@odingard/guardian-hook 0.1.1 → 0.3.0

package/dist/index.js

@@ -1,8 +1,5 @@
 #!/usr/bin/env node
 
-// src/index.ts
-import { createGuardianClient } from "@odingard/guardian-sdk";
-
 // src/classify.ts
 import { createHash } from "node:crypto";
 var HOOK_TOOLS = [
@@ -26,6 +23,11 @@ var HOOK_TOOLS = [
     suggestedMode: "ask",
     description: "Pushing commits to a remote."
   },
+  {
+    name: "shell_session",
+    suggestedMode: "ask",
+    description: "Starting an interactive shell, interpreter or remote session (bash, python, ssh, docker exec -it). What is typed into it later is not seen by Guardian."
+  },
   {
     name: "file_write",
     suggestedMode: "allow",
@@ -69,10 +71,102 @@ var DESTRUCTIVE = [
   /\bfind\b.*\s-delete\b/
 ];
 var GIT_PUSH = /\bgit\s+push\b/;
+var INTERPRETERS = new Set(
+  "sh bash zsh dash ksh mksh csh tcsh fish ash pwsh powershell python python2 python3 ipython node nodejs deno bun ruby irb perl php lua luajit r julia ghci scala groovysh jshell tclsh wish expect su login tmux screen script".split(" ")
+);
+var DB_CLIENTS = new Set(
+  "psql mysql mariadb mongo mongosh cqlsh sqlplus clickhouse-client".split(" ")
+);
+var DB_INLINE = /^(-c|-e|-f|--command|--execute|--file|--eval|--query)(=|$)/;
+var NET_PIPES = new Set("telnet nc ncat netcat socat openssl".split(" "));
+var SSH_VALUE_OPTS = new Set(
+  "-B -b -c -D -E -e -F -I -i -J -L -l -m -O -o -p -Q -R -S -W -w".split(" ")
+);
+var SUDO_VALUE_OPTS = new Set("-u -g -U -C -D -h -p -r -t -T".split(" "));
+var REDIS_VALUE_OPTS = new Set("-h -p -a -n -u --user --pass".split(" "));
+var WRAPPERS = new Set(
+  "exec command builtin nohup time env stdbuf nice ionice".split(" ")
+);
+function positionals(args, valueOpts) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (valueOpts.has(a)) i++;
+    else if (!a.startsWith("-")) out.push(a);
+  }
+  return out;
+}
+function startsSession(segment) {
+  const words = segment.trim().split(/\s+/).filter(Boolean);
+  let wrapped = false;
+  while (words.length > 0) {
+    const w = words[0];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || WRAPPERS.has(w) || wrapped && w.startsWith("-")) {
+      wrapped ||= WRAPPERS.has(w);
+      words.shift();
+      continue;
+    }
+    break;
+  }
+  if (words.length === 0) return false;
+  const base = (words[0].split(/[\\/]/).pop() ?? "").replace(/^['"]+|['"]+$/g, "").toLowerCase().replace(/\.exe$/, "");
+  const args = words.slice(1);
+  if (args.some((a) => /^(--version|-V|--help)$/.test(a))) {
+    return false;
+  }
+  if (base === "sudo" || base === "doas" || base === "busybox") {
+    if (base !== "busybox" && args.some((a) => /^-[a-zA-Z]*[is]$/.test(a))) {
+      return true;
+    }
+    const rest = positionals(args, SUDO_VALUE_OPTS);
+    if (rest.length === 0) return false;
+    return startsSession(args.slice(args.indexOf(rest[0])).join(" "));
+  }
+  if (base === "ssh" || base === "mosh") {
+    if (args.some((a) => /^-[a-zA-Z]*t/.test(a))) return true;
+    return positionals(args, SSH_VALUE_OPTS).length <= 1;
+  }
+  if (["docker", "podman", "nerdctl", "kubectl", "oc"].includes(base)) {
+    if (!args.some((a) => ["exec", "run", "attach", "debug"].includes(a))) {
+      return false;
+    }
+    return args.includes("attach") || args.some(
+      (a) => /^(-[a-zA-Z]*i[a-zA-Z]*|--interactive|--stdin)(=true)?$/.test(a)
+    );
+  }
+  if (DB_CLIENTS.has(base)) {
+    return !args.some((a) => DB_INLINE.test(a)) && !segment.includes("<");
+  }
+  if (base === "sqlite3") {
