arkgate 4.8.23 → 4.8.24

package/bin/lib/enforcement-profiles.mjs

@@ -10,6 +10,35 @@ import {
   HOST_SUPPORT_MATRIX,
 } from './host-support-matrix.mjs';
 import { KNOWN_TOOLS, normalizeToolsList } from './skill-install.mjs';
+import {
+  antigravityHooks,
+  claudeSettings,
+  codexHooks,
+  cursorHooks,
+  mergeAntigravityArkHook,
+  mergeClaudeStyleArkHooks,
+  mergeCursorArkHook,
+} from './hook-templates.mjs';
+
+/** Hosts whose hook file the installer merges (keeping user keys) instead of replacing. */
+const MERGEABLE_HOOK_FILES = {
+  claude: [claudeSettings, mergeClaudeStyleArkHooks],
+  codex: [codexHooks, mergeClaudeStyleArkHooks],
+  cursor: [cursorHooks, mergeCursorArkHook],
+  antigravity: [antigravityHooks, mergeAntigravityArkHook],
+};
+
+/** True when install will upsert Ark's hook into the existing host file without --force. */
+export function hostHookFileMergeable(root, host, hookFile) {
+  const entry = MERGEABLE_HOOK_FILES[host];
+  if (!entry) return false;
+  try {
+    const [template, merge] = entry;
+    return merge(fs.readFileSync(hookFile, 'utf8'), template(root)) != null;
+  } catch {
+    return false;
+  }
+}
 
 export const HOST_ENFORCEMENT_SUPPORT = Object.freeze(
   Object.fromEntries(
@@ -79,12 +108,19 @@ export function validateHardWriteRequest({ root, host, tools, force = false }) {
   }
 
   const hookFile = path.join(root, support.hookPath);
-  if (fs.existsSync(hookFile) && !force && !hasHardWriteHook(root, normalizedHost)) {
+  if (
+    fs.existsSync(hookFile) &&
+    !force &&
+    !hasHardWriteHook(root, normalizedHost) &&
+    !hostHookFileMergeable(root, normalizedHost, hookFile)
+  ) {
     return {
       ok: false,
-      error:
-        `${support.hookPath} already exists without an Ark hard-write hook and would be preserved. ` +
-        'Use --force to replace that host file, or omit --require-write-hook for merge-only enforcement.',
+      error: MERGEABLE_HOOK_FILES[normalizedHost]
+        ? `${support.hookPath} already exists but is not a JSON object Ark can merge into, so it would be preserved. ` +
+          'Fix that file (or use --force to replace it), or omit --require-write-hook for merge-only enforcement.'
+        : `${support.hookPath} already exists without an Ark hard-write hook and would be preserved. ` +
+          'Use --force to replace that host file, or omit --require-write-hook for merge-only enforcement.',
     };
   }
 

package/bin/lib/first-run-help.mjs

@@ -3,6 +3,7 @@
  */
 
 import { NORTH_STAR_ONE_LINE } from './product-copy.mjs';
+import { KNOWN_TOOLS } from './skill-install.mjs';
 
 export function setupUsage() {
   return `arkgate (alias ark) — Write. Check. Ship.
@@ -96,8 +97,8 @@ Options:
                Valid ids: crud-product, api-backend, frontend-surface, library-sdk, cli-utility,
                worker-pipeline, event-coordinator, integration-bridge, multi-app-workspace, prototype-spike,
                vertical-slice-product, ddd-bounded-contexts.
-  --tools      One active agent host for start (claude,cursor,codex,grok,antigravity,windsurf,cline,copilot,kiro,roo,continue,gemini).
-               Omit to use the active host; an unknown host creates only the shared compact router.
+  --tools      One active agent host for start (${KNOWN_TOOLS.join(',')}).
+               Omit to use the active host; a list or an unknown host is rejected (exit 2).
   --remove-host <host>
                Preview or apply removal of that compact host integration; re-add it with --tools <host>.
   --require-write-hook <host>

