agy-context-saver 1.4.0 → 1.6.0

package/scripts/execution-guard-hook.mjs

@@ -32,6 +32,7 @@ import os from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
 function respond(obj) {
   process.stdout.write(JSON.stringify(obj) + "\n");
@@ -66,13 +67,11 @@ function getStateFilePath(convId = "global") {
 function getSessionState(convId = "global") {
   const file = getStateFilePath(convId);
   try {
-    if (fs.existsSync(file)) {
-      const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
-      const entry = (parsed && typeof parsed.pollCount === "number") ? parsed : (parsed && parsed[convId]);
-      const now = Date.now();
-      if (entry && typeof entry.lastPollTime === "number" && (now - entry.lastPollTime) < STATE_TTL_MS) {
-        return entry;
-      }
+    const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+    const entry = (parsed && typeof parsed.pollCount === "number") ? parsed : (parsed && parsed[convId]);
+    const now = Date.now();
+    if (entry && typeof entry.lastPollTime === "number" && (now - entry.lastPollTime) < STATE_TTL_MS) {
+      return entry;
     }
   } catch {}
   return { pollCount: 0, denials: 0, taskIds: [], lastPollTime: 0 };
@@ -86,14 +85,12 @@ function saveSessionState(convId = "global", entry) {
     let toWrite;
     if (!convId || convId === "global") {
       let state = {};
-      if (fs.existsSync(file)) {
-        try {
-          const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
-          if (parsed && typeof parsed === "object" && typeof parsed.pollCount !== "number") {
-            state = parsed;
-          }
-        } catch {}
-      }
+      try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        if (parsed && typeof parsed === "object" && typeof parsed.pollCount !== "number") {
+          state = parsed;
+        }
+      } catch {}
       state[convId] = entry;
 
       // Prune stale entries
@@ -123,12 +120,7 @@ function saveSessionState(convId = "global", entry) {
  */
 function isProtectedInternalState(targetPath) {
   if (!targetPath || typeof targetPath !== "string") return false;
-  const normalized = targetPath.replace(/\\/g, "/");
-  return (
-    normalized.includes("/.system_generated/") ||
-    normalized.endsWith("/.system_generated") ||
-    /\.system_generated(?:$|[\/\\])/i.test(normalized)
-  );
+  return /\.system_generated(?:$|[\/\\])/i.test(targetPath);
 }
 
 /**
@@ -189,6 +181,7 @@ function isProtectedBenchmarkPath(targetPath) {
  */
 function isStepSpilloverPath(targetPath) {
   if (!targetPath || typeof targetPath !== "string") return false;
+  if (!isProtectedInternalState(targetPath)) return false; // cheap precheck
   const normalized = targetPath.replace(/\\/g, "/");
   return (
     /\.system_generated[/\\]steps[/\\]\d+[/\\]output\.txt/i.test(normalized) ||
@@ -197,180 +190,149 @@ function isStepSpilloverPath(targetPath) {
 }
 
 /**
- * Extracts task ID from target path or command if targeting a task output log.
+ * Extracts the task-log reference from a target path or command, or null.
+ * Returns { id, token }: `id` is the bare task id; `token` is the matched path text
+ * (relative "tasks/task-1.log" or absolute ".../.system_generated/tasks/task-1.log").
  */
-function getTaskLogMatch(targetPath) {
-  if (!targetPath || typeof targetPath !== "string") return null;
-  const normalized = targetPath.replace(/\\/g, "/");
-  const match = normalized.match(/(?:^|[\s"'/])(?:\.system_generated\/)?tasks\/(?:task-)?([a-zA-Z0-9_-]+)\.log/i);
-  return match ? match[1] : null;
+function getTaskLogMatch(text) {
+  if (!text || typeof text !== "string" || !text.includes(".log")) return null;
+  const normalized = text.replace(/\\/g, "/");
+  if (!normalized.includes("tasks/")) return null;
+  const m = normalized.match(/(?:^|[\s"'])((?:[^\s"']*\/)?tasks\/(?:task-)?([a-zA-Z0-9_-]+)\.log)/i);
+  if (!m) return null;
+  let token = m[1].replace(/^file:\/\//i, "");
+  if (/^\/[A-Za-z]:/.test(token)) token = token.slice(1);
+  return { id: m[2], token };
 }
 
-/**
- * Resolves full path to a task log on disk.
- */
-function resolveTaskLogFile(taskId, convId) {
-  if (taskId && typeof taskId === "string") {
-    if (fs.existsSync(taskId)) {
-      const cleanId = String(taskId).replace(/^.*[\/\\]/, "").replace(/\.log$/i, "");
-      return { logPath: taskId, convId: convId || "global", cleanId };
-    }
-    if (taskId.includes("/") || taskId.includes("\\")) {
-      const cleanId = String(taskId).replace(/^.*[\/\\]/, "").replace(/\.log$/i, "");
-      return { logPath: null, convId: convId || "global", cleanId };
-    }
-  }
+const TASK_TAIL_BYTES = 262144; // transcript tail scanned first (256 KB)
+const TASK_QUIET_MS = 300000;   // log-mtime fallback: quiet for 5 min => treated as finished
 
