sessionpipe 0.9.0 → 0.10.0

package/dist/hook.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/hook.ts", "../src/control/local.ts"],
-  "sourcesContent": ["#!/usr/bin/env node\n// SPDX-License-Identifier: Apache-2.0\n// The hook path. A harness runs `node hook.js <harness> <event>`; this reads stdin,\n// writes one job file, spawns the worker detached, prints what the harness needs\n// (Antigravity's answer) and exits 0 \u2014 in milliseconds, with nothing but node:\n// builtins imported (the build checks that). No network, no schema library, no\n// config parsing beyond one small file read for the throttle.\nimport { spawn } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { ask, socketPath } from \"./control/local.js\";\n\n/** A Claude Code session id (the same test as core's notClaudeCode). */\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** The two streams the hook touches: stdin once, whole; stdout for an answer. */\nexport interface HookIO {\n  stdin(): Buffer;\n  stdout(text: string): void;\n}\n\n/** One hook run: `argv` is [harness, event, ...] as the harness invoked it, `env` the\n *  process environment. Resolves once the job is on its way and any answer printed;\n *  the process then exits 0, whatever happened (the hook is invisible to the harness). */\nexport async function hookMain(argv: string[], env: NodeJS.ProcessEnv, io: HookIO): Promise<void> {\n  const t0 = process.hrtime.bigint();\n  /** The hook's own work, when a control wait follows it (the wait is not the hook's cost). */\n  let workMs: number | null = null;\n  const [harness = \"\", event = \"\", ...rest] = argv;\n\n  function stateDir(): string {\n    if (env.SESSIONPIPE_STATE) return path.resolve(env.SESSIONPIPE_STATE);\n    const home = os.homedir();\n    if (process.platform === \"win32\")\n      return path.join(env.LOCALAPPDATA || path.join(home, \"AppData\", \"Local\"), \"sessionpipe\");\n    return path.join(env.XDG_STATE_HOME || path.join(home, \".local\", \"state\"), \"sessionpipe\");\n  }\n  function configFile(): string {\n    if (env.SESSIONPIPE_CONFIG) return path.resolve(env.SESSIONPIPE_CONFIG);\n    const home = os.homedir();\n    if (process.platform === \"win32\")\n      return path.join(env.APPDATA || path.join(home, \"AppData\", \"Roaming\"), \"sessionpipe\", \"config.json\");\n    return path.join(env.XDG_CONFIG_HOME || path.join(home, \".config\"), \"sessionpipe\", \"config.json\");\n  }\n\n  // Antigravity parses stdout as the hook's answer; `{}` is \"carry on\" for every event we\n  // register. PreToolUse is not one of them: `{}` there is a deny, so an entry an older\n  // install left behind asks the person instead (core's AG_STALE_PRETOOL, same bytes).\n  if (harness === \"antigravity\") {\n    try {\n      io.stdout(\n        event === \"PreToolUse\"\n          ? '{\"decision\":\"ask\",\"reason\":\"sessionpipe: an outdated PreToolUse hook is still loaded. Restart this conversation (or run sessionpipe install) to drop it.\"}\\n'\n          : \"{}\\n\",\n      );\n    } catch {}\n  }\n\n  const state = stateDir();\n  try {\n    if (!harness || !event) throw new Error(\"usage: hook <harness> <event>\");\n    let stdin = \"\";\n    if (harness !== \"codex\" || event !== \"notify\") {\n      try {\n        const buf = io.stdin();\n        stdin = buf.subarray(0, 1024 * 1024).toString(\"utf8\");\n      } catch {}\n    }\n    // Tool events are the bulk of what a harness fires. When no sink takes tier \u2265 1\n    // they are only a \"still working\" signal: one heartbeat a minute per session.\n    const TOOL = /^(PreToolUse|PostToolUse|PostToolUseFailure|BeforeTool|AfterTool|PostInvocation)$/;\n    if (TOOL.test(event) && !anySinkAbove(0)) {\n      const id = sessionIdOf(stdin);\n      if (!id || !beatDue(id)) return finish(false);\n    }\n    // A Stop asks the daemon BEFORE its event goes to the worker: the worker reports the\n    // Stop to the daemon too, and a message queued for this Stop must be taken here,\n    // not rerouted because the event got there first.\n    const stopAnswer = event === \"Stop\" ? await (controlAsk(stdin) ?? Promise.resolve(null)) : null;\n    mkdirSync(path.join(state, \"jobs\"), { recursive: true, mode: 0o700 });\n    const job = {\n      harness,\n      event,\n      argv: [harness, event, ...rest],\n      stdin,\n      cwd: process.cwd(),\n      env: pick([\n        // Where a harness keeps its config and its sessions, so a job swept by a worker\n        // some other harness's hook spawned still resolves this harness's own homes\n        // (run.ts sweepJobs runs any stale job file, whatever spawned the worker).\n        \"APPDATA\",\n        \"CLAUDE_CODE_HOST_SESSION_ID\",\n        \"CLAUDE_CONFIG_DIR\",\n        \"CLAUDE_PROJECT_DIR\",\n        \"CODEX_HOME\",\n        // Devin's payload names no folder at all; this is the only thing that does.\n        \"DEVIN_PROJECT_DIR\",\n        \"GEMINI_CLI_HOME\",\n        // Devin's config file and session store are both resolved through these.\n        \"XDG_CONFIG_HOME\",\n        \"XDG_DATA_HOME\",\n      ]),\n      ppid: process.ppid,\n      at: Date.now(),\n    };\n    const jobFile = path.join(\n      state,\n      \"jobs\",\n      `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}.json`,\n    );\n    writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });\n    if (!env.SESSIONPIPE_NO_WORKER) {\n      const worker = path.join(path.dirname(fileURLToPath(import.meta.url)), \"worker.js\");\n      const p = spawn(process.execPath, [worker, jobFile], { detached: true, stdio: \"ignore\", windowsHide: true, env });\n      p.unref();\n    }\n    if (stopAnswer) {\n      try {\n        io.stdout(`${stopAnswer}\\n`);\n      } catch {}\n    }\n    // A PermissionRequest waits AFTER its event is on its way, so the receiver already\n    // shows the Allow / Deny this answer is for.\n    const ctl = event === \"PermissionRequest\" ? controlAsk(stdin) : null;\n    if (ctl) {\n      workMs = Number(process.hrtime.bigint() - t0) / 1e6;\n      const out = await ctl;\n      if (out) {\n        try {\n          io.stdout(`${out}\\n`);\n        } catch {}\n      }\n    }\n    return finish(true);\n  } catch {\n    return finish(false); // the hook must be invisible to the harness\n  }\n\n  /** Control (spec/CONTROL.md \u00A76, \u00A79): only on a machine with control paired, and only\n   *  for a message the daemon itself verified. A Stop hook asks for a queued message and\n   *  answers a block with it; a PermissionRequest hook waits for the person's signed\n   *  answer while the terminal shows its own prompt, first answer wins. Anything that\n   *  goes wrong (no daemon, a timeout) prints nothing: the harness carries on as usual. */\n  function controlAsk(stdin: string): Promise<string | null> | null {\n    if (harness !== \"claude-code\" || (event !== \"Stop\" && event !