@overdeck/desktop 0.45.12 → 0.45.13

package/sync-sources/hooks/auto-approve-hook

@@ -0,0 +1,96 @@
+#!/bin/bash
+# ~/.overdeck/bin/auto-approve-hook
+#
+# PreToolUse hook that returns permissionDecision: "allow" — but ONLY for the
+# fully-autonomous, headless pipeline agents that have no human to answer Claude
+# Code's "Do you want to proceed?" prompt. Without this, an unapproved tool call
+# hangs the session forever (PAN-1024's "Interrupted · What should Claude do
+# instead?" loop). This is the replacement for launching those agents with
+# --dangerously-skip-permissions, which Auto-mode (compliance) users forbid.
+#
+# SCOPE (by OVERDECK_AGENT_ID prefix):
+#   agent-*    → AUTO-APPROVE. Work / review / test / ship pipeline agents run
+#                unattended; a prompt would hang them.
+#   flywheel-* → AUTO-APPROVE. The Fix-All Flywheel orchestrator
+#                (OVERDECK_AGENT_ID=flywheel-orchestrator) is fully headless —
+#                a prompt hangs the entire run. It does NOT use an agent-* id.
+#   sequencer-* → AUTO-APPROVE. The Backlog Sequencer
+#                (OVERDECK_AGENT_ID=sequencer-runner) is a headless singleton
+#                runner like the flywheel — it reads issues via `gh` with no human
+#                present, so an approval prompt stalls the whole ranking pass.
+#   strike-* / inspect-* → AUTO-APPROVE. Headless strike (implement+merge) and
+#                per-bead inspect agents, same autonomy as a work agent.
+#   planning-* → AUTO-APPROVE. A planning agent must not be MORE restrictive than
+#                a work agent (which is auto-approved) or a conversation (which
+#                runs under bypass) — otherwise it is the only thing in the system
+#                that stalls on Claude Code's native command gates (e.g. the
+#                "compound command contains cd with output redirection" prompt).
+#                Planning's interactivity is the AskUserQuestion DIALOG (decisions
+#                surface to the operator via ask-user-question-hook), NOT per-command
+#                approval. So its routine research is auto-approved like a work agent.
+#   conv-*     → AUTO-APPROVE. Overdeck conversations run autonomously between
+#                operator turns; they used to rely on Claude Code's `--permission-mode
+#                auto` classifier to avoid per-command prompts, but Claude Code
+#                removed `auto` as a valid interactive mode (we now launch every
+#                Overdeck session with `--permission-mode default`). Without this
+#                the conversation stalls on Claude's native "requires approval"
+#                gate for routine commands (e.g. `pan status`). The operator still
+#                sees every command in the dashboard terminal and steers via
+#                `pan tell`; AskUserQuestion is still excluded below so operator
+#                decisions surface as a dialog.
+#   (unset)    → NOT auto-approved. A human's own plain `claude` session keeps
+#                normal prompts.
+#
+# This hook is wired in the GLOBAL settings.json (frontmatter PreToolUse hooks'
+# permissionDecision is NOT honored by Claude Code — only settings.json hooks can
+# decide permission), so the prefix check above is what keeps it from leaking
+# into interactive/human sessions.
+#
+# AskUserQuestion is also skipped so ask-user-question-hook's deny stands.
+#
+# Never breaks Claude Code: on any error it stays silent (exit 0), which falls
+# back to the normal permission flow rather than forcing a decision.
+
+set +e
+
+LOG_DIR="$HOME/.overdeck/logs"
+mkdir -p "$LOG_DIR" 2>/dev/null || true
+
+INPUT=$(cat 2>/dev/null || echo '{}')
+
+TOOL_NAME=""
+if command -v jq >/dev/null 2>&1; then
+  TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null)
+fi
+
+echo "[$(date -Iseconds)] auto-approve-hook: AGENT=${OVERDECK_AGENT_ID:-unset} tool=${TOOL_NAME:-unknown}" \
+  >> "$LOG_DIR/auto-approve.log" 2>/dev/null || true
+
+# Overdeck pipeline agents (work + planning) AND conversations, which run
+# autonomously between operator turns. Only a plain human `claude` session
+# (OVERDECK_AGENT_ID unset) keeps normal prompts.
+case "${OVERDECK_AGENT_ID:-}" in
+  agent-*|planning-*|flywheel-*|strike-*|inspect-*|sequencer-*|conv-*) : ;;
+  *) exit 0 ;;
+esac
+
+# Let ask-user-question-hook own AskUserQuestion (its deny summons the dialog).
+if [ "$TOOL_NAME" = "AskUserQuestion" ]; then
+  exit 0
+fi
+
+REASON='Overdeck autonomous pipeline agent auto-approve: headless agent-* sessions replace --dangerously-skip-permissions with this scoped PreToolUse allow hook.'
+
+if command -v jq >/dev/null 2>&1; then
+  jq -n --arg reason "$REASON" '{
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow",
+      permissionDecisionReason: $reason
+    }
+  }'
+else
+  printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Overdeck autonomous pipeline agent auto-approve"}}'
+fi
+
+exit 0

package/sync-sources/hooks/codex-notify-hook

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+// ~/.overdeck/bin/codex-notify-hook  (PAN-1574)
+//
+// Fires via Codex CLI notify mechanism on agent-turn-complete.
