@zelari/core 2.15.0 → 2.16.0

package/dist/core/hooks/lifecycleHookRunner.js

@@ -1,10 +1,19 @@
 /**
  * LifecycleHookRunner — executes PreToolUse / PostToolUse / SessionStart /
- * SessionEnd hooks as external commands (or HTTP POSTs), FAIL-OPEN.
+ * SessionEnd hooks as external commands (or HTTP POSTs).
  *
  * Safety model (v1.32.0):
  * - A hook that crashes, times out, exits non-zero, or returns invalid JSON
- *   is logged and treated as ALLOW. Hooks must never brick the agent.
+ *   is logged and treated as ALLOW (default `failureMode: 'fail-open'`).
+ *   v2.16 (HARNESS-10 t22): `failureMode: 'fail-closed'` — used by the CLI
+ *   for strict headless/mission/CI surfaces — treats every such unreliable
+ *   outcome as an explicit DENY with reason `hook-failed` instead (same
+ *   deny shape as a hook's own decision). The mode applies to PreToolUse
+ *   AND Session hooks; the CLI layer decides it (see
+ *   src/cli/safety/lifecycleHooks.ts `resolveHookFailureMode`).
+ * - v2.17 (t27): hook commands spawn as an EXPLICIT argv with `shell: false`
+ *   on every OS (see splitHookCommandLine) — shell metacharacters in a hook
+ *   `command` are literal arguments, never re-interpreted by a shell.
  * - The ONLY way to block a tool is an explicit JSON decision
  *   `{ "decision": "deny", "reason": "..." }` on stdout / response body.
  * - Tool matching is Claude-code style: `Bash` and `bash` both match the
@@ -32,16 +41,82 @@ function parseJson(text) {
     }
 }
 /**
- * Execute one hook for an event. NEVER throws: any failure becomes an
- * explicit allow (fail-open) with a logged warning.
+ * v2.17 (t27): conservative command line → argv split for hook commands.
+ *
+ * Splits on whitespace; honors single/double quotes and `\"` `\'` `\\`
+ * escapes. A backslash escapes ONLY quote/backslash characters (never an
+ * arbitrary next char) so Windows paths like `C:\tools\hook.mjs` survive
+ * unquoted. There are NO shell semantics: metacharacters (`;`, `&&`, `|`,
+ * `$VAR`, `>`) are never special — they become literal argv tokens. Paired
+ * with `shell: false` in {@link LifecycleHookRunner.execCommand} the OS
+ * executes exactly `[program, ...args]`: `echo a; rm -rf /` is the program
+ * `echo` with the literal argument `a;` — the `rm` NEVER runs. Unclosed
+ * quotes are tolerated (the partial token is kept, the hook then fails and
+ * the failure mode decides the outcome). Env-prefix syntax (`FOO=1 node x`)
+ * is NOT shell-magic here: `FOO=1` would be the program name and fail —
+ * move environment into the hook script. Windows `.cmd`/`.bat` shims
+ * (`npm`, `npx`) need the full path, same limitation as exec_process.
+ */
+export function splitHookCommandLine(line) {
+    const out = [];
+    let cur = '';
+    let hasToken = false;
+    let quote = null;
+    for (let i = 0; i < line.length; i += 1) {
+        const ch = line[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else if (quote === '"' && ch === '\\' && (line[i + 1] === '"' || line[i + 1] === '\\')) {
+                cur += line[i + 1];
+                i += 1;
+            }
+            else {
+                cur += ch;
+            }
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+            hasToken = true;
+        }
+        else if (ch === '\\' && (line[i + 1] === '"' || line[i + 1] === "'" || line[i + 1] === '\\')) {
+            cur += line[i + 1];
+            hasToken = true;
+            i += 1;
+        }
+        else if (/\s/.test(ch)) {
+            if (hasToken) {
+                out.push(cur);
+                cur = '';
+                hasToken = false;
+            }
+        }
+        else {
+            cur += ch;
+            hasToken = true;
+        }
+    }
+    if (hasToken || cur.length > 0)
+        out.push(cur);
+    return out;
+}
+/**
+ * Execute hooks for lifecycle events. NEVER throws: an unreliable hook
+ * (crash / timeout / invalid JSON / deny without reason) becomes an explicit
+ * allow (fail-open, default) or an explicit deny 'hook-failed' (fail-closed,
+ * t22), with a logged warning either way.
