@r1z4x/tezgah 1.13.0 → 1.14.0

package/hosts/opencode/plugins/tezgah.js

@@ -190,17 +190,17 @@ const EXPLORE_DENY =
 // as _CREDIT is there. The parity test in tests/test_opencode_plugin.py reads
 // this literal and the Python one and fails if the two alternations differ.
 const ATTRIB =
-  /co-authored-by\s*:|generated with|made with|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+(?:with|using)\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|gemini|deepseek|openai|anthropic)(?:-[\w.]+)?(?:\s+(?:code|cli))?(?:\s*\([^)\n]*\))?(?=[.!)\]*_`]*(?:[\x22\x27,;]|\s+-\s|\s*(?:\n|$)))|noreply@anthropic|\u{1F916}/iu
+  /co-authored-by\s*[:=]|generated with|made with|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+(?:with|using)\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|gemini|deepseek|openai|anthropic)(?:-[\w.]+)?(?:\s+(?:code|cli))?(?:\s*\([^)\n]*\))?(?=[.!)\]*_`]*(?:[\x22\x27,;]|\s+-\s|\s*(?:\n|$)))|noreply@anthropic|\u{1F916}/iu
 // The same forms anchored to the start of a line, for the text a write/edit
 // tool is about to land. Mirrors hooks/tezgah_gate.py ATTRIB_LINE: a credit owns
 // its line, while prose naming the ban does not, and that anchor is what keeps
 // the rule from denying the documentation that describes it.
 const ATTRIB_LINE =
-  /^[\s>#*/<!+-]*(?:co-authored-by\s*:|generated with|made with|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+(?:with|using)\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|gemini|deepseek|openai|anthropic)(?:-[\w.]+)?(?:\s+(?:code|cli))?(?:\s*\([^)\n]*\))?(?=[.!)\]*_`]*(?:[\x22\x27,;]|\s+-\s|\s*(?:\n|$)))|noreply@anthropic|\u{1F916})/imu
+  /^[\s>#*/<!+-]*(?:co-authored-by\s*[:=]|generated with|made with|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+(?:with|using)\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|gemini|deepseek|openai|anthropic)(?:-[\w.]+)?(?:\s+(?:code|cli))?(?:\s*\([^)\n]*\))?(?=[.!)\]*_`]*(?:[\x22\x27,;]|\s+-\s|\s*(?:\n|$)))|noreply@anthropic|\u{1F916})/imu
 const EDIT_TEXT = ["content", "new_string", "newString", "new_str", "file_text",
   "patch", "text"]
 const WRITE_CMD =
-  /(?:^|[|;&]\s*|\s)git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*(?:commit|merge|tag|notes)\b|(?:^|[|;&]\s*|\s)gh\s+api\b|(?:^|[|;&]\s*|\s)gh\s+(?:pr|issue|release)\s+(?:create|edit|comment|review|merge|close)\b/i
+  /(?:^|[|;&]\s*|\s)(?:\S*\/)?git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*(?:commit|merge|tag|notes)\b|(?:^|[|;&]\s*|\s)(?:\S*\/)?gh\s+api\b|(?:^|[|;&]\s*|\s)(?:\S*\/)?gh\s+(?:pr|issue|release)\s+(?:create|edit|comment|review|merge|close)\b/i
 const ATTRIB_DENY =
   "Attribution is banned in every artifact tezgah touches. Remove the " +
   "Co-Authored-By / \"Generated with\" / robot-emoji / model-name credit from " +
@@ -314,12 +314,45 @@ const LEDGER_TAIL = 200
 // hooks/tezgah_integrity.VERIFY).
 const RUNNER_FLAGS =
   "(?:(?:--filter|--prefix|--workspace|--cwd|--dir|-C|-w)\\s+\\S+\\s+|-\\S+\\s+)*"
+// hooks/tezgah_integrity.WRAPPER_VALUE_OPTS and _wrapper_prefix: the wrappers
+// a check may sit behind, each with its env assignments, options, the options'
+// values (a short one may close a cluster, `sudo -Hu deploy`) and `timeout`'s
+// duration, so `timeout 60 pytest` and `nice -n 5 pytest` are checks on both
+// sides (B-121; VerifyParity pins the agreement). The core reads this prefix
+// case-sensitively inside its `re.I` (`(?-i:...)`), which node cannot spell, so
+// WRAPPER_RUN strips it from the text with a regex of its own before VERIFY
+// reads it: `sudo -H true pytest` runs `true`, as there. A value never starts
+// with `-` nor looks like an assignment, so a failed match stays linear.
+const WRAPPER_VALUE_OPTS = {
+  sudo: ["-u", "--user", "-g", "--group", "-h", "--host", "-p", "--prompt",
+    "-C", "--close-from", "-D", "--chdir", "-r", "--role", "-t", "--type",
+    "-U", "--other-user", "-T", "--command-timeout"],
+  env: ["-u", "--unset", "-C", "--chdir", "-S", "-P", "-L", "-U"],
+  nice: ["-n", "--adjustment"], nohup: [], exec: ["-a"], command: [],
+  builtin: [], time: ["-f", "--format", "-o", "--output"],
+  timeout: ["-s", "--signal", "-k", "--kill-after"],
+  stdbuf: ["-i", "--input", "-o", "--output", "-e", "--error"],
+  ionice: ["-c", "--class", "-n", "--classdata", "-p", "--pid"],
+  caffeinate: ["-t", "-w"],
+}
+const reEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+const WRAPPER_VALUE = "(?!\\w+=)[^-\\s]\\S*\\s+"
+const WRAPPER_PREFIX = "(?:(?:[\\w./-]*/)?(?:" + Object.entries(WRAPPER_VALUE_OPTS)
+  .map(([name, opts]) => {
+    const shorts = [...new Set(opts.filter((o) => o.length === 2 && o !== "-S")
+      .map((o) => o[1]))].sort().join("")
+    const valued = (shorts ? "-[A-Za-z]*[" + reEscape(shorts) + "]\\s+" + WRAPPER_VALUE + "|" : "") +
+      opts.filter((o) => o.startsWith("--"))