+// Codex passes the event JSON as stdin or as a JSON argv argument.
+//
+// Writes ~/.overdeck/agents/<id>/heartbeat.json so codex.ts getHeartbeat
+// can detect turn-end activity. Also writes a `completed` marker used by
+// the recovery path to detect agent idle state.
+
+'use strict';
+
+const { join } = require('node:path');
+const { homedir } = require('node:os');
+const { writeFileSync, mkdirSync, existsSync } = require('node:fs');
+
+const agentId = process.env.OVERDECK_AGENT_ID;
+if (!agentId) process.exit(0); // Not a Overdeck-managed agent
+
+// Read event JSON from stdin (Codex delivers via stdin by default).
+let eventData = {};
+try {
+  const chunks = [];
+  process.stdin.setEncoding('utf8');
+  for (const chunk of []) { chunks.push(chunk); }
+  // Synchronous stdin read — Codex provides the event before invoking the shim.
+  const raw = require('node:fs').readFileSync('/dev/stdin', 'utf8').trim();
+  if (raw) eventData = JSON.parse(raw);
+} catch {
+  // Ignore parse errors — best-effort heartbeat.
+}
+
+const overdeckHome = process.env.OVERDECK_HOME || join(homedir(), '.overdeck');
+const heartbeatsDir = join(overdeckHome, 'heartbeats');
+const agentDir = join(overdeckHome, 'agents', agentId);
+
+try {
+  mkdirSync(heartbeatsDir, { recursive: true });
+  mkdirSync(agentDir, { recursive: true });
+} catch { /* ignore */ }
+
+const timestamp = new Date().toISOString();
+const lastAction = typeof eventData['last-assistant-message'] === 'string'
+  ? eventData['last-assistant-message'].slice(0, 200)
+  : undefined;
+
+const heartbeat = {
+  timestamp,
+  tool_name: 'agent-turn-complete',
+  last_action: lastAction,
+  thread_id: eventData['thread-id'],
+};
+
+// Write heartbeat.json for the 3-tier ladder (tier 1 = active heartbeat <60s).
+try {
+  writeFileSync(join(heartbeatsDir, `${agentId}.json`), JSON.stringify(heartbeat) + '\n');
+} catch { /* ignore */ }
+
+// Write completed marker so recovery path knows the agent finished a turn.
+try {
+  writeFileSync(join(agentDir, 'turn-completed'), timestamp + '\n');
+} catch { /* ignore */ }

package/sync-sources/hooks/gh-issue-trailer-hook

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec node "$SCRIPT_DIR/gh-issue-trailer-hook.js"

package/sync-sources/hooks/gh-issue-trailer-hook.d.ts

@@ -0,0 +1,7 @@
+//#region gh-issue-trailer-hook.d.ts
+type HookEnv = Record<string, string | undefined>;
+declare function rewriteGhIssueCreateCommand(command: string, env?: HookEnv): string | null;
+declare function runGhIssueTrailerHook(input: string, env?: HookEnv): string;
+//#endregion
+export { rewriteGhIssueCreateCommand, runGhIssueTrailerHook };
+//# sourceMappingURL=gh-issue-trailer-hook.d.ts.map

package/sync-sources/hooks/gh-issue-trailer-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-issue-trailer-hook.d.ts","names":[],"sources":["gh-issue-trailer-hook.ts"],"mappings":";KAoBK,OAAA,GAAU,MAAA;AAAA,iBA+OC,2BAAA,CAA4B,OAAA,UAAiB,GAAA,GAAK,OAAA;AAAA,iBAiBlD,qBAAA,CAAsB,KAAA,UAAe,GAAA,GAAK,OAAA"}

package/sync-sources/hooks/gh-issue-trailer-hook.js

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+//#region gh-issue-trailer-hook.ts
+const FLYWHEEL_RUN_ID_PATTERN = /^RUN-\d+$/;
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function tokenize(command) {
+	const tokens = [];
+	let text = "";
+	let start = -1;
+	let quote = null;
+	let escape = false;
+	const flush = (end) => {
+		if (start !== -1) tokens.push({
+			text,
+			start,
+			end
+		});
+		text = "";
+		start = -1;
+	};
+	for (let index = 0; index < command.length; index += 1) {
+		const char = command[index];
+		if (start === -1 && !/\s/.test(char)) start = index;
+		if (escape) {
+			text += char;
+			escape = false;
+			continue;
+		}
+		if (quote === "single") {
+			if (char === "'") quote = null;
+			else text += char;
