glimmervoid 0.29.1 → 0.30.0

package/README.md

@@ -17,28 +17,26 @@ Glimmervoid is developed inside Glimmervoid.
 
 ## Quickstart
 
-Until the `glimmervoid` npm package is published, run the tarball attached to the latest GitHub release. Windows and macOS:
+Windows and macOS:
 
 ```bash
-npx --allow-remote=root --allow-scripts=node-pty https://github.com/johncwaters/glimmervoid/releases/latest/download/glimmervoid.tgz
+npx glimmervoid@latest
 ```
 
-Linux (node-pty ships no Linux prebuilds, so it compiles at install time):
+Linux (node-pty ships no Linux prebuilds, so it compiles at install time, and npm runs that build only when allowed):
 
 ```bash
 sudo apt install build-essential python3 git
-npx --allow-remote=root --allow-scripts=node-pty https://github.com/johncwaters/glimmervoid/releases/latest/download/glimmervoid.tgz
+npx --allow-scripts=node-pty glimmervoid@latest
 ```
 
-To upgrade, run the versioned command the dashboard's update banner shows (or the `glimmervoid-<version>.tgz` URL from the release page): npx caches by the literal command, so rerunning the command above keeps starting the version it first fetched.
-
-Once the package is published, `npm install -g glimmervoid` (plus `--allow-scripts=node-pty` on Linux) installs it globally; if that fails with `EACCES`, see [docs/troubleshooting.md](docs/troubleshooting.md#eacces-on-a-global-install) and never use `sudo npm`.
+To install it globally instead, run `npm install -g glimmervoid` (add `--allow-scripts=node-pty` on Linux); if that fails with `EACCES`, see [docs/troubleshooting.md](docs/troubleshooting.md#eacces-on-a-global-install) and never use `sudo npm`.
 
 Open http://localhost:3000. A fresh install knows no projects, so **+ Session** shows "No projects found" until you say where your repositories live: open **Settings**, then **Repositories**, and add the folder that holds your git checkouts under **Repository roots** (each subfolder becomes a project). For a one-off, **+ Session** then **Advanced options** takes a name and a path directly. That is the whole setup; everything else is optional.
 
 To check notifications, allow them when the dashboard asks (or turn on **Desktop notifications** under **Settings**, **Appearance and alerts**) and keep a dashboard tab open. A notification only appears while that tab is not focused, since a focused tab already shows the change. With no dashboard tab open anywhere, only Telegram reaches you (the `telegram` keys in [docs/configuration.md](docs/configuration.md)).
 
-Both flags matter on npm 12, which refuses tarball URLs (`EALLOWREMOTE`) and blocks dependency install scripts by default. npm 10 and 11 allow both by default (npm 11 prints a notice), so there the flags are unnecessary but harmless. If the native module still fails to load, the server refuses to start and prints the repair command; `glimmervoid doctor` runs the same check. See [docs/troubleshooting.md](docs/troubleshooting.md).
+The Linux flag matters on npm 12, which blocks dependency install scripts by default; npm 10 and 11 run them (npm 11 prints a notice), so there it is harmless. Keep `@latest` so npx checks for a new release instead of rerunning the version it cached first. If the native module still fails to load, the server refuses to start and prints the repair command; `glimmervoid doctor` runs the same check. See [docs/troubleshooting.md](docs/troubleshooting.md).
 
 ### From source
 
@@ -144,7 +142,7 @@ Remote access is off by default. It is a second loopback listener meant to sit b
    ```
 
 2. Restart Glimmervoid (stop and start it, or `systemctl --user restart glimmervoid` when it runs as a service). The log line `Glimmervoid remote listener on http://127.0.0.1:3456 (paired devices only)` confirms the listener is up.
-3. Point an HTTPS reverse proxy at that port. With Tailscale, `tailscale serve --bg 3456` serves `https://<machine>.<tailnet>.ts.net`, which is the name `publicHost` should hold.
+3. Point an HTTPS reverse proxy at that port. With Tailscale, `tailscale serve --bg 3456` serves `https://<machine>.<tailnet>.ts.net`, which is the name `publicHost` should hold. When the port is reached solely through HTTP-mode `tailscale serve`, also set `"ownerLogin": "you@example.com"` in the `remote` block: the listener then refuses every request and WebSocket whose `Tailscale-User-Login` is not that login, including Funnel and tagged-device traffic, which carry none. Only HTTP-mode `tailscale serve` strips a client-sent `Tailscale-User-Login`; behind any other proxy, or `tailscale serve --tcp` or `--tls-terminated-tcp`, a client can forge it, so `ownerLogin` proves nothing there. It works on top of pairing, never instead of it.
 4. Verify from the device: `https://<publicHost>/` should answer with Glimmervoid's "Pairing required" page.
 5. On the host, run `glimmervoid pair --name phone`. It prints a single-use URL valid for 10 minutes that sets an auth cookie when opened on the device.
 

