portable-agent-layer 0.78.2 → 0.79.0

package/src/hooks/lib/auto-update.ts

@@ -1,5 +1,5 @@
 /**
- * The daily self-update: when it may run unattended, and what came of it.
+ * The unattended self-update: when it may run, and what came of it.
  *
  * `pal cli update` still owns the pull and the reinstall — this module only
  * decides whether to start it and records the outcome, so the command shape
@@ -41,7 +41,8 @@ export interface AutoUpdateStatus {
   last: AutoUpdateLedger | null;
 }
 
-const DAY_MS = 24 * 60 * 60 * 1000;
+const HOUR_MS = 60 * 60 * 1000;
+const DAY_MS = 24 * HOUR_MS;
 const RESCUE_AFTER_MS = 3 * DAY_MS;
 const LOCK_STALE_MS = 30 * 60 * 1000;
 const DIRTY_TREE = "uncommitted changes in the PAL repo";
@@ -122,15 +123,24 @@ function recordSkip(reason: string): void {
   logDebug("auto-update", `skipped: ${reason}`);
 }
 
-function attemptedWithin(ledger: AutoUpdateLedger | null, now: number): boolean {
+/**
+ * A clean run — including one that found nothing to install — only waits out the
+ * hour, so a release published after the morning's check still lands today. A
+ * failed or interrupted run waits a day, so a broken update cannot loop.
+ */
+function waitAfter(ledger: AutoUpdateLedger): number {
+  return ledger.ok === true ? HOUR_MS : DAY_MS;
+}
+
+function heldByLastRun(ledger: AutoUpdateLedger | null, now: number): boolean {
   if (!ledger?.attemptedAt) return false;
-  return now - new Date(ledger.attemptedAt).getTime() < DAY_MS;
+  return now - new Date(ledger.attemptedAt).getTime() < waitAfter(ledger);
 }
 
-/** The unattended gate: opted in, not already tried today, and safe to pull. */
+/** The unattended gate: opted in, not held by the last run, and safe to pull. */
 export function shouldAutoUpdate(now: number = Date.now()): boolean {
   if (!isAutoUpdateEnabled()) return false;
-  if (attemptedWithin(readLedger(), now)) return false;
+  if (heldByLastRun(readLedger(), now)) return false;
   if (hasUncommittedChanges()) {
     recordSkip(DIRTY_TREE);
     return false;

package/src/hooks/lib/context.ts

@@ -8,15 +8,17 @@ import { resolve } from "node:path";
 import { loadReflectNudge } from "../handlers/reflect-trigger";
 import { loadAlgorithmReviewNudge } from "./algorithm-review";
 import { loadAnalyzeNudge } from "./analyze-nudge";
-import { readLearnings } from "./learning-store";
+import { resolveAnchor } from "./anchor";
+import { loadHandoffContext } from "./handoff-context";
 import { loadOpinionContext } from "./opinions";
 import { paths, toPath } from "./paths";
 import { loadActiveProjectsContext } from "./projects";
 import { loadRecentNotes } from "./relationship";
 import { loadFailurePatterns } from "./semi-static";
+import { sessionDir } from "./session-dir";
 import * as settings from "./settings";
 import { readFramePrinciples } from "./wisdom";
-import { readProjectHistory } from "./work-tracking";
+import { lastSessionTitle, readProjectHistory } from "./work-tracking";
 
 /** Load and concatenate loadAtStartup files */
 function loadStartupFiles(): string {
@@ -50,29 +52,6 @@ export function loadWisdomContext(): string {
   }
 }
 