-  const cleanId = String(taskId).replace(/^.*[\/\\]/, "").replace(/\.log$/i, "");
-  const baseTaskName = cleanId.startsWith("task-") ? cleanId : `task-${cleanId}`;
+function getProfileHomeDir() {
+  return process.env.AGY_TEST_PROFILE_DIR || os.homedir();
+}
 
-  const home = os.homedir();
-  const brainDir = path.join(home, ".gemini", "antigravity", "brain");
+function getBrainDir() {
+  return process.env.AGY_BRAIN_DIR || path.join(getProfileHomeDir(), ".gemini", "antigravity", "brain");
+}
 
-  if (convId && convId !== "global") {
-    const candidate = path.join(brainDir, convId, ".system_generated", "tasks", `${baseTaskName}.log`);
-    if (fs.existsSync(candidate)) {
-      return { logPath: candidate, convId, cleanId: baseTaskName };
-    }
+/** Reads the last `bytes` of a file. Returns { text, whole } or null. */
+function readTail(file, bytes) {
+  let fd;
+  try {
+    fd = fs.openSync(file, "r");
+    const size = fs.fstatSync(fd).size;
+    const len = Math.min(size, bytes);
+    const buf = Buffer.alloc(len);
+    fs.readSync(fd, buf, 0, len, size - len);
+    return { text: buf.toString("utf-8"), whole: len === size };
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch {} }
   }
+}
 
-  return { logPath: null, convId: convId || "global", cleanId: baseTaskName };
+/**
+ * Looks for the finish / start notices of `taskName` in transcript text using literal needles
+ * (JSON-escaped and raw variants). Finish: `<conv>/task-N" finished with result`.
+ * Start: `<conv>/task-N` followed by a newline and "Task Description" or "Task logs".
+ * Returns "COMPLETED", "RUNNING" or null.
+ */
+function scanTaskMarkers(text, taskName) {
+  if (text.includes(`/${taskName}\\" finished`) || text.includes(`/${taskName}" finished`)) return "COMPLETED";
+  if (text.includes(`/${taskName}\\nTask `) || text.includes(`/${taskName}\nTask `)) return "RUNNING";
+  return null;
 }
 
 /**
- * Determines whether a background task is verified completed / terminated.
+ * Resolves a background task's lifecycle state: "RUNNING", "COMPLETED" or "UNKNOWN".
+ * Authority order: transcript notices (tail first, full file only if needed), then log mtime.
  */
-function isTaskCompleted(taskId, convId, rawPath) {
-  const candidatePath = (rawPath && fs.existsSync(rawPath)) ? rawPath : null;
-  const resolved = resolveTaskLogFile(candidatePath || taskId, convId);
-  const logPath = resolved.logPath || candidatePath;
-  const cleanId = resolved.cleanId;
-
-  // 1. Session state check
-  const safeId = String(resolved.convId || convId || "global").replace(/[^a-zA-Z0-9_-]/g, "_");
-  const sessionPath = path.join(os.tmpdir(), `agy-session-${safeId}.json`);
-  if (fs.existsSync(sessionPath)) {
-    try {
-      const sess = JSON.parse(fs.readFileSync(sessionPath, "utf-8"));
-      if (sess && sess.tasks && sess.tasks[cleanId]) {
-        if (sess.tasks[cleanId].state === "TERMINATED" || sess.tasks[cleanId].state === "COMPLETED") return true;
-        if (sess.tasks[cleanId].state === "RUNNING") return false;
-      }
-    } catch {}
+function getTaskState(match, convId) {
+  const taskName = `task-${match.id}`;
+  const token = match.token;
+  let logPath = null;
+  let transcript = null;
+
+  if (/^(?:[A-Za-z]:)?\//.test(token)) {
+    logPath = token;
+    const sysDir = path.posix.dirname(path.posix.dirname(token));
+    if (path.posix.basename(sysDir) === ".system_generated") transcript = `${sysDir}/logs/transcript.jsonl`;
+  }
+  if (convId && convId !== "global") {
+    const sysDir = path.join(getBrainDir(), convId, ".system_generated");
+    logPath = logPath || path.join(sysDir, "tasks", `${taskName}.log`);
+    transcript = transcript || path.join(sysDir, "logs", "transcript.jsonl");
   }
 
