@nexrall/code-core 1.4.71 → 1.4.73

package/dist/agent/peerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peerRegistry.d.ts","sourceRoot":"","sources":["../../src/agent/peerRegistry.ts"],"names":[],"mappings":"AA2CA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yJAAyJ;IACzJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,iBAAS,SAAS,IAAI,MAAM,CAE3B;AAED,iBAAS,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtC;AAMD,iBAAS,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAG7C;AA0BD,8FAA8F;AAC9F,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,+IAA+I;IAC/I,SAAS,IAAI,IAAI,CAAC;IAClB,sJAAsJ;IACtJ,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC9C,mKAAmK;IACnK,UAAU,IAAI,IAAI,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,UAAU,CAyClE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAwBtD;AAED,wHAAwH;AACxH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAE9D;AAED,eAAO,MAAM,qBAAqB;;;;;;CAAsF,CAAC"}
+{"version":3,"file":"peerRegistry.d.ts","sourceRoot":"","sources":["../../src/agent/peerRegistry.ts"],"names":[],"mappings":"AA2CA,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yJAAyJ;IACzJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,iBAAS,SAAS,IAAI,MAAM,CAE3B;AAED,iBAAS,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtC;AAWD,iBAAS,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAG7C;AAoDD,8FAA8F;AAC9F,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,+IAA+I;IAC/I,SAAS,IAAI,IAAI,CAAC;IAClB,sJAAsJ;IACtJ,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC9C,mKAAmK;IACnK,UAAU,IAAI,IAAI,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,UAAU,CAiDlE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAgCtD;AAED,wHAAwH;AACxH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAE9D;AAED,eAAO,MAAM,qBAAqB;;;;;;CAMjC,CAAC"}

package/dist/agent/peerRegistry.js

@@ -127,8 +127,34 @@ function writeRecord(r) {
     fs.writeFileSync(tmp, JSON.stringify(r));
     fs.renameSync(tmp, p);
 }
-const ADJECTIVES = ['graceful', 'quiet', 'brave', 'calm', 'swift', 'keen', 'bold', 'clear', 'gentle', 'sharp', 'steady', 'curious'];
-const NOUNS = ['unicorn', 'falcon', 'otter', 'harbor', 'meadow', 'ember', 'summit', 'cedar', 'quartz', 'heron', 'lynx', 'delta'];
+const ADJECTIVES = [
+    'graceful',
+    'quiet',
+    'brave',
+    'calm',
+    'swift',
+    'keen',
+    'bold',
+    'clear',
+    'gentle',
+    'sharp',
+    'steady',
+    'curious',
+];
+const NOUNS = [
+    'unicorn',
+    'falcon',
+    'otter',
+    'harbor',
+    'meadow',
+    'ember',
+    'summit',
+    'cedar',
+    'quartz',
+    'heron',
+    'lynx',
+    'delta',
+];
 /** Generate a readable random peer name, same shape Claude Code uses ("graceful-unicorn"). */
 function randomPeerName() {
     const a = ADJECTIVES[crypto.randomInt(ADJECTIVES.length)];
@@ -160,7 +186,9 @@ function registerPeer(opts) {
     }
     const now = Date.now();
     const record = {
-        id, name, pid: process.pid,
+        id,
+        name,
+        pid: process.pid,
         clientType: opts.clientType,
         workDir: opts.workDir,
         socketPath: opts.socketPath,
@@ -185,7 +213,9 @@ function registerPeer(opts) {
             try {
                 fs.unlinkSync(recordPath(id));
             }
-            catch { /* already gone */ }
+            catch {
+                /* already gone */
+            }
         },
     };
 }
@@ -222,7 +252,9 @@ function listPeers(ownId) {
             try {
                 fs.unlinkSync(recordPath(id));
             }
-            catch { /* raced with another GC — fine */ }
+            catch {
+                /* raced with another GC — fine */
+            }
         }
     }
     if (ownId) {
@@ -234,5 +266,11 @@ function listPeers(ownId) {
 function findPeerByName(name) {
     return listPeers().find((p) => p.name === name) ?? null;
 }
-exports._peerRegistryInternal = { peersRoot, recordPath, isRecordAlive, HEARTBEAT_STALE_MS, HEARTBEAT_INTERVAL_MS };
+exports._peerRegistryInternal = {
+    peersRoot,
+    recordPath,
+    isRecordAlive,
+    HEARTBEAT_STALE_MS,
+    HEARTBEAT_INTERVAL_MS,
+};
 //# sourceMappingURL=peerRegistry.js.map

