@pushary/agent-hooks 1.9.0 → 1.9.2

package/dist/{chunk-JW7DKTT6.js → chunk-SI327OZF.js}

@@ -2,14 +2,16 @@ import {
   spawnClaude
 } from "./chunk-XHKBHWLX.js";
 import {
+  CODEX_HOOK_EVENTS,
+  CODEX_REQUIRED_APPROVAL_EVENTS,
   codexHome,
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-R76C43H7.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   getPackageVersion
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";
@@ -20,6 +22,7 @@ var CODEX_HOOK_STATUS = {
   modified: "modified",
   managed: "managed",
   disabled: "disabled",
+  asynchronous: "asynchronous",
   notListed: "not listed"
 };
 var CODEX_APP_SERVER_ARGS = ["app-server"];
@@ -42,11 +45,19 @@ var CODEX_NOT_ASKED = {
 };
 var UNRECOGNISED_LISTING = "Codex answered hooks/list in a shape Pushary does not recognise";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var isCodexListedHook = (value) => isRecord(value) && typeof value.key === "string" && typeof value.eventName === "string" && typeof value.command === "string" && typeof value.sourcePath === "string" && typeof value.enabled === "boolean" && typeof value.isManaged === "boolean" && typeof value.currentHash === "string" && typeof value.trustStatus === "string";
+var hasCodexHookIdentity = (value) => isRecord(value) && typeof value.key === "string" && value.key.length > 0 && typeof value.eventName === "string" && value.eventName.length > 0 && typeof value.sourcePath === "string" && value.sourcePath.length > 0 && typeof value.enabled === "boolean" && typeof value.isManaged === "boolean" && typeof value.currentHash === "string" && value.currentHash.length > 0 && typeof value.trustStatus === "string" && value.trustStatus.length > 0;
+var isCodexListedHook = (value) => hasCodexHookIdentity(value) && (value.handlerType === void 0 || value.handlerType === "command") && typeof value.command === "string" && value.command.length > 0 && (value.async === void 0 || typeof value.async === "boolean");
+var isCodexHookMetadata = (value) => {
+  if (isCodexListedHook(value)) return true;
+  if (!hasCodexHookIdentity(value)) return false;
+  if (value.handlerType === "prompt" || value.handlerType === "agent") return true;
+  return value.handlerType === "mcpTool" && typeof value.server === "string" && value.server.length > 0 && typeof value.tool === "string" && value.tool.length > 0;
+};
 var listedHookFields = (hook) => ({
   key: hook.key,
   eventName: hook.eventName,
   command: hook.command,
+  async: hook.async ?? false,
   sourcePath: hook.sourcePath,
   enabled: hook.enabled,
   isManaged: hook.isManaged,
@@ -67,20 +78,17 @@ var hooksListingOf = (result) => {
   const warnings = [];
   for (const layer of result.data) {
     if (!isRecord(layer) || !Array.isArray(layer.hooks)) return null;
+    if (!layer.hooks.every(isCodexHookMetadata)) return null;
     hooks.push(...layer.hooks.filter(isCodexListedHook).map(listedHookFields));
     warnings.push(...diagnosticMessages(layer.warnings), ...diagnosticMessages(layer.errors));
   }
   return { hooks, warnings };
 };
 var isPusharyHookIn = (hooksJsonPath, hook) => hook.sourcePath === hooksJsonPath && isPusharyCodexCommand(hook.command);
-var isTrustableByPushary = (hook) => hook.enabled && !hook.isManaged && hook.trustStatus !== CODEX_HOOK_STATUS.managed;
+var isTrustableByPushary = (hook) => hook.enabled && !hook.isManaged && hook.trustStatus !== CODEX_HOOK_STATUS.managed && !(CODEX_REQUIRED_APPROVAL_EVENTS.includes(hookEventOf(hook.eventName)) && hook.async === true);
 var pusharyHooksIn = (hooks, hooksJsonPath) => hooks.filter((hook) => isPusharyHookIn(hooksJsonPath, hook));
 var selectPusharyCodexHooks = (hooks, hooksJsonPath) => pusharyHooksIn(hooks, hooksJsonPath).filter(isTrustableByPushary);
-var codexTrustVerdict = (hooks, hooksJsonPath) => {
-  if (pusharyHooksIn(hooks, hooksJsonPath).length === 0) return { kind: "unlisted" };
-  const untrusted = selectPusharyCodexHooks(hooks, hooksJsonPath).filter((hook) => hook.trustStatus !== CODEX_HOOK_STATUS.trusted);
-  return untrusted.length === 0 ? { kind: "trusted" } : { kind: "untrusted", hooks: untrusted };
-};