+    return positionals(args, /* @__PURE__ */ new Set(["-cmd"])).length <= 1;
+  }
+  if (base === "redis-cli") {
+    return positionals(args, REDIS_VALUE_OPTS).length === 0;
+  }
+  if (NET_PIPES.has(base)) {
+    return base === "openssl" ? args[0] === "s_client" : !args.some((a) => /^-[a-zA-Z]*z/.test(a));
+  }
+  if (!INTERPRETERS.has(base) && !/^python[0-9.]+$/.test(base)) return false;
+  if ((base === "deno" || base === "bun") && args[0] === "repl") return true;
+  const code = args.findIndex((a) => /^-[a-zA-Z]*c[a-zA-Z]*$/.test(a));
+  if (code >= 0 && /sh$/.test(base)) {
+    const inner = args.slice(code + 1).join(" ").replace(/['"]/g, " ");
+    if (startsInteractiveSession(inner)) return true;
+  }
+  if (args.some((a) => /^(-[a-zA-Z]*[is][a-zA-Z]*|--interactive|-)$/.test(a))) {
+    return true;
+  }
+  return args.every((a) => a.startsWith("-") && !/^-[a-zA-Z]*[ce]/.test(a));
+}
+function startsInteractiveSession(command) {
+  if (/\bwhile\s+(?:IFS=\S*\s+)?read\b/.test(command)) return true;
+  return command.split(/&&|\|\||[;&|\n()]|\$\(|`/).some((segment) => startsSession(segment));
+}
 function classifyCommand(command) {
   if (DESTRUCTIVE.some((re) => re.test(command))) return "shell_destructive";
   if (DEPLOY.some((re) => re.test(command))) return "shell_deploy";
   if (GIT_PUSH.test(command)) return "git_push";
+  if (startsInteractiveSession(command)) return "shell_session";
   return "shell";
 }
 function mcpToolName(server, tool) {
@@ -88,34 +182,119 @@ function digest(text) {
 function str(value) {
   return typeof value === "string" ? value : "";
 }
+var SHELL_TOOLS = {
+  Bash: "command",
+  // Claude Code; Codex shell and unified exec
+  shell: "command",
+  bash: "command",
+  // DeepSeek Harness (plain and persistent)
+  pwsh: "command",
+  // DeepSeek Harness on Windows
+  terminal_send: "text"
+  // DeepSeek Harness PTY: typed input runs as a command
+};
+var FILE_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit",
+  "write",
+  // DeepSeek Harness
+  "edit"
+  // DeepSeek Harness
+]);
+function commandText(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+    return value.join(" ");
+  }
+  return "";
+}
+var MAX_PATHS = 50;
+function patchTargets(patch) {
+  const targets = [];
+  const re = /^[ \t]*\*\*\* (Add File|Update File|Delete File|Move to): (.+?)[ \t\r]*$/gm;
+  for (const m of patch.matchAll(re)) {
+    const kind = m[1];
+    const op = kind === "Add File" ? "add" : kind === "Update File" ? "update" : kind === "Delete File" ? "delete" : "move";
+    targets.push({ op, path: m[2] });
+  }
+  return targets;
+}
+function fileWrite(operation, path, content, cwd, summaryVerb) {
+  return {
+    toolName: "file_write",
+    arguments: {
+      operation,
+      path,
+      contentBytes: Buffer.byteLength(content),
+      contentDigest: digest(content),
+      ...cwd
+    },
+    summary: `${summaryVerb} ${path}`
+  };
+}
 function governedCall(call) {
   const { tool, input } = call;
   const cwd = call.cwd ? { cwd: call.cwd } : {};
-  if (tool === "Bash" || tool === "shell") {
-    const command = str(input.command);
+  const shellField = Object.hasOwn(SHELL_TOOLS, tool) ? SHELL_TOOLS[tool] : void 0;
+  if (shellField) {
+    const command = commandText(input[shellField]);
     const toolName = classifyCommand(command);
     return {
       toolName,
-      arguments: { command: bounded(command), ...cwd },
+      arguments: {
+        command: bounded(command),