-/** Load recent session learning files as digest, with detail for current project */
-export function loadLearningDigest(): string {
-  try {
-    const cwd = process.cwd();
-    const entries = readLearnings(paths.sessionLearning(), 10);
-    if (entries.length === 0) return "";
-
-    // This-project learnings are now in loadProjectHistoryContext(); only show cross-project here
-    const other = entries.filter((e) => e.cwd !== cwd).slice(0, 5);
-
-    if (other.length === 0) return "";
-
-    const lines: string[] = [];
-
-    lines.push("## Other Recent Learnings");
-    for (const e of other) lines.push(`- ${e.title}`);
-
-    return lines.join("\n");
-  } catch {
-    return "";
-  }
-}
-
 /** Load self-model for session context injection */
 function loadSelfModel(): string {
   try {
@@ -105,6 +84,11 @@ function loadProjectHistoryContext(): string {
   }
 }
 
+function stampedPath(stamp: string): string {
+  const resolved = resolveAnchor(stamp);
+  return resolved.state === "unresolvable" ? stamp : resolved.path;
+}
+
 /**
  * Filter raw relationship note lines:
  * - O entries: stripped (loaded natively via digest)
@@ -125,7 +109,7 @@ function filterRelationshipNotes(notes: string, cwd: string): string {
     }
     const cwdMatch = new RegExp(/<!--.*cwd:(\S+)/).exec(line);
     if (cwdMatch) {
-      blockCwd = cwdMatch[1];
+      blockCwd = stampedPath(cwdMatch[1]);
       continue;
     }
     if (/^\s*<!--/.test(line)) continue;
@@ -213,31 +197,6 @@ function loadSessionIntelligence(): string {
   }
 }
 
-/** Load handoff state for the current project */
-function loadHandoff(): string {
-  try {
-    const p = resolve(paths.state(), "last-handoff.json");
-    if (!existsSync(p)) return "";
-    const handoffs = JSON.parse(readFileSync(p, "utf-8"));
-    const cwd = process.cwd();
-    const entry = handoffs[cwd];
-    if (!entry?.handoff || entry.status !== "in-progress") return "";
-
-    const age = Date.now() - new Date(entry.timestamp).getTime();
-    if (age > 7 * 24 * 60 * 60 * 1000) return ""; // stale after 7 days
-
-    return [
-      "## Pick Up Where You Left Off",
-      `*Previous session: ${entry.title}*`,
-      "",
-      entry.handoff,
-      "→ Continue this work or explicitly close it before starting something new.",
-    ].join("\n");
-  } catch {
-    return "";
-  }
-}
-
 /** Truncate text to maxChars at the last complete line boundary */
 function capSection(text: string, maxChars: number): string {
   if (text.length <= maxChars) return text;
@@ -266,7 +225,9 @@ export type AgentTarget = "claude" | "opencode" | "cursor" | "copilot";
  * opts.agent — agent target; Claude Code skips semi-static sections (self-model,
  * wisdom, opinions) that load natively via @imports in CLAUDE.md.
  */
-export function buildSystemReminder(opts: { agent?: AgentTarget } = {}): string {
+export function buildSystemReminder(
+  opts: { agent?: AgentTarget; withoutHandoff?: boolean } = {}
+): string {
   // Semi-static sections loaded natively via @imports (Claude Code) or
   // instructions[] (opencode). Skip them from hook output for those agents.
   const skipSemiStatic =
@@ -281,12 +242,11 @@ export function buildSystemReminder(opts: { agent?: AgentTarget } = {}): string
   const relationship = settings.isEnabled("relationship")
     ? loadRelationshipContext()
     : "";
-  const digest = settings.isEnabled("learningDigest") ? loadLearningDigest() : "";
   const projectHistory = settings.isEnabled("projectHistory")
     ? loadProjectHistoryContext()
     : "";
   const activeProjects = settings.isEnabled("projects")
-    ? loadActiveProjectsContext()
+    ? loadActiveProjectsContext(process.cwd(), lastSessionTitle)
     : "";
   const failures =
     settings.isEnabled("failurePatterns") && !skipSemiStatic ? loadFailurePatterns() : "";
@@ -297,7 +257,10 @@ export function buildSystemReminder(opts: { agent?: AgentTarget } = {}): string
   const intelligence = settings.isEnabled("sessionIntelligence")
     ? loadSessionIntelligence()
     : "";
-  const handoff = settings.isEnabled("handoff") ? loadHandoff() : "";
+  const handoff =
+    !opts.withoutHandoff && settings.isEnabled("handoff")
+      ? loadHandoffContext(sessionDir())
+      : "";
   // Maintainer-only: self-gates to a repo checkout, "" for everyone else.
   const algoReview = loadAlgorithmReviewNudge();
   const reflectNudge = loadReflectNudge();
@@ -315,7 +278,6 @@ export function buildSystemReminder(opts: { agent?: AgentTarget } = {}): string
   if (relationship) parts.push(relationship);
   if (activeProjects) parts.push(activeProjects);
   if (projectHistory) parts.push(projectHistory);
-  if (digest) parts.push(digest);
   if (failures) parts.push(failures);
   if (parts.length === 0) return "";
 

