@tekmidian/pai 1.0.4 → 1.0.6

package/src/hooks/ts/lib/rules/lint.ts

@@ -0,0 +1,102 @@
+/**
+ * lint.ts — run each rule's own fixtures.
+ *
+ * Every `tests.match` must hit the rule, every `tests.no_match` must not.
+ * A single-step rule's fixtures are plain strings tested as Bash commands; a
+ * sequence rule's are lists of step contents, checked step by step (the
+ * window and ordering are the scan's business, not the fixtures'). A rule
+ * with no fixtures is ok (nothing to check).
+ */
+
+import { evaluateRules } from "./eval.js";
+import type { Rule, RuleSequenceStep } from "./types.js";
+
+export interface RuleLint {
+  id: string;
+  ok: boolean;
+  failures: string[];
+}
+
+function stepRegex(step: RuleSequenceStep): RegExp | null {
+  try {
+    return new RegExp(step.match, step.flags ?? "");
+  } catch {
+    return null;
+  }
+}
+
+/** One fixture step: the content tested, optionally the tool it belongs to. */
+interface FixtureStep {
+  tool?: string;
+  content: string;
+}
+
+/**
+ * A fixture sequence hits when every step's regex matches its content and its
+ * tool pin, when set. A plain string is a Bash-shaped step; an object names
+ * the tool, so a rule whose step is pinned to a fetched result (WebFetch,
+ * Read) can still carry a fixture that hits. A step whose source
+ * backreferences an earlier step's group (`\1`) is checked with that group's
+ * capture substituted in — the same resolution the transcript scan applies —
+ * so a fixture like download-then-execute's "same file twice" checks the way
+ * the scan does.
+ */
+function sequenceHit(rule: Rule, steps: FixtureStep[]): boolean {
+  const seqSteps = rule.sequence?.steps ?? [];
+  if (steps.length !== seqSteps.length) return false;
+  const prior: RegExpMatchArray[] = [];
+  for (let i = 0; i < seqSteps.length; i++) {
+    const step = seqSteps[i];
+    const { tool, content } = steps[i];
+    if (step.tool && !new RegExp(step.tool).test(tool ?? "Bash")) return false;
+    // a step that names an earlier step's capture (`\1`) is checked with that
+    // capture substituted in — the raw `\1` can never match text
+    if (step.match.includes("\\1") && prior.length) {
+      const cap = prior[0][1];
+      if (!cap || !new RegExp(step.match.replace(/\\1/g, cap), step.flags ?? "").test(content)) return false;
+      continue;
+    }
+    const re = stepRegex(step);
+    if (!re) return false;
+    const m = content.match(re);
+    if (!m) return false;
+    prior.push(m);
+  }
+  return true;
+}
+
+/** A fixture sequence as written in yaml: a list of strings or {tool, content} objects. */
+type FixtureSequence = Array<string | { tool?: string; content: string }>;
+
+function asFixtureSteps(t: string | FixtureSequence): FixtureStep[] | null {
+  if (!Array.isArray(t)) return null;
+  return t.map((s) => (typeof s === "string" ? { content: s } : { tool: s.tool, content: s.content }));
+}
+
+export function lintRules(rules: Rule[]): RuleLint[] {
+  return rules.map((rule) => {
+    const failures: string[] = [];
+    const show = (t: string | FixtureSequence): string =>
+      Array.isArray(t) ? t.map((s) => (typeof s === "string" ? s : `${s.tool ?? "Bash"}: ${s.content}`)).join(" | ") : t;
+    if (rule.sequence) {
+      for (const t of rule.tests?.match ?? []) {
+        const steps = asFixtureSteps(t);
+        if (!steps || !sequenceHit(rule, steps)) failures.push(`tests.match did not hit: ${show(t)}`);
+      }
+      for (const t of rule.tests?.no_match ?? []) {
+        const steps = asFixtureSteps(t);
+        if (steps && sequenceHit(rule, steps)) failures.push(`tests.no_match hit: ${show(t)}`);
+      }
+      return { id: rule.id, ok: failures.length === 0, failures };
+    }
+    for (const text of (rule.tests?.match ?? []) as string[]) {
+      const hit = evaluateRules([rule], "Bash", text);
+      if (!hit || hit.rule.id !== rule.id) failures.push(`tests.match did not hit: ${text}`);
+    }
+    for (const text of (rule.tests?.no_match ?? []) as string[]) {
+      const hit = evaluateRules([rule], "Bash", text);
+      if (hit && hit.rule.id === rule.id) failures.push(`tests.no_match hit: ${text}`);
+    }
+    return { id: rule.id, ok: failures.length === 0, failures };
+  });
+}

