@ory/argus 1.2.2 → 1.2.4

package/dist/bash-parser.js

@@ -46,12 +46,75 @@ const LITERAL_LEAF_TYPES = new Set(["word", "string_content", "raw_string"]);
  */
 const WRAPPERS = new Set([
     "sudo", "doas", "env", "nohup", "setsid", "command", "exec", "nice",
-    "ionice", "chrt", "stdbuf", "time", "timeout", "xargs",
+    "ionice", "chrt", "stdbuf", "time", "timeout", "xargs", "builtin",
 ]);
-/** Wrappers that take a numeric positional operand before the wrapped command. */
-const OPERAND_WRAPPERS = new Set(["timeout", "nice", "ionice", "chrt"]);
-/** A numeric operand (`5`, `5s`, `1.5`) consumed by an {@link OPERAND_WRAPPERS}. */
-const NUMERIC_OPERAND = /^\d+(\.\d+)?[smhdSMHD]?$/;
+/** Wrapper options whose following token is an option value, not a command. */
+const WRAPPER_OPTIONS_WITH_VALUES = {
+    doas: new Set(["-a", "-C", "-u"]),
+    sudo: new Set([
+        "-u", "--user", "-g", "--group", "-h", "--host", "-p", "--prompt",
+        "-C", "--close-from", "-T", "--command-timeout", "-R", "--chroot",
+        "-D", "--chdir", "-r", "--role", "-t", "--type",
+    ]),
+    env: new Set([
+        "-u", "--unset", "-C", "--chdir",
+    ]),
+    nice: new Set(["-n", "--adjustment"]),
+    exec: new Set(["-a"]),
+    ionice: new Set([
+        "-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid",
+        "-u", "--uid",
+    ]),
+    timeout: new Set(["-s", "--signal", "-k", "--kill-after"]),
+    stdbuf: new Set(["-i", "--input", "-o", "--output", "-e", "--error"]),
+    xargs: new Set([
+        "-a", "--arg-file", "-E", "--eof", "-I", "--replace", "-L",
+        "--max-lines", "-n", "--max-args", "-P", "--max-procs", "-s",
+        "--max-chars",
+    ]),
+};
+/** Common standalone options that do not consume the following command token. */
+const WRAPPER_OPTIONS_WITHOUT_VALUES = {
+    doas: new Set(["-L", "-n", "-s"]),
+    sudo: new Set([
+        "-A", "--askpass", "-b", "--background", "-E", "--preserve-env",
+        "-H", "--set-home", "-K", "-k", "--reset-timestamp", "-N",
+        "--no-update", "-n", "--non-interactive", "-S", "--stdin", "-V",
+        "--version", "-v", "--validate",
+    ]),
+    env: new Set([
+        "-i", "--ignore-environment", "-0", "--null", "-v", "--debug",
+        "--ignore-signal", "--default-signal", "--block-signal",
+    ]),
+    command: new Set(["-p", "-v", "-V"]),
+    chrt: new Set([
+        "-a", "--all-tasks", "-b", "--batch", "-d", "--deadline", "-f", "--fifo",
+        "-i", "--idle", "-m", "--max", "-o", "--other", "-r", "--rr",
+    ]),
+    exec: new Set(["-c", "-l"]),
+    setsid: new Set(["-c", "--ctty", "-f", "--fork", "-w", "--wait"]),
+    time: new Set(["-p"]),
+    timeout: new Set(["--foreground", "--preserve-status", "-v", "--verbose"]),
+    xargs: new Set([
+        "-0", "--null", "-r", "--no-run-if-empty", "-t", "--verbose", "-x",
+        "--exit",
+    ]),
+};
+const WRAPPER_OPTIONS_WITH_ATTACHED_VALUES = {
+    doas: /^-[aCu].+/,
+    sudo: /^-[ughCpTDRrt].+/,
+    nice: /^-(?:n.+|\d+)$/,
+    exec: /^-a.+/,
+    ionice: /^-[cnpPu].+/,
+    timeout: /^-[sk].+/,
+    stdbuf: /^-[ioe].+/,
+    xargs: /^-[ELnPs].+/,
+};
+/** Wrappers with a required positional operand before the wrapped command. */
+const WRAPPER_POSITIONAL_OPERANDS = {
+    timeout: 1,
+    chrt: 1,
+};
 /** Shells whose `-c "<script>"` argument is re-parsed as a nested command. */
 const SHELL_DASH_C = new Set(["sh", "bash", "dash", "zsh", "ksh", "ash"]);
 /** Cap re-parse recursion (`sh -c "sh -c …"`) so a pathological input can't loop. */
@@ -122,6 +185,8 @@ function lastLeaf(node) {
 function literalText(node) {
     switch (node.type) {
         case "word":
+            // Unquoted globs depend on the runtime filesystem and are not literal.
+            return /[*?[]/.test(node.text) ? null : node.text;
         case "number":
             return node.text;
         case "raw_string":
@@ -150,10 +215,10 @@ function literalText(node) {
 function resolveCommandName(nameNode) {
     const child = nameNode.namedChild(0);
     if (!child)
-        return basename(nameNode.text);
+        return /[*?[]/.test(nameNode.text) ? null : basename(nameNode.text);
     switch (child.type) {
         case "word":
-            return basename(child.text);
+            return /[*?[]/.test(child.text) ? null : basename(child.text);
         case "raw_string":
             return basename(stripQuotes(child.text));
         case "simple_expansion":
@@ -227,20 +292,55 @@ function collectRedirects(cmd) {
  * {@link ShellCommand} for that command (and recursing through nested wrappers,
  * e.g. `sudo env A=1 curl`).
  */
-function descendWrapper(wrapper, args, pipeline, state) {
-    const skipsNumeric = OPERAND_WRAPPERS.has(wrapper);
+function descendWrapper(wrapper, args, pipeline, parser, depth, state) {
+    let positionalOperands = WRAPPER_POSITIONAL_OPERANDS[wrapper] ?? 0;
+    let optionsEnded = false;
     for (let i = 0; i < args.length; i++) {
         const txt = literalText(args[i]);
         if (txt === null) {
             state.tooComplex = true;
             return;
         }
-        if (txt.startsWith("-"))
+        if (wrapper === "env" && /^--s[^=]*=/.test(txt)) {
+            state.tooComplex = true;
+            return;
+        }
+        if (wrapper === "env" && (txt === "-S" || txt === "--split-string")) {
+            // env's split-string language is not shell syntax. Parsing it with the
+            // Bash grammar can reinterpret comments and quoting, so fail closed.
+            state.tooComplex = true;
+            return;
+        }
+        if (!optionsEnded && txt.startsWith("-")) {
+            if (txt === "--") {
+                optionsEnded = true;
+                continue;
+            }
+            if (txt.includes("="))
+                continue;
+            if (WRAPPER_OPTIONS_WITH_ATTACHED_VALUES[wrapper]?.test(txt))
+                continue;
+            if (WRAPPER_OPTIONS_WITH_VALUES[wrapper]?.has(txt)) {
+                if (!args[i + 1] || literalText(args[i + 1]) === null) {
+                    state.tooComplex = true;
+                    return;
+                }
+                i++;
+                continue;
+            }
+            if (!WRAPPER_OPTIONS_WITHOUT_VALUES[wrapper]?.has(txt)) {
+                // An unknown option may consume the next token. Do not guess which
+                // token is the command because a wrong guess would silently bypass it.
+                state.tooComplex = true;
+            }
             continue;
+        }
         if (/^[A-Za-z_]\w*=/.test(txt))
             continue;
-        if (skipsNumeric && NUMERIC_OPERAND.test(txt))
+        if (positionalOperands > 0) {
+            positionalOperands--;
             continue;
+        }
         const wrapped = basename(txt);