package/dist/agent/peerTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peerTransport.d.ts","sourceRoot":"","sources":["../../src/agent/peerTransport.ts"],"names":[],"mappings":"AAgDA,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AA+CD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,iBAAS,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,CAAC;IACtC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA8EhF;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAkChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GACnC,OAAO,CAAC,eAAe,EAAE,CAAC,CAQ5B;AAED,eAAO,MAAM,sBAAsB;;;;;CAA2E,CAAC"}
+{"version":3,"file":"peerTransport.d.ts","sourceRoot":"","sources":["../../src/agent/peerTransport.ts"],"names":[],"mappings":"AAgDA,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AA+CD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,iBAAS,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB7D;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,CAAC;IACtC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAgGhF;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAqChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GACnC,OAAO,CAAC,eAAe,EAAE,CAAC,CAQ5B;AAED,eAAO,MAAM,sBAAsB;;;;;CAA2E,CAAC"}

package/dist/agent/peerTransport.js

@@ -215,7 +215,9 @@ function startPeerInbox(peerId, opts) {
         try {
             fs.unlinkSync(socketPath);
         }
-        catch { /* did not exist */ }
+        catch {
+            /* did not exist */
+        }
     }
     // No directory/stale-file handling needed on Windows — named pipes have no
     // on-disk path component (see socketPathFor's doc comment), and a stale
@@ -247,10 +249,14 @@ function startPeerInbox(peerId, opts) {
                     });
                 }
             }
-            catch { /* malformed message — drop silently, same as a corrupt network packet */ }
+            catch {
+                /* malformed message — drop silently, same as a corrupt network packet */
+            }
             conn.end();
         });
-        conn.on('error', () => { });
+        conn.on('error', () => {
+            /* peer disconnected mid-write — nothing to recover */
+        });
     });
     server.listen(socketPath, () => {
         if (isWindows)
@@ -261,14 +267,18 @@ function startPeerInbox(peerId, opts) {
         try {
             fs.chmodSync(socketPath, 0o600);
         }
-        catch { /* best-effort on platforms without POSIX chmod semantics */ }
+        catch {
+            /* best-effort on platforms without POSIX chmod semantics */
+        }
     });
     // See PeerInboxOptions.onError's own comment for why this used to be a
     // pure no-op (`() => {}`) and why that was a real bug, not a deliberate
     // simplification: `listen()` failing (EINVAL for an over-length path,
     // EADDRINUSE, EACCES, ...) used to be indistinguishable from success from
     // this function's return value alone.
-    server.on('error', (err) => { opts.onError?.(err instanceof Error ? err : new Error(String(err))); });
+    server.on('error', (err) => {
+        opts.onError?.(err instanceof Error ? err : new Error(String(err)));
+    });
     return {
         socketPath,
         close() {
@@ -286,7 +296,9 @@ function startPeerInbox(peerId, opts) {
             try {
                 fs.unlinkSync(socketPath);
             }
-            catch { /* already gone, or never existed (Windows) */ }
+            catch {
+                /* already gone, or never existed (Windows) */
+            }
         },
     };
 }

package/dist/agent/planMode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAiJA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAqFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA8D1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,GAAG,IAAI,CAoCxB;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}
+{"version":3,"file":"planMode.d.ts","sourceRoot":"","sources":["../../src/agent/planMode.ts"],"names":[],"mappings":"AAwOA,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAuKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA8D1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAU3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,GAAG,IAAI,CAoClG;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,QAqBvB,CAAC"}