+        .map((o) => reEscape(o) + "\\s+" + WRAPPER_VALUE + "|").join("")
+    return reEscape(name) + "\\s+(?:\\w+=\\S+\\s+|" + valued + "-\\S+\\s+)*" +
+      (name === "timeout" ? "(?:\\d\\S*\\s+)?" : "")
+  }).join("|") + "))*"
+const WRAPPER_RUN = new RegExp("((?:^|[|;&(\\n])\\s*)" + WRAPPER_PREFIX, "g")
 const VERIFY = new RegExp(
   // command position only: `echo pytest` is not a check, and a `\\s` prefix made
   // the port read one where hooks/tezgah_integrity.VERIFY does not (review of
-  // plan 135) - the wrapper set keeps `sudo pytest` and `env X=1 pytest`
-  "(?:^|[|;&(\\n])\\s*(?:(?:sudo|env|time|nohup|command|exec)\\s+" +
-  "(?:\\w+=\\S+\\s+)*(?:-\\S+\\s+)*)?(?:" +
+  // plan 135)
+  "(?:^|[|;&(\\n])\\s*(?:" +
   "(?:python3?|uv run)\\s+(?:(?:--project|--with|--python|--extra|--group|-p|-w)" +
   "\\s+\\S+\\s+|-\\S+\\s+)*(?:python3?\\s+-m\\s+)?" +
   "(?:pytest|unittest|mypy|ruff|flake8|compileall)|" +
@@ -337,14 +370,27 @@ const VERIFY = new RegExp(
   "bunx?|uvx)\\s+(?:-\\S+\\s+)*(?:playwright|cypress|storybook|chromatic|percy|" +
   "lighthouse|pa11y|axe-core|backstop|reg-suit|vitest|jest|ava|mocha|eslint|" +
   "prettier|tsc|pyright))\\b", "i")
-const NEUTER = /\|\|\s*(?:true|:|exit\s+0)(?:\s|$|[|;&])|;\s*true\s*(?:$|[|;&])/
+// hooks/tezgah_integrity.NEUTER, the same alternatives: `|| true`, `|| :`,
+// `|| exit 0`, `; true`, `; :` and `; exit 0` after a check. Also the bound on
+// asking the core about a swallowed check: its own VERIFY decides the check.
+const NEUTER = /\|\|\s*(?:true|:|exit\s+0)(?:\s|$|[|;&])|;\s*(?:true|:|exit\s+0)\s*(?:$|[|;&])/
+// The bound on asking the core about the rest of the shortcut rule
+// (hooks/tezgah_integrity.shortcut_command): a commit or push whose hooks a
+// wrapper's options, an `eval` or an env var might hide, and an EXIT trap that
+// could swallow a check's status. The core's readers step over the wrappers and
+// open `eval`; this mirror's own (shortcutCommand) still runs after the core,
+// and alone when the core cannot answer.
+const SHORTCUT_CMD = /\b(?:commit|push|eval|trap)\b|--no-verify|\b(?:SKIP|HUSKY_SKIP_HOOKS|HUSKY)\s*=/i
 const SKIP_ENV = /\b(?:SKIP|HUSKY_SKIP_HOOKS)\s*=|\bHUSKY=0\b/
 const NO_VERIFY = /--no-verify\b/
 const GITISH = /\b(?:git|commit|push|husky|pre-commit|npm|yarn|pnpm)\b/i
 // mirrors _shell_segments/_hooks_redirect in hooks/tezgah_integrity.py: a
 // core.hooksPath assignment in the same line as a git commit/push skips the
-// hooks like --no-verify; read word by word through shellWords (shlex's reading)
-const HOOKS_KEY = "core.hookspath"
+// hooks like --no-verify; read word by word through shellWords (shlex's reading).
+// HOOKS_KEYS is the core's: an include (`include.path`, `includeIf.<cond>.path`)
+// can carry a hooksPath too.
+const HOOKS_KEYS = /core\.hookspath|include\.path|includeif\..+\.path/
+const HOOKS_KEYS_FULL = new RegExp("^(?:" + HOOKS_KEYS.source + ")$")
 const GIT_CONFIG_ENV = /^GIT_CONFIG_(?:KEY_\d+|PARAMETERS)$/
 const ENV_WORD = /^[A-Za-z_]\w*=/
 const GIT_VALUE_OPTS = new Set(["-C", "-c", "--git-dir", "--work-tree",
@@ -548,13 +594,43 @@ function shellSegments(cmd) {
 // the separators after a check that keep its status the line's
 // (hooks/tezgah_integrity.OWNING_SEP)
 const OWNING_SEP = /^[()]*(?:&&|\|&?)[()]*$/
+// hooks/tezgah_integrity.trap_owns_status: a trap may own the line's status
+// unless it is an EXIT (or 0) trap whose every command is plain cleanup
+// (TRAP_CLEANUP). Any other action can end the shell with a status of its own,
+// an ERR/DEBUG/RETURN trap runs in the middle of the check, and a `trap` word
+// the line's own commands do not set (inside a string, an `eval`, a function
+// body, behind a wrapper) counts the same way. The word is counted with quotes
+// and backslashes taken out, so `t''rap` and `t\rap` are traps here too, and a
+// trap on a line with ANSI-C quoting (`$'...'`) is never read as cleanup - a
+// lost credit, never an invented one.
+const TRAP_WORD = /(?<![\w.-])trap(?![\w.-])/g
+const TRAP_CLEANUP = new Set(["rm", "echo", "printf", ":"])
+function trapOwnsStatus(cmd) {
+  const seen = (cmd.replace(/['"\\]/g, "").match(TRAP_WORD) || []).length
+  const traps = shellSegments(cmd).map((words) => {
+    let i = 0
+    while (i < words.length && (ENV_WORD.test(words[i]) || SECRET_KEYWORDS.has(words[i]))) i++
+    return words.slice(i)
+  }).filter((words) => words[0] === "trap")
+  if (traps.length < seen || (traps.length && cmd.includes("$'"))) return true
+  for (const words of traps) {
+    const args = words.slice(1).filter((w) => w !== "--")
+    if (args.length < 2 || args[0] === "-") continue  // a listing or a reset
+    if (args.slice(1).some((s) => !["EXIT", "0"].includes(s.toUpperCase().replace(/^SIG/, ""))))
+      return true
+    if (shellSegments(args[0]).some((w) => !w.length || !TRAP_CLEANUP.has(w[0]))) return true
+  }
+  return false
+}
 