+			continue;
+		}
+		if (quote === "double") {
+			if (char === "\"") quote = null;
+			else if (char === "\\") escape = true;
+			else text += char;
+			continue;
+		}
+		if (/\s/.test(char)) {
+			flush(index);
+			continue;
+		}
+		if (char === "'") {
+			quote = "single";
+			continue;
+		}
+		if (char === "\"") {
+			quote = "double";
+			continue;
+		}
+		if (char === "\\") {
+			escape = true;
+			continue;
+		}
+		text += char;
+	}
+	flush(command.length);
+	return tokens;
+}
+function findGhIssueCreate(tokens) {
+	for (let index = 0; index <= tokens.length - 3; index += 1) if (tokens[index].text === "gh" && tokens[index + 1].text === "issue" && tokens[index + 2].text === "create") return index;
+	return -1;
+}
+function containsFlywheelRunId(body) {
+	return /^Flywheel-Run-Id:/m.test(body);
+}
+function resolveDiscoveredIn(env) {
+	const agentId = env.OVERDECK_AGENT_ID;
+	if (!agentId || basename(agentId) !== agentId) return null;
+	const statePath = join(env.OVERDECK_HOME ?? join(env.HOME ?? homedir(), ".overdeck"), "agents", agentId, "state.json");
+	if (!existsSync(statePath)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(statePath, "utf-8"));
+		return typeof parsed.issueId === "string" && parsed.issueId.trim() ? parsed.issueId.trim() : null;
+	} catch {
+		return null;
+	}
+}
+function buildTrailer(env) {
+	const runId = env.OVERDECK_FLYWHEEL_RUN_ID?.trim();
+	if (!runId || !FLYWHEEL_RUN_ID_PATTERN.test(runId)) return null;
+	const filedBy = env.OVERDECK_FLYWHEEL_AGENT_ROLE === "flywheel" ? "agent" : "operator";
+	const discoveredIn = resolveDiscoveredIn(env);
+	return `\n\n${[
+		"---",
+		`Flywheel-Run-Id: ${runId}`,
+		`Flywheel-Filed-By: ${filedBy}`,
+		discoveredIn ? `Flywheel-Discovered-In: ${discoveredIn}` : void 0
+	].filter((line) => line !== void 0).join("\n")}\n`;
+}
+function replaceSpan(command, start, end, replacement) {
+	return `${command.slice(0, start)}${replacement}${command.slice(end)}`;
+}
+function findFlag(tokens, ghIndex, flagName) {
+	for (let index = ghIndex + 3; index < tokens.length; index += 1) {
+		const token = tokens[index];
+		if (token.text === flagName) return {
+			flag: token,
+			value: tokens[index + 1],
+			inline: false
+		};
+		if (token.text.startsWith(`${flagName}=`)) return {
+			flag: token,
+			inline: true
+		};
+	}
+	return null;
+}
+function inlineFlagValue(flag) {
+	const equalsOffset = flag.text.indexOf("=");
+	if (equalsOffset === -1) return null;
+	const valueStart = flag.start + equalsOffset + 1;
+	return {
+		value: flag.text.slice(equalsOffset + 1),
+		valueStart,
+		valueEnd: flag.end
+	};
+}
+function appendBodyFlag(command, tokens, ghIndex, trailer) {
+	const bodyFlag = findFlag(tokens, ghIndex, "--body");
+	if (!bodyFlag) return null;
+	const body = bodyFlag.inline ? inlineFlagValue(bodyFlag.flag) : bodyFlag.value;
+	if (!body) return null;
+	const bodyText = "text" in body ? body.text : body.value;
+	if (containsFlywheelRunId(bodyText)) return command;
+	const appended = `${bodyText}${trailer}`;
+	if ("text" in body) return replaceSpan(command, body.start, body.end, shellQuote(appended));
+	return replaceSpan(command, body.valueStart, body.valueEnd, shellQuote(appended));
+}
+function writeTempBodyFile(body) {
+	const path = join(mkdtempSync(join(tmpdir(), "pan-gh-issue-body-")), "body.md");
+	writeFileSync(path, body, "utf-8");
+	return path;
+}
+function appendBodyFileFlag(command, tokens, ghIndex, trailer) {
+	const bodyFileFlag = findFlag(tokens, ghIndex, "--body-file");
+	if (!bodyFileFlag) return null;
+	const pathValue = bodyFileFlag.inline ? inlineFlagValue(bodyFileFlag.flag) : bodyFileFlag.value;
+	if (!pathValue) return null;
+	const pathText = "text" in pathValue ? pathValue.text : pathValue.value;
+	if (pathText === "-") return appendStdinBody(command, tokens[ghIndex].start, trailer);
