@sun-asterisk/sungen 3.3.0-alpha.1 → 3.3.0-alpha.10

package/dist/hooks/bash-write-targets.js

@@ -37,16 +37,54 @@ exports.bashSegments = bashSegments;
 exports.bashWriteTargets = bashWriteTargets;
 /**
  * The files a Bash command line WRITES through the three forms the pre-tool guard covers (P0.1):
- * output redirection (`>`, `>>`, `>|`, `&>`, `2>`…), `tee`, and in-place `sed -i`.
+ * output redirection (`>`, `>>`, `>|`, `&>`, `2>`, `>&file`, zsh `>!`…), `tee`, in-place `sed -i`, and
+ * `git … --output <file>` (also abbreviated, `--outp=`) (#968).
  *
- * A floor, not a shell interpreter: quotes, escapes, `;`/`&&`/`||`/`|` and a leading `cd` are
- * understood; anything else that can write a file (`cp`, a script, `python -c`) is out of scope by
+ * A floor, not a shell interpreter: quotes, escapes, `$'…'` ANSI-C strings, backslash-newline
+ * continuations, `;`/`&&`/`||`/`|` and `cd` / `pushd` (with their options; an operand it cannot resolve
+ * marks the directory unknown) are understood; anything else that can write a file (`cp`, a script, `python -c`) is out of scope by
  * design. The command string is untrusted — it is only tokenized here, never executed.
  */
 const path = __importStar(require("path"));
 /** Commands that run another command: the real one is the next word. */
 const WRAPPERS = new Set(['sudo', 'env', 'command', 'nohup', 'time', 'exec', 'nice']);
 const ASSIGNMENT = /^[A-Za-z_]\w*=/;
+const ANSI_C = {
+    a: '\x07', b: '\b', e: '\x1b', E: '\x1b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v', '\\': '\\', "'": "'", '"': '"', '?': '?',
+};
+/** Decode a bash `$'…'` body starting at `j` (just past `$'`); returns the text and the index past the closing `'`. */
+function ansiC(cmd, j) {
+    let out = '';
+    while (j < cmd.length && cmd[j] !== "'") {
+        if (cmd[j] !== '\\' || j + 1 >= cmd.length) {
+            out += cmd[j++];
+            continue;
+        }
+        const e = cmd[j + 1];
+        j += 2;
+        if (e in ANSI_C)
+            out += ANSI_C[e];
+        else if (/[0-7]/.test(e)) {
+            let m = e;
+            while (m.length < 3 && /[0-7]/.test(cmd[j] ?? ''))
+                m += cmd[j++];
+            out += String.fromCharCode(parseInt(m, 8) & 0xff);
+        }
+        else if (e === 'x' || e === 'u' || e === 'U') {
+            const max = e === 'x' ? 2 : e === 'u' ? 4 : 8;
+            let h = '';
+            while (h.length < max && /[0-9a-fA-F]/.test(cmd[j] ?? ''))
+                h += cmd[j++];
+            const cp = parseInt(h, 16);
+            out += !h ? `\\${e}` : cp <= 0x10ffff ? String.fromCodePoint(cp) : '\ufffd'; // never throw: a throw fails open
+        }
+        else if (e === 'c' && j < cmd.length)
+            out += String.fromCharCode(cmd.charCodeAt(j++) & 31);
+        else
+            out += `\\${e}`;
+    }
+    return [out, j + 1];
+}
 function tokenize(cmd) {
     const toks = [];
     let word = '';
@@ -55,7 +93,16 @@ function tokenize(cmd) {
         toks.push({ kind: 'word', value: word }); word = ''; inWord = false; };
     for (let i = 0; i < cmd.length;) {
         const ch = cmd[i];
-        if (ch === "'") {
+        if (ch === '$' && cmd[i + 1] === "'") {
+            const [text, next] = ansiC(cmd, i + 2);
+            word += text;
+            inWord = true;
+            i = next;
+        }
+        else if (ch === '$' && cmd[i + 1] === '"') {
+            i++; // `$"…"` (locale translation) reads as `"…"`
+        }
+        else if (ch === "'") {
             const end = cmd.indexOf("'", i + 1);
             word += cmd.slice(i + 1, end < 0 ? cmd.length : end);
             inWord = true;
@@ -64,6 +111,10 @@ function tokenize(cmd) {
         else if (ch === '"') {
             let j = i + 1;
             for (; j < cmd.length && cmd[j] !== '"'; j++) {
+                if (cmd[j] === '\\' && cmd[j + 1] === '\n') {
+                    j++;
+                    continue;
+                } // line continuation
                 if (cmd[j] === '\\' && j + 1 < cmd.length)
                     j++;
                 word += cmd[j];
@@ -71,6 +122,9 @@ function tokenize(cmd) {
             inWord = true;
             i = j + 1;
         }
+        else if (ch === '\\' && cmd[i + 1] === '\n') {
+            i += 2; // line continuation: removed entirely
+        }
         else if (ch === '\\' && i + 1 < cmd.length) {
             word += cmd[i + 1];
             inWord = true;
@@ -81,9 +135,10 @@ function tokenize(cmd) {
             i++;
         }
         else if ('\n;|()'.includes(ch) || (ch === '&' && cmd[i + 1] !== '>')) {
+            const doubled = (ch === '|' || ch === '&') && cmd[i + 1] === ch;
             flush();
-            toks.push({ kind: 'sep' });
-            i += (ch === '|' || ch === '&') && cmd[i + 1] === ch ? 2 : 1;
+            toks.push({ kind: 'sep', pipe: ch === '|' && !doubled });
+            i += doubled ? 2 : 1;
         }
         else if (ch === '>' || (ch === '&' && cmd[i + 1] === '>')) {
             if (ch === '>' && inWord && /^\d+$/.test(word)) {
@@ -93,14 +148,14 @@ function tokenize(cmd) {
             else
                 flush(); // `2>`: an fd, not a word
             i += ch === '&' ? 2 : 1;
-            if (cmd[i] === '>' || cmd[i] === '|')
-                i++;
-            if (cmd[i] === '&') {
+            if (cmd[i] === '>')
+                i++; // `>>`, `&>>`