package/bin/lib/flat-parent-importers.mjs

@@ -0,0 +1,137 @@
+/**
+ * Importer graph for the flat-parent doctor suggestion.
+ *
+ * Prefers the resolved dependency facts ark-check already built (tsconfig
+ * paths included). Without facts it scans the text and resolves relative
+ * specifiers plus tsconfig path aliases, so an `@/…` importer is never
+ * invisible. Advisory input only.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { readTsconfigAliases, resolveSpecifierToRel } from './import-resolve.mjs';
+
+const SPEC_MARKS = [' from "', " from '", ' from `', 'require("', "require('", 'import("', "import('"];
+const EXT = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
+
+function withoutComments(text) {
+  let out = '';
+  let i = 0;
+  while (i < text.length) {
+    const c = text[i];
+    const n = text[i + 1];
+    if (c === '/' && n === '/') {
+      while (i < text.length && text[i] !== '\n') i += 1;
+      continue;
+    }
+    if (c === '/' && n === '*') {
+      i += 2;
+      while (i + 1 < text.length && !(text[i] === '*' && text[i + 1] === '/')) i += 1;
+      i = Math.min(text.length, i + 2);
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+
+/** Every string module specifier in `text` (relative and bare). */
+export function moduleSpecifiers(text) {
+  const specs = [];
+  const source = withoutComments(String(text));
+  let i = 0;
+  while (i < source.length) {
+    let at = -1;
+    let mark = '';
+    for (const candidate of SPEC_MARKS) {
+      const found = source.indexOf(candidate, i);
+      if (found !== -1 && (at === -1 || found < at)) {
+        at = found;
+        mark = candidate;
+      }
+    }
+    if (at === -1) break;
+    const quote = mark[mark.length - 1];
+    const start = at + mark.length;
+    const end = source.indexOf(quote, start);
+    if (end === -1) break;
+    const spec = source.slice(start, end);
+    if (spec.length > 0) specs.push(spec);
+    i = end + 1;
+  }
+  return specs;
+}
+
+function resolveRelative(fromFile, spec) {
+  const base = fromFile.split('/');
+  base.pop();
+  for (const part of spec.split('/')) {
+    if (part === '' || part === '.') continue;
+    if (part === '..') {
+      if (base.length === 0) return null;
+      base.pop();
+      continue;
+    }
+    base.push(part);
+  }
+  return base.join('/');
+}
+
+function probe(joined, fileSet) {
+  if (!joined) return null;
+  const names = [joined];
+  for (const ext of EXT) names.push(`${joined}${ext}`, `${joined}/index${ext}`);
+  const stem = joined.replace(/\.(?:m|c)?js$/, '');
+  if (stem !== joined) for (const ext of EXT) names.push(`${stem}${ext}`);
+  for (const name of names) {
+    if (fileSet.has(name)) return name;
+  }
+  return null;
+}
+
+function readText(root, rel) {
+  try {
+    return fs.readFileSync(path.join(root, rel), 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function addEdge(graph, target, importer) {
+  let set = graph.get(target);
+  if (!set) {
+    set = new Set();
+    graph.set(target, set);
+  }
+  set.add(importer);
+}
+
+/**
+ * target file → every file that imports it (value and type-only edges; a
+ * peerIsolation wall judges both).
+ * @param {{ root: string, files: string[], facts?: object, ts?: object }} input
+ */
+export function flatParentImporterGraph({ root, files, facts, ts }) {
+  const graph = new Map();
+  const fileSet = new Set(files);
+  const dependencies = Array.isArray(facts?.dependencies) ? facts.dependencies : null;
+  if (dependencies && dependencies.length > 0) {
+    for (const dep of dependencies) {
+      if (dep?.resolution !== 'resolved-project' || typeof dep.target !== 'string') continue;
+      if (typeof dep.from !== 'string' || dep.from === dep.target) continue;
+      addEdge(graph, dep.target, dep.from);
+    }
+    return graph;
+  }
+  const aliases = readTsconfigAliases(ts, root);
+  for (const file of files) {
+    for (const spec of moduleSpecifiers(readText(root, file))) {
+      const joined = spec.startsWith('.')
+        ? resolveRelative(file, spec)
+        : resolveSpecifierToRel(spec, file, root, aliases);
+      const target = probe(joined, fileSet);
+      if (target && target !== file) addEdge(graph, target, file);
+    }
+  }
+  return graph;
+}