+	if (!existsSync(pathText)) return null;
+	const body = readFileSync(pathText, "utf-8");
+	if (containsFlywheelRunId(body)) return command;
+	const tempPath = writeTempBodyFile(`${body}${trailer}`);
+	if ("text" in pathValue) return replaceSpan(command, pathValue.start, pathValue.end, shellQuote(tempPath));
+	return replaceSpan(command, pathValue.valueStart, pathValue.valueEnd, shellQuote(tempPath));
+}
+function findPipeBefore(command, beforeIndex) {
+	let quote = null;
+	let escape = false;
+	let pipeIndex = -1;
+	for (let index = 0; index < beforeIndex; index += 1) {
+		const char = command[index];
+		if (escape) {
+			escape = false;
+			continue;
+		}
+		if (quote === "single") {
+			if (char === "'") quote = null;
+			continue;
+		}
+		if (quote === "double") {
+			if (char === "\"") quote = null;
+			else if (char === "\\") escape = true;
+			continue;
+		}
+		if (char === "'") quote = "single";
+		else if (char === "\"") quote = "double";
+		else if (char === "\\") escape = true;
+		else if (char === "|" && command[index + 1] !== "|" && command[index - 1] !== "|") pipeIndex = index;
+	}
+	return pipeIndex;
+}
+function appendHereDoc(command, trailer) {
+	const match = command.match(/(<<-?\s*['"]?([A-Za-z_][A-Za-z0-9_-]*)['"]?[^\n]*\n)([\s\S]*?)(\n\2\s*)$/);
+	if (!match || match.index === void 0) return null;
+	const body = match[3];
+	if (containsFlywheelRunId(body)) return command;
+	const bodyStart = match.index + match[1].length;
+	return replaceSpan(command, bodyStart, bodyStart + body.length, `${body}${trailer}`);
+}
+function appendStdinBody(command, ghStart, trailer) {
+	if (command.includes("Flywheel-Run-Id:")) return command;
+	const hereDoc = appendHereDoc(command, trailer);
+	if (hereDoc) return hereDoc;
+	const pipeIndex = findPipeBefore(command, ghStart);
+	if (pipeIndex === -1) return null;
+	const producer = command.slice(0, pipeIndex).trim();
+	const consumer = command.slice(pipeIndex + 1).trimStart();
+	if (!producer || !consumer) return null;
+	return `{ ${producer}; printf %s ${shellQuote(trailer)}; } | ${consumer}`;
+}
+function buildUpdatedInput(command) {
+	return { hookSpecificOutput: {
+		hookEventName: "PreToolUse",
+		permissionDecisionReason: "Flywheel issue provenance trailers added",
+		updatedInput: { command }
+	} };
+}
+function rewriteGhIssueCreateCommand(command, env = process.env) {
+	const trailer = buildTrailer(env);
+	if (!trailer) return null;
+	const tokens = tokenize(command);
+	const ghIndex = findGhIssueCreate(tokens);
+	if (ghIndex === -1) return null;
+	const bodyCommand = appendBodyFlag(command, tokens, ghIndex, trailer);
+	if (bodyCommand !== null) return bodyCommand === command ? null : bodyCommand;
+	const bodyFileCommand = appendBodyFileFlag(command, tokens, ghIndex, trailer);
+	if (bodyFileCommand !== null) return bodyFileCommand === command ? null : bodyFileCommand;
+	return null;
+}
+function runGhIssueTrailerHook(input, env = process.env) {
+	let event;
+	try {
+		event = JSON.parse(input);
+	} catch {
+		return "{}";
+	}
+	const command = event.tool_name === "Bash" ? event.tool_input?.command : void 0;
+	if (typeof command !== "string") return "{}";
+	const updatedCommand = rewriteGhIssueCreateCommand(command, env);
+	if (!updatedCommand) return "{}";
+	return JSON.stringify(buildUpdatedInput(updatedCommand));
+}
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+	const input = readFileSync(0, "utf-8");
+	process.stdout.write(runGhIssueTrailerHook(input));
+}
+//#endregion
+export { rewriteGhIssueCreateCommand, runGhIssueTrailerHook };
+
+//# sourceMappingURL=gh-issue-trailer-hook.js.map

