glimmervoid 0.35.1 → 0.37.0

package/dist/chunks/config-store-CsUoy88Q.js

@@ -0,0 +1 @@
+export { s as loadConfigFile } from "./config-store-B7MpiYxG.js";

package/dist/chunks/{contracts-DjIgIuDk.js → contracts-C6ipN_zw.js}

@@ -1,5 +1,5 @@
-import { C as SessionState, D as TaskTitle, S as SessionSnapshot, f as PendingPromptDetail, m as PendingWakeup, v as SESSION_DOC_PATH_MAX_CHARS, x as SessionDoc } from "./session-D6xXN0UU.js";
-import { D as MyPrMergeWhenReadyRequest, Dt as CoherenceRisk, Et as CoherenceReadiness, F as CommitSha, O as MyPrMergeWhenReadyResult, P as MyPrsStatus, Q as TeamReviewActionResult, S as MyPrKeepMergeableResult, T as MyPrMergeResult, Tt as CoherenceOrient, Z as TeamReviewActionRequest, _t as GithubPollingRefreshResult, gt as GithubPollingRefreshRequest, jt as CoherenceWorkState, mt as REPO_SLUG_RE, n as BUILTIN_AGENT_IDS, nt as TeamReviewStatus, vt as githubPollingShape, w as MyPrMergeRequest, x as MyPrKeepMergeableRequest } from "./config-rPbbL4nW.js";
+import { D as SessionDoc, Dt as hasRequiredActionHead, G as MyPrMergeWhenReadyResult, H as MyPrMergeResult, It as GithubPollingRefreshRequest, Lt as GithubPollingRefreshResult, N as TaskTitle, O as SessionSnapshot, P as LinkedPr, Pt as REPO_SLUG_RE, Q as SessionPrLinks, R as MyPrKeepMergeableRequest, Rt as githubPollingShape, V as MyPrMergeRequest, W as MyPrMergeWhenReadyRequest, Z as MyPrsStatus, _ as ConversationApprovalDecision, _t as TeamReviewActionResult, b as PendingWakeup, et as CommitSha, g as ConversationApproval, gt as TeamReviewActionRequest, h as ConversationAnswers, k as SessionState, w as SESSION_DOC_PATH_MAX_CHARS, xt as TeamReviewStatus, z as MyPrKeepMergeableResult } from "./session-BZbariv5.js";
+import { J as CoherenceOrient, X as CoherenceRisk, Y as CoherenceReadiness, et as CoherenceWorkState, h as FactorySettings, n as BUILTIN_AGENT_IDS } from "./config-BYc2z1Oc.js";
 import { z } from "zod";
 //#region shared/contracts/factory.ts
 var FactoryConsequences = z.looseObject({ records: z.array(z.looseObject({
@@ -15,6 +15,7 @@ var FactoryConsequences = z.looseObject({ records: z.array(z.looseObject({
 	session: z.string().optional(),
 	evidence: z.string().optional()
 })) });
+var confirmedFlakes = z.array(z.string().min(1)).max(256);
 var FactoryProjectState = z.object({
 	projectId: z.string(),
 	projectName: z.string(),
@@ -34,6 +35,12 @@ var FactoryProjectState = z.object({
 	spentTodayUsd: z.number().finite().nonnegative().optional(),
 	dailyBudgetUsd: z.number().finite().nonnegative().nullable().optional(),
 	verifierIntentIds: z.array(z.string()).optional(),
+	confirmedFlakesByIntent: z.record(z.string().min(1), confirmedFlakes).optional(),
+	partialIntentIds: z.array(z.string()).optional(),
+	factoryProfile: FactorySettings.unwrap().unwrap().pick({ checks: true }).extend({
+		focusedTestCommand: z.string().trim().min(1).optional(),
+		widenableScopes: z.array(z.string().trim().min(1)).optional()
+	}).optional(),
 	error: z.string().nullable(),
 	heading: z.object({
 		action: CoherenceOrient.shape.action,
@@ -52,6 +59,9 @@ var FactoryProjectState = z.object({
 		dependsOn: z.array(z.string()),
 		writeScopes: z.array(z.string()),
 		owner: z.string().nullable(),
+		blockReason: z.string().nullable().optional(),
+		parked: z.boolean().optional(),
+		blockCount: z.number().int().nonnegative().optional(),
 		lastEvent: z.object({
 			event: z.string(),
 			at: z.string(),
@@ -79,7 +89,11 @@ var FactoryHarnessStateLine = z.object({
 	state: FactoryState
 });
 var FactoryHarnessVerdict = z.looseObject({
-	outcome: z.enum(["pass", "fail"]),
+	outcome: z.enum([
+		"pass",
+		"partial",
+		"fail"
+	]),
 	failureClass: z.string().nullable().optional()
 });
 var FACTORY_ERROR_MAX_CHARS = 16384;
@@ -141,12 +155,22 @@ var FactoryQueueIntentResult = z.object({
 });
 var FactoryControlRequest = z.object({