package/src/hooks/ts/lib/rules/load.ts

@@ -0,0 +1,229 @@
+/**
+ * load.ts — read `*.rule.yaml` files from directories into rules.
+ *
+ * One rule per file, or a top-level list of rules. A bad regex or a missing
+ * field is reported in `errors` and the rule is skipped — this never throws,
+ * because hooks fail open and a broken user rule must not break the hook.
+ *
+ * Directories are read in order; a later rule with the same id replaces an
+ * earlier one (user rules override built-ins), and `severity: off` disables
+ * that id entirely.
+ */
+
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { defaultPaiHomeDir, legacyPaiHomeDir } from "../../../../config/pai-home.js";
+import { BUILTIN_RULES } from "./builtin.generated.js";
+import type { LoadedRule, Rule, RuleSequence, RuleSequenceStep, RuleSeverity } from "./types.js";
+
+const SEVERITIES: RuleSeverity[] = ["block", "confirm", "warn", "off"];
+
+/** A YAML regex node (`/foo/i`) split into source and flags; a plain string is the source. */
+function splitRegex(value: string): { source: string; flags: string } {
+  const isRegexNode = value.length > 2 && value.startsWith("/") && /\/[a-z]*$/.test(value);
+  return isRegexNode
+    ? { source: value.slice(1, value.lastIndexOf("/")), flags: value.slice(value.lastIndexOf("/") + 1) }
+    : { source: value, flags: "" };
+}
+
+/** A sequence mapping, validated (steps, window, order, every step regex compiles), or null with an error pushed. */
+function asSequence(raw: Record<string, unknown>, id: string, source: string, errors: string[]): RuleSequence | null {
+  const seq = raw.sequence;
+  if (typeof seq !== "object" || seq === null || Array.isArray(seq)) {
+    errors.push(`${source} (${id}): sequence must be a mapping`);
+    return null;
+  }
+  const s = seq as Record<string, unknown>;
+  const rawSteps = Array.isArray(s.steps) ? s.steps : [];
+  const steps: RuleSequenceStep[] = [];
+  for (const item of rawSteps) {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) {
+      errors.push(`${source} (${id}): sequence step must be a mapping`);
+      return null;
+    }
+    const step = item as Record<string, unknown>;
+    const match = typeof step.match === "string" ? step.match : "";
+    if (!match) {
+      errors.push(`${source} (${id}): sequence step missing match`);
+      return null;
+    }
+    const split = splitRegex(match);
+    const flags = typeof step.flags === "string" ? step.flags : split.flags;
+    try {
+      new RegExp(split.source, flags);
+    } catch (e) {
+      errors.push(`${source} (${id}): sequence step invalid regex: ${e instanceof Error ? e.message : String(e)}`);
+      return null;
+    }
+    steps.push({
+      tool: typeof step.tool === "string" ? step.tool : undefined,
+      match: split.source,
+      flags: flags || undefined,
+    });
+  }
+  if (!steps.length) {
+    errors.push(`${source} (${id}): sequence has no steps`);
+    return null;
+  }
+  const window = Number(s.window_seconds);
+  if (!Number.isFinite(window) || window <= 0) {
+    errors.push(`${source} (${id}): sequence needs a positive window_seconds`);
+    return null;
+  }
+  const order = s.order === "any" ? "any" : s.order === "strict" ? "strict" : null;
+  if (!order) {
+    errors.push(`${source} (${id}): sequence order must be strict or any`);
+    return null;
+  }
+  return { steps, window_seconds: window, order };
+}
+
+/**
+ * The user rule directories: PAI_HOME/rules and .pai/rules under the cwd.
+ * PAI_HOME is resolved like paiHomeDir() but without its stderr migration
+ * notice — a hook's stderr is machinery, and reading a rules directory is
+ * not a reason to complain about it.
+ */
+export function userRuleDirs(cwd: string = process.cwd()): string[] {
+  const home = process.env.PAI_HOME
+    ? process.env.PAI_HOME
+    : !existsSync(join(defaultPaiHomeDir(), "config.yaml")) && existsSync(join(legacyPaiHomeDir(), "config.yaml"))
+      ? legacyPaiHomeDir()
+      : defaultPaiHomeDir();
+  return [join(home, "rules"), join(cwd, ".pai", "rules")];
+}
+
+function asRule(value: unknown, source: string, errors: string[]): Rule | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    errors.push(`${source}: not a mapping`);
+    return null;
+  }
+  const raw = value as Record<string, unknown>;
+  const id = typeof raw.id === "string" ? raw.id : "";
+  const severity = raw.severity as RuleSeverity;
+  const reason = typeof raw.reason === "string" ? raw.reason : "";
+  if (!id) {
+    errors.push(`${source}: missing id`);
