@odingard/guardian-hook 0.2.0 → 0.3.1

package/dist/index.js

@@ -2,6 +2,456 @@
 
 // src/classify.ts
 import { createHash } from "node:crypto";
+
+// src/shell.ts
+var MAX_NESTING = 16;
+var isBlank = (c) => c === " " || c === "	";
+var OPERATOR_START = /* @__PURE__ */ new Set([";", "&", "|", "\n", "(", ")", "<", ">"]);
+function parseShell(src) {
+  const st = {
+    src,
+    pos: 0,
+    ambiguous: false,
+    nesting: 0,
+    heredocs: [],
+    bodySubs: []
+  };
+  const parsed = parseList(st, false);
+  if (st.pos < src.length) st.ambiguous = true;
+  if (st.bodySubs.length > 0) {
+    parsed.commands.push(bodyCommand(st.bodySubs));
+  }
+  return {
+    commands: parsed.commands,
+    ambiguous: st.ambiguous || parsed.ambiguous
+  };
+}
+function bodyCommand(subs) {
+  return { words: [], writes: [], pipeline: -1, stage: 0, subs };
+}
+function parseList(st, inSub) {
+  const commands = [];
+  let pipeline = 0;
+  let stage = 0;
+  let words = [];
+  let writes = [];
+  let depth = 0;
+  let pendingWrite = false;
+  let pendingHeredoc = null;
+  let pendingHereString = false;
+  const endCommand = (nextIsPipe) => {
+    if (words.length > 0 || writes.length > 0) {
+      commands.push({ words, writes, pipeline, stage, subs: [] });
+    }
+    words = [];
+    writes = [];
+    if (nextIsPipe) stage++;
+    else {
+      pipeline++;
+      stage = 0;
+    }
+  };
+  const { src } = st;
+  while (st.pos < src.length) {
+    const c = src[st.pos];
+    if (isBlank(c)) {
+      st.pos++;
+      continue;
+    }
+    if (c === "\\" && src[st.pos + 1] === "\n") {
+      st.pos += 2;
+      continue;
+    }
+    if (c === "#") {
+      while (st.pos < src.length && src[st.pos] !== "\n") st.pos++;
+      continue;
+    }
+    if (c === "\n") {
+      st.pos++;
+      endCommand(false);
+      readHeredocBodies(st);
+      continue;
+    }
+    if (c === ";" || c === "&" || c === "|") {
+      const two = src.slice(st.pos, st.pos + 2);
+      if (c === "&" && src[st.pos + 1] === ">") {
+        st.pos += src[st.pos + 2] === ">" ? 3 : 2;
+        pendingWrite = true;
+        continue;
+      }
+      if (two === "&&" || two === "||" || two === ";;" || two === "|&") {
+        st.pos += 2;
+        endCommand(two === "|&");
+        continue;
+      }
+      st.pos++;
+      endCommand(c === "|");
+      continue;
+    }
+    if (c === "(") {
+      st.pos++;
+      depth++;
+      endCommand(false);
+      continue;
+    }
+    if (c === ")") {
+      if (depth > 0) {
+        st.pos++;
+        depth--;
+        endCommand(false);
+        continue;
+      }
+      if (inSub) {
+        endCommand(false);
+        return { commands, ambiguous: false };
+      }
+      st.pos++;
+      st.ambiguous = true;
+      endCommand(false);
+      continue;
+    }
+    if (c === "<" || c === ">") {
+      if (src[st.pos + 1] === "(") {
+        const w2 = readWord(st);
+        if (w2) addWord(w2);
+        continue;
+      }
+      const op = /^(<<<|<<-|<<|<>|<&|>>|>&|>\||<|>)/.exec(src.slice(st.pos))[0];
+      st.pos += op.length;
+      if (op === "<<" || op === "<<-") pendingHeredoc = { stripTabs: op === "<<-" };
+      else if (op === "<<<") pendingHereString = true;
+      else if (op === ">&" || op === "<&") {
+        const m = /^[ \t]*([0-9]+|-)(?=[\s;&|)<>]|$)/.exec(src.slice(st.pos));
+        if (m) st.pos += m[0].length;
+        else if (op === ">&") pendingWrite = true;
+      } else if (op !== "<") pendingWrite = true;
+      continue;
+    }
+    const w = readWord(st);
+    if (!w) continue;
+    addWord(w);
+  }
+  if (inSub) st.ambiguous = true;
+  if (depth > 0) st.ambiguous = true;
+  endCommand(false);
+  return { commands, ambiguous: false };
+  function addWord(w) {
+    if (pendingHeredoc) {
+      st.heredocs.push({
+        delimiter: w.value,
+        stripTabs: pendingHeredoc.stripTabs,
+        quoted: w.quoted
+      });
+      pendingHeredoc = null;
+      return;
+    }
+    if (pendingHereString) {
+      pendingHereString = false;
+      collectSubs(w);
+      return;
+    }
+    if (pendingWrite) {
+      pendingWrite = false;
+      writes.push(w);
+      return;
+    }
+    const next = src[st.pos];
+    if (/^[0-9]+$/.test(w.value) && !w.quoted && (next === ">" || next === "<")) {
+      return;
+    }
+    words.push(w);
+  }
+  function collectSubs(w) {
+    if (w.subs.length > 0) {
+      commands.push({ words: [], writes: [], pipeline: -1, stage: 0, subs: w.subs });
+    }
+  }
+}
+function readHeredocBodies(st) {
+  while (st.heredocs.length > 0) {
+    const doc = st.heredocs.shift();
+    const lines = [];
+    let found = false;
+    while (st.pos < st.src.length) {
+      let end = st.src.indexOf("\n", st.pos);
+      if (end < 0) end = st.src.length;
+      const raw = st.src.slice(st.pos, end);
+      st.pos = Math.min(end + 1, st.src.length);
+      const line = doc.stripTabs ? raw.replace(/^\t+/, "") : raw;
+      if (line === doc.delimiter) {
+        found = true;
+        break;
+      }
+      lines.push(raw);
+    }
+    void found;
+    if (!doc.quoted) {
+      const body = lines.join("\n");
+      if (/\$\(|`/.test(body)) {
+        const inner = { ...st, src: body, pos: 0, heredocs: [], bodySubs: [] };
+        const w = readDoubleQuotedBody(inner);
+        st.ambiguous ||= inner.ambiguous;
+        if (w.subs.length > 0) st.bodySubs.push(...w.subs);
+      }
+    }
+  }
+}
+function readDoubleQuotedBody(st) {
+  const word = { value: "", dynamic: false, subs: [] };
+  while (st.pos < st.src.length) {
+    const c = st.src[st.pos];
+    if (c === "\\") {
+      st.pos += 2;
+      continue;
+    }
+    if (c === "$" || c === "`") {
+      readExpansion(st, word);
+      continue;
+    }
+    st.pos++;
+  }
+  return word;
+}
+function readWord(st) {
+  const { src } = st;
+  const word = {
+    value: "",
+    dynamic: false,
+    subs: [],
+    quoted: false
+  };
+  const start = st.pos;
+  while (st.pos < src.length) {
+    const c = src[st.pos];
+    if (isBlank(c) || c === "\n") break;
+    if ((c === "<" || c === ">") && src[st.pos + 1] === "(") {
+      st.pos += 2;
+      word.dynamic = true;
+      word.subs.push(parseNested(st));
+      continue;
+    }
+    if (OPERATOR_START.has(c)) break;
+    if (c === "\\") {
+      if (st.pos + 1 < src.length) {
+        if (src[st.pos + 1] !== "\n") word.value += src[st.pos + 1];
+        st.pos += 2;
+      } else {
+        st.pos++;
+      }
+      word.quoted = true;
+      continue;
+    }
+    if (c === "'") {
