halfcycle 0.4.18 → 0.5.1

package/bin/bin.bundle.mjs

@@ -15033,6 +15033,7 @@ var HOOK_REMEDY = `Run ${SIGN_IN_COMMAND} in the project folder to sign in.`;
 // ../core/dist/task-plan.js
 var TASK_PLAN_TASKS_MAX = 500;
 var TASK_PLAN_ID_MAX = 64;
+var TASK_PLAN_BUILDS_NONE = "none";
 var TASK_PLAN_KINDS = ["build", "review", "spec", "walk", "check"];
 var CONTROL_CHARACTER = /[\u0000-\u001f\u007f-\u009f]/;
 var planText = external_exports.string().refine((text) => !CONTROL_CHARACTER.test(text), { message: "holds a control character" });
@@ -15048,7 +15049,8 @@ var taskPlanTaskSchema = external_exports.object({
     interfaces: external_exports.array(planText).optional()
   }).strict().optional(),
   wholeProject: external_exports.literal(true).optional(),
-  ships: external_exports.enum(["deploy", "release"]).optional()
+  ships: external_exports.enum(["deploy", "release"]).optional(),
+  builds: external_exports.union([external_exports.literal(TASK_PLAN_BUILDS_NONE), external_exports.array(planText)]).optional()
 }).strict().superRefine((task, ctx) => {
   if (task.reviews !== void 0 && task.kind !== "review") {
     ctx.addIssue({
@@ -15085,6 +15087,101 @@ var taskListFileSchema = external_exports.union([
   external_exports.array(external_exports.unknown())
 ]);
 
+// ../core/dist/agent-profile.js
+var AGENT_IDS = ["claude-code", "codex"];
+var CLAUDE_CODE_PROFILE = {
+  id: "claude-code",
+  settingsFiles: [SETTINGS_REL, LOCAL_SETTINGS_REL],
+  wiring: HALFCYCLE_HOOK_WIRING,
+  commands: HALFCYCLE_HOOK_COMMANDS,
+  wiringPaths: HALFCYCLE_HOOK_WIRING_PATHS,
+  writeCapableTools: WRITE_CAPABLE_TOOLS,
+  projectRoot: "claude-project-dir",
+  configFolder: "claude-config",
+  mcpRegistration: { file: MCP_REGISTRATION_REL, serversKey: "mcpServers", serverKey: MCP_SERVER_KEY },
+  tierModels: {
+    deep: { model: "opus" },
+    standard: { model: "sonnet" },
+    fast: { model: "haiku" }
+  }
+};
+var CODEX_HOOKS_REL = ".codex/hooks.json";
+var CODEX_CONFIG_REL = ".codex/config.toml";
+function codexHookCommand(script, args2) {
+  const invocation = `cd "$(git rev-parse --show-toplevel)" && bash ./${script}`;
+  return args2 === void 0 ? invocation : `${invocation} ${args2}`;
+}
+var CODEX_WINDOWS_NOT_SET_UP = "Halfcycle checks did not run because Halfcycle is not set up in this folder or any folder above it; run npx halfcycle in the project folder.";
+var CODEX_WINDOWS_NO_GIT_BASH = "Halfcycle checks did not run because Git for Windows was not found; install Git for Windows, then open a new session.";
+function codexHookCommandWindows(script, args2) {
+  const tick = (text) => "`" + text + "`";
+  const argv = [script, ...args2 === void 0 ? [] : args2.split(" ")].map(tick).join(",");
+  const program = [
+    "const p=require(`path`),f=require(`fs`),c=require(`child_process`);",
+    "let d=process.cwd();",
+    `for(;;){if(f.existsSync(p.join(d,${tick(VENDORED_BIN_REL)})))break;`,
+    "const u=p.dirname(d);",
+    "if(u===d){d=``;break}",
+    "d=u}",
+    `if(d===\`\`){console.error(${tick(CODEX_WINDOWS_NOT_SET_UP)})}else{`,
+    "const g=c.spawnSync(`git`,[`--exec-path`],{encoding:`utf8`});",
+    "const b=g.status===0?p.join(g.stdout.trim(),`..`,`..`,`..`,`bin`,`bash.exe`):``;",
+    `if(b===\`\`||!f.existsSync(b)){console.error(${tick(CODEX_WINDOWS_NO_GIT_BASH)})}else{`,
+    `const r=c.spawnSync(b,[${argv}],{cwd:d,stdio:\`inherit\`});`,
+    "process.exitCode=typeof r.status===`number`?r.status:1}}"
+  ].join("");
+  return `node -e '${program}'`;
+}
+function codexHookRow(event, matcher, timeout, script, args2) {
+  return {
+    event,
+    matcher,
+    timeout,
+    command: codexHookCommand(script, args2),
+    script,
+    commandWindows: codexHookCommandWindows(script, args2)
+  };
+}
+var CODEX_WRITE_CAPABLE_TOOLS = ["apply_patch", "Edit", "Write"];
+var CODEX_PRE_TOOL_USE_MATCHER = "^(Bash|apply_patch)$";
+var CODEX_HOOK_WIRING = [
+  codexHookRow("SessionStart", null, 5, SESSION_START_MARKER_REL),
+  codexHookRow("SessionStart", null, 10, GUARD_RUNNER_REL, "refresh-credential --agent codex"),
+  codexHookRow("UserPromptSubmit", null, 5, USER_PROMPT_REMINDER_REL),
+  codexHookRow("UserPromptSubmit", null, 10, USER_PROMPT_SCOPE_REL, "--agent codex"),
+  codexHookRow("UserPromptSubmit", null, 10, USER_PROMPT_FINDINGS_REL, "--agent codex"),
+  codexHookRow("PreToolUse", CODEX_PRE_TOOL_USE_MATCHER, 10, GUARD_RUNNER_REL, "hook pre-tool-use --agent codex"),
+  codexHookRow("PostToolUse", CODEX_WRITE_CAPABLE_TOOLS.join("|"), 60, GUARD_RUNNER_REL, "hook post-tool-use --agent codex"),
+  codexHookRow("Stop", null, 60, GUARD_RUNNER_REL, "hook stop --agent codex"),
+  codexHookRow("SubagentStop", null, 60, GUARD_RUNNER_REL, "hook subagent-stop --agent codex"),
+  codexHookRow("SessionEnd", null, 3, SESSION_END_MARKER_REL)
+];
+var RETIRED_CODEX_HOOK_COMMANDS = [];
+function codexHookCommandSet(retired) {
+  return /* @__PURE__ */ new Set([...CODEX_HOOK_WIRING.map((entry) => entry.command), ...retired]);
+}
+var CODEX_PROFILE = {
+  id: "codex",
+  settingsFiles: [CODEX_HOOKS_REL],
+  wiring: CODEX_HOOK_WIRING,
+  commands: codexHookCommandSet(RETIRED_CODEX_HOOK_COMMANDS),
+  wiringPaths: [.../* @__PURE__ */ new Set([CODEX_HOOKS_REL, ...CODEX_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])],
+  writeCapableTools: CODEX_WRITE_CAPABLE_TOOLS,
+  projectRoot: "git-toplevel",
+  configFolder: "codex-home",
+  mcpRegistration: { file: CODEX_CONFIG_REL, serversKey: "mcp_servers", serverKey: MCP_SERVER_KEY },
+  tierModels: {
+    deep: { model: "gpt-6-luna", effort: "high" },
+    standard: { model: "gpt-6-luna", effort: "medium" },
+    fast: { model: "gpt-6-luna", effort: "low" }
+  }
+};
+var AGENT_PROFILES = {
+  "claude-code": CLAUDE_CODE_PROFILE,
+  codex: CODEX_PROFILE
+};
+var ALL_HOOK_COMMANDS = new Set(AGENT_IDS.flatMap((id) => [...AGENT_PROFILES[id].commands]));
+
 // dist/control-origin.js
 var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
 function resolveControlOrigin(env) {
@@ -15269,7 +15366,8 @@ var seatPathSchema = external_exports.object({
 }).strict();
 var seatConfigurationSchema = external_exports.object({
   settingsFiles: external_exports.array(seatSettingsFileSchema),
-  paths: external_exports.array(seatPathSchema)
+  paths: external_exports.array(seatPathSchema),
+  agent: external_exports.string().optional()
 }).strict();
 var evaluationRequestSchema = external_exports.object({
   engagementId: external_exports.string(),
@@ -15960,7 +16058,7 @@ function crossFieldProblems(raw) {
   const parts = Array.isArray(raw.parts) ? raw.parts : [];
   const connections = Array.isArray(raw.connections) ? raw.connections : [];
   const ids = /* @__PURE__ */ new Set();
-  const placed = /* @__PURE__ */ new Map();
+  const placed2 = /* @__PURE__ */ new Map();
   const owners = /* @__PURE__ */ new Map();
   parts.forEach((part, i) => {
     if (!isRecord(part))
@@ -15973,14 +16071,14 @@ function crossFieldProblems(raw) {
     }
     if (typeof part.lane === "string" && typeof part.slot === "number") {
       const place = `${part.lane}\0${part.slot}`;
-      const earlier = placed.get(place);
+      const earlier = placed2.get(place);
       if (earlier !== void 0) {
         problems.push({
           path: `parts.${i}.slot`,
           message: `${quoted(parts[earlier].id)} already sits in lane ${shown(part.lane)} at slot ${part.slot}`
         });
       } else {
-        placed.set(place, i);
+        placed2.set(place, i);
       }
     }
     if (typeof part.outside === "boolean" && Array.isArray(part.owns)) {
@@ -16348,7 +16446,10 @@ var buildSnapshotReportResultSchema = external_exports.object({
   // Which phase the graph was recorded against.
   phase: buildPhaseSchema,
   // When it was recorded.
-  reportedAt: utcIso8601
+  reportedAt: utcIso8601,
+  // One sentence to pass on to the developer about the graph just stored. Absent
+  // when there is nothing to say.
+  warning: external_exports.string().min(1).max(400).optional()
 }).strict();
 
 // ../events/dist/change-path-order.js
@@ -16795,8 +16896,13 @@ var METHOD_FILE_PATTERNS = [
   ".claude/commands",
   ".claude/hooks",
   ".claude/settings.json",
+  ".claude/agents",
   ".mcp.json",
   ".halfcycle",
+  ".agents/skills",
+  ".codex/hooks.json",
+  ".codex/config.toml",
+  ".codex/agents",
   ".workbench",
   "docs/product-spec.md",
   "docs/architecture-overview.md",
@@ -18134,7 +18240,7 @@ function approvalSentence(phase, offerTyping) {
     return TYPED_APPROVAL_OFF_SENTENCE;
   if (offerTyping === "update")
     return CLIENT_UPDATE_SENTENCE;
-  return `In their own Claude Code session, they ask to see the plan, check each part, and then type: approve ${phase}.`;
+  return `In their own coding agent's session, they ask to see the plan, check each part, and then type: approve ${phase}.`;
 }
 function phaseWords(phase) {
   return `phase "${phase}"`;
@@ -18743,6 +18849,7 @@ var savedSchema = external_exports.object({
   branches: external_exports.array(savedBranchSchema)
   // every saved line of work
 }).strict().refine((s) => s.ref === savedRefOf(s.id), { message: "must be the ref of this save", path: ["ref"] });
+var AUTONOMY_A1_TITLE = "Let builds run on their own";
 var AUTONOMY_A4 = 'Builds in this project now run on their own. Turn it off with "autonomy off", or in the console.';
 var AUTONOMY_A5 = "Builds in this project wait for you again.";
 function withoutFinalStop(text) {
@@ -18770,6 +18877,28 @@ var AUTONOMY_A18 = "Halfcycle cannot check PowerShell commands while builds run
 
 // dist/hook-protocol.js
 import { writeSync } from "node:fs";
+
+// dist/agent-argument.js
+var AGENT_FLAG = "--agent";
+function agentFromArguments(rest) {
+  const leading = rest[0] === AGENT_FLAG;
+  const start = leading ? 2 : 0;
+  for (let i = start; i < rest.length; i += 1) {
+    if ((rest[i] ?? "").startsWith(AGENT_FLAG))
+      return null;
+  }
+  if (!leading)
+    return AGENT_PROFILES["claude-code"];
+  const id = rest[1];
+  if (id === void 0 || !isAgentId(id))
+    return null;
+  return AGENT_PROFILES[id];
+}
+function isAgentId(id) {
+  return AGENT_IDS.includes(id);
+}
+
+// dist/hook-protocol.js
 function emitBlock(reason, systemMessage) {
   const body = systemMessage === void 0 ? { decision: "block", reason } : { decision: "block", reason, systemMessage };
   process.stdout.write(JSON.stringify(body) + "\n");
@@ -18783,12 +18912,8 @@ function preToolUseReplyText(answer, text = "", agentLine) {
       hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: text }
     });
   }
-  const forAgent = agentLine === void 0 || agentLine === "" ? text : `${text}
-${agentLine}`;
-  return JSON.stringify({
-    systemMessage: text,
-    hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: forAgent }
-  });
+  const hookSpecificOutput = agentLine === void 0 || agentLine === "" ? { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: text } : { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: text, additionalContext: agentLine };
+  return JSON.stringify({ systemMessage: text, hookSpecificOutput });
 }
 function preToolUseNoticeText(text) {
   return JSON.stringify({ systemMessage: text });
@@ -18808,13 +18933,26 @@ function nonBlockingReply(event, text) {
   }
   return JSON.stringify({ systemMessage: text });
 }
-function hookReply(event) {
+function hookReply(event, profile = AGENT_PROFILES["claude-code"]) {
   const queued = [];
+  const forPerson = [];
   const forAgent = [];
+  const jsonOnly = repliesInJsonOnly(profile);
   return {
     notice(text) {
       queued.push(text);
     },
+    personNotice(text) {
+      queued.push(text);
+      forPerson.push(text);
+    },
+    loud(text, exitCode) {
+      if (jsonOnly)
+        queued.push(text);
+      else
+        writeSync(2, text);
+      process.exitCode = exitCode;
+    },
     agentContext(text) {
       forAgent.push(text);
     },
@@ -18824,11 +18962,23 @@ function hookReply(event) {
     },
     flush() {
       const text = queued.splice(0).join("\n");
+      const person = forPerson.splice(0).join("\n");
       const context = event === "PostToolUse" ? forAgent.splice(0).join("\n") : "";
       const code = process.exitCode;
       if (code !== void 0 && code !== null && Number(code) !== 0) {
-        if (text !== "")
+        if (text === "")
+          return;
+        if (jsonOnly)
+          process.stdout.write(`${jsonOnlyLoudReply(event, text)}
+`);
+        else
           writeSync(2, `${text}
+`);
+        return;
+      }
+      if (jsonOnly && event === "PostToolUse" && person !== "") {
+        process.stdout.write(`${postToolUsePersonReply(person, context === "" ? text : `${text}
+${context}`)}
 `);
         return;
       }
@@ -18844,6 +18994,60 @@ function hookReply(event) {
     }
   };
 }
+function repliesInJsonOnly(profile) {
+  return profile.id === "codex";
+}
+function hookExitCode(profile) {
+  if (repliesInJsonOnly(profile))
+    return 0;
+  const code = process.exitCode;
+  return code === void 0 || code === null ? 0 : Number(code);
+}
+function jsonOnlyLoudReply(event, text) {
+  return event === "PostToolUse" ? postToolUsePersonReply(text, text) : nonBlockingReply(event, text);
+}
+function postToolUsePersonReply(person, agent) {
+  return JSON.stringify({
+    systemMessage: person,
+    hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: agent }
+  });
+}
+function lastResortReply(argv, text) {
+  const [cmd, sub] = argv;
+  let event = null;
+  let rest = [];
+  if (cmd === "refresh-credential") {
+    event = "SessionStart";
+    rest = argv.slice(1);
+  } else if (cmd === "hook" && sub !== void 0 && Object.hasOwn(LAST_RESORT_HOOK_EVENTS, sub)) {
+    event = LAST_RESORT_HOOK_EVENTS[sub] ?? null;
+    rest = argv.slice(2);
+  }
+  if (event === null)
+    return null;
+  const profile = agentFromArguments(rest);
+  if (profile === null || !repliesInJsonOnly(profile))
+    return null;
+  return jsonOnlyLoudReply(event, text);
+}
+function answerUnexpectedError(argv, err, out) {
+  const text = `halfcycle-runner: unexpected error: ${err instanceof Error ? err.message : String(err)}
+Contact hello@halfcycle.ai if this keeps happening.
+`;
+  const reply = lastResortReply(argv, text);
+  if (reply !== null) {
+    out.stdout(`${reply}
+`);
+    return 0;
+  }
+  out.stderr(text);
+  return 1;
+}
+var LAST_RESORT_HOOK_EVENTS = {
+  "post-tool-use": "PostToolUse",
+  stop: "Stop",
+  "subagent-stop": "SubagentStop"
+};
 function postToolUseReply(notice, context) {
   const additionalContext = notice === "" ? context : `${notice}
 ${context}`;
@@ -18855,6 +19059,9 @@ function userPromptContextReply(context) {
 function infraWarningText() {
   return "[Halfcycle] WARNING: Halfcycle's check service could not be reached, so nothing was checked this time. The session continues without checks.";
 }
+function unreadableEditText() {
+  return "[Halfcycle] WARNING: The files this change touched could not be read, so this change was not checked. The session continues.";
+}
 function localFaultText(message) {
   return `[Halfcycle] WARNING: Local fault \u2014 ${message}. The guard service was not contacted. Session continues (fail-open).`;
 }
@@ -18867,8 +19074,13 @@ This is not a service outage: the guard service answered. The suspect is this re
 }
 var UNCONFIGURED_EXIT_TOOL_USE = 2;
 var UNCONFIGURED_EXIT_STOP_FAMILY = 1;
-function emitNeverConfigured(exitCode, reason, engagementId) {
-  writeSync(2, neverConfiguredReport(reason, void 0, engagementId));
+function emitNeverConfigured(exitCode, reason, engagementId, reply) {
+  const text = neverConfiguredReport(reason, void 0, engagementId);
+  if (reply !== void 0) {
+    reply.loud(text, exitCode);
+    return;
+  }
+  writeSync(2, text);
   process.exitCode = exitCode;
 }
 function namesTheSignInCommand(text) {
@@ -18947,8 +19159,13 @@ This is not a service outage. The guard service is up and replying; ${cause}, so
 ${remedy}
 `;
 }
-function emitCredentialRejected(statusCode, serviceMessage, exitCode, remedy = HOOK_REMEDY) {
-  writeSync(2, credentialRejectedMessage(statusCode, serviceMessage, remedy));
+function emitCredentialRejected(statusCode, serviceMessage, exitCode, remedy = HOOK_REMEDY, reply) {
+  const text = credentialRejectedMessage(statusCode, serviceMessage, remedy);
+  if (reply !== void 0) {
+    reply.loud(text, exitCode);
+    return;
+  }
+  writeSync(2, text);
   process.exitCode = exitCode;
 }
 function credentialRenewalFailedMessage(remedy, label = "[Halfcycle]") {
@@ -21168,6 +21385,18 @@ function findingsPath(sessionId) {
     return null;
   return join6(markerDir(), `${FINDINGS_PREFIX}${sessionId}${FINDINGS_SUFFIX}`);
 }
+var HELD_STEP_PREFIX = "halfcycle-held-";
+var ALLOW_PREFIX = "halfcycle-allow-";
+var ALLOW_ONCE_SUFFIX = ".json";
+function allowOncePaths(sessionId, dir) {
+  if (typeof sessionId !== "string" || !FINDINGS_ID.test(sessionId))
+    return null;
+  const base = dir ?? markerDir();
+  return {
+    held: join6(base, `${HELD_STEP_PREFIX}${sessionId}${ALLOW_ONCE_SUFFIX}`),
+    allow: join6(base, `${ALLOW_PREFIX}${sessionId}${ALLOW_ONCE_SUFFIX}`)
+  };
+}
 function markerDir() {
   const raw = process.env["TMPDIR"] || tmpdir();
   return raw.replace(/\/+$/, "");
@@ -21324,7 +21553,9 @@ function sweepSessionFiles(keepSessionId, now) {
   }
   const kinds = [
     [FINDINGS_PREFIX, FINDINGS_SUFFIX],
-    [OWN_WORK_PREFIX, OWN_WORK_SUFFIX]
+    [OWN_WORK_PREFIX, OWN_WORK_SUFFIX],
+    [HELD_STEP_PREFIX, ALLOW_ONCE_SUFFIX],
+    [ALLOW_PREFIX, ALLOW_ONCE_SUFFIX]
   ];
   for (const name of names) {
     for (const [prefix, suffix] of kinds) {
@@ -21428,9 +21659,9 @@ function removeLivenessIndexEntry(dir, sessionId, name) {
 import { existsSync as existsSync5, readFileSync as readFileSync8, realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join7, relative as relative3, resolve as resolve2 } from "node:path";
-function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
+function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration, profile = AGENT_PROFILES["claude-code"]) {
   try {
-    const facts = read(repoRoot);
+    const facts = read(repoRoot, profile);
     if (facts === void 0)
       return void 0;
     const parsed = seatConfigurationSchema.safeParse(facts);
@@ -21439,8 +21670,8 @@ function gatherSeatConfiguration(repoRoot, read = readSeatConfiguration) {
     return void 0;
   }
 }
-function readSeatConfiguration(repoRoot) {
-  const given = resolve2(process.env["CLAUDE_PROJECT_DIR"] || process.cwd());
+function readSeatConfiguration(repoRoot, profile = AGENT_PROFILES["claude-code"]) {
+  const given = profile.projectRoot === "git-toplevel" ? resolve2(repoRoot) : resolve2(process.env["CLAUDE_PROJECT_DIR"] || process.cwd());
   const projectDir = realpathSync2.native(given);
   const home = homedir3();
   let realHome = home;
@@ -21452,14 +21683,15 @@ function readSeatConfiguration(repoRoot) {
   if (projectDir === home || given === home || projectDir === realHome)
     return void 0;
   return {
-    settingsFiles: [readSettingsFile(projectDir, SETTINGS_REL), readSettingsFile(projectDir, LOCAL_SETTINGS_REL)],
-    paths: readPathStates(projectDir, repoRoot)
+    settingsFiles: profile.settingsFiles.map((rel) => readSettingsFile(projectDir, rel, profile.commands)),
+    paths: readPathStates(projectDir, repoRoot, profile.wiringPaths),
+    agent: profile.id
   };
 }
 function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readSettingsFile(projectDir, rel) {
+function readSettingsFile(projectDir, rel, ours) {
   let raw;
   try {
     raw = readFileSync8(join7(projectDir, rel), "utf-8");
@@ -21476,9 +21708,9 @@ function readSettingsFile(projectDir, rel) {
   }
   if (!isPlainObject3(parsed))
     return { path: rel, state: "unreadable", hooks: [] };
-  return { path: rel, state: "read", hooks: ourHooks(parsed["hooks"]) };
+  return { path: rel, state: "read", hooks: ourHooks(parsed["hooks"], ours) };
 }
-function ourHooks(hooks) {
+function ourHooks(hooks, ours) {
   if (!isPlainObject3(hooks))
     return [];
   const rows = [];
@@ -21502,7 +21734,7 @@ function ourHooks(hooks) {
         if (!isPlainObject3(hook))
           continue;
         const command = hook["command"];
-        if (typeof command !== "string" || !HALFCYCLE_HOOK_COMMANDS.has(command))
+        if (typeof command !== "string" || !ours.has(command))
           continue;
         let timeout = null;
         if (Object.hasOwn(hook, "timeout")) {
@@ -21521,8 +21753,8 @@ function ourHooks(hooks) {
   }
   return rows;
 }
-function readPathStates(projectDir, repoRoot) {
-  const unknown2 = () => HALFCYCLE_HOOK_WIRING_PATHS.map((path) => ({ path, state: "unknown" }));
+function readPathStates(projectDir, repoRoot, wiringPaths) {
+  const unknown2 = () => wiringPaths.map((path) => ({ path, state: "unknown" }));
   let projectTop = projectDir;
   if (repoRoot !== projectDir) {
     const top = getRepoRoot(projectDir);
@@ -21531,10 +21763,10 @@ function readPathStates(projectDir, repoRoot) {
     projectTop = top.value;
   }
   const prefix = relative3(projectTop, projectDir);
-  const status = getWiringStatus(HALFCYCLE_HOOK_WIRING_PATHS, projectDir);
+  const status = getWiringStatus(wiringPaths, projectDir);
   if (!status.ok)
     return unknown2();
-  const mapped = mapWiringStatus(status.value, prefix, HALFCYCLE_HOOK_WIRING_PATHS, (rel) => existsSync5(join7(projectDir, rel)));
+  const mapped = mapWiringStatus(status.value, prefix, wiringPaths, (rel) => existsSync5(join7(projectDir, rel)));
   return mapped ?? unknown2();
 }
 function mapWiringStatus(output, prefix, paths, onDisk) {
@@ -22253,8 +22485,8 @@ function separatorOf(path) {
 function subagentsFolderOf(transcript) {
   if (!transcript.endsWith(".jsonl") || transcript.length === ".jsonl".length)
     return null;
-  const sep5 = separatorOf(transcript);
-  return `${transcript.slice(0, -".jsonl".length)}${sep5}subagents`;
+  const sep6 = separatorOf(transcript);
+  return `${transcript.slice(0, -".jsonl".length)}${sep6}subagents`;
 }
 function subagentRecordName(agentId) {
   return /^[A-Za-z0-9_-]+$/.test(agentId) ? `agent-${agentId}.jsonl` : null;
@@ -22794,7 +23026,7 @@ async function pruneTimeLog(path, openedAt) {
     written = true;
     let seen = Buffer.byteLength(text, "utf-8");
     for (; ; ) {
-      await new Promise((resolve8) => setTimeout(resolve8, PRUNE_SETTLE_MS));
+      await new Promise((resolve10) => setTimeout(resolve10, PRUNE_SETTLE_MS));
       const after = readFileSync11(aside);
       if (after.length <= seen)
         break;
@@ -23429,344 +23661,109 @@ function turnEndMessage(news) {
   return parts.length === 0 ? null : parts.join("\n");
 }
 
