glimmervoid 0.29.1 → 0.31.0

package/README.md

@@ -17,28 +17,26 @@ Glimmervoid is developed inside Glimmervoid.
 
 ## Quickstart
 
-Until the `glimmervoid` npm package is published, run the tarball attached to the latest GitHub release. Windows and macOS:
+Windows and macOS:
 
 ```bash
-npx --allow-remote=root --allow-scripts=node-pty https://github.com/johncwaters/glimmervoid/releases/latest/download/glimmervoid.tgz
+npx glimmervoid@latest
 ```
 
-Linux (node-pty ships no Linux prebuilds, so it compiles at install time):
+Linux (node-pty ships no Linux prebuilds, so it compiles at install time, and npm runs that build only when allowed):
 
 ```bash
 sudo apt install build-essential python3 git
-npx --allow-remote=root --allow-scripts=node-pty https://github.com/johncwaters/glimmervoid/releases/latest/download/glimmervoid.tgz
+npx --allow-scripts=node-pty glimmervoid@latest
 ```
 
-To upgrade, run the versioned command the dashboard's update banner shows (or the `glimmervoid-<version>.tgz` URL from the release page): npx caches by the literal command, so rerunning the command above keeps starting the version it first fetched.
-
-Once the package is published, `npm install -g glimmervoid` (plus `--allow-scripts=node-pty` on Linux) installs it globally; if that fails with `EACCES`, see [docs/troubleshooting.md](docs/troubleshooting.md#eacces-on-a-global-install) and never use `sudo npm`.
+To install it globally instead, run `npm install -g glimmervoid` (add `--allow-scripts=node-pty` on Linux); if that fails with `EACCES`, see [docs/troubleshooting.md](docs/troubleshooting.md#eacces-on-a-global-install) and never use `sudo npm`.
 
 Open http://localhost:3000. A fresh install knows no projects, so **+ Session** shows "No projects found" until you say where your repositories live: open **Settings**, then **Repositories**, and add the folder that holds your git checkouts under **Repository roots** (each subfolder becomes a project). For a one-off, **+ Session** then **Advanced options** takes a name and a path directly. That is the whole setup; everything else is optional.
 
 To check notifications, allow them when the dashboard asks (or turn on **Desktop notifications** under **Settings**, **Appearance and alerts**) and keep a dashboard tab open. A notification only appears while that tab is not focused, since a focused tab already shows the change. With no dashboard tab open anywhere, only Telegram reaches you (the `telegram` keys in [docs/configuration.md](docs/configuration.md)).
 
-Both flags matter on npm 12, which refuses tarball URLs (`EALLOWREMOTE`) and blocks dependency install scripts by default. npm 10 and 11 allow both by default (npm 11 prints a notice), so there the flags are unnecessary but harmless. If the native module still fails to load, the server refuses to start and prints the repair command; `glimmervoid doctor` runs the same check. See [docs/troubleshooting.md](docs/troubleshooting.md).
+The Linux flag matters on npm 12, which blocks dependency install scripts by default; npm 10 and 11 run them (npm 11 prints a notice), so there it is harmless. Keep `@latest` so npx checks for a new release instead of rerunning the version it cached first. If the native module still fails to load, the server refuses to start and prints the repair command; `glimmervoid doctor` runs the same check. See [docs/troubleshooting.md](docs/troubleshooting.md).
 
 ### From source
 
@@ -59,7 +57,7 @@ Update a clone with `git pull --ff-only && npm ci && npm run build`, then restar
 - **Claude Code CLI** on PATH, or another supported agent below.
 - **git** on PATH, for per-session worktrees.
 - **Linux only:** `build-essential` and `python3` for node-pty.
-- **Linux only:** `bubblewrap` (`bwrap`) and `socat` for Claude Code's sandbox, which team review, Keep mergeable, workflow sessions and benchmark runs use (`sudo apt install bubblewrap socat`). `glimmervoid doctor` reports both.
+- **Linux only:** `bubblewrap` (`bwrap`), `socat` and `ripgrep` (`rg`) for the sandbox that sandboxed sessions and factory checks run in (`sudo apt install bubblewrap socat ripgrep`). `glimmervoid doctor` reports all three.
 