+    return null;
+  }
+  if (!SEVERITIES.includes(severity)) {
+    errors.push(`${source} (${id}): severity must be block, confirm, warn or off`);
+    return null;
+  }
+  if (!reason) {
+    errors.push(`${source} (${id}): missing reason`);
+    return null;
+  }
+  // `severity: off` disables the id; it needs no match.
+  if (severity === "off") return { id, severity, reason };
+  const match = typeof raw.match === "string" ? raw.match : "";
+  // A sequence rule carries its patterns in `sequence.steps` instead of `match`.
+  if (raw.sequence !== undefined) {
+    const sequence = asSequence(raw, id, source, errors);
+    if (!sequence) return null;
+    return { id, severity, sequence, category: typeof raw.category === "string" ? raw.category : undefined, reason, tests: asTests(raw) };
+  }
+  if (!match) {
+    errors.push(`${source} (${id}): missing match`);
+    return null;
+  }
+  // YAML accepts a bare regex node (`match: /foo/i`); a plain string is the
+  // regex source with flags in `flags`.
+  const split = splitRegex(match);
+  const flags = typeof raw.flags === "string" ? raw.flags : split.flags;
+  const source2 = split.source;
+  try {
+    new RegExp(source2, flags);
+  } catch (e) {
+    errors.push(`${source} (${id}): invalid regex: ${e instanceof Error ? e.message : String(e)}`);
+    return null;
+  }
+  return {
+    id,
+    severity,
+    tool: typeof raw.tool === "string" ? raw.tool : undefined,
+    category: typeof raw.category === "string" ? raw.category : undefined,
+    match: source2,
+    flags: flags || undefined,
+    quoted: raw.quoted === true ? true : undefined,
+    reason,
+    tests: asTests(raw),
+  };
+}
+
+/** Fixtures: plain strings for a single-step rule, lists of step contents for a sequence rule. */
+function asTests(raw: Record<string, unknown>): Rule["tests"] {
+  if (typeof raw.tests !== "object" || raw.tests === null || Array.isArray(raw.tests)) return undefined;
+  const t = raw.tests as Record<string, unknown>;
+  const list = (v: unknown): string[] | string[][] | undefined => {
+    if (!Array.isArray(v)) return undefined;
+    return v.every((x) => Array.isArray(x)) ? (v as unknown[][]).map((x) => x.map(String)) : v.map(String);
+  };
+  return { match: list(t.match), no_match: list(t.no_match) };
+}
+
+/** Rules from one directory's `*.rule.yaml` files, in filename order. */
+function loadDir(dir: string, errors: string[]): LoadedRule[] {
+  const out: LoadedRule[] = [];
+  let names: string[];
+  try {
+    names = readdirSync(dir).filter((f) => f.endsWith(".rule.yaml")).sort();
+  } catch {
+    return out; // missing directory is not an error
+  }
+  for (const name of names) {
+    const source = join(dir, name);
+    let text: string;
+    try {
+      text = readFileSync(source, "utf8");
+    } catch (e) {
+      errors.push(`${source}: ${e instanceof Error ? e.message : String(e)}`);
+      continue;
+    }
+    let doc: unknown;
+    try {
+      doc = parse(text);
+    } catch (e) {
+      errors.push(`${source}: ${e instanceof Error ? e.message : String(e)}`);
+      continue;
+    }
+    const items = Array.isArray(doc) ? doc : [doc];
+    for (const item of items) {
+      const rule = asRule(item, source, errors);
+      if (rule) out.push({ ...rule, source });
+    }
+  }
+  return out;
+}
+
+/**
+ * Built-in rules first, then each directory in order; a later rule with the
+ * same id replaces the earlier one, and `severity: off` removes the id.
+ */
+export function loadRules(dirs: string[]): { rules: Rule[]; errors: string[] } {
+  const errors: string[] = [];
+  const byId = new Map<string, LoadedRule>();
+  for (const rule of BUILTIN_RULES) byId.set(rule.id, rule);
+  for (const dir of dirs) {
+    for (const rule of loadDir(dir, errors)) byId.set(rule.id, rule);
+  }
+  const rules: Rule[] = [];
+  for (const rule of byId.values()) {
+    if (rule.severity === "off") continue;
+    const { source: _source, ...rest } = rule;
+    rules.push(rest);
+  }
+  return { rules, errors };
+}
+
+/** Every rule with its source and enabled state, for `pai rules list`. */
+export function listRules(dirs: string[]): { rules: LoadedRule[]; errors: string[] } {
+  const errors: string[] = [];
+  const byId = new Map<string, LoadedRule>();
+  for (const rule of BUILTIN_RULES) byId.set(rule.id, rule);
+  for (const dir of dirs) {
+    for (const rule of loadDir(dir, errors)) byId.set(rule.id, rule);
+  }
+  return { rules: [...byId.values()], errors };
+}