  */
 export class LifecycleHookRunner {
     hooks = [];
     logger;
     defaultTimeoutMs;
+    /** v2.16 (t22): resolved failure mode. Default 'fail-open'. */
+    failureMode;
     constructor(options = {}) {
         this.logger = options.logger ?? ((msg) => console.error(`[hooks] ${msg}`));
         this.defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.failureMode = options.failureMode ?? 'fail-open';
         for (const dir of options.dirs ?? []) {
             this.loadDir(dir);
         }
@@ -84,8 +159,9 @@ export class LifecycleHookRunner {
     }
     /**
      * Run matching PreToolUse hooks. Returns `{ ok: false }` ONLY when a hook
-     * explicitly denies. All other outcomes (no match, crash, timeout, invalid
-     * JSON, allow decision) return `{ ok: true }`.
+     * explicitly denies — or, in fail-closed mode (t22), when the hook runner
+     * could not produce a verdict at all. Fail-open: no match, crash, timeout,
+     * invalid JSON and allow decisions all return `{ ok: true }`.
      */
     async runPreToolUse(toolName, toolInput, ctx) {
         for (const hook of this.hooks) {
@@ -127,11 +203,11 @@ export class LifecycleHookRunner {
             await this.runHookSafely(hook, payload);
         }
     }
-    /** Run matching SessionStart hooks. Fail-open; deny never throws. */
+    /** Run matching SessionStart hooks. Failure semantics per failureMode (t22). */
     async runSessionStart(ctx) {
         return this.runSessionHooks('SessionStart', ctx);
     }
-    /** Run matching SessionEnd hooks. Fail-open. */
+    /** Run matching SessionEnd hooks. Failure semantics per failureMode (t22). */
     async runSessionEnd(ctx) {
         return this.runSessionHooks('SessionEnd', ctx);
     }
@@ -155,7 +231,7 @@ export class LifecycleHookRunner {
         }
         return { ok: true };
     }
-    /** Execute a single hook, swallowing every failure into an allow. */
+    /** Execute a single hook; the failure mode decides allow vs deny 'hook-failed'. */
     async runHookSafely(hook, payload) {
         try {
             const timeoutMs = hook.timeoutMs ?? this.defaultTimeoutMs;
@@ -164,26 +240,46 @@ export class LifecycleHookRunner {
                 : await this.execCommand(hook.command ?? '', payload, timeoutMs, hook.cwd);
             const decision = parseJson(raw);
             if (!decision) {
-                this.logger(`hook "${hook.name}" returned invalid JSON (fail-open): ${raw.slice(0, 200)}`);
-                return { decision: 'allow' };
+                this.logger(`hook "${hook.name}" returned invalid JSON (${this.failureMode}): ${raw.slice(0, 200)}`);
+                return this.failureDecision();
             }
             if (decision.decision === 'deny' && typeof decision.reason !== 'string') {
-                this.logger(`hook "${hook.name}" denied without reason (fail-open)`);
-                return { decision: 'allow' };
+                this.logger(`hook "${hook.name}" denied without reason (${this.failureMode})`);
+                return this.failureDecision();
             }
             return decision;
         }
         catch (err) {
-            this.logger(`hook "${hook.name}" failed (fail-open): ${err instanceof Error ? err.message : String(err)}`);
-            return { decision: 'allow' };
+            this.logger(`hook "${hook.name}" failed (${this.failureMode}): ${err instanceof Error ? err.message : String(err)}`);
+            return this.failureDecision();
         }
     }
+    /**
+     * v2.16 (t22): resolve a hook that produced no usable verdict. Fail-open
+     * (default) allows; fail-closed maps the failure to the same shape as an
+     * explicit deny so PreToolUse/Session hook consumers block the call.
+     */
+    failureDecision() {
+        return this.failureMode === 'fail-closed'
+            ? { decision: 'deny', reason: 'hook-failed' }
+            : { decision: 'allow' };
+    }
     /** Spawn `command`, write JSON payload to stdin, read stdout until close. */
     execCommand(command, payload, timeoutMs, cwd) {
         return new Promise((resolve, reject) => {
-            // Shell-spawn so `node script.mjs` / `deno run` both work cross-platform.
-            const child = spawn(command, {
-                shell: true,
+            // v2.17 (t27): explicit argv + `shell: false` on EVERY OS (previously
+            // `spawn(command, { shell: true })`). The command line is parsed by
+            // splitHookCommandLine (quotes yes, shell metacharacters no) so a hook
+            // command can never be re-interpreted / chained by a shell: the OS
+            // runs exactly [program, ...args]. Plain .exe binaries resolve on PATH
+            // (`node script.mjs` / `deno run` keep working cross-platform).
