@visual-z/xeno 0.8.1 → 0.8.3

package/src/core/command-contract.ts

@@ -10,10 +10,18 @@ export function commandArgv(command: string): string[] {
   return ["bash", "-o", "pipefail", "-lc", command];
 }
 
-/** Preserve inherited values except documented noninteractive defaults; never mutate the host. */
-export function commandEnvironment(base: Readonly<Record<string, string | undefined>>): Record<string, string> {
+/**
+ * Preserve inherited values except documented noninteractive defaults; never mutate the host.
+ *
+ * `appendPath` is xeno's own tool directory (store/tool-binaries.ts). It goes
+ * last, so anything the user installed wins and xeno only fills a gap.
+ */
+export function commandEnvironment(base: Readonly<Record<string, string | undefined>>, appendPath?: string): Record<string, string> {
   const env: Record<string, string> = {};
   for (const [key, value] of Object.entries(base)) if (value !== undefined) env[key] = value;
+  if (appendPath !== undefined && appendPath.length > 0 && !(env["PATH"] ?? "").split(":").includes(appendPath)) {
+    env["PATH"] = env["PATH"] ? `${env["PATH"]}:${appendPath}` : appendPath;
+  }
   Object.assign(env, {
     TERM: "dumb", PAGER: "cat", GIT_PAGER: "cat", NO_COLOR: "1",
     GIT_TERMINAL_PROMPT: "0", DEBIAN_FRONTEND: "noninteractive",
@@ -22,14 +30,122 @@ export function commandEnvironment(base: Readonly<Record<string, string | undefi
   return env;
 }
 
+/**
+ * Codex's `max_output_tokens` as an inline byte budget for one call. It can
+ * only lower the session ceiling: full output is still captured and
+ * recoverable, so this shapes the preview, never the receipt.
+ *
+ * Assumed, not measured: 4 bytes per token rounds the ASCII estimate in
+ * tokens.ts (about 3.6) up, so the model never gets less than it asked for.
+ * The 1 KiB floor keeps room for the header and recovery hint (about 300
+ * bytes); below it a preview shows almost no output and forces a re-read.
+ */
+export const OUTPUT_BYTES_PER_TOKEN = 4;
+export const MIN_OUTPUT_BYTES = 1_024;
+export function outputBytesForTokens(tokens: unknown, ceiling: number): number {
+  if (typeof tokens !== "number" || !Number.isFinite(tokens) || tokens <= 0) return ceiling;
+  return Math.min(ceiling, Math.max(MIN_OUTPUT_BYTES, Math.floor(tokens) * OUTPUT_BYTES_PER_TOKEN));
+}
+
 /** Model seconds and host milliseconds meet once; a yield is never a command deadline. */
 export function commandTimeout(requestedSeconds: number | undefined, defaultMs: number, maximumMs = defaultMs): number {
   return Math.min(requestedSeconds === undefined ? defaultMs : requestedSeconds * 1000, maximumMs);
 }
 