package/dist/agent/planMode.js

@@ -31,18 +31,26 @@ exports.checkPlanMode = checkPlanMode;
  * and the refusal is visible the first time anybody tries it.
  */
 const READ_ONLY_TOOLS = new Set([
-    'read_file', 'search_files', 'glob', 'list_directory', 'notebook_read',
+    'read_file',
+    'search_files',
+    'glob',
+    'list_directory',
+    'notebook_read',
     // Planning bookkeeping. todo_write persists only to the session's own todo
     // list, not the repo, so it stays available — a plan mode that cannot draft
     // a checklist is missing the point of plan mode.
-    'todo_write', 'todo_read',
-    'cron_list', 'mcp_list_resources', 'mcp_read_resource',
+    'todo_write',
+    'todo_read',
+    'cron_list',
+    'mcp_list_resources',
+    'mcp_read_resource',
     // Reading memory is fine; memory_write is NOT here on purpose. Memory is
     // durable state that survives the session, so writing it is a real mutation
     // even though no file in the repo changes.
     'memory_read',
     'use_skill',
-    'fetch_url', 'web_search',
+    'fetch_url',
+    'web_search',
     // Delegating research is ALLOWED, and this is safe rather than a hole:
     // runSubTask passes planMode down, so the sub-agent is under the same lock and
     // its own write tools are refused by this very function one level deeper.
@@ -53,8 +61,12 @@ const READ_ONLY_TOOLS = new Set([
     // the mode's headline use case worse, for no security gain.
     'task',
     // VS Code language server — all pure queries.
-    'get_symbols', 'get_workspace_symbols', 'find_references', 'go_to_definition',
-    'get_hover', 'get_diagnostics',
+    'get_symbols',
+    'get_workspace_symbols',
+    'find_references',
+    'go_to_definition',
+    'get_hover',
+    'get_diagnostics',
     // Reading output from an ALREADY-running background shell. Starting one is
     // gated with the rest of bash below; draining a buffer is not a new effect.
     'bash_output',
@@ -68,16 +80,71 @@ const READ_ONLY_TOOLS = new Set([
  * `isReadOnlyCommand` for the several that are read-only ONLY in some forms.
  */
 const READ_ONLY_BASH = new Set([
-    'ls', 'cat', 'head', 'tail', 'wc', 'file', 'stat', 'du', 'df', 'pwd', 'which',
-    'type', 'echo', 'printf', 'basename', 'dirname', 'realpath', 'readlink',
-    'grep', 'egrep', 'fgrep', 'rg', 'ag', 'ack', 'find', 'fd', 'locate',
-    'diff', 'comm', 'cmp', 'sort', 'uniq', 'cut', 'tr', 'column', 'jq', 'yq',
-    'date', 'whoami', 'hostname', 'uname', 'env', 'printenv', 'id', 'groups',
-    'ps', 'uptime', 'free', 'node', 'python', 'python3',
+    'ls',
+    'cat',
+    'head',
+    'tail',
+    'wc',
+    'file',
+    'stat',
+    'du',
+    'df',
+    'pwd',
+    'which',
+    'type',
+    'echo',
+    'printf',
+    'basename',
+    'dirname',
+    'realpath',
+    'readlink',
+    'grep',
+    'egrep',
+    'fgrep',
+    'rg',
+    'ag',
+    'ack',
+    'find',
+    'fd',
+    'locate',
+    'diff',
+    'comm',
+    'cmp',
+    'sort',
+    'uniq',
+    'cut',
+    'tr',
+    'column',
+    'jq',
+    'yq',
+    'date',
+    'whoami',
+    'hostname',
+    'uname',
+    'env',
+    'printenv',
+    'id',
+    'groups',
+    'ps',
+    'uptime',
+    'free',
+    'node',
+    'python',
+    'python3',
     // `less`/`more`/`top` are deliberately NOT here: pagers run `!cmd` from inside and
     // `top` never exits. `env` is listed but only bare — see toolFlagsOk.
-    'tree', 'nl', 'tac', 'strings', 'md5sum', 'sha256sum',
-    'true', 'false', 'test', 'sleep', 'seq', 'expr',
+    'tree',
+    'nl',
+    'tac',
+    'strings',
+    'md5sum',
+    'sha256sum',
+    'true',
+    'false',
+    'test',
+    'sleep',
+    'seq',
+    'expr',
     // Changes this shell's cwd only. Needed so `cd x && ls` is not refused.
     'cd',
 ]);
@@ -87,9 +154,7 @@ const READ_ONLY_BASH = new Set([
  * `build/git` — attacker-written files — were classified by their NAME and waved
  * through as read-only.
  */
-const SYSTEM_BIN_DIRS = new Set([
-    '/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin', '/opt/homebrew/bin',
-]);
+const SYSTEM_BIN_DIRS = new Set(['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin', '/opt/homebrew/bin']);
 /**
  * Environment assignments that change WHAT a read-only verb runs: the search path,
  * loader, pager/editor/external-diff hooks, and the interpreters' option vars.
@@ -106,10 +171,31 @@ const GH_NOUNS = new Set(['pr', 'issue', 'run', 'repo', 'release', 'workflow', '
  */
 const READ_ONLY_SUBCOMMANDS = {
     git: new Set([
-        'log', 'show', 'diff', 'status', 'blame', 'branch', 'tag', 'remote',
-        'describe', 'rev-parse', 'rev-list', 'ls-files', 'ls-tree', 'ls-remote',
-        'cat-file', 'shortlog', 'reflog', 'whatchanged', 'grep', 'config',
-        'check-ignore', 'merge-base', 'name-rev', 'count-objects', 'verify-commit',
+        'log',
+        'show',
+        'diff',
+        'status',
+        'blame',
+        'branch',
+        'tag',
+        'remote',
+        'describe',
+        'rev-parse',
+        'rev-list',
+        'ls-files',
+        'ls-tree',
+        'ls-remote',
+        'cat-file',
+        'shortlog',
+        'reflog',
+        'whatchanged',
+        'grep',
+        'config',
+        'check-ignore',
+        'merge-base',
+        'name-rev',
+        'count-objects',
+        'verify-commit',
     ]),
     // Package managers: only their query verbs.
     npm: new Set(['ls', 'list', 'view', 'info', 'outdated', 'why', 'config', 'ping', 'search']),
@@ -151,23 +237,33 @@ function toolFlagsOk(verb, args) {
     const flags = args.filter((a) => a.startsWith('-'));
     const pos = args.filter((a) => !a.startsWith('-'));
     switch (verb) {
-        case 'env': return args.length === 0; // `env CMD` RUNS CMD
+        case 'env':
+            return args.length === 0; // `env CMD` RUNS CMD
         case 'sort':
             return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*o/.test(f)) || f.startsWith('--output') || f.startsWith('--compress-program'));
-        case 'uniq': return pos.length <= 1; // second positional is an OUTPUT file
+        case 'uniq':
+            return pos.length <= 1; // second positional is an OUTPUT file
         case 'find':
             return !args.some((a) => ['-exec', '-execdir', '-delete', '-ok', '-okdir', '-fprint', '-fprint0', '-fprintf', '-fls'].includes(a));
