@pushary/agent-hooks 1.9.26 → 1.9.28

package/dist/{chunk-TVP5UU33.js → chunk-7DXPQW2H.js}

@@ -298,6 +298,7 @@ var normalizeAgentId = (value, accepted) => {
 
 // ../contracts/src/agent-wiring.ts
 var COMPATIBLE_AGENT_TYPES = ["qwen_code", "codebuddy", "qoder", "droid", "devin", "antigravity_cli"];
+var isCompatibleAgentType = (value) => typeof value === "string" && COMPATIBLE_AGENT_TYPES.includes(value);
 var CANONICAL_PATH_KEYS = ["file_path", "path", "notebook_path"];
 var CANONICAL_COMMAND_KEYS = ["command"];
 var SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
@@ -315,7 +316,34 @@ var withCanonicalInputKeys = (profile, toolInput) => {
   return renamed.length === 0 ? toolInput : { ...toolInput, ...Object.fromEntries(renamed) };
 };
 var canonicalToolName = (profile, toolName) => profile.toolAliases[toolName] ?? toolName;
+var TASK_OUTPUT_TOOL = "BashOutput";
+var TASK_STOP_TOOL = "KillShell";
+var BLANK_TASK_INPUT_TOOL = "TaskInput";
+var SHELL_TOOL = "Bash";
+var typesText = (value) => typeof value === "string" && value.trim().length > 0;
+var taskIdOf = (control, toolInput) => typeof toolInput[control.taskKey] === "string" ? { task_id: toolInput[control.taskKey] } : {};
+var typedIntoTask = (control, toolInput) => {
+  const text = toolInput[control.inputKey];
+  if (typesText(text)) return { tool: SHELL_TOOL, input: { command: text }, unreadable: false };
+  return {
+    tool: BLANK_TASK_INPUT_TOOL,
+    input: { ...taskIdOf(control, toolInput), input: typeof text === "string" ? text : "" },
+    unreadable: false
+  };
+};
+var taskControlLookup = (control, toolInput) => {
+  const action = toolInput[control.actionKey];
+  if (action === control.typingAction) return typedIntoTask(control, toolInput);
+  if (action === control.stopAction) return { tool: TASK_STOP_TOOL, input: taskIdOf(control, toolInput), unreadable: false };
+  if (typeof action === "string" && control.outputActions.includes(action)) {
+    return { tool: TASK_OUTPUT_TOOL, input: taskIdOf(control, toolInput), unreadable: false };
+  }
+  return { tool: control.name, input: toolInput, unreadable: false };
+};
+var controlsTasks = (profile, toolName) => profile.taskControl?.name === toolName ? profile.taskControl : void 0;
 var toToolLookup = (profile, toolName, toolInput, resolvePath = (path) => path) => {
+  const taskControl = controlsTasks(profile, toolName);
+  if (taskControl) return taskControlLookup(taskControl, toolInput);
   const tool = canonicalToolName(profile, toolName);
   if (SHELL_TOOLS.has(tool)) {
     const command = firstString(toolInput, [...profile.shellCommandKeys, ...CANONICAL_COMMAND_KEYS]);
@@ -453,7 +481,8 @@ var QWEN_CODE = {
   instructions: { file: [".qwen", "QWEN.md"], label: "Qwen Code" },
   permissionRuleFile: null,
   configDirIsShared: false,
-  soleGate: null
+  soleGate: null,
+  taskControl: null
 };
 var CODEBUDDY = {
   agentType: "codebuddy",
@@ -476,7 +505,8 @@ var CODEBUDDY = {
   instructions: { file: [".codebuddy", "CODEBUDDY.md"], label: "CodeBuddy" },
   permissionRuleFile: [".codebuddy", "settings.json"],
   configDirIsShared: false,
-  soleGate: null
+  soleGate: null,
+  taskControl: null
 };
 var QODER = {
   agentType: "qoder",
@@ -499,7 +529,8 @@ var QODER = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: false,
-  soleGate: null
+  soleGate: null,
+  taskControl: null
 };
 var DROID = {
   agentType: "droid",
@@ -527,7 +558,8 @@ var DROID = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: false,
-  soleGate: null
+  soleGate: null,
+  taskControl: null
 };
 var DEVIN = {
   agentType: "devin",
@@ -560,7 +592,17 @@ var DEVIN = {
   instructions: null,
   permissionRuleFile: null,
   configDirIsShared: false,
-  soleGate: null
+  soleGate: null,
+  taskControl: null
+};
+var ANTIGRAVITY_TASK_CONTROL = {
+  name: "manage_task",
+  actionKey: "Action",
+  taskKey: "TaskId",
+  inputKey: "Input",
+  typingAction: "send_input",
+  outputActions: ["list", "status"],
+  stopAction: "kill"
 };
 var ANTIGRAVITY_CLI = {
   agentType: "antigravity_cli",
@@ -599,8 +641,10 @@ var ANTIGRAVITY_CLI = {
     file: [".gemini", "antigravity-cli", "settings.json"],
     key: "toolPermission",
     value: "always-proceed",
-    receipt: [".pushary", "setup", "antigravity-tool-permission.json"]
-  }
+    receipt: [".pushary", "setup", "antigravity-tool-permission.json"],
+    coveredTools: [ANTIGRAVITY_TASK_CONTROL.name]
+  },
+  taskControl: ANTIGRAVITY_TASK_CONTROL
 };
 var HOOK_COMPATIBLE_PROFILES = Object.freeze([QWEN_CODE, CODEBUDDY, QODER, DROID, DEVIN, ANTIGRAVITY_CLI]);
 var hookCompatibleProfile = (agentType) => HOOK_COMPATIBLE_PROFILES.find((profile) => profile.agentType === agentType);
@@ -989,6 +1033,17 @@ var serializeDeclinedAgents = (agents) => `${JSON.stringify(declinedAgentsDocume
 var withDeclinedAgent = (agents, agent) => canonicalAgents([...agents, agent]);
 var withoutDeclinedAgent = (agents, agent) => agents.filter((candidate) => candidate !== agent);
 