-// dist/hooks/post-tool-use.js
-var HANDLED_EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-async function runPostToolUse(readSeat = readSeatConfiguration) {
-  const reply = hookReply("PostToolUse");
-  const at = { session: void 0, folder: null };
-  await evaluateEdit(reply, readSeat, at);
-  handOverAtEdit(reply, at);
-  reply.flush();
-}
-function handOverAtEdit(reply, at) {
-  if (at.folder === null)
-    return;
-  const code = process.exitCode;
-  if (code !== void 0 && code !== null && Number(code) !== 0)
-    return;
-  const given = deliverFindings(at.session, at.folder);
-  if (given.length === 0)
-    return;
-  reply.agentContext(detailsBlock(given, realPathOf(projectFolder())));
-}
-async function evaluateEdit(reply, readSeat, at) {
-  let input;
-  try {
-    const raw = await readStdin();
-    input = JSON.parse(raw);
-  } catch {
-    recordTimeEvent("edit", {});
-    return;
-  }
-  recordTimeEvent("edit", input);
-  const toolName = input.tool_name ?? "";
-  if (!HANDLED_EDIT_TOOLS.has(toolName))
-    return;
-  const isNotebook = toolName === "NotebookEdit";
-  const absFilePath = isNotebook ? input.tool_input?.notebook_path : input.tool_input?.file_path;
-  if (!absFilePath || typeof absFilePath !== "string")
-    return;
-  recordOwnEdit(input, absFilePath);
-  const repoRootResult = getRepoRoot(process.cwd());
-  if (!repoRootResult.ok) {
-    if (firstNoRepoNoticeThisSession(process.cwd(), input.session_id)) {
-      reply.notice(noRepositoryText(repoRootResult));
+// dist/patch.js
+var PATCH_ADD_HEADER = "*** Add File: ";
+var PATCH_UPDATE_HEADER = "*** Update File: ";
+var PATCH_DELETE_HEADER = "*** Delete File: ";
+var PATCH_MOVE_HEADER = "*** Move to: ";
+function patchOperations(patch) {
+  const ops = [];
+  let addLines = null;
+  let hunks = null;
+  let lastWasUpdate = false;
+  const hunk = () => {
+    if (hunks.length === 0)
+      hunks.push({ before: [], after: [] });
+    return hunks[hunks.length - 1];
+  };
+  for (const raw of patch.split("\n")) {
+    const line2 = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    if (addLines !== null && line2.startsWith("+")) {
+      lastWasUpdate = false;
+      addLines.push(line2.slice(1));
+      continue;
     }
-    return;
-  }
-  const repoRoot = repoRootResult.value;
-  at.session = input.session_id;
-  at.folder = realPathOf(repoRoot);
-  const diffContent = isNotebook ? "" : getSingleFileDiff(absFilePath, repoRoot);
-  const { relative: pathRelative } = await import("node:path");
-  const relPath = pathRelative(repoRoot, absFilePath);
-  if (isInstallerOutput(relPath))
-    return;
-  const context = loadChangeSetContext(repoRoot);
-  const changeSet = buildChangeSet([{ path: relPath, diffContent }], {
-    ...context,
-    excerpts: readExcerptConfig()
-  });
-  const configResult = readConfig();
-  if (!configResult.config) {
-    await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet });
-    if (!firstNoticeThisSession("credential-missing", repoRoot, input.session_id))
-      return;
-    emitNeverConfigured(UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason(), pinnedEngagementId(projectFolder()));
-    return;
-  }
-  const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
-  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat);
-  const evaluation = await evaluateWithRefresh({
-    guardServiceUrl,
-    token: guardServiceToken,
-    engagementId: guardEngagementId,
-    request: buildEvaluationRequest(guardEngagementId, changeSet, context, seatConfiguration),
-    warn: warnOnceThisSession("credential-renewed-for-this-run", repoRoot, input.session_id)
-  });
-  const clientResult = evaluation.result;
-  if (!clientResult.ok) {
-    const failure = classifyFailure(clientResult);
-    await emitRunRecord({
-      engagementId: guardEngagementId,
-      runType: "hook",
-      outcome: outcomeForClientFailure(clientResult.kind),
-      failureReason: failure.reason,
-      changeSet,
-      credential: evaluation.token,
-      credentialRefused: failure.kind === "credential"
-    });
-    if (failure.kind === "credential") {
-      if (!firstNoticeThisSession("credential-rejected", repoRoot, input.session_id))
-        return;
-      emitCredentialRejected(
-        failure.statusCode,
-        failure.message,
-        CREDENTIAL_REJECTED_EXIT_TOOL_USE,
-        // The remedy the renewal attempt earned: the sign-in when the account
-        // credential is the thing that was refused, and otherwise the plane's own
-        // sentence about why it would not mint.
-        evaluation.remedy
-      );
-      return;
+    if (hunks !== null && isUpdateLine(line2)) {
+      lastWasUpdate = false;
+      if (line2.startsWith("@@")) {
+        hunks.push({ before: [], after: [] });
+        continue;
+      }
+      const mark = line2.charAt(0);
+      const text = line2.slice(1);
+      if (mark === "-")
+        hunk().before.push(text);
+      else if (mark === "+")
+        hunk().after.push(text);
+      else {
+        hunk().before.push(text);
+        hunk().after.push(text);
+      }
+      continue;
     }
-    if (failure.kind === "contract") {
-      reply.notice(contractFaultText(failure.message));
-      return;
+    const trimmed = line2.trim();
+    const move = headerPath(trimmed, PATCH_MOVE_HEADER);
+    if (move !== void 0) {
+      const last = ops[ops.length - 1];
+      if (!lastWasUpdate || move === "" || last === void 0 || last.kind !== "update")
+        return null;
+      ops[ops.length - 1] = { ...last, movedTo: move };
+      lastWasUpdate = false;
+      continue;
     }
-    reply.notice(infraWarningText());
-    return;
+    lastWasUpdate = false;
+    const header = [PATCH_ADD_HEADER, PATCH_UPDATE_HEADER, PATCH_DELETE_HEADER].find((h) => headerPath(trimmed, h) !== void 0);
+    if (header === void 0)
+      continue;
+    const path = headerPath(trimmed, header);
+    if (path === "")
+      return null;
+    addLines = null;
+    hunks = null;
+    if (header === PATCH_ADD_HEADER) {
+      addLines = [];
+      ops.push({ kind: "add", path, lines: addLines });
+    } else if (header === PATCH_UPDATE_HEADER) {
+      hunks = [];
+      ops.push({ kind: "update", path, movedTo: null, hunks });
+    } else {
+      ops.push({ kind: "delete", path });
+    }
+    lastWasUpdate = header === PATCH_UPDATE_HEADER;
   }
-  const telemetryConfig = readTelemetryConfig();
-  const run = buildGuardEvalRun({
-    engagementId: guardEngagementId,
-    runType: "hook",
-    // The phase this run belongs to, as the client named it — it names the
-    // guard-eval log file the run is appended to. Absent → the run is unphased.
-    phase: telemetryConfig.phase,
-    outcome: "evaluated",
-    changeSet,
-    result: clientResult.envelope
-  });
-  await emitTelemetry(run, {
-    controlTelemetryUrl: telemetryConfig.controlTelemetryUrl,
-    // THE CREDENTIAL IN FORCE, NOT THE ONE IN THE ENVIRONMENT (T-08,
-    // credential-lifecycle). `readTelemetryConfig` reads the bearer off
-    // `process.env` after the evaluation, and a renewal does not write there — so
-    // taking its value on a run that just recovered would present the credential
-    // the plane had already refused and drop the record with a 401, silently,
-    // because telemetry is best-effort.
-    controlTelemetryToken: evaluation.token,
-    // Per-engagement log dir from HALFCYCLE_GUARD_EVAL_LOG_DIR (E1-T-02, #61).
-    guardEvalLogDir: telemetryConfig.guardEvalLogDir
-  }, {
-    warn: (msg) => process.stderr.write(msg + "\n")
-  });
-  actOnEnvelope2(clientResult.envelope, reply);
+  return ops;
 }
-function actOnEnvelope2(envelope, reply) {
-  const notRun = notRunReport(envelope.notRun);
-  const notRunBlock = notRun ? `
-${notRun}` : "";
-  if (envelope.guardsFired.length === 0) {
-    if (notRun)
-      reply.notice(notRun);
-    return;
-  }
-  if (envelope.blocking) {
-    const personNotRun = notRunMessage((envelope.notRun ?? []).map((n) => n.reason));
-    const reason = `${blockReason(envelope.guardsFired.map((g) => g.explanation))}${personNotRun ? `
-${personNotRun}` : ""}`;
-    reply.block(reason, stoppedMessage(blockingExplanations(envelope.guardsFired)));
-  } else {
-    const guardLines = envelope.guardsFired.map((g) => `  [${g.severity.toUpperCase()}] ${g.patternRef}: ${g.explanation}`).join("\n");
-    reply.notice(`[Halfcycle] Guard warning: ${envelope.explanation}
-${guardLines}${notRunBlock}`);
-  }
+function isUpdateLine(line2) {
+  return line2 === "" || line2.startsWith(" ") || line2.startsWith("+") || line2.startsWith("-") || line2.startsWith("@@");
 }
-function readStdin() {
-  return new Promise((resolve8, reject) => {
-    const chunks = [];
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve8(Buffer.concat(chunks).toString("utf-8")));
-    process.stdin.on("error", reject);
-  });
+function headerPath(trimmed, header) {
+  if (trimmed === header.trimEnd())
+    return "";
+  return trimmed.startsWith(header) ? trimmed.slice(header.length).trim() : void 0;
 }
-
-// dist/liveness.js
-import { closeSync as closeSync2, mkdtempSync, openSync as openSync2, readdirSync as readdirSync5, readFileSync as readFileSync14, renameSync as renameSync5, rmSync, statSync as statSync4, unlinkSync as unlinkSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join11 } from "node:path";
-var LIVE_WINDOW_MS = 10 * 60 * 1e3;
-function field(input, key) {
-  if (typeof input !== "object" || input === null)
+function patchHeaderPaths(patch) {
+  const ops = patchOperations(patch);
+  if (ops === null)
     return null;
-  const v = input[key];
-  return typeof v === "string" && v !== "" ? v : null;
+  return ops.map((op) => op.kind === "update" && op.movedTo !== null ? op.movedTo : op.path);
 }
-function indexEntry(dir, sessionId, name) {
-  const folder = join11(dir, livenessIndexDirName(sessionId));
-  for (let attempt2 = 0; attempt2 < 3; attempt2++) {
-    try {
-      closeSync2(openSync2(join11(folder, name), "a", 384));
-      return true;
-    } catch (err) {
-      if (err.code !== "ENOENT")
-        return false;
-    }
-    let tmp = null;
-    try {
-      tmp = mkdtempSync(`${folder}.`);
-      for (const existing of readdirSync5(dir)) {
-        if (parseLivenessFileName(existing)?.sessionId === sessionId)
-          closeSync2(openSync2(join11(tmp, existing), "a", 384));
-      }
-      closeSync2(openSync2(join11(tmp, name), "a", 384));
-      renameSync5(tmp, folder);
-      return true;
-    } catch {
-      if (tmp !== null)
-        rmSync(tmp, { recursive: true, force: true });
-    }
-  }
-  return false;
+
+// dist/pacing.js
+import { createHash as createHash4 } from "node:crypto";
+import { closeSync as closeSync2, mkdirSync as mkdirSync4, openSync as openSync2, readdirSync as readdirSync5, readFileSync as readFileSync14, readSync, realpathSync as realpathSync5, renameSync as renameSync5, statSync as statSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import nodePath from "node:path";
+var DEFAULT_CONFIG_FOLDER_NAME = ".claude";
+var CODEX_DEFAULT_FOLDER_NAME = ".codex";
+var RECORDS_FOLDER_NAME = "projects";
+function hookInputForRule(input, rule) {
+  if (rule === "claude-config" || typeof input !== "object" || input === null || Array.isArray(input))
+    return input;
+  const copy = { ...input };
+  delete copy["transcript_path"];
+  delete copy["agent_transcript_path"];
+  return copy;
 }
-function recordLiveness(input, deps = {}) {
-  try {
-    const sessionId = field(input, "session_id");
-    const agentId = field(input, "agent_id");
-    const cwd = field(input, "cwd");
-    if (sessionId === null || cwd === null || !livenessIdOk(sessionId))
-      return null;
-    if (agentId !== null && !livenessIdOk(agentId))
-      return null;
-    if (/[\r\n]/.test(cwd))
-      return null;
-    const copy = whichCopy(cwd, deps.walk);
-    const dir = deps.dir ?? markerDir();
-    const name = livenessFileName(livenessKey(copy?.common ?? null), sessionId, agentId);
-    if (!indexEntry(dir, sessionId, name))
-      return null;
-    const path = join11(dir, name);
-    const text = `${cwd}
-${copy?.top ?? ""}
-`;
-    try {
-      writeFileSync7(path, text, { encoding: "utf-8", flag: "wx", mode: 384 });
-      return { firstSeen: true };
-    } catch (err) {
-      if (err.code !== "EEXIST")
-        return null;
-    }
-    writeFileSync7(path, text, { encoding: "utf-8", mode: 384 });
-    return { firstSeen: false };
-  } catch {
-    return null;
-  }
-}
-function clearLiveness(input, deps = {}) {
-  try {
-    const sessionId = field(input, "session_id");
-    const agentId = field(input, "agent_id");
-    if (sessionId === null || agentId === null)
-      return 0;
-    const dir = deps.dir ?? markerDir();
-    let removed = 0;
-    for (const name of readdirSync5(dir)) {
-      const p = parseLivenessFileName(name);
-      if (p === null || p.sessionId !== sessionId || p.agentId !== agentId)
-        continue;
-      try {
-        unlinkSync6(join11(dir, name));
-        removed += 1;
-      } catch {
-      }
-      removeLivenessIndexEntry(dir, sessionId, name);
-    }
-    return removed;
-  } catch {
-    return 0;
-  }
-}
-function topOf(path) {
-  try {
-    const top = readFileSync14(path, "utf-8").split("\n")[1] ?? "";
-    return top === "" ? null : top;
-  } catch {
-    return null;
-  }
-}
-function readLiveness(sessionId, cwd, deps = {}) {
-  try {
-    if (!sessionId || !cwd || !livenessIdOk(sessionId))
-      return null;
-    const copy = whichCopy(cwd, deps.walk);
-    if (copy === null)
-      return null;
-    const key = livenessKey(copy.common);
-    const dir = deps.dir ?? markerDir();
-    const now = (deps.now ?? Date.now)();
-    let main2 = null;
-    const agents = [];
-    for (const name of readdirSync5(dir)) {
-      const p = parseLivenessFileName(name);
-      if (p === null || p.key !== key || p.sessionId !== sessionId)
-        continue;
-      const full = join11(dir, name);
-      let seenAt;
-      try {
-        seenAt = statSync4(full).mtimeMs;
-      } catch {
-        continue;
-      }
-      const top = topOf(full);
-      if (top === null)
-        continue;
-      if (p.agentId === null)
-        main2 = { top, seenAt };
-      else if (now - seenAt <= LIVE_WINDOW_MS)
-        agents.push({ agentId: p.agentId, top, seenAt });
-    }
-    agents.sort((a, b) => a.agentId.localeCompare(b.agentId));
-    return { main: main2, agents };
-  } catch {
-    return null;
-  }
-}
-function liveCount(record2) {
-  return record2 === null ? 0 : record2.agents.length;
-}
-function withoutAgent(record2, agentId) {
-  if (record2 === null || agentId === null || agentId === void 0 || agentId === "")
-    return record2;
-  return { main: record2.main, agents: record2.agents.filter((a) => a.agentId !== agentId) };
-}
-function runsBesideOtherWork(toolInput, record2) {
-  const t = typeof toolInput === "object" && toolInput !== null ? toolInput : {};
-  const bg = t["run_in_background"];
-  if (bg !== false && bg !== "false")
-    return true;
-  const name = t["name"];
-  if (name !== void 0 && name !== null && name !== "")
-    return true;
-  return liveCount(record2) > 0;
-}
-
-// dist/pace-hook.js
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync18, renameSync as renameSync9, unlinkSync as unlinkSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import nodePath4 from "node:path";
-
-// dist/pace-verb.js
-import { mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync17, renameSync as renameSync8, statSync as statSync6, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import nodePath3 from "node:path";
-
-// dist/pacing.js
-import { createHash as createHash4 } from "node:crypto";
-import { closeSync as closeSync3, mkdirSync as mkdirSync4, openSync as openSync3, readdirSync as readdirSync6, readFileSync as readFileSync15, readSync, realpathSync as realpathSync5, renameSync as renameSync6, statSync as statSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import nodePath from "node:path";
-var DEFAULT_CONFIG_FOLDER_NAME = ".claude";
-var RECORDS_FOLDER_NAME = "projects";
 function normaliseFolder(folder, input = {}) {
   const p = input.path ?? nodePath;
   const home = input.home ?? homedir5();
@@ -23780,6 +23777,12 @@ function normaliseFolder(folder, input = {}) {
 function configFolderKey(input = {}) {
   const p = input.path ?? nodePath;
   const env = input.env ?? process.env;
+  if (input.rule === "codex-home") {
+    const codexHome = env["CODEX_HOME"];
+    if (typeof codexHome === "string" && codexHome !== "")
+      return normaliseFolder(codexHome, input);
+    return normaliseFolder(p.join(input.home ?? homedir5(), CODEX_DEFAULT_FOLDER_NAME), input);
+  }
   const fromEnv = env["CLAUDE_CONFIG_DIR"];
   if (typeof fromEnv === "string" && fromEnv !== "")
     return normaliseFolder(fromEnv, input);
@@ -23811,7 +23814,7 @@ function pacingDir(home) {
 }
 function readJsonObject(path) {
   try {
-    const v = JSON.parse(readFileSync15(path, "utf-8"));
+    const v = JSON.parse(readFileSync14(path, "utf-8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -23820,8 +23823,8 @@ function readJsonObject(path) {
 function writeJsonWhole(path, value) {
   mkdirSync4(nodePath.dirname(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${String(process.pid)}.${createHash4("sha1").update(String(Math.random())).digest("hex").slice(0, 8)}.tmp`;
-  writeFileSync8(tmp, JSON.stringify(value), { mode: 384 });
-  renameSync6(tmp, path);
+  writeFileSync7(tmp, JSON.stringify(value), { mode: 384 });
+  renameSync5(tmp, path);
 }
 function writeAccountEntry(path, key, entry) {
   const current = readJsonObject(path);
@@ -23978,7 +23981,7 @@ function readLearnedAccount(key, deps = {}) {
 }
 function dirents(path) {
   try {
-    return readdirSync6(path, { withFileTypes: true });
+    return readdirSync5(path, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -24012,7 +24015,7 @@ var NEWLINE = 10;
 var ASSISTANT = Buffer.from('"assistant"');
 var READ_CHUNK = 8 * 1024 * 1024;
 function readWholeLines(path, from, size, onLine) {
-  const fd = openSync3(path, "r");
+  const fd = openSync2(path, "r");
   try {
     let pos = from;
     let carry = Buffer.alloc(0);
@@ -24040,7 +24043,7 @@ function readWholeLines(path, from, size, onLine) {
     }
     return consumed;
   } finally {
-    closeSync3(fd);
+    closeSync2(fd);
   }
 }
 function hashId(id) {
@@ -24069,7 +24072,7 @@ function scanRecords(key, deps = {}) {
     let size;
     let mtimeSec;
     try {
-      const st = statSync5(file2.path);
+      const st = statSync4(file2.path);
       size = st.size;
       mtimeSec = Math.floor(st.mtimeMs / 1e3);
     } catch {
@@ -24205,7 +24208,7 @@ function timeLogTranscripts(home) {
       continue;
     let text;
     try {
-      text = readFileSync15(nodePath.join(engagements, e.name, TIME_LOG_DIR_NAME, TIME_LOG_FILENAME), "utf-8");
+      text = readFileSync14(nodePath.join(engagements, e.name, TIME_LOG_DIR_NAME, TIME_LOG_FILENAME), "utf-8");
     } catch {
       continue;
     }
@@ -24350,19 +24353,405 @@ function paceOf(input) {
     } else {
       continue;
     }
-    if (PACE_RANK[d.pace] > PACE_RANK[best.pace] || d.pace === best.pace && d.allowance < best.allowance)
-      best = d;
+    if (PACE_RANK[d.pace] > PACE_RANK[best.pace] || d.pace === best.pace && d.allowance < best.allowance)
+      best = d;
+  }
+  return best;
+}
+function knownWindowOf(learned, reported, now) {
+  for (const kind of PACE_WINDOW_KINDS) {
+    if (learned?.ceilings[kind] !== void 0 || reportedFresh(reported[kind], now))
+      return kind;
+  }
+  return null;
+}
+
+// dist/hooks/post-tool-use.js
+import { isAbsolute as isAbsolute2, join as join11, relative as relative5, resolve as resolve4, sep as sep3 } from "node:path";
+var HANDLED_EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+async function runPostToolUse(readSeat = readSeatConfiguration, profile = AGENT_PROFILES["claude-code"]) {
+  const reply = hookReply("PostToolUse", profile);
+  const at = { session: void 0, folder: null };
+  await evaluateEdit(reply, readSeat, at, profile);
+  handOverAtEdit(reply, at);
+  reply.flush();
+}
+function handOverAtEdit(reply, at) {
+  if (at.folder === null)
+    return;
+  const code = process.exitCode;
+  if (code !== void 0 && code !== null && Number(code) !== 0)
+    return;
+  const given = deliverFindings(at.session, at.folder);
+  if (given.length === 0)
+    return;
+  reply.agentContext(detailsBlock(given, realPathOf(projectFolder())));
+}
+async function evaluateEdit(reply, readSeat, at, profile) {
+  let input;
+  try {
+    const raw = await readStdin();
+    input = hookInputForRule(JSON.parse(raw), profile.configFolder);
+  } catch {
+    recordTimeEvent("edit", {});
+    return;
+  }
+  recordTimeEvent("edit", input);
+  const toolName = input.tool_name ?? "";
+  const edited = editedPaths(input, profile);
+  if (edited === UNREADABLE_EDIT) {
+    reply.personNotice(unreadableEditText());
+    return;
+  }
+  if (edited.length === 0)
+    return;
+  for (const absFilePath of edited)
+    recordOwnEdit(input, absFilePath);
+  const repoRootResult = getRepoRoot(process.cwd());
+  if (!repoRootResult.ok) {
+    if (firstNoRepoNoticeThisSession(process.cwd(), input.session_id)) {
+      reply.notice(noRepositoryText(repoRootResult));
+    }
+    return;
+  }
+  const repoRoot = repoRootResult.value;
+  at.session = input.session_id;
+  at.folder = realPathOf(repoRoot);
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const named of edited) {
+    const absFilePath = profile.id === "claude-code" ? named : insideRepository(named, repoRoot);
+    if (absFilePath === null)
+      continue;
+    const relPath = relative5(repoRoot, absFilePath);
+    if (isInstallerOutput(relPath) || seen.has(relPath))
+      continue;
+    seen.add(relPath);
+    const diffContent = toolName === "NotebookEdit" ? "" : getSingleFileDiff(absFilePath, repoRoot);
+    files.push({ path: relPath, diffContent });
+  }
+  if (files.length === 0)
+    return;
+  const context = loadChangeSetContext(repoRoot);
+  const changeSet = buildChangeSet(files, {
+    ...context,
+    excerpts: readExcerptConfig()
+  });
+  const configResult = readConfig();
+  if (!configResult.config) {
+    await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet });
+    if (!firstNoticeThisSession("credential-missing", repoRoot, input.session_id))
+      return;
+    emitNeverConfigured(UNCONFIGURED_EXIT_TOOL_USE, readNeverConfiguredReason(), pinnedEngagementId(projectFolder()), reply);
+    return;
+  }
+  const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
+  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat, profile);
+  const evaluation = await evaluateWithRefresh({
+    guardServiceUrl,
+    token: guardServiceToken,
+    engagementId: guardEngagementId,
+    request: buildEvaluationRequest(guardEngagementId, changeSet, context, seatConfiguration),
+    warn: warnOnceThisSession("credential-renewed-for-this-run", repoRoot, input.session_id)
+  });
+  const clientResult = evaluation.result;
+  if (!clientResult.ok) {
+    const failure = classifyFailure(clientResult);
+    await emitRunRecord({
+      engagementId: guardEngagementId,
+      runType: "hook",
+      outcome: outcomeForClientFailure(clientResult.kind),
+      failureReason: failure.reason,
+      changeSet,
+      credential: evaluation.token,
+      credentialRefused: failure.kind === "credential"
+    });
+    if (failure.kind === "credential") {
+      if (!firstNoticeThisSession("credential-rejected", repoRoot, input.session_id))
+        return;
+      emitCredentialRejected(
+        failure.statusCode,
+        failure.message,
+        CREDENTIAL_REJECTED_EXIT_TOOL_USE,
+        // The remedy the renewal attempt earned: the sign-in when the account
+        // credential is the thing that was refused, and otherwise the plane's own
+        // sentence about why it would not mint.
+        evaluation.remedy,
+        reply
+      );
+      return;
+    }
+    if (failure.kind === "contract") {
+      reply.notice(contractFaultText(failure.message));
+      return;
+    }
+    reply.notice(infraWarningText());
+    return;
+  }
+  const telemetryConfig = readTelemetryConfig();
+  const run = buildGuardEvalRun({
+    engagementId: guardEngagementId,
+    runType: "hook",
+    // The phase this run belongs to, as the client named it — it names the
+    // guard-eval log file the run is appended to. Absent → the run is unphased.
+    phase: telemetryConfig.phase,
+    outcome: "evaluated",
+    changeSet,
+    result: clientResult.envelope
+  });
+  await emitTelemetry(run, {
+    controlTelemetryUrl: telemetryConfig.controlTelemetryUrl,
+    // THE CREDENTIAL IN FORCE, NOT THE ONE IN THE ENVIRONMENT (T-08,
+    // credential-lifecycle). `readTelemetryConfig` reads the bearer off
+    // `process.env` after the evaluation, and a renewal does not write there — so
+    // taking its value on a run that just recovered would present the credential
+    // the plane had already refused and drop the record with a 401, silently,
+    // because telemetry is best-effort.
+    controlTelemetryToken: evaluation.token,
+    // Per-engagement log dir from HALFCYCLE_GUARD_EVAL_LOG_DIR (E1-T-02, #61).
+    guardEvalLogDir: telemetryConfig.guardEvalLogDir
+  }, {
+    warn: (msg) => process.stderr.write(msg + "\n")
+  });
+  actOnEnvelope2(clientResult.envelope, reply);
+}
+var UNREADABLE_EDIT = /* @__PURE__ */ Symbol("unreadable-edit");
+function editedPaths(input, profile) {
+  const toolName = input.tool_name ?? "";
+  if (profile.id === "claude-code") {
+    if (!HANDLED_EDIT_TOOLS.has(toolName))
+      return [];
+    const absFilePath = toolName === "NotebookEdit" ? input.tool_input?.notebook_path : input.tool_input?.file_path;
+    if (!absFilePath || typeof absFilePath !== "string")
+      return [];
+    return [absFilePath];
+  }
+  if (!profile.writeCapableTools.includes(toolName))
+    return [];
+  const filePath = input.tool_input?.file_path;
+  const command = input.tool_input?.command;
+  let named;
+  if (typeof filePath === "string" && filePath !== "")
+    named = [filePath];
+  else if (typeof command === "string")
+    named = patchHeaderPaths(command);
+  else
+    named = null;
+  if (named === null || named.length === 0)
+    return UNREADABLE_EDIT;
+  const cwd = typeof input.cwd === "string" && isAbsolute2(input.cwd) ? input.cwd : null;
+  const out = [];
+  for (const path of named) {
+    if (!isAbsolute2(path) && cwd === null)
+      return UNREADABLE_EDIT;
+    const abs = isAbsolute2(path) ? resolve4(path) : resolve4(cwd, path);
+    if (!out.includes(abs))
+      out.push(abs);
+  }
+  return out;
+}
+function insideRepository(path, repoRoot) {
+  const rel = relative5(realPathOf(repoRoot), realPathOf(path));
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute2(rel))
+    return null;
+  return join11(repoRoot, rel);
+}
+function actOnEnvelope2(envelope, reply) {
+  const notRun = notRunReport(envelope.notRun);
+  const notRunBlock = notRun ? `
+${notRun}` : "";
+  if (envelope.guardsFired.length === 0) {
+    if (notRun)
+      reply.notice(notRun);
+    return;
+  }
+  if (envelope.blocking) {
+    const personNotRun = notRunMessage((envelope.notRun ?? []).map((n) => n.reason));
+    const reason = `${blockReason(envelope.guardsFired.map((g) => g.explanation))}${personNotRun ? `
+${personNotRun}` : ""}`;
+    reply.block(reason, stoppedMessage(blockingExplanations(envelope.guardsFired)));
+  } else {
+    const guardLines = envelope.guardsFired.map((g) => `  [${g.severity.toUpperCase()}] ${g.patternRef}: ${g.explanation}`).join("\n");
+    reply.notice(`[Halfcycle] Guard warning: ${envelope.explanation}
+${guardLines}${notRunBlock}`);
+  }
+}
+function readStdin() {
+  return new Promise((resolve10, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("end", () => resolve10(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("error", reject);
+  });
+}
+
+// dist/liveness.js
+import { closeSync as closeSync3, mkdtempSync, openSync as openSync3, readdirSync as readdirSync6, readFileSync as readFileSync15, renameSync as renameSync6, rmSync, statSync as statSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join12 } from "node:path";
+var LIVE_WINDOW_MS = 10 * 60 * 1e3;
+function field(input, key) {
+  if (typeof input !== "object" || input === null)
+    return null;
+  const v = input[key];
+  return typeof v === "string" && v !== "" ? v : null;
+}
+function indexEntry(dir, sessionId, name) {
+  const folder = join12(dir, livenessIndexDirName(sessionId));
+  for (let attempt2 = 0; attempt2 < 3; attempt2++) {
+    try {
+      closeSync3(openSync3(join12(folder, name), "a", 384));
+      return true;
+    } catch (err) {
+      if (err.code !== "ENOENT")
+        return false;
+    }
+    let tmp = null;
+    try {
+      tmp = mkdtempSync(`${folder}.`);
+      for (const existing of readdirSync6(dir)) {
+        if (parseLivenessFileName(existing)?.sessionId === sessionId)
+          closeSync3(openSync3(join12(tmp, existing), "a", 384));
+      }
+      closeSync3(openSync3(join12(tmp, name), "a", 384));
+      renameSync6(tmp, folder);
+      return true;
+    } catch {
+      if (tmp !== null)
+        rmSync(tmp, { recursive: true, force: true });
+    }
+  }
+  return false;
+}
+function recordLiveness(input, deps = {}) {
+  try {
+    const sessionId = field(input, "session_id");
+    const agentId = field(input, "agent_id");
+    const cwd = field(input, "cwd");
+    if (sessionId === null || cwd === null || !livenessIdOk(sessionId))
+      return null;
+    if (agentId !== null && !livenessIdOk(agentId))
+      return null;
+    if (/[\r\n]/.test(cwd))
+      return null;
+    const copy = whichCopy(cwd, deps.walk);
+    const dir = deps.dir ?? markerDir();
+    const name = livenessFileName(livenessKey(copy?.common ?? null), sessionId, agentId);
+    if (!indexEntry(dir, sessionId, name))
+      return null;
+    const path = join12(dir, name);
+    const text = `${cwd}
+${copy?.top ?? ""}
+`;
+    try {
+      writeFileSync8(path, text, { encoding: "utf-8", flag: "wx", mode: 384 });
+      return { firstSeen: true };
+    } catch (err) {
+      if (err.code !== "EEXIST")
+        return null;
+    }
+    writeFileSync8(path, text, { encoding: "utf-8", mode: 384 });
+    return { firstSeen: false };
+  } catch {
+    return null;
+  }
+}
+function clearLiveness(input, deps = {}) {
+  try {
+    const sessionId = field(input, "session_id");
+    const agentId = field(input, "agent_id");
+    if (sessionId === null || agentId === null)
+      return 0;
+    const dir = deps.dir ?? markerDir();
+    let removed = 0;
+    for (const name of readdirSync6(dir)) {
+      const p = parseLivenessFileName(name);
+      if (p === null || p.sessionId !== sessionId || p.agentId !== agentId)
+        continue;
+      try {
+        unlinkSync6(join12(dir, name));
+        removed += 1;
+      } catch {
+      }
+      removeLivenessIndexEntry(dir, sessionId, name);
+    }
+    return removed;
+  } catch {
+    return 0;
+  }
+}
+function topOf(path) {
+  try {
+    const top = readFileSync15(path, "utf-8").split("\n")[1] ?? "";
+    return top === "" ? null : top;
+  } catch {
+    return null;
+  }
+}
+function readLiveness(sessionId, cwd, deps = {}) {
+  try {
+    if (!sessionId || !cwd || !livenessIdOk(sessionId))
+      return null;
+    const copy = whichCopy(cwd, deps.walk);
+    if (copy === null)
+      return null;
+    const key = livenessKey(copy.common);
+    const dir = deps.dir ?? markerDir();
+    const now = (deps.now ?? Date.now)();
+    let main2 = null;
+    const agents = [];
+    for (const name of readdirSync6(dir)) {
+      const p = parseLivenessFileName(name);
+      if (p === null || p.key !== key || p.sessionId !== sessionId)
+        continue;
+      const full = join12(dir, name);
+      let seenAt;
+      try {
+        seenAt = statSync5(full).mtimeMs;
+      } catch {
+        continue;
+      }
+      const top = topOf(full);
+      if (top === null)
+        continue;
+      if (p.agentId === null)
+        main2 = { top, seenAt };
+      else if (now - seenAt <= LIVE_WINDOW_MS)
+        agents.push({ agentId: p.agentId, top, seenAt });
+    }
+    agents.sort((a, b) => a.agentId.localeCompare(b.agentId));
+    return { main: main2, agents };
+  } catch {
+    return null;
   }
-  return best;
 }
-function knownWindowOf(learned, reported, now) {
-  for (const kind of PACE_WINDOW_KINDS) {
-    if (learned?.ceilings[kind] !== void 0 || reportedFresh(reported[kind], now))
-      return kind;
-  }
-  return null;
+function liveCount(record2) {
+  return record2 === null ? 0 : record2.agents.length;
+}
+function withoutAgent(record2, agentId) {
+  if (record2 === null || agentId === null || agentId === void 0 || agentId === "")
+    return record2;
+  return { main: record2.main, agents: record2.agents.filter((a) => a.agentId !== agentId) };
+}
+function runsBesideOtherWork(toolInput, record2) {
+  const t = typeof toolInput === "object" && toolInput !== null ? toolInput : {};
+  const bg = t["run_in_background"];
+  if (bg !== false && bg !== "false")
+    return true;
+  const name = t["name"];
+  if (name !== void 0 && name !== null && name !== "")
+    return true;
+  return liveCount(record2) > 0;
 }
 