 ## Supported agents
 
@@ -144,7 +142,7 @@ Remote access is off by default. It is a second loopback listener meant to sit b
    ```
 
 2. Restart Glimmervoid (stop and start it, or `systemctl --user restart glimmervoid` when it runs as a service). The log line `Glimmervoid remote listener on http://127.0.0.1:3456 (paired devices only)` confirms the listener is up.
-3. Point an HTTPS reverse proxy at that port. With Tailscale, `tailscale serve --bg 3456` serves `https://<machine>.<tailnet>.ts.net`, which is the name `publicHost` should hold.
+3. Point an HTTPS reverse proxy at that port. With Tailscale, `tailscale serve --bg 3456` serves `https://<machine>.<tailnet>.ts.net`, which is the name `publicHost` should hold. When the port is reached solely through HTTP-mode `tailscale serve`, also set `"ownerLogin": "you@example.com"` in the `remote` block: the listener then refuses every request and WebSocket whose `Tailscale-User-Login` is not that login, including Funnel and tagged-device traffic, which carry none. Only HTTP-mode `tailscale serve` strips a client-sent `Tailscale-User-Login`; behind any other proxy, or `tailscale serve --tcp` or `--tls-terminated-tcp`, a client can forge it, so `ownerLogin` proves nothing there. It works on top of pairing, never instead of it.
 4. Verify from the device: `https://<publicHost>/` should answer with Glimmervoid's "Pairing required" page.
 5. On the host, run `glimmervoid pair --name phone`. It prints a single-use URL valid for 10 minutes that sets an auth cookie when opened on the device.
 

package/dist/bin/glimmervoid.js

@@ -1,15 +1,93 @@
 #!/usr/bin/env node
-import { o as nodePtyRebuildHint, t as probeNodePty } from "../chunks/node-pty-preflight-CK1knGIR.js";
-import { a as packageRoot } from "../chunks/runtime-paths-CVvq20A4.js";
-import { t as AGENT_API_VERBS } from "../chunks/session-CJtOveHl.js";
-import { i as execSync } from "../chunks/child-process-safe-Cz22RwlG.js";
+import { o as nodePtyRebuildHint, r as firstLine, t as probeNodePty } from "../chunks/node-pty-preflight-C8QIlrtU.js";
+import { i as errorText } from "../chunks/text-DoirglWV.js";
+import { a as packageRoot } from "../chunks/runtime-paths-BPoxENmK.js";
+import { t as AGENT_API_VERBS } from "../chunks/session-fc4pFbon.js";
+import { i as execSync } from "../chunks/child-process-safe-Ch-Zgxqs.js";
 import { t as renderTable } from "../chunks/ascii-figure-core-pDAwtlKO.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "../chunks/config-path-core-DFt-TemS.js";
-import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-BwvbDBDl.js";
+import { i as sandboxDoctorRows, r as probeSandboxDependencies } from "../chunks/sandbox-deps-BPKE-ylr.js";
 import { i as pnpmGlobalBinDir, n as npmGlobalBinDir, r as onPath, t as formatPathNotice } from "../chunks/path-doctor-C23VAqeu.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