+      const end = src.indexOf("'", st.pos + 1);
+      if (end < 0) {
+        st.ambiguous = true;
+        word.value += src.slice(st.pos + 1);
+        st.pos = src.length;
+        break;
+      }
+      word.value += src.slice(st.pos + 1, end);
+      st.pos = end + 1;
+      word.quoted = true;
+      continue;
+    }
+    if (c === '"') {
+      st.pos++;
+      word.quoted = true;
+      let closed = false;
+      while (st.pos < src.length) {
+        const d = src[st.pos];
+        if (d === '"') {
+          st.pos++;
+          closed = true;
+          break;
+        }
+        if (d === "\\") {
+          const n = src[st.pos + 1];
+          if (n === void 0) {
+            st.pos++;
+            continue;
+          }
+          if ('$`"\\\n'.includes(n)) {
+            if (n !== "\n") word.value += n;
+          } else {
+            word.value += d + n;
+          }
+          st.pos += 2;
+          continue;
+        }
+        if (d === "$" || d === "`") {
+          readExpansion(st, word);
+          continue;
+        }
+        word.value += d;
+        st.pos++;
+      }
+      if (!closed) st.ambiguous = true;
+      continue;
+    }
+    if (c === "$" && src[st.pos + 1] === "'") {
+      let i = st.pos + 2;
+      let out = "";
+      let closed = false;
+      while (i < src.length) {
+        const d = src[i];
+        if (d === "'") {
+          closed = true;
+          i++;
+          break;
+        }
+        if (d === "\\" && i + 1 < src.length) {
+          const n = src[i + 1];
+          const simple = { n: "\n", t: "	", "\\": "\\", "'": "'", '"': '"' };
+          if (simple[n] !== void 0) {
+            out += simple[n];
+            i += 2;
+            continue;
+          }
+          const hex = /^x([0-9a-fA-F]{1,2})/.exec(src.slice(i + 1));
+          if (hex) {
+            out += String.fromCharCode(parseInt(hex[1], 16));
+            i += 1 + hex[0].length;
+            continue;
+          }
+          const oct = /^([0-7]{1,3})/.exec(src.slice(i + 1));
+          if (oct) {
+            out += String.fromCharCode(parseInt(oct[1], 8));
+            i += 1 + oct[0].length;
+            continue;
+          }
+          st.ambiguous = true;
+          out += n;
+          i += 2;
+          continue;
+        }
+        out += d;
+        i++;
+      }
+      if (!closed) st.ambiguous = true;
+      word.value += out;
+      word.quoted = true;
+      st.pos = i;
+      continue;
+    }
+    if (c === "$" || c === "`") {
+      readExpansion(st, word);
+      continue;
+    }
+    word.value += c;
+    st.pos++;
+  }
+  return st.pos > start ? word : null;
+}
+function readExpansion(st, word) {
+  const { src } = st;
+  const c = src[st.pos];
+  if (c === "`") {
+    let i = st.pos + 1;
+    let inner = "";
+    while (i < src.length && src[i] !== "`") {
+      if (src[i] === "\\" && i + 1 < src.length) {
+        inner += src[i + 1];
+        i += 2;
+        continue;
+      }
+      inner += src[i];
+      i++;
+    }
+    if (i >= src.length) st.ambiguous = true;
+    word.value += "`" + inner + "`";
+    word.dynamic = true;
+    word.subs.push(parseString(st, inner));
+    st.pos = Math.min(i + 1, src.length);
+    return;
+  }
+  const n = src[st.pos + 1];
+  if (n === "(" && src[st.pos + 2] === "(") {
+    let i = st.pos + 3;
+    let level = 2;
+    while (i < src.length && level > 0) {
+      if (src[i] === "(") level++;
+      else if (src[i] === ")") level--;
+      i++;
+    }
+    if (level > 0) st.ambiguous = true;
+    word.value += src.slice(st.pos, i);
+    word.dynamic = true;
+    st.pos = i;
+    return;
+  }
+  if (n === "(") {
+    const start = st.pos;
+    st.pos += 2;
+    word.subs.push(parseNested(st));
+    word.value += src.slice(start, st.pos);
+    word.dynamic = true;
+    return;
+  }
+  if (n === "{") {
+    let i = st.pos + 2;
+    let level = 1;
+    while (i < src.length && level > 0) {
+      if (src[i] === "{") level++;
+      else if (src[i] === "}") level--;
+      i++;
+    }
+    if (level > 0) st.ambiguous = true;
+    const text = src.slice(st.pos, i);
+    word.value += text;
+    word.dynamic = true;
+    if (/\$\(|`/.test(text)) {
+      word.subs.push(parseString(st, text.slice(2, -1)));
+    }
+    st.pos = i;
+    return;
+  }
+  const name = /^\$([A-Za-z_][A-Za-z0-9_]*|[0-9@*#?$!-])/.exec(src.slice(st.pos));
+  if (name) {
+    word.value += name[0];
+    word.dynamic = true;
+    st.pos += name[0].length;
+    return;
+  }
+  word.value += "$";
+  st.pos++;
+}
+function parseNested(st) {
+  if (st.nesting >= MAX_NESTING) {
+    st.ambiguous = true;
+    st.pos = st.src.length;
+    return { commands: [], ambiguous: true };
+  }
+  st.nesting++;
+  const savedHeredocs = st.heredocs;
+  st.heredocs = [];
+  const inner = parseList(st, true);
+  st.heredocs = savedHeredocs;
+  st.nesting--;
+  if (st.src[st.pos] === ")") st.pos++;
+  else st.ambiguous = true;
+  return inner;
+}
+function parseString(st, text) {
+  if (st.nesting >= MAX_NESTING) {
+    st.ambiguous = true;
+    return { commands: [], ambiguous: true };
+  }
+  const inner = {
+    src: text,
+    pos: 0,
+    ambiguous: false,
+    nesting: st.nesting + 1,
+    heredocs: [],
+    bodySubs: []
+  };
+  const parsed = parseList(inner, false);
+  if (inner.bodySubs.length) parsed.commands.push(bodyCommand(inner.bodySubs));
+  st.ambiguous ||= inner.ambiguous;
+  return { commands: parsed.commands, ambiguous: inner.ambiguous };
+}
+
+// src/classify.ts
 var HOOK_TOOLS = [
   {
     name: "shell",
@@ -16,13 +466,18 @@ var HOOK_TOOLS = [
   {
     name: "shell_destructive",
     suggestedMode: "ask",
-    description: "Destructive commands: rm -rf, git reset --hard, git clean, force pushes, dropping databases, disk formatting."
+    description: "Destructive commands: rm -rf (also through xargs or find -exec), git reset --hard, git clean, force pushes and remote branch deletes, dropping databases, disk formatting, piping a download into a shell. Also changes to the agent's own MCP servers, hooks or permissions (claude mcp add, writes to .mcp.json or .claude/settings.json), and commands the hook cannot parse."
   },
   {
     name: "git_push",
     suggestedMode: "ask",
     description: "Pushing commits to a remote."
   },
+  {
+    name: "shell_session",
+    suggestedMode: "ask",
+    description: "Starting an interactive shell, interpreter or remote session (bash, python, ssh, docker exec -it). What is typed into it later is not seen by Guardian."