+// ../contracts/src/cli-version-standing.ts
+var FIRST_AUTO_UPDATING_RELEASE = [1, 5, 0];
+var MIN_SAFE_RELEASE = [1, 9, 26];
+var formatReleaseVersion = (version) => version.join(".");
+var FIRST_AUTO_UPDATING_CLI_VERSION = formatReleaseVersion(FIRST_AUTO_UPDATING_RELEASE);
+var MIN_SAFE_CLI_VERSION = formatReleaseVersion(MIN_SAFE_RELEASE);
+
+// ../contracts/src/auto-update-report.ts
+var AUTO_UPDATE_RESULTS = ["updated", "current", "needs_manual", "failed", "finish_pending", "finish_blocked"];
+var isAutoUpdateResult = (value) => typeof value === "string" && AUTO_UPDATE_RESULTS.includes(value);
+
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];
 var normalizeKeyScope = (value) => typeof value === "string" && KEY_SCOPES.includes(value) ? value : null;
@@ -1663,15 +1718,16 @@ var verdictForPolicy = (policy) => {
   return "requires_human";
 };
 var policyIntent = (policy) => isAutoApprove(policy) ? PATTERN_INTENT.grant : PATTERN_INTENT.restrict;
-var selectGoverningRule = (policies, toolName, args, repoKey, sessionId) => {
+var restricts = (policy) => policyIntent(policy) === PATTERN_INTENT.restrict;
+var appliesToThisCall = (policy, repoKey, sessionId) => isRepoKeyMatch(policy.repoKey, repoKey) && (!policy.sessionId || policy.sessionId === sessionId);
+var selectGoverningRule = (policies, toolName, args, repoKey, sessionId, restrictedArgs = args) => {
   let best;
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
   for (const candidate of policies) {
-    if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    if (candidate.sessionId && candidate.sessionId !== sessionId) continue;
-    const rank = matchToolPatternAny(candidate.tool, toolName, args, policyIntent(candidate));
+    if (!appliesToThisCall(candidate, repoKey, sessionId)) continue;
+    const rank = matchToolPatternAny(candidate.tool, toolName, restricts(candidate) ? restrictedArgs : args, policyIntent(candidate));
     if (rank === "none") continue;
     const weight = matchRankWeight(rank);
     const scoped = candidate.sessionId ? 2 : candidate.repoKey ? 1 : 0;
@@ -2448,15 +2504,14 @@ var replacesTheCrontab = ({ program, args }) => program !== void 0 && basenameOf
 var FIND_DELETE = "-delete";
 var FIND_RUNNERS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var FIND_RUNNER_END = /* @__PURE__ */ new Set([";", "+"]);
+var FIND = "find";
+var commandsRunByFind = ({ program, args }) => program === void 0 || basenameOf(program.text) !== FIND ? [] : args.flatMap((arg, index) => FIND_RUNNERS.has(arg.text) ? [{ program: args[index + 1], args: args.slice(index + 2, findRunnerEnd(args, index + 2)) }] : []);
 var losesDataVisibly = (toolName, invocation, normalized, depth) => {
   const { program, args } = invocation;
   if (program === void 0) return false;
   const name = basenameOf(program.text);
-  if (name === "find") {
-    return args.some((arg) => arg.text === FIND_DELETE) || args.some((arg, index) => FIND_RUNNERS.has(arg.text) && invocationHasAVisibleConsequence(toolName, {
-      program: args[index + 1],
-      args: args.slice(index + 2, findRunnerEnd(args, index + 2))
-    }, depth + 1));
+  if (name === FIND) {
+    return args.some((arg) => arg.text === FIND_DELETE) || commandsRunByFind(invocation).some((run) => invocationHasAVisibleConsequence(toolName, run, depth + 1));
   }
   const destructiveArguments = destructiveArgumentsOf(name, args);
   return destructiveArguments !== void 0 && args.some((arg) => namesDestructiveArgument(arg.text, destructiveArguments)) || namesDestructiveWordInAnyCase(name, args.map((arg) => arg.text)) || gitDiscardsWork(invocation) || changesAService(invocation) || replacesTheCrontab(invocation) || isCoveredByPolicy(VISIBLE_DATA_LOSS_PATTERNS, toolName, normalized);