+// dist/pace-hook.js
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync18, renameSync as renameSync9, unlinkSync as unlinkSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import nodePath4 from "node:path";
+
+// dist/pace-verb.js
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync17, renameSync as renameSync8, statSync as statSync6, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import nodePath3 from "node:path";
+
 // dist/scan-lock.js
 import { spawn } from "node:child_process";
 import { linkSync, mkdirSync as mkdirSync5, readFileSync as readFileSync16, renameSync as renameSync7, unlinkSync as unlinkSync7, writeFileSync as writeFileSync9 } from "node:fs";
@@ -24961,7 +25350,7 @@ async function paceAtTurnEnd(input, reply, deps = {}) {
       return;
     const nowMs = (deps.now ?? Date.now)();
     const now = new Date(nowMs);
-    const key = configFolderKey({ env, transcriptPath: field2(input, "transcript_path"), home: deps.home });
+    const key = configFolderKey({ env, transcriptPath: field2(input, "transcript_path"), home: deps.home, rule: deps.configFolder });
     const stored = readPaceStateFile(dir);
     const before = stored.accounts[key] ?? null;
     if (before !== null) {
@@ -25065,7 +25454,7 @@ function whereOf(input, deps) {
   const dir = enginePacingDir(configured.config.guardEngagementId, deps.home);
   if (dir === null)
     return null;
-  return { dir, key: configFolderKey({ env, transcriptPath: field2(input, "transcript_path"), home: deps.home }) };
+  return { dir, key: configFolderKey({ env, transcriptPath: field2(input, "transcript_path"), home: deps.home, rule: deps.configFolder }) };
 }
 function retirePendingStart(input, deps = {}) {
   try {
@@ -25139,7 +25528,7 @@ function paceHoldText(input, toolInput, deps = {}) {
 // dist/risky/facts.js
 import { existsSync as existsSync7, lstatSync as lstatSync2, readdirSync as readdirSync8, readFileSync as readFileSync19, realpathSync as realpathSync6, statSync as statSync7 } from "node:fs";
 import { homedir as homedir7, tmpdir as tmpdir2 } from "node:os";
-import { basename as pathBasename, dirname as dirname6, isAbsolute as isAbsolute2, join as join12, relative as relative5, resolve as resolve4, sep as sep3 } from "node:path";
+import { basename as pathBasename, dirname as dirname6, isAbsolute as isAbsolute3, join as join13, relative as relative6, resolve as resolve5, sep as sep4 } from "node:path";
 
