eminiar 0.13.2 → 0.13.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "eminiar",
   "displayName": "Eminiar",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Local-first context, memory and knowledge graph for Claude Code: sandboxed execution, FTS5 + vector search, session continuity, code graph.",
   "author": {
     "name": "Ryan Dick"

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "eminiar",
   "displayName": "Eminiar",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Local-first context, memory and knowledge graph for coding agents: sandboxed execution, FTS5 + vector search, session continuity, code graph.",
   "author": {
     "name": "Ryan Dick"

package/README.md

@@ -60,14 +60,17 @@ Everything runs locally in one SQLite database per project.
 
 `em_execute`, `em_batch_execute` and `em_execute_file` run shell, JavaScript and TypeScript, plus
 Python, Ruby, Go, PHP, Perl, R, Elixir, Rust and C# when they are installed. Output over 5 KB is
-indexed. Claude gets back only the sections that match its `intent`. Snippets obey your Claude
-Code `Bash` deny rules, and `em_execute_file` refuses a `path` that one of your `Read` deny rules
-matches ([which rule forms](docs/how-it-works.md#sandbox)).
+indexed. Claude gets back only the sections that match its `intent`. Shell snippets are checked
+against your Claude Code `Bash` deny and ask rules, and `em_execute_file` refuses a `path` that
+one of your `Read` deny rules matches. Snippets in other languages are not rule-checked, and
+the sandbox is not an isolation boundary
+([what is enforced](docs/how-it-works.md#what-the-sandbox-enforces)).
 
 Hooks route noisy commands for Claude. A Bash line is judged one command at a time: output that
-is already bounded (`| head`, `| wc`, `grep -l`, `cat` of a small file) and commands that change
-files stay native. `git log`, `git blame` and `git show` go to `em_history`, and a `Grep` for a
-symbol the graph knows goes to `em_symbols`. `em_stats` shows each routing decision and the rule
+is already bounded (`| head`, `| wc`, `grep -l`, `cat` of a small file) and commands it
+recognises as changing something (files, a cluster, a remote API) stay native. `git log`,
+`git blame` and `git show` go to `em_history`, and a `Grep` for a symbol the graph knows goes to
+`em_symbols`. `em_stats` shows each routing decision and the rule
 behind it, so you can see what was sent where.
 
 ### 🔎 Hybrid search — keyword and meaning together

package/dist/hook.js

@@ -2197,9 +2197,9 @@ var preCompact = (input) => {
 
 // src/hooks/routing.ts
 init_esm_shims();
-import { realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { extname, join as join7, relative, resolve as resolve2 } from "path";
+import { dirname as dirname3, extname, join as join7, relative as relative2, resolve as resolve3 } from "path";
 
 // src/permissions/settings.ts
 init_esm_shims();
@@ -2364,6 +2364,36 @@ function checkReadPath(rules, abs) {
   return more.length ? checkRead(rules, more) : asWritten;
 }
 
+// src/sandbox/file.ts
+init_esm_shims();
+import { existsSync as existsSync4, realpathSync as realpathSync2 } from "fs";
+import { isAbsolute, relative, resolve as resolve2 } from "path";
+function confinePath(root, target, given) {
+  const abs = resolve2(root, target);
+  const rules = given.root ? given : { ...given, root };
+  refuse(checkRead(rules, [abs]), target);
+  let real;
+  try {
+    real = realpathSync2(abs);
+  } catch {
+    throw new Error(`file not found: ${target}`);
+  }
+  refuse(checkReadPath(rules, abs), target);
+  const rel = relative(root, real);
+  const inside = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+  if (inside) return real;
+  if (readMatcher(rules.allow, rules.root).test(real)) return real;
+  throw new Error(
+    `${target} is outside the project root; add a Read(/${real}) rule to permissions.allow to opt it in`
+  );
+}
+function refusal(check, target) {
+  return `refused by permission rule ${check.rule} (${check.kind}) on path: ${target}`;
+}
+function refuse(check, target) {
+  if (!check.allowed) throw new Error(refusal(check, target));
+}
+
 // src/session/routing-stats.ts
 init_esm_shims();
 var ROUTING_CATEGORY = "routing";
@@ -2386,7 +2416,7 @@ function recordRouting(db, sessionId, e) {
 
 // src/session/server-alive.ts
 init_esm_shims();
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync as readdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync as readdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
 function markersDir(ctx) {
   return join4(projectDir(ctx.id), "servers");
@@ -2401,7 +2431,7 @@ function processAlive(pid) {
 }
 function liveServers(ctx) {
   const dir = markersDir(ctx);
-  if (!existsSync4(dir)) return [];
+  if (!existsSync5(dir)) return [];
   const live = [];
   for (const name of readdirSync2(dir)) {
     const pid = Number(name);
@@ -2424,7 +2454,7 @@ import { join as join6 } from "path";
 init_esm_shims();
 import {
   copyFileSync,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync3,
   readFileSync as readFileSync3,
@@ -2469,7 +2499,11 @@ function literalOf(pattern) {
 function symbolHints(db, pattern) {
   const lit = literalOf(pattern);
   if (!lit) return void 0;