+/**
+ * Programs whose exit 1 is an answer rather than a fault (POSIX: grep's 1 is
+ * "no match" and >1 an error; diff and cmp use 1 for "differ"; test for
+ * false). Reporting them as failures tells the model to inspect and retry an
+ * answer it already holds -- the same reading Claude Code's command semantics
+ * give these programs.
+ */
+const NEGATIVE_ANSWERS: Readonly<Record<string, string>> = {
+  grep: "no match", egrep: "no match", fgrep: "no match", rg: "no match",
+  diff: "files differ", cmp: "files differ", test: "condition false", "[": "condition false",
+};
+
+/**
+ * The final simple command of `command` and the separator before it, or
+ * null when this scanner cannot read the command with certainty --
+ * unbalanced quotes, subshells, compound statements, substitutions or a
+ * background `&`. Only top-level `;`, newline, `&&`, `||` and `|` split.
+ */
+function finalStage(command: string): { separator: string; words: string[] } | null {
+  let quote: "'" | "\"" | null = null, start = 0, separator = "";
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i]!;
+    if (quote !== null) {
+      if (c === "\\" && quote === "\"") i++;
+      else if (c === quote) quote = null;
+      continue;
+    }
+    if (c === "\\") { i++; continue; }
+    if (c === "'" || c === "\"") { quote = c; continue; }
+    if (c === "`" || c === "(" || c === ")" || c === "{" || c === "}" || (c === "$" && command[i + 1] === "(")) return null;
+    const two = command.slice(i, i + 2);
+    if (two === "&&" || two === "||") { separator = two; start = i + 2; i++; continue; }
+    if (c === ";" || c === "\n" || c === "|") { separator = c; start = i + 1; continue; }
+    if (c === "&" && command[i + 1] !== ">" && command[i - 1] !== ">") return null;
+  }
+  if (quote !== null) return null;
+  return { separator, words: command.slice(start).trim().split(/\s+/).filter(word => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) };
+}
+
+const programName = (words: readonly string[]) => (words[0] ?? "").replace(/^.*\//, "");
+
+/**
+ * What exit 1 of the command's final simple command means, or null.
+ *
+ * Only the last segment after a top-level `;`, newline, `||` or `|` is read.
+ * After `&&` the 1 may come from the command that short-circuited, so it is
+ * not classified. Under pipefail an earlier pipeline stage can also set the
+ * status; the exit is kept in the receipt either way, and the label states
+ * the program's meaning rather than claiming success. Anything this scanner
+ * cannot read with certainty -- unbalanced quotes, subshells, compound
+ * statements, substitutions -- yields null.
+ */
+export function negativeAnswer(command: string, exit: number): string | null {
+  if (exit !== 1) return null;
+  const stage = finalStage(command);
+  if (stage === null || stage.separator === "&&") return null;
+  const program = programName(stage.words);
+  if (program === "git") return stage.words[1] === "grep" ? "no match" : null;
+  return Object.hasOwn(NEGATIVE_ANSWERS, program) ? NEGATIVE_ANSWERS[program]! : null;
+}
+
+/**
+ * Readers that may stop reading before their input ends (`head -n`, `sed Nq`,
+ * `awk '{exit}'`, `grep -m` / `-q`), closing the pipe on the writer before it.
+ */
+const EARLY_READERS: ReadonlySet<string> = new Set(["head", "sed", "awk", "gawk", "mawk", "grep", "egrep", "fgrep", "rg"]);
+
+/**
+ * What exit 141 means when an early reader ends the pipeline, or null.
+ *
+ * Measured (pipe-early-close card): under `bash -o pipefail`, `seq 1 1000000
+ * | head -1` exits 141 -- pipefail reports the rightmost nonzero stage, here
+ * the writer that SIGPIPE killed after head closed its input, while every
+ * stage to its right, the final reader included, exited 0. The output the
+ * command asked for is complete. Only a final stage joined by a top-level
+ * `|` is read: after `;`, `&&` or `||` the 141 is the last command's own.
+ */
+export function earlyCloseAnswer(command: string, exit: number): string | null {
+  if (exit !== 141) return null;
+  const stage = finalStage(command);
+  if (stage === null || stage.separator !== "|") return null;
+  const program = programName(stage.words);
+  return EARLY_READERS.has(program) ? `${program} closed the pipe early; the earlier stage's SIGPIPE is not a failure` : null;
+}
+
+/** The program's own meaning of a nonzero exit that is an answer, not a fault. */
+export function commandAnswer(command: string, exit: number): string | null {
+  return negativeAnswer(command, exit) ?? earlyCloseAnswer(command, exit);
+}
+
 /** A trap can exit zero after cancellation: successful exit alone does not erase the stop. */
-export function commandCompletion(exit: number, stopped?: "cancelled" | "timeout", cleanup?: ToolDiagnostic) {
-  return { ok: stopped === undefined && exit === 0 && cleanup === undefined,
-    outcome: executionOutcome(stopped ?? (exit === 0 && cleanup === undefined ? "tool_completed" : "tool_failed")),
+export function commandCompletion(exit: number, stopped?: "cancelled" | "timeout", cleanup?: ToolDiagnostic, command?: string) {
+  const answered = exit === 0 || command !== undefined && commandAnswer(command, exit) !== null;
+  return { ok: stopped === undefined && answered && cleanup === undefined,
+    outcome: executionOutcome(stopped ?? (answered && cleanup === undefined ? "tool_completed" : "tool_failed")),
     ...(cleanup ? { warnings: [cleanup] } : {}) };
 }