+            const argv = splitHookCommandLine(command);
+            if (argv.length === 0) {
+                reject(new Error('empty hook command'));
+                return;
+            }
+            const child = spawn(argv[0], argv.slice(1), {
+                shell: false,
                 cwd,
                 stdio: ['pipe', 'pipe', 'pipe'],
                 windowsHide: true,

package/dist/core/hooks/lifecycleHookRunner.js.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycleHookRunner.js","sourceRoot":"","sources":["../../../src/core/hooks/lifecycleHookRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,WAAW,GAOZ,MAAM,YAAY,CAAC;AAWpB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,SAAS,SAAS,CAAI,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACtB,KAAK,GAAqB,EAAE,CAAC;IACpB,MAAM,CAAwB;IAC9B,gBAAgB,CAAS;IAE1C,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;QACvE,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAW;QACjB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,CAAC,yBAAyB;QACrC,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CAAiB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;oBAClD,SAAS;gBACX,CAAC;gBACD,qEAAqE;gBACrE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,SAAkB,EAClB,GAAyC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;gBAAE,SAAS;YACzD,MAAM,OAAO,GAAgB;gBAC3B,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS;gBACT,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,oBAAoB,IAAI,CAAC,IAAI,GAAG;iBAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,SAAkB,EAClB,UAAmB,EACnB,GAAuE;QAEvE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAC1D,MAAM,OAAO,GAAgB;gBAC3B,KAAK,EAAE,aAAa;gBACpB,QAAQ;gBACR,SAAS;gBACT,UAAU;gBACV,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,eAAe,CAAC,GAAyC;QAC7D,OAAO,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,aAAa,CAAC,GAAyC;QAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,KAAgB,EAChB,GAAyC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;gBAAE,SAAS;YACnD,MAAM,OAAO,GAAgB;gBAC3B,KAAK;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,oBAAoB,IAAI,CAAC,IAAI,GAAG;iBAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,aAAa,CACzB,IAAoB,EACpB,OAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;gBAClB,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC;gBACnD,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,SAAS,CAAe,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,wCAAwC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC/B,CAAC;YACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,qCAAqC,CAAC,CAAC;gBACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CACT,SAAS,IAAI,CAAC,IAAI,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,WAAW,CACjB,OAAe,EACf,OAAoB,EACpB,SAAiB,EACjB,GAAY;QAEZ,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,0EAA0E;YAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE;gBAC3B,KAAK,EAAE,IAAI;gBACX,GAAG;gBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC,CAAC;YACtD,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC5B,kBAAkB;YACpB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IACtD,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,OAAoB,EACpB,SAAiB;QAEjB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"lifecycleHookRunner.js","sourceRoot":"","sources":["../../../src/core/hooks/lifecycleHookRunner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,WAAW,GAOZ,MAAM,YAAY,CAAC;AAoBpB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,SAAS,SAAS,CAAI,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,GAAqB,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,IAAI,KAAK,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBACzF,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG,EAAE,CAAC;YACX,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC/F,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,GAAG,GAAG,EAAE,CAAC;gBACT,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;YACV,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACtB,KAAK,GAAqB,EAAE,CAAC;IACpB,MAAM,CAAwB;IAC9B,gBAAgB,CAAS;IAC1C,+DAA+D;IACtD,WAAW,CAAkB;IAEtC,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;QACvE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,GAAW;QACjB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,CAAC,yBAAyB;QACrC,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CAAiB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;oBAClD,SAAS;gBACX,CAAC;gBACD,qEAAqE;gBACrE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACvD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,SAAkB,EAClB,GAAyC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;gBAAE,SAAS;YACzD,MAAM,OAAO,GAAgB;gBAC3B,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,SAAS;gBACT,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,oBAAoB,IAAI,CAAC,IAAI,GAAG;iBAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,SAAkB,EAClB,UAAmB,EACnB,GAAuE;QAEvE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAC1D,MAAM,OAAO,GAAgB;gBAC3B,KAAK,EAAE,aAAa;gBACpB,QAAQ;gBACR,SAAS;gBACT,UAAU;gBACV,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,GAAyC;QAC7D,OAAO,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,aAAa,CAAC,GAAyC;QAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,KAAgB,EAChB,GAAyC;QAEzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;gBAAE,SAAS;YACnD,MAAM,OAAO,GAAgB;gBAC3B,KAAK;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,oBAAoB,IAAI,CAAC,IAAI,GAAG;iBAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,aAAa,CACzB,IAAoB,EACpB,OAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;gBAClB,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC;gBACnD,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,MAAM,QAAQ,GAAG,SAAS,CAAe,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,4BAA4B,IAAI,CAAC,WAAW,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrG,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,CAAC;YACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,4BAA4B,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;gBAC/E,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CACT,SAAS,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,WAAW,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxG,CAAC;YACF,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,eAAe;QACrB,OAAO,IAAI,CAAC,WAAW,KAAK,aAAa;YACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE;YAC7C,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,6EAA6E;IACrE,WAAW,CACjB,OAAe,EACf,OAAoB,EACpB,SAAiB,EACjB,GAAY;QAEZ,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC1C,KAAK,EAAE,KAAK;gBACZ,GAAG;gBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC,CAAC;YACtD,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC5B,kBAAkB;YACpB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IACtD,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,OAAoB,EACpB,SAAiB;QAEjB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/core/tools/builtin/shell.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type ChildProcess } from 'node:child_process';
 import { type ToolDefinition } from '../toolTypes.js';
 declare const BashArgsSchema: z.ZodObject<{
     command: z.ZodString;
@@ -21,7 +22,51 @@ interface BashResult {
      * (live test 2026-07-02: 6× `npm create vite` in a non-empty dir).