-  const nodes = db.graphFindNodes({ query: lit, kinds: SYMBOL_KINDS, limit: 5 });
+  const nodes = db.graphFindNodes({
+    query: lit,
+    kinds: SYMBOL_KINDS,
+    limit: 5
+  });
   if (!nodes.length) return void 0;
   const list = nodes.map((n) => `${n.kind} ${n.name} (${n.path}:${n.start_line ?? "?"})`).join("; ");
   return `eminiar graph: symbols matching "${lit}": ${list}. em_symbols {name_path, include_body: true} reads one; {mode:"references"} lists its callers.`;
@@ -2479,13 +2513,13 @@ function coverageHint(db, rel) {
   if (!row || row.status === "indexed") return void 0;
   return `eminiar graph: ${rel} is ${row.status}${row.reason ? ` (${row.reason})` : ""}; graph answers about it may be incomplete.`;
 }
-var GIT_HISTORY = /(?:^|[;&|]\s*)git\s+(?:(?:-C|--git-dir|--work-tree)[= ]\S+\s+|--no-pager\s+)*(log|blame|shortlog|show|whatchanged|reflog)\b([^;&|]*)/;
+var GIT_HISTORY = /(?:^|[;&|]\s*)git\s+((?:(?:-C|--git-dir|--work-tree)[= ]\S+\s+|--no-pager\s+)*)(log|blame|shortlog|show|whatchanged|reflog)\b([^;&|]*)/;
 var ONE_COMMIT = /(^|\s)(-1|-n\s*1|-n1|--max-count[= ]1)(?=\s|$)/;
 function historyCall(cmd) {
   const m = GIT_HISTORY.exec(cmd);
   if (!m) return void 0;
-  const sub = m[1];
-  const rest = (m[2] ?? "").trim();
+  const sub = m[2];
+  const rest = (m[3] ?? "").trim();
   const args = rest.split(/\s+/).filter(Boolean);
   const q = (s) => JSON.stringify(s.replace(/^['"]|['"]$/g, ""));
   const positional = (a) => !a.startsWith("-");
@@ -2520,6 +2554,66 @@ function historyCall(cmd) {
   if (sub === "shortlog") return `{action:"timeline"}`;
   return `{action:"overview"}`;
 }
+function historyDir(segments, cwd) {
+  let dir = cwd;
+  let steps = 0;
+  const step = (arg) => {
+    dir = ++steps > MAX_STEPS ? void 0 : dir && changeDir(dir, arg);
+  };
+  for (const segment of segments) {
+    const m = GIT_HISTORY.exec(segment);
+    if (m) {
+      const opts = m[1] ?? "";
+      if (/--(git-dir|work-tree)\b/.test(opts)) return void 0;
+      for (const c of opts.matchAll(/-C[= ](\S+)/g)) {
+        step(c[1]);
+        if (!dir) return void 0;
+      }
+      return dir;
+    }
+    const cd = CD.exec(segment);
+    if (cd) step(cd[1]);
+    if (!dir) return void 0;
+  }
+  return dir;
+}
+var CD = /^\(?\s*(?:cd|pushd)\b(.*)$/;
+var MAX_STEPS = 16;
+var MAX_RAW = 64 * 1024;
+var MAX_CLASSIFIED = 8 * 1024;
+var MAX_OPERANDS = 64;
+var MAX_SEGMENTS = 64;
+function changeDir(dir, arg) {
+  const a = arg.trim().replace(/^(['"])(.*)\1$/, "$2") || "~";
+  if (/^-|^~[^/]|[\s$`*?[\]{}()\\]/.test(a)) return void 0;
+  return a === "~" || a.startsWith("~/") ? join7(homedir2(), a.slice(1)) : resolve3(dir, a);
+}
+function inRootRepo(root, dir) {
+  try {
+    const top = realpathSync3(root);
+    let inside = false;
+    for (let d = realpathSync3(dir); ; d = dirname3(d)) {
+      if (d === top) inside = true;
+      if (existsSync7(join7(d, ".git"))) return inside;
+      if (dirname3(d) === d) return false;
+    }
+  } catch {
+    return false;
+  }
+}
+function repoOf(dir) {
+  try {
+    for (let d = realpathSync3(dir); ; d = dirname3(d)) {
+      if (existsSync7(join7(d, ".git"))) return d;
+      if (dirname3(d) === d) return void 0;
+    }
+  } catch {
+    return void 0;
+  }
+}
+function sameRepo(root, dir) {
+  return repoOf(root) === repoOf(dir);
+}
 function docsSources(root) {
   try {
     return readManifestAt(join7(root, ".eminiar", "docs.json"), root).sources;
@@ -2562,7 +2656,34 @@ var BIG_TEXT_EXT = /* @__PURE__ */ new Set([
 ]);
 var VISUAL_EXT = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp", ".pdf"]);
 function withoutHeredocs(cmd) {
-  return cmd.replace(/<<-?\s*(['"]?)(\w+)\1[^\n]*\n[\s\S]*?\n\s*\2\s*(?=\n|$)/g, "<<$2");
+  if (!cmd.includes("<<")) return cmd;
+  const head = /<<-?\s*(['"]?)(\w+)\1/y;
+  const seen = /* @__PURE__ */ new Map();
+  const terminator = (word, from) => {
+    const c = seen.get(word);
+    if (c && from >= c.from && (c.at === -1 || from <= c.at)) return c.end;
+    const re = new RegExp(String.raw`\n[^\S\n]*${word}\s*(?=\n|$)`, "g");
+    re.lastIndex = from;
+    const m = re.exec(cmd);
+    const rec = m ? { from, at: m.index, end: m.index + m[0].length } : { from, at: -1, end: -1 };
+    seen.set(word, rec);
+    return rec.end;
+  };
+  let out = "";
+  let copied = 0;
+  for (let k = cmd.indexOf("<<"); k !== -1; k = cmd.indexOf("<<", Math.max(k + 1, copied))) {
+    head.lastIndex = k;
+    const m = head.exec(cmd);
+    if (!m) continue;
+    const word = m[2];
+    const eol = cmd.indexOf("\n", head.lastIndex);
+    if (eol === -1) break;
+    const end = terminator(word, eol + 1);
+    if (end === -1) continue;
+    out += `${cmd.slice(copied, k)}<<${word}${cmd.slice(head.lastIndex, eol)}`;
+    copied = end;
+  }
+  return out + cmd.slice(copied);
 }
 function splitUnquoted(s, sep2) {
   const out = [];
@@ -2570,13 +2691,23 @@ function splitUnquoted(s, sep2) {
   let quote;
   for (let i = 0; i < s.length; i++) {
     const ch = s[i];
+    if (quote === "'") {
+      cur += ch;
+      if (ch === "'") quote = void 0;
+      continue;
+    }
+    if (ch === "\\") {
+      cur += ch + (s[i + 1] ?? "");
+      i++;
+      continue;
+    }
     if (quote) {
       cur += ch;