 // dist/risky/shell.js
 var MAX_DEPTH = 8;
@@ -27349,13 +27738,13 @@ var Env = class {
   description;
   projectCommonDir;
   constructor(ctx) {
-    this.projectDir = realOrSelf(resolve4(ctx.projectDir));
-    this.cwd = realOrSelf(resolve4(this.projectDir, ctx.cwd));
-    this.home = realOrSelf(resolve4(ctx.home ?? homedir7()));
+    this.projectDir = realOrSelf(resolve5(ctx.projectDir));
+    this.cwd = realOrSelf(resolve5(this.projectDir, ctx.cwd));
+    this.home = realOrSelf(resolve5(ctx.home ?? homedir7()));
     this.timeoutMs = ctx.gitTimeoutMs ?? FACTS_GIT_TIMEOUT_MS;
-    this.tempDir = realOrSelf(resolve4(ctx.tempDir ?? tmpdir2()));
+    this.tempDir = realOrSelf(resolve5(ctx.tempDir ?? tmpdir2()));
     const roots = ctx.tempRoots ?? [this.tempDir, tmpdir2(), ...TEMP_ROOTS];
-    this.tempRoots = [...new Set(roots.map((r) => realOrSelf(resolve4(r))))].filter((r) => !isInside(this.projectDir, r));
+    this.tempRoots = [...new Set(roots.map((r) => realOrSelf(resolve5(r))))].filter((r) => !isInside(this.projectDir, r));
   }
   isTemp(abs) {
     return this.tempRoots.some((r) => isInside(abs, r));
@@ -27365,7 +27754,7 @@ var Env = class {
   }
   display(abs) {
     if (isInside(abs, this.projectDir)) {
-      const rel = relative5(this.projectDir, abs);
+      const rel = relative6(this.projectDir, abs);
       return rel === "" ? "." : toSlash(rel);
     }
     return toSlash(abs);
@@ -27375,7 +27764,7 @@ var Env = class {
       return this.description;
     this.description = null;
     try {
-      const raw = JSON.parse(readFileSync19(join12(repoRoot, SYSTEM_DESCRIPTION_REL), "utf-8"));
+      const raw = JSON.parse(readFileSync19(join13(repoRoot, SYSTEM_DESCRIPTION_REL), "utf-8"));
       const checked = checkSystemDescription(raw);
       if (checked.ok)
         this.description = checked.description;
@@ -27418,7 +27807,7 @@ var Env = class {
     if (!r.ok)
       return null;
     const d = r.value.trim();
-    return d === "" ? null : realOrSelf(resolve4(dir, d));
+    return d === "" ? null : realOrSelf(resolve5(dir, d));
   }
 };
 function realOrSelf(p) {
@@ -27429,29 +27818,29 @@ function realOrSelf(p) {
   }
 }
 function toSlash(p) {
-  return sep3 === "/" ? p : p.split(sep3).join("/");
+  return sep4 === "/" ? p : p.split(sep4).join("/");
 }
 function isInside(child, parent) {
-  const rel = relative5(parent, child);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+  const rel = relative6(parent, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function resolveHome(text, home, base) {
   if (text === "~")
     return home;
   if (text.startsWith("~/"))
-    return join12(home, text.slice(2));
-  return resolve4(base, text);
+    return join13(home, text.slice(2));
+  return resolve5(base, text);
 }
 function realTarget(abs) {
   const parent = dirname6(abs);
   if (parent === abs)
     return abs;
-  return join12(realOrSelf(parent), pathBasename(abs));
+  return join13(realOrSelf(parent), pathBasename(abs));
 }
 function wordPath(word, base, env) {
   if (word.temp !== void 0) {
-    const root = word.temp.base === "mktemp" ? join12(env.tempDir, ".halfcycle-mktemp-new") : env.tempDir;
-    return resolve4(`${root}${word.temp.suffix}`);
+    const root = word.temp.base === "mktemp" ? join13(env.tempDir, ".halfcycle-mktemp-new") : env.tempDir;
+    return resolve5(`${root}${word.temp.suffix}`);
   }
   return word.literal ? resolveHome(word.text, env.home, base) : null;
 }
@@ -27460,7 +27849,7 @@ function follow(start, prefix, dirs, m, env) {
   let fresh = start.fresh;
   let freshRoot = start.freshRoot;
   const seen = [...prefix];
-  const insideFresh = (p) => freshRoot !== void 0 && isInside(resolve4(p), resolve4(freshRoot));
+  const insideFresh = (p) => freshRoot !== void 0 && isInside(resolve5(p), resolve5(freshRoot));
   const mark = (by) => {
     if (fresh !== void 0 && insideFresh(cwd))
       return;
@@ -27589,14 +27978,14 @@ function expandBraces(text) {
   return body.split(",").map((b) => `${head}${b}${tail}`);
 }
 function globPath(abs) {
-  const root = abs.startsWith(sep3) ? sep3 : "";
-  const segments = abs.split(sep3).filter((s) => s !== "");
+  const root = abs.startsWith(sep4) ? sep4 : "";
+  const segments = abs.split(sep4).filter((s) => s !== "");
   let current = [root === "" ? "." : root];
   for (const segment of segments) {
     const next = [];
     if (!/[*?[]/.test(segment)) {
       for (const c of current)
-        next.push(join12(c, segment));
+        next.push(join13(c, segment));
     } else {
       const re = segmentPattern(segment);
       for (const c of current) {
@@ -27610,7 +27999,7 @@ function globPath(abs) {
           if (n.startsWith(".") && !segment.startsWith("."))
             continue;
           if (re.test(n))
-            next.push(join12(c, n));
+            next.push(join13(c, n));
         }
       }
     }
@@ -27675,7 +28064,7 @@ function isDirectory(p) {
 }
 function filesUnder(targets, repoRoot, env, keep, seen) {
   const specs = targets.map((t) => {
-    const rel = toSlash(relative5(repoRoot, t));
+    const rel = toSlash(relative6(repoRoot, t));
     return rel === "" ? "." : rel;
   });
   const tracked = env.git(["--literal-pathspecs", "ls-files", "--full-name", "-z", "--", ...specs], repoRoot);
@@ -27738,12 +28127,12 @@ function findKeeps(filter, roots, repoRoot) {
   const names = filter.names.map((n) => findPattern(n.pattern, n.fold, false));
   const excluded = filter.excluded.map((p) => findPattern(p, false, true));
   const steps = (rel) => {
-    const abs = join12(repoRoot, rel);
+    const abs = join13(repoRoot, rel);
     const out = [];
     for (const r of roots) {
       if (!isInside(abs, r.abs))
         continue;
-      const below = toSlash(relative5(r.abs, abs)).split("/").filter((x) => x !== "");
+      const below = toSlash(relative6(r.abs, abs)).split("/").filter((x) => x !== "");
       const rootName = r.text === null ? pathBasename(r.abs) : r.text.replace(/\/+$/, "").split("/").pop() || r.text;
       const prefixes = r.text === null ? [] : [.../* @__PURE__ */ new Set([r.text, r.text.replace(/\/+$/, "") || r.text])];
       const chain = [{ name: rootName, printed: r.text === null ? [] : [r.text] }];
@@ -27810,9 +28199,9 @@ function credentialFilesIn(folders, repoRoot, deadline, skip) {
   const out = [];
   const stack = [];
   for (const f of folders) {
-    if (isDirectory(join12(repoRoot, f)))
+    if (isDirectory(join13(repoRoot, f)))
       stack.push(f);
-    else if (pathExists(join12(repoRoot, f)) && isCredentialPath(f))
+    else if (pathExists(join13(repoRoot, f)) && isCredentialPath(f))
       out.push(f);
   }
   let seen = 0;
@@ -27820,7 +28209,7 @@ function credentialFilesIn(folders, repoRoot, deadline, skip) {
     const rel = stack.pop();
     let entries;
     try {
-      entries = readdirSync8(join12(repoRoot, rel), { withFileTypes: true });
+      entries = readdirSync8(join13(repoRoot, rel), { withFileTypes: true });
     } catch {
       continue;
     }
@@ -27917,7 +28306,7 @@ function deleteFilesFacts(m, env) {
     for (const raw of expanded) {
       const abs = realTarget(raw);
       written.set(abs, word.literal ? word.text : null);
-      if (abs === sep3 || abs === env.home || abs !== env.projectDir && isInside(env.projectDir, abs)) {
+      if (abs === sep4 || abs === env.home || abs !== env.projectDir && isInside(env.projectDir, abs)) {
         guarded.push(abs);
       } else if (isInside(abs, env.projectDir) || !env.isTemp(abs) && env.sameRepository(abs)) {
         if (pathExists(abs))
@@ -27961,7 +28350,7 @@ function deleteFilesFacts(m, env) {
     ...base.pre.length === 0 ? {
       save: {
         repoRoot,
-        paths: targets.map((t) => toSlash(relative5(repoRoot, t)) || "."),
+        paths: targets.map((t) => toSlash(relative6(repoRoot, t)) || "."),
         ...keep === void 0 ? {} : { keep: (rel) => keep.deletes(rel) },
         lines: []
       }
@@ -27973,12 +28362,12 @@ function closeFoldsAll(targets, env) {
     const root = recordRoot(t, env);
     if (root === null || !isInside(t, root))
       return false;
-    const rel = toSlash(relative5(root, t));
+    const rel = toSlash(relative6(root, t));
     if (rel === "" || recordPatternFor(rel)?.deleteAsked !== false)
       return false;
     let at = root;
     for (const seg of rel.split("/")) {
-      at = join12(at, seg);
+      at = join13(at, seg);
       try {
         if (lstatSync2(at).isSymbolicLink())
           return false;
@@ -28167,11 +28556,11 @@ function cleanFiles(m, where, env) {
   const repoRoot = env.repoRoot(where.cwd);
   if (repoRoot === null)
     return null;
-  const abs = named.map((n) => resolve4(where.cwd, n));
+  const abs = named.map((n) => resolve5(where.cwd, n));
   const files = filesUnder(abs, repoRoot, env);
   if (files === null)
     return null;
-  return { lost: files.filter((f) => f.neverSaved).map((f) => f.path), removed: abs.map((a) => toSlash(relative5(repoRoot, a)) || ".") };
+  return { lost: files.filter((f) => f.neverSaved).map((f) => f.path), removed: abs.map((a) => toSlash(relative6(repoRoot, a)) || ".") };
 }
 function stashFiles(m, where, env) {
   let refs;
@@ -28561,7 +28950,7 @@ function publishFacts(m, env) {
   const start = startFolder(m, env);
   if (start !== null && PACKAGE_JSON_PROGRAMS.has(m.program)) {
     try {
-      const pkg = JSON.parse(readFileSync19(join12(start, "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync19(join13(start, "package.json"), "utf-8"));
       if (typeof pkg["name"] === "string" && typeof pkg["version"] === "string" && pkg["name"] !== "" && pkg["version"] !== "") {
         name = pkg["name"];
         version2 = pkg["version"];
@@ -28674,7 +29063,7 @@ function recordFileAt(abs, env) {
   const root = recordRoot(abs, env);
   if (root === null || !isInside(abs, root))
     return null;
-  const rel = toSlash(relative5(root, abs));
+  const rel = toSlash(relative6(root, abs));
   if (rel === "")
     return null;
   const row = recordPatternFor(rel);
@@ -28684,11 +29073,11 @@ function recordFilesUnder(folder, env) {
   const root = recordRoot(folder, env);
   if (root === null)
     return [];
-  const relFolder = toSlash(relative5(root, folder));
+  const relFolder = toSlash(relative6(root, folder));
   const starts = /* @__PURE__ */ new Set();
   for (const { pattern } of PROJECT_RECORD_PATTERNS) {
     if (relFolder === "" || patternOwns(relFolder, pattern))
-      starts.add(join12(root, pattern));
+      starts.add(join13(root, pattern));
     else if (patternOwns(pattern, relFolder))
       starts.add(folder);
   }
@@ -28714,7 +29103,7 @@ function recordFilesUnder(folder, env) {
         continue;
       }
       for (const n of names)
-        stack.push(join12(p, n));
+        stack.push(join13(p, n));
     } else if (st.isFile()) {
       const r = recordFileAt(p, env);
       if (r !== null)
@@ -28735,7 +29124,7 @@ function recordHistory(files, env) {
     byTree.set(top, list);
   }
   for (const [top, list] of byTree) {
-    const specs = list.map((abs) => toSlash(relative5(top, abs)));
+    const specs = list.map((abs) => toSlash(relative6(top, abs)));
     const tracked = trackedOf(specs, top, env);
     if (tracked === null)
       continue;
@@ -28792,8 +29181,14 @@ function parseNumstatZ(text) {
 // dist/risky/sentence.js
 var REASON_MAX_CHARS = 200;
 var MAX_LISTED = 3;
-var TURN_QUESTIONS_ON_LINE = "To let it happen, turn the coding agent's permission questions back on and ask for it again.";
+var PAUSED_OPENER = "Halfcycle paused a risky step before it runs: ";
+var PERSON_HOLD_LINE = "Halfcycle paused a risky step before it ran. Nothing changed \u2014 your agent will check with you.";
+var HELD_STEP_OPENER = "The step was: ";
+var PRECAUTION_OPENER = "It was stopped as a precaution: ";
+var ALLOW_REPLY = "allow";
+var HOLD_AGENT_INSTRUCTION = `If the step is not needed, carry on without it; there is no need to mention it. If it is needed, ask the person in chat, in one plain sentence, whether to run it, and tell them to reply "${ALLOW_REPLY}" to run it once, or anything else to skip it. Do not try it again until they answer.`;
 var NOTHING_LOST_ON_NO = "Nothing is lost if you say no.";
+var IF_YES = "If you say yes, ";
 var DESCRIBED_TOOLS = /* @__PURE__ */ new Set(["Bash", "Agent"]);
 function reasonOf(call) {
   if (!DESCRIBED_TOOLS.has(call.toolName))
@@ -28822,10 +29217,43 @@ function questionFor(facts, description) {
     return couldNotTellQuestion(description);
   if (staked.length === 1) {
     const only = staked[0];
-    return `Halfcycle: ${whatOf(only)} ${reason} If you allow it, ${lostOf(only)} ${NOTHING_LOST_ON_NO}`;
+    return `${PAUSED_OPENER}${stepOf(whatOf(only))}. ${reason} ${NOTHING_LOST_ON_NO} ${IF_YES}${lostOf(only)}`;
   }
-  const shown2 = staked.slice(0, MAX_LISTED).map((f) => `${whatOf(f)} If you allow it, ${lostOf(f)}`);
-  return `Halfcycle: ${shown2.join(" ")}${moreLine(staked.length - shown2.length)} ${reason} ${NOTHING_LOST_ON_NO}`;
+  const shown2 = staked.slice(0, MAX_LISTED).map((f) => `${whatOf(f)} ${IF_YES}${lostOf(f)}`);
+  return `${PAUSED_OPENER.trimEnd().slice(0, -1)}. ${shown2.join(" ")}${moreLine(staked.length - shown2.length)} ${reason} ${NOTHING_LOST_ON_NO}`;
+}
+function refusalFor(facts, description) {
+  const staked = orderedStaked(facts);
+  if (staked.length === 0)
+    return couldNotTellRefusal(description);
+  const shown2 = staked.slice(0, MAX_LISTED);
+  const more = staked.length - shown2.length;
+  const steps = `${shown2.map((f) => stepOf(whatOf(f))).join("; ")}${more > 0 ? `; and ${more} more risky ${more === 1 ? "step" : "steps"}` : ""}`;
+  return heldStep(steps, description, shown2.map(whyOf).join("; "));
+}
+function heldStep(steps, description, why) {
+  return {
+    person: PERSON_HOLD_LINE,
+    agent: `${HELD_STEP_OPENER}${steps}. ${reasonSentence(description)} ${PRECAUTION_OPENER}${why}. ${HOLD_AGENT_INSTRUCTION}`
+  };
+}
+var STEP_VERBS = {
+  Delete: "deleting",
+  Throw: "throwing",
+  Replace: "replacing",
+  Move: "moving",
+  Show: "showing",
+  Publish: "publishing",
+  Put: "putting"
+};
+function stepOf(what) {
+  const bare = what.endsWith(".") ? what.slice(0, -1) : what;
+  const space = bare.indexOf(" ");
+  const verb = space < 0 ? bare : bare.slice(0, space);
+  const ing = STEP_VERBS[verb];
+  if (ing !== void 0)
+    return `${ing}${bare.slice(verb.length)}`;
+  return `one that would ${bare.charAt(0).toLowerCase()}${bare.slice(1)}`;
 }
 function orderedStaked(facts) {
   const said = /* @__PURE__ */ new Set();
@@ -28840,7 +29268,7 @@ function orderedStaked(facts) {
 function moreLine(more) {
   return more > 0 ? ` And ${more} more risky ${more === 1 ? "step" : "steps"}.` : "";
 }
-var UNNAMED_PUSH_WHAT = "Replace a line of work on the shared copy.";
+var UNNAMED_PUSH_WHAT = "Replace a remote branch.";
 function whatsText(facts, extraPush = false) {
   const staked = orderedStaked(facts);
   const items = staked.map((f) => ({ order: riskyTypeOrder(f.type), what: whatOf(f) }));
@@ -28859,11 +29287,12 @@ function typeSentenceFor(facts, extraPush = false) {
 function savedWhatFor(facts) {
   return whatsText(facts);
 }
-function refusalText(question) {
-  return `${question} ${TURN_QUESTIONS_ON_LINE}`;
-}
+var COULD_NOT_TELL_STEP = "one that can delete, overwrite, publish or show something that cannot be taken back";
 function couldNotTellQuestion(description) {
-  return `${AUTONOMY_COULD_NOT_TELL_SENTENCE} ${reasonSentence(description)} If you allow it, whatever it changes may not be possible to bring back. ${NOTHING_LOST_ON_NO}`;
+  return `${PAUSED_OPENER}${COULD_NOT_TELL_STEP}, and Halfcycle could not work out what. ${reasonSentence(description)} ${NOTHING_LOST_ON_NO} ${IF_YES}whatever it changes may not be possible to bring back.`;
+}
+function couldNotTellRefusal(description) {
+  return heldStep(COULD_NOT_TELL_STEP, description, "Halfcycle could not work out what this step would change");
 }
 function whatOf(f) {
   switch (f.type) {
@@ -28892,23 +29321,45 @@ function lostOf(f) {
     case "delete-files":
       return deleteLost(f);
     case "discard-unsaved":
-      return f.files === null ? "Halfcycle cannot tell which changes this would throw away; any it does were never saved and can never be brought back." : `${f.files === 1 ? "that change was" : "those changes were"} never saved and can never be brought back.`;
+      return f.files === null ? "any uncommitted changes it throws away could not be brought back; Halfcycle cannot tell which ones those are." : `${f.files === 1 ? "that change could not be brought back, because it was" : "those changes could not be brought back, because they were"} never committed.`;
     case "rewrite-shared-history":
       return pushLost(f);
     case "delete-unmerged-work":
       return unmergedLost(f);
     case "wipe-data":
-      return "Halfcycle cannot see the database, so it cannot tell how much that is or whether a copy exists.";
+      return "that data is deleted; Halfcycle cannot see the database, so it cannot tell how much that is or whether a backup exists.";
     case "read-credentials":
-      return "nothing is deleted, but the secrets would be in the agent's conversation, which is kept on this computer and sent to the coding agent's provider, and cannot be taken back.";
+      return "nothing is deleted, but the secrets become part of the agent's conversation, which is kept on this computer and sent to the coding agent's provider; that cannot be taken back.";
     case "publish":
-      return "once published it cannot be taken back.";
+      return "anyone can install it straight away, and a published version cannot be taken back.";
     case "deploy":
       return "what is live now is replaced at once; Halfcycle cannot tell whether going back is possible.";
     case "shrink-record":
       return shrinkLost(f);
   }
 }
+function whyOf(f) {
+  switch (f.type) {
+    case "delete-files":
+      return deleteWhy(f);
+    case "discard-unsaved":
+      return f.files === null ? "any uncommitted changes it throws away could not be brought back, and Halfcycle cannot tell which ones those are" : `${f.files === 1 ? "that change was never committed, so it" : "those changes were never committed, so they"} could not be brought back`;
+    case "rewrite-shared-history":
+      return pushWhy(f);
+    case "delete-unmerged-work":
+      return unmergedWhy(f);
+    case "wipe-data":
+      return "Halfcycle cannot see the database, so it cannot tell how much would be deleted or whether a backup exists";
+    case "read-credentials":
+      return "once shown, the secrets would be part of the agent's conversation, which is sent to the coding agent's provider";
+    case "publish":
+      return "a published version cannot be taken back";
+    case "deploy":
+      return "what is live now would be replaced at once, and Halfcycle cannot tell whether going back is possible";
+    case "shrink-record":
+      return shrinkWhy(f);
+  }
+}
 function deleteWhat(f) {
   const thing = thingText(f.thing) ?? listNames(f.match.targets.map((t) => t.text));
   if (f.files === null)
@@ -28917,24 +29368,39 @@ function deleteWhat(f) {
 }
 function deleteLost(f) {
   if (f.files === null || f.neverSaved === null) {
-    return "Halfcycle cannot tell which files this would delete, so it cannot tell whether any of them could be brought back.";
+    return "any file it deletes that was never committed could not be brought back; Halfcycle cannot tell which files those are.";
+  }
+  const n = f.files;
+  const k = f.neverSaved;
+  if (k === 0)
+    return n === 1 ? "it can still be brought back from the project's history." : "all of them can still be brought back from the project's history.";
+  if (k === n) {
+    if (n === 1)
+      return "that file could not be brought back, because it was never committed.";
+    return `${n === 2 ? "both" : `all ${n}`} of those files could not be brought back, because they were never committed.`;
+  }
+  return `${k} of those files could not be brought back, because ${k === 1 ? "it was" : "they were"} never committed; the other ${n - k} can be brought back from the project's history.`;
+}
+function deleteWhy(f) {
+  if (f.files === null || f.neverSaved === null) {
+    return "Halfcycle cannot tell which files this would delete, or whether any of them were never committed";
   }
   const n = f.files;
   const k = f.neverSaved;
   if (k === 0)
-    return n === 1 ? "it can be brought back from the project's history." : "all of them can be brought back from the project's history.";
+    return `a delete like this is checked first, even though ${n === 1 ? "the file" : "every file"} can be brought back from the project's history`;
   if (k === n) {
     if (n === 1)
-      return "that file was never saved to the project's history and can never be brought back.";
-    return `${n === 2 ? "both" : `all ${n}`} of those files were never saved to the project's history and can never be brought back.`;
+      return "that file was never committed, so it could not be brought back";
+    return `${n === 2 ? "both" : `all ${n}`} of those files were never committed, so they could not be brought back`;
   }
-  return `${k} of those files ${k === 1 ? "was" : "were"} never saved to the project's history and can never be brought back; the other ${n - k} can be.`;
+  return `${k} of those files ${k === 1 ? "was" : "were"} never committed, so ${k === 1 ? "it" : "they"} could not be brought back`;
 }
 function discardWhat(f) {
   if (f.files === null)
-    return "Throw away unsaved changes in this project.";
+    return "Throw away uncommitted changes in this project.";
   const thing = thingText(f.thing) ?? "this project";
-  return `Throw away the unsaved changes to ${thing} \u2014 ${f.files} ${f.files === 1 ? "file" : "files"}.`;
+  return `Throw away the uncommitted changes to ${thing} \u2014 ${f.files} ${f.files === 1 ? "file" : "files"}.`;
 }
 function pushLines(f) {
   const lines2 = f.lines.filter((l) => l.dropped !== 0);
@@ -28945,19 +29411,30 @@ function pushWhat(f) {
   const verb = lines2.length > 0 && lines2.every((l) => l.deletes) ? "Delete" : "Replace";
   const named = lines2.filter((l) => l.branch !== null).map((l) => l.branch);
   if (named.length === 0)
-    return verb === "Replace" ? UNNAMED_PUSH_WHAT : `${verb} a line of work on the shared copy.`;
-  return `${verb} the shared copy's ${named.length === 1 ? "line" : "lines"} of work ${listNames(named)}.`;
+    return verb === "Replace" ? UNNAMED_PUSH_WHAT : `${verb} a remote branch.`;
+  return `${verb} the remote ${named.length === 1 ? "branch" : "branches"} ${listNames(named)}.`;
+}
+function unknownPushWhere(f) {
+  const unknown2 = pushLines(f).find((l) => l.dropped === null);
+  if (unknown2 === void 0)
+    return null;
+  return unknown2.branch === null ? "that branch" : `the remote branch ${quote(unknown2.branch)}`;
 }
 function pushLost(f) {
   const lines2 = pushLines(f);
-  const unknown2 = lines2.find((l) => l.dropped === null);
-  if (unknown2 !== void 0) {
-    const where = unknown2.branch === null ? "that line of work" : `the shared copy's line of work ${quote(unknown2.branch)}`;
-    return `whatever is on it now might no longer be there, because Halfcycle cannot tell what is on ${where}.`;
-  }
+  const where = unknownPushWhere(f);
+  if (where !== null)
+    return `commits now on it might no longer be there; Halfcycle cannot tell what is on ${where}.`;
   const n = lines2.reduce((s, l) => s + (l.dropped ?? 0), 0);
   const them = n === 1 ? "it" : "them";
-  return `${n} saved ${n === 1 ? "change" : "changes"} now on ${lines2.length === 1 ? "it" : "them"} would no longer be there, as of the last time this copy checked; anyone who already has ${them} keeps ${them}, and Halfcycle cannot tell who does.`;
+  return `${n} ${n === 1 ? "commit" : "commits"} now on ${lines2.length === 1 ? "it" : "them"} would no longer be there, as of the last fetch; anyone who already has ${them} keeps ${them}, and Halfcycle cannot tell who does.`;
+}
+function pushWhy(f) {
+  const where = unknownPushWhere(f);
+  if (where !== null)
+    return `Halfcycle cannot tell what is on ${where}, so it cannot tell whether any commits would no longer be there`;
+  const n = pushLines(f).reduce((s, l) => s + (l.dropped ?? 0), 0);
+  return `${n} ${n === 1 ? "commit" : "commits"} now on the remote would no longer be there, and Halfcycle cannot tell whether anyone else has ${n === 1 ? "it" : "them"}`;
 }
 function unmergedLines(f) {
   const lines2 = f.lines.filter((l) => l.commits !== 0);
@@ -28967,24 +29444,34 @@ function unmergedWhat(f) {
   const lines2 = unmergedLines(f);
   if (f.match.form === "reset-to") {
     const l = lines2[0];
-    const which = l?.branch == null ? "this copy's current line of work" : `the line of work ${quote(l.branch)}`;
+    const which = l?.branch == null ? "the current branch" : `the branch ${quote(l.branch)}`;
     if (l?.commits == null)
       return `Move ${which} back.`;
-    return `Move ${which} back ${l.commits} saved ${l.commits === 1 ? "change" : "changes"}.`;
+    return `Move ${which} back ${l.commits} ${l.commits === 1 ? "commit" : "commits"}.`;
   }
   const named = lines2.filter((l) => l.branch !== null).map((l) => l.branch);
   if (named.length === 0)
-    return "Delete a line of work.";
-  return `Delete the ${named.length === 1 ? "line" : "lines"} of work ${listNames(named)}.`;
+    return "Delete a branch.";
+  return `Delete the ${named.length === 1 ? "branch" : "branches"} ${listNames(named)}.`;
 }
-function unmergedLost(f) {
+function unmergedCount(f) {
   const lines2 = unmergedLines(f);
-  const tail = "this computer can bring them back for a while, the shared copy cannot.";
-  if (lines2.some((l) => l.commits === null)) {
-    return `Halfcycle cannot tell how many saved changes on it are on no other line of work; ${tail}`;
+  if (lines2.some((l) => l.commits === null))
+    return null;
+  return lines2.reduce((s, l) => s + (l.commits ?? 0), 0);
+}
+function unmergedLost(f) {
+  const n = unmergedCount(f);
+  if (n === null) {
+    return "some commits might be left on no branch, here or on the remote; Halfcycle cannot tell how many, and they can still be recovered on this computer for a while.";
   }
-  const n = lines2.reduce((s, l) => s + (l.commits ?? 0), 0);
-  return n === 1 ? "1 saved change on it is on no other line of work; this computer can bring it back for a while, the shared copy cannot." : `${n} saved changes on it are on no other line of work; ${tail}`;
+  return n === 1 ? "1 commit would be left on no branch, here or on the remote; it can still be recovered on this computer for a while." : `${n} commits would be left on no branch, here or on the remote; they can still be recovered on this computer for a while.`;
+}
+function unmergedWhy(f) {
+  const n = unmergedCount(f);
+  if (n === null)
+    return "some of its commits may not be on any other branch or on the remote";
+  return `${n} of its commits ${n === 1 ? "is" : "are"} not on any other branch or on the remote`;
 }
 function wipeWhat(f) {
   const m = f.match;
@@ -29028,7 +29515,7 @@ function sqlTarget(statement) {
 }
 function credentialsWhat(f) {
   if (f.match.form === "gh-token")
-    return "Show the agent the sign-in token this computer uses to reach the shared copy.";
+    return "Show the agent the GitHub sign-in token on this computer.";
   if (f.match.form === "keychain")
     return "Show the agent a password kept in this computer's keychain.";
   const file2 = f.file ?? f.match.file;
@@ -29067,6 +29554,20 @@ function shrinkLost(f) {
       return "Halfcycle cannot tell how much of it could be brought back from the project's history.";
   }
 }
+function shrinkWhy(f) {
+  switch (f.history) {
+    case "saved":
+      return "a record cut this much is checked first, even though all of it can be brought back from the project's history";
+    case "never":
+      return "this record was never saved to the project's history, so what is removed could not be brought back";
+    case "changed": {
+      const u = Math.min(f.unsaved ?? f.removed, f.removed);
+      return `${u === f.removed && u > 1 ? `all ${u}` : u} of those lines ${u === 1 ? "was" : "were"} changed since the record was last saved, so ${u === 1 ? "it" : "they"} could not be brought back`;
+    }
+    case null:
+      return "Halfcycle cannot tell how much of it could be brought back from the project's history";
+  }
+}
 var NOTHING_WAS_CHANGED = "Nothing was changed.";
 var OWN_COPY_START_FIX = 'To start it, add isolation: "worktree" so it works in a copy of its own. If you already made a copy for it, remove that copy (git worktree remove <path>) and keep its branch: never delete it. In the brief, tell the agent to work in the copy it starts in, its first action git switch <branch>, and drop any "your working folder is <path>" line, because that folder is gone.';
 function ownCopyRefusal(f, description) {
@@ -29127,24 +29628,188 @@ function listPlain(items) {
 