 // True when the line's exit status is not its check's
 // (hooks/tezgah_integrity.status_hidden): a pipe owns it unless the line opens
 // with `set -o pipefail` and has no `||`, or a command after the check does -
 // a `;`, a newline or a trailing `&` - unless that command is `exit $?`. A
-// heredoc body and its terminator are data.
+// heredoc body and its terminator are data. A trap may own it too
+// (trapOwnsStatus).
 function statusHidden(cmd) {
+  if (trapOwnsStatus(cmd)) return true
   if (cmd.includes("|") && (cmd.includes("||") ||
       !/^\s*set\s+(?:-\w+\s+)*-\w*o\s+pipefail\s*(?:;|&&|\n)/.test(cmd))) return true
   const body = heredocBytes(cmd)
@@ -562,6 +638,10 @@ function statusHidden(cmd) {
     body[k] && ch !== "\n" ? " " : ch).join(""))
   for (let i = 0; i < cmds.length; i++) {
     if (!verifyCommand(cmds[i][0].map(quoteWord).join(" "))) continue
+    // an `exit`, or an `exec` that runs a command, before the check ends the
+    // line with its own status (`exit 0; pytest` never runs pytest)
+    if (cmds.slice(0, i).some(([w]) => w[0] === "exit" || (w[0] === "exec" && w.length > 1)))
+      return true
     for (let k = i; k < cmds.length - 1; k++) {
       if (OWNING_SEP.test(cmds[k][1])) continue
       const next = cmds[k + 1][0].join(" ")
@@ -580,7 +660,7 @@ function quoteWord(word) {
 
 function namesHooksKey(setting) {
   // a leading `$`: bash reads `$'core.hooksPath'` as the plain key, shlex keeps it
-  return setting.replace(/^\$+/, "").toLowerCase().split("=")[0] === HOOKS_KEY
+  return HOOKS_KEYS_FULL.test(setting.replace(/^\$+/, "").toLowerCase().split("=")[0])
 }
 