package/src/core/completion-review.ts

@@ -69,7 +69,7 @@ export function requestCompletion(state: RequestState, remainingRequests: number
   if (state.used_tools && text.length === 0) gaps.push("the final reply is empty");
   // Strict verification counts only configured gates (O.11); say so, since a successful `cat` would otherwise look like a check.
   if (freshCheck && freshCheck.status !== "pass") gaps.push(freshCheck.gate_only
-    ? "files were changed but no configured verification gate (a test, typecheck, lint, build or check command) has passed since the last edit; reading or printing files does not count"
+    ? "files were changed but no configured verification gate (a test, typecheck, lint, build or check command) has passed since the last edit; reading or printing files does not count, and a gate counts only when run as plain commands joined by && (trailing output redirects to fixed files are fine); ;, ||, pipes, $() and variables hide it"
     : "files were changed but no command has succeeded since the last edit");
   if (acceptance?.status === "needs_work") gaps.push(`declared acceptance criteria need evidence: ${[
     ...missingCommands.map(item => `${item.id}=${item.status}`),

package/src/core/derive.ts

@@ -425,7 +425,15 @@ export function deriveHandoff(input: DeriveInput): Handoff {
   const processes = deriveProcesses(prev?.processes ?? [], events, input.self.node);
 
   const hasRemaining = inFlight.length > 0 || blocked.length > 0 || openQuestions.length > 0;
-  const hasNextAction = inFlight.some((i) => i.next_action.trim().length > 0);
+  // A next action is a statement about the current state of the work, so it
+  // follows the evidence rule above: only one this segment recorded or
+  // refreshed counts. A carried one stays listed but no longer suppresses the
+  // boundary and continuation reminders that ask the model to confirm it.
+  const thisSegment = new Set(events.map((e) => e.id));
+  const freshUnscoped = new Set(events.flatMap((e) => e.t === "next_action" && e.work_id === undefined ? [e.what] : []));
+  const freshWork = new Set(workItems.filter((item) => thisSegment.has(item.updated_at)).map((item) => item.id));
+  const hasNextAction = inFlight.some((i) => i.next_action.trim().length > 0 &&
+    (i.work_id === undefined ? freshUnscoped.has(i.what) : freshWork.has(i.work_id)));
 
   return {
     handoff_version: HANDOFF_VERSION,

package/src/core/environment.ts

@@ -19,6 +19,12 @@ export interface SessionEnvironment {
   /** Local calendar date, YYYY-MM-DD. */
   date: string;
   git: boolean;
+  /**
+   * Whether `rg` resolves in tool shells at session start. Models reach for
+   * it by habit; without this line a missing one costs an exit-127 request.
+   * Optional so environments recorded before it existed still render.
+   */
+  ripgrep?: boolean;
 }
 
 export function environmentSection(env: SessionEnvironment): string {
@@ -29,6 +35,7 @@ export function environmentSection(env: SessionEnvironment): string {
     `- Working directory: ${env.cwd}`,
     `- Date: ${env.date}`,
     `- Git repository: ${env.git ? "yes" : "no"}`,
+    ...(env.ripgrep === undefined ? [] : [`- ripgrep (rg) in the shell: ${env.ripgrep ? "yes" : "no — use the grep and find tools"}`]),
   ].join("\n");
 }
 

package/src/core/event-validation.ts

@@ -25,6 +25,14 @@ export function validNodeRef(value: unknown): value is NodeRef {
     (value["at_event"] === undefined || typeof value["at_event"] === "string");
 }
 
