `policy_${kind}_advisory`);
-        writeOutput(systemMessage(kind === 'forbiddenCommand'
-            ? [
-                `Mnemonik: a forbiddenCommand policy matched the command — pattern "${pattern}".`,
-                'Recommended: do NOT run this. Surface the policy to the user; if they explicitly confirm, the user should run it directly.',
-                'This advisory will become a hard block when FORBIDDEN_GATE flips to "enforce".',
-            ].join(' ')
-            : [
-                `Mnemonik: a mustConfirm policy matched the command — pattern "${pattern}".`,
-                'Recommended: present a clear summary of what you are about to do and why, then wait for the user to respond before running it.',
-                'This advisory will become a hard block when MUST_CONFIRM_GATE flips to "enforce".',
-            ].join(' ')));
+    const lines = [
+        'Mnemonik: project policies matched this command. Read each rule and act accordingly.',
+    ];
+    for (const p of actionClass) {
+        const desc = p.description ?? p.pattern;
+        const repl = p.replacement ? ` Replacement: ${p.replacement}.` : '';
+        lines.push(`- [${p.kind}] ${desc}${repl}`);
     }
-    // mode === 'enforce'
-    await emitGateFired(input, config, 'Bash', mode, `policy_${kind}_deny`);
-    writeOutput(denyPreToolUse([
-        'MNEMONIK_POLICY_GATE',
-        `Bash blocked by ${kind} policy: pattern "${pattern}" matched the command.`,
-        kind === 'forbiddenCommand'
-            ? 'Forbidden commands cannot be run via the agent. If this is intentional, the user must run it directly OR remove the policy.'
-            : 'Fix: present a summary of what this command does and why, get explicit user confirmation, then proceed.',
-        "Bypass: MNEMONIK_BYPASS_HOOKS=1 + MNEMONIK_BYPASS_TYPE=<typo|formatting|regenerated|already_grounded|other>; 'other' additionally requires MNEMONIK_BYPASS_DETAIL 50-200 chars.",
-    ].join('\n')));
+    await emitGateFired(input, config, 'Bash', 'advisory', `policy_match_${actionClass.length}`);
+    writeOutput(systemMessage(lines.join('\n')));
 }
 async function handlePostTool(input, config) {
     const tool = input.tool_name ?? '';