== \"PermissionRequest\")) return null;\n    if (env.SESSIONPIPE_CONTROL_JOB) return null; // a headless turn the daemon itself runs\n    const sock = socketPath(state, env);\n    if (\n      process.platform === \"win32\"\n        ? !existsSync(path.join(path.dirname(configFile()), \"control.json\"))\n        : !existsSync(sock)\n    )\n      return null;\n    let s: Record<string, unknown>;\n    try {\n      s = JSON.parse(stdin) as Record<string, unknown>;\n    } catch {\n      return null;\n    }\n    const id = typeof s.session_id === \"string\" ? s.session_id : \"\";\n    if (!id) return null;\n    // Our entry in ~/.claude/settings.json is run by every harness that imports that file\n    // \u2014 Devin's `claude` hooks provider is live, not a stub \u2014 and it arrives under the\n    // claude-code name. Every Claude Code payload names a transcript and a UUID session;\n    // a payload with neither is somebody else's, and must not be parked for up to 125 s\n    // waiting on an answer that is not coming. Same test as core's notClaudeCode\n    // (claude-code.ts), which the worker applies; repeated here because this file imports\n    // nothing but node builtins.\n    if (typeof s.transcript_path !== \"string\" && !UUID.test(id)) return null;\n    const session = `claude-code:${id}`;\n    if (event === \"Stop\")\n      return ask(sock, { op: \"stop\", session, active: s.stop_hook_active === true }, 300).then((r) =>\n        r?.op === \"block\" ? JSON.stringify({ decision: \"block\", reason: r.reason }) : null,\n      );\n    // The attention id the adapter puts on attention.needed (claude-code.ts), so the\n    // receiver's Allow / Deny names this very prompt.\n    const tool =\n      typeof s.tool_name === \"string\" && /^[A-Za-z0-9_.:-]{1,120}$/.test(s.tool_name) ? s.tool_name : undefined;\n    const turn = typeof s.prompt_id === \"string\" ? s.prompt_id : undefined;\n    const attention = `perm-${createHash(\"sha256\")\n      .update(`${turn ?? \"\"}|${tool ?? \"\"}|${JSON.stringify(s.tool_input ?? null)}`)\n      .digest(\"hex\")\n      .slice(0, 16)}`;\n    return ask(sock, { op: \"permission\", session, attention, ...(tool ? { tool } : {}) }, 125_000).then((r) =>\n      r?.op === \"decision\"\n        ? JSON.stringify({\n            hookSpecificOutput: {\n              hookEventName: \"PermissionRequest\",\n              decision:\n                r.behavior === \"allow\"\n                  ? { behavior: \"allow\" }\n                  : { behavior: \"deny\", message: r.message || \"Denied by the owner (sessionpipe control).\" },\n            },\n          })\n        : null,\n    );\n  }\n\n  /** The timing line; the process exits 0 right after. */\n  function finish(spawned: boolean): void {\n    const total = Number(process.hrtime.bigint() - t0) / 1e6;\n    const ms = workMs ?? total;\n    try {\n      mkdirSync(state, { recursive: true });\n      appendFileSync(\n        path.join(state, \"timing.jsonl\"),\n        `${JSON.stringify({ at: Date.now(), harness, event, ms: Math.round(ms * 10) / 10, spawned, ...(workMs !== null ? { control_wait_ms: Math.round(total - workMs) } : {}) })}\\n`,\n      );\n    } catch {}\n  }\n  function pick(names: string[]): Record<string, string> {\n    const out: Record<string, string> = {};\n    for (const n of names) if (env[n] !== undefined) out[n] = env[n] as string;\n    return out;\n  }\n  function anySinkAbove(tier: number): boolean {\n    try {\n      const c = JSON.parse(readFileSync(configFile(), \"utf8\")) as { sinks?: { tier?: number; paused?: string }[] };\n      return (c.sinks ?? []).some((s) => Number(s.tier) > tier && !s.paused);\n    } catch {\n      return false;\n    }\n  }\n  function sessionIdOf(stdin: string): string {\n    const m = /\"(?:session_id|sessionId|conversationId)\"\\s*:\\s*\"([^\"]{1,128})\"/.exec(stdin);\n    return m?.[1] ?? \"\";\n  }\n  /** One heartbeat per minute per session: the stamp file's mtime is the clock. */\n  function beatDue(id: string): boolean {\n    const stamp = path.join(state, \"beats\", `${harness}-${id.replace(/[^A-Za-z0-9_-]/g, \"_\")}`);\n    try {\n      if (Date.now() - statSync(stamp).mtimeMs < 60_000) return false;\n    } catch {}\n    try {\n      mkdirSync(path.dirname(stamp), { recursive: true, mode: 0o700 });\n      writeFileSync(stamp, \"\", { mode: 0o600 });\n    } catch {}\n    return true;\n  }\n}\n\n// Run as `node hook.js <harness> <event>`; importing this module runs nothing. The main\n// module is known by its real path: node resolves symlinks for import.meta.url, argv[1]\n// keeps the spelling it was given (/var \u2192 /private/var on macOS).\nif (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href)\n  hookMain(process.argv.slice(2), process.env, {\n    // fd 0 and 1 are the test runner's own (a read of 0 would block it); launcher.test.ts\n    // and the bench run these two through the real binary.\n    /* v8 ignore next -- see above */\n    stdin: () => readFileSync(0),\n    /* v8 ignore next -- see above */\n    stdout: (text) => writeFileSync(1, text),\n  }).then(() => process.exit(0));\n", "// SPDX-License-Identifier: Apache-2.0\n// The daemon's local socket (spec/CONTROL.md \u00A78): how the waiter, the Stop and\n// PermissionRequest hooks and the worker talk to the one daemon on this machine.\n// Line-delimited JSON, one request per connection. A Unix socket in the state\n// directory (0600, in a 0700 dir); a per-user named pipe on Windows. Only node:\n// builtins \u2014 the hook bundle imports this.\nimport net from \"node:net\";\nimport os from \"node:os\";\nimport path from \"node:path\";\n\nexport type LocalRequest =\n  /** A waiter parks until a message for its session arrives. */\n  | { op: \"wait\"; session: string; pid?: number }\n  /** A Stop hook asks for a queued message (turn mode). */\n  | { op: \"stop\"; session: string; active: boolean }\n  /** A PermissionRequest hook parks until a verified answer, or until it's released. */\n  | { op: \"permission\"; session: string; attention: string; tool?: string }\n  /** The worker reports a hook event: turn state and attention closure. */\n  | { op: \"event\"; session: string; event: string; transcript?: string; cwd?: string }\n  /** `sessionpipe control status`. */\n  | { op: \"status\" }\n  /** `sessionpipe update` installed a new copy: restart onto it once nothing is in hand. */\n  | { op: \"restart\" };\n\nexport type LocalReply =\n  | { op: \"message\"; text: string; id: string }\n  | { op: \"block\"; reason: string; id: string }\n  | { op: \"decision\"; behavior: \"allow\" | \"deny\"; message?: string; id: string }\n  | { op: \"none\" }\n  /** A newer waiter for the same session took over; this one stops. */\n  | { op: \"replaced\" }\n  | { op: \"ok\" }\n  | { op: \"status\"; status: unknown };\n\n/** Where the daemon listens. `SESSIONPIPE_SOCKET` overrides (tests). */\nexport function socketPath(state: string, env: NodeJS.ProcessEnv = process.env): string {\n  if (env.SESSIONPIPE_SOCKET) return env.SESSIONPIPE_SOCKET;\n  if (process.platform === \"win32\") return `\\\\\\\\.\\\\pipe\\\\sessionpipe-control-${os.userInfo().username}`;\n  return path.join(state, \"control.sock\");\n}\n\n/** One request, one reply. `timeoutMs` bounds the whole exchange; null on any\n *  failure (no daemon, a timeout, a garbled reply) \u2014 callers treat that as \"none\". */\nexport function ask(sock: string, req: LocalRequest, timeoutMs: number): Promise<LocalReply | null> {\n  return new Promise((resolve) => {\n    let buf = \"\";\n    let done = false;\n    const s = net.connect(sock);\n    const finish = (r: LocalReply | null) => {\n      if (done) return;\n      done = true;\n      clearTimeout(t);\n      s.destroy();\n      resolve(r);\n    };\n    const t = setTimeout(() => finish(null), timeoutMs);\n    s.on(\"connect\", () => s.write(`${JSON.stringify(req)}\\n`));\n    s.on(\"data\", (d) => {\n      buf += d.toString(\"utf8\");\n      const i = buf.indexOf(\"\\n\");\n      if (i < 0) return;\n      try {\n        finish(JSON.parse(buf.slice(0, i)) as LocalReply);\n      } catch {\n        finish(null);\n      }\n    });\n    s.on(\"error\", () => finish(null));\n    s.on(\"close\", () => finish(null));\n  });\n}\n"],