         if (wrapped.length === 0)
             return;
@@ -252,11 +352,92 @@ function descendWrapper(wrapper, args, pipeline, state) {
             redirects: [],
             pipeline,
         });
-        if (WRAPPERS.has(wrapped))
-            descendWrapper(wrapped, rest, pipeline, state);
+        if (SHELL_DASH_C.has(wrapped) && state.pipelineIds.has(pipeline)) {
+            if (shellReadsPipelineInput(rest))
+                state.tooComplex = true;
+        }
+        if (WRAPPERS.has(wrapped)) {
+            descendWrapper(wrapped, rest, pipeline, parser, depth, state);
+        }
+        inspectLiteralScriptInvocation(wrapped, rest, parser, state, depth);
         return;
     }
 }
+function shellReadsPipelineInput(args) {
+    for (let i = 0; i < args.length; i++) {
+        const arg = literalText(args[i]);
+        if (arg === null)
+            return true;
+        if (arg === "--")
+            return i + 1 >= args.length;
+        if (arg === "-O" || arg === "-o" || arg === "--init-file" || arg === "--rcfile") {
+            i++;
+            continue;
+        }
+        if (arg.startsWith("-")) {
+            if (/^-[^-]*c/.test(arg))
+                return false;
+            if (/^-[^-]*s/.test(arg))
+                return true;
+            continue;
+        }
+        const normalized = arg.startsWith("/")
+            ? `/${arg.split("/").reduce((parts, part) => {
+                if (!part || part === ".")
+                    return parts;
+                if (part === "..")
+                    parts.pop();
+                else
+                    parts.push(part);
+                return parts;
+            }, []).join("/")}`
+            : arg;
+        if (arg === "-"
+            || normalized === "/dev/stdin"
+            || /^\/dev\/fd\/0+$/.test(normalized)
+            || /^\/proc\/self\/fd\/0+$/.test(normalized))
+            return true;
+        // A positional operand is a script file, so pipeline stdin is data rather
+        // than shell source and does not hide additional command words.
+        return false;
+    }
+    return true;
+}
+function inspectLiteralScriptInvocation(name, args, parser, state, depth) {
+    if (SHELL_DASH_C.has(name)) {
+        for (let i = 0; i < args.length; i++) {
+            const text = literalText(args[i]);
+            if (text === null) {
+                state.tooComplex = true;
+                break;
+            }
+            if (text === "--" || !text.startsWith("-"))
+                break;
+            if (text === "-O" || text === "-o" || text === "--init-file" || text === "--rcfile") {
+                i++;
+                continue;
+            }
+            if (/^-[^-]*c/.test(text)) {
+                const target = args[i + 1];
+                const script = target ? literalText(target) : null;
+                if (script === null)
+                    state.tooComplex = true;
+                else
+                    reparse(script, parser, state, depth + 1);
+                break;
+            }
+        }
+    }
+    if (name === "eval") {
+        const parts = args.map(literalText);
+        if (parts.length === 0 || parts.some((part) => part === null)) {
+            state.tooComplex = true;
+        }
+        else {
+            reparse(parts.join(" "), parser, state, depth + 1);
+        }
+    }
+}
 /** Recursively walk the tree, building the command model. */
 function walk(node, pipeline, parser, state, depth, treeDepth) {
     // Bound recursion so a maliciously deep AST can't overflow the stack (which
@@ -267,6 +448,7 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
     }
     if (node.type === "pipeline") {
         const id = state.pipelineCounter++;
+        state.pipelineIds.add(id);
         for (const child of node.children)
             walk(child, id, parser, state, depth, treeDepth + 1);
         return;
@@ -291,41 +473,15 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
             redirects: collectRedirects(node),
             pipeline: pid,
         });
-        if (name && WRAPPERS.has(name))
-            descendWrapper(name, args, pid, state);
-        if (name && SHELL_DASH_C.has(name)) {
-            const flagIdx = args.findIndex((a) => {
-                const t = literalText(a);
-                return t !== null && t.startsWith("-") && t.includes("c");
-            });
-            if (flagIdx >= 0) {
-                const target = args[flagIdx + 1];
-                if (!target)
-                    state.tooComplex = true;
-                else {
-                    const script = literalText(target);
-                    if (script === null)
-                        state.tooComplex = true;
-                    else
-                        reparse(script, parser, state, depth + 1);
-                }
-            }
+        if (name && WRAPPERS.has(name)) {
+            descendWrapper(name, args, pid, parser, depth, state);
         }
-        if (name === "eval") {
-            const parts = [];
-            let dynamic = false;
-            for (const a of args) {
-                const t = literalText(a);
-                if (t === null)
-                    dynamic = true;
-                else
-                    parts.push(t);
-            }
-            if (dynamic || parts.length === 0)
+        if (name && SHELL_DASH_C.has(name) && state.pipelineIds.has(pid)) {
+            if (shellReadsPipelineInput(args))
                 state.tooComplex = true;
-            else
-                reparse(parts.join(" "), parser, state, depth + 1);
         }
+        if (name)
+            inspectLiteralScriptInvocation(name, args, parser, state, depth);
         // Descend into arguments for nested command substitutions ($(curl …)).
         for (const child of node.children)
             walk(child, -1, parser, state, depth, treeDepth + 1);
@@ -337,7 +493,11 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
 }
 /** Parse a nested script string and fold its commands into `state`. */
 function reparse(script, parser, state, depth) {
-    if (depth > MAX_REPARSE_DEPTH || script.trim().length === 0)
+    if (depth > MAX_REPARSE_DEPTH) {
+        state.tooComplex = true;
+        return;
+    }
+    if (script.trim().length === 0)
         return;
     const tree = parser.parse(script);
     if (!tree) {
@@ -370,7 +530,12 @@ async function extractShellCommands(command) {
     }
     if (!tree)
         return { commands: [], tooComplex: true };
-    const state = { commands: [], tooComplex: false, pipelineCounter: 0 };
+    const state = {
+        commands: [],
+        tooComplex: false,
+        pipelineCounter: 0,
+        pipelineIds: new Set(),
+    };
     if (command.includes("\\\n"))
         state.tooComplex = true;
     if (tree.rootNode.hasError)