+        ...tool === "Bash" || tool === "shell" ? {} : { agentTool: tool },
+        ...cwd
+      },
       summary: `Run: ${bounded(command, 160)}`
     };
   }
-  if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool)) {
+  if (FILE_TOOLS.has(tool)) {
     const path = str(input.file_path) || str(input.notebook_path);
     const content = str(input.content) || str(input.new_string) || str(input.new_source) || (Array.isArray(input.edits) ? JSON.stringify(input.edits) : "");
+    return fileWrite(
+      tool,
+      path,
+      content,
+      cwd,
+      tool === "Write" || tool === "write" ? "Write" : "Edit"
+    );
+  }
+  if (tool === "str_replace_editor") {
+    if (input.command === "view") return null;
+    const sub = str(input.command) || "unknown";
+    const content = str(input.file_text) || str(input.new_str);
+    return fileWrite(
+      `str_replace_editor.${sub}`,
+      str(input.path),
+      content,
+      cwd,
+      sub === "create" ? "Write" : "Edit"
+    );
+  }
+  if (tool === "apply_patch") {
+    const patch = commandText(input.command) || str(input.patch) || str(input.input);
+    const targets = patchTargets(patch);
+    const paths = [...new Set(targets.map((t) => t.path))];
+    const shown = paths.slice(0, MAX_PATHS).map((p) => bounded(p, 500));
     return {
       toolName: "file_write",
       arguments: {
-        operation: tool,
-        path,
-        contentBytes: Buffer.byteLength(content),
-        contentDigest: digest(content),
+        operation: "apply_patch",
+        path: shown[0] ?? "",
+        paths: shown,
+        ...paths.length > MAX_PATHS ? { morePaths: paths.length - MAX_PATHS } : {},
+        operations: targets.slice(0, MAX_PATHS).map((t) => `${t.op} ${bounded(t.path, 500)}`),
+        contentBytes: Buffer.byteLength(patch),
+        contentDigest: digest(patch),
         ...cwd
       },
-      summary: `${tool === "Write" ? "Write" : "Edit"} ${path}`
+      summary: paths.length === 0 ? "Apply a patch (no file headers found)" : paths.length === 1 ? `Patch ${bounded(paths[0], 160)}` : `Patch ${paths.length} files: ${bounded(paths.join(", "), 160)}`
     };
   }
-  if (tool === "WebFetch") {
+  if (tool === "WebFetch" || tool === "web_fetch") {
     const url = str(input.url);
     return {
       toolName: "web_fetch",
@@ -145,6 +324,9 @@ function tierOf(toolName) {
   return known ? known.suggestedMode : "ask";
 }
 
+// src/run.ts
+import { createGuardianClient } from "@odingard/guardian-sdk";
+
 // src/decide.ts
 var PLAIN = {
   NOT_AUTHORIZED: "this agent is not authorized for it",
@@ -166,6 +348,7 @@ function denied(call, code, extra = {}) {
     ...extra
   };
 }
+var FINAL_CHECK_LEAD_MS = 1500;
 var isPending = (r) => !r.ok && (r.reasonCode === "APPROVAL_REQUIRED" || r.reasonCode === "APPROVAL_PENDING") || r.ok && r.decision === "ASK";
 async function decide(call, options) {
   const wait = options.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -185,6 +368,7 @@ async function decide(call, options) {
   } catch {
     return denied(call, "SERVICE_UNAVAILABLE");
   }
+  const answeredAt = now();
   const requestId = result.requestId;
   let approvedByHuman = false;
   if (isPending(result)) {
@@ -192,14 +376,19 @@ async function decide(call, options) {
     log(
       `Guardian: "${call.summary}" is held for approval (request ${requestId}). Approve it on your phone or in the console.`
     );
-    const deadline = now() + options.approvalTimeoutMs;
+    const window = Math.min(