 	projectId,
-	action: z.enum(["pause", "resume"])
+	action: z.enum([
+		"pause",
+		"resume",
+		"retry-parked",
+		"rerun-setup"
+	]),
+	intentId: z.string().trim().min(1).max(128).optional()
+}).refine((request) => request.action !== "retry-parked" || request.intentId !== void 0, {
+	message: "Retry parked requires an intentId",
+	path: ["intentId"]
 });
 var FactoryControlResult = z.object({
 	projectId: z.string().max(128),
 	action: FactoryControlRequest.shape.action,
 	ok: z.boolean(),
+	reopenedWorkIds: z.array(z.string().min(1)).optional(),
 	error: z.string().max(FACTORY_ERROR_MAX_CHARS).optional()
 });
 var FactoryReviewVerdict = z.object({
@@ -181,6 +205,8 @@ var FactoryLaneState = z.object({
 	trustedIntentIds: z.array(z.string().min(1)).optional(),
 	intentWriteScopes: z.record(z.string().min(1), z.array(z.string().min(1))).optional(),
 	intentFloorAllowances: z.record(z.string().min(1), floorAllowances).optional(),
+	intentConfirmedFlakes: z.record(z.string().min(1), confirmedFlakes).optional(),
+	intentScopeNeeds: z.record(z.string().min(1), z.array(z.string().min(1)).max(256)).optional(),
 	ticketedIntentIds: z.array(z.string().min(1)).optional(),
 	pendingIntentTickets: z.record(z.string().min(1), z.object({
 		risk: CoherenceRisk,
@@ -191,7 +217,7 @@ var FactoryLaneState = z.object({
 	factoryLandedShas: z.array(z.string().regex(/^[a-f0-9]{40,64}$/)).optional(),
 	unlandedFactoryRecords: z.array(FactoryUnlandedRecord).optional(),
 	ticketBlockCounts: z.record(z.string().min(1), z.number().int().nonnegative()).optional(),
-	intentCapCancelCounts: z.record(z.string().min(1), z.number().int().nonnegative()).optional()
+	notifiedIntentOutcomes: z.array(z.string().min(1)).optional()
 });
 var FactoryWorkerEvent = z.object({
 	workId: z.string().min(1),
@@ -269,7 +295,7 @@ var decisionFields = {
 	attempt: z.number().int().positive().nullable(),
 	durationMs: z.number().int().nonnegative().nullable(),
 	failureClass: FactoryDecisionFailureClass.nullable(),
-	reason: z.string().max(1e3).nullable()
+	reason: z.string().max(3999).nullable()
 };
 var FactoryDecisionLogLine = z.discriminatedUnion("kind", [
 	z.strictObject({
@@ -1233,6 +1259,7 @@ var UpdateJournalSummary = UpdateJournal.pick({
 //#region shared/contracts/control-messages.ts
 var requestId = z.string().nullable().optional();
 var sessionId = z.string();
+var PullRequestKey = SessionPrLinks.shape.unlinkedKeys.unwrap().element;
 function loose(type, shape) {
 	return z.looseObject({
 		type: z.literal(type),
@@ -1275,8 +1302,10 @@ var SessionCardFields = z.object({
 	saneYolo: z.boolean(),
 	worktree: z.boolean(),
 	workspace: z.boolean().optional(),
+	guarded: z.boolean().optional(),
 	resumeSessionId: nullableString,
-	ephemeral: z.boolean().optional()
+	ephemeral: z.boolean().optional(),
+	linkedPrs: z.array(LinkedPr).optional()
 });
 var DIFF_ANNOTATION_NOTE_MAX_CHARS = 1e3;
 var DIFF_ANNOTATION_PATH_RE = new RegExp(`^[^${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]+$`);
@@ -1383,6 +1412,14 @@ var clientVariants = [
 		id: sessionId,
 		title: TaskTitle
 	}),
+	loose("link-session-pr", {
+		id: sessionId,
+		key: PullRequestKey
+	}),
+	loose("unlink-session-pr", {
+		id: sessionId,
+		key: PullRequestKey
+	}),
 	loose("reorder-sessions", { order: z.array(sessionId) }),
 	loose("ping", { requestId }),
 	loose("get-settings", { requestId }),
@@ -1390,8 +1427,14 @@ var clientVariants = [
 		settings: z.record(z.string(), z.unknown()),
 		requestId
 	}),
-	loose("scan-repo-roots", { requestId }),
-	loose("list-agents", { requestId }),
+	loose("scan-repo-roots", {
+		requestId,
+		includeSuggestions: z.boolean().optional()
+	}),
+	loose("list-agents", {
+		requestId,
+		rescan: z.boolean().optional()
+	}),
 	loose("get-radar-report", {
 		issueId: z.union([z.string(), z.number()]),
 		requestId
