riskrails 3.0.1 → 3.2.1

package/hooks/guard/paths.py

@@ -59,21 +59,18 @@ WHY_APPROVE = T(
     "and tells the session to run state.py questions --sync. An unattended run\n"
     "exports AI_UNATTENDED=1 in the launcher's environment, and the journal then\n"
     "records the approval as unattended for ever. See .ai/policies/safety.md.")
-WHY_SET_BY = T(
-    "\n\nA task gets review_rounds_max review verdicts; after that the human decides,\n"
-    "in their own terminal:\n"
-    "  python3 <plugin>/skills/ai-task/state.py --root . set review_status <value> --by \"<name>\"\n"
-    "Show them the findings in .ai/reports/<task-id>/task.md §Review. An unattended\n"
-    "run exports AI_UNATTENDED=1 in the launcher's environment. See .ai/policies/safety.md.")
 WHY_WORK_CAP = T(
     "This command names more paths than the guard can check within its timeout; split it into "
     "smaller commands, or pass the list through a file and xargs.")
 
 TOKEN_END = "([[:space:]\"';&|)<>]|$)"
 
-# The --confirm-delete rule.
+# The --confirm-delete rule, and --confirm-cleanup (the same human gate; any argparse prefix).
 SEP = "(([^|;&]|[<>]&|&>)*[[:space:]])?" + Q
-CONFIRM = "--co(n(f(i(r(m(-(d(e(l(e(t(e)?)?)?)?)?)?)?)?)?)?)?)?(=|[[:space:]]|['\"]|$)"
+CONFIRM_DEL = "d(e(l(e(t(e)?)?)?)?)?"
+CONFIRM_CLEAN = "c(l(e(a(n(u(p)?)?)?)?)?)?"
+CONFIRM = ("--co(n(f(i(r(m(-(" + CONFIRM_DEL + "|" + CONFIRM_CLEAN + ")?)?)?)?)?)?)?"
+           "(=|[[:space:]]|['\"]|$)")
 APPLY = "--ap(p(l(y)?)?)?" + END
 HEAD = "(^|[[:space:]'\"/|;&(`])(update\\.py|-[A-Za-z]*m[[:space:]]*" + Q + "update|" + VAR + ")" + Q + "[[:space:]]"
 CONFIRM_RE = HEAD + SEP + CONFIRM + SEP + APPLY + "|" + HEAD + SEP + APPLY + SEP + CONFIRM
@@ -84,22 +81,36 @@ VERB = "([[:space:]]+--)?[[:space:]]+" + Q + "approve" + END
 BOUND = "(^|[|;&([:space:]`])"
 APPROVE_RE = (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS + VERB + "|"
               + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + VERB)
-SETBY_VERB = ("([[:space:]]+--)?[[:space:]]+" + Q + "set" + END + "([^|;&`]*[[:space:]])?" + Q + "--by?"
-              + Q + "(=|[[:space:]]|$)")
-SETBY_RE = (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS + SETBY_VERB + "|"
-            + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + SETBY_VERB)
-# R36.11, with the dialog on only: the other human-only state.py commands —
-# `profile set` and the --by forms of verify, review and reject — run from an
-# agent session only as the next live pick, like approve. `start --mode --by`
-# reaches state.py: raising a mode needs no human, and a lowering opens its own
-# decision there before human_route() refuses it (review H1, T-2026-10-28-010).
+# R36.11: the other human-only state.py commands — `profile set` (dialog on only)
+# and the --by forms of verify, review and reject (dialog on or off) — run from an
+# agent session only as the next live pick, like approve. `start --mode light --by`
+# is denied with the dialog off only: `light` is the one --mode value that can
+# never raise a mode; with the dialog on it reaches state.py, which opens the
+# lowering decision (review H1, T-2026-10-28-010); any other `start --mode X --by`
+# reaches state.py too (T-2026-10-30-0758 Q1, Q2).
 PROFILE_SET_VERB = "([[:space:]]+--)?[[:space:]]+" + Q + "profile" + Q + "[[:space:]]+" + Q + "set" + END
 PROFILE_SET_RE = (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS + PROFILE_SET_VERB
                   + "|" + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + PROFILE_SET_VERB)
-HUMAN_BY_VERB = ("([[:space:]]+--)?[[:space:]]+" + Q + "(verify|review|reject)" + END + "([^|;&`]*[[:space:]])?"
-                 + Q + "--by?" + Q + "(=|[[:space:]]|$)")
-HUMAN_BY_RE = (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS + HUMAN_BY_VERB + "|"
-               + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + HUMAN_BY_VERB)