+      options.approvalTimeoutMs,
+      options.requestTtlMs ?? options.approvalTimeoutMs
+    );
+    const lead = Math.min(FINAL_CHECK_LEAD_MS, Math.floor(window / 4));
+    const lastCheckAt = answeredAt + window - lead;
     const maxInterval = Math.max(
       options.maxPollIntervalMs ?? 1e4,
       options.pollIntervalMs
     );
     let interval = options.pollIntervalMs;
     for (; ; ) {
-      await wait(interval);
+      await wait(Math.max(0, Math.min(interval, lastCheckAt - now())));
       interval = Math.min(Math.ceil(interval * 1.5), maxInterval);
       let claimed;
       try {
@@ -212,7 +401,7 @@ async function decide(call, options) {
         approvedByHuman = claimed.ok && claimed.decision === "ALLOW";
         break;
       }
-      if (now() >= deadline) {
+      if (now() >= lastCheckAt) {
         return {
           decision: "deny",
           reason: `Guardian is still waiting for a human to approve ${call.toolName} (request ${requestId}). Nothing ran. Tell the developer it needs approval in the Guardian app, then try again.`,
@@ -254,10 +443,44 @@ async function decide(call, options) {
   };
 }
 
-// src/index.ts
+// src/run.ts
 var DEFAULT_BASE_URL = "https://guardian-api.odingard.com";
 var REQUEST_TTL_MS = 3e5;
 var MAX_WAIT_MS = REQUEST_TTL_MS;
+var DEFAULT_DEADLINE_MS = 54e4;
+var DIALECTS = ["claude-code", "codex", "dsh"];
+var AGENT_NAMES = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  dsh: "DeepSeek Harness"
+};
+function formatVerdict(dialect2, verdict) {
+  if (verdict === null) {
+    return { stdout: "", stderr: "", exitCode: 0, verdict };
+  }
+  if (dialect2 === "claude-code") {
+    return {
+      stdout: claudeCodeOutput(verdict),
+      stderr: "",
+      exitCode: 0,
+      verdict
+    };
+  }
+  if (verdict.decision === "allow") {
+    return {
+      stdout: dialect2 === "codex" ? "" : claudeCodeOutput(verdict),
+      stderr: "",
+      exitCode: 0,
+      verdict
+    };
+  }
+  return {
+    stdout: claudeCodeOutput(verdict),
+    stderr: verdict.reason,
+    exitCode: 2,
+    verdict
+  };
+}
 function claudeCodeOutput(verdict) {
   return JSON.stringify({
     hookSpecificOutput: {
@@ -283,12 +506,41 @@ var SETTINGS_SNIPPET = {
     ]
   }
 };
+var CODEX_HOOK_COMMAND = 'guardian-hook codex || { s=$?; [ $s -eq 2 ] || echo "Guardian hook failed to run. Nothing ran." >&2; exit 2; }';
+var CODEX_HOOKS_SNIPPET = {
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: "^(Bash|apply_patch)$|^mcp__.*",
+        hooks: [
+          {
+            type: "command",
+            command: CODEX_HOOK_COMMAND,
+            timeout: 600,
+            statusMessage: "Guardian is checking this action"
+          }
+        ]
+      }
+    ]
+  }
+};
+var DSH_HOOK_COMMAND = 'guardian-hook dsh || { s=$?; [ $s -eq 2 ] || echo "Guardian hook failed to run. Nothing ran." >&2; exit 2; }';
+var DSH_HOOKS_SNIPPET = {
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: "^(bash|pwsh|terminal_send|write|edit|apply_patch|str_replace_editor|web_fetch|Bash|Write|Edit|MultiEdit|NotebookEdit|WebFetch)$|^mcp__.*",
+        hooks: [{ type: "command", command: DSH_HOOK_COMMAND, timeout: 600 }]
+      }
+    ]
+  }
+};
 function connectionFor(toolName, env) {
   const allow = env.GUARDIAN_CONNECTION_ID?.trim() || void 0;
   if (tierOf(toolName) === "allow") return allow;
   return env.GUARDIAN_HOOK_ASK_CONNECTION_ID?.trim() || allow;
 }
-function setupText() {
+function setupText(dialect2 = "claude-code") {