@@ -1418,9 +1461,16 @@ var clientVariants = [
 		action: z.string(),
 		requestId
 	}),
+	loose("open-team-review-session", {
+		requestId,
+		key: PullRequestKey
+	}),
 	loose("team-review-action", {
 		...TeamReviewActionRequest.shape,
 		requestId
+	}).refine(hasRequiredActionHead, {
+		message: "only discard may omit head",
+		path: ["head"]
 	}),
 	loose("factory-queue-intent", {
 		...FactoryQueueIntentRequest.shape,
@@ -1484,6 +1534,7 @@ var clientVariants = [
 	}),
 	loose("session-trace", {
 		id: sessionId,
+		requestId,
 		after: z.number().int().nonnegative().default(0),
 		endingAt: z.union([z.number().int().nonnegative(), z.literal("tail")]).optional()
 	}),
@@ -1494,6 +1545,16 @@ var clientVariants = [
 		draft: z.boolean().optional()
 	}),
 	loose("plan-decision", PlanDecision.shape),
+	loose("set-session-conversation-view", {
+		id: sessionId,
+		isOn: z.boolean()
+	}),
+	loose("conversation-approval", {
+		id: sessionId,
+		requestId: ConversationApproval.shape.requestId,
+		decision: ConversationApprovalDecision,
+		answers: ConversationAnswers.optional()
+	}),
 	loose("session-doc-read", {
 		id: sessionId,
 		path: sessionDocPath,
@@ -1528,11 +1589,13 @@ Object.freeze([
 	"session-removed",
 	"session-renamed",
 	"session-title",
+	"session-prs",
 	"session-modified",
 	"session-git",
 	"session-agents",
 	"session-wakeup",
 	"session-prompt",
+	"session-conversation",
 	"session-sleep",
 	"session-wake",
 	"session-merge-status",
@@ -1577,6 +1640,7 @@ Object.freeze([
 	"radar-open-session-result",
 	"issue-detail-result",
 	"open-issue-session-result",
+	"open-team-review-session-result",
 	"radar-issue-action-result",
 	"team-review-action-result",
 	"benchmark-action-result",
@@ -1668,8 +1732,7 @@ var serverVariants = [
 		event: z.string(),
 		timestamp,
 		skipPerms: z.boolean().optional(),
-		saneYolo: z.boolean().optional(),
-		hasEndedTurn: z.boolean().optional()
+		saneYolo: z.boolean().optional()
 	}),
 	loose("session-added", SessionCardFields.shape),
 	loose("session-modified", SessionCardFields.shape),
@@ -1687,6 +1750,10 @@ var serverVariants = [
 		taskTitle: TaskTitle.nullable(),
 		isCustom: z.boolean()
 	}),
+	loose("session-prs", {
+		id: sessionId,
+		linkedPrs: z.array(LinkedPr)
+	}),
 	loose("session-git", {
 		id: sessionId,
 		worktree: z.boolean()
@@ -1706,9 +1773,14 @@ var serverVariants = [
 		isCompacting: z.boolean().optional(),
 		id: sessionId,
 		pendingPromptKind: nullableString,
-		pendingPromptDetail: PendingPromptDetail.nullable().optional(),
 		timestamp
 	}),
+	loose("session-conversation", {
+		id: sessionId,
+		hasConversationBridge: z.boolean(),
+		isConversationViewOn: z.boolean(),
+		conversationApproval: ConversationApproval.nullable()
+	}),
 	loose("session-sleep"),
 	loose("session-wake"),
 	loose("session-merge-status", {
@@ -1795,6 +1867,7 @@ var serverVariants = [
 	}),
 	loose("session-trace-response", {
 		id: sessionId,
+		requestId,
 		records: z.array(TraceRecord),
 		start: z.number().int().nonnegative(),
 		next: z.number().int().nonnegative(),
@@ -1879,6 +1952,11 @@ var serverVariants = [
 				path: z.string()
 			}))
 		})),
+		suggestions: z.array(openObject({
+			path: z.string(),
+			label: z.string(),
+			gitRepoCount: z.number().int().nonnegative()
+		})).optional(),
 		error: z.string().optional()
 	}),
 	loose("conversations", {
@@ -1958,6 +2036,16 @@ var serverVariants = [
 		pending: z.boolean().optional(),
 		existing: z.boolean().optional()
 	}),
+	loose("open-team-review-session-result", {
+		requestId,
+		ok: z.boolean(),
+		error: optionalError,
+		key: PullRequestKey.optional(),
+		sessionId: z.string().optional(),
+		sessionName: z.string().optional(),
+		pending: z.boolean().optional(),
+		existing: z.boolean().optional()
+	}),
 	loose("radar-issue-action-result", {
 		requestId,
 		ok: z.boolean(),