package/src/hooks/lib/graduation.ts

@@ -12,7 +12,7 @@
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { hasApiKey } from "./inference";
+import { canInfer } from "./inference";
 import {
   type FailureEntry,
   type LearningEntry,
@@ -215,7 +215,7 @@ async function generateRecommendations(
   ratings: RatingsSummary | null
 ): Promise<string[]> {
   if (candidates.length === 0 && !ratings) return [];
-  if (!hasApiKey()) {
+  if (!canInfer()) {
     return candidates
       .slice(0, 3)
       .map(

package/src/hooks/lib/handoff-context.ts

@@ -0,0 +1,112 @@
+import { existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { resolve } from "node:path";
+import { paths } from "./paths";
+
+interface HandoffEntry {
+  title?: string;
+  handoff?: string;
+  status?: string;
+  timestamp?: string;
+  lastUser?: string;
+  lastAssistant?: string;
+}
+
+const HANDOFF_STALE_MS = 7 * 24 * 60 * 60 * 1000;
+const ELSEWHERE_MAX_CHARS = 300;
+
+function readHandoffs(): Record<string, HandoffEntry> {
+  const p = resolve(paths.state(), "last-handoff.json");
+  if (!existsSync(p)) return {};
+  try {
+    return JSON.parse(readFileSync(p, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+
+function isFresh(entry: HandoffEntry, now: number): boolean {
+  if (!(entry.handoff || entry.lastUser) || !entry.timestamp) return false;
+  return now - new Date(entry.timestamp).getTime() <= HANDOFF_STALE_MS;
+}
+
+function isScratchDir(dir: string): boolean {
+  return dir.startsWith(tmpdir());
+}
+
+export function trimAtWord(text: string, max: number): string {
+  const flat = text.replace(/\s+/g, " ").trim();
+  if (flat.length <= max) return flat;
+  const cut = flat.slice(0, max);
+  const lastSpace = cut.lastIndexOf(" ");
+  return `${lastSpace > 0 ? cut.slice(0, lastSpace) : cut}…`;
+}
+
+function formatAgo(timestamp: string, now: number): string {
+  const minutes = Math.floor((now - new Date(timestamp).getTime()) / 60_000);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  return `${Math.floor(hours / 24)}d ago`;
+}
+
+function lastExchangeLines(entry: HandoffEntry): string[] {
+  if (!entry.lastUser) return [];
+  const lines = ["Last exchange:", `- User: ${entry.lastUser}`];
+  if (entry.lastAssistant) lines.push(`- You: ${entry.lastAssistant}`);
+  return lines;
+}
+
+/** A finished session is still shown, for follow-ups, just not as open work. */
+function hereSection(entry: HandoffEntry | undefined, now: number): string {
+  if (!entry || !isFresh(entry, now)) return "";
+  const open = entry.status !== "completed";
+  return [
+    "## Pick Up Where You Left Off",
+    `*Previous session: ${entry.title} · ${formatAgo(entry.timestamp ?? "", now)}*`,
+    ...(entry.handoff ? [entry.handoff] : []),
+    ...lastExchangeLines(entry),
+    ...(open
+      ? ["→ Continue this work or explicitly close it before starting something new."]
+      : []),
+  ].join("\n");
+}
+
+function latestElsewhere(
+  handoffs: Record<string, HandoffEntry>,
+  here: string,
+  now: number
+): [string, HandoffEntry] | undefined {
+  return Object.entries(handoffs)
+    .filter(([dir, entry]) => dir !== here && !isScratchDir(dir) && isFresh(entry, now))
+    .sort(([, a], [, b]) => (b.timestamp ?? "").localeCompare(a.timestamp ?? ""))[0];
+}
+
+function elsewhereSection(
+  handoffs: Record<string, HandoffEntry>,
+  here: string,
+  now: number
+): string {
+  const latest = latestElsewhere(handoffs, here, now);
+  if (!latest) return "";
+  const [dir, entry] = latest;
+  const hereEntry = handoffs[here];
+  if (hereEntry?.timestamp && hereEntry.timestamp > (entry.timestamp ?? "")) return "";
+  return [
+    "## Last Conversation Elsewhere",
+    `*${dir} · ${formatAgo(entry.timestamp ?? "", now)} · may be unrelated: ${entry.title}*`,
+    trimAtWord(entry.handoff || `User: ${entry.lastUser}`, ELSEWHERE_MAX_CHARS),
+  ].join("\n");
+}
+
+/**
+ * This folder's handoff comes first and in full, since it is what a session
+ * started here usually continues. The latest conversation from any other
+ * folder follows in brief, only when it is newer than this folder's.
+ */
+export function loadHandoffContext(here: string, now: number = Date.now()): string {
+  const handoffs = readHandoffs();
+  return [hereSection(handoffs[here], now), elsewhereSection(handoffs, here, now)]
+    .filter(Boolean)
+    .join("\n\n");
+}