package/dist/hook.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"hook.js","sourceRoot":"","sources":["../src/hook.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAEL,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,QAAQ,GACT,MAAM,sBAAsB,CAAC;AAG9B,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,CAAC,CAAC;QACF,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACjC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC,EACpC,OAAe;IAEf,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,IAAI;QACJ,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,QAA0B,EAAE,GAAW,EAAE,YAAoB;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC;IAEpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,YAAY,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,YAAY,CAAC,0CAA0C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;QACrF,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAqB,EAAE,MAAkB;IACzE,IAAI,cAAc,KAAK,KAAK;QAAE,UAAU,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,eAAe;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,MAAM,IAAI,GAAG,aAAa,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC;IAC9C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ;QAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,WAAW,CACT,aAAa,CACX;YACE,kDAAkD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAC1G,iGAAiG;YACjG,8FAA8F;SAC/F,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,WAAW,CACT,cAAc,CACZ;QACE,gCAAgC;QAChC,sDAAsD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAC9G,8DAA8D;QAC9D,4GAA4G;KAC7G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,6EAA6E;IAC7E,wEAAwE;IACxE,qEAAqE;IACrE,4BAA4B;IAC5B,IAAI,cAAc,KAAK,KAAK,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,UAAU,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ;QAAE,UAAU,EAAE,CAAC;IAE5B,MAAM,iBAAiB,GACrB,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,kBAAkB,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,MAAM,mBAAmB,GACvB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;QACjC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,YAAY,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;QACpF,cAAc,GAAG,cAAc,IAAI,YAAY,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,YAAY,IAAI,cAAc;YAAE,MAAM;IAC5C,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAC1E,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAqB,EACrB,MAAkB,EAClB,IAAwC,EACxC,OAAe,EACf,IAAc;IAEd,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,MAAM,CAAC,CAAC;QACvE,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAC;QAC5E,WAAW,CACT,aAAa,CACX,IAAI,KAAK,kBAAkB;YACzB,CAAC,CAAC;gBACE,sEAAsE,OAAO,IAAI;gBACjF,4HAA4H;gBAC5H,gFAAgF;aACjF,CAAC,IAAI,CAAC,GAAG,CAAC;YACb,CAAC,CAAC;gBACE,iEAAiE,OAAO,IAAI;gBAC5E,gIAAgI;gBAChI,mFAAmF;aACpF,CAAC,IAAI,CAAC,GAAG,CAAC,CAChB,CACF,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,CAAC;IACxE,WAAW,CACT,cAAc,CACZ;QACE,sBAAsB;QACtB,mBAAmB,IAAI,qBAAqB,OAAO,wBAAwB;QAC3E,IAAI,KAAK,kBAAkB;YACzB,CAAC,CAAC,6HAA6H;YAC/H,CAAC,CAAC,yGAAyG;QAC7G,iLAAiL;KAClL,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAqB,EAAE,MAAkB;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAqB,EAAE,MAAkB;IACjE,IAAI,mBAAmB,KAAK,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM;QACb,oBAAoB,EAAE,KAAK,CAAC,sBAAsB;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB;QAAE,UAAU,EAAE,CAAC;IACtD,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAqB;IAC3C,IAAI,gBAAgB,EAAE;QAAE,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,eAAe;YAC9C,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,UAAU,EAAE,CAAC;IACf,CAAC;IAED,QAAQ,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM;QACR,KAAK,YAAY;YACf,IACE,KAAK,CAAC,SAAS,KAAK,aAAa;gBACjC,KAAK,CAAC,SAAS,KAAK,MAAM;gBAC1B,KAAK,CAAC,SAAS,KAAK,OAAO,EAC3B,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC9D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,UAAU,EAAE,CAAC;YACb,MAAM;QACR,KAAK,aAAa;YAChB,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,MAAM;YACT,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChC,MAAM;QACR;YACE,UAAU,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,UAAU,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC5G,CAAC;QACF,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}
1	+ {"version":3,"file":"hook.js","sourceRoot":"","sources":["../src/hook.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,CAAC,CAAC;QACF,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACjC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC,EACpC,OAAe;IAEf,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,IAAI;QACJ,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,QAA0B,EAAE,GAAW,EAAE,YAAoB;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC;IAEpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,YAAY,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,YAAY,CAAC,0CAA0C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;QACrF,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAqB,EAAE,MAAkB;IACzE,IAAI,cAAc,KAAK,KAAK;QAAE,UAAU,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,eAAe;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,MAAM,IAAI,GAAG,aAAa,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC;IAC9C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ;QAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,WAAW,CACT,aAAa,CACX;YACE,kDAAkD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAC1G,iGAAiG;YACjG,8FAA8F;SAC/F,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,WAAW,CACT,cAAc,CACZ;QACE,gCAAgC;QAChC,sDAAsD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAC9G,8DAA8D;QAC9D,4GAA4G;KAC7G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,UAAU,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,CAAC;IAElC,mCAAmC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QACtF,WAAW,CACT,cAAc,CACZ;YACE,2BAA2B;YAC3B,gEAAgE,QAAQ,IAAI;YAC5E,wKAAwK;YACxK,gIAAgI;SACjI,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9F,UAAU,EAAE,CAAC;IACf,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,+DAA+D;IAC/D,4EAA4E;IAC5E,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,CACjE,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;QAC5E,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,sFAAsF;KACvF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAqB,EAAE,MAAkB;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAqB,EAAE,MAAkB;IACjE,IAAI,mBAAmB,KAAK,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM;QACb,oBAAoB,EAAE,KAAK,CAAC,sBAAsB;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB;QAAE,UAAU,EAAE,CAAC;IACtD,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAqB;IAC3C,IAAI,gBAAgB,EAAE;QAAE,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,eAAe;YAC9C,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,UAAU,EAAE,CAAC;IACf,CAAC;IAED,QAAQ,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM;QACR,KAAK,YAAY;YACf,IACE,KAAK,CAAC,SAAS,KAAK,aAAa;gBACjC,KAAK,CAAC,SAAS,KAAK,MAAM;gBAC1B,KAAK,CAAC,SAAS,KAAK,OAAO,EAC3B,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC9D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,UAAU,EAAE,CAAC;YACb,MAAM;QACR,KAAK,aAAa;YAChB,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,MAAM;YACT,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChC,MAAM;QACR;YACE,UAAU,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,UAAU,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC5G,CAAC;QACF,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}

package/dist/install.js CHANGED Viewed

@@ -92,10 +92,8 @@ async function main() {
         `  dispatcher   -> ${dispatcher}`,
         '',
         'Installed Codex hooks only. This does not install or modify skills, rules, AGENTS.md, .mnemonik.json, or MCP config.',
-        'Behavior is package-level — gate modes are constants in lib/behavior.ts, not user config.',
-        "  FORBIDDEN_GATE    = 'enforce'  → forbiddenCommand match denies.",
-        "  MUST_CONFIRM_GATE = 'advisory' → mustConfirm match allows + emits a systemMessage nudge.",
-        "  Either can be flipped to 'advisory' / 'enforce' / 'off' by editing the constant and bumping the package version.",
+        'Bash policy reminders are server-driven. The dispatcher posts the command to /api/v1/hooks/policy-reminder; matched policies come back as a systemMessage. No per-kind knobs in the client.',
+        'Local irreducible deny-floor blocks three catastrophic patterns unconditionally: rm -rf / | ~ | $HOME, dd of=<whole-disk>, mkfs <whole-disk>.',
     ].join('\n'));
     return 0;
 }

