token-goat 2.9.29 → 2.9.31

package/dist/token-goat-chunk-7MAOA6X4.mjs

@@ -0,0 +1,3647 @@
+import { createRequire as __cjsRequire } from 'node:module';
+const require = __cjsRequire(import.meta.url);
+import {
+  compareSemver
+} from "./token-goat-chunk-CXHOFN7R.mjs";
+import {
+  emitErr,
+  jsonc,
+  stripBom
+} from "./token-goat-chunk-QQTWJY2O.mjs";
+import {
+  HOOKS_CONFIG_FILE,
+  copilotHooksOwnersPath,
+  readCopilotHooksOwners
+} from "./token-goat-chunk-G5PJ7AGM.mjs";
+import {
+  claudeConfigDir
+} from "./token-goat-chunk-BPGCUMR7.mjs";
+import {
+  toolMatcherFor
+} from "./token-goat-chunk-C75NA7PL.mjs";
+import {
+  COPILOT_CLI_TOOL_NAME_MAP,
+  copilotCliUserRoot,
+  foldToolName
+} from "./token-goat-chunk-76FGDLRO.mjs";
+import {
+  loadConfig,
+  nativeHooksEnabled,
+  parse,
+  stringify
+} from "./token-goat-chunk-7EZTZOMC.mjs";
+import {
+  registerReset
+} from "./token-goat-chunk-YZAAZU2S.mjs";
+import {
+  assertWriteInScope,
+  atomicWriteText,
+  backupFile,
+  commandHookFields,
+  ensureDirRecordingCreation,
+  ensureDirSync,
+  escapeRegExp,
+  extractErrorMessage,
+  hasCreatedConfig,
+  hookCommandFor,
+  hookExecPartsFor,
+  hookPowershellCommand,
+  isOwnHookEntry,
+  projectScopeRoot,
+  recordCreatedBy,
+  recordCreatedConfig,
+  recordCreatedRootKey,
+  removeCreatedBackups,
+  removeCreatedIfEmpty,
+  removeCreatedTree,
+  removeFileInScope,
+  stripDelimitedBlock,
+  stripOwnHooksFromMap,
+  stripStaleGroupHooks,
+  takeCreatedConfig,
+  takeCreatedRootKey,
+  upsertDelimitedBlock,
+  withInstallScope,
+  withRetryOnLock,
+  writeConfigText,
+  writeIfDifferent,
+  writeJsonSettings
+} from "./token-goat-chunk-HU4TORC5.mjs";
+import {
+  echoedValue,
+  fencedCommand
+} from "./token-goat-chunk-GGGG7RWB.mjs";
+import {
+  powershellHookLine,
+  quotePosixShellWord,
+  quotePowershellPath,
+  resolveOnPath,
+  spawnResolvedSync
+} from "./token-goat-chunk-AM5V6GSX.mjs";
+import {
+  normalizeDarwinSystemAlias
+} from "./token-goat-chunk-FNFBKLRD.mjs";
+import {
+  dataDir
+} from "./token-goat-chunk-CO3UYX6G.mjs";
+import {
+  init_define_import_meta_env
+} from "./token-goat-chunk-A37V4PBF.mjs";
+
+// src/bridges/claudecode.ts
+init_define_import_meta_env();
+
+// src/bridges/shim_common.ts
+init_define_import_meta_env();
+
+// src/bridges/shim_try_server.ts
+init_define_import_meta_env();
+var SHIM_TRY_SERVER = `// Attempts the resident hook server (src/hook_server.ts): the sibling hook client sends this
+// call to an already-running token-goat process, so neither Node's module loading nor the hook
+// graph is paid for again. The CommonJS client comes first: this shim is CommonJS, and loading
+// the ES module one starts Node's ESM loader, about 5ms of a call the server answers. The ES
+// module one is for an install built before the CommonJS file existed. It returns undefined
+// whenever nothing was dispatched -- no server yet (it starts one in the background), all busy,
+// replaced by a newer build, turned off, or an install predating the client -- and the caller
+// then runs the call itself.
+async function tryServer(entryPath, eventName, input, harnessWaitMs) {
+  if (!entryPath) return undefined
+  try {
+    const fs = require('node:fs')
+    const cjsPath = path.join(path.dirname(entryPath), 'token-goat-hook-client.cjs')
+    const mjsPath = path.join(path.dirname(entryPath), 'token-goat-hook-client.mjs')
+    const client = fs.existsSync(cjsPath) ? require(cjsPath) : fs.existsSync(mjsPath) ? await import(pathToFileURL(mjsPath).href) : undefined
+    if (client === undefined) return undefined
+    return await client.relayViaServer(eventName, input, harnessWaitMs)
+  } catch {
+    return undefined
+  }
+}`;
+
+// src/bridges/shim_common.ts
+var SHIM_FILE = "token-goat-shim.cjs";
+var LEGACY_SHIM_FILE = "token-goat-shim.js";
+function legacyShimForwarder(noOp) {
+  const answer = noOp === "" ? "" : `
+  try { process.stdout.write('${noOp}') } catch {}`;
+  return `#!/usr/bin/env node
+// Forwards to token-goat-shim.cjs for hook commands wired before the shim was renamed.
+import('./token-goat-shim.cjs').catch(() => {${answer}
+  process.exitCode = 0
+});
+`;
+}
+var SHIM_REQUIRES = `const { spawnSync } = require('node:child_process')
+const path = require('node:path')
+const { pathToFileURL } = require('node:url')`;
+var SHIM_VALID_HOOK_EVENTS = `// Keep in sync with HOOK_EVENTS in src/types.ts. eventName is validated against this closed
+// set before being concatenated into a shell command string, so a hostile argv (e.g.
+// 'pre_tool_use & calc.exe') can never reach the shell parser.
+const VALID_HOOK_EVENTS = new Set([
+  'pre_tool_use',
+  'post_tool_use',
+  'notification',
+  'stop',
+  'pre_compact',
+  'post_compact',
+  'user_prompt_submit',
+  'subagent_stop',
+  'subagent_start',
+  'session_start',
+  'post_tool_use_failure',
+])`;
+var SHIM_TRY_IN_PROCESS = `// Attempts the in-process hook call: import()s dist/token-goat-hook.mjs (a sibling of
+// the baked token-goat entry path, built with zero load-time side effects -- unlike
+// the CLI entry, which runs the full argv-parsing CLI as a side effect of being
+// loaded) and calls its exported relayInProcess() directly, avoiding a second node
+// process spawn entirely. Returns undefined (triggering the spawnSync fallback below)
+// when entryPath is absent, the sibling file doesn't exist (an older install predating
+// this file), or anything else goes wrong -- this must never throw. harnessWaitMs, when
+// the caller has one (Claude Code's async-detach marker time -- see SHIM_ASYNC_DETACH),
+// is forwarded straight through: this runs in the same process as the caller, so its
+// performance.now() reading shares the same origin and needs no conversion.
+async function tryInProcess(entryPath, eventName, input, harnessWaitMs) {
+  if (!entryPath) return undefined
+  try {
+    const payload = JSON.parse(input)
+    const served = await tryServer(entryPath, eventName, input, harnessWaitMs)
+    if (served !== undefined) return served
+    const hookLibPath = path.join(path.dirname(entryPath), 'token-goat-hook.mjs')
+    if (!require('node:fs').existsSync(hookLibPath)) return undefined
+    const mod = await import(pathToFileURL(hookLibPath).href)
+    return await mod.relayInProcess(eventName, payload, harnessWaitMs)
+  } catch {
+    return undefined
+  }
+}`;
+var SHIM_SPAWN_LADDER = `    const res = entryPath
+      ? spawnSync(process.execPath, [entryPath, 'hook', eventName], {
+          input,
+          encoding: 'utf8',
+          timeout: SHIM_FALLBACK_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+          maxBuffer: SHIM_MAX_BUFFER_BYTES,
+        })`;
+var SHIM_FALLBACK_TIMEOUT_MS = { claudecode: 2e4, codex: 45e3, copilot: 45e3, grok: 3e3, kimi: 2e4, pi: 2e4, relay: 1e4 };
+var SHIM_SESSION_START_TIMEOUT_MS = 1e4;
+var SESSION_START_TEST_BUDGET_ENV = "TG_TEST_SESSION_START_BUDGET_MS";
+var SESSION_START_TEST_BUDGET_MIN_MS = 1e3;
+var SESSION_START_TEST_BUDGET_MAX_MS = 6e5;
+function shimFallbackTimeoutConst(harness) {
+  return `const SHIM_FALLBACK_TIMEOUT_MS = ${SHIM_FALLBACK_TIMEOUT_MS[harness]}`;
+}
+var SHIM_MAX_BUFFER_CONST = `const SHIM_MAX_BUFFER_BYTES = 32 * 1024 * 1024`;
+var SHIM_ASYNC_DETACH = `const ASYNC_DETACH_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
+const ASYNC_DETACH_SKIP_EXT_RE = /\\.(md|mdx|markdown|rst)$/i
+const ASYNC_DETACH_BASH_MAX_BYTES = 200
+// Same key order as OUTPUT_FIRST_TOOL_RESPONSE_KEYS in hooks_common.ts.
+const ASYNC_DETACH_BASH_TEXT_KEYS = ['output', 'content', 'text', 'body', 'stdout', 'stderr']
+function bashResultByteLength(resp) {
+  if (typeof resp === 'string') return Buffer.byteLength(resp, 'utf8')
+  if (resp && typeof resp === 'object') {
+    if (typeof resp['persistedOutputSize'] === 'number') return resp['persistedOutputSize']
+    for (const key of ASYNC_DETACH_BASH_TEXT_KEYS) {
+      if (typeof resp[key] === 'string' && resp[key] !== '') return Buffer.byteLength(resp[key], 'utf8')
+    }
+    return Buffer.byteLength(JSON.stringify(resp), 'utf8')
+  }
+  return 0
+}
+// A token-goat read|section|symbol result is never detached, however short: see isAsyncDetachEligible in src/hook_adapters.ts.
+const TG_LEDGER_PREFIX_RE = /^(?:(?:cd\\s+(?:"[^"]*"|'[^']*'|\\S+)|export[ \\t]+[A-Za-z_]\\w*=(?:"[^"]*"|'[^']*'|[^\\s"'])*(?:[ \\t]+[A-Za-z_]\\w*=(?:"[^"]*"|'[^']*'|[^\\s"'])*)*)[ \\t]*(?:&&|;|\\r?\\n)\\s*)+/
+const TG_LEDGER_READ_RE = /^(?:[A-Za-z_][A-Za-z0-9_]*=\\S+\\s+)*(?:env\\s+(?:(?:(?:-u|--unset)\\s+\\S+|-(?![A-Za-z]*C|-c)\\S*|[A-Za-z_][A-Za-z0-9_]*=\\S+)\\s+)*)?(?:token-goat|tg|node(?:\\.exe)?\\s+["']?(?:\\S*[\\\\/])?token-goat(?:\\.mjs)?["']?)\\s+(?:read|section|symbol)\\b/i
+function isLedgerReadCommand(cmd) {
+  if (typeof cmd !== 'string') return false
+  const body = cmd.trim().replace(/^\\(\\s*/, '')
+  return TG_LEDGER_READ_RE.test((body.replace(TG_LEDGER_PREFIX_RE, '') || body).trim())
+}
+function isAsyncDetachEligible(eventName, input) {
+  if (eventName === 'subagent_stop') return true
+  if (eventName !== 'post_tool_use') return false
+  try {
+    const payload = JSON.parse(input)
+    const toolName = payload['tool_name']
+    if (ASYNC_DETACH_TOOLS.has(toolName)) {
+      const toolInput = payload['tool_input'] || {}
+      const filePath =
+        typeof toolInput['file_path'] === 'string'
+          ? toolInput['file_path']
+          : typeof toolInput['notebook_path'] === 'string'
+            ? toolInput['notebook_path']
+            : ''
+      return !ASYNC_DETACH_SKIP_EXT_RE.test(filePath)
+    }
+    if (toolName === 'Bash') return !isLedgerReadCommand((payload['tool_input'] || {})['command']) && bashResultByteLength(payload['tool_response']) < ASYNC_DETACH_BASH_MAX_BYTES
+    return false
+  } catch {
+    return false
+  }
+}`;
+var SHIM_OWN_COMMAND_BYPASS = `const TG_CD_PREFIX_RE = /^(?:cd\\s+(?:"[^"]*"|'[^']*'|\\S+)[ \\t]*(?:&&|;|\\r?\\n)\\s*)+/
+const TG_OWN_COMMAND_RE = /^(?:[A-Za-z_][A-Za-z0-9_]*=\\S+\\s+)*(?:token-goat\\b|node(?:\\.exe)?\\s+["']?(?:\\S*[\\\\/])?token-goat(?:\\.mjs)?["']?\\b)/i
+function isOwnTokenGoatCommand(cmd) {
+  if (typeof cmd !== 'string' || cmd.trim() === '') return false
+  const body = (cmd.replace(TG_CD_PREFIX_RE, '') || cmd).trim()
+  if (/[;&|\`]|\\$\\(/.test(body)) return false
+  return TG_OWN_COMMAND_RE.test(body)
+}`;
+
+// src/bridges/claudecode.ts
+var CLAUDECODE_HOOK_SCRIPT = `#!/usr/bin/env node
+// token-goat Claude Code hook shim. Reads the hook payload on stdin, forwards it to \`token-goat hook <event>\`, and relays the response on stdout.