@@ -2619,7 +2674,8 @@ var runsADownloadedScript = (invocations) => {
 var pipedSegmentsOf = (command) => (shellSegmentsReadingAPipe(commandForReading(command)) ?? []).map((segment) => innermostInvocation(invocationOf(withoutShellGrouping(segment))));
 var pipesIntoASqlClient = (command) => pipedSegmentsOf(command).some((invocation) => sqlClientSyntaxOf(invocation) !== void 0);
 var pipesFetchedCodeIntoAnInterpreter = (command, invocations) => invocations.some(fetches) && pipedSegmentsOf(command).some(runsWhatItReads);
-var SHELL_GROUPING_PREFIX = /^\s*(?:(?:if|then|elif|else|do|while|until|!)\s+|[({]\s*)+/;
+var WORDS_THAT_OPEN_A_COMMAND = String.raw`if|then|elif|else|do|while|until|!`;
+var SHELL_GROUPING_PREFIX = new RegExp(String.raw`^\s*(?:(?:${WORDS_THAT_OPEN_A_COMMAND})\s+|[({]\s*)+`);
 var GROUP_OPENER_BY_CLOSER = /* @__PURE__ */ new Map([[")", "("], ["}", "{"]]);
 var occurrencesOf = (text, character) => text.split(character).length - 1;
 var closesAGroupItDidNotOpen = (text) => {
@@ -2736,6 +2792,116 @@ var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
   return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesFetchedCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations);
 };
 var commandHasAVisibleConsequence = (toolName, command) => commandHasAVisibleConsequenceAt(toolName, command, 0);
+var MAX_SPELLING_DEPTH = 3;
+var GIT_GLOBAL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--super-prefix",
+  "--config-env"
+]);
+var GIT_GLOBAL_FLAGS = /* @__PURE__ */ new Set([
+  "-p",
+  "--paginate",
+  "-P",
+  "--no-pager",
+  "--bare",
+  "--exec-path",
+  "--html-path",
+  "--man-path",
+  "--info-path",
+  "--no-replace-objects",
+  "--no-lazy-fetch",
+  "--no-optional-locks",
+  "--no-advice",
+  "--literal-pathspecs",
+  "--glob-pathspecs",
+  "--noglob-pathspecs",
+  "--icase-pathspecs"
+]);
+var GIT_OPTION_AND_ITS_VALUE = 2;
+var GIT_OPTION_ALONE = 1;
+var NOT_A_GIT_GLOBAL_OPTION = 0;
+var gitGlobalOptionWidth = (text) => {
+  if (GIT_GLOBAL_OPTIONS_WITH_A_VALUE.has(text)) return GIT_OPTION_AND_ITS_VALUE;
+  const name = longOptionName(text);
+  return GIT_GLOBAL_OPTIONS_WITH_A_VALUE.has(name) || GIT_GLOBAL_FLAGS.has(name) ? GIT_OPTION_ALONE : NOT_A_GIT_GLOBAL_OPTION;
+};
+var argsAfterGitGlobalOptions = (args) => {
+  let index = 0;
+  while (index < args.length) {
+    const width = gitGlobalOptionWidth(args[index]?.text ?? "");
+    if (width === NOT_A_GIT_GLOBAL_OPTION) break;
+    index += width;
+  }
+  return args.slice(index);
+};
+var gitReadingsPastGlobalOptions = ({ program, args }) => {
+  if (program === void 0 || basenameOf(program.text) !== GIT) return [];
+  const rest = argsAfterGitGlobalOptions(args);
+  return rest.length === args.length ? [] : [{ program, args: rest }];
+};
+var CURRENT_DIRECTORY_STEP = /\/\.(?=\/)/g;
+var LEADING_CURRENT_DIRECTORY = /^(?:\.\/+)+(?=[^/])/;
+var canonicalPathWord = (text) => text.replace(CURRENT_DIRECTORY_STEP, "").replace(LEADING_CURRENT_DIRECTORY, "");
+var verbatimInvocationText = (invocation) => wordsOfInvocation(invocation).map((word) => asOneShellWord(word.text)).join(" ");
+var canonicalInvocationText = (invocation) => invocationTextWith(invocation, (word) => asOneShellWord(canonicalPathWord(word.text)));
+var spellingsOfAnInvocation = (invocation, innermost) => [invocation, innermost, ...gitReadingsPastGlobalOptions(innermost), ...readingsPastGlobalFlags(innermost)].flatMap((reading) => [verbatimInvocationText(reading), canonicalInvocationText(reading)]);
