@warren-dean/code-kit 0.6.0 → 0.8.0

package/hooks/guard-bash.mjs

@@ -9,8 +9,10 @@ import { appendFileSync, existsSync, readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { join, resolve } from 'node:path';
 import { addedPackages, dependencyApproval, isDependencyFile } from './lib/dependencies.mjs';
-import { CODE_KIT, GIT, codeOf, runs } from './lib/shell.mjs';
+import { CODE_KIT, GIT, codeOf, commandsOf, runs } from './lib/shell.mjs';
 import { block, start } from './lib/hook.mjs';
+import { CONFIG_FILE } from './lib/config.mjs';
+import { noteBefore } from './lane-audit.mjs';
 import {
   APPROVAL_LOG,
   actorFor,
@@ -54,10 +56,14 @@ const ALWAYS = [
     'Piping downloads into a shell is not allowed.',
     codeOf(cmd),
   ],
-  [/\.claude\/approvals/, 'Approvals are created only by a person, with a `!` shell command.', cmd],
+  [
+    /\.claude\/approvals/,
+    "Approvals are created only by a person, with a `!` shell command. A shell command may not name them, even to read them; read them with the Read tool (or Glob to list them), which can't write.",
+    cmd,
+  ],
   [
     /approval-log\.jsonl/,
-    'The approval audit log is appended only by the commit hook; nobody edits it.',
+    "The approval audit log is appended only by the commit hook; nobody edits it. A shell command may not name it, even to read it; read it with the Read tool, which can't write.",
     cmd,
   ],
 ];
@@ -66,7 +72,8 @@ for (const [re, why, text] of ALWAYS) {
 }
 const packages = addedPackages(cmd);
 const approves = runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+approve\b`));
-const delegatedMerge = runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+merge\b`));
+const delegatedMerge = runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+(?:queue\s+)?merge\b`));
+const queues = runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+queue\s+(?:add|drop)\b`));
 const commits = runs(cmd, new RegExp(String.raw`^${GIT}commit\b`));
 if (error) {
   if (commits) block(`Blocked: ${error}\nFix the config before committing.`);
@@ -83,6 +90,14 @@ const branches = config.branches.protected
 // The branch is read before the command runs, so a command that switches to a protected branch and then
 // commits or merges in the same breath is judged by what it does, not by where it starts. Moving a
 // protected branch directly (branch -f, update-ref) is a commit on it by another name.
+/** Whether `file` is committed at HEAD in the repository at `root`. */
+function committedOnHead(root, file) {
+  return (
+    spawnSync('git', ['-C', root, 'cat-file', '-e', `HEAD:${file}`], { stdio: 'ignore' }).status ===
+    0
+  );
+}
+
 const writesHistory = runs(
   cmd,
   new RegExp(String.raw`^${GIT}(commit|merge|cherry-pick|rebase|revert|am)\b`),
@@ -119,11 +134,16 @@ if (runs(cmd, new RegExp(String.raw`^${GIT}push\b.*\b(${branches})\b`))) {
 
 const sessionIn = sessionRoot(input, project);
 const actor = actorFor(input, sessionIn ?? project, config);
+// A read-only agent's command is judged afterwards by what it changed (lane-audit).
+if (actor.kind === 'readonly') noteBefore(input);
 // The lead acts for the person only where the config says the person may approve from chat.
 const forPerson = actor.kind === 'lead' && config.approvals.lead;
 