package/dist/chunks/git-version-6QFnKbWa.js

@@ -0,0 +1,139 @@
+import { t as AGENT_API_VERBS } from "./session-BZbariv5.js";
+import { r as execFileSync } from "./child-process-safe-CbQnyh7D.js";
+//#region server/core/command-line-core.ts
+var SUBCOMMANDS_HONORING_TRAILING_GLOBAL_OPTIONS = /* @__PURE__ */ new Set([
+	"doctor",
+	"pair",
+	"visions"
+]);
+var SUBCOMMANDS_HONORING_A_LEADING_HELP_OR_VERSION = /* @__PURE__ */ new Set([...AGENT_API_VERBS, "factory"]);
+var OPTIONS_TAKING_A_VALUE = {
+	"--config": "configPath",
+	"--port": "port"
+};
+function scanGlobalOption(argv, index, state) {
+	const token = argv[index];
+	const valueKey = OPTIONS_TAKING_A_VALUE[token];
+	if (valueKey) {
+		const value = argv[index + 1];
+		if (value !== void 0) state[valueKey] = value;
+		return index + 2;
+	}
+	if (token === "--help" || token === "-h") state.wantsHelp = true;
+	if (token === "--version") state.wantsVersion = true;
+	if (token === "--doctor") state.wantsDoctor = true;
+	if (token === "--no-open") state.wantsNoOpen = true;
+	return index + 1;
+}
+function scanTrailingGlobalOptions(subcommandArgs, state) {
+	let index = 0;
+	while (index < subcommandArgs.length) {
+		if (!subcommandArgs[index].startsWith("-")) {
+			index += 1;
+			continue;
+		}
+		index = scanGlobalOption(subcommandArgs, index, state);
+	}
+}
+function scanLeadingHelpOrVersion(subcommandArgs, state) {
+	const firstArgument = subcommandArgs[0];
+	if (firstArgument === "--help" || firstArgument === "-h") state.wantsHelp = true;
+	if (firstArgument === "--version") state.wantsVersion = true;
+}
+function parseCommandLine(argv) {
+	const state = {
+		configPath: null,
+		port: null,
+		wantsHelp: false,
+		wantsVersion: false,
+		wantsDoctor: false,
+		wantsNoOpen: false
+	};
+	let index = 0;
+	while (index < argv.length && argv[index].startsWith("-")) index = scanGlobalOption(argv, index, state);
+	const name = argv[index];
+	const subcommandArgs = argv.slice(index + 1);
+	if (name !== void 0 && SUBCOMMANDS_HONORING_TRAILING_GLOBAL_OPTIONS.has(name)) scanTrailingGlobalOptions(subcommandArgs, state);
+	if (name !== void 0 && SUBCOMMANDS_HONORING_A_LEADING_HELP_OR_VERSION.has(name)) scanLeadingHelpOrVersion(subcommandArgs, state);
+	if (state.wantsHelp) return { kind: "help" };
+	if (state.wantsVersion) return { kind: "version" };
+	const globalOptions = {
+		configPath: state.configPath,
+		port: state.port
+	};
+	if (state.wantsDoctor) return {
+		kind: "subcommand",
+		name: "doctor",
+		subcommandArgs: [],
+		globalOptions