+//#region server/core/command-line-core.ts
+var SUBCOMMANDS_HONORING_TRAILING_GLOBAL_OPTIONS = /* @__PURE__ */ new Set([
+	"doctor",
+	"pair",
+	"visions"
+]);
+var SUBCOMMANDS_HONORING_A_LEADING_HELP_OR_VERSION = new Set(AGENT_API_VERBS);
+var OPTIONS_TAKING_A_VALUE = {
+	"--config": "configPath",
+	"--port": "port"
+};
+function scanGlobalOption(argv, index, state) {
+	const token = argv[index];
+	const valueKey = OPTIONS_TAKING_A_VALUE[token];
+	if (valueKey) {
+		const value = argv[index + 1];
+		if (value !== void 0) state[valueKey] = value;
+		return index + 2;
+	}
+	if (token === "--help" || token === "-h") state.wantsHelp = true;
+	if (token === "--version") state.wantsVersion = true;
+	if (token === "--doctor") state.wantsDoctor = true;
+	return index + 1;
+}
+function scanTrailingGlobalOptions(subcommandArgs, state) {
+	let index = 0;
+	while (index < subcommandArgs.length) {
+		if (!subcommandArgs[index].startsWith("-")) {
+			index += 1;
+			continue;
+		}
+		index = scanGlobalOption(subcommandArgs, index, state);
+	}
+}
+function scanLeadingHelpOrVersion(subcommandArgs, state) {
+	const firstArgument = subcommandArgs[0];
+	if (firstArgument === "--help" || firstArgument === "-h") state.wantsHelp = true;
+	if (firstArgument === "--version") state.wantsVersion = true;
+}
+function parseCommandLine(argv) {
+	const state = {
+		configPath: null,
+		port: null,
+		wantsHelp: false,
+		wantsVersion: false,
+		wantsDoctor: false
+	};
+	let index = 0;
+	while (index < argv.length && argv[index].startsWith("-")) index = scanGlobalOption(argv, index, state);
+	const name = argv[index];
+	const subcommandArgs = argv.slice(index + 1);
+	if (name !== void 0 && SUBCOMMANDS_HONORING_TRAILING_GLOBAL_OPTIONS.has(name)) scanTrailingGlobalOptions(subcommandArgs, state);
+	if (name !== void 0 && SUBCOMMANDS_HONORING_A_LEADING_HELP_OR_VERSION.has(name)) scanLeadingHelpOrVersion(subcommandArgs, state);
+	if (state.wantsHelp) return { kind: "help" };
+	if (state.wantsVersion) return { kind: "version" };
+	const globalOptions = {
+		configPath: state.configPath,
+		port: state.port
+	};
+	if (state.wantsDoctor) return {
+		kind: "subcommand",
+		name: "doctor",
+		subcommandArgs: [],
+		globalOptions
+	};
+	if (name === void 0) return {
+		kind: "server",
+		globalOptions
+	};
+	return {
+		kind: "subcommand",
+		name,
+		subcommandArgs,
+		globalOptions
+	};
+}
+//#endregion
 //#region bin/glimmervoid.ts
 var args = process.argv.slice(2);
 var pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
@@ -28,6 +106,7 @@ Commands:
   spawn <prompt>    From inside a Glimmervoid session, start a sibling session on that prompt
   attention <note>  From inside a Glimmervoid session, flag it as needing the operator
   board             From inside a Glimmervoid session, list the live sessions
+  kg [command]      Experimental typed knowledge and task graph (Settings > Lanes > Knowledge graph)
 
