@ra3orblade/swarm 0.14.0 → 0.15.0

package/dist/swarm-hook.js

@@ -100,168 +100,268 @@ var init_adapters = __esm(() => {
   init_updates();
   init_db();
 });
+// packages/core/src/prompt.ts
+var init_prompt = () => {};
 
 // packages/core/src/adapters/claude-code/hooks.ts
-var init_hooks = () => {};
-
-// packages/core/src/art.ts
-var ROBOT, HEAD;
-var init_art = __esm(() => {
-  ROBOT = [
-    "                        MM                     MM                        ",
-    "                        LL                     LL                        ",
-    "                        LL                     LL                        ",
-    "                        LM                     MM                        ",
-    "                        MD                     MS                        ",
-    "                        LE                     LE                        ",
-    "                        ME                     ME                        ",
-    "                        MS                     MS                        ",
-    "                        KK                     KK                        ",
-    "                   SSDDDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDS                   ",
-    "                   SSDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDSS                   ",
-    "                   SSDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKSS                   ",
-    "                   SSOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMOSS                   ",
-    "                   DDKMMLLLMLLMMMMMMMMMMMMMMMMMMMMMODD                   ",
-    "                   DDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-    "              SSSSODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
-    "              SSSSODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
-    "             SMMMMODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSMMMS             ",
-    "             DMSSSODDOMMMMOOOOOOMMMMMMMMMOOOOOOMMMMODDOSSSED             ",
-    "             DSSSSODDOMMMMODDDDDMMMMMMMMMODDDDDMMMMODDOSSSSK             ",
-    "             DSMMSODDOMMMMDDDDDDMMMMMMMMMKDDDDDMMMMODDOSMMSK             ",
-    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDOSSSSK             ",
-    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
-    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
-    "             DSSSKODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSD             ",
-    "             OKKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOKKKKO             ",
-    "              KKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
-    "              KKKOODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
-    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
-    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
-    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
-    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-    "                   DDDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKDD                   ",
-    "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDKDDDDD                   ",
-    "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD                   ",
-    "                               OOOOOOOOOOO                               ",
-    "                               OODDDDDKKOO                               ",
-    "                               DSMMMMMMSDD                               ",
-    "                               OOOOOOOOOOO                               ",
-    "                              KDSMMMMMESSKK                              ",
-    "                   MMMMMMSSKOOKDSMMMMMSSSDKOODSEMMMMMM                   ",
-    "         SSSSDO   MMMMMMSSKKOOOOOOOOOOOOOOOOOKSSSMMMMMM   ODSSSS         ",
-    "        EEESSSSOOLLLLMMMMMESSSSSSSSSSSSSSSSSSSSMMMMMLLLLOOSSSSMME        ",
-    "       SMMSSSSKOEELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLEEOOSSSSEMS       ",
-    "      DSSSSSSSOOSEEKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSOEEDOOSSSSSSSK      ",
-    "      DSSSSSSDOOSEOSKEMMMMMMMMMMMMMMMMMMMMMMMMMMMMMEOSDEDOODSSSSSSK      ",
-    "      KSSSSSSKOODSSOSEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESOEEDOOKSSSSSSK      ",
-    "      DKSSSSKKOODSMEEMLLLLLLLLLLLLLLLLLLLLLLLLLLLLLMSEMSDOOKKSSSSDK      ",
-    "      OKDDKDKKOOKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSKOOKKKKKKKO      ",
-    "      OOOOOKKKOOKSMMMMESSSSSSSSSSSSSMMMMEEEEEESSSSEMMMMSKOOKKKOOOOO      ",
-    "      OOOOOOKKOOKSMMMSSKKKKKKKKKKKKKKMMMDKOOOOOOOODDMMMSKOOKKOOOOOO      ",
-    "      OKSSKOOOOOKSMMMKKMLLLLLLLLLLLMKMMMDDSSSSSSSSDDMMMSKOOOOODSSKO      ",
-    "      SDOKKK    KSMMMKDLLLLLLLLLLLLLKMMMKDKKKDDKKKDKMMMSK    KKKKDS      ",
-    "     DMLLMKO    KSMMMKDLLLLLLLLLLLLLKMMMDDDDDDDDDSKDMMMSK    ODMLLMD     ",
-    "     DELLMSD    KSMMMKKMLLLLLLLLLLLLKMMMDKKKKKKKKKDDMMMSK    DSMLLEO     ",
-    "    KSKKKKDO    KSMMMEDDDDKKDDDKKKDKSMMMDDDDDDDDDSDDMMMSK    ODDKKKSK    ",
-    "    EMLLMDO     KSMMMMLLLLLLLLLLLLLLLMMMDOOOOOOOOODDMMMSK     ODMLLME    ",
-    "    KMLLMSD     KSMMMMMMMMMMMMMMMMMMMMMMDDSSDDSSSSDDMMMSK     SSMLLEK    ",
-    "   KSKKKKSO     KSMMMMMOOMMOOMKOEMOOMMMMDOOOOOOOOODDMMMSK     OSKKKKSO   ",
-    "   SMLLMDO      KSMMMMMKKMMKKMDKEMKKMMMMKDDDDSSSSDDDMMMSK      ODMLLMS   ",
-    "   SMMMMSD      KSMMMMMEEMMEEMEEMMEEMMMMDSOOOOOOOODDMMSSK      DSMMMMD   ",
-    "   OOOOOOO      KSSMMMMMMMMMMMMMMMMMMMMMDDDDDDDDDDDDMSSSK      OOOOOOO   ",
-    " KSMLLLMMSKO    KSSSSMMMMMMMMMMMMMMMMMMMSOOOOOOOOOOSSSSSK    OKSMLLLLMSO ",
-    " DSMMMEEESKK    KSSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOSSK    KDSMMMMMESD ",