         case 'fd':
             return !flags.some((f) => f.startsWith('--exec') || (isShort(f) && /^-[A-Za-z]*[xX]/.test(f)));
-        case 'rg': return !flags.some((f) => flagName(f) === '--pre' || f.startsWith('--hostname-bin'));
+        case 'rg':
+            return !flags.some((f) => flagName(f) === '--pre' || f.startsWith('--hostname-bin'));
         case 'ag':
-        case 'ack': return !flags.some((f) => f.startsWith('--pager'));
-        case 'yq': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*i/.test(f)) || f.startsWith('--inplace'));
-        case 'tree': return !flags.some((f) => isShort(f) && /^-[A-Za-z]*o/.test(f));
-        case 'date': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*s/.test(f)) || f.startsWith('--set'));
-        case 'hostname': return pos.length === 0; // `hostname NAME` renames the machine
-        case 'file': return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*C/.test(f)) || f.startsWith('--compile'));
-        default: return true;
+        case 'ack':
+            return !flags.some((f) => f.startsWith('--pager'));
+        case 'yq':
+            return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*i/.test(f)) || f.startsWith('--inplace'));
+        case 'tree':
+            return !flags.some((f) => isShort(f) && /^-[A-Za-z]*o/.test(f));
+        case 'date':
+            return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*s/.test(f)) || f.startsWith('--set'));
+        case 'hostname':
+            return pos.length === 0; // `hostname NAME` renames the machine
+        case 'file':
+            return !flags.some((f) => (isShort(f) && /^-[A-Za-z]*C/.test(f)) || f.startsWith('--compile'));
+        default:
+            return true;
     }
 }
 /** Every flag must be a known read-only one; anything unfamiliar fails closed. */
@@ -192,18 +288,72 @@ function subcommandFlagsOk(verb, sub, args) {
             return false;
         switch (sub) {
             case 'branch':
-                return flagsWithin(flags, 'arvlq', ['--all', '--remotes', '--verbose', '--list', '--show-current', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--sort', '--format', '--column', '--no-column', '--color', '--no-color', '--abbrev', '--no-abbrev', '--ignore-case', '--omit-empty'])
-                    && (pos.length <= 1 || listish);
+                return (flagsWithin(flags, 'arvlq', [
+                    '--all',
+                    '--remotes',
+                    '--verbose',
+                    '--list',
+                    '--show-current',
+                    '--contains',
+                    '--no-contains',
+                    '--merged',
+                    '--no-merged',
+                    '--points-at',
+                    '--sort',
+                    '--format',
+                    '--column',
+                    '--no-column',
+                    '--color',
+                    '--no-color',
+                    '--abbrev',
+                    '--no-abbrev',
+                    '--ignore-case',
+                    '--omit-empty',
+                ]) &&
+                    (pos.length <= 1 || listish));
             case 'tag':
-                return flagsWithin(flags, 'lnv', ['--list', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--sort', '--format', '--column', '--no-column', '--color', '--no-color', '--verify', '--ignore-case', '--omit-empty'])
-                    && (pos.length <= 1 || listish || flags.some((f) => f === '-v' || f === '--verify'));
+                return (flagsWithin(flags, 'lnv', [
+                    '--list',
+                    '--contains',
+                    '--no-contains',
+                    '--merged',
+                    '--no-merged',
+                    '--points-at',
+                    '--sort',
+                    '--format',
+                    '--column',
+                    '--no-column',
+                    '--color',
+                    '--no-color',
+                    '--verify',
+                    '--ignore-case',
+                    '--omit-empty',
+                ]) &&
+                    (pos.length <= 1 || listish || flags.some((f) => f === '-v' || f === '--verify')));
             case 'remote':
-                return flagsWithin(flags, 'vn', ['--verbose']) && (pos[1] === undefined || pos[1] === 'show' || pos[1] === 'get-url');
+                return (flagsWithin(flags, 'vn', ['--verbose']) && (pos[1] === undefined || pos[1] === 'show' || pos[1] === 'get-url'));
             case 'config':
-                return flagsWithin(flags, 'lz', ['--get', '--get-all', '--get-regexp', '--list', '--show-origin', '--show-scope', '--global', '--local', '--system', '--worktree', '--name-only', '--null', '--includes', '--no-includes', '--type'])
-                    && pos.length <= 2; // `config` itself + at most one key
-            case 'reflog': return pos[1] !== 'expire' && pos[1] !== 'delete';
-            default: return true;
+                return (flagsWithin(flags, 'lz', [
+                    '--get',
+                    '--get-all',
+                    '--get-regexp',
+                    '--list',
+                    '--show-origin',
+                    '--show-scope',
+                    '--global',
+                    '--local',
+                    '--system',
+                    '--worktree',
+                    '--name-only',
+                    '--null',
+                    '--includes',
+                    '--no-includes',
+                    '--type',
+                ]) && pos.length <= 2); // `config` itself + at most one key
+            case 'reflog':
+                return pos[1] !== 'expire' && pos[1] !== 'delete';
+            default:
+                return true;
         }
     }
     if (sub === 'config' && (verb === 'npm' || verb === 'pnpm' || verb === 'yarn')) {
@@ -312,7 +462,10 @@ function isReadOnlyPipeline(command) {
         return false;
     if (/[>`]|\$\(|<\(/.test(cmd))
         return false;
-    const segs = cmd.split(/\|\||&&|[;|\n\r]/).map((x) => x.trim()).filter(Boolean);
+    const segs = cmd
+        .split(/\|\||&&|[;|\n\r]/)
+        .map((x) => x.trim())
+        .filter(Boolean);
     if (!segs.length)
         return false;
     return segs.every((seg) => !seg.includes('&') && isReadOnlyCommand(seg));