-      if (ch === quote && s[i - 1] !== "\\") quote = void 0;
+      if (ch === quote[quote.length - 1]) quote = void 0;
       continue;
     }
     if (ch === "'" || ch === '"') {
-      quote = ch;
+      quote = ch === "'" && s[i - 1] === "$" ? "$'" : ch;
       cur += ch;
       continue;
     }
@@ -2597,9 +2728,44 @@ function commandSegments(cmd) {
     const ch = s[i];
     if (ch === ";" || ch === "\n") return 1;
     if ((ch === "&" || ch === "|") && s[i + 1] === ch) return 2;
+    if (ch === "&" && !/[&<>|]/.test(s[i - 1] ?? "") && !/[&>]/.test(s[i + 1] ?? "")) return 1;
     return 0;
   });
 }
+function shellWords(s) {
+  const words = [];
+  let cur = "";
+  let inWord = false;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === " " || ch === "	" || ch === "\n") {
+      if (inWord) words.push(cur);
+      cur = "";
+      inWord = false;
+      continue;
+    }
+    inWord = true;
+    if (ch === "\\") {
+      cur += s[++i] ?? "";
+    } else if (ch === "'" && s[i - 1] !== "$") {
+      const end = s.indexOf("'", i + 1);
+      const stop2 = end === -1 ? s.length : end;
+      cur += s.slice(i + 1, stop2);
+      i = stop2;
+    } else if (ch === '"' || ch === "$" && s[i + 1] === "'") {
+      const close = ch === '"' ? '"' : "'";
+      if (ch === "$") i++;
+      for (i++; i < s.length && s[i] !== close; i++) {
+        if (s[i] === "\\" && i + 1 < s.length) i++;
+        cur += s[i];
+      }
+    } else {
+      cur += ch;
+    }
+  }
+  if (inWord) words.push(cur);
+  return words;
+}
 function pipeStages(segment) {
   return splitUnquoted(segment, (s, i) => s[i] === "|" && s[i + 1] !== "|" ? 1 : 0);
 }
@@ -2613,10 +2779,416 @@ function bounds(stage) {
   if (!/^\s*(head|tail)\b/.test(stage) || /(^|\s)-c\b|--bytes\b/.test(stage)) return false;
   return headLines(stage) <= BOUNDED_LINES;
 }
-var MUTATING = /^\s*(?:(?:sudo|env|[A-Z_][A-Z0-9_]*=\S*)\s+)*(git\s+(add|commit|checkout|switch|push|pull|fetch|merge|rebase|stash|reset|restore|cherry-pick|revert|tag|init|clone|worktree|mv|rm|am|apply|submodule)|npm\s+(install|i|ci|uninstall|un|link|publish|version|update|up|dedupe)|pnpm\s+(install|i|add|remove|rm|update|up|link)|yarn\s+(add|remove|install|upgrade)|pip3?\s+(install|uninstall)|cargo\s+(add|install)|brew\s+(install|uninstall|upgrade)|gh\s+(pr|issue|release|repo)\s+(create|edit|merge|close|comment|delete|ready)|rm|mv|cp|mkdir|rmdir|touch|chmod|chown|ln|sed\s+(?:-\S+\s+)*-i|tee)\b/;
-var WRITES_FILE = /(?:^|\s|\d)>{1,2}\s*(?!&)(?!\/dev\/null)\S/;
-function mutates(segment) {
-  return MUTATING.test(segment) || WRITES_FILE.test(segment);
+var GIT_MUTATING = /^(git\s+(?:(?:-[Cc]\s*[^-\s]\S*|--(?:git-dir|work-tree)[= ]\S+|--no-pager)\s+)*(add|commit|checkout|switch|push|pull|fetch|merge|rebase|stash|reset|restore|cherry-pick|revert|tag|init|clone|worktree|mv|rm|am|apply|submodule|clean|branch\s(?:.*\s)?(-[a-zA-Z]*[dDmM][a-zA-Z]*|--delete|--move)|config(?:\s+--(?:global|local|system|worktree))*\s+(?:set|unset|--(?:unset|unset-all|add|replace-all|rename-section|remove-section|edit)|-e|\w[\w.-]*\s+\S+)))(?![\w-])/;
+var OTHER_MUTATING = /^(npm\s+(install|i|ci|uninstall|un|link|publish|version|update|up|dedupe|audit\s+fix)|pnpm\s+(install|i|add|remove|rm|update|up|link|audit\s.*--fix)|yarn\s+(add|remove|install|upgrade)|pip3?\s+(install|uninstall)|cargo\s+(add|install)|brew\s+(install|uninstall|upgrade)|gh\s+(pr|issue|release|repo)\s+(create|edit|merge|close|comment|delete|ready)|terraform\s+(?:-\S+\s+)*(apply|destroy|import|taint|untaint|state\s+(rm|mv|push))|helm\s+(?:-\S+\s+(?:[^-\s]\S*\s+)?)*(install|upgrade|uninstall|rollback|delete)|mvnw?(?:\s.*)?\s(deploy|install|release:\S*)|gradlew?(?:\s.*)?[\s:](publish|upload)\w*|rm|mv|cp|mkdir|rmdir|touch|chmod|chown|ln|sed\s+(?:-\S+\s+)*-i|tee|eval|sh|bash|zsh|find\s.*\s-(delete|exec|execdir|ok|okdir))(?![\w-])/;
+var MUTATING_WORDS = /* @__PURE__ */ new Set([
+  "npm",
+  "pnpm",
+  "yarn",
+  "pip",
+  "pip3",
+  "cargo",
+  "brew",
+  "gh",
+  "terraform",
+  "helm",
+  "mvn",
+  "mvnw",
+  "gradle",
+  "gradlew",
+  "rm",
+  "mv",
+  "cp",
+  "mkdir",
+  "rmdir",
+  "touch",
+  "chmod",
+  "chown",
+  "ln",
+  "sed",
+  "tee",
+  "eval",
+  "sh",
+  "bash",
+  "zsh",
+  "find"
+]);
+var MUTATING = {
+  test(cmd) {
+    const word = /^[A-Za-z0-9]*/.exec(cmd)[0];
+    if (word === "git") return GIT_MUTATING.test(cmd);
+    return MUTATING_WORDS.has(word) && OTHER_MUTATING.test(cmd);
+  }
+};
+var longOpts = (valued) => String.raw`--(?:${valued})\s+[^-\s]\S*|--(?!(?:${valued})(?:\s|$))\S*`;
+var RUNNERS = [
+  String.raw`sudo(?:\s+(?:-[ugCDhpRrtTU]\s*[^-\s]\S*|-(?![ugCDhpRrtTU-])\S+|${longOpts("user|group|chdir|host|prompt|close-from|role|type|other-user|chroot|command-timeout")}))*`,
+  String.raw`env(?:\s+(?:-[uC]\s*[^-\s]\S*|-(?![uC-])\S+|${longOpts("unset|chdir|split-string")}))*`,
+  String.raw`(?:xargs|parallel)(?:\s+(?:-[nILPsdEaj]\s*[^-\s]\S*|-(?![nILPsdEaj-])\S+|${longOpts("max-args|max-procs|max-lines|max-chars|delimiter|arg-file|eof|jobs")}))*`,
+  String.raw`timeout(?:\s+(?:-[sk]\s*[^-\s]\S*|-(?![sk-])\S+|${longOpts("signal|kill-after")}))*\s+\d\S*`,
+  String.raw`nice(?:\s+-n\s*\S+|\s+-\d+|\s+--adjustment(?:=|\s+)\S+)?`,
+  String.raw`stdbuf(?:\s+-[ioe]\s*\S+)*`,
+  String.raw`(?:time|command)(?:\s+-p)?`,