 Options:
   --name <label>    Label for the device being paired (with: pair)
@@ -35,71 +114,75 @@ Options:
   --config <path>   Path to config file (default: ~/.glimmervoid/config.json)
   --version         Show version number
   --help, -h        Show this help message`;
-if (args.includes("--help") || args.includes("-h")) {
+var commandLine = parseCommandLine(args);
+if (commandLine.kind === "help") {
 	console.log(USAGE);
 	process.exit(0);
 }
-if (args.includes("--version")) {
+if (commandLine.kind === "version") {
 	console.log(pkg.version);
 	process.exit(0);
 }
-function getArgValue(flag) {
-	const idx = args.indexOf(flag);
-	if (idx !== -1 && idx + 1 < args.length) return args[idx + 1];
-	return null;
-}
-var configArg = getArgValue("--config");
-if (configArg) process.env.GLIMMERVOID_CONFIG = configArg;
-var portArg = getArgValue("--port");
-if (portArg) process.env.GLIMMERVOID_PORT = portArg;
+if (commandLine.globalOptions.configPath) process.env.GLIMMERVOID_CONFIG = commandLine.globalOptions.configPath;
+if (commandLine.globalOptions.port) process.env.GLIMMERVOID_PORT = commandLine.globalOptions.port;
 var SUBCOMMAND_RUNNERS = new Map([
 	["doctor", async () => {
 		await runDoctor();
 		return 0;
 	}],
-	["pair", async (commandArgs) => {
-		const { runPairCli } = await import("../chunks/pair-cli-BQQnhkkc.js");
-		return runPairCli(commandArgs.slice(1));
+	["pair", async (subcommandArgs) => {
+		const { runPairCli } = await import("../chunks/pair-cli-BbCBfd6l.js");
+		return runPairCli(subcommandArgs);
+	}],
+	["agent", async (subcommandArgs) => {
+		const { runAgentSetupCli } = await import("../chunks/agent-setup-cli-CiJSDWSo.js");
+		return runAgentSetupCli(subcommandArgs);
 	}],
-	["agent", async (commandArgs) => {
-		const { runAgentSetupCli } = await import("../chunks/agent-setup-cli-C1CQ8Nkk.js");
-		return runAgentSetupCli(commandArgs.slice(1));
+	["kg", async (subcommandArgs) => {
+		const { runKnowledgeGraphCommand } = await import("../chunks/knowledge-graph-cli-D2tt5hPn.js");
+		return runKnowledgeGraphCommand(subcommandArgs);
 	}],
-	["visions", async (commandArgs) => {
-		const { runVisionsCli } = await import("../chunks/visions-cli-DUZnopGY.js");
-		return runVisionsCli(commandArgs.slice(1));
+	["visions", async (subcommandArgs) => {
+		const { runVisionsCli } = await import("../chunks/visions-cli-CT5rjiwf.js");
+		return runVisionsCli(subcommandArgs);
 	}],
-	...AGENT_API_VERBS.map((verb) => [verb, async (commandArgs) => {
-		const { runAgentApiCli } = await import("../chunks/agent-api-cli-ClOzm28U.js");
-		return runAgentApiCli(commandArgs);
+	...AGENT_API_VERBS.map((verb) => [verb, async (subcommandArgs, subcommandName) => {
+		const { runAgentApiCli } = await import("../chunks/agent-api-cli-DAA7Jx8N.js");
+		return runAgentApiCli([subcommandName, ...subcommandArgs]);
 	}])
 ]);
+function flushStream(stream) {
+	return new Promise((resolve) => {
+		stream.once("error", () => resolve());
+		stream.write("", () => resolve());
+	});
+}
+async function exitAfterOutputDrains(exitCode) {
+	await Promise.all([flushStream(process.stdout), flushStream(process.stderr)]);
+	process.exit(exitCode);
+}
+async function runSubcommandToExitCode(runSubcommand, subcommandArgs, subcommandName) {
+	try {
+		return await runSubcommand(subcommandArgs, subcommandName);
+	} catch (err) {
+		console.error(errorText(err));
+		return 1;
+	}
+}
 async function dispatchCommandLine() {
-	const requestedSubcommand = args.includes("--doctor") ? "doctor" : args[0];
-	if (!requestedSubcommand || requestedSubcommand.startsWith("-")) {
+	if (commandLine.kind !== "subcommand") {
 		await import("../server/index.js");
 		return;
 	}
-	const runSubcommand = SUBCOMMAND_RUNNERS.get(requestedSubcommand);
+	const runSubcommand = SUBCOMMAND_RUNNERS.get(commandLine.name);
 	if (!runSubcommand) {