+'use strict'
+// Cache V8's compiled bytecode for the 3.4 MB hook bundle this shim import()s below. Without it
+// every hook invocation recompiles that bundle from source, which profiled at ~40ms of the ~148ms
+// a single hook takes -- and a hook fires on every tool call. Worth ~23ms per invocation, measured
+// twice on the installed shim by interleaving both variants: 148ms to 125ms, and later 186ms to
+// 163ms on a busier machine. The floor moves with load; the 23ms it removes does not.
+//
+// It has to be here rather than inside the bundle: a module is compiled before any of its own code
+// runs, so a bundle cannot enable the cache for itself. This shim is small enough to compile in
+// well under a millisecond, and the dynamic import() happens after this line, so the bundle is
+// compiled with the cache already active. Same reason the MCP SDK could not be deferred from
+// inside mcp_server.ts -- what a module can affect starts after it is already compiled.
+//
+// enableCompileCache landed in Node 22.1 and package.json allows >=22.0.0, so a miss is possible;
+// it is also best-effort by nature (read-only cache dir, full disk). Swallow everything: this shim
+// must never fail a tool call to save itself 23ms.
+try { require('node:module').enableCompileCache() } catch { /* older Node, or an unwritable cache dir: run uncached */ }
+${SHIM_REQUIRES}
+
+${SHIM_VALID_HOOK_EVENTS}
+
+${SHIM_TRY_SERVER}
+
+${SHIM_TRY_IN_PROCESS}
+
+${SHIM_MAX_BUFFER_CONST}
+${shimFallbackTimeoutConst("claudecode")}
+
+${SHIM_ASYNC_DETACH}
+
+${SHIM_OWN_COMMAND_BYPASS}
+
+async function main() {
+  const eventName = process.argv[2] || ''
+  if (!VALID_HOOK_EVENTS.has(eventName)) {
+    process.stdout.write('{}')
+    return
+  }
+  let input = ''
+  try {
+    input = require('node:fs').readFileSync(0, 'utf8')
+  } catch {
+    process.stdout.write('{}')
+    return
+  }
+  // A pre_tool_use Bash call that is token-goat's own CLI has nothing for the pipeline below to
+  // say, so this skips the round trip entirely rather than backgrounding it -- see
+  // isOwnTokenGoatCommand's docstring in shim_common.ts for the measured emission rate this
+  // forfeits.
+  if (eventName === 'pre_tool_use') {
+    try {
+      const payload = JSON.parse(input)
+      if (payload['tool_name'] === 'Bash' && isOwnTokenGoatCommand(payload['tool_input'] && payload['tool_input']['command'])) {
+        process.stdout.write('{}')
+        return
+      }
+    } catch {
+      // Fall through to normal handling on unparseable stdin.
+    }
+  }
+  // Print this before the in-process/spawn round trip below, not after: the harness detaches on
+  // the first stdout line it sees, and the whole point is not waiting out that round trip for a
+  // call that was always going to answer '{}'. asyncDetachAtMs, taken at this exact print, is the
+  // last instant this process's elapsed time and the harness's own wait are the same number --
+  // record it now so the finally block in relayInProcess (relay.ts) can report what Claude Code
+  // actually waited on instead of this call's full lifetime.
+  let asyncDetachAtMs
+  if (isAsyncDetachEligible(eventName, input)) {
+    asyncDetachAtMs = performance.now()
+    process.stdout.write('{"async":true}\\n')
+  }
+  // process.argv[3], when present, is the absolute path to the running token-goat CLI
+  // entry (mirrors the same argv[3]-baked-entry convention used by the Codex/Copilot
+  // CLI shims). Try the in-process hook lib first (tryInProcess above), which avoids
+  // spawning a second node process altogether; fall back to the entry path directly via
+  // process.execPath, then finally to the old PATH-based shell:true invocation (an
+  // older cached hook config with no argv[3], or a config wired directly to
+  // \`token-goat hook <event>\` rather than through this shim). A
+  // SHIM_FALLBACK_TIMEOUT_MS timeout/killSignal on both spawnSync fallbacks means token-goat degrades to its own
+  // fail-open '{}' rather than being force-killed by Claude Code's own hook timeout (30 s on UserPromptSubmit).
+  const entryPath = process.argv[3]
+  let stdout = await tryInProcess(entryPath, eventName, input, asyncDetachAtMs)
+  if (stdout === undefined) {
+    // Reaching here with asyncDetachAtMs set means tryInProcess failed after
+    // isAsyncDetachEligible had already parsed this same input successfully, so the cause is an
+    // install missing its dist/token-goat-hook.mjs sibling or a broken import -- never a bad
+    // payload. asyncDetachAtMs is this process's own elapsed time and has no meaning in the
+    // spawned child's clock, so it is deliberately not threaded across that boundary; the child
+    // falls back to timing its own lifetime, the same already-approximate number every hook got
+    // on this fallback path before async-detach existed.
+${SHIM_SPAWN_LADDER}
+      : spawnSync('token-goat hook ' + eventName, {
+          input,
+          encoding: 'utf8',
+          shell: true,
+          timeout: SHIM_FALLBACK_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+          maxBuffer: SHIM_MAX_BUFFER_BYTES,
+        })
+    if (res.status !== 0 || !res.stdout) {
+      process.stdout.write('{}')
+      return
+    }
+    stdout = res.stdout
+  }
+  process.stdout.write(stdout)
+}
+
+main().catch(() => {
+  process.stdout.write('{}')
+})
+`;
+
+// src/bridges/guidance_block.ts
+init_define_import_meta_env();
+function buildGuidanceBody(fallbackToolClause, opts = {}) {
+  const gdrive = opts.gdrive !== false;
+  return [
+    "## token-goat",
+    "",
+    "**Gate \u2014 before every file read, answer one question first: is there a token-goat command that returns just what I need?** If yes, run it. A read tool invoked without answering the gate is a violation, not an oversight. The gate is per file: batched or parallel reads do not exempt it.",
+    "",
+    `This gate decides *whether* to reach for a read tool at all. ${fallbackToolClause} only pick the *fallback* once token-goat has been ruled out for this read \u2014 they never authorize skipping the gate.`,
+    "",
+    "Shell binaries and editor programs are commands run through the shell tool, never tool identifiers: keep them out of an agent's tools and allowed-tools lists, where loaders harvest the names and warn that each is unknown.",
+    "",
+    "Exemptions (gate passes, read directly): the file is under ~200 lines and you need all of it; it was never indexed (new, untracked, or generated this turn); it is a genuinely opaque binary (not an image); the target has no symbol handle (e.g. a literal mid-function).",
+    "",
+    "Failure shapes to catch yourself in, and the command that replaces each:",
+    '- not knowing which command answers a question you can already state in words \u2192 `answer "<question>"`, which runs the right command and refuses rather than guess',
+    '- a shell text search with context flags to find a function body \u2192 `read "file::symbol"`',
+    '- paging one function with view/view_range \u2192 `read "file::symbol"`',
+    '- issuing sequential or overlapping line-range reads across a file (paging) \u2192 `read "file::symbol"` / `outline file` / `skeleton file` / rg <pattern> <file>',
+    "- a read refused by a `[tg]` deny, retried with a shifted range, different lines, or another read tool \u2192 never retry reading the file at different lines; run the command the deny names or use bash-output / token-goat read",
+    '- reading a symbol plus chasing its callers and containing doc section as separate reads \u2192 `brief "file::symbol"`',
+    '- reading one heading of a large doc \u2192 `section "file::Heading"`',
+    "- searching for a symbol's callers \u2192 `refs file::symbol --callers`",
+    '- searching across symbols, headings, text, and concepts concurrently \u2192 `search "<query>"`',
+    '- searching for a *concept* rather than a literal string \u2192 `semantic "description"`',
+    "- re-reading output you already captured \u2192 `bash-output`/`web-output`/`mcp-output` by ID",
+    "- a directory listing or recursive wildcard walk to orient in an unfamiliar repo \u2192 `map --compact`",
+    "- pulling one value or subtree out of a JSON/YAML/XML file (manifest, lockfile, spec, config) \u2192 `json-query file 'a.b.c'` / `yaml-query file 'a.b.c'` / `xml-query file 'a.b.c'`",
+    "- opening an image to check its dimensions, format, or size \u2192 `image-meta file`",
+    "- opening a screenshot, diagram, or scan to read the text in it \u2192 `image-text file`",
+    "- running tests immediately on edited code without fast static validation \u2192 run language validator first (e.g. `ruff check --select F821 <file>`, `node --check`, `tsc --noEmit`) to catch missing imports and syntax errors before test execution",
+    "- passing concatenated or unquoted paths to shell tools \u2192 verify whitespace and argument separation in multi-path commands (e.g. `git add path1 path2`, never `git add path1path2`)",
+    "",
+    "Commands: `symbol NAME`, `changed --symbol`, `config-get file KEY`, `json-outline`/`yaml-outline`/`xml-outline`, " + (gdrive ? "`gdrive-sections <file-id>`, " : "") + "and `token-goat --help` for the rest.",
+    "",
+    "Sub-agent briefs must carry this gate verbatim: a sub-agent inherits none of this context and its reads spend the same token budget.",
+    "",
+    "`token-goat stats` \u2014 self-check. Flat counts during code work mean the gate is being skipped."
