claude-yes 1.155.1 → 1.157.0

package/dist/SUPPORTED_CLIS-DLSsJ845.js

@@ -0,0 +1,8 @@
+import "./ts-CKvvDjEK.js";
+import "./logger-CDIsZ-Pp.js";
+import "./versionChecker-IAATi04_.js";
+import "./pidStore-fqXqTKkh.js";
+import "./globalPidIndex-DlmmJlO8.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-tIYMeICi.js";
+
+export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-Nwu058MP.js → SUPPORTED_CLIS-tIYMeICi.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-SEpCdKU5.js";
+import { t as CLIS_CONFIG } from "./ts-CKvvDjEK.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-Nwu058MP.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-tIYMeICi.js.map

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { i as versionString, n as displayVersion, r as getInstalledPackage, t as checkAndAutoUpdate } from "./versionChecker-B9y2MQF2.js";
+import { i as versionString, n as displayVersion, r as getInstalledPackage, t as checkAndAutoUpdate } from "./versionChecker-IAATi04_.js";
 import { argv } from "process";
 import { execFileSync, spawn } from "child_process";
 import ms from "ms";
@@ -481,7 +481,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-DcJsS7Uu.js");
+	const { isSubcommand, runSubcommand, cmdHelp } = await import("./subcommands-B1EoS0xQ.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		cmdHelp(managerCommands);
 		process.exit(0);
@@ -514,7 +514,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-BJkbB_vi.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-DLSsJ845.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);

package/dist/index.js

@@ -1,6 +1,6 @@
-import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-SEpCdKU5.js";
+import { a as removeControlCharacters, i as AgentContext, n as agentYes, r as config, t as CLIS_CONFIG } from "./ts-CKvvDjEK.js";
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-B9y2MQF2.js";
+import "./versionChecker-IAATi04_.js";
 import "./pidStore-fqXqTKkh.js";
 import "./globalPidIndex-DlmmJlO8.js";
 

package/dist/{schedule-CuPyOtGt.js → schedule-43wkfctj.js}

@@ -1,10 +1,10 @@
-import "./ts-SEpCdKU5.js";
+import "./ts-CKvvDjEK.js";
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-B9y2MQF2.js";
+import "./versionChecker-IAATi04_.js";
 import "./pidStore-fqXqTKkh.js";
 import "./globalPidIndex-DlmmJlO8.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-Nwu058MP.js";
-import { i as resolveSpawnCwd } from "./workspaceConfig-DT3cCBZK.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-tIYMeICi.js";
+import { o as resolveSpawnCwd } from "./workspaceConfig-B0Q9-q2B.js";
 import { createHash } from "node:crypto";
 
 //#region ts/oxmgrService.ts
@@ -141,4 +141,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-CuPyOtGt.js.map
+//# sourceMappingURL=schedule-43wkfctj.js.map