+  },
   {
     name: "file_write",
     suggestedMode: "allow",
@@ -62,15 +517,697 @@ var DESTRUCTIVE = [
   /\b(drop|truncate)\s+(table|database|schema)\b/i,
   /\bdelete\s+from\s+\w+\s*(;|$)/i,
   /\b(mkfs|dd\s+if=|shred|wipefs)\b/,
+  /\bdd\b.*\bof=/,
+  /\brsync\b.*\s--(delete\S*|remove-source-files)\b/,
+  /\btruncate\b.*(\s-s\s*0\b|\s--size[= ]0\b)/,
   /\bchmod\s+-R\s+777\b/,
   /\bfind\b.*\s-delete\b/
 ];
 var GIT_PUSH = /\bgit\s+push\b/;
+var INTERPRETERS = new Set(
+  "sh bash zsh dash ksh mksh csh tcsh fish ash pwsh powershell python python2 python3 ipython node nodejs deno bun ruby irb perl php lua luajit r julia ghci scala groovysh jshell tclsh wish expect su login tmux screen script".split(" ")
+);
+var DB_CLIENTS = new Set(
+  "psql mysql mariadb mongo mongosh cqlsh sqlplus clickhouse-client".split(" ")
+);
+var DB_INLINE = /^(-c|-e|-f|--command|--execute|--file|--eval|--query)(=|$)/;
+var NET_PIPES = new Set("telnet nc ncat netcat socat openssl".split(" "));
+var SSH_VALUE_OPTS = new Set(
+  "-B -b -c -D -E -e -F -I -i -J -L -l -m -O -o -p -Q -R -S -W -w".split(" ")
+);
+var SUDO_VALUE_OPTS = new Set("-u -g -U -C -D -h -p -r -t -T".split(" "));
+var REDIS_VALUE_OPTS = new Set("-h -p -a -n -u --user --pass".split(" "));
+var WRAPPERS = new Set(
+  "exec command builtin nohup time env stdbuf nice ionice".split(" ")
+);
+function positionals(args, valueOpts) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (valueOpts.has(a)) i++;
+    else if (!a.startsWith("-")) out.push(a);
+  }
+  return out;
+}
+function startsSession(segment) {
+  const words = segment.trim().split(/\s+/).filter(Boolean);
+  let wrapped = false;
+  while (words.length > 0) {
+    const w = words[0];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || WRAPPERS.has(w) || wrapped && w.startsWith("-")) {
+      wrapped ||= WRAPPERS.has(w);
+      words.shift();
+      continue;
+    }
+    break;
+  }
+  if (words.length === 0) return false;
+  const base = (words[0].split(/[\\/]/).pop() ?? "").replace(/^['"]+|['"]+$/g, "").toLowerCase().replace(/\.exe$/, "");
+  const args = words.slice(1);
+  if (args.some((a) => /^(--version|-V|--help)$/.test(a))) {
+    return false;
+  }
+  if (base === "sudo" || base === "doas" || base === "busybox") {
+    if (base !== "busybox" && args.some((a) => /^-[a-zA-Z]*[is]$/.test(a))) {
+      return true;
+    }
+    const rest = positionals(args, SUDO_VALUE_OPTS);
+    if (rest.length === 0) return false;
+    return startsSession(args.slice(args.indexOf(rest[0])).join(" "));
+  }
+  if (base === "ssh" || base === "mosh") {
+    if (args.some((a) => /^-[a-zA-Z]*t/.test(a))) return true;
+    return positionals(args, SSH_VALUE_OPTS).length <= 1;
+  }
+  if (["docker", "podman", "nerdctl", "kubectl", "oc"].includes(base)) {
+    if (!args.some((a) => ["exec", "run", "attach", "debug"].includes(a))) {
+      return false;
+    }
+    return args.includes("attach") || args.some(
+      (a) => /^(-[a-zA-Z]*i[a-zA-Z]*|--interactive|--stdin)(=true)?$/.test(a)
+    );
+  }
+  if (DB_CLIENTS.has(base)) {
+    return !args.some((a) => DB_INLINE.test(a)) && !segment.includes("<");
+  }
+  if (base === "sqlite3") {
+    return positionals(args, /* @__PURE__ */ new Set(["-cmd"])).length <= 1;
+  }
+  if (base === "redis-cli") {
+    return positionals(args, REDIS_VALUE_OPTS).length === 0;
+  }
+  if (NET_PIPES.has(base)) {
+    return base === "openssl" ? args[0] === "s_client" : !args.some((a) => /^-[a-zA-Z]*z/.test(a));
+  }
+  if (!INTERPRETERS.has(base) && !/^python[0-9.]+$/.test(base)) return false;
+  if ((base === "deno" || base === "bun") && args[0] === "repl") return true;
+  const code = args.findIndex((a) => /^-[a-zA-Z]*c[a-zA-Z]*$/.test(a));
+  if (code >= 0 && /sh$/.test(base)) {
+    const inner = args.slice(code + 1).join(" ").replace(/['"]/g, " ");
+    if (startsInteractiveSession(inner)) return true;
+  }
+  if (args.some((a) => /^(-[a-zA-Z]*[is][a-zA-Z]*|--interactive|-)$/.test(a))) {
+    return true;
+  }
+  return args.every((a) => a.startsWith("-") && !/^-[a-zA-Z]*[ce]/.test(a));
+}
+function startsInteractiveSession(command) {
+  if (/\bwhile\s+(?:IFS=\S*\s+)?read\b/.test(command)) return true;
+  return command.split(/&&|\|\||[;&|\n()]|\$\(|`/).some((segment) => startsSession(segment));
+}
+var RANK = {
+  shell: 0,
+  shell_session: 1,
+  git_push: 2,
+  shell_deploy: 3,
+  shell_destructive: 4
+};
+var BY_RANK = [
+  "shell",
+  "shell_session",
+  "git_push",
+  "shell_deploy",
+  "shell_destructive"
+];
+var ASK = RANK.shell_destructive;
+var MAX_DEPTH = 12;
+var EDGE = String.raw`(?:^|[\s/\\'"=:,(~])`;
+var AGENT_CONFIG_PATH = new RegExp(
+  [
+    EDGE + String.raw`(?:\.?mcp\.json|\.claude\.json|settings\.local\.json|managed-settings\.json|managed-mcp\.json|claude_desktop_config\.json|guardian-hooks\.json|cordis\.patch\.ya?ml)(?![\w-])`,
+    EDGE + String.raw`\.claude(?:[/\\](?:settings[^/\\\s'"]*\.json|hooks|agents|commands|skills|plugins|output-styles)(?![\w-])|[/\\]?(?=$|[\s'"]))`,
+    EDGE + String.raw`\.(?:codex|cursor|gemini|dsh)(?=$|[/\\\s'"])`
+  ].join("|"),
+  "i"
+);
+var READERS = new Set(
+  "cat tac less more head tail grep egrep fgrep zgrep rg ag ack ls dir stat file wc diff cmp comm jq bat batcat md5sum sha1sum sha256sum sha512sum shasum b2sum cksum echo printf test [ [[ find fd realpath readlink dirname basename du tree type which".split(" ")
+);
+var GIT_READS = new Set(
+  "status log show diff blame ls-files grep add commit check-ignore cat-file rev-parse ls-tree shortlog describe".split(" ")
+);
+var RESERVED = new Set(
+  "if then else elif fi do done while until for in case esac ! { } select function".split(
+    " "
+  )
+);
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*(\[[^\]]*\])?\+?=/;
+var SHELLS = new Set(
+  "sh bash zsh dash ksh mksh ash yash posh fish busybox".split(" ")
+);
+var FETCHERS = new Set(
+  "curl wget fetch http https xh aria2c iwr irm invoke-webrequest invoke-restmethod".split(
+    " "
+  )
+);
+var BULK_DELETE = /* @__PURE__ */ new Set(["rm", "unlink", "shred"]);
+var EVALUATORS = /* @__PURE__ */ new Set(["eval", "source", ".", "iex", "invoke-expression"]);
+var WRAPPER_SPECS = {
+  nohup: {},
+  command: {},
+  builtin: {},
+  chronic: {},
+  unbuffer: {},
+  busybox: {},
+  time: { value: ["-f", "-o", "--format", "--output"] },
+  nice: { value: ["-n", "--adjustment"] },
+  ionice: { value: ["-c", "-n", "-p", "-P", "-u", "--class", "--classdata"] },
+  stdbuf: { value: ["-i", "-o", "-e", "--input", "--output", "--error"] },
+  timeout: { value: ["-s", "-k", "--signal", "--kill-after"], positional: 1 },
+  exec: { value: ["-a"] },
+  sudo: {
+    value: [
+      ...SUDO_VALUE_OPTS,
+      "--user",
+      "--group",
+      "--host",
+      "--prompt",
+      "--chdir",
+      "--role",
+      "--type",
+      "--close-from",
+      "--other-user",
+      "--command-timeout"
+    ]
+  },
+  doas: { value: ["-u", "-C"] },
+  xargs: {
+    value: [
+      "-a",
+      "--arg-file",
+      "-d",
+      "--delimiter",
+      "-E",
+      "-I",
+      "-L",
+      "-n",
+      "--max-args",
+      "-P",
+      "--max-procs",
+      "-s",
+      "--max-chars",
+      "--process-slot-var",
+      "--max-lines"
+    ]
+  },
+  chroot: { value: ["--userspec", "--groups"], positional: 1 },
+  taskset: { positional: 1 },
+  flock: {
+    value: ["-w", "-E", "--timeout", "--conflict-exit-code"],