package/bin/lib/flat-parent-pilot.mjs

@@ -2,18 +2,15 @@
  * Doctor suggestion: a universe-level flat file that one child slice imports.
  * Advisory only. Not a finding, not a verdict, not a config field.
  */
-import fs from 'node:fs';
-import path from 'node:path';
 import {
+  findDeniedEdgeDecision,
   layerForRelativePath,
   resolveGovernedSlice,
   sliceAliasDestination,
   sliceIdForPath,
 } from '../ark-layer-match.mjs';
 import { destinationKeepsLayerAndSlice } from './physical-cohesion.mjs';
-
-const SPEC_MARKS = [' from "', " from '", ' from `', 'require("', "require('", 'import("', "import('"];
-const EXT = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
+import { flatParentImporterGraph } from './flat-parent-importers.mjs';
 
 function ruleKey(rule) {
   const child = rule?.childSlices;
@@ -45,102 +42,41 @@ function isFlatParent(rel, rule) {
   return Boolean(universe && raw && raw.toLowerCase() === universe.toLowerCase());
 }
 
-function withoutComments(text) {
-  let out = '';
-  let i = 0;
-  while (i < text.length) {
-    const c = text[i];
-    const n = text[i + 1];
-    if (c === '/' && n === '/') {
-      while (i < text.length && text[i] !== '\n') i += 1;
-      continue;
-    }
-    if (c === '/' && n === '*') {
-      i += 2;
-      while (i + 1 < text.length && !(text[i] === '*' && text[i + 1] === '/')) i += 1;
-      i = Math.min(text.length, i + 2);
-      continue;
+/**
+ * Importers of each flat file, split by child. A file any non-child imports
+ * (universe common, a shared root, another universe, another layer) is marked:
+ * moving it into one child would turn that edge into a wall deny.
+ */
+function childImporters(flatFiles, graph, rule) {
+  const out = new Map();
+  for (const target of flatFiles) {
+    const universe = resolveGovernedSlice(target, rule).universeId ?? '';
+    const ids = new Set();
+    let nonChild = false;
+    for (const importer of graph.get(target) ?? []) {
+      const place = resolveGovernedSlice(importer, rule);
+      if (!place.childId || (place.universeId ?? '') !== universe) nonChild = true;
+      else ids.add(place.childId);
     }
-    out += c;
-    i += 1;
+    out.set(target, { ids, nonChild, importers: [...(graph.get(target) ?? [])] });
   }
   return out;
 }
 
-function relativeSpecifiers(text) {
-  const specs = [];
-  const source = withoutComments(String(text));
-  let i = 0;
-  while (i < source.length) {
-    let at = -1;
-    let mark = '';
-    for (const candidate of SPEC_MARKS) {
-      const found = source.indexOf(candidate, i);
-      if (found !== -1 && (at === -1 || found < at)) {
-        at = found;
-        mark = candidate;
-      }
-    }
-    if (at === -1) break;
-    const quote = mark[mark.length - 1];
-    const start = at + mark.length;
-    const end = source.indexOf(quote, start);
-    if (end === -1) break;
-    const spec = source.slice(start, end);
-    if (spec.startsWith('.')) specs.push(spec);
-    i = end + 1;
-  }
-  return specs;
-}
-
-function resolveRelative(fromFile, spec, fileSet) {
-  const base = fromFile.split('/');
-  base.pop();
-  for (const part of spec.split('/')) {
-    if (part === '' || part === '.') continue;
-    if (part === '..') {
-      if (base.length === 0) return null;
-      base.pop();
-      continue;
-    }
-    base.push(part);
-  }
-  const joined = base.join('/');
-  const names = [joined];
-  for (const ext of EXT) names.push(`${joined}${ext}`, `${joined}/index${ext}`);
-  for (const name of names) {
-    if (fileSet.has(name)) return name;
-  }
-  return null;
-}
-
-function readText(root, rel) {
-  try {
-    return fs.readFileSync(path.join(root, rel), 'utf8');
-  } catch {
-    return '';
-  }
-}
-
-function childImporters(flatFiles, files, rule, root) {
-  const flat = new Set(flatFiles);
-  const known = new Set(files);
-  const importers = new Map();
-  for (const file of files) {
-    const place = resolveGovernedSlice(file, rule);
-    if (!place.childId) continue;
-    for (const spec of relativeSpecifiers(readText(root, file))) {
-      const target = resolveRelative(file, spec, known);
-      if (!target || !flat.has(target) || target === file) continue;
-      let ids = importers.get(target);
-      if (!ids) {
-        ids = new Set();
-        importers.set(target, ids);
-      }
-      ids.add(place.childId);
-    }
+/** Would any recorded importer be denied by the rules after the move? */
+function moveBreaksWall(importers, destFile, rules, layers) {
+  const toLayer = layerForRelativePath(destFile, layers);
+  for (const importer of importers) {
+    const fromLayer = layerForRelativePath(importer, layers);
+    if (!fromLayer || !toLayer) return true;
+    const denied = findDeniedEdgeDecision(rules, fromLayer, toLayer, {
+      fromPath: importer,
+      toPath: destFile,
+      layers,
+    });
+    if (denied) return true;
   }
-  return importers;
+  return false;
 }
 