+/** A label is a short phrase or class name; anything longer or with control characters is not one the harness wrote. */
+function validFailureCause(value: unknown): boolean {
+  return isRecord(value) && (value["source"] === "provider" || value["source"] === "harness") &&
+    typeof value["label"] === "string" && /^[^\u0000-\u001f\u007f]{1,64}$/.test(value["label"]) &&
+    (value["status"] === undefined || Number.isSafeInteger(value["status"])) &&
+    (value["retries"] === undefined || natural(value["retries"]));
+}
+
 export function isLogEvent(value: unknown): value is LogEvent {
   if (!isRecord(value) || typeof value["id"] !== "string" || value["id"].length === 0 || typeof value["at"] !== "string") return false;
   if (value["outcome"] !== undefined && !isExecutionOutcome(value["outcome"])) return false;
@@ -58,6 +66,14 @@ export function isLogEvent(value: unknown): value is LogEvent {
         value["reason"] === "disposed" && isRecord(output) && typeof output["path"] === "string" &&
         typeof output["sha256"] === "string" && /^[a-f0-9]{64}$/.test(output["sha256"]) && natural(output["bytes"]);
     }
+    case "approval": {
+      const user = ["once", "command", "tool", "deny"].includes(String(value["decision"]));
+      const rule = value["decision"] === "allow" || value["decision"] === "deny";
+      return has("call_id", "tool") && value["call_id"] !== "" && value["tool"] !== "" &&
+        optionalString(value["command"]) && optionalString(value["rule"]) &&
+        (value["source"] === "user" ? user : value["source"] === "no_prompt" ? value["decision"] === "deny" :
+          ["session_rule", "config", "auto"].includes(String(value["source"])) && rule);
+    }
     case "skill_loaded": return has("name", "path", "sha256", "artifact") &&
       ["sha256", "artifact"].every(key => /^[a-f0-9]{64}$/.test(String(value[key]))) &&
       ["inline", "fork", "read"].includes(String(value["mode"])) && ["user", "model"].includes(String(value["origin"]));
@@ -81,7 +97,7 @@ export function isLogEvent(value: unknown): value is LogEvent {
     }
     case "extension": return has("customType", "content") && typeof value["display"] === "boolean" && typeof value["inContext"] === "boolean" && (value["data"] === undefined || isJsonValue(value["data"]));
     case "user": return has("text") && (value["request"] === undefined || typeof value["request"] === "string" && value["request"] !== "");
-    case "outcome": return has("reason") && isExecutionOutcome(value["outcome"]);
+    case "outcome": return has("reason") && isExecutionOutcome(value["outcome"]) && (value["failure"] === undefined || validFailureCause(value["failure"]));
     case "user_bash": {
       const ref = value["content_ref"];
       const outcome = value["outcome"];
@@ -92,7 +108,7 @@ export function isLogEvent(value: unknown): value is LogEvent {
         isRecord(ref) && typeof ref["sha256"] === "string" &&
         typeof ref["path"] === "string" && natural(ref["bytes"]);
     }
-    case "guidance": return has("text") && ["continuation", "repetition", "budget", "boundary", "stall", "output_recovery", "completion_review", "churn", "deadline", "runtime_acceptance", "goal"].includes(String(value["reason"])) && strings(value["sources"]);
+    case "guidance": return has("text") && ["continuation", "repetition", "budget", "boundary", "stall", "output_recovery", "completion_review", "churn", "deadline", "runtime_acceptance", "goal", "secret"].includes(String(value["reason"])) && strings(value["sources"]);
     case "interrupt": return has("user_id");
     case "assistant": return (value["stop_reason"] === null || optionalString(value["stop_reason"])) &&
       (value["replay_key"] === undefined || typeof value["replay_key"] === "string" && /^[a-f0-9]{64}$/.test(value["replay_key"])) &&
@@ -156,7 +172,7 @@ export function isLogEvent(value: unknown): value is LogEvent {
       return effect["kind"] === "edit" && typeof effect["path"] === "string" && typeof effect["sha256_after"] === "string" &&
         (effect["sha256_before"] === null || typeof effect["sha256_before"] === "string");
     }
-    case "cut": return has("handoff_ref") && (value["working_set_version"] === undefined || value["working_set_version"] === 2) && ["trigger", "hard_limit", "model_checkpoint"].includes(String(value["reason"])) &&
+    case "cut": return has("handoff_ref") && (value["working_set_version"] === undefined || value["working_set_version"] === 2 || value["working_set_version"] === 3) && ["trigger", "hard_limit", "model_checkpoint"].includes(String(value["reason"])) &&
       (value["guidance_tools"] === undefined || Array.isArray(value["guidance_tools"]) && value["guidance_tools"].every(item => typeof item === "string")) &&
       optionalString(value["retained_from"]) && optionalString(value["next_context_ref"]) &&
       (value["next_node"] === undefined || natural(value["next_node"])) && optionalString(value["next_model"]) &&