+	};
+	if (name === void 0) return {
+		kind: "server",
+		globalOptions,
+		isBrowserOpenSkipped: state.wantsNoOpen
+	};
+	return {
+		kind: "subcommand",
+		name,
+		subcommandArgs,
+		globalOptions
+	};
+}
+//#endregion
+//#region server/git/core/git-version-core.ts
+var NEW_WORK_ISOLATION_FLOOR = Object.freeze({
+	major: 2,
+	minor: 48
+});
+var NEW_WORK_ISOLATION_FLOOR_LABEL = `${NEW_WORK_ISOLATION_FLOOR.major}.${NEW_WORK_ISOLATION_FLOOR.minor}`;
+var WHOLE_RANGE_CONSEQUENCE = "a team re-review cannot single out the author's new work and reviews the whole pull request range";
+var GIT_UPDATE_HINT = `Update git to ${NEW_WORK_ISOLATION_FLOOR_LABEL} or newer`;
+var UNKNOWN_GIT_VERSION = Object.freeze({
+	version: null,
+	isTooOldToIsolateNewWork: false
+});
+function gitVersionReport(versionOutput) {
+	const match = /^git version (\d+)\.(\d+)(?:\.(\d+))?/.exec(versionOutput?.trim() ?? "");
+	if (!match) return UNKNOWN_GIT_VERSION;
+	const [, major = "", minor = "", patch] = match;
+	const isBelowFloorMajor = Number(major) < NEW_WORK_ISOLATION_FLOOR.major;
+	const isBelowFloorMinor = Number(major) === NEW_WORK_ISOLATION_FLOOR.major && Number(minor) < NEW_WORK_ISOLATION_FLOOR.minor;
+	return {
+		version: [
+			major,
+			minor,
+			patch
+		].filter((part) => part !== void 0).join("."),
+		isTooOldToIsolateNewWork: isBelowFloorMajor || isBelowFloorMinor
+	};
+}
+function gitBootWarning(report) {
+	if (!report.isTooOldToIsolateNewWork) return null;
+	return `[git] git ${report.version} is older than ${NEW_WORK_ISOLATION_FLOOR_LABEL}, so ${WHOLE_RANGE_CONSEQUENCE}. ${GIT_UPDATE_HINT}.`;
+}
+function gitDoctorRows(report) {
+	const versionRow = ["git", report.version ?? "unknown"];
+	if (!report.isTooOldToIsolateNewWork) return [versionRow];
+	return [versionRow, ["hint", `${GIT_UPDATE_HINT}: on an older one ${WHOLE_RANGE_CONSEQUENCE}`]];
+}
+//#endregion
+//#region server/git/git-version.ts
+function readGitVersionOutput() {
+	return execFileSync("git", ["--version"], {
+		encoding: "utf8",
+		timeout: 3e3
+	});
+}
+function probeGitVersion({ readVersionOutput = readGitVersionOutput } = {}) {
+	try {
+		return gitVersionReport(readVersionOutput());
+	} catch {
+		return gitVersionReport(null);
+	}
+}
+function warnWhenGitIsTooOld({ probe = probeGitVersion, log = console } = {}) {
+	const warning = gitBootWarning(probe());
+	if (warning !== null) log.warn(warning);
+}
+//#endregion
+export { parseCommandLine as i, warnWhenGitIsTooOld as n, gitDoctorRows as r, probeGitVersion as t };