+  ].join("\n");
+}
+function skillDescriptionLine(gdrive) {
+  return `description: Use before reading whole files or grepping wide. token-goat commands (symbol, read, section, semantic, outline, skeleton, map, refs, changed, config-get, bash-output, web-output${gdrive ? ", gdrive-sections" : ""}) return narrow slices of code and docs at a fraction of the token cost.`;
+}
+function buildGuidanceBlock(h) {
+  return [h.beginMarker, buildGuidanceBody(h.fallbackToolClause, h.gdrive === void 0 ? {} : { gdrive: h.gdrive }), h.endMarker].join("\n");
+}
+
+// src/native_hook.ts
+init_define_import_meta_env();
+import { spawnSync } from "node:child_process";
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+var NATIVE_TARGETS = /* @__PURE__ */ new Set(["win32-x64", "win32-arm64", "linux-x64", "linux-arm64"]);
+var SELFTEST_TIMEOUT_MS = 5e3;
+function exeName(platform = process.platform) {
+  return platform === "win32" ? "tg-hook.exe" : "tg-hook";
+}
+function packagedNativeBinary(entryPath = process.argv[1]) {
+  if (entryPath === void 0 || entryPath === "") return void 0;
+  const target = `${process.platform}-${process.arch}`;
+  if (!NATIVE_TARGETS.has(target)) return void 0;
+  const bin = path.join(path.dirname(entryPath), "native", target, exeName());
+  return fs.existsSync(bin) ? bin : void 0;
+}
+function nativeCopyPath(entryPath, home = dataDir()) {
+  let bundleDir = path.dirname(entryPath);
+  try {
+    bundleDir = fs.realpathSync.native(bundleDir);
+  } catch {
+  }
+  const id = crypto.createHash("sha256").update(bundleDir.toLowerCase()).digest("hex").slice(0, 16);
+  return path.join(home, "native", id, exeName("win32"));
+}
+var LEFTOVER = /^tg-hook\.exe\.[0-9a-f]+\.(?:old|new)$/;
+function reclaimLeftovers(dir) {
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (!LEFTOVER.test(name)) continue;
+    try {
+      fs.unlinkSync(path.join(dir, name));
+    } catch {
+    }
+  }
+}
+function syncNativeCopy(src, dest) {
+  let want;
+  try {
+    want = fs.readFileSync(src);
+  } catch {
+    return false;
+  }
+  try {
+    if (fs.readFileSync(dest).equals(want)) return true;
+  } catch {
+  }
+  const dir = path.dirname(dest);
+  const tag = crypto.randomBytes(6).toString("hex");
+  const staged = `${dest}.${tag}.new`;
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    reclaimLeftovers(dir);
+    fs.writeFileSync(staged, want, { mode: 493 });
+  } catch {
+    discardStaged(staged);
+    return false;
+  }
+  try {
+    fs.renameSync(staged, dest);
+    return true;
+  } catch {
+  }
+  const ready = `${dest}.${crypto.randomBytes(6).toString("hex")}.new`;
+  try {
+    withRetryOnLock(() => fs.renameSync(staged, ready));
+  } catch {
+    discardStaged(staged);
+    return false;
+  }
+  const aside = `${dest}.${tag}.old`;
+  let movedAside = false;
+  try {
+    if (fs.existsSync(dest)) {
+      withRetryOnLock(() => fs.renameSync(dest, aside));
+      movedAside = true;
+    }
+    withRetryOnLock(() => fs.renameSync(ready, dest));
+    return true;
+  } catch {
+    if (movedAside) {
+      try {
+        withRetryOnLock(() => fs.renameSync(aside, dest));
+      } catch {
+      }
+    }
+    discardStaged(ready);
+    return false;
+  }
+}
+function discardStaged(staged) {
+  try {
+    fs.rmSync(staged, { force: true });
+  } catch {
+  }
+}
+function nativeCopyCurrent(src, dest) {
+  try {
+    return fs.readFileSync(dest).equals(fs.readFileSync(src));
+  } catch {
+    return false;
+  }
+}
+var _selftests = /* @__PURE__ */ new Map();
+function nativeSelftest(bin) {
+  const cached = _selftests.get(bin);
+  if (cached !== void 0) return cached;
+  let result;
+  const res = spawnSync(bin, ["--selftest"], { encoding: "utf8", timeout: SELFTEST_TIMEOUT_MS, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+  if (res.error !== void 0) result = { ok: false, reason: res.error.code === "ETIMEDOUT" ? `no answer within ${SELFTEST_TIMEOUT_MS} ms` : res.error.message };
+  else if (res.status !== 0) result = { ok: false, reason: res.signal !== null ? `killed by ${res.signal}` : `exit code ${String(res.status)}` };
+  else result = { ok: true };
+  _selftests.set(bin, result);
+  return result;
+}
+var _decisions = /* @__PURE__ */ new Map();
+var COPY_FAILED = "its copy could not be put in place in the data directory (a scanner or another process held the file)";
+var COPY_STALE = "the data-directory copy is missing or differs from the packaged binary";
+var TRANSIENT_WHY = /could not be put in place|no answer within/;
+registerReset(() => {
+  _selftests.clear();
+  _decisions.clear();
+});
+function nativeHookBinary(entryPath = process.argv[1], opts = {}) {
+  if (entryPath === void 0 || entryPath === "" || !nativeHooksEnabled()) return void 0;
+  const sync = opts.sync !== false;
+  const key = `${String(sync)}\0${entryPath}`;
+  const cached = _decisions.get(key);
+  if (cached !== void 0) return cached ?? void 0;
+  const packaged = packagedNativeBinary(entryPath);
+  let bin;
+  let why;
+  if (packaged !== void 0) {
+    for (let attempt = 1; attempt <= 2 && bin === void 0; attempt++) {
+      if (attempt === 2) {
+        if (why === void 0 || !TRANSIENT_WHY.test(why)) break;
+        _selftests.clear();
+      }
+      why = void 0;
+      let candidate = packaged;
+      if (process.platform === "win32") {
+        const copy = nativeCopyPath(entryPath);
+        const current = sync ? syncNativeCopy(packaged, copy) : nativeCopyCurrent(packaged, copy);
+        if (current) candidate = copy;
+        else {
+          candidate = void 0;
+          why = sync ? COPY_FAILED : COPY_STALE;
+        }
+      }
+      if (candidate !== void 0) {
+        const test = nativeSelftest(candidate);
+        if (test.ok) bin = candidate;
+        else why = `its self-test failed: ${test.reason ?? "no reason given"}`;
+      }
+    }
+  }
+  if (bin === void 0 && sync && why !== void 0 && why !== COPY_STALE) emitErr(`token-goat: wrote the Node form of the hooks, not the native hook client, because ${why}. Run \`token-goat doctor --repair\` (or install again) to retry.`);
+  _decisions.set(key, bin ?? null);
+  if (sync) _decisions.set(`false\0${entryPath}`, bin ?? null);
+  return bin;
+}
+function nativeHookFlags(harness, event, entry, scriptPath) {
+  const flags = ["--harness", harness, "--event", event, "--entry", entry];
+  if (harness === "copilot_cli") flags.push("--script-dir", path.dirname(scriptPath));
+  return flags;
+}
+function nodeHookArgv(scriptPath, event, entry) {
+  if (entry === void 0 || entry === "") return void 0;
+  return [process.execPath, scriptPath, event, entry];
+}
+var PATH_FLAGS = /* @__PURE__ */ new Set(["--entry", "--script-dir"]);
+function nativeWords(bin, harness, scriptPath, event, entry) {
+  const flags = nativeHookFlags(harness, event, entry, scriptPath);
+  const flagWords = flags.map((text, i) => ({ text, quote: i > 0 && PATH_FLAGS.has(flags[i - 1]) }));
+  return [{ text: bin, quote: true }, ...flagWords, { text: "--", quote: false }, { text: process.execPath, quote: true }, { text: scriptPath, quote: true }, { text: event, quote: false }, { text: entry, quote: true }];
+}
+function quoteFor(shell, text) {
+  if (shell === "sh") return quotePosixShellWord(text);
+  if (shell === "powershell") return quotePowershellPath(text);
+  return `"${text}"`;
+}
+function nativeHookCommandLine(shell, bin, harness, scriptPath, event, entry = process.argv[1]) {
+  if (nodeHookArgv(scriptPath, event, entry) === void 0) return void 0;
+  const line = nativeWords(bin, harness, scriptPath, event, entry).map((w) => w.quote ? quoteFor(shell, w.text) : w.text).join(" ");
+  return shell === "powershell" ? powershellHookLine(line) : line;
+}
+function nativeHookExecParts(bin, harness, scriptPath, event, entry = process.argv[1]) {
+  if (nodeHookArgv(scriptPath, event, entry) === void 0) return void 0;
+  return { command: bin, args: nativeWords(bin, harness, scriptPath, event, entry).slice(1).map((w) => w.text) };
+}
+function splitHookCommand(command, shell) {
+  const words = [];
+  let text = command.trim();
+  if (shell === "powershell" && text.startsWith("& ")) text = text.slice(2);
+  const posix = shell === "sh";
+  const dqEscapes = posix && process.platform !== "win32";
+  let cur = "";
+  let inWord = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === ";" && shell === "powershell") break;
+    if (/\s/.test(ch)) {
+      if (inWord) words.push(cur);
+      cur = "";
+      inWord = false;
+      continue;
+    }
+    inWord = true;
+    if (ch === "'" && shell !== "cmd") {
+      for (i++; i < text.length; i++) {
+        if (text[i] !== "'") cur += text[i];
+        else if (shell === "powershell" && text[i + 1] === "'") cur += text[++i];
+        else break;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      for (i++; i < text.length && text[i] !== '"'; i++) {
+        if (dqEscapes && text[i] === "\\" && i + 1 < text.length) cur += text[++i];
+        else cur += text[i];
+      }
+      continue;
+    }
+    if (posix && ch === "\\" && i + 1 < text.length && (process.platform !== "win32" || text[i + 1] === "'")) {
+      cur += text[++i];
+      continue;
+    }
+    cur += ch;
+  }
+  if (inWord) words.push(cur);
+  return words;
+}
+var HookCommandRewriteError = class extends Error {
+};
+function hookCommandRewrittenSpan(command, reader) {
+  return (reader === "cmd" ? /%[^%\r\n]+%/ : /\$(?:[A-Za-z_][A-Za-z0-9_]*|\{[^}]*\})/).exec(command)?.[0];
+}
+function parseNativeInvocation(argv) {
+  const bin = argv[0];
+  if (bin === void 0 || !/^tg-hook(?:\.exe)?$/i.test(path.basename(bin.replace(/\\/g, "/")))) return void 0;
+  const split = argv.indexOf("--");