 // dist/risky/check.js
 function riskyAnswer(call, contextOf) {
-  const matches = recognise(call);
+  const calls = isOneCall(call) ? [call] : call;
+  const matches = calls.flatMap((c) => recognise(c)).sort((a, b) => riskyTypeOrder(a.type) - riskyTypeOrder(b.type));
   if (matches.length === 0)
     return { silent: true };
-  const reason = reasonOf(call);
+  const reason = calls.length === 0 ? null : reasonOf(calls[0]);
   try {
     const staked = factsFor(matches, contextOf()).filter((f) => f.atStake);
     if (staked.length === 0)
       return { silent: true };
-    return { silent: false, question: questionFor(staked, reason), staked };
+    return { silent: false, question: questionFor(staked, reason), refusal: refusalFor(staked, reason), staked };
+  } catch {
+    return { silent: false, question: couldNotTellQuestion(reason), refusal: couldNotTellRefusal(reason), staked: [] };
+  }
+}
+function isOneCall(call) {
+  return !Array.isArray(call);
+}
+
+// dist/risky/allow-once.js
+import { createHash as createHash5 } from "node:crypto";
+import { appendFileSync as appendFileSync4, readFileSync as readFileSync20, renameSync as renameSync10, unlinkSync as unlinkSync9, writeFileSync as writeFileSync12 } from "node:fs";
+var ALLOW_ONCE_MS = 5 * 60 * 1e3;
+var HELD_STEP_MAX_AGE_MS = 60 * 60 * 1e3;
+function isAllowReply(prompt) {
+  return typeof prompt === "string" && prompt.trim().toLowerCase() === ALLOW_REPLY;
+}
+function stepKey(input, staked) {
+  const toolName = input["tool_name"];
+  const toolInput = input["tool_input"];
+  if (typeof toolName !== "string" || toolName === "")
+    return null;
+  if (typeof toolInput !== "object" || toolInput === null || Array.isArray(toolInput))
+    return null;
+  const rest = { ...toolInput };
+  if (DESCRIBED_TOOLS.has(toolName))
+    delete rest["description"];
+  const cwd = typeof input["cwd"] === "string" ? input["cwd"] : "";
+  return createHash5("sha256").update(canonical([toolName, cwd, rest, staked])).digest("hex");
+}
+function canonical(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    const o = value;
+    return `{${Object.keys(o).sort().filter((k) => o[k] !== void 0).map((k) => `${JSON.stringify(k)}:${canonical(o[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function recordHeld(sessionId, key, deps = {}) {
+  const paths = allowOncePaths(sessionId, deps.dir);
+  if (paths === null)
+    return;
+  const record2 = { version: 1, session: sessionId, key, at: nowOf(deps) };
+  try {
+    appendFileSync4(paths.held, `${JSON.stringify(record2)}
+`, { mode: 384 });
+  } catch {
+    return;
+  }
+}
+function armAllow(sessionId, deps = {}) {
+  try {
+    const paths = allowOncePaths(sessionId, deps.dir);
+    if (paths === null)
+      return "nothing-held";
+    const now = nowOf(deps);
+    const keys = claimHeldKeys(paths.held, sessionId, now);
+    if (keys.length === 0)
+      return "nothing-held";
+    if (keys.length > 1)
+      return "several-held";
+    return writeRecord(paths.allow, { version: 1, session: sessionId, key: keys[0], at: now }) ? "armed" : "not-saved";
+  } catch {
+    return "not-saved";
+  }
+}
+function claimHeldKeys(path, session, now) {
+  const claimed = `${path}.${process.pid}.${now}.claim`;
+  try {
+    renameSync10(path, claimed);
+  } catch {
+    return [];
+  }
+  let text = "";
+  try {
+    text = readFileSync20(claimed, "utf8");
+  } catch {
+    text = "";
+  }
+  removeQuietly(claimed);
+  const keys = /* @__PURE__ */ new Set();
+  for (const line2 of text.split("\n")) {
+    const r = parseRecord(line2, session);
+    if (r !== null && within(r.at, now, HELD_STEP_MAX_AGE_MS))
+      keys.add(r.key);
+  }
+  return [...keys];
+}
+function spendAllow(sessionId, key, deps = {}) {
+  try {
+    const paths = allowOncePaths(sessionId, deps.dir);
+    if (paths === null)
+      return false;
+    const armed = readRecord2(paths.allow, sessionId);
+    if (armed === null)
+      return false;
+    if (!within(armed.at, nowOf(deps), ALLOW_ONCE_MS)) {
+      removeQuietly(paths.allow);
+      return false;
+    }
+    if (armed.key !== key)
+      return false;
+    unlinkSync9(paths.allow);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function within(at, now, limit) {
+  const age = now - at;
+  return Number.isFinite(age) && age >= 0 && age < limit;
+}
+function nowOf(deps) {
+  return (deps.now ?? Date.now)();
+}
+function readRecord2(path, session) {
+  try {
+    return parseRecord(readFileSync20(path, "utf8"), session);
+  } catch {
+    return null;
+  }
+}
+function parseRecord(text, session) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return null;
+  const r = parsed;
+  if (r["version"] !== 1 || r["session"] !== session)
+    return null;
+  if (typeof r["key"] !== "string" || !/^[0-9a-f]{64}$/.test(r["key"]))
+    return null;
+  if (typeof r["at"] !== "number")
+    return null;
+  return { version: 1, session, key: r["key"], at: r["at"] };
+}
+function writeRecord(path, record2) {
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync12(tmp, JSON.stringify(record2), { mode: 384 });
+    renameSync10(tmp, path);
+    return true;
+  } catch {
+    removeQuietly(tmp);
+    return false;
+  }
+}
+function removeQuietly(path) {
+  try {
+    unlinkSync9(path);
   } catch {
-    return { silent: false, question: couldNotTellQuestion(reason), staked: [] };
   }
 }
 
 // dist/risky/decide.js
 var QUESTIONS_ON_MODES = /* @__PURE__ */ new Set(["default", "acceptEdits", "plan", "auto"]);
-function answerModeFor(permissionMode) {
-  return typeof permissionMode === "string" && QUESTIONS_ON_MODES.has(permissionMode) ? "questions-on" : "questions-off";
+function answerModeFor(permissionMode, agent = "claude-code") {
+  switch (agent) {
+    case "codex":
+      return "questions-off";
+    case "claude-code":
+      return typeof permissionMode === "string" && QUESTIONS_ON_MODES.has(permissionMode) ? "questions-on" : "questions-off";
+    default: {
+      const unhandled = agent;
+      void unhandled;
+      return "questions-off";
+    }
+  }
 }
 var REFUSED_IN_EVERY_MODE = /* @__PURE__ */ new Set(["outside-own-copy"]);
 function autonomousRowOf(type) {
@@ -29194,6 +29859,9 @@ function decide(action, facts, mode, mayPublishNow = () => false) {
     }
   }
 }
+function allowableByTyping(action, facts) {
+  return decide(action, facts, "questions-on") === "ask";
+}
 function decideAutonomous(facts, mayPublishNow) {
   if (facts.length === 0)
     return { autonomous: "could-not-tell" };
@@ -29210,8 +29878,8 @@ function decideAutonomous(facts, mayPublishNow) {
 }
 