+    positional: 1
+  },
+  setsid: {},
+  caffeinate: { value: ["-t", "-w"] }
+};
+var leaf = (rank, base = "", args = []) => ({
+  rank,
+  base,
+  args
+});
+function baseName(value) {
+  return (value.split(/[\\/]/).pop() ?? "").toLowerCase().replace(/\.exe$/, "");
+}
+var literal = (value) => ({ value, dynamic: false, subs: [] });
+function skipOptions(args, spec) {
+  const value = new Set(spec.value ?? []);
+  let i = 0;
+  let unknown = false;
+  while (i < args.length) {
+    const a = args[i].value;
+    if (a === "--") {
+      i++;
+      break;
+    }
+    if (a.startsWith("--")) {
+      if (a.includes("=")) i++;
+      else if (value.has(a)) i += 2;
+      else {
+        unknown = true;
+        i++;
+      }
+      continue;
+    }
+    if (a.startsWith("-") && a.length > 1) {
+      let takes = false;
+      for (let k = 1; k < a.length; k++) {
+        if (value.has(`-${a[k]}`)) {
+          takes = k === a.length - 1;
+          break;
+        }
+      }
+      i += takes ? 2 : 1;
+      continue;
+    }
+    break;
+  }
+  let positional = spec.positional ?? 0;
+  while (positional-- > 0 && i < args.length) i++;
+  return { start: i, unknown };
+}
+function rankText(text, depth) {
+  if (depth > MAX_DEPTH) return ASK;
+  return rankParsed(parseShell(text), depth + 1);
+}
+function rankParsed(parsed, depth) {
+  if (depth > MAX_DEPTH) return ASK;
+  let rank = parsed.ambiguous ? ASK : 0;
+  const stages = /* @__PURE__ */ new Map();
+  for (const cmd of parsed.commands) {
+    const l = rankArgv(cmd.words, depth);
+    rank = Math.max(rank, l.rank);
+    if (cmd.writes.some((w) => AGENT_CONFIG_PATH.test(w.value))) rank = ASK;
+    const subs = [
+      ...cmd.subs,
+      ...cmd.words.flatMap((w) => w.subs),
+      ...cmd.writes.flatMap((w) => w.subs)
+    ];
+    for (const sub of subs) rank = Math.max(rank, rankParsed(sub, depth + 1));
+    if (runsCode(l) && cmd.words.some((w) => w.subs.some((s) => fetches(s, depth + 1)))) {
+      rank = ASK;
+    }
+    if (cmd.pipeline >= 0) {
+      const list = stages.get(cmd.pipeline) ?? [];
+      list.push(l);
+      stages.set(cmd.pipeline, list);
+    }
+  }
+  for (const list of stages.values()) {
+    const first = list.findIndex((l) => FETCHERS.has(l.base));
+    if (first >= 0 && list.slice(first + 1).some((l) => readsCodeFromStdin(l))) {
+      rank = ASK;
+    }
+  }
+  return rank;
+}
+function fetches(parsed, depth) {
+  return parsed.commands.some(
+    (c) => FETCHERS.has(rankArgv(c.words, depth).base) || [...c.subs, ...c.words.flatMap((w) => w.subs)].some(
+      (s) => fetches(s, depth + 1)
+    )
+  );
+}
+var isInterpreter = (base) => INTERPRETERS.has(base) || /^python[0-9.]*$/.test(base);
+function runsCode(l) {
+  return EVALUATORS.has(l.base) || isInterpreter(l.base);
+}
+function readsCodeFromStdin(l) {
+  if (EVALUATORS.has(l.base)) return true;
+  if (!isInterpreter(l.base)) return false;
+  const options = [];
+  let script = false;
+  for (const a of l.args) {
+    if (a === "--") break;
+    if (a === "-") return true;
+    if (a.startsWith("-") || a.startsWith("+")) options.push(a);
+    else {
+      script = true;
+      break;
+    }
+  }
+  if (options.some((a) => /^-[a-zA-Z]*s[a-zA-Z]*$/.test(a))) return true;
+  if (options.some((a) => /^-[a-zA-Z]*[cem][a-zA-Z]*$/.test(a))) return false;
+  return !script;
+}
+function rankArgv(words, depth) {
+  if (depth > MAX_DEPTH) return leaf(ASK);
+  let i = 0;
+  while (i < words.length && (ASSIGNMENT.test(words[i].value) || RESERVED.has(words[i].value))) {
+    i++;
+  }
+  if (i >= words.length) return leaf(0);
+  const head = words[i];
+  const argWords = words.slice(i + 1);
+  if (head.dynamic) return leaf(ASK);
+  const base = baseName(head.value);
+  const args = argWords.map((w) => w.value);
+  const joined = [base, ...args].join(" ");
+  let rank = 0;
+  if (DESTRUCTIVE.some((re) => re.test(joined))) rank = ASK;
+  else if (DEPLOY.some((re) => re.test(joined))) rank = RANK.shell_deploy;
+  const done = (r, b = base, a = args) => leaf(Math.max(rank, r), b, a);
+  const inner = (from) => rankArgv(from, depth + 1);
+  const pathCheck = (values) => values.some((v) => AGENT_CONFIG_PATH.test(v)) ? ASK : 0;
+  if (base === "env") return done(rankEnv(argWords, depth));
+  if (base === "sudoedit") return done(pathCheck(args));
+  if (Object.hasOwn(WRAPPER_SPECS, base)) {
+    if (base === "sudo" && args.some((a) => /^-[a-zA-Z]*e[a-zA-Z]*$/.test(a))) {
+      return done(pathCheck(args));
+    }
+    if (base === "command" && args.some((a) => /^-[a-zA-Z]*[vV]/.test(a))) {
+      return done(0);
+    }
+    if (base === "flock") {
+      const c = args.findIndex((a) => a === "-c" || a === "--command");
+      if (c >= 0) return done(rankText(args[c + 1] ?? "", depth));
+    }
+    const { start, unknown } = skipOptions(argWords, WRAPPER_SPECS[base]);
+    let rest = argWords.slice(start);
+    if (base === "xargs" && rest.length === 0) rest = [literal("echo")];
+    const l = inner(rest);
+    if (base === "xargs" && BULK_DELETE.has(l.base)) l.rank = ASK;
+    const alt = unknown ? inner(argWords.slice(start + 1)).rank : 0;
+    return leaf(Math.max(rank, l.rank, alt), l.base, l.args);
+  }
+  if (base === "watch") {
+    const { start } = skipOptions(argWords, {
+      value: ["-n", "--interval", "-d", "-q", "--equexit"]
+    });
+    return done(rankText(args.slice(start).join(" "), depth));
+  }
+  if (SHELLS.has(base)) {
+    return done(rankShell(base, argWords, depth));
+  }
+  if (base === "su") {
+    const c = args.findIndex((a) => /^(-c|--command)$/.test(a));
+    const eq = args.find((a) => a.startsWith("--command="));
+    if (c >= 0) return done(rankText(args[c + 1] ?? "", depth));
+    if (eq) return done(rankText(eq.slice("--command=".length), depth));
+    return done(0);
+  }
+  if (base === "eval" || base === "iex" || base === "invoke-expression") {
+    return done(rankText(args.join(" "), depth));
+  }
+  if (base === "find") return done(rankFind(argWords, depth));
+  if (["npx", "bunx", "pnpx", "npm", "pnpm", "yarn"].includes(base)) {
+    const l = rankRunner(base, argWords, depth);
+    if (l) return leaf(Math.max(rank, l.rank), l.base, l.args);
+    return done(0);
+  }
+  if (base === "rm") {
+    const recursive = argsBeforeDashDash(args).some(
+      (a) => a === "--recursive" || /^-[a-zA-Z]*[rR]/.test(a)
+    );
+    return done(Math.max(recursive ? ASK : 0, pathCheck(args)));
+  }
+  if (base === "chmod") return done(Math.max(rankChmod(args), pathCheck(args)));
+  if (base === "git") return done(rankGit(argWords, depth));
+  if (base === "claude" || base === "codex" || base === "gemini") {
+    return done(rankAgentCli(base, args));
+  }
+  if (READERS.has(base)) return done(0);
+  return done(pathCheck(args));
+}
+function argsBeforeDashDash(args) {
+  const end = args.indexOf("--");
+  return end < 0 ? args : args.slice(0, end);
+}
+function rankEnv(argWords, depth) {
+  let i = 0;
+  while (i < argWords.length) {
+    const a = argWords[i].value;
+    if (a === "--") {
+      i++;
+      break;
+    }
+    if (a === "-S" || a === "--split-string") {
+      const text = [a, ...argWords.slice(i + 1).map((w) => w.value)].slice(1).join(" ");
+      return rankText(text, depth);
+    }
+    if (a.startsWith("--split-string=") || /^-S./.test(a)) {