+  if (split < 0) return void 0;
+  const flags = argv.slice(1, split);
+  const h = flags.indexOf("--harness");
+  return { bin, harness: h >= 0 ? flags[h + 1] : void 0, wrapped: argv.slice(split + 1) };
+}
+
+// src/install.ts
+init_define_import_meta_env();
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+
+// src/canonical_skill.ts
+init_define_import_meta_env();
+import { gunzipSync } from "node:zlib";
+var CANONICAL_SKILL_GZIP_BASE64 = "H4sIAAAAAAACCp1b25IbR3J9x1ekRxEmB4HGkFqvL0OFNqjr0ktJNMkN2eHYWBS6E+jSdFc1q6oHxAbD4Sd/gMNf4E/bL7FPZlWjMZyRtX4QhQG6q6uysk6ePJldVdXCmZ6vKfkbdtXem7RoONbBDsl6d00Xv49MW975wBTYNNbt6dD6jmlnO47kA+0DD4N8bxtez0ai2ve9cU2kx/HYb323kiFWFLnG6PjQG5dsvSI/ps46XlFvBly2iyvamthWfkzDmC4pcBqDI2dC8AeKna05kknU+YM+kmof05o2V7MJmLGxaUOBby0fIhmKHKP1jnY+UG9j5IaiubVuH9cXCxP2Y88uVa116Zou/lVu/wN9oK0JTNbd+tpg4mSGobMcKbVqFdqbxM/okdzwiMLo5g8LnIKPAxZ9y2RcQ9zbhCu+M9YlYx0H+oa52Zr6hr40oblY3HKIugFP1/+w/vXFwnSdP3BTJe+7eL0gqugLE1v58JpNIx++DTzoh85vF1VVLT77q6qib9lxMIkb2h7n+7MLvqcY6qvaOO9sbbo/xhvbdeu+eUbc2EQ2YY1BZx1GN7/buphM163I8S0HSq2N4hRrqqrPF4tPPqEfW8Yd9PvIi8Xz7mCO2FV1JiPXqvX+/O//RanFkGrSwVuXVvJMK18e2qOOL9PDN0ZMTsFgerjZkaHEdevsu5HX9FZmbSM5T6kNHFvfNZhLYFO3MjR+MfGGov0T6+P5PfdDimTTtczj3chR9vtCJybTzk6td6hXRvppjIkO+OYFOebmQrwRT08tjkbyhEfpfbBmPHDA9MY4mq470pHjerF423KehPVwocDF4XFnZ6PsIcPn5yvveJfwiJ/GZs/wYFi5NmPkYqeDTS01NtaBMbQJx/lzxEwpX7um57o1o2s4UPDjvu2O9OmTJ4QTGnXhRz/KQhUMVmU75beDidknrGv4PTe6lYb27EbruDuSH8y7kWlrZSpYJ8xSm8jYbDV0YwPXST0kO0aw+zZRbbpuvVj8qFucaDDHSL2P4io2wdVx0A4+3FyToc77ARNUFKDBxLgCbuEXt5+d0soP7PRB0fQF4QIPjLPTHXUZ4j+BqzKvujVhzw2ZvbEOiLQbu46GYGvW7yIsu8XWyGFSp7MpcrcTE2Ljv2e7b7d+DNm8/gB/hj2AjLLs68WiouVyY/aAKNxd1b4fjEDpZrmUUyQuGMdwa28Bj3S6YnXmMXIdu8QhUu1d4vc4zzK9nQ0x0dCZWo8RebmtNd2O/O5kHV3RWicVx63Oqwn2ll3V8C13foAvlqkZioM5OLEUu0QxmZAibTvj9GAErmQngc3wnqMeHSDlNljeke9tSvCmQ2vrVlFAfsFlQ/DbjvsCL4obRrDX8q3pyDsuk81RZ0OPT6DyKIrR8+m+nOzJTnwdLhrZhFrmtBP3Wdbe1Tyk5R0Y6sQHO4opWLdfTdB2wg547iqfucAmeoHJnek6khgAuJBwKsF1LWA6i9CL5fJbnGrMMK9XDHaC1FWBGO9mMCZbe00zMPs4WP88rv1muaQXO6DVSsKBTYALOQoITBIjb4AKNrV+THkWgoAtKxSJIW6t74y6pVjBkZeIt2+TOl25dOAgq7qmrUl1yw1O7mCC6Tru5MGRGi+DKKBhSgBSG3WMhmvbcKTloWWsenkKArqLp8mDMHTdmr7szNgwfekbzl7xWkyK6KoYgPBKQ+AdB3Y1UxiFC7nuSIPF/rVMS2wndnNJcJO5qVsTacvs5L4GJ1zmIs44C4h8zDBqxtT6gDAVb6xyrWLO9WLxTX4O1R0gP1JvjgRWB8fFwQ2OY8wrcYqNhYfBoTOsIdwLuRBwxKmLLXcdtdwNHOKa3sifAtngPuUm7Efw+2B6DVgT6Su+kFqJIYocMgYeM9EGcZuGXbI7yyHqbHr4XV78MLBBKIGXCHQ8ijpR8BeXepMSHD3I73OWJAET7gQ/MsHsgxlaarizW6FDnZpJOALomd3ZWufjQw5N18JywigQWsnx6rxpAJutCbccgbZ1m8exTg6uOhNmggmUoO/oYILLRENOK86mImovVMDdOH9w68Xi61NofixOjJglRw7OoXGxO15eZ7zuWG9HuP63U5zGc6cwDWjxO7LpGaDxowhNjx0fVjS6FEx9A4wFsZ9oo3gmEOHy2YSsDwXzx/lA297s+fJZDnkB0Q9+D1tLMkCtcU3H9JjX+/UMNXvbVLvRicUvxb1tNwJ9WzOAfXiqgQTi3BJDrVtNxOoOiEkUixKyrxcVQpD6H8KdOr8yoxICd53ZyyN2VghLmQdtfXOkP//Hf9JGtuBCIOlaF3KxWVQ0mD2OJbZ0ukmGBue4wj9/DMbt+WcHKQmWKSYaulEIRiyBENQHzoc1YtLGOvzU+LokVWQiRYa7J874KI/UEPrwMzHztnzeYT+wZzKy3F+GzyP8Vi+9M+0h+JqbUYKfWFozSapbrm/gUjHxcGc8vWQd2+vrT+gL4xyHiw2uzVa69/dF9VE01jU9OtkoW3qnWUlZNFVVvuC+QX5ZSC8rUBpBF7OMWaZ2y8HujlbIZb6G+y03aqVbYzuztZ1NxxK9340cjh8PXFWIMR2iolpk9svBhF6NX01bKKmy0pUOXx6pNkMaw/8mDeoDp4R6c7U58Pb0R18P5Q8kiS++OlsGUqvQW2e66YSZOmnmcgg+Me2QYpUZ3H0YVQqdnw0mtZ9TVenIVWdiqg7BJsZKkJ6ABYjd6pZ7I5tS+HlMsJQPwut3SIEak8wWFLmwjf2Ia09mlBurPNa/JrPt+A9qSN2xLdNnCk2fTz8LTCjE+nCUECK2DRS4HkOUzMJ2TW1CQwfTCVnzwYLSaowa3c70trMGtwxeJ9ObAZ6ndFwAY+y6cu5uTTfK0uK4TYGF8+sh/Mc3P3x/9S/Pv3t59c/fvVSof9wbZ3cc04o6X9/gu5WErxUQYWf3l/rEn6J3lTiW3vfIrLfr+tGGrmhzNH330G/v7/9pURHSI/GGDO6CxXKyAU2N7dnB4HGFfetNkiAi2bVMSO6pek6aK56NCKBgdrH1aUWNRaju9fbauMzYFOFLqmLTfFRF749GffXVNxjkh90O2Vjja9F35EbrRJGRqet0lR6vNFbL88yZ3HQtw22GZieL2FzJxyxcbfQ2+aqDTIRvchwRScPsS+qMKQhQy6ESKJfb+D2CLw6LXLxRPplaH/kZ/ehDQ5vG1+/vPlG+E+eNm6v8F79Pm2f0yh84vIKWQpthSB/dKd/FzjaMteAP5xPHzTP6+n3NHW3ed/F9FVvmFMs98lXtu7F3eJz8ibBRPkuQK3+IG20WZyFCw8qb3714+XLdN1df/vb5999+/fKHb9d9Q4/llFWzMChyTwEzYV5Ndm/5qSpR5DMQsM/p0Wc5Ln2uvqwXSfDWKwQxzaF6PT1iRvYnqMGpe0kpGJfj1xme3LHiBDPwkYzIp7BSG0lalFUqGJo6+Kgygyqp5bE5YCE80WdiO5kv2HdGIUOxx68ygsQx2sFlLBJXhwxK9cnCZ2REbCpFTld7Tlejwyeg2mbxZWbq17TJsfH75999vVndz09WD3CI1cPcYPVgkFzRJptRT+3VJt5wx0mS1I7x+zlirn4+lK9oU7dwvYaqSn+V7wQQK3BPAbPfff0v+PohaLyaASN8ePpc7rkzZ7m6uINeX/5a/dJou6LNXkST4suRPsPwlW0+x493UfPqI8RbPYhJV3M4upqDDG46A5OrB3FkdQc8rh7EjfxHuWuOHlf/H+BY3Tnl4iXlQKtznZ/IqzuHcVWOEz49dAzWi8WbcVupKCUeHjX9rE0IWXaWJOyWw9Yk20NTjNMd1rUcrEi9JZ2zJ01NJeyYiXgcOIcDUdC0bFF0tMVmphDEZIC50AFU6UOYXdM3nQg1o0O8HYUp1QAuUCLq2bgzmWXLQqUgGXCjItKbcVvy88XiA704lTQ+0HM9xB8WH6qqkv8WH87KKRuVTd0xS4KlXkIfTpKN2XrUOLQ+ci7DT1lJyRKEQITRrenuk0rh5gO9ebCG8lDtJKtinT9g3MUnn3yio2Vj3jPcYvE6F4hka/IlmucWEcNqzWg2RT8k29sMuH4YfEijs6lII6B+0DeTl1H7abYrzQudhx2GYDkhawaXhXVfvXixzvoeTMy3kEZqBifPG6eK2fYIPuq7To/GermUPZjFrCyZH4IXuShXIeCI1/fEMuEj53o4iliYPTRxv6Oe92Z7TJAhoj9LG5MnIfEipmHV8IJRVIbEu7HTMFdN4mSkgx+7Rkok1HsR/43LoojK6onqYJOtbYQXvR7FsaNu/LsRJ1lESdHIVKtcw5//qSidHygHtzvu/CPuamxWNKbUAudyJVqjajeumYTH39AH2shKqKqSH+jpkw3pUBChtUZw4FweValPqksir4yxVAYwDvZj87pcdlLARuEIctmGtmD1Z0p75g146Fe2IVQnEQhzVQ7Bze6dD9zIXPFzlfFjWjKUlzm8mNtSlfG5GLA10UYZQO9dFXqDv6hCeGl94zu/P+q4L9S/chUQ2kGX2qOM0HgkT3rZF7aDxgluMkbC9vQqKWE2cU6Gah+GMcoMsncWFFh8oOcnha73AjoHH1IrzgA//HCPTw92kAdBmBCR0BXRR9VWJi0pj/0Wx/IeOkeVxiX6vvpO5/FD5nB38+szf/rwl6Xaq6x2nBE/YNf34h/Q2We7ijlx5KwIqKnlu8HYsClhAaoFrLemLzwELiFHElY4V+PyBQWoBHVemZCsHKAhsJpfY4tUivVvfs/1OMecIdgeEBbH7U/IqLLrniO2FHH1xE5mggrZeMx2qTrIUouj+liTlZwGVRrGSQoQfk28KcI1oEjCn64OteXRdk2WkBPEWYDY5ZrUkJ3QQAfcglh/eljWxuXs45kRa4nJphHKRvaVPOtHUSyixVo3VXId+dBwuF4snq5pufwu9xaMYY+yeoa9XGE72TaPCUv+mCsyp+YK7K9mS4VfwyYqAY9TTUWqiZJXbk68FxdptC7cfJMxtzW3OGm3HAoAaLk124Wix0HXYOGhbXiNClIIOxWwZoPt/Kh1+h1AMqwzWm5oLzVIWTAHRX9B/KLVYpKV4CV42DMtWRRFO65RZ7rXWtSahv7EwZcODjHuSp27FPKHztY2dcf14lPsx2+xmF2wWSJ1GUVh+N8KnMptwNQz45YnypKFySjQquUadtZ0+V4ptzenZ/ggcswo+3uOyoUasNYzT1XiOjEsIrEHnH3vw/FZiYiQKXwSFjuphop9iJ1QOEyNfGY/orZY6v+yimQCFhb8QUs0scYiJOY7MtvIJWjlSpowyem4jq4M4FFWwI/rxa9g1ZfincUnFNPEpi/9PkLH2e20mjSphzmUPXQQsiMj6Qsc4wZct/hZbMPoblQUko+0GwNIkhYMkx8qfo8CPnIpPcVTKC0uGYy7EZfs14u/wQpecRDxpxhgO+5lASU1zn5hbIdNb0eUc3sbBxNiLpIo++CGOpY4phz8OJv5mv5JGItGy1MPUU4N1CTrxa8xn+fnEHuCq8c2omLKzeVaS7BhdK64qdowtxSwkwQBB3zyRpm0KKNS4ZCJjw7mqtOkTtxyaKUsCGIZ5EgLNBTe3h01DNy/cwqKfyuLaESJCNZ0Urkq/gptvRuxHqzha6F7dWdsr20QdxyJttxasdEzaoIf5Ll+akDJriqugSg2k+uj3yUuxum1Ktdys5+ByjwE1R0b9KKZI4jt0BkL3Q3ZwsWsfcf2Q0BqowmNm49yUVoNBOjj2OXepcGo4p97mHyImelGdvmH9eLvBJ6EPKmYmvd3IlFaNJNQhp1hl9CJosX3/Jh4CmdZQpC4DnuyQ3/J3+Mhb7TRbeJgORGR/gqQPwXQBs9/JaVtMjjsUfiN4opYJRNECYwKEidiqa6Do1GO3FTYPsVPTYOlJwT8FfRAMhXrmtzppGSTDEJPRBsEfleedj09v+GdGTtNsX71hBr0jmQ6qanEELwQkrlvzKeiu3Q/w40YTWRm5QYHHwoa5EwkoBSM2F7sGXNmZlXYR0a3pi9FlpPurFlPDCULXg8/szsp2EDmngKgZMn4FiFFfNbk1eM6eQhT9GOoYensuAghklqgInoLjVnTMyF2wlUQb3KfVWiWy1UuGT/99RNdHpqkWmTQtRmKQ0mZY27A4mjOdMcoIkM+pbk/6S34yJuxByXMTTTIESOajYCy3n1MBJGQZYw4J4A5+9a+nW9KaP1ryvQqe3R+TDp4kdzR9LAdu45T6ZPUP8QVPwauE8Si72giDtd08ed//2+chPPrr+n7iXjcoXc+nMJ/w0mw9VmWRZpWABkVE8BNd7y4XGt/5M6i/v7dl68Uhhu0MykHL4gs8OLIxjjyit6NEFR3RzEVv4f8q+kpWAOGiRzAdh/n/8OrVpnbIjCsPk7CJPEdQz4Q9diPXWkTqaK461myNgVrtAhdrsXGGVf/z0gkbCCvk+sU59EG5bMp2qyo4cbW2rUqG0id2bIkBLIzGiq/LqHymtbr9YV6yusCfdzQN/Z9aUBL1LGJSfwRsShwKrmD7B2bJNxJYFGtW3MYEoljmH7oWCJVTiqR6jhtN3plUhtpj0NIgbPxsvKDwCh4UGqKzyZsHIJwT7ONvkOqgegm6koKtleaQr9jHspEJjVpx4fc5CEiZeEBs77ZWIdxC60uN9Fpgw2uVCHwuUu2eqVNC2+DGaSd0p22TIvX70bclh2c4rjfq74ivl7o72PpgDGRNm9ON2B2OXfOrRHlRGwuVyV4IylHy1byUh+bOoVyM+kojMU0PxlEvfmQuf1bW0c2T6unT54g7Xn65Gn1qX789MnT6ldPnmwu15RXKbdvj5UI+FvpblO3Xknl2QDftdVH+heygptzyWD3e2n6QR6xHwGKefnrxfOJmu6DP7jMUO0Onitij87Z7FLpkm7YHeVQd9HLOMCJeLBoa8EOT/F0shSSaT3xr0u72nqxeKGQvyLb99xY5Wh5HHMwma/JgvMmJE/P37y9yvUTZ27t3kzHUirhgLWcXV/LYXr+5i1d0ZtcIJruuF4uRZc7U631olxqk/TzjBt8XFSSrUe/7AnMSvvMCtwwt+pmPnDCRj3nb07b9cMtB2i4906rlJaksPLxxEpVp/ycPN5CUB/UicaVWjFknUFSBeS92gp3/n7EOsfBbE10DdIVvTqmVq2GNyomWwc7oMWTHm/CXvojIFN9XqZyqT0z0yqxF9CH8NDHG3RP4GacqPn+DfKo3HsjmKElII25RUaTBckxngJO6aPYdgjpmY+h0DOt6qtSQn+Ti1VlQWf2fqAcqG9dmHDTSHuz5Js6nPrgnGZkf53a9uIZbImVohKO5x+3mAqAX6Aj2GzR5OfTxZweTTJGUbBOfalTq6wMYZSRoyaWhZ7StNvYOPiorigNsUrh8KOwOO1QvkctQTQAacMN8oV2y2FsliBYVcpKPy4GHVALjy3ed0EImJWChJZqemJzR/bbwCaXjKVxFviMuCc9o8slfVO6QKPyCqlw4IKeYwQWGxGFbvWOTG3BJukLDCcxJUo5H7TueFYNkR7BxrPmLQOivShVp7d0ZIq/F3gvqhUmaLTdebk8L0gjqfKdNrTPIEDpEwx5MK70VC7HyMtTy/XPFo2fndq7ZQRDufvrF/ZznxrJ14DlUx/Zqe4Ci079n2gIxiV3WryzJi1ZUVHCo8ioW5/azH3zrZLL5n4ScflgxF45xt0JoGchTzx6HtIlKhUXECUIhytDULYuWla151rDVO7ImgbRaaxK0JnHoQdDzeOPQwYi9j2AfefrIuxf3oN2V9ooL1EBDF48/2deSYHR8nsudZD3O1anfleBU3mpZmqIPbXAli5WGQjvUISjcDajrGQ69KWFvmgI+h2sbaIoC9qEf3HmbPJ9nuIFhC1RFiPnHSrpyenlHeBFKZmVxmBNoYEG4Kcn3BMSMUmbmGyhy1VRk2avN6Fgy/f1FIqmBY2s1D6KqBfJNA10OwFMKW3QrTW/vBNC6xKZspbOmXlhRfvj61YeIA5dCvw4gdMqculTXgmaNEECIcKq6uC7jsbsLT+izqhy96zv+6yh+9R2vpG+8s3V5qzPfDNvRIdlfmGnfKktL/OxXd5pkX+mSqK8BebTR53ya3rxF/emu1/al37qR4eHTS/c6It4OWJqh4MU/O9tqi8v3HwV/PlLC7mcNOuikL4LPZN/SWvFDDNn7yTl46jdSoXTTM8ubRy6HM6aQ34LlN6NlnGEOjY3CtQe4iy4x2sWAZbeoAclk484Dgz5eLm81uxrStFia3A2vnz5AvG7vqHHG3Z761i4SiVVE8HDeBUdOjRSvKo7+0e5eN03m8siP2GIt9h7cNygEeNUx5j7Os4uur8kvmm7P3Zv3hMi2ssN8yAvT2ES3NBsYlpPkv0pbZSZCkmsAgLopt77GhrMkO59ZUxhPL8FFzUNnr3RuYfW4eJ976XleCvkZX7V9Jbb6fHrvCcPvotW5nfH8Sjwu9EGeXUyO7S8SRiVEASgKA3om9KacD4nf8H7bBOq4emnt9mizjhry5jd6fVFfedDRKASyoAE6rKzLkksH/sYtQAX1f2nPVdUitpnUYSe/P6XhBzlfRVab7OIjykFPwIW1UpVz72HnHc9vU6liKA92UabENFzgyNkEeJRp5IuPu43K3rz9vnbr2UNl2fb7g/5fUu9nnqGHGPreFYklIUs/gcqO+3WrD4AAA==";
+var CANONICAL_SKILL_MD = gunzipSync(Buffer.from(CANONICAL_SKILL_GZIP_BASE64, "base64")).toString("utf8");
+
+// src/install.ts
+var HOOK_EVENT_MAP = [
+  ["PreToolUse", "pre_tool_use"],
+  ["PostToolUse", "post_tool_use"],
+  // A failed call never reaches PostToolUse: Claude Code 2.1.281 sends a missing-file Read and a non-zero Bash exit here instead, carrying `error`, `is_interrupt` and `duration_ms` (captured, 2026-09-24).
+  ["PostToolUseFailure", "post_tool_use_failure"],
+  ["PreCompact", "pre_compact"],
+  ["PostCompact", "post_compact"],
+  ["UserPromptSubmit", "user_prompt_submit"],