+var codexTrustVerdict = (hooks, hooksJsonPath) => assessCodexHookTrust(CODEX_HOOK_EVENTS.map((event) => event.event), pusharyHooksIn(hooks, hooksJsonPath));
 var codexTrustEdit = (hooks) => ({
   edits: [{
     keyPath: HOOKS_STATE_KEY_PATH,
@@ -94,16 +102,34 @@ var initializeParams = (clientVersion) => ({
 });
 var hooksListParams = (cwd) => ({ cwds: [cwd] });
 var hookEventOf = (eventName) => eventName.charAt(0).toUpperCase() + eventName.slice(1);
+var trustStatusOf = (hook) => {
+  if (!hook.enabled) return CODEX_HOOK_STATUS.disabled;
+  if (CODEX_REQUIRED_APPROVAL_EVENTS.includes(hookEventOf(hook.eventName)) && hook.async === true) return CODEX_HOOK_STATUS.asynchronous;
+  return hook.trustStatus;
+};
 var readingOf = (hook) => ({
   event: hookEventOf(hook.eventName),
-  status: hook.enabled ? hook.trustStatus : CODEX_HOOK_STATUS.disabled
+  status: trustStatusOf(hook)
 });
-var codexHookTrustByEvent = (events, hooks) => events.map((event) => hooks.map(readingOf).find((reading) => reading.event === event) ?? { event, status: CODEX_HOOK_STATUS.notListed });
-var CODEX_TRUST_FAILURES = /* @__PURE__ */ new Set([CODEX_HOOK_STATUS.untrusted, CODEX_HOOK_STATUS.modified]);
-var isCodexTrustFailure = (reading) => CODEX_TRUST_FAILURES.has(reading.status);
+var codexHookTrustByEvent = (events, hooks) => {
+  const readings = hooks.map(readingOf);
+  const result = [];
+  for (const event of events) {
+    const matching = readings.filter((reading) => reading.event === event);
+    result.push(...matching.length > 0 ? matching : [{ event, status: CODEX_HOOK_STATUS.notListed }]);
+  }
+  return result;
+};
+var isCodexTrustFailure = (reading) => {
+  if (reading.status === CODEX_HOOK_STATUS.trusted || reading.status === CODEX_HOOK_STATUS.managed) return false;
+  if (reading.status === CODEX_HOOK_STATUS.disabled || reading.status === CODEX_HOOK_STATUS.notListed) {
+    return CODEX_REQUIRED_APPROVAL_EVENTS.includes(reading.event);
+  }
+  return true;
+};
 var eventsWithStatus = (readings, status) => readings.filter((reading) => reading.status === status).map((reading) => reading.event);
 var assessCodexHookTrust = (events, hooks) => {
-  const readings = codexHookTrustByEvent(events, hooks);
+  const readings = codexHookTrustByEvent([.../* @__PURE__ */ new Set([...events, ...CODEX_REQUIRED_APPROVAL_EVENTS])], hooks);
   const notListed = eventsWithStatus(readings, CODEX_HOOK_STATUS.notListed);
   if (readings.length > 0 && notListed.length === readings.length) return { kind: "unlisted" };
   const disabled = eventsWithStatus(readings, CODEX_HOOK_STATUS.disabled);
@@ -265,7 +291,7 @@ var confirmationAfterWrite = (listing, hooksJsonPath, writeError) => {
   const verdict = codexTrustVerdict(listing.hooks, hooksJsonPath);
   if (verdict.kind === "trusted") return { kind: "verified", wrote: true };
   if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: listing.warnings };
-  return { kind: "refused", hooks: verdict.hooks.map(readingOf), writeError };
+  return { kind: "refused", hooks: verdict.failures, writeError };
 };
 var trustConversation = (launch, hooksJsonPath) => async (session) => {
   const unavailable = await openSession(session);
@@ -275,7 +301,9 @@ var trustConversation = (launch, hooksJsonPath) => async (session) => {
   const verdict = codexTrustVerdict(before.hooks, hooksJsonPath);
   if (verdict.kind === "trusted") return { kind: "verified", wrote: false };
   if (verdict.kind === "unlisted") return { kind: "unlisted", warnings: before.warnings };
-  const written = await session.request(METHOD_CONFIG_BATCH_WRITE, codexTrustEdit(verdict.hooks));
+  const trustable = selectPusharyCodexHooks(before.hooks, hooksJsonPath).filter((hook) => hook.trustStatus === CODEX_HOOK_STATUS.untrusted || hook.trustStatus === CODEX_HOOK_STATUS.modified);
+  if (trustable.length === 0) return { kind: "refused", hooks: verdict.failures, writeError: null };
+  const written = await session.request(METHOD_CONFIG_BATCH_WRITE, codexTrustEdit(trustable));
   const after = await listHooks(session, launch);
   if (!isListing(after)) return after;
   return confirmationAfterWrite(after, hooksJsonPath, written.kind === "error" ? written.message : null);