package/dist/{serve-KupsUr6A.js → serve-MQwHVctu.js}

@@ -1,18 +1,18 @@
-import "./ts-SEpCdKU5.js";
+import "./ts-CKvvDjEK.js";
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-B9y2MQF2.js";
+import { r as getInstalledPackage } from "./versionChecker-IAATi04_.js";
 import "./pidStore-fqXqTKkh.js";
 import { a as updateGlobalPidStatus } from "./globalPidIndex-DlmmJlO8.js";
 import { t as pgidForWrapper } from "./reaper-C-eWAxIj.js";
 import "./configShared-CEyhl0WH.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-Nwu058MP.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-tIYMeICi.js";
 import "./e2e-Bfw7qL9O.js";
 import "./webrtcLink-CBZkZ-LT.js";
 import "./remotes-DBCvpp3B.js";
-import { i as resolveSpawnCwd, r as isProvisionAllowed, t as getProvisionRoot } from "./workspaceConfig-DT3cCBZK.js";
-import { E as writeToIpc, _ as readPtysize, b as resolveOne, c as extractTaskCounts, g as readNotes, i as controlCodeFromName, m as listRecords, o as deriveLiveStatus, v as renderRawLog, w as snapshotStatus } from "./subcommands-DSTQRbub.js";
+import { a as isProvisionAllowed, i as hasSpawnHook, n as getSpawnHook, o as resolveSpawnCwd, t as getProvisionRoot } from "./workspaceConfig-B0Q9-q2B.js";
+import { E as writeToIpc, _ as readPtysize, b as resolveOne, c as extractTaskCounts, g as readNotes, i as controlCodeFromName, m as listRecords, o as deriveLiveStatus, v as renderRawLog, w as snapshotStatus } from "./subcommands-Bkf8qkP8.js";
 import yargs from "yargs";
-import { mkdir, open, readFile, stat, writeFile } from "fs/promises";
+import { mkdir, open, readFile, stat, unlink, writeFile } from "fs/promises";
 import { homedir, hostname, userInfo } from "os";
 import path from "path";
 import { execFileSync } from "node:child_process";
@@ -789,6 +789,7 @@ Options:
 			return Response.json({ host: user ? `${user}@${host}` : host });
 		}
 		if (req.method === "GET" && p === "/api/version") return Response.json({ version: getInstalledPackage().version });
+		if (req.method === "GET" && p === "/api/spawn-config") return Response.json({ hasSpawnHook: hasSpawnHook() });
 		if (req.method === "GET" && p === "/api/notes") {
 			const notes = await readNotes();
 			return Response.json(Object.fromEntries(notes));
@@ -1154,15 +1155,59 @@ Options:
 			}
 			process.stderr.write(`→ console spawned:  ay ${cli}${prompt ? ` -- "${prompt.slice(0, 60)}"` : ""}  (cwd: ${cwd}${provisioned ? `, ${provisioned.action}` : ""})\n`);
 			const ayBin = Bun.which("ay") ?? process.argv[1];
-			const ayCmd = process.platform === "win32" && ayBin.toLowerCase().endsWith(".exe") ? [ayBin] : [process.execPath, ayBin];
+			const agentArgv = [
+				...process.platform === "win32" && ayBin.toLowerCase().endsWith(".exe") ? [ayBin] : [process.execPath, ayBin],
+				cli,
+				...prompt ? ["--", prompt] : []
+			];
+			const agentEnv = freshAgentEnv();
 			try {
-				const child = Bun.spawn([
-					...ayCmd,
-					cli,
-					...prompt ? ["--", prompt] : []
-				], {
+				const hook = getSpawnHook();
+				if (hook) {
+					const shell = process.env.AGENT_YES_SPAWN_SHELL?.trim() || "/bin/sh";
+					const script = `set -e\n${hook}\nexec "$@"`;
+					const errPath = path.join(agentYesHome(), `spawn-hook-${process.pid}-${performance.now().toString(36).replace(".", "")}.err`);
+					const child = Bun.spawn([
+						shell,
+						"-c",
+						script,
+						"ay-spawn",
+						...agentArgv
+					], {
+						cwd,
+						env: {
+							...agentEnv,
+							AGENT_YES_CWD: cwd,
+							AGENT_YES_CLI: cli
+						},
+						stdin: "ignore",
+						stdout: "ignore",
+						stderr: Bun.file(errPath)
+					});
+					const windowMs = Number(process.env.AGENT_YES_SPAWN_HOOK_TIMEOUT_MS) || 5e3;
+					const exitCode = await Promise.race([child.exited, new Promise((r) => setTimeout(() => r(null), windowMs))]);
+					if (exitCode !== null && exitCode !== 0) {
+						let detail = "";
+						try {
+							detail = (await Bun.file(errPath).text()).slice(0, 4096);
+						} catch {}
+						await unlink(errPath).catch(() => {});
+						return new Response(`spawn hook failed (exit ${exitCode})${detail ? `:\n${detail.trimEnd()}` : ""}`, { status: 502 });
+					}
+					child.unref();
+					setTimeout(() => void unlink(errPath).catch(() => {}), 6e4).unref?.();
+					return Response.json({
+						ok: true,
+						pid: child.pid,
+						cli,
+						cwd,
+						hook: true,
+						...provisioned ? { provisioned } : {}
+					});
+				}
+				const child = Bun.spawn(agentArgv, {
 					cwd,
-					env: freshAgentEnv(),
+					env: agentEnv,
 					stdin: "ignore",
 					stdout: "ignore",
 					stderr: "ignore"
@@ -1303,4 +1348,4 @@ Options:
 