-  "mappings": ";;;;AAOA,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB,YAAY,WAAW,cAAc,cAAc,UAAU,qBAAqB;AAC3G,OAAOA,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,eAAe,qBAAqB;;;ACN7C,OAAO,SAAS;AAChB,OAAO,QAAQ;AACf,OAAO,UAAU;AA2BV,SAAS,WAAW,OAAe,MAAyB,QAAQ,KAAa;AACtF,MAAI,IAAI,mBAAoB,QAAO,IAAI;AACvC,MAAI,QAAQ,aAAa,QAAS,QAAO,oCAAoC,GAAG,SAAS,EAAE,QAAQ;AACnG,SAAO,KAAK,KAAK,OAAO,cAAc;AACxC;AAIO,SAAS,IAAI,MAAc,KAAmB,WAA+C;AAClG,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,MAAM;AACV,QAAI,OAAO;AACX,UAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,UAAM,SAAS,CAAC,MAAyB;AACvC,UAAI,KAAM;AACV,aAAO;AACP,mBAAa,CAAC;AACd,QAAE,QAAQ;AACV,cAAQ,CAAC;AAAA,IACX;AACA,UAAM,IAAI,WAAW,MAAM,OAAO,IAAI,GAAG,SAAS;AAClD,MAAE,GAAG,WAAW,MAAM,EAAE,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC;AAAA,CAAI,CAAC;AACzD,MAAE,GAAG,QAAQ,CAAC,MAAM;AAClB,aAAO,EAAE,SAAS,MAAM;AACxB,YAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,UAAI,IAAI,EAAG;AACX,UAAI;AACF,eAAO,KAAK,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,CAAe;AAAA,MAClD,QAAQ;AACN,eAAO,IAAI;AAAA,MACb;AAAA,IACF,CAAC;AACD,MAAE,GAAG,SAAS,MAAM,OAAO,IAAI,CAAC;AAChC,MAAE,GAAG,SAAS,MAAM,OAAO,IAAI,CAAC;AAAA,EAClC,CAAC;AACH;;;ADtDA,IAAM,OAAO;AAWb,eAAsB,SAAS,MAAgB,KAAwB,IAA2B;AAChG,QAAM,KAAK,QAAQ,OAAO,OAAO;AAEjC,MAAI,SAAwB;AAC5B,QAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,GAAG,IAAI,IAAI;AAE5C,WAAS,WAAmB;AAC1B,QAAI,IAAI,kBAAmB,QAAOC,MAAK,QAAQ,IAAI,iBAAiB;AACpE,UAAM,OAAOC,IAAG,QAAQ;AACxB,QAAI,QAAQ,aAAa;AACvB,aAAOD,MAAK,KAAK,IAAI,gBAAgBA,MAAK,KAAK,MAAM,WAAW,OAAO,GAAG,aAAa;AACzF,WAAOA,MAAK,KAAK,IAAI,kBAAkBA,MAAK,KAAK,MAAM,UAAU,OAAO,GAAG,aAAa;AAAA,EAC1F;AACA,WAAS,aAAqB;AAC5B,QAAI,IAAI,mBAAoB,QAAOA,MAAK,QAAQ,IAAI,kBAAkB;AACtE,UAAM,OAAOC,IAAG,QAAQ;AACxB,QAAI,QAAQ,aAAa;AACvB,aAAOD,MAAK,KAAK,IAAI,WAAWA,MAAK,KAAK,MAAM,WAAW,SAAS,GAAG,eAAe,aAAa;AACrG,WAAOA,MAAK,KAAK,IAAI,mBAAmBA,MAAK,KAAK,MAAM,SAAS,GAAG,eAAe,aAAa;AAAA,EAClG;AAKA,MAAI,YAAY,eAAe;AAC7B,QAAI;AACF,SAAG;AAAA,QACD,UAAU,eACN,iKACA;AAAA,MACN;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,SAAS;AACvB,MAAI;AACF,QAAI,CAAC,WAAW,CAAC,MAAO,OAAM,IAAI,MAAM,+BAA+B;AACvE,QAAI,QAAQ;AACZ,QAAI,YAAY,WAAW,UAAU,UAAU;AAC7C,UAAI;AACF,cAAM,MAAM,GAAG,MAAM;AACrB,gBAAQ,IAAI,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,MAAM;AAAA,MACtD,QAAQ;AAAA,MAAC;AAAA,IACX;AAGA,UAAM,OAAO;AACb,QAAI,KAAK,KAAK,KAAK,KAAK,CAAC,aAAa,CAAC,GAAG;AACxC,YAAM,KAAK,YAAY,KAAK;AAC5B,UAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAG,QAAO,OAAO,KAAK;AAAA,IAC9C;AAIA,UAAM,aAAa,UAAU,SAAS,OAAO,WAAW,KAAK,KAAK,QAAQ,QAAQ,IAAI,KAAK;AAC3F,cAAUA,MAAK,KAAK,OAAO,MAAM,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpE,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,MACA,MAAM,CAAC,SAAS,OAAO,GAAG,IAAI;AAAA,MAC9B;AAAA,MACA,KAAK,QAAQ,IAAI;AAAA,MACjB,KAAK,KAAK;AAAA;AAAA;AAAA;AAAA,QAIR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA;AAAA,QACA;AAAA;AAAA,QAEA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,MAAM,QAAQ;AAAA,MACd,IAAI,KAAK,IAAI;AAAA,IACf;AACA,UAAM,UAAUA,MAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IACtE;AACA,kBAAc,SAAS,KAAK,UAAU,GAAG,GAAG,EAAE,MAAM,IAAM,CAAC;AAC3D,QAAI,CAAC,IAAI,uBAAuB;AAC9B,YAAM,SAASA,MAAK,KAAKA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,WAAW;AAClF,YAAM,IAAI,MAAM,QAAQ,UAAU,CAAC,QAAQ,OAAO,GAAG,EAAE,UAAU,MAAM,OAAO,UAAU,aAAa,MAAM,IAAI,CAAC;AAChH,QAAE,MAAM;AAAA,IACV;AACA,QAAI,YAAY;AACd,UAAI;AACF,WAAG,OAAO,GAAG,UAAU;AAAA,CAAI;AAAA,MAC7B,QAAQ;AAAA,MAAC;AAAA,IACX;AAGA,UAAM,MAAM,UAAU,sBAAsB,WAAW,KAAK,IAAI;AAChE,QAAI,KAAK;AACP,eAAS,OAAO,QAAQ,OAAO,OAAO,IAAI,EAAE,IAAI;AAChD,YAAM,MAAM,MAAM;AAClB,UAAI,KAAK;AACP,YAAI;AACF,aAAG,OAAO,GAAG,GAAG;AAAA,CAAI;AAAA,QACtB,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AAOA,WAAS,WAAW,OAA8C;AAChE,QAAI,YAAY,iBAAkB,UAAU,UAAU,UAAU,oBAAsB,QAAO;AAC7F,QAAI,IAAI,wBAAyB,QAAO;AACxC,UAAM,OAAO,WAAW,OAAO,GAAG;AAClC,QACE,QAAQ,aAAa,UACjB,CAAC,WAAWA,MAAK,KAAKA,MAAK,QAAQ,WAAW,CAAC,GAAG,cAAc,CAAC,IACjE,CAAC,WAAW,IAAI;AAEpB,aAAO;AACT,QAAI;AACJ,QAAI;AACF,UAAI,KAAK,MAAM,KAAK;AAAA,IACtB,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,KAAK,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAC7D,QAAI,CAAC,GAAI,QAAO;AAQhB,QAAI,OAAO,EAAE,oBAAoB,YAAY,CAAC,KAAK,KAAK,EAAE,EAAG,QAAO;AACpE,UAAM,UAAU,eAAe,EAAE;AACjC,QAAI,UAAU;AACZ,aAAO,IAAI,MAAM,EAAE,IAAI,QAAQ,SAAS,QAAQ,EAAE,qBAAqB,KAAK,GAAG,GAAG,EAAE;AAAA,QAAK,CAAC,MACxF,GAAG,OAAO,UAAU,KAAK,UAAU,EAAE,UAAU,SAAS,QAAQ,EAAE,OAAO,CAAC,IAAI;AAAA,MAChF;AAGF,UAAM,OACJ,OAAO,EAAE,cAAc,YAAY,2BAA2B,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY;AAClG,UAAM,OAAO,OAAO,EAAE,cAAc,WAAW,EAAE,YAAY;AAC7D,UAAM,YAAY,QAAQ,WAAW,QAAQ,EAC1C,OAAO,GAAG,QAAQ,EAAE,IAAI,QAAQ,EAAE,IAAI,KAAK,UAAU,EAAE,cAAc,IAAI,CAAC,EAAE,EAC5E,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE,CAAC;AACf,WAAO,IAAI,MAAM,EAAE,IAAI,cAAc,SAAS,WAAW,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,GAAG,KAAO,EAAE;AAAA,MAAK,CAAC,MACnG,GAAG,OAAO,aACN,KAAK,UAAU;AAAA,QACb,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,UACE,EAAE,aAAa,UACX,EAAE,UAAU,QAAQ,IACpB,EAAE,UAAU,QAAQ,SAAS,EAAE,WAAW,6CAA6C;AAAA,QAC/F;AAAA,MACF,CAAC,IACD;AAAA,IACN;AAAA,EACF;AAGA,WAAS,OAAO,SAAwB;AACtC,UAAM,QAAQ,OAAO,QAAQ,OAAO,OAAO,IAAI,EAAE,IAAI;AACrD,UAAM,KAAK,UAAU;AACrB,QAAI;AACF,gBAAU,OAAO,EAAE,WAAW,KAAK,CAAC;AACpC;AAAA,QACEA,MAAK,KAAK,OAAO,cAAc;AAAA,QAC/B,GAAG,KAAK,UAAU,EAAE,IAAI,KAAK,IAAI,GAAG,SAAS,OAAO,IAAI,KAAK,MAAM,KAAK,EAAE,IAAI,IAAI,SAAS,GAAI,WAAW,OAAO,EAAE,iBAAiB,KAAK,MAAM,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,CAAC;AAAA;AAAA,MAC3K;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,WAAS,KAAK,OAAyC;AACrD,UAAM,MAA8B,CAAC;AACrC,eAAW,KAAK,MAAO,KAAI,IAAI,CAAC,MAAM,OAAW,KAAI,CAAC,IAAI,IAAI,CAAC;AAC/D,WAAO;AAAA,EACT;AACA,WAAS,aAAa,MAAuB;AAC3C,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,aAAa,WAAW,GAAG,MAAM,CAAC;AACvD,cAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC,EAAE,MAAM;AAAA,IACvE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,WAAS,YAAY,OAAuB;AAC1C,UAAM,IAAI,kEAAkE,KAAK,KAAK;AACtF,WAAO,IAAI,CAAC,KAAK;AAAA,EACnB;AAEA,WAAS,QAAQ,IAAqB;AACpC,UAAM,QAAQA,MAAK,KAAK,OAAO,SAAS,GAAG,OAAO,IAAI,GAAG,QAAQ,mBAAmB,GAAG,CAAC,EAAE;AAC1F,QAAI;AACF,UAAI,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,UAAU,IAAQ,QAAO;AAAA,IAC5D,QAAQ;AAAA,IAAC;AACT,QAAI;AACF,gBAAUA,MAAK,QAAQ,KAAK,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC/D,oBAAc,OAAO,IAAI,EAAE,MAAM,IAAM,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACF;AAKA,IAAI,QAAQ,KAAK,CAAC,KAAK,YAAY,QAAQ,cAAc,aAAa,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE;AACtF,WAAS,QAAQ,KAAK,MAAM,CAAC,GAAG,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,IAI3C,OAAO,MAAM,aAAa,CAAC;AAAA;AAAA,IAE3B,QAAQ,CAAC,SAAS,cAAc,GAAG,IAAI;AAAA,EACzC,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC;",