package/dist/chunks/{grok-KKgdSe-7.js → grok-CZ6kP_vD.js}

@@ -1,10 +1,10 @@
 import { r as errorMessage } from "./text-DoirglWV.js";
 import { o as relayPath } from "./runtime-paths-BkeftE60.js";
-import { n as AGENT_URL_ENV, y as SIGN_URL_ENV } from "./session-D6xXN0UU.js";
+import { T as SIGN_URL_ENV, n as AGENT_URL_ENV } from "./session-BZbariv5.js";
 import { t as HOOK_URL_ENV } from "./hook-relay-core-DA_bz2KA.js";
 import { n as isRecord } from "./coerce-NSst8oRP.js";
-import { a as SANE_YOLO_PATH_ENV, n as RTK_PATH_ENV, o as saneYoloEnv } from "./rtk-hook-core-BmEz2aq9.js";
-import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
+import { o as SANE_YOLO_PATH_ENV, r as RTK_PATH_ENV, s as saneYoloEnv } from "./rtk-hook-core-VrUafGAp.js";
+import { t as buildHookCommand } from "./hook-command-core-qTNK-xMF.js";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -271,6 +271,9 @@ function mayContributeHooks(configText) {
 	if (!isRecord(settings)) return false;
 	return Object.hasOwn(settings, "hooks");
 }
+function userConfigFolders() {
+	return [path.join(os.homedir(), ".claude")];
+}
 function mapHookToSignal(event, payload) {
 	const normalizedEvent = String(event || "").toLowerCase();
 	if (normalizedEvent === "subagentstart") return "subagent-start";
@@ -403,6 +406,7 @@ var grok = {
 				hookToolRelayPath: HOOK_TOOL_RELAY_PATH
 			}),
 			projectConfigCandidates: PROJECT_CONFIG_CANDIDATES,
+			userConfigFolders,
 			mayContributeHooks
 		}
 	},

package/dist/chunks/guardrails-deps-Cb-ki4EU.js

@@ -0,0 +1,70 @@
+import { i as execSync } from "./child-process-safe-CbQnyh7D.js";
+import { r as resolvePathCommandMatches } from "./spawn-command-Cc40FiZI.js";
+//#region server/guardrails/core/guardrails-deps-core.ts
+var LINUX_GUARDRAILS_BINARIES = Object.freeze([
+	"bwrap",
+	"socat",
+	"rg"
+]);
+var NO_GUARDRAILS_BINARIES = Object.freeze([]);
+var GUARDRAILS_INSTALL_HINT = "Install bubblewrap, socat and ripgrep, for example: sudo apt install bubblewrap socat ripgrep";
+var GUARDED_WORK = "guarded sessions and factory checks";
+function requiredGuardrailsBinaries(platform) {
+	return platform === "linux" ? LINUX_GUARDRAILS_BINARIES : NO_GUARDRAILS_BINARIES;
+}
+function guardrailsDependencyReport({ platform, binariesOnPath }) {
+	const requiredBinaries = requiredGuardrailsBinaries(platform);
+	const missingBinaries = requiredBinaries.filter((binary) => !binariesOnPath.has(binary));
+	return {
+		platform,
+		requiredBinaries,
+		missingBinaries,
+		installHint: missingBinaries.length > 0 ? GUARDRAILS_INSTALL_HINT : null
+	};
+}
+function namesList(names) {
+	if (names.length <= 1) return names.join("");
+	return `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
+}
+function missingBinariesPhrase(report) {
+	return `${namesList(report.missingBinaries)} ${report.missingBinaries.length === 1 ? "is" : "are"} not on PATH`;
+}
+function guardrailsSpawnRefusal(report) {
+	if (report.missingBinaries.length === 0) return null;
+	return `not started: the guardrails need ${namesList(report.requiredBinaries)}, and ${missingBinariesPhrase(report)}. ${report.installHint}`;
+}
+function guardrailsBootWarning(report) {
+	if (report.missingBinaries.length === 0) return null;
+	return `[guardrails] ${missingBinariesPhrase(report)}, so ${GUARDED_WORK} will refuse to start. ${report.installHint}`;
+}
+function guardrailsDoctorRows(report) {
+	if (report.requiredBinaries.length === 0) return [["guardrails", `nothing to check on ${report.platform}`]];
+	const binaryRows = report.requiredBinaries.map((binary) => [binary, report.missingBinaries.includes(binary) ? "MISSING" : "found"]);
+	if (report.installHint === null) return binaryRows;
+	return [...binaryRows, ["hint", report.installHint]];
+}
+function guardrailsInstallNotice(report) {
+	if (report.installHint === null) return null;
+	return `glimmervoid: ${missingBinariesPhrase(report)}; ${GUARDED_WORK} need ${namesList(report.requiredBinaries)}. ${report.installHint}`;
+}
+//#endregion
+//#region server/guardrails/guardrails-deps.ts
+function probeGuardrailsDependencies({ platform = process.platform, exec = execSync } = {}) {
+	return guardrailsDependencyReport({
+		platform,
+		binariesOnPath: new Set(requiredGuardrailsBinaries(platform).filter((binary) => resolvePathCommandMatches(binary, {
+			platform,
+			exec
+		}).length > 0))
+	});
+}
+function checkGuardrailsDependencies({ probe = probeGuardrailsDependencies, log = console } = {}) {
+	const report = probe();
+	const warning = guardrailsBootWarning(report);
+	if (warning !== null) log.warn(warning);
+	const refusal = guardrailsSpawnRefusal(report);
+	return () => refusal;
+}
+var allowGuardedSpawn = () => null;
+//#endregion
+export { guardrailsInstallNotice as a, guardrailsDoctorRows as i, checkGuardrailsDependencies as n, probeGuardrailsDependencies as r, allowGuardedSpawn as t };