-for (const { pattern, why, person } of config.shell.block) {
-  if (!new RegExp(pattern).test(cmd) || (person && forPerson)) continue;
+for (const { pattern, why, person, command } of config.shell.block) {
+  // `command: true`: the pattern names a command, matched from the start of each one the line runs, so a
+  // heredoc or a quoted message that mentions it isn't refused. Otherwise it reads the whole text.
+  const matched = command ? runs(cmd, new RegExp(pattern)) : new RegExp(pattern).test(cmd);
+  if (!matched || (person && forPerson)) continue;
   const hint =
     person && actor.kind === 'lead'
       ? '\nTo let the lead run it when the person says so in chat, a person sets "approvals": { "lead": true } in the config.'
@@ -140,11 +160,20 @@ if ((delegatedMerge && /\s--person\b/.test(cmd)) || (approves && /\s--via\b/.tes
   block(
     `Blocked: merging or approving as the person is the person's own act, from the code-kit pane or their terminal. Ask them, and stop.\nCommand: ${cmd}`,
   );
+// Pausing and resuming the lead loop is the person's, from the band or their terminal.
+if (runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+loop\s+(pause|resume)\b`)))
+  block(
+    `Blocked: pausing or resuming the lead loop is the person's own act, from the code-kit band or their terminal. Ask them, and stop.\nCommand: ${cmd}`,
+  );
 // The harness settings are the person's to change, from the pane or their terminal.
 if (runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+settings\s+set\b`)))
   block(
     `Blocked: changing the harness settings is the person's own act, from the code-kit pane (/harness) or their terminal. Tell them what you'd change and why, and stop.\nCommand: ${cmd}`,
   );
+if (queues && actor.kind !== 'lead')
+  block(
+    `Blocked: only the lead puts branches in the merge queue, after its review passes them. Finish your story and commit it on your branch; the lead reviews it.\nCommand: ${cmd}`,
+  );
 if (delegatedMerge && actor.kind !== 'lead')
   block(
     `Blocked: only the lead merges into a protected branch. Finish your story and commit it on your branch; the lead reviews and merges it.\nCommand: ${cmd}`,
@@ -218,21 +247,30 @@ try {
 } catch {
   // not a git repository yet
 }
-if (writesHistory && config.branches.protected.includes(branch)) {
+// SETUP-1: the one exception is setting up. Until the protected branch has the rules committed, the
+// lead commits the setup the person approved straight onto it, so no first merge needs anyone; from
+// that commit on, the branch is protected by the rules it now holds.
+const settingUp =
+  actor.kind === 'lead' &&
+  runs(cmd, new RegExp(String.raw`^${GIT}commit\b`)) &&
+  !runs(cmd, new RegExp(String.raw`^${GIT}(merge|cherry-pick|rebase|revert|am)\b`)) &&
+  !committedOnHead(root, CONFIG_FILE);
+if (writesHistory && config.branches.protected.includes(branch) && !settingUp) {
   block(
-    `Blocked: never commit or merge on ${branch}. Work on a branch; a person merges after review.`,
+    `Blocked: never commit or merge on ${branch}. Work on a branch; the lead merges it after review (or the person, where merges aren't delegated).`,
   );
 }
 
-// Kit files edited through the shell follow the same rule as edits through Write/Edit.
-const touchesKit =
-  /\.claude\/(hooks|agents|skills|settings[^/]*\.json|README\.md|code-kit\.json)/.test(cmd);
+// Kit files edited through the shell follow the same rule as edits through Write/Edit: a command that
+// names a kit file and writes, judged one simple command at a time, so a redirect elsewhere in the line
+// (`npm install > /tmp/log; ls .claude/skills`) isn't taken for a write to the kit. A write the shell
+// hides (a script, a variable) is still caught after the call, as a change outside the actor's paths.
+const KIT_PATH = /\.claude\/(hooks|agents|skills|settings[^/]*\.json|README\.md|code-kit\.json)/;
 // a real redirect into a file; `2>&1` and `>/dev/null` are not writes
-const writes =
-  /((?<![0-9&])>>?\s*(?!&|\/dev\/null)\S|\btee\b|\bsed\s+-i|\bperl\s+-i|\bmv\b|\bcp\b|\brm\b|\bpython3?\b|\bnode\s+-e|\btruncate\b|\bchmod\b|\bln\b)/.test(
-    cmd,
-  );
-if (touchesKit && writes && actor.kind !== 'lead' && !approval(root, 'kit', actor)) {
+const WRITES =
+  /((?<![0-9&])>>?\s*(?!&|\/dev\/null)\S|\btee\b|\bsed\s+-i|\bperl\s+-i|\bmv\b|\bcp\b|\brm\b|\bpython3?\b|\bnode\s+-e|\btruncate\b|\bchmod\b|\bln\b)/;
+const kitWrite = commandsOf(cmd).some((c) => KIT_PATH.test(c.text) && WRITES.test(c.text));
+if (kitWrite && actor.kind !== 'lead' && !approval(root, 'kit', actor)) {
   recordRequest(
     root,
     actor,

package/hooks/lane-audit.mjs

@@ -2,8 +2,9 @@
 // PostToolUse (Bash) and part of Stop: shell commands can write files without going through the
 // path guard, so after each one every uncommitted change in the worktree is checked against the
 // same rules (lib/rules.mjs). Anything the actor may not write is reported for revert.
-import { readFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   APPROVAL_LOG,
@@ -39,12 +40,54 @@ export function changedFiles(root) {
     .filter((f) => f !== LANE_FILE);
 }
 