package/sync-sources/hooks/gh-issue-trailer-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-issue-trailer-hook.js","names":[],"sources":["gh-issue-trailer-hook.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir, tmpdir } from 'node:os';\nimport { basename, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\ninterface PreToolUseEvent {\n  tool_name?: string;\n  tool_input?: {\n    command?: string;\n    [key: string]: unknown;\n  };\n}\n\ninterface Token {\n  text: string;\n  start: number;\n  end: number;\n}\n\ntype HookEnv = Record<string, string | undefined>;\n\nconst FLYWHEEL_RUN_ID_PATTERN = /^RUN-\\d+$/;\n\nfunction shellQuote(value: string): string {\n  return `'${value.replace(/'/g, `'\"'\"'`)}'`;\n}\n\nfunction tokenize(command: string): Token[] {\n  const tokens: Token[] = [];\n  let text = '';\n  let start = -1;\n  let quote: 'single' | 'double' | null = null;\n  let escape = false;\n\n  const flush = (end: number): void => {\n    if (start !== -1) tokens.push({ text, start, end });\n    text = '';\n    start = -1;\n  };\n\n  for (let index = 0; index < command.length; index += 1) {\n    const char = command[index];\n    if (start === -1 && !/\\s/.test(char)) start = index;\n\n    if (escape) {\n      text += char;\n      escape = false;\n      continue;\n    }\n\n    if (quote === 'single') {\n      if (char === \"'\") quote = null;\n      else text += char;\n      continue;\n    }\n\n    if (quote === 'double') {\n      if (char === '\"') quote = null;\n      else if (char === '\\\\') escape = true;\n      else text += char;\n      continue;\n    }\n\n    if (/\\s/.test(char)) {\n      flush(index);\n      continue;\n    }\n\n    if (char === \"'\") {\n      quote = 'single';\n      continue;\n    }\n\n    if (char === '\"') {\n      quote = 'double';\n      continue;\n    }\n\n    if (char === '\\\\') {\n      escape = true;\n      continue;\n    }\n\n    text += char;\n  }\n\n  flush(command.length);\n  return tokens;\n}\n\nfunction findGhIssueCreate(tokens: Token[]): number {\n  for (let index = 0; index <= tokens.length - 3; index += 1) {\n    if (tokens[index].text === 'gh' && tokens[index + 1].text === 'issue' && tokens[index + 2].text === 'create') {\n      return index;\n    }\n  }\n  return -1;\n}\n\nfunction containsFlywheelRunId(body: string): boolean {\n  return /^Flywheel-Run-Id:/m.test(body);\n}\n\nfunction resolveDiscoveredIn(env: HookEnv): string | null {\n  const agentId = env.OVERDECK_AGENT_ID;\n  if (!agentId || basename(agentId) !== agentId) return null;\n\n  const overdeckHome = env.OVERDECK_HOME ?? join(env.HOME ?? homedir(), '.overdeck');\n  const statePath = join(overdeckHome, 'agents', agentId, 'state.json');\n  if (!existsSync(statePath)) return null;\n\n  try {\n    const parsed = JSON.parse(readFileSync(statePath, 'utf-8')) as { issueId?: unknown };\n    return typeof parsed.issueId === 'string' && parsed.issueId.trim() ? parsed.issueId.trim() : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction buildTrailer(env: HookEnv): string | null {\n  const runId = env.OVERDECK_FLYWHEEL_RUN_ID?.trim();\n  if (!runId || !FLYWHEEL_RUN_ID_PATTERN.test(runId)) return null;\n\n  const filedBy = env.OVERDECK_FLYWHEEL_AGENT_ROLE === 'flywheel' ? 'agent' : 'operator';\n  const discoveredIn = resolveDiscoveredIn(env);\n  const lines = [\n    '---',\n    `Flywheel-Run-Id: ${runId}`,\n    `Flywheel-Filed-By: ${filedBy}`,\n    discoveredIn ? `Flywheel-Discovered-In: ${discoveredIn}` : undefined,\n  ].filter((line): line is string => line !