+BY_TOK = Q + "--by?" + Q + "(=|[[:space:]]|$)"
+MODE_LIGHT = Q + "--m(o(d(e)?)?)?" + Q + "(=|[[:space:]]+)" + Q + "light" + END
+SKIP = "([^|;&`]*[[:space:]])?"
+HUMAN_BY_VERB = ("([[:space:]]+--)?[[:space:]]+" + Q + "(verify|review|reject)" + END + SKIP + BY_TOK)
+START_LIGHT_VERB = ("([[:space:]]+--)?[[:space:]]+" + Q + "start" + END + SKIP + "("
+                    + MODE_LIGHT + SKIP + BY_TOK + "|" + BY_TOK + SKIP + MODE_LIGHT + ")")
+
+
+def state_verb_re(verb):
+    """The state.py command whose verb part is `verb`, as an ERE: by path or by a variable."""
+    return (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS
+            + "(" + verb + ")|" + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + "(" + verb + ")")
+
+
+HUMAN_BY_RE = state_verb_re(HUMAN_BY_VERB)
+START_LIGHT_RE = state_verb_re(START_LIGHT_VERB)
+WHY_HUMAN = T(
+    "\n\nThis command is the human's, whether or not the dialog is on. A human runs it in their\n"
+    "own terminal, outside the agent session; an unattended run exports AI_UNATTENDED=1 in the\n"
+    "launcher's environment. See .ai/policies/safety.md.")
 WHY_PICK = T(
     "\n\nWith the dialog on, this command runs from an agent session only as the human's pick.\n"
     "The command that needs it opened a decision: 'state.py decision show' prints the dialog;\n"
@@ -137,21 +148,106 @@ LN_SRC_RE = ".*(^|[|;&[:space:]])ln([[:space:]]+-[^[:space:]]+)*[[:space:]]+([^[
 LONG_CMD = 4096
 # Whole words only, so --cov, --config and approve_invoice do not trip it.
 LONG_TRIGGER_RE = ("(^|[^A-Za-z0-9_])approve([^A-Za-z0-9_]|$)|--by(=|[[:space:]]|$)|"
-                   "--con?f?i?r?m?-?d?e?l?e?t?e?(=|[[:space:]]|$)|state\\.py|update\\.py")
+                   "--con?f?i?r?m?-?(d?e?l?e?t?e?|c?l?e?a?n?u?p?)(=|[[:space:]]|$)|state\\.py|update\\.py")
 # Tools that write a file named on their command line without a redirect; the
 # movers do not parse them, so any protected path they name is refused (H1).
 FETCHERS = "(^|[|;&[:space:]])(scp|tar|zip|unzip|curl|wget)([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+"
 # An interpreter one-liner is not parsed, its text is scanned: one that names a
 # secret, or one that names a control file and looks like a write, is refused (H3).
-INTERP_RE = "(^|[|;&[:space:]])(python3?|perl|ruby|node|php)([[:space:]]+-[^[:space:]]+)*[[:space:]]+-(c|e)([[:space:]]|$)"
+INTERP_RE = ("(^|[|;&[:space:]])(python3?|perl|ruby|node|php)([[:space:]]+-[^[:space:]]+)*[[:space:]]+-(c|e)([[:space:]]|$)|"
+             "(^|[|;&[:space:]])php([[:space:]]+-[^[:space:]]+)*[[:space:]]+-r([[:space:]]|$)")
 CONTROL_TEXT_RE = "\\.ai/state/|\\.ai/reports/"
-INPLACE_RE = ("(^|[|;&[:space:]])(perl|ruby)([[:space:]]+-([CEIMmr][[:space:]]*[^[:space:]]+|[^[:space:]]+))*"
-              "[[:space:]]+-[acdfghlnpsStTuUvwWXy]*i")
+# perl or ruby with -i, behind any blank, separator, ( ` { or quote, so every wrapper and
+# position is caught; Guard.inplace_edit carves out the segments of a text tool (grep, echo,
+# git log ...) that merely name it. An -e/-E/-ne code argument may be one quoted word.
+INPLACE_RE = ("(^|[|;&(`{'\"[:space:]])"
+              "(perl|ruby)([[:space:]]+-([CEIMmr][[:space:]]*[^[:space:]]+|[a-zA-Z]*[eE][[:space:]]+('[^']*'|\"[^\"]*\")|"
+              "[^[:space:]]+))*[[:space:]]+-[acdfghlnpsStTuUvwWXy]*i")
+_TEXT_TOOLS = {"grep", "egrep", "fgrep", "rg", "ag", "ack", "echo", "printf"}
+_GIT_TEXT = {"log", "grep", "commit", "show", "diff", "tag", "notes"}
+_STD_WRITE = re.compile(r"(writeSync|writevSync)\([ \t]*(1|2|process\.std(out|err)\.fd)[ \t]*,|"
+                        r"v?fprintf\([ \t]*STD(OUT|ERR)[ \t]*,")
+
+
+_SHELL_SINKS = {"sh", "bash", "zsh", "dash", "ksh", "ssh", "source", ".", "eval"}
+_XARGS_ARG = {"-I", "-n", "-P", "-L", "-s", "-E", "-d", "-a"}
+_GIT_RUNS = ("GIT_", "PAGER", "EDITOR", "VISUAL", "SSH_COMMAND")