-    " DSMMMMMESKK    KSOOKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOOKSK    KKSMMMMMMSD ",
-    " DSMMMMMESKK    OKSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSDSKO    KDSMMMMMMSD ",
-    " KDDDDDDDDKK      KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK      KKDDDDDDDDO ",
-    " OOOOOOOOOOO         OOOOOOOOO             OOOOOOOOO         OOOOOOOOOOO ",
-    "DSDO     OSSO        ODKKKKKKK             OKKKKKKKO        KEDO     ODEK",
-    "SMDO     OSMD        KDSSSSSSK             KDSSSSSKO        SMDO     ODMS",
-    "DEKO     OOED         OOKKKOOO             OOOKKOOO         SSOO     OKMS",
-    "DEKO     OOED         SEMMMMSK             OSMMMMED         SSKO     OKES",
-    "DSSO     OESK         SEMMMMSK             OSMMMMED         KSSO     OSSK",
-    "KSMS     EEDO         OOKKKKKO             OOKKKKKO         OSEE     EMSO",
-    " DSS     SSK          OSEEESDO             ODSEEESO          KSS     SSD ",
-    " OOO     OO           SEMMMMSK             OSMMMMED           OO     OOO ",
-    "                      KSSSSSDO             OKSSESSK                      ",
-    "                   DKKDDDDDDKKDK         KDKDDDDDDDKDK                   ",
-    "                  SSMLLMMMMMMLMSK       DSSMMMMMMMLLMSS                  ",
-    "                  SMLMMMMMMMMLLED       SEMMMMMMMMMMLMS                  ",
-    "                 DMMMMMMMMMMMMMMD       SMMMMMMMMMMMMMSK                 ",
-    "                ODSSSSSSSSSSSSSSDO     ODSSSSSSSSSSSSSSKO                ",
-    "                OOOOOOOOOOOOOOOOO       OOOOOOOOOOOOOOOOO                ",
-    "                OKSSSSSSSSSSSSSSK       KSSSSSSSSSSSSSSKO                ",
-    "                OKDDDDDDDDDDDDDDK       KDDDDDDDDDDDDDDOO                "
-  ];
-  HEAD = ROBOT.slice(0, 37);
-});
-
-// packages/core/src/audit.ts
-var AUDIT_TYPES, AUDIT_TYPES_SQL;
-var init_audit = __esm(() => {
-  AUDIT_TYPES = new Set([
-    "session.started",
-    "session.ended",
-    "tool.denied",
-    "claim.acquired",
-    "claim.renewed",
-    "claim.released",
-    "claim.expired",
-    "claim.orphaned",
-    "claim.denied",
-    "rules.changed",
-    "worktree.reclaimed",
-    "worktree.created",
-    "worktree.removed",
-    "worktree.bootstrapped",
-    "pr.opened",
-    "question.asked",
-    "question.answered",
-    "dispatch.queued",
-    "dispatch.started",
-    "dispatch.finished",
-    "resource.acquired",
-    "resource.released",
-    "resource.reaped",
-    "process.started",
-    "process.exited",
-    "gate.recorded",
-    "gate.blocked",
-    "codify.applied",
-    "handoff.recorded",
-    "permission.requested",
-    "permission.resolved",
-    "incident.opened",
-    "incident.acked",
-    "run.result",
-    "workflow.started",
-    "workflow.finished"
+var OWN_SUMMARY;
+var init_hooks = __esm(() => {
+  init_prompt();
+  OWN_SUMMARY = new Set([
+    "Bash",
+    "Read",
+    "Edit",
+    "Write",
+    "MultiEdit",
+    "NotebookEdit",
+    "Glob",
+    "Grep",
+    "Agent",
+    "Task",
+    "WebFetch",
+    "WebSearch",
+    "AskUserQuestion"
   ]);
-  AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
 });
 
-// packages/core/src/budget.ts
-var BUDGET_ASK_TOOLS;
-var init_budget = __esm(() => {
-  BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
-});
-// packages/core/src/workflows.ts
-var init_workflows = () => {};
-
-// packages/core/src/config.ts
-var init_config = __esm(() => {
-  init_audit();
-  init_workflows();
+// packages/core/src/guards.ts
+function expandHome(s, home) {
+  return s.replace(/(^|[\s="'`:])(?:~|\$HOME|\$\{HOME\})(?=\/|$|[\s"'`])/g, `$1${home}`);
+}
+function segments(cmd) {
+  return cmd.split(/\s*(?:&&|\|\||;|\n)\s*/).map((s) => s.trim()).filter(Boolean);
+}
+function words(seg) {
+  return (seg.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^["']|["']$/g, ""));
+}
+function dangerousTarget(target, home, toplevel) {
+  if (/^\$\{?\w+\}?(\/|$)/.test(target) && !target.startsWith(home))
+    return `starts with ${target.match(/^\$\{?\w+\}?/)?.[0]} \u2014 if that is ever unset, it is /`;
+  const t = trimSlash(target.replace(/\/\*$/, "/").replace(/\/\.$/, "/"));
+  if (t === "*" || target === "/*")
+    return "removes everything the glob matches, from the top";
+  if (t === "." || t === ".." || t.startsWith("../"))
+    return "removes the working directory or its parent";
+  if (t === home || t === trimSlash(home))
+    return "removes the home directory";
+  if (!t.startsWith("/"))
+    return null;
+  if (SYSTEM_DIRS.includes(t))
+    return `removes ${t}`;
+  if (t.split("/").length <= 3 && /^\/(Users|home)\//.test(t))
+    return `removes the home directory ${t}`;
+  if (SCRATCH.test(t))
+    return null;
+  if (toplevel && !(t === toplevel || t.startsWith(`${trimSlash(toplevel)}/`)))
+    return `removes ${t}, outside this repository`;
+  return null;
+}
+function destructiveFs(cmd, home, toplevel) {
+  const c = expandHome(cmd, home);
+  for (const seg of segments(c)) {
+    const w = words(seg.replace(/^sudo\s+/, ""));
+    if (w[0] === "rm") {
+      const flags = w.filter((x) => x.startsWith("-"));
+      const recursive = flags.some((f) => /^-[a-zA-Z]*[rR]/.test(f) || f === "--recursive");
+      if (!recursive)
+        continue;
+      for (const target of w.slice(1).filter((x) => !x.startsWith("-"))) {
+        const why = dangerousTarget(target, home, toplevel);
+        if (why)
+          return { what: `\`rm -r ${target}\` ${why}` };
+      }
+    }
+    if (w[0] === "find" && (w.includes("-delete") || /-exec\s+rm\b/.test(seg))) {
+      const root = w[1] ?? ".";
+      const why = dangerousTarget(root, home, toplevel);
+      if (why && root !== ".")