+            const dup = cmd[i] === '&'; // `>&x`, `>>&x`: an fd dup only when x is an fd
+            if (dup)
                 i++;
-                toks.push({ kind: 'redir', writes: false });
-            } // `>&2`: an fd dup
-            else
-                toks.push({ kind: 'redir', writes: true });
+            if (cmd[i] === '|' || cmd[i] === '!')
+                i++; // clobber: `>|`, `>!`, `>>!`, `&>!`, `>&|`, `>&!`
+            toks.push({ kind: 'redir', writes: true, dup });
         }
         else if (ch === '<') {
             flush();
@@ -119,36 +174,73 @@ function tokenize(cmd) {
     return toks;
 }
 const isInPlaceFlag = (a) => a === '--in-place' || a.startsWith('--in-place=') || /^-[a-zA-Z]*i/.test(a);
+/** `git diff|log|show … --output=<file>` / `--output <file>` writes that file (git takes `--outp` for `--output`). */
+function gitOutputTargets(args) {
+    const out = [];
+    args.forEach((a, k) => {
+        const m = /^--([\w-]+)(=([\s\S]*))?$/.exec(a);
+        if (!m || m[1].length < 2 || !'output'.startsWith(m[1]))
+            return;
+        if (m[2] !== undefined)
+            out.push(m[3]);
+        else if (args[k + 1])
+            out.push(args[k + 1]);
+    });
+    return out.filter((t) => t && t !== '/dev/null' && t !== '-');
+}
+/** The operand of `cd` / `pushd` after its options (`-L -P -e -@`, pushd `-n`, `--`), or null when there is not exactly one. */
+function cdOperand(args) {
+    let k = 0;
+    while (k < args.length && /^-[LPe@n]+$/.test(args[k]))
+        k++;
+    if (args[k] === '--')
+        k++;
+    return args.length - k === 1 ? args[k] : null;
+}
 function bashSegments(command, cwd) {
     const out = [];
     const toks = tokenize(command);
     let dir = cwd;
+    let dirKnown = true;
     let seg = [];
     let redirected = [];
-    let writes = [];
-    const endSegment = () => {
+    let rawWrites = [];
+    const endSegment = (pipesTo = false) => {
         let k = 0;
         while (k < seg.length && (ASSIGNMENT.test(seg[k]) || WRAPPERS.has(seg[k])))
             k++;
-        const cmd = path.basename(seg[k] ?? '');
+        const assigns = seg.slice(0, k).filter((w) => ASSIGNMENT.test(w));
+        const cmdPath = seg[k] ?? '';
+        const cmd = path.basename(cmdPath);
         const args = seg.slice(k + 1).filter((a) => a !== '');
         if (cmd === 'tee')
-            writes.push(...args.filter((a) => !a.startsWith('-')).map((a) => path.resolve(dir, a)));
-        else if ((cmd === 'sed' || cmd === 'gsed') && args.some(isInPlaceFlag)) {
-            writes.push(...args.filter((a) => !a.startsWith('-')).map((a) => path.resolve(dir, a)));
-        }
-        if (cmd || redirected.length)
-            out.push({ cmd, words: [...args, ...redirected], dir, writes });
-        if (cmd === 'cd' && args.length === 1 && !/^[-~]/.test(args[0]))
-            dir = path.resolve(dir, args[0]);
+            rawWrites.push(...args.filter((a) => !a.startsWith('-')));
+        else if ((cmd === 'sed' || cmd === 'gsed') && args.some(isInPlaceFlag))
+            rawWrites.push(...args.filter((a) => !a.startsWith('-')));
+        else if (cmd === 'git')
+            rawWrites.push(...gitOutputTargets(args));
+        const writes = rawWrites.map((a) => path.resolve(dir, a));
+        const writesInUnknownDir = !dirKnown && rawWrites.some((a) => !path.isAbsolute(a));
+        if (cmd || redirected.length || assigns.length) {
+            out.push({ cmd, cmdPath, words: [...args, ...redirected], dir, dirKnown, writes, writesInUnknownDir, assigns, pipesTo });
+        }
+        if (cmd === 'cd' || cmd === 'pushd' || cmd === 'popd') {
+            const target = cmd === 'popd' ? null : cdOperand(args);
+            if (target && !/[$~`]/.test(target) && target !== '-' && !/^[+-]\d+$/.test(target)) {
+                dir = path.resolve(dir, target);
+                dirKnown = dirKnown || path.isAbsolute(target);
+            }
+            else
+                dirKnown = false; // `cd`, `cd ~`, `cd $D`, `cd -`, `popd`: somewhere the guard cannot resolve
+        }
         seg = [];
         redirected = [];
-        writes = [];
+        rawWrites = [];
     };
     for (let t = 0; t < toks.length; t++) {
         const tok = toks[t];
         if (tok.kind === 'sep') {
-            endSegment();
+            endSegment(tok.pipe === true);
             continue;
         }
         if (tok.kind === 'redir') {
@@ -157,8 +249,9 @@ function bashSegments(command, cwd) {
                 continue;
             t++;
             redirected.push(target.value);
-            if (tok.writes && target.value && target.value !== '/dev/null' && target.value !== '-')
-                writes.push(path.resolve(dir, target.value));
+            const fd = tok.dup && /^(?:\d+-?|-)$/.test(target.value); // `2>&1`, `>&2`, `2>&-`
+            if (tok.writes && !fd && target.value && target.value !== '/dev/null' && target.value !== '-')
+                rawWrites.push(target.value);
             continue;
         }
         seg.push(tok.value);
@@ -166,7 +259,7 @@ function bashSegments(command, cwd) {
     endSegment();
     return out;
 }
-/** Absolute paths the command writes via redirection, `tee` or `sed -i`, resolved against `cwd`. */
+/** Absolute paths the command writes via redirection, `tee`, `sed -i` or `git --output`, resolved against `cwd`. */
 function bashWriteTargets(command, cwd) {
     return bashSegments(command, cwd).flatMap((s) => s.writes);
 }