-		console.error(`Unknown command: ${requestedSubcommand}\n${USAGE}`);
-		process.exit(1);
-	}
-	try {
-		process.exit(await runSubcommand(args));
-	} catch (err) {
-		console.error(messageOf(err));
-		process.exit(1);
+		console.error(`Unknown command: ${commandLine.name}\n${USAGE}`);
+		await exitAfterOutputDrains(1);
+		return;
 	}
+	await exitAfterOutputDrains(await runSubcommandToExitCode(runSubcommand, commandLine.subcommandArgs, commandLine.name));
 }
 await dispatchCommandLine();
-function messageOf(error) {
-	if (error instanceof Error && error.message) return error.message;
-	return String(error);
-}
-function firstLineOf(error) {
-	return messageOf(error).split("\n")[0];
-}
 function decideReadOnlyConfigPath() {
 	return decideConfigPath({
 		env: process.env,
@@ -118,7 +201,7 @@ async function readDeclaredCustomAgents() {
 		declared: [],
 		error: null
 	};
-	const { loadConfigFile } = await import("../chunks/config-store-DtUGwi4-.js");
+	const { loadConfigFile } = await import("../chunks/config-store-DbBp7LJZ.js");
 	try {
 		const loaded = loadConfigFile(decided.path, { exitOnError: false });
 		if (!loaded.config) return {
@@ -132,7 +215,7 @@ async function readDeclaredCustomAgents() {
 	} catch (err) {
 		return {
 			declared: [],
-			error: `could not read ${decided.path}: ${firstLineOf(err)}`
+			error: `could not read ${decided.path}: ${firstLine(errorText(err))}`
 		};
 	}
 }
@@ -194,7 +277,7 @@ async function runDoctor() {
 	}
 	switchSection("Agents");
 	try {
-		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-DIavI9-i.js");
+		const { listAgentIds, describeAgentResolvability, setCustomAgents } = await import("../chunks/adapters-ClA_GbtA.js");
 		const declaredCustomAgents = await readDeclaredCustomAgents();
 		if (declaredCustomAgents.error) line("config", declaredCustomAgents.error);
 		setCustomAgents(declaredCustomAgents.declared);
@@ -202,18 +285,34 @@ async function runDoctor() {
 			const { label, path: resolvedPath } = describeAgentResolvability(id);
 			line(`${id} (${label})`, resolvedPath ?? "not found on PATH");
 		}
-		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-C1CQ8Nkk.js");
+		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-CiJSDWSo.js");
 		const grokSetup = inspectGrokAgentSetup();
 		line("grok hook setup", `${grokSetup.classification}: ${grokSetup.filePath}`);
 	} catch (err) {
-		line("agents", `probe failed: ${firstLineOf(err)}`);
+		line("agents", `probe failed: ${firstLine(errorText(err))}`);
 	}
 	switchSection("rtk");
 	try {
-		const { getRtkPath } = await import("../chunks/rtk-resolver-DDVVNRBT.js");
+		const { getRtkPath } = await import("../chunks/rtk-resolver-D4Nke1Fr.js");
 		line("rtk", getRtkPath() || "not installed (Glimmervoid installs it when the rtk setting is on)");
 	} catch (err) {
-		line("rtk", `probe failed: ${firstLineOf(err)}`);
+		line("rtk", `probe failed: ${firstLine(errorText(err))}`);
+	}
+	switchSection("Sane YOLO");
+	try {
+		const { resolvePackageBin } = await import("../chunks/runtime-paths-DU5jBEEO.js");
+		const { execFileSync } = await import("../chunks/child-process-safe-BKPZ-5qQ.js");
+		const { inspectGrokAgentSetup } = await import("../chunks/agent-setup-cli-CiJSDWSo.js");
+		const binPath = resolvePackageBin("cc-safety-net", "cc-safety-net");
+		line("Sane YOLO", binPath || "not installed");
+		if (binPath) line("cc-safety-net version", execFileSync(process.execPath, [binPath, "--version"], {
+			encoding: "utf8",
+			timeout: 3e3
+		}).trim());
+		line("Codex hook trust", "Sane YOLO is inactive unless Codex trusts the injected hooks.");
+		line("Grok Sane YOLO", inspectGrokAgentSetup().saneYoloReady ? "installed" : "inactive; run glimmervoid agent setup grok");
+	} catch (err) {
+		line("Sane YOLO", `probe failed: ${firstLine(errorText(err))}`);
 	}
 	switchSection("Native module");
 	const nodePty = await probeNodePty();