+        return { what: `\`find ${root} \u2026 -delete\` ${why}` };
+    }
+    if (/^(mkfs(\.\w+)?|newfs\w*|wipefs)$/.test(w[0] ?? ""))
+      return { what: `\`${w[0]}\` formats a disk` };
+    if (w[0] === "dd" && w.some((x) => /^of=\/dev\//.test(x)))
+      return { what: "`dd` writes over a device" };
+    if (w[0] === "diskutil" && /^(erase|zero|secureErase|reformat)/i.test(w[1] ?? ""))
+      return { what: `\`diskutil ${w[1]}\` erases a disk` };
+    if ((w[0] === "chmod" || w[0] === "chown") && w.some((x) => /^-[a-zA-Z]*R/.test(x))) {
+      const target = w[w.length - 1] ?? "";
+      if (target.startsWith("/") || target === home) {
+        const why = dangerousTarget(target, home, toplevel);
+        if (why)
+          return { what: `\`${w[0]} -R ${target}\` ${why.replace(/^removes/, "changes")}` };
+      }
+    }
+  }
+  return null;
+}
+function destructiveInfra(cmd) {
+  for (const r of INFRA)
+    if (r.re.test(cmd) && (!r.needs || r.needs.test(cmd)))
+      return { what: r.what };
+  return null;
+}
+function pipeToShell(cmd) {
+  if (new RegExp(`${FETCHER}[^|;&]*\\|\\s*(${INTERP})\\b`).test(cmd))
+    return { what: "pipes a downloaded script straight into an interpreter" };
+  if (/\b((ba|z)?sh|source|\.)\s+<\(\s*(curl|wget)\b/.test(cmd))
+    return { what: "runs a downloaded script via process substitution" };
+  if (/\b(ba|z)?sh\s+-c\s+["']?\$\(\s*(curl|wget)\b/.test(cmd))
+    return { what: "runs a downloaded script via command substitution" };
+  return null;
+}
+function secretFileIn(text) {
+  return SECRET_FILES.find((s) => s.re.test(text))?.what ?? null;
+}
+function secretCommand(cmd) {
+  if (/\bsecurity\s+find-(generic|internet)-password\b[^|;&]*\s-[a-z]*w/.test(cmd))
+    return { what: "prints a password from the macOS keychain" };
+  if (/\b(printenv|env)\s*(\||>|$)/.test(cmd) && /\|\s*(curl|nc|ncat)\b/.test(cmd))
+    return { what: "sends the environment over the network" };
+  for (const seg of segments(cmd)) {
+    if (!READERS.test(seg))
+      continue;
+    const w = words(seg);
+    const copy = /^(cp|scp|rsync)$/.test(w[0] ?? "");
+    const text = copy ? w.slice(1, -1).filter((x) => !x.startsWith("-")).join(" ") : seg;
+    const what = secretFileIn(text);
+    if (what)
+      return { what: `${copy ? "copies" : "reads"} ${what}` };
+  }
+  return null;
+}
+function secretFile(tool, path) {
+  const what = secretFileIn(path);
+  if (!what)
+    return null;
+  if (tool === "Read")
+    return { what: `reads ${what}` };
+  if (/\.env(\.[\w-]+)?$|\.(pem|p12|pfx|key)$/i.test(path))
+    return { what: `writes ${what}` };
+  return null;
+}
+function guardConfigFile(path, home) {
+  const p = expandHome(path, home);
+  const h = trimSlash(home);
+  if (/(^|\/)\.claude\/settings(\.local)?\.json$/.test(p))
+    return "Claude Code settings (hooks and permissions)";
+  if (p === `${h}/.claude.json`)
+    return "Claude Code's MCP registration";
+  if (p.startsWith(`${h}/.swarm/`) || p === `${h}/.swarm`)
+    return "Swarm's config and ledger";
+  if (/(^|\/)\.swarm\.toml$/.test(p))
+    return "this repo's Swarm rules";
+  if (p === `${h}/.codex/config.toml` || p === `${h}/.gemini/settings.json` || p === `${h}/.cursor/hooks.json`)
+    return "another agent's hook config";
+  return null;
+}
+function configTamperCommand(cmd, home) {
+  if (/(^|[\s;&|])swarm\s+uninstall\b/.test(cmd))
+    return { what: "uninstalls Swarm's hooks" };
+  for (const seg of segments(expandHome(cmd, home))) {
+    if (!WRITERS.test(seg))
+      continue;
+    for (const w of words(seg)) {
+      const target = w.replace(/^>+/, "");
+      if (!target.includes("/") && !target.startsWith("."))