package/src/core/events.ts

@@ -109,6 +109,22 @@ export interface OutcomeEvent {
   at: IsoTime;
   reason: string;
   outcome: ExecutionOutcome;
+  /** Why a failed request failed; absent on success and in logs written before it existed. */
+  failure?: FailureCause;
+}
+
+/**
+ * Credential-free facts about a failure (PLAYBOOK: provider error text never
+ * reaches the log). `label` is a phrase from retry.ts's fixed vocabulary or an
+ * error class name -- both chosen by code, never copied from a response body.
+ */
+export interface FailureCause {
+  /** provider: the model request failed after its retries; harness: xeno itself threw. */
+  source: "provider" | "harness";
+  label: string;
+  status?: number;
+  /** Retries the adapter actually made before giving up. */
+  retries?: number;
 }
 
 /** A factual harness notice, appended once rather than rewriting the prompt (N.1). */
@@ -116,7 +132,7 @@ export interface GuidanceEvent {
   t: "guidance";
   id: EventId;
   at: IsoTime;
-  reason: "continuation" | "repetition" | "budget" | "boundary" | "stall" | "output_recovery" | "completion_review" | "churn" | "deadline" | "runtime_acceptance" | "goal";
+  reason: "continuation" | "repetition" | "budget" | "boundary" | "stall" | "output_recovery" | "completion_review" | "churn" | "deadline" | "runtime_acceptance" | "goal" | "secret";
   text: string;
   sources: readonly EventId[];
 }
@@ -243,7 +259,8 @@ export interface CutEvent {
   handoff_tokens?: number;
   /** O.10: absent preserves the original D20 carried projection. */
   /** R9: present when the source-priority working set was carried across this cut. */
-  working_set_version?: 2;
+  /** 3: user turns are carried before other pages, with image references and one copy of each next action. */
+  working_set_version?: 2 | 3;
   /** R10: declared builtin advice capabilities at this cut, not an authorization grant. Absent replays old text. */
   guidance_tools?: readonly string[];
   /** N.8: first retained event on the effective ancestry; no copied transcript. */
@@ -564,8 +581,26 @@ export interface ProcessExitEvent {
   receipt?: import("./process-receipt.ts").ProcessReceipt;
 }
 