+var NO_INLINE_SCRIPT = { kind: "none" };
+var HIDDEN_INLINE_SCRIPT = { kind: "hidden" };
+var passesAnInlineScript = ({ program, args }) => {
+  const name = basenameOf(program?.text ?? "");
+  return name === EVAL || SHELLS.has(name) && args.some((arg) => SCRIPT_FLAG_CLUSTER.test(arg.text));
+};
+var shellReadsItsScript = (invocation) => SHELLS.has(basenameOf(invocation.program?.text ?? "")) && runsWhatItReads(invocation);
+var inlineScriptsOf = (invocation, heredocs) => {
+  const script = shellScriptOf(invocation);
+  if (script !== null) return { kind: "readable", scripts: [script] };
+  if (passesAnInlineScript(invocation)) return HIDDEN_INLINE_SCRIPT;
+  if (!shellReadsItsScript(invocation)) return NO_INLINE_SCRIPT;
+  return heredocs.length > 0 ? { kind: "readable", scripts: heredocs } : HIDDEN_INLINE_SCRIPT;
+};
+var programIsHidden = ({ program }) => program?.expands ?? false;
+var SUBSTITUTION_AS_A_PROGRAM = new RegExp(String.raw`(?:^|[;&|({\n]|(?:^|[\s;&|({])(?:${WORDS_THAT_OPEN_A_COMMAND})\s)\s*"?(?:\$\(|\`)`);
+var runsASubstitutionAsAProgram = (command) => {
+  const visible = shellVisibleText(withHeredocBodiesSetAside(commandForReading(command)).text);
+  return visible !== null && SUBSTITUTION_AS_A_PROGRAM.test(visible);
+};
+var parsedSpelledSegment = (segment) => {
+  const text = withoutShellGrouping(segment);
+  return { text, invocation: invocationOf(text), heredocs: [], feedsASubstitution: false };
+};
+var roughSpelledSegment = ({ invocation, heredocs, feedsASubstitution }) => ({ text: verbatimInvocationText(invocation), invocation, heredocs, feedsASubstitution });
+var segmentHidesWhatItRuns = (segment, innermost, scripts) => programIsHidden(innermost) || scripts.kind === "hidden" || segment.feedsASubstitution && passesAnInlineScript(innermost);
+var commandsNestedIn = (innermost, scripts) => [
+  ...scripts.kind === "readable" ? scripts.scripts : [],
+  ...commandsRunByFind(innermost).map(verbatimInvocationText)
+];
+var spelledSegmentsOf = (command) => {
+  const parsed = readableCommandSegments(command);
+  return parsed === null ? roughSegmentsOf(command).map(roughSpelledSegment) : parsed.map(parsedSpelledSegment);
+};
+var SPELLINGS_OF_AN_UNREADABLE_COMMAND = { forms: [], hidesWhatItRuns: true };
+var commandSpellingsAt = (command, depth) => {
+  if (depth > MAX_SPELLING_DEPTH) return SPELLINGS_OF_AN_UNREADABLE_COMMAND;
+  const forms = [];
+  let hidesWhatItRuns = runsASubstitutionAsAProgram(command);
+  for (const segment of spelledSegmentsOf(command)) {
+    const innermost = innermostInvocation(segment.invocation);
+    const scripts = inlineScriptsOf(innermost, segment.heredocs);
+    forms.push(segment.text, ...spellingsOfAnInvocation(segment.invocation, innermost));
+    hidesWhatItRuns ||= segmentHidesWhatItRuns(segment, innermost, scripts);
+    for (const nested of commandsNestedIn(innermost, scripts)) {
+      const inner = commandSpellingsAt(nested, depth + 1);
+      forms.push(nested, ...inner.forms);
+      hidesWhatItRuns ||= inner.hidesWhatItRuns;
+    }
+  }
+  return { forms, hidesWhatItRuns };
+};
+var commandSpellings = (command) => commandSpellingsAt(command, 0);
 var withoutSessionToolGrants = (config) => ({
   ...config,
   policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
@@ -3296,9 +3462,10 @@ var findBestRoute = (routes, toolName, args, repoKey) => {
   let bestWeight = 0;
   let bestScoped = -1;
   let bestLength = -1;
+  const { forms } = restrictionReadingOf(routes.map((route) => route.toolPattern), toolName, args);
   for (const candidate of routes) {
     if (!isRepoKeyMatch(candidate.repoKey, repoKey)) continue;