 //#endregion
 export { cmdServe };
-//# sourceMappingURL=serve-KupsUr6A.js.map
+//# sourceMappingURL=serve-MQwHVctu.js.map

package/dist/{setup-DkN1MjXp.js → setup-DcYBxFku.js}

@@ -1,4 +1,4 @@
-import { a as setWorkspaceRoot, n as getWorkspaceRoot } from "./workspaceConfig-DT3cCBZK.js";
+import { r as getWorkspaceRoot, s as setWorkspaceRoot } from "./workspaceConfig-B0Q9-q2B.js";
 import { existsSync } from "node:fs";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-KupsUr6A.js");
+	const { cmdServe } = await import("./serve-MQwHVctu.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-DkN1MjXp.js.map
+//# sourceMappingURL=setup-DcYBxFku.js.map

package/dist/{subcommands-DcJsS7Uu.js → subcommands-B1EoS0xQ.js}

@@ -4,6 +4,6 @@ import "./configShared-CEyhl0WH.js";
 import "./e2e-Bfw7qL9O.js";
 import "./webrtcLink-CBZkZ-LT.js";
 import "./remotes-DBCvpp3B.js";
-import { C as runSubcommand, E as writeToIpc, S as resolveResumeArgs, T as stopTipForCli, _ as readPtysize, a as cursorAbs, b as resolveOne, c as extractTaskCounts, d as isExitRequest, f as isPidAlive, g as readNotes, h as matchKeyword, i as controlCodeFromName, l as finalizedLines, m as listRecords, n as READ_PAGE_DEFAULT, o as deriveLiveStatus, p as isSubcommand, r as cmdHelp, s as extractNeedsInput, t as GRACEFUL_EXIT_COMMANDS, u as isAgentStuck, v as renderRawLog, w as snapshotStatus, x as resolveReadWindow, y as renderRawLogLines } from "./subcommands-DSTQRbub.js";
+import { C as runSubcommand, E as writeToIpc, S as resolveResumeArgs, T as stopTipForCli, _ as readPtysize, a as cursorAbs, b as resolveOne, c as extractTaskCounts, d as isExitRequest, f as isPidAlive, g as readNotes, h as matchKeyword, i as controlCodeFromName, l as finalizedLines, m as listRecords, n as READ_PAGE_DEFAULT, o as deriveLiveStatus, p as isSubcommand, r as cmdHelp, s as extractNeedsInput, t as GRACEFUL_EXIT_COMMANDS, u as isAgentStuck, v as renderRawLog, w as snapshotStatus, x as resolveReadWindow, y as renderRawLogLines } from "./subcommands-Bkf8qkP8.js";
 
 export { cmdHelp, isSubcommand, runSubcommand };

package/dist/{subcommands-DSTQRbub.js → subcommands-Bkf8qkP8.js}

@@ -554,15 +554,15 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-KupsUr6A.js");
+				const { cmdServe } = await import("./serve-MQwHVctu.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-DkN1MjXp.js");
+				const { cmdSetup } = await import("./setup-DcYBxFku.js");
 				return cmdSetup(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-CuPyOtGt.js");
+				const { cmdSchedule } = await import("./schedule-43wkfctj.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
@@ -2710,4 +2710,4 @@ async function cmdResultSet(rest) {
 
 //#endregion
 export { runSubcommand as C, writeToIpc as E, resolveResumeArgs as S, stopTipForCli as T, readPtysize as _, cursorAbs as a, resolveOne as b, extractTaskCounts as c, isExitRequest as d, isPidAlive as f, readNotes as g, matchKeyword as h, controlCodeFromName as i, finalizedLines as l, listRecords as m, READ_PAGE_DEFAULT as n, deriveLiveStatus as o, isSubcommand as p, cmdHelp as r, extractNeedsInput as s, GRACEFUL_EXIT_COMMANDS as t, isAgentStuck as u, renderRawLog as v, snapshotStatus as w, resolveReadWindow as x, renderRawLogLines as y };
-//# sourceMappingURL=subcommands-DSTQRbub.js.map
+//# sourceMappingURL=subcommands-Bkf8qkP8.js.map

package/dist/{ts-SEpCdKU5.js → ts-CKvvDjEK.js}

@@ -1,5 +1,5 @@
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-B9y2MQF2.js";
+import { r as getInstalledPackage } from "./versionChecker-IAATi04_.js";
 import { t as agentYesHome } from "./agentYesHome-_eJa3DaX.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-V4qvXgAw.js";
 import { t as PidStore } from "./pidStore-fqXqTKkh.js";
@@ -1802,4 +1802,4 @@ function sleep(ms) {
 