+  "nohup",
+  String.raw`[A-Z_][A-Z0-9_]*=\S*`
+];
+var SHELL_WORDS = /^(?:\s*(?:[({!]|(?:then|do|else|exec|if|elif|while|until)\s))*\s*/;
+var RUNNER = new RegExp(String.raw`^\s*(?:(?:${RUNNERS.join("|")})\s+)*`);
+var RUNNER_HEAD = /^\s*(?:sudo|env|xargs|parallel|timeout|nice|stdbuf|time|command|nohup|[A-Z_])/;
+var stripRunners = (s) => RUNNER_HEAD.test(s) ? s.replace(RUNNER, "") : s.replace(/^\s+/, "");
+var WRITES_FILE = /(?:^|[\s\d&])>{1,2}\s*(?!&)(?!\/dev\/null)\S/;
+var GLUED_WRITE = /(?<![-=>])>{1,2}\s*(?!&)(?!\/dev\/null)\S/;
+var RUNS_STDIN = /^(python3?|node|perl|ruby|deno|bun)(\s+-\S*)*$/;
+var FOLLOWS = /^((kubectl|docker)(\s.*)?\s(-f|-w|--follow)(?=[\s=]|$)|tail(\s.*)?\s(-[a-zA-Z]*[fF]|--follow)|.*\s--watch(All)?(?=[\s=]|$))/;
+var CURL_SENDS = /\s(?:-(?:(?!X)[a-zA-Z])*[dFTOoKDc]|(?:-[a-zA-Z]*X|--request)(?![\s=]*['"]?(?:GET|HEAD)\b)|--(?:data|json|form|upload-file|output|remote-name|config|dump-header|cookie-jar|trace|stderr|create-dirs|libcurl|etag-save|hsts|alt-svc))/;
+var WGET_PRINTS = /\s(?:-[a-zA-Z]*O\s*-|--output-document[= ]-|--spider)(?=\s|$)/;
+var WGET_SENDS = /\s(?:--(post-data|post-file|body-data|body-file|method|output-file|append-output|execute|config)\b|-[a-zA-Z]*[oae])/;
+var KUBECTL_READS = /^(get|describe|logs|top|explain|api-resources|api-versions|events|version|cluster-info|config\s+(view|get-contexts|current-context)|rollout\s+(status|history)|auth\s+can-i)\b/;
+var DOCKER_READS = /^(ps|logs|images|inspect|history|version|info|stats\s.*--no-stream|(container|image|network|volume)\s+(ls|inspect)|compose\s+(ps|logs|config|images|ls)|system\s+df)\b/;
+var CHECK_SCRIPT = /^(t|test|lint|type-?check|check)(?=$|[:.-])(?![\w:.-]*(fix|write|update|install|deploy|publish|push|release|clean))/;
+var FIX_ARGS = /(?:^|\s)(--fix|--write|--apply(-unsafe)?|-u|--update(-?[sS]napshots?)?)(?=[\s=]|$)/;
+var NPX_CHECKS = /^(vitest|jest|tsc|eslint|biome|prettier)(?:@[\w.^~-]*)?$/;
+var PM_READS = /^(ls|list|outdated|why|info|view|audit|licenses|bin|root|help)$/;
+var VALUE_OPTS = {
+  kubectl: /* @__PURE__ */ new Set([
+    "-n",
+    "--namespace",
+    "--context",
+    "--cluster",
+    "--kubeconfig",
+    "--user",
+    "-s",
+    "--server",
+    "--token",
+    "--as",
+    "--as-group",
+    "--as-uid",
+    "--cache-dir",
+    "--certificate-authority",
+    "--client-certificate",
+    "--client-key",
+    "--password",
+    "--username",
+    "--profile",
+    "--profile-output",
+    "--request-timeout",
+    "--tls-server-name",
+    "--log-dir",
+    "--log-file",
+    "--log-file-max-size",
+    "--vmodule",
+    "-v",
+    "--v"
+  ]),
+  docker: /* @__PURE__ */ new Set([
+    "-H",
+    "--host",
+    "-c",
+    "--context",
+    "--config",
+    "-l",
+    "--log-level",
+    "--tlscacert",
+    "--tlscert",
+    "--tlskey"
+  ]),
+  npm: /* @__PURE__ */ new Set(["--prefix", "-w", "--workspace", "--userconfig", "--registry", "--cache"]),
+  pnpm: /* @__PURE__ */ new Set(["-C", "--dir", "--filter", "-F", "--workspace-dir"]),
+  yarn: /* @__PURE__ */ new Set(["--cwd", "--cache-folder", "--registry"])
+};
+var FLAG_OPTS = {
+  kubectl: /* @__PURE__ */ new Set([
+    "--insecure-skip-tls-verify",
+    "--match-server-version",
+    "--warnings-as-errors",
+    "--disable-compression",
+    "--alsologtostderr",
+    "--logtostderr",
+    "--add-dir-header",
+    "--skip-headers",
+    "--skip-log-headers",
+    "--one-output",
+    "-h",
+    "--help"
+  ]),
+  docker: /* @__PURE__ */ new Set(["-D", "--debug", "--tls", "--tlsverify", "-v", "--version", "--help"])
+};
+var MAX_READINGS = 4;
+function afterOptions(tool, args) {
+  const words = args.trim().split(/\s+/);
+  const valued = VALUE_OPTS[tool];
+  let i = 0;
+  while (words[i]?.startsWith("-")) i += valued?.has(words[i]) ? 2 : 1;
+  return words.slice(i);
+}
+function subcommands(tool, args) {
+  const words = args.trim().split(/\s+/);
+  const valued = VALUE_OPTS[tool];
+  const flags = FLAG_OPTS[tool];
+  const starts = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const todo = [0];
+  while (todo.length) {
+    const i = todo.pop();
+    if (seen.has(i)) continue;
+    seen.add(i);
+    const w = words[i];
+    if (w === void 0 || !w.startsWith("-")) {
+      starts.add(i);
+      if (starts.size > MAX_READINGS) return void 0;
+    } else if (valued?.has(w)) todo.push(i + 2);
+    else if (flags?.has(w) || w.includes("=") || /^-[^-]./.test(w)) todo.push(i + 1);
+    else todo.push(i + 1, i + 2);
+  }
+  const tail = /\s--no-stream\b/.test(args) ? " --no-stream" : "";
+  return [...starts].map((i) => words.slice(i, i + 3).join(" ") + tail);
+}
+function verbChanges(tool, reads, args) {
+  const subs = subcommands(tool, args);
+  return !subs || subs.some((s) => !reads.test(s));
+}
+function runsScript(tool, args) {
+  const words = afterOptions(tool, args);
+  let script = words.shift();
+  if (script === "run" || script === "run-script") script = words.shift();
+  else if (script === void 0 || PM_READS.test(script) || tool === "npm" && script !== "test")
+    return false;
+  if (script === void 0) return false;
+  return !CHECK_SCRIPT.test(script) || FIX_ARGS.test(words.join(" "));
+}
+function makeChanges(args) {
+  const words = shellWords(args);
+  const targets = [];