package/dist/{chunk-MGXXQHCM.js → chunk-U4DLXAGD.js}

@@ -1,6 +1,6 @@
 import {
   redactSecretsFromContent
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/crypto.ts
 import nacl from "tweetnacl";

package/dist/{chunk-US3RDXK7.js → chunk-UBCTOE5X.js}

@@ -1,9 +1,9 @@
 import {
   configFilePath
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   normalizeInstallSource
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/install-source.ts
 import { readFileSync } from "fs";

package/dist/{chunk-4GMZOGH4.js → chunk-UBNJYMTG.js}

@@ -14,18 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-CPBRXBLG.js";
+} from "./chunk-XOXW4D6P.js";
 import {
   reportedInstallSource
-} from "./chunk-US3RDXK7.js";
+} from "./chunk-UBCTOE5X.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-SDSKTRIV.js";
+} from "./chunk-ABIW72ST.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
+  classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {
@@ -206,8 +207,8 @@ var defaultCancel = async (apiKey, correlationId) => {
   });
 };
 var answeredRoundTrip = (answer, correlationId, latencyMs) => {
-  if (answer.value !== "yes" && answer.value !== "no") {
-    return { kind: "error", detail: "the server reported an answer without a valid Yes or No value" };
+  if (answer.value === void 0 || classifyConfirmResponse(answer.value) === null) {
+    return { kind: "error", detail: "the server reported an answer without a valid Yes, No or defer value" };
   }
   return {
     kind: "answered",

package/dist/{chunk-HSM5FIA3.js → chunk-UX2YSFKS.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-P6VDRQF3.js → chunk-V3P2VSX7.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-VV4SBPCQ.js";
+} from "./chunk-3O4EBTR3.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/{chunk-HNMMKFYN.js → chunk-VMGLXL74.js}

@@ -1,15 +1,15 @@
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-CKPDSFY3.js";
+} from "./chunk-ESME4HN2.js";
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-YJZDIFON.js";
+} from "./chunk-N2ATGXI4.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-IJJ3HHFT.js";
+} from "./chunk-MZXXLIF6.js";
 import {
   announceSubscriptionRequired,
   denyReasonFrom,
@@ -39,7 +39,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-42E4DE6C.js";
+} from "./chunk-35N53QLA.js";
 import {
   DEFAULT_SESSION
 } from "./chunk-N6IOSZOE.js";
@@ -55,20 +55,20 @@ import {
   requestGate,
   sendNotification,
   waitForQuestion
-} from "./chunk-ZMVLKPT7.js";
+} from "./chunk-HZYUDXIH.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-CPBRXBLG.js";
+} from "./chunk-XOXW4D6P.js";
 import {
   getMachineId
-} from "./chunk-VV4SBPCQ.js";
+} from "./chunk-3O4EBTR3.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-SDSKTRIV.js";
+} from "./chunk-ABIW72ST.js";
 import {
   AGENT_QUESTION_STRATEGY,
   GATE_BLOCK_REASON_MAX_LENGTH,
@@ -96,7 +96,7 @@ import {
   parseAgentQuestions,
   resolveGate,
   stoppedOutput
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-LQESQPIT.js → chunk-WCHFDVCC.js}