+/**
+ * Who let one call through the permission gate (feat-approval-events). A
+ * harness fact recorded between the call's invocation and its result, before
+ * the call starts; it never enters the model's context. `decision` is the
+ * person's prompt choice when `source` is `user`, otherwise the rule's own
+ * `allow` / `deny`. `rule` is the matched rule's text -- for `user`, the rule
+ * that asked. `no_prompt`: a rule asked and nobody could be asked.
+ */
+export interface ApprovalEvent {
+  t: "approval"; id: EventId; at: IsoTime;
+  call_id: string; tool: string;
+  decision: "once" | "command" | "tool" | "deny" | "allow";
+  source: "user" | "session_rule" | "config" | "auto" | "no_prompt";
+  command?: string;
+  rule?: string;
+}
+
 export type LogEvent =
   | ToolInvocationEvent
+  | ApprovalEvent
   | ProcessExitEvent
   | SkillLoadedEvent
   | AcceptanceContractEvent
@@ -606,6 +641,7 @@ export const HARNESS_EVENTS = [
   "checkpoint", "workspace_observation",
   "target_observation",
   "process_exit",
+  "approval",
   "skill_loaded",
   "acceptance_contract", "acceptance_decision", "goal", "counter_check", "blind_check",
   "user", "user_bash", "outcome", "guidance", "interrupt", "assistant", "tool_result", "cut", "rewind", "extension",

package/src/core/evidence.ts

@@ -74,15 +74,109 @@ export function exchangeProgressChecks(events: readonly LogEvent[]): Set<string>
   return eligibleProgressChecks(events, claimed, new Set([...gates].filter(([, exit]) => exit !== 0).map(([gate]) => gate)));
 }
 