== undefined);\n  return `\\n\\n${lines.join('\\n')}\\n`;\n}\n\nfunction replaceSpan(command: string, start: number, end: number, replacement: string): string {\n  return `${command.slice(0, start)}${replacement}${command.slice(end)}`;\n}\n\nfunction findFlag(tokens: Token[], ghIndex: number, flagName: '--body' | '--body-file'): { flag: Token; value?: Token; inline: boolean } | null {\n  for (let index = ghIndex + 3; index < tokens.length; index += 1) {\n    const token = tokens[index];\n    if (token.text === flagName) return { flag: token, value: tokens[index + 1], inline: false };\n    if (token.text.startsWith(`${flagName}=`)) return { flag: token, inline: true };\n  }\n  return null;\n}\n\nfunction inlineFlagValue(flag: Token): { value: string; valueStart: number; valueEnd: number } | null {\n  const equalsOffset = flag.text.indexOf('=');\n  if (equalsOffset === -1) return null;\n  const valueStart = flag.start + equalsOffset + 1;\n  return { value: flag.text.slice(equalsOffset + 1), valueStart, valueEnd: flag.end };\n}\n\nfunction appendBodyFlag(command: string, tokens: Token[], ghIndex: number, trailer: string): string | null {\n  const bodyFlag = findFlag(tokens, ghIndex, '--body');\n  if (!bodyFlag) return null;\n\n  const body = bodyFlag.inline ? inlineFlagValue(bodyFlag.flag) : bodyFlag.value;\n  if (!body) return null;\n  const bodyText = 'text' in body ? body.text : body.value;\n  if (containsFlywheelRunId(bodyText)) return command;\n\n  const appended = `${bodyText}${trailer}`;\n  if ('text' in body) return replaceSpan(command, body.start, body.end, shellQuote(appended));\n  return replaceSpan(command, body.valueStart, body.valueEnd, shellQuote(appended));\n}\n\nfunction writeTempBodyFile(body: string): string {\n  const dir = mkdtempSync(join(tmpdir(), 'pan-gh-issue-body-'));\n  const path = join(dir, 'body.md');\n  writeFileSync(path, body, 'utf-8');\n  return path;\n}\n\nfunction appendBodyFileFlag(command: string, tokens: Token[], ghIndex: number, trailer: string): string | null {\n  const bodyFileFlag = findFlag(tokens, ghIndex, '--body-file');\n  if (!bodyFileFlag) return null;\n\n  const pathValue = bodyFileFlag.inline ? inlineFlagValue(bodyFileFlag.flag) : bodyFileFlag.value;\n  if (!pathValue) return null;\n  const pathText = 'text' in pathValue ? pathValue.text : pathValue.value;\n\n  if (pathText === '-') return appendStdinBody(command, tokens[ghIndex].start, trailer);\n  if (!existsSync(pathText)) return null;\n\n  const body = readFileSync(pathText, 'utf-8');\n  if (containsFlywheelRunId(body)) return command;\n\n  const tempPath = writeTempBodyFile(`${body}${trailer}`);\n  if ('text' in pathValue) return replaceSpan(command, pathValue.start, pathValue.end, shellQuote(tempPath));\n  return replaceSpan(command, pathValue.valueStart, pathValue.valueEnd, shellQuote(tempPath));\n}\n\nfunction findPipeBefore(command: string, beforeIndex: number): number {\n  let quote: 'single' | 'double' | null = null;\n  let escape = false;\n  let pipeIndex = -1;\n\n  for (let index = 0; index < beforeIndex; index += 1) {\n    const char = command[index];\n    if (escape) {\n      escape = false;\n      continue;\n    }\n    if (quote === 'single') {\n      if (char === \"'\") quote = null;\n      continue;\n    }\n    if (quote === 'double') {\n      if (char === '\"') quote = null;\n      else if (char === '\\\\') escape = true;\n      continue;\n    }\n    if (char === \"'\") quote = 'single';\n    else if (char === '\"') quote = 'double';\n    else if (char === '\\\\') escape = true;\n    else if (char === '|' && command[index + 1] !== '|' && command[index - 1] !== '|') pipeIndex = index;\n  }\n\n  return pipeIndex;\n}\n\nfunction appendHereDoc(command: string, trailer: string): string | null {\n  const match = command.match(/(<<-?\\s*['\"]?([A-Za-z_][A-Za-z0-9_-]*)['\"]?[^\\n]*\\n)([\\s\\S]*?)