 function basename(rel) {
@@ -149,7 +85,7 @@ function basename(rel) {
 }
 
 /**
- * @param {{ root: string, files: string[], rules: object[] | undefined, layers: object[] | undefined }} input
+ * @param {{ root: string, files: string[], rules: object[] | undefined, layers: object[] | undefined, facts?: object, ts?: object }} input
  * @returns {object | null}
  */
 export function collectFlatParentPilot(input) {
@@ -161,15 +97,18 @@ export function collectFlatParentPilot(input) {
   const layers = input.layers;
   const moves = [];
   const seen = new Set();
+  let graph = null;
   for (const rule of rules) {
     const flat = files.filter((file) => isFlatParent(file, rule));
     if (flat.length === 0) continue;
-    const importers = childImporters(flat, files, rule, input.root);
+    graph ??= flatParentImporterGraph({ root: input.root, files, facts: input.facts, ts: input.ts });
+    const importers = childImporters(flat, graph, rule);
     for (const file of flat) {
       if (seen.has(file)) continue;
-      const ids = importers.get(file);
-      if (!ids || ids.size !== 1) continue;
-      const importer = [...ids][0];
+      const entry = importers.get(file);
+      // Exactly one child and nobody else: two children, or any non-child importer, keeps it in place.
+      if (!entry || entry.nonChild || entry.ids.size !== 1) continue;
+      const importer = [...entry.ids][0];
       const destination = sliceAliasDestination(file, importer, rule.childSlices);
       if (!destination) continue;
       const destFile = `${destination}/${basename(file)}`;
@@ -177,6 +116,7 @@ export function collectFlatParentPilot(input) {
       if (!layer || layer !== layerForRelativePath(destFile, layers)) continue;
       const toPlace = resolveGovernedSlice(destFile, rule);
       if ((toPlace.childId ?? '') !== importer) continue;
+      if (moveBreaksWall(entry.importers, destFile, input.rules, layers)) continue;
       const fromPlace = resolveGovernedSlice(file, rule);
       const keepsSlice = destinationKeepsLayerAndSlice(file, destFile, layers, [rule]);
       const wallSame =

package/bin/lib/gate-files.mjs

@@ -3,9 +3,11 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { codexProjectMcpIsValid } from './codex-home.mjs';
 import { enforcingArkRunText, runsArkCheck } from './github-enforcement.mjs';
+import { npxArkgatePrefixLength } from './package-manager.mjs';
 
 export const __packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 export const __arkCheckCli = path.join(__packageRoot, 'bin', 'ark-check.mjs');
@@ -86,10 +88,27 @@ export function treeHasTypecheckScript(root) {
  * @param {{ write?: boolean }} [opts]
  * @returns {{
  *   changed: boolean,
- *   reason: 'added' | 'already' | 'no-tsconfig' | 'no-package-json',
+ *   reason: 'added' | 'already' | 'no-tsconfig' | 'no-package-json' | 'no-typescript',
  *   script?: string,
  * }}
  */
+/**
+ * True when `typescript` is declared by the project (deps/devDeps/peerDeps) or resolves
+ * from its root (e.g. hoisted in a workspace), so a generated `tsc --noEmit` can run.
+ */
+export function projectHasTypeScript(root, pkg = readPackageJson(root) || {}) {
+  for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+    const deps = pkg?.[field];
+    if (deps && typeof deps === 'object' && Object.hasOwn(deps, 'typescript')) return true;
+  }
+  try {
+    createRequire(path.join(root, 'package.json')).resolve('typescript/package.json');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function ensureTypecheckScript(root, opts = {}) {
   const write = opts.write !== false;
   const hasTsconfig =
@@ -105,6 +124,8 @@ export function ensureTypecheckScript(root, opts = {}) {
   }
 