package/dist/chunks/{adapters-DIavI9-i.js → adapters-ClA_GbtA.js}

@@ -1,2 +1,2 @@
-import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-Dlvu1FVB.js";
+import { a as describeAgentResolvability, d as setCustomAgents, l as listAgentIds } from "./adapters-gn7ulNO4.js";
 export { describeAgentResolvability, listAgentIds, setCustomAgents };

package/dist/chunks/{adapters-Dlvu1FVB.js → adapters-gn7ulNO4.js}

@@ -1,9 +1,12 @@
-import { o as relayPath } from "./runtime-paths-CVvq20A4.js";
-import { c as PendingPromptQuestion, g as toolDetailFieldValue, h as firstDetailLine, o as PROMPT_DETAIL_HIDDEN_CHARACTERS } from "./session-CJtOveHl.js";
-import { r as execFileSync } from "./child-process-safe-Cz22RwlG.js";
+import { o as relayPath } from "./runtime-paths-BPoxENmK.js";
+import { _ as firstDetailLine, l as PendingPromptQuestion, s as PROMPT_DETAIL_HIDDEN_CHARACTERS, v as toolDetailFieldValue } from "./session-fc4pFbon.js";
+import { r as execFileSync } from "./child-process-safe-Ch-Zgxqs.js";
 import { n as resolveAgentCommand, t as buildAgentSpawnCommand } from "./spawn-command-Cc40FiZI.js";
-import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, s as buildHookCommand, t as grok } from "./grok-COekzawt.js";
-import "./contracts-JKChPhZ0.js";
+import { n as isRecord } from "./coerce-NSst8oRP.js";
+import { c as buildAgentEnv, i as isSpinnerChar, n as classifyAgentTitle, r as isBrailleChar, t as grok } from "./grok-CXKeSt2z.js";
+import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
+import "./contracts-3LkrilQX.js";
+import { n as mergeCodexPreToolUse, t as HOOK_TOOLS } from "./hook-tools-UX2fmt81.js";
 import fs from "node:fs";
 //#region session/core/anti-slop-prompt.ts
 var ANTI_SLOP_NOTE = [
@@ -85,9 +88,6 @@ function mapHookPromptDetail(event, payload) {
 		question: answerableQuestionOf(toolName, payload?.tool_input)
 	};
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function answerableQuestionOf(toolName, toolInput) {
 	if (toolName !== "AskUserQuestion" || !isRecord(toolInput)) return null;
 	const questions = toolInput.questions;
@@ -121,6 +121,8 @@ function isWholeBashCommandShown(toolName, toolInput, fieldValue, summary) {
 function mapHookToSignal$1(event, payload) {
 	switch (String(event || "").toLowerCase()) {
 		case "sessionstart": return "session-start";
+		case "precompact": return "compaction-start";
+		case "postcompact": return "compaction-end";
 		case "sessionend": return "session-end";
 		case "userpromptsubmit": return "resume";
 		case "stop": return "ready";
@@ -176,7 +178,15 @@ var settingsArgs = (settingsPath) => ["--settings", settingsPath];
 function buildArgs$1({ dangerouslySkipPermissions = false, resumeSessionId = null, extraArgs = [], antiSlopPrompt = false, initialPrompt = null } = {}) {
 	const args = dangerouslySkipPermissions ? ["--dangerously-skip-permissions"] : [];
 	if (resumeSessionId) args.push("--resume", resumeSessionId);
-	if (extraArgs.length > 0) args.push(...extraArgs);
+	for (let index = 0; index < extraArgs.length; index += 1) {
+		const argument = extraArgs[index];
+		if (resumeSessionId && argument === "--session-id") {
+			index += 1;
+			continue;
+		}
+		if (resumeSessionId && argument.startsWith("--session-id=")) continue;
+		args.push(argument);
+	}
 	args.push(...buildAntiSlopArgs(antiSlopPrompt));
 	if (initialPrompt != null) args.push(initialPrompt);
 	return args;
@@ -201,6 +211,7 @@ var claudeCode = {
 		resume: true,
 		statusLine: true,
 		rtk: true,
+		saneYolo: true,
 		antiSlop: true,
 		compactQuiet: true,
 		skipPermissionsFlag: true,