package/dist/agent/readDedupe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readDedupe.d.ts","sourceRoot":"","sources":["../../src/agent/readDedupe.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAMxC,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAFrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAE5B,OAAO,CAAC,EAAE,MAAM,YAAA;IAE7C,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,GAAG;IAQX,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI;IAezE,0FAA0F;IAC1F,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAS/D,uFAAuF;IACvF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;CAOrC"}
+{"version":3,"file":"readDedupe.d.ts","sourceRoot":"","sources":["../../src/agent/readDedupe.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAUxC,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAFrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;gBAE5B,OAAO,CAAC,EAAE,MAAM,YAAA;IAE7C,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,GAAG;IAQX,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI;IA0BzE,0FAA0F;IAC1F,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAW/D,uFAAuF;IACvF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;CAOrC"}

package/dist/agent/readDedupe.js

@@ -109,7 +109,9 @@ class ReadDedupe {
             const st = fs.statSync(k.abs);
             this.records.set(k.key, { toolUseId, mtimeMs: st.mtimeMs, size: st.size });
         }
-        catch { /* unreadable now — nothing to remember */ }
+        catch {
+            /* unreadable now — nothing to remember */
+        }
     }
     /** Forget every recorded range of these absolute paths (a write tool touched them). */
     invalidate(absPaths) {

