harnery 0.41.0 → 0.43.0

package/dist/core/hooks/resolve/transcript.js

@@ -318,6 +318,90 @@ const SESSION_FILE_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-
 const FORK_SCAN_MAX_BYTES = 128 * 1024 * 1024;
 /** How many message uuids to sample across the fork's copied prefix. */
 const FORK_SAMPLE_SIZE = 24;
+/** Tail window scanned for inherited rows; a fork's own rows are few when the
+ * scan runs (session start or the first tool call), so the copied history ends
+ * well inside it. */
+const INHERITED_TAIL_BYTES = 4 * 1024 * 1024;
+const INHERITED_HEAD_BYTES = 64 * 1024;
+const SESSION_ID_FIELD_RE = /"sessionId":"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})"/gi;
+/**
+ * Detect inherited history from row session ids: the session whose rows were
+ * copied into this transcript, or undefined when every row is this session's.
+ *
+ * Empirical basis (verified 2026-10-07, Claude Code 2.1.283): the desktop
+ * app's "Fork from here" copies the parent's rows into the fork's transcript
+ * WITHOUT rewriting their `sessionId`, so the fork's file opens with thousands
+ * of rows stamped with the parent's id. The CLI `--fork-session` path rewrites
+ * the ids instead and is covered by {@link detectForkParent}.
+ *
+ * When the history is itself several generations deep, the LAST foreign row is
+ * the nearest ancestor, so the tail is scanned first. Whether the foreign
+ * session is a fork parent or a dead predecessor (a continuation) is the
+ * caller's call. Fail-soft: never throws, undefined on any read problem.
+ */
+export function detectInheritedSessionParent(transcriptPath, sessionId) {
+    try {
+        const readablePath = resolveTranscriptPath(transcriptPath);
+        if (!readablePath || !sessionId)
+            return undefined;
+        const size = statSync(readablePath).size;
+        const fromTail = lastForeignSessionId(readRange(readablePath, Math.max(0, size - INHERITED_TAIL_BYTES), size), sessionId);
+        if (fromTail || size <= INHERITED_TAIL_BYTES)
+            return fromTail;
+        return lastForeignSessionId(readRange(readablePath, 0, Math.min(size, INHERITED_HEAD_BYTES)), sessionId);
+    }
+    catch {
+        return undefined;
+    }
+}
+function lastForeignSessionId(text, sessionId) {
+    if (!text)
+        return undefined;
+    const own = sessionId.toLowerCase();
+    const lines = text.split("\n");
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        if (!line.includes('"sessionId":"'))
+            continue;
+        let foreign = false;
+        for (const m of line.matchAll(SESSION_ID_FIELD_RE)) {
+            if (m[1].toLowerCase() !== own)
+                foreign = true;
+        }
+        if (!foreign)
+            continue;
+        // Confirm on the parsed row: a nested object can carry another session's
+        // id, but only the row's own top-level field says whose row it is. A
+        // partial line at a window edge fails to parse and is skipped.
+        try {
+            const row = JSON.parse(line);
+            if (typeof row.sessionId === "string" && row.sessionId.toLowerCase() !== own) {
+                return row.sessionId;
+            }
+        }
+        catch {
+            /* torn line */
+        }
+    }
+    return undefined;
+}
+function readRange(path, start, end) {
+    try {
+        const fs = require("node:fs");
+        const fd = fs.openSync(path, "r");
+        try {
+            const buf = Buffer.alloc(Math.max(0, end - start));
+            fs.readSync(fd, buf, 0, buf.length, start);
+            return buf.toString("utf8");
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Detect the parent session of a forked CC conversation from its transcript.
  *