@@ -219,9 +230,7 @@ var claudeCode = {
 var ID = "codex";
 var COMMAND_NAME = "codex";
 var RELAY_PATH = relayPath("hook-relay");
-var RTK_RELAY_PATH = relayPath("rtk-relay");
-var RTK_HOOK_EVENT = "PreToolUse";
-var RTK_TOOL_MATCHER = "Bash";
+var HOOK_TOOL_RELAY_PATH = relayPath("hook-tool-relay");
 var HOOK_EVENTS = [
 	"SessionStart",
 	"SessionEnd",
@@ -285,17 +294,23 @@ function mayContributeHooks(configText) {
 	if (typeof configText !== "string") return false;
 	return HOOKS_DECLARATION_RE.test(configText);
 }
-function buildHookArgs({ relayPath = RELAY_PATH, events = HOOK_EVENTS, bypassHookTrust = false, rtkRewrites = false, rtkRelayPath = RTK_RELAY_PATH } = {}) {
+function buildHookArgs({ relayPath = RELAY_PATH, events = HOOK_EVENTS, bypassHookTrust = false, hookTools = [], hookToolRelayPath = HOOK_TOOL_RELAY_PATH } = {}) {
 	const args = bypassHookTrust ? [TRUST_BYPASS_FLAG] : [];
+	const preToolUseGroups = [];
 	for (const event of events) {
 		const command = buildHookCommand(relayPath, event);
 		if (!command) return null;
+		if (event === "PreToolUse") {
+			preToolUseGroups.push(`{hooks=[{type='command',command='${command}'}]}`);
+			continue;
+		}
 		args.push("-c", `hooks.${event}=[{hooks=[{type='command',command='${command}'}]}]`);
 	}
-	if (!rtkRewrites) return args;
-	const rtkCommand = buildHookCommand(rtkRelayPath, RTK_HOOK_EVENT);
-	if (!rtkCommand) return args;
-	args.push("-c", `hooks.${RTK_HOOK_EVENT}=[{matcher='${RTK_TOOL_MATCHER}',hooks=[{type='command',command='${rtkCommand}'}]}]`);
+	const groups = hookTools.flatMap((tool) => {
+		const group = HOOK_TOOLS[tool.id].codexGroup(tool, hookToolRelayPath);
+		return group ? [group] : [];
+	});
+	args.push(...mergeCodexPreToolUse([...preToolUseGroups, ...groups]));
 	return args;
 }
 var hooks = {
@@ -337,10 +352,22 @@ var SKIP_PERMISSIONS_ARGS = [
 	"-s",
 	"workspace-write"
 ];
-function buildArgs({ dangerouslySkipPermissions = false, resumeSessionId = null, extraArgs = [], initialPrompt = null } = {}) {
+var OUTER_SANDBOX_ARGS = ["-s", "danger-full-access"];
+var OUTER_SANDBOX_SKIP_PERMISSIONS_ARGS = [
+	"-a",
+	"never",
+	...OUTER_SANDBOX_ARGS
+];
+function permissionArgs(dangerouslySkipPermissions, hasOuterSandbox) {
+	if (hasOuterSandbox && dangerouslySkipPermissions) return OUTER_SANDBOX_SKIP_PERMISSIONS_ARGS;
+	if (hasOuterSandbox) return OUTER_SANDBOX_ARGS;
+	if (dangerouslySkipPermissions) return SKIP_PERMISSIONS_ARGS;
+	return [];
+}
+function buildArgs({ dangerouslySkipPermissions = false, resumeSessionId = null, extraArgs = [], initialPrompt = null, hasOuterSandbox = false } = {}) {
 	const args = [...UPDATE_CHECK_ARGS];
 	if (resumeSessionId) args.push("resume", resumeSessionId);
-	if (dangerouslySkipPermissions) args.push(...SKIP_PERMISSIONS_ARGS);
+	args.push(...permissionArgs(dangerouslySkipPermissions, hasOuterSandbox));
 	if (extraArgs.length > 0) args.push(...extraArgs);
 	if (initialPrompt != null) args.push(initialPrompt);
 	return args;
@@ -368,7 +395,7 @@ var codex = {
 	sessionIdOf,
 	HOOK_EVENTS,
 	RELAY_PATH,
-	RTK_RELAY_PATH,
+	HOOK_TOOL_RELAY_PATH,
 	TRUST_BYPASS_FLAG,
 	SKIP_PERMISSIONS_ARGS,
 	UPDATE_CHECK_ARGS,
@@ -379,6 +406,7 @@ var codex = {
 		resume: true,
 		statusLine: false,
 		rtk: true,
+		saneYolo: true,
 		antiSlop: false,
 		compactQuiet: false,
 		skipPermissionsFlag: true,
@@ -398,6 +426,7 @@ var TITLE_ONLY_CAPABILITIES = Object.freeze({
 	resume: false,
 	statusLine: false,
 	rtk: false,
+	saneYolo: false,
 	antiSlop: false,
 	compactQuiet: false,
 	skipPermissionsFlag: false,