package/dist/install.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAmBxC,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAO,GAAG,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;QAC7C,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,CACZ,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,OAA2B,EAC3B,KAAkB;IAElB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACnD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1E,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,OAAO,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,aAAa,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC;QACxF,OAAO,GAAG,MAAM,oCAAoC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,uBAAuB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAE3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,iDAAiD,UAAU,sCAAsC,CAClG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAgC,CAAC;IACrE,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAEzC,KAAK,CAAC,YAAY,GAAG,cAAc,CACjC,KAAK,CAAC,YAAY,EAClB,sBAAsB,EACtB,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,gBAAgB,GAAG,cAAc,CACrC,KAAK,CAAC,gBAAgB,EACtB,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC1F,KAAK,CAAC,WAAW,GAAG,cAAc,CAChC,KAAK,CAAC,WAAW,EACjB,0CAA0C,EAC1C,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAE/E,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,CACT;QACE,oCAAoC,SAAS,EAAE;QAC/C,qBAAqB,UAAU,EAAE;QACjC,qBAAqB,UAAU,EAAE;QACjC,EAAE;QACF,sHAAsH;QACtH,~~2FAA2F~~;~~QAC3F,mEAAmE~~;~~QACnE~~,~~4FAA4F;QAC5F,oHAAoH;KACrH,~~CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,IAAI,EAAE;SACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC"}
1	+ {"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAmBxC,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAO,GAAG,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;QAC7C,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,CACZ,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,OAA2B,EAC3B,KAAkB;IAElB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACnD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1E,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,OAAO,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,aAAa,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC;QACxF,OAAO,GAAG,MAAM,oCAAoC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,uBAAuB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAE3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,iDAAiD,UAAU,sCAAsC,CAClG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAgC,CAAC;IACrE,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAEzC,KAAK,CAAC,YAAY,GAAG,cAAc,CACjC,KAAK,CAAC,YAAY,EAClB,sBAAsB,EACtB,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,gBAAgB,GAAG,cAAc,CACrC,KAAK,CAAC,gBAAgB,EACtB,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC1F,KAAK,CAAC,WAAW,GAAG,cAAc,CAChC,KAAK,CAAC,WAAW,EACjB,0CAA0C,EAC1C,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAE/E,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,CACT;QACE,oCAAoC,SAAS,EAAE;QAC/C,qBAAqB,UAAU,EAAE;QACjC,qBAAqB,UAAU,EAAE;QACjC,EAAE;QACF,sHAAsH;QACtH,6LAA6L;QAC7L,+IAA+I;KAChJ,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,IAAI,EAAE;SACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/lib/behavior.d.ts CHANGED Viewed

@@ -35,23 +35,15 @@ export declare const PRE_EDIT_GATE: GateMode;
  */
 export declare const PRE_EDIT_ADVISORY_AUTO_FETCH = true;
 /**
- * PreToolUse Bash gate — `forbiddenCommand` policy kind.
+ * PreToolUse Bash gate (phase 3 simplification, 0.4.x line).
  *
- * Default `enforce`: the kind name is the contract. Flip to `advisory`
- * for a soft nudge (allow but emit additionalContext) or `off` to
- * disable. Kept in sync with @mnemonik/claude-code-hooks.
- */
-export declare const FORBIDDEN_GATE: GateMode;
-/**
- * PreToolUse Bash gate — `mustConfirm` policy kind.
- *
- * Default `advisory`: the policy semantic is "pause and confirm with
- * the user." Advisory emits the policy text as additionalContext and
- * allows; the agent + user enforce the pause. Flip to `enforce` for
- * a hard block on match, or `off` to disable. Kept in sync with
+ * Per-kind policy enforcement moved server-side. The dispatcher posts
+ * the bash command to /api/v1/hooks/policy-reminder and emits whatever
+ * comes back as systemMessage (Codex PreToolUse cannot inject
+ * additionalContext reliably). The only LOCAL gate is the irreducible
+ * deny-floor in lib/shellTokens.ts. Kept in sync with
  * @mnemonik/claude-code-hooks.
  */
-export declare const MUST_CONFIRM_GATE: GateMode;
 /**
  * Stop checkpoint pressure (Codex-specific name for the Stop gate that
  * surfaces a continuation reason when meaningful work hasn't been

package/dist/lib/behavior.js CHANGED Viewed

@@ -33,23 +33,15 @@ export const PRE_EDIT_GATE = 'advisory';
  */
 export const PRE_EDIT_ADVISORY_AUTO_FETCH = true;
 /**
- * PreToolUse Bash gate — `forbiddenCommand` policy kind.
+ * PreToolUse Bash gate (phase 3 simplification, 0.4.x line).
  *
- * Default `enforce`: the kind name is the contract. Flip to `advisory`
- * for a soft nudge (allow but emit additionalContext) or `off` to
- * disable. Kept in sync with @mnemonik/claude-code-hooks.
- */
-export const FORBIDDEN_GATE = 'enforce';
-/**
- * PreToolUse Bash gate — `mustConfirm` policy kind.
- *
- * Default `advisory`: the policy semantic is "pause and confirm with
- * the user." Advisory emits the policy text as additionalContext and
- * allows; the agent + user enforce the pause. Flip to `enforce` for
- * a hard block on match, or `off` to disable. Kept in sync with
+ * Per-kind policy enforcement moved server-side. The dispatcher posts
+ * the bash command to /api/v1/hooks/policy-reminder and emits whatever
+ * comes back as systemMessage (Codex PreToolUse cannot inject
+ * additionalContext reliably). The only LOCAL gate is the irreducible
+ * deny-floor in lib/shellTokens.ts. Kept in sync with
  * @mnemonik/claude-code-hooks.
  */
-export const MUST_CONFIRM_GATE = 'advisory';
 /**
  * Stop checkpoint pressure (Codex-specific name for the Stop gate that
  * surfaces a continuation reason when meaningful work hasn't been

package/dist/lib/behavior.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"behavior.js","sourceRoot":"","sources":["../../src/lib/behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAa,UAAU,CAAC;AAEnD,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAa,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD~~;;;;;;GAMG~~;~~AACH,MAAM,CAAC,MAAM,cAAc,GAAa,SAAS,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAa,UAAU,CAAC;AAEtD~~;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa,UAAU,CAAC"}
1	+ {"version":3,"file":"behavior.js","sourceRoot":"","sources":["../../src/lib/behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAa,UAAU,CAAC;AAEnD,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAa,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa,UAAU,CAAC"}

