pullfrog 0.1.97 → 0.1.99

package/dist/agents/claudePretoolGate.d.ts

@@ -39,6 +39,11 @@
  * `#!/usr/bin/env node` shebang and the executable bit set by the harness.
  */
 export declare const CLAUDE_PRETOOL_GATE_FILENAME: "pullfrog-pretool-gate.mjs";
+/** the Stop-hook script and the flag `--settings` JSON, both written into the
+ * per-run tmpdir alongside the gate. named here so the hook-asset seal
+ * (nativeFsDenies.ts) and the writers in claude.ts share one source. */
+export declare const CLAUDE_STOP_HOOK_FILENAME: "pullfrog-stop-hook.sh";
+export declare const CLAUDE_SETTINGS_FILENAME: "pullfrog-claude-settings.json";
 /**
  * Build the gate script source, embedding the run's derived denied-tool set
  * (see `subagentDeniedToolNames` in action/agents/subagentToolGates.ts).

package/dist/agents/nativeFsDenies.d.ts

@@ -26,3 +26,11 @@ export declare const GIT_NATIVE_WRITE_DENY_CLAUDE: string[];
 /** Claude `permissions.deny` entries for the narrow `.git/config` READ deny,
  * one per read/enumerate tool — mirrors {@link GIT_NATIVE_READ_DENY_OPENCODE}. */
 export declare const GIT_NATIVE_READ_DENY_CLAUDE: string[];
+/** Claude hook assets, relative to the per-run tmpdir (== HOME). */
+export declare const CLAUDE_HOOK_ASSET_RELPATHS: readonly string[];
+/** OpenCode auto-discovers every plugin in this dir (relative to tmpdir); seal
+ * the whole dir so both bundled plugins and any future one are covered. */
+export declare const OPENCODE_PLUGIN_DIR_RELPATH: ".config/opencode/plugin";
+/** every hook asset, tmpdir-relative — the read-only-bind set for the MCP
+ * shell, which both agents share. dir entries bind recursively like `.git`. */
+export declare const HOOK_ASSET_TMPDIR_RELPATHS: readonly string[];