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (/^(-E|--eval)/.test(w)) return true;
+    if (w.startsWith("-")) {
+      if (/^(-[CfIoW]|--(directory|file|makefile|include-dir|old-file|assume-old|what-if|new-file|assume-new))$/.test(
+        w
+      ) || /^(-[jl]|--jobs|--load-average|--max-load)$/.test(w) && /^\d+(\.\d+)?$/.test(words[i + 1] ?? ""))
+        i++;
+      continue;
+    }
+    if (!w.includes("=")) targets.push(w);
+  }
+  return !targets.length || !targets.every((t) => CHECK_SCRIPT.test(t)) || FIX_ARGS.test(args);
+}
+var GH_API_VALUED = /^(-[FfHXpqt]|--(method|field|raw-field|input|header|jq|template|preview|hostname|cache))$/;
+function ghApiSends(args) {
+  const words = shellWords(args);
+  if (words[0] !== "api") return false;
+  let method;
+  let fields = false;
+  for (let i = 1; i < words.length; i++) {
+    const w = words[i];
+    const long = /^--(method|field|raw-field|input)(?:=|$)/.exec(w)?.[1];
+    if (long) {
+      if (long === "method")
+        method = w.includes("=") ? w.slice(w.indexOf("=") + 1) : words[i + 1] ?? "";
+      else fields = true;
+    } else if (/^-[a-zA-Z]/.test(w)) {
+      const c = w.slice(1).replace(/^i+/, "")[0];
+      const value = w.slice(w.indexOf(c ?? "") + 1) || (words[i + 1] ?? "");
+      if (c === "X") method = value;
+      else if (c === "f" || c === "F") fields = true;
+    }
+    if (GH_API_VALUED.test(w)) i++;
+  }
+  if (method !== void 0) return method.toUpperCase() !== "GET";
+  if (words.includes("graphql")) return /\bmutation\b/.test(words.join(" "));
+  return fields;
+}
+function npxChanges(args, cwd) {
+  const words = shellWords(args);
+  let i = 0;
+  for (; words[i]?.startsWith("-"); i++)
+    if (/^(-p|--package|-c|--call)(=|$)/.test(words[i])) return true;
+  const [name = "", ...rest] = words.slice(i);
+  const tool = NPX_CHECKS.exec(name)?.[1];
+  if (!tool || FIX_ARGS.test(args)) return true;
+  const has = (re) => rest.some((w) => re.test(w));
+  if (has(/^--(output-?file|outputFile|out-?dir|outFile|generateTrace)(=|$)/i)) return true;
+  if (tool === "eslint" && has(/^-o/)) return true;
+  if (tool === "prettier" && has(/^-[a-zA-Z]*w$/)) return true;
+  return tool === "tsc" && !tscEmitsNothing(rest, cwd);
+}
+function tscEmitsNothing(words, cwd) {
+  if (words.some((w) => /^(-b|--build|--generateTrace)(=|$)/i.test(w))) return false;
+  const noEmit = words.findIndex((w) => /^--noEmit(=true)?$/i.test(w));
+  if (noEmit !== -1) return words[noEmit + 1] !== "false";
+  let project = "tsconfig.json";
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (/^(-p|--project)$/i.test(w)) project = words[++i] ?? "";
+    else if (!w.startsWith("-")) return false;
+  }
+  try {
+    let file2 = resolve3(cwd, project);
+    if (statSync3(file2).isDirectory()) file2 = join7(file2, "tsconfig.json");
+    const st = statSync3(file2);
+    if (st.size > 256 * 1024) return false;
+    return /"noEmit"\s*:\s*true\b/.test(readFileSync5(file2, "utf8"));
+  } catch {
+    return false;
+  }
+}
+var CHANGES = /* @__PURE__ */ new Map([
+  ["curl", (a) => CURL_SENDS.test(a)],
+  ["wget", (a) => !WGET_PRINTS.test(a) || WGET_SENDS.test(a)],
+  ["kubectl", (a) => verbChanges("kubectl", KUBECTL_READS, a)],
+  ["docker", (a) => verbChanges("docker", DOCKER_READS, a)],
+  ["gh", ghApiSends],
+  ["make", makeChanges],
+  ["npx", npxChanges],
+  ["npm", (a) => runsScript("npm", a)],
+  ["pnpm", (a) => runsScript("pnpm", a)],
+  ["yarn", (a) => runsScript("yarn", a)]
+]);
+function operands(words, valued) {
+  let n = 0;
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (w === "--") return n + words.length - i - 1;
+    if (w.startsWith("-") && w.length > 1) {
+      if (valued.test(w)) i++;
+    } else n++;
+  }
+  return n;
+}
+function awkRuns(words) {
+  let program;
+  for (let i = 0; i < words.length && program === void 0; i++) {
+    const w = words[i];
+    if (w === "--") program = words[i + 1];
+    else if (/^(-[fiEl]|--(file|include|load|exec))/.test(w)) return true;
+    else if (/^(-e|--source)$/.test(w)) program = words[i + 1];
+    else if (/^(-[FvW]|--(field-separator|assign))$/.test(w)) i++;
+    else if (!w.startsWith("-")) program = w;
+  }
+  return program !== void 0 && /\bsystem\s*\(|\|\s*&?\s*getline|\bprintf?\b[^;{}\n]*[>|]|@(load|include)\b/.test(program);
+}
+function sedWrites(words) {
+  const scripts = [];
+  let first;
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (w === "--") {
+      first ??= words[i + 1];
+      break;
+    }
+    if (w.startsWith("--")) {
+      const [name, value] = w.split(/=(.*)/s);
+      if (name === "--in-place" || name === "--file") return true;
+      if (name === "--expression") scripts.push(value ?? words[++i] ?? "");
+      else if (name === "--line-length" && value === void 0) i++;
+    } else if (/^-./.test(w)) {
+      for (let k = 1; k < w.length; k++) {
+        const c = w[k];
+        if (c === "i" || c === "f") return true;
+        if (c === "e" || c === "l") {
+          const value = w.slice(k + 1) || words[++i] || "";
+          if (c === "e") scripts.push(value);
+          break;
+        }
+      }
+    } else if (first === void 0) first = w;
+  }
+  if (!scripts.length && first !== void 0) scripts.push(first);