+// A read-only agent (a reviewer, a card writer) works in a checkout it shares, usually the lead's,
+// whose uncommitted work isn't the agent's. So its shell commands are judged by what each one changed:
+// the uncommitted files are noted before the command runs (guard-bash) and compared after it.
+const snapshotFile = (id) => join(tmpdir(), 'code-kit-shell', `${id}.json`);
+const signature = (root, rel) => {
+  try {
+    const s = statSync(join(root, rel));
+    return `${s.size}:${s.mtimeMs}`;
+  } catch {
+    return 'gone';
+  }
+};
+
+/** Notes the uncommitted files and their state before a read-only agent's command runs. */
+export function noteBefore(input) {
+  const root = actorRoot(input);
+  if (!root || !input.tool_use_id) return;
+  const before = Object.fromEntries(changedFiles(root).map((rel) => [rel, signature(root, rel)]));
+  try {
+    mkdirSync(join(tmpdir(), 'code-kit-shell'), { recursive: true });
+    writeFileSync(snapshotFile(input.tool_use_id), JSON.stringify(before));
+  } catch {
+    // without a note, every uncommitted change is judged, as for any actor
+  }
+}
+
+/** What was noted before the command, taken once; null when nothing was. */
+function takeNote(input) {
+  if (!input.tool_use_id) return null;
+  const file = snapshotFile(input.tool_use_id);
+  try {
+    const before = JSON.parse(readFileSync(file, 'utf8'));
+    rmSync(file, { force: true });
+    return before;
+  } catch {
+    return null;
+  }
+}
+
 export function auditProblems(input, config) {
   const root = actorRoot(input);
   if (!root) return [];
   const actor = actorFor(input, root, config);
+  const before = actor.kind === 'readonly' ? takeNote(input) : null;
   return (
     changedFiles(root)
+      // A read-only agent answers for what its command changed, not for the checkout it shares.
+      .filter((rel) => !before || before[rel] !== signature(root, rel))
       .filter((rel) => !(rel === APPROVAL_LOG && appendedOnly(root, rel)))
       // Mid-merge, the incoming branch's changes are its own, not this actor's writes.
       .filter((rel) => !arrivesWithMerge(root, rel))

package/hooks/lib/adapters/context-graph.mjs

@@ -1,35 +1,58 @@
-// Context Graph (ctx) keeps a project's engineering context in `.ctx/`: ratified rules and concepts in
-// graph.ctx, settings in config.toml, the decisions agents record as they work in decisions.ctx, and
-// each file's card (its why) in cards.ctx. Every agent records decisions and cards for the files it
-// edits, so those two files are writable by any actor; the rules and settings
-// are the lead's, and changes to them go through the approval log. Ratifying a rule is a person's act,
-// signed with a commit trailer, so no Claude actor may write that trailer, unless the project lets the
-// lead act on what the person says in chat (`approvals.lead`). A delegated ratification, signed
-// `Ctx-Ratified-By: <ratifier> (delegated)`, is the lead's own act under the repository's [delegate]
-// rules: only the lead may write that trailer, and Context Graph's gate checks the kinds it covers.
-// Ratifying with `--commit`, and dropping a proposal, are the person's acts in ctx too, so no actor runs
-// them; only a command in command position counts, so text that mentions one isn't refused.
+// Context Graph (ctx) keeps a project's engineering context in `.ctx/`: rules and concepts in graph.ctx
+// (proposals in proposals.ctx), settings in config.toml, the decisions agents record as they work in
+// decisions.ctx, and each file's card (its why) in cards.ctx. It runs in the background, so every agent
+// writes its cards, its decisions and the guidance it finds; the settings are the lead's, and a change
+// to them goes through the approval log. A rule that blocks edits, or a concept, needs a person's
+// signature, a commit trailer, and Context Graph's own gate checks it, so no Claude actor may write that
+// trailer, unless the project lets the lead act on what the person says in chat (`approvals.lead`). A
+// delegated ratification, signed `Ctx-Ratified-By: <ratifier> (delegated)`, is the lead's own act under
+// the repository's [delegate] rules: only the lead may write that trailer.
+// Ratifying with `--commit`, dropping a proposal and changing the harness settings are the person's acts
+// in ctx too, so no actor runs
+// them; only a command the line runs counts, so a heredoc or quoted text that mentions one isn't refused.
+import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 
+/** ctx's JSON for `args`, run in `root`, or null where ctx isn't installed or fails. */
+function ctx(root, args) {
+  try {
+    return JSON.parse(
+      execFileSync('ctx', [...args, '--json'], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 30000,
+      }),
+    );
+  } catch {
+    return null;
+  }
+}
+
 const CTX = String.raw`(?:ctx|node\s+["']?[^\s"']*ctx\.mjs["']?|npx\s+(?:--yes\s+)?@warren-dean/context-graph(?:@\S+)?)`;
-const PERSONS_ACT = String.raw`(?:^|[;&|\n])\s*${CTX}\s+(?:ratify\b[^;&|\n]*\s--commit\b|drop\b)`;
+const PERSONS_ACT = String.raw`^${CTX}\s+(?:ratify\b[^;&|\n]*\s--commit\b|drop\b|settings\s+set\b)`;
+
+/** A commit the person signed with their ratification trailer; agents may not write it. */
+const PERSON_SIGNED = '^Ctx-Ratified-By:(?![^\\n]*\\(delegated\\))\\s*\\S';
 