package/src/hooks/lib/inference.ts

@@ -214,40 +214,32 @@ export async function inference(opts: InferenceOptions): Promise<InferenceResult
 // Per-agent CLI metadata — binary presence + argv builders
 // ─────────────────────────────────────────────────────────────────────────────
 
-let claudeBinaryCache: string | null | undefined;
-let codexBinaryCache: string | null | undefined;
-let opencodeBinaryCache: string | null | undefined;
-let copilotBinaryCache: string | null | undefined;
-let cursorBinaryCache: string | null | undefined;
+const binaryCache = new Map<string, string | null>();
+
+function cachedBinary(name: string): string | null {
+  const key = `${name}\0${process.env.PATH ?? ""}`;
+  if (!binaryCache.has(key)) binaryCache.set(key, findBinaryOnPath(name));
+  return binaryCache.get(key) ?? null;
+}
 
 function getClaudeBinary(): string | null {
-  if (claudeBinaryCache !== undefined) return claudeBinaryCache;
-  claudeBinaryCache = findBinaryOnPath("claude");
-  return claudeBinaryCache;
+  return cachedBinary("claude");
 }
 
 function getCodexBinary(): string | null {
-  if (codexBinaryCache !== undefined) return codexBinaryCache;
-  codexBinaryCache = findBinaryOnPath("codex");
-  return codexBinaryCache;
+  return cachedBinary("codex");
 }
 
 function getOpencodeBinary(): string | null {
-  if (opencodeBinaryCache !== undefined) return opencodeBinaryCache;
-  opencodeBinaryCache = findBinaryOnPath("opencode");
-  return opencodeBinaryCache;
+  return cachedBinary("opencode");
 }
 
 function getCopilotBinary(): string | null {
-  if (copilotBinaryCache !== undefined) return copilotBinaryCache;
-  copilotBinaryCache = findBinaryOnPath("copilot");
-  return copilotBinaryCache;
+  return cachedBinary("copilot");
 }
 
 function getCursorBinary(): string | null {
-  if (cursorBinaryCache !== undefined) return cursorBinaryCache;
-  cursorBinaryCache = findBinaryOnPath("cursor-agent");
-  return cursorBinaryCache;
+  return cachedBinary("cursor-agent");
 }
 
 function hasClaudeBinary(): boolean {
@@ -266,31 +258,6 @@ function hasCursorBinary(): boolean {
   return getCursorBinary() !== null;
 }
 