   const list = (mode) => HOOK_TOOLS.filter((t) => t.suggestedMode === mode).map((t) => `     ${t.name.padEnd(18)} ${t.description}`).join("\n");
   return [
     "Guardian modes are set per connection, so the hook uses two record-only tool servers.",
@@ -310,23 +562,111 @@ function setupText() {
     "3. In the shell that starts the agent, export GUARDIAN_AGENT_CREDENTIAL,",
     "   GUARDIAN_CONNECTION_ID (a) and GUARDIAN_HOOK_ASK_CONNECTION_ID (b).",
     "",
+    ...agentSteps(dialect2)
+  ].join("\n");
+}
+function agentSteps(dialect2) {
+  if (dialect2 === "codex") {
+    return [
+      "4. Install the hook where Codex runs (npm i -g @odingard/guardian-hook), then add",
+      "   this to ~/.codex/hooks.json (or <repo>/.codex/hooks.json):",
+      JSON.stringify(CODEX_HOOKS_SNIPPET, null, 2),
+      "",
+      "5. Trust it once with /hooks in the Codex TUI, or run headless with",
+      "   `codex exec --dangerously-bypass-hook-trust ...`. Untrusted hooks are skipped.",
+      "",
+      "Governed: Bash (shell and unified exec_command), apply_patch file edits, MCP tools.",
+      "NOT governed: write_stdin. Codex runs no hook when it types into an open",
+      "exec_command session, so anything typed there skips Guardian. Starting an",
+      "interactive shell, interpreter or ssh session is routed to shell_session (Ask);",
+      "to close the gap, turn unified exec off in a managed requirements.toml:",
+      "   [features]",
+      "   unified_exec = false",
+      "Also not governed: hosted tools such as WebSearch, and tool paths Codex runs",
+      "without hooks. A missing, untrusted or unparseable hooks.json governs nothing.",
+      "Codex lets a call run if the hook crashes or times out; the || above and the",
+      "hook's own 540 s deadline turn those cases into a deny."
+    ];
+  }
+  if (dialect2 === "dsh") {
+    return [
+      "4. Install the hook in the image or on the volume (npm i -g @odingard/guardian-hook),",
+      "   save this as /data/.dsh/guardian-hooks.json:",
+      JSON.stringify(DSH_HOOKS_SNIPPET, null, 2),
+      "",
+      "5. Mount the Claude Code hook bridge in $DSH_HOME/cordis.patch.yml:",
+      "   - insert:",
+      "       - id: guardian-hooks",
+      "         name: '@deepseek-ai/dsh-hooks-claude-code'",
+      "         config: { configPath: /data/.dsh/guardian-hooks.json, defaultTimeoutMs: 600000 }",
+      "",
+      "Governed: bash, pwsh, terminal_send, write, edit, apply_patch, str_replace_editor",
+      "(not view), web_fetch, MCP tools. The matcher decides whether the hook runs at",
+      "all: a tool it does not name is not governed. NOT governed: every other dsh tool,",
+      "including run_code itself, subagent, workflow, plugin_manager and",
+      "load_workspace_dependencies (install packages), stagehand_act/stagehand_navigate",
+      "(browser actions), send_message, spawn_teammate, team_task_*, job_*, schedule_*,",
+      "skill, lsp, propose_action, terminal_open, web_search, read/glob/grep.",
+      "A missing or unparseable hooks file: the bridge registers no hooks and nothing",
+      "is governed. The bridge lets a call run if the hook crashes; the || above and",
+      "the hook's own 540 s deadline turn those cases into a deny."
+    ];
+  }
+  return [
     "4. Add this to .claude/settings.json (project) or ~/.claude/settings.json (all projects):",
     JSON.stringify(SETTINGS_SNIPPET, null, 2),
     "",
     "Read-only tools (Read, Grep, Glob, LS, WebSearch) are not routed through Guardian."