+  return scripts.some(sedScriptWrites);
+}
+function sedScriptWrites(script) {
+  if (script.length > 2048) return true;
+  let flagged = false;
+  const t = script.replace(
+    /(^|[^a-zA-Z\\])([sy])([^\\\n\sa-zA-Z0-9])((?:\\[\s\S]|(?!\3)[^\\])*)\3((?:\\[\s\S]|(?!\3)[^\\])*)\3([a-zA-Z0-9]*)/g,
+    (_m, pre, cmd, _d, _a, _b, flags) => {
+      if (cmd === "s" && /[we]/.test(flags)) flagged = true;
+      return `${pre};`;
+    }
+  ).replace(/\/(?:\\[\s\S]|[^/\\\n])*\//g, ";");
+  return flagged || /(?:^|[^a-zA-Z_.-])(?:[wW]|e(?![a-zA-Z]))/.test(t);
+}
+var FLAG_WRITES = /* @__PURE__ */ new Map([
+  // `--pre cmd` runs cmd on every file searched
+  ["rg", (w) => w.some((x) => /^--pre(-glob)?(=|$)/.test(x))],
+  ["git", gitRunsOrWrites],
+  ["find", (w) => w.some((x) => /^-(delete|exec|execdir|ok|okdir|fprint0?|fprintf|fls)$/.test(x))],
+  ["tree", (w) => w.some((x) => /^(-[a-zA-Z]*o|--output)/.test(x))],
+  ["sed", sedWrites],
+  ["gsed", sedWrites],
+  ["awk", awkRuns],
+  ["gawk", awkRuns],
+  ["mawk", awkRuns],
+  ["nawk", awkRuns],
+  ["sort", (w) => w.some((x) => /^(-[a-zA-Z]*o|--output(=|$))/.test(x))],
+  // `uniq IN OUT` and `xxd IN OUT` write OUT
+  ["uniq", (w) => operands(w, /^(-[fsw]|--(skip-fields|skip-chars|check-chars))$/) > 1],
+  ["xxd", (w) => operands(w, /^-(c|g|l|o|s|n|cols|groupsize|len|offset|seek|name)$/) > 1],
+  ["yq", (w) => w.some((x) => /^(-[a-zA-Z]*i[a-zA-Z]*|--inplace)(=|$)/.test(x))]
+]);
+function gitRunsOrWrites(words) {
+  let i = 0;
+  for (; i < words.length && words[i].startsWith("-"); i++) {
+    const w = words[i];
+    if (/^(-c|--config-env|--exec-path=)/.test(w)) return true;
+    if (/^(-C|--git-dir|--work-tree|--namespace|--super-prefix)$/.test(w)) i++;
+  }
+  const sub = words[i];
+  const rest = words.slice(i + 1);
+  if (sub === "difftool" || sub === "mergetool") return true;
+  if (rest.some((w) => /^--(output|ext-diff)(=|$)/.test(w))) return true;
+  return sub === "grep" && rest.some((w) => /^(-[a-zA-Z]*O|--open-files-in-pager)/.test(w));
+}
+var GIT_ENV = /(?:^|\s)GIT_(?:EXTERNAL_DIFF|PAGER|EDITOR|SEQUENCE_EDITOR|SSH|SSH_COMMAND|ASKPASS|PROXY_COMMAND|EXEC_PATH|CONFIG\w*|TRACE\w*|DIFF_OPTS|TEMPLATE_DIR)=/;
+var ARITHMETIC = /\$\(\(([^()`]*)\)\)/g;
+function substitutions(segment) {
+  const found = [];
+  const inner = /[$<>]\(([^()]*)\)|`([^`]*)`/g;
+  let s = segment.replace(ARITHMETIC, "_");
+  for (let level = 0; ; level++) {
+    const next = s.replace(inner, (_, a, b) => {
+      found.push(a ?? b ?? "");
+      return "_";
+    });
+    if (next === s) break;
+    if (level >= MAX_STEPS) return void 0;
+    s = next;
+  }
+  return /[$<>]\(/.test(s) ? void 0 : found;
+}
+function staysNative(segment, cwd) {
+  if (WRITES_FILE.test(segment)) return true;
+  if (GLUED_WRITE.test(segment.replace(/'[^']*'|"(?:[^"\\]|\\.)*"/g, "''"))) return true;
+  return pipeStages(segment).some((stage, i) => {
+    const plain = stage.replace(SHELL_WORDS, "");
+    if (plain.includes("GIT_") && GIT_ENV.test(plain)) return true;
+    const cmd = stripRunners(plain).replace(/^\S*\//, "");
+    const [, quoted = "", args = ""] = /^(\S+)([\s\S]*)$/.exec(cmd) ?? [];
+    const tool = quoted.replace(/['"\\]/g, "");
+    const named = tool + args;
+    const bare = /^(npm|pnpm|yarn)$/.test(tool) ? `${tool} ${afterOptions(tool, args).join(" ")}` : named;
+    return MUTATING.test(named) || MUTATING.test(bare) || (/^(?:kubectl|docker|tail)(?![^\s])/.test(named) || named.includes("--watch")) && FOLLOWS.test(named) || i > 0 && RUNS_STDIN.test(named) || CHANGES.get(tool)?.(args, cwd) === true || FLAG_WRITES.get(tool)?.(shellWords(args)) === true;
+  });
+}
+var READ_ONLY = /^(?:(?:cd|pushd|popd|pwd|true|false|:|test|\[|sleep|echo|printf|ls|tree|cat|head|tail|wc|grep|egrep|fgrep|rg|sort|uniq|cut|tr|nl|column|awk|sed|jq|yq|diff|cmp|du|df|stat|file|which|type|date|basename|dirname|realpath|readlink|ps|lsof|strings|xxd|od|find)|git\s+(?:(?:-[Cc]\s*[^-\s]\S*|--no-pager)\s+)*(?:diff|log|show|status|ls-files|ls-tree|grep|blame|branch(?=\s*$|\s+(?:-[avr]+|--(?:list|show-current|merged|no-merged|contains))(?:\s|$))|rev-list|rev-parse|for-each-ref|cat-file|describe|shortlog|reflog|merge-base|name-rev|config\s+(?:--(?:global|local|system|worktree)\s+)*(?:--get\S*|--list|-l)))(?![\w-])/;
+var TOOL_READS = {
+  gh: (a) => /^\s+(?:api|(?:pr|issue|run|search|repo|release)\s+(?:list|view|diff|checks|status))\b/.test(a),
+  npm: (a) => /^(?:test|t|run|run-script|ls|ll|list|outdated|view|show|info|why|explain|audit|root|bin|prefix|help)$/.test(
+    afterOptions("npm", a)[0] ?? ""
+  ),
+  pnpm: (a) => afterOptions("pnpm", a).length > 0,
+  yarn: (a) => afterOptions("yarn", a).length > 0
+  // bare `yarn` installs
+};
+function readsOnly(segment, cwd) {
+  return pipeStages(segment).every((stage) => {
+    const cmd = stripRunners(stage.replace(SHELL_WORDS, "")).replace(/^\S*\//, "");
+    const [, tool = "", args = ""] = /^(\S+)([\s\S]*)$/.exec(cmd) ?? [];
+    if (/(?:^|\s)--output(?=[\s=]|$)/.test(args) || tool === "sort" && /\s-\w*o\b/.test(args))
+      return false;
+    if (CHANGES.has(tool)) return TOOL_READS[tool]?.(args) ?? !CHANGES.get(tool)(args, cwd);
+    return READ_ONLY.test(cmd);
+  });
 }
 var READ_LIMIT = 200 * 1024;