+  ["Stop", "stop"],
+  ["SubagentStop", "subagent_stop"],
+  ["SessionStart", "session_start"]
+];
+var SHIM_COMMAND_MARKER = "token-goat-shim";
+var COMMAND_MARKER = "token-goat hook";
+var LEGACY_COMMAND_MARKERS = ["tokenwise", "token_goat", "tg-hook", "token-goat-hook"];
+function anchoredMarkerPattern(marker) {
+  const escaped = escapeRegExp(marker);
+  return new RegExp(`(?<![a-zA-Z0-9_-])${escaped}(?![a-zA-Z0-9_-])`);
+}
+var HOOK_MARKER_PATTERNS = [SHIM_COMMAND_MARKER, COMMAND_MARKER, ...LEGACY_COMMAND_MARKERS].map(anchoredMarkerPattern);
+function isTokenGoatHookCommand(command, args) {
+  const haystack = args !== void 0 && args.length > 0 ? `${command} ${args.join(" ")}` : command;
+  return HOOK_MARKER_PATTERNS.some((pattern) => pattern.test(haystack));
+}
+var CLAUDE_EXEC_FORM_MIN_VERSION = "2.1.139";
+var _claudeExecFormHooksSupported;
+function claudeExecFormHooksSupported() {
+  const override = process.env["TOKEN_GOAT_CLAUDE_EXEC_FORM_HOOKS"];
+  if (override === "1") return true;
+  if (override === "0") return false;
+  if (_claudeExecFormHooksSupported !== void 0) return _claudeExecFormHooksSupported;
+  _claudeExecFormHooksSupported = probeClaudeExecFormHooksSupported();
+  return _claudeExecFormHooksSupported;
+}
+function probeClaudeExecFormHooksSupported() {
+  const resolved = resolveOnPath("claude");
+  if (resolved === null) return false;
+  try {
+    const result = spawnResolvedSync(resolved, ["--version"], { encoding: "utf-8", timeout: 5e3, windowsHide: true });
+    if (result.status !== 0) return false;
+    return execFormSupportedForVersionOutput(result.stdout ?? "");
+  } catch {
+    return false;
+  }
+}
+function execFormSupportedForVersionOutput(stdout) {
+  const m = /(\d+\.\d+\.\d+)/.exec(stdout);
+  if (!m) return false;
+  return compareSemver(m[1], CLAUDE_EXEC_FORM_MIN_VERSION) >= 0;
+}
+function expectedHookEntryFor(scriptPath, event, opts = {}) {
+  const bin = nativeHookBinary(process.argv[1], opts);
+  if (claudeExecFormHooksSupported()) return (bin === void 0 ? void 0 : nativeHookExecParts(bin, "claudecode", scriptPath, event)) ?? hookExecPartsFor(scriptPath, event);
+  return { command: (bin === void 0 ? void 0 : nativeHookCommandLine("sh", bin, "claudecode", scriptPath, event)) ?? hookCommandFor(scriptPath, event) };
+}
+function realPathOrNull(p) {
+  if (!path2.isAbsolute(p)) return null;
+  try {
+    return fs2.realpathSync.native(p);
+  } catch {
+    return null;
+  }
+}
+function sameHookWord(a, b) {
+  if (a === b) return true;
+  const realA = realPathOrNull(a);
+  return realA !== null && realA === realPathOrNull(b);
+}
+function stringFormHookWords(command) {
+  return splitHookCommand(command, "sh");
+}
+function hookEntryMatches(command, args, expected) {
+  const execForm = expected.args !== void 0;
+  if (!execForm && args !== void 0 && args.length > 0) return false;
+  const a = execForm ? [command, ...args ?? []] : stringFormHookWords(command);
+  const b = execForm ? [expected.command, ...expected.args] : stringFormHookWords(expected.command);
+  return a.length === b.length && a.every((v, i) => sameHookWord(v, b[i]));
+}
+function claudeHookScriptPath() {
+  return path2.join(claudeConfigDir(), "hooks", SHIM_FILE);
+}
+function claudeLegacyHookScriptPath() {
+  return path2.join(claudeConfigDir(), "hooks", LEGACY_SHIM_FILE);
+}
+function anyScopeReferencesShim(scriptPaths, currentScope, alreadyStripped) {
+  const referencesIn = (map) => {
+    for (const groups of Object.values(map ?? {})) {
+      for (const group of Array.isArray(groups) ? groups : []) {
+        for (const h of hooksOf(group)) {
+          const fields = commandHookFields(h);
+          if (fields !== void 0 && scriptPaths.some((p) => fields.command.includes(p) || (fields.args ?? []).some((a) => a.includes(p)))) return true;
+        }
+      }
+    }
+    return false;
+  };
+  if (referencesIn(alreadyStripped)) return true;
+  for (const scope of ["user", "project"]) {
+    if (scope === currentScope) continue;
+    let other;
+    try {
+      other = readSettings(settingsPath(scope), { strict: true });
+    } catch (e) {
+      if (e instanceof SettingsParseError) return true;
+      throw e;
+    }
+    if (referencesIn(other.hooks)) return true;
+  }
+  return false;
+}
+function settingsPath(scope) {
+  const base = scope === "user" ? claudeConfigDir() : path2.join(normalizeDarwinSystemAlias(process.cwd()), ".claude");
+  return path2.join(base, "settings.json");
+}
+var SettingsParseError = class extends Error {
+};
+function readSettings(p, opts = {}) {
+  const refuse = (problem, detail) => new SettingsParseError(
+    (opts.command === "uninstall" ? `settings file ${echoedValue(p)} is unreadable: it ${problem}. Uninstall left it untouched, along with the hook shim it may still name and the file's backups; fix the file and run uninstall again.` : `settings file ${echoedValue(p)} ${problem}. Fix or back up the file before running install.`) + (detail === void 0 ? "" : ` (${detail})`)
+  );
+  let raw;
+  try {
+    raw = fs2.readFileSync(p, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (opts.strict === true && code !== "ENOENT" && code !== "ENOTDIR") throw refuse("exists but cannot be read", code ?? extractErrorMessage(e));
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripBom(raw));
+  } catch {
+    if (opts.strict === true) throw refuse("exists but contains invalid JSON");
+    return {};
+  }
+  if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+    const hooksValue = parsed.hooks;
+    if (hooksValue === void 0 || typeof hooksValue === "object" && hooksValue !== null && !Array.isArray(hooksValue)) return parsed;
+    if (opts.strict === true) throw refuse('has a "hooks" value that is not a JSON object');
+    const { hooks: _ignored, ...rest } = parsed;
+    return rest;
+  }
+  if (opts.strict === true) throw refuse("does not contain a JSON object at the top level");
+  return {};
+}
+function wiredClaudeHookWords(scope) {
+  const out = [];
+  for (const groups of Object.values(readSettings(settingsPath(scope)).hooks ?? {})) {
+    for (const g of Array.isArray(groups) ? groups : []) {
+      for (const h of Array.isArray(g?.hooks) ? g.hooks : []) {
+        const fields = commandHookFields(h);
+        if (fields === void 0 || !isTokenGoatHookCommand(fields.command, fields.args)) continue;
+        out.push(fields.args !== void 0 && fields.args.length > 0 ? [fields.command, ...fields.args] : stringFormHookWords(fields.command));
+      }
+    }
+  }
+  return out;
+}
+function hooksOf(group) {
+  return Array.isArray(group?.hooks) ? group.hooks : [];
+}
+function groupHasTokenGoat(groups, predicate) {
+  if (!Array.isArray(groups)) return false;
+  for (const group of groups) {
+    for (const h of hooksOf(group)) {
+      if (isOwnHookEntry(h, predicate)) return true;
+    }
+  }
+  return false;
+}
+function installHooks(scope = "user") {
+  return withInstallScope(hookScopeRoot(scope), () => installHooksScoped(scope));
+}
+function hookScopeRoot(scope) {
+  return scope === "project" ? normalizeDarwinSystemAlias(process.cwd()) : void 0;
+}
+function installHooksScoped(scope) {
+  const p = settingsPath(scope);
+  const settings = readSettings(p, { strict: true });
+  const hooks = settings.hooks ?? {};
+  const scriptPath = claudeHookScriptPath();
+  const scriptChanged = withInstallScope(void 0, () => {
+    ensureDirRecordingCreation(path2.dirname(scriptPath));
+    const forwarderChanged = writeIfDifferent(claudeLegacyHookScriptPath(), legacyShimForwarder("{}"));
+    const scriptChanged2 = writeIfDifferent(scriptPath, CLAUDECODE_HOOK_SCRIPT);
+    return scriptChanged2 || forwarderChanged;
+  });
+  let settingsChanged = false;
+  const skippedEvents = [];
+  for (const [eventKey, eventArg] of HOOK_EVENT_MAP) {
+    const expected = expectedHookEntryFor(scriptPath, eventArg);
+    const rawGroups = hooks[eventKey];
+    if (rawGroups !== void 0 && !Array.isArray(rawGroups)) {
+      skippedEvents.push(eventKey);
+      continue;
+    }
+    const existingGroups = rawGroups ?? [];
+    const groups = [];
+    let strippedStale = false;
+    for (const group of existingGroups) {
+      if (typeof group !== "object" || group === null) {
+        groups.push(group);
+        continue;
+      }
+      const keptHooks = hooksOf(group).filter((h) => {
+        const isStale = isOwnHookEntry(h, (command, args) => isTokenGoatHookCommand(command, args) && !hookEntryMatches(command, args, expected));
+        if (isStale) strippedStale = true;
+        return !isStale;
+      });
+      if (keptHooks.length > 0) {
+        groups.push({ ...group, hooks: keptHooks });
+      } else if (hooksOf(group).length === 0) {
+        groups.push(group);
+      }
+    }
+    const isOurs = (command, args) => hookEntryMatches(command, args, expected);
+    if (groupHasTokenGoat(groups, isOurs)) {
+      const narrowed = toolMatcherFor(eventArg);
+      let renarrowed = false;
+      if (narrowed !== null) {
+        for (let i = 0; i < groups.length; i++) {
+          const group = groups[i];
+          if (group === void 0) continue;
+          const ownHooks = hooksOf(group);
+          const isOwnGroup = ownHooks.length > 0 && ownHooks.every((h) => isOwnHookEntry(h, isOurs));
+          if (isOwnGroup && group.matcher !== narrowed) {
+            groups[i] = { ...group, matcher: narrowed };
+            renarrowed = true;
+          }
+        }
+      }
+      if (strippedStale || renarrowed) {
+        hooks[eventKey] = groups;
+        settingsChanged = true;
+      }
+      continue;
+    }
+    const matcher = toolMatcherFor(eventArg) ?? "";