   const pkg = readPackageJson(root) || {};
+  // `tsc` only exists when typescript resolves — otherwise CI fails with `tsc: not found`.
+  if (!projectHasTypeScript(root, pkg)) return { changed: false, reason: 'no-typescript' };
   const scripts =
     pkg.scripts && typeof pkg.scripts === 'object' ? { ...pkg.scripts } : {};
   const script = 'tsc --noEmit';
@@ -194,7 +215,10 @@ function arkMcpArgs(server) {
   const isArkBin = (value) => /^(?:arkgate-mcp|ark-mcp)(?:\.mjs)?$/.test(executableName(value));
   if ([server.command, ...args].filter(isArkBin).length !== 1) return null;
   if (isArkBin(server.command)) return args;
-  if ((command === 'npx' || command === 'yarn') && isArkBin(args[0])) return args.slice(1);
+  const npxPrefix = command === 'npx' ? npxArkgatePrefixLength(args) : 0;
+  if ((command === 'npx' || command === 'yarn') && isArkBin(args[npxPrefix])) {
+    return args.slice(npxPrefix + 1);
+  }
   if (command === 'pnpm') {
     const binIndex =
       args[0] === 'exec'
@@ -285,6 +309,9 @@ export function hasArkMcpRegistration(root, relativePath = '.mcp.json') {
  */
 export const MCP_JSON_GATE_FILES = ['.mcp.json', '.cursor/mcp.json', '.agents/mcp_config.json'];
 
+/** Claude-style hook files: Ark SessionStart/PreToolUse groups are merged, never whole-file replaced. */
+export const CLAUDE_STYLE_HOOK_FILES = ['.claude/settings.json', '.codex/hooks.json'];
+
 /**
  * Upsert mcpServers.ark into an existing MCP JSON document.
  * Preserves sibling servers and unknown top-level keys. Returns null if unreadable.

package/bin/lib/git-change-scope.mjs

@@ -0,0 +1,109 @@
+/**
+ * Git plumbing for diff-scoped checks (`--changed`, `--local`, `--against`, `--persona`).
+ *
+ * Every path this module returns or reads is relative to the Ark ROOT (the `-C` directory),
+ * never to the repository top level, so a package inside a monorepo sees its own files:
+ *   - `git diff --relative` strips the package prefix and drops paths outside the root;
+ *   - `git ls-files --others` is already cwd-relative;
+ *   - `<ref>:./<path>` makes `git show` resolve from the root instead of the top level.
+ * Output is NUL-separated (`-z`) so core.quotePath never C-quotes a non-ASCII name.
+ * Every listing is checked: a failed or truncated call is an error, never an empty diff.
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+
+/** Kill hung git instead of stalling CI. */
+export const SPAWN_TIMEOUT_MS = 8000;
+/** Same ceiling as design-delta: a large untracked tree must not overflow the default 1 MiB. */
+export const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+
+/** Refs tried, in order, when no `--base` / `--against` is given. */
+export const TEAM_BASE_CANDIDATES = Object.freeze([
+  'origin/dev',
+  'origin/main',
+  'origin/master',
+  'dev',
+  'main',
+  'master',
+]);
+
+export function runGit(cwd, args) {
+  return spawnSync('git', ['-C', cwd, '-c', 'core.quotePath=false', ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: SPAWN_TIMEOUT_MS,
+    maxBuffer: GIT_MAX_BUFFER,
+  });
+}
+
+export function safeGitRef(value) {
+  return (
+    typeof value === 'string' &&
+    /^[A-Za-z0-9][A-Za-z0-9._/-]{0,200}$/.test(value) &&
+    !value.includes('..')
+  );
+}
+
+export function discoverTeamBaseRef(root, preferred) {
+  if (safeGitRef(preferred)) return preferred;
+  for (const candidate of TEAM_BASE_CANDIDATES) {
+    const exists = runGit(root, ['rev-parse', '--verify', `${candidate}^{commit}`]);
+    if (exists.status === 0) return candidate;
+  }
+  return null;
+}
+
+function gitFailure(label, result) {
+  if (result.error) return `git ${label} failed: ${result.error.code || result.error.message}`;
+  if (result.status !== 0) {
+    const detail = String(result.stderr || '').trim();
+    return `git ${label} failed${detail ? `: ${detail}` : ` (status ${result.status})`}`;
+  }
+  return null;
+}
+
+/**
+ * Root-relative paths changed vs `baseRef` (committed since the merge base, staged,
+ * unstaged, untracked). Fails closed: any git failure returns `ok: false`.
+ */
+export function listChangedPaths(root, baseRef) {
+  if (!safeGitRef(baseRef)) {
+    return { ok: false, paths: [], error: 'Invalid or missing git base ref.' };
+  }
+  const verify = runGit(root, ['rev-parse', '--verify', `${baseRef}^{commit}`]);
+  if (verify.status !== 0) {
+    return { ok: false, paths: [], error: `Cannot resolve git ref ${baseRef}.` };
+  }
+  const calls = [
+    [`diff ${baseRef}...HEAD`, ['diff', '--relative', '--name-only', '-z', `${baseRef}...HEAD`]],
+    ['diff (unstaged)', ['diff', '--relative', '--name-only', '-z']],
+    ['diff --cached', ['diff', '--relative', '--name-only', '-z', '--cached']],
+    ['ls-files --others', ['ls-files', '-z', '--others', '--exclude-standard']],
+  ];
+  const paths = [];
+  for (const [label, gitArgs] of calls) {
+    const result = runGit(root, gitArgs);
+    const failure = gitFailure(label, result);
+    if (failure) return { ok: false, paths: [], error: failure };
+    paths.push(...String(result.stdout).split('\0'));
+  }
+  return { ok: true, paths: [...new Set(paths.filter(Boolean))].sort(), error: null };
+}
+
+/** Root-relative form of `relPath` for a `<ref>:./<path>` spec; null when outside the root. */
+export function rootRelativeGitPath(root, relPath) {
+  if (typeof relPath !== 'string' || !relPath) return null;
+  const rel = path.isAbsolute(relPath) ? path.relative(path.resolve(root), relPath) : relPath;
+  const normalized = path.posix.normalize(rel.split(path.sep).join('/'));
+  if (!normalized || normalized === '.' || normalized === '..' || normalized.startsWith('../')) return null;
+  return normalized.replace(/^\.\//, '');
+}
+
+/** File text at `baseRef`, resolved relative to the Ark root (not the repo top level). */
+export function gitShowText(root, baseRef, relPath) {
+  const rel = rootRelativeGitPath(root, relPath);
+  if (!safeGitRef(baseRef) || !rel) return null;
+  const shown = runGit(root, ['show', `${baseRef}:./${rel}`]);
+  if (shown.error || shown.status !== 0) return null;
+  return shown.stdout;
+}