package/dist/lib/http.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { HookContextResponse, SnapshotResponse } from './types.js';
+import type { HookContextResponse, PolicyReminderResponse, SnapshotResponse } from './types.js';
 export interface FetchSnapshotInput {
     server: string;
     apiKey: string;
@@ -6,6 +6,19 @@ export interface FetchSnapshotInput {
     codexSessionId: string;
 }
 export declare function fetchSnapshot(input: FetchSnapshotInput): Promise<SnapshotResponse | null>;
+/**
+ * JIT policy reminder fetch — see claude-code-hooks for the full
+ * rationale. Soft-fails on auth/lookup/timeout.
+ */
+export interface FetchPolicyReminderInput {
+    server: string;
+    apiKey: string;
+    cwd: string;
+    codexSessionId: string;
+    tool: string;
+    context: string;
+}
+export declare function fetchPolicyReminder(input: FetchPolicyReminderInput): Promise<PolicyReminderResponse | null>;
 export interface FetchHookContextInput {
     server: string;
     apiKey: string;

package/dist/lib/http.js CHANGED Viewed

@@ -34,6 +34,37 @@ export async function fetchSnapshot(input) {
         cleanup();
     }
 }
+export async function fetchPolicyReminder(input) {
+    if (!input.context.trim())
+        return null;
+    const url = `${input.server.replace(/\/$/, '')}/api/v1/hooks/policy-reminder`;
+    const { signal, cleanup } = withTimeout(FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                authorization: `Bearer ${input.apiKey}`,
+            },
+            body: JSON.stringify({
+                cwd: input.cwd,
+                claudeSessionId: input.codexSessionId,
+                tool: input.tool,
+                context: input.context,
+            }),
+            signal,
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+    finally {
+        cleanup();
+    }
+}
 export async function fetchHookContext(input) {
     const url = `${input.server.replace(/\/$/, '')}/api/v1/hooks/context`;
     const { signal, cleanup } = withTimeout(FETCH_TIMEOUT_MS);

package/dist/lib/http.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACvE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,IAAI,EAAE,OAAO;aACd,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,cAAc;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAKlC;IACC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAC;IAC/E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC7F,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACvE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,IAAI,EAAE,OAAO;aACd,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC;IAC9E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,cAAc;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAKlC;IACC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAC;IAC/E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC7F,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/shellTokens.d.ts CHANGED Viewed

@@ -1,71 +1,16 @@
 /**
- * Tiny shell tokenizer good enough for matching destructive Bash patterns.
+ * Irreducible deny-floor for catastrophic, irreversible commands.
+ * Kept in sync with @mnemonik/claude-code-hooks/src/lib/shellTokens.ts —
+ * see the comment block there for the full rationale.
  *
- * Why not a full shell parser? Because:
- *   - We only need to recognise patterns like `git push origin main` or
- *     `rm -rf /`, not interpret pipes, redirects, command substitution, or
- *     shell builtins.
- *   - A full parser introduces a runtime dep — the dispatcher is meant to
- *     be a single self-contained file with zero npm dependencies.
- *   - The regex-only approach is the false-positive trap the plan explicitly
- *     calls out (e.g. matching `rm -rf` inside a string literal). We avoid
- *     that by tokenising first and only matching tokens, never substrings.
- *
- * Limitations the caller MUST know:
- *   - Single-quoted strings are kept verbatim as one token (correct).
- *   - Double-quoted strings keep their content but $expansion is NOT resolved.
- *   - Backticks / $(...) are tokenised as raw text, not recursed into.
- *   - Pipes / redirects / && / || split commands so each side can be matched
- *     independently — the result is a list of token arrays, one per command.
- */
-export interface TokenizeResult {
-    /** Each entry is one command in a pipeline / sequence. */
-    commands: string[][];
-    /**
-     * Parallel to `commands`: per-token boolean — true iff the token came from
-     * (or partially included) a quoted region (single OR double quotes). The
-     * regex match path uses this to exclude quoted argument bodies from
-     * pattern matching, so a project policy regex like `\b(api|db|...):` can't
-     * spuriously match because "api" appears inside `gh api 'jq-query-text'`.
-     * The plain-phrase / token-subsequence path doesn't need this since it
-     * already operates on whole tokens — quoted strings stay as one token
-     * and are compared verbatim.
-     */
-    wasQuoted: boolean[][];
-}
-export declare function tokenize(input: string): TokenizeResult;
-/**
- * Match a token sequence against a project policy pattern.
- *
- * Pattern kinds (auto-detected — authors don't have to wrap in /…/):
- *   - Plain phrase like "git push origin main" — split into pattern tokens by
- *     whitespace; matches when a contiguous sub-sequence of `commandTokens`
- *     equals the pattern tokens. Critically, this does NOT substring-match
- *     against `tokens.join(' ')` — that would defeat the tokenizer (e.g.
- *     `echo '{"x":"git push origin main"}'` would falsely match because the
- *     literal phrase appears inside a single-quoted JSON token).
- *   - Glob like "git push *" or "delete-*" — pattern tokens with "*" matching
- *     any single command token (one-for-one). "*" within a token (e.g.
- *     "delete-*") is anchored to one whole command token.
- *   - Regex — anything that looks like a regex (contains "|", "\\", "^", "$",
- *     "(", ")", ".", "+", "?", "{", "}", "[", "]") OR is wrapped in /…/ or
- *     /…/i. Compiled and tested against `tokens.join(' ')`. The auto-detect
- *     covers the realistic case where a project's mustConfirm pattern is
- *     pipe-alternation (e.g. "make staging|make prod|git push|git commit")
- *     without explicit /…/ wrapping.
- *
- * Returning the matched pattern (verbatim) lets the dispatcher emit it
- * verbatim in telemetry and deny-reason text.
- */
-export declare function matchCommand(commandTokens: string[], patterns: string[], wasQuoted?: boolean[]): string | null;
-/**
- * Built-in `forbiddenCommand` patterns — catastrophic, host-rooted, no
- * legitimate agent use. Kept in sync with @mnemonik/claude-code-hooks.
- */
-export declare const BUILT_IN_FORBIDDEN: readonly string[];
-/**
- * Built-in `mustConfirm` patterns — operations the user almost certainly
- * wants done at some point but never silently. Kept in sync with
- * @mnemonik/claude-code-hooks.
+ * Phase 3 simplification (codex-hooks 0.4.0): all other policy matching
+ * moved server-side. The dispatcher posts to /api/v1/hooks/policy-reminder
+ * and emits whatever reminders come back. This file is the ONE place the
+ * dispatcher still does local pattern matching, only for "your machine
+ * is bricked" patterns.
  */
-export declare const BUILT_IN_MUST_CONFIRM: readonly string[];
+export declare const IRREDUCIBLE_DENY: ReadonlyArray<{
+    name: string;
+    pattern: RegExp;
+}>;
+export declare function matchIrreducibleDeny(command: string): string | null;