 function hooksRedirect(cmd) {
@@ -593,7 +673,7 @@ function hooksRedirect(cmd) {
       if (ENV_WORD.test(words[i])) {
         const eq = words[i].indexOf("=")
         if (GIT_CONFIG_ENV.test(words[i].slice(0, eq)) &&
-            words[i].slice(eq + 1).toLowerCase().includes(HOOKS_KEY)) assigns = true
+            HOOKS_KEYS.test(words[i].slice(eq + 1).toLowerCase())) assigns = true
       }
       i++
     }
@@ -619,7 +699,7 @@ function hooksRedirect(cmd) {
         CONFIG_READ_OPTS.has(a)) || (head.length > 0 && CONFIG_READ_SUBS.has(head[0]))
       const positional = head.filter((a) => !a.startsWith("-"))
         .concat(cut >= 0 ? args.slice(cut + 1) : [])
-      if (!reads && positional.length >= 2 && positional[0] === HOOKS_KEY) assigns = true
+      if (!reads && positional.length >= 2 && HOOKS_KEYS_FULL.test(positional[0])) assigns = true
     }
   }
   return assigns && writes
@@ -657,13 +737,18 @@ const WRITE_TOOLS = new Set(["edit", "write", "multiedit", "notebookedit",
 // hosts send.
 const BASH_TOOLS = new Set(["bash", "shell", "command", "exec_command",
   "run_command", "powershell", "pwsh"])
-// The control rule's shell half (`hooks/tezgah_gate.control_reason`): a line
-// that could change tezgah's own control plane - a program that writes, removes
-// or moves a path, or a redirect, before a name that plane holds; or one of its
-// CLIs with an argument. The rule, its path table and its `~`/`$HOME`/XDG
-// expansion are the core's; this is only the bound on asking, loose the same
-// way IDENT_CMD is: a false hit costs one spawn whose answer comes back empty.
-const CONTROL_CMD = /(?:\b(?:touch|rm|rmdir|unlink|shred|truncate|chmod|chown|chgrp|mv|mkdir|tee|cp|ln|install|rsync|dd|sed|perl|git|sh|bash|zsh)\b|>)[\s\S]*(?:tezgah|\.no-|\.husky|\.git\/hooks|\.claude|\.codex|\.cursor|opencode|\.omp|\.local\/share)|\btezgah-(?:gate(?:\.py)?\s+decide|(?:capture|pony|adhd)(?:\.py)?\s+\S|context(?:\.py)?\s+(?:attest|user_prompt)\b|(?:codex|cursor)-hook\b)|\bprojects-(?:auto-init|pretooluse|posttooluse|stop)\b|\bhook\.py\b/
+// The shell lines the core is asked about first: every line with a write shape
+// its rules read - a redirect (a descriptor copy such as `2>&1` names no file,
+// as `shell_control` reads it), a program that writes, removes or moves a path
+// (hooks/tezgah_gate.CONTROL_PROGRAMS, OPTION_TARGETS, `tar`), a git staging
+// command (hooks/tezgah_gate.STAGING) or `git config` - and tezgah's own CLIs,
+// however the program word is quoted, and hook entries. The control rule
+// (`control_reason`) follows a `cd`, expands `~`/`$HOME`/XDG and refuses the
+// removal of a directory that holds its state, and the workspace and credential
+// rules read the write's target, so no path shape can stand in for them here:
+// this is only the bound on asking, loose the same way IDENT_CMD is - a false
+// hit costs one spawn whose answer comes back empty.
+const CONTROL_CMD = />(?!&(?:\d+|-)(?=$|[\s;&|)]))|\b(?:touch|rm|rmdir|unlink|shred|truncate|chmod|chown|chgrp|mv|mkdir|tee|cp|ln|install|rsync|dd|sed|perl|sqlite3|curl|wget|unzip|tar|ditto|mkfifo|mknod)\b|\bgit\b[\s\S]*\b(?:add|config|stage|commit|update-index)\b|\btezgah-(?:gate(?:\.py)?\b[^|;&\n]*\bdecide\b|capture\b|pony\b|adhd\b|context(?:\.py)?\b[^|;&\n]*\b(?:attest|user_prompt)\b|[\w-]+-hook\b)|\bprojects-(?:auto-init|pretooluse|posttooluse|stop)\b|\bhook\.py\b/i
 // The same bound for the language rule: the command shapes that dream up an
 // identifier which outlives the session - `git commit` (its message), `git
 // checkout -b`/`-B`/`--branch` and `git switch -c`/`-C`/`--create` (a branch),
@@ -682,7 +767,7 @@ const CONTROL_CMD = /(?:\b(?:touch|rm|rmdir|unlink|shred|truncate|chmod|chown|ch
 // comes first and the language rule comes first there too
 // (hooks/tezgah_gate.decision order).
 const IDENT_CMD =
-  /\bgit\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*(?:commit\b|checkout\s+(?:-\S+\s+)*(?:-b|-B|--branch)\s+\S|switch\s+(?:-\S+\s+)*(?:-c|-C|--create)\s+\S|branch\s+(?!-)\S)|(?:^|[|;&(]\s*|\s)gh\s+(?:pr|issue)\s+(?:create|edit)\b/i
+  /\bgit\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*(?:commit\b|checkout\s+(?:-\S+\s+)*(?:(?:-b|-B|--branch)\s+\S|-[bB](?=[^\s;&|]))|switch\s+(?:-\S+\s+)*(?:-c|-C|--create)\s+\S|branch\s+(?!-)\S)|(?:^|[|;&(]\s*|\s)gh\s+(?:pr|issue)\s+(?:create|edit)\b/i
 // Mirrors hooks/tezgah_integrity.py READ_TOOLS: known calls that do no step of
 // work and that no rule reads a row for. A name missing from this set is not
 // silently dropped - it records as `unknown`, which would fill the trace with
@@ -942,7 +1027,7 @@ function verifyCommand(cmd) {
   // the masked text, the convention shortcutCommand already follows: a check
   // named inside a quoted string or a heredoc body is text ABOUT a command, not
   // one, and reading it as one records a passing check nobody ran
-  const text = maskText(cmd)
+  const text = maskText(cmd).replace(WRAPPER_RUN, "$1")
   for (const m of text.matchAll(VERIFY_ALL)) {
     const words = m[0].trim().split(/\s+/)
     const tool = words[words.length - 1].toLowerCase()
@@ -2025,12 +2110,47 @@ function orderReason(args, rows) {
   return ORDER_DENY.replace("%s", failedCheck(rows))
 }
 