+_GIT_CFG = re.compile(r"[A-Za-z0-9_.-]+=[A-Za-z0-9_./:-]*$")
+
+
+def _tool_word(w):
+    """The bare word, /bin/<w> or /usr/bin/<w>; any other path is a program of its own."""
+    if w.startswith("/bin/"):
+        return w[5:]
+    if w.startswith("/usr/bin/"):
+        return w[9:]
+    return w
+
+
+def shell_sink(seg):
+    """A segment that runs its input or its arguments as shell text."""
+    words = seg.split()
+    if not words:
+        return False
+    w = _tool_word(words[0])
+    if w in _SHELL_SINKS:
+        return True
+    return w == "xargs" and any(_tool_word(x) in _SHELL_SINKS for x in words[1:])
+
+
+def _plain_text_tool(words, i, git_runs):
+    if i >= len(words):
+        return False
+    w = _tool_word(words[i])
+    if w in _TEXT_TOOLS:
+        return True
+    if w != "git" or git_runs:
+        return False
+    if any(x.startswith(("-O", "--open-files-in-pager", "--config-env")) for x in words[i + 1:]):
+        return False
+    k = i + 1
+    while k < len(words):
+        x = words[k]
+        if x in ("-C", "-c"):
+            if x == "-c" and (k + 1 >= len(words) or not _GIT_CFG.match(words[k + 1])):
+                return False
+            k += 2
+        elif x.startswith("-"):
+            k += 1
+        else:
+            return x in _GIT_TEXT
+    return False
+
+
+def text_tool_segment(seg, git_runs=False):
+    """A segment whose command word is a text tool: a program named in it is an argument.
+    xargs and find -exec are looked through; git_runs is set when the line may hand git a
+    command to run (a stripped GIT_PAGER=... assignment)."""
+    words = seg.split()
+    if not words:
+        return False
+    w = _tool_word(words[0])
+    if w == "xargs":
+        i = 1
+        while i < len(words) and words[i].startswith("-"):
+            i += 2 if words[i] in _XARGS_ARG else 1
+        return _plain_text_tool(words, i, git_runs)
+    if w == "find":
+        found = False
+        for k, x in enumerate(words):
+            if x in ("-exec", "-execdir", "-ok", "-okdir"):
+                if not _plain_text_tool(words, k + 1, git_runs):
+                    return False
+                found = True
+        return found
+    return _plain_text_tool(words, 0, git_runs)
+
+
 EVAL_WORD_RE = "(^|[|;&[:space:]])eval([[:space:]]|$)"
 SECRET_TEXT_RE = "\\.env|secrets?/|credentials?|id_rsa|\\.pem|\\.aws"
 WRITE_CALL_RE = (
     "(^|[^A-Za-z0-9_])(write|writelines|write_text|write_bytes|write_file|writeFile|writeFileSync|appendFile|"
-    "appendFileSync|createWriteStream|binwrite|syswrite|fwrite|fputs|file_put_contents|dump|unlink|unlinkSync|"
+    "appendFileSync|createWriteStream|binwrite|syswrite|fwrite|fputs|fprintf|vfprintf|writeSync|writevSync|file_put_contents|dump|unlink|unlinkSync|"
     "remove|removedirs|rename|renames|renameSync|rmdir|rmdirSync|rm|rmSync|rmtree|mkdir|mkdirSync|makedirs|"
     "mkdtemp|truncate|truncateSync|ftruncate|symlink|symlinkSync|symlink_to|hardlink_to|link|linkSync|link_to|"
     "touch|chmod|chown|utime|utimes|copyFile|copyFileSync|cp|cpSync|move|delete|system|exec|execSync|execFile|"
@@ -1171,7 +1267,8 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         p = self.p
         if p.tool not in ("Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"):
             return
-        unattended = bool(env_b("AI_UNATTENDED"))
+        # AI_UNATTENDED is set when non-empty and not 0, false or no: one rule (risk 0587)
+        unattended = env_b("AI_UNATTENDED").strip().lower() not in ("", "0", "false", "no")
         if p.tool == "Bash" and not unattended:
             self.confirm_delete(p.bash_command())
         root = find_ai_root(p.cwd, self.ctx.pwd)
@@ -1216,6 +1313,22 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         command = b_bytes(cmd).decode("utf-8", "replace").strip()
         return True, bool(pick and pick.get("label") == command)
 