package/dist/bin/glimmervoid.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { o as nodePtyRebuildHint, t as probeNodePty } from "../chunks/node-pty-preflight-CK1knGIR.js";
-import { a as packageRoot } from "../chunks/runtime-paths-CVvq20A4.js";
-import { t as AGENT_API_VERBS } from "../chunks/session-CJtOveHl.js";
-import { i as execSync } from "../chunks/child-process-safe-Cz22RwlG.js";
+import { a as packageRoot } from "../chunks/runtime-paths-Ci_ksSkj.js";
+import { t as AGENT_API_VERBS } from "../chunks/session-Cez8aIWg.js";
+import { i as execSync } from "../chunks/child-process-safe-DRGsp0TE.js";
 import { t as renderTable } from "../chunks/ascii-figure-core-pDAwtlKO.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "../chunks/config-path-core-DFt-TemS.js";
-import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-BwvbDBDl.js";
+import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-Dd5-kZnf.js";
 import { i as pnpmGlobalBinDir, n as npmGlobalBinDir, r as onPath, t as formatPathNotice } from "../chunks/path-doctor-C23VAqeu.js";
 import fs from "node:fs";
 import path from "node:path";
@@ -58,19 +58,19 @@ var SUBCOMMAND_RUNNERS = new Map([
 		return 0;
 	}],
 	["pair", async (commandArgs) => {
-		const { runPairCli } = await import("../chunks/pair-cli-BQQnhkkc.js");
+		const { runPairCli } = await import("../chunks/pair-cli-w-gCAF-1.js");
 		return runPairCli(commandArgs.slice(1));
 	}],
 	["agent", async (commandArgs) => {
-		const { runAgentSetupCli } = await import("../chunks/agent-setup-cli-C1CQ8Nkk.js");
+		const { runAgentSetupCli } = await import("../chunks/agent-setup-cli-B5Atxr3F.js");
 		return runAgentSetupCli(commandArgs.slice(1));
 	}],
 	["visions", async (commandArgs) => {
-		const { runVisionsCli } = await import("../chunks/visions-cli-DUZnopGY.js");
+		const { runVisionsCli } = await import("../chunks/visions-cli-BXQFIBCX.js");
 		return runVisionsCli(commandArgs.slice(1));
 	}],
 	...AGENT_API_VERBS.map((verb) => [verb, async (commandArgs) => {
-		const { runAgentApiCli } = await import("../chunks/agent-api-cli-ClOzm28U.js");
+		const { runAgentApiCli } = await import("../chunks/agent-api-cli-D0MmtEdz.js");
 		return runAgentApiCli(commandArgs);
 	}])
 ]);
@@ -118,7 +118,7 @@ async function readDeclaredCustomAgents() {
 		declared: [],
 		error: null
 	};
-	const { loadConfigFile } = await import("../chunks/config-store-DtUGwi4-.js");
+	const { loadConfigFile } = await import("../chunks/config-store-CC8T3okC.js");
 	try {
 		const loaded = loadConfigFile(decided.path, { exitOnError: false });
 		if (!loaded.config) return {
@@ -194,7 +194,7 @@ async function runDoctor() {
 	}
 	switchSection("Agents");
 	try {
-		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-DIavI9-i.js");
+		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-Dho1VSY5.js");
 		const declaredCustomAgents = await readDeclaredCustomAgents();
 		if (declaredCustomAgents.error) line("config", declaredCustomAgents.error);
 		setCustomAgents(declaredCustomAgents.declared);
@@ -202,7 +202,7 @@ async function runDoctor() {
 			const { label, path: resolvedPath } = describeAgentResolvability(id);
 			line(`${id} (${label})`, resolvedPath ?? "not found on PATH");
 		}
-		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-C1CQ8Nkk.js");
+		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-B5Atxr3F.js");
 		const grokSetup = inspectGrokAgentSetup();
 		line("grok hook setup", `${grokSetup.classification}: ${grokSetup.filePath}`);
 	} catch (err) {
@@ -210,11 +210,27 @@ async function runDoctor() {
 	}
 	switchSection("rtk");
 	try {
-		const { getRtkPath } = await import("../chunks/rtk-resolver-DDVVNRBT.js");
+		const { getRtkPath } = await import("../chunks/rtk-resolver-CMQAidlI.js");
 		line("rtk", getRtkPath() || "not installed (Glimmervoid installs it when the rtk setting is on)");
 	} catch (err) {
 		line("rtk", `probe failed: ${firstLineOf(err)}`);
 	}
+	switchSection("Sane YOLO");
+	try {
+		const { resolvePackageBin } = await import("../chunks/runtime-paths-JLrZ3wyi.js");
+		const { execFileSync } = await import("../chunks/child-process-safe-DvQjXsgz.js");
+		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-B5Atxr3F.js");
+		const binPath = resolvePackageBin("cc-safety-net", "cc-safety-net");
+		line("Sane YOLO", binPath || "not installed");
+		if (binPath) line("cc-safety-net version", execFileSync(process.execPath, [binPath, "--version"], {
+			encoding: "utf8",
+			timeout: 3e3
+		}).trim());
+		line("Codex hook trust", "Sane YOLO is inactive unless Codex trusts the injected hooks.");
+		line("Grok Sane YOLO", inspectGrokAgentSetup().saneYoloReady ? "installed" : "inactive; run glimmervoid agent setup grok");
+	} catch (err) {
+		line("Sane YOLO", `probe failed: ${firstLineOf(err)}`);
+	}
 	switchSection("Native module");
 	const nodePty = await probeNodePty();
 	if (nodePty.ok) line("node-pty", "loads OK");