package/dist/core/hooks/run-markers.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Start markers for hook runs on adapters that kill a hook at its `timeout`
+ * (ADR 0197). A Codex hook that times out has its process tree killed and the
+ * tool proceeds without that hook's checks, and the killed process never
+ * reaches the completion receipt in `health.ts`. A small marker written at
+ * start and removed at completion leaves evidence of that case for doctor.
+ *
+ * Observer-only: every write, read, and removal swallows its own errors so a
+ * marker can never change hook behavior.
+ */
+export interface HookRunMarker {
+    event: string;
+    adapter: string;
+    pid: number;
+    started_at: string;
+    timeout_sec: number;
+}
+export declare function hookRunMarkerDir(coordRoot: string): string;
+/** Write this run's marker; returns its path, or null when it could not be written. */
+export declare function writeHookRunMarker(coordRoot: string, marker: Omit<HookRunMarker, "started_at">, now?: Date): string | null;
+export declare function clearHookRunMarker(path: string | null): void;
+export interface UnfinishedHookRuns {
+    count: number;
+    /** Count per event name, most frequent first. */
+    events: Array<{
+        event: string;
+        count: number;
+    }>;
+    latest: string | null;
+}
+/**
+ * Markers whose run outlived its timeout plus a grace period and whose
+ * process is gone, within the window. A live process past its timeout is
+ * still running and is not counted.
+ */
+export declare function findUnfinishedHookRuns(coordRoot: string, nowMs?: number, windowMs?: number, isAlive?: (pid: number) => boolean): UnfinishedHookRuns;
+//# sourceMappingURL=run-markers.d.ts.map

package/dist/core/hooks/run-markers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-markers.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/run-markers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EACzC,GAAG,OAAa,GACf,MAAM,GAAG,IAAI,CAYf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO5D;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,SAAa,EAClB,QAAQ,SAAsB,EAC9B,OAAO,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAsB,GAC/C,kBAAkB,CA+BpB"}

package/dist/core/hooks/run-markers.js

@@ -0,0 +1,109 @@
+/**
+ * Start markers for hook runs on adapters that kill a hook at its `timeout`
+ * (ADR 0197). A Codex hook that times out has its process tree killed and the
+ * tool proceeds without that hook's checks, and the killed process never
+ * reaches the completion receipt in `health.ts`. A small marker written at
+ * start and removed at completion leaves evidence of that case for doctor.
+ *
+ * Observer-only: every write, read, and removal swallows its own errors so a
+ * marker can never change hook behavior.
+ */
+import { mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** Markers older than this are pruned when a new one is written. */
+const MARKER_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+/** A run is unfinished once its marker outlives the timeout by this much. */
+const UNFINISHED_GRACE_MS = 30_000;
+export function hookRunMarkerDir(coordRoot) {
+    return join(coordRoot, ".harnery", "active", "hook-runs");
+}
+/** Write this run's marker; returns its path, or null when it could not be written. */
+export function writeHookRunMarker(coordRoot, marker, now = new Date()) {
+    try {
+        const dir = hookRunMarkerDir(coordRoot);
+        mkdirSync(dir, { recursive: true });
+        pruneHookRunMarkers(dir, now.getTime());
+        const path = join(dir, `${marker.pid}-${safeName(marker.event)}.json`);
+        const body = { ...marker, started_at: now.toISOString() };
+        writeFileSync(path, `${JSON.stringify(body)}\n`);
+        return path;
+    }
+    catch {
+        return null;
+    }
+}
+export function clearHookRunMarker(path) {
+    if (!path)
+        return;
+    try {
+        rmSync(path, { force: true });
+    }
+    catch {
+        // Observer-only.
+    }
+}
+/**
+ * Markers whose run outlived its timeout plus a grace period and whose
+ * process is gone, within the window. A live process past its timeout is
+ * still running and is not counted.
+ */
+export function findUnfinishedHookRuns(coordRoot, nowMs = Date.now(), windowMs = 24 * 60 * 60 * 1000, isAlive = processAlive) {
+    const counts = new Map();
+    let latest = null;
+    let count = 0;
+    let names = [];
+    try {
+        names = readdirSync(hookRunMarkerDir(coordRoot)).filter((n) => n.endsWith(".json"));
+    }
+    catch {
+        return { count: 0, events: [], latest: null };
+    }
+    for (const name of names) {
+        let marker;
+        try {
+            marker = JSON.parse(readFileSync(join(hookRunMarkerDir(coordRoot), name), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        const started = Date.parse(marker.started_at);
+        if (!Number.isFinite(started) || nowMs - started > windowMs)
+            continue;
+        if (nowMs - started < marker.timeout_sec * 1000 + UNFINISHED_GRACE_MS)
+            continue;
+        if (isAlive(marker.pid))
+            continue;
+        count++;
+        counts.set(marker.event, (counts.get(marker.event) ?? 0) + 1);
+        if (!latest || marker.started_at > latest)
+            latest = marker.started_at;
+    }
+    const events = [...counts.entries()]
+        .map(([event, n]) => ({ event, count: n }))
+        .sort((a, b) => b.count - a.count || a.event.localeCompare(b.event));
+    return { count, events, latest };
+}
+function pruneHookRunMarkers(dir, nowMs) {
+    for (const name of readdirSync(dir)) {
+        const path = join(dir, name);
+        try {
+            if (nowMs - statSync(path).mtimeMs > MARKER_RETENTION_MS)
+                rmSync(path, { force: true });
+        }
+        catch {
+            // Observer-only.
+        }
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+function safeName(value) {
+    return value.replace(/[^a-zA-Z0-9._-]+/g, "-").slice(0, 64) || "unknown";
+}

package/dist/core/hooks/shell-rm.d.ts

@@ -0,0 +1,2 @@
+export declare function shellRmReason(toolName: unknown, toolInput: unknown, binName: string): string | null;
+//# sourceMappingURL=shell-rm.d.ts.map

package/dist/core/hooks/shell-rm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-rm.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-rm.ts"],"names":[],"mappings":"AAsFA,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAYf"}

package/dist/core/hooks/shell-rm.js

@@ -0,0 +1,105 @@
+import { basename, shellCommandFromTool, tokenize } from "./shell-tokens.js";
+/**
+ * Deny a shell `rm` and name the guarded replacement. The instructions have
+ * said "use <bin> rm instead of shell rm" since the command shipped, and
+ * agents still reached for bare rm several times a day, often on unquoted
+ * variable paths that Claude Code then stops on for a human prompt. A
+ * repeated, machine-detectable failure belongs in a gate, not more prose.
+ *
+ * This is a guardrail against the reflex, not a security boundary: it reads
+ * command positions only (so `git rm`, `docker rm`, and quoted examples pass),
+ * plus the `xargs rm`, `find -exec rm`, and `bash -c '...rm...'` shapes.
+ * HARNERY_ALLOW_RM=1 on the command is the deliberate override.
+ */
+const OVERRIDE = "HARNERY_ALLOW_RM=1";
+const SEPARATORS = new Set([";", "|", "||", "&", "&&", "(", ")", "{", "}"]);
+const KEYWORDS = new Set(["do", "if", "then", "elif", "else", "!", "while", "until", "time"]);
+const WRAPPERS = new Set(["command", "exec", "builtin", "nohup", "sudo", "doas", "env", "nice"]);
+// xargs options that consume the following token as their value.
+const XARGS_VALUE_FLAGS = new Set(["-n", "-I", "-L", "-P", "-d", "-E", "-s", "-a"]);
+function isRm(value, quoted) {
+    return !quoted && basename(value) === "rm";
+}
+function invokesRm(source, depth = 0) {
+    if (depth > 8)
+        return false;
+    const tokens = tokenize(source);
+    if (tokens.some((t) => !t.quoted && t.value === OVERRIDE))
+        return false;
+    let start = true;
+    let afterWrapper = false;
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.operator) {
+            if (SEPARATORS.has(token.value)) {
+                start = true;
+                afterWrapper = false;
+            }
+            continue;
+        }
+        if (!start)
+            continue;
+        if (!token.quoted) {
+            if (KEYWORDS.has(token.value))
+                continue;
+            if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(token.value))
+                continue;
+            if (afterWrapper && token.value.startsWith("-"))
+                continue;
+        }
+        const name = basename(token.value);
+        if (WRAPPERS.has(name)) {
+            afterWrapper = true;
+            continue;
+        }
+        start = false;
+        afterWrapper = false;
+        if (isRm(token.value, token.quoted))
+            return true;
+        if (name === "xargs") {
+            for (let j = i + 1; j < tokens.length && !tokens[j].operator; j++) {
+                const arg = tokens[j];
+                if (arg.value.startsWith("-")) {
+                    if (XARGS_VALUE_FLAGS.has(arg.value))
+                        j++;
+                    continue;
+                }
+                if (isRm(arg.value, arg.quoted))
+                    return true;
+                break;
+            }
+        }
+        if (name === "find") {
+            for (let j = i + 1; j < tokens.length && !tokens[j].operator; j++) {
+                if (!/^-(?:exec|execdir|ok|okdir)$/.test(tokens[j].value))
+                    continue;
+                const next = tokens[j + 1];
+                if (next && !next.operator && isRm(next.value, next.quoted))
+                    return true;
+            }
+        }
+        if (["bash", "sh", "dash", "zsh", "ksh"].includes(name)) {
+            for (let j = i + 1; j < tokens.length && !tokens[j].operator; j++) {
+                if (/^-[a-z]*c[a-z]*$/.test(tokens[j].value)) {
+                    const script = tokens[j + 1];
+                    if (script && !script.operator && invokesRm(script.value, depth + 1))
+                        return true;
+                    break;
+                }
+            }
+        }
+    }
+    return false;
+}
+export function shellRmReason(toolName, toolInput, binName) {
+    const command = shellCommandFromTool(toolName, toolInput);
+    if (command === null || !invokesRm(command))
+        return null;
+    return (`Shell rm blocked: it skips the resolved-path, Git-ownership, and peer-claim checks, and an ` +
+        `unquoted variable path can expand to the wrong target. Use the guarded paths instead: ` +
+        `\`${binName} rm --root <directory> <paths...>\` previews removal of untracked files (add ` +
+        `--yes to delete, -r for a directory); \`git rm\` removes tracked source; ` +
+        `\`${binName} artifacts discard <id>\` retires managed evidence. To replace a file, overwrite ` +
+        `it in place or \`mv\` the new file over the old one, so nothing needs deleting. If none of ` +
+        `these fit, prefix the command with ${OVERRIDE}.`);
+}

package/dist/core/hooks/shell-tokens.d.ts

@@ -0,0 +1,12 @@
+/** Shared, deliberately small shell lexer for PreToolUse command guards. */
+export interface Token {
+    value: string;
+    quoted: boolean;
+    operator?: boolean;
+}
+/** Keep quoted arguments opaque, including examples and heredoc bodies. */
+export declare function tokenize(source: string): Token[];
+export declare function basename(value: string): string;
+/** The command string of a Bash-style tool call, or null for any other tool. */
+export declare function shellCommandFromTool(toolName: unknown, toolInput: unknown): string | null;
+//# sourceMappingURL=shell-tokens.d.ts.map

package/dist/core/hooks/shell-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-tokens.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-tokens.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,CA+DhD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAgBzF"}

package/dist/core/hooks/shell-tokens.js

@@ -0,0 +1,97 @@
+/** Shared, deliberately small shell lexer for PreToolUse command guards. */
+/** Keep quoted arguments opaque, including examples and heredoc bodies. */
+export function tokenize(source) {
+    const out = [];
+    const heredocs = [];
+    for (let i = 0; i < source.length;) {
+        const ch = source[i];
+        if (ch === "\\" && source[i + 1] === "\n") {
+            i += 2;
+            continue;
+        }
+        if (ch === "\n") {
+            out.push({ value: ";", quoted: false, operator: true });
+            i++;
+            for (const doc of heredocs.splice(0)) {
+                while (i < source.length) {
+                    const end = source.indexOf("\n", i);
+                    const stop = end === -1 ? source.length : end;
+                    const line = source.slice(i, stop);
+                    i = end === -1 ? source.length : end + 1;
+                    if ((doc.tabs ? line.replace(/^\t+/, "") : line) === doc.end)
+                        break;
+                }
+            }
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        if (ch === "#") {
+            const end = source.indexOf("\n", i);
+            i = end === -1 ? source.length : end;
+            continue;
+        }
+        if (";|&(){}<>".includes(ch)) {
+            const op = source.slice(i).match(/^(?:<<-?|>>|&&|\|\||[;|&(){}<>])/)[0];
+            out.push({ value: op, quoted: false, operator: true });
+            i += op.length;
+            continue;
+        }
+        let value = "";
+        let quoted = false;
+        while (i < source.length && !/[\s;|&(){}<>]/.test(source[i])) {
+            const next = source[i++];
+            if (next === "'" || next === '"' || next === "`") {
+                quoted = true;
+                while (i < source.length && source[i] !== next) {
+                    if (source[i] === "\\" && next !== "'" && i + 1 < source.length)
+                        i++;
+                    value += source[i++];
+                }
+                if (source[i] === next)
+                    i++;
+            }
+            else if (next === "\\" && i < source.length) {
+                const escaped = source[i++];
+                if (escaped !== "\n")
+                    value += escaped;
+            }
+            else {
+                value += next;
+            }
+        }
+        const previous = out.at(-1)?.value;
+        if (previous === "<<" || previous === "<<-") {
+            heredocs.push({ end: value, tabs: previous === "<<-" });
+        }
+        out.push({ value, quoted });
+    }
+    return out;
+}
+export function basename(value) {
+    return value.split(/[\\/]/).at(-1) ?? value;
+}
+/** The command string of a Bash-style tool call, or null for any other tool. */
+export function shellCommandFromTool(toolName, toolInput) {
+    if (typeof toolName !== "string")
+        return null;
+    const name = toolName.toLowerCase().replace(/^functions\./, "");
+    if (!["bash", "shell", "shell_command", "exec_command"].includes(name))
+        return null;
+    let input = toolInput;
+    if (typeof input === "string") {
+        try {
+            input = JSON.parse(input);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!input || typeof input !== "object")
+        return null;
+    const args = input;
+    const command = args.command ?? args.cmd;
+    return typeof command === "string" ? command : null;
+}

package/dist/core/hooks/shell-waiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-waiter.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-waiter.ts"],"names":[],"mappings":"AAqJA,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAgBtF"}
+{"version":3,"file":"shell-waiter.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-waiter.ts"],"names":[],"mappings":"AA2EA,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGtF"}

package/dist/core/hooks/shell-waiter.js

@@ -1,83 +1,10 @@
+import { basename, shellCommandFromTool, tokenize } from "./shell-tokens.js";
 /** Recognize inline waiters; this is not a proof of arbitrary shell termination. */
 const REASON = "Inline shell waiter blocked: polling loops and delayed log-only checks can outlive the job " +
     "and accumulate as background tasks. Read the existing task output now, or wait on its " +
     "existing task handle. If polling is necessary, use a reviewed script with a hard deadline, " +
     "nonzero timeout exit, and producer-exit/failure detection. Do not create another waiter " +
     "to check progress or infer completion from a broad pgrep -f pattern.";
-/** Keep quoted arguments opaque, including examples and heredoc bodies. */
-function tokenize(source) {
-    const out = [];
-    const heredocs = [];
-    for (let i = 0; i < source.length;) {
-        const ch = source[i];
-        if (ch === "\\" && source[i + 1] === "\n") {
-            i += 2;
-            continue;
-        }
-        if (ch === "\n") {
-            out.push({ value: ";", quoted: false, operator: true });
-            i++;
-            for (const doc of heredocs.splice(0)) {
-                while (i < source.length) {
-                    const end = source.indexOf("\n", i);
-                    const stop = end === -1 ? source.length : end;
-                    const line = source.slice(i, stop);
-                    i = end === -1 ? source.length : end + 1;
-                    if ((doc.tabs ? line.replace(/^\t+/, "") : line) === doc.end)
-                        break;
-                }
-            }
-            continue;
-        }
-        if (/\s/.test(ch)) {
-            i++;
-            continue;
-        }
-        if (ch === "#") {
-            const end = source.indexOf("\n", i);
-            i = end === -1 ? source.length : end;
-            continue;
-        }
-        if (";|&(){}<>".includes(ch)) {
-            const op = source.slice(i).match(/^(?:<<-?|>>|&&|\|\||[;|&(){}<>])/)[0];
-            out.push({ value: op, quoted: false, operator: true });
-            i += op.length;
-            continue;
-        }
-        let value = "";
-        let quoted = false;
-        while (i < source.length && !/[\s;|&(){}<>]/.test(source[i])) {
-            const next = source[i++];
-            if (next === "'" || next === '"' || next === "`") {
-                quoted = true;
-                while (i < source.length && source[i] !== next) {
-                    if (source[i] === "\\" && next !== "'" && i + 1 < source.length)
-                        i++;
-                    value += source[i++];
-                }
-                if (source[i] === next)
-                    i++;
-            }
-            else if (next === "\\" && i < source.length) {
-                const escaped = source[i++];
-                if (escaped !== "\n")
-                    value += escaped;
-            }
-            else {
-                value += next;
-            }
-        }
-        const previous = out.at(-1)?.value;
-        if (previous === "<<" || previous === "<<-") {
-            heredocs.push({ end: value, tabs: previous === "<<-" });
-        }
-        out.push({ value, quoted });
-    }
-    return out;
-}
-function basename(value) {
-    return value.split(/[\\/]/).at(-1) ?? value;
-}
 function isWaiter(source, depth = 0) {
     if (depth > 8)
         return false;
@@ -151,23 +78,6 @@ function isWaiter(source, depth = 0) {
         commands.every((name) => harmless.has(name)));
 }
 export function shellWaiterReason(toolName, toolInput) {
-    if (typeof toolName !== "string")
-        return null;
-    const name = toolName.toLowerCase().replace(/^functions\./, "");
-    if (!["bash", "shell", "shell_command", "exec_command"].includes(name))
-        return null;
-    let input = toolInput;
-    if (typeof input === "string") {
-        try {
-            input = JSON.parse(input);
-        }
-        catch {
-            return null;
-        }
-    }
-    if (!input || typeof input !== "object")
-        return null;
-    const args = input;
-    const command = args.command ?? args.cmd;
-    return typeof command === "string" && isWaiter(command) ? REASON : null;
+    const command = shellCommandFromTool(toolName, toolInput);
+    return command !== null && isWaiter(command) ? REASON : null;
 }