+    def inplace_edit(self, cmd):
+        """perl or ruby -i as a command: INPLACE_RE on the line less the segments of a text tool."""
+        m = self.m
+        if not m.ere_match(INPLACE_RE, cmd):
+            return False
+        if "<<" in cmd:                     # a heredoc body is read by whoever reads it
+            return True
+        segs = shell_segments(cmd).split("\n")
+        if "|" in cmd and any(shell_sink(sg) for sg in segs):
+            return True                     # a text tool's output may run as shell text
+        git_runs = any(t in cmd for t in _GIT_RUNS)
+        if git_runs and any(_tool_word(sg.split(None, 1)[0]) == "git" for sg in segs if sg.strip()):
+            return True                     # the assignment that runs a command is not in the segment
+        keep = [sg for sg in segs if not text_tool_segment(sg, git_runs)]
+        return m.ere_match(INPLACE_RE, "\n".join(keep))
+
     def interpreter_text(self, cmd):
         """The text of an interpreter one-liner or an eval, scanned whole (H3)."""
         m = self.m
@@ -1224,10 +1337,10 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         if (is_eval or is_interp) and m.ere_match(SECRET_TEXT_RE, cmd):
             raise Deny("Refusing an interpreter one-liner that references a sensitive path." + WHY_SENSITIVE)
         if m.ere_match(CONTROL_TEXT_RE, cmd):
-            if is_eval or m.ere_match(INPLACE_RE, cmd):
+            if is_eval or self.inplace_edit(cmd):
                 raise Deny("Refusing an interpreter one-liner that writes the task's own control files." + WHY_APPROVE)
             if is_interp:
-                scan = cmd.replace("stdout.write", " ").replace("stderr.write", " ")
+                scan = _STD_WRITE.sub(" ", cmd.replace("stdout.write", " ").replace("stderr.write", " "))
                 pscan = cmd.replace("copy.copy(", " ")
                 if (m.ere_match(WRITE_CALL_RE, scan) or m.ere_match(WRITE_WORD_RE, cmd)
                         or (m.ere_match("Path", cmd)
@@ -1255,14 +1368,14 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         on, picked = self.dialog_consent(cmd)
         if m.ere_match(APPROVE_RE, cmd_joined) and not unattended and self.task_in_flight() and not picked:
             raise Deny("Refusing 'state.py approve' from an agent session." + WHY_APPROVE)
-        if on and not picked and not unattended:
-            if m.ere_match(PROFILE_SET_RE, cmd_joined):
-                raise Deny("Refusing 'state.py profile set' from an agent session." + WHY_PICK)
-            if m.ere_match(HUMAN_BY_RE, cmd_joined):
-                raise Deny(T("Refusing a 'state.py … --by' verdict from an agent session.") + WHY_PICK)
-        if m.ere_match(SETBY_RE, cmd_joined) and not unattended and self.task_in_flight():
-            raise Deny(T("Refusing 'state.py set \u2026 --by' from an agent session: a verdict with --by is the "
-                         "human's, given when the review budget is spent.") + WHY_SET_BY)
+        if on and not picked and not unattended and m.ere_match(PROFILE_SET_RE, cmd_joined):
+            raise Deny("Refusing 'state.py profile set' from an agent session." + WHY_PICK)
+        if not picked and not unattended and m.ere_match(HUMAN_BY_RE, cmd_joined):
+            raise Deny(T("Refusing a verdict with 'state.py … --by' from an agent session.")
+                       + (WHY_PICK if on else WHY_HUMAN))
+        if not on and not picked and not unattended and m.ere_match(START_LIGHT_RE, cmd_joined):
+            raise Deny(T("Refusing 'state.py start --mode light … --by' from an agent session: lowering the "
+                         "mode is the human's.") + WHY_HUMAN)
         self.interpreter_text(cmd)
 