+// A write or shell call's first row, as hooks/tezgah_gate.decision writes it
+// before any rule runs (tezgah_integrity.BEGAN_KIND): tool.execute.after writes
+// the second with the same id, a refusal answers it with its `deny`, and one
+// never answered is a call whose outcome nobody saw. BEGAN holds the args
+// object of each call whose row is written - by the core when it answered
+// (gateReason), else here - so a call gets exactly one, ahead of its `deny`.
+const BEGAN = new WeakSet()
+// The directory the plugin was loaded for, the `cwd` the core is handed: a
+// `began` row's `target` resolves against it as the core's does.
+let HOOK_DIR = null
+async function noteBegan(sessionID, tool, args, workspace) {
+  const t = String(tool || "").toLowerCase()
+  if (!sessionID || !args || typeof args !== "object" || BEGAN.has(args)
+      || !(WRITE_TOOLS.has(t) || BASH_TOOLS.has(t))) return
+  BEGAN.add(args)
+  const command = String(args.command || args.cmd || "")
+  const written = writtenPath(args)
+  // `~` and `$HOME` expanded as the core's write_paths does
+  const target = written
+    ? absTarget(written.replace(/^(?:~|\$\{HOME\}|\$HOME)(?=\/|$)/, HOME), HOOK_DIR) : null
+  await appendRow(sessionID, {
+    kind: "began", ts: Math.floor(Date.now() / 1000),
+    detail: redact(command || written || "").slice(0, DETAIL_MAX),
+    id: actionID(t, args), tool: t, workspace,
+    // decided from the whole command, as hooks/tezgah_gate.decision does: the
+    // detail is cut at DETAIL_MAX
+    ...(BASH_TOOLS.has(t) && verifyCommand(command) ? { check: 1 } : {}),
+    // the file it writes, as the race rule matches it: a `began` row nothing
+    // answered yet is a write in flight (hooks/tezgah_gate.writers_elsewhere)
+    ...(target ? { target } : {}),
+  })
+}
+
 // The refusal recorded before it is returned, as the Python gate's `_deny` does:
 // a deny nobody counts is a rule whose effect can never be argued about, and the
 // row says which action the rule stopped and where. `extra` appends a fact the
-// row must keep beyond the 80 characters of the reason it truncates.
+// row must keep beyond the 80 characters of the reason it truncates. The call's
+// `began` row goes first, as the core writes it before any rule.
 async function noteDeny(sessionID, rule, reason, tool, args, workspace, extra) {
   if (!sessionID) return
+  await noteBegan(sessionID, tool, args, workspace)
   let detail = rule + ": " + String(reason).slice(0, 80)
   if (extra) detail += "; " + extra
   await appendRow(sessionID, {
@@ -2222,7 +2342,7 @@ function secretPrinter(text) {
 }
 
 // `words` past keywords, env assignments and the wrappers
-// (hooks/tezgah_gate._past_wrappers)
+// (hooks/tezgah_integrity._past_wrappers)
 function secretPastWrappers(words) {
   let i = 0
   while (i < words.length) {
@@ -2674,8 +2794,15 @@ const SWITCHES = new Set(["adhd-off", "consult-off", "design-off", "docs-judge-o
 // switch file whose ctime or mtime is newer than the session ledger's first row
 // is ignored unless an `authorized` row names it or it is the full uninstall's
 // stand-down (STAND_DOWN); without one the file alone answers. This process
-// serves many sessions, so the id is an argument, not process state.
+// serves many sessions, so the id is an argument, not process state. A child
+// session latches on the earlier of its own and its parent's first row, and
+// its parent's `authorized` rows count for it (B-036). The parent is the one
+// opencode named on the child's session.created (PARENTS), never a ledger row:
+// a `spawned` row is bytes an agent can write (review 165).
+// ponytail: held in this process only - a plugin restarted while a child runs
+// forgets its parent, and the child then latches on its own first row as before.
 const STAND_DOWN = "tezgah-setup --uninstall --full\n"
+const PARENTS = new Map()
 