package/dist/chunks/{adapters-DIavI9-i.js → adapters-Dho1VSY5.js}

@@ -1,2 +1,2 @@
-import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-Dlvu1FVB.js";
+import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-zPDx1Xox.js";
 export { describeAgentResolvability, listAgentIds, setCustomAgents };

package/dist/chunks/{adapters-Dlvu1FVB.js → adapters-zPDx1Xox.js}

@@ -1,9 +1,11 @@
-import { o as relayPath } from "./runtime-paths-CVvq20A4.js";
-import { c as PendingPromptQuestion, g as toolDetailFieldValue, h as firstDetailLine, o as PROMPT_DETAIL_HIDDEN_CHARACTERS } from "./session-CJtOveHl.js";
-import { r as execFileSync } from "./child-process-safe-Cz22RwlG.js";
+import { o as relayPath } from "./runtime-paths-Ci_ksSkj.js";
+import { _ as toolDetailFieldValue, c as PendingPromptQuestion, g as firstDetailLine, o as PROMPT_DETAIL_HIDDEN_CHARACTERS } from "./session-Cez8aIWg.js";
+import { r as execFileSync } from "./child-process-safe-DRGsp0TE.js";
 import { n as resolveAgentCommand, t as buildAgentSpawnCommand } from "./spawn-command-Cc40FiZI.js";
-import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, s as buildHookCommand, t as grok } from "./grok-COekzawt.js";
-import "./contracts-JKChPhZ0.js";
+import { i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, s as buildAgentEnv, t as grok } from "./grok-DuU8xVLZ.js";
+import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
+import "./contracts-DGkKNh9W.js";
+import { n as mergeCodexPreToolUse, t as HOOK_TOOLS } from "./hook-tools-pSJia7ks.js";
 import fs from "node:fs";
 //#region session/core/anti-slop-prompt.ts
 var ANTI_SLOP_NOTE = [
@@ -201,6 +203,7 @@ var claudeCode = {
 		resume: true,
 		statusLine: true,
 		rtk: true,
+		saneYolo: true,
 		antiSlop: true,
 		compactQuiet: true,
 		skipPermissionsFlag: true,
@@ -219,9 +222,7 @@ var claudeCode = {
 var ID = "codex";
 var COMMAND_NAME = "codex";
 var RELAY_PATH = relayPath("hook-relay");
-var RTK_RELAY_PATH = relayPath("rtk-relay");
-var RTK_HOOK_EVENT = "PreToolUse";
-var RTK_TOOL_MATCHER = "Bash";
+var HOOK_TOOL_RELAY_PATH = relayPath("hook-tool-relay");
 var HOOK_EVENTS = [
 	"SessionStart",
 	"SessionEnd",
@@ -285,17 +286,23 @@ function mayContributeHooks(configText) {
 	if (typeof configText !== "string") return false;
 	return HOOKS_DECLARATION_RE.test(configText);
 }
-function buildHookArgs({ relayPath = RELAY_PATH, events = HOOK_EVENTS, bypassHookTrust = false, rtkRewrites = false, rtkRelayPath = RTK_RELAY_PATH } = {}) {
+function buildHookArgs({ relayPath = RELAY_PATH, events = HOOK_EVENTS, bypassHookTrust = false, hookTools = [], hookToolRelayPath = HOOK_TOOL_RELAY_PATH } = {}) {
 	const args = bypassHookTrust ? [TRUST_BYPASS_FLAG] : [];
+	const preToolUseGroups = [];
 	for (const event of events) {
 		const command = buildHookCommand(relayPath, event);
 		if (!command) return null;
+		if (event === "PreToolUse") {
+			preToolUseGroups.push(`{hooks=[{type='command',command='${command}'}]}`);
+			continue;
+		}
 		args.push("-c", `hooks.${event}=[{hooks=[{type='command',command='${command}'}]}]`);
 	}
-	if (!rtkRewrites) return args;
-	const rtkCommand = buildHookCommand(rtkRelayPath, RTK_HOOK_EVENT);
-	if (!rtkCommand) return args;
-	args.push("-c", `hooks.${RTK_HOOK_EVENT}=[{matcher='${RTK_TOOL_MATCHER}',hooks=[{type='command',command='${rtkCommand}'}]}]`);
+	const groups = hookTools.flatMap((tool) => {
+		const group = HOOK_TOOLS[tool.id].codexGroup(tool, hookToolRelayPath);
+		return group ? [group] : [];
+	});
+	args.push(...mergeCodexPreToolUse([...preToolUseGroups, ...groups]));
 	return args;
 }
 var hooks = {
@@ -368,7 +375,7 @@ var codex = {
 	sessionIdOf,
 	HOOK_EVENTS,
 	RELAY_PATH,
-	RTK_RELAY_PATH,
+	HOOK_TOOL_RELAY_PATH,
 	TRUST_BYPASS_FLAG,
 	SKIP_PERMISSIONS_ARGS,
 	UPDATE_CHECK_ARGS,
@@ -379,6 +386,7 @@ var codex = {
 		resume: true,
 		statusLine: false,
 		rtk: true,
+		saneYolo: true,
 		antiSlop: false,
 		compactQuiet: false,
 		skipPermissionsFlag: true,
@@ -398,6 +406,7 @@ var TITLE_ONLY_CAPABILITIES = Object.freeze({
 	resume: false,
 	statusLine: false,
 	rtk: false,
+	saneYolo: false,
 	antiSlop: false,
 	compactQuiet: false,
 	skipPermissionsFlag: false,