+      const first = a.startsWith("--") ? a.slice(15) : a.slice(2);
+      return rankText(
+        [first, ...argWords.slice(i + 1).map((w) => w.value)].join(" "),
+        depth
+      );
+    }
+    if (/^(-u|-C|-P|--unset|--chdir)$/.test(a)) {
+      i += 2;
+      continue;
+    }
+    if (a.startsWith("-") && a.length > 1) {
+      i++;
+      continue;
+    }
+    break;
+  }
+  return rankArgv(argWords.slice(i), depth + 1).rank;
+}
+function rankShell(base, argWords, depth) {
+  let code = false;
+  for (let i = 0; i < argWords.length; i++) {
+    const a = argWords[i].value;
+    if (a === "--") break;
+    if (/^(--rcfile|--init-file|-o|\+o|-O|\+O)$/.test(a)) {
+      i++;
+      continue;
+    }
+    if (a === "--command" || base === "fish" && a === "-c") {
+      return rankText(argWords[i + 1]?.value ?? "", depth);
+    }
+    if (/^[-+][a-zA-Z]+$/.test(a)) {
+      if (/^-[a-zA-Z]*c/.test(a)) code = true;
+      continue;
+    }
+    if (a.startsWith("-")) continue;
+    if (code) {
+      if (base === "busybox")
+        return rankArgv(argWords.slice(i), depth + 1).rank;
+      return rankText(a, depth);
+    }
+    if (base === "busybox") return rankArgv(argWords.slice(i), depth + 1).rank;
+    return 0;
+  }
+  return 0;
+}
+function rankFind(argWords, depth) {
+  let rank = 0;
+  for (let i = 0; i < argWords.length; i++) {
+    const a = argWords[i].value;
+    if (a === "-delete") rank = ASK;
+    if (/^-(exec|execdir|ok|okdir)$/.test(a)) {
+      let end = i + 1;
+      while (end < argWords.length && argWords[end].value !== ";" && argWords[end].value !== "+") {
+        end++;
+      }
+      const l = rankArgv(argWords.slice(i + 1, end), depth + 1);
+      rank = Math.max(rank, BULK_DELETE.has(l.base) ? ASK : l.rank);
+      i = end;
+    }
+    if (/^-f(print|print0|printf|ls)$/.test(a)) {
+      if (AGENT_CONFIG_PATH.test(argWords[i + 1]?.value ?? "")) rank = ASK;
+    }
+  }
+  return rank;
+}
+function rankRunner(base, argWords, depth) {
+  let rest = argWords;
+  if (base === "npm" || base === "pnpm" || base === "yarn") {
+    const sub = rest[0]?.value;
+    if (!["exec", "x", "dlx"].includes(sub ?? "")) return null;
+    rest = rest.slice(1);
+  }
+  let i = 0;
+  while (i < rest.length) {
+    const a = rest[i].value;
+    if (a === "--") {
+      i++;
+      break;
+    }
+    if (a === "-c" || a === "--call")
+      return leaf(rankText(rest[i + 1]?.value ?? "", depth));
+    if (a.startsWith("--call=")) return leaf(rankText(a.slice(7), depth));
+    if (a === "-p" || a === "--package") {
+      i += 2;
+      continue;
+    }
+    if (a.startsWith("-")) {
+      i++;
+      continue;
+    }
+    break;
+  }
+  const pkg = rest[i];
+  if (!pkg) return null;
+  if (pkg.dynamic) return leaf(ASK);
+  const name = /^(?:@[^/]+\/)?([^@]+)(?:@.*)?$/.exec(pkg.value)?.[1] ?? pkg.value;
+  const bin = name === "claude-code" ? "claude" : name;
+  return rankArgv([literal(bin), ...rest.slice(i + 1)], depth + 1);
+}
+function rankChmod(args) {
+  const opts = argsBeforeDashDash(args);
+  const recursive = opts.some(
+    (a) => a === "--recursive" || /^-[a-zA-Z]*R/.test(a)
+  );
+  if (!recursive) return 0;
+  const modes = args.filter(
+    (a) => !a.startsWith("-") || /^-[rwxXst]+$/.test(a)
+  );
+  const worldWritable = modes.some(
+    (m) => /^0*[0-7]?[0-7]?[0-7]?[2367]$/.test(m) && m.length >= 3 || /(^|,)[ugo]*[ao][ugo]*[+=][rwxXst]*w/.test(m)
+  );
+  return worldWritable ? ASK : 0;
+}
+var GIT_VALUE_OPTS = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--super-prefix",
+  "--config-env",
+  "--exec-path",
+  "--list-cmds",
+  "--attr-source"
+]);
+var GIT_EXEC_KEY = /^(core\.(pager|editor|sshcommand|askpass|gitproxy)|pager\..+|sequence\.editor|.+\.(textconv|command|cmd|helper|program|clean|smudge|process|driver|tool)|credential\..*|uploadpack\.packobjectshook|gpg\..*program|.*\.(receivepack|uploadpack))$/i;
+function rankGit(argWords, depth) {
+  const args = argWords.map((w) => w.value);
+  let rank = 0;
+  const aliases = /* @__PURE__ */ new Map();
+  let i = 0;
+  while (i < args.length) {
+    const a = args[i];
+    if (!a.startsWith("-")) break;
+    let opt = a;
+    let val;
+    if (a.startsWith("--") && a.includes("=")) {
+      opt = a.slice(0, a.indexOf("="));
+      val = a.slice(a.indexOf("=") + 1);
+      i++;
+    } else if (GIT_VALUE_OPTS.has(a)) {
+      val = args[i + 1] ?? "";
+      if (argWords[i + 1]?.dynamic && (a === "-c" || a === "--config-env")) {
+        rank = ASK;
+      }
+      i += 2;
+    } else {
+      i++;
+    }
+    if (opt === "-c" && val !== void 0) {
+      const eq = val.indexOf("=");
+      const key = (eq < 0 ? val : val.slice(0, eq)).toLowerCase();
+      const value = eq < 0 ? "" : val.slice(eq + 1);
+      if (key.startsWith("alias.")) aliases.set(key.slice(6), value);
+      else if (key === "core.hookspath" || key === "core.fsmonitor") {
+        if (!/^(false|0|no|off|)$/i.test(value)) rank = ASK;
+      } else if (GIT_EXEC_KEY.test(key)) {
+        rank = Math.max(rank, rankText(value, depth));
+      }
+    }
+    if (opt === "--config-env" && val !== void 0) {
+      const key = val.split("=")[0].toLowerCase();
+      if (key.startsWith("alias.") || GIT_EXEC_KEY.test(key) || /hookspath|fsmonitor/.test(key)) {
+        rank = ASK;
+      }
+    }
+  }
+  if (i >= args.length) return rank;
+  if (argWords[i].dynamic) return ASK;
+  const sub = args[i];
+  const rest = args.slice(i + 1);
+  const alias = aliases.get(sub.toLowerCase());
+  if (alias !== void 0) {
+    if (alias.startsWith("!")) {
+      return Math.max(
+        rank,
+        rankText(`${alias.slice(1)} ${rest.join(" ")}`, depth)
+      );
+    }
+    const expanded = parseShell(alias);
+    const aliasWords = expanded.commands[0]?.words ?? [];
+    return Math.max(
+      rank,
+      expanded.ambiguous ? ASK : 0,
+      rankGit([...aliasWords, ...argWords.slice(i + 1)], depth + 1)
+    );
+  }
+  const opts = argsBeforeDashDash(rest);
+  const has = (...names) => opts.some((a) => names.includes(a.split("=")[0]));
+  const short = (letter) => opts.some((a) => new RegExp(`^-[a-zA-Z]*${letter}`).test(a));
+  let sr = 0;
+  switch (sub) {
+    case "push": {
+      const forced = has(
+        "--force",
+        "--force-with-lease",
+        "--force-if-includes",
+        "--mirror",
+        "--delete",
+        "--prune"
+      ) || opts.some(
+        (a) => /^-[a-zA-Z]+$/.test(a) && /[fd]/.test(a.replace(/o.*$/, ""))
+      ) || rest.some((a) => /^[+:]/.test(a));
+      sr = forced ? ASK : RANK.git_push;
+      break;
+    }
+    case "reset":
+      sr = has("--hard", "--merge") ? ASK : 0;
+      break;
+    case "clean":
+      sr = has("--force") || short("f") ? ASK : 0;
+      break;
+    case "branch":
+      sr = short("D") || (has("--delete") || short("d")) && (has("--force") || short("f")) ? ASK : 0;
+      break;
+    case "checkout":
+      sr = rest.includes("--") || has("--force") || short("f") ? ASK : 0;
+      break;
+    case "switch":
+      sr = has("--discard-changes", "--force") || short("f") ? ASK : 0;
+      break;
+    case "restore":
+      sr = has("--source") || short("s") ? ASK : 0;
+      break;
+    case "stash":
+      sr = ["drop", "clear"].includes(rest[0] ?? "") ? ASK : 0;
+      break;
+    case "update-ref":
+      sr = short("d") ? ASK : 0;
+      break;
+    case "reflog":