      */
     hint?: string;
+    /**
+     * v2.17 (t28): present ONLY when the CLI OS-jail seam ran this command
+     * in visible fail-open advisory mode (backend missing). Model-visible so
+     * the advisory fail-open is never silent.
+     */
+    jailNotice?: string;
 }
+/**
+ * v2.17 (t28) — OS-jail seam (Pilastro A).
+ *
+ * The builtin runs in TWO hosts with a strict dependency direction:
+ *  - the CLI (src/cli) must route every spawn through the osJail choke-point
+ *    (`spawnJailed` in src/cli/safety/osJail.ts) — core cannot import CLI
+ *    modules, so the CLI INJECTS this seam via createBashTool(seam);
+ *  - the core harness (harnessToolBridge → bashTool) keeps the default
+ *    direct spawn (documented, out of the CLI jail surface).
+ *
+ * The seam receives the FINAL program+argv+env (the same shape t27 made
+ * explicit, shell:false everywhere) and returns either a spawned child —
+ * optionally with an advisory `notice` — or a typed deny/failed reason that
+ * becomes a `[jail]`-prefixed tool error. Never throws.
+ */
+export type BashSpawnSeam = (req: {
+    program: string;
+    argv: string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+}) => {
+    outcome: 'spawned';
+    child: ChildProcess;
+    notice?: string;
+} | {
+    outcome: 'denied';
+    reason: string;
+} | {
+    outcome: 'failed';
+    reason: string;
+};
+export declare function createBashTool(spawnSeam?: BashSpawnSeam): ToolDefinition<BashArgs, BashResult>;
+/**
+ * Default builtin (core harness host): direct spawn, NO jail seam. The CLI
+ * registry builds its own instance via createBashTool(spawnJailedSeam) —
+ * see src/cli/toolRegistry.ts (v2.17 t28).
+ */
 export declare const bashTool: ToolDefinition<BashArgs, BashResult>;
 export {};
 //# sourceMappingURL=shell.d.ts.map

package/dist/core/tools/builtin/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../src/core/tools/builtin/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAyBzE,QAAA,MAAM,cAAc;;;;iBAIlB,CAAC;AAEH,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE/C,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAYD,eAAO,MAAM,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,UAAU,CAkGzD,CAAC"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../src/core/tools/builtin/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAyBzE,QAAA,MAAM,cAAc;;;;iBAIlB,CAAC;AAEH,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE/C,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,KACG;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAsH9F;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAoB,CAAC"}

package/dist/core/tools/builtin/shell.js

@@ -38,100 +38,126 @@ const INTERACTIVE_HINT = 'This command tried to PROMPT for input, but stdin is c
     'scaffold into a fresh EMPTY subdirectory (e.g. `npm create vite@latest scaffold-tmp -- --template react-ts`, ' +
     'then move its contents here with `mv`/`cp`), or write package.json, configs and sources directly ' +
     'with write_file and then run `npm install`.';
-export const bashTool = {
-    name: 'bash',
-    description: 'Run a shell command. On Windows uses Git Bash when available (POSIX semantics: ls, $VAR, && work); falls back to cmd.exe otherwise. Streams stdout/stderr. Respects timeout and cancellation. Returns exit code. ' +
-        'stdin is CLOSED (non-interactive): any command that prompts for input will fail or be cancelled — always pass non-interactive flags (--yes, -y, --template), and if a scaffolder insists on prompting (e.g. create-vite in a non-empty directory), create the files manually with write_file instead.',
-    permissions: ['execute'],
-    sideEffect: 'local',
-    timeoutMs: 60000,
-    inputSchema: BashArgsSchema,
-    execute: async (args, ctx) => {
-        return new Promise((resolve) => {
-            const start = Date.now();
-            const cwd = args.cwd ?? ctx.cwd;
-            const resolved = resolveShell();
-            // win32 + real bash: spawn the binary directly with `-c` and shell:false
-            // so there is no cmd.exe indirection (npm, &&, $VAR, ls all work because
-            // Git Bash's PATH resolves shims and `-c` runs a true POSIX string).