+    groups.push({ matcher, hooks: [{ type: "command", command: expected.command, ...expected.args !== void 0 ? { args: expected.args } : {} }] });
+    hooks[eventKey] = groups;
+    settingsChanged = true;
+  }
+  if (skippedEvents.length > 0) {
+    process.stderr.write(`token-goat: left ${p} untouched under hooks.${skippedEvents.join(", hooks.")}: not a list of hook groups, so no token-goat hook was added there. Fix the value and run install again.
+`);
+  }
+  if (!settingsChanged && !scriptChanged) {
+    return { scope, settingsPath: p, alreadyInstalled: true, ...skippedEvents.length > 0 ? { skippedEvents } : {} };
+  }
+  if (settingsChanged) {
+    settings.hooks = hooks;
+    recordCreatedBy([p], () => writeJsonSettings(p, settings));
+  }
+  return { scope, settingsPath: p, alreadyInstalled: false, ...skippedEvents.length > 0 ? { skippedEvents } : {} };
+}
+function uninstallHooks(scope = "user") {
+  return withInstallScope(hookScopeRoot(scope), () => uninstallHooksScoped(scope));
+}
+function uninstallHooksScoped(scope) {
+  const p = settingsPath(scope);
+  const settings = readSettings(p, { strict: true, command: "uninstall" });
+  const hooks = settings.hooks ?? {};
+  const removed = stripOwnHooksFromMap(hooks, isTokenGoatHookCommand);
+  const scriptPath = claudeHookScriptPath();
+  let removedScript = false;
+  if (!anyScopeReferencesShim([scriptPath, claudeLegacyHookScriptPath()], scope, hooks)) {
+    removedScript = withInstallScope(void 0, () => {
+      const removedAny = [scriptPath, claudeLegacyHookScriptPath()].map((p2) => removeFileInScope(p2)).some(Boolean);
+      removeCreatedIfEmpty(path2.dirname(scriptPath));
+      return removedAny;
+    });
+  }
+  const result = finishHookUninstall(p, settings, removed) || removedScript;
+  removeCreatedTree([p]);
+  return result;
+}
+function finishHookUninstall(p, settings, removed, write = writeJsonSettings) {
+  if (removed) {
+    if (settings.hooks !== void 0 && Object.keys(settings.hooks).length === 0) delete settings.hooks;
+    write(p, settings);
+  }
+  removeCreatedBackups(p);
+  return removed;
+}
+function isInstalled(scope = "user") {
+  if (!fs2.existsSync(claudeHookScriptPath())) return false;
+  const gaps = hookEventGaps(scope);
+  return gaps !== null && gaps.missing.length === 0 && gaps.outdated.length === 0 && gaps.broken.length === 0;
+}
+function hasFiringHook(scope) {
+  const gaps = hookEventGaps(scope);
+  return gaps !== null && gaps.missing.length + gaps.broken.length < HOOK_EVENT_MAP.length;
+}
+function claudeHooksInstalledAnyScope() {
+  return hasFiringHook("user") || hasFiringHook("project");
+}
+var LIVE_HOOK_MARKER_PATTERNS = [SHIM_COMMAND_MARKER, COMMAND_MARKER].map(anchoredMarkerPattern);
+var SHIM_FILE_WORD = /(?:^|[\\/])token-goat-shim\.c?js$/;
+function isLiveTokenGoatHookCommand(command, args) {
+  const execForm = args !== void 0 && args.length > 0;
+  const haystack = execForm ? `${command} ${args.join(" ")}` : command;
+  if (!LIVE_HOOK_MARKER_PATTERNS.some((pattern) => pattern.test(haystack))) return false;
+  const words = execForm ? [command, ...args] : stringFormHookWords(command);
+  const native = parseNativeInvocation(words);
+  if (native !== void 0 && !fs2.existsSync(native.bin)) return false;
+  const shimFile = words.find((word) => SHIM_FILE_WORD.test(word));
+  return shimFile === void 0 || fs2.existsSync(shimFile);
+}
+function isBrokenNativeHookCommand(command, args) {
+  const words = args !== void 0 && args.length > 0 ? [command, ...args] : stringFormHookWords(command);
+  const native = parseNativeInvocation(words);
+  return native !== void 0 && native.wrapped.some((word) => SHIM_FILE_WORD.test(word)) && !fs2.existsSync(native.bin);
+}
+function hookEventGaps(scope = "user") {
+  const hooks = readSettings(settingsPath(scope)).hooks;
+  if (hooks === void 0) return null;
+  if (!HOOK_EVENT_MAP.some(([eventKey]) => groupHasTokenGoat(hooks[eventKey], isTokenGoatHookCommand))) return null;
+  const scriptPath = claudeHookScriptPath();
+  const missing = [];
+  const outdated = [];
+  const broken = [];
+  for (const [eventKey, eventArg] of HOOK_EVENT_MAP) {
+    const expected = expectedHookEntryFor(scriptPath, eventArg, { sync: false });
+    if (groupHasTokenGoat(hooks[eventKey], (c, a) => hookEntryMatches(c, a, expected) && isLiveTokenGoatHookCommand(c, a))) continue;
+    if (groupHasTokenGoat(hooks[eventKey], isLiveTokenGoatHookCommand)) outdated.push(eventKey);
+    else if (groupHasTokenGoat(hooks[eventKey], isBrokenNativeHookCommand)) broken.push(eventKey);
+    else missing.push(eventKey);
+  }
+  return { missing, outdated, broken };
+}
+var CLAUDE_MD_BEGIN = "<!-- token-goat-begin -->";
+var CLAUDE_MD_END = "<!-- token-goat-end -->";
+function claudeMdPath(scope = "user") {
+  return scope === "user" ? path2.join(claudeConfigDir(), "CLAUDE.md") : path2.join(normalizeDarwinSystemAlias(process.cwd()), "CLAUDE.md");
+}
+function buildClaudeMdBlock() {
+  return buildGuidanceBlock({
+    beginMarker: CLAUDE_MD_BEGIN,
+    endMarker: CLAUDE_MD_END,
+    fallbackToolClause: "Claude Code's own Read, Grep, and Glob preference rules",
+    gdrive: loadConfig().gdrive.enabled
+  });
+}
+function writeClaudeMdBlock(p) {
+  return upsertDelimitedBlock(p, CLAUDE_MD_BEGIN, CLAUDE_MD_END, buildClaudeMdBlock());
+}
+function stripClaudeMdBlock(p) {
+  return stripDelimitedBlock(p, CLAUDE_MD_BEGIN, CLAUDE_MD_END);
+}
+function installedClaudeMdBlock() {
+  let text;
+  try {
+    text = fs2.readFileSync(claudeMdPath(), "utf8");
+  } catch {
+    return null;
+  }
+  const begin = text.indexOf(CLAUDE_MD_BEGIN);
+  if (begin === -1) return null;
+  const end = text.indexOf(CLAUDE_MD_END, begin + CLAUDE_MD_BEGIN.length);
+  return end === -1 ? null : text.slice(begin, end + CLAUDE_MD_END.length);
+}
+function installClaudeMd(scope = "user") {
+  return withInstallScope(hookScopeRoot(scope), () => {
+    const p = claudeMdPath(scope);
+    const existed = fs2.existsSync(p);
+    const changed = writeClaudeMdBlock(p);
+    if (!existed) recordCreatedConfig(p);
+    return { path: p, alreadyInstalled: !changed };
+  });
+}
+function uninstallClaudeMd(scope = "user") {
+  return withInstallScope(hookScopeRoot(scope), () => {
+    const p = claudeMdPath(scope);
+    const stripped = stripClaudeMdBlock(p);
+    removeCreatedIfEmpty(p);
+    return stripped;
+  });
+}
+function findStrayClaudeMdBlocks(searchRoot) {
+  const root = searchRoot ?? claudeConfigDir();
+  const canonical = path2.resolve(claudeMdPath());
+  const found = [];
+  if (!fs2.existsSync(root)) return found;
+  const SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+  const MAX_DEPTH = 6;
+  const hasRealBlock = (text) => {
+    let sawBegin = false;
+    for (const line of text.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (trimmed === CLAUDE_MD_BEGIN) sawBegin = true;
+      else if (sawBegin && trimmed === CLAUDE_MD_END) return true;
+    }
+    return false;
+  };
+  const walk = (dir, depth) => {
+    if (depth > MAX_DEPTH) return;
+    let entries;
+    try {
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = path2.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) walk(full, depth + 1);
+        continue;
+      }
+      if (!entry.isFile() || !entry.name.toLowerCase().endsWith(".md")) continue;
+      if (path2.resolve(full) === canonical) continue;
+      let text;
+      try {
+        text = fs2.readFileSync(full, "utf8");
+      } catch {
+        continue;
+      }
+      if (hasRealBlock(text)) found.push(full);
+    }
+  };
+  walk(root, 0);
+  return found.sort();
+}
+function skillMdContent() {
+  return CANONICAL_SKILL_MD;
+}
+function skillDir(scope = "user") {
+  return path2.join(scope === "user" ? claudeConfigDir() : path2.join(normalizeDarwinSystemAlias(process.cwd()), ".claude"), "skills", "token-goat");
+}
+function skillPath(scope = "user") {
+  return path2.join(skillDir(scope), "SKILL.md");
+}
+function installedSkillDescription() {
+  let text;
+  try {
+    text = fs2.readFileSync(skillPath(), "utf8");
+  } catch {
+    return null;
+  }
+  const lines = text.split(/\r?\n/);
+  if (lines[0] !== "---") return null;
+  for (const line of lines.slice(1)) {
+    if (line === "---") return null;
+    if (line.startsWith("description:")) return line;
+  }
+  return null;
+}
+function installSkill(scope = "user") {
+  return withInstallScope(hookScopeRoot(scope), () => installSkillScoped(scope));
+}
+function installSkillScoped(scope) {
+  const p = skillPath(scope);
+  let existing = null;
+  try {
+    existing = fs2.readFileSync(p, "utf8");
+  } catch {
+  }
+  const skillContent = skillMdContent();
+  if (existing === skillContent) return { path: p, alreadyInstalled: true };
+  recordCreatedBy([skillDir(scope)], () => ensureDirSync(skillDir(scope)));
+  backupFile(p);
+  atomicWriteText(p, skillContent);
+  return { path: p, alreadyInstalled: false };
+}
+function uninstallSkill(scope = "user") {
+  return withInstallScope(hookScopeRoot(scope), () => uninstallSkillScoped(scope));
+}
+function uninstallSkillScoped(scope) {
+  const dir = skillDir(scope);
+  const present = fs2.existsSync(dir);
+  if (present) {
+    removeCreatedBackups(skillPath(scope));
+    assertWriteInScope(dir);
+    fs2.rmSync(dir, { recursive: true, force: true });
+  }
+  removeCreatedTree([dir]);
+  return present;
+}
+
+// src/bridges/codex.ts
+init_define_import_meta_env();
+var CODEX_HOOK_SCRIPT = `#!/usr/bin/env node
+// token-goat Codex hook shim. Forwards the hook payload to \`token-goat hook <event>\`, then strips _tg_* keys and injects hookEventName so the response satisfies Codex's strict (additionalProperties:false) schema.