package/src/hooks/ts/lib/rules/types.ts

@@ -0,0 +1,56 @@
+/**
+ * types.ts — the shape of a security rule. Rules live in `*.rule.yaml` files
+ * (built-ins under ./builtin/, user rules under PAI_HOME/rules and
+ * .pai/rules), so patterns can be extended without editing TypeScript, and
+ * every rule carries its own fixtures.
+ */
+
+export type RuleSeverity = "block" | "confirm" | "warn" | "off";
+
+/** One step of a sequence rule: a regex on the tool's content, optionally pinned to a tool. */
+export interface RuleSequenceStep {
+  /** Regex on the tool name; any tool when absent. */
+  tool?: string;
+  /** Regex source; flags come from `flags`. */
+  match: string;
+  flags?: string;
+}
+
+/**
+ * A two-step (or more) pattern: every step must occur within `window_seconds`
+ * of the first, in step order when `order` is "strict". Sequence rules are not
+ * evaluated live by the hook (eval.ts) — they are for the after-the-fact scan
+ * over a transcript (`pai audit scan`).
+ */
+export interface RuleSequence {
+  steps: RuleSequenceStep[];
+  window_seconds: number;
+  order: "strict" | "any";
+}
+
+export interface Rule {
+  id: string;
+  severity: RuleSeverity;
+  /** Regex on the tool name; default "Bash". */
+  tool?: string;
+  /** Regex source; flags come from `flags`. Required unless severity is "off" or `sequence` is set. */
+  match?: string;
+  flags?: string;
+  /** Multi-step pattern; see RuleSequence. */
+  sequence?: RuleSequence;
+  /** Also test the text with only the quote marks removed (default: quoted strings are dropped). */
+  quoted?: boolean;
+  /** Legacy group name shown in deny messages and security events; defaults to the id. */
+  category?: string;
+  reason: string;
+  /** Built-in fixtures: every `match` must hit, every `no_match` must not. For a sequence rule each entry is the list of steps, in step order: a plain string is a Bash-shaped step, an object names the tool a step's content belongs to. */
+  tests?: {
+    match?: Array<string | string[] | Array<string | { tool?: string; content: string }>>;
+    no_match?: Array<string | string[] | Array<string | { tool?: string; content: string }>>;
+  };
+}
+
+/** Where a rule came from, for `pai rules list`. */
+export interface LoadedRule extends Rule {
+  source: string;
+}