package/dist/hooks/bash-write-targets.js.map

@@ -1 +1 @@
-{"version":3,"file":"bash-write-targets.js","sourceRoot":"","sources":["../../src/hooks/bash-write-targets.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,oCAmCC;AAGD,4CAEC;AA5GD;;;;;;;GAOG;AACH,2CAA6B;AAI7B,wEAAwE;AACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/G,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1G,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;oBAAE,CAAC,EAAE,CAAC;gBAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YACjH,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACrC,KAAK,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;QACf,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvE,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,MAAM,GAAG,KAAK,CAAC;YAAC,CAAC;;gBAAM,KAAK,EAAE,CAAC,CAAC,0BAA0B;YACvH,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC,CAAC,mBAAmB;;gBACxF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAc1H,SAAgB,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aACtG,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClG,GAAG,GAAG,EAAE,CAAC;QAAC,UAAU,GAAG,EAAE,CAAC;QAAC,MAAM,GAAG,EAAE,CAAC;IACzC,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,MAAM,EAAE,IAAI,KAAK,MAAM;gBAAE,SAAS;YACtC,CAAC,EAAE,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrI,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,UAAU,EAAE,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAgB,gBAAgB,CAAC,OAAe,EAAE,GAAW;IAC3D,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"bash-write-targets.js","sourceRoot":"","sources":["../../src/hooks/bash-write-targets.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6IA,oCAgDC;AAGD,4CAEC;AAlMD;;;;;;;;;GASG;AACH,2CAA6B;AAI7B,wEAAwE;AACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,MAAM,GAA2B;IACrC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAChI,CAAC;AAEF,uHAAuH;AACvH,SAAS,KAAK,CAAC,GAAW,EAAE,CAAS;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,CAAC,IAAI,MAAM;YAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;aAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACjE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAG,kCAAkC;QACnH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;;YACxF,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/G,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,IAAI,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,CAAC;QACxC,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,CAAC,EAAE,CAAC,CAAG,6CAA6C;QACtD,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC1G,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAAC,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC,CAAG,oBAAoB;gBACrF,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;oBAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,CAAC,IAAI,CAAC,CAAC,CAAG,sCAAsC;QAClD,CAAC;aAAM,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACrC,KAAK,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;QACf,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,OAAO,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;YAChE,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC;gBAAC,MAAM,GAAG,KAAK,CAAC;YAAC,CAAC;;gBAAM,KAAK,EAAE,CAAC,CAAC,0BAA0B;YACvH,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC,CAA0B,cAAc;YAChE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAuB,gDAAgD;YAClG,IAAI,GAAG;gBAAE,CAAC,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC,CAAQ,kDAAkD;YACpG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,CAAC,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAwB1H,sHAAsH;AACtH,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO;QAChE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAClC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,gIAAgI;AAChI,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC3D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,CAAC,EAAE,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAgB,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,OAAO,GAAG,KAAK,EAAQ,EAAE;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACxE,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC7H,IAAI,GAAG,KAAK,KAAK;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,kBAAkB,GAAG,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnF,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAChC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;;gBAAM,QAAQ,GAAG,KAAK,CAAC,CAAG,4EAA4E;QACzG,CAAC;QACD,GAAG,GAAG,EAAE,CAAC;QAAC,UAAU,GAAG,EAAE,CAAC;QAAC,SAAS,GAAG,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,MAAM,EAAE,IAAI,KAAK,MAAM;gBAAE,SAAS;YACtC,CAAC,EAAE,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAG,wBAAwB;YACpF,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,GAAG;gBAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5H,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,UAAU,EAAE,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oHAAoH;AACpH,SAAgB,gBAAgB,CAAC,OAAe,EAAE,GAAW;IAC3D,OAAO,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/hooks/guard-protected-paths.d.ts