+  "sourcesContent": ["#!/usr/bin/env node\n// SPDX-License-Identifier: Apache-2.0\n// The hook path. A harness runs `node hook.js <harness> <event>`; this reads stdin,\n// writes one job file, spawns the worker detached, prints what the harness needs\n// (Antigravity's answer) and exits 0 \u2014 in milliseconds, with nothing but node:\n// builtins imported (the build checks that). No network, no schema library, no\n// config parsing beyond one small file read for the throttle.\nimport { spawn } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { ask, socketPath } from \"./control/local.js\";\n\n/** A Claude Code session id (the same test as core's notClaudeCode). */\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** The two streams the hook touches: stdin once, whole; stdout for an answer. */\nexport interface HookIO {\n  stdin(): Buffer;\n  stdout(text: string): void;\n}\n\n/** One hook run: `argv` is [harness, event, ...] as the harness invoked it, `env` the\n *  process environment. Resolves once the job is on its way and any answer printed;\n *  the process then exits 0, whatever happened (the hook is invisible to the harness). */\nexport async function hookMain(argv: string[], env: NodeJS.ProcessEnv, io: HookIO): Promise<void> {\n  const t0 = process.hrtime.bigint();\n  /** The hook's own work, when a control wait follows it (the wait is not the hook's cost). */\n  let workMs: number | null = null;\n  const [harness = \"\", event = \"\", ...rest] = argv;\n\n  function stateDir(): string {\n    if (env.SESSIONPIPE_STATE) return path.resolve(env.SESSIONPIPE_STATE);\n    const home = os.homedir();\n    if (process.platform === \"win32\")\n      return path.join(env.LOCALAPPDATA || path.join(home, \"AppData\", \"Local\"), \"sessionpipe\");\n    return path.join(env.XDG_STATE_HOME || path.join(home, \".local\", \"state\"), \"sessionpipe\");\n  }\n  function configFile(): string {\n    if (env.SESSIONPIPE_CONFIG) return path.resolve(env.SESSIONPIPE_CONFIG);\n    const home = os.homedir();\n    if (process.platform === \"win32\")\n      return path.join(env.APPDATA || path.join(home, \"AppData\", \"Roaming\"), \"sessionpipe\", \"config.json\");\n    return path.join(env.XDG_CONFIG_HOME || path.join(home, \".config\"), \"sessionpipe\", \"config.json\");\n  }\n\n  // Antigravity parses stdout as the hook's answer; `{}` is \"carry on\" for every event we\n  // register. PreToolUse is not one of them: `{}` there is a deny, so an entry an older\n  // install left behind asks the person instead (core's AG_STALE_PRETOOL, same bytes).\n  if (harness === \"antigravity\") {\n    try {\n      io.stdout(\n        event === \"PreToolUse\"\n          ? '{\"decision\":\"ask\",\"reason\":\"sessionpipe: an outdated PreToolUse hook is still loaded. Restart this conversation (or run sessionpipe install) to drop it.\"}\\n'\n          : \"{}\\n\",\n      );\n    } catch {}\n  }\n\n  const state = stateDir();\n  try {\n    if (!harness || !event) throw new Error(\"usage: hook <harness> <event>\");\n    let stdin = \"\";\n    if (harness !== \"codex\" || event !== \"notify\") {\n      try {\n        const buf = io.stdin();\n        stdin = buf.subarray(0, 1024 * 1024).toString(\"utf8\");\n      } catch {}\n    }\n    // Tool events are the bulk of what a harness fires. When no sink takes tier \u2265 1\n    // they are only a \"still working\" signal: one heartbeat a minute per session.\n    const TOOL = /^(PreToolUse|PostToolUse|PostToolUseFailure|BeforeTool|AfterTool|PostInvocation)$/;\n    if (TOOL.test(event) && !anySinkAbove(0)) {\n      const id = sessionIdOf(stdin);\n      if (!id || !beatDue(id)) return finish(false);\n    }\n    // A Stop asks the daemon BEFORE its event goes to the worker: the worker reports the\n    // Stop to the daemon too, and a message queued for this Stop must be taken here,\n    // not rerouted because the event got there first.\n    const stopAnswer = event === \"Stop\" ? await (controlAsk(stdin) ?? Promise.resolve(null)) : null;\n    mkdirSync(path.join(state, \"jobs\"), { recursive: true, mode: 0o700 });\n    const job = {\n      harness,\n      event,\n      argv: [harness, event, ...rest],\n      stdin,\n      cwd: process.cwd(),\n      env: pick([\n        // Where a harness keeps its config and its sessions, so a job swept by a worker\n        // some other harness's hook spawned still resolves this harness's own homes\n        // (run.ts sweepJobs runs any stale job file, whatever spawned the worker).\n        \"APPDATA\",\n        \"CLAUDE_CODE_HOST_SESSION_ID\",\n        // session.attended: Claude Code's own word, and SESSIONPIPE_CONTROL_JOB below, the\n        // control daemon's mark on a turn it runs for a person's message.\n        \"CLAUDE_CODE_SESSION_ATTENDED\",\n        \"CLAUDE_CONFIG_DIR\",\n        \"CLAUDE_PROJECT_DIR\",\n        \"CODEX_HOME\",\n        // Devin's payload names no folder at all; this is the only thing that does.\n        \"DEVIN_PROJECT_DIR\",\n        \"GEMINI_CLI_HOME\",\n        \"SESSIONPIPE_CONTROL_JOB\",\n        // The launcher a script named for a session it starts (PROTOCOL.md \u00A73 launched_by).\n        \"SESSIONPIPE_LAUNCHED_BY\",\n        // Devin's config file and session store are both resolved through these.\n        \"XDG_CONFIG_HOME\",\n        \"XDG_DATA_HOME\",\n      ]),\n      ppid: process.ppid,\n      at: Date.now(),\n    };\n    const jobFile = path.join(\n      state,\n      \"jobs\",\n      `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}.json`,\n    );\n    writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });\n    if (!env.SESSIONPIPE_NO_WORKER) {\n      const worker = path.join(path.dirname(fileURLToPath(import.meta.url)), \"worker.js\");\n      const p = spawn(process.execPath, [worker, jobFile], { detached: true, stdio: \"ignore\", windowsHide: true, env });\n      p.unref();\n    }\n    if (stopAnswer) {\n      try {\n        io.stdout(`${stopAnswer}\\n`);\n      } catch {}\n    }\n    // A PermissionRequest waits AFTER its event is on its way, so the receiver already\n    // shows the Allow / Deny this answer is for.\n    const ctl = event === \"PermissionRequest\" ? controlAsk(stdin) : null;\n    if (ctl) {\n      workMs = Number(process.hrtime.bigint() - t0) / 1e6;\n      const out = await ctl;\n      if (out) {\n        try {\n          io.stdout(`${out}\\n`);\n        } catch {}\n      }\n    }\n    return finish(true);\n  } catch {\n    return finish(false); // the hook must be invisible to the harness\n  }\n\n  /** Control (spec/CONTROL.md \u00A76, \u00A79): only on a machine with control paired, and only\n   *  for a message the daemon itself verified. A Stop hook asks for a queued message and\n   *  answers a block with it; a PermissionRequest hook waits for the person's signed\n   *  answer while the terminal shows its own prompt, first answer wins. Anything that\n   *  goes wrong (no daemon, a timeout) prints nothing: the harness carries on as usual. */\n  function controlAsk(stdin: string): Promise<string | null> | null {\n    if (harness !== \"claude-code\" || (event !== \"Stop\" && event !== \"PermissionRequest\")) return null;\n    if (env.SESSIONPIPE_CONTROL_JOB) return null; // a headless turn the daemon itself runs\n    const sock = socketPath(state, env);\n    if (\n      process.platform === \"win32\"\n        ? !existsSync(path.join(path.dirname(configFile()), \"control.json\"))\n        : !existsSync(sock)\n    )\n      return null;\n    let s: Record<string, unknown>;\n    try {\n      s = JSON.parse(stdin) as Record<string, unknown>;\n    } catch {\n      return null;\n    }\n    const id = typeof s.session_id === \"string\" ? s.session_id : \"\";\n    if (!id) return null;\n    // Our entry in ~/.claude/settings.json is run by every harness that imports that file\n    // \u2014 Devin's `claude` hooks provider is live, not a stub \u2014 and it arrives under the\n    // claude-code name. Every Claude Code payload names a transcript and a UUID session;\n    // a payload with neither is somebody else's, and must not be parked for up to 125 s\n    // waiting on an answer that is not coming. Same test as core's notClaudeCode\n    // (claude-code.ts), which the worker applies; repeated here because this file imports\n    // nothing but node builtins.\n    if (typeof s.transcript_path !== \"string\" && !UUID.test(id)) return null;\n    const session = `claude-code:${id}`;\n    if (event === \"Stop\")\n      return ask(sock, { op: \"stop\", session, active: s.stop_hook_active === true }, 300).then((r) =>\n        r?.op === \"block\" ? JSON.stringify({ decision: \"block\", reason: r.reason }) : null,\n      );\n    // The attention id the adapter puts on attention.needed (claude-code.ts), so the\n    // receiver's Allow / Deny names this very prompt.\n    const tool =\n      typeof s.tool_name === \"string\" && /^[A-Za-z0-9_.:-]{1,120}$/.test(s.tool_name) ? s.tool_name : undefined;\n    const turn = typeof s.prompt_id === \"string\" ? s.prompt_id : undefined;\n    const attention = `perm-${createHash(\"sha256\")\n      .update(`${turn ?? \"\"}|${tool ?? \"\"}|${JSON.stringify(s.tool_input ?? null)}`)\n      .digest(\"hex\")\n      .slice(0, 16)}`;\n    return ask(sock, { op: \"permission\", session, attention, ...(tool ? { tool } : {}) }, 125_000).then((r) =>\n      r?.op === \"decision\"\n        ? JSON.stringify({\n            hookSpecificOutput: {\n              hookEventName: \"PermissionRequest\",\n              decision:\n                r.behavior === \"allow\"\n                  ? { behavior: \"allow\" }\n                  : { behavior: \"deny\", message: r.message || \"Denied by the owner (sessionpipe control).\" },\n            },\n          })\n        : null,\n    );\n  }\n\n  /** The timing line; the process exits 0 right after. */\n  function finish(spawned: boolean): void {\n    const total = Number(process.hrtime.bigint() - t0) / 1e6;\n    const ms = workMs ?? total;\n    try {\n      mkdirSync(state, { recursive: true });\n      appendFileSync(\n        path.join(state, \"timing.jsonl\"),\n        `${JSON.stringify({ at: Date.now(), harness, event, ms: Math.round(ms * 10) / 10, spawned, ...(workMs !== null ? { control_wait_ms: Math.round(total - workMs) } : {}) })}\\n`,\n      );\n    } catch {}\n  }\n  function pick(names: string[]): Record<string, string> {\n    const out: Record<string, string> = {};\n    for (const n of names) if (env[n] !== undefined) out[n] = env[n] as string;\n    return out;\n  }\n  function anySinkAbove(tier: number): boolean {\n    try {\n      const c = JSON.parse(readFileSync(configFile(), \"utf8\")) as { sinks?: { tier?: number; paused?: string }[] };\n      return (c.sinks ?? []).some((s) => Number(s.tier) > tier && !s.paused);\n    } catch {\n      return false;\n    }\n  }\n  function sessionIdOf(stdin: string): string {\n    const m = /\"(?:session_id|sessionId|conversationId)\"\\s*:\\s*\"([^\"]{1,128})\"/.exec(stdin);\n    return m?.[1] ?? \"\";\n  }\n  /** One heartbeat per minute per session: the stamp file's mtime is the clock. */\n  function beatDue(id: string): boolean {\n    const stamp = path.join(state, \"beats\", `${harness}-${id.replace(/[^A-Za-z0-9_-]/g, \"_\")}`);\n    try {\n      if (Date.now() - statSync(stamp).mtimeMs < 60_000) return false;\n    } catch {}\n    try {\n      mkdirSync(path.dirname(stamp), { recursive: true, mode: 0o700 });\n      writeFileSync(stamp, \"\", { mode: 0o600 });\n    } catch {}\n    return true;\n  }\n}\n\n// Run as `node hook.js <harness> <event>`; importing this module runs nothing. The main\n// module is known by its real path: node resolves symlinks for import.meta.url, argv[1]\n// keeps the spelling it was given (/var \u2192 /private/var on macOS).\nif (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href)\n  hookMain(process.argv.slice(2), process.env, {\n    // fd 0 and 1 are the test runner's own (a read of 0 would block it); launcher.test.ts\n    // and the bench run these two through the real binary.\n    /* v8 ignore next -- see above */\n    stdin: () => readFileSync(0),\n    /* v8 ignore next -- see above */\n    stdout: (text) => writeFileSync(1, text),\n  }).then(() => process.exit(0));\n", "// SPDX-License-Identifier: Apache-2.0\n// The daemon's local socket (spec/CONTROL.md \u00A78): how the waiter, the Stop and\n// PermissionRequest hooks and the worker talk to the one daemon on this machine.\n// Line-delimited JSON, one request per connection. A Unix socket in the state\n// directory (0600, in a 0700 dir); a per-user named pipe on Windows. Only node:\n// builtins \u2014 the hook bundle imports this.\nimport net from \"node:net\";\nimport os from \"node:os\";\nimport path from \"node:path\";\n\nexport type LocalRequest =\n  /** A waiter parks until a message for its session arrives. */\n  | { op: \"wait\"; session: string; pid?: number }\n  /** A Stop hook asks for a queued message (turn mode). */\n  | { op: \"stop\"; session: string; active: boolean }\n  /** A PermissionRequest hook parks until a verified answer, or until it's released. */\n  | { op: \"permission\"; session: string; attention: string; tool?: string }\n  /** The worker reports a hook event: turn state and attention closure. */\n  | { op: \"event\"; session: string; event: string; transcript?: string; cwd?: string }\n  /** `sessionpipe control status`. */\n  | { op: \"status\" }\n  /** `sessionpipe update` installed a new copy: restart onto it once nothing is in hand. */\n  | { op: \"restart\" };\n\nexport type LocalReply =\n  | { op: \"message\"; text: string; id: string }\n  | { op: \"block\"; reason: string; id: string }\n  | { op: \"decision\"; behavior: \"allow\" | \"deny\"; message?: string; id: string }\n  | { op: \"none\" }\n  /** A newer waiter for the same session took over; this one stops. */\n  | { op: \"replaced\" }\n  | { op: \"ok\" }\n  | { op: \"status\"; status: unknown };\n\n/** Where the daemon listens. `SESSIONPIPE_SOCKET` overrides (tests). */\nexport function socketPath(state: string, env: NodeJS.ProcessEnv = process.env): string {\n  if (env.SESSIONPIPE_SOCKET) return env.SESSIONPIPE_SOCKET;\n  if (process.platform === \"win32\") return `\\\\\\\\.