+        continue;
+      const what = guardConfigFile(target, home);
+      if (what)
+        return { what: `changes ${what} (${target})` };
+    }
+  }
+  return null;
+}
+var trimSlash = (p) => p.length > 1 ? p.replace(/\/+$/, "") : p, SYSTEM_DIRS, SCRATCH, DB_CLIENT, INFRA, FETCHER, INTERP, SECRET_FILES, READERS, WRITERS;
+var init_guards = __esm(() => {
+  SYSTEM_DIRS = [
+    "/",
+    "/bin",
+    "/boot",
+    "/dev",
+    "/etc",
+    "/home",
+    "/lib",
+    "/opt",
+    "/private",
+    "/root",
+    "/sbin",
+    "/System",
+    "/Library",
+    "/Applications",
+    "/Users",
+    "/usr",
+    "/var"
+  ];
+  SCRATCH = /^(\/tmp|\/private\/tmp|\/var\/folders|\/private\/var\/folders)(\/|$)/;
+  DB_CLIENT = /\b(psql|mysql|mariadb|sqlite3|sqlcmd|clickhouse(-client)?|cockroach|mongo(sh)?|duckdb)\b/i;
+  INFRA = [
+    {
+      what: "`terraform destroy` tears the stack down",
+      re: /\b(terraform|tofu)\s+(\S+\s+)*destroy\b/
+    },
+    { what: "`terraform state rm` forgets live resources", re: /\b(terraform|tofu)\s+state\s+rm\b/ },
+    {
+      what: "`kubectl delete` of a namespace or everything",
+      re: /\bkubectl\s+(\S+\s+)*delete\s+(\S+\s+)*(ns|namespaces?|pvc?|persistentvolume(claim)?s?|--all\b|-A\b|--all-namespaces\b)/
+    },
+    { what: "`kubectl drain` evicts a node's workloads", re: /\bkubectl\s+(\S+\s+)*drain\b/ },
+    { what: "`helm uninstall` removes a release", re: /\bhelm\s+(\S+\s+)*(uninstall|delete)\b/ },
+    {
+      what: "`aws s3 rm --recursive` empties a bucket path",
+      re: /\baws\s+s3\s+rm\b[^|;&]*--recursive/
+    },
+    { what: "`aws s3 rb` deletes a bucket", re: /\baws\s+s3\s+rb\b/ },
+    {
+      what: "an AWS delete / terminate call",
+      re: /\baws\s+[\w-]+\s+(terminate-instances|delete-(db-instance|db-cluster|stack|table|bucket|cluster|function|user|role|repository))\b/
+    },
+    { what: "a `gcloud \u2026 delete`", re: /\bgcloud\s+(\S+\s+)+delete\b/ },
+    { what: "an `az \u2026 delete`", re: /\baz\s+(\S+\s+)+delete\b/ },
+    {
+      what: "`docker system prune` removes images and volumes",
+      re: /\bdocker\s+system\s+prune\b[^|;&]*(-a\b|--all\b|--volumes\b)/
+    },
+    { what: "`docker volume rm/prune` deletes data volumes", re: /\bdocker\s+volume\s+(rm|prune)\b/ },
+    { what: "a SQL `DROP`", re: /\bdrop\s+(database|schema|table)\b/i, needs: DB_CLIENT },
+    { what: "a SQL `TRUNCATE`", re: /\btruncate\s+(table\s+)?\w/i, needs: DB_CLIENT },
+    {
+      what: "an unbounded SQL `DELETE`",
+      re: /\bdelete\s+from\s+[\w."]+\s*(;|"|'|$)/i,
+      needs: DB_CLIENT
+    },
+    { what: "`dropdb` deletes a database", re: /(^|[\s;&|])dropdb\s/ },
+    {
+      what: "a database reset",
+      re: /\b(prisma\s+migrate\s+reset|rails\s+db:(drop|reset)|rake\s+db:(drop|reset)|supabase\s+db\s+reset)\b/
+    },
+    {
+      what: "`redis-cli FLUSHALL/FLUSHDB` wipes the store",
+      re: /\bredis-cli\b[^|;&]*\bflush(all|db)\b/i
+    },
+    { what: "`dropDatabase()` in the Mongo shell", re: /\bdropDatabase\s*\(/, needs: DB_CLIENT }
+  ];
+  FETCHER = String.raw`\b(curl|wget|fetch|http|xh)\b`;
+  INTERP = String.raw`(sudo\s+(-\S+\s+)*)?(env\s+(\w+=\S+\s+)*)?(ba|z|k|da|fi)?sh|python[0-9.]*|node|perl|ruby|php|iex`;
+  SECRET_FILES = [
+    {
+      what: "a .env file",
+      re: /(^|[/\s"'`=@])\.env(\.(?!example\b|sample\b|template\b|dist\b|defaults?\b)[\w-]+)?(?=$|[\s"'`;|&)])/
+    },
+    {
+      what: "an SSH private key",
+      re: /(^|[/\s"'`])(id_rsa|id_ed25519|id_ecdsa|id_dsa)(?=$|[\s"'`;|&)])/
+    },
+    { what: "AWS credentials", re: /\.aws\/credentials\b/ },
+    { what: "an npm token file", re: /(^|[/\s"'`])\.npmrc\b/ },
+    { what: "a kubeconfig", re: /\.kube\/config\b/ },
+    { what: "Google Cloud credentials", re: /gcloud\/[\w-]*credential/i },
+    { what: "a private key file", re: /[\w-]\.(pem|p12|pfx|key)(?=$|[\s"'`;|&)])/i },
+    { what: "a netrc", re: /(^|[/\s"'`])\.netrc\b/ }
+  ];
+  READERS = /(^|[\s;&|(])(cat|less|more|head|tail|bat|strings|base64|xxd|od|hexdump|grep|egrep|rg|ag|awk|nl|tac|cp|scp|rsync|openssl|gpg|pbcopy)\b|curl\b[^|;&]*(-d|--data[\w-]*|-F|--form|-T|--upload-file)\s*@/;
+  WRITERS = /(^|[\s;&|(])(>>?|tee|rm|mv|cp|truncate|ln|chmod|chown|unlink|shred)\b|>>?\s*\S|\bsed\s+(-[a-zA-Z]*\s+)*-i|\bperl\s+-[a-zA-Z]*i|\bsqlite3\b[^|;&]*\b(delete|update|drop|insert)\b/i;
 });
 
-// packages/core/src/context.ts
-var init_context = () => {};
-
-// packages/core/src/dag.ts
-var init_dag = () => {};
 // packages/core/src/rules.ts
 function otherLiveInSameTree(current, sessions, now, withinMs = LIVE_WINDOW_MS) {
   if (!current.toplevel)
@@ -312,6 +412,41 @@ function killedPorts(cmd) {
     ports.add(Number(m[1]));
   return [...ports];
 }
+function familyHitsBash(cmd, home, toplevel) {
+  const out = [];
+  const add = (rule, h) => h && out.push({ rule, what: h.what });
+  add("destructive_fs", destructiveFs(cmd, home, toplevel));
+  add("destructive_infra", destructiveInfra(cmd));
+  add("pipe_to_shell", pipeToShell(cmd));
+  add("secrets", secretCommand(cmd));
+  add("config_tamper", configTamperCommand(cmd, home));
+  return out;
+}
+function familyHitsFile(tool, path, home) {
+  const out = [];
+  const secret = secretFile(tool, path);
+  if (secret)
+    out.push({ rule: "secrets", what: secret.what });
+  if (WRITE_TOOLS.has(tool)) {
+    const what = guardConfigFile(path, home);
+    if (what)
+      out.push({ rule: "config_tamper", what: `changes ${what} (${path})` });
+  }
+  return out;
+}
+function familyDecision(hits, modes) {
+  for (const h of hits) {
+    const mode = modes[h.rule] ?? "off";
+    if (mode !== "off")