@@ -4,6 +4,10 @@ export declare function approvalRecordPath(abs: string): string | null;
 export declare function traceEvidencePath(abs: string): string | null;
 /** The hook-control file `abs` is (as its project-relative name), or null. */
 export declare function hookControlPath(abs: string): string | null;
+/** A word the shell rewrites at runtime (`$…`, a literal `\`) that sits near a protected name: the guard cannot read it. */
+export declare const opaqueNearProtected: (word: string) => boolean;
+/** Does this text (a command word, a heredoc, a whole command line) name a protected path as written? */
+export declare const mentionsProtectedText: (text: string) => boolean;
 /** Does this command word name a protected path — as text, or once resolved against `dir`? */
 export declare function mentionsProtectedPath(word: string, dir: string): boolean;
 //# sourceMappingURL=guard-protected-paths.d.ts.map

package/dist/hooks/guard-protected-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-protected-paths.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":"AA0CA,uHAAuH;AACvH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIxE"}
+{"version":3,"file":"guard-protected-paths.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":"AA2CA,uHAAuH;AACvH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAKD,4HAA4H;AAC5H,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,KAAG,OAA0D,CAAC;AAE9G,yGAAyG;AACzG,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,OAA+C,CAAC;AAErG,8FAA8F;AAC9F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIxE"}

package/dist/hooks/guard-protected-paths.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mentionsProtectedText = exports.opaqueNearProtected = void 0;
 exports.approvalRecordPath = approvalRecordPath;
 exports.traceEvidencePath = traceEvidencePath;
 exports.hookControlPath = hookControlPath;
@@ -49,7 +50,8 @@ exports.mentionsProtectedPath = mentionsProtectedPath;
  *     — the CLI still writes the last two itself; the guard only judges an agent's tool calls
  *   trace evidence — DENY an agent write (phase 08; the verdict trusts it only as far as this guard and git review):
  *     .sungen/trace-identity/**                    (the driver's identity answers — written by the CLI)
- *     test-results/sungen-run-record*.json         (run id + test-file hashes — written by the Playwright reporter)
+ *     test-results[-free]/sungen-run-record*.json  (run id + test-file hashes — written by the Playwright reporter;
+ *                                                  test-results-free/ is the free run's own outputDir, #941)
  *   hook control — ASK before an agent write (the agent must not switch its own guard off):
  *     qa/sungen.config.yaml · .claude/settings.json · .claude/settings.local.json ·
  *     .claude/hooks/sungen-hook.cjs
@@ -63,7 +65,7 @@ const LOCK = /^qa\/(?:.+\/)?contracts\.lock\.yaml$/i;
 const DECISION = /^qa\/(?:(?:screens|flows|api(?:\/flows)?)\/[^/]+\/)?decisions\/[^/]+/i;
 const APPROVAL_STATE = /^\.sungen\/(?:journey\/[^/]+\.state\.json|viewpoint-baseline\.json)$/i;
 /** Trace evidence (phase 08, DOS-14.6): the driver's identity answers and the run records. */
-const TRACE_EVIDENCE = /^(?:\.sungen\/trace-identity\/.+|test-results\/sungen-run-record(?:\.[A-Za-z0-9._-]+)?\.json)$/i;
+const TRACE_EVIDENCE = /^(?:\.sungen\/trace-identity\/.+|test-results(?:-free)?\/sungen-run-record(?:\.[A-Za-z0-9._-]+)?\.json)$/i;
 const HOOK_CONTROL = ['qa/sungen.config.yaml', '.claude/settings.json', '.claude/settings.local.json', '.claude/hooks/sungen-hook.cjs'];
 /** The same paths as they appear INSIDE a command string (e.g. in `bash -c "…"` or `python -c "…"`). */
 const MENTIONS = [
@@ -96,9 +98,17 @@ function hookControlPath(abs) {
     const p = posix(path.resolve(abs)).toLowerCase();
     return HOOK_CONTROL.find((rel) => p.endsWith(`/${rel}`)) ?? null;
 }
+/** Names near a protected path — for a word the shell expands (`$Q/decisions/x`), whose real text is unknown. */
+const NEAR_PROTECTED = /qa|\.sungen|\.claude|decision|contracts|lock\.ya?ml|run-record|trace-identity|viewpoint|journey|settings|sungen-hook|sungen\.config/i;
+/** A word the shell rewrites at runtime (`$…`, a literal `\`) that sits near a protected name: the guard cannot read it. */
+const opaqueNearProtected = (word) => /[$\\]/.test(word) && NEAR_PROTECTED.test(word);
+exports.opaqueNearProtected = opaqueNearProtected;
+/** Does this text (a command word, a heredoc, a whole command line) name a protected path as written? */
+const mentionsProtectedText = (text) => MENTIONS.some((re) => re.test(text));
+exports.mentionsProtectedText = mentionsProtectedText;
 /** Does this command word name a protected path — as text, or once resolved against `dir`? */
 function mentionsProtectedPath(word, dir) {
-    if (MENTIONS.some((re) => re.test(word)))
+    if ((0, exports.mentionsProtectedText)(word))
         return true;
     const abs = path.resolve(dir, word);
     return approvalRecordPath(abs) !== null || traceEvidencePath(abs) !== null || hookControlPath(abs) !== null;