package/dist/chunks/{agent-api-cli-ClOzm28U.js → agent-api-cli-D0MmtEdz.js}

@@ -1,6 +1,6 @@
-import { n as AGENT_URL_ENV } from "./session-CJtOveHl.js";
+import { n as AGENT_URL_ENV } from "./session-Cez8aIWg.js";
 import { i as resolveHookTarget } from "./hook-relay-core-BHfYFnYV.js";
-import { a as isAgentApiVerb } from "./agent-api-core-D6LHrpSL.js";
+import { a as isAgentApiVerb } from "./agent-api-core-Dz0r21y9.js";
 //#region server/agent-api-cli.ts
 var AGENT_PATH_PREFIX = "/agent/";
 var BODY_BUILDERS = {

package/dist/chunks/{agent-api-core-D6LHrpSL.js → agent-api-core-Dz0r21y9.js}

@@ -1,4 +1,4 @@
-import { a as AgentSpawnRequest, i as AgentAttentionRequest, t as AGENT_API_VERBS } from "./session-CJtOveHl.js";
+import { a as AgentSpawnRequest, i as AgentAttentionRequest, t as AGENT_API_VERBS } from "./session-Cez8aIWg.js";
 import crypto from "node:crypto";
 var MAX_SPAWNS_IN_FLIGHT = 1;
 var SPAWNABLE_DEPTH = 0;

package/dist/chunks/{agent-setup-cli-C1CQ8Nkk.js → agent-setup-cli-B5Atxr3F.js}

@@ -1,4 +1,4 @@
-import { a as classifyGrokHooksFile, o as renderGrokHooksFile, t as grok } from "./grok-COekzawt.js";
+import { a as classifyGrokHooksFile, o as renderGrokHooksFile, t as grok } from "./grok-DuU8xVLZ.js";
 import fs from "node:fs";
 import path from "node:path";
 import crypto from "node:crypto";
@@ -15,6 +15,7 @@ function setupInputs(env = process.env) {
 	return {
 		filePath: grok.hooksFilePath(env),
 		relayPath: grok.RELAY_PATH,
+		hookToolRelayPath: grok.HOOK_TOOL_RELAY_PATH,
 		events: grok.HOOK_EVENTS,
 		managedEventSets: grok.MANAGED_HOOK_EVENT_SETS
 	};
@@ -37,7 +38,8 @@ function inspectGrokAgentSetup({ env = process.env, readFileSync = fs.readFileSy
 	}
 	return {
 		filePath: inputs.filePath,
-		classification: classifyGrokHooksFile(contents, inputs)
+		classification: classifyGrokHooksFile(contents, inputs),
+		saneYoloReady: contents === renderGrokHooksFile(inputs)
 	};
 }
 function assertRealDirectory(directory, fileSystem, requireOwnership = true) {
@@ -96,7 +98,7 @@ function runGrokSetup({ env, fileSystem, log, error }) {
 		env,
 		readFileSync: fileSystem.readFileSync
 	});
-	if (inspection.classification === "current") {
+	if (inspection.classification === "current" && inspection.saneYoloReady) {
 		log(`Grok hooks are already current at ${inputs.filePath}`);
 		return 0;
 	}

package/dist/chunks/{child-process-safe-Cz22RwlG.js → child-process-safe-DRGsp0TE.js}

@@ -66,4 +66,4 @@ function spawn(file, ...rest) {
 }
 var execFileAsync = promisify(execFile);
 //#endregion
-export { spawn as a, execSync as i, execFileAsync as n, execFileSync as r, execFile as t };
+export { hide as a, execSync as i, execFileAsync as n, spawn as o, execFileSync as r, execFile as t };

package/dist/chunks/child-process-safe-DvQjXsgz.js

@@ -0,0 +1,2 @@
+import { r as execFileSync } from "./child-process-safe-DRGsp0TE.js";
+export { execFileSync };

package/dist/chunks/config-store-CC8T3okC.js

@@ -0,0 +1,2 @@
+import { c as loadConfigFile } from "./config-store-mm7MgzoL.js";
+export { loadConfigFile };