-/** Test-only: reset the cached claude-binary resolution. */
-export function _resetClaudeBinaryCache(): void {
-  claudeBinaryCache = undefined;
-}
-
-/** Test-only: reset the cached codex-binary resolution. */
-export function _resetCodexBinaryCache(): void {
-  codexBinaryCache = undefined;
-}
-
-/** Test-only: reset the cached opencode-binary resolution. */
-export function _resetOpencodeBinaryCache(): void {
-  opencodeBinaryCache = undefined;
-}
-
-/** Test-only: reset the cached copilot-binary resolution. */
-export function _resetCopilotBinaryCache(): void {
-  copilotBinaryCache = undefined;
-}
-
-/** Test-only: reset the cached cursor-binary resolution. */
-export function _resetCursorBinaryCache(): void {
-  cursorBinaryCache = undefined;
-}
-
 /**
  * Build the argv for `claude --print …`. Pure.
  *

package/src/hooks/lib/log.ts

@@ -1,6 +1,6 @@
 /**
  * Simple file-based debug logger for PAL hooks.
- * Writes to memory/state/debug.log — rotated on each session start.
+ * Writes to debug/debug.log, rotated by size.
  *
  * Only writes when debug is enabled (`pal cli debug on`) or when called via logError (always logged).
  */
@@ -8,6 +8,7 @@
 import {
   appendFileSync,
   existsSync,
+  readFileSync,
   renameSync,
   statSync,
   unlinkSync,
@@ -78,8 +79,48 @@ function rotateIfNeeded(path: string): void {
   }
 }
 
-/** Test-only: max rotated count for callers that need to enumerate. */
-export const DEBUG_LOG_MAX_ROTATED = MAX_ROTATED;
+export interface HookHealth {
+  totalErrors: number;
+  lastError: string | null;
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function logFilesOldestFirst(): string[] {
+  const path = logFile();
+  const rotated = Array.from(
+    { length: MAX_ROTATED },
+    (_, i) => `${path}.${MAX_ROTATED - i}`
+  );
+  return [...rotated, `${path}.prev`, path];
+}
+
+function readAllLogs(): string {
+  return logFilesOldestFirst()
+    .filter((path) => existsSync(path))
+    .map((path) => readFileSync(path, "utf-8"))
+    .join("\n");
+}
+
+function loggedAt(line: string): number {
+  const match = /^\[(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2}:\d{2})\]/.exec(line);
+  return match ? Date.parse(`${match[1]}T${match[2]}Z`) : 0;
+}
+
+export function recentHookErrors(now: number = Date.now()): HookHealth {
+  try {
+    const recent = readAllLogs()
+      .split("\n")
+      .filter((line) => line.includes("] ERROR ") && loggedAt(line) > now - DAY_MS);
+    const last = recent.at(-1);
+    return {
+      totalErrors: recent.length,
+      lastError: last ? last.replace(/^\[.*?\] ERROR /, "").slice(0, 120) : null,
+    };
+  } catch {
+    return { totalErrors: 0, lastError: null };
+  }
+}
 
 function isDebugEnabled(): boolean {
   return existsSync(resolve(palHome(), "memory", "state", "debug-enabled"));

package/src/hooks/lib/paths.ts

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { resolve } from "node:path";
 
 /**
@@ -56,8 +56,13 @@ export function palPkg(): string {
  * Always resolves to ~/.pal/ regardless of where the package lives.
  * Power users who want memory/telos versioned in a repo can override via PAL_HOME.
  */
+function defaultPalHome(): string {
+  if (process.env.PAL_TEST_SANDBOX) return resolve(tmpdir(), "pal-test-home");
+  return resolve(homedir(), ".pal");
+}
+
 export function palHome(): string {
-  return envPath("PAL_HOME", resolve(homedir(), ".pal"));
+  return envPath("PAL_HOME", defaultPalHome());
 }
 
 /** Ensure a directory exists, creating it recursively if needed */

package/src/hooks/lib/projects.ts

@@ -391,10 +391,14 @@ const MAX_INLINE_BULLETS = 3;
  * Format the SessionStart "Active Projects" section.
  *
  * For the cwd-resolved project (`→ here`): full detail with Context, Objectives
- * (from goal section), Next, and Blockers. For all others: compact one-liner with
- * next/blocker counts only. Stale flag (>14d) and browse-mode hint included.
+ * (from goal section), Next, and Blockers. Other recent projects: one line with
+ * counts and the last session's title, enough to follow up from any folder.
+ * Quiet ones (>14d) collapse to a single line of names.
  */
-export function loadActiveProjectsContext(cwd: string = process.cwd()): string {
+export function loadActiveProjectsContext(
+  cwd: string = process.cwd(),
+  lastSessionTitle: (project: string) => string | undefined = () => undefined
+): string {
   const all = readAllProjects();
   const visible = all.filter((p) => p.status === "active" || p.status === "paused");
   const resolved = resolveProjectFromCwd(cwd, visible);
@@ -411,6 +415,7 @@ export function loadActiveProjectsContext(cwd: string = process.cwd()): string {
   if (visible.length > 0) {
     lines.push("## Active Projects", "");
     const sorted = [...visible].sort((a, b) => b.updated.localeCompare(a.updated));
+    const quiet: string[] = [];
     for (const p of sorted) {
       const ago = formatAgo(p.updated);
       const stale = isStale(p) ? " ⚠ stale" : "";
@@ -447,14 +452,21 @@ export function loadActiveProjectsContext(cwd: string = process.cwd()): string {
         if (p.blockers?.length) {
           lines.push(`  Blockers: ${p.blockers.slice(0, MAX_INLINE_BULLETS).join("; ")}`);
         }
+      } else if (stale) {
+        quiet.push(p.name);
       } else {
         const counts: string[] = [];
         if (p.next?.length) counts.push(`${p.next.length} next`);
         if (p.blockers?.length) counts.push(`${p.blockers.length} blockers`);
         const countsSuffix = counts.length > 0 ? ` — ${counts.join(", ")}` : "";
-        lines.push(`- **${p.name}** (${statusPrefix}${ago})${countsSuffix}${stale}`);
+        const last = lastSessionTitle(p.name);
+        const lastSuffix = last ? ` — last: ${last}` : "";
+        lines.push(`- **${p.name}** (${statusPrefix}${ago})${countsSuffix}${lastSuffix}`);
       }
     }
+    if (quiet.length > 0) {
+      lines.push(`- Quiet for ${PROJECT_STALE_DAYS_DEFAULT}+ days: ${quiet.join(", ")}`);
+    }
   }
 
   if (showHint) {

package/src/hooks/lib/relationship.ts

@@ -76,8 +76,8 @@ export function appendNotes(notes: RelationshipNote[], sessionId?: string): Appe
 
   const timestamp = new Date().toTimeString().slice(0, 5);
   lines.push(`## ${timestamp}`);
-  if (sessionId)
-    lines.push(`<!-- session:${sessionId} cwd:${encodeAnchor(process.cwd())} -->`);
+  const session = sessionId ? `session:${sessionId} ` : "";
+  lines.push(`<!-- ${session}cwd:${encodeAnchor(process.cwd())} -->`);
 
   for (const note of fresh) {
     if (note.type === "O" && note.confidence !== undefined) {

package/src/hooks/lib/retrieval-index.ts

@@ -8,7 +8,7 @@
  */
 
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { SIMILARITY_THRESHOLD } from "./graduation";
 import { readFailures, readReflections } from "./learning-store";
@@ -197,14 +197,21 @@ export function readIndex(): RetrievalIndex | null {
 }
 