package/dist/hooks/guard-protected-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-protected-paths.js","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,gDAKC;AAGD,8CAKC;AAGD,0CAGC;AAGD,sDAIC;AArED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,2CAA6B;AAC7B,+DAAuD;AAEvD,MAAM,IAAI,GAAG,uCAAuC,CAAC;AACrD,MAAM,QAAQ,GAAG,uEAAuE,CAAC;AACzF,MAAM,cAAc,GAAG,uEAAuE,CAAC;AAC/F,8FAA8F;AAC9F,MAAM,cAAc,GAAG,iGAAiG,CAAC;AACzH,MAAM,YAAY,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;AAExI,wGAAwG;AACxG,MAAM,QAAQ,GAAG;IACf,wBAAwB;IACxB,kFAAkF;IAClF,yEAAyE;IACzE,oHAAoH;IACpH,6BAA6B;IAC7B,8DAA8D;CAC/D,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEjE,uHAAuH;AACvH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AACnE,CAAC;AAED,8FAA8F;AAC9F,SAAgB,qBAAqB,CAAC,IAAY,EAAE,GAAW;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9G,CAAC"}
+{"version":3,"file":"guard-protected-paths.js","sourceRoot":"","sources":["../../src/hooks/guard-protected-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,gDAKC;AAGD,8CAKC;AAGD,0CAGC;AAYD,sDAIC;AA/ED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,2CAA6B;AAC7B,+DAAuD;AAEvD,MAAM,IAAI,GAAG,uCAAuC,CAAC;AACrD,MAAM,QAAQ,GAAG,uEAAuE,CAAC;AACzF,MAAM,cAAc,GAAG,uEAAuE,CAAC;AAC/F,8FAA8F;AAC9F,MAAM,cAAc,GAAG,2GAA2G,CAAC;AACnI,MAAM,YAAY,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;AAExI,wGAAwG;AACxG,MAAM,QAAQ,GAAG;IACf,wBAAwB;IACxB,kFAAkF;IAClF,yEAAyE;IACzE,oHAAoH;IACpH,6BAA6B;IAC7B,8DAA8D;CAC/D,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEjE,uHAAuH;AACvH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,IAAA,oCAAc,EAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AACnE,CAAC;AAED,iHAAiH;AACjH,MAAM,cAAc,GAAG,sIAAsI,CAAC;AAE9J,4HAA4H;AACrH,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAjG,QAAA,mBAAmB,uBAA8E;AAE9G,yGAAyG;AAClG,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAAxF,QAAA,qBAAqB,yBAAmE;AAErG,8FAA8F;AAC9F,SAAgB,qBAAqB,CAAC,IAAY,EAAE,GAAW;IAC7D,IAAI,IAAA,6BAAqB,EAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9G,CAAC"}

package/dist/hooks/guard-rules.d.ts

@@ -1,20 +1,3 @@
-/**
- * The pre-tool guard's rules. Each looks at one normalized tool call and returns a decision or
- * null; pre-tool-guard-hook.ts runs them in order (first deny wins, else first ask).
- *
- *   protected-approval-paths  DENY  a precise write (Edit/Write/MultiEdit, or Bash `>`, `tee`,
- *                                   `sed -i`) to a contract lock, a decision record, approval state or
- *                                   trace evidence (.sungen/trace-identity, test-results/sungen-run-record*)
- *   protected-hook-control    ASK   the same writes to the files that control the hooks, so the
- *                                   agent cannot switch its own guard off unasked
- *   bash-protected-mention    ASK   any other Bash segment that names a protected path and does not
- *                                   start with a read-only command (cp, mv, ln, install, rm,
- *                                   bash -c, python -c, perl -i…)
- *
- * A floor, not a sandbox: a path built at runtime, a symlink, or a script file that writes without
- * naming the path on the command line is out of reach by design. Each rule only matches strings,
- * so each fails open (`onError: 'no-op'`); a rule that READS project state must declare `'ask'`.
- */
 import type { HookContext, HookResult } from './hook-result-contract';
 /** One tool call, normalized from the untrusted payload. */
 export interface GuardedCall {

package/dist/hooks/guard-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-rules.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAItE,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iGAAiG;IACjG,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC;IACzB,mFAAmF;IACnF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC;CAC/D;AAMD,eAAO,MAAM,sBAAsB,EAAE,SAqBpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,SAWlC,CAAC;AAQF,eAAO,MAAM,oBAAoB,EAAE,SAalC,CAAC"}
+{"version":3,"file":"guard-rules.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-rules.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOtE,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iGAAiG;IACjG,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC;IACzB,mFAAmF;IACnF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC;CAC/D;AAMD,eAAO,MAAM,sBAAsB,EAAE,SAqBpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,SAWlC,CAAC;AAKF,eAAO,MAAM,oBAAoB,EAAE,SA0BlC,CAAC"}

package/dist/hooks/guard-rules.js

@@ -1,7 +1,64 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bashProtectedMention = exports.protectedHookControl = exports.protectedApprovalPaths = void 0;
+/**
+ * The pre-tool guard's rules. Each looks at one normalized tool call and returns a decision or
+ * null; pre-tool-guard-hook.ts runs them in order (first deny wins, else first ask).
+ *
+ *   protected-approval-paths  DENY  a precise write (Edit/Write/MultiEdit, or Bash `>`, `tee`,
+ *                                   `sed -i`) to a contract lock, a decision record, approval state or
+ *                                   trace evidence (.sungen/trace-identity, test-results[-free]/sungen-run-record*)
+ *   protected-hook-control    ASK   the same writes to the files that control the hooks, so the
+ *                                   agent cannot switch its own guard off unasked
+ *   bash-protected-mention    ASK   any other Bash segment that names a protected path and is not
+ *                                   read-only (cp, mv, ln, install, rm, bash -c, python -c, perl -i…);
+ *                                   a read-only one too when its output is piped into a non-read-only
+ *                                   command, or the line has command substitution or sets shell state
+ *                                   (`X=…`, export, alias, a function…); a heredoc / here-string
+ *                                   that names one; and a write target with a glob or brace (#968 — bash-read-only-segment.ts lists what counts
+ *                                   as read-only, and the accepted floor)
+ *
+ * A floor, not a sandbox: a path built at runtime, a symlink, or a script file that writes without
+ * naming the path on the command line is out of reach by design (the full list of what the floor
+ * does not catch is in bash-read-only-segment.ts; release-time decision integrity is the backstop). Each rule only matches strings,
+ * so each fails open (`onError: 'no-op'`); a rule that READS project state must declare `'ask'`.
+ */
+const path = __importStar(require("path"));
 const bash_write_targets_1 = require("./bash-write-targets");
+const bash_read_only_segment_1 = require("./bash-read-only-segment");
 const guard_protected_paths_1 = require("./guard-protected-paths");
 /** The files a call writes precisely: a file tool's target, or Bash's `>` / `tee` / `sed -i` targets. */
 const preciseWrites = (call) => call.tool === 'Bash' ? (0, bash_write_targets_1.bashSegments)(call.bashCommand ?? '', call.cwd).flatMap((s) => s.writes) : call.filePaths;
@@ -39,23 +96,35 @@ exports.protectedHookControl = {
         } : null;
     },
 };
-/** Segments that only read: they may name a protected path freely. */
-const READ_ONLY = new Set(['cat', 'ls', 'head', 'tail', 'grep', 'rg', 'wc', 'diff', 'sungen', 'sungen.js']);
-const GIT_READ_ONLY = new Set(['diff', 'log', 'show', 'status']);
-const isReadOnly = (cmd, words) => READ_ONLY.has(cmd) || (cmd === 'git' && GIT_READ_ONLY.has(words.find((w) => !w.startsWith('-')) ?? ''));
+/** A heredoc or here-string: its body is another program's input, which the segments do not see. */
+const HEREDOC = /<</;
 exports.bashProtectedMention = {
     id: 'bash-protected-mention',
     onError: 'no-op',
     check(call) {
-        if (call.tool !== 'Bash' || !call.bashCommand)
+        const command = call.tool === 'Bash' ? call.bashCommand : undefined;
+        if (!command)
             return null;
-        const seg = (0, bash_write_targets_1.bashSegments)(call.bashCommand, call.cwd)
-            .find((s) => s.cmd && !isReadOnly(s.cmd, s.words) && s.words.some((w) => (0, guard_protected_paths_1.mentionsProtectedPath)(w, s.dir)));
-        return seg ? {
+        const segs = (0, bash_write_targets_1.bashSegments)(command, call.cwd);
+        const lineExempt = (0, bash_read_only_segment_1.lineKeepsReadOnlyExemption)(command, segs);
+        // the command word too: zsh `for f (qa/decisions/*) …` puts the list where a command name goes
+        const names = (s) => [s.cmdPath, ...s.words, ...s.assigns.map((a) => a.slice(a.indexOf('=') + 1))]
+            .some((w) => w !== '' && ((0, guard_protected_paths_1.mentionsProtectedPath)(w, s.dir) || (0, guard_protected_paths_1.opaqueNearProtected)(w)));
+        const seg = segs.find((s, i) => names(s) && !(lineExempt && (0, bash_read_only_segment_1.isReadOnlySegment)(s) && (0, bash_read_only_segment_1.pipelineStaysReadOnly)(segs, i)));
+        // a write target the shell expands (`> q*/decisions/x`, `--output=qa/{a,b}`, `> $Q/decisions/x`, a literal `\`),
+        // or a relative one after a `cd` the guard could not follow, cannot be judged by its text
+        const opaqueWrite = segs.some((s) => s.writesInUnknownDir || s.writes.some((w) => {
+            const rel = path.relative(s.dir, w);
+            return /[*?[{\\]/.test(rel) || (0, guard_protected_paths_1.opaqueNearProtected)(rel);
+        }));
+        if (!seg && !opaqueWrite && !(HEREDOC.test(command) && (0, guard_protected_paths_1.mentionsProtectedText)(command)))
+            return null;
+        const what = seg ? (seg.cmd ? `\`${seg.cmd}\` command` : 'variable') : opaqueWrite ? 'write target the guard cannot resolve' : 'heredoc';
+        return {
             status: 'ask',
-            askReason: `sungen: this \`${seg.cmd}\` command names a contract lock, a decision record, approval state or a hook-control file, `
+            askReason: `sungen: this ${what} names a contract lock, a decision record, approval state or a hook-control file, `
                 + 'and the guard cannot tell whether it writes it. Allow only if you asked for exactly this.',
-        } : null;
+        };
     },
 };
 //# sourceMappingURL=guard-rules.js.map