 export default {
   name: 'context-graph',
   detect: (root) => existsSync(join(root, '.ctx')),
   config: {
     lead: ['.ctx/**'],
-    anyActor: ['.ctx/decisions.ctx', '.ctx/cards.ctx'],
+    // Context Graph runs in the background: every agent writes its cards and decisions, and the guidance
+    // rules it finds (which inform and never block). A rule that blocks edits, or a concept, still needs
+    // a person's signed commit, and Context Graph's own gate checks that on every pull request.
+    anyActor: ['.ctx/decisions.ctx', '.ctx/cards.ctx', '.ctx/graph.ctx', '.ctx/proposals.ctx'],
     protected: [
+      // Its settings are the person's: a change is logged, or signed when they commit it themselves.
       {
-        glob: '.ctx/graph.ctx',
+        glob: '.ctx/config.toml',
         approval: 'ctx',
-        why: "Context Graph's rules and concepts",
-        // A person's ratification (`ctx ratify --commit`, `ctx drop --commit`) is signed, not logged.
-        signedBy: '^Ctx-Ratified-By:(?![^\\n]*\\(delegated\\))\\s*\\S',
+        why: "Context Graph's settings",
+        signedBy: PERSON_SIGNED,
       },
-      { glob: '.ctx/config.toml', approval: 'ctx', why: "Context Graph's settings" },
     ],
   },
   shell: {
@@ -41,7 +64,8 @@ export default {
       },
       {
         pattern: PERSONS_ACT,
-        why: "Ratifying a Context Graph proposal with --commit, and dropping one, are the person's own acts: they run them themselves, with a `!` command, or from the Context Graph pane.",
+        command: true,
+        why: "Ratifying a Context Graph proposal with --commit, dropping one, and changing Context Graph's harness settings are the person's own acts: they run them themselves, with a `!` command, or from the Context Graph pane.",
       },
     ],
     restricted: [
@@ -52,6 +76,50 @@ export default {
       },
     ],
   },
+  // What Context Graph knows of the lanes' work (the combined lane view, docs/specs/13-combined.md).
+  facts: {
+    /** Whether ctx's command line runs here. */
+    available: (root) => ctx(root, ['agents', '--session', 'none']) !== null,
+    /**
+     * Per agent type in a session (null for the main session): the edits made without understanding,
+     * each with the files still unread, and the cards owed.
+     */
+    lanes: (root, { session }) => {
+      const agents = session ? (ctx(root, ['agents', '--session', session]) ?? []) : [];
+      const byType = {};
+      for (const a of Array.isArray(agents) ? agents : []) {
+        const key = a.agentType ?? 'lead';
+        const f = (byType[key] ??= { withoutUnderstanding: [], cardsOwed: [] });
+        for (const e of a.edited ?? [])
+          if (!e.understood) f.withoutUnderstanding.push({ path: e.path, unread: e.missing ?? [] });
+        for (const c of a.cardsOwed ?? []) if (!f.cardsOwed.includes(c)) f.cardsOwed.push(c);
+      }
+      return byType;
+    },
+    /** Per file: the rules that apply to it, agreed and proposed, and its card: current, stale or missing, with its text. */
+    files: (root, paths) =>
+      Object.fromEntries(
+        paths.map((path) => {
+          const f = ctx(root, ['file', path]);
+          return [
+            path,
+            {
+              card: f?.card
+                ? { state: f.card.fresh === false ? 'stale' : 'current', text: f.card.text ?? '' }
+                : { state: 'missing', text: '' },
+              rules: (f?.rules ?? []).map((r) => ({
+                id: r.id,
+                text: r.text,
+                mode: r.mode,
+                proposed: r.mode === 'G?',
+              })),
+            },
+          ];
+        }),
+      ),
+    /** The command that opens Context Graph's pane on a file, given its path. */
+    open: { command: 'graph' },
+  },
   setup: [
     '.gitignore: .ctx/archive/, .ctx/bench/, .ctx/models/ and .ctx/serve.json (ctx working files, never committed)',
     '.gitattributes: .ctx/decisions.ctx merge=union and .ctx/cards.ctx merge=union (lanes record decisions and cards on parallel branches; merging keeps them all)',