\\\\pipe\\\\sessionpipe-control-${os.userInfo().username}`;\n  return path.join(state, \"control.sock\");\n}\n\n/** One request, one reply. `timeoutMs` bounds the whole exchange; null on any\n *  failure (no daemon, a timeout, a garbled reply) \u2014 callers treat that as \"none\". */\nexport function ask(sock: string, req: LocalRequest, timeoutMs: number): Promise<LocalReply | null> {\n  return new Promise((resolve) => {\n    let buf = \"\";\n    let done = false;\n    const s = net.connect(sock);\n    const finish = (r: LocalReply | null) => {\n      if (done) return;\n      done = true;\n      clearTimeout(t);\n      s.destroy();\n      resolve(r);\n    };\n    const t = setTimeout(() => finish(null), timeoutMs);\n    s.on(\"connect\", () => s.write(`${JSON.stringify(req)}\\n`));\n    s.on(\"data\", (d) => {\n      buf += d.toString(\"utf8\");\n      const i = buf.indexOf(\"\\n\");\n      if (i < 0) return;\n      try {\n        finish(JSON.parse(buf.slice(0, i)) as LocalReply);\n      } catch {\n        finish(null);\n      }\n    });\n    s.on(\"error\", () => finish(null));\n    s.on(\"close\", () => finish(null));\n  });\n}\n"],
+  "mappings": ";;;;AAOA,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB,YAAY,WAAW,cAAc,cAAc,UAAU,qBAAqB;AAC3G,OAAOA,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,eAAe,qBAAqB;;;ACN7C,OAAO,SAAS;AAChB,OAAO,QAAQ;AACf,OAAO,UAAU;AA2BV,SAAS,WAAW,OAAe,MAAyB,QAAQ,KAAa;AACtF,MAAI,IAAI,mBAAoB,QAAO,IAAI;AACvC,MAAI,QAAQ,aAAa,QAAS,QAAO,oCAAoC,GAAG,SAAS,EAAE,QAAQ;AACnG,SAAO,KAAK,KAAK,OAAO,cAAc;AACxC;AAIO,SAAS,IAAI,MAAc,KAAmB,WAA+C;AAClG,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,MAAM;AACV,QAAI,OAAO;AACX,UAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,UAAM,SAAS,CAAC,MAAyB;AACvC,UAAI,KAAM;AACV,aAAO;AACP,mBAAa,CAAC;AACd,QAAE,QAAQ;AACV,cAAQ,CAAC;AAAA,IACX;AACA,UAAM,IAAI,WAAW,MAAM,OAAO,IAAI,GAAG,SAAS;AAClD,MAAE,GAAG,WAAW,MAAM,EAAE,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC;AAAA,CAAI,CAAC;AACzD,MAAE,GAAG,QAAQ,CAAC,MAAM;AAClB,aAAO,EAAE,SAAS,MAAM;AACxB,YAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,UAAI,IAAI,EAAG;AACX,UAAI;AACF,eAAO,KAAK,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,CAAe;AAAA,MAClD,QAAQ;AACN,eAAO,IAAI;AAAA,MACb;AAAA,IACF,CAAC;AACD,MAAE,GAAG,SAAS,MAAM,OAAO,IAAI,CAAC;AAChC,MAAE,GAAG,SAAS,MAAM,OAAO,IAAI,CAAC;AAAA,EAClC,CAAC;AACH;;;ADtDA,IAAM,OAAO;AAWb,eAAsB,SAAS,MAAgB,KAAwB,IAA2B;AAChG,QAAM,KAAK,QAAQ,OAAO,OAAO;AAEjC,MAAI,SAAwB;AAC5B,QAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,GAAG,IAAI,IAAI;AAE5C,WAAS,WAAmB;AAC1B,QAAI,IAAI,kBAAmB,QAAOC,MAAK,QAAQ,IAAI,iBAAiB;AACpE,UAAM,OAAOC,IAAG,QAAQ;AACxB,QAAI,QAAQ,aAAa;AACvB,aAAOD,MAAK,KAAK,IAAI,gBAAgBA,MAAK,KAAK,MAAM,WAAW,OAAO,GAAG,aAAa;AACzF,WAAOA,MAAK,KAAK,IAAI,kBAAkBA,MAAK,KAAK,MAAM,UAAU,OAAO,GAAG,aAAa;AAAA,EAC1F;AACA,WAAS,aAAqB;AAC5B,QAAI,IAAI,mBAAoB,QAAOA,MAAK,QAAQ,IAAI,kBAAkB;AACtE,UAAM,OAAOC,IAAG,QAAQ;AACxB,QAAI,QAAQ,aAAa;AACvB,aAAOD,MAAK,KAAK,IAAI,WAAWA,MAAK,KAAK,MAAM,WAAW,SAAS,GAAG,eAAe,aAAa;AACrG,WAAOA,MAAK,KAAK,IAAI,mBAAmBA,MAAK,KAAK,MAAM,SAAS,GAAG,eAAe,aAAa;AAAA,EAClG;AAKA,MAAI,YAAY,eAAe;AAC7B,QAAI;AACF,SAAG;AAAA,QACD,UAAU,eACN,iKACA;AAAA,MACN;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,SAAS;AACvB,MAAI;AACF,QAAI,CAAC,WAAW,CAAC,MAAO,OAAM,IAAI,MAAM,+BAA+B;AACvE,QAAI,QAAQ;AACZ,QAAI,YAAY,WAAW,UAAU,UAAU;AAC7C,UAAI;AACF,cAAM,MAAM,GAAG,MAAM;AACrB,gBAAQ,IAAI,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,MAAM;AAAA,MACtD,QAAQ;AAAA,MAAC;AAAA,IACX;AAGA,UAAM,OAAO;AACb,QAAI,KAAK,KAAK,KAAK,KAAK,CAAC,aAAa,CAAC,GAAG;AACxC,YAAM,KAAK,YAAY,KAAK;AAC5B,UAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAG,QAAO,OAAO,KAAK;AAAA,IAC9C;AAIA,UAAM,aAAa,UAAU,SAAS,OAAO,WAAW,KAAK,KAAK,QAAQ,QAAQ,IAAI,KAAK;AAC3F,cAAUA,MAAK,KAAK,OAAO,MAAM,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpE,UAAM,MAAM;AAAA,MACV;AAAA,MACA;AAAA,MACA,MAAM,CAAC,SAAS,OAAO,GAAG,IAAI;AAAA,MAC9B;AAAA,MACA,KAAK,QAAQ,IAAI;AAAA,MACjB,KAAK,KAAK;AAAA;AAAA;AAAA;AAAA,QAIR;AAAA,QACA;AAAA;AAAA;AAAA,QAGA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA;AAAA;AAAA,QAEA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,MAAM,QAAQ;AAAA,MACd,IAAI,KAAK,IAAI;AAAA,IACf;AACA,UAAM,UAAUA,MAAK;AAAA,MACnB;AAAA,MACA;AAAA,MACA,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IACtE;AACA,kBAAc,SAAS,KAAK,UAAU,GAAG,GAAG,EAAE,MAAM,IAAM,CAAC;AAC3D,QAAI,CAAC,IAAI,uBAAuB;AAC9B,YAAM,SAASA,MAAK,KAAKA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,WAAW;AAClF,YAAM,IAAI,MAAM,QAAQ,UAAU,CAAC,QAAQ,OAAO,GAAG,EAAE,UAAU,MAAM,OAAO,UAAU,aAAa,MAAM,IAAI,CAAC;AAChH,QAAE,MAAM;AAAA,IACV;AACA,QAAI,YAAY;AACd,UAAI;AACF,WAAG,OAAO,GAAG,UAAU;AAAA,CAAI;AAAA,MAC7B,QAAQ;AAAA,MAAC;AAAA,IACX;AAGA,UAAM,MAAM,UAAU,sBAAsB,WAAW,KAAK,IAAI;AAChE,QAAI,KAAK;AACP,eAAS,OAAO,QAAQ,OAAO,OAAO,IAAI,EAAE,IAAI;AAChD,YAAM,MAAM,MAAM;AAClB,UAAI,KAAK;AACP,YAAI;AACF,aAAG,OAAO,GAAG,GAAG;AAAA,CAAI;AAAA,QACtB,QAAQ;AAAA,QAAC;AAAA,MACX;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AAOA,WAAS,WAAW,OAA8C;AAChE,QAAI,YAAY,iBAAkB,UAAU,UAAU,UAAU,oBAAsB,QAAO;AAC7F,QAAI,IAAI,wBAAyB,QAAO;AACxC,UAAM,OAAO,WAAW,OAAO,GAAG;AAClC,QACE,QAAQ,aAAa,UACjB,CAAC,WAAWA,MAAK,KAAKA,MAAK,QAAQ,WAAW,CAAC,GAAG,cAAc,CAAC,IACjE,CAAC,WAAW,IAAI;AAEpB,aAAO;AACT,QAAI;AACJ,QAAI;AACF,UAAI,KAAK,MAAM,KAAK;AAAA,IACtB,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,KAAK,OAAO,EAAE,eAAe,WAAW,EAAE,aAAa;AAC7D,QAAI,CAAC,GAAI,QAAO;AAQhB,QAAI,OAAO,EAAE,oBAAoB,YAAY,CAAC,KAAK,KAAK,EAAE,EAAG,QAAO;AACpE,UAAM,UAAU,eAAe,EAAE;AACjC,QAAI,UAAU;AACZ,aAAO,IAAI,MAAM,EAAE,IAAI,QAAQ,SAAS,QAAQ,EAAE,qBAAqB,KAAK,GAAG,GAAG,EAAE;AAAA,QAAK,CAAC,MACxF,GAAG,OAAO,UAAU,KAAK,UAAU,EAAE,UAAU,SAAS,QAAQ,EAAE,OAAO,CAAC,IAAI;AAAA,MAChF;AAGF,UAAM,OACJ,OAAO,EAAE,cAAc,YAAY,2BAA2B,KAAK,EAAE,SAAS,IAAI,EAAE,YAAY;AAClG,UAAM,OAAO,OAAO,EAAE,cAAc,WAAW,EAAE,YAAY;AAC7D,UAAM,YAAY,QAAQ,WAAW,QAAQ,EAC1C,OAAO,GAAG,QAAQ,EAAE,IAAI,QAAQ,EAAE,IAAI,KAAK,UAAU,EAAE,cAAc,IAAI,CAAC,EAAE,EAC5E,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE,CAAC;AACf,WAAO,IAAI,MAAM,EAAE,IAAI,cAAc,SAAS,WAAW,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,GAAG,KAAO,EAAE;AAAA,MAAK,CAAC,MACnG,GAAG,OAAO,aACN,KAAK,UAAU;AAAA,QACb,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,UACE,EAAE,aAAa,UACX,EAAE,UAAU,QAAQ,IACpB,EAAE,UAAU,QAAQ,SAAS,EAAE,WAAW,6CAA6C;AAAA,QAC/F;AAAA,MACF,CAAC,IACD;AAAA,IACN;AAAA,EACF;AAGA,WAAS,OAAO,SAAwB;AACtC,UAAM,QAAQ,OAAO,QAAQ,OAAO,OAAO,IAAI,EAAE,IAAI;AACrD,UAAM,KAAK,UAAU;AACrB,QAAI;AACF,gBAAU,OAAO,EAAE,WAAW,KAAK,CAAC;AACpC;AAAA,QACEA,MAAK,KAAK,OAAO,cAAc;AAAA,QAC/B,GAAG,KAAK,UAAU,EAAE,IAAI,KAAK,IAAI,GAAG,SAAS,OAAO,IAAI,KAAK,MAAM,KAAK,EAAE,IAAI,IAAI,SAAS,GAAI,WAAW,OAAO,EAAE,iBAAiB,KAAK,MAAM,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,CAAC;AAAA;AAAA,MAC3K;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,WAAS,KAAK,OAAyC;AACrD,UAAM,MAA8B,CAAC;AACrC,eAAW,KAAK,MAAO,KAAI,IAAI,CAAC,MAAM,OAAW,KAAI,CAAC,IAAI,IAAI,CAAC;AAC/D,WAAO;AAAA,EACT;AACA,WAAS,aAAa,MAAuB;AAC3C,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,aAAa,WAAW,GAAG,MAAM,CAAC;AACvD,cAAQ,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,OAAO,EAAE,IAAI,IAAI,QAAQ,CAAC,EAAE,MAAM;AAAA,IACvE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,WAAS,YAAY,OAAuB;AAC1C,UAAM,IAAI,kEAAkE,KAAK,KAAK;AACtF,WAAO,IAAI,CAAC,KAAK;AAAA,EACnB;AAEA,WAAS,QAAQ,IAAqB;AACpC,UAAM,QAAQA,MAAK,KAAK,OAAO,SAAS,GAAG,OAAO,IAAI,GAAG,QAAQ,mBAAmB,GAAG,CAAC,EAAE;AAC1F,QAAI;AACF,UAAI,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,UAAU,IAAQ,QAAO;AAAA,IAC5D,QAAQ;AAAA,IAAC;AACT,QAAI;AACF,gBAAUA,MAAK,QAAQ,KAAK,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC/D,oBAAc,OAAO,IAAI,EAAE,MAAM,IAAM,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACF;AAKA,IAAI,QAAQ,KAAK,CAAC,KAAK,YAAY,QAAQ,cAAc,aAAa,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE;AACtF,WAAS,QAAQ,KAAK,MAAM,CAAC,GAAG,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,IAI3C,OAAO,MAAM,aAAa,CAAC;AAAA;AAAA,IAE3B,QAAQ,CAAC,SAAS,cAAc,GAAG,IAAI;AAAA,EACzC,CAAC,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC;",