 var BIG_TEXT_LIMIT = 20 * 1024;
@@ -2665,13 +3237,13 @@ function fileOperands(stage, cwd) {
     }
     files.push(t);
   }
-  if (!files.length) return void 0;
+  if (!files.length || files.length > MAX_OPERANDS) return void 0;
   const out = [];
   for (let f of files) {
     if (/[*?[\]{}$`\\]/.test(f)) return void 0;
     f = f.replace(/^['"]|['"]$/g, "");
     if (f.startsWith("~/")) f = join7(homedir2(), f.slice(2));
-    out.push(resolve2(cwd, f));
+    out.push(resolve3(cwd, f));
   }
   return out;
 }
@@ -2709,66 +3281,99 @@ function firstStageBound(first, cwd) {
     const bytes = stageBytes(first, cwd);
     if (bytes === void 0) return void 0;
     if (bytes <= READ_LIMIT) return true;
-    return { rule: "big-read", text: `reads about ${Math.round(bytes / 1024)} KB` };
+    return {
+      rule: "big-read",
+      text: `reads about ${Math.round(bytes / 1024)} KB`
+    };
   }
   return void 0;
 }
+var READ_SOURCE = /^\s*(ls|cat|sed|awk|cut|sort|uniq|tr|nl|echo|printf|ps|lsof|jq|yq|diff|strings|xxd|od|git\s+(diff|ls-files|ls-tree|grep|status|show|log|blame|branch|rev-list|for-each-ref|cat-file)|gh\s+(api|pr\s+(list|view|diff|checks)|issue\s+(list|view)|run\s+(list|view)|search))\b/;
+var FILTERS = /^\s*(grep|egrep|fgrep|rg|sort|uniq|jq|head|tail|wc|cut|tr|column|less|awk|sed|python3?\s+-m\s+json\.tool)\b/;
+var UNBOUNDED_FILTERS = /^\s*(grep|rg|sort|uniq|jq|less)\b/;
 function heavySegment(segment, cwd) {
   if (TINY_BASH.test(segment)) return void 0;
   const stages = pipeStages(segment);
   const first = stages[0];
   if (!first) return void 0;
   if (stages.length > 1 && bounds(stages[stages.length - 1])) return void 0;
+  const rest = stages.slice(1);
+  if (!rest.every((s) => FILTERS.test(s))) return void 0;
   const bound = firstStageBound(first, cwd);
   if (bound === true) return void 0;
   if (bound) return bound;
   if (HEAVY_BASH.test(first)) return { rule: "heavy", text: "usually prints a lot" };
-  if (stages.slice(1).some((s) => /^\s*(grep|rg|sort|uniq|jq|less)\b/.test(s)))
-    return { rule: "pipe", text: "streams an unbounded output through a filter" };
+  if (READ_SOURCE.test(first) && rest.some((s) => UNBOUNDED_FILTERS.test(s)))
+    return {
+      rule: "pipe",
+      text: "streams an unbounded output through a filter"
+    };
   return void 0;
 }
 function headOf(segment, n = 60) {
   const one = segment.replace(/\s+/g, " ").trim();
   return one.length > n ? `${one.slice(0, n - 1)}\u2026` : one;
 }
-function bashSuggestion(raw, cwd) {
+function bashSuggestion(raw, root, cwd) {
+  if (raw.length > MAX_RAW) return void 0;
   const cmd = withoutHeredocs(raw);
   if (!cmd.trim()) return void 0;
+  if (cmd.length > MAX_CLASSIFIED) return void 0;
   const segments = commandSegments(cmd);
-  if (segments.some(mutates)) return void 0;
+  if (segments.length > MAX_SEGMENTS) return void 0;
+  const subs = substitutions(cmd);
+  if (!subs) return void 0;
+  if ([...segments, ...subs.flatMap(commandSegments)].some((s) => staysNative(s, cwd)))
+    return void 0;
+  if (segments.length > 1 && !segments.every((s) => readsOnly(s, cwd))) return void 0;
   const history = historyCall(cmd);
-  if (history) {
+  const dir = history && historyDir(segments, cwd);
+  if (history && dir && !sameRepo(root, dir)) return void 0;
+  if (history && dir && inRootRepo(root, dir)) {
     return {
       tool: "em_history",
       rule: "history",
       reason: `the git history is already classified (commit kinds, fixes traced to the change that caused them, risk per file); em_history ${history} answers this without the raw log`
     };
   }
+  let at = cwd;
+  let steps = 0;
   for (const segment of segments) {
-    const heavy = heavySegment(segment, cwd);
-    if (!heavy) continue;
-    return {
-      tool: "em_execute",
-      rule: heavy.rule,
-      reason: `\`${headOf(segment)}\` ${heavy.text}; em_execute {language:"shell", code, intent} keeps the output out of context and returns only matching sections`
-    };
+    const heavy = heavySegment(segment, at ?? cwd);
+    if (heavy)
+      return {
+        tool: "em_execute",
+        rule: heavy.rule,
+        reason: `\`${headOf(segment)}\` ${heavy.text}; em_execute {language:"shell", code, intent} keeps the output out of context and returns only matching sections`
+      };
+    const cd = CD.exec(segment);
+    if (cd) at = ++steps > MAX_STEPS ? void 0 : at && changeDir(at, cd[1]);
   }
   return void 0;
 }
+function executeFileTakes(root, fp) {
+  try {
+    const real = realpathSync3(root);
+    confinePath(real, resolve3(root, fp), loadPermissionRules(real));
+    return true;
+  } catch {
+    return false;
+  }
+}
 function suggest(toolName, input, root, extra = {}) {
   switch (toolName) {
     case "Bash":
-      return bashSuggestion(String(input.command ?? ""), extra.cwd ?? root);
+      return bashSuggestion(String(input.command ?? ""), root, extra.cwd ?? root);
     case "Read": {
       const fp = String(input.file_path ?? "");
       if (!fp) return void 0;
+      if (input.offset != null || input.limit != null) return void 0;
       const ext = extname(fp).toLowerCase();
       if (VISUAL_EXT.has(ext)) return void 0;
       try {
-        const abs = resolve2(root, fp);