+      return { action: mode, rule: h.rule, reason: FAMILY_REASON[h.rule](h.what) };
+  }
+  return null;
+}
+function guardFile(tool, path, modes = DEFAULT_MODES, home = process.env.HOME ?? "") {
+  if ((modes.secrets ?? "off") === "off" && (modes.config_tamper ?? "off") === "off")
+    return { action: "allow" };
+  return familyDecision(familyHitsFile(tool, path, home), modes) ?? { action: "allow" };
+}
 function isSingleCommand(cmd) {
   return !/[&|;<>`\n]/.test(cmd) && !cmd.includes("$(");
 }
@@ -436,7 +571,7 @@ function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES, ctx = {})
   if (modes.shared_tree !== "off" && isBroadStage(cmd)) {
     const o = other();
     if (o) {
-      const d = hit("shared_tree", `Another session (${o.id.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`);
+      const d = hit("shared_tree", sharedTreeReason(o.id));
       if (d.action !== "allow")
         return d;
     }
@@ -449,6 +584,11 @@ function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES, ctx = {})
         return d;
     }
   }
+  if (FAMILY_RULES.some((r) => (modes[r] ?? "off") !== "off")) {
+    const d = familyDecision(familyHitsBash(cmd, ctx.home ?? process.env.HOME ?? "", current.toplevel), modes);
+    if (d)
+      return d;
+  }
   for (const rule of modes.custom ?? []) {
     const d = applyCustomRule(rule, cmd);
     if (d)
@@ -456,7 +596,7 @@ function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES, ctx = {})
   }
   const nv = rewriteNoVerify(cmd);
   if (nv) {
-    const d = fix("no_verify", "Hooks and signing exist for a reason: `--no-verify` / `--no-gpg-sign` was dropped. If a hook is wrong, fix the hook.", nv);
+    const d = fix("no_verify", NO_VERIFY_REASON, nv);
     if (d.action !== "allow")
       return d;
   }
@@ -519,8 +659,9 @@ function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file
   }
   return { action: "allow" };
 }
-var LIVE_WINDOW_MS, GIT_GLOBAL_OPTS = "(?:\\s+(?:-C\\s+\\S+|-c\\s+\\S+|--git-dir(?:=|\\s+)\\S+|--work-tree(?:=|\\s+)\\S+|--namespace(?:=|\\s+)\\S+|--no-pager|--paginate|--bare|--literal-pathspecs|--exec-path(?:=\\S+)?))*", DEFAULT_MODES, customRe, WRITE_TOOLS;
+var LIVE_WINDOW_MS, GIT_GLOBAL_OPTS = "(?:\\s+(?:-C\\s+\\S+|-c\\s+\\S+|--git-dir(?:=|\\s+)\\S+|--work-tree(?:=|\\s+)\\S+|--namespace(?:=|\\s+)\\S+|--no-pager|--paginate|--bare|--literal-pathspecs|--exec-path(?:=\\S+)?))*", DEFAULT_MODES, FAMILY_RULES, FAMILY_REASON, customRe, sharedTreeReason = (sessionId) => `Another session (${sessionId.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`, NO_VERIFY_REASON = "Hooks and signing exist for a reason: `--no-verify` / `--no-gpg-sign` was dropped. If a hook is wrong, fix the hook.", WRITE_TOOLS;
 var init_rules = __esm(() => {
+  init_guards();
   LIVE_WINDOW_MS = 10 * 60000;
   DEFAULT_MODES = {
     shared_tree: "ask",
@@ -532,12 +673,348 @@ var init_rules = __esm(() => {
     no_verify: "off",
     dry_run_first: "off",
     custom: [],
+    destructive_fs: "off",
+    destructive_infra: "off",
+    pipe_to_shell: "off",
+    secrets: "off",
+    config_tamper: "off",
     protected: { ports: [] }
   };
+  FAMILY_RULES = [
+    "destructive_fs",
+    "destructive_infra",
+    "pipe_to_shell",
+    "secrets",
+    "config_tamper"
+  ];
+  FAMILY_REASON = {
+    destructive_fs: (w) => `This ${w}. Nothing gets that back \u2014 name the exact paths you mean, inside this repository.`,
+    destructive_infra: (w) => `This is ${w} \u2014 outside this checkout, and not something git can undo. Confirm with the owner first.`,
+    pipe_to_shell: (w) => `This ${w}. Download it to a file, read it, then run it.`,
+    secrets: (w) => `This ${w}. Credentials stay out of the transcript: use the variable by name, or ask the owner.`,
+    config_tamper: (w) => `This ${w} \u2014 the settings that decide what agents may do. Ask the owner to change them.`
+  };
   customRe = new WeakMap;
   WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 });
 
+// packages/core/src/policy.ts
+import { createHash } from "crypto";
+function verifyPolicyCache(raw) {
+  if (!raw || typeof raw !== "object")
+    return null;
+  const c = raw;
+  if (c.version !== POLICY_CACHE_VERSION || typeof c.sha256 !== "string")
+    return null;
+  const { sha256, ...body } = c;
+  if (!body.modes || !Array.isArray(body.sessions) || !Array.isArray(body.worktrees))
+    return null;
+  return digest(body) === sha256 ? c : null;
+}
+function evaluateOffline(cache, raw, toplevel, now = Date.now()) {
+  const tool = typeof raw.tool_name === "string" ? raw.tool_name : "";
+  const input = raw.tool_input ?? {};
+  const id = typeof raw.session_id === "string" ? raw.session_id : "";
+  const cwd = typeof raw.cwd === "string" ? raw.cwd : "";
+  const isWrite = WRITE_TOOLS.has(tool) && typeof input.file_path === "string";
+  const cmd = tool === "Bash" && typeof input.command === "string" ? input.command : null;
+  const modes = cache.modes;
+  if (typeof input.file_path === "string" && (isWrite || tool === "Read")) {
+    const f = guardFile(tool, absolutePath(input.file_path, cwd), modes);
+    if (f.action !== "allow")
+      return f;
+  }
+  if (!isWrite && !cmd)
+    return { action: "allow" };
+  const current = { id, cwd, toplevel: toplevel(cwd) };
+  if (modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off") {
+    const target = isWrite ? absolutePath(input.file_path, cwd) : cwd;
+    const w = guardWrite(target, current, cache.worktrees, modes, isWrite ? "file" : "bash");
+    if (w.action !== "allow")
+      return w;
+  }
+  if (!cmd)
+    return { action: "allow" };