 async function off(name, sessionID) {
   if (!SWITCHES.has(name)) return false
@@ -2691,15 +2818,24 @@ async function honored(path, name, sessionID) {
   let stats
   try { stats = [statSync(path), lstatSync(path)] } catch { return false }
   if (!sessionID) return true
-  const [first] = await ledgerRead(sessionID, "first")
-  const since = typeof first?.ts === "number" ? first.ts : null
+  const parent = PARENTS.get(String(sessionID))
+  const ids = parent && parent !== String(sessionID) ? [sessionID, parent] : [sessionID]
+  const firsts = []
+  for (const id of ids) {
+    const [first] = await ledgerRead(id, "first")
+    if (typeof first?.ts === "number") firsts.push(first.ts)
+  }
+  const since = firsts.length ? Math.min(...firsts) : null
   const newest = Math.max(...stats.flatMap((s) => [s.mtimeMs, s.ctimeMs])) / 1000
   if (since === null || newest < since + 1) return true
   try {
     if (name === "pretooluse-off" && readFileSync(path, "utf8") === STAND_DOWN) return true
   } catch {}
-  return (await ledgerRead(sessionID, "kind", "authorized")).some(
-    (row) => Array.isArray(row.authorized) && row.authorized.includes(name))
+  for (const id of ids) {
+    if ((await ledgerRead(id, "kind", "authorized")).some(
+      (row) => Array.isArray(row.authorized) && row.authorized.includes(name))) return true
+  }
+  return false
 }
 
 function slug(p) {
@@ -2945,18 +3081,33 @@ function builderText(event, directory, payload) {
 // guards. What the silence costs is one row, never a refusal.
 // `core.answered` says the core did answer: its live `decide` has then kept the
 // snapshot of an allowed write itself, and this file must not keep a second one.
+// It has written the call's `began` row too, and its `deny` when `core.denied`.
+// A core that failed after its first line (a rule raised, the deadline hit) may
+// have written that `began` already: a row for this call since the ask began
+// counts as written, so the call is not opened twice.
 async function gateReason(tool, args, dir, sessionID, core = {}) {
   const state = {}
+  const since = Math.floor(Date.now() / 1000)
   const reason = await collect(
     [GATE_BIN, "decide"], { stdio: ["pipe", "pipe", "ignore"] },
     JSON.stringify({
-      tool, input: args, cwd: dir, session_id: sessionID || null }),
+      tool, input: args, cwd: dir, session_id: sessionID || null,
+      parent: PARENTS.get(String(sessionID)) }),
     (code, out, failure) => {
       state.failure = failure
       return code === 0 ? out.trim() : ""
     })
-  if (state.failure) await noteDelegation(sessionID, state.failure)
-  else core.answered = true
+  if (state.failure) {
+    await noteDelegation(sessionID, state.failure)
+    const digest = actionID(tool, args)
+    if (sessionID && args && typeof args === "object" &&
+        (await ledgerTail(sessionID, LEDGER_TAIL)).some((r) => r.kind === "began"
+          && r.id === digest && Number(r.ts) >= since)) BEGAN.add(args)
+  } else {
+    core.answered = true
+    core.denied = Boolean(reason)
+    if (args && typeof args === "object") BEGAN.add(args)
+  }
   return reason
 }
 
@@ -3101,6 +3252,7 @@ export const Tezgah = async ({ directory }) => {
   if (globalThis.__tezgahPluginLoaded) return {}
   globalThis.__tezgahPluginLoaded = true
   const dir = directory || process.cwd()
+  HOOK_DIR = dir
 
   return {
     // Register the repo's generated subagents at config load so opencode sees
@@ -3149,8 +3301,8 @@ export const Tezgah = async ({ directory }) => {
 