-            // POSIX / fallback: keep the historical `shell: true` (Node picks /bin/sh
-            // on posix, cmd.exe on win32-fallback — already warned by the resolver).
-            let child;
-            // v0.7.3: CI=1 pushes well-behaved CLIs (npm, scaffolders, test runners)
-            // into non-interactive mode; stdin 'ignore' makes the rest fail FAST
-            // with EOF instead of hanging on a prompt until the timeout (live test:
-            // `npm create vite` in a non-empty dir prompted → "Operation cancelled").
-            const baseEnv = withNodeDirOnPath({
-                ...process.env,
-                CI: process.env.CI ?? '1',
-            });
-            const env = resolved.isBash
-                ? { ...baseEnv, MSYSTEM: process.env.MSYSTEM ?? 'MINGW64' }
-                : baseEnv;
-            if (resolved.isBash) {
-                child = spawn(resolved.shell, ['-c', args.command], {
-                    cwd,
-                    signal: ctx.signal,
-                    shell: false,
-                    env,
-                    stdio: ['ignore', 'pipe', 'pipe'],
+export function createBashTool(spawnSeam) {
+    return {
+        name: 'bash',
+        description: 'Run a shell command. On Windows uses Git Bash when available (POSIX semantics: ls, $VAR, && work); falls back to cmd.exe otherwise. Streams stdout/stderr. Respects timeout and cancellation. Returns exit code. ' +
+            'stdin is CLOSED (non-interactive): any command that prompts for input will fail or be cancelled — always pass non-interactive flags (--yes, -y, --template), and if a scaffolder insists on prompting (e.g. create-vite in a non-empty directory), create the files manually with write_file instead.',
+        permissions: ['execute'],
+        sideEffect: 'local',
+        timeoutMs: 60000,
+        inputSchema: BashArgsSchema,
+        execute: async (args, ctx) => {
+            return new Promise((resolve) => {
+                const start = Date.now();
+                const cwd = args.cwd ?? ctx.cwd;
+                const resolved = resolveShell();
+                // win32 + real bash: spawn the binary directly with `-c` and shell:false
+                // so there is no cmd.exe indirection (npm, &&, $VAR, ls all work because
+                // Git Bash's PATH resolves shims and `-c` runs a true POSIX string).
+                // v2.17 (t27): the fallback branch ALSO spawns the shell binary as an
+                // explicit program+argv (`/bin/sh -c` on POSIX, `cmd.exe /d /s /c` on
+                // the win32 fallback) — the exact spawn shape of the NodeShellProvider
+                // seam (ADR-0022). `shell: true` is gone from every branch: the OS
+                // process tree is always [shell, flag, command], never a hidden
+                // shell-parsing indirection (DEP0190, Pilastro A prerequisite).
+                // v0.7.3: CI=1 pushes well-behaved CLIs (npm, scaffolders, test runners)
+                // into non-interactive mode; stdin 'ignore' makes the rest fail FAST
+                // with EOF instead of hanging on a prompt until the timeout (live test:
+                // `npm create vite` in a non-empty dir prompted → "Operation cancelled").
+                const baseEnv = withNodeDirOnPath({
+                    ...process.env,
+                    CI: process.env.CI ?? '1',
                 });
-            }
-            else if (resolved.isPowerShell) {
-                // PowerShell: use `-Command` (works on PS5.1 and PS7+).
-                // Do NOT set MSYSTEM — it's not a bash/MSYS2 environment.
-                child = spawn(resolved.shell, ['-Command', args.command], {
-                    cwd,
-                    signal: ctx.signal,
-                    shell: false,
-                    env: baseEnv,
-                    stdio: ['ignore', 'pipe', 'pipe'],
+                const env = resolved.isBash
+                    ? { ...baseEnv, MSYSTEM: process.env.MSYSTEM ?? 'MINGW64' }
+                    : baseEnv;
+                let program;
+                let argv;
+                if (resolved.isBash) {
+                    program = resolved.shell;
+                    argv = ['-c', args.command];
+                }
+                else if (resolved.isPowerShell) {
+                    // PowerShell: use `-Command` (works on PS5.1 and PS7+).
+                    // Do NOT set MSYSTEM — it's not a bash/MSYS2 environment.
+                    program = resolved.shell;
+                    argv = ['-Command', args.command];
+                }
+                else {
+                    // Fallback (POSIX / win32 without bash or PowerShell): spawn the shell
+                    // Node's `shell: true` would have picked — /bin/sh on POSIX, cmd.exe
+                    // (ComSpec semantics: /d skips AutoRun, /s fixes /c quoting) on win32 —
+                    // but as an explicit argv with shell:false (v2.17 t27).