package/dist/chunks/{sandbox-proxy-core-hnQgKR0T.js → guardrails-proxy-core-BI3rdY-m.js}

@@ -1,6 +1,6 @@
 import { a as isLoopbackHostname } from "./hook-relay-core-DA_bz2KA.js";
-//#region session/core/sandbox-proxy-core.ts
-var HOOK_VIA_SANDBOX_PROXY_ENV = "GLIMMERVOID_HOOK_VIA_SANDBOX_PROXY";
+//#region session/core/guardrails-proxy-core.ts
+var HOOK_VIA_GUARDRAILS_PROXY_ENV = "GLIMMERVOID_HOOK_VIA_GUARDRAILS_PROXY";
 function decodeProxyCredential(percentEncoded) {
 	try {
 		return decodeURIComponent(percentEncoded);
@@ -8,7 +8,7 @@ function decodeProxyCredential(percentEncoded) {
 		return null;
 	}
 }
-function decideSandboxProxy(env) {
+function decideGuardrailsProxy(env) {
 	if (env.SANDBOX_RUNTIME !== "1") return null;
 	const rawProxyUrl = env.HTTP_PROXY || env.http_proxy || "";
 	if (!URL.canParse(rawProxyUrl)) return null;
@@ -24,4 +24,4 @@ function decideSandboxProxy(env) {
 	};
 }
 //#endregion
-export { decideSandboxProxy as n, HOOK_VIA_SANDBOX_PROXY_ENV as t };
+export { decideGuardrailsProxy as n, HOOK_VIA_GUARDRAILS_PROXY_ENV as t };

package/dist/chunks/{hook-command-core-DclEoE9e.js → hook-command-core-qTNK-xMF.js}

@@ -10,5 +10,8 @@ function buildHookCommand(relayPath, event, argvTail = []) {
 	const forwardSlashedPath = rawPath.replace(/\\/g, "/");
 	return `node ${/\s/.test(forwardSlashedPath) ? `"${forwardSlashedPath}"` : forwardSlashedPath} ${rawEvent}${argvTail.length ? ` ${argvTail.join(" ")}` : ""}`;
 }
+function shellQuote(value) {
+	return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
 //#endregion
-export { buildHookCommand as t };
+export { shellQuote as n, buildHookCommand as t };

package/dist/chunks/{hook-tools-UX2fmt81.js → hook-tools-BkxllUHE.js}

@@ -1,6 +1,6 @@
 import { r as resolvePathCommandMatches } from "./spawn-command-Cc40FiZI.js";
-import { a as SANE_YOLO_PATH_ENV, n as RTK_PATH_ENV, o as saneYoloEnv } from "./rtk-hook-core-BmEz2aq9.js";
-import { t as buildHookCommand } from "./hook-command-core-DclEoE9e.js";
+import { o as SANE_YOLO_PATH_ENV, r as RTK_PATH_ENV, s as saneYoloEnv, t as CLAUDE_RELAY_FLAVOR } from "./rtk-hook-core-VrUafGAp.js";
+import { n as shellQuote, t as buildHookCommand } from "./hook-command-core-qTNK-xMF.js";
 import path from "node:path";
 //#region session/core/hook-tools.ts
 function firstExistingFile(candidates, fsApi) {
@@ -19,22 +19,9 @@ function resolveRtkPath({ glimmervoidHome, platform, exec, fsApi }) {
 	if (!firstMatch) return null;
 	return path.resolve(firstMatch);
 }
-function quoteCommandPath(commandPath) {
-	if (!/\s/.test(commandPath)) return commandPath;
-	return `"${commandPath}"`;
-}
 function toForwardSlashes(commandPath) {
 	return commandPath.replace(/\\/g, "/");
 }
-function buildRtkHookEntry(rtkPath) {
-	return {
-		matcher: "Bash",
-		hooks: [{
-			type: "command",
-			command: `${quoteCommandPath(toForwardSlashes(rtkPath))} hook claude`
-		}]
-	};
-}
 function codexGroup(command) {
 	if (!command) return null;
 	return `{matcher='Bash',hooks=[{type='command',command='${command}'}]}`;
@@ -44,7 +31,13 @@ var HOOK_TOOLS = {
 		capability: "rtk",
 		purpose: "rtk command rewriting",
 		env: (tool) => ({ [RTK_PATH_ENV]: tool.binPath }),
-		claudeEntry: (tool) => buildRtkHookEntry(tool.binPath),
+		claudeEntry: (_tool, relayPath) => ({
+			matcher: "Bash",
+			hooks: [{
+				type: "command",
+				command: `node ${shellQuote(toForwardSlashes(relayPath))} rtk ${CLAUDE_RELAY_FLAVOR}`
+			}]
+		}),
 		codexGroup: (_tool, relayPath) => codexGroup(buildHookCommand(relayPath, "rtk"))
 	},
 	saneYolo: {