-    const rank = matchToolPatternAny(candidate.toolPattern, toolName, args, PATTERN_INTENT.restrict);
+    const rank = matchToolPatternAny(candidate.toolPattern, toolName, forms, PATTERN_INTENT.restrict);
     if (rank === "none") continue;
     const weight = matchRankWeight(rank);
     const scoped = candidate.repoKey ? 1 : 0;
@@ -3329,11 +3496,39 @@ var isCodexCoordinationTool = (toolName) => CODEX_COORDINATION_TOOL_NAMES.has(to
 var isNamedByARule = (rank) => rank !== void 0 && rank !== "wildcard";
 var isSpecificArgumentRank = (rank) => rank === "exact" || rank === "prefix";
 var shellReadOnlyFloorApplies = (toolName, arg, rank) => !isSpecificArgumentRank(rank) && toolName === "Bash" && typeof arg === "string" && isSafeReadOnlyCommand(arg);
-var coordinationFloorApplies = (toolName, rank) => isCodexCoordinationTool(toolName) && !isNamedByARule(rank);
+var AGENT_TASK_CONTROL_TOOLS = [TASK_OUTPUT_TOOL, TASK_STOP_TOOL];
+var AGENT_TASK_CONTROL_TOOL_NAMES = new Set(AGENT_TASK_CONTROL_TOOLS);
+var readsOrStopsItsOwnWork = (toolName) => isCodexCoordinationTool(toolName) || AGENT_TASK_CONTROL_TOOL_NAMES.has(toolName);
+var coordinationFloorApplies = (toolName, rank) => readsOrStopsItsOwnWork(toolName) && !isNamedByARule(rank);
+var POSIX_SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "Monitor"]);
+var argumentsAsWritten = (args) => ({ forms: args, hidesWhatItRuns: false });
+var namesAnArgumentOf = (pattern, toolName) => pattern.startsWith(`${toolName}(`);
+var isSpelledOut = (form) => form.length > 0;
+var restrictionReadingOf = (restrictingPatterns, toolName, args) => {
+  const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
+  if (command === void 0 || !restrictingPatterns.some((pattern) => namesAnArgumentOf(pattern, toolName))) {
+    return argumentsAsWritten(args);
+  }
+  const spellings = commandSpellings(command);
+  return {
+    forms: [.../* @__PURE__ */ new Set([...args, ...spellings.forms.filter(isSpelledOut)])],
+    hidesWhatItRuns: POSIX_SHELL_TOOLS.has(toolName) && spellings.hidesWhatItRuns
+  };
+};
+var restrictingPatternsOf = (policies) => policies.filter(restricts).map((policy) => policy.tool);
+var policyReadingOf = (policies, toolName, args) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args);
+var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || restraintRank(current.policy) > restraintRank(challenger.policy)) ? current : challenger;
+var restrictsAnArgumentOf = (policy, toolName) => restricts(policy) && namesAnArgumentOf(policy.tool, toolName);
+var strictestRuleNamingAnArgument = (pool, toolName, repoKey, sessionId) => pool.filter((policy) => restrictsAnArgumentOf(policy, toolName) && appliesToThisCall(policy, repoKey, sessionId)).reduce((strictest, policy) => stricterRule(strictest, { policy, rank: "prefix" }), void 0);
+var governingRuleForReading = (pool, toolName, args, reading, repoKey, sessionId) => {
+  const selected = selectGoverningRule(pool, toolName, args, repoKey, sessionId, reading.forms);
+  return reading.hidesWhatItRuns ? stricterRule(selected, strictestRuleNamingAnArgument(pool, toolName, repoKey, sessionId)) : selected;
+};
 var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const rank = selectGoverningRule(config.policies, toolName, args, repoKey, sessionId)?.rank;
+  const reading = policyReadingOf(config.policies, toolName, args);
+  const rank = governingRuleForReading(config.policies, toolName, args, reading, repoKey, sessionId)?.rank;
   if (shellReadOnlyFloorApplies(toolName, arg, rank) || coordinationFloorApplies(toolName, rank)) {
     return DECISION_ORIGIN.safeReadonly;