+                    const isWin = process.platform === 'win32';
+                    program = isWin ? 'cmd.exe' : '/bin/sh';
+                    argv = isWin ? ['/d', '/s', '/c', args.command] : ['-c', args.command];
+                }
+                // v2.17 (t28): the CLI-injected seam (osJail.spawnJailed) is the ONLY
+                // route for CLI spawns; the default stays the direct t27 spawn.
+                let child;
+                let jailNotice;
+                if (spawnSeam) {
+                    const seamResult = spawnSeam({ program, argv, cwd, env, signal: ctx.signal });
+                    if (seamResult.outcome !== 'spawned') {
+                        resolve(typedErr(seamResult.reason));
+                        return;
+                    }
+                    child = seamResult.child;
+                    jailNotice = seamResult.notice;
+                }
+                else {
+                    child = spawn(program, argv, {
+                        cwd,
+                        signal: ctx.signal,
+                        shell: false,
+                        env,
+                        stdio: ['ignore', 'pipe', 'pipe'],
+                    });
+                }
+                let stdout = '';
+                let stderr = '';
+                const maxBuffer = 1024 * 1024; // 1MB cap on each stream
+                child.stdout?.on('data', (data) => {
+                    if (stdout.length < maxBuffer)
+                        stdout += data.toString('utf-8');
                 });
-            }
-            else {
-                child = spawn(args.command, {
-                    shell: resolved.shell,
-                    cwd,
-                    signal: ctx.signal,
-                    env,
-                    stdio: ['ignore', 'pipe', 'pipe'],
+                child.stderr?.on('data', (data) => {
+                    if (stderr.length < maxBuffer)
+                        stderr += data.toString('utf-8');
+                });
+                const timer = setTimeout(() => {
+                    child.kill('SIGTERM');
+                    resolve(typedErr(`Bash command timed out after ${args.timeoutMs}ms. ` +
+                        'If it was waiting for interactive input: stdin is closed — pass non-interactive flags or create the files directly instead of retrying.'));
+                }, args.timeoutMs);
+                child.on('close', (code) => {
+                    clearTimeout(timer);
+                    const cappedStdout = stdout.slice(0, maxBuffer);
+                    const cappedStderr = stderr.slice(0, maxBuffer);
+                    const interactive = INTERACTIVE_CANCEL_RE.test(cappedStdout) || INTERACTIVE_CANCEL_RE.test(cappedStderr);
+                    resolve(typedOk({
+                        stdout: cappedStdout,
+                        stderr: cappedStderr,
+                        exitCode: code ?? -1,
+                        durationMs: Date.now() - start,
+                        shellVia: resolved.via,
+                        ...(jailNotice ? { jailNotice } : {}),
+                        ...(interactive ? { hint: INTERACTIVE_HINT } : {}),
+                    }));
+                });
+                child.on('error', (err) => {
+                    clearTimeout(timer);
+                    resolve(typedErr(err.message));
                 });
-            }
-            let stdout = '';
-            let stderr = '';
-            const maxBuffer = 1024 * 1024; // 1MB cap on each stream
-            child.stdout?.on('data', (data) => {
-                if (stdout.length < maxBuffer)
-                    stdout += data.toString('utf-8');
-            });
-            child.stderr?.on('data', (data) => {
-                if (stderr.length < maxBuffer)
-                    stderr += data.toString('utf-8');
-            });
-            const timer = setTimeout(() => {
-                child.kill('SIGTERM');
-                resolve(typedErr(`Bash command timed out after ${args.timeoutMs}ms. ` +
-                    'If it was waiting for interactive input: stdin is closed — pass non-interactive flags or create the files directly instead of retrying.'));
-            }, args.timeoutMs);
-            child.on('close', (code) => {
-                clearTimeout(timer);
-                const cappedStdout = stdout.slice(0, maxBuffer);
-                const cappedStderr = stderr.slice(0, maxBuffer);
-                const interactive = INTERACTIVE_CANCEL_RE.test(cappedStdout) || INTERACTIVE_CANCEL_RE.test(cappedStderr);
-                resolve(typedOk({
-                    stdout: cappedStdout,
-                    stderr: cappedStderr,
-                    exitCode: code ?? -1,
-                    durationMs: Date.now() - start,
-                    shellVia: resolved.via,
-                    ...(interactive ? { hint: INTERACTIVE_HINT } : {}),
-                }));
-            });
-            child.on('error', (err) => {
-                clearTimeout(timer);
-                resolve(typedErr(err.message));
             });
-        });
-    },
-};
+        },
+    };
+}
+/**
+ * Default builtin (core harness host): direct spawn, NO jail seam. The CLI
+ * registry builds its own instance via createBashTool(spawnJailedSeam) —
+ * see src/cli/toolRegistry.ts (v2.17 t28).