     "tool.execute.before": async (input, output) => {
       let deny = null
-      // whether the core was asked: its live `decide` writes the call's `began`
-      // row first, so this file writes one only when the core did not answer
+      // whether the core was asked, so it is asked at most once per call; what
+      // it answered (and so which rows it wrote) is in `core`
       let asked = false
       const core = {}
       try {
@@ -3166,11 +3318,15 @@ export const Tezgah = async ({ directory }) => {
         // `verify-off` removes; attribution and explore are other rules and stay
         const shortcuts = !(await off("verify-off", sessionID))
         // The control rule is the Python gate's first (hooks/tezgah_gate.decision),
-        // so a shell line CONTROL_CMD says could touch the control plane is put to
-        // the core before any rule here: its answer is the whole gate's, in the
-        // gate's own order, and this file keeps no copy of the path table.
+        // so a shell line CONTROL_CMD says could write - or one NEUTER or
+        // SHORTCUT_CMD says could swallow a check's status or skip the hooks - is
+        // put to the core before any rule here: its answer is the whole gate's,
+        // in the gate's own order, and this file keeps no copy of the path table,
+        // the credential's `git add` reader, the workspace rule or the shortcut
+        // readers' wrapper table and `eval` opening.
         const line = BASH_TOOLS.has(tool) ? String(args.command || args.cmd || "") : ""
-        if (line && CONTROL_CMD.test(line)) {
+        if (line && (CONTROL_CMD.test(line) ||
+            (shortcuts && (NEUTER.test(line) || SHORTCUT_CMD.test(line))))) {
           asked = true
           deny = await gateReason(tool, args, dir, sessionID, core)
         }
@@ -3207,10 +3363,10 @@ export const Tezgah = async ({ directory }) => {
           }
         }
         // A refusal this file decided is counted the way the Python gate counts
-        // its own (hooks/tezgah_gate._deny); one the core answered (`asked`) is
-        // in the ledger already. Without the row, `--report --live` saw the
-        // shortcut refused and nothing recorded.
-        if (deny && !asked) {
+        // its own (hooks/tezgah_gate._deny); one the core answered is in the
+        // ledger already. Without the row, `--report --live` saw the shortcut
+        // refused and nothing recorded.
+        if (deny && !core.denied) {
           await noteDeny(sessionID, deny === ATTRIB_DENY ? "attribution"
             : deny === EXPLORE_DENY ? "explorer" : "shortcut", deny, tool, args, base)
         }
@@ -3292,24 +3448,9 @@ export const Tezgah = async ({ directory }) => {
             await captureSnapshot("write", { file_path: target }, dir, sessionID)
           }
         }
-        // The call's first row, as hooks/tezgah_gate.decision writes it on its
-        // allow path (tezgah_integrity.BEGAN_KIND): tool.execute.after writes the
-        // second with the same id, and one never answered is a call whose
-        // outcome nobody saw. A core that was asked and did not answer wrote
-        // none, so this file writes it then too.
-        if (!deny && !core.answered && sessionID &&
-            (WRITE_TOOLS.has(tool) || BASH_TOOLS.has(tool))) {
-          await appendRow(sessionID, {
-            kind: "began", ts: Math.floor(Date.now() / 1000),
-            detail: redact(String(args.command || args.cmd || writtenPath(args)
-                                  || "")).slice(0, DETAIL_MAX),
-            id: actionID(tool, args), tool, workspace: base,
-            // decided from the whole command, as hooks/tezgah_gate.decision
-            // does: the detail is cut at DETAIL_MAX
-            ...(BASH_TOOLS.has(tool) && verifyCommand(String(args.command || args.cmd || ""))
-              ? { check: 1 } : {}),
-          })
-        }
+        // The call's `began` row on its allow path (noteBegan): written here
+        // unless the core answered, or a refusal above already wrote it.
+        if (!deny) await noteBegan(sessionID, tool, args, base)
       } catch {}
       if (deny) throw new Error(deny)
     },
@@ -3326,6 +3467,7 @@ export const Tezgah = async ({ directory }) => {
         const ev = input && input.event
         const info = ev && ev.type === "session.created" && ev.properties && ev.properties.info
         if (!info || !info.id || !info.parentID) return
+        PARENTS.set(String(info.id), String(info.parentID))
         if (!(await rootFor(dir))) return
         const title = String(info.title || "")
         const typed = /\(@([^\s()]+) subagent\)\s*$/.exec(title)
@@ -3345,7 +3487,6 @@ export const Tezgah = async ({ directory }) => {
         const env = output.env && typeof output.env === "object" ? output.env : (output.env = {})
         const rs = await roots()
         if (rs.length) env.TEZGAH_ROOTS = rs.join(delimiter)
-        env.TEZGAH_HOME = CONFIG
         env.TEZGAH_STATUS_BIN = STATUS_BIN
         if (input && input.sessionID) env.TEZGAH_SESSION = String(input.sessionID)
       } catch {}
@@ -3363,7 +3504,8 @@ export const Tezgah = async ({ directory }) => {
         const context = Array.isArray(output.context) ? output.context : (output.context = [])
         const sessionID = String(input?.sessionID || "")
         const text = await builderText("post_compact", dir,
-                                       sessionID ? { session_id: sessionID } : {})
+                                       sessionID ? { session_id: sessionID,
+                                                     parent: PARENTS.get(sessionID) } : {})
         if (text) context.push(text)
       } catch {}
     },
@@ -3389,8 +3531,12 @@ export const Tezgah = async ({ directory }) => {
           const prompt = parts
             .filter((p) => p && p.type === "text" && typeof p.text === "string")
             .map((p) => p.text).join("\n")
+          // a child session's prompt is its parent's brief, never the user's
+          // grant (B-086), and its latch counts from its parent too (B-036)
+          const parent = PARENTS.get(sessionID)
           const text = await builderText("user_prompt", dir,
-                                         { prompt, session_id: sessionID, host: "opencode" })
+                                         { prompt, session_id: sessionID, host: "opencode",
+                                           ...(parent ? { subagent: true, parent } : {}) })
           if (text) {
             const anchor = output.message && typeof output.message === "object"
               ? output.message : {}