package/dist/chunks/agent-api-cli-DAA7Jx8N.js

@@ -0,0 +1,135 @@
+import { t as errorCode } from "./text-DoirglWV.js";
+import { a as AgentDispatchRequest, n as AGENT_URL_ENV } from "./session-fc4pFbon.js";
+import { i as resolveHookTarget } from "./hook-relay-core-DA_bz2KA.js";
+import { n as decideSandboxProxy } from "./sandbox-proxy-core-hnQgKR0T.js";
+import { a as isAgentApiVerb } from "./agent-api-core-hVcT26JW.js";
+import http from "node:http";
+//#region server/agent-api-cli.ts
+var AGENT_PATH_PREFIX = "/agent/";
+var BODY_BUILDERS = {
+	spawn: (rest) => {
+		const prompt = rest.join(" ").trim();
+		return prompt ? { prompt } : null;
+	},
+	attention: (rest) => {
+		const note = rest.join(" ").trim();
+		return note ? { note } : null;
+	},
+	board: () => ({}),
+	dispatch: (rest) => {
+		const parsed = AgentDispatchRequest.safeParse(rest[0] === "--ready" ? { readyIntent: rest[1] } : { workId: rest[0] });
+		return parsed.success ? parsed.data : null;
+	}
+};
+function bodySaysOk(text) {
+	try {
+		const parsed = JSON.parse(text);
+		return typeof parsed === "object" && parsed !== null && parsed.ok === true;
+	} catch {
+		return false;
+	}
+}
+function verbEndpoint(rawUrl, verb) {
+	const target = resolveHookTarget(rawUrl, verb, AGENT_PATH_PREFIX);
+	if (!target.url) return { ok: false };
+	const endpoint = new URL(target.url);
+	const token = endpoint.searchParams.get("t") || "";
+	endpoint.search = "";
+	return {
+		ok: true,
+		endpoint,
+		token
+	};
+}
+async function postDirectly(endpoint, headers, bodyText) {
+	const response = await fetch(endpoint, {
+		method: "POST",
+		headers,
+		body: bodyText
+	});
+	return {
+		hasSuccessStatus: response.ok,
+		text: await response.text()
+	};
+}
+function postThroughSandboxProxy(sandboxProxy, endpoint, headers, bodyText) {
+	const proxyHeaders = sandboxProxy.authorization ? { "proxy-authorization": sandboxProxy.authorization } : {};
+	return new Promise((resolve, reject) => {
+		const request = http.request({
+			host: sandboxProxy.hostname,
+			port: sandboxProxy.port,
+			method: "POST",
+			path: endpoint.href,
+			headers: {
+				...headers,
+				...proxyHeaders,
+				host: endpoint.host,
+				"content-length": String(Buffer.byteLength(bodyText))
+			}
+		}, (response) => {
+			const chunks = [];
+			response.on("data", (chunk) => {
+				chunks.push(chunk);
+			});
+			response.on("error", reject);
+			response.on("end", () => {
+				const statusCode = response.statusCode ?? 0;
+				resolve({
+					hasSuccessStatus: statusCode >= 200 && statusCode < 300,
+					text: Buffer.concat(chunks).toString("utf8")
+				});
+			});
+		});
+		request.on("error", reject);
+		request.end(bodyText);
+	});
+}
+function wasConnectionRefused(error) {
+	return errorCode(error?.cause) === "ECONNREFUSED";
+}
+async function postToAgentIngress(endpoint, token, body) {
+	const headers = {
+		"content-type": "application/json",
+		authorization: `Bearer ${token}`
+	};
+	const bodyText = JSON.stringify(body);
+	try {
+		return await postDirectly(endpoint, headers, bodyText);
+	} catch (error) {
+		if (!wasConnectionRefused(error)) throw error;
+		const sandboxProxy = decideSandboxProxy(process.env);
+		if (!sandboxProxy) throw error;
+		return postThroughSandboxProxy(sandboxProxy, endpoint, headers, bodyText);
+	}
+}
+async function runAgentApiCli(args) {
+	const verb = args[0];
+	if (!verb || !isAgentApiVerb(verb)) {
+		console.error(`glimmervoid: ${verb || "that"} is not an agent command`);
+		return 1;
+	}
+	const body = BODY_BUILDERS[verb](args.slice(1));
+	if (!body) {
+		if (verb === "dispatch") {
+			console.error("glimmervoid dispatch: expected a work id matching wrk-[0-9a-f]{16}");
+			return 1;
+		}
+		console.error(`glimmervoid ${verb}: this command needs text, for example "glimmervoid ${verb} check the failing test"`);
+		return 1;
+	}
+	const rawUrl = process.env[AGENT_URL_ENV];
+	if (!rawUrl) {
+		console.error(`glimmervoid: ${AGENT_URL_ENV} is not set, so this is not a Glimmervoid session with the agent API turned on`);
+		return 1;
+	}
+	const target = verbEndpoint(rawUrl, verb);
+	if (!target.ok) {
+		console.error(`glimmervoid: ${AGENT_URL_ENV} must be a loopback http url under ${AGENT_PATH_PREFIX}, so nothing was sent`);
+		return 1;
+	}
+	const reply = await postToAgentIngress(target.endpoint, target.token, body);
+	console.log(reply.text);
+	return reply.hasSuccessStatus && bodySaysOk(reply.text) ? 0 : 1;
+}
+//#endregion
+export { runAgentApiCli };

package/dist/chunks/{agent-api-core-D6LHrpSL.js → agent-api-core-hVcT26JW.js}

@@ -1,4 +1,4 @@
-import { a as AgentSpawnRequest, i as AgentAttentionRequest, t as AGENT_API_VERBS } from "./session-CJtOveHl.js";
+import { a as AgentDispatchRequest, i as AgentAttentionRequest, o as AgentSpawnRequest, t as AGENT_API_VERBS } from "./session-fc4pFbon.js";
 import crypto from "node:crypto";
 var MAX_SPAWNS_IN_FLIGHT = 1;
 var SPAWNABLE_DEPTH = 0;
@@ -67,6 +67,15 @@ function parseAgentVerb(verb, payload) {
 		status: 404,
 		error: REFUSAL_REASON
 	};
+	if (verb === "dispatch") {
+		const parsed = AgentDispatchRequest.safeParse(payload);
+		if (!parsed.success) return refuseInvalidBody(parsed.error.issues);
+		return {
+			ok: true,
+			verb,
+			request: parsed.data
+		};
+	}
 	if (verb === "board") return {
 		ok: true,
 		verb