+ */
+export const bashTool = createBashTool();
 //# sourceMappingURL=shell.js.map

package/dist/core/tools/builtin/shell.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../../../src/core/tools/builtin/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAuB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,GAAG,GAAG,GAAG,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACpE,CAAC,CAAC;AAqBH,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,wEAAwE,CAAC;AAEvG,MAAM,gBAAgB,GACpB,uFAAuF;IACvF,2EAA2E;IAC3E,+GAA+G;IAC/G,mGAAmG;IACnG,6CAA6C,CAAC;AAEhD,MAAM,CAAC,MAAM,QAAQ,GAAyC;IAC5D,IAAI,EAAE,MAAM;IACZ,WAAW,EACT,mNAAmN;QACnN,uSAAuS;IACzS,WAAW,EAAE,CAAC,SAAS,CAAC;IACxB,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,KAAK;IAChB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;YAChC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;YAEhC,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,IAAI,KAA+B,CAAC;YACpC,yEAAyE;YACzE,qEAAqE;YACrE,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,GAAG,OAAO,CAAC,GAAG;gBACd,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG;aAC1B,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM;gBACzB,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,EAAE;gBAC3D,CAAC,CAAC,OAAO,CAAC;YACZ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;oBAC5D,GAAG;oBACH,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK,EAAE,KAAK;oBACZ,GAAG;oBACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACjC,wDAAwD;gBACxD,0DAA0D;gBAC1D,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAe,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;oBAClE,GAAG;oBACH,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,KAAK,EAAE,KAAK;oBACZ,GAAG,EAAE,OAAO;oBACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;oBAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,GAAG;oBACH,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG;oBACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,yBAAyB;YACxD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS;oBAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS;oBAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,OAAO,CAAC,QAAQ,CACd,gCAAgC,IAAI,CAAC,SAAS,MAAM;oBACpD,yIAAyI,CAC1I,CAAC,CAAC;YACL,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAChD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAChD,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACzG,OAAO,CACL,OAAO,CAAC;oBACN,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,YAAY;oBACpB,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;oBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,GAAG;oBACtB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../../../src/core/tools/builtin/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAuB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,GAAG,GAAG,GAAG,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACpE,CAAC,CAAC;AA2BH,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,wEAAwE,CAAC;AAEvG,MAAM,gBAAgB,GACpB,uFAAuF;IACvF,2EAA2E;IAC3E,+GAA+G;IAC/G,mGAAmG;IACnG,6CAA6C,CAAC;AA4BhD,MAAM,UAAU,cAAc,CAAC,SAAyB;IACtD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,mNAAmN;YACnN,uSAAuS;QACzS,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;gBAChC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;gBAEhC,yEAAyE;gBACzE,yEAAyE;gBACzE,qEAAqE;gBACrE,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,mEAAmE;gBACnE,gEAAgE;gBAChE,gEAAgE;gBAChE,yEAAyE;gBACzE,qEAAqE;gBACrE,wEAAwE;gBACxE,0EAA0E;gBAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC;oBAChC,GAAG,OAAO,CAAC,GAAG;oBACd,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG;iBAC1B,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM;oBACzB,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,EAAE;oBAC3D,CAAC,CAAC,OAAO,CAAC;gBACZ,IAAI,OAAe,CAAC;gBACpB,IAAI,IAAc,CAAC;gBACnB,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,OAAO,GAAG,QAAQ,CAAC,KAAe,CAAC;oBACnC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC9B,CAAC;qBAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;oBACjC,wDAAwD;oBACxD,0DAA0D;oBAC1D,OAAO,GAAG,QAAQ,CAAC,KAAe,CAAC;oBACnC,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;qBAAM,CAAC;oBACN,uEAAuE;oBACvE,qEAAqE;oBACrE,wEAAwE;oBACxE,wDAAwD;oBACxD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;oBAC3C,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;oBACxC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzE,CAAC;gBAED,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,KAAmB,CAAC;gBACxB,IAAI,UAA8B,CAAC;gBACnC,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC9E,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;wBACrC,OAAO;oBACT,CAAC;oBACD,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;oBACzB,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;wBAC3B,GAAG;wBACH,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,KAAK,EAAE,KAAK;wBACZ,GAAG;wBACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,yBAAyB;gBACxD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACxC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS;wBAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACxC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS;wBAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,OAAO,CAAC,QAAQ,CACd,gCAAgC,IAAI,CAAC,SAAS,MAAM;wBACpD,yIAAyI,CAC1I,CAAC,CAAC;gBACL,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;oBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBAChD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBAChD,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACzG,OAAO,CACL,OAAO,CAAC;wBACN,MAAM,EAAE,YAAY;wBACpB,MAAM,EAAE,YAAY;wBACpB,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;wBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;wBAC9B,QAAQ,EAAE,QAAQ,CAAC,GAAG;wBACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnD,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAyC,cAAc,EAAE,CAAC"}

package/dist/core/tools/registry.d.ts

@@ -46,7 +46,11 @@ export declare class ToolRegistry {
     private openAIToolsCache;
     register<I, O>(def: ToolDefinition<I, O>): void;
     get(name: string): ToolDefinition | undefined;
-    /** v0.10.0: attach the fail-open lifecycle hook runner (null to disable). */
+    /**
+     * v0.10.0: attach the lifecycle hook runner (null to disable).