-  ].join("\n");
+  ];
 }
 async function runHook(stdin, env, deps = {}) {
-  const failClosed = (reason) => claudeCodeOutput({ decision: "deny", reason: `Guardian hook: ${reason}` });
+  return (await runHookAs("claude-code", stdin, env, deps)).stdout;
+}
+async function runHookAs(dialect2, stdin, env, deps = {}) {
+  const requested = Number(
+    env.GUARDIAN_HOOK_DEADLINE_MS ?? DEFAULT_DEADLINE_MS
+  );
+  const deadlineMs = Number.isFinite(requested) && requested > 0 ? Math.min(requested, DEFAULT_DEADLINE_MS) : DEFAULT_DEADLINE_MS;
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(
+      () => resolve({
+        decision: "deny",
+        reason: "Guardian hook: no decision before the hook's deadline. Nothing ran."
+      }),
+      deadlineMs
+    );
+    timer.unref?.();
+  });
+  try {
+    const verdict = await Promise.race([
+      evaluate(dialect2, stdin, env, deps, deadlineMs).catch(
+        () => ({
+          decision: "deny",
+          reason: "Guardian hook: crashed. Nothing ran."
+        })
+      ),
+      timedOut
+    ]);
+    return formatVerdict(dialect2, verdict);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function evaluate(dialect2, stdinText, env, deps, deadlineMs) {
+  const failClosed = (reason) => ({
+    decision: "deny",
+    reason: `Guardian hook: ${reason}`
+  });
   let input;
   try {
-    input = JSON.parse(stdin);
+    input = JSON.parse(await stdinText);
   } catch {
     return failClosed(
       "could not read the tool call from the agent. Nothing ran."
     );
   }
-  if (typeof input.tool_name !== "string") {
+  if (!input || typeof input.tool_name !== "string") {
     return failClosed("the tool call had no tool name. Nothing ran.");
   }
   const call = governedCall({
@@ -334,7 +674,7 @@ async function runHook(stdin, env, deps = {}) {
     input: input.tool_input && typeof input.tool_input === "object" ? input.tool_input : {},
     ...typeof input.cwd === "string" ? { cwd: input.cwd } : {}
   });
-  if (call === null) return "";
+  if (call === null) return null;
   const connectionId = connectionFor(call.toolName, env);
   const credential = env.GUARDIAN_AGENT_CREDENTIAL?.trim();
   const baseUrl = (env.GUARDIAN_BASE_URL?.trim() || DEFAULT_BASE_URL).replace(
@@ -343,7 +683,7 @@ async function runHook(stdin, env, deps = {}) {
   );
   if (!deps.client && (!credential || !connectionId)) {
     return failClosed(
-      "GUARDIAN_AGENT_CREDENTIAL and GUARDIAN_CONNECTION_ID must be set (run `npx @odingard/guardian-hook setup`). Nothing ran."
+      `GUARDIAN_AGENT_CREDENTIAL and GUARDIAN_CONNECTION_ID must be set (run \`${dialect2 === "claude-code" ? "npx @odingard/guardian-hook" : `guardian-hook ${dialect2}`} setup\`). Nothing ran.`
     );
   }
   if (!deps.client && !baseUrl.startsWith("https://")) {
@@ -352,15 +692,16 @@ async function runHook(stdin, env, deps = {}) {
   const requested = Number(
     env.GUARDIAN_HOOK_APPROVAL_TIMEOUT_MS ?? MAX_WAIT_MS
   );
-  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), MAX_WAIT_MS) : MAX_WAIT_MS;
-  const verdict = await decide(call, {
+  const ceiling = Math.max(0, Math.min(MAX_WAIT_MS, deadlineMs - 3e4));
+  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), ceiling) : ceiling;
+  return decide(call, {
     client: deps.client ?? createGuardianClient({
       baseUrl,
       credential,
       ...env.GUARDIAN_ADAPTER_ID ? { adapterId: env.GUARDIAN_ADAPTER_ID } : {}
     }),
     connectionId: connectionId ?? "",
-    agentName: env.GUARDIAN_HOOK_AGENT_NAME?.trim() || "Claude Code",
+    agentName: env.GUARDIAN_HOOK_AGENT_NAME?.trim() || AGENT_NAMES[dialect2],