-  // 2. Transcript check
-  if (resolved.convId && resolved.convId !== "global") {
-    const home = os.homedir();
-    const candidateTrans = path.join(home, ".gemini", "antigravity", "brain", resolved.convId, ".system_generated", "logs", "transcript.jsonl");
-    if (fs.existsSync(candidateTrans)) {
-      try {
-        const content = fs.readFileSync(candidateTrans, "utf-8");
-        const taskRegex = new RegExp(`Task id [^"]*${cleanId}[^"]* finished`, "i");
-        if (taskRegex.test(content)) return true;
-      } catch {}
+  if (transcript) {
+    const tail = readTail(transcript, TASK_TAIL_BYTES);
+    if (tail) {
+      let state = scanTaskMarkers(tail.text, taskName);
+      if (!state && !tail.whole) {
+        try { state = scanTaskMarkers(fs.readFileSync(transcript, "utf-8"), taskName); } catch {}
+      }
+      if (state) return state;
     }
   }
 
-  // 3. File exists on disk and age check (>15s and not marked live)
-  if (logPath && fs.existsSync(logPath)) {
-    if (cleanId.includes("live") || cleanId.includes("running")) {
-      return false;
-    }
+  if (logPath) {
     try {
-      const stats = fs.statSync(logPath);
-      const mtimeAgeMs = Date.now() - stats.mtimeMs;
-      if (mtimeAgeMs > 15000) {
-        return true;
-      }
+      return (Date.now() - fs.statSync(logPath).mtimeMs) > TASK_QUIET_MS ? "COMPLETED" : "RUNNING";
     } catch {}
   }
+  return "UNKNOWN";
+}
 
-  return false;
+function isCompatibleRtkVersion(versionStr) {
+  if (!versionStr || typeof versionStr !== "string") return false;
+  const match = versionStr.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return false;
+  const major = parseInt(match[1], 10);
+  const minor = parseInt(match[2], 10);
+  return major === 0 && (minor === 50 || minor === 51);
 }
 
-/**
- * Determines whether a background task is actively running.
- */
-function isTaskRunning(taskId, convId, rawPath) {
-  const candidatePath = (rawPath && fs.existsSync(rawPath)) ? rawPath : null;
-  const { logPath: resolvedPath, convId: resolvedConvId, cleanId } = resolveTaskLogFile(candidatePath || taskId, convId);
-  const logPath = resolvedPath || candidatePath;
-
-  // 1. Session state ledger check
-  const safeId = String(resolvedConvId || convId || "global").replace(/[^a-zA-Z0-9_-]/g, "_");
-  const sessionPath = path.join(os.tmpdir(), `agy-session-${safeId}.json`);
-  if (fs.existsSync(sessionPath)) {
-    try {
-      const sess = JSON.parse(fs.readFileSync(sessionPath, "utf-8"));
-      if (sess && sess.tasks && sess.tasks[cleanId]) {
-        if (sess.tasks[cleanId].state === "RUNNING") return true;
-        if (sess.tasks[cleanId].state === "TERMINATED" || sess.tasks[cleanId].state === "COMPLETED") return false;
-      }
-    } catch {}
+function getLocalRtkCandidate() {
+  const names = os.platform() === "win32" ? ["rtk.exe", "rtk.cmd"] : ["rtk"];
+  const hookDir = path.dirname(fileURLToPath(import.meta.url));
+  for (const exeName of names) {
+    const pluginBin = path.join(getProfileHomeDir(), ".gemini", "config", "plugins", "agy-context-saver", "bin", exeName);
+    if (fs.existsSync(pluginBin)) return pluginBin;
   }
+  for (const exeName of names) {
+    const repoBin = path.resolve(hookDir, "..", "bin", exeName);
+    if (fs.existsSync(repoBin)) return repoBin;
+  }
+  return "";
+}
 
-  // 2. Transcript check for completion notice
-  if (resolvedConvId && resolvedConvId !== "global") {
-    const home = os.homedir();
-    const candidateTrans = path.join(home, ".gemini", "antigravity", "brain", resolvedConvId, ".system_generated", "logs", "transcript.jsonl");
-    if (fs.existsSync(candidateTrans)) {
+function findFirstRtkOnPath() {
+  const pathEnv = process.env.PATH || process.env.Path || "";
+  const dirs = pathEnv.split(path.delimiter).filter(Boolean);
+  const exts = os.platform() === "win32" ? [".exe", ".cmd", ".bat"] : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = path.join(dir, `rtk${ext}`);
       try {
-        const content = fs.readFileSync(candidateTrans, "utf-8");
-        const taskRegex = new RegExp(`Task id [^"]*${cleanId}[^"]* finished`, "i");
-        if (taskRegex.test(content)) {
-          return false; // completed!
+        if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
+          return candidate;
         }
       } catch {}
     }
   }
-
-  // 3. File modification age check
-  if (logPath && fs.existsSync(logPath)) {
-    try {
-      const stats = fs.statSync(logPath);
-      const mtimeAgeMs = Date.now() - stats.mtimeMs;
-      if (mtimeAgeMs > 15000) {
-        return false; // Inactive for >15s -> terminated!
-      }
-      return true; // Modified within 15s and not marked finished -> RUNNING!
-    } catch {}
-  }
-
-  // 4. Test environment / naming convention
-  if (cleanId.includes("live") || cleanId.includes("running")) {
-    return true;
-  }
-
-  return false;
+  return "";
 }
 