 // dist/risky/own-copy.js
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join13, posix as posix2, win32 as win322 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join14, posix as posix2, win32 as win322 } from "node:path";
 var OWN_COPY_START_TOOL = "Agent";
 var OWN_COPY_WRITE_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 var OWN_COPY_ISOLATION = "worktree";
@@ -29232,7 +29900,7 @@ function stringField2(o, key) {
 }
 function readOr(deps, path) {
   try {
-    return (deps.readFile ?? ((p) => readFileSync20(p, "utf-8")))(path);
+    return (deps.readFile ?? ((p) => readFileSync21(p, "utf-8")))(path);
   } catch {
     return null;
   }
@@ -29272,7 +29940,7 @@ function typeCanChangeFiles(subagentType, deps) {
     return true;
   if (AGENT_FILE_NAME.test(type)) {
     for (const base of [deps.projectDir, deps.home]) {
-      const text = readOr(deps, join13(base, ".claude", "agents", `${type}.md`));
+      const text = readOr(deps, join14(base, ".claude", "agents", `${type}.md`));
       if (text === null)
         continue;
       const tools = frontmatterTools(text);
@@ -29378,9 +30046,9 @@ function judgeChange(input, call, deps) {
 
 // dist/risky/save.js
 import { randomBytes } from "node:crypto";
-import { chmodSync as chmodSync2, constants as fsConstants, copyFileSync, lstatSync as lstatSync3, mkdirSync as mkdirSync8, readdirSync as readdirSync9, readFileSync as readFileSync21, readlinkSync, realpathSync as realpathSync7, renameSync as renameSync10, rmSync as rmSync2, statSync as statSync8, symlinkSync, writeFileSync as writeFileSync12 } from "node:fs";
+import { chmodSync as chmodSync2, constants as fsConstants, copyFileSync, lstatSync as lstatSync3, mkdirSync as mkdirSync8, readdirSync as readdirSync9, readFileSync as readFileSync22, readlinkSync, realpathSync as realpathSync7, renameSync as renameSync11, rmSync as rmSync2, statSync as statSync8, symlinkSync, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join14, resolve as resolve5 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute4, join as join15, resolve as resolve6 } from "node:path";
 var SAVE_LIMIT_BYTES = 2e8;
 var SAVE_BUDGET_MS = 5e3;
 function notSaved(reason) {
@@ -29389,7 +30057,7 @@ function notSaved(reason) {
 function savedFolderOf(engagementId, home = homedir8()) {
   if (!isEngagementId(engagementId))
     return null;
-  return join14(home, HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, SAVED_DIR_NAME);
+  return join15(home, HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, SAVED_DIR_NAME);
 }
 function saveFirst(staked, ctx) {
   const now = ctx.now ?? Date.now;
@@ -29420,20 +30088,20 @@ function saveFirst(staked, ctx) {
     const id = freshId(folder, ctx.newId);
     if (id === null)
       return notSaved(AUTONOMY_SAVE_FAILED_REASON);
-    saveDir = join14(folder, id);
+    saveDir = join15(folder, id);
     const repository = repositoryOf(g);
     if (repository === null)
       return failed(saveDir);
-    writeFileSync12(join14(saveDir, SAVED_REPOSITORY_FILE_NAME), `${repository}
+    writeFileSync13(join15(saveDir, SAVED_REPOSITORY_FILE_NAME), `${repository}
 `, { mode: 384 });
-    const privateIndex = join14(saveDir, PRIVATE_INDEX_NAME);
+    const privateIndex = join15(saveDir, PRIVATE_INDEX_NAME);
     const commit = saveCommit(id, headCommit2, found2.tracked, plan.lines, privateIndex, g, now());
     rmSync2(privateIndex, { force: true });
     if (commit === null)
       return failed(saveDir);
-    const copiesDir = join14(saveDir, SAVED_COPIES_DIR_NAME);
+    const copiesDir = join15(saveDir, SAVED_COPIES_DIR_NAME);
     for (const rel of found2.copies) {
-      if (now() > deadline || !copyOne(join14(plan.root, rel), join14(copiesDir, rel)))
+      if (now() > deadline || !copyOne(join15(plan.root, rel), join15(copiesDir, rel)))
         return failed(saveDir);
     }
     const description = savedSchema.safeParse({
@@ -29449,10 +30117,10 @@ function saveFirst(staked, ctx) {
     });
     if (!description.success)
       return failed(saveDir);
-    const file2 = join14(saveDir, SAVED_FILE_NAME);
-    writeFileSync12(`${file2}.part`, `${JSON.stringify(description.data, null, 2)}
+    const file2 = join15(saveDir, SAVED_FILE_NAME);
+    writeFileSync13(`${file2}.part`, `${JSON.stringify(description.data, null, 2)}
 `, { mode: 384 });
-    renameSync10(`${file2}.part`, file2);
+    renameSync11(`${file2}.part`, file2);
     ctx.beforeRef?.();
     const ref = g.run(["update-ref", "--no-deref", savedRefOf(id), commit, ""]);
     if (!ref.ok)
@@ -29480,7 +30148,7 @@ function planOf(staked) {
     const t = f.save;
     if (t === void 0)
       return { ok: false, reason: f.cannotTell === void 0 ? AUTONOMY_SAVE_NOT_COVERED_REASON : AUTONOMY_COULD_NOT_TELL_REASON };
-    const r = realOrSelf2(resolve5(t.repoRoot));
+    const r = realOrSelf2(resolve6(t.repoRoot));
     if (root === null)
       root = r;
     else if (root !== r)
@@ -29499,7 +30167,7 @@ function planOf(staked) {
 function isInsideRel(p) {
   if (p === ".")
     return true;
-  if (p === "" || isAbsolute3(p) || p.includes("\\"))
+  if (p === "" || isAbsolute4(p) || p.includes("\\"))
     return false;
   return p.split("/").every((s) => s !== "" && s !== "." && s !== "..");
 }
@@ -29529,7 +30197,7 @@ function filesOf(plan, g, deadline) {
     trackedAll.add(path);
     if (!reached(path, plan.specs))
       continue;
-    const st = lstatOrNull(join14(plan.root, path));
+    const st = lstatOrNull(join15(plan.root, path));
     if (st !== null && (st.isFile() || st.isSymbolicLink()))
       tracked.add(path);
   }
@@ -29541,7 +30209,7 @@ function filesOf(plan, g, deadline) {
     const rel = stack.pop();
     if (rel === ".git")
       continue;
-    const abs = rel === "." ? plan.root : join14(plan.root, rel);
+    const abs = rel === "." ? plan.root : join15(plan.root, rel);
     const st = lstatOrNull(abs);
     if (st === null)
       continue;
@@ -29585,7 +30253,7 @@ function saveCommit(id, head, tracked, lines2, privateIndex, g, at) {
   const indexPath = g.run(["rev-parse", "--git-path", "index"]);
   if (!indexPath.ok)
     return null;
-  const projectIndex = resolve5(g.root, indexPath.value.trim());
+  const projectIndex = resolve6(g.root, indexPath.value.trim());
   const env = commitEnv(privateIndex, at);
   if (lstatOrNull(projectIndex) !== null)
     copyFileSync(projectIndex, privateIndex);
@@ -29654,7 +30322,7 @@ function freshId(folder, newId) {
     if (!savedIdSchema.safeParse(id).success)
       return null;
     try {
-      mkdirSync8(join14(folder, id), { mode: 448 });
+      mkdirSync8(join15(folder, id), { mode: 448 });
       return id;
     } catch (e) {
       if (e.code !== "EEXIST")
@@ -29675,11 +30343,11 @@ function repositoryOf(g) {
   if (!r.ok)
     return null;
   const dir = r.value.trim();
-  return dir === "" ? null : realOrSelf2(resolve5(g.root, dir));
+  return dir === "" ? null : realOrSelf2(resolve6(g.root, dir));
 }
 function markedRepository(dir) {
   try {
-    const text = readFileSync21(join14(dir, SAVED_REPOSITORY_FILE_NAME), "utf-8").trim();
+    const text = readFileSync22(join15(dir, SAVED_REPOSITORY_FILE_NAME), "utf-8").trim();
     return text === "" ? null : text;
   } catch {
     return null;
@@ -29713,7 +30381,7 @@ function pruneSaves(root, engagementId, ctx = {}) {
     if (!savedIdSchema.safeParse(id).success)
       continue;
     here.add(id);
-    const dir = join14(folder, id);
+    const dir = join15(folder, id);
     const st = lstatOrNull(dir);
     const answer = savedPruneAnswer({
       refMadeAt: refs.get(id) ?? null,
@@ -29752,19 +30420,19 @@ function realOrSelf2(p) {
 
 // dist/autonomy-state.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync9, readFileSync as readFileSync22, renameSync as renameSync11, rmSync as rmSync3, writeFileSync as writeFileSync13 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync9, readFileSync as readFileSync23, renameSync as renameSync12, rmSync as rmSync3, writeFileSync as writeFileSync14 } from "node:fs";
 import { homedir as homedir9, platform as platform2 } from "node:os";
-import { dirname as dirname8, join as join15 } from "node:path";
+import { dirname as dirname8, join as join16 } from "node:path";
 var AUTONOMY_STATE_FILENAME = "autonomy.json";
 var AUTONOMY_STATE_DEADLINE_MS = 1500;
 function autonomyStateFilePath(engagementId, home) {
-  return join15(home ?? homedir9(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, AUTONOMY_STATE_FILENAME);
+  return join16(home ?? homedir9(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, AUTONOMY_STATE_FILENAME);
 }
 function readCachedAutonomy(engagementId, nowMs, home) {
   if (!isEngagementId(engagementId))
     return null;
   try {
-    const parsed = autonomyStateFileSchema.safeParse(JSON.parse(readFileSync22(autonomyStateFilePath(engagementId, home), "utf-8")));
+    const parsed = autonomyStateFileSchema.safeParse(JSON.parse(readFileSync23(autonomyStateFilePath(engagementId, home), "utf-8")));
     if (!parsed.success || !parsed.data.on)
       return null;
     const age = nowMs - Date.parse(parsed.data.readAt);
@@ -29810,14 +30478,14 @@ function deleteAutonomyStateFile(engagementId, home) {
 }
 function writeAutonomyStateFile(engagementId, file2, home) {
   const target = autonomyStateFilePath(engagementId, home);
-  const temp = join15(dirname8(target), `.${AUTONOMY_STATE_FILENAME}.${process.pid}.tmp`);
+  const temp = join16(dirname8(target), `.${AUTONOMY_STATE_FILENAME}.${process.pid}.tmp`);
   try {
     mkdirSync9(dirname8(target), { recursive: true, mode: 448 });
-    writeFileSync13(temp, `${JSON.stringify(file2)}
+    writeFileSync14(temp, `${JSON.stringify(file2)}
 `, { mode: 384 });
     if (platform2() !== "win32")
       chmodSync3(temp, 384);
-    renameSync11(temp, target);
+    renameSync12(temp, target);
     return true;
   } catch {
     try {
@@ -29871,6 +30539,76 @@ async function cacheAutonomySetting(opts) {
   }
 }
 
+// dist/risky/patch-calls.js
+import { isAbsolute as isAbsolute5, resolve as resolve7 } from "node:path";
+var SHELL_TOOL = "Bash";
+function toolCallsOf(input, profile) {
+  const toolName = input["tool_name"];
+  const toolInput = input["tool_input"];
+  if (typeof toolName !== "string" || toolName === "")
+    return null;
+  if (typeof toolInput !== "object" || toolInput === null || Array.isArray(toolInput))
+    return null;
+  const call = { toolName, toolInput };
+  if (profile.id === "claude-code")
+    return [call];
+  if (!profile.writeCapableTools.includes(toolName))
+    return [call];
+  const filePath = call.toolInput["file_path"];
+  if (typeof filePath === "string" && filePath !== "")
+    return [call];
+  const command = call.toolInput["command"];
+  if (typeof command !== "string")
+    return null;
+  const ops = patchOperations(command);
+  if (ops === null || ops.length === 0)
+    return null;
+  const cwd = typeof input["cwd"] === "string" && isAbsolute5(input["cwd"]) ? input["cwd"] : null;
+  const calls = [];
+  for (const op of ops) {
+    const made = callsFor(op, cwd);
+    if (made === null)
+      return null;
+    calls.push(...made);
+  }
+  return calls;
+}
+function callsFor(op, cwd) {
+  const path = placed(op.path, cwd);
+  if (path === null)
+    return null;
+  switch (op.kind) {
+    case "add":
+      return [{ toolName: "Write", toolInput: { file_path: path, content: op.lines.length === 0 ? "" : `${op.lines.join("\n")}
+` } }];
+    case "delete":
+      return [{ toolName: SHELL_TOOL, toolInput: { command: `rm -- ${shellWord(path)}` } }];
+    case "update": {
+      const edits = op.hunks.filter((h) => h.before.length > 0).map((h) => ({ old_string: h.before.join("\n"), new_string: h.after.join("\n") }));
+      const out = [{ toolName: "MultiEdit", toolInput: { file_path: path, edits } }];
+      if (op.movedTo !== null) {
+        const dest = placed(op.movedTo, cwd);
+        if (dest === null)
+          return null;
+        out.push({ toolName: SHELL_TOOL, toolInput: { command: `mv -- ${shellWord(path)} ${shellWord(dest)}` } });
+      }
+      return out;
+    }
+    default: {
+      const unhandled = op;
+      return unhandled;
+    }
+  }
+}
+function placed(path, cwd) {
+  if (isAbsolute5(path))
+    return resolve7(path);
+  return cwd === null ? null : resolve7(cwd, path);
+}
+function shellWord(text) {
+  return `'${text.split("'").join("'\\''")}'`;
+}
+
 // dist/hooks/pre-tool-use.js
 import { performance } from "node:perf_hooks";
 import { homedir as homedir10 } from "node:os";
@@ -29882,13 +30620,15 @@ var OWN_COPY_UNKNOWN_NOTICE = "Halfcycle could not tell which copy of the projec
 var CHECKED = new Set(CHECKED_TOOLS);
 var RECORDED_ONLY = new Set(RECORDED_ONLY_TOOLS);
 function runPreToolUse(deps) {
-  const input = parseObject(deps.input);
+  const parsed = parseObject(deps.input);
+  const input = parsed === null ? null : hookInputForRule(parsed, profileOf(deps).configFolder);
   const at = clockOf(deps)();
   const stamped = { ...deps, now: () => at };
   recordTimeEvent("action", input ?? {}, stamped);
   recordOwnShell(input, at, { ...deps.liveness?.dir === void 0 ? {} : { dir: deps.liveness.dir } });
   const seen = recordLiveness(input ?? {}, deps.liveness);
   const paceDeps = {
+    configFolder: profileOf(deps).configFolder,
     ...deps.pace ?? {},
     ...deps.env === void 0 ? {} : { env: deps.env },
     ...deps.home === void 0 ? {} : { home: deps.home },
@@ -29900,14 +30640,15 @@ function runPreToolUse(deps) {
   const toolName = input === null ? void 0 : stringOf(input, "tool_name");
   if (toolName !== void 0 && RECORDED_ONLY.has(toolName))
     return recordedOnlyReply(mode);
-  const call = input === null ? null : toolCallOf(input);
-  if (call === null || !CHECKED.has(call.toolName))
+  const calls = input === null ? null : toolCallsOf(input, profileOf(deps));
+  if (calls === null || !calls.every((c) => CHECKED.has(c.toolName)))
     return unreadable(deps, input);
+  const call = calls[0] ?? { toolName: stringOf(input, "tool_name") ?? "", toolInput: {} };
   let answer;
   try {
-    answer = riskyAnswer(call, () => {
+    answer = riskyAnswer(calls, () => {
       const cwd = stringOf(input, "cwd") ?? (deps.cwd ?? (() => process.cwd()))();
-      const projectDir = deps.projectDir ?? projectFolder(deps.env ?? process.env);
+      const projectDir = projectDirOf(deps);
       const tempDir = (deps.env ?? process.env)["TMPDIR"];
       return {
         cwd,
@@ -29920,7 +30661,7 @@ function runPreToolUse(deps) {
   } catch {
     answer = { silent: true };
   }
-  const own = ownCopyOf(input, call, deps);
+  const own = ownCopyOfAll(input, calls, deps);
   try {
     if (own.kind === "refused") {
       const staked = [...answer.silent ? [] : answer.staked, own.facts];
@@ -29931,12 +30672,12 @@ function runPreToolUse(deps) {
       }
     }
     if (mode === "autonomous") {
-      const sendsSaves = call.toolName === "Bash" && typeof call.toolInput["command"] === "string" && pushesSavedRefs(call.toolInput["command"]);
+      const sendsSaves = calls.some((c) => c.toolName === "Bash" && typeof c.toolInput["command"] === "string" && pushesSavedRefs(c.toolInput["command"]));
       if (!answer.silent || sendsSaves)
         return autonomousReply(call, answer.silent ? [] : answer.staked, sendsSaves, mode, autonomy, deps);
     }
     if (answer.silent) {
-      if (call.toolName === PACE_HELD_TOOL) {
+      if (calls.length === 1 && call.toolName === PACE_HELD_TOOL) {
         const held = paceHoldText(input, call.toolInput, paceDeps);
         if (held !== null)
           return `${preToolUseReplyText("refuse", held)}
@@ -29949,7 +30690,16 @@ function runPreToolUse(deps) {
       return `${preToolUseReplyText("ask", answer.question)}
 `;
     }
-    return `${preToolUseReplyText("refuse", refusalText(answer.question))}
+    if (allowableByTyping(call, answer.staked)) {
+      const key = stepKey(input, answer.staked);
+      if (key !== null) {
+        const allowOnce = { ...deps.liveness?.dir === void 0 ? {} : { dir: deps.liveness.dir }, now: () => at.getTime() };
+        if (spendAllow(input["session_id"], key, allowOnce))
+          return "";
+        recordHeld(input["session_id"], key, allowOnce);
+      }
+    }
+    return `${preToolUseReplyText("refuse", answer.refusal.person, answer.refusal.agent)}
 `;
   } catch {
     return "";
@@ -29963,7 +30713,7 @@ function answerModeOf(input, deps, at) {
   const cached2 = engagementId === void 0 ? null : readCachedAutonomy(engagementId, at.getTime(), deps.home);
   if (engagementId !== void 0 && cached2 !== null)
     return { mode: "autonomous", autonomy: { engagementId, mayPublish: cached2.mayPublish } };
-  return { mode: answerModeFor(input === null ? void 0 : input["permission_mode"]), autonomy: null };
+  return { mode: answerModeFor(input === null ? void 0 : input["permission_mode"], profileOf(deps).id), autonomy: null };
 }
 function autonomousReply(call, staked, sendsSaves, mode, autonomy, deps) {
   try {
@@ -30043,11 +30793,40 @@ function recordedOnlyReply(mode) {
     }
   }
 }
+function profileOf(deps) {
+  return deps.profile ?? AGENT_PROFILES["claude-code"];
+}
+function projectDirOf(deps) {
+  if (deps.projectDir !== void 0)
+    return deps.projectDir;
+  const rule = profileOf(deps).projectRoot;
+  switch (rule) {
+    case "git-toplevel":
+      return (deps.cwd ?? (() => process.cwd()))();
+    case "claude-project-dir":
+      return projectFolder(deps.env ?? process.env);
+    default: {
+      const unhandled = rule;
+      return unhandled;
+    }
+  }
+}
+function ownCopyOfAll(input, calls, deps) {
+  let unknown2 = false;
+  for (const c of calls) {
+    const v = ownCopyOf(input, c, deps);
+    if (v.kind === "refused")
+      return v;
+    if (v.kind === "unknown")
+      unknown2 = true;
+  }
+  return unknown2 ? { kind: "unknown" } : { kind: "pass" };
+}
 function ownCopyOf(input, call, deps) {
   try {
     const walk2 = deps.walk ?? deps.liveness?.walk;
     return judgeOwnCopy(input, call, {
-      projectDir: deps.projectDir ?? projectFolder(deps.env ?? process.env),
+      projectDir: projectDirOf(deps),
       home: deps.home ?? homedir10(),
       ...walk2 === void 0 ? {} : { walk: walk2 },
       ...deps.liveness === void 0 ? {} : { liveness: deps.liveness }
@@ -30057,7 +30836,7 @@ function ownCopyOf(input, call, deps) {
   }
 }
 function ownCopyNotice(input, deps) {
-  const folder = stringOf(input, "cwd") ?? deps.projectDir ?? projectFolder(deps.env ?? process.env);
+  const folder = stringOf(input, "cwd") ?? projectDirOf(deps);
   return firstNoticeThisSession("outside-own-copy-unknown", folder, stringOf(input, "session_id"), deps.liveness?.dir) ? `${preToolUseNoticeText(OWN_COPY_UNKNOWN_NOTICE)}
 ` : "";
 }
@@ -30073,23 +30852,16 @@ function stringOf(input, key) {
   const v = input[key];
   return typeof v === "string" && v !== "" ? v : void 0;
 }
-function toolCallOf(input) {
-  const toolName = stringOf(input, "tool_name");
-  const toolInput = input["tool_input"];
-  if (toolName === void 0 || typeof toolInput !== "object" || toolInput === null || Array.isArray(toolInput))
-    return null;
-  return { toolName, toolInput };
-}
 function unreadable(deps, input) {
   const session = (input === null ? void 0 : stringOf(input, "session_id")) ?? /"session_id"\s*:\s*"([^"\\]+)"/.exec(deps.input)?.[1];
-  const folder = (input === null ? void 0 : stringOf(input, "cwd")) ?? deps.projectDir ?? projectFolder(deps.env ?? process.env);
+  const folder = (input === null ? void 0 : stringOf(input, "cwd")) ?? projectDirOf(deps);
   return firstNoticeThisSession("pre-tool-use-unreadable", folder, session) ? `${preToolUseNoticeText(UNREADABLE_INPUT_NOTICE)}
 ` : "";
 }
 