package/dist/chunks/{config-store-DtPUFVaO.js → config-store-mm7MgzoL.js}

@@ -1,5 +1,5 @@
 import { n as glimmervoidHomeDir$1, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
-import { I as TELEMETRY_KILL_SWITCH_FLAG, N as FeatureFlagsResponse, R as AGENT_ID_SHAPE_MESSAGE, U as RUNTIME_CONFIG_SCALAR_KEYS, V as Config, W as configIssueMessage, q as BranchGcFileSettings, z as BUILTIN_AGENT_IDS } from "./contracts-JKChPhZ0.js";
+import { I as TELEMETRY_KILL_SWITCH_FLAG, N as FeatureFlagsResponse, R as AGENT_ID_SHAPE_MESSAGE, U as RUNTIME_CONFIG_SCALAR_KEYS, V as Config, W as configIssueMessage, q as BranchGcFileSettings, z as BUILTIN_AGENT_IDS } from "./contracts-DGkKNh9W.js";
 import { r as SOURCE_NAMES } from "./ingest-core-DWI1Mbu4.js";
 import fs from "node:fs";
 import path from "node:path";
@@ -899,6 +899,12 @@ var DEFAULT_CONFIG = {
 	recordSignals: true,
 	trace: { enabled: true },
 	planReview: { enabled: true },
+	taskTitle: { refiner: {
+		enabled: true,
+		model: "haiku",
+		minIntervalSeconds: 60,
+		timeoutSeconds: 60
+	} },
 	changeMap: { narrator: {
 		enabled: false,
 		engine: "claude",
@@ -913,6 +919,7 @@ var DEFAULT_CONFIG = {
 	skipPermissionsByDefault: false,
 	antiSlopPrompt: false,
 	rtk: false,
+	saneYolo: true,
 	telegramNotifications: false,
 	integrationBranch: null,
 	worktreeRoot: "",
@@ -1269,6 +1276,7 @@ function createConfigStore({ settingsDefaults } = {}) {
 			telemetryForcedOff: isTelemetryForcedOff(process.env),
 			antiSlopPrompt: config.antiSlopPrompt ?? effectiveDefaults.antiSlopPrompt,
 			rtk: config.rtk ?? effectiveDefaults.rtk,
+			saneYolo: config.saneYolo ?? effectiveDefaults.saneYolo,
 			checkForUpdates: config.checkForUpdates ?? effectiveDefaults.checkForUpdates,
 			updateChannel: config.updateChannel ?? effectiveDefaults.updateChannel,
 			autoResume: config.autoResume ?? effectiveDefaults.autoResume,
@@ -1278,6 +1286,7 @@ function createConfigStore({ settingsDefaults } = {}) {
 			worktreeRoot: config.worktreeRoot ?? effectiveDefaults.worktreeRoot,
 			worktreeShare: config.worktreeShare ?? effectiveDefaults.worktreeShare,
 			repoRoots: config.repoRoots,
+			taskTitle: config.taskTitle ? { ...config.taskTitle } : { ...DEFAULT_CONFIG.taskTitle },
 			changeMap: config.changeMap ? { ...config.changeMap } : null,
 			branchGc: { ...config.branchGc },
 			postTurnChecks: config.postTurnChecks ? { ...config.postTurnChecks } : { ...DEFAULT_CONFIG.postTurnChecks },
@@ -1318,6 +1327,7 @@ function createConfigStore({ settingsDefaults } = {}) {
 		config.repoRoots = newConfig.repoRoots || [];
 		if (newConfig.postTurnChecks != null) config.postTurnChecks = newConfig.postTurnChecks;
 		if (newConfig.worktreeShare != null) config.worktreeShare = newConfig.worktreeShare;
+		if (newConfig.taskTitle != null) config.taskTitle = newConfig.taskTitle;
 		if (newConfig.changeMap != null) config.changeMap = newConfig.changeMap;
 		if (newConfig.branchGc != null) config.branchGc = resolveBranchGc(newConfig.branchGc);
 		if (newConfig.visions != null) config.visions = newConfig.visions;
@@ -1331,6 +1341,8 @@ function createConfigStore({ settingsDefaults } = {}) {
 		if (newConfig.telemetry != null) config.telemetry = newConfig.telemetry;
 		if (newConfig.workflows == null) delete config.workflows;
 		if (newConfig.workflows != null) config.workflows = newConfig.workflows;
+		if (newConfig.coder == null) delete config.coder;
+		if (newConfig.coder != null) config.coder = newConfig.coder;
 		config.customAgents = newConfig.customAgents ?? [];
 		config.hooks = Array.isArray(newConfig.hooks) ? newConfig.hooks : [];
 		if (newConfig.port != null && newConfig.port !== config.port) console.log(`[settings] Port changed to ${newConfig.port} - restart required to take effect`);