+  return guardBash(cmd, current, cache.sessions, now, modes);
+}
+var POLICY_CACHE_VERSION = 1, POLICY_CACHE_FILE = "policy.cache.json", digest = (body) => createHash("sha256").update(JSON.stringify(body)).digest("hex");
+var init_policy = __esm(() => {
+  init_hooks();
+  init_rules();
+});
+
+// packages/core/src/agenthooks.ts
+function detectAgent(raw) {
+  if (typeof raw.cursor_version === "string" || typeof raw.conversation_id === "string")
+    return "cursor";
+  if (raw.hook_event_name === "BeforeTool")
+    return "gemini";
+  if (typeof raw.turn_id === "string")
+    return "codex";
+  return "claude-code";
+}
+function patchPaths(patch) {
+  const out = [];
+  for (const m of patch.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)) {
+    const p = m[1]?.trim();
+    if (p && !out.includes(p))
+      out.push(p);
+  }
+  return out;
+}
+function toToolRequests(agent, raw) {
+  const input = raw.tool_input && typeof raw.tool_input === "object" ? raw.tool_input : {};
+  const tool = str(raw.tool_name) ?? "";
+  const cwd = str(raw.cwd) ?? "";
+  const sessionId = str(raw.session_id) ?? str(raw.conversation_id) ?? "";
+  const req = (t, i, at = cwd) => ({
+    tool: t,
+    input: i,
+    sessionId,
+    cwd: at
+  });
+  switch (agent) {
+    case "claude-code": {
+      const command = str(input.command);
+      const file_path = str(input.file_path);
+      return [req(tool, { ...command ? { command } : {}, ...file_path ? { file_path } : {} })];
+    }
+    case "codex": {
+      const command = str(input.command);
+      if (tool === "Bash" && command)
+        return [req("Bash", { command })];
+      if (tool === "apply_patch" && command)
+        return patchPaths(command).map((p) => req("Write", { file_path: p }));
+      return [];
+    }
+    case "gemini": {
+      const shell = str(input.command);
+      if (tool === "run_shell_command" && shell)
+        return [req("Bash", { command: shell }, str(input.dir_path) ?? cwd)];
+      const fp = str(input.file_path);
+      if (!fp)
+        return [];
+      if (tool === "read_file")
+        return [req("Read", { file_path: fp })];
+      if (tool === "write_file" || tool === "replace")
+        return [req("Write", { file_path: fp })];
+      return [];
+    }
+    case "cursor": {
+      const shell = str(input.command);
+      if (tool === "Shell" && shell)
+        return [req("Bash", { command: shell }, str(input.working_directory) ?? cwd)];
+      const fp = str(input.file_path) ?? str(input.path) ?? str(input.target_file);
+      if (!fp)
+        return [];
+      if (tool === "Read")
+        return [req("Read", { file_path: fp })];
+      if (tool === "Write" || tool === "Delete")
+        return [req("Write", { file_path: fp })];
+      return [];
+    }
+  }
+}
+function effectiveDecision(agent, d) {
+  if (d.action === "ask" && !CAN_ASK.has(agent))
+    return {
+      ...d,
+      action: "deny",
+      reason: `${d.reason ?? ""} (Swarm would ask the user here; ${AGENT_LABEL[agent]}'s hooks cannot ask, so the call is refused \u2014 ask the user to run it, or to turn the rule off.)`.trim()
+    };
+  if (d.action === "rewrite" && agent !== "claude-code")
+    return {
+      ...d,
+      action: "deny",
+      reason: `${d.reason ?? ""} Run this instead: ${d.command ?? ""}`.trim()
+    };
+  return d;
+}
+function renderAgentDecision(agent, d) {
+  const e = effectiveDecision(agent, d);
+  if (e.action === "allow")
+    return "{}";
+  const reason = `[swarm] ${e.reason ?? ""}`.trim();
+  if (agent === "gemini")
+    return JSON.stringify({ decision: "deny", reason });
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: e.action === "ask" ? "ask" : "deny",
+      permissionDecisionReason: reason
+    }
+  });
+}
+var AGENT_LABEL, CAN_ASK, str = (v) => typeof v === "string" && v ? v : undefined;
+var init_agenthooks = __esm(() => {
+  init_policy();
+  AGENT_LABEL = {
+    "claude-code": "Claude Code",
+    codex: "Codex",
+    gemini: "Gemini CLI",
+    cursor: "Cursor"
+  };
+  CAN_ASK = new Set(["claude-code"]);
+});
+
+// packages/core/src/art.ts
+var ROBOT, HEAD;
+var init_art = __esm(() => {
+  ROBOT = [
+    "                        MM                     MM                        ",
+    "                        LL                     LL                        ",
+    "                        LL                     LL                        ",
+    "                        LM                     MM                        ",
+    "                        MD                     MS                        ",
+    "                        LE                     LE                        ",
+    "                        ME                     ME                        ",
+    "                        MS                     MS                        ",
+    "                        KK                     KK                        ",
+    "                   SSDDDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDS                   ",
+    "                   SSDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDSS                   ",
+    "                   SSDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKSS                   ",
+    "                   SSOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMOSS                   ",
+    "                   DDKMMLLLMLLMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "              SSSSODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
+    "              SSSSODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
+    "             SMMMMODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSMMMS             ",