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "fc1ff6ae66afbfb17f4190927e734abe3df8d241",
-  "commitShort": "fc1ff6a",
+  "commit": "8e70fe38343bc8599c65c5e1bd4af54861f633be",
+  "commitShort": "8e70fe3",
   "branch": "main",
-  "commitDate": "2026-09-09T14:04:39-07:00",
+  "commitDate": "2026-09-14T08:17:01-07:00",
   "dirty": false,
-  "builtAt": "2026-09-09T21:08:18.388Z"
+  "builtAt": "2026-09-14T15:20:26.275Z"
 }

package/dist/contract-suite.js

@@ -205,7 +205,12 @@ function runHarnessContractSuite(adapter) {
                 const observeEvents = (0, testing_js_1.getActivityEvents)(client, "permission.observe_deny");
                 const blockObservedEvents = (0, testing_js_1.getActivityEvents)(client, "permission.block_observed");
                 (0, vitest_1.expect)(observeEvents).toHaveLength(0);
-                (0, vitest_1.expect)(blockObservedEvents).toHaveLength(check === "denied" && mode === "observe" ? 1 : 0);
+                if (check === "denied" && mode === "observe") {
+                    (0, vitest_1.expect)(blockObservedEvents.length).toBeGreaterThanOrEqual(1);
+                }
+                else {
+                    (0, vitest_1.expect)(blockObservedEvents).toHaveLength(0);
+                }
             });
             (0, vitest_1.it)("records tool.invoke when an interactive tool proceeds", async () => {
                 process.env.ORY_INTERACTIVE_TOOLS = adapter.tool;

package/dist/permission-mode.d.ts

@@ -61,8 +61,19 @@ export interface AdditionalModeSubject {
     subject: ModeSubject;
     scope: "agent" | "subagent";
 }
+export interface PermissionModeBatchPlan {
+    checks: PermissionCheck[];
+    resolve(results: Array<{
+        allowed: boolean;
+        error?: string;
+    }>): ResolvedPermissionMode;
+}
 /** Drop all in-memory caches. Test-only (reassigns the WeakMap). */
 export declare function resetPermissionModeCache(): void;
+export declare function preparePermissionModeBatch(client: OryAgentClient, subject: ModeSubject, opts?: {
+    now?: number;
+    additionalSubjects?: AdditionalModeSubject[];
+}): PermissionModeBatchPlan;
 /**
  * Resolve the current permission mode for `subject`. Never throws — a Keto
  * error falls back to the persistent cache, then `observe`. See the module