         # Top-level splitting only: the string a sh -c or an eval runs is not

package/hooks/project-scaffold.py

@@ -204,7 +204,8 @@ class Scaffold:
         if os.path.exists(os.path.join(d, ".gitkeep")):
             return
         os.makedirs(d, exist_ok=True)
-        open(os.path.join(d, ".gitkeep"), "wb").close()
+        with open(os.path.join(d, ".gitkeep"), "wb"):
+            pass
         self.created.append(rel + "/.gitkeep")
 
     def append_once(self, path, marker, template, label):
@@ -236,12 +237,8 @@ def main(argv):
     on = runtimes(runtime, root)
     s = Scaffold(tpl, root)
 
-    # shared SDLC
+    # shared SDLC (the intent/spec/plan/adr templates ship with the plugin; a project TEMPLATE.md is only an override)
     s.put("sdlc-README.md", "docs/sdlc/README.md")
-    s.put("intent.md", "docs/sdlc/intent/TEMPLATE.md")
-    s.put("spec.md", "docs/sdlc/specs/TEMPLATE.md")
-    s.put("plan.md", "docs/sdlc/plans/TEMPLATE.md")
-    s.put("adr.md", "docs/sdlc/adr/TEMPLATE.md")
     s.put("constitution.md", "docs/sdlc/constitution.md", render=True)
 
     # per runtime

package/hooks/runtime-gate.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
-"""Runtime gate: one hook for both runtimes, replacing fable-gate.py and
-codex-model-gate.py (which remain as shims that exec this file).
+"""Runtime gate: one hook for both runtimes (Claude Code and Codex). The older
+fable-gate.py and codex-model-gate.py remain only as shims that exec this file.
 
 The most capable model of a plan can stop serving an account — a rate limit, a
 used-up usage limit, a model the account cannot reach — and the runtime's own
@@ -138,7 +138,7 @@ def profile_tier(home, tier, field, default):
         with open(profile_file(home), encoding="utf-8") as fh:
             value = json.load(fh)["tiers"][tier][field]
         return value if isinstance(value, str) and value else default
-    except (OSError, ValueError, KeyError, TypeError):
+    except (OSError, ValueError, KeyError, TypeError, RecursionError):
         return default
 
 
@@ -148,7 +148,7 @@ def profile_fable(home):
     try:
         with open(profile_file(home), encoding="utf-8") as fh:
             return bool(json.load(fh).get("fable", True))
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, AttributeError, RecursionError):
         return True
 
 
@@ -205,7 +205,7 @@ def load(path=None):
         return data if isinstance(data, dict) else {}
     except OSError:
         return import_legacy() if path in (None, STATE) else {}
-    except ValueError:
+    except (ValueError, RecursionError):
         return {}
 