@@ -4,14 +4,14 @@ import {
 } from "./chunk-XHKBHWLX.js";
 import {
   readControlMode
-} from "./chunk-ZRHA4PGN.js";
+} from "./chunk-ZNUNWWCN.js";
 import {
   getMachineId
-} from "./chunk-VV4SBPCQ.js";
+} from "./chunk-3O4EBTR3.js";
 import {
   pusharyDir,
   resolveGlobalBinary
-} from "./chunk-R76C43H7.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -20,14 +20,14 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   CLI_PACKAGE_NAMES,
   cmdShimTarget,
   getPackageVersion,
   globalPackageFolder,
   globalRootFor
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/daemon-lifecycle.ts
 import { dirname, join, win32 as win32Path } from "path";

package/dist/{chunk-3OFHFVPX.js → chunk-WM2MEFCA.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-R76C43H7.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-CPBRXBLG.js → chunk-XOXW4D6P.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-75CEJ4WP.js";
+} from "./chunk-Y6DSV2OS.js";
 import {
   installNetworkDefaults
-} from "./chunk-P6VDRQF3.js";
+} from "./chunk-V3P2VSX7.js";
 import {
   getBaseUrl
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-BG4QCOHQ.js → chunk-XXSAGQAV.js}

@@ -4,18 +4,18 @@ import {
 } from "./chunk-POFBE6ZY.js";
 import {
   isNetworkFailure
-} from "./chunk-P6VDRQF3.js";
+} from "./chunk-V3P2VSX7.js";
 import {
   clientReportClaims
-} from "./chunk-R76C43H7.js";
+} from "./chunk-HZ57E6LS.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   CLIENT_REPORT_PATH,
   degradedLine
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/client-report-claim.ts
 import { createHash } from "crypto";

package/dist/{chunk-HQWPMVR4.js → chunk-Y4AUVOR7.js}

@@ -1,6 +1,6 @@
 import {
   SETUP_FLAGS
-} from "./chunk-ET6QSY3H.js";
+} from "./chunk-CEHDCHXK.js";
 import {
   parseFlags
 } from "./chunk-GMXKITVA.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-7QLSKOSU.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-SDSKTRIV.js";
+} from "./chunk-ABIW72ST.js";
 import {
   CLAUDE_CONNECTOR_GUIDE,
   CLAUDE_CONNECTOR_STEPS,
@@ -17,7 +17,7 @@ import {
   CLAUDE_CONNECTOR_URL,
   COWORK_CONNECTOR_LIMIT,
   COWORK_STANDING_INSTRUCTIONS
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/cli/cowork.ts
 import { readFileSync } from "fs";

package/dist/{chunk-75CEJ4WP.js → chunk-Y6DSV2OS.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-P6VDRQF3.js";
+} from "./chunk-V3P2VSX7.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-4PCF34AB.js";
+} from "./chunk-ZFDGCEKO.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-KETBIX7I.js → chunk-Y73RBCQD.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-ZRHA4PGN.js";
+} from "./chunk-ZNUNWWCN.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-4PCF34AB.js → chunk-ZFDGCEKO.js}