package/dist/permission-mode.js

@@ -49,6 +49,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetPermissionModeCache = resetPermissionModeCache;
+exports.preparePermissionModeBatch = preparePermissionModeBatch;
 exports.resolvePermissionMode = resolvePermissionMode;
 exports.warmPermissionModeCache = warmPermissionModeCache;
 const config_js_1 = require("./config.js");
@@ -123,6 +124,139 @@ function projectPostureSubject(namespace) {
 function resetPermissionModeCache() {
     clientMemo = new WeakMap();
 }
+function preparePermissionModeBatch(client, subject, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const projectUrl = (0, config_js_1.resolveConfig)().projectUrl;
+    const namespace = resolveNamespace();
+    const subjects = [
+        { subject, scope: "principal", key: subjectKey(subject) },
+        ...(opts.additionalSubjects ?? []).map((item) => ({ ...item, key: subjectKey(item.subject) })),
+    ].filter((item, index, all) => all.findIndex((candidate) => candidate.key === item.key) === index);
+    const memo = memoFor(client);
+    const fresh = (key) => {
+        const entry = memo.get(key);
+        if (entry && now - entry.fetchedAt < ttlMs())
+            return entry;
+        memo.delete(key);
+        return undefined;
+    };
+    const cachedProject = fresh(PROJECT_SCOPE_KEY);
+    const cachedSubjects = subjects.map((item) => fresh(item.key));
+    if (cachedProject?.mode === "enforce" || (cachedProject && cachedSubjects.every(Boolean))) {
+        const enforcing = cachedProject.mode === "enforce"
+            ? cachedProject
+            : cachedSubjects.find((entry) => entry?.mode === "enforce");
+        const resolved = {
+            mode: enforcing?.mode ?? "observe",
+            source: enforcing?.source ?? cachedProject.source,
+        };
+        return { checks: [], resolve: () => resolved };
+    }
+    const pending = [
+        ...(!cachedProject ? [{ scope: "project", key: PROJECT_SCOPE_KEY, subject: projectPostureSubject(namespace) }] : []),
+        ...subjects.flatMap((item, index) => cachedSubjects[index] ? [] : [item]),
+    ];
+    const checks = pending.map((item) => ({
+        namespace,
+        object: opl_js_1.PERMISSION_MODE_OBJECT,
+        relation: opl_js_1.RELATION_ENFORCED_SUBJECTS,
+        ...item.subject,
+    }));
+    return {
+        checks,
+        resolve(results) {
+            const consultedKeys = [];
+            let sawError = false;
+            const read = (key, cached) => {
+                consultedKeys.push(key);
+                if (cached)
+                    return cached;
+                const index = pending.findIndex((item) => item.key === key);
+                const result = results[index];
+                if (!result || result.error) {
+                    sawError = true;
+                    return undefined;
+                }
+                const entry = {
+                    mode: result.allowed ? "enforce" : "observe",
+                    source: "server",
+                    fetchedAt: now,
+                };
+                memo.set(key, entry);
+                return entry;
+            };
+            const ordered = [
+                { key: PROJECT_SCOPE_KEY, scope: "project", cached: cachedProject },
+                ...subjects.map((item, index) => ({ ...item, cached: cachedSubjects[index] })),
+            ];
+            for (const item of ordered) {
+                const entry = read(item.key, item.cached);
+                if (entry?.mode === "enforce") {
+                    client.logger.activity("permission.mode_resolve", "ok", {
+                        attributes: { permissionMode: "enforce", enforceGranted: true, scope: item.scope, source: "server" },
+                    });
+                    persistPermissionModeMemo(client, projectUrl, now, consultedKeys);
+                    return { mode: "enforce", source: "server" };
+                }
+            }
+            if (consultedKeys.some((key) => memo.get(key)?.source === "server")) {
+                persistPermissionModeMemo(client, projectUrl, now, consultedKeys);
+            }
+            if (sawError)
+                return fallbackPermissionMode(projectUrl, subjects.map((item) => item.key));
+            client.logger.activity("permission.mode_resolve", "ok", {
+                attributes: { permissionMode: "observe", enforceGranted: false, scope: "principal", source: "server" },
+            });
+            return { mode: "observe", source: "server" };
+        },
+    };
+}
+function fallbackPermissionMode(projectUrl, subjectKeys) {
+    const cache = (0, config_js_1.resolveConfig)().permissionModeCache;
+    const scoped = cache && cache.projectUrl === projectUrl ? cache.scopes : undefined;
+    const project = scoped?.[PROJECT_SCOPE_KEY];
+    const subjectEntries = subjectKeys.map((key) => scoped?.[key]);
+    const scopedMode = project?.mode === "enforce" || subjectEntries.some((entry) => entry?.mode === "enforce")
+        ? "enforce"
+        : project && subjectEntries.every(Boolean)
+            ? "observe"
+            : undefined;
+    const legacyMode = cache && !cache.scopes && (!cache.projectUrl || cache.projectUrl === projectUrl)
+        ? cache.mode
+        : undefined;
+    const mode = scopedMode ?? (legacyMode === "enforce" ? "enforce" : undefined);
+    return mode ? { mode, source: "cache" } : { mode: "observe", source: "default" };
+}
+function persistPermissionModeMemo(client, projectUrl, now, requestedKeys) {
+    const updates = {};
+    for (const key of new Set(requestedKeys)) {
+        const entry = memoFor(client).get(key);
+        if (entry?.source === "server")
+            updates[key] = { mode: entry.mode, fetchedAt: entry.fetchedAt };
+    }
+    try {
+        (0, config_js_1.mutateConfig)((config) => {
+            const current = config.permissionModeCache;
+            const scopes = { ...(current && current.projectUrl === projectUrl ? current.scopes ?? {} : {}) };
+            const projectMode = updates[PROJECT_SCOPE_KEY]?.mode ?? scopes[PROJECT_SCOPE_KEY]?.mode ?? "observe";
+            let changed = current?.mode !== projectMode || current?.projectUrl !== projectUrl;
+            for (const [key, entry] of Object.entries(updates)) {
+                const refreshed = { mode: entry.mode, fetchedAt: now };
+                if (scopes[key]?.mode === refreshed.mode && scopes[key]?.fetchedAt === refreshed.fetchedAt)
+                    continue;
+                scopes[key] = refreshed;
+                changed = true;
+            }
+            if (!changed)
+                return undefined;
+            const boundedScopes = Object.fromEntries(Object.entries(scopes).sort(([, left], [, right]) => right.fetchedAt - left.fetchedAt).slice(0, 256));
+            return { ...config, permissionModeCache: { mode: projectMode, fetchedAt: now, projectUrl, scopes: boundedScopes } };
+        });
+    }
+    catch {
+        // Persistence is best-effort; a later process can read the server again.
+    }
+}
 /**
  * Resolve the current permission mode for `subject`. Never throws — a Keto
  * error falls back to the persistent cache, then `observe`. See the module
@@ -266,42 +400,7 @@ async function warmPermissionModeCache(client, subject, opts = {}) {
     });
     if (resolved.source === "server") {
         const requestedKeys = [PROJECT_SCOPE_KEY, subjectKey(subject), ...(opts.additionalSubjects ?? []).map((item) => subjectKey(item.subject))];
-        const updates = {};
-        for (const key of new Set(requestedKeys)) {
-            const entry = memoFor(client).get(key);
-            if (entry?.source === "server")
-                updates[key] = { mode: entry.mode, fetchedAt: entry.fetchedAt };
-        }
-        try {
-            (0, config_js_1.mutateConfig)((config) => {
-                const current = config.permissionModeCache;
-                const scopes = { ...(current && current.projectUrl === projectUrl ? current.scopes ?? {} : {}) };
-                const projectMode = updates[PROJECT_SCOPE_KEY]?.mode
-                    ?? scopes[PROJECT_SCOPE_KEY]?.mode
-                    ?? "observe";
-                let changed = current?.mode !== projectMode || current?.projectUrl !== projectUrl;
-                for (const [key, entry] of Object.entries(updates)) {
-                    const refreshed = { mode: entry.mode, fetchedAt: now };
-                    if (scopes[key]?.mode === refreshed.mode && scopes[key]?.fetchedAt === refreshed.fetchedAt)
-                        continue;
-                    scopes[key] = refreshed;
-                    changed = true;
-                }
-                if (!changed)
-                    return undefined;
-                const boundedScopes = Object.fromEntries(Object.entries(scopes)
-                    .sort(([, left], [, right]) => right.fetchedAt - left.fetchedAt)
-                    .slice(0, 256));
-                return {
-                    ...config,
-                    permissionModeCache: { mode: projectMode, fetchedAt: now, projectUrl, scopes: boundedScopes },
-                };
-            });
-        }
-        catch {
-            // Best-effort — a write failure just means the next process re-reads
-            // from the server (or starts at observe until it can).
-        }
+        persistPermissionModeMemo(client, projectUrl, now, requestedKeys);
     }
     return resolved;
 }