+      sr = ["expire", "delete"].includes(rest[0] ?? "") ? ASK : 0;
+      break;
+    case "filter-branch":
+    case "filter-repo":
+      sr = ASK;
+      break;
+  }
+  if (!GIT_READS.has(sub) && rest.some((a) => AGENT_CONFIG_PATH.test(a)))
+    sr = ASK;
+  return Math.max(rank, sr);
+}
+var AGENT_CONFIG_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "mcp",
+  "plugin",
+  "plugins",
+  "config"
+]);
+var AGENT_READ_ACTIONS = /* @__PURE__ */ new Set([
+  "list",
+  "ls",
+  "get",
+  "show",
+  "serve",
+  "help",
+  "--help",
+  "-h"
+]);
+var AGENT_WIDENING_OPTS = /^(--mcp-config|--settings|--dangerously-skip-permissions|--allow-dangerously-skip-permissions|--allowed-tools|--allowedtools|--add-dir|--plugin-dir|--dangerously-bypass-approvals-and-sandbox|--yolo|--config)(=|$)/i;
+function rankAgentCli(base, args) {
+  if (args.some((a) => AGENT_WIDENING_OPTS.test(a))) return ASK;
+  if (base === "codex" && args.includes("-c")) return ASK;
+  const mode = args.findIndex((a) => a === "--permission-mode");
+  const modeValue = mode >= 0 ? args[mode + 1] : args.find((a) => a.startsWith("--permission-mode="))?.slice(18);
+  if (modeValue !== void 0 && !/^(default|plan)$/i.test(modeValue))
+    return ASK;
+  const positionals2 = args.filter((a) => !a.startsWith("-"));
+  const sub = positionals2.findIndex((p) => AGENT_CONFIG_SUBCOMMANDS.has(p));
+  if (sub < 0) return 0;
+  const action = positionals2[sub + 1];
+  if (action === void 0 || AGENT_READ_ACTIONS.has(action)) return 0;
+  return ASK;
+}
 function classifyCommand(command) {
-  if (DESTRUCTIVE.some((re) => re.test(command))) return "shell_destructive";
-  if (DEPLOY.some((re) => re.test(command))) return "shell_deploy";
-  if (GIT_PUSH.test(command)) return "git_push";
-  return "shell";
+  let rank = 0;
+  if (DESTRUCTIVE.some((re) => re.test(command))) rank = ASK;
+  else if (DEPLOY.some((re) => re.test(command))) rank = RANK.shell_deploy;
+  else if (GIT_PUSH.test(command)) rank = RANK.git_push;
+  else if (startsInteractiveSession(command)) rank = RANK.shell_session;
+  if (rank < ASK) rank = Math.max(rank, rankText(command, 0));
+  return BY_RANK[rank];
+}
+function isAgentConfigPath(path) {
+  return AGENT_CONFIG_PATH.test(path);
 }
 function mcpToolName(server, tool) {
   const part = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").replace(/^(\d)/, "x$1") || "x";
@@ -85,34 +1222,124 @@ function digest(text) {
 function str(value) {
   return typeof value === "string" ? value : "";
 }
+var SHELL_TOOLS = {
+  Bash: "command",
+  // Claude Code; Codex shell and unified exec
+  shell: "command",
+  bash: "command",
+  // DeepSeek Harness (plain and persistent)
+  pwsh: "command",
+  // DeepSeek Harness on Windows
+  terminal_send: "text"
+  // DeepSeek Harness PTY: typed input runs as a command
+};
+var FILE_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit",
+  "write",
+  // DeepSeek Harness
+  "edit"
+  // DeepSeek Harness
+]);
+function commandText(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+    return value.join(" ");
+  }
+  return "";
+}
+var MAX_PATHS = 50;
+function patchTargets(patch) {
+  const targets = [];
+  const re = /^[ \t]*\*\*\* (Add File|Update File|Delete File|Move to): (.+?)[ \t\r]*$/gm;
+  for (const m of patch.matchAll(re)) {
+    const kind = m[1];
+    const op = kind === "Add File" ? "add" : kind === "Update File" ? "update" : kind === "Delete File" ? "delete" : "move";
+    targets.push({ op, path: m[2] });
+  }
+  return targets;
+}
+var AGENT_CONFIG_NOTE = "(agent MCP, hook, permission or plugin config)";
+function fileWrite(operation, path, content, cwd, summaryVerb) {
+  const config = isAgentConfigPath(path);
+  return {
+    toolName: config ? "shell_destructive" : "file_write",
+    arguments: {
+      operation,
+      path,
+      contentBytes: Buffer.byteLength(content),
+      contentDigest: digest(content),
+      ...config ? { touches: "agent-config" } : {},
+      ...cwd
+    },
+    summary: `${summaryVerb} ${path}${config ? ` ${AGENT_CONFIG_NOTE}` : ""}`
+  };
+}
 function governedCall(call) {
   const { tool, input } = call;
   const cwd = call.cwd ? { cwd: call.cwd } : {};
-  if (tool === "Bash" || tool === "shell") {
-    const command = str(input.command);
+  const shellField = Object.hasOwn(SHELL_TOOLS, tool) ? SHELL_TOOLS[tool] : void 0;
+  if (shellField) {
+    const command = commandText(input[shellField]);
     const toolName = classifyCommand(command);
     return {
       toolName,
-      arguments: { command: bounded(command), ...cwd },
+      arguments: {
+        command: bounded(command),
+        ...tool === "Bash" || tool === "shell" ? {} : { agentTool: tool },
+        ...cwd
+      },
       summary: `Run: ${bounded(command, 160)}`
     };
   }
-  if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool)) {
+  if (FILE_TOOLS.has(tool)) {
     const path = str(input.file_path) || str(input.notebook_path);
     const content = str(input.content) || str(input.new_string) || str(input.new_source) || (Array.isArray(input.edits) ? JSON.stringify(input.edits) : "");
+    return fileWrite(
+      tool,
+      path,
+      content,
+      cwd,
+      tool === "Write" || tool === "write" ? "Write" : "Edit"
+    );
+  }
+  if (tool === "str_replace_editor") {
+    if (input.command === "view") return null;
+    const sub = str(input.command) || "unknown";
+    const content = str(input.file_text) || str(input.new_str);
+    return fileWrite(
+      `str_replace_editor.${sub}`,
+      str(input.path),
+      content,
+      cwd,
+      sub === "create" ? "Write" : "Edit"
+    );
+  }
+  if (tool === "apply_patch") {
+    const patch = commandText(input.command) || str(input.patch) || str(input.input);
+    const targets = patchTargets(patch);
+    const paths = [...new Set(targets.map((t) => t.path))];
+    const shown = paths.slice(0, MAX_PATHS).map((p) => bounded(p, 500));
+    const config = paths.some((p) => isAgentConfigPath(p));
     return {
-      toolName: "file_write",
+      toolName: config ? "shell_destructive" : "file_write",
       arguments: {
-        operation: tool,
-        path,
-        contentBytes: Buffer.byteLength(content),
-        contentDigest: digest(content),
+        operation: "apply_patch",
+        ...config ? { touches: "agent-config" } : {},
+        path: shown[0] ?? "",
+        paths: shown,
+        ...paths.length > MAX_PATHS ? { morePaths: paths.length - MAX_PATHS } : {},
+        operations: targets.slice(0, MAX_PATHS).map((t) => `${t.op} ${bounded(t.path, 500)}`),
+        contentBytes: Buffer.byteLength(patch),
+        contentDigest: digest(patch),
         ...cwd
       },
-      summary: `${tool === "Write" ? "Write" : "Edit"} ${path}`
+      summary: (paths.length === 0 ? "Apply a patch (no file headers found)" : paths.length === 1 ? `Patch ${bounded(paths[0], 160)}` : `Patch ${paths.length} files: ${bounded(paths.join(", "), 160)}`) + (config ? ` ${AGENT_CONFIG_NOTE}` : "")
     };
   }
-  if (tool === "WebFetch") {
+  if (tool === "WebFetch" || tool === "web_fetch") {
     const url = str(input.url);
     return {
       toolName: "web_fetch",
@@ -166,6 +1393,7 @@ function denied(call, code, extra = {}) {
     ...extra
   };
 }
+var FINAL_CHECK_LEAD_MS = 1500;
 var isPending = (r) => !r.ok && (r.reasonCode === "APPROVAL_REQUIRED" || r.reasonCode === "APPROVAL_PENDING") || r.ok && r.decision === "ASK";