     approvalTimeoutMs,
     requestTtlMs: REQUEST_TTL_MS,
     pollIntervalMs: 2e3,
@@ -368,17 +709,64 @@ async function runHook(stdin, env, deps = {}) {
     ...deps.now ? { now: deps.now } : {},
     ...deps.log ? { log: deps.log } : {}
   });
-  return claudeCodeOutput(verdict);
 }
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
+
+// src/index.ts
+function readHookInput(stream = process.stdin) {
+  return (async () => {
+    const chunks = [];
+    for await (const chunk of stream) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      const text = Buffer.concat(chunks).toString("utf8");
+      if (/\}\s*$/.test(text)) {
+        try {
+          const value = JSON.parse(text);
+          if (value && typeof value === "object") return text;
+        } catch {
+        }
+      }
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  })();
+}
+function isDialect(value) {
+  return DIALECTS.includes(value ?? "");
+}
+function parseArgs(argv, env) {
+  const [first, ...rest] = argv;
+  if (isDialect(first)) return { dialect: first, rest };
+  const fromEnv = env.GUARDIAN_HOOK_DIALECT?.trim();
+  return {
+    dialect: isDialect(fromEnv) ? fromEnv : "claude-code",
+    rest: [...argv]
+  };
+}
+var dialect = "claude-code";
+var answered = false;
+function emit(result) {
+  if (answered) return;
+  answered = true;
+  if (result.stdout) process.stdout.write(`${result.stdout}
+`);
+  if (result.stderr) process.stderr.write(`${result.stderr}
+`);
+  process.exitCode = result.exitCode;
+}
+function crashed() {
+  emit(
+    formatVerdict(dialect, {
+      decision: "deny",
+      reason: "Guardian hook crashed. Nothing ran."
+    })
+  );
+  process.exit(process.exitCode ?? 2);
 }
 async function main(argv) {
-  const [command, ...rest] = argv;
+  const parsed = parseArgs(argv, process.env);
+  dialect = parsed.dialect;
+  const [command, ...rest] = parsed.rest;
   if (command === "setup") {
-    process.stdout.write(`${setupText()}
+    process.stdout.write(`${setupText(dialect)}
 `);
     return;
   }
@@ -388,32 +776,42 @@ async function main(argv) {
     return;
   }
   if (command === "--help" || command === "-h") {
-    process.stdout.write("guardian-hook [setup | classify <command>]\n");
+    process.stdout.write(
+      "guardian-hook [codex | dsh] [setup | classify <command>]\n"
+    );
     return;
   }
-  const output = await runHook(await readStdin(), process.env, {
-    log: (line) => process.stderr.write(`${line}
+  emit(
+    await runHookAs(dialect, readHookInput(), process.env, {
+      log: (line) => process.stderr.write(`${line}
 `)
-  });
-  if (output) process.stdout.write(`${output}
-`);
+    })
+  );
+  setTimeout(() => process.exit(process.exitCode ?? 0), 250).unref();
 }
 var invokedDirectly = process.argv[1] !== void 0 && /guardian-hook|hook[\\/]dist[\\/]index\.js$/.test(process.argv[1]);
 if (invokedDirectly) {
-  main(process.argv.slice(2)).catch(() => {
-    process.stdout.write(
-      `${claudeCodeOutput({ decision: "deny", reason: "Guardian hook crashed. Nothing ran." })}
-`
-    );
-  });
+  process.on("uncaughtException", crashed);
+  process.on("unhandledRejection", crashed);
+  main(process.argv.slice(2)).catch(crashed);
 }
 export {
+  CODEX_HOOKS_SNIPPET,
+  CODEX_HOOK_COMMAND,
   DEFAULT_BASE_URL,
+  DEFAULT_DEADLINE_MS,
+  DIALECTS,
+  DSH_HOOKS_SNIPPET,
+  DSH_HOOK_COMMAND,
   MAX_WAIT_MS,
   REQUEST_TTL_MS,
   SETTINGS_SNIPPET,
   claudeCodeOutput,
   connectionFor,
+  formatVerdict,
+  parseArgs,
+  readHookInput,
   runHook,
+  runHookAs,
   setupText
 };