package/dist/permissions.d.ts

@@ -231,13 +231,13 @@ export interface GateToolCallArgs {
     /** Override the resolved {@link PermissionMode}. Tests use this. */
     modeOverride?: PermissionMode;
     /**
-     * Raw shell command string when {@link toolName} is the harness's shell tool
+     * Raw shell command string(s) when {@link toolName} is the harness's shell tool
      * (issue #76). When present and the tool is a shell tool, the gate decomposes
-     * the command into `ShellTool:<word>#use` sub-checks in addition to the
+     * each command into `ShellTool:<word>#use` sub-checks in addition to the
      * top-level tool check. Absent / undefined ⇒ decomposition is skipped and the
      * gate behaves exactly as before.
      */
-    shellCommand?: string;
+    shellCommand?: string | readonly string[];
     /**
      * The acting machine principals, so an explicit block on the agent install,
      * this session, the sub-agent kind, or this spawn can deny the call. Omitted ⇒

package/dist/permissions.js

@@ -220,6 +220,9 @@ async function gateToolCall(client, args) {
     // every read 401s: `session_inactive` denies every tool under `enforce`, and
     // under `observe` stops checking anything at all (#242).
     await (0, read_credential_js_1.ensureReadCredential)(client, { harness: args.harness });
+    if (!(args.shellCommand && (0, tool_catalog_js_1.isShellTool)(args.harness, args.toolName))) {
+        return batchNonShellGate(client, args);
+    }
     // Resolve the mode ONCE for this gate — a per-principal Keto permission read
     // (server → cache → observe), cached with a short TTL. Threaded downstream as
     // `modeOverride` so the whole gate (top-level check + every decomposed shell
@@ -240,16 +243,7 @@ async function gateToolCall(client, args) {
     // than before it, so the extra read costs no serial latency, and let a block
     // override an allow afterwards.
     const [decision, blocked] = await Promise.all([
-        args.shellCommand && (0, tool_catalog_js_1.isShellTool)(args.harness, args.toolName)
-            ? // Shell tools (issue #76): decompose the command into per-word sub-checks
-                // in addition to the top-level tool check. Only when the harness marks
-                // this a shell tool AND the raw command was threaded through — otherwise
-                // fall back to the plain single check (never breaks).
-                decomposeAndCheck(client, { ...args, modeOverride: mode })
-            : checkAndDecide(client, args.check, {
-                activityAttributes: args.activityAttributes,
-                modeOverride: mode,
-            }),
+        decomposeAndCheck(client, { ...args, modeOverride: mode }),
         findBlockedPrincipal(client, {
             namespace: args.check.namespace,
             object: args.check.object,
@@ -273,6 +267,77 @@ async function gateToolCall(client, args) {
     }
     return applyPrincipalBlock(client, { args, mode, decision, blocked });
 }
+async function batchNonShellGate(client, args) {
+    const additionalSubjects = [
+        { scope: "agent", subject: (0, subject_js_1.resolveAgentSubject)(client) },
+        { scope: "subagent", subject: (0, subject_js_1.resolveSubAgentSubject)(args.principals?.subAgentClientId) },
+    ].filter((item) => item.subject !== undefined);
+    const modeSubject = { subjectId: args.check.subjectId, subjectSet: args.check.subjectSet };
+    const modePlan = args.modeOverride ? undefined : (0, permission_mode_js_1.preparePermissionModeBatch)(client, modeSubject, { additionalSubjects });
+    const candidates = principalBlockCandidates(client, args.principals);
+    const effectiveCheck = { ...args.check, relation: resolveCheckRelation(args.check.relation) };
+    const checks = [
+        ...(modePlan?.checks ?? []),
+        effectiveCheck,
+        ...candidates.map(({ ref }) => ({
+            namespace: args.check.namespace,
+            object: args.check.object,
+            relation: opl_js_1.RELATION_BLOCKED_SUBJECTS,
+            ...ref,
+        })),
+    ];
+    try {
+        const batch = await client.batchCheckPermissions(checks, {
+            activityAttributes: { ...args.activityAttributes, source: "tool_gate" },
+        });
+        const modeCount = modePlan?.checks.length ?? 0;
+        const mode = args.modeOverride ?? modePlan.resolve(batch.results.slice(0, modeCount)).mode;
+        const toolResult = batch.results[modeCount];
+        if (!toolResult || toolResult.error)
+            throw new Error(toolResult?.error ?? "missing tool result");
+        const result = { allowed: toolResult.allowed, checkedAt: batch.checkedAt, check: args.check };
+        const decision = await decidePermissionResult(client, result, effectiveCheck, {
+            activityAttributes: args.activityAttributes,
+            modeOverride: mode,
+        });
+        let blocked;
+        for (const [index, candidate] of candidates.entries()) {
+            const block = batch.results[modeCount + 1 + index];
+            if (block?.allowed && !block.error) {
+                blocked = {