 //#endregion
 export { removeControlCharacters as a, AgentContext as i, agentYes as n, config as r, CLIS_CONFIG as t };
-//# sourceMappingURL=ts-SEpCdKU5.js.map
+//# sourceMappingURL=ts-CKvvDjEK.js.map

package/dist/{versionChecker-B9y2MQF2.js → versionChecker-IAATi04_.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "claude-yes";
-var version = "1.155.1";
+var version = "1.157.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -215,4 +215,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-B9y2MQF2.js.map
+//# sourceMappingURL=versionChecker-IAATi04_.js.map

package/dist/{workspaceConfig-DT3cCBZK.js → workspaceConfig-B0Q9-q2B.js}

@@ -1,5 +1,5 @@
 import { t as agentYesHome } from "./agentYesHome-_eJa3DaX.js";
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { lstatSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
 
@@ -61,6 +61,41 @@ function isProvisionAllowed(owner, repo) {
 	const full = `${owner}/${repo}`.toLowerCase();
 	return list.some((e) => e.replace(/\/\*$/, "") === o || e === full);
 }
+/**
+* A trusted, HOST-LOCAL shell hook run before each agent spawn. It is a POSIX
+* `sh -c` script that prepares the environment (provisioning, env, cd) and that
+* agent-yes runs as `sh -c "set -e\n<hook>\nexec \"$@\"" ay-spawn <agent argv…>`
+* — so the real agent argv is passed as positional params and the prompt is
+* never shell-parsed. `set -e` aborts the spawn if any hook step fails.
+*
+* This is arbitrary local code that runs on EVERY spawn, so it is deliberately
+* NOT writable over the network. Set it on the machine by editing
+* `~/.agent-yes/config.json` (`"spawnHook"`), or via env `AGENT_YES_SPAWN_HOOK`.
+*
+* Tampering guard (POSIX): a file-backed hook is ignored when the config file is
+* a symlink, is not owned by us, or is group/world-writable — we refuse to run a
+* hook from a file other users can swap or rewrite. The env override is trusted
+* (it comes from the daemon's own environment). Returns null when unset/guarded.
+*/
+function getSpawnHook() {
+	const env = process.env.AGENT_YES_SPAWN_HOOK;
+	if (env && env.trim()) return env;
+	const h = readConfig().spawnHook;
+	if (!h || !h.trim()) return null;
+	if (process.platform !== "win32") try {
+		if (lstatSync(configPath()).isSymbolicLink()) return null;
+		const st = statSync(configPath());
+		if ((st.mode & 18) !== 0) return null;
+		if (typeof process.getuid === "function" && st.uid !== process.getuid()) return null;
+	} catch {
+		return null;
+	}
+	return h;
+}
+/** Whether a usable {@link getSpawnHook} is configured (for read-only disclosure). */
+function hasSpawnHook() {
+	return getSpawnHook() !== null;
+}
 /** Persist the workspace root, tilde-expanded and resolved to an absolute path. */
 function setWorkspaceRoot(dir) {
 	const abs = path.resolve(expandTilde(dir));
@@ -87,5 +122,5 @@ function resolveSpawnCwd(input) {
 }
 