 
@@ -218,7 +218,7 @@ def import_legacy():
     try:
         with open(LEGACY_STATE, encoding="utf-8") as fh:
             old = json.load(fh)
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return {}
     data = {"imported_from": os.path.basename(LEGACY_STATE)}
     if isinstance(old, dict) and isinstance(old.get("unavailable"), dict):
@@ -341,7 +341,7 @@ def claude_code_version(path):
             continue
         try:
             version = json.loads(line).get("version")
-        except (ValueError, AttributeError):
+        except (ValueError, AttributeError, RecursionError):
             continue
         m = re.match(r"(\d+)\.(\d+)\.(\d+)", version) if isinstance(version, str) else None
         if m:
@@ -415,10 +415,10 @@ def claude_pre_tool_use(payload):
         "hookSpecificOutput": {
             "hookEventName": "PreToolUse",
             "permissionDecision": "allow",
-            "permissionDecisionReason": f"fable-gate: {why}; {name} runs on {FALLBACK}",
+            "permissionDecisionReason": f"runtime-gate: {why}; {name} runs on {FALLBACK}",
             "updatedInput": {**tool_input, "model": FALLBACK},
             "additionalContext": (
-                f"fable-gate routed this {name} agent to {FALLBACK}: {why}. "
+                f"runtime-gate routed this {name} agent to {FALLBACK}: {why}. "
                 f"Its answer is {FALLBACK}'s, not Fable's. "
                 "`~/.claude/hooks/runtime-gate.py clear` re-enables Fable early."
             ),
@@ -444,7 +444,7 @@ def last_transcript_model(path):
     for line in reversed(transcript_tail(path)):
         try:
             model = (json.loads(line).get("message") or {}).get("model")
-        except (ValueError, AttributeError):
+        except (ValueError, AttributeError, RecursionError):
             continue
         if isinstance(model, str) and model and not model.startswith("<"):
             return model
@@ -504,9 +504,10 @@ ROLLOUT_TAIL = 64 * 1024
 
 def number(value):
     try:
-        return None if value is None else float(value)
+        x = None if value is None else float(value)
     except (TypeError, ValueError):
         return None
+    return x if x is None or math.isfinite(x) else None   # NaN/Infinity is no reading
 
 
 def record_quota(weekly, five_hour, resets_at, source, seen_at=None):
@@ -564,7 +565,7 @@ def rollout_limits(path):
             continue
         try:
             event = json.loads(line)
-        except ValueError:
+        except (ValueError, RecursionError):
             continue
         limits = (event.get("payload") or {}).get("rate_limits") or {}
         weekly = five = None
@@ -801,10 +802,10 @@ def codex_pre_tool_use(payload):
         journal_fallback(payload, label, model, to, rec)
         out["hookSpecificOutput"]["permissionDecision"] = "allow"
         out["hookSpecificOutput"]["updatedInput"] = updated
-        context = (f"codex-model-gate: {why}. {label} runs on {to}{via} instead, so its answer is "
+        context = (f"runtime-gate: {why}. {label} runs on {to}{via} instead, so its answer is "
                    f"{to}'s, not {EXPERT}'s. Say so when you report it. ")
     else:
-        context = (f"codex-model-gate: {why}. {label} is not rerouted ({not_why}): it runs on {EXPERT} "
+        context = (f"runtime-gate: {why}. {label} is not rerouted ({not_why}): it runs on {EXPERT} "
                    "and may fail the same way. Say so when you report it. ")
     out["hookSpecificOutput"]["additionalContext"] = context + "`runtime-gate.py clear` re-enables the expert model early."
     respond(out)
@@ -864,7 +865,7 @@ def profile():
         with open(profile_file(HOME), encoding="utf-8") as fh:
             data = json.load(fh)
         return data if isinstance(data, dict) else {}
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return {}
 
 
@@ -919,7 +920,7 @@ def project_task(cwd):
             try:
                 with open(path, encoding="utf-8") as fh:
                     task = json.load(fh).get("task_id")
-            except (OSError, ValueError, AttributeError):
+            except (OSError, ValueError, AttributeError, RecursionError):
                 return None, None
             return (here, task) if task else (None, None)
         parent = os.path.dirname(here)
@@ -985,11 +986,18 @@ def codex_missed_reroute(payload):
         "or an unavailable model, stop and say so instead of retrying.")}})
 
