one-code-extension 0.3.1 → 0.4.0

package/docs/guide/windows.md

@@ -0,0 +1,184 @@
+# Windows
+
+[← One Code user guide](README.md)
+
+One Code on native Windows works the way Claude Code does today: Git for
+Windows is optional, PowerShell is the primary shell tool when it is
+enabled, and the Windows-specific pieces of your Claude Code configuration
+keep working. This page says what that means in practice and what has and
+hasn't been verified.
+
+## Install
+
+```powershell
+powershell -c "irm https://raw.githubusercontent.com/IsuruMaduranga/one-code/master/install.ps1 | iex"
+```
+
+This fetches Node.js when the machine has none and installs the app; with
+Node.js 22.19 or later already present, `npm install -g @one-ai/one-code`
+does the same. Details, and the script's knobs, are in
+[Install on Windows](installation.md#install-on-windows). Git for Windows is
+optional; the section below says what it adds.
+
+## Two shell tools
+
+| Tool | When it is active | What runs it |
+|---|---|---|
+| `powershell` | On by default on Windows. Off elsewhere unless `CLAUDE_CODE_USE_POWERSHELL_TOOL=1`. | `pwsh.exe`, else `powershell.exe`, from your PATH. On macOS and Linux, a `pwsh` on PATH. |
+| `bash` | Whenever a bash exists. | Git Bash (`Program Files\Git\bin\bash.exe`, then `bash.exe` on PATH), or the bash named by `CLAUDE_CODE_GIT_BASH_PATH`. |
+
+When both are active, PowerShell is the primary shell: the system prompt says
+so and the model reaches for it first, with bash alongside for POSIX scripts.
+`CLAUDE_CODE_USE_POWERSHELL_TOOL=0` turns the PowerShell tool off and makes
+bash primary again, which is the shape Claude Code had before 2.1.126.
+
+A Windows machine with neither Git for Windows nor PowerShell has no shell
+tool. One Code says so at startup, in Claude Code's words, and the fix is to
+install one of them.
+
+`CLAUDE_CODE_GIT_BASH_PATH` is read from your environment or from the `env`
+block of `~/.claude/settings.json`. A value that isn't a `bash` or `sh`
+binary is ignored with a warning, as Claude Code does since 2.1.219.
+
+## The PowerShell tool
+
+The tool the model sees is Claude Code's PowerShell tool: same parameters
+(`command`, `timeout` in milliseconds, `description`, `run_in_background`)
+and Claude Code's own description text, including the edition section. One
+Code picks that section from the executable it found: PowerShell 7 guidance
+for `pwsh`, Windows PowerShell 5.1 guidance for `powershell.exe`. Under the
+hood it is pi's `powershell` tool, run with `-NoProfile -NonInteractive
+-ExecutionPolicy Bypass -Command`, output forced to UTF-8.
+
+`run_in_background` works like bash's: a task id comes back at once, output
+spools to the session directory, completion arrives as a notification, and
+the shell shows up in the panel below the editor. A foreground command that
+starts with `Start-Sleep` is refused with a pointer to background runs and
+the monitor tool, and `Read-Host`, `Get-Credential`, `Out-GridView`, `pause`
+and interactive git are refused because the shell has no console to prompt
+on.
+
+Inside a worktree session, every PowerShell command is prefixed with a
+`Set-Location` into the worktree, the way bash commands get a `cd`.
+
+## Permission rules
+
+`PowerShell(...)` rules use the same shape as `Bash(...)` rules and follow
+Claude Code's PowerShell matching:
+
+- Aliases are canonicalized on both sides, so `PowerShell(Remove-Item:*)`
+  catches `rm -Recurse build`, `del x`, and `ri y`, and
+  `PowerShell(Get-ChildItem:*)` allows `ls` and `dir`. Cmdlet names are
+  case-insensitive.
+- A command line is split on `|`, `;`, `&&`, `||`, and newlines, outside
+  quotes and here-strings. An `allow` rule has to cover every statement; a
+  `deny` or `ask` rule fires on any statement, including inside a nested
+  `pwsh -Command '…'`.
+- A line with a `$(…)` subexpression, a backtick escape, a script block, the
+  `&` or `.` call operators, `Invoke-Expression`, or an encoded command is
+  never covered by a wildcard or prefix allow rule. An exact rule for the
+  literal line still is.
+- Unbalanced quoting is a parse failure: no allow rule applies and you are
+  asked.
+
+Blanket rules (`PowerShell`, `PowerShell(*)`, `PowerShell(iex *)`,
+`PowerShell(Start-Process *)`) are suspended in auto mode like their bash
+counterparts. Hook matchers accept `PowerShell`, `Bash|PowerShell`, and
+`Bash,PowerShell`.
+
+## Auto mode and plan mode
+
+Claude Code's read-only cmdlets run without a prompt or a classifier call:
+`Get-ChildItem`, `Get-Content`, `Get-Item`, `Test-Path`, `Resolve-Path`,
+`Select-String`, `Get-Location`, `Get-Process`, `Get-Service`,
+`Get-FileHash`, `Get-Acl`, `Format-Hex`, `findstr`, `where.exe`, plus
+`Write-Output` and `Write-Host`. One Code adds the pure pipeline cmdlets
+those are usually piped through, `Select-Object`, `Sort-Object`,
+`Measure-Object`, `Group-Object`, `ConvertFrom-Json`, `Out-String` and the
+`Format-*` family, so `Select-String … | Measure-Object` counts as read-only
+too; `Where-Object` and `ForEach-Object` do not, because they take script
+blocks. The check is textual and strict: no
+redirection, no variables, no script blocks, and every path inside the
+project or one of the harness's own session directories (auto-memory, the
+scratchpad, persisted tool output, this project's transcripts). A relative
+path is inside by construction; an absolute or drive-lettered path is
+resolved and checked, so `Select-String -Path C:\src\app\notes.md` runs
+unprompted while `Get-Content C:\Users\you\.ssh\id_rsa` does not. A UNC
+path, `~`, a registry or environment drive, or `..` always takes the
+ordinary route.
+
+Everything else goes to the auto-mode classifier. One Code has no PowerShell
+command parser yet, so unlike bash there is no deterministic shortcut for
+in-project deletes: a `Remove-Item` inside the repository is classified, not
+auto-approved. The safety floor still applies. Any PowerShell line that
+names a permission settings file (`.claude/settings.json`,
+`~/.onecode/settings.json`, `.claude.json`, managed settings) stops for you,
+whether it reads or writes.
+
+Plan mode allows the read-only cmdlets above and refuses the rest, as it
+does for bash.
+
+## Hooks
+
+Hooks run in bash where one exists and in PowerShell on a Windows machine
+without Git for Windows. A hook can pick its interpreter with Claude Code's
+`shell` field: `"shell": "powershell"` or `"shell": "bash"`. Timeouts kill
+the whole process tree through `taskkill /T` on Windows. See
+[Hooks](hooks.md#which-shell-runs-a-hook).
+
+## Keys
+
+pi binds a few of its own shortcuts differently on Windows and WSL, where
+alt+enter and ctrl+shift+letter do not reach the terminal reliably: queue a
+follow-up is ctrl+q instead of alt+enter, fork is ctrl+f, paste is alt+v,
+model selection is alt+p. Because ctrl+q is taken there, One Code cycles
+permission modes with **alt+m** on Windows and WSL (ctrl+q everywhere
+else). The footer badge, the startup hints, and `/doctor` name the key that
+applies on your machine. Everything else in the [terminal reference](reference.md)
+is the same.
+
+## Paths and state
+
+- One Code's state lives in `%USERPROFILE%\.onecode`; Claude Code's
+  configuration is read from `%USERPROFILE%\.claude` (or
+  `CLAUDE_CONFIG_DIR`).
+- The scratchpad directory is under `%TEMP%`.
+- The `Shell:` line in the system prompt is the basename of `SHELL`, else
+  `COMSPEC`, with `.exe` stripped, the value Claude Code prints.
+- Language servers installed with npm are `.cmd` shims on Windows
+  (`typescript-language-server.cmd`). One Code finds them on `PATH` and
+  starts them through `cmd.exe`, so a plugin's `.lsp.json` can name the
+  command the way it does elsewhere.
+- Auto mode's shell pre-gate and the worktree guards understand Git Bash's
+  path spellings inside a command line: `/c/Users/…` is `C:\Users\…`, and
+  `/tmp/…` is your temp directory, which Git for Windows mounts there. A
+  path rule with a wildcard is spelled with forward slashes
+  (`Read(C:/notes/**)` or `Read(//c/notes/**)`), because a backslash before
+  `*` is the escape character.
+
+## What is verified
+
+- The unit suite, including live PowerShell runs, passes on the
+  `windows-latest`, `macos-latest`, and `ubuntu-latest` GitHub runners.
+- A real model drives both shell tools on the `windows-latest` runner: the
+  bash tool under Git Bash and the PowerShell tool under PowerShell 7, each
+  running a command whose output has to come back in the tool result. This
+  runs as its own workflow whenever the shell-facing code changes.
+- Drive-letter, backslash, `C:/` and `~` paths in `Read(...)`/`Edit(...)`
+  rules, Windows PowerShell 5.1 (edition text, UTF-8 output, no `&&`),
+  stopping background PowerShell commands and timed-out hooks, and
+  npm-installed language servers all have Windows-only unit tests that run
+  on that runner.
+- The PowerShell tool has also been driven through a real model with a
+  `pwsh` on macOS, the same way Claude Code's own PowerShell tool was
+  captured for reference.
+- An interactive session on a Windows desktop (Windows Terminal, permission
+  prompts, plan mode) has not been checked by hand yet. If you hit something
+  there, [Troubleshooting](troubleshooting.md) says what to collect.
+
+## Not provided
+
+- No PowerShell command parser or pre-gate beyond the read-only list.
+- No sandbox on Windows. Claude Code has none there either.
+- `defaultShell` for the user's own `!` prefix is pi's to handle; One Code
+  does not read it.

package/extensions/auto-mode/actions.ts

@@ -17,6 +17,8 @@
  * path auto mode exists to close.
  */
 
+import type { HandBackVerdict } from "../lib/notifications.ts";
+
 export const SUBAGENT_ACTIONS_CHANNEL = "one-code:subagent-actions";
 
 export interface ChildAction {
@@ -45,7 +47,7 @@ export interface SubagentActionsPayload {
 	 * synchronously when no review will run, so the emitter never waits for
 	 * nothing.
 	 */
-	onReview?: (flag: string | undefined) => void;
+	onReview?: (verdict: HandBackVerdict | undefined) => void;
 }
 
 /** Per-action and total caps: a long-running child must not blow up the prompt. */

package/extensions/auto-mode/paths.ts

@@ -15,9 +15,9 @@
  *    and every caller treats that as "not provably contained".
  */
 
-import { lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { lstatSync, readlinkSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { expandTilde } from "../lib/paths.ts";
+import { comparablePath, expandTilde, gitBashPathToNative, isPathAtOrUnder, tryRealpath } from "../lib/paths.ts";
 
 /**
  * Tools whose calls write to a path. Lives here — the lowest shared layer both
@@ -41,23 +41,8 @@ export function pathArgument(input: Record<string, unknown> | undefined): string
 	return typeof path === "string" ? path : undefined;
 }
 
-/** Case-folded on darwin/win32, where the filesystem is case-insensitive. */
-function normalize(target: string): string {
-	const normalized = resolve(target).replace(/\\/g, "/").replace(/\/+$/, "");
-	return process.platform === "linux" ? normalized : normalized.toLowerCase();
-}
-
-function tryRealpath(target: string): string | undefined {
-	try {
-		return realpathSync.native(target);
-	} catch {
-		try {
-			return realpathSync(target);
-		} catch {
-			return undefined;
-		}
-	}
-}
+/** The shared comparison form (lib/paths.ts): `/` separators, case-folded on darwin/win32. */
+const normalize = comparablePath;
 
 /**
  * Resolve a path for containment checks, following a symlink leaf that does not
@@ -99,11 +84,9 @@ export function resolveForContainment(target: string): string | undefined {
 	}
 }
 
-/** True only when `target` is provably at or under `base`. */
+/** True only when `target` is provably at or under `base` (lib/paths.ts `isPathAtOrUnder`, argument order kept for the callers here). */
 export function isWithin(base: string, target: string): boolean {
-	const normalizedBase = normalize(base);
-	const normalizedTarget = normalize(target);
-	return normalizedTarget === normalizedBase || normalizedTarget.startsWith(`${normalizedBase}/`);
+	return isPathAtOrUnder(target, base);
 }
 
 /**
@@ -119,3 +102,18 @@ export function toAbsolute(cwd: string, token: string, home: string): string {
 	if (isAbsolute(token)) return resolve(token);
 	return resolve(cwd, token);
 }
+
+/**
+ * {@link toAbsolute} for a token taken from a bash command line. On Windows the
+ * bash tool runs Git Bash, whose absolute paths are MSYS spellings — `/c/proj/f`
+ * is `C:\proj\f`, `/tmp/f` sits under the user's temp dir — so the token is
+ * converted first (lib/paths.ts gitBashPathToNative). `path.resolve` alone reads
+ * `/c/proj/f` as `<cwd drive>:\c\proj\f`, which no gate recognises as the
+ * project: the error fell towards escalate/prompt, never towards allow, but every
+ * in-project write spelled that way went to the classifier. File-tool paths keep
+ * `toAbsolute`: pi's read/edit/write resolve them natively, and a gate must
+ * judge the path the tool acts on, not the one Git Bash would reach.
+ */
+export function toAbsoluteBash(cwd: string, token: string, home: string): string {
+	return toAbsolute(cwd, gitBashPathToNative(token), home);
+}

package/extensions/auto-mode/safety-floor.ts

@@ -25,14 +25,11 @@
 import { analyzeShellCommand } from "./shell-analysis.ts";
 import { autoModeSettingsPaths } from "./config.ts";
 import { oneCodeProjectSettingsPath } from "../lib/one-code-settings.ts";
-import { claudeJsonPath } from "../lib/paths.ts";
+import { claudeJsonPath, comparablePath } from "../lib/paths.ts";
 import { isWritingTool, resolveForContainment, toAbsolute } from "./paths.ts";
 
-/** Case-fold the same way resolveForContainment's output is folded. */
-function fold(path: string): string {
-	const forward = path.replace(/\\/g, "/");
-	return process.platform === "linux" ? forward : forward.toLowerCase();
-}
+/** The same comparison form resolveForContainment's output is in (lib/paths.ts). */
+const fold = comparablePath;
 
 /**
  * Any `.claude/settings.json` or `.claude/settings.local.json`, wherever it
@@ -127,5 +124,46 @@ export function safetyControlWrite({ toolName, input, cwd, home, oneCodeProjectS
 		}
 	}
 
+	if (toolName === "powershell") {
+		// No PowerShell write model yet, so the floor is textual and wider than
+		// bash's: ANY mention of a gate-control file in the command line stops it,
+		// whether the cmdlet reads or writes. A `Get-Content` of settings.json
+		// costs one prompt; a `Set-Content` that slipped through would cost the
+		// gate (the floor may only ever say "stop" — header).
+		const command = typeof input.command === "string" ? input.command : "";
+		if (!command) return undefined;
+		for (const token of powershellPathTokens(command, home)) {
+			const absolute = toAbsolute(cwd, token, home);
+			if (isSafetyControlTarget(resolveForContainment(absolute) ?? absolute, home, perRepoSettings)) return REASON(token);
+		}
+	}
+
 	return undefined;
 }
+
+/**
+ * Path-looking tokens of a PowerShell line, quotes stripped, `$env:USERPROFILE`,
+ * `$env:HOME`, `$HOME` and `~` expanded to the home dir, backslashes
+ * forward-slashed. Anything with a separator or a `.json`-style file name
+ * counts; the floor tolerates false positives.
+ */
+export function powershellPathTokens(command: string, home: string): string[] {
+	const out: string[] = [];
+	for (const raw of command.split(/[\s;|()]+/)) {
+		let token = raw.replace(/^["']+|["',]+$/g, "");
+		if (!token) continue;
+		token = token
+			.replace(/^\$env:(USERPROFILE|HOME)/i, home)
+			.replace(/^\$HOME\b/i, home)
+			.replace(/^~(?=[\\/]|$)/, home)
+			.replace(/\\/g, "/");
+		// Parameter names (`-Path`) are not paths; `-Path:value` carries one.
+		if (token.startsWith("-")) {
+			const colon = token.indexOf(":");
+			if (colon === -1) continue;
+			token = token.slice(colon + 1);
+		}
+		if (/[\\/]/.test(token) || /\.json$/i.test(token)) out.push(token);
+	}
+	return out;
+}

package/extensions/auto-mode/shell-analysis.ts

@@ -32,7 +32,7 @@
 
 import { isProtectedPath } from "../permissions/protected-paths.ts";
 import { isExecutionPrimitivePath, isSensitivePath } from "./sensitive.ts";
-import { isWithin, resolveForContainment, toAbsolute } from "./paths.ts";
+import { isWithin, resolveForContainment, toAbsoluteBash } from "./paths.ts";
 
 export type ShellVerdict = "safe" | "escalate";
 
@@ -43,7 +43,13 @@ export interface ShellEvidence {
 	/** The commands that actually run, wrappers peeled (`env rm` → `rm`). */
 	commands: string[];
 	/** Resolved paths this command may write, with containment already decided. */
-	writes: { token: string; resolved?: string; outsideCwd: boolean }[];
+	/**
+	 * Every write target: the token as written, its absolute form as the shell
+	 * reaches it (`toAbsoluteBash`: Git Bash spellings converted, `~` and cwd
+	 * applied, not yet realpath'd — the form a "write it here instead" message
+	 * keeps the model's spelling from), the realpath'd form, and the verdict.
+	 */
+	writes: { token: string; absolute: string; resolved?: string; outsideCwd: boolean }[];
 	/** Credential/secret paths named anywhere in the command (original tokens, never expanded). */
 	sensitivePaths: string[];
 	/** In-project paths whose contents execute later (`.git/hooks/*`, `.vscode/*.json`). */
@@ -722,12 +728,21 @@ export interface AnalyzeInput {
 	 * A redirect landing inside one escalates like a write to `.git/hooks`.
 	 */
 	protectedDirs?: string[];
+	/**
+	 * REALPATH-resolved directories a read-only command may read from besides
+	 * the working directory without escalating: the harness's own session dirs
+	 * (memory, scratchpad, persisted results, this project's transcripts —
+	 * permissions/matcher.ts `DecideInput.sessionDirPath`), resolved once per
+	 * session by the caller (compared against realpaths here, unresolved). Reads
+	 * only; the write and delete checks never consult this list.
+	 */
+	readableRoots?: string[];
 }
 
 /**
  * Classify a shell command. Never denies — see the module contract above.
  */
-export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }: AnalyzeInput): ShellEvidence {
+export function analyzeShellCommand({ command, cwd, home, protectedDirs = [], readableRoots = [] }: AnalyzeInput): ShellEvidence {
 	const evidence: ShellEvidence = {
 		verdict: "safe",
 		notes: [],
@@ -790,10 +805,10 @@ export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }:
 	 */
 	const checkWriteTarget = (token: string) => {
 		if (token === "/dev/null") return;
-		const absolute = toAbsolute(effectiveCwd, token, home);
+		const absolute = toAbsoluteBash(effectiveCwd, token, home);
 		const resolved = resolveForContainment(absolute);
 		const outsideCwd = resolved === undefined || !isWithin(containmentRoot, resolved);
-		evidence.writes.push({ token, resolved, outsideCwd });
+		evidence.writes.push({ token, absolute, resolved, outsideCwd });
 		if (resolved === undefined) {
 			escalate(`writes to ${token}, which could not be resolved to a real path`);
 		} else if (outsideCwd) {
@@ -863,7 +878,7 @@ export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }:
 		// `~/.kube/config` through two tokens that each look harmless (N12).
 		for (const { value } of args) {
 			if (!value || value.startsWith("-")) continue;
-			const absolute = toAbsolute(effectiveCwd, value, home);
+			const absolute = toAbsoluteBash(effectiveCwd, value, home);
 			if (isSensitivePath(value) || isSensitivePath(absolute)) {
 				// The *original* token, never the resolved/expanded form (N18).
 				if (!evidence.sensitivePaths.includes(value)) evidence.sensitivePaths.push(value);
@@ -878,7 +893,7 @@ export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }:
 		if (name === "cd") {
 			const target = args.find((token) => !token.value.startsWith("-"))?.value;
 			if (target) {
-				effectiveCwd = toAbsolute(effectiveCwd, target, home);
+				effectiveCwd = toAbsoluteBash(effectiveCwd, target, home);
 				escalate(`changes directory to ${target}, so later paths in this command resolve elsewhere`);
 			}
 			continue;
@@ -902,7 +917,7 @@ export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }:
 				continue;
 			}
 			const reason = gitEscalationReason(args, (dir) => {
-				const resolved = resolveForContainment(toAbsolute(effectiveCwd, dir, home));
+				const resolved = resolveForContainment(toAbsoluteBash(effectiveCwd, dir, home));
 				return resolved === undefined || !isWithin(containmentRoot, resolved);
 			});
 			if (reason) escalate(reason);
@@ -946,8 +961,8 @@ export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }:
 			}
 			for (const value of positionals) {
 				if (!looksLikePath(value)) continue;
-				const resolved = resolveForContainment(toAbsolute(effectiveCwd, value, home));
-				if (resolved !== undefined && isWithin(containmentRoot, resolved)) continue;
+				const resolved = resolveForContainment(toAbsoluteBash(effectiveCwd, value, home));
+				if (resolved !== undefined && (isWithin(containmentRoot, resolved) || readableRoots.some((root) => isWithin(root, resolved)))) continue;
 				if (!evidence.outsideReads.includes(value)) evidence.outsideReads.push(value);
 				escalate(`reads ${value}, which is outside the working directory`, { outsideRead: true });
 			}

package/extensions/auto-mode/transcript.ts

@@ -16,6 +16,8 @@
 // the hooks matcher (its `ccToolName` is the correct-direction, mcp-passthrough
 // map; permissions/matcher.ts's is lower-cased and cannot recover casing).
 import { ccToolName } from "../hooks/matcher.ts";
+// The shell tools render as `{"<Tool>":"<command>"}` (lib/shell-tools.ts is the one list).
+import { SHELL_TOOLS } from "../lib/shell-tools.ts";
 
 export { ccToolName };
 
@@ -30,7 +32,13 @@ export { ccToolName };
 export type TranscriptEntry =
 	| { kind: "user"; text: string }
 	| { kind: "tool"; tool: string; input: Record<string, unknown> }
-	| { kind: "denied"; tool: string; subject: string; rule: string };
+	| { kind: "denied"; tool: string; subject: string; rule: string }
+	/**
+	 * Harness ground truth, Claude Code's `{"meta":{"gitStatus":{"clean":…}}}`
+	 * line after a `git status` call (captured 2.1.276, findings §22): the
+	 * classifier reads the tree's real state, not the model's account of it.
+	 */
+	| { kind: "meta"; gitStatus: { clean: boolean } };
 
 /** Truncate one field so a single huge argument cannot dominate the transcript. */
 export function clip(value: string, max: number): string {
@@ -47,12 +55,14 @@ function clipInput(input: Record<string, unknown>, max: number): Record<string,
 }
 
 /**
- * Render one entry as its compact JSON line. Bash renders as `{"Bash":"<command>"}`
- * (the command string, as Claude Code does); every other tool renders as
- * `{"<Tool>":{…input…}}` with string fields clipped.
+ * Render one entry as its compact JSON line. The shell tools render as
+ * `{"Bash":"<command>"}` / `{"PowerShell":"<command>"}` (the command string,
+ * as Claude Code does); every other tool renders as `{"<Tool>":{…input…}}`
+ * with string fields clipped.
  */
 function renderEntry(entry: TranscriptEntry, maxField: number): string {
 	if (entry.kind === "user") return JSON.stringify({ user: clip(entry.text, maxField) });
+	if (entry.kind === "meta") return JSON.stringify({ meta: { gitStatus: { clean: entry.gitStatus.clean } } });
 	if (entry.kind === "denied") {
 		return JSON.stringify({
 			denied_by_permission_rule: { tool: ccToolName(entry.tool), attempted: clip(entry.subject, maxField), rule: entry.rule },
@@ -60,7 +70,7 @@ function renderEntry(entry: TranscriptEntry, maxField: number): string {
 	}
 	const name = ccToolName(entry.tool);
 	const command = entry.input.command;
-	if (entry.tool === "bash" && typeof command === "string") {
+	if (SHELL_TOOLS.has(entry.tool) && typeof command === "string") {
 		return JSON.stringify({ [name]: clip(command, maxField) });
 	}
 	return JSON.stringify({ [name]: clipInput(entry.input, maxField) });