package/dist/chunks/{knowledge-graph-cli-Rj5nj87L.js → knowledge-graph-cli-DApeMzA8.js}

@@ -2,7 +2,7 @@ import { r as errorMessage } from "./text-DoirglWV.js";
 import { s as resolvePackageBin } from "./runtime-paths-BkeftE60.js";
 import { r as execFileSync } from "./child-process-safe-CbQnyh7D.js";
 import { n as glimmervoidHomeDir, t as decideConfigPath } from "./config-path-core-DFt-TemS.js";
-import { r as BrowserConfig } from "./config-rPbbL4nW.js";
+import { r as BrowserConfig } from "./config-BYc2z1Oc.js";
 import fs, { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import path, { dirname, join, posix, resolve, win32 } from "node:path";
 import os from "node:os";

package/dist/chunks/{loopback-post-DepQfdcM.js → loopback-post-DJ6iYWuL.js}

@@ -1,5 +1,5 @@
 import { a as isLoopbackHostname } from "./hook-relay-core-DA_bz2KA.js";
-import { n as decideSandboxProxy } from "./sandbox-proxy-core-hnQgKR0T.js";
+import { n as decideGuardrailsProxy } from "./guardrails-proxy-core-BI3rdY-m.js";
 import http from "node:http";
 //#region session/loopback-post.ts
 var POST_TIMEOUT_MS = 1500;
@@ -16,11 +16,11 @@ function directRoute(target) {
 		path: `${target.pathname}${target.search}`
 	};
 }
-function sandboxProxyRoute(sandboxProxy, target) {
-	const proxyHeaders = sandboxProxy.authorization ? { "proxy-authorization": sandboxProxy.authorization } : {};
+function guardrailsProxyRoute(guardrailsProxy, target) {
+	const proxyHeaders = guardrailsProxy.authorization ? { "proxy-authorization": guardrailsProxy.authorization } : {};
 	return {
-		hostname: sandboxProxy.hostname,
-		port: sandboxProxy.port,
+		hostname: guardrailsProxy.hostname,
+		port: guardrailsProxy.port,
 		path: target.href,
 		headers: {
 			...proxyHeaders,
@@ -81,10 +81,10 @@ async function postToLoopback(url, body, env = process.env) {
 	const target = new URL(url);
 	if (target.protocol !== "http:") return refusal("not-http");
 	if (!isLoopbackHostname(target.hostname)) return refusal("not-loopback");
-	if (env["GLIMMERVOID_HOOK_VIA_SANDBOX_PROXY"] !== "1") return sendPost(directRoute(target), body);
-	const sandboxProxy = decideSandboxProxy(env);
-	if (!sandboxProxy) return refusal("sandbox-proxy-missing");
-	return sendPost(sandboxProxyRoute(sandboxProxy, target), body);
+	if (env["GLIMMERVOID_HOOK_VIA_GUARDRAILS_PROXY"] !== "1") return sendPost(directRoute(target), body);
+	const guardrailsProxy = decideGuardrailsProxy(env);
+	if (!guardrailsProxy) return refusal("guardrails-proxy-missing");
+	return sendPost(guardrailsProxyRoute(guardrailsProxy, target), body);
 }
 async function postPayload(url, body) {
 	return (await postToLoopback(url, body)).responseBody;