 
+def ai_unattended():
+    """AI_UNATTENDED is set when it is non-empty and not 0, false or no (case
+    and blanks ignored): one rule in every reader (risk 0587)."""
+    return os.environ.get("AI_UNATTENDED", "").strip().lower() not in ("", "0", "false", "no")
+
+
 def unattended():
-    """Nobody can answer an ask: AI_UNATTENDED=1, or Claude Code's own
-    CLAUDE_CODE_SESSION_ATTENDED=0 (set by `claude -p` and the SDK). Unset —
-    an older Claude Code — still asks."""
-    return os.environ.get("AI_UNATTENDED") == "1" or os.environ.get("CLAUDE_CODE_SESSION_ATTENDED") == "0"
+    """Nobody can answer an ask: AI_UNATTENDED set (ai_unattended), or Claude
+    Code's own CLAUDE_CODE_SESSION_ATTENDED=0 (set by `claude -p` and the SDK).
+    Unset — an older Claude Code — still asks. dialog.json background_sessions
+    is the dialog's opt-in only: this gate still treats ATTENDED=0 as unattended."""
+    return ai_unattended() or os.environ.get("CLAUDE_CODE_SESSION_ATTENDED") == "0"
 
 
 def will_ask():
@@ -1117,24 +1125,31 @@ def disabled():
 
 
 def context_line(payload):
-    """`Opus 5.5 [1m] · 123k/1000k (12%)` from a Claude Code statusline payload, or ""
+    """`Opus 5.5 [1m] high · 123k/1000k (12%)` (the effort right after the model,
+    when the payload names one) from a Claude Code statusline payload, or ""
     when it names neither the model nor the context. The context_window fields differ
     between Claude Code versions: the tokens come from current_usage (input plus cache
     reads and writes, what the next turn re-reads), else from used_percentage."""
     model = payload.get("model")
     name = str(model.get("display_name") or model.get("id") or "") if isinstance(model, dict) else ""
+    effort = payload.get("effort")
+    effort = effort.get("level") if isinstance(effort, dict) else None
+    if name and isinstance(effort, str) and effort.strip():
+        name = "%s %s" % (name, effort.strip())
     window = payload.get("context_window")
     window = window if isinstance(window, dict) else {}
 
-    def number(value):
-        return value if isinstance(value, (int, float)) and not isinstance(value, bool) and value >= 0 else None
+    def finite_number(value):
+        # finite only: Infinity makes round() raise and the whole line would be lost
+        return (value if isinstance(value, (int, float)) and not isinstance(value, bool)
+                and math.isfinite(value) and value >= 0 else None)
 
-    size = number(window.get("context_window_size"))
-    pct = number(window.get("used_percentage"))
+    size = finite_number(window.get("context_window_size"))
+    pct = finite_number(window.get("used_percentage"))
     usage = window.get("current_usage")
     used = None
     if isinstance(usage, dict):
-        parts = [number(usage.get(k)) for k in
+        parts = [finite_number(usage.get(k)) for k in
                  ("input_tokens", "cache_creation_input_tokens", "cache_read_input_tokens")]
         if any(p is not None for p in parts):
             used = sum(p or 0 for p in parts)
@@ -1148,15 +1163,96 @@ def context_line(payload):
     return " · ".join(part for part in (name, context) if part)
 