package/dist/chunks/{contracts-JKChPhZ0.js → contracts-DGkKNh9W.js}

@@ -1,4 +1,4 @@
-import { d as SessionState, l as PendingWakeup, p as TaskTitle, s as PendingPromptDetail, u as SessionSnapshot } from "./session-CJtOveHl.js";
+import { d as SessionSnapshot, f as SessionState, l as PendingWakeup, m as TaskTitle, s as PendingPromptDetail } from "./session-Cez8aIWg.js";
 import path from "node:path";
 import { z } from "zod";
 //#region shared/settings-ranges.ts
@@ -360,6 +360,10 @@ var TeamReviewThread = z.object({
 	viewerCanResolve: z.boolean(),
 	isNit: z.boolean(),
 	url: z.string().url(),
+	viewerComment: z.string().max(1500).optional(),
+	lastReplyBody: z.string().max(1500).optional(),
+	viewerCommentTruncated: z.boolean().optional(),
+	lastReplyTruncated: z.boolean().optional(),
 	lastReplyAuthor: z.string(),
 	lastReplyAt: z.string().datetime(),
 	judgement: TeamReviewThreadResult.extend({
@@ -1040,6 +1044,16 @@ var ChangeMapSettings = optionalObject("changeMap", { narrator: optionalObject("
 	model: optionalString("changeMap.narrator.model", true),
 	timeoutSeconds: optionalInteger("changeMap.narrator.timeoutSeconds", CHANGE_MAP_NARRATOR_TIMEOUT_RANGE)
 }) });
+var TaskTitleSettings = z.object({ refiner: z.object({
+	enabled: optionalBoolean("taskTitle.refiner.enabled"),
+	model: optionalString("taskTitle.refiner.model", true),
+	minIntervalSeconds: optionalNumber("taskTitle.refiner.minIntervalSeconds", { min: 0 }),
+	timeoutSeconds: optionalNumber("taskTitle.refiner.timeoutSeconds", {
+		min: 0,
+		exclusiveMin: true,
+		max: 2147483647 / 1e3
+	})
+}, { error: "taskTitle.refiner must be an object" }).nullable().optional() }, { error: "taskTitle must be an object" }).nullable().optional();
 var BRANCH_GC_SETTINGS_SHAPE = {
 	enabled: optionalBoolean("branchGc.enabled"),
 	worktrees: optionalBoolean("branchGc.worktrees"),
@@ -1161,6 +1175,7 @@ var createBrowserConfigShape = (isAbsolutePath) => ({
 	recordSignals: optionalBoolean("recordSignals"),
 	antiSlopPrompt: optionalBoolean("antiSlopPrompt"),
 	rtk: optionalBoolean("rtk"),
+	saneYolo: optionalBoolean("saneYolo"),
 	skipPermissionsByDefault: optionalBoolean("skipPermissionsByDefault"),
 	checkForUpdates: optionalBoolean("checkForUpdates"),
 	updateChannel: z.enum(["release", "main"], { error: "updateChannel must be one of release, main" }).optional(),
@@ -1171,6 +1186,7 @@ var createBrowserConfigShape = (isAbsolutePath) => ({
 	worktreeShare: z.array(z.string()).optional(),
 	repoRoots: z.array(z.string()).optional(),
 	changeMap: ChangeMapSettings,
+	taskTitle: TaskTitleSettings,
 	branchGc: BranchGcSettings,
 	postTurnChecks: PostTurnChecksSettings,
 	visions: VisionsSettings,
@@ -1257,6 +1273,7 @@ var FILE_CONFIG_SHAPE = {
 	...BROWSER_CONFIG_SHAPE,
 	changeMap: ChangeMapSettings,
 	branchGc: optionalLooseObject("branchGc"),
+	coder: z.object({ appSlug: z.string().optional() }).loose().optional(),
 	visions: optionalLooseObject("visions"),
 	teamReview: optionalLooseObject("teamReview"),
 	benchmarks: optionalLooseObject("benchmarks"),
@@ -1283,7 +1300,8 @@ var Config = z.object({
 		enabled: z.boolean().optional(),
 		port: z.number().int().min(1).max(65535).nullable().optional(),
 		publicHost: z.string().optional(),
-		allowedOrigins: z.array(z.string()).optional()
+		allowedOrigins: z.array(z.string()).optional(),
+		ownerLogin: z.string().optional()
 	}).passthrough().optional(),
 	projects: z.array(ProjectConfig)
 }).passthrough().superRefine((config, ctx) => {
@@ -1308,6 +1326,7 @@ var Config = z.object({
 Object.freeze(Object.keys(BROWSER_CONFIG_SHAPE));
 var CONFIG_BLOCK_KEYS = Object.freeze([
 	"changeMap",
+	"taskTitle",
 	"branchGc",
 	"postTurnChecks",
 	"visions",
@@ -1319,7 +1338,8 @@ var CONFIG_BLOCK_KEYS = Object.freeze([
 	"ingest",
 	"agentApi",
 	"telemetry",
-	"workflows"
+	"workflows",
+	"coder"
 ]);
 var CONFIG_SCALAR_KEYS = Object.freeze(Object.keys(BROWSER_CONFIG_SHAPE).filter((key) => {
 	if (CONFIG_BLOCK_KEYS.includes(key)) return false;
@@ -2143,6 +2163,7 @@ var SessionCardFields = z.object({
 	state: SessionState,
 	stateSince: timestamp,
 	skipPerms: z.boolean(),
+	saneYolo: z.boolean(),
 	worktree: z.boolean(),
 	workspace: z.boolean().optional(),
 	resumeSessionId: nullableString,
@@ -2552,6 +2573,7 @@ var serverVariants = [
 		event: z.string(),
 		timestamp,
 		skipPerms: z.boolean().optional(),
+		saneYolo: z.boolean().optional(),
 		hasEndedTurn: z.boolean().optional()
 	}),
 	loose("session-added", SessionCardFields.shape),