package/dist/agent/securityLint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"securityLint.d.ts","sourceRoot":"","sources":["../../src/agent/securityLint.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AA+ID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,eAAe,EAAE,CA6CzE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAepE"}
+{"version":3,"file":"securityLint.d.ts","sourceRoot":"","sources":["../../src/agent/securityLint.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAyJD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,eAAe,EAAE,CA8CzE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAapE"}

package/dist/agent/sharedTasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharedTasks.d.ts","sourceRoot":"","sources":["../../src/agent/sharedTasks.ts"],"names":[],"mappings":"AA6DA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,4HAA4H;IAC5H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD,iBAAS,SAAS,IAAI,MAAM,CAE3B;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzC;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AA4BD,0HAA0H;AAC1H,iBAAS,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAUnD;AAED,4GAA4G;AAC5G,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAG/D;AAED,0IAA0I;AAC1I,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAW7D;AAED,sJAAsJ;AACtJ,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/C,UAAU,CAUZ;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,aAAa,CAAA;CAAE,CAAC;AAEvF;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BxG;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACrF,OAAO,CAAC,WAAW,CAAC,CAoBtB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;CAAqH,CAAC;AAEvJ;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE"}
+{"version":3,"file":"sharedTasks.d.ts","sourceRoot":"","sources":["../../src/agent/sharedTasks.ts"],"names":[],"mappings":"AA6DA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,4HAA4H;IAC5H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD,iBAAS,SAAS,IAAI,MAAM,CAE3B;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzC;AAED,iBAAS,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAiCD,0HAA0H;AAC1H,iBAAS,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAenD;AAED,4GAA4G;AAC5G,iBAAS,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAG/D;AAED,0IAA0I;AAC1I,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,CAe7D;AAED,sJAAsJ;AACtJ,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/C,UAAU,CAaZ;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,aAAa,CAAA;CAAE,CAAC;AAEvF;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAmCxG;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,WAAW,CAAC,CA0BtB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;CAQhC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOzE"}

package/dist/agent/sharedTasks.js

@@ -171,7 +171,9 @@ function isClaimAbandoned(task) {
     // verdict is withheld until the claim has existed for a minimum age —
     // without this guard, a session that legitimately claims-then-exits
     // quickly can have its still-valid claim stolen out from under it.
-    if (age >= MIN_CLAIM_AGE_FOR_DEATH_CHECK_MS && typeof task.claimedByPid === 'number' && !isPidAlive(task.claimedByPid))
+    if (age >= MIN_CLAIM_AGE_FOR_DEATH_CHECK_MS &&
+        typeof task.claimedByPid === 'number' &&
+        !isPidAlive(task.claimedByPid))
         return true;
     if (age > CLAIM_STALE_MS)
         return true;
@@ -208,9 +210,12 @@ function createSharedTask(workDir, content, opts = {}) {
     const id = opts.id ?? crypto.randomBytes(6).toString('hex');
     const now = Date.now();
     const task = {
-        id, content, status: 'pending',
+        id,
+        content,
+        status: 'pending',
         blockedBy: opts.blockedBy?.length ? opts.blockedBy : undefined,
-        createdAt: now, updatedAt: now,
+        createdAt: now,
+        updatedAt: now,
     };
     writeTask(workDir, task);
     return task;
@@ -275,13 +280,23 @@ async function updateSharedTaskStatus(workDir, taskId, status, opts = {}) {
             ...task,
             status,
             updatedAt: Date.now(),
-            ...(status === 'pending' || status === 'completed' ? { claimedBy: undefined, claimedByPid: undefined, claimedAt: undefined } : {}),
+            ...(status === 'pending' || status === 'completed'
+                ? { claimedBy: undefined, claimedByPid: undefined, claimedAt: undefined }
+                : {}),
         };
         writeTask(workDir, updated);
         return { ok: true, task: updated };
     }, workDir);
 }
-exports._sharedTasksInternal = { tasksRoot, scopeDir, taskPath, isClaimAbandoned, isUnblocked, CLAIM_STALE_MS, MIN_CLAIM_AGE_FOR_DEATH_CHECK_MS };
+exports._sharedTasksInternal = {
+    tasksRoot,
+    scopeDir,
+    taskPath,
+    isClaimAbandoned,
+    isUnblocked,
+    CLAIM_STALE_MS,
+    MIN_CLAIM_AGE_FOR_DEATH_CHECK_MS,
+};
 /**
  * Remove a task outright — the veto path for a `TaskCreated` hook. Claude Code creates the
  * task, and when a hook refuses it the task is DELETED and the reason goes back to the