-
-let resolvedRtkPath = null;
-function getRtkBinary() {
-  if (resolvedRtkPath) return resolvedRtkPath;
-
-  // 1. Try global rtk on PATH
-  try {
-    const check = spawnSync("rtk", ["--version"], { timeout: 1000, windowsHide: true });
-    if (check.status === 0) {
-      resolvedRtkPath = "rtk";
-      return resolvedRtkPath;
-    }
-  } catch {}
-
-  // 2. Try plugin local bin
-  const isWin = os.platform() === "win32";
-  const exeName = isWin ? "rtk.exe" : "rtk";
-  const homeDir = os.homedir();
-  const pluginBin = path.join(homeDir, ".gemini", "config", "plugins", "agy-context-saver", "bin", exeName);
-  if (fs.existsSync(pluginBin)) {
-    resolvedRtkPath = pluginBin;
-    return resolvedRtkPath;
+function spawnRtk(bin, args, opts) {
+  if (!bin) return { error: Object.assign(new Error("ENOENT"), { code: "ENOENT" }), status: null, stdout: "", stderr: "" };
+  if (os.platform() === "win32" && /\.(cmd|bat)$/i.test(bin)) {
+    const quotedBin = /\s/.test(bin) ? `"${bin}"` : bin;
+    const quotedArgs = args.map((a) => (/\s|["&|<>^]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a)).join(" ");
+    return spawnSync("cmd.exe", ["/d", "/s", "/c", `"${quotedBin} ${quotedArgs}"`], { ...opts, windowsVerbatimArguments: true });
   }
-
-  resolvedRtkPath = "rtk";
-  return resolvedRtkPath;
+  return spawnSync(bin, args, opts);
 }
 
 const NON_REWRITABLE_BINARIES = new Set([
@@ -397,31 +359,98 @@ const REWRITE_CACHE_FILE = path.join(os.tmpdir(), "agy-rtk-rewrite-cache.json");
 const REWRITE_CACHE_MAX = 100;
 let inMemoryRewriteCache = null;
 
+function readRewriteCacheFile() {
+  try {
+    const data = JSON.parse(fs.readFileSync(REWRITE_CACHE_FILE, "utf-8"));
+    if (data && typeof data === "object" && !Array.isArray(data)) return data;
+  } catch {}
+  return {};
+}
+
 function loadRewriteCache() {
-  if (inMemoryRewriteCache) return inMemoryRewriteCache;
+  if (!inMemoryRewriteCache) inMemoryRewriteCache = readRewriteCacheFile();
+  return inMemoryRewriteCache;
+}
+
+function resolveCompatibleRtk() {
+  const localCandidate = getLocalRtkCandidate();
+  const pathCandidate = findFirstRtkOnPath();
+  const envSig = `${pathCandidate}::${localCandidate}`;
+  const cache = loadRewriteCache();
+  if (cache.__envSig === envSig && cache.__rtkResolved !== undefined) {
+    return cache.__rtkResolved;
+  }
+
+  for (const k of Object.keys(cache)) delete cache[k];
+
+  const opts = { encoding: "utf-8", timeout: 2000, windowsHide: true };
+  let resolved = null;
+
+  const pathRes = pathCandidate ? spawnRtk(pathCandidate, ["--version"], opts) : { status: 1, stdout: "" };
+  const pathCompatible = !pathRes.error && pathRes.status === 0 && isCompatibleRtkVersion(pathRes.stdout);
+
+  if (pathCompatible) {
+    resolved = { exe: pathCandidate, prefix: "rtk" };
+  } else if (localCandidate) {
+    const localRes = spawnRtk(localCandidate, ["--version"], opts);
+    const localCompatible = !localRes.error && localRes.status === 0 && isCompatibleRtkVersion(localRes.stdout);
+    if (localCompatible) {
+      const normalizedLocal = localCandidate.replace(/\\/g, "/");
+      const prefix = /\s/.test(normalizedLocal) ? `"${normalizedLocal}"` : normalizedLocal;
+      resolved = { exe: localCandidate, prefix };
+    }
+  }
+
+  cache.__envSig = envSig;
+  cache.__rtkResolved = resolved;
   try {
-    if (fs.existsSync(REWRITE_CACHE_FILE)) {
-      const data = JSON.parse(fs.readFileSync(REWRITE_CACHE_FILE, "utf-8"));
-      if (data && typeof data === "object") {
-        inMemoryRewriteCache = data;
-        return inMemoryRewriteCache;
-      }
+    const tmp = `${REWRITE_CACHE_FILE}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(cache), "utf-8");
+    try {
+      fs.renameSync(tmp, REWRITE_CACHE_FILE);
+    } catch {
+      fs.writeFileSync(REWRITE_CACHE_FILE, JSON.stringify(cache), "utf-8");
+      try { fs.unlinkSync(tmp); } catch {}
     }
   } catch {}
-  inMemoryRewriteCache = {};
-  return inMemoryRewriteCache;
+
+  return resolved;
 }
 