package/hooks/lib/adapters/index.mjs

@@ -11,6 +11,9 @@
 //             shell.block (`person: true` marks a person's act the lead may do for them under
 //             approvals.lead); restricted: commands only the lead and the listed lanes may run
 //   setup     lines for init to apply or tell the person: ignore files, merge drivers, instructions
+//   facts     what the tool knows of the lanes' work, for the mod's combined view: { available(root),
+//             lanes(root, { session }) → { [agent type or 'lead']: { withoutUnderstanding, cardsOwed } },
+//             files(root, paths) → { [path]: { rules } }, open: { command } (its view of a file) }
 //
 // The core only ever calls applyAdapters() and activeAdapters(); it never names a tool.
 import contextGraph from './context-graph.mjs';
@@ -22,6 +25,21 @@ export function activeAdapters(raw, root) {
   return ADAPTERS.filter((a) => raw.adapters?.[a.name] !== false && a.detect(root));
 }
 
+/**
+ * What the active adapters that know of the lanes' work report (JOIN-1): [{ name, lanes?, files?, open }],
+ * only those whose tool is available here. `paths` asks for those files' facts too.
+ */
+export function adapterFacts(raw, root, { session = null, paths = null } = {}) {
+  return activeAdapters(raw, root)
+    .filter((a) => a.facts && a.facts.available(root))
+    .map((a) => ({
+      name: a.name,
+      ...(a.facts.lanes ? { lanes: a.facts.lanes(root, { session }) } : {}),
+      ...(paths && a.facts.files ? { files: a.facts.files(root, paths) } : {}),
+      open: a.facts.open ?? null,
+    }));
+}
+
 /** The effective config with every active adapter's contributions merged in. */
 export function applyAdapters(config, raw, root) {
   const active = activeAdapters(raw, root);

package/hooks/lib/config.mjs

@@ -1,5 +1,6 @@
 // The project's rules live in .claude/code-kit.json. The hooks read it from the project the session
 // was opened in; a project without one is not governed by the kit, and an invalid one fails closed.
+import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { harnessProblems, harnessSettings } from './harness.mjs';
 import { join } from 'node:path';
@@ -29,6 +30,43 @@ export function loadConfig(projectDir) {
   return { config: effectiveConfig(raw, projectDir) };
 }
 
+/**
+ * The config as committed on `ref`: what governs merging into it, so a branch's own config can't grant
+ * itself a merge its target doesn't allow. `{ config }`, `{ error }` when it's invalid, or `{}` when
+ * `ref` has none committed yet (the first merge, which brings code-kit's rules onto it).
+ */
+export function committedConfig(root, ref, file = CONFIG_FILE) {
+  let text;
+  try {
+    text = execFileSync('git', ['-C', root, 'show', `${ref}:${file}`], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return {};
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (e) {
+    return { error: `${file} on ${ref} is not valid JSON: ${e.message}` };
+  }
+  const problems = validate(raw);
+  if (problems.length)
+    return { error: `${file} on ${ref} is invalid:\n  ${problems.join('\n  ')}` };
+  return { config: effectiveConfig(raw, root) };
+}
+
+/**
+ * Whether the lead may merge into the base (the first protected branch), by the rules committed there:
+ * `{ into, delegated, first }`, `first` when the base has no config committed yet.
+ */
+export function mergeDelegation(root, config, file = CONFIG_FILE) {
+  const into = config.branches.protected[0];
+  const { config: target, error } = committedConfig(root, into, file);
+  return { into, delegated: Boolean(target?.approvals.delegate?.merge), first: !target && !error };
+}
+
 /** The rules the hooks enforce: the project's config, the kit's defaults, and any active adapters. */
 export const effectiveConfig = (raw, root) => applyAdapters(withDefaults(raw), raw, root);
 