+'use strict'
+${SHIM_REQUIRES}
+
+${SHIM_VALID_HOOK_EVENTS}
+
+// Codex sets no env var of its own identifying a hook subprocess; see this module's docblock.
+process.env.TOKEN_GOAT_HARNESS_OVERRIDE = 'codex'
+
+// Keep in sync with CLAUDE_CODE_EVENT_NAMES in src/hook_registry.ts -- the
+// live/wired 'token-goat hook <event>' path (src/relay.ts) always emits this
+// PascalCase spelling for hookSpecificOutput.hookEventName, never the raw
+// snake_case event name.
+const HOOK_EVENT_NAME_MAP = {
+  pre_tool_use: 'PreToolUse',
+  post_tool_use: 'PostToolUse',
+  notification: 'Notification',
+  stop: 'Stop',
+  pre_compact: 'PreCompact',
+  post_compact: 'PostCompact',
+  user_prompt_submit: 'UserPromptSubmit',
+  subagent_stop: 'SubagentStop',
+  subagent_start: 'SubagentStart',
+  session_start: 'SessionStart',
+  post_tool_use_failure: 'PostToolUseFailure',
+}
+
+function stripTg(value) {
+  if (Array.isArray(value)) return value.map(stripTg)
+  if (value && typeof value === 'object') {
+    const out = {}
+    for (const [k, v] of Object.entries(value)) {
+      if (k.startsWith('_tg_')) continue
+      out[k] = stripTg(v)
+    }
+    return out
+  }
+  return value
+}
+
+${SHIM_TRY_SERVER}
+
+${SHIM_TRY_IN_PROCESS}
+
+${SHIM_MAX_BUFFER_CONST}
+${shimFallbackTimeoutConst("codex")}
+
+async function main() {
+  const eventName = process.argv[2] || ''
+  if (!VALID_HOOK_EVENTS.has(eventName)) {
+    process.stdout.write('{}')
+    return
+  }
+  let input = ''
+  try {
+    input = require('node:fs').readFileSync(0, 'utf8')
+  } catch {
+    process.stdout.write('{}')
+    return
+  }
+  // process.argv[3], when present, is the absolute path to the token-goat CLI entry
+  // that ran 'token-goat install --codex' (baked in by hookCommandFor in
+  // codex_install.ts). Try the in-process hook lib first (tryInProcess above) --
+  // this avoids spawning a second node process altogether. If that's unavailable,
+  // invoking the entry directly via process.execPath sidesteps PATH/shell resolution
+  // for this inner call, the same single-point-of-failure class fixed for the Copilot
+  // CLI bridge's inner hook call (a bare 'token-goat' on PATH failing to resolve
+  // crashes this call, and Codex -- like Copilot -- fails closed on a non-zero-exit
+  // hook). Falls back further to the old PATH-based shell:true invocation when argv[3]
+  // is absent (an older cached hook config). A SHIM_FALLBACK_TIMEOUT_MS timeout/killSignal on both
+  // spawnSync fallbacks bounds them well under Codex's own hook timeout budget, so
+  // token-goat degrades to its own fail-open '{}' rather than being force-killed by
+  // Codex first.
+  const entryPath = process.argv[3]
+  let stdout = await tryInProcess(entryPath, eventName, input)
+  if (stdout === undefined) {
+${SHIM_SPAWN_LADDER}
+      : spawnSync('token-goat hook ' + eventName, {
+          input,
+          encoding: 'utf8',
+          shell: true,
+          timeout: SHIM_FALLBACK_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+          maxBuffer: SHIM_MAX_BUFFER_BYTES,
+        })
+    if (res.status !== 0 || !res.stdout) {
+      process.stdout.write('{}')
+      return
+    }
+    stdout = res.stdout
+  }
+  let parsed
+  try {
+    parsed = JSON.parse(stdout)
+  } catch {
+    process.stdout.write('{}')
+    return
+  }
+  parsed = stripTg(parsed)
+  const hso = parsed && parsed.hookSpecificOutput
+  if (hso && typeof hso === 'object' && !hso.hookEventName) {
+    hso.hookEventName = HOOK_EVENT_NAME_MAP[eventName] || eventName
+  }
+  process.stdout.write(JSON.stringify(parsed))
+}
+
+main().catch(() => {
+  process.stdout.write('{}')
+})
+`;
+
+// src/bridges/codex_install.ts
+init_define_import_meta_env();
+import * as crypto2 from "node:crypto";
+import * as fs3 from "node:fs";
+import * as os from "node:os";
+import * as path3 from "node:path";
+
+// src/bridges/matcher_group.ts
+init_define_import_meta_env();
+function findTokenGoatEntryPosition(groups, matcher, predicate) {
+  if (groups === void 0) return void 0;
+  for (let groupIndex = 0; groupIndex < groups.length; groupIndex++) {
+    const group = groups[groupIndex];
+    if (group.matcher !== matcher) continue;
+    const hookList = group.hooks ?? [];
+    for (let hookIndex = 0; hookIndex < hookList.length; hookIndex++) {
+      if (predicate(hookList[hookIndex].command)) return { groupIndex, hookIndex };
+    }
+  }
+  return void 0;
+}
+function findAnyTokenGoatEntryPosition(groups, predicate) {
+  if (groups === void 0) return void 0;
+  for (let groupIndex = 0; groupIndex < groups.length; groupIndex++) {
+    const hookList = groups[groupIndex].hooks ?? [];
+    for (let hookIndex = 0; hookIndex < hookList.length; hookIndex++) {
+      if (predicate(hookList[hookIndex].command)) return { groupIndex, hookIndex };
+    }
+  }
+  return void 0;
+}
+function groupHasTokenGoat2(groups, matcher, predicate) {
+  return findTokenGoatEntryPosition(groups, matcher, predicate) !== void 0;
+}
+
+// src/bridges/codex_install.ts
+var CODEX_COMMAND_MARKER = "token-goat-shim";
+var CODEX_MATCHERS = ["view_image|Bash|exec|shell|bash", "apply_patch", "web_search", "spawn_agent|multi_agent_v1wait_agent"];
+var CODEX_HOOK_EVENTS = ["PreToolUse", "PostToolUse"];
+var CODEX_EVENT_ARG = {
+  PreToolUse: "pre_tool_use",
+  PostToolUse: "post_tool_use"
+};
+var CODEX_GLOBAL_HOOK_EVENTS = ["PreCompact", "UserPromptSubmit", "Stop", "SubagentStop"];
+var CODEX_GLOBAL_EVENT_ARG = {
+  PreCompact: "pre_compact",
+  UserPromptSubmit: "user_prompt_submit",
+  Stop: "stop",
+  SubagentStop: "subagent_stop"
+};
+var CodexConfigParseError = class extends Error {
+};
+function codexHomeDir() {
+  const override = process.env["CODEX_HOME"];
+  if (override !== void 0 && override !== "") return path3.resolve(override);
+  return path3.join(os.homedir(), ".codex");
+}
+function codexConfigPath() {
+  return path3.join(codexHomeDir(), "config.toml");
+}
+function codexAgentsPath() {
+  return path3.join(codexHomeDir(), "AGENTS.md");
+}
+function codexHookScriptPath() {
+  return path3.join(codexHomeDir(), "hooks", SHIM_FILE);
+}
+function codexLegacyHookScriptPath() {
+  return path3.join(codexHomeDir(), "hooks", LEGACY_SHIM_FILE);
+}
+function readCodexConfig(p, opts = {}) {
+  const refuse = (problem, detail) => new CodexConfigParseError(
+    (opts.command === "uninstall" ? `Codex config file ${echoedValue(p)} is unreadable: it ${problem}. Uninstall left it untouched, along with the hook shim it may still name, the AGENTS.md block and the file's backups; fix the file and run uninstall again.` : `Codex config file ${echoedValue(p)} ${problem}. Fix or back up the file before running install.`) + (detail === void 0 ? "" : ` (${detail})`)
+  );
+  let raw;
+  try {
+    raw = fs3.readFileSync(p, "utf8");
+  } catch (e) {
+    const code = e.code;
+    if (opts.strict === true && code !== "ENOENT" && code !== "ENOTDIR") throw refuse("exists but cannot be read", code ?? extractErrorMessage(e));
+    return {};
+  }
+  try {
+    const parsed = parse(raw);
+    return parsed;
+  } catch (e) {
+    if (opts.strict === true) throw refuse("exists but contains invalid TOML", extractErrorMessage(e));
+    return {};
+  }
+}
+var CODEX_MARKER_PATTERN = anchoredMarkerPattern(CODEX_COMMAND_MARKER);
+function isCodexTokenGoatCommand(command) {
+  return typeof command === "string" && CODEX_MARKER_PATTERN.test(command);
+}
+function anyGroupHasTokenGoat(groups, predicate = isCodexTokenGoatCommand) {
+  return findAnyTokenGoatEntryPosition(groups, predicate) !== void 0;
+}
+function codexHookCommandFor(scriptPath, eventArg, opts = {}) {
+  const bin = nativeHookBinary(process.argv[1], opts);
+  const native = bin === void 0 ? void 0 : nativeHookCommandLine(process.platform === "win32" ? "powershell" : "sh", bin, "codex", scriptPath, eventArg);
+  if (native !== void 0) return native;
+  return process.platform === "win32" ? powershellHookLine(hookPowershellCommand(scriptPath, eventArg)) : hookCommandFor(scriptPath, eventArg);
+}
+function computeCodexHookHash(eventArg, command, matcher) {
+  const norm = {
+    event_name: eventArg,
+    hooks: [
+      {
+        async: false,
+        command,
+        timeout: 600,
+        type: "command"
+      }
+    ]
+  };
+  if (matcher !== void 0) {
+    norm["matcher"] = matcher;
+  }
+  const serialized = JSON.stringify(norm);
+  const hash = crypto2.createHash("sha256").update(serialized).digest("hex");
+  return `sha256:${hash}`;
+}
+var MANAGED_BEGIN = "# >>> token-goat codex hooks (managed block; token-goat uninstall removes it) >>>";
+var MANAGED_BEGIN_NO_EOL = "# >>> token-goat codex hooks (managed block; token-goat uninstall removes it; file had no final newline) >>>";
+var MANAGED_END = "# <<< token-goat codex hooks <<<";
+function removeManagedBlock(text) {
+  for (const begin of [MANAGED_BEGIN_NO_EOL, MANAGED_BEGIN]) {
+    const start = text.indexOf(begin);
+    if (start < 0 || start > 0 && text[start - 1] !== "\n") continue;
+    const endMark = text.indexOf(MANAGED_END, start);
+    if (endMark < 0) return void 0;
+    const nl = text.indexOf("\n", endMark);
+    const end = nl < 0 ? text.length : nl + 1;
+    const sep = start === 0 ? 0 : begin === MANAGED_BEGIN_NO_EOL ? 2 : 1;
+    if (text.slice(start - sep, start) !== "\n".repeat(sep)) return void 0;
+    return text.slice(0, start - sep) + text.slice(end);
+  }
+  return void 0;
+}
+function canonicalToml(v) {