package/dist/lib/shellTokens.js CHANGED Viewed

@@ -1,328 +1,33 @@
 /**
- * Tiny shell tokenizer good enough for matching destructive Bash patterns.
+ * Irreducible deny-floor for catastrophic, irreversible commands.
+ * Kept in sync with @mnemonik/claude-code-hooks/src/lib/shellTokens.ts —
+ * see the comment block there for the full rationale.
  *
- * Why not a full shell parser? Because:
- *   - We only need to recognise patterns like `git push origin main` or
- *     `rm -rf /`, not interpret pipes, redirects, command substitution, or
- *     shell builtins.
- *   - A full parser introduces a runtime dep — the dispatcher is meant to
- *     be a single self-contained file with zero npm dependencies.
- *   - The regex-only approach is the false-positive trap the plan explicitly
- *     calls out (e.g. matching `rm -rf` inside a string literal). We avoid
- *     that by tokenising first and only matching tokens, never substrings.
- *
- * Limitations the caller MUST know:
- *   - Single-quoted strings are kept verbatim as one token (correct).
- *   - Double-quoted strings keep their content but $expansion is NOT resolved.
- *   - Backticks / $(...) are tokenised as raw text, not recursed into.
- *   - Pipes / redirects / && / || split commands so each side can be matched
- *     independently — the result is a list of token arrays, one per command.
- */
-export function tokenize(input) {
-    const commands = [];
-    const wasQuotedAll = [];
-    let current = [];
-    let currentQuoted = [];
-    let buf = '';
-    let bufQuoted = false;
-    let mode = 'normal';
-    const flushToken = () => {
-        if (buf.length > 0) {
-            current.push(buf);
-            currentQuoted.push(bufQuoted);
-            buf = '';
-            bufQuoted = false;
-        }
-    };
-    const flushCommand = () => {
-        flushToken();
-        if (current.length > 0) {
-            commands.push(current);
-            wasQuotedAll.push(currentQuoted);
-        }
-        current = [];
-        currentQuoted = [];
-    };
-    for (let i = 0; i < input.length; i++) {
-        const c = input[i];
-        if (mode === 'single') {
-            if (c === "'") {
-                mode = 'normal';
-            }
-            else {
-                buf += c;
-                bufQuoted = true;
-            }
-            continue;
-        }
-        if (mode === 'double') {
-            if (c === '"') {
-                mode = 'normal';
-            }
-            else if (c === '\\' && i + 1 < input.length) {
-                // Handle escaped quotes inside double-quoted strings.
-                buf += input[++i];
-                bufQuoted = true;
-            }
-            else {
-                buf += c;
-                bufQuoted = true;
-            }
-            continue;
-        }
-        // mode === 'normal'
-        if (c === "'") {
-            mode = 'single';
-            bufQuoted = true; // entering quoted region — even if empty, mark token
-            continue;
-        }
-        if (c === '"') {
-            mode = 'double';
-            bufQuoted = true;
-            continue;
-        }
-        if (c === '\\' && i + 1 < input.length) {
-            buf += input[++i];
-            continue;
-        }
-        if (c === ' ' || c === '\t' || c === '\n') {
-            flushToken();
-            continue;
-        }
-        // Two-char meta tokens we recognise.
-        if ((c === '|' && input[i + 1] === '|') ||
-            (c === '&' && input[i + 1] === '&') ||
-            (c === '>' && input[i + 1] === '>') ||
-            (c === '<' && input[i + 1] === '<')) {
-            flushCommand();
-            i++;
-            continue;
-        }
-        if (c === '|' || c === ';' || c === '&') {
-            flushCommand();
-            continue;
-        }
-        if (c === '>' || c === '<') {
-            flushCommand();
-            continue;
-        }
-        buf += c;
-    }
-    flushCommand();
-    return { commands, wasQuoted: wasQuotedAll };
-}
-/**
- * Match a token sequence against a project policy pattern.
- *
- * Pattern kinds (auto-detected — authors don't have to wrap in /…/):
- *   - Plain phrase like "git push origin main" — split into pattern tokens by
- *     whitespace; matches when a contiguous sub-sequence of `commandTokens`
- *     equals the pattern tokens. Critically, this does NOT substring-match
- *     against `tokens.join(' ')` — that would defeat the tokenizer (e.g.
- *     `echo '{"x":"git push origin main"}'` would falsely match because the
- *     literal phrase appears inside a single-quoted JSON token).
- *   - Glob like "git push *" or "delete-*" — pattern tokens with "*" matching
- *     any single command token (one-for-one). "*" within a token (e.g.
- *     "delete-*") is anchored to one whole command token.
- *   - Regex — anything that looks like a regex (contains "|", "\\", "^", "$",
- *     "(", ")", ".", "+", "?", "{", "}", "[", "]") OR is wrapped in /…/ or
- *     /…/i. Compiled and tested against `tokens.join(' ')`. The auto-detect
- *     covers the realistic case where a project's mustConfirm pattern is
- *     pipe-alternation (e.g. "make staging|make prod|git push|git commit")
- *     without explicit /…/ wrapping.
- *
- * Returning the matched pattern (verbatim) lets the dispatcher emit it
- * verbatim in telemetry and deny-reason text.
- */
-export function matchCommand(commandTokens, patterns, wasQuoted) {
-    if (commandTokens.length === 0 || patterns.length === 0)
-        return null;
-    const joined = commandTokens.join(' ').trim();
-    // Regex-safe joined excludes content of quoted tokens — see TokenizeResult
-    // doc comment. Each quoted token becomes a single-character placeholder so
-    // patterns can't bridge across them either. When wasQuoted is not provided
-    // (test fixtures, legacy callers), fall back to the old behavior.
-    const joinedForRegex = wasQuoted
-        ? commandTokens
-            .map((t, i) => (wasQuoted[i] ? '' : t))
-            .join(' ')
-            .trim()
-        : joined;
-    for (const raw of patterns) {
-        const pattern = raw.trim();
-        if (!pattern)
-            continue;
-        const explicitRegex = parseExplicitRegex(pattern);
-        if (explicitRegex !== null) {
-            try {
-                if (new RegExp(explicitRegex.body, explicitRegex.flags).test(joinedForRegex)) {
-                    return pattern;
-                }
-            }
-            catch {
-                /* invalid regex — skip */
-            }
-            continue;
-        }
-        // Pipe alternation: split into segments and decide phrase-vs-regex