@@ -252,10 +290,13 @@ function validateLayers(c, need, each) {
 function validateShell(s, lanes, need) {
   if (!need(isObj(s), '"shell" must be an object')) return;
   const rule = (r) => isObj(r) && isRegExp(r.pattern) && isStr(r.why);
-  const blockRule = (r) => rule(r) && [undefined, true, false].includes(r.person);
+  const blockRule = (r) =>
+    rule(r) &&
+    [undefined, true, false].includes(r.person) &&
+    [undefined, true, false].includes(r.command);
   need(
     s.block === undefined || (Array.isArray(s.block) && s.block.every(blockRule)),
-    '"shell.block" must be a list of { pattern, why, person? }',
+    '"shell.block" must be a list of { pattern, why, person?, command? }',
   );
   const restricted =
     s.restricted === undefined ||

package/hooks/lib/dependencies.mjs

@@ -1,6 +1,7 @@
 // New dependencies: which packages a shell command adds, and which files installing them changes.
 // Each package needs a person's approval (`dep-<package>`), which also covers those files.
 import { basename } from 'node:path';
+import { commandsOf } from './shell.mjs';
 
 // What installing a package rewrites: manifests and lockfiles, wherever they sit.
 const DEPENDENCY_FILES = new Set([
@@ -86,22 +87,38 @@ const MANAGERS = {
 };
 MANAGERS.pip3 = MANAGERS.pip;
 
-/** The packages `cmd` adds as dependencies, in order: none for a bare install or a requirements file. */
+/**
+ * The packages `cmd` adds as dependencies, in order: none for a bare install or a requirements file.
+ * Only the commands it runs count: quoted text and heredoc bodies are data (an echo, a commit message),
+ * except a shell's `-c` script, which runs.
+ */
 export function addedPackages(cmd) {
   const found = [];
-  for (const segment of cmd.split(/&&|\|\||[;|\n]/)) {
-    const tokens = segment
-      .trim()
-      .split(/\s+/)
-      .map((t) => t.replace(/^["']|["']$/g, ''));
-    tokens.forEach((token, i) => {
-      const manager = MANAGERS[basename(token)];
-      if (manager) found.push(...packagesAfter(tokens.slice(i + 1), manager));
+  for (const { text, code } of commandsOf(cmd)) {
+    // Words split where the quote-masked code has spaces, so a quoted word stays one word.
+    const words = [...code.matchAll(/\S+/g)].map((m) => ({
+      quoted: /^["']/.test(m[0]),
+      word: text.slice(m.index, m.index + m[0].length).replace(/^["']|["']$/g, ''),
+    }));
+    words.forEach(({ word, quoted }, i) => {
+      if (quoted) return;
+      if (SHELLS.has(basename(word)) && words[i + 1]?.word === '-c' && words[i + 2])
+        found.push(...addedPackages(words[i + 2].word));
+      const manager = MANAGERS[basename(word)];
+      if (manager)
+        found.push(
+          ...packagesAfter(
+            words.slice(i + 1).map((w) => w.word),
+            manager,
+          ),
+        );
     });
   }
   return [...new Set(found)];
 }
 
+const SHELLS = new Set(['sh', 'bash', 'zsh']);
+
 // The words after a package manager's name: its subcommand must be one that adds packages, and the
 // words after that, other than flags and their values, are the packages.
 function packagesAfter(words, manager) {

package/hooks/lib/harness.mjs

@@ -15,9 +15,9 @@ export const SETTINGS = {
   'hold.minutes': {
     default: 2,
     problem: (v) =>
-      Number.isFinite(v) && v >= 0 && v <= 30
+      Number.isFinite(v) && v >= 0 && v <= 10
         ? null
-        : 'must be a number of minutes from 0 (off) to 30',
+        : 'must be a number of minutes from 0 (off) to 10',
     about: 'How long a call waiting on your approval is held before it is refused',
   },
   'stall.nudgeMinutes': {