+  if (Array.isArray(v)) return `[${v.map(canonicalToml).join(",")}]`;
+  if (v instanceof Date) return `d${v.toISOString()}`;
+  if (typeof v === "bigint") return `n${v}`;
+  if (typeof v === "object" && v !== null) {
+    return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonicalToml(v[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(v) ?? "undefined";
+}
+function appendManagedBlock(original, target) {
+  const base = removeManagedBlock(original) ?? original;
+  try {
+    const baseHooks = parse(base).hooks ?? {};
+    const targetHooks = target.hooks ?? {};
+    const added = {};
+    for (const [event, groups] of Object.entries(targetHooks)) {
+      if (event === "state" || !Array.isArray(groups)) continue;
+      const have = Array.isArray(baseHooks[event]) ? baseHooks[event].length : 0;
+      if (groups.length > have) added[event] = groups.slice(have);
+    }
+    const baseState = baseHooks["state"] ?? {};
+    const addedState = Object.fromEntries(Object.entries(targetHooks["state"] ?? {}).filter(([k]) => !(k in baseState)));
+    if (Object.keys(addedState).length > 0) added["state"] = addedState;
+    let candidate = base;
+    if (Object.keys(added).length > 0) {
+      const noEol = base.length > 0 && !base.endsWith("\n");
+      const lead = base.length === 0 ? "" : noEol ? "\n\n" : "\n";
+      candidate = `${base}${lead}${noEol ? MANAGED_BEGIN_NO_EOL : MANAGED_BEGIN}
+${stringify({ hooks: added }).trimEnd()}
+${MANAGED_END}
+`;
+    }
+    return canonicalToml(parse(candidate)) === canonicalToml(target) ? candidate : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function removeManagedBlockText(original, target, rekey) {
+  const without = removeManagedBlock(original);
+  if (without === void 0) return void 0;
+  const renamed = without.replace(/^([ \t]*)\[hooks\.state\.("(?:[^"\\\n]|\\.)*"|'[^'\n]*')\]([ \t]*(?:#[^\r\n]*)?)(\r?)$/gm, (whole, indent, quoted, tail, cr) => {
+    let key;
+    try {
+      key = quoted.startsWith('"') ? JSON.parse(quoted) : quoted.slice(1, -1);
+    } catch {
+      return whole;
+    }
+    const next = rekey.get(key);
+    return next === void 0 ? whole : `${indent}[hooks.state.${JSON.stringify(next)}]${tail}${cr}`;
+  });
+  try {
+    return canonicalToml(parse(renamed)) === canonicalToml(target) ? renamed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function codexEventLabel(event) {
+  const known = CODEX_EVENT_ARG[event] ?? CODEX_GLOBAL_EVENT_ARG[event];
+  return known ?? event.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+}
+function planStateCleanup(configPath, hooks) {
+  const ownKeys = /* @__PURE__ */ new Set();
+  const ownHashes = /* @__PURE__ */ new Set();
+  const rekey = /* @__PURE__ */ new Map();
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (event === "state" || !Array.isArray(groups)) continue;
+    const label = codexEventLabel(event);
+    const keyOf = (g, h) => `${configPath}:${label}:${g}:${h}`;
+    let newGroup = 0;
+    groups.forEach((group, gi) => {
+      const list = Array.isArray(group?.hooks) ? group.hooks : [];
+      const matcher = typeof group?.matcher === "string" ? group.matcher : void 0;
+      const mine = list.map((h) => isCodexTokenGoatCommand(h?.command));
+      list.forEach((h, hi) => {
+        if (!mine[hi]) return;
+        ownKeys.add(keyOf(gi, hi));
+        ownHashes.add(computeCodexHookHash(label, h.command, matcher));
+        ownHashes.add(computeCodexHookHash(label, h.command));
+      });
+      const kept = mine.filter((m) => !m).length;
+      if (kept === 0 && list.length > 0) return;
+      let newHook = 0;
+      list.forEach((_h, hi) => {
+        if (mine[hi]) return;
+        if (newGroup !== gi || newHook !== hi) rekey.set(keyOf(gi, hi), keyOf(newGroup, newHook));
+        newHook++;
+      });
+      newGroup++;
+    });
+  }
+  return { ownKeys, ownHashes, rekey };
+}
+function installCodex() {
+  return recordCreatedBy(codexArtifactPaths(), installCodexFiles);
+}
+function codexArtifactPaths() {
+  return [codexConfigPath(), codexAgentsPath(), codexHookScriptPath(), codexLegacyHookScriptPath()];
+}
+function installCodexFiles() {
+  const configPath = codexConfigPath();
+  const agentsPath = codexAgentsPath();
+  const scriptPath = codexHookScriptPath();
+  ensureDirSync(path3.dirname(scriptPath));
+  atomicWriteText(scriptPath, CODEX_HOOK_SCRIPT);
+  atomicWriteText(codexLegacyHookScriptPath(), legacyShimForwarder("{}"));
+  const config = readCodexConfig(configPath, { strict: true });
+  const hooks = config.hooks ?? {};
+  let hooksChanged = false;
+  const staleStateKeysToRemove = [];
+  for (const event of CODEX_HOOK_EVENTS) {
+    const eventArg = CODEX_EVENT_ARG[event];
+    const expectedCommand = codexHookCommandFor(scriptPath, eventArg);
+    const groups = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+    let removedGroups = 0;
+    for (let idx = 0; idx < groups.length; idx++) {
+      const g = groups[idx];
+      if (g.matcher === void 0 || CODEX_MATCHERS.includes(g.matcher)) continue;
+      const hookList = g.hooks ?? [];
+      const keptHooks = hookList.filter((h) => !isCodexTokenGoatCommand(h.command));
+      if (keptHooks.length === hookList.length) continue;
+      const originalIdx = idx + removedGroups;
+      hookList.forEach((h, hi) => {
+        if (isCodexTokenGoatCommand(h.command)) staleStateKeysToRemove.push(`${configPath}:${eventArg}:${originalIdx}:${hi}`);
+      });
+      hooksChanged = true;
+      if (keptHooks.length > 0) {
+        groups[idx] = { ...g, hooks: keptHooks };
+      } else {
+        groups.splice(idx, 1);
+        idx--;
+        removedGroups++;
+      }
+    }
+    for (const matcher of CODEX_MATCHERS) {
+      if (groupHasTokenGoat2(groups, matcher, (c) => c === expectedCommand)) continue;
+      const nextGroups = stripStaleGroupHooks(groups, isCodexTokenGoatCommand, { matcher });
+      groups.length = 0;
+      groups.push(...nextGroups);
+      groups.push({ matcher, hooks: [{ type: "command", command: expectedCommand }] });
+      hooksChanged = true;
+    }
+    hooks[event] = groups;
+  }
+  for (const event of CODEX_GLOBAL_HOOK_EVENTS) {
+    const eventArg = CODEX_GLOBAL_EVENT_ARG[event];
+    const expectedCommand = codexHookCommandFor(scriptPath, eventArg);
+    const groups = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+    if (anyGroupHasTokenGoat(groups, (c) => c === expectedCommand)) {
+      hooks[event] = groups;
+      continue;
+    }
+    const nextGroups = stripStaleGroupHooks(groups, isCodexTokenGoatCommand);
+    nextGroups.push({ hooks: [{ type: "command", command: expectedCommand }] });
+    hooks[event] = nextGroups;
+    hooksChanged = true;
+  }
+  const agentsChanged = writeAgentsBlock(agentsPath);
+  const hooksState = hooks["state"] ?? {};
+  for (const key of staleStateKeysToRemove) {
+    if (key in hooksState) {
+      delete hooksState[key];
+      hooksChanged = true;
+    }
+  }
+  for (const event of CODEX_HOOK_EVENTS) {
+    const eventArg = CODEX_EVENT_ARG[event];
+    const groups = hooks[event] ?? [];
+    for (let groupIndex = 0; groupIndex < groups.length; groupIndex++) {
+      const g = groups[groupIndex];
+      if (g && g.matcher && CODEX_MATCHERS.includes(g.matcher)) {
+        const hookList = g.hooks ?? [];
+        for (let hookIndex = 0; hookIndex < hookList.length; hookIndex++) {
+          const h = hookList[hookIndex];
+          if (h && isCodexTokenGoatCommand(h.command)) {
+            const stateKey = `${configPath}:${eventArg}:${groupIndex}:${hookIndex}`;
+            const hash = computeCodexHookHash(eventArg, h.command, g.matcher);
+            if (hooksState[stateKey]?.trusted_hash !== hash) {
+              hooksState[stateKey] = { ...hooksState[stateKey], trusted_hash: hash };
+              hooksChanged = true;
+            }
+          }
+        }
+      }
+    }
+  }
+  for (const event of CODEX_GLOBAL_HOOK_EVENTS) {
+    const eventArg = CODEX_GLOBAL_EVENT_ARG[event];
+    const groups = hooks[event] ?? [];
+    for (let groupIndex = 0; groupIndex < groups.length; groupIndex++) {
+      const g = groups[groupIndex];
+      if (!g) continue;
+      const hookList = g.hooks ?? [];
+      for (let hookIndex = 0; hookIndex < hookList.length; hookIndex++) {
+        const h = hookList[hookIndex];
+        if (h && isCodexTokenGoatCommand(h.command)) {
+          const stateKey = `${configPath}:${eventArg}:${groupIndex}:${hookIndex}`;
+          const hash = computeCodexHookHash(eventArg, h.command);
+          if (hooksState[stateKey]?.trusted_hash !== hash) {
+            hooksState[stateKey] = { ...hooksState[stateKey], trusted_hash: hash };
+            hooksChanged = true;
+          }
+        }
+      }
+    }
+  }
+  if (Object.keys(hooksState).length > 0) {
+    hooks["state"] = hooksState;
+  }
+  if (hooksChanged) {
+    config.hooks = hooks;
+    ensureDirSync(path3.dirname(configPath));
+    backupFile(configPath);
+    const before = fs3.existsSync(configPath) ? fs3.readFileSync(configPath, "utf8") : "";
+    writeConfigText(configPath, appendManagedBlock(before, config) ?? stringify(config));
+  }
+  return {
+    configPath,
+    agentsPath,
+    hookScriptPath: scriptPath,
+    alreadyInstalled: !hooksChanged && !agentsChanged
+  };
+}
+function uninstallCodex() {
+  const configPath = codexConfigPath();
+  const agentsPath = codexAgentsPath();
+  const scriptPