harnery 0.45.1 → 0.46.0

package/dist/core/hooks/adapter/native-parent.d.ts

@@ -0,0 +1,23 @@
+export type NativeParentObservation = {
+    state: "observed";
+    parent_session_id: string;
+    source_witness: string;
+} | {
+    state: "none";
+    reason: string;
+    source_witness: string;
+} | {
+    state: "unknown";
+    reason: string;
+};
+export interface NativeParentRequest {
+    adapter: string;
+    native_session_id?: string;
+    transcript_path?: string;
+}
+export interface NativeParentReaderOptions {
+    discoverTranscript?: (sessionId: string, transcriptPath?: string) => string | undefined;
+}
+/** Native relationship evidence only; no prompt bodies, state writes or recipient authority. */
+export declare function readNativeParentReference(request: NativeParentRequest, options?: NativeParentReaderOptions): NativeParentObservation;
+//# sourceMappingURL=native-parent.d.ts.map

package/dist/core/hooks/adapter/native-parent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-parent.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/adapter/native-parent.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,uBAAuB,GAC/B;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACzF;AAYD,gGAAgG;AAChG,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,yBAA8B,GACtC,uBAAuB,CAuDzB"}

package/dist/core/hooks/adapter/native-parent.js

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { discoverCodexSessionTranscript } from "./runtime-telemetry.js";
+const HEADER_LIMIT = 1024 * 1024;
+const NATIVE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ORDINARY_SOURCES = new Set(["cli", "exec", "vscode", "app-server"]);
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Native relationship evidence only; no prompt bodies, state writes or recipient authority. */
+export function readNativeParentReference(request, options = {}) {
+    if (request.adapter !== "codex")
+        return unknown("native_parent_adapter_unsupported");
+    const child = request.native_session_id;
+    if (!child || !NATIVE_ID.test(child))
+        return unknown("native_child_identity_unavailable");
+    let fd;
+    try {
+        const path = (options.discoverTranscript ?? discoverCodexSessionTranscript)(child, request.transcript_path);
+        if (!path)
+            return unknown("native_parent_transcript_unavailable");
+        const entry = lstatSync(path);
+        if (!entry.isFile() || entry.isSymbolicLink())
+            return unknown("native_parent_not_regular");
+        fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const before = fstatSync(fd);
+        if (!before.isFile() || before.dev !== entry.dev || before.ino !== entry.ino) {
+            return unknown("native_parent_file_changed");
+        }
+        const header = readHeader(fd);
+        if (!header)
+            return unknown("native_parent_header_incomplete");
+        // Appending later rows is normal. The same header must remain unchanged.
+        const checked = readHeader(fd);
+        const after = lstatSync(path);
+        if (!checked?.equals(header) ||
+            !after.isFile() ||
+            after.isSymbolicLink() ||
+            before.dev !== after.dev ||
+            before.ino !== after.ino) {
+            return unknown("native_parent_file_changed");
+        }
+        const row = object(JSON.parse(header.toString("utf8")));
+        const payload = object(row?.payload);
+        if (row?.type !== "session_meta" || payload?.id !== child) {
+            return unknown("native_parent_child_mismatch");
+        }
+        const source_witness = createHash("sha256").update(header).digest("hex");
+        if (typeof payload.source === "string" && ORDINARY_SOURCES.has(payload.source)) {
+            return { state: "none", reason: "native_ordinary_session", source_witness };
+        }
+        const source = object(payload.source);
+        const spawn = object(object(source?.subagent)?.thread_spawn);
+        const parent = spawn?.parent_thread_id;
+        if (typeof parent !== "string" || !NATIVE_ID.test(parent)) {
+            return unknown("native_parent_not_reported");
+        }
+        if (parent.toLowerCase() === child.toLowerCase())
+            return unknown("native_parent_self_reference");
+        return { state: "observed", parent_session_id: parent, source_witness };
+    }
+    catch {
+        return unknown("native_parent_metadata_unreadable");
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function readHeader(fd) {
+    const chunks = [];
+    let offset = 0;
+    while (offset < HEADER_LIMIT) {
+        const buffer = Buffer.alloc(Math.min(16 * 1024, HEADER_LIMIT - offset));
+        const bytes = readSync(fd, buffer, 0, buffer.length, offset);
+        if (bytes === 0)
+            return undefined;
+        const data = buffer.subarray(0, bytes);
+        const newline = data.indexOf(10);
+        if (newline >= 0)
+            return Buffer.concat([...chunks, data.subarray(0, newline)]);
+        chunks.push(data);
+        offset += bytes;
+    }
+    return undefined;
+}
+function unknown(reason) {
+    return { state: "unknown", reason };
+}

package/dist/core/hooks/cli.js

@@ -32,12 +32,13 @@ import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.
 import { ensureLiveCoordinationHeartbeat } from "../agents/state/live-coordination-writer.js";
 import { assignName, readForkParent, readForkState, recordForkDetection, resolveName, } from "../agents/state/names.js";
 import { writePidmapRow } from "../agents/state/pidmap.js";
-import { agentsRequireGitFinalization, coordFreshnessSeconds, hostPromptContextConfig, resolveBinName, } from "../config.js";
+import { agentsRequireGitFinalization, coordFreshnessSeconds, hostPromptContextConfig, readAdmissionConfig, resolveBinName, } from "../config.js";
 import { checkpointContext, completeContextRecovery, extractContextSample, markContextCompactionCompleted, prepareContextRecovery, readContextState, recordContextSample, } from "../context/index.js";
 import { tryWriteLiveDisplayV3 } from "../events/v3/live-feed.js";
 import { liveHookSignalDefersDrainV3, reconcileLivePendingRuntimeContextV3, recordLiveDelegatedChildSessionV3, recordLiveHookSignalV3, resolveLiveEventLedgerRouteV3, } from "../events/v3/live-routing.js";
 import { captureSpanClockV3 } from "../events/v3/span-state.js";
 import { ensureRelayDaemon, fetchPresence, publishPresence } from "../presence/index.js";
+import { importMail, publishMail } from "../presence/mail.js";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.js";
 import { stableScopeId } from "../workflow/scope-id.js";
 import { adapterBehavior } from "./adapter/behaviors/index.js";
@@ -57,6 +58,7 @@ import { resolveOwner } from "./resolve/owner.js";
 import { inspectSessionNameDisplayImmediately, scanAssistantStatusBoxPresent, scanStatusBoxPresent, scanTranscriptRuntime, } from "./resolve/transcript.js";
 import { clearHookRunMarker, writeHookRunMarker } from "./run-markers.js";
 import { sessionNamePresence } from "./session-name-presence.js";
+import { shellCommitTreeReason } from "./shell-commit-tree.js";
 import { shellRmReason } from "./shell-rm.js";
 import { shellWaiterReason } from "./shell-waiter.js";
 let hookHealthState;
@@ -227,7 +229,18 @@ function healForkLineage(coordRoot, instanceId, payload) {
 function ensureSessionDisplayName(coordRoot, instanceId, sessionId, adapter, payload) {
     if (coordEnv("WORKFLOW_CHILD") === "1")
         return;
-    const row = readLiveCoordinationRow(coordRoot, instanceId) ?? readHeartbeat(coordRoot, instanceId);
+    // This runs on every tool call. The heartbeat cache is the surface this
+    // function stamps, so a cache that already carries a name, or marks a
+    // session that never takes one, means there is nothing to do. Only a cache
+    // that cannot answer pays for the authoritative read, which re-validates the
+    // whole active ledger and cost about half a second per call at 22 MB.
+    const cached = readHeartbeat(coordRoot, instanceId);
+    if (cached?.kind === "subagent" || cached?.kind === "transient" || cached?.workflow_run_id) {
+        return;
+    }
+    if (cached?.name?.trim())
+        return;
+    const row = readLiveCoordinationRow(coordRoot, instanceId) ?? cached;
     if (row?.kind === "subagent" || row?.kind === "transient" || row?.workflow_run_id)
         return;
     if (row?.name?.trim())
@@ -1009,8 +1022,23 @@ function recordContextTelemetry(run) {
         }
     }
 }
+/** Cross-machine peer messages (ADR 0222) ride the presence fetch: import
+ * whatever mail refs are already local. Reads local refs only, at most once
+ * per import interval; never blocks on the network. */
+async function receiveRemoteMail(coordRoot) {
+    const { peerInbox } = await import("../inbox/peer-messages.js");
+    importMail(coordRoot, peerInbox(coordRoot), { throttle: true });
+}
 async function handleSessionStarted(run) {
     const { coordRoot, adapter, payload, owner, sessionId, data } = run;
+    // Import mail from refs fetched earlier, so a message sent from another
+    // machine while this task was away is in the inbox this context renders.
+    try {
+        await receiveRemoteMail(coordRoot);
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "session-start-mail" });
+    }
     // A configured backup runs out of process and is freshness-gated per host.
     // Startup never waits for restic or a remote provider; the child owns no
     // hook stdio, so the harness is not held open until it finishes. A failed
@@ -1124,6 +1152,7 @@ async function handleTurnStarted(run) {
     // interval; the systemMessage below reads whatever is locally known).
     try {
         fetchPresence(coordRoot);
+        await receiveRemoteMail(coordRoot);
     }
     catch (err) {
         logError(coordRoot, err, { phase: "user-prompt-submit-presence" });
@@ -1187,6 +1216,7 @@ async function handleStop(run) {
     // its daemon intentionally exits when a machine has no live sessions.
     try {
         publishPresence(coordRoot);
+        publishMail(coordRoot);
         ensureRelayDaemon(coordRoot);
     }
     catch (err) {
@@ -1310,6 +1340,12 @@ async function handleToolRequested(run) {
         emitDeny(adapter, rmReason);
         return 0;
     }
+    const commitTreeReason = shellCommitTreeReason(payload?.tool_name, payload?.tool_input, resolveBinName(coordRoot));
+    if (commitTreeReason) {
+        const { emitDeny } = await import("./adapter/output.js");
+        emitDeny(adapter, commitTreeReason);
+        return 0;
+    }
     // G-guard for ALL adapters. Claude Code previously ran this via a
     // pre-tool-use bash adapter (which called `agent-coord verdict --rule=claim`);
     // that adapter is now deleted, so agent-hook owns the deny for every adapter.
@@ -1327,8 +1363,38 @@ async function handleToolRequested(run) {
     }
     if (!guardAllowed)
         return 0;
+    // Heavy shell checks queue for a machine-wide admission slot when the
+    // project configures one. Fails open: any error runs the command as written.
+    try {
+        if (await emitAdmissionRewrite(coordRoot, adapter, payload))
+            return 0;
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "pre-tool-use-admission" });
+    }
     return undefined;
 }
+async function emitAdmissionRewrite(coordRoot, adapter, payload) {
+    const resource = readAdmissionConfig(coordRoot)?.guard?.resource;
+    if (!resource)
+        return false;
+    const { admissionHookOutput } = await import("./shell-admission.js");
+    const output = admissionHookOutput({
+        adapter,
+        resource,
+        bin: resolveBinName(coordRoot),
+        projectRoot: coordRoot,
+        toolName: payload?.tool_name,
+        toolInput: payload?.tool_input,
+        cwd: payload?.cwd,
+        skip: coordEnv("ADMISSION_SKIP") === "1" || Boolean(coordEnv("ADMISSION_HELD")),
+        platform: process.platform,
+    });
+    if (!output)
+        return false;
+    process.stdout.write(`${JSON.stringify(output)}\n`);
+    return true;
+}
 async function handlePostToolUse(run) {
     const { coordRoot, adapter, eventName, payload, owner } = run;
     // Inject the full instruction only at the successful tool boundary that
@@ -1348,9 +1414,18 @@ async function handlePostToolUse(run) {
     // retry response already carries the full instruction and an end-turn
     // status is the wrong place to ask.
     try {
-        const row = readLiveCoordinationRow(coordRoot, owner.instance_id);
         // A workflow child has no user-visible title to set.
-        const name = coordEnv("WORKFLOW_CHILD") === "1" ? undefined : sessionNameDisplayPending(row);
+        if (coordEnv("WORKFLOW_CHILD") === "1")
+            return;
+        // The live row copies every name-display field from a current heartbeat
+        // cache and leaves them unset otherwise, so a raw cache with nothing
+        // pending proves the row has nothing pending either. That skips a full
+        // ledger read on almost every tool call; only a pending title pays for
+        // the authoritative check below.
+        if (!sessionNameDisplayPending(readHeartbeat(coordRoot, owner.instance_id)))
+            return;
+        const row = readLiveCoordinationRow(coordRoot, owner.instance_id);
+        const name = sessionNameDisplayPending(row);
         if (name && toolResponseMintedSessionName(payload?.tool_response, name)) {
             // Record the title before asking for it. The suggestion can still
             // change afterwards (an assigned-name rewrite, a lifecycle re-mint, a

package/dist/core/hooks/resolve/owner.d.ts

@@ -30,17 +30,6 @@ export declare function resolveOwner(opts: {
     instance_id: string;
     source: "env" | "payload" | "session_env" | "pidmap-self" | "pidmap-ancestor";
 } | null;
-/**
- * Find the parent owner for a subagent invocation. The per-shell marker at
- * `.harnery/shells/<pid>` is set by `sub-agent-start` and removed by
- * `sub-agent-stop`.
- *
- * Phase 2 stub: the marker file isn't written yet, so we return null in most
- * cases. Phase 2 callers can pass through.
- */
-export declare function readShellMarker(coordRoot: string, pid: number): string | null;
-/** Read the V3-projected `agent_id` for an owner if it exists. */
-export declare function readAgentIdForOwner(coordRoot: string, instanceId: string): string | null;
 /** Diagnostic: list of pid-map entries (for debugging). */
 export declare function listPidmap(coordRoot: string): Array<{
     pid: number;

package/dist/core/hooks/resolve/owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/owner.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,iBAAiB,CAAC;CAC/E,GAAG,IAAI,CAgFP;AA2BD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ7E;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAExF;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnF"}
+{"version":3,"file":"owner.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/owner.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,iBAAiB,CAAC;CAC/E,GAAG,IAAI,CAgFP;AA2BD,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnF"}

package/dist/core/hooks/resolve/owner.js

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { coordEnv } from "../../../lib/env.js";
 import { resolveOwnerBySessionEnv } from "../../agents/coord-client.js";
 import { readLiveCoordinationRow } from "../../agents/state/live-coordination-view.js";
-import { checkPidToken } from "../../agents/state/proc-start.js";
+import { verifyProcessGeneration } from "../../agents/state/proc-start.js";
 /**
  * Resolve the canonical `instance_id` for the current hook invocation.
  *
@@ -91,7 +91,7 @@ export function resolveOwner(opts) {
                     // A row whose start token disagrees with the process now holding this
                     // pid is about a different, earlier process. Believing it hands this
                     // session another agent's identity, so walk past it.
-                    const recycled = checkPidToken(pid, startToken || undefined) === "mismatch";
+                    const recycled = verifyProcessGeneration(pid, startToken) === "different";
                     if (owner && owner.length > 0 && !recycled) {
                         return {
                             instance_id: owner,
@@ -140,29 +140,6 @@ function readPpid(pid) {
     }
     return null;
 }
-/**
- * Find the parent owner for a subagent invocation. The per-shell marker at
- * `.harnery/shells/<pid>` is set by `sub-agent-start` and removed by
- * `sub-agent-stop`.
- *
- * Phase 2 stub: the marker file isn't written yet, so we return null in most
- * cases. Phase 2 callers can pass through.
- */
-export function readShellMarker(coordRoot, pid) {
-    const path = join(coordRoot, ".harnery", "shells", String(pid));
-    if (!existsSync(path))
-        return null;
-    try {
-        return readFileSync(path, "utf8").trim() || null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Read the V3-projected `agent_id` for an owner if it exists. */
-export function readAgentIdForOwner(coordRoot, instanceId) {
-    return readLiveCoordinationRow(coordRoot, instanceId)?.agent_id ?? null;
-}
 /** Diagnostic: list of pid-map entries (for debugging). */
 export function listPidmap(coordRoot) {
     const dir = join(coordRoot, ".harnery", "pid-map");

package/dist/core/hooks/shell-admission.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Admission guard for heavy shell checks. A whole-project typecheck, a full
+ * test suite, or a production build can each take gigabytes of memory, and
+ * several agents starting them at once on one machine can exhaust it. Asking
+ * agents in prose to wrap those commands in `admission run` does not work: the
+ * rule has to be read and remembered on every call. This guard rewrites the
+ * agent's shell command at PreToolUse instead, so each heavy check waits for a
+ * slot on a machine-wide admission resource.
+ *
+ * Enabled only when the project config names a resource
+ * (`admission.guard.resource`). It finds each simple command that is a heavy
+ * check and inserts `<bin> admission run --resource <name> --label 'agent:
+ * ...' --` in front of it, after any leading VAR=value assignments. The rest
+ * of the command (cd, pipes, redirects, && chains) is left byte for byte.
+ * Heavy means:
+ *   - tsc, however launched (tsc, npx/bunx/bun x/pnpm exec/yarn tsc,
+ *     node_modules/.bin/tsc, node .../typescript/bin/tsc)
+ *   - next build
+ *   - bun test with no file or directory named (a full suite)
+ *   - the package scripts test / test:* (with no further positional
+ *     argument), build, typecheck, type-check, typecheck:*, check-types, tsc,
+ *     run through bun run, npm, pnpm, or yarn
+ *   - bash/sh -c '<script>' whose script contains one of the above
+ * Watch modes, --help/--version, and named-file test runs are left alone.
+ *
+ * Passes through untouched: non-shell tools; a command that already runs
+ * `admission run` or `heavy-slot`; HARNERY_ADMISSION_SKIP=1 in the command or
+ * the hook's environment; HARNERY_ADMISSION_HELD in the hook's environment
+ * (the session already holds a slot); text inside quotes, heredocs, and
+ * comments. Any parse failure means no rewrite.
+ */
+export declare const ADMISSION_SKIP_PREFIX = "HARNERY_ADMISSION_SKIP=1";
+/** Claude Code's maximum Bash timeout; a queued wait counts against it. */
+export declare const BASH_TIMEOUT_MAX_MS = 600000;
+/** POSIX single-quote a word when it needs quoting (shlex.quote semantics). */
+export declare function shellQuote(value: string): string;
+/**
+ * Return the command with each heavy simple command wrapped in `wrapper`
+ * (a shell-ready prefix such as `harn admission run --resource build`), or
+ * null when nothing changes.
+ */
+export declare function rewriteHeavyCommand(command: string, wrapper: string): string | null;
+/** Normalized shell-tool name, or null for any other tool. */
+export declare function shellToolName(toolName: unknown): string | null;
+export interface AdmissionRewrite {
+    updatedInput: Record<string, unknown>;
+}
+/**
+ * Rewrite a shell tool's input so its heavy checks queue for admission.
+ * Handles `command` or `cmd` as a string, or as an argv such as
+ * ["bash", "-lc", "<script>"]. Returns null when nothing changes.
+ */
+export declare function admissionRewriteForTool(toolName: unknown, toolInput: unknown, wrapper: string): AdmissionRewrite | null;
+export interface AdmissionHookInput {
+    adapter: string;
+    /** Admission resource the project's guard queues on. */
+    resource: string;
+    /** Host bin name used in the wrapper and the agent-facing note. */
+    bin: string;
+    /**
+     * Project whose admission config `admission run` should read. A nested
+     * checkout with its own `.harnery/` would otherwise shadow the host's
+     * resource settings for a shell started inside it.
+     */
+    projectRoot?: string;
+    toolName: unknown;
+    toolInput: unknown;
+    cwd?: unknown;
+    /** True when HARNERY_ADMISSION_SKIP=1 or HARNERY_ADMISSION_HELD is set for the hook. */
+    skip?: boolean;
+    platform?: string;
+}
+/**
+ * The PreToolUse output that queues a shell command's heavy checks, or null
+ * to let the command run as written. Claude Code applies `updatedInput`
+ * under the session's own permission rules, so no decision is sent, and its
+ * Bash timeout is raised to the maximum because a queued wait counts against
+ * it. Codex applies a rewrite only beside `permissionDecision: "allow"`.
+ * Cursor and OpenCode have no rewrite channel. Windows-native shells (a
+ * drive-letter or UNC workspace) are outside the machine whose queue this
+ * guards.
+ */
+export declare function admissionHookOutput(input: AdmissionHookInput): Record<string, unknown> | null;
+//# sourceMappingURL=shell-admission.d.ts.map

package/dist/core/hooks/shell-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-admission.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAuGH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAChE,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAgV3C,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIhD;AAWD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBnF;AAID,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,GAAG,IAAI,CAmCzB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,wFAAwF;IACxF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA4B7F"}