+    "             DMSSSODDOMMMMOOOOOOMMMMMMMMMOOOOOOMMMMODDOSSSED             ",
+    "             DSSSSODDOMMMMODDDDDMMMMMMMMMODDDDDMMMMODDOSSSSK             ",
+    "             DSMMSODDOMMMMDDDDDDMMMMMMMMMKDDDDDMMMMODDOSMMSK             ",
+    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDOSSSSK             ",
+    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
+    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
+    "             DSSSKODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSD             ",
+    "             OKKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOKKKKO             ",
+    "              KKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
+    "              KKKOODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
+    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKDD                   ",
+    "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDKDDDDD                   ",
+    "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD                   ",
+    "                               OOOOOOOOOOO                               ",
+    "                               OODDDDDKKOO                               ",
+    "                               DSMMMMMMSDD                               ",
+    "                               OOOOOOOOOOO                               ",
+    "                              KDSMMMMMESSKK                              ",
+    "                   MMMMMMSSKOOKDSMMMMMSSSDKOODSEMMMMMM                   ",
+    "         SSSSDO   MMMMMMSSKKOOOOOOOOOOOOOOOOOKSSSMMMMMM   ODSSSS         ",
+    "        EEESSSSOOLLLLMMMMMESSSSSSSSSSSSSSSSSSSSMMMMMLLLLOOSSSSMME        ",
+    "       SMMSSSSKOEELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLEEOOSSSSEMS       ",
+    "      DSSSSSSSOOSEEKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSOEEDOOSSSSSSSK      ",
+    "      DSSSSSSDOOSEOSKEMMMMMMMMMMMMMMMMMMMMMMMMMMMMMEOSDEDOODSSSSSSK      ",
+    "      KSSSSSSKOODSSOSEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESOEEDOOKSSSSSSK      ",
+    "      DKSSSSKKOODSMEEMLLLLLLLLLLLLLLLLLLLLLLLLLLLLLMSEMSDOOKKSSSSDK      ",
+    "      OKDDKDKKOOKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSKOOKKKKKKKO      ",
+    "      OOOOOKKKOOKSMMMMESSSSSSSSSSSSSMMMMEEEEEESSSSEMMMMSKOOKKKOOOOO      ",
+    "      OOOOOOKKOOKSMMMSSKKKKKKKKKKKKKKMMMDKOOOOOOOODDMMMSKOOKKOOOOOO      ",
+    "      OKSSKOOOOOKSMMMKKMLLLLLLLLLLLMKMMMDDSSSSSSSSDDMMMSKOOOOODSSKO      ",
+    "      SDOKKK    KSMMMKDLLLLLLLLLLLLLKMMMKDKKKDDKKKDKMMMSK    KKKKDS      ",
+    "     DMLLMKO    KSMMMKDLLLLLLLLLLLLLKMMMDDDDDDDDDSKDMMMSK    ODMLLMD     ",
+    "     DELLMSD    KSMMMKKMLLLLLLLLLLLLKMMMDKKKKKKKKKDDMMMSK    DSMLLEO     ",
+    "    KSKKKKDO    KSMMMEDDDDKKDDDKKKDKSMMMDDDDDDDDDSDDMMMSK    ODDKKKSK    ",
+    "    EMLLMDO     KSMMMMLLLLLLLLLLLLLLLMMMDOOOOOOOOODDMMMSK     ODMLLME    ",
+    "    KMLLMSD     KSMMMMMMMMMMMMMMMMMMMMMMDDSSDDSSSSDDMMMSK     SSMLLEK    ",
+    "   KSKKKKSO     KSMMMMMOOMMOOMKOEMOOMMMMDOOOOOOOOODDMMMSK     OSKKKKSO   ",
+    "   SMLLMDO      KSMMMMMKKMMKKMDKEMKKMMMMKDDDDSSSSDDDMMMSK      ODMLLMS   ",
+    "   SMMMMSD      KSMMMMMEEMMEEMEEMMEEMMMMDSOOOOOOOODDMMSSK      DSMMMMD   ",
+    "   OOOOOOO      KSSMMMMMMMMMMMMMMMMMMMMMDDDDDDDDDDDDMSSSK      OOOOOOO   ",
+    " KSMLLLMMSKO    KSSSSMMMMMMMMMMMMMMMMMMMSOOOOOOOOOOSSSSSK    OKSMLLLLMSO ",
+    " DSMMMEEESKK    KSSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOSSK    KDSMMMMMESD ",
+    " DSMMMMMESKK    KSOOKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOOKSK    KKSMMMMMMSD ",
+    " DSMMMMMESKK    OKSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSDSKO    KDSMMMMMMSD ",
+    " KDDDDDDDDKK      KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK      KKDDDDDDDDO ",
+    " OOOOOOOOOOO         OOOOOOOOO             OOOOOOOOO         OOOOOOOOOOO ",
+    "DSDO     OSSO        ODKKKKKKK             OKKKKKKKO        KEDO     ODEK",
+    "SMDO     OSMD        KDSSSSSSK             KDSSSSSKO        SMDO     ODMS",
+    "DEKO     OOED         OOKKKOOO             OOOKKOOO         SSOO     OKMS",
+    "DEKO     OOED         SEMMMMSK             OSMMMMED         SSKO     OKES",
+    "DSSO     OESK         SEMMMMSK             OSMMMMED         KSSO     OSSK",
+    "KSMS     EEDO         OOKKKKKO             OOKKKKKO         OSEE     EMSO",
+    " DSS     SSK          OSEEESDO             ODSEEESO          KSS     SSD ",
+    " OOO     OO           SEMMMMSK             OSMMMMED           OO     OOO ",
+    "                      KSSSSSDO             OKSSESSK                      ",
+    "                   DKKDDDDDDKKDK         KDKDDDDDDDKDK                   ",
+    "                  SSMLLMMMMMMLMSK       DSSMMMMMMMLLMSS                  ",
+    "                  SMLMMMMMMMMLLED       SEMMMMMMMMMMLMS                  ",
+    "                 DMMMMMMMMMMMMMMD       SMMMMMMMMMMMMMSK                 ",
+    "                ODSSSSSSSSSSSSSSDO     ODSSSSSSSSSSSSSSKO                ",
+    "                OOOOOOOOOOOOOOOOO       OOOOOOOOOOOOOOOOO                ",
+    "                OKSSSSSSSSSSSSSSK       KSSSSSSSSSSSSSSKO                ",
+    "                OKDDDDDDDDDDDDDDK       KDDDDDDDDDDDDDDOO                "
+  ];
+  HEAD = ROBOT.slice(0, 37);
+});
+
+// packages/core/src/audit.ts
+var AUDIT_TYPES, AUDIT_TYPES_SQL;
+var init_audit = __esm(() => {
+  AUDIT_TYPES = new Set([
+    "session.started",
+    "session.ended",
+    "tool.denied",
+    "claim.acquired",
+    "claim.renewed",
+    "claim.released",
+    "claim.expired",