 //#endregion
-export { setWorkspaceRoot as a, resolveSpawnCwd as i, getWorkspaceRoot as n, isProvisionAllowed as r, getProvisionRoot as t };
-//# sourceMappingURL=workspaceConfig-DT3cCBZK.js.map
+export { isProvisionAllowed as a, hasSpawnHook as i, getSpawnHook as n, resolveSpawnCwd as o, getWorkspaceRoot as r, setWorkspaceRoot as s, getProvisionRoot as t };
+//# sourceMappingURL=workspaceConfig-B0Q9-q2B.js.map

package/lab/ui/index.html

@@ -832,6 +832,17 @@
       .dot.idle {
         background: var(--amber);
       }
+      /* Wedged: the Rust supervisor flagged the agent unresponsive (no PTY output
+         after a poke / frozen spinner) — surfaced as `stuck` by /api/ls. Red so a
+         stuck agent stands out from a healthy green / quiet-amber one. */
+      .dot.stuck {
+        background: var(--red);
+      }
+      /* Waiting on you: alive and quiet, but parked on an unanswered prompt/menu.
+         The UI accent (blue) reads as "your turn" — distinct from idle-amber. */
+      .dot.needs_input {
+        background: var(--accent);
+      }
       .dot.stopped,
       .dot.exited {
         background: var(--muted);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-yes",
-  "version": "1.155.1",
+  "version": "1.157.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/serve.ts

@@ -1,4 +1,4 @@
-import { mkdir, open, readFile, stat, writeFile } from "fs/promises";
+import { mkdir, open, readFile, stat, unlink, writeFile } from "fs/promises";
 import { renameSync, watch, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -23,7 +23,13 @@ import { updateGlobalPidStatus } from "./globalPidIndex.ts";
 import { pgidForWrapper } from "./reaper.ts";
 import { SUPPORTED_CLIS } from "./SUPPORTED_CLIS.ts";
 import { getInstalledPackage } from "./versionChecker.ts";
-import { getProvisionRoot, isProvisionAllowed, resolveSpawnCwd } from "./workspaceConfig.ts";
+import {
+  getProvisionRoot,
+  getSpawnHook,
+  hasSpawnHook,
+  isProvisionAllowed,
+  resolveSpawnCwd,
+} from "./workspaceConfig.ts";
 
 const DEFAULT_PORT = 7432;
 
@@ -1157,6 +1163,15 @@ export async function cmdServe(rest: string[]): Promise<number> {
       return Response.json({ version: getInstalledPackage().version });
     }
 