package/src/hooks/ts/pre-tool-use/security-validator.ts

@@ -23,75 +23,22 @@ import { dirname, resolve } from 'path';
 import { securityEventsPath } from '../lib/pai-paths.js';
 import { isSharedCheckout } from '../lib/shared-checkout.js';
 import { maskSecrets } from '../lib/loop-guard.js';
-import { decideWorkerGitGuard, splitSegments, workerGitGuardMessage } from '../lib/worker-git-guard.js';
+import { decideWorkerGitGuard, workerGitGuardMessage } from '../lib/worker-git-guard.js';
 import { detectUnsafePlutil, plutilGuardMessage } from '../lib/plutil-guard.js';
+import { loadRules, userRuleDirs } from '../lib/rules/load.js';
+import { evaluateRules } from '../lib/rules/eval.js';
 import { readWorkersSection } from '../../../workers/config.js';
 import { workersLogDir } from '../../../workers/paths.js';
 import { worktreesDir } from '../../../workers/worktree.js';
 
 // ============================================================================
-// ATTACK PATTERNS - CUSTOMIZE THESE FOR YOUR ENVIRONMENT
+// ATTACK RULES
 // ============================================================================
+// Patterns live in *.rule.yaml files: built-ins under lib/rules/builtin/
+// (embedded at build time), user rules under PAI_HOME/rules and .pai/rules.
+// Loaded once per hook process; a broken rule file is skipped, never fatal.
 
-// Example: Reverse Shell Patterns (BLOCK - rarely legitimate)
-const REVERSE_SHELL_PATTERNS: RegExp[] = [
-  /\/dev\/(tcp|udp)\/[0-9]/,                    // Bash TCP/UDP device
-  /bash\s+-i\s+>&?\s*\/dev\//,                  // Interactive bash redirect
-  // Add your own reverse shell patterns here
-];
-
-// Example: Instruction Override (BLOCK - prompt injection)
-const INSTRUCTION_OVERRIDE_PATTERNS: RegExp[] = [
-  /ignore\s+(all\s+)?previous\s+instructions?/i,
-  /disregard\s+(all\s+)?(prior|previous)\s+(instructions?|rules?)/i,
-  // Add your own prompt injection patterns here
-];
-
-// Example: Catastrophic Deletion Patterns (BLOCK - filesystem destruction)
-const CATASTROPHIC_DELETION_PATTERNS: RegExp[] = [
-  // The destructive verb must sit in command position (line start, after
-  // ; & | ( ` $( or sudo), so `~`, `/` and `-` inside awk programs or python
-  // strings never match on their own.
-  // Recursive rm of /, ~, $HOME or a system directory
-  /(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?rm\s+(?:-\S+\s+)*(?:-\w*[rR]\w*|--recursive)\s+(?:-\S+\s+)*(?:\S+\s+)*(?:\/\*?|~\/?\*?|\$\{?HOME\}?\/?\*?|\/(?:usr|etc|bin|sbin|lib|var|opt|home|System|Library|Users|Applications)\/?\*?)(?=\s|;|&|\||$)/m,
-  // find / -delete
-  /(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?find\s+(?:\/|~|\$\{?HOME\}?)\/?\s+(?:\S+\s+)*?-delete\b/m,
-
-  // Trailing tilde bypass
-  /(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?rm\s+(?:-[rfivd]+\s+)*\S+\s+~\/?(?:\s|$)/m, // rm something ~/
-
-  // Relative path recursive deletion
-  /(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?rm\s+(?:-[rfivd]+\s+)*\.\/\s*$/m,     // rm -rf ./
-  /(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?rm\s+(?:-[rfivd]+\s+)*\.\.\/\s*$/m,   // rm -rf ../
-
-  // Add your own dangerous deletion patterns here
-];
-
-// Example: Dangerous File Operations (BLOCK - data destruction)
-const DANGEROUS_FILE_OPS_PATTERNS: RegExp[] = [
-  /\bchmod\s+(-R\s+)?0{3,}/,                        // chmod 000
-  // Add your own dangerous file operation patterns here
-];
-
-// OPTIONAL: Operations that require confirmation instead of blocking
-const DANGEROUS_GIT_PATTERNS: RegExp[] = [
-  /\bgit\b.*\spush\b.*(\s-f\b|\s--force(\s|$))/i,  // git push -f / --force; --force-with-lease and --follow-tags pass
-  /\bgit\b.*\spush\b.*\s\+\S/i,                  // a plus-prefixed refspec forces the update without -f
-  /\bgit\s+reset\s+--hard/i,                        // git reset --hard
-  // Add your own git safety patterns here
-];
-
-// Combined patterns for fast iteration
-const ALL_BLOCK_PATTERNS: { category: string; patterns: RegExp[] }[] = [
-  { category: 'reverse_shell', patterns: REVERSE_SHELL_PATTERNS },
-  { category: 'instruction_override', patterns: INSTRUCTION_OVERRIDE_PATTERNS },
-  { category: 'catastrophic_deletion', patterns: CATASTROPHIC_DELETION_PATTERNS },
-  { category: 'dangerous_file_ops', patterns: DANGEROUS_FILE_OPS_PATTERNS },
-];
-
-const CONFIRM_PATTERNS: { category: string; patterns: RegExp[] }[] = [
-  { category: 'dangerous_git', patterns: DANGEROUS_GIT_PATTERNS },
-];
+const RULES = loadRules(userRuleDirs(process.cwd())).rules;
 