package/dist/core/semantic/contract.d.ts

@@ -152,7 +152,7 @@ export declare const SemanticUsageReceiptV1Schema: import("@sinclair/typebox").T
     scope: import("@sinclair/typebox").TLiteral<"unreported">;
 }>]>;
 export declare const SemanticEvidenceObservationV1Schema: import("@sinclair/typebox").TObject<{
-    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"error" | "recovery" | "artifact" | "operation" | "action" | "terminal" | "progress" | "task" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
+    kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"recovery" | "artifact" | "error" | "operation" | "action" | "terminal" | "task" | "progress" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
     event_id: import("@sinclair/typebox").TString;
     observed_at: import("@sinclair/typebox").TString;
     label: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -193,7 +193,7 @@ export declare const SemanticEvidenceV1Schema: import("@sinclair/typebox").TObje
         started_at: import("@sinclair/typebox").TString;
     }>>;
     recent: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
-        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"error" | "recovery" | "artifact" | "operation" | "action" | "terminal" | "progress" | "task" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
+        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"recovery" | "artifact" | "error" | "operation" | "action" | "terminal" | "task" | "progress" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
         event_id: import("@sinclair/typebox").TString;
         observed_at: import("@sinclair/typebox").TString;
         label: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -201,7 +201,7 @@ export declare const SemanticEvidenceV1Schema: import("@sinclair/typebox").TObje
         error_class: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
     attention: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
-        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"error" | "recovery" | "artifact" | "operation" | "action" | "terminal" | "progress" | "task" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
+        kind: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"recovery" | "artifact" | "error" | "operation" | "action" | "terminal" | "task" | "progress" | "intent" | "wait" | "lifecycle" | "claim-conflict">[]>;
         event_id: import("@sinclair/typebox").TString;
         observed_at: import("@sinclair/typebox").TString;
         label: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -628,7 +628,7 @@ export declare const SemanticInvalidReadModelV2Schema: import("@sinclair/typebox
     }>;
     receipt: import("@sinclair/typebox").TObject<{
         reason_code: import("@sinclair/typebox").TLiteral<"invalid_output">;
-        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "schema" | "privacy" | "confidence" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
+        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "confidence" | "schema" | "privacy" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
         usage: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
             schema_version: import("@sinclair/typebox").TLiteral<1>;
             source: import("@sinclair/typebox").TLiteral<"native">;
@@ -954,7 +954,7 @@ export declare const SemanticAgentReadModelV2Schema: import("@sinclair/typebox")
     }>;
     receipt: import("@sinclair/typebox").TObject<{
         reason_code: import("@sinclair/typebox").TLiteral<"invalid_output">;
-        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "schema" | "privacy" | "confidence" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
+        validation_issue_codes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"unknown" | "confidence" | "schema" | "privacy" | "identity" | "basis" | "citation" | "unsupported_claim">[]>>;
         usage: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
             schema_version: import("@sinclair/typebox").TLiteral<1>;
             source: import("@sinclair/typebox").TLiteral<"native">;