+    // GET /api/spawn-config — read-only disclosure of WHETHER a host-local spawn
+    // hook is configured. Deliberately returns only a boolean, never the hook
+    // body: the hook is arbitrary local code and console/room clients holding the
+    // share token are not necessarily host admins. Setting it stays host-local
+    // (edit ~/.agent-yes/config.json) — there is no PUT.
+    if (req.method === "GET" && p === "/api/spawn-config") {
+      return Response.json({ hasSpawnHook: hasSpawnHook() });
+    }
+
     // GET /api/notes
     if (req.method === "GET" && p === "/api/notes") {
       const notes = await readNotes();
@@ -1685,10 +1700,75 @@ export async function cmdServe(rest: string[]): Promise<number> {
         process.platform === "win32" && ayBin.toLowerCase().endsWith(".exe")
           ? [ayBin]
           : [process.execPath, ayBin];
+      const agentArgv = [...ayCmd, cli, ...(prompt ? ["--", prompt] : [])];
+      // don't leak our Claude Code session into the agent
+      const agentEnv = freshAgentEnv();
       try {
-        const child = Bun.spawn([...ayCmd, cli, ...(prompt ? ["--", prompt] : [])], {
+        const hook = getSpawnHook();
+        if (hook) {
+          // Host-local spawn hook (trusted local code, never network-writable). We
+          // run it via POSIX `sh -c` then `exec "$@"` the real agent — the agent
+          // argv is passed as positional params ($1…), so the prompt is NEVER
+          // shell-parsed (no quoting/injection surface). `set -e` aborts the spawn
+          // if any hook step fails. No `-l`: we don't re-source rc files here (the
+          // env is already the recovered login-shell env via freshAgentEnv). cwd
+          // and cli are exposed as env for the hook to consume.
+          const shell = process.env.AGENT_YES_SPAWN_SHELL?.trim() || "/bin/sh";
+          const script = `set -e\n${hook}\nexec "$@"`;
+          const errPath = path.join(
+            agentYesHome(),
+            `spawn-hook-${process.pid}-${performance.now().toString(36).replace(".", "")}.err`,
+          );
+          // File-backed stderr never blocks the child (a pipe we stop draining
+          // after exec would), and bounds our read to the first few KB.
+          const child = Bun.spawn([shell, "-c", script, "ay-spawn", ...agentArgv], {
+            cwd,
+            env: { ...agentEnv, AGENT_YES_CWD: cwd, AGENT_YES_CLI: cli },
+            stdin: "ignore",
+            stdout: "ignore",
+            stderr: Bun.file(errPath),
+          });
+          // Handshake: surface an EARLY hook/provision failure synchronously. If
+          // the child exits non-zero within the window, the hook failed before the
+          // agent settled — return the captured stderr. If it's still alive after
+          // the window, `exec` succeeded (or the agent is running) → detach and
+          // report success. We can't always attribute a failure to the hook vs the
+          // agent, so we just surface the captured output.
+          const windowMs = Number(process.env.AGENT_YES_SPAWN_HOOK_TIMEOUT_MS) || 5000;
+          const exitCode = await Promise.race([
+            child.exited,
+            new Promise<null>((r) => setTimeout(() => r(null), windowMs)),
+          ]);
+          if (exitCode !== null && exitCode !== 0) {
+            let detail = "";
+            try {
+              detail = (await Bun.file(errPath).text()).slice(0, 4096);
+            } catch {
+              /* no stderr captured */
+            }
+            await unlink(errPath).catch(() => {});
+            return new Response(
+              `spawn hook failed (exit ${exitCode})${detail ? `:\n${detail.trimEnd()}` : ""}`,
+              { status: 502 },
+            );
+          }
+          child.unref();
+          // Clean up the stderr sidecar. On POSIX the running agent may still hold
+          // the fd; unlinking an open file is harmless (the inode lives until
+          // close), so a brief delay is enough to keep early-failure reads valid.
+          setTimeout(() => void unlink(errPath).catch(() => {}), 60_000).unref?.();
+          return Response.json({
+            ok: true,
+            pid: child.pid,
+            cli,
+            cwd,
+            hook: true,
+            ...(provisioned ? { provisioned } : {}),
+          });
+        }
+        const child = Bun.spawn(agentArgv, {
           cwd,
-          env: freshAgentEnv(), // don't leak our Claude Code session into the agent
+          env: agentEnv,
           stdin: "ignore",
           stdout: "ignore",
           stderr: "ignore",

package/ts/workspaceConfig.spec.ts

@@ -1,12 +1,14 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "fs";
 import { homedir, tmpdir } from "os";
 import path from "path";
 import {
   expandTilde,
   getProvisionAllowlist,
   getProvisionRoot,
+  getSpawnHook,
   getWorkspaceRoot,
+  hasSpawnHook,
   isProvisionAllowed,
   resolveSpawnCwd,
   setWorkspaceRoot,
@@ -25,6 +27,7 @@ describe("workspaceConfig", () => {
     else process.env.AGENT_YES_HOME = original;
     delete process.env.CODEHOST_WS_ROOT;
     delete process.env.CODEHOST_PROVISION_ALLOWLIST;
+    delete process.env.AGENT_YES_SPAWN_HOOK;
     rmSync(tmp, { recursive: true, force: true });
   });
 
@@ -142,4 +145,42 @@ describe("workspaceConfig", () => {
       expect(isProvisionAllowed("org", "anything")).toBe(true);
     });
   });
+
+  describe("getSpawnHook / hasSpawnHook", () => {
+    const isPosix = process.platform !== "win32";
+
+    it("is null/false when unset", () => {
+      expect(getSpawnHook()).toBeNull();
+      expect(hasSpawnHook()).toBe(false);
+    });
+
+    it("returns the configured hook from a private (0600) config", () => {
+      writeConfig({ spawnHook: 'echo hi >&2\nexec "$@"' });
+      if (isPosix) chmodSync(path.join(tmp, "config.json"), 0o600);
+      expect(getSpawnHook()).toBe('echo hi >&2\nexec "$@"');
+      expect(hasSpawnHook()).toBe(true);
+    });
+
+    it("ignores a blank hook", () => {
+      writeConfig({ spawnHook: "   " });
+      expect(getSpawnHook()).toBeNull();
+    });
+
+    it("env AGENT_YES_SPAWN_HOOK overrides the config", () => {
+      writeConfig({ spawnHook: "from-file" });
+      process.env.AGENT_YES_SPAWN_HOOK = "from-env";
+      expect(getSpawnHook()).toBe("from-env");
+    });
+
+    it.skipIf(!isPosix)(
+      "refuses a file-backed hook when the config is group/world-writable (tampering guard)",
+      () => {
+        writeConfig({ spawnHook: "echo pwned" });
+        chmodSync(path.join(tmp, "config.json"), 0o666);
+        expect(getSpawnHook()).toBeNull();
+        chmodSync(path.join(tmp, "config.json"), 0o600);
+        expect(getSpawnHook()).toBe("echo pwned");
+      },
+    );
+  });
 });