 // ============================================================================
 // TYPES
@@ -147,45 +94,18 @@ function deny(reason: string): never {
 interface DetectionResult {
   blocked: boolean;
   requiresConfirmation?: boolean;
+  warned?: boolean;
   category?: string;
   pattern?: string;
 }
 
-/** Quoted strings removed: text inside a commit message or echo is not a command. */
-function dropQuoted(segment: string): string {
-  return segment.replace(/"(?:\\.|[^"\\])*"|'[^']*'/g, '""');
-}
-
-/** A quoted +refspec is still a forced push, so push segments also test with only the quote marks removed. */
-function gitPatternHit(pattern: RegExp, segment: string): boolean {
-  const bare = dropQuoted(segment);
-  if (pattern.test(bare)) return true;
-  return /\bgit\b.*\spush\b/.test(bare) && pattern.test(segment.replace(/["']/g, ''));
-}
-
+/** First block hit, else first confirm hit, else first warn hit (category = the rule's group, else its id). */
 function detectAttack(content: string): DetectionResult {
-  // A quoted target is the same target: test the text with quote marks removed too.
-  const unquoted = content.replace(/["']/g, '');
-  // First check for hard blocks
-  for (const { category, patterns } of ALL_BLOCK_PATTERNS) {
-    for (const pattern of patterns) {
-      if (pattern.test(content) || pattern.test(unquoted)) {
-        return { blocked: true, category, pattern: pattern.source };
-      }
-    }
-  }
-
-  // Then check for confirmation-required patterns
-  const segments = splitSegments(content);
-  for (const { category, patterns } of CONFIRM_PATTERNS) {
-    for (const pattern of patterns) {
-      if (segments.some((seg) => gitPatternHit(pattern, seg))) {
-        return { blocked: false, requiresConfirmation: true, category, pattern: pattern.source };
-      }
-    }
-  }
-
-  return { blocked: false };
+  const hit = evaluateRules(RULES, 'Bash', content);
+  if (!hit) return { blocked: false };
+  if (hit.rule.severity === 'block') return { blocked: true, category: hit.rule.category ?? hit.rule.id, pattern: hit.rule.match };
+  if (hit.rule.severity === 'confirm') return { blocked: false, requiresConfirmation: true, category: hit.rule.category ?? hit.rule.id, pattern: hit.rule.match };
+  return { blocked: false, warned: true, category: hit.rule.category ?? hit.rule.id, pattern: hit.rule.match };
 }
 
 // ============================================================================
@@ -334,7 +254,18 @@ async function main(): Promise<void> {
     deny(`This is a dangerous operation (${command.slice(0, 50)}...). This can cause data loss. If you're sure, explicitly confirm this command.`);
   }
 
-  // Allow - no logging, immediate exit
+  if (result.warned) {
+    // Log the security event but allow the command.
+    logSecurityEvent({
+      type: 'security_warning',
+      category: result.category,
+      pattern: result.pattern,
+      command: command.slice(0, 200),
+      session_id: input.session_id,
+    });
+  }
+
+  // Allow - no further logging, immediate exit
   console.log(JSON.stringify({ permissionDecision: 'allow' }));
 }
 

package/src/hooks/ts/user-prompt/handoff-link.ts

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+
+/**
+ * handoff-link.ts — UserPromptSubmit
+ *
+ * Records a handoff link: when a prompt carries the `[pai-handoff from=<id>]`
+ * marker `pai handoff export` tells the user to paste, appends
+ * {ts, from, to} to <PAI_HOME>/handoffs/links.jsonl, so the chain of sessions
+ * that continued from one brief is reconstructable. Silent on any failure —
+ * never blocks a prompt.
+ */
+
+import { appendHandoffLink } from "../../../session/handoff.js";
+
+const MARKER = /\[pai-handoff from=([^\]\s]+)\]/;
+
+async function main(): Promise<void> {
+  try {
+    const chunks: Buffer[] = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const input = JSON.parse(Buffer.concat(chunks).toString("utf8")) as {
+      prompt?: string;
+      session_id?: string;
+    };
+    const prompt = typeof input.prompt === "string" ? input.prompt : "";
+    const m = MARKER.exec(prompt);
+    if (!m || !input.session_id) return;
+    appendHandoffLink(m[1], input.session_id);
+  } catch {
+    // silent failure — don't block user prompts
+  }
+}
+
+void main();

package/dist/aibroker-client-BxzeEHPF.mjs

@@ -1,3 +0,0 @@
-import { i as switchToSession, n as fetchLiveSessions, r as sendToSession, t as callAiBroker } from "./aibroker-client-CQPGqLxL.mjs";
-
-export { callAiBroker, sendToSession };

package/dist/auto-route-C3S2W3Bc.mjs

@@ -1,11 +0,0 @@
-import "./config-XpZWOYOG.mjs";
-import "./config-Bu1_vbY8.mjs";
-import "./paths-CHifubDh.mjs";
-import "./worktree-CRs2gyg0.mjs";
-import "./status-ggJ7lgVg.mjs";
-import "./pool-Dh-q3iJi.mjs";
-import "./registrable-DpyTtajg.mjs";
-import "./pai-marker-BcZyJguM.mjs";
-import { n as formatAutoRouteJson, t as autoRoute } from "./auto-route-21GdHL70.mjs";
-
-export { autoRoute, formatAutoRouteJson };

package/dist/budget-BrloTOZW.mjs

@@ -1,15 +0,0 @@
-import "./config-XpZWOYOG.mjs";
-import "./config-Bu1_vbY8.mjs";
-import "./paths-CHifubDh.mjs";
-import "./status-ggJ7lgVg.mjs";
-import "./scope-D-h6F6DN.mjs";
-import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall, N as fetchBudgetReading, O as budgetFresh, P as pickBudgetWindow, T as BudgetCache, j as budgetUntilLabel, k as budgetFull, w as BUDGET_TTL_MS } from "./routing-DmkheCRH.mjs";
-import "./tool-errors-7E13StWd.mjs";
-import "./wait-ByV0OyMZ.mjs";
-import "./local-tiers-BE4jGaMa.mjs";
-import "./caller-identity-yLFb7CKq.mjs";
-import "./capacity-DEveQdFV.mjs";
-import "./local-instances-DOxSgT_L.mjs";
-import "./local-candidate-DLdwQt0s.mjs";
-
-export { BUDGET_TTL_MS, BudgetCache, budgetCache, budgetExceeded, budgetFresh, budgetFull, budgetSkipReason, budgetUntilLabel, budgetWall, fetchBudgetReading, pickBudgetWindow };