   }
@@ -3344,28 +3539,37 @@ var wildcardRuleOf = (pool) => {
   return wildcard ? { policy: wildcard, rank: "wildcard" } : void 0;
 };
 var withSiteDelivery = (rule, siteMode) => isAutoApprove(rule.policy) || isAutoDeny(rule.policy) ? rule : { ...rule, policy: { ...rule.policy, mode: siteMode.mode, pushFirstSeconds: siteMode.pushFirstSeconds } };
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
-  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
-  const arg = args[0];
-  const specificRule = (pool) => pool.length === 0 ? void 0 : selectGoverningRule(pool, toolName, args, repoKey, sessionId);
+var layeredGoverningRule = (config, toolName, args, reading, repoKey, sessionId) => {
+  const specificRule = (pool) => pool.length === 0 ? void 0 : governingRuleForReading(pool, toolName, args, reading, repoKey, sessionId);
   const written = config.policies.filter((p) => !p.origin);
   const presets = config.policies.filter((p) => p.origin === "preset");
   const builtins = config.policies.filter((p) => p.origin === "builtin");
   const siteMode = wildcardRuleOf(written);
   const presetRule = specificRule(presets);
-  const match = specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
-  let base = match?.policy ?? {
-    tool: toolName,
-    timeoutSeconds: config.defaultTimeoutSeconds,
-    timeoutAction: config.defaultTimeoutAction,
-    mode: config.defaultMode ?? "push_first",
-    pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
-  };
+  return specificRule(written) ?? (presetRule && siteMode ? withSiteDelivery(presetRule, siteMode.policy) : presetRule) ?? siteMode ?? wildcardRuleOf(presets) ?? specificRule(builtins) ?? wildcardRuleOf(builtins);
+};
+var unmatchedPolicyOf = (config, toolName) => ({
+  tool: toolName,
+  timeoutSeconds: config.defaultTimeoutSeconds,
+  timeoutAction: config.defaultTimeoutAction,
+  mode: config.defaultMode ?? "push_first",
+  pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
+});
+var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => restraintRank(asWritten?.policy ?? unmatched) > restraintRank(asSpelled?.policy ?? unmatched) ? asWritten : asSpelled;
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+  const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
+  const arg = args[0];
+  const unmatched = unmatchedPolicyOf(config, toolName);
+  const asWritten = layeredGoverningRule(config, toolName, args, argumentsAsWritten(args), repoKey, sessionId);
+  const asSpelled = layeredGoverningRule(config, toolName, args, policyReadingOf(config.policies, toolName, args), repoKey, sessionId);
+  const match = stricterOfTheReadings(asWritten, asSpelled, unmatched);
+  let base = match?.policy ?? unmatched;
   const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
   const governedBySessionToolGrant = match?.rank === "tool" && isSessionToolGrant(match.policy);
   const governedByStandingShellAllow = match?.rank === "tool" && isStandingShellAllow(match.policy);
   const governingMode = base.mode;
-  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) || coordinationFloorApplies(toolName, match?.rank));
+  const aRuleNamesASpelling = isSpecificArgumentRank(asSpelled?.rank);
+  const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) && !aRuleNamesASpelling || coordinationFloorApplies(toolName, match?.rank));
   if (governedBySessionToolGrant && !approvedByReadOnlyFloor && typeof arg === "string" && commandNeedsAPerson(toolName, arg)) {
     return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   }
@@ -3580,11 +3784,13 @@ var everyCommandSegmentGranted = (rules, toolName, command) => {
   const segments = readableCommandSegments(command);
   return segments !== null && segments.every((segment) => isSafeReadOnlyCommand(segment) || anyRuleGrants(rules, toolName, [segment]));
 };
-var restrictionFormsOf = (toolName, args) => {
+var agentRuleReadingOf = (rules, toolName, args) => {
+  const reading = restrictionReadingOf([...rules.ask, ...rules.deny], toolName, args);
   const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
   const normalized = command === void 0 ? null : normalizedCommand(command);
-  return normalized === null ? args : [...args, normalized];
+  return normalized === null ? reading : { ...reading, forms: [...reading.forms, normalized] };
 };
+var anyRuleRestrictsReading = (rules, toolName, reading) => anyRuleRestricts(rules, toolName, reading.forms) || reading.hidesWhatItRuns && rules.some((rule) => namesAnArgumentOf(rule, toolName));
 var allowRulesGrant = (rules, toolName, args) => {
   const command = args[0];
   return toolName in POLICY_COMMAND_KEYS && command !== void 0 ? everyCommandSegmentGranted(rules, toolName, command) : anyRuleGrants(rules, toolName, args);
@@ -3596,8 +3802,8 @@ var inputNeedsAPerson = (toolName, toolInput) => {
 };
 var agentRulesAllowEveryInput = (rules, toolName, toolInputs, cwd) => rules.allow.length > 0 && toolInputs.length > 0 && toolInputs.every((toolInput) => {
   const args = policyArgForms(toolName, toolInput, cwd);
-  const restrictionForms = restrictionFormsOf(toolName, args);
-  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestricts(rules.ask, toolName, restrictionForms) && !anyRuleRestricts(rules.deny, toolName, restrictionForms) && !inputNeedsAPerson(toolName, toolInput);
+  const reading = agentRuleReadingOf(rules, toolName, args);
+  return allowRulesGrant(rules.allow, toolName, args) && !anyRuleRestrictsReading(rules.ask, toolName, reading) && !anyRuleRestrictsReading(rules.deny, toolName, reading) && !inputNeedsAPerson(toolName, toolInput);
 });
 var isDefaultRule = (policy) => policy.origin === "builtin" || policy.tool === WILDCARD_TOOL_PATTERN;
 var isApprovalRoutePattern = (value) => typeof value === "object" && value !== null && typeof value.toolPattern === "string" && ["string", "undefined"].includes(typeof value.repoKey);
@@ -3611,7 +3817,8 @@ var aChosenRuleGoverns = (input) => {
   if (routes === null) return true;
   return input.toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
-    return selectGoverningRule(chosen, input.toolName, args, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
+    const reading = policyReadingOf(chosen, input.toolName, args);
+    return governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId) !== void 0 || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
   });
 };
 var claudeAllowlistOwnsCall = (input, verdict, permissionMode, rules) => rules !== null && verdict.kind === "gate" && !verdict.scopeReason && !aChosenRuleGoverns(input) && !isAskedInEveryMode(input.toolName) && claudeConsultsItsAllowlist(permissionMode) && agentRulesAllowEveryInput(rules, input.toolName, input.toolInputs, input.cwd);
@@ -4096,8 +4303,12 @@ export {
   MANAGED_PROVIDERS,
   DISCONNECT_AGENT_IDS,
   normalizeAgentId,
+  isCompatibleAgentType,
   PHONE_ANSWERED_TOOLS,
   canonicalToolName,
+  TASK_OUTPUT_TOOL,
+  TASK_STOP_TOOL,
+  BLANK_TASK_INPUT_TOOL,
   toToolLookup,
   SOLE_GATE_UNDECIDED_REASON,
   SOLE_GATE_SUBSCRIPTION_REASON,
@@ -4133,6 +4344,7 @@ export {
   serializeDeclinedAgents,
   withDeclinedAgent,
   withoutDeclinedAgent,
+  isAutoUpdateResult,
   normalizeKeyScope,
   isApprovalMode,
   approvalModeWithoutLocalPrompt,