package/dist/hooks/guard-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-rules.js","sourceRoot":"","sources":["../../src/hooks/guard-rules.ts"],"names":[],"mappings":";;;AAkBA,6DAAoD;AACpD,mEAAwH;AAmBxH,yGAAyG;AACzG,MAAM,aAAa,GAAG,CAAC,IAAiB,EAAY,EAAE,CACpD,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAA,iCAAY,EAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;AAErG,QAAA,sBAAsB,GAAc;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,0CAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChF,IAAI,GAAG,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,aAAa,GAAG,iFAAiF;sBACzG,0GAA0G;sBAC1G,wDAAwD;aAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,aAAa,QAAQ,sFAAsF;kBACnH,0GAA0G;SAC/G,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC;AAEW,QAAA,oBAAoB,GAAc;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uCAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,aAAa,GAAG,mFAAmF;kBAC1G,mHAAmH;SACxH,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC;AAEF,sEAAsE;AACtE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5G,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,KAAe,EAAW,EAAE,CAC3D,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAE7F,QAAA,oBAAoB,GAAc;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAA,iCAAY,EAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,6CAAqB,EAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7G,OAAO,GAAG,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,kBAAkB,GAAG,CAAC,GAAG,8FAA8F;kBAC9H,2FAA2F;SAChG,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC"}
+{"version":3,"file":"guard-rules.js","sourceRoot":"","sources":["../../src/hooks/guard-rules.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,2CAA6B;AAE7B,6DAAiE;AACjE,qEAAgH;AAChH,mEAEiC;AAmBjC,yGAAyG;AACzG,MAAM,aAAa,GAAG,CAAC,IAAiB,EAAY,EAAE,CACpD,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAA,iCAAY,EAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;AAErG,QAAA,sBAAsB,GAAc;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,0CAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChF,IAAI,GAAG,EAAE,CAAC;YACR,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,aAAa,GAAG,iFAAiF;sBACzG,0GAA0G;sBAC1G,wDAAwD;aAC7D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,aAAa,QAAQ,sFAAsF;kBACnH,0GAA0G;SAC/G,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC;AAEW,QAAA,oBAAoB,GAAc;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,uCAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,aAAa,GAAG,mFAAmF;kBAC1G,mHAAmH;SACxH,CAAC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;CACF,CAAC;AAEF,oGAAoG;AACpG,MAAM,OAAO,GAAG,IAAI,CAAC;AAER,QAAA,oBAAoB,GAAc;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAA,iCAAY,EAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAA,mDAA0B,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,+FAA+F;QAC/F,MAAM,KAAK,GAAG,CAAC,CAAc,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACrH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAA,6CAAqB,EAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAA,2CAAmB,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,IAAA,0CAAiB,EAAC,CAAC,CAAC,IAAI,IAAA,8CAAqB,EAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,iHAAiH;QACjH,0FAA0F;QAC1F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACpC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAA,2CAAmB,EAAC,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAA,6CAAqB,EAAC,OAAO,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpG,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzI,OAAO;YACL,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,gBAAgB,IAAI,oFAAoF;kBAC/G,2FAA2F;SAChG,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/hooks/guard-tty-spoof-rule.d.ts

@@ -2,7 +2,9 @@
  * Guard rule `tty-spoof` (phase 06, M5): ASK before an agent runs a human-confirmed sungen command
  * through a terminal emulator.
  *
- * `contract approve`, `journey --waive` and `journey --decide` refuse without a TTY (DOS-13.4), and
+ * `contract approve`, `journey --waive`, `journey --decide`, `journey --signoff`, `triage --as test-defect|environment`
+ * (#928: a red classified away from the product-defect path) and `delivery --accept-in-run` (delivering past
+ * decisions recorded during the run) refuse without a TTY (DOS-13.4), and
  * an agent's Bash has none — unless it borrows one: `script`, `expect`, `unbuffer`, or a pty from
  * Python/Perl/zsh. Then the prompt sees a "terminal" and a piped phrase reads as a human typing it.
  * This rule spots the pair in the raw command (quotes included, so `bash -c "…"` and `expect -c '…'`

package/dist/hooks/guard-tty-spoof-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-tty-spoof-rule.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-tty-spoof-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAK/C,eAAO,MAAM,QAAQ,EAAE,SAatB,CAAC"}
+{"version":3,"file":"guard-tty-spoof-rule.d.ts","sourceRoot":"","sources":["../../src/hooks/guard-tty-spoof-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAK/C,eAAO,MAAM,QAAQ,EAAE,SActB,CAAC"}