@@ -1186,6 +1186,7 @@ var isSafeSimpleCommand = (segment) => {
   if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(first) || first.includes("$")) return false;
   if (!isTrustedExecutable(first)) return false;
   const exe = basenameOf(first);
+  if (INSPECTED_ARGUMENT_COMMANDS.has(exe) && argumentsMayExpand(segment)) return false;
   if (exe === "git") {
     const sub = tokens[1];
     if (!sub || sub.startsWith("-")) return false;
@@ -1200,25 +1201,73 @@ var isSafeSimpleCommand = (segment) => {
     }
     return true;
   }
+  if (exe === "sed") return isPrintOnlySed(tokens.slice(1));
+  if (exe === "date") return isReadOnlyDate(tokens.slice(1));
   return SAFE_SHELL_COMMANDS.has(exe);
 };
+var SED_PRINT_ONLY_SCRIPT = /^(?:\d+|\$)(?:,(?:\d+|\$))?p$/;
+var SED_QUIET_FLAG = "-n";
+var DATE_FORMAT_PREFIX = "+";
+var DATE_UTC_FLAG = "-u";
+var isFlagToken = (token) => token.startsWith("-");
+var isPrintOnlySed = (args) => args[0] === SED_QUIET_FLAG && SED_PRINT_ONLY_SCRIPT.test(args[1] ?? "") && !args.slice(2).some(isFlagToken);
+var isReadOnlyDate = (args) => args.every((arg) => arg.startsWith(DATE_FORMAT_PREFIX) || arg === DATE_UTC_FLAG);
+var SINGLE_QUOTE = "'";
+var QUOTED_LITERAL = "_";
+var LITERAL_IN_DOUBLE_QUOTES = /* @__PURE__ */ new Set([";", "|", "&", "<", ">", "*", "?", "[", SHELL_ESCAPE]);
+var READ_ONLY_SEGMENT_SEPARATOR = /&&|\|\||[;|]/g;
+var PIPELINE_CHAIN_SEPARATOR = /&&|\|\||;/g;
+var shellVisibleText = (command) => {
+  let visible = "";
+  let quote = null;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command[index];
+    if (quote === SINGLE_QUOTE) {
+      quote = char === SINGLE_QUOTE ? null : quote;
+      visible += quote === null ? char : QUOTED_LITERAL;
+      continue;
+    }
+    if (quote === SHELL_DOUBLE_QUOTE) {
+      if (char === SHELL_ESCAPE && DOUBLE_QUOTE_ESCAPABLE.has(command[index + 1] ?? "")) return null;
+      quote = char === SHELL_DOUBLE_QUOTE ? null : quote;
+      visible += quote !== null && LITERAL_IN_DOUBLE_QUOTES.has(char) ? QUOTED_LITERAL : char;
+      continue;
+    }
+    if (SHELL_QUOTES.has(char)) quote = char;
+    visible += char;
+  }
+  return quote === null ? visible : null;
+};
+var EXPANSION_THAT_CAN_BECOME_A_FLAG = /\$|(?:^|\s)[*?[]/;
+var SHELL_QUOTE_CHARACTERS = /['"]/g;
+var INSPECTED_ARGUMENT_COMMANDS = /* @__PURE__ */ new Set(["git", "find", "sed", "date"]);
+var argumentsMayExpand = (segment) => {
+  const visible = shellVisibleText(segment);
+  return visible === null || EXPANSION_THAT_CAN_BECOME_A_FLAG.test(visible.replace(SHELL_QUOTE_CHARACTERS, ""));
+};
+var blankedSafeRedirections = (text) => text.replace(SAFE_REDIRECTION, (redirection) => " ".repeat(redirection.length));
+var segmentsSplitWhereVisible = (command, visible, separators) => {
+  const segments = [];
+  let start = 0;
+  for (const separator of visible.matchAll(separators)) {
+    segments.push(command.slice(start, separator.index));
+    start = separator.index + separator[0].length;
+  }
+  segments.push(command.slice(start));
+  return segments;
+};
 var isSafeReadOnlyCommand = (command) => {
   const trimmed = command.trim();
   if (!trimmed || trimmed.length > 2e3) return false;
-  if (/[`\n\r{}]/.test(trimmed)) return false;
-  if (/;|\|\|/.test(trimmed)) return false;
-  if (/\\(?![()!])/.test(trimmed)) return false;
-  if (/(?<!\\)[()]/.test(trimmed)) return false;
-  const noRedir = trimmed.replace(SAFE_REDIRECTION, " ");
-  if (/[<>]/.test(noRedir)) return false;
-  if (noRedir.replace(/&&/g, "  ").includes("&")) return false;
-  for (const andPart of noRedir.split("&&")) {
-    if (!andPart.trim()) return false;
-    for (const segment of andPart.split("|")) {
-      if (!isSafeSimpleCommand(segment)) return false;
-    }
-  }
-  return true;
+  if (/[\n\r]/.test(trimmed)) return false;
+  const visible = shellVisibleText(trimmed);