package/dist/chunks/{grok-COekzawt.js → grok-DuU8xVLZ.js}

@@ -1,6 +1,8 @@
-import { o as relayPath } from "./runtime-paths-CVvq20A4.js";
-import { n as AGENT_URL_ENV } from "./session-CJtOveHl.js";
+import { o as relayPath } from "./runtime-paths-Ci_ksSkj.js";
+import { n as AGENT_URL_ENV } from "./session-Cez8aIWg.js";
 import { t as HOOK_URL_ENV } from "./hook-relay-core-BHfYFnYV.js";
+import { a as SANE_YOLO_PATH_ENV, n as RTK_PATH_ENV, o as saneYoloEnv } from "./rtk-hook-core-Bl6gYHPN.js";
+import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -9,8 +11,17 @@ var GLIMMERVOID_SCRUB_KEYS = [
 	"GLIMMERVOID_PORT",
 	"GLIMMERVOID_CONFIG",
 	HOOK_URL_ENV,
-	AGENT_URL_ENV
+	AGENT_URL_ENV,
+	RTK_PATH_ENV,
+	SANE_YOLO_PATH_ENV,
+	...[
+		"GLIMMERVOID_POSTHOG_API_KEY",
+		"GLIMMERVOID_TELEGRAM_BOT_TOKEN",
+		"GLIMMERVOID_CLAUDE_OAUTH_TOKEN"
+	]
 ];
+var SANE_YOLO_GUARD_KEYS = [SANE_YOLO_PATH_ENV, ...Object.keys(saneYoloEnv(""))];
+var SAFETY_NET_ENV_PREFIXES = ["CC_SAFETY_NET_", "SAFETY_NET_"];
 var LAUNCHING_TERMINAL_IDENTITY_KEYS = ["TERM_PROGRAM", "TERM_PROGRAM_VERSION"];
 function normalizePathEntry(entry) {
 	return entry.replace(/\\/g, "/").toLowerCase();
@@ -46,29 +57,29 @@ function prependPathDir(env, prependPathDirValue) {
 	}
 	env[pathKey] = `${prependPathDirValue}${path.delimiter}${existingPath}`;
 }
+function isSafetyNetKey(key) {
+	const upperKey = key.toUpperCase();
+	return SAFETY_NET_ENV_PREFIXES.some((prefix) => upperKey.startsWith(prefix));
+}
+function isSaneYoloGuarded(extraEnv) {
+	if (!extraEnv) return false;
+	return SANE_YOLO_GUARD_KEYS.some((key) => extraEnv[key] !== void 0);
+}
+function scrubInheritedSafetyNetEnv(env) {
+	for (const key of Object.keys(env)) if (isSafetyNetKey(key)) delete env[key];
+}
 function buildAgentEnv(baseEnv, extraEnv, profile, { prependPathDir: pathDir = null } = {}) {
 	const env = { ...baseEnv };
 	for (const key of profile.scrub || []) delete env[key];
 	for (const key of GLIMMERVOID_SCRUB_KEYS) delete env[key];
 	for (const key of LAUNCHING_TERMINAL_IDENTITY_KEYS) delete env[key];
+	if (isSaneYoloGuarded(extraEnv)) scrubInheritedSafetyNetEnv(env);
 	Object.assign(env, extraEnv || {});
 	Object.assign(env, profile.set || {});
 	prependPathDir(env, pathDir);
 	return env;
 }
 //#endregion
-//#region session/core/hook-command-core.ts
-var SAFE_PATH_RE = /^[A-Za-z0-9_.:/\\ -]+$/;
-var SAFE_EVENT_RE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
-function buildHookCommand(relayPath, event) {
-	const rawPath = String(relayPath);
-	const rawEvent = String(event);
-	if (!SAFE_PATH_RE.test(rawPath)) return null;
-	if (!SAFE_EVENT_RE.test(rawEvent)) return null;
-	const forwardSlashedPath = rawPath.replace(/\\/g, "/");
-	return `node ${/\s/.test(forwardSlashedPath) ? `"${forwardSlashedPath}"` : forwardSlashedPath} ${rawEvent}`;
-}
-//#endregion
 //#region session/core/grok-hooks-file-core.ts
 function hookGroup(command) {
 	return [{ hooks: [{
@@ -76,13 +87,18 @@ function hookGroup(command) {
 		command
 	}] }];
 }
-function renderGrokHooksFile({ relayPath, events }) {
+function renderGrokHooksFile({ relayPath, events, hookToolRelayPath }) {
 	const hooks = {};
 	for (const event of events) {
 		const command = buildHookCommand(relayPath, event);
 		if (!command) return null;
 		hooks[event] = hookGroup(command);
 	}
+	if (hookToolRelayPath) {
+		const command = buildHookCommand(hookToolRelayPath, "saneYolo");
+		if (!command) return null;
+		hooks.PreToolUse = hookGroup(command);
+	}
 	return `${JSON.stringify({ hooks }, null, 2)}\n`;
 }
 function hasOnlyKeys(value, expectedKeys) {
@@ -91,15 +107,18 @@ function hasOnlyKeys(value, expectedKeys) {
 	const sortedExpectedKeys = [...expectedKeys].sort();
 	return actualKeys.length === sortedExpectedKeys.length && actualKeys.every((key, index) => key === sortedExpectedKeys[index]);
 }
-var MANAGED_RELAY_RE = /(?:^|\/)hook-relay\.(?:js|ts)$/;