-function saveRewriteCache(cache) {
+function runRtkRewrite(cmd, resolvedRtk) {
+  const rtk = resolvedRtk || resolveCompatibleRtk();
+  if (!rtk) return { status: 1, stdout: "", stderr: "No compatible RTK binary available" };
+  const opts = { encoding: "utf-8", timeout: 2000, windowsHide: true };
+  return spawnRtk(rtk.exe, ["rewrite", cmd], opts);
+}
+
+/**
+ * Persists one rewrite result. Re-reads the file first so concurrent hook processes merge instead
+ * of overwriting each other, trims to the newest entries, and writes atomically (temp + rename).
+ */
+function rememberRewrite(cmd, rewritten) {
+  const cache = loadRewriteCache();
+  cache[cmd] = rewritten;
   try {
-    const keys = Object.keys(cache);
-    let toSave = cache;
-    if (keys.length > REWRITE_CACHE_MAX) {
-      const slice = keys.slice(keys.length - REWRITE_CACHE_MAX);
-      toSave = {};
-      for (const k of slice) toSave[k] = cache[k];
-    }
-    fs.writeFileSync(REWRITE_CACHE_FILE, JSON.stringify(toSave), "utf-8");
+    const disk = readRewriteCacheFile();
+    const envSig = cache.__envSig ?? disk.__envSig;
+    const rtkResolved = cache.__rtkResolved ?? disk.__rtkResolved;
+    delete disk.__envSig;
+    delete disk.__rtkResolved;
+    delete disk[cmd];
+    disk[cmd] = rewritten;
+    const keys = Object.keys(disk);
+    for (const k of keys.slice(0, Math.max(0, keys.length - REWRITE_CACHE_MAX))) delete disk[k];
+    if (envSig !== undefined) disk.__envSig = envSig;
+    if (rtkResolved !== undefined) disk.__rtkResolved = rtkResolved;
+    const tmp = `${REWRITE_CACHE_FILE}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(disk), "utf-8");
+    try {
+      fs.renameSync(tmp, REWRITE_CACHE_FILE);
+    } catch {
+      fs.writeFileSync(REWRITE_CACHE_FILE, JSON.stringify(disk), "utf-8");
+      try { fs.unlinkSync(tmp); } catch {}
+    }
   } catch {}
 }
 
@@ -434,7 +463,11 @@ function rewriteCommandWithRtk(rawCmd) {
   if (!trimmed) return rawCmd;
 
   // Already prefixed with rtk
-  if (/^rtk(?:\.exe)?\s+/i.test(trimmed)) {
+  if (/^rtk(?:\.exe)?(?=\s|$)/i.test(trimmed)) {
+    const rtk = resolveCompatibleRtk();
+    if (rtk && rtk.prefix !== "rtk") {
+      return trimmed.replace(/^rtk(?:\.exe)?(?=\s|$)/i, rtk.prefix);
+    }
     return trimmed;
   }
 
@@ -452,7 +485,7 @@ function rewriteCommandWithRtk(rawCmd) {
     return trimmed;
   }
 
-    // Fast-path bypass for shell builtins, non-rewritable binaries, and powershell cmdlets
+  // Fast-path bypass for shell builtins, non-rewritable binaries, and powershell cmdlets
   const firstWord = (trimmed.match(/^[^\s"']+/)?.[0] || "").toLowerCase();
   if (
     NON_REWRITABLE_BINARIES.has(firstWord) ||
@@ -467,6 +500,9 @@ function rewriteCommandWithRtk(rawCmd) {
     return trimmed;
   }
 
+  const rtk = resolveCompatibleRtk();
+  if (!rtk) return trimmed;
+
   // Check persistent cache
   const cache = loadRewriteCache();
   if (cache[trimmed] !== undefined) {
@@ -474,22 +510,23 @@ function rewriteCommandWithRtk(rawCmd) {
   }
 
   let rewritten = trimmed;
+  let cacheable = false;
   try {
-    const rtkBin = getRtkBinary();
-    const res = spawnSync(rtkBin, ["rewrite", trimmed], {
-      encoding: "utf-8",
-      timeout: 2000,
-      windowsHide: true
-    });
+    const res = runRtkRewrite(trimmed, rtk);
+    // Never cache timeouts, spawn errors or signals: a transient failure must not pin a command
+    // to "no rewrite" for the lifetime of the cache.
+    cacheable = !res.error && !res.signal && typeof res.status === "number" && res.status >= 0 && res.status <= 3;
 
     // RTK exits 0 or 3 when rewritten, with new command on stdout
     if ((res.status === 0 || res.status === 3) && res.stdout && res.stdout.trim()) {
       rewritten = res.stdout.trim();
+      if (rtk.prefix !== "rtk") {
+        rewritten = rewritten.replace(/^rtk(?:\.exe)?(?=\s|$)/i, rtk.prefix);
+      }
     }
   } catch {}
 