-        // PER SEGMENT — but ONLY at the top level of the pattern. Pipes inside
-        // `(...)` or `[...]` groups are regex syntax (alternation inside a
-        // capture group, character class), not policy alternatives. Splitting
-        // them produced the v0.2.0 false positive: a YAML-targeted regex like
-        // `\b(app|db|...|api|...):` was split into a phrase segment "api" that
-        // matched any command containing `api` as a token (e.g. `gh api ...`).
-        const segments = splitTopLevelPipes(pattern);
-        for (const segment of segments) {
-            if (matchOneSegment(segment, commandTokens, joinedForRegex))
-                return pattern;
-        }
+ * Phase 3 simplification (codex-hooks 0.4.0): all other policy matching
+ * moved server-side. The dispatcher posts to /api/v1/hooks/policy-reminder
+ * and emits whatever reminders come back. This file is the ONE place the
+ * dispatcher still does local pattern matching, only for "your machine
+ * is bricked" patterns.
+ */
+export const IRREDUCIBLE_DENY = [
+    {
+        name: 'rm-rf-root-or-home',
+        pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f?[a-zA-Z]*\s+(?:\/|~|\$HOME)(?![A-Za-z0-9/_-])/,
+    },
+    {
+        name: 'dd-of-whole-disk',
+        pattern: /\bdd\b[^|;&]*\bof=\/dev\/(?:sd[a-z]|nvme\d+n\d+|hd[a-z]|vd[a-z])(?![A-Za-z0-9])/,
+    },
+    {
+        name: 'mkfs-whole-disk',
+        pattern: /\bmkfs(?:\.[a-z0-9]+)?\b[^|;&]*?\s\/dev\/(?:sd[a-z]|nvme\d+n\d+|hd[a-z]|vd[a-z])(?![A-Za-z0-9])/,
+    },
+];
+export function matchIrreducibleDeny(command) {
+    for (const { name, pattern } of IRREDUCIBLE_DENY) {
+        if (pattern.test(command))
+            return name;
     }
     return null;
 }
-function matchOneSegment(segment, commandTokens, joined) {
-    if (looksLikeRegex(segment)) {
-        try {
-            return new RegExp(segment).test(joined);
-        }
-        catch {
-            return false;
-        }
-    }
-    const tokens = segment.split(/\s+/).filter(Boolean);
-    if (tokens.length === 0)
-        return false;
-    return matchTokenSubsequence(commandTokens, tokens);
-}
-/**
- * Split `pattern` on `|` only when the pipe is at the top level (not nested
- * inside `(...)` or `[...]`). Backslash-escapes the next character. Used by
- * matchCommand to handle policy patterns like `make staging|make prod` while
- * leaving regex group alternations like `(app|db|...)` intact.
- */
-function splitTopLevelPipes(pattern) {
-    const segments = [];
-    let buf = '';
-    let depthParen = 0;
-    let depthBracket = 0;
-    for (let i = 0; i < pattern.length; i++) {
-        const c = pattern[i];
-        if (c === '\\' && i + 1 < pattern.length) {
-            buf += c + pattern[i + 1];
-            i++;
-            continue;
-        }
-        if (c === '(')
-            depthParen++;
-        else if (c === ')')
-            depthParen = Math.max(0, depthParen - 1);
-        else if (c === '[')
-            depthBracket++;
-        else if (c === ']')
-            depthBracket = Math.max(0, depthBracket - 1);
-        if (c === '|' && depthParen === 0 && depthBracket === 0) {
-            const trimmed = buf.trim();
-            if (trimmed)
-                segments.push(trimmed);
-            buf = '';
-            continue;
-        }
-        buf += c;
-    }
-    const tail = buf.trim();
-    if (tail)
-        segments.push(tail);
-    return segments.length > 0 ? segments : [pattern];
-}
-/**
- * /regex/ or /regex/i — explicit opt-in to joined-form regex matching.
- * Returns null when the pattern isn't wrapped this way.
- */
-function parseExplicitRegex(pattern) {
-    if (!pattern.startsWith('/'))
-        return null;
-    const tail = pattern.endsWith('/i') ? '/i' : pattern.endsWith('/') ? '/' : null;
-    if (!tail)
-        return null;
-    return { body: pattern.slice(1, pattern.length - tail.length), flags: tail === '/i' ? 'i' : '' };
-}
-/**
- * Heuristic: does `pattern` contain regex metacharacters that aren't part of
- * the plain-phrase / glob vocabulary? `*` alone is glob, not regex. The pipe
- * is the most common case in real-world policies.
- */
-function looksLikeRegex(pattern) {
-    return /[|\\.^$()+?{}[\]]/.test(pattern);
-}
-/**
- * True iff `patternTokens` appears as a contiguous sub-sequence of
- * `commandTokens`. A "*" pattern token matches any single command token.
- *
- * Whole-token matches only — `git push` does NOT match a command token
- * `'git push origin main'` (a single-quoted string), which is the property
- * that protects us from the false-positive Bash regex trap. A pattern token
- * is allowed to be a partial-string glob (`git*`) — those still only match
- * a single whole command token, never crossing token boundaries.
- */
-function matchTokenSubsequence(commandTokens, patternTokens) {
-    const need = patternTokens.length;
-    if (need === 0)
-        return true;
-    for (let start = 0; start <= commandTokens.length - need; start++) {
-        let ok = true;
-        for (let i = 0; i < need; i++) {
-            const cmd = commandTokens[start + i] ?? '';
-            const pat = patternTokens[i] ?? '';
-            if (pat === '*')
-                continue;
-            if (pat.includes('*')) {
-                // Within-token glob, e.g. "delete-*" — anchored to the whole token.
-                const escaped = pat
-                    .split('*')
-                    .map((seg) => seg.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
-                    .join('.*');
-                if (!new RegExp(`^${escaped}$`).test(cmd)) {
-                    ok = false;
-                    break;
-                }
-                continue;
-            }
-            if (cmd !== pat) {
-                ok = false;
-                break;
-            }
-        }
-        if (ok)
-            return true;
-    }
-    return false;
-}
-/**
- * Built-in `forbiddenCommand` patterns — catastrophic, host-rooted, no
- * legitimate agent use. Kept in sync with @mnemonik/claude-code-hooks.
- */
-export const BUILT_IN_FORBIDDEN = [
-    'rm -rf /',
-    'rm -rf ~',
-    'rm -rf $HOME',
-];
-/**
- * Built-in `mustConfirm` patterns — operations the user almost certainly
- * wants done at some point but never silently. Kept in sync with
- * @mnemonik/claude-code-hooks.
- */
-export const BUILT_IN_MUST_CONFIRM = [
-    'git push origin main',
-    'git push origin master',
-    'git push --force',
-    'git reset --hard',
-    'git merge main',
-    'git merge master',
-    'git branch -D',
-    'npm publish',
-    'pnpm publish',
-    'yarn publish',
-    'docker rm',
-    'docker rmi',
-    'kubectl delete',
-];
 //# sourceMappingURL=shellTokens.js.map