 async function decide(call, options) {
   const wait = options.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -185,6 +1413,7 @@ async function decide(call, options) {
   } catch {
     return denied(call, "SERVICE_UNAVAILABLE");
   }
+  const answeredAt = now();
   const requestId = result.requestId;
   let approvedByHuman = false;
   if (isPending(result)) {
@@ -192,14 +1421,19 @@ async function decide(call, options) {
     log(
       `Guardian: "${call.summary}" is held for approval (request ${requestId}). Approve it on your phone or in the console.`
     );
-    const deadline = now() + options.approvalTimeoutMs;
+    const window = Math.min(
+      options.approvalTimeoutMs,
+      options.requestTtlMs ?? options.approvalTimeoutMs
+    );
+    const lead = Math.min(FINAL_CHECK_LEAD_MS, Math.floor(window / 4));
+    const lastCheckAt = answeredAt + window - lead;
     const maxInterval = Math.max(
       options.maxPollIntervalMs ?? 1e4,
       options.pollIntervalMs
     );
     let interval = options.pollIntervalMs;
     for (; ; ) {
-      await wait(interval);
+      await wait(Math.max(0, Math.min(interval, lastCheckAt - now())));
       interval = Math.min(Math.ceil(interval * 1.5), maxInterval);
       let claimed;
       try {
@@ -212,7 +1446,7 @@ async function decide(call, options) {
         approvedByHuman = claimed.ok && claimed.decision === "ALLOW";
         break;
       }
-      if (now() >= deadline) {
+      if (now() >= lastCheckAt) {
         return {
           decision: "deny",
           reason: `Guardian is still waiting for a human to approve ${call.toolName} (request ${requestId}). Nothing ran. Tell the developer it needs approval in the Guardian app, then try again.`,
@@ -258,6 +1492,40 @@ async function decide(call, options) {
 var DEFAULT_BASE_URL = "https://guardian-api.odingard.com";
 var REQUEST_TTL_MS = 3e5;
 var MAX_WAIT_MS = REQUEST_TTL_MS;
+var DEFAULT_DEADLINE_MS = 54e4;
+var DIALECTS = ["claude-code", "codex", "dsh"];
+var AGENT_NAMES = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  dsh: "DeepSeek Harness"
+};
+function formatVerdict(dialect2, verdict) {
+  if (verdict === null) {
+    return { stdout: "", stderr: "", exitCode: 0, verdict };
+  }
+  if (dialect2 === "claude-code") {
+    return {
+      stdout: claudeCodeOutput(verdict),
+      stderr: "",
+      exitCode: 0,
+      verdict
+    };
+  }
+  if (verdict.decision === "allow") {
+    return {
+      stdout: dialect2 === "codex" ? "" : claudeCodeOutput(verdict),
+      stderr: "",
+      exitCode: 0,
+      verdict
+    };
+  }
+  return {
+    stdout: claudeCodeOutput(verdict),
+    stderr: verdict.reason,
+    exitCode: 2,
+    verdict
+  };
+}
 function claudeCodeOutput(verdict) {
   return JSON.stringify({
     hookSpecificOutput: {
@@ -283,12 +1551,41 @@ var SETTINGS_SNIPPET = {
     ]
   }
 };
+var CODEX_HOOK_COMMAND = 'guardian-hook codex || { s=$?; [ $s -eq 2 ] || echo "Guardian hook failed to run. Nothing ran." >&2; exit 2; }';
+var CODEX_HOOKS_SNIPPET = {
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: "^(Bash|apply_patch)$|^mcp__.*",
+        hooks: [
+          {
+            type: "command",
+            command: CODEX_HOOK_COMMAND,
+            timeout: 600,
+            statusMessage: "Guardian is checking this action"
+          }
+        ]
+      }
+    ]
+  }
+};
+var DSH_HOOK_COMMAND = 'guardian-hook dsh || { s=$?; [ $s -eq 2 ] || echo "Guardian hook failed to run. Nothing ran." >&2; exit 2; }';
+var DSH_HOOKS_SNIPPET = {
+  hooks: {
+    PreToolUse: [
+      {
+        matcher: "^(bash|pwsh|terminal_send|write|edit|apply_patch|str_replace_editor|web_fetch|Bash|Write|Edit|MultiEdit|NotebookEdit|WebFetch)$|^mcp__.*",
+        hooks: [{ type: "command", command: DSH_HOOK_COMMAND, timeout: 600 }]
+      }
+    ]
+  }
+};
 function connectionFor(toolName, env) {
   const allow = env.GUARDIAN_CONNECTION_ID?.trim() || void 0;
   if (tierOf(toolName) === "allow") return allow;
   return env.GUARDIAN_HOOK_ASK_CONNECTION_ID?.trim() || allow;
 }
-function setupText() {
+function setupText(dialect2 = "claude-code") {
   const list = (mode) => HOOK_TOOLS.filter((t) => t.suggestedMode === mode).map((t) => `     ${t.name.padEnd(18)} ${t.description}`).join("\n");
   return [
     "Guardian modes are set per connection, so the hook uses two record-only tool servers.",
@@ -310,23 +1607,111 @@ function setupText() {
     "3. In the shell that starts the agent, export GUARDIAN_AGENT_CREDENTIAL,",
     "   GUARDIAN_CONNECTION_ID (a) and GUARDIAN_HOOK_ASK_CONNECTION_ID (b).",
     "",
+    ...agentSteps(dialect2)
+  ].join("\n");
+}
+function agentSteps(dialect2) {
+  if (dialect2 === "codex") {
+    return [
+      "4. Install the hook where Codex runs (npm i -g @odingard/guardian-hook), then add",
+      "   this to ~/.codex/hooks.json (or <repo>/.codex/hooks.json):",
+      JSON.stringify(CODEX_HOOKS_SNIPPET, null, 2),
+      "",
+      "5. Trust it once with /hooks in the Codex TUI, or run headless with",
+      "   `codex exec --dangerously-bypass-hook-trust ...`. Untrusted hooks are skipped.",
+      "",
+      "Governed: Bash (shell and unified exec_command), apply_patch file edits, MCP tools.",
+      "NOT governed: write_stdin. Codex runs no hook when it types into an open",
+      "exec_command session, so anything typed there skips Guardian. Starting an",
+      "interactive shell, interpreter or ssh session is routed to shell_session (Ask);",
+      "to close the gap, turn unified exec off in a managed requirements.toml:",
+      "   [features]",
+      "   unified_exec = false",
+      "Also not governed: hosted tools such as WebSearch, and tool paths Codex runs",
+      "without hooks. A missing, untrusted or unparseable hooks.json governs nothing.",
+      "Codex lets a call run if the hook crashes or times out; the || above and the",
+      "hook's own 540 s deadline turn those cases into a deny."
+    ];
+  }
+  if (dialect2 === "dsh") {
+    return [
+      "4. Install the hook in the image or on the volume (npm i -g @odingard/guardian-hook),",
+      "   save this as /data/.dsh/guardian-hooks.json:",
+      JSON.stringify(DSH_HOOKS_SNIPPET, null, 2),
+      "",
+      "5. Mount the Claude Code hook bridge in $DSH_HOME/cordis.patch.yml:",
+      "   - insert:",
+      "       - id: guardian-hooks",
+      "         name: '@deepseek-ai/dsh-hooks-claude-code'",
+      "         config: { configPath: /data/.dsh/guardian-hooks.json, defaultTimeoutMs: 600000 }",
+      "",
+      "Governed: bash, pwsh, terminal_send, write, edit, apply_patch, str_replace_editor",
+      "(not view), web_fetch, MCP tools. The matcher decides whether the hook runs at",
+      "all: a tool it does not name is not governed. NOT governed: every other dsh tool,",
+      "including run_code itself, subagent, workflow, plugin_manager and",
+      "load_workspace_dependencies (install packages), stagehand_act/stagehand_navigate",
+      "(browser actions), send_message, spawn_teammate, team_task_*, job_*, schedule_*,",
+      "skill, lsp, propose_action, terminal_open, web_search, read/glob/grep.",
+      "A missing or unparseable hooks file: the bridge registers no hooks and nothing",
+      "is governed. The bridge lets a call run if the hook crashes; the || above and",
+      "the hook's own 540 s deadline turn those cases into a deny."