 // dist/hooks/session-diff.js
-import { unlinkSync as unlinkSync9 } from "node:fs";
-import { join as join16 } from "node:path";
+import { unlinkSync as unlinkSync10 } from "node:fs";
+import { join as join17 } from "node:path";
 var STOP_HOOK_EVENT = {
   stop: "Stop",
   "subagent-stop": "SubagentStop"
@@ -30124,14 +30896,14 @@ function collectDiff(repoRoot, base) {
     getDiff: (relPath) => getWorkingTreeFileDiff(relPath, repoRoot)
   };
 }
-async function runSessionDiff(input, kind, readSeat = readSeatConfiguration, afterPass) {
-  const reply = hookReply(STOP_HOOK_EVENT[kind]);
-  await evaluateSession(input, kind, reply, readSeat);
+async function runSessionDiff(input, kind, readSeat = readSeatConfiguration, afterPass, profile = AGENT_PROFILES["claude-code"]) {
+  const reply = hookReply(STOP_HOOK_EVENT[kind], profile);
+  await evaluateSession(input, kind, reply, readSeat, profile);
   if (afterPass)
     await afterPass(reply);
   reply.flush();
 }
-async function evaluateSession(input, kind, reply, readSeat) {
+async function evaluateSession(input, kind, reply, readSeat, profile) {
   const repoRootResult = getRepoRoot(process.cwd());
   if (!repoRootResult.ok) {
     if (firstNoRepoNoticeThisSession(process.cwd(), input.session_id)) {
@@ -30154,7 +30926,7 @@ async function evaluateSession(input, kind, reply, readSeat) {
   const candidates = ownEditedFiles(repoRoot, sessionId).filter((relPath) => !tracked.has(relPath));
   const untracked = getUntrackedFiles(repoRoot, candidates);
   const created = untracked.ok ? untracked.value.filter((relPath) => !tracked.has(relPath)) : [];
-  const getDiff = (relPath) => tracked.has(relPath) ? collected.getDiff(relPath) : getSingleFileDiff(join16(repoRoot, relPath), repoRoot);
+  const getDiff = (relPath) => tracked.has(relPath) ? collected.getDiff(relPath) : getSingleFileDiff(join17(repoRoot, relPath), repoRoot);
   const { evaluated } = partitionInstallerOutput(collected.files);
   const { evaluated: createdEvaluated } = partitionInstallerOutput(created);
   const changedFiles2 = [...ownChangedFiles(repoRoot, evaluated, sessionId), ...createdEvaluated];
@@ -30180,11 +30952,11 @@ async function evaluateSession(input, kind, reply, readSeat) {
     await emitRunRecord({ runType: "hook", outcome: "unconfigured", changeSet, diffBase });
     if (!firstNoticeThisSession("credential-missing", repoRoot, sessionId))
       return;
-    emitNeverConfigured(UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason(), pinnedEngagementId(projectFolder()));
+    emitNeverConfigured(UNCONFIGURED_EXIT_STOP_FAMILY, readNeverConfiguredReason(), pinnedEngagementId(projectFolder()), reply);
     return;
   }
   const { guardServiceUrl, guardServiceToken, guardEngagementId } = configResult.config;
-  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat);
+  const seatConfiguration = gatherSeatConfiguration(repoRoot, readSeat, profile);
   const evaluation = await evaluateWithRefresh({
     guardServiceUrl,
     token: guardServiceToken,
@@ -30215,7 +30987,8 @@ async function evaluateSession(input, kind, reply, readSeat) {
         // The remedy the renewal attempt earned: the sign-in when the account
         // credential is what was refused, and otherwise the plane's own sentence
         // about why it would not mint.
-        evaluation.remedy
+        evaluation.remedy,
+        reply
       );
       return;
     }
@@ -30271,7 +31044,7 @@ function removeFindingsFile(sessionId) {
   if (path === null)
     return;
   try {
-    unlinkSync9(path);
+    unlinkSync10(path);
   } catch {
   }
 }
@@ -30317,9 +31090,9 @@ async function readHookStdin() {
   }
 }
 function readStdin2() {
-  return new Promise((resolve8) => {
+  return new Promise((resolve10) => {
     if (process.stdin.isTTY) {
-      resolve8("");
+      resolve10("");
       return;
     }
     const chunks = [];
@@ -30329,7 +31102,7 @@ function readStdin2() {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve8(Buffer.concat(chunks).toString("utf-8"));
+      resolve10(Buffer.concat(chunks).toString("utf-8"));
     };
     const timer = setTimeout(done, HOOK_STDIN_GRACE_MS);
     process.stdin.on("data", (chunk) => chunks.push(chunk));
@@ -30339,11 +31112,11 @@ function readStdin2() {
 }
 
 // dist/hooks/subagent-stop.js
-async function runSubagentStop() {
-  const input = await readHookStdin();
+async function runSubagentStop(profile = AGENT_PROFILES["claude-code"]) {
+  const input = hookInputForRule(await readHookStdin(), profile.configFolder);
   recordTimeEvent("turn-end", input);
-  subagentStopped(input);
-  await runSessionDiff(input, "subagent-stop");
+  subagentStopped(input, { pace: { configFolder: profile.configFolder } });
+  await runSessionDiff(input, "subagent-stop", void 0, void 0, profile);
 }
 function subagentStopped(input, deps = {}) {
   if (clearLiveness(input, deps.liveness) === 0)
@@ -30351,14 +31124,14 @@ function subagentStopped(input, deps = {}) {
 }
 
 // dist/hooks/stop.js
-async function runStop(observeDeps = {}, timeDeps = {}, paceDeps = {}) {
-  const input = await readHookStdin();
+async function runStop(observeDeps = {}, timeDeps = {}, paceDeps = {}, profile = AGENT_PROFILES["claude-code"]) {
+  const input = hookInputForRule(await readHookStdin(), profile.configFolder);
   recordTimeEvent("turn-end", input);
   await runSessionDiff(input, "stop", readSeatConfiguration, async (reply) => {
     await observeChanges(input.session_id, reply, observeDeps);
     await sendTimeRecord(timeDeps);
-    await paceAtTurnEnd(input, reply, paceDeps);
-  });
+    await paceAtTurnEnd(input, reply, { configFolder: profile.configFolder, ...paceDeps });
+  }, profile);
 }
 
 // dist/hooks/scope-phrase.js
@@ -30514,20 +31287,20 @@ function matchReviewPhraseShape(shape, reviews) {
 }
 
 // dist/hooks/shown-record.js
-import { chmodSync as chmodSync4, readFileSync as readFileSync23, renameSync as renameSync12, unlinkSync as unlinkSync10, writeFileSync as writeFileSync14 } from "node:fs";
+import { chmodSync as chmodSync4, readFileSync as readFileSync24, renameSync as renameSync13, unlinkSync as unlinkSync11, writeFileSync as writeFileSync15 } from "node:fs";
 import { homedir as homedir11, platform as platform3 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function recordDir(engagementId, home) {
   if (!isEngagementId(engagementId))
     return null;
-  return join17(home ?? homedir11(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId);
+  return join18(home ?? homedir11(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId);
 }
 function readShownRecord(engagementId, home) {
   const dir = recordDir(engagementId, home);
   if (dir === null)
     return { entries: [], reviews: [] };
   try {
-    return parseShownRecord(readFileSync23(join17(dir, SHOWN_PLANS_FILENAME), "utf-8"));
+    return parseShownRecord(readFileSync24(join18(dir, SHOWN_PLANS_FILENAME), "utf-8"));
   } catch {
     return { entries: [], reviews: [] };
   }
@@ -30548,24 +31321,24 @@ function moveListedReviewForward(engagementId, home, listed, reviewVersion, deci
     const dir = recordDir(engagementId, home);
     if (dir === null)
       return false;
-    const path = join17(dir, SHOWN_PLANS_FILENAME);
-    const current = parseShownRecord(readFileSync23(path, "utf-8"));
+    const path = join18(dir, SHOWN_PLANS_FILENAME);
+    const current = parseShownRecord(readFileSync24(path, "utf-8"));
     const at = current.reviews.findIndex((r) => r.phase === listed.phase && r.shownAt === listed.shownAt && r.reviewVersion === listed.reviewVersion);
     if (at === -1)
       return false;
     const acts = new Map(decided.map((d) => [d.part, d.act]));
     const reviews = current.reviews.map((review, i) => i === at ? { ...review, reviewVersion, parts: review.parts.map((p) => movedPart(p, acts.get(p.part))) } : review);
     const body = serialiseShownRecord({ entries: current.entries, reviews });
-    temp = join17(dir, `.${SHOWN_PLANS_FILENAME}.${process.pid}.tmp`);
-    writeFileSync14(temp, body, { mode: 384 });
+    temp = join18(dir, `.${SHOWN_PLANS_FILENAME}.${process.pid}.tmp`);
+    writeFileSync15(temp, body, { mode: 384 });
     if (platform3() !== "win32")
       chmodSync4(temp, 384);
-    renameSync12(temp, path);
+    renameSync13(temp, path);
     return true;
   } catch {
     if (temp !== null) {
       try {
-        unlinkSync10(temp);
+        unlinkSync11(temp);
       } catch {
         return false;
       }
@@ -30909,16 +31682,63 @@ function autonomyLineForAnswer(answer) {
     }
   }
 }
+var NOTHING_ALLOWED = "Nothing was allowed";
+var ALLOW_MINUTES = Math.round(ALLOW_ONCE_MS / 6e4);
+function allowArmedLine() {
+  return line(`The person allowed the paused step once. Run it again now, exactly as before; it will go ahead once if it runs within ${ALLOW_MINUTES} minutes, and any other risky step is still paused.`);
+}
+function allowNothingHeldLine() {
+  return line(`${NOTHING_ALLOWED}: no step is paused in this session.`);
+}
+function allowSeveralHeldLine() {
+  return line(`${NOTHING_ALLOWED}: more than one step is paused in this session. Ask the agent to try the one you mean again, then type ${ALLOW_REPLY}.`);
+}
+function allowNotAttendedLine() {
+  return line(`${NOTHING_ALLOWED}: a paused step can be allowed by typing only when a person types it into an open session.`);
+}
+function allowNotSavedLine() {
+  return line(`${NOTHING_ALLOWED}: Halfcycle could not save the answer on this computer. Type ${ALLOW_REPLY} again.`);
+}
+var CODEX_TYPING_NEVER_COUNTS = "in Codex, Halfcycle cannot tell a line a person typed from one a program sent, so a typed decision never counts there";
+function codexScopeLine(act) {
+  return act === "approve" ? line(`${nothingDone(act)}: ${CODEX_TYPING_NEVER_COUNTS}. To approve, choose Accept in the console.`) : line(`${nothingDone(act)}: ${CODEX_TYPING_NEVER_COUNTS}. The console offers only Accept, so work cannot be sent back from Codex.`);
+}
+function codexReviewLine(act) {
+  return act === "accept" ? line(`${NOTHING_RECORDED}: ${CODEX_TYPING_NEVER_COUNTS}. To accept, choose Accept in the console.`) : line(`${NOTHING_RECORDED}: ${CODEX_TYPING_NEVER_COUNTS}. The console offers only Accept, so this cannot be done from Codex.`);
+}
+function codexAutonomyLine() {
+  return line(`${AUTONOMY_NOTHING_CHANGED}: ${CODEX_TYPING_NEVER_COUNTS}. Turn it on or off with "${AUTONOMY_A1_TITLE}" in the console's settings.`);
+}
 
 // dist/hooks/user-prompt-submit.js
 var CHAT_REQUEST_TIMEOUT_MS = 6e3;
 var SHOWN_ENTRY_MAX_AGE_MS = 60 * 60 * 1e3;
 async function runUserPromptSubmit(opts) {
+  return decideLine(opts);
+}
+function promptReplyFor(line2, agent) {
+  if (line2 === "" || agent === "claude-code")
+    return line2;
+  return `${userPromptContextReply(line2.trimEnd())}
+`;
+}
+function whoTyped(opts) {
+  if (agentOf(opts) !== "claude-code")
+    return "cannot-tell";
+  return readSessionAttended(opts.env ?? process.env) ? "person" : "not-attended";
+}
+function agentOf(opts) {
+  return opts.agent ?? "claude-code";
+}
+async function decideLine(opts) {
   let act = null;
   let autonomyAct = null;
   const review = { recognised: false };
   try {
     const prompt = promptOf(opts.input);
+    if (isAllowReply(prompt))
+      return `${decideAllow(opts)}
+`;
     const autonomyShape = autonomyPhraseShape(prompt);
     if (autonomyShape !== null) {
       autonomyAct = autonomyShape;
@@ -30948,9 +31768,35 @@ async function runUserPromptSubmit(opts) {
 `;
   }
 }
+function decideAllow(opts) {
+  const env = opts.env ?? process.env;
+  if ((opts.agent ?? "claude-code") === "claude-code" && !readSessionAttended(env))
+    return allowNotAttendedLine();
+  const outcome = armAllow(sessionIdOf(opts.input), {
+    ...opts.tempDir === void 0 ? {} : { dir: opts.tempDir },
+    ...opts.now === void 0 ? {} : { now: opts.now }
+  });
+  switch (outcome) {
+    case "armed":
+      return allowArmedLine();
+    case "nothing-held":
+      return allowNothingHeldLine();
+    case "several-held":
+      return allowSeveralHeldLine();
+    case "not-saved":
+      return allowNotSavedLine();
+    default: {
+      const unhandled = outcome;
+      return unhandled;
+    }
+  }
+}
 async function decideAutonomy(act, opts) {
   const env = opts.env ?? process.env;
-  if (!readSessionAttended(env))
+  const typed = whoTyped(opts);
+  if (typed === "cannot-tell")
+    return codexAutonomyLine();
+  if (typed === "not-attended")
     return autonomyNotAttendedLine();
   const read = readConfig(env);
   if (read.config === null) {
@@ -30996,12 +31842,18 @@ async function decideReview(shape, opts, progress) {
     if (match2.kind === "nothing")
       return "";
     progress.recognised = true;
-    if (!readSessionAttended(env))
+    const typed2 = whoTyped(opts);
+    if (typed2 === "cannot-tell")
+      return codexReviewLine("accept");
+    if (typed2 === "not-attended")
       return reviewNotAttendedLine();
     return checkAndSendReview(match2, read2.config.guardEngagementId, read2.config.guardServiceToken, env, opts);
   }
   progress.recognised = true;
-  if (!readSessionAttended(env))
+  const typed = whoTyped(opts);
+  if (typed === "cannot-tell")
+    return codexReviewLine(shape.kind === "part" && shape.act === "accept" ? "accept" : "other");
+  if (typed === "not-attended")
     return reviewNotAttendedLine();
   const read = readConfig(env);
   if (read.config === null) {
@@ -31107,7 +31959,10 @@ async function postReview(bulk, entry, request, engagementId, credential, env, o
 async function decide2(shape, opts) {
   const { act } = shape;
   const env = opts.env ?? process.env;
-  if (!readSessionAttended(env))
+  const typed = whoTyped(opts);
+  if (typed === "cannot-tell")
+    return codexScopeLine(act);
+  if (typed === "not-attended")
     return notAttendedLine(act);
   const read = readConfig(env);
   if (read.config === null) {
@@ -31140,6 +31995,16 @@ async function decide2(shape, opts) {
     return showFirstLine(act);
   return post(act, entry, request.data, guardEngagementId, guardServiceToken, env, opts.fetchFn);
 }
+function sessionIdOf(input) {
+  try {
+    const parsed = JSON.parse(input);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+      return void 0;
+    return parsed["session_id"];
+  } catch {
+    return void 0;
+  }
+}
 function promptOf(input) {
   try {
     const parsed = JSON.parse(input);
@@ -31201,17 +32066,17 @@ function runUserPromptFindings(opts) {
 }
 
 // dist/resolve-engagement.js
-import { existsSync as existsSync8, readFileSync as readFileSync24, realpathSync as realpathSync8 } from "node:fs";
-import { join as join18, sep as sep4 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync25, realpathSync as realpathSync8 } from "node:fs";
+import { join as join19, sep as sep5 } from "node:path";
 import { homedir as homedir12 } from "node:os";
 function defaultRegistryPath() {
-  return join18(homedir12(), ".halfcycle", "registry.json");
+  return join19(homedir12(), ".halfcycle", "registry.json");
 }
 function readRegistry(registryPath = defaultRegistryPath()) {
   if (!existsSync8(registryPath))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync24(registryPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(registryPath, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
       return {};
     const out = {};
@@ -31247,7 +32112,7 @@ function resolveEngagement(cwd, registry2) {
 function isSelfOrAncestor(ancestor, target) {
   if (ancestor === target)
     return true;
-  const withSep = ancestor.endsWith(sep4) ? ancestor : ancestor + sep4;
+  const withSep = ancestor.endsWith(sep5) ? ancestor : ancestor + sep5;
   return target.startsWith(withSep);
 }
 function runResolveEngagement(cwd, registryPath) {
@@ -31259,13 +32124,27 @@ function runResolveEngagement(cwd, registryPath) {
 }
 