+  if (visible === null || /[`{}]|\$'/.test(visible)) return false;
+  if (/\\(?![()!])/.test(visible)) return false;
+  if (/(?<!\\)[()]/.test(visible)) return false;
+  const visibleWithoutRedirection = blankedSafeRedirections(visible);
+  if (/[<>]/.test(visibleWithoutRedirection)) return false;
+  if (visibleWithoutRedirection.replace(/&&/g, "  ").includes("&")) return false;
+  return segmentsSplitWhereVisible(blankedSafeRedirections(trimmed), visibleWithoutRedirection, READ_ONLY_SEGMENT_SEPARATOR).every((segment) => segment.trim().length > 0 && isSafeSimpleCommand(segment));
 };
 var isAutoApprove = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "approve";
 var isAutoDeny = (policy) => policy.timeoutSeconds === 0 && policy.timeoutAction === "deny";
@@ -1542,6 +1591,7 @@ var segmentNeedsAPerson = (toolName, segment) => {
   return invocationHidesItsEffect(invocation) || subcommandDestroys(invocation) || classifyDecisionRisk(toolName, normalized) !== "standard" || isCoveredByPolicy(CAPABILITY_PATTERNS.destructive, toolName, normalized) || isCoveredByPolicy(CAPABILITY_PATTERNS.network, toolName, normalized) || isCoveredByPolicy(DATA_LOSS_COMMAND_PATTERNS, toolName, normalized);
 };
 var commandNeedsAPerson = (toolName, command) => {
+  if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
   const segments = readableCommandSegments(command);
   return segments === null || classifyDecisionRisk(toolName, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(toolName, segment));
 };
@@ -1619,11 +1669,7 @@ ${body}`;
   const highConsequence = HIGH_CONSEQUENCE_PATTERNS.some((re) => re.test(scanText));
   return { isCommand: command, commandText, path, highConsequence };
 };
-var isDestructive = (toolName, commandText) => {
-  const haystack = `${toolName ?? ""}
-${commandText}`;
-  return APPROVAL_FATIGUE_FLAG_PATTERNS.some((re) => re.test(haystack));
-};
+var isDestructive = (toolName, commandText) => namesADestructiveAction(toolName ?? "", commandText);
 var addAlnumTokens = (source, set) => {
   for (const raw of source.toLowerCase().split(/[^a-z0-9]+/)) {
     if (raw) set.add(raw);
@@ -1776,11 +1822,27 @@ var SETTLED_OUTCOME = {
   deny: "deny"
 };
 var isSettledOutcome = (value) => typeof value === "string" && SETTLED_OUTCOMES.includes(value);
+var APPROVE_RESPONSES = /* @__PURE__ */ new Set(["yes", "approve", "approved"]);
+var DENY_RESPONSES = /* @__PURE__ */ new Set(["no", "deny", "denied", "reject", "rejected"]);
+var DEFER_RESPONSES = /* @__PURE__ */ new Set(["defer"]);
+var classifyConfirmResponse = (response) => {
+  const normalized = (response ?? "").trim().toLowerCase();
+  if (APPROVE_RESPONSES.has(normalized)) return "approve";
+  if (DENY_RESPONSES.has(normalized)) return "deny";
+  if (DEFER_RESPONSES.has(normalized)) return "defer";
+  return null;
+};
+var commandTextThatCanAct = (command) => {
+  const visible = shellVisibleText(command);
+  return visible === null ? command : segmentsSplitWhereVisible(command, visible, PIPELINE_CHAIN_SEPARATOR).filter((pipeline) => !isSafeReadOnlyCommand(pipeline)).join("\n");
+};
+var destructiveKeywordTarget = (toolName, toolTarget) => toolName === "Bash" ? commandTextThatCanAct(toolTarget) : toolTarget;
+var matchesAnyPattern = (patterns, parts) => parts.some((part) => patterns.some((re) => re.test(part)));
+var namesADestructiveAction = (toolName, toolTarget) => matchesAnyPattern(APPROVAL_FATIGUE_FLAG_PATTERNS, [toolName, destructiveKeywordTarget(toolName, toolTarget)]);
 var classifyDecisionRisk = (toolName, toolTarget) => {
-  const parts = [toolName, toolTarget ?? ""];
-  const matchesAny = (patterns) => parts.some((part) => patterns.some((re) => re.test(part)));
-  if (matchesAny(APPROVAL_FATIGUE_FLAG_PATTERNS)) return "destructive";
-  if (matchesAny(HIGH_CONSEQUENCE_PATTERNS)) return "elevated";
+  const target = toolTarget ?? "";
+  if (namesADestructiveAction(toolName, target)) return "destructive";
+  if (matchesAnyPattern(HIGH_CONSEQUENCE_PATTERNS, [toolName, target])) return "elevated";
   return "standard";
 };
 var POLICY_CAPABILITIES = ["read", "edit", "shell", "network", "destructive"];
@@ -2555,10 +2617,11 @@ var elicitationContentFromAnswers = (ask, answers) => {
 // ../contracts/src/hook-activation.ts
 var hookWritePath = (toolName, input) => toolName === "Write" && typeof input.file_path === "string" && input.file_path.startsWith("/") && input.file_path.length <= 4096 ? input.file_path : void 0;
 var HOOK_ACTIVATION_RESULTS = ["unverified", "approved_executed", "denied_observed", "unexpected_execution", "tool_failed"];
+var MAX_HOOK_ACTIVATION_EVIDENCE_ROWS = 20;
 var isHookActivationReport = (value) => {
   if (!value || typeof value !== "object") return false;
   const report = value;
-  return typeof report.agentType === "string" && typeof report.machineId === "string" && typeof report.target === "string" && report.target.length > 0 && report.target.length <= 4096 && typeof report.truncated === "boolean" && Array.isArray(report.evidence) && report.evidence.length <= 20 && (!report.truncated || report.evidence.length === 0) && report.evidence.every((item) => {
+  return typeof report.agentType === "string" && typeof report.machineId === "string" && typeof report.target === "string" && report.target.length > 0 && report.target.length <= 4096 && typeof report.truncated === "boolean" && Array.isArray(report.evidence) && report.evidence.length <= MAX_HOOK_ACTIVATION_EVIDENCE_ROWS && (!report.truncated || report.evidence.length === 0) && report.evidence.every((item) => {
     if (!item || typeof item !== "object") return false;
     const row = item;
     return ["correlationId", "sessionId", "toolUseId", "toolName", "createdAt"].every((key) => typeof row[key] === "string" && row[key].length > 0 && row[key].length <= 256) && (row.answerSource === null || isAnswerSource(row.answerSource)) && HOOK_ACTIVATION_RESULTS.includes(row.result) && Number.isFinite(Date.parse(row.createdAt)) && (row.occurredAt === null || typeof row.occurredAt === "string" && Number.isFinite(Date.parse(row.occurredAt))) && (row.observedAt === null || typeof row.observedAt === "string" && Number.isFinite(Date.parse(row.observedAt))) && (row.result === "unverified" || row.occurredAt !== null && row.observedAt !== null && row.producer !== null && isAnswerSource(row.answerSource) && row.answerSource !== "sandbox") && (row.producer === null || row.producer === "hook" || row.producer === "uplink");
@@ -2738,6 +2801,7 @@ export {
   redactSecretsDeep,
   degradedLine,
   hookWritePath,
+  MAX_HOOK_ACTIVATION_EVIDENCE_ROWS,
   isHookActivationReport,
   hookActivationResult,
   PAIR_TTL_SECONDS,
@@ -2780,6 +2844,7 @@ export {
   ASK_AGENT_NAME_MAX,
   truncateLine,
   isAnswerSource,
+  classifyConfirmResponse,
   buildDecisionEpisodeFeatures,
   resolveAutoResolveOrigin,
   resolvePolicy,

package/dist/{chunk-ZRHA4PGN.js → chunk-ZNUNWWCN.js}

@@ -1,6 +1,6 @@
 import {
   resolveInstallSourceFor
-} from "./chunk-US3RDXK7.js";
+} from "./chunk-UBCTOE5X.js";
 import {
   backupFile,
   readJsonSafe,
@@ -9,7 +9,7 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   configFilePath
-} from "./chunk-EG46RJRF.js";
+} from "./chunk-L52OIZXV.js";
 
 // src/shell-alias.ts
 import { homedir } from "os";
@@ -110,6 +110,7 @@ var isDisabledExport = (line) => {
   return OUR_EXPORT.test(trimmed.slice(1, -LOGOUT_MARK.length).trim());
 };
 var keyPrefix = (key) => key.split(".")[0] ?? key;
+var manualKeyStepFor = (kind, platform) => kind === "no-rc" || platform === "win32" ? "config-only" : "paste-export";
 var rcResult = (kind, over = {}) => ({
   kind,
   path: null,
@@ -298,6 +299,7 @@ export {
   exportLine,
   isDisabledExport,
   keyPrefix,
+  manualKeyStepFor,
   writeKey,
   clearKey,
   readConfigFileKey,