   "names": ["os", "path", "path", "os"]
 }

package/dist/index.js

@@ -1,4 +1,4 @@
-// sessionpipe 0.9.0 · Apache-2.0 · https://sessionpipe.org
+// sessionpipe 0.10.0 · Apache-2.0 · https://sessionpipe.org
 
 // src/http-sink.ts
 import { createHash, createHmac } from "node:crypto";
@@ -924,14 +924,28 @@ var claudeCode = {
       case "SessionStart":
         events.push(ev("session.started", { source: pickSource(s.source ?? s.trigger) }));
         break;
-      case "UserPromptSubmit":
+      case "UserPromptSubmit": {
+        const prompt = typeof s.prompt === "string" ? s.prompt : void 0;
         events.push(
           ev("turn.started", {
             turn_id,
-            prompt_chars: typeof s.prompt === "string" ? [...s.prompt].length : void 0
+            prompt_chars: prompt === void 0 ? void 0 : [...prompt].length,
+            // Claude Code's hook schema documents `source`
+            // (user | sdk | system | loop_wakeup | schedule_wakeup | poll_event) and says a
+            // payload may omit it while the field rolls out; 2.1.304's payload has no such
+            // key at all. Forwarded verbatim, shape-guarded only: the list is the harness's
+            // to extend.
+            submitted_by: harnessWord(s.source),
+            // One of Claude Code's own prompt wrappers: the prompt is a block the harness
+            // wrote, so it is not the person's words. Absent is unknown, never "the person" —
+            // and `true` is never "no person caused this turn", because a Talk or
+            // `sessionpipe wait` delivery hands the person's own message over inside a
+            // <task-notification> (PROTOCOL.md §4).
+            injected: prompt !== void 0 && injectedBlock(prompt) ? true : void 0
           })
         );
         break;
+      }
       case "PreToolUse":
         if (tool) events.push(ev("tool.started", { tool, call_id, turn_id, agent_id, input: s.tool_input }));
         break;
@@ -986,7 +1000,13 @@ var claudeCode = {
         );
         break;
       case "Stop":
-        events.push(ev("turn.ended", { turn_id, reason: "stop" }));
+        events.push(
+          ev("turn.ended", {
+            turn_id,
+            reason: "stop",
+            background: Array.isArray(s.background_tasks) ? s.background_tasks.length : void 0
+          })
+        );
         break;
       case "StopFailure":
         events.push(
@@ -1029,6 +1049,8 @@ var claudeCode = {
     if (event === "UserPromptSubmit" && typeof s.prompt === "string") hints.prompt = s.prompt;
     const host = input.env.CLAUDE_CODE_HOST_SESSION_ID;
     if (host && DESKTOP_ID.test(host)) hints.desktop_id = host;
+    const attended = input.env.CLAUDE_CODE_SESSION_ATTENDED;
+    if (attended === "1" || attended === "0") hints.attended = attended === "1" || !!input.env.SESSIONPIPE_CONTROL_JOB;
     if (event !== "PreToolUse" && event !== "PostToolUse") hints.claude_pid = claudePid(input.env);
     const r = { session, events, hints };
     if (typeof s.transcript_path === "string") r.transcript = s.transcript_path;
@@ -1049,6 +1071,7 @@ var claudeCode = {
     const cwd = out.cwd ?? session.cwd;
     Object.assign(out, gitFacts(cwd), out.branch ? { branch: out.branch } : {});
     if (!out.url && typeof hints.desktop_id === "string") out.url = `claude://code/continue/${hints.desktop_id}`;
+    if (typeof hints.attended === "boolean") out.attended = hints.attended || !!out.url;
     return out;
   },
   backfill(sinceMs, env = process.env) {
@@ -1084,6 +1107,9 @@ function notClaudeCode(id, s) {
 function pickSource(v) {
   return typeof v === "string" && ["startup", "resume", "clear", "compact", "fork"].includes(v) ? v : "unknown";
 }
+var harnessWord = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,39}$/.test(v) ? v : void 0;
+var WRAPPER = /^<(?:task-notification|cross-session-message|system-reminder|local-command-stdout|command-[a-z-]+)[\s/>]/i;
+var injectedBlock = (prompt) => WRAPPER.test(prompt.trim());
 function errText(v) {
   if (typeof v === "string") return v.slice(0, 2e3);
   if (v && typeof v === "object") {
@@ -1200,7 +1226,27 @@ function claudeLogin(dir, home = homeDir()) {
     } catch {
     }
   }
-  return null;
+  return apiAccount(dir);
+}
+var ANTHROPIC_HOST = /(^|\.)anthropic\.com$/i;
+function apiAccount(dir) {
+  let base;
+  try {
+    base = JSON.parse(readFileSync3(settingsIn(dir), "utf8")).env?.ANTHROPIC_BASE_URL;
+  } catch {
+    return null;
+  }
+  if (typeof base !== "string") return null;
+  let u;
+  try {
+    u = new URL(base.trim());
+  } catch {
+    return null;
+  }
+  if (u.protocol !== "https:" && u.protocol !== "http:" || !u.hostname || ANTHROPIC_HOST.test(u.hostname))
+    return null;
+  const origin = `${u.protocol}//${u.host}`;
+  return { id: `api-${createHash2("sha256").update(origin).digest("hex").slice(0, 16)}`, name: u.host };
 }
 var accountCache = /* @__PURE__ */ new Map();
 function claudeAccount(dir) {
@@ -1360,6 +1406,18 @@ function claudeFacts(file, sessionId, hints, state) {
   return out;
 }
 
+// ../core/src/control/verify.ts
+var GRANT_MAX_MS = 24 * 36e5;
+var SKEW_MS = 5 * 6e4;
+var MACHINE_MAX_AGE_MS = 24 * 36e5;
+var RECEIVER_MAX_AGE_MS = 10 * 6e4;
+var NONCE_TTL_MS = 25 * 36e5;
+var MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:/@[\]-]*$/;
+var START_PERMISSIONS = ["read", "safe", "edits", "auto"];
+var levelRank = (l) => START_PERMISSIONS.indexOf(l);
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+
 // ../core/src/adapters/codex.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import path6 from "node:path";
@@ -1681,7 +1739,7 @@ var codex = {
       if (j && typeof j === "object" && !Array.isArray(j)) s = j;
     } catch {
     }
-    const id = s.session_id;
+    const id = s.session_id ?? s.thread_id ?? s.conversation_id ?? s["thread-id"] ?? s["session-id"];
     if (!id) return null;
     if (s.transcript_path === null) return null;
     const session = { id: String(id), cwd: typeof s.cwd === "string" ? s.cwd : input.cwd };
@@ -2525,6 +2583,22 @@ function makeEvent(a, ctx) {
   };
 }
 
+// ../core/src/launched-by.ts
+var LAUNCHED_BY_ENV = "SESSIONPIPE_LAUNCHED_BY";
+var LAUNCHED_BY = /^[a-z][a-z0-9-]{0,39}:[A-Za-z0-9._:-]{1,128}$/;
+function launchedBy(env) {
+  const v = env[LAUNCHED_BY_ENV]?.trim();