package/dist/lib/shellTokens.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"shellTokens.js","sourceRoot":"","sources":["../../src/lib/shellTokens.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;;;;;;;GAmBG~~;~~AAkBH~~,MAAM,~~UAAU,QAAQ,~~CAAC,~~KAAa;IACpC,~~MAAM,~~QAAQ~~,~~GAAe,EAAE,CAAC~~;~~IAChC,MAAM,YAAY,GAAgB,EAAE,CAAC~~;~~IACrC~~,IAAI,~~OAAO,GAAa,~~EAAE,~~CAAC~~;~~IAC3B~~,IAAI,aAAa,GAAc,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAI,GAAmC,QAAQ,CAAC;IAEpD,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,~~CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,GAAG,GAAG,~~EAAE,~~CAAC~~;~~YACT,SAAS,GAAG,KAAK,CAAC~~;QACpB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,UAAU,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,QAAQ,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,CAAC,CAAC;gBACT,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,QAAQ,CAAC;YAClB,CAAC;iBAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9C,sDAAsD;gBACtD,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,CAAC,CAAC;gBACT,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,QAAQ,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC,CAAC,qDAAqD;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,QAAQ,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,qCAAqC;QACrC,IACE,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YACnC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YACnC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;YACnC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EACnC,CAAC;YACD,YAAY,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD~~,YAAY,EAAE,CAAC~~;~~IACf~~,~~OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAuB,EACvB,QAAkB,EAClB,SAAqB;IAErB,~~IAAI,~~aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,~~EAAE,CAAC;IAC9C,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,cAAc,GAAG,SAAS;QAC9B,CAAC,CAAC,aAAa;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACvC,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,EAAE;QACX,CAAC,CAAC,MAAM,CAAC;IACX,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,aAAa,GAAG,kBAAkB~~,CAAC,OAAO,CAAC,CAAC~~;~~QAClD~~,~~IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC7E,~~OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;YACD,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,~~CAAC~~;~~YAC/B,IAAI,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,CAAC~~;~~gBAAE,OAAO,OAAO,CAAC;QAC9E,CAAC;IACH,CAAC;~~IACD~~,OAAO,IAAI,CAAC~~;~~AACd~~,~~CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,aAAuB,EAAE,MAAc;IAC/E,~~IAAI,~~cAAc,CAAC,OAAO,CAAC,~~EAAE,~~CAAC~~;~~QAC5B~~,~~IAAI,CAAC;YACH,~~OAAO,~~IAAI~~,~~MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC~~;~~QAC1C,CAAC~~;~~QAAC~~,~~MAAM,~~CAAC;~~YACP~~,~~OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,~~MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,UAAU,~~GAAG~~,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACzC,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;aACxD,IAAI,CAAC,KAAK,GAAG;YAAE,YAAY,EAAE,CAAC;aAC9B,IAAI,CAAC,KAAK,GAAG;YAAE,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,GAAG,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAe;~~IACzC~~,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,~~CAAC,CAAC,EAAE,OAAO,CAAC,~~MAAM,~~GAAG,IAAI,CAAC,MAAM,CAAC,~~EAAE,~~KAAK,EAAE,~~IAAI,~~KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,~~EAAE,~~EAAE,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,~~OAAO,~~mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,aAAuB,~~EAAE,~~aAAuB;IAC7E,MAAM,~~IAAI,~~GAAG~~,~~aAAa,CAAC,MAAM,CAAC;IAClC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,~~EAAE,~~KAAK,IAAI,aAAa,~~CAAC~~,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC~~;~~QAClE~~,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,GAAG,KAAK,GAAG;gBAAE,SAAS;YAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,oEAAoE;gBACpE,MAAM,OAAO,~~GAAG,GAAG;qBAChB,KAAK,~~CAAC,~~GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;qBACvD,~~IAAI,CAAC,~~IAAI,CAAC,CAAC;gBACd,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,~~OAAO,~~GAAG,~~CAAC~~,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC~~;~~oBAC1C,EAAE,GAAG,KAAK,CAAC;oBACX,MAAM;gBACR,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,EAAE,GAAG,KAAK,CAAC;gBACX,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,EAAE;~~YAAE,OAAO,IAAI,CAAC;~~IACtB~~,CAAC;IACD,OAAO,~~KAAK~~,CAAC;~~AACf~~,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,UAAU;IACV,cAAc;CACN,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,sBAAsB;IACtB,wBAAwB;IACxB,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,cAAc;IACd,cAAc;IACd,WAAW;IACX,YAAY;IACZ,gBAAgB;CACR,CAAC"}
1	+ {"version":3,"file":"shellTokens.js","sourceRoot":"","sources":["../../src/lib/shellTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAqD;IAChF;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4EAA4E;KACtF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,iFAAiF;KAC3F;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EACL,iGAAiG;KACpG;CACF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/types.d.ts CHANGED Viewed