-  cache[trimmed] = rewritten;
-  saveRewriteCache(cache);
+  if (cacheable) rememberRewrite(trimmed, rewritten);
   return rewritten;
 }
 
@@ -504,6 +541,34 @@ function getRequiredBackoffSeconds(pollCount) {
   return Math.min(600, Math.round(30 * Math.pow(2.5, Math.max(0, pollCount - 1))));
 }
 
+/**
+ * Denies reading the log of an actively RUNNING task: records the denial, trips the circuit
+ * breaker at 5 cumulative denials, otherwise answers with the Proportional Backoff message.
+ */
+function denyRunningTask(taskId, convId) {
+  const session = getSessionState(convId);
+  session.denials++;
+  saveSessionState(convId, session);
+
+  if (session.denials >= 5) {
+    respond({
+      decision: "force_ask",
+      reason: `[CIRCUIT BREAKER ACTIVATED] Autonomous loop suspended: reading task log '${taskId}' attempted prematurely ${session.denials} times during active backoff window. Stop calling tools and yield the turn for native Reactive Wakeup (<SYSTEM_MESSAGE>). User confirmation required to proceed.`
+    });
+  }
+
+  const requiredBackoffSec = Math.max(30, getRequiredBackoffSeconds(session.pollCount));
+  const requiredBackoffMs = requiredBackoffSec * 1000;
+  const elapsedMs = session.lastPollTime ? (Date.now() - session.lastPollTime) : Infinity;
+  const elapsedSec = Math.floor(elapsedMs / 1000);
+  const remainingSec = Math.max(1, Math.ceil((requiredBackoffMs - elapsedMs) / 1000));
+
+  respond({
+    decision: "deny",
+    reason: `Antigravity Execution Governance: Task '${taskId}' is actively RUNNING. Reading task logs in .system_generated during execution is strictly prohibited to prevent polling loops. Diagnostic check #${session.pollCount + 1} requires at least ${requiredBackoffSec}s elapsed (${elapsedSec}s elapsed, ${remainingSec}s remaining). Tasks execute asynchronously and notify you automatically via native Reactive Wakeup (<SYSTEM_MESSAGE>) upon completion. Stop calling tools and yield your turn now.`
+  });
+}
+
 // --- Main Hook Entrypoint ---
 let isGovernedTool = false;
 
@@ -563,71 +628,49 @@ try {
       });
     }
 
-    const rewritten = rewriteCommandWithRtk(rawCmd);
-    const effectiveCmd = rewritten;
+    // Raw-command governance gates are pure string/fs checks: run them BEFORE the rtk rewrite
+    // spawn so denied commands never pay for a subprocess.
+    const isSpillover = isStepSpilloverPath(rawCmd);
+    const taskMatch = isSpillover ? null : getTaskLogMatch(rawCmd);
 
-    // Check 1: Step Output Spillover Safe Harbor (0 New Tools)
-    if (isStepSpilloverPath(rawCmd) || isStepSpilloverPath(effectiveCmd)) {
-      if (/^rtk(?:\.exe)?\s+read\b/i.test(effectiveCmd)) {
-        // Safe harbor: rtk read already provides line clamping and token windowing
-      } else {
-        respond({
-          decision: "deny",
-          reason:
-            "Antigravity Execution Governance: Runtime step output spillover files must be inspected using 'rtk read <path>' via run_command to prevent context blowouts."
-        });
-      }
-    } else {
-      // Check 2: Task Log Inspection (Lifecycle-Gated, 0 New Tools)
-      const taskLogId = getTaskLogMatch(rawCmd) || getTaskLogMatch(effectiveCmd);
-      if (taskLogId) {
-        if (isTaskRunning(taskLogId, convId, rawCmd)) {
-          // Task actively running: Deny with Proportional Backoff
-          const session = getSessionState(convId);
-          session.denials++;
-          saveSessionState(convId, session);
-
-          if (session.denials >= 5) {
-            respond({
-              decision: "force_ask",
-              reason: `[CIRCUIT BREAKER ACTIVATED] Autonomous loop suspended: reading task log '${taskLogId}' attempted prematurely ${session.denials} times during active backoff window. Stop calling tools and yield the turn for native Reactive Wakeup (<SYSTEM_MESSAGE>). User confirmation required to proceed.`
-            });
-          }
+    // Check 1: Other protected internal state (transcripts, scheduler, progress)
+    if (!isSpillover && !taskMatch && isProtectedInternalState(rawCmd)) {
+      respond({
+        decision: "deny",
+        reason:
+          "Antigravity Execution Governance: Direct shell access to internal Antigravity execution state (.system_generated) is strictly prohibited to prevent transcript bloat and polling loops.\n" +
+          "- To inspect conversation transcripts: Call MCP tool read_transcript(conversationId=\"...\", mode=\"compact\") or query_transcript(...).\n" +
+          "- To inspect background tasks: Yield execution turn and rely on native Reactive Wakeup (<SYSTEM_MESSAGE>). Do not read internal task logs."
+      });
+    }
 