+  return v && LAUNCHED_BY.test(v) ? v : void 0;
+}
+function readHook(adapter, input) {
+  const r = adapter.fromHook(input);
+  if (r && !r.session.parent_id) {
+    const launcher = launchedBy(input.env);
+    if (launcher && launcher !== `${adapter.name}:${r.session.id}`) r.session.launched_by = launcher;
+  }
+  return r;
+}
+
 // ../core/src/outbox.ts
 import {
   appendFileSync,
@@ -2967,8 +3041,8 @@ var DATA_ALLOW = {
   "session.ended": { 0: ["reason"] },
   "session.backfill": { 0: ["started_at", "last_at", "turns"] },
   "session.forgotten": { 0: [] },
-  "turn.started": { 0: ["turn_id"], 1: ["prompt_chars"] },
-  "turn.ended": { 0: ["turn_id", "reason", "ms"], 1: ["error"] },
+  "turn.started": { 0: ["turn_id", "submitted_by", "injected"], 1: ["prompt_chars"] },
+  "turn.ended": { 0: ["turn_id", "reason", "ms", "background"], 1: ["error"] },
   "turn.transcript": { 2: ["turn", "user", "assistant", "at"] },
   "turn.progress": { 2: ["turn", "user", "assistant", "at"] },
   "tool.started": { 1: ["tool", "call_id", "turn_id", "agent_id"], 3: ["input"] },
@@ -2992,7 +3066,9 @@ var SESSION_ALLOW = [
   "title_source",
   "url",
   "account_id",
-  "parent_id"
+  "attended",
+  "parent_id",
+  "launched_by"
 ];
 var MAX_SIDE = 2e4;
 var MAX_IO = 64 * 1024;
@@ -3106,6 +3182,49 @@ var StdoutSink = class {
 // src/control/aliases.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import path12 from "node:path";
+
+// src/secrets.ts
+import { spawnSync } from "node:child_process";
+import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
+var SERVICE = "sessionpipe";
+var defaultRunner = (cmd, args, input) => {
+  const r = spawnSync(cmd, args, {
+    input: input ?? "",
+    encoding: "utf8",
+    timeout: 8e3,
+    stdio: ["pipe", "pipe", "ignore"]
+  });
+  return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
+};
+var sinkAccount = (name, what = "token") => {
+  const scope = process.env.SESSIONPIPE_CONFIG ? `@${createHash6("sha256").update(configFile()).digest("hex").slice(0, 8)}` : "";
+  return `sink:${name}:${what}${scope}`;
+};
+function secretGet(store, account, run = defaultRunner) {
+  const r = store === "keychain" ? run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]) : run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+  if (r.status !== 0) return null;
+  const v = r.stdout.replace(/\r?\n$/, "");
+  return v || null;
+}
+function sinkWithSecrets(s, run = defaultRunner) {
+  if (!s.token_in) return s;
+  const token = secretGet(s.token_in, sinkAccount(s.name), run);
+  if (!token) return null;
+  const secret = secretGet(s.token_in, sinkAccount(s.name, "secret"), run);
+  return { ...s, token, ...secret ? { secret } : {} };
+}
+
+// src/control/store.ts
+function startOptionsOf(v) {
+  const o = v;
+  if (!o || typeof o !== "object" || levelRank(o.permission) < 0 && o.permission !== "inherit") return null;
+  return {
+    permission: o.permission,
+    ...typeof o.model === "string" && MODEL_RE.test(o.model) ? { model: o.model } : {}
+  };
+}
+
+// src/control/aliases.ts
 var aliasFile = (controlDir) => path12.join(controlDir, "aliases.json");
 function readAliases(file) {
   try {
@@ -3115,7 +3234,7 @@ function readAliases(file) {
     for (const [k, v] of Object.entries(j)) {
       const a = v;
       if (a && typeof a.id === "string" && a.id && typeof a.cwd === "string")
-        out[k] = { id: a.id, cwd: a.cwd, at: typeof a.at === "string" ? a.at : "" };
+        out[k] = { id: a.id, cwd: a.cwd, at: typeof a.at === "string" ? a.at : "", ...startOptionsOf(a) };
     }
     return out;
   } catch {
@@ -3167,37 +3286,6 @@ function ask(sock, req, timeoutMs) {
   });
 }
 
-// src/secrets.ts
-import { spawnSync } from "node:child_process";
-import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
-var SERVICE = "sessionpipe";
-var defaultRunner = (cmd, args, input) => {
-  const r = spawnSync(cmd, args, {
-    input: input ?? "",
-    encoding: "utf8",
-    timeout: 8e3,
-    stdio: ["pipe", "pipe", "ignore"]
-  });
-  return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
-};
-var sinkAccount = (name, what = "token") => {
-  const scope = process.env.SESSIONPIPE_CONFIG ? `@${createHash6("sha256").update(configFile()).digest("hex").slice(0, 8)}` : "";
-  return `sink:${name}:${what}${scope}`;
-};
-function secretGet(store, account, run = defaultRunner) {
-  const r = store === "keychain" ? run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]) : run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
-  if (r.status !== 0) return null;
-  const v = r.stdout.replace(/\r?\n$/, "");
-  return v || null;
-}
-function sinkWithSecrets(s, run = defaultRunner) {
-  if (!s.token_in) return s;
-  const token = secretGet(s.token_in, sinkAccount(s.name), run);
-  if (!token) return null;
-  const secret = secretGet(s.token_in, sinkAccount(s.name, "secret"), run);
-  return { ...s, token, ...secret ? { secret } : {} };
-}
-
 // src/run.ts
 async function tellDaemon(state, job, session, cwd, transcript) {
   const sock = socketPath(state);
@@ -3298,6 +3386,12 @@ function openTurn(read, o) {
   };
 }
 var MAX_TURN_SIDE = 2e4;
+var JOB_OWN_ENV = [
+  "CLAUDE_CODE_SESSION_ATTENDED",
+  "CLAUDE_CODE_HOST_SESSION_ID",
+  "SESSIONPIPE_CONTROL_JOB",
+  "SESSIONPIPE_LAUNCHED_BY"
+];
 async function runJob(job, opts = {}) {
   const state = opts.state ?? stateDir();
   const cfg = readConfig();
@@ -3306,9 +3400,20 @@ async function runJob(job, opts = {}) {
     log(state, `${job.harness} ${job.event}: no adapter for harness "${job.harness}"; event dropped`);
     return { events: [], delivered: {} };
   }
-  const r = adapter.fromHook({ argv: job.argv, stdin: job.stdin, env: { ...process.env, ...job.env }, cwd: job.cwd });
+  const env = { ...process.env };
+  for (const k of JOB_OWN_ENV) delete env[k];
+  const r = readHook(adapter, { argv: job.argv, stdin: job.stdin, env: { ...env, ...job.env }, cwd: job.cwd });
   if (!r || !r.session.id) {
-    log(state, `${job.harness} ${job.event}: the ${job.harness} adapter did not claim this payload; event dropped`);
+    let keys = [];
+    try {
+      const payload = JSON.parse(job.argv.find((a) => a.startsWith("{")) ?? job.stdin);
+      if (payload && typeof payload === "object" && !Array.isArray(payload)) keys = Object.keys(payload);
+    } catch {
+    }
+    log(
+      state,
+      `${job.harness} ${job.event}: the ${job.harness} adapter did not claim this payload; event dropped; keys: ${keys.join(", ") || "(none)"}`
+    );
     return { events: [], delivered: {} };
   }
   const id = receiverIdOf(readAliases(aliasFile(path14.join(state, "control"))), job.harness, r.session.id) ?? r.session.id;
@@ -3360,7 +3465,8 @@ async function runJob(job, opts = {}) {
       seq: 0,
       machine: machineName(cfg, os3.hostname()),
       ...cwdRaw ? { cwd: tilde(cwdRaw) } : {},
-      ...r.session.model ? { model: r.session.model } : {}
+      ...r.session.model ? { model: r.session.model } : {},
+      ...r.session.launched_by ? { launched_by: r.session.launched_by } : {}
     };
     const version = facts.get(job.harness, id).harness_version ?? void 0;
     for (const a of r.events) {