@@ -34,12 +34,33 @@ export interface BypassEnvelope {
     detail: string | null;
     invalidReason: string | null;
 }
+/**
+ * Server response from /api/v1/hooks/policy-reminder. Each entry is a
+ * context-triggered policy whose trigger_keywords overlap the action
+ * context the dispatcher posted.
+ */
+export interface PolicyReminderResponse {
+    ok: boolean;
+    reason?: 'unauthorized' | 'no_project' | 'no_context' | 'lookup_failed';
+    policies: Array<{
+        id: string;
+        kind: string;
+        pattern: string;
+        description: string | null;
+        replacement: string | null;
+    }>;
+}
+/**
+ * Server snapshot. Phase 3 (0.4.0): dispatcher no longer matches against
+ * `policies` locally; policy decisions live in /api/v1/hooks/policy-reminder.
+ * `policies` retained for backwards compat with older servers.
+ */
 export interface SnapshotResponse {
     ok: boolean;
     reason?: 'unauthorized' | 'no_project' | 'no_active_session';
     coveredFiles: string[];
     editedFiles: string[];
-    policies: {
+    policies?: {
         forbiddenCommand: Array<{
             pattern: string;
             description: string;

package/dist/lib/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"~~AA+EA~~,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC"}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAqGA,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@mnemonik/codex-hooks",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "Codex lifecycle hooks for Mnemonik memory awareness and host-side grounding gates. Hooks only: does not install skills, rules, AGENTS.md, .mnemonik.json, or MCP config.",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
   ],
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^20.19.40",
     "typescript": "^5.3.3",
     "vitest": "^4.1.5"
   }