-/** D11: classify an actual verifier invocation, never a runner word in data. */
+/**
+ * D11: classify an actual verifier invocation, never a runner word in data.
+ *
+ * Only command shapes whose exit 0 proves every gate in them exited 0 are
+ * read: simple commands joined by `&&` (the chain stops at the first failure),
+ * each optionally ending in output redirects to fixed paths (a redirect that
+ * cannot open fails the command, it never masks one). Anything that can turn
+ * a failure into exit 0 or run text the log does not show -- `;`, `||`,
+ * pipes, background jobs, subshells, expansions, input redirects -- rejects
+ * the whole command, as before. A chain's gates join with `+` in order, so a
+ * failed chain is recorded as that chain failing, not as one of its parts.
+ */
 export function classifyGate(gates: Readonly<Record<string, string>>, command: string): string | undefined {
-  if (/[\n\r;&|<>`$(){}'"\\]/.test(command)) return undefined;
-  const tokens = command.trim().split(/\s+/);
-  const informational = ["--version", "-V", "--help", "-h", "--collect-only", "--listTests", "--showConfig", "--init", "--fixtures", "--markers"];
-  if (tokens.some((t) => informational.includes(t))) return undefined;
+  const segments = gateSegments(command);
+  if (!segments) return undefined;
+  const names = [...new Set(segments.flatMap((words) => segmentGates(gates, words)))];
+  return names.length === 0 ? undefined : names.join("+");
+}
+
+type ShellToken = { kind: "word"; value: string } | { kind: "and" } | { kind: "redirect"; target: boolean };
+
+/**
+ * A deliberately small tokenizer, not a shell parser (M.2): it accepts the
+ * subset above and returns undefined for everything else, so an unfamiliar
+ * construct can only lose a gate, never forge one. Quotes may hold plain text
+ * only; `$`, backticks and backslashes are rejected even inside them.
+ */
+function shellTokens(command: string): ShellToken[] | undefined {
+  const tokens: ShellToken[] = [];
+  let word: string | undefined, i = 0;
+  const end = () => { if (word !== undefined) tokens.push({ kind: "word", value: word }); word = undefined; };
+  while (i < command.length) {
+    const c = command[i]!;
+    if (c === " " || c === "\t") { end(); i++; continue; }
+    if (c === "#" && word === undefined) break; // a comment runs to the end of the (single) line
+    if (c === "'" || c === '"') {
+      const close = command.indexOf(c, i + 1);
+      if (close < 0) return undefined;
+      const quoted = command.slice(i + 1, close);
+      if (/[$`\\\n\r]/.test(quoted)) return undefined;
+      word = (word ?? "") + quoted; i = close + 1; continue;
+    }
+    if (c === "&" && command[i + 1] === "&") { end(); tokens.push({ kind: "and" }); i += 2; continue; }
+    if (c === ">" || c === "&" && command[i + 1] === ">") {
+      // An unquoted 1 or 2 directly before `>` is the descriptor, not a word.
+      if (c === ">" && (word === "1" || word === "2") && /[12]$/.test(command.slice(0, i))) word = undefined;
+      end();
+      i += c === "&" ? 2 : 1;
+      if (command[i] === ">") i++;
+      if (c === ">" && command[i] === "&") {
+        if (!/^[12](?![^\s&])/.test(command.slice(i + 1))) return undefined;
+        tokens.push({ kind: "redirect", target: false }); i += 2; continue;
+      }
+      if (command[i] === "|") return undefined;
+      tokens.push({ kind: "redirect", target: true }); continue;
+    }
+    if (/[\n\r;&|<`$(){}\\]/.test(c)) return undefined;
+    word = (word ?? "") + c; i++;
+  }
+  end();
+  return tokens;
+}
+
+/** The `&&`-joined segments' words with trailing output redirects removed. */
+function gateSegments(command: string): string[][] | undefined {
+  const tokens = shellTokens(command);
+  if (!tokens) return undefined;
+  const segments: string[][] = [[]];
+  let redirected = false, needTarget = false;
+  for (const token of tokens) {
+    const words = segments.at(-1)!;
+    if (token.kind === "and") {
+      if (needTarget || words.length === 0) return undefined;
+      segments.push([]); redirected = false; continue;
+    }
+    if (token.kind === "redirect") {
+      if (needTarget || words.length === 0) return undefined;
+      redirected = true; needTarget = token.target; continue;
+    }
+    if (needTarget) { needTarget = false; continue; }
+    // Only trailing redirects are stripped; one before an argument is rejected.
+    if (redirected) return undefined;
+    words.push(token.value);
+  }
+  return needTarget || segments.at(-1)!.length === 0 ? undefined : segments;
+}
+
+const INFORMATIONAL = ["--version", "-V", "--help", "-h", "--collect-only", "--listTests", "--showConfig", "--init", "--fixtures", "--markers"];
+
+/** One simple command's gates: none, the runner's gate, or a target runner's gate targets. */
+function segmentGates(gates: Readonly<Record<string, string>>, tokens: readonly string[]): string[] {