+    "claim.orphaned",
+    "claim.denied",
+    "rules.changed",
+    "worktree.reclaimed",
+    "worktree.created",
+    "worktree.removed",
+    "worktree.bootstrapped",
+    "pr.opened",
+    "question.asked",
+    "question.answered",
+    "dispatch.queued",
+    "dispatch.started",
+    "dispatch.finished",
+    "resource.acquired",
+    "resource.released",
+    "resource.reaped",
+    "process.started",
+    "process.exited",
+    "gate.recorded",
+    "gate.blocked",
+    "codify.applied",
+    "handoff.recorded",
+    "permission.requested",
+    "permission.resolved",
+    "incident.opened",
+    "incident.acked",
+    "run.result",
+    "workflow.started",
+    "workflow.finished"
+  ]);
+  AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
+});
+
+// packages/core/src/budget.ts
+var BUDGET_ASK_TOOLS;
+var init_budget = __esm(() => {
+  BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
+});
+// packages/core/src/workflows.ts
+var init_workflows = () => {};
+
+// packages/core/src/config.ts
+var init_config = __esm(() => {
+  init_audit();
+  init_workflows();
+});
+
+// packages/core/src/context.ts
+var init_context = () => {};
+
+// packages/core/src/dag.ts
+var init_dag = () => {};
 // packages/core/src/dryrun.ts
 var init_dryrun = __esm(() => {
   init_rules();
@@ -578,6 +1055,7 @@ var init_hygiene = __esm(() => {
 // packages/core/src/ledger.ts
 var EDIT_TOOLS;
 var init_ledger = __esm(() => {
+  init_prompt();
   EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
 });
 // packages/core/src/lessons-apply.ts
@@ -592,65 +1070,31 @@ var init_lineage = __esm(() => {
 var init_mcphealth = __esm(() => {
   init_gatehealth();
 });
-
 // packages/core/src/memory.ts
 var init_memory = () => {};
+// packages/core/src/otel.ts
+var init_otel = () => {};
+
 // packages/core/src/outcomes.ts
 var DEFAULT_BRANCHES;
 var init_outcomes = __esm(() => {
   DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
 });
-// packages/core/src/policy.ts
-import { createHash } from "crypto";
-function verifyPolicyCache(raw) {
-  if (!raw || typeof raw !== "object")
-    return null;
-  const c = raw;
-  if (c.version !== POLICY_CACHE_VERSION || typeof c.sha256 !== "string")
-    return null;
-  const { sha256, ...body } = c;
-  if (!body.modes || !Array.isArray(body.sessions) || !Array.isArray(body.worktrees))
-    return null;
-  return digest(body) === sha256 ? c : null;
-}
-function evaluateOffline(cache, raw, toplevel, now = Date.now()) {
-  const tool = typeof raw.tool_name === "string" ? raw.tool_name : "";
-  const input = raw.tool_input ?? {};
-  const id = typeof raw.session_id === "string" ? raw.session_id : "";
-  const cwd = typeof raw.cwd === "string" ? raw.cwd : "";
-  const isWrite = WRITE_TOOLS.has(tool) && typeof input.file_path === "string";
-  const cmd = tool === "Bash" && typeof input.command === "string" ? input.command : null;
-  if (!isWrite && !cmd)
-    return { action: "allow" };
-  const current = { id, cwd, toplevel: toplevel(cwd) };
-  const modes = cache.modes;
-  if (modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off") {
-    const target = isWrite ? absolutePath(input.file_path, cwd) : cwd;
-    const w = guardWrite(target, current, cache.worktrees, modes, isWrite ? "file" : "bash");
-    if (w.action !== "allow")
-      return w;
-  }
-  if (!cmd)
-    return { action: "allow" };
-  return guardBash(cmd, current, cache.sessions, now, modes);
-}
-var POLICY_CACHE_VERSION = 1, POLICY_CACHE_FILE = "policy.cache.json", digest = (body) => createHash("sha256").update(JSON.stringify(body)).digest("hex");
-var init_policy = __esm(() => {
-  init_hooks();
-  init_rules();
-});
 
 // packages/core/src/pricing.ts
 var init_pricing = () => {};
 // packages/core/src/provenance.ts
 var init_provenance = () => {};
 // packages/core/src/quota.ts
-var BURN_MIN_SPAN_MS;
+var BURN_MIN_SPAN_MS, BURN_LOOKBACK_MS;
 var init_quota = __esm(() => {
   BURN_MIN_SPAN_MS = 10 * 60000;
+  BURN_LOOKBACK_MS = 60 * 60000;
 });
 // packages/core/src/security.ts
-var init_security = () => {};
+var init_security = __esm(() => {
+  init_rules();
+});
 
 // packages/core/src/stall.ts
 var init_stall = () => {};
@@ -749,6 +1193,7 @@ var init_src2 = __esm(() => {
   init_actor();
   init_adapters();
   init_hooks();
+  init_agenthooks();
   init_art();
   init_audit();
   init_budget();
@@ -766,9 +1211,11 @@ var init_src2 = __esm(() => {
   init_lineage();
   init_mcphealth();
   init_memory();
+  init_otel();
   init_outcomes();
   init_policy();
   init_pricing();
+  init_prompt();
   init_provenance();
   init_quota();
   init_rules();
@@ -921,7 +1368,7 @@ if (out === null && base !== fallback) {
     out = await post(fallback);
   } catch {}
 }
-if (out === null && event === "PreToolUse")
+if (out === null && (event === "PreToolUse" || event === "BeforeTool"))
   out = offline();
 process.stdout.write(`${out ?? "{}"}
 `);
@@ -934,6 +1381,18 @@ function offline() {
     if (!cache)
       return null;
     const raw = input ? JSON.parse(input) : {};
+    const agent = detectAgent(raw);
+    if (agent !== "claude-code") {
+      for (const r of toToolRequests(agent, raw)) {
+        const d = evaluateOffline(cache, { tool_name: r.tool, tool_input: r.input, session_id: r.sessionId, cwd: r.cwd }, gitToplevel);
+        if (d.action !== "allow")
+          return renderAgentDecision(agent, {
+            ...d,
+            reason: `(daemon unreachable, policy-locked rule) ${d.reason}`
+          });
+      }
+      return null;
+    }
     const d = evaluateOffline(cache, raw, gitToplevel);
     if (d.action === "allow")
       return null;