package/bin/lib/github-enforcement.mjs

@@ -22,7 +22,7 @@ const SAFE_IF = /^(?:['"]?true['"]?|['"]?\$\{\{\s*(?:true|always\(\))\s*\}\}['"]
 const SAFE_NEEDS_IF = /^['"]?\$\{\{\s*always\(\)\s*\}\}['"]?$/i;
 const SAFE_CONTINUE = /^['"]?false['"]?$/i;
 const ENV_PREFIX = /^(?:(?:env\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S+)\s+)*)/;
-const DIRECT_ARK = /^(?:(?:npx|yarn)\s+(?:arkgate-check|ark-check)(?=\s|$)|pnpm(?:\s+--\S+)*\s+exec\s+(?:arkgate-check|ark-check)(?=\s|$)|node\s+(?:\S+\/)?bin\/(?:arkgate-check|ark-check)\.mjs(?=\s|$)|(?:arkgate-check|ark-check)(?=\s|$))/;
+const DIRECT_ARK = /^(?:(?:npx(?:\s+(?:-y|--yes))?(?:\s+(?:-p\s+|--package[\s=])arkgate(?:@\S+)?)?|yarn)\s+(?:arkgate-check|ark-check)(?=\s|$)|pnpm(?:\s+--\S+)*\s+exec\s+(?:arkgate-check|ark-check)(?=\s|$)|node\s+(?:\S+\/)?bin\/(?:arkgate-check|ark-check)\.mjs(?=\s|$)|(?:arkgate-check|ark-check)(?=\s|$))/;
 const CHECK_SCRIPT = /^(?:(?:npm|pnpm)\s+run\s+check:architecture(?=\s|$)|yarn(?:\s+run)?\s+check:architecture(?=\s|$))/;
 const FAIL_CLOSED = /(?:^|\s)--(?:strict|strict-merge|require-gates)(?=\s|$)/;