package/hosts/qwen/hook.py

@@ -151,7 +151,7 @@ def main():
     event = payload.get("hook_event_name") or ""
     cwd = payload.get("cwd") or os.getcwd()
     session_id = payload.get("session_id")
-    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    safe(session_id, bind_session, session_id, payload.get("parent"))  # the switch latch
     out = {}
     if event == "PreToolUse":
         reason = safe(session_id, decision, gate_name(payload.get("tool_name", "")),

package/output-styles/tezgah.md

@@ -38,7 +38,7 @@ first; write what was cut only when you consciously cut something the user asked
 for, in at most three lines. In force from the first turn; levels
 lite|full|ultra are set with `~/.config/tezgah/bin/tezgah-pony` and ride the per-turn reminder when
 not `full`; read the full `ponytail` skill from the router for the level table
-and examples. Off: "stop ponytail".
+and examples. Off: "stop ponytail", `ponytail-auto.off` or `.no-ponytail`.
 
 **Output shape: ADHD-friendly.** The answer or the next action is on the first
 line - a command, path, snippet or the decision itself, never context or the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@r1z4x/tezgah",
-  "version": "1.13.0",
-  "description": "One shared working contract for every AI coding assistant you run: Claude Code, Codex, Cursor, opencode, dsh and oh-my-pi (omp).",
+  "version": "1.14.0",
+  "description": "One shared working contract for every AI coding assistant you run, across fourteen hosts: omp, Claude Code, Codex, Cursor, opencode, dsh, Qwen Code, Factory Droid, Command Code, GitHub Copilot CLI, Gemini CLI, Antigravity CLI, Goose and Amp.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -23,7 +23,10 @@
     "MANIFEST",
     "CHANGELOG.md",
     "LICENSE",
-    "packaging/"
+    "NOTICE",
+    "third_party/",
+    "packaging/",
+    "!**/__pycache__"
   ],
   "engines": {
     "node": ">=18"

package/packaging/build.sh

@@ -79,12 +79,12 @@ def version():
 
 
 def changelog_version():
-    """The newest release heading: the second source `plugin_version()` reads."""
+    """The newest `## [x.y.z]` heading, as `RELEASE` in hooks/tezgah_context.py."""
     try:
         with open(os.path.join(ROOT, "CHANGELOG.md")) as fh:
-            for line in fh:
-                if line.startswith("## ["):
-                    return line[4:].split("]")[0].strip()
+            for v in (ln[4:].split("]")[0] for ln in fh if ln.startswith("## [")):
+                if v.count(".") == 2 and all(p.isdigit() for p in v.split(".")):
+                    return v
     except OSError:
         pass
     return ""

package/packaging/install.sh

@@ -26,6 +26,17 @@ while [ $# -gt 0 ]; do case $1 in
     *) echo "tezgah: unknown option $1" >&2; exit 2 ;;
 esac; done
 
+# Python 3.10+ is the floor (README; CI tests nothing older): refused here, by
+# the version found, before anything is fetched.
+py=$(command -v python3 2>/dev/null) || { echo "tezgah: needs Python 3.10 or newer, and no python3 is on PATH" >&2; exit 1; }
+pyver=$("$py" --version 2>&1 | sed -n 's/^Python \([0-9][0-9]*\.[0-9][0-9.]*\).*/\1/p')
+pymajor=0; pyminor=0
+if [ -n "$pyver" ]; then pymajor=${pyver%%.*}; pyminor=${pyver#*.}; pyminor=${pyminor%%.*}; fi
+if [ "$pymajor" -lt 3 ] || { [ "$pymajor" -eq 3 ] && [ "$pyminor" -lt 10 ]; }; then
+    echo "tezgah: needs Python 3.10 or newer; $py is ${pyver:-of unknown version}" >&2
+    exit 1
+fi
+
 # The default upgrade.sh resolves: the installer is reached through the tree it picks.
 PREFIX=${PREFIX_ARG:-${TEZGAH_PREFIX:-${XDG_DATA_HOME:-$HOME/.local/share}/tezgah}}
 finish() { [ -z "$work" ] || rm -rf "$work"; }

package/packaging/upgrade.sh

@@ -41,6 +41,9 @@ die() {
     exit 1
 }
 
+# First: a missing curl would otherwise read as a fetch failure blaming a token.
+for t in curl tar; do command -v "$t" >/dev/null 2>&1 || die "$t is required (README: Install)"; done
+
 # A private repository answers 404 to `releases/download/...` from a session without
 # a token (measured 2026-10-17, with the token as URL userinfo and as a header
 # alike), while the REST asset endpoint returns the blob for `Accept:

package/skills/ai-research/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Claude AI Research Skills Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.