-        const st = statSync3(abs);
+        const st = statSync3(resolve3(root, fp));
         if (st.size > 200 * 1024 || BIG_TEXT_EXT.has(ext) && st.size > 20 * 1024) {
-          if (!checkReadPath(loadPermissionRules(root), abs).allowed) return void 0;
+          if (!executeFileTakes(root, fp)) return void 0;
           return {
             tool: "em_execute_file",
             rule: "big-read",
@@ -2835,12 +3440,12 @@ function subagentPrefix(shell) {
 }
 function projectRel(ctx, fp) {
   if (!fp) return void 0;
-  let abs = resolve2(ctx.root, fp);
+  let abs = resolve3(ctx.root, fp);
   try {
-    abs = realpathSync2(abs);
+    abs = realpathSync3(abs);
   } catch {
   }
-  const rel = relative(ctx.root, abs).split("\\").join("/");
+  const rel = relative2(ctx.root, abs).split("\\").join("/");
   return rel.startsWith("..") ? void 0 : rel;
 }
 function graphContext(ctx, input) {
@@ -2871,7 +3476,11 @@ function fileKnowledge(ctx, input) {
     const repeatAfter = ctx.config.recall.repeatAfter;
     const edit = EDIT_TOOLS.has(input.tool_name ?? "");
     const results = [
-      memoriesForFile(db, rel, { sessionId, symbols: fileSymbols(db, rel), repeatAfter }),
+      memoriesForFile(db, rel, {
+        sessionId,
+        symbols: fileSymbols(db, rel),
+        repeatAfter
+      }),
       fileContext(db, rel, { sessionId, edit, repeatAfter })
     ];
     const shown = results.filter((r) => r.text);
@@ -2921,7 +3530,11 @@ async function webKnowledge(ctx, input) {
   if (!text.trim()) return void 0;
   try {
     const db = getStorage(ctx, { vectors: false });
-    const r = await recallForText(db, text, { maxMemories: 0, maxDocs: 3, path: "web" });
+    const r = await recallForText(db, text, {
+      maxMemories: 0,
+      maxDocs: 3,
+      path: "web"
+    });
     if (!r.text) return void 0;
     const pages = r.text.split("\n").filter((l) => l.startsWith("- docs:"));
     return [
@@ -2939,7 +3552,12 @@ function joinHints(...hints) {
 function withContext(out, extra) {
   if (!extra) return out;
   if (!out)
-    return { hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: extra } };
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: extra
+      }
+    };
   const cur = out.hookSpecificOutput?.additionalContext;
   return {
     ...out,
@@ -2981,7 +3599,10 @@ async function route(ctx, input, swarmWorker) {
   const graph = graphContext(ctx, input);
   const hint = joinHints(graph, memo);
   const symbol = input.tool_name === "Grep" && graph ? literalOf(String(input.tool_input.pattern ?? "")) : void 0;
-  const s = suggest(input.tool_name, input.tool_input, ctx.root, { symbol, cwd: input.cwd });
+  const s = suggest(input.tool_name, input.tool_input, ctx.root, {
+    symbol,
+    cwd: input.cwd
+  });
   const record = routingRecorder(ctx, input, s);
   if (!s) {
     record("allow");
@@ -3101,12 +3722,12 @@ function annotate(s, note = "") {
 
 // src/hooks/session-start.ts
 init_esm_shims();
-import { appendFileSync, existsSync as existsSync6, readdirSync as readdirSync4 } from "fs";
+import { appendFileSync, existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
 import { join as join9 } from "path";
 
 // src/session/current.ts
 init_esm_shims();
-import { readFileSync as readFileSync5, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
+import { readFileSync as readFileSync6, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
 import { join as join8 } from "path";
 function file(ctx) {
   return join8(projectDir(ctx.id), "current-session");
@@ -3220,7 +3841,7 @@ ${guide}`);
   }
   try {
     const onboarding = join9(memoriesDir(ctx), "onboarding");
-    const onboarded = existsSync6(onboarding) && readdirSync4(onboarding).some((f) => f.endsWith(".md"));
+    const onboarded = existsSync8(onboarding) && readdirSync4(onboarding).some((f) => f.endsWith(".md"));
     if (!onboarded)
       parts.push(
         "No onboarding memories yet: run /eminiar:em-onboard once so future sessions start with the project's structure, build and test commands."
@@ -3234,7 +3855,7 @@ ${guide}`);
   } catch {
   }
   try {
-    if (existsSync6(join9(ctx.root, ".git")) && !db.metaGet("history_files"))
+    if (existsSync8(join9(ctx.root, ".git")) && !db.metaGet("history_files"))
       parts.push(
         'Git history is not classified yet: em_history {action:"overview"} builds it (the server also does this in the background shortly after start); bug-prone files are flagged before you read or edit them once it exists.'
       );
@@ -3279,8 +3900,8 @@ function ranLate() {
 }
 async function runWithin(handler, input, ms) {
   let timer;
-  const deadline = new Promise((resolve3) => {
-    timer = setTimeout(() => resolve3("late"), ms);
+  const deadline = new Promise((resolve4) => {
+    timer = setTimeout(() => resolve4("late"), ms);
   });
   try {
     const r = await Promise.race([handler(input), deadline]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eminiar",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Local-first context, memory and knowledge-graph plugin for Claude Code and Cursor. Sandboxed execution, FTS5 + vector search, session continuity, and a code graph — nothing leaves your machine.",
   "type": "module",
   "license": "MIT",