+  if (tokens.some((t) => INFORMATIONAL.includes(t))) return [];
+  const first = tokens[0] ?? "";
+  const runner = own(TARGET_RUNNERS, first);
+  if (runner && !Object.hasOwn(gates, first)) return targetGates(gates, runner, tokens.slice(1));
+  const single = runnerGate(gates, tokens);
+  return single === undefined ? [] : [single];
+}
+
+function runnerGate(gates: Readonly<Record<string, string>>, tokens: readonly string[]): string | undefined {
   let i = 0;
   const first = tokens[0];
-  if (["bun", "npm", "pnpm", "yarn"].includes(first ?? "") && tokens[1] === "test") return gates["test"];
+  if (["bun", "npm", "pnpm", "yarn"].includes(first ?? "") && tokens[1] === "test") return own(gates, "test");
   if (first === "python" || first === "python3") {
     if (tokens[1] !== "-m") return undefined;
     i = 2;
@@ -94,5 +188,53 @@ export function classifyGate(gates: Readonly<Record<string, string>>, command: s
   const executable = tokens[i];
   if (executable === "cargo" && !["test", "check", "clippy", "build"].includes(tokens[i + 1] ?? "")) return undefined;
   if (executable === "vitest" && ["list", "init"].includes(tokens[i + 1] ?? "")) return undefined;
-  return gates[executable ?? ""];
+  return own(gates, executable ?? "");
+}
+
+/** A table lookup that a word like `constructor` cannot satisfy through the prototype. */
+function own<T>(table: Readonly<Record<string, T>>, key: string): T | undefined {
+  return Object.hasOwn(table, key) ? table[key] : undefined;
+}
+
+/**
+ * Options a target runner may carry and still prove its targets ran. An
+ * allowlist on purpose: an unknown option might be a dry run, a touch or an
+ * ignore-errors switch (exit 0 without the targets passing), so it makes the
+ * segment not a gate rather than being guessed at.
+ */
+type TargetRunner = { withValue: readonly string[]; flags: readonly string[]; attached: RegExp; argsAfterDashes: boolean };
+const TARGET_RUNNERS: Readonly<Record<string, TargetRunner>> = {
+  make: { withValue: ["-C", "-f", "--directory", "--file", "--makefile"],
+    flags: ["-k", "-s", "-B", "-w", "-r", "-R", "--keep-going", "--silent", "--quiet", "--always-make", "--print-directory", "--no-print-directory"],
+    attached: /^(?:-C.+|-f.+|-j\d*|--(?:directory|file|makefile|jobs)=.+|--jobs)$/, argsAfterDashes: false },
+  just: { withValue: ["-f", "-d", "--justfile", "--working-directory"], flags: ["-q", "-v", "--quiet", "--verbose"],
+    attached: /^--(?:justfile|working-directory)=.+$/, argsAfterDashes: false },
+  task: { withValue: ["-d", "-t", "--dir", "--taskfile"], flags: ["-s", "-v", "-p", "-f", "--silent", "--verbose", "--parallel", "--force"],
+    attached: /^--(?:dir|taskfile)=.+$/, argsAfterDashes: true },
+};
+
+/**
+ * `make build size test`: the runner exits 0 only when every target
+ * succeeded, so each target named after a configured gate key (exactly, or
+ * as `<key>-…` / `<key>:…`) is that gate; other targets do not weaken it. No
+ * gate target, or no target at all (the default goal is unknown), is no gate.
+ */
+function targetGates(gates: Readonly<Record<string, string>>, runner: TargetRunner, args: readonly string[]): string[] {
+  const keys = Object.keys(gates).sort((a, b) => b.length - a.length);
+  const names: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === "--") { if (runner.argsAfterDashes) break; return []; }
+    if (arg.startsWith("-")) {
+      if (runner.withValue.includes(arg)) { if (++i >= args.length) return []; continue; }
+      if (arg === "-j" && /^\d+$/.test(args[i + 1] ?? "")) { i++; continue; }
+      if (runner.flags.includes(arg) || runner.attached.test(arg)) continue;
+      return [];
+    }
+    if (arg.includes("=")) continue; // a variable override, not a target
+    if (/[*?[\]~]/.test(arg)) return [];
+    const key = keys.find((k) => arg === k || arg.startsWith(`${k}-`) || arg.startsWith(`${k}:`));
+    if (key !== undefined) names.push(gates[key]!);
+  }
+  return names;
 }

package/src/core/export.ts

@@ -137,6 +137,8 @@ function eventHtml(e: LogEvent): string {
     case "evidence_link":
       return wrap("event", "evidence link", e.at, `${e.work}: ${e.what} → ${e.source}`);
     case "work_owner": case "work_dependencies": return wrap("event", e.t, e.at, JSON.stringify(e));
+    case "approval": return wrap("event", "approval", e.at,
+      [`${e.tool} · ${e.call_id} · ${e.decision} · ${e.source}`, ...(e.rule ? [`rule: ${e.rule}`] : []), ...(e.command !== undefined ? [`$ ${e.command}`] : [])].join("\n"));
     case "skill_loaded": return wrap("event", "skill loaded", e.at, `${e.name} · ${e.path} · ${e.sha256} · ${e.mode}`);
     case "process_exit": return wrap("event", "process exit", e.at, `${e.session} · exit ${e.exit} · output ${e.output.sha256}`);
     case "acceptance_contract": return wrap("event", "acceptance contract", e.at, JSON.stringify(e.contract));