-          const requiredBackoffSec = Math.max(30, getRequiredBackoffSeconds(session.pollCount));
-          const requiredBackoffMs = requiredBackoffSec * 1000;
-          const elapsedMs = session.lastPollTime ? (Date.now() - session.lastPollTime) : Infinity;
-          const elapsedSec = Math.floor(elapsedMs / 1000);
-          const remainingSec = Math.max(1, Math.ceil((requiredBackoffMs - elapsedMs) / 1000));
+    // Check 2: Task Log Inspection (Lifecycle-Gated, 0 New Tools): RUNNING => Proportional Backoff
+    if (taskMatch && getTaskState(taskMatch, convId) === "RUNNING") {
+      denyRunningTask(taskMatch.id, convId);
+    }
 
-          respond({
-            decision: "deny",
-            reason: `Antigravity Execution Governance: Task '${taskLogId}' is actively RUNNING. Reading task logs in .system_generated during execution is strictly prohibited to prevent polling loops. Diagnostic check #${session.pollCount + 1} requires at least ${requiredBackoffSec}s elapsed (${elapsedSec}s elapsed, ${remainingSec}s remaining). Tasks execute asynchronously and notify you automatically via native Reactive Wakeup (<SYSTEM_MESSAGE>) upon completion. Stop calling tools and yield your turn now.`
-          });
-        }
+    const rewritten = rewriteCommandWithRtk(rawCmd);
+    const effectiveCmd = rewritten;
+    const isRtkRead = /^(?:["']?[^\s"']*[/\\])?rtk(?:\.exe|\.cmd|\.bat)?["']?\s+read\b/i.test(effectiveCmd);
 
-        // Task is TERMINATED / COMPLETED: allow rtk read
-        if (/^rtk(?:\.exe)?\s+read\b/i.test(effectiveCmd)) {
-          // Allowed under lifecycle governance
-        } else {
-          respond({
-            decision: "deny",
-            reason:
-              "Antigravity Execution Governance: Direct shell access to internal Antigravity execution state (.system_generated) is strictly prohibited to prevent transcript bloat and polling loops.\n" +
-              `- Once completed, inspect output using 'rtk read <path>' via run_command.\n` +
-              "- If actively running, yield execution turn and rely on native Reactive Wakeup (<SYSTEM_MESSAGE>)."
-          });
-        }
-      } else if (isProtectedInternalState(rawCmd) || isProtectedInternalState(effectiveCmd)) {
-        // Check 3: Other protected internal state (transcripts, scheduler, progress)
-        respond({
-          decision: "deny",
-          reason:
-            "Antigravity Execution Governance: Direct shell access to internal Antigravity execution state (.system_generated) is strictly prohibited to prevent transcript bloat and polling loops.\n" +
-            "- To inspect conversation transcripts: Call MCP tool read_transcript(conversationId=\"...\", mode=\"compact\") or query_transcript(...).\n" +
-            "- To inspect background tasks: Yield execution turn and rely on native Reactive Wakeup (<SYSTEM_MESSAGE>). Do not read internal task logs."
-        });
-      }
+    // Check 3: Step Output Spillover Safe Harbor (rtk read only; it clamps + windows output)
+    if (isSpillover && !isRtkRead) {
+      respond({
+        decision: "deny",
+        reason:
+          "Antigravity Execution Governance: Runtime step output spillover files must be inspected using 'rtk read <path>' via run_command to prevent context blowouts."
+      });
+    }
+
+    // Check 4: Terminated / unknown-state task log: allow only through rtk read
+    if (taskMatch && !isRtkRead) {
+      respond({
+        decision: "deny",
+        reason:
+          "Antigravity Execution Governance: Direct shell access to internal Antigravity execution state (.system_generated) is strictly prohibited to prevent transcript bloat and polling loops.\n" +
+          `- Once completed, inspect output using 'rtk read <path>' via run_command.\n` +
+          "- If actively running, yield execution turn and rely on native Reactive Wakeup (<SYSTEM_MESSAGE>)."
+      });
     }
 
     const isDaemon = args.IsDaemon === true || args.isDaemon === true;
@@ -682,33 +725,14 @@ try {
     }
 