 
+SL_RESET, SL_SEP = "\033[00m", " \033[02m|\033[00m "
+
+
+def reset_text(value, fmt):
+    """A rate-limit window's resets_at (epoch seconds or an ISO timestamp) as
+    local time in `fmt`, or ""."""
+    try:
+        if isinstance(value, (int, float)) and not isinstance(value, bool):
+            when = dt.datetime.fromtimestamp(value)
+        elif isinstance(value, str) and value.strip():
+            text = value.strip()
+            when = (dt.datetime.fromtimestamp(float(text)) if re.fullmatch(r"\d+(\.\d+)?", text)
+                    else dt.datetime.fromisoformat(text.replace("Z", "+00:00")).astimezone())
+        else:
+            return ""
+        return when.strftime(fmt)
+    except (ValueError, OverflowError, OSError):
+        return ""
+
+
+def git_branch(cwd):
+    """The branch checked out in cwd, else the short commit, else ""."""
+    for args in (["symbolic-ref", "--short", "-q", "HEAD"], ["rev-parse", "--short", "HEAD"]):
+        try:
+            done = subprocess.run(["git", "--no-optional-locks", "-C", cwd] + args, capture_output=True,
+                                  text=True, timeout=2, check=False)
+        except (OSError, subprocess.SubprocessError):
+            return ""
+        if done.returncode == 0 and done.stdout.strip():
+            return done.stdout.strip()
+    return ""
+
+
+def second_line(payload):
+    """`user@host:cwd | branch | 5h:12% (↻14:00) 7d:41% (↻Fri 03:04) | $1.23`, the
+    colours of a Debian colour PS1; each part after the prompt is skipped when its
+    data is missing."""
+    workspace = payload.get("workspace")
+    cwd = workspace.get("current_dir") if isinstance(workspace, dict) else None
+    cwd = cwd if isinstance(cwd, str) and cwd else os.getcwd()
+    user = os.environ.get("USER") or os.environ.get("LOGNAME") or ""
+    if not user:
+        try:
+            import getpass  # pylint: disable=import-outside-toplevel
+            user = getpass.getuser()
+        except (ImportError, KeyError, OSError):
+            user = "?"
+    import socket  # pylint: disable=import-outside-toplevel
+    host = socket.gethostname().split(".")[0]
+    out = "\033[01;32m%s@%s%s:\033[01;34m%s%s" % (user, host, SL_RESET, cwd, SL_RESET)
+    branch = git_branch(cwd) if os.path.isdir(cwd) else ""
+    if branch:
+        out += "%s\033[35m%s%s" % (SL_SEP, branch, SL_RESET)
+    limits = payload.get("rate_limits")
+    limits = limits if isinstance(limits, dict) else {}
+    parts = []
+    for key, label, fmt in (("five_hour", "5h", "%H:%M"), ("seven_day", "7d", "%a %H:%M")):
+        window = limits.get(key)
+        pct = window.get("used_percentage") if isinstance(window, dict) else None
+        if isinstance(pct, (int, float)) and not isinstance(pct, bool) and math.isfinite(pct):
+            reset = reset_text(window.get("resets_at"), fmt)
+            parts.append("%s:%d%%%s" % (label, round(pct), " (↻%s)" % reset if reset else ""))
+    if parts:
+        out += "%s\033[33m%s%s" % (SL_SEP, " ".join(parts), SL_RESET)
+    cost = payload.get("cost")
+    cost = cost.get("total_cost_usd") if isinstance(cost, dict) else None
+    if isinstance(cost, (int, float)) and not isinstance(cost, bool) and math.isfinite(cost):
+        out += "%s\033[32m$%.2f%s" % (SL_SEP, cost, SL_RESET)
+    return out
+
+
+def emit(text):
+    """One statusline line as UTF-8 whatever the locale (`·` and `↻` are not ASCII)."""
+    sys.stdout.flush()
+    sys.stdout.buffer.write((text + "\n").encode("utf-8", "replace"))
+    sys.stdout.buffer.flush()
+
+
 def statusline_main(argv):
-    """`statusline [--context] [--then <command>]`: check the weekly limit, print the
-    model and the context use with --context, then hand the same input to the user's
-    own statusline command and pass its output and exit code through. Neither the
-    check nor the line ever gets in the way of the statusline."""
+    """`statusline [--context] [--line] [--then <command>]`: check the weekly limit,
+    print the model, effort and context use with --context (cyan), the prompt line
+    (user@host:cwd | branch | limits | cost) with --line, then hand the same input
+    to the user's own statusline command and pass its output and exit code through.
+    Neither the check nor the lines ever get in the way of the statusline."""
     data = sys.stdin.buffer.read()
-    show_context = argv[1:2] == ["--context"]
-    if show_context:
+    flags = set()
+    while argv[1:2] in (["--context"], ["--line"]):
+        flags.add(argv[1])
         argv = argv[:1] + argv[2:]
+    show_context = "--context" in flags
     payload = None
     try:
         payload = json.loads(data.decode("utf-8", "replace"))
@@ -1171,7 +1267,12 @@ def statusline_main(argv):
         try:
             line = context_line(payload)
             if line:
-                print(line)
+                emit("\033[36m%s%s" % (line, SL_RESET))
+        except Exception:  # pylint: disable=broad-exception-caught  # fail open, as above
+            pass
+    if "--line" in flags and isinstance(payload, dict):
+        try:
+            emit(second_line(payload))
         except Exception:  # pylint: disable=broad-exception-caught  # fail open, as above
             pass
     if len(argv) >= 3 and argv[1] == "--then" and argv[2].strip():