+                    subject: candidate.level === "project" ? "project" : (0, subject_js_1.subjectLabel)(candidate.ref),
+                    level: candidate.level,
+                };
+                break;
+            }
+        }
+        return applyBlockedDecision(client, args, mode, decision, blocked);
+    }
+    catch {
+        const mode = args.modeOverride ?? (await (0, permission_mode_js_1.warmPermissionModeCache)(client, modeSubject, { additionalSubjects })).mode;
+        const [decision, blocked] = await Promise.all([
+            checkAndDecide(client, args.check, { activityAttributes: args.activityAttributes, modeOverride: mode }),
+            findBlockedPrincipal(client, { namespace: args.check.namespace, object: args.check.object, principals: args.principals }),
+        ]);
+        return applyBlockedDecision(client, args, mode, decision, blocked);
+    }
+}
+function applyBlockedDecision(client, args, mode, decision, blocked) {
+    if (!blocked)
+        return decision;
+    if (decision.kind === "deny") {
+        return {
+            ...decision,
+            activityAttributes: {
+                ...decision.activityAttributes,
+                blockReason: "explicit_block",
+                blockedPrincipal: blocked.subject,
+                blockedPrincipalLevel: blocked.level,
+            },
+        };
+    }
+    return applyPrincipalBlock(client, { args, mode, decision, blocked });
+}
 /**
  * Turn a machine-principal block into the gate's outcome, respecting
  * `permissionMode` exactly as any other deny does: `enforce` blocks, `observe`
@@ -342,11 +407,36 @@ async function decomposeAndCheck(client, args) {
     // letting the exception bubble to the harness catch, which fails open.
     let parsed;
     try {
-        parsed = await (0, bash_parser_js_1.extractBashCommandWords)(args.shellCommand ?? "");
+        const commands = typeof args.shellCommand === "string"
+            ? [args.shellCommand]
+            : args.shellCommand ?? [];
+        const words = [];
+        const seen = new Set();
+        let tooComplex = false;
+        let parserUnavailable = false;
+        for (const command of commands) {
+            const result = await (0, bash_parser_js_1.extractBashCommandWords)(command);
+            tooComplex ||= result.tooComplex;
+            parserUnavailable ||= result.parserUnavailable === true;
+            for (const word of result.words) {
+                if (!seen.has(word)) {
+                    seen.add(word);
+                    words.push(word);
+                }
+            }
+        }
+        parsed = { words, tooComplex, parserUnavailable };
     }
     catch {
         parsed = { words: [], tooComplex: true };
     }
+    if (args.toolName.toLowerCase() === "powershell"
+        || (args.harness === "cline" && args.toolName === "run_commands" && process.platform === "win32")) {
+        // The bundled grammar models POSIX shell syntax, not PowerShell. Retain its
+        // Never retain words parsed with the incompatible grammar: PowerShell
+        // literals could otherwise be persisted as if they were command names.
+        parsed = { words: [], tooComplex: true, parserUnavailable: false };
+    }
     if (parsed.parserUnavailable) {
         client.logger.warn("bash.parser_unavailable", {
             harness: args.harness,
@@ -610,6 +700,10 @@ async function checkAndDecide(client, check, opts = {}) {
     // Report the decision against the caller's original check (relation `use`),
     // not the internal permit rewrite, so callers see the coordinates they passed.
     result = { ...result, check };
+    return decidePermissionResult(client, result, effectiveCheck, opts);
+}
+async function decidePermissionResult(client, result, effectiveCheck, opts) {
+    const check = result.check;
     // A deny from the native `use` permit is necessarily an explicit block.
     // Retain the diagnostic probe only for other grant-based public checks.
     const blockReason = result.allowed
@@ -640,6 +734,24 @@ const PROJECT_BLOCK_SUBJECT = {
         relation: opl_js_1.RELATION_ENFORCED_SUBJECTS,
     },
 };
+function principalBlockCandidates(client, principals) {
+    const p = principals ?? {};
+    return [
+        { level: "project", ref: PROJECT_BLOCK_SUBJECT },
+        { level: "agent", ref: (0, subject_js_1.resolveAgentSubject)(client) },
+        { level: "agent_session", ref: (0, subject_js_1.resolveAgentSessionSubject)(client, p.sessionId) },
+        { level: "subagent", ref: (0, subject_js_1.resolveSubAgentSubject)(p.subAgentClientId) },
+        {
+            level: "subagent_spawn",
+            ref: p.subAgentType ? (0, subject_js_1.resolveSubAgentSpawnSubject)(client, {
+                subAgentClientId: p.subAgentClientId,
+                subAgentType: p.subAgentType,
+                perSpawnId: p.perSpawnId,
+                sessionId: p.sessionId,
+            }) : undefined,
+        },
+    ].filter((candidate) => candidate.ref !== undefined);
+}
 /**
  * Check whether the project or any acting machine principal is explicitly blocked from this
  * tool, and name the one that is.