+var MANAGED_RELAY_RE = /(?:^|\/)(hook-relay|hook-tool-relay)\.(?:js|ts)$/;
 function isManagedCommand(command, event) {
 	if (typeof command !== "string") return false;
 	const match = command.match(/^node (?:(?:"([^"\r\n]+)")|([^\s"']+)) ([A-Za-z][A-Za-z0-9_-]{0,63})$/);
 	if (!match) return false;
 	const relayPath = match[1] || match[2];
-	if (match[3] !== event) return false;
-	if (!MANAGED_RELAY_RE.test(relayPath)) return false;
-	return buildHookCommand(relayPath, event) === command;
+	const relayMatch = relayPath.match(MANAGED_RELAY_RE);
+	if (!relayMatch) return false;
+	const expectedRelay = event === "PreToolUse" ? "hook-tool-relay" : "hook-relay";
+	const expectedToken = event === "PreToolUse" ? "saneYolo" : event;
+	if (relayMatch[1] !== expectedRelay || match[3] !== expectedToken) return false;
+	return buildHookCommand(relayPath, expectedToken) === command;
 }
 function isManagedHookGroup(group, event) {
 	if (!Array.isArray(group) || group.length !== 1) return false;
@@ -111,8 +130,13 @@ function isManagedHookGroup(group, event) {
 	if (handler.type !== "command") return false;
 	return isManagedCommand(handler.command, event);
 }
-function classifyGrokHooksFile(contents, { relayPath, events, managedEventSets = [] }) {
+function classifyGrokHooksFile(contents, { relayPath, events, managedEventSets = [], hookToolRelayPath }) {
 	if (contents == null) return "absent";
+	if (contents === renderGrokHooksFile({
+		relayPath,
+		events,
+		hookToolRelayPath
+	})) return "current";
 	if (contents === renderGrokHooksFile({
 		relayPath,
 		events
@@ -130,7 +154,7 @@ function classifyGrokHooksFile(contents, { relayPath, events, managedEventSets =
 	const actualEvents = Object.keys(hooksValue);
 	if (!hasOnlyKeys(hooksValue, actualEvents)) return "foreign";
 	const hooks = hooksValue;
-	if (!(hasOnlyKeys(hooks, events) || managedEventSets.some((managedEvents) => hasOnlyKeys(hooks, managedEvents)))) return "foreign";
+	if (![events, ...managedEventSets].some((managedEvents) => hasOnlyKeys(hooks, managedEvents) || hasOnlyKeys(hooks, [...managedEvents, "PreToolUse"]))) return "foreign";
 	for (const event of actualEvents) if (!isManagedHookGroup(hooks[event], event)) return "foreign";
 	return "managed-stale";
 }
@@ -174,6 +198,7 @@ function classifyAgentTitle(title, { cwdBasename = null }, vocabulary) {
 var ID = "grok";
 var COMMAND_NAME = "grok";
 var RELAY_PATH = relayPath("hook-relay");
+var HOOK_TOOL_RELAY_PATH = relayPath("hook-tool-relay");
 var HOOK_EVENTS = [
 	"UserPromptSubmit",
 	"Stop",
@@ -359,12 +384,14 @@ var grok = {
 			filePath: hooksFilePath,
 			expectedContents: () => renderGrokHooksFile({
 				relayPath: RELAY_PATH,
-				events: HOOK_EVENTS
+				events: HOOK_EVENTS,
+				hookToolRelayPath: HOOK_TOOL_RELAY_PATH
 			}),
 			classifyContents: (contents) => classifyGrokHooksFile(contents, {
 				relayPath: RELAY_PATH,
 				events: HOOK_EVENTS,
-				managedEventSets: MANAGED_HOOK_EVENT_SETS
+				managedEventSets: MANAGED_HOOK_EVENT_SETS,
+				hookToolRelayPath: HOOK_TOOL_RELAY_PATH
 			}),
 			projectConfigCandidates: PROJECT_CONFIG_CANDIDATES,
 			mayContributeHooks
@@ -386,6 +413,7 @@ var grok = {
 	mayContributeHooks,
 	PROJECT_CONFIG_CANDIDATES,
 	CLAUDE_COMPAT_HOOKS_ENV,
+	HOOK_TOOL_RELAY_PATH,
 	HOOK_EVENTS,
 	MANAGED_HOOK_EVENT_SETS,
 	RELAY_PATH,
@@ -397,6 +425,7 @@ var grok = {
 		resume: true,
 		statusLine: false,
 		rtk: false,
+		saneYolo: true,
 		antiSlop: false,
 		compactQuiet: false,
 		skipPermissionsFlag: true,
@@ -404,4 +433,4 @@ var grok = {
 	}
 };
 //#endregion
-export { classifyGrokHooksFile as a, buildAgentEnv as c, isSpinnerChar as i, classifyAgentTitle as n, renderGrokHooksFile as o, isBrailleChar as r, buildHookCommand as s, grok as t };
+export { classifyGrokHooksFile as a, isSpinnerChar as i, classifyAgentTitle as n, renderGrokHooksFile as o, isBrailleChar as r, buildAgentEnv as s, grok as t };