(\\n\\2\\s*)$/);\n  if (!match || match.index === undefined) return null;\n  const body = match[3];\n  if (containsFlywheelRunId(body)) return command;\n  const bodyStart = match.index + match[1].length;\n  const bodyEnd = bodyStart + body.length;\n  return replaceSpan(command, bodyStart, bodyEnd, `${body}${trailer}`);\n}\n\nfunction appendStdinBody(command: string, ghStart: number, trailer: string): string | null {\n  if (command.includes('Flywheel-Run-Id:')) return command;\n\n  const hereDoc = appendHereDoc(command, trailer);\n  if (hereDoc) return hereDoc;\n\n  const pipeIndex = findPipeBefore(command, ghStart);\n  if (pipeIndex === -1) return null;\n\n  const producer = command.slice(0, pipeIndex).trim();\n  const consumer = command.slice(pipeIndex + 1).trimStart();\n  if (!producer || !consumer) return null;\n  return `{ ${producer}; printf %s ${shellQuote(trailer)}; } | ${consumer}`;\n}\n\nfunction buildUpdatedInput(command: string): Record<string, unknown> {\n  return {\n    hookSpecificOutput: {\n      hookEventName: 'PreToolUse',\n      permissionDecisionReason: 'Flywheel issue provenance trailers added',\n      updatedInput: { command },\n    },\n  };\n}\n\nexport function rewriteGhIssueCreateCommand(command: string, env: HookEnv = process.env): string | null {\n  const trailer = buildTrailer(env);\n  if (!trailer) return null;\n\n  const tokens = tokenize(command);\n  const ghIndex = findGhIssueCreate(tokens);\n  if (ghIndex === -1) return null;\n\n  const bodyCommand = appendBodyFlag(command, tokens, ghIndex, trailer);\n  if (bodyCommand !== null) return bodyCommand === command ? null : bodyCommand;\n\n  const bodyFileCommand = appendBodyFileFlag(command, tokens, ghIndex, trailer);\n  if (bodyFileCommand !== null) return bodyFileCommand === command ? null : bodyFileCommand;\n\n  return null;\n}\n\nexport function runGhIssueTrailerHook(input: string, env: HookEnv = process.env): string {\n  let event: PreToolUseEvent;\n  try {\n    event = JSON.parse(input) as PreToolUseEvent;\n  } catch {\n    return '{}';\n  }\n\n  const command = event.tool_name === 'Bash' ? event.tool_input?.command : undefined;\n  if (typeof command !== 'string') return '{}';\n\n  const updatedCommand = rewriteGhIssueCreateCommand(command, env);\n  if (!updatedCommand) return '{}';\n  return JSON.stringify(buildUpdatedInput(updatedCommand));\n}\n\nif (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {\n  const input = readFileSync(0, 'utf-8');\n  process.stdout.write(runGhIssueTrailerHook(input));\n}\n"],"mappings":";;;;;;AAsBA,MAAM,0BAA0B;AAEhC,SAAS,WAAW,OAAuB;AACzC,QAAO,IAAI,MAAM,QAAQ,MAAM,QAAQ,CAAC;;AAG1C,SAAS,SAAS,SAA0B;CAC1C,MAAM,SAAkB,EAAE;CAC1B,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,IAAI,QAAoC;CACxC,IAAI,SAAS;CAEb,MAAM,SAAS,QAAsB;AACnC,MAAI,UAAU,GAAI,QAAO,KAAK;GAAE;GAAM;GAAO;GAAK,CAAC;AACnD,SAAO;AACP,UAAQ;;AAGV,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACtD,MAAM,OAAO,QAAQ;AACrB,MAAI,UAAU,MAAM,CAAC,KAAK,KAAK,KAAK,CAAE,SAAQ;AAE9C,MAAI,QAAQ;AACV,WAAQ;AACR,YAAS;AACT;;AAGF,MAAI,UAAU,UAAU;AACtB,OAAI,SAAS,IAAK,SAAQ;OACrB,SAAQ;AACb;;AAGF,MAAI,UAAU,UAAU;AACtB,OAAI,SAAS,KAAK,SAAQ;YACjB,SAAS,KAAM,UAAS;OAC5B,SAAQ;AACb;;AAGF,MAAI,KAAK,KAAK,KAAK,EAAE;AACnB,SAAM,MAAM;AACZ;;AAGF,MAAI,SAAS,KAAK;AAChB,WAAQ;AACR;;AAGF,MAAI,SAAS,MAAK;AAChB,WAAQ;AACR;;AAGF,MAAI,SAAS,MAAM;AACjB,YAAS;AACT;;AAGF,UAAQ;;AAGV,OAAM,QAAQ,OAAO;AACrB,QAAO;;AAGT,SAAS,kBAAkB,QAAyB;AAClD,MAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,SAAS,GAAG,SAAS,EACvD,KAAI,OAAO,OAAO,SAAS,QAAQ,OAAO,QAAQ,GAAG,SAAS,WAAW,OAAO,QAAQ,GAAG,SAAS,SAClG,QAAO;AAGX,QAAO;;AAGT,SAAS,sBAAsB,MAAuB;AACpD,QAAO,qBAAqB,KAAK,KAAK;;AAGxC,SAAS,oBAAoB,KAA6B;CACxD,MAAM,UAAU,IAAI;AACpB,KAAI,CAAC,WAAW,SAAS,QAAQ,KAAK,QAAS,QAAO;CAGtD,MAAM,YAAY,KADG,IAAI,iBAAiB,KAAK,IAAI,QAAQ,SAAS,EAAE,YAAY,EAC7C,UAAU,SAAS,aAAa;AACrE,KAAI,CAAC,WAAW,UAAU,CAAE,QAAO;AAEnC,KAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa,WAAW,QAAQ,CAAC;AAC3D,SAAO,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,MAAM,GAAG,OAAO,QAAQ,MAAM,GAAG;SACvF;AACN,SAAO;;;AAIX,SAAS,aAAa,KAA6B;CACjD,MAAM,QAAQ,IAAI,0BAA0B,MAAM;AAClD,KAAI,CAAC,SAAS,CAAC,wBAAwB,KAAK,MAAM,CAAE,QAAO;CAE3D,MAAM,UAAU,IAAI,iCAAiC,aAAa,UAAU;CAC5E,MAAM,eAAe,oBAAoB,IAAI;AAO7C,QAAO,OANO;EACZ;EACA,oBAAoB;EACpB,sBAAsB;EACtB,eAAe,2BAA2B,iBAAiB,KAAA;EAC5D,CAAC,QAAQ,SAAyB,SAAS,KAAA,EACzB,CAAC,KAAK,KAAK,CAAC;;AAGjC,SAAS,YAAY,SAAiB,OAAe,KAAa,aAA6B;AAC7F,QAAO,GAAG,QAAQ,MAAM,GAAG,MAAM,GAAG,cAAc,QAAQ,MAAM,IAAI;;AAGtE,SAAS,SAAS,QAAiB,SAAiB,UAA4F;AAC9I,MAAK,IAAI,QAAQ,UAAU,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;EAC/D,MAAM,QAAQ,OAAO;AACrB,MAAI,MAAM,SAAS,SAAU,QAAO;GAAE,MAAM;GAAO,OAAO,OAAO,QAAQ;GAAI,QAAQ;GAAO;AAC5F,MAAI,MAAM,KAAK,WAAW,GAAG,SAAS,GAAG,CAAE,QAAO;GAAE,MAAM;GAAO,QAAQ;GAAM;;AAEjF,QAAO;;AAGT,SAAS,gBAAgB,MAA6E;CACpG,MAAM,eAAe,KAAK,KAAK,QAAQ,IAAI;AAC3C,KAAI,iBAAiB,GAAI,QAAO;CAChC,MAAM,aAAa,KAAK,QAAQ,eAAe;AAC/C,QAAO;EAAE,OAAO,KAAK,KAAK,MAAM,eAAe,EAAE;EAAE;EAAY,UAAU,KAAK;EAAK;;AAGrF,SAAS,eAAe,SAAiB,QAAiB,SAAiB,SAAgC;CACzG,MAAM,WAAW,SAAS,QAAQ,SAAS,SAAS;AACpD,KAAI,CAAC,SAAU,QAAO;CAEtB,MAAM,OAAO,SAAS,SAAS,gBAAgB,SAAS,KAAK,GAAG,SAAS;AACzE,KAAI,CAAC,KAAM,QAAO;CAClB,MAAM,WAAW,UAAU,OAAO,KAAK,OAAO,KAAK;AACnD,KAAI,sBAAsB,SAAS,CAAE,QAAO;CAE5C,MAAM,WAAW,GAAG,WAAW;AAC/B,KAAI,UAAU,KAAM,QAAO,YAAY,SAAS,KAAK,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC;AAC3F,QAAO,YAAY,SAAS,KAAK,YAAY,KAAK,UAAU,WAAW,SAAS,CAAC;;AAGnF,SAAS,kBAAkB,MAAsB;CAE/C,MAAM,OAAO,KADD,YAAY,KAAK,QAAQ,EAAE,qBAAqB,CACvC,EAAE,UAAU;AACjC,eAAc,MAAM,MAAM,QAAQ;AAClC,QAAO;;AAGT,SAAS,mBAAmB,SAAiB,QAAiB,SAAiB,SAAgC;CAC7G,MAAM,eAAe,SAAS,QAAQ,SAAS,cAAc;AAC7D,KAAI,CAAC,aAAc,QAAO;CAE1B,MAAM,YAAY,aAAa,SAAS,gBAAgB,aAAa,KAAK,GAAG,aAAa;AAC1F,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,WAAW,UAAU,YAAY,UAAU,OAAO,UAAU;AAElE,KAAI,aAAa,IAAK,QAAO,gBAAgB,SAAS,OAAO,SAAS,OAAO,QAAQ;AACrF,KAAI,CAAC,WAAW,SAAS,CAAE,QAAO;CAElC,MAAM,OAAO,aAAa,UAAU,QAAQ;AAC5C,KAAI,sBAAsB,KAAK,CAAE,QAAO;CAExC,MAAM,WAAW,kBAAkB,GAAG,OAAO,UAAU;AACvD,KAAI,UAAU,UAAW,QAAO,YAAY,SAAS,UAAU,OAAO,UAAU,KAAK,WAAW,SAAS,CAAC;AAC1G,QAAO,YAAY,SAAS,UAAU,YAAY,UAAU,UAAU,WAAW,SAAS,CAAC;;AAG7F,SAAS,eAAe,SAAiB,aAA6B;CACpE,IAAI,QAAoC;CACxC,IAAI,SAAS;CACb,IAAI,YAAY;AAEhB,MAAK,IAAI,QAAQ,GAAG,QAAQ,aAAa,SAAS,GAAG;EACnD,MAAM,OAAO,QAAQ;AACrB,MAAI,QAAQ;AACV,YAAS;AACT;;AAEF,MAAI,UAAU,UAAU;AACtB,OAAI,SAAS,IAAK,SAAQ;AAC1B;;AAEF,MAAI,UAAU,UAAU;AACtB,OAAI,SAAS,KAAK,SAAQ;YACjB,SAAS,KAAM,UAAS;AACjC;;AAEF,MAAI,SAAS,IAAK,SAAQ;WACjB,SAAS,KAAK,SAAQ;WACtB,SAAS,KAAM,UAAS;WACxB,SAAS,OAAO,QAAQ,QAAQ,OAAO,OAAO,QAAQ,QAAQ,OAAO,IAAK,aAAY;;AAGjG,QAAO;;AAGT,SAAS,cAAc,SAAiB,SAAgC;CACtE,MAAM,QAAQ,QAAQ,MAAM,2EAA2E;AACvG,KAAI,CAAC,SAAS,MAAM,UAAU,KAAA,EAAW,QAAO;CAChD,MAAM,OAAO,MAAM;AACnB,KAAI,sBAAsB,KAAK,CAAE,QAAO;CACxC,MAAM,YAAY,MAAM,QAAQ,MAAM,GAAG;AAEzC,QAAO,YAAY,SAAS,WADZ,YAAY,KAAK,QACe,GAAG,OAAO,UAAU;;AAGtE,SAAS,gBAAgB,SAAiB,SAAiB,SAAgC;AACzF,KAAI,QAAQ,SAAS,mBAAmB,CAAE,QAAO;CAEjD,MAAM,UAAU,cAAc,SAAS,QAAQ;AAC/C,KAAI,QAAS,QAAO;CAEpB,MAAM,YAAY,eAAe,SAAS,QAAQ;AAClD,KAAI,cAAc,GAAI,QAAO;CAE7B,MAAM,WAAW,QAAQ,MAAM,GAAG,UAAU,CAAC,MAAM;CACnD,MAAM,WAAW,QAAQ,MAAM,YAAY,EAAE,CAAC,WAAW;AACzD,KAAI,CAAC,YAAY,CAAC,SAAU,QAAO;AACnC,QAAO,KAAK,SAAS,cAAc,WAAW,QAAQ,CAAC,QAAQ;;AAGjE,SAAS,kBAAkB,SAA0C;AACnE,QAAO,EACL,oBAAoB;EAClB,eAAe;EACf,0BAA0B;EAC1B,cAAc,EAAE,SAAS;EAC1B,EACF;;AAGH,SAAgB,4BAA4B,SAAiB,MAAe,QAAQ,KAAoB;CACtG,MAAM,UAAU,aAAa,IAAI;AACjC,KAAI,CAAC,QAAS,QAAO;CAErB,MAAM,SAAS,SAAS,QAAQ;CAChC,MAAM,UAAU,kBAAkB,OAAO;AACzC,KAAI,YAAY,GAAI,QAAO;CAE3B,MAAM,cAAc,eAAe,SAAS,QAAQ,SAAS,QAAQ;AACrE,KAAI,gBAAgB,KAAM,QAAO,gBAAgB,UAAU,OAAO;CAElE,MAAM,kBAAkB,mBAAmB,SAAS,QAAQ,SAAS,QAAQ;AAC7E,KAAI,oBAAoB,KAAM,QAAO,oBAAoB,UAAU,OAAO;AAE1E,QAAO;;AAGT,SAAgB,sBAAsB,OAAe,MAAe,QAAQ,KAAa;CACvF,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,MAAM;SACnB;AACN,SAAO;;CAGT,MAAM,UAAU,MAAM,cAAc,SAAS,MAAM,YAAY,UAAU,KAAA;AACzE,KAAI,OAAO,YAAY,SAAU,QAAO;CAExC,MAAM,iBAAiB,4BAA4B,SAAS,IAAI;AAChE,KAAI,CAAC,eAAgB,QAAO;AAC5B,QAAO,KAAK,UAAU,kBAAkB,eAAe,CAAC;;AAG1D,IAAI,QAAQ,KAAK,MAAM,cAAc,OAAO,KAAK,IAAI,KAAK,QAAQ,KAAK,IAAI;CACzE,MAAM,QAAQ,aAAa,GAAG,QAAQ;AACtC,SAAQ,OAAO,MAAM,sBAAsB,MAAM,CAAC"}