package/dist/testing.d.ts

@@ -241,13 +241,21 @@ export declare function stubOAuth2Inactive(client: OryAgentClient): import("vite
  */
 export declare function setTestPermissionMode(mode: PermissionMode): void;
 /** Stub checkPermission to allow. */
-export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub checkPermission to deny (the tool check; the mode check still answers `currentTestMode`). */
-export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub checkPermission to throw a network error. */
-export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub checkPermission to throw a rate-limit error. */
-export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */
 export declare function stubMcpAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
 /** Stub checkPermission to deny (server-only MCP check). */

package/dist/testing.js

@@ -454,7 +454,7 @@ function ensurePermissionCredential(client) {
 /** Stub checkPermission to allow. */
 function stubPermissionAllowed(client) {
     ensurePermissionCredential(client);
-    stubApi(client, "permission", "batchCheckPermission", (request) => {
+    const batch = stubApi(client, "permission", "batchCheckPermission", (request) => {
         const tuples = request.batchCheckPermissionBody?.tuples ?? [];
         return Promise.resolve({
             data: {
@@ -466,22 +466,38 @@ function stubPermissionAllowed(client) {
             },
         });
     });
-    return stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_ALLOWED));
+    const check = stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_ALLOWED));
+    return Object.assign(check, { batch });
 }
 /** Stub checkPermission to deny (the tool check; the mode check still answers `currentTestMode`). */
 function stubPermissionDenied(client) {
     ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_DENIED));
+    const batch = stubApi(client, "permission", "batchCheckPermission", (request) => {
+        const tuples = request.batchCheckPermissionBody?.tuples ?? [];
+        return Promise.resolve({
+            data: {
+                results: tuples.map((tuple) => ({
+                    allowed: tuple.relation === "enforcedSubjects" && currentTestMode === "enforce",
+                })),
+            },
+        });
+    });
+    const check = stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_DENIED));
+    return Object.assign(check, { batch });
 }
 /** Stub checkPermission to throw a network error. */
 function stubPermissionNetworkError(client) {
     ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", () => Promise.reject(makeNetworkError()));
+    const batch = stubApi(client, "permission", "batchCheckPermission", () => Promise.reject(makeNetworkError()));
+    const check = stubApi(client, "permission", "checkPermission", () => Promise.reject(makeNetworkError()));
+    return Object.assign(check, { batch });
 }
 /** Stub checkPermission to throw a rate-limit error. */
 function stubPermissionRateLimited(client) {
     ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", () => Promise.reject(makeRateLimitError()));
+    const batch = stubApi(client, "permission", "batchCheckPermission", () => Promise.reject(makeRateLimitError()));
+    const check = stubApi(client, "permission", "checkPermission", () => Promise.reject(makeRateLimitError()));
+    return Object.assign(check, { batch });
 }
 // ─── MCP Stub Presets ─────────────────────────────────────────────
 /** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */

package/dist/tool-catalog.d.ts

@@ -14,17 +14,17 @@
  * Built-in tool names known to ship with each supported harness.
  */
 export declare const HARNESS_TOOL_CATALOG: {
-    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
-    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
+    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
+    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
     readonly codex: readonly ["Bash", "apply_patch"];
     readonly "gemini-cli": readonly ["read_file", "write_file", "edit_file", "list_files", "search_files", "shell", "web_search"];
     readonly openclaw: readonly ["exec", "read", "write", "edit", "apply_patch", "web_search", "web_fetch", "browser"];
     readonly opencode: readonly ["read", "write", "edit", "bash", "glob", "grep", "webfetch"];
     readonly continue: readonly ["Bash", "Read", "Edit", "Write", "Grep", "Glob", "WebSearch"];
     readonly goose: readonly ["shell", "text_editor", "read_file", "write_file", "list_windows", "screen_capture"];
-    readonly cline: readonly ["execute_command", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool"];
+    readonly cline: readonly ["execute_command", "run_commands", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool"];
     readonly amp: readonly ["Bash", "Read", "create_file", "edit_file", "undo_edit", "glob", "Grep", "finder", "read_web_page", "web_search", "todo_read", "todo_write", "oracle", "Task"];
-    readonly pi: readonly ["read", "write", "edit", "bash", "grep", "find", "ls"];
+    readonly pi: readonly ["read", "write", "edit", "bash", "powershell", "grep", "find", "ls"];
     readonly antigravity: readonly ["run_command", "view_file", "write_to_file", "replace_file_content", "multi_replace_file_content", "list_directory", "grep_search", "find", "read_url_content", "search_web", "call_mcp_tool"];
     readonly cursor: readonly ["Read", "Write", "Edit", "Delete", "Shell", "List", "Search", "MCP", "Task"];
 };
@@ -109,10 +109,12 @@ export declare function getShellCommandCatalog(): readonly string[];
  */
 export declare function resolveShellCommandNamespace(): string;
 /**
- * Extract the shell command string from a harness's tool-args object — the same
+ * Extract shell command strings from a harness's tool-args object — the same
  * object the handler already passes to `summarizeToolInput`. Returns `undefined`
  * when the tool isn't a shell tool for this harness or no command field is
- * present (the gate then skips decomposition and degrades to the top-level
- * `Bash` check — it never breaks).
+ * present. Cline's `run_commands` is the exception: malformed command data is
+ * represented as an unresolvable command so enforce mode fails closed. Cline's
+ * command array remains an array so independently executed entries cannot
+ * change how neighboring entries parse.
  */
-export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | undefined;
+export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | readonly string[] | undefined;

package/dist/tool-catalog.js

@@ -35,6 +35,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "Write",
         "Edit",
         "Bash",
+        "Monitor",
+        "PowerShell",
+        "Workflow",
         "Glob",
         "Grep",
         "WebFetch",
@@ -54,6 +57,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "Write",
         "Edit",
         "Bash",
+        "Monitor",
+        "PowerShell",
+        "Workflow",
         "Glob",
         "Grep",
         "WebFetch",
@@ -103,6 +109,7 @@ exports.HARNESS_TOOL_CATALOG = {
     ],
     cline: [
         "execute_command",
+        "run_commands",
         "read_file",
         "write_to_file",
         "replace_in_file",
@@ -126,7 +133,7 @@ exports.HARNESS_TOOL_CATALOG = {
         "oracle",
         "Task",
     ],
-    pi: ["read", "write", "edit", "bash", "grep", "find", "ls"],
+    pi: ["read", "write", "edit", "bash", "powershell", "grep", "find", "ls"],
     antigravity: [
         "run_command",
         "view_file",
@@ -245,8 +252,8 @@ function isInteractiveTool(harness, toolName) {
  * precise map is used rather than the {@link isBashLikeTool} heuristic.
  */
 exports.SHELL_TOOL_CATALOG = {
-    "claude-code": ["Bash"],
-    "claude-agent-sdk": ["Bash"],
+    "claude-code": ["Bash", "Monitor", "PowerShell"],
+    "claude-agent-sdk": ["Bash", "Monitor", "PowerShell"],
     codex: ["Bash"],
     // Gemini CLI's hook payload has been observed with both the short `shell`
     // name and the fuller `run_shell_command` id across versions; accept both so
@@ -256,10 +263,11 @@ exports.SHELL_TOOL_CATALOG = {
     opencode: ["bash"],
     continue: ["Bash"],
     goose: ["shell"],
-    cline: ["execute_command"],
+    cline: ["execute_command", "run_commands"],
     amp: ["Bash"],
-    pi: ["bash"],
+    pi: ["bash", "powershell"],
     antigravity: ["run_command"],
+    cursor: ["Shell"],
 };
 function parseEnvList(raw) {
     if (!raw)
@@ -346,16 +354,39 @@ const SHELL_COMMAND_FIELDS = [
     "commandLine",
     "CommandLine",
 ];
+const UNRESOLVED_SHELL_COMMAND = "$ORY_UNRESOLVED_SHELL_COMMAND";
+function extractClineRunCommands(args) {
+    if (!args || typeof args !== "object")
+        return [UNRESOLVED_SHELL_COMMAND];
+    const value = args.commands;
+    if (typeof value !== "string")
+        return [UNRESOLVED_SHELL_COMMAND];
+    try {
+        const commands = JSON.parse(value);
+        if (!Array.isArray(commands) || !commands.every((command) => typeof command === "string")) {
+            return [UNRESOLVED_SHELL_COMMAND];
+        }
+        return commands.length > 0 ? commands : undefined;
+    }
+    catch {
+        return [UNRESOLVED_SHELL_COMMAND];
+    }
+}
 /**
- * Extract the shell command string from a harness's tool-args object — the same
+ * Extract shell command strings from a harness's tool-args object — the same
  * object the handler already passes to `summarizeToolInput`. Returns `undefined`
  * when the tool isn't a shell tool for this harness or no command field is
- * present (the gate then skips decomposition and degrades to the top-level
- * `Bash` check — it never breaks).
+ * present. Cline's `run_commands` is the exception: malformed command data is
+ * represented as an unresolvable command so enforce mode fails closed. Cline's
+ * command array remains an array so independently executed entries cannot
+ * change how neighboring entries parse.
  */
 function extractShellCommand(harness, toolName, args) {
     if (!isShellTool(harness, toolName))
         return undefined;
+    if (harness === "cline" && toolName === "run_commands") {
+        return extractClineRunCommands(args);
+    }
     if (!args || typeof args !== "object")
         return undefined;
     const obj = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",