package/ts/workspaceConfig.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { lstatSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
 import { agentYesHome } from "./agentYesHome.ts";
@@ -19,6 +19,12 @@ interface Config {
   provisionRoot?: string;
   /** Owners/repos permitted for `from`-provisioning; empty = deny all. */
   provisionAllowlist?: string[];
+  /**
+   * A trusted, HOST-LOCAL shell hook run before each console/CLI spawn. See
+   * {@link getSpawnHook}. Intentionally NOT settable over the network — it is
+   * arbitrary local code that runs on every spawn.
+   */
+  spawnHook?: string;
 }
 
 function configPath(): string {
@@ -86,6 +92,45 @@ export function isProvisionAllowed(owner: string, repo: string): boolean {
   return list.some((e) => e.replace(/\/\*$/, "") === o || e === full);
 }
 
+/**
+ * A trusted, HOST-LOCAL shell hook run before each agent spawn. It is a POSIX
+ * `sh -c` script that prepares the environment (provisioning, env, cd) and that
+ * agent-yes runs as `sh -c "set -e\n<hook>\nexec \"$@\"" ay-spawn <agent argv…>`
+ * — so the real agent argv is passed as positional params and the prompt is
+ * never shell-parsed. `set -e` aborts the spawn if any hook step fails.
+ *
+ * This is arbitrary local code that runs on EVERY spawn, so it is deliberately
+ * NOT writable over the network. Set it on the machine by editing
+ * `~/.agent-yes/config.json` (`"spawnHook"`), or via env `AGENT_YES_SPAWN_HOOK`.
+ *
+ * Tampering guard (POSIX): a file-backed hook is ignored when the config file is
+ * a symlink, is not owned by us, or is group/world-writable — we refuse to run a
+ * hook from a file other users can swap or rewrite. The env override is trusted
+ * (it comes from the daemon's own environment). Returns null when unset/guarded.
+ */
+export function getSpawnHook(): string | null {
+  const env = process.env.AGENT_YES_SPAWN_HOOK;
+  if (env && env.trim()) return env;
+  const h = readConfig().spawnHook;
+  if (!h || !h.trim()) return null;
+  if (process.platform !== "win32") {
+    try {
+      if (lstatSync(configPath()).isSymbolicLink()) return null;
+      const st = statSync(configPath());
+      if ((st.mode & 0o022) !== 0) return null; // group/world-writable
+      if (typeof process.getuid === "function" && st.uid !== process.getuid()) return null;
+    } catch {
+      return null;
+    }
+  }
+  return h;
+}
+
+/** Whether a usable {@link getSpawnHook} is configured (for read-only disclosure). */
+export function hasSpawnHook(): boolean {
+  return getSpawnHook() !== null;
+}
+
 /** Persist the workspace root, tilde-expanded and resolved to an absolute path. */
 export function setWorkspaceRoot(dir: string): string {
   const abs = path.resolve(expandTilde(dir));

package/dist/SUPPORTED_CLIS-BJkbB_vi.js

@@ -1,8 +0,0 @@
-import "./ts-SEpCdKU5.js";
-import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-B9y2MQF2.js";
-import "./pidStore-fqXqTKkh.js";
-import "./globalPidIndex-DlmmJlO8.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-Nwu058MP.js";
-
-export { SUPPORTED_CLIS };