package/dist/cockpit-memory-teG9M8bG.mjs

@@ -1,20 +0,0 @@
-import "./config-XpZWOYOG.mjs";
-import "./config-Bu1_vbY8.mjs";
-import "./paths-CHifubDh.mjs";
-import "./status-ggJ7lgVg.mjs";
-import "./scope-D-h6F6DN.mjs";
-import "./routing-DmkheCRH.mjs";
-import "./tool-errors-7E13StWd.mjs";
-import "./wait-ByV0OyMZ.mjs";
-import "./local-tiers-BE4jGaMa.mjs";
-import "./caller-identity-yLFb7CKq.mjs";
-import "./capacity-DEveQdFV.mjs";
-import "./local-instances-DOxSgT_L.mjs";
-import "./local-candidate-DLdwQt0s.mjs";
-import "./providers-C9QC0TtO.mjs";
-import "./main-config-ops-kTXR8Pyv.mjs";
-import { A as cockpitMemoryPayload, F as memoryRunLog, I as rateSeries, L as runProgress, M as latestMemoryJob, N as liveMemoryDeps, P as memoryJobProgress, R as runningMemoryJob, j as fetchDaemonMemory, z as sameModel } from "./cockpit-actions-OodH_vx_.mjs";
-import "./ipc-client-CnYEF31R.mjs";
-import "./embed-pass-e64AwDCa.mjs";
-
-export { fetchDaemonMemory };

package/dist/config-Cxi-aBf4.mjs

@@ -1,4 +0,0 @@
-import { A as providerQuotaSkipAt, C as parseMcpSetsValue, D as providerContextWindow, E as parseWorkersConfig, F as writeWorkersSection, M as resolveCapability, N as resolveModelCapability, O as providerCostTier, P as resolveProviderKey, S as parseClassesValue, T as parseProvider, _ as maskKey, a as MODEL_CAPABILITIES, b as nativeOrchestratorModel, c as WorkersConfigError, d as defaultWorkersConfig, f as escalationCloud, g as keysDir, h as isModelCapability, ht as DEFAULT_CONTEXT_WINDOW, i as DEFAULT_POOL_PORT, j as readWorkersSection, k as providerKeyPath, l as assertProviderRunnable, m as isLocalProvider, n as CAPABILITY_NAME_RE, o as PROVIDER_TAGS, p as getProviderOrNative, r as DEFAULT_COST_TIER, s as WORKER_CLASSES, t as ANTHROPIC_NATIVE, u as classModelCapability, v as nativeAnthropicModels, w as parseModelsBlock, x as parseCapabilitiesValue, y as nativeAnthropicProvider } from "./config-XpZWOYOG.mjs";
-import { o as expandHome, s as homeRel } from "./config-Bu1_vbY8.mjs";
-
-export { ANTHROPIC_NATIVE, CAPABILITY_NAME_RE, DEFAULT_CONTEXT_WINDOW, DEFAULT_COST_TIER, DEFAULT_POOL_PORT, MODEL_CAPABILITIES, PROVIDER_TAGS, WORKER_CLASSES, WorkersConfigError, assertProviderRunnable, classModelCapability, defaultWorkersConfig, escalationCloud, expandHome, getProviderOrNative, homeRel, isLocalProvider, isModelCapability, keysDir, maskKey, nativeAnthropicModels, nativeAnthropicProvider, nativeOrchestratorModel, parseCapabilitiesValue, parseClassesValue, parseMcpSetsValue, parseModelsBlock, parseProvider, parseWorkersConfig, providerContextWindow, providerCostTier, providerKeyPath, providerQuotaSkipAt, readWorkersSection, resolveCapability, resolveModelCapability, resolveProviderKey, writeWorkersSection };