+    ];
+  }
+  return [
     "4. Add this to .claude/settings.json (project) or ~/.claude/settings.json (all projects):",
     JSON.stringify(SETTINGS_SNIPPET, null, 2),
     "",
     "Read-only tools (Read, Grep, Glob, LS, WebSearch) are not routed through Guardian."
-  ].join("\n");
+  ];
 }
 async function runHook(stdin, env, deps = {}) {
-  const failClosed = (reason) => claudeCodeOutput({ decision: "deny", reason: `Guardian hook: ${reason}` });
+  return (await runHookAs("claude-code", stdin, env, deps)).stdout;
+}
+async function runHookAs(dialect2, stdin, env, deps = {}) {
+  const requested = Number(
+    env.GUARDIAN_HOOK_DEADLINE_MS ?? DEFAULT_DEADLINE_MS
+  );
+  const deadlineMs = Number.isFinite(requested) && requested > 0 ? Math.min(requested, DEFAULT_DEADLINE_MS) : DEFAULT_DEADLINE_MS;
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(
+      () => resolve({
+        decision: "deny",
+        reason: "Guardian hook: no decision before the hook's deadline. Nothing ran."
+      }),
+      deadlineMs
+    );
+    timer.unref?.();
+  });
+  try {
+    const verdict = await Promise.race([
+      evaluate(dialect2, stdin, env, deps, deadlineMs).catch(
+        () => ({
+          decision: "deny",
+          reason: "Guardian hook: crashed. Nothing ran."
+        })
+      ),
+      timedOut
+    ]);
+    return formatVerdict(dialect2, verdict);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function evaluate(dialect2, stdinText, env, deps, deadlineMs) {
+  const failClosed = (reason) => ({
+    decision: "deny",
+    reason: `Guardian hook: ${reason}`
+  });
   let input;
   try {
-    input = JSON.parse(stdin);
+    input = JSON.parse(await stdinText);
   } catch {
     return failClosed(
       "could not read the tool call from the agent. Nothing ran."
     );
   }
-  if (typeof input.tool_name !== "string") {
+  if (!input || typeof input.tool_name !== "string") {
     return failClosed("the tool call had no tool name. Nothing ran.");
   }
   const call = governedCall({
@@ -334,7 +1719,7 @@ async function runHook(stdin, env, deps = {}) {
     input: input.tool_input && typeof input.tool_input === "object" ? input.tool_input : {},
     ...typeof input.cwd === "string" ? { cwd: input.cwd } : {}
   });
-  if (call === null) return "";
+  if (call === null) return null;
   const connectionId = connectionFor(call.toolName, env);
   const credential = env.GUARDIAN_AGENT_CREDENTIAL?.trim();
   const baseUrl = (env.GUARDIAN_BASE_URL?.trim() || DEFAULT_BASE_URL).replace(
@@ -343,7 +1728,7 @@ async function runHook(stdin, env, deps = {}) {
   );
   if (!deps.client && (!credential || !connectionId)) {
     return failClosed(
-      "GUARDIAN_AGENT_CREDENTIAL and GUARDIAN_CONNECTION_ID must be set (run `npx @odingard/guardian-hook setup`). Nothing ran."
+      `GUARDIAN_AGENT_CREDENTIAL and GUARDIAN_CONNECTION_ID must be set (run \`${dialect2 === "claude-code" ? "npx @odingard/guardian-hook" : `guardian-hook ${dialect2}`} setup\`). Nothing ran.`
     );
   }
   if (!deps.client && !baseUrl.startsWith("https://")) {
@@ -352,15 +1737,16 @@ async function runHook(stdin, env, deps = {}) {
   const requested = Number(
     env.GUARDIAN_HOOK_APPROVAL_TIMEOUT_MS ?? MAX_WAIT_MS
   );
-  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), MAX_WAIT_MS) : MAX_WAIT_MS;
-  const verdict = await decide(call, {
+  const ceiling = Math.max(0, Math.min(MAX_WAIT_MS, deadlineMs - 3e4));
+  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), ceiling) : ceiling;
+  return decide(call, {
     client: deps.client ?? createGuardianClient({
       baseUrl,
       credential,
       ...env.GUARDIAN_ADAPTER_ID ? { adapterId: env.GUARDIAN_ADAPTER_ID } : {}
     }),
     connectionId: connectionId ?? "",
-    agentName: env.GUARDIAN_HOOK_AGENT_NAME?.trim() || "Claude Code",
+    agentName: env.GUARDIAN_HOOK_AGENT_NAME?.trim() || AGENT_NAMES[dialect2],
     approvalTimeoutMs,
     requestTtlMs: REQUEST_TTL_MS,
     pollIntervalMs: 2e3,
@@ -368,19 +1754,64 @@ async function runHook(stdin, env, deps = {}) {
     ...deps.now ? { now: deps.now } : {},
     ...deps.log ? { log: deps.log } : {}
   });
-  return claudeCodeOutput(verdict);
 }
 
 // src/index.ts
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
+function readHookInput(stream = process.stdin) {
+  return (async () => {
+    const chunks = [];
+    for await (const chunk of stream) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      const text = Buffer.concat(chunks).toString("utf8");
+      if (/\}\s*$/.test(text)) {
+        try {
+          const value = JSON.parse(text);
+          if (value && typeof value === "object") return text;
+        } catch {
+        }
+      }
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  })();
+}
+function isDialect(value) {
+  return DIALECTS.includes(value ?? "");
+}
+function parseArgs(argv, env) {
+  const [first, ...rest] = argv;
+  if (isDialect(first)) return { dialect: first, rest };
+  const fromEnv = env.GUARDIAN_HOOK_DIALECT?.trim();
+  return {
+    dialect: isDialect(fromEnv) ? fromEnv : "claude-code",
+    rest: [...argv]
+  };
+}
+var dialect = "claude-code";
+var answered = false;
+function emit(result) {
+  if (answered) return;
+  answered = true;
+  if (result.stdout) process.stdout.write(`${result.stdout}
+`);
+  if (result.stderr) process.stderr.write(`${result.stderr}
+`);
+  process.exitCode = result.exitCode;
+}
+function crashed() {
+  emit(
+    formatVerdict(dialect, {
+      decision: "deny",
+      reason: "Guardian hook crashed. Nothing ran."
+    })
+  );
+  process.exit(process.exitCode ?? 2);
 }
 async function main(argv) {
-  const [command, ...rest] = argv;
+  const parsed = parseArgs(argv, process.env);
+  dialect = parsed.dialect;
+  const [command, ...rest] = parsed.rest;
   if (command === "setup") {
-    process.stdout.write(`${setupText()}
+    process.stdout.write(`${setupText(dialect)}
 `);
     return;
   }
@@ -390,32 +1821,42 @@ async function main(argv) {
     return;
   }
   if (command === "--help" || command === "-h") {
-    process.stdout.write("guardian-hook [setup | classify <command>]\n");
+    process.stdout.write(
+      "guardian-hook [codex | dsh] [setup | classify <command>]\n"
+    );
     return;
   }
-  const output = await runHook(await readStdin(), process.env, {
-    log: (line) => process.stderr.write(`${line}
+  emit(
+    await runHookAs(dialect, readHookInput(), process.env, {
+      log: (line) => process.stderr.write(`${line}
 `)
-  });
-  if (output) process.stdout.write(`${output}
-`);
+    })
+  );
+  setTimeout(() => process.exit(process.exitCode ?? 0), 250).unref();
 }
 var invokedDirectly = process.argv[1] !== void 0 && /guardian-hook|hook[\\/]dist[\\/]index\.js$/.test(process.argv[1]);
 if (invokedDirectly) {
-  main(process.argv.slice(2)).catch(() => {
-    process.stdout.write(
-      `${claudeCodeOutput({ decision: "deny", reason: "Guardian hook crashed. Nothing ran." })}
-`
-    );
-  });
+  process.on("uncaughtException", crashed);
+  process.on("unhandledRejection", crashed);
+  main(process.argv.slice(2)).catch(crashed);
 }
 export {
+  CODEX_HOOKS_SNIPPET,
+  CODEX_HOOK_COMMAND,
   DEFAULT_BASE_URL,
+  DEFAULT_DEADLINE_MS,
+  DIALECTS,
+  DSH_HOOKS_SNIPPET,
+  DSH_HOOK_COMMAND,
   MAX_WAIT_MS,
   REQUEST_TTL_MS,
   SETTINGS_SNIPPET,
   claudeCodeOutput,
   connectionFor,
+  formatVerdict,
+  parseArgs,
+  readHookInput,
   runHook,
+  runHookAs,
   setupText
 };