+     * v2.16 (t22): the runner's failureMode decides what a THROWING runner
+     * means — fail-closed denies the call, fail-open (default) allows it.
+     */
     setLifecycleHooks(runner: LifecycleHookRunner | null): void;
     getLifecycleHooks(): LifecycleHookRunner | null;
     list(): string[];

package/dist/core/tools/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/tools/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAY,KAAK,cAAc,EAAoB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAM,GAAG,yBAAgD,GACnE,MAAM,CA0DR;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAqC;IAClD,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAoC;IAC1D;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB,CAAkI;IAE1J,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI;IAK/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,6EAA6E;IAC7E,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAI3D,iBAAiB,IAAI,mBAAmB,GAAG,IAAI;IAI/C,IAAI,IAAI,MAAM,EAAE;IAIhB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAMlB,gFAAgF;IAC1E,MAAM,CAAC,CAAC,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAoH1B,gFAAgF;IAChF,aAAa,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAalI,oGAAoG;IACpG,YAAY,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE;CAa3D;AAID,wBAAgB,eAAe,IAAI,YAAY,CAG9C"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/tools/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAY,KAAK,cAAc,EAAoB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAM,GAAG,yBAAgD,GACnE,MAAM,CA0DR;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAqC;IAClD,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAoC;IAC1D;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB,CAAkI;IAE1J,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI;IAK/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;;;OAIG;IACH,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAI3D,iBAAiB,IAAI,mBAAmB,GAAG,IAAI;IAI/C,IAAI,IAAI,MAAM,EAAE;IAIhB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAMlB,gFAAgF;IAC1E,MAAM,CAAC,CAAC,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IA8H1B,gFAAgF;IAChF,aAAa,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAalI,oGAAoG;IACpG,YAAY,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,EAAE;CAa3D;AAID,wBAAgB,eAAe,IAAI,YAAY,CAG9C"}

package/dist/core/tools/registry.js

@@ -141,7 +141,11 @@ export class ToolRegistry {
     get(name) {
         return this.tools.get(name);
     }
-    /** v0.10.0: attach the fail-open lifecycle hook runner (null to disable). */
+    /**
+     * v0.10.0: attach the lifecycle hook runner (null to disable).
+     * v2.16 (t22): the runner's failureMode decides what a THROWING runner
+     * means — fail-closed denies the call, fail-open (default) allows it.
+     */
     setLifecycleHooks(runner) {
         this.lifecycleHooks = runner;
     }
@@ -200,7 +204,10 @@ export class ToolRegistry {
             audit: () => { },
             sessionId: options.sessionId ?? 'default',
         };
-        // v0.10.0: PreToolUse lifecycle hooks — fail-open; deny blocks the tool.
+        // v0.10.0: PreToolUse lifecycle hooks — deny blocks the tool.
+        // v2.16 (t22): a THROWING runner follows the runner's failureMode:
+        // fail-closed ⇒ typedErr deny before execute; fail-open (default) ⇒ log
+        // + allow, exactly as before.
         if (this.lifecycleHooks) {
             try {
                 const pre = await this.lifecycleHooks.runPreToolUse(name, parsed.data, {
@@ -213,7 +220,12 @@ export class ToolRegistry {
                 }
             }
             catch (hookErr) {
-                // Belt-and-suspenders: a throwing runner must never block the tool.
+                if (this.lifecycleHooks.failureMode === 'fail-closed') {
+                    parentSignal?.removeEventListener('abort', onParentAbort);
+                    return typedErr('[hook:unknown] hook-failed');
+                }
+                // Belt-and-suspenders (fail-open): a throwing runner never blocks the tool.
+                console.error(`[hooks] PreToolUse runner threw (fail-open): ${hookErr instanceof Error ? hookErr.message : String(hookErr)}`);
             }
         }
         try {