     // 2b. Task Log Inspection (Lifecycle-Gated)
-    const taskLogId = getTaskLogMatch(target);
-    if (taskLogId) {
-      if (isTaskRunning(taskLogId, convId, target)) {
-        const session = getSessionState(convId);
-        session.denials++;
-        saveSessionState(convId, session);
-
-        if (session.denials >= 5) {
-          respond({
-            decision: "force_ask",
-            reason: `[CIRCUIT BREAKER ACTIVATED] Autonomous loop suspended: reading task log '${taskLogId}' attempted prematurely ${session.denials} times during active backoff window. Stop calling tools and yield the turn for native Reactive Wakeup (<SYSTEM_MESSAGE>). User confirmation required to proceed.`
-          });
-        }
-
-        const requiredBackoffSec = Math.max(30, getRequiredBackoffSeconds(session.pollCount));
-        const requiredBackoffMs = requiredBackoffSec * 1000;
-        const elapsedMs = session.lastPollTime ? (Date.now() - session.lastPollTime) : Infinity;
-        const elapsedSec = Math.floor(elapsedMs / 1000);
-        const remainingSec = Math.max(1, Math.ceil((requiredBackoffMs - elapsedMs) / 1000));
-
-        respond({
-          decision: "deny",
-          reason: `Antigravity Execution Governance: Task '${taskLogId}' is actively RUNNING. Reading task logs in .system_generated during execution is strictly prohibited to prevent polling loops. Diagnostic check #${session.pollCount + 1} requires at least ${requiredBackoffSec}s elapsed (${elapsedSec}s elapsed, ${remainingSec}s remaining). Tasks execute asynchronously and notify you automatically via native Reactive Wakeup (<SYSTEM_MESSAGE>) upon completion. Stop calling tools and yield your turn now.`
-        });
+    const taskMatch = getTaskLogMatch(target);
+    if (taskMatch) {
+      const state = getTaskState(taskMatch, convId);
+      if (state === "RUNNING") {
+        denyRunningTask(taskMatch.id, convId);
       }
 
-      if (isTaskCompleted(taskLogId, convId, target)) {
+      if (state === "COMPLETED") {
         // If terminated / completed, route to rtk read:
         respond({
           decision: "deny",
@@ -740,14 +764,57 @@ try {
       respond({ decision: "allow" });
     }
 
-    // 2c. Hard-Route Workspace Code/Data Inspection to Canonical RTK Commands (LH-07)
-    if (toolName === "view_file" || toolName === "read_file") {
+    // 2e. Bounded Slice Safe Harbor for view_file
+    // Allow view_file IF AND ONLY IF it is a bounded slice inspection (StartLine and EndLine <= 150 lines)
+    if (toolName === "view_file") {
+      const rawStart = args.StartLine !== undefined ? args.StartLine : args.start_line;
+      const rawEnd = args.EndLine !== undefined ? args.EndLine : args.end_line;
+      const hasSliceParams = typeof rawStart !== "undefined" || typeof rawEnd !== "undefined";
+
+      if (hasSliceParams) {
+        const startLine = Number(rawStart);
+        const endLine = Number(rawEnd);
+
+        if (
+          typeof rawStart !== "undefined" &&
+          typeof rawEnd !== "undefined" &&
+          Number.isInteger(startLine) &&
+          Number.isInteger(endLine) &&
+          startLine > 0 &&
+          endLine >= startLine
+        ) {
+          const span = endLine - startLine + 1;
+          const MAX_SAFE_SLICE_LINES = 150;
+          if (span <= MAX_SAFE_SLICE_LINES) {
+            respond({ decision: "allow" });
+          }
+          respond({
+            decision: "deny",
+            reason: `Antigravity Governance: Oversized file slice via 'view_file' (${span} lines > ${MAX_SAFE_SLICE_LINES} lines max safe window). Reduce line range or run 'rtk read ${target || "<file>"}' via run_command instead.`
+          });
+        }
+
+        respond({
+          decision: "deny",
+          reason: `Antigravity Governance: Invalid slice range via 'view_file'. Ensure StartLine and EndLine are positive integers with EndLine >= StartLine (max 150 lines), or run 'rtk read ${target || "<file>"}' via run_command instead.`
+        });
+      }
+
+      // Default when no slice attempted: keep hook identical to original behavior (zero slice advertisement)
       respond({
         decision: "deny",
         reason: `Antigravity Governance: Native file inspection via '${toolName}' bypasses token optimization. Run 'rtk read ${target || "<file>"}' via run_command instead.`
       });
     }
 
+    // 2f. Hard-Route Full-File / Other Workspace Code Inspection to Canonical RTK Commands (LH-07)
+    if (toolName === "read_file") {
+      respond({
+        decision: "deny",
+        reason: `Antigravity Governance: Native file inspection via 'read_file' bypasses token optimization. Run 'rtk read ${target || "<file>"}' via run_command instead.`
+      });
+    }
+
     if (toolName === "read_many_files") {
       respond({
         decision: "deny",
@@ -791,8 +858,8 @@ try {
   if (toolName === "manage_task") {
     const action = String(args.Action || args.action || "").replace(/^["']|["']$/g, "").trim().toLowerCase();
 
-    // kill, send_input are always allowed immediately
-    if (action !== "status" && action !== "list") {
+    // kill, send_input, and list are always allowed immediately
+    if (action !== "status") {
       respond({ decision: "allow" });
     }