 // dist/refresh-credential.js
-import { readFileSync as readFileSync26 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 
 // dist/mcp-headers.js
-import { readFileSync as readFileSync25 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { dirname as dirname9, resolve as resolve6 } from "node:path";
+import { dirname as dirname9, resolve as resolve8 } from "node:path";
+var URL_FLAG = "--url";
+function urlFromArguments(rest) {
+  const at = [];
+  for (let i = 0; i < rest.length; i += 1) {
+    if ((rest[i] ?? "").startsWith(URL_FLAG))
+      at.push(i);
+  }
+  if (at.length === 0)
+    return void 0;
+  const only = at[0];
+  if (at.length !== 1 || rest[only] !== URL_FLAG)
+    return "";
+  return rest[only + 1] ?? "";
+}
 function defaultWriteErr(text) {
   process.stderr.write(text);
 }
@@ -31278,12 +32157,12 @@ function headerLine(bearer, clientVersion) {
 }
 function projectRootFromBinary(binaryPath) {
   const depth = VENDORED_BIN_REL.split("/").length - 1;
-  return resolve6(dirname9(binaryPath), ...Array(depth).fill(".."));
+  return resolve8(dirname9(binaryPath), ...Array(depth).fill(".."));
 }
 function readPinnedVersion(root) {
   let raw;
   try {
-    raw = readFileSync25(resolve6(root, BUNDLE_PIN_REL), "utf-8");
+    raw = readFileSync26(resolve8(root, BUNDLE_PIN_REL), "utf-8");
   } catch {
     return void 0;
   }
@@ -31325,7 +32204,7 @@ function sentences(lines2) {
 }
 function badIdSentence(root) {
   return sentences([
-    `${resolve6(root, BUNDLE_PIN_REL)} names an engagement id that is not a Halfcycle project id,`,
+    `${resolve8(root, BUNDLE_PIN_REL)} names an engagement id that is not a Halfcycle project id,`,
     'so no credential was read. Delete that file and run "npx halfcycle" again: this repository',
     "is then set up as a new Halfcycle project."
   ]);
@@ -31339,7 +32218,7 @@ function storeProblemSentence(problem, root, home, engagementId) {
       ]);
     case "no-id":
       return sentences([
-        `${resolve6(root, BUNDLE_PIN_REL)} names no engagement id.`,
+        `${resolve8(root, BUNDLE_PIN_REL)} names no engagement id.`,
         'run "npx halfcycle" here to rewrite it.'
       ]);
     case "bad-id":
@@ -31356,7 +32235,7 @@ function storeProblemSentence(problem, root, home, engagementId) {
     case "no-credential":
       return sentences([
         `this machine holds no credential for engagement ${engagementId ?? ""}.`,
-        `run "npx halfcycle" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve6(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
+        `run "npx halfcycle" in this repository \u2014 it will sign you in through your browser if needed, and write the credential to ${resolve8(home, HALFCYCLE_DIR_NAME)}, outside this repository.`
       ]);
   }
 }
@@ -31418,13 +32297,14 @@ async function chooseBearer(opts) {
     }
     return NO_CREDENTIAL_PLACEHOLDER;
   }
+  const registrationFile = opts.registrationFile ?? MCP_REGISTRATION_REL;
   const want = urlOrigin(recorded);
   const got = requested === void 0 ? void 0 : urlOrigin(requested);
   if (want === void 0 || got !== want) {
     writeErr(sentences([
-      `.mcp.json asks for this repository's Halfcycle credential to be sent to ${shownUrl(requested ?? "")},`,
+      `${registrationFile} asks for this repository's Halfcycle credential to be sent to ${shownUrl(requested ?? "")},`,
       `which is not this machine's Halfcycle server (${want ?? "none recorded"}). The credential was NOT sent.`,
-      'if nobody meant to change .mcp.json, treat that change as suspect; "npx halfcycle" restores the entry.'
+      `if nobody meant to change ${registrationFile}, treat that change as suspect; "npx halfcycle" restores the entry.`
     ]));
     return NO_CREDENTIAL_PLACEHOLDER;
   }
@@ -31444,13 +32324,18 @@ async function chooseBearer(opts) {
 async function mcpHeaders(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr;
   const root = projectRootFromBinary(opts.binaryPath);
+  const variableUrl = readMcpServerUrl();
   try {
     return headerLine(await chooseBearer({
-      ...opts,
+      binaryPath: opts.binaryPath,
+      home: opts.home,
+      fetchFn: opts.fetchFn,
+      deadlineMs: opts.deadlineMs,
       writeErr,
-      requestedUrl: readMcpServerUrl(),
+      requestedUrl: variableUrl ?? opts.url,
       renewal: "renew-here",
-      environmentTokenFirst: true
+      environmentTokenFirst: true,
+      registrationFile: variableUrl === void 0 && opts.url !== void 0 ? AGENT_PROFILES.codex.mcpRegistration.file : void 0
     }), readPinnedVersion(root));
   } catch (err) {
     try {
@@ -31464,6 +32349,25 @@ async function mcpHeaders(opts) {
     return headerLine(NO_CREDENTIAL_PLACEHOLDER, readPinnedVersion(root));
   }
 }
+async function headersVerbLine(binaryPath, rest, run = mcpHeaders, writeErr = defaultWriteErr) {
+  const url2 = urlFromArguments(rest);
+  try {
+    return await run({ binaryPath, url: url2 });
+  } catch (err) {
+    if (url2 === void 0)
+      throw err;
+    const fallback = headerLine(NO_CREDENTIAL_PLACEHOLDER, readPinnedVersion(projectRootFromBinary(binaryPath)));
+    try {
+      writeErr(sentences([
+        `the credential could not be read: ${err instanceof Error ? err.message : String(err)}`,
+        `run "npx halfcycle" in this repository to rewrite this machine's credential.`
+      ]));
+    } catch {
+      return fallback;
+    }
+    return fallback;
+  }
+}
 
 // dist/refresh-credential.js
 var UNAUTHORIZED2 = 401;
@@ -31504,13 +32408,19 @@ async function refreshCredentialToken(opts) {
   return { token: refreshed.token };
 }
 var CHECKED_SOURCES = /* @__PURE__ */ new Set(["startup", "resume"]);
+function isCheckedSessionStart(input, profile) {
+  const source = input["source"];
+  if (source === void 0 && profile.id === "codex")
+    return true;
+  return CHECKED_SOURCES.has(source);
+}
 var CONNECTED_SENTENCE = `Halfcycle's sign-in works and its service answered. If its tools are missing, turn on ${MCP_SERVER_KEY} in /mcp; if it is not listed, run "claude mcp reset-project-choices" here and restart Claude Code.`;
 var INITIALIZE_BODY = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} });
 var SESSION_START_PROBE_ATTEMPTS = 2;
 function registeredMcpUrl(projectRoot) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync26(resolve7(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
+    parsed = JSON.parse(readFileSync27(resolve9(projectRoot, MCP_REGISTRATION_REL), "utf-8"));
   } catch {
     return void 0;
   }
@@ -31682,6 +32592,7 @@ function defaultWriteErr2(text) {
 }
 async function runRefreshCredential(opts) {
   const writeErr = opts.writeErr ?? defaultWriteErr2;
+  const profile = opts.profile ?? AGENT_PROFILES["claude-code"];
   const startedAt = Date.now();
   try {
     const renewalSaid = [];
@@ -31695,7 +32606,7 @@ async function runRefreshCredential(opts) {
     ]);
     renewalOpen = false;
     const parts = [];
-    if (CHECKED_SOURCES.has(input["source"])) {
+    if (isCheckedSessionStart(input, profile)) {
       const connection = await checkConnection(renewedToken, { ...opts, writeErr });
       if (connection !== void 0) {
         parts.push(connection.sentence);
@@ -31717,7 +32628,7 @@ async function runRefreshCredential(opts) {
         }
       }
     }
-    if (CHECKED_SOURCES.has(input["source"])) {
+    if (isCheckedSessionStart(input, profile)) {
       const config2 = readConfig().config;
       if (config2 !== null) {
         const remainingForMargin = SESSION_START_HOOK_TIMEOUT_MS - SESSION_START_MARGIN_MS - (Date.now() - startedAt);
@@ -31757,7 +32668,7 @@ async function runRefreshCredential(opts) {
 import { fileURLToPath } from "node:url";
 
 // dist/capture.js
-import { readFileSync as readFileSync27, writeFileSync as writeFileSync15, mkdirSync as mkdirSync10, existsSync as existsSync9 } from "node:fs";
+import { readFileSync as readFileSync28, writeFileSync as writeFileSync16, mkdirSync as mkdirSync10, existsSync as existsSync9 } from "node:fs";
 import { dirname as dirname10 } from "node:path";
 function runCapture(provider, endpoint, opts = {}) {
   const repoRoot = opts.repoRoot ?? process.cwd();
@@ -31794,7 +32705,7 @@ function runCapture(provider, endpoint, opts = {}) {
   const manifestFile = manifestPath(repoRoot);
   try {
     mkdirSync10(dirname10(fixture), { recursive: true });
-    writeFileSync15(fixture, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+    writeFileSync16(fixture, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     return { ok: false, kind: "write-failed", message: `could not write fixture: ${msg}` };
@@ -31825,7 +32736,7 @@ function readInputFile(fromFile) {
   if (!fromFile)
     return void 0;
   try {
-    return readFileSync27(fromFile, "utf-8");
+    return readFileSync28(fromFile, "utf-8");
   } catch {
     return void 0;
   }
@@ -31837,10 +32748,10 @@ function relativeFixturePath(repoRoot, fixture) {
 
 // dist/prove.js
 import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
-import { createWriteStream, mkdirSync as mkdirSync11, readdirSync as readdirSync10, readFileSync as readFileSync28, renameSync as renameSync13, unlinkSync as unlinkSync11, writeFileSync as writeFileSync16 } from "node:fs";
+import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
+import { createWriteStream, mkdirSync as mkdirSync11, readdirSync as readdirSync10, readFileSync as readFileSync29, renameSync as renameSync14, unlinkSync as unlinkSync12, writeFileSync as writeFileSync17 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
-import { dirname as dirname11, join as join19 } from "node:path";
+import { dirname as dirname11, join as join20 } from "node:path";
 
 // dist/test-counts.js
 function sum(values) {
@@ -31949,10 +32860,10 @@ function isProofTestPath(path) {
 function testRunsDir(engagementId, home) {
   if (!isEngagementId(engagementId))
     return null;
-  return join19(home ?? homedir14(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, TEST_RUNS_DIR_NAME);
+  return join20(home ?? homedir14(), HALFCYCLE_DIR_NAME, ENGAGEMENTS_DIR_NAME, engagementId, TEST_RUNS_DIR_NAME);
 }
 function commandIdOf(command) {
-  return createHash5("sha256").update(command, "utf8").digest("hex").slice(0, 16);
+  return createHash6("sha256").update(command, "utf8").digest("hex").slice(0, 16);
 }
 var PLAIN_WORD = /^[A-Za-z0-9_./:=@%+,-]+$/;
 function commandFromWords(words, platform4 = process.platform) {
@@ -32037,19 +32948,19 @@ function parseProveArgs(args2) {
 function writeJsonFile2(path, value) {
   mkdirSync11(dirname11(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.${randomUUID3()}.tmp`;
-  writeFileSync16(tmp, JSON.stringify(value), { mode: 384 });
-  renameSync13(tmp, path);
+  writeFileSync17(tmp, JSON.stringify(value), { mode: 384 });
+  renameSync14(tmp, path);
 }
 function subjectKey(subject) {
   return subject.kind === "task" ? ["task", subject.phase, subject.task] : ["change", subject.change];
 }
 function keptCheckPath(dir, subject, label) {
-  const key = createHash5("sha256").update(JSON.stringify([...subjectKey(subject), label]), "utf8").digest("hex");
-  return join19(dir, COMMANDS_DIR_NAME, `${key.slice(0, 32)}.json`);
+  const key = createHash6("sha256").update(JSON.stringify([...subjectKey(subject), label]), "utf8").digest("hex");
+  return join20(dir, COMMANDS_DIR_NAME, `${key.slice(0, 32)}.json`);
 }
 function readKeptCheck(dir, subject, label) {
   try {
-    const raw = JSON.parse(readFileSync28(keptCheckPath(dir, subject, label), "utf-8"));
+    const raw = JSON.parse(readFileSync29(keptCheckPath(dir, subject, label), "utf-8"));
     if (typeof raw.command !== "string" || raw.command === "" || typeof raw.commandId !== "string")
       return null;
     const b = raw.before;
@@ -32060,21 +32971,21 @@ function readKeptCheck(dir, subject, label) {
   }
 }
 function queuePath(dir, runId) {
-  return join19(dir, QUEUE_DIR_NAME, `${runId}.json`);
+  return join20(dir, QUEUE_DIR_NAME, `${runId}.json`);
 }
 function readQueue(dir) {
   let names;
   try {
-    names = readdirSync10(join19(dir, QUEUE_DIR_NAME)).filter((n) => n.endsWith(".json"));
+    names = readdirSync10(join20(dir, QUEUE_DIR_NAME)).filter((n) => n.endsWith(".json"));
   } catch {
     return [];
   }
   const reports = [];
   for (const name of names) {
-    const path = join19(dir, QUEUE_DIR_NAME, name);
+    const path = join20(dir, QUEUE_DIR_NAME, name);
     let parsed = null;
     try {
-      parsed = testRunReportSchema.safeParse(JSON.parse(readFileSync28(path, "utf-8")));
+      parsed = testRunReportSchema.safeParse(JSON.parse(readFileSync29(path, "utf-8")));
     } catch {
       parsed = null;
     }
@@ -32087,7 +32998,7 @@ function readQueue(dir) {
 }
 function removeFile(path) {
   try {
-    unlinkSync11(path);
+    unlinkSync12(path);
   } catch {
   }
 }
@@ -32154,7 +33065,7 @@ function runCommand(command, repoRoot, logPath, env, deps) {
   mkdirSync11(dirname11(logPath), { recursive: true, mode: 448 });
   const log = createWriteStream(logPath, { mode: 384 });
   const began = process.hrtime.bigint();
-  return new Promise((resolve8) => {
+  return new Promise((resolve10) => {
     let timedOut = false;
     let started = true;
     let settled = false;
@@ -32189,7 +33100,7 @@ function runCommand(command, repoRoot, logPath, env, deps) {
       process.off("SIGINT", onSignal);
       process.off("SIGTERM", onSignal);
       const durationMs = Number((process.hrtime.bigint() - began) / 1000000n);
-      log.end(() => resolve8({ exitCode: timedOut || !started ? null : code, timedOut, started, durationMs }));
+      log.end(() => resolve10({ exitCode: timedOut || !started ? null : code, timedOut, started, durationMs }));
     };
     child.on("error", (e) => {
       started = false;
@@ -32243,7 +33154,7 @@ function checkCommand(command, reason, repoRoot, env, home) {
       ...home === void 0 ? {} : { home }
     }));
   } catch {
-    return { silent: false, question: couldNotTellQuestion(reason ?? null), staked: [] };
+    return { silent: false, question: couldNotTellQuestion(reason ?? null), refusal: couldNotTellRefusal(reason ?? null), staked: [] };
   }
 }
 async function runProve(args2, deps = {}) {
@@ -32311,13 +33222,13 @@ ${PROVE_USAGE}`);
   if (request.when === "before" && changedOutsideTests > 0)
     say(lateBeforeLine(changedOutsideTests));
   const runId = randomUUID3();
-  const logPath = join19(dir, `${runId}.log`);
+  const logPath = join20(dir, `${runId}.log`);
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const deadline = deps.deadlineMs ?? PROVE_RUN_DEADLINE_MS;
   const end = await runCommand(command, repoRoot, logPath, env, deps);
   let output = "";
   try {
-    output = readFileSync28(logPath, "utf-8");
+    output = readFileSync29(logPath, "utf-8");
   } catch {
     output = "";
   }
@@ -32367,7 +33278,7 @@ ${PROVE_USAGE}`);
 
 // dist/statusline.js
 import { spawn as spawn3 } from "node:child_process";
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 import nodePath5 from "node:path";
 var OWN_STATUS_LINE_DEADLINE_MS = 5e3;
 var PERSON_SETTINGS_FILENAME = "settings.json";
@@ -32405,7 +33316,7 @@ function halfcycleStatusLineOf(figures) {
 }
 function personStatusLineCommand(configFolder) {
   try {
-    const v = JSON.parse(readFileSync29(nodePath5.join(configFolder, PERSON_SETTINGS_FILENAME), "utf-8"));
+    const v = JSON.parse(readFileSync30(nodePath5.join(configFolder, PERSON_SETTINGS_FILENAME), "utf-8"));
     const line2 = v["statusLine"];
     if (typeof line2 !== "object" || line2 === null)
       return null;
@@ -32429,14 +33340,14 @@ function personCommandEnv(env) {
   }
   return out;
 }
-var runOwnCommandReal = (command, input, env) => new Promise((resolve8) => {
+var runOwnCommandReal = (command, input, env) => new Promise((resolve10) => {
   let out = "";
   let settled = false;
   const done = (v) => {
     if (settled)
       return;
     settled = true;
-    resolve8(v);
+    resolve10(v);
   };
   try {
     const child = spawn3(command, {
@@ -32546,7 +33457,12 @@ async function main() {
     return;
   }
   if (cmd === "refresh-credential") {
-    const reply = await runRefreshCredential({ binaryPath: fileURLToPath(import.meta.url) });
+    const profile = agentFromArguments(args.slice(1));
+    if (profile === null) {
+      unknownCommand();
+      return;
+    }
+    const reply = await runRefreshCredential({ binaryPath: fileURLToPath(import.meta.url), profile });
     process.stdout.write(reply, () => process.exit(0));
     return;
   }
@@ -32631,7 +33547,7 @@ async function main() {
     return;
   }
   if (cmd === "mcp-headers") {
-    const line2 = await mcpHeaders({ binaryPath: fileURLToPath(import.meta.url) });
+    const line2 = await headersVerbLine(fileURLToPath(import.meta.url), args.slice(1));
     process.stdout.write(line2, () => process.exit(0));
     return;
   }
@@ -32673,25 +33589,30 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
     return;
   }
   if (cmd === "hook") {
+    const profile = agentFromArguments(args.slice(2));
+    if (profile === null) {
+      unknownCommand();
+      return;
+    }
     if (sub === "post-tool-use") {
-      await runPostToolUse();
-      process.exit(process.exitCode ?? 0);
+      await runPostToolUse(void 0, profile);
+      process.exit(hookExitCode(profile));
       return;
     }
     if (sub === "stop") {
-      await runStop();
-      process.exit(process.exitCode ?? 0);
+      await runStop(void 0, void 0, void 0, profile);
+      process.exit(hookExitCode(profile));
       return;
     }
     if (sub === "subagent-stop") {
-      await runSubagentStop();
-      process.exit(process.exitCode ?? 0);
+      await runSubagentStop(profile);
+      process.exit(hookExitCode(profile));
       return;
     }
     if (sub === "pre-tool-use") {
       let reply = "";
       try {
-        reply = runPreToolUse({ input: await readStdin2() });
+        reply = runPreToolUse({ input: await readStdin2(), profile });
       } catch {
         reply = "";
       }
@@ -32701,7 +33622,7 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
     if (sub === "user-prompt-submit") {
       let reply = "";
       try {
-        reply = await runUserPromptSubmit({ input: await readStdin2() });
+        reply = promptReplyFor(await runUserPromptSubmit({ input: await readStdin2(), agent: profile.id }), profile.id);
       } catch {
         reply = "";
       }
@@ -32724,17 +33645,20 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
     process.exit(1);
     return;
   }
-  process.stderr.write(`halfcycle-runner: unknown command "${cmd ?? ""}"
+  unknownCommand(cmd ?? "");
+}
+function unknownCommand(name = args.join(" ")) {
+  process.stderr.write(`halfcycle-runner: unknown command "${name}"
   Usage: halfcycle-runner ci
-         halfcycle-runner hook post-tool-use
-         halfcycle-runner hook pre-tool-use
-         halfcycle-runner hook stop
-         halfcycle-runner hook subagent-stop
-         halfcycle-runner hook user-prompt-submit
-         halfcycle-runner hook user-prompt-findings
-         halfcycle-runner refresh-credential
+         halfcycle-runner hook post-tool-use [--agent <id>]
+         halfcycle-runner hook pre-tool-use [--agent <id>]
+         halfcycle-runner hook stop [--agent <id>]
+         halfcycle-runner hook subagent-stop [--agent <id>]
+         halfcycle-runner hook user-prompt-submit [--agent <id>]
+         halfcycle-runner hook user-prompt-findings [--agent <id>]
+         halfcycle-runner refresh-credential [--agent <id>]
          halfcycle-runner check-connection
-         halfcycle-runner mcp-headers
+         halfcycle-runner mcp-headers [--url <address>]
          halfcycle-runner observe
          halfcycle-runner observe --change <sortingId>
          halfcycle-runner time
@@ -32748,16 +33672,20 @@ Commit the fixture; the next guard evaluation of this endpoint will pass.
   process.exit(1);
 }
 function readStdin3() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve10, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => resolve8(Buffer.concat(chunks).toString("utf-8")));
+    process.stdin.on("end", () => resolve10(Buffer.concat(chunks).toString("utf-8")));
     process.stdin.on("error", reject);
   });
 }
 main().catch((err) => {
-  process.stderr.write(`halfcycle-runner: unexpected error: ${err instanceof Error ? err.message : String(err)}
-Contact hello@halfcycle.ai if this keeps happening.
-`);
-  process.exit(1);
+  let reply = "";
+  const code = answerUnexpectedError(args, err, {
+    stdout: (text) => {
+      reply += text;
+    },
+    stderr: (text) => process.stderr.write(text)
+  });
+  process.stdout.write(reply, () => process.exit(code));
 });