package/dist/hooks/guard-tty-spoof-rule.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ttySpoof = void 0;
 const TTY_EMULATOR = /\b(?:script|unbuffer|expect|pty|zpty|openpty|forkpty|ptyprocess)\b/i;
-const HUMAN_GATED = /\bsungen\b[\s\S]*?\b(?:contract['",\s]+approve\b|journey\b[\s\S]*?--(?:waive|decide)\b)/i;
+const HUMAN_GATED = /\bsungen\b[\s\S]*?\b(?:contract['",\s]+approve\b|journey\b[\s\S]*?--(?:waive|decide|signoff)\b|triage\b[\s\S]*?--as[\s='",]+(?:test-defect|environment)\b|delivery\b[\s\S]*?--accept-in-run\b)/i;
 exports.ttySpoof = {
     id: 'tty-spoof',
     onError: 'no-op',
@@ -12,7 +12,8 @@ exports.ttySpoof = {
             return null;
         return {
             status: 'ask',
-            askReason: 'sungen: this runs a human-confirmed sungen action (`contract approve` / `journey --waive|--decide`) through a terminal '
+            askReason: 'sungen: this runs a human-confirmed sungen action (`contract approve` / `journey --waive|--decide|--signoff` / '
+                + '`triage --as test-defect|environment` / `delivery --accept-in-run`) through a terminal '
                 + 'emulator (script / expect / unbuffer / pty). Those confirmations exist so a PERSON at a terminal decides — allow only if you '
                 + 'are that person and asked for exactly this; otherwise run the command yourself in your own terminal.',
         };

package/dist/hooks/guard-tty-spoof-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-tty-spoof-rule.js","sourceRoot":"","sources":["../../src/hooks/guard-tty-spoof-rule.ts"],"names":[],"mappings":";;;AAcA,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAC3F,MAAM,WAAW,GAAG,0FAA0F,CAAC;AAElG,QAAA,QAAQ,GAAc;IACjC,EAAE,EAAE,WAAW;IACf,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO;YACL,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,yHAAyH;kBAChI,+HAA+H;kBAC/H,sGAAsG;SAC3G,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"guard-tty-spoof-rule.js","sourceRoot":"","sources":["../../src/hooks/guard-tty-spoof-rule.ts"],"names":[],"mappings":";;;AAgBA,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAC3F,MAAM,WAAW,GAAG,iMAAiM,CAAC;AAEzM,QAAA,QAAQ,GAAc;IACjC,EAAE,EAAE,WAAW;IACf,OAAO,EAAE,OAAO;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO;YACL,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,iHAAiH;kBACxH,yFAAyF;kBACzF,+HAA+H;kBAC/H,sGAAsG;SAC3G,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/hooks/hand-back-core.d.ts

@@ -1,11 +1,13 @@
 import { NextStep, UnitState } from '../harness/next-step';
 import { HookContext, HookInput, HookResult } from './hook-result-contract';
 import { UnitRef } from './sungen-project-root';
-export declare function handBackLine(unit?: string): string;
+/** `invocation`: how the project runs sungen (`npx sungen` with a local install, #939). */
+export declare function handBackLine(unit?: string, invocation?: string): string;
 export interface CliHandBackState {
     unit?: string;
     machine: boolean;
     silent: boolean;
+    answer: boolean;
     actionRan: boolean;
 }
 /** The default, set before commander parses — what a usage error or a fatal error hands back. */
@@ -24,14 +26,17 @@ export declare function exitHandBack(state: CliHandBackState, code: number, cwd:
 export declare function attachCliHandBack(argv: string[], cwd: string): {
     onAction: (name: string, opts: Record<string, unknown>, args: unknown[]) => void;
 };
-/** `sungen next` rendered compactly for an agent's context. */
-export declare function formatSteps(steps: NextStep[], max?: number): string[];
+/**
+ * `sungen next` rendered compactly for an agent's context; commands — the step's own and those quoted in
+ * its reason (#966) — as `root` runs sungen, the way `sungen next` prints them.
+ */
+export declare function formatSteps(steps: NextStep[], max?: number, root?: string): string[];
 /** The unit a session is on (a named one when it exists, else the nearest) and its derived state. */
 export declare function locateUnitState(ctx: HookContext, preferred?: string): {
     root: string;
     unit: UnitRef;
     state: UnitState;
 } | null;
-/** Hook core: the next steps for the session's unit (input.unit, else the nearest) as context. */
+/** Hook core: the next steps for the session's unit (input.unit, else the nearest) as context, then what waits for a human (#954). */
 export declare function run(input: HookInput, ctx: HookContext): HookResult;
 //# sourceMappingURL=hand-back-core.d.ts.map

package/dist/hooks/hand-back-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hand-back-core.d.ts","sourceRoot":"","sources":["../../src/hooks/hand-back-core.ts"],"names":[],"mappings":"AAaA,OAAO,EAAiB,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAS,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAyC,OAAO,EAAE,MAAM,uBAAuB,CAAC;AASvF,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,MAAM,WAAW,gBAAgB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AAE1G,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAUrE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAOvH;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQrI;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;CAAE,CASnJ;AAMD,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAI,GAAG,MAAM,EAAE,CAGhE;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAK9H;AAED,kGAAkG;AAClG,wBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,UAAU,CAOlE"}
+{"version":3,"file":"hand-back-core.d.ts","sourceRoot":"","sources":["../../src/hooks/hand-back-core.ts"],"names":[],"mappings":"AAeA,OAAO,EAAiB,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAS,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAyC,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAWvF,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,SAAW,GAAG,MAAM,CAEzE;AAED,MAAM,WAAW,gBAAgB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AAE3H,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAUrE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAQvH;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASrI;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;CAAE,CASnJ;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAI,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAI/E;AAED,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAK9H;AAED,sIAAsI;AACtI,wBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,UAAU,CAQlE"}