 /** True if any source directory was modified after the index was built. */
+function newestFileMtime(dir: string): number {
+  let newest = 0;
+  for (const entry of readdirSync(dir, { recursive: true, withFileTypes: true })) {
+    if (!entry.isFile()) continue;
+    newest = Math.max(newest, statSync(resolve(entry.parentPath, entry.name)).mtimeMs);
+  }
+  return newest;
+}
+
 export function isStale(index: RetrievalIndex): boolean {
   try {
     const builtMs = new Date(index.builtAt).getTime();
-    for (const dir of [paths.failures(), paths.wisdom(), paths.reflections()]) {
-      if (!existsSync(dir)) continue;
-      if (statSync(dir).mtimeMs > builtMs) return true;
-    }
-    return false;
+    return [paths.failures(), paths.wisdom(), paths.reflections()].some(
+      (dir) => newestFileMtime(dir) > builtMs
+    );
   } catch {
     return false;
   }

package/src/hooks/lib/security.ts

@@ -79,9 +79,14 @@ const WIN_ELEVATED_THREATS: [RegExp, string][] = [
   [/\bdiskpart\b/i, "Disk partitioning"],
 ];
 
+const POSIX_ROOT_TARGET = String.raw`["']?(?:(?:~|\$HOME|\$\{HOME\})/?|/)\*?["']?(?=\s|[;&|]|$)`;
+
 /** Dangerous command patterns — always blocked */
 const BLOCKED_COMMANDS: [RegExp, string][] = [
-  [/rm\s+-rf\s+[/~]/, "Recursive delete of root or home"],
+  [
+    new RegExp(String.raw`rm\s+-rf\s+${POSIX_ROOT_TARGET}`),
+    "Recursive delete of root or home",
+  ],
   [/mkfs\./, "Filesystem format"],
   [/dd\s+if=.*of=\/dev\//, "Raw disk write"],
   [/>\s*\/dev\/sd/, "Direct device write"],
@@ -232,6 +237,28 @@ function managedReasonInSegment(segment: string): string | null {
 const READ_ONLY_COMMANDS =
   /^\s*(?:cat|head|tail|less|more|grep|rg|wc|diff|stat|file|ls|dir|find|git\s+(?:log|diff|blame|show|status)|bat)\b/;
 
+const COMMAND_SEPARATORS = new Set(["|", ";", "&"]);
+
+function unquotedSegments(cmd: string): string[] {
+  const segments: string[] = [];
+  let current = "";
+  let quote: string | null = null;
+  for (const char of cmd) {
+    if (quote) {
+      if (char === quote) quote = null;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    } else if (COMMAND_SEPARATORS.has(char)) {
+      segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  segments.push(current.trim());
+  return segments;
+}
+
 /** Check a bash command against blocked patterns. Returns reason string or null. */
 export function checkBashCommand(cmd: string): string | null {
   for (const [pattern, reason] of BLOCKED_COMMANDS) {
@@ -242,8 +269,7 @@ export function checkBashCommand(cmd: string): string | null {
       if (pattern.test(cmd)) return reason;
     }
   }
-  const segments = cmd.split(/[|;&]/).map((s) => s.trim());
-  for (const segment of segments) {
+  for (const segment of unquotedSegments(cmd)) {
     const reason = managedReasonInSegment(segment);
     if (reason && !READ_ONLY_COMMANDS.test(segment)) return reason;
   }