package/dist/{chunk-47RVFUEG.js → chunk-7RKX7WRQ.js}

@@ -2,7 +2,7 @@ import {
   DISCONNECT_AGENT_IDS,
   SETUP_AGENT_CHOICES,
   isApprovalMode
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-7DXPQW2H.js";
 
 // src/cli/mode-request.ts
 var parseDuration = (value) => {

package/dist/{chunk-F2HVTVQG.js → chunk-7TBCGHJT.js}

@@ -10,10 +10,10 @@ import {
   resolvePackageVersionFromBinary,
   resolvePathBinary,
   resolvePathBinaryAsync
-} from "./chunk-3TRGUDQ3.js";
+} from "./chunk-TAPGV2YV.js";
 import {
   MANAGED_PROVIDERS
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-7DXPQW2H.js";
 
 // src/setup/codex-install.ts
 var NATIVE_BINARY_MIN_BYTES = 20 * 1024 * 1024;

package/dist/{chunk-BWXRLXNE.js → chunk-7ZWU4BNG.js}

@@ -4,7 +4,7 @@ import {
   forkFinishWithUpgradeLock,
   installWithUpgradeLock,
   releaseAutoUpdateLock
-} from "./chunk-I52A3NLY.js";
+} from "./chunk-YTCMVHW5.js";
 import {
   describeAutoUpdateCheck,
   globalInstallLocation,
@@ -14,7 +14,7 @@ import {
   readAutoUpdateState,
   updateAutoUpdateState,
   upgradeEntryFor
-} from "./chunk-TS3CRCI7.js";
+} from "./chunk-IWYBFBRW.js";
 import {
   EXIT
 } from "./chunk-KZERVKTD.js";
@@ -27,10 +27,10 @@ import {
   npmErrorMessage,
   readGlobalCliInstallAt,
   readGlobalPrefix
-} from "./chunk-3TRGUDQ3.js";
+} from "./chunk-TAPGV2YV.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-47RVFUEG.js";
+} from "./chunk-7RKX7WRQ.js";
 import {
   commandsPackage,
   globalUpgradeEntry,
@@ -39,7 +39,7 @@ import {
   isSameMajorVersion,
   ownPackageRoot,
   packageVersionAt
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-7DXPQW2H.js";
 
 // src/global-upgrade.ts
 import { existsSync } from "fs";

package/dist/{chunk-GEN4YTNR.js → chunk-A24TEUD6.js}

@@ -1,20 +1,20 @@
 import {
   defersToNativeMode,
   reportMachineDenial
-} from "./chunk-FA3YPD4P.js";
+} from "./chunk-YRB2VBKK.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "./chunk-3DLVLVEM.js";
+} from "./chunk-BG7T5MNV.js";
 import {
   announceSubscriptionRequired,
   isDeferAnswer,
   oncePerSession
-} from "./chunk-ZXYHVZZZ.js";
+} from "./chunk-ZH32OREM.js";
 import {
   activeHookSource,
   activeIdentity
-} from "./chunk-AXOMDPA7.js";
+} from "./chunk-ZX5ISG5O.js";
 import {
   DEFAULT_SESSION,
   UNNAMED_ACTION,
@@ -39,7 +39,7 @@ import {
   reportEvent,
   scopePathFor,
   settleQuestionsForToolUse
-} from "./chunk-BIV2LKDK.js";
+} from "./chunk-FD3QASU3.js";
 import {
   askUser,
   cancelQuestion,
@@ -51,20 +51,20 @@ import {
   sendNotification,
   waitForQuestion,
   waitsForThePhone
-} from "./chunk-DDRSG6JL.js";
+} from "./chunk-3TF5FHAT.js";
 import {
   SubscriptionRequiredError
-} from "./chunk-AG5ATWVT.js";
+} from "./chunk-ZREXC363.js";
 import {
   getMachineId
-} from "./chunk-4YWINUPJ.js";
+} from "./chunk-IWPQBWFN.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-5UKZXDHV.js";
+} from "./chunk-OK4WDRGM.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-47RVFUEG.js";
+} from "./chunk-7RKX7WRQ.js";
 import {
   AGENT_QUESTION_STRATEGY,
   DECISION_STOP_REASON,
@@ -106,7 +106,7 @@ import {
   questionHandedToTheTerminal,
   resolveGate,
   timeoutActionWithoutLocalPrompt
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-7DXPQW2H.js";
 
 // src/claude-permission-rules.ts
 import { readFileSync, statSync } from "fs";

package/dist/{chunk-RZTIB2TY.js → chunk-AR7XOG6W.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-3EGEA4KH.js";
 import {
   getBaseUrl
-} from "./chunk-5UKZXDHV.js";
+} from "./chunk-OK4WDRGM.js";
 
 // src/cli/login-ui.ts
 import { hostname } from "os";

package/dist/{chunk-4GKLAQY4.js → chunk-AXGA3WJI.js}

@@ -1,6 +1,6 @@
 import {
   getBaseUrl
-} from "./chunk-5UKZXDHV.js";
+} from "./chunk-OK4WDRGM.js";
 
 // src/transcript-api.ts
 var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {

package/dist/{chunk-3DLVLVEM.js → chunk-BG7T5MNV.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-7DXPQW2H.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-2YF72RC5.js → chunk-BXUYF5HB.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-XUVKAWV3.js";
+} from "./chunk-V5BIWNB3.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-3TRGUDQ3.js";
+} from "./chunk-TAPGV2YV.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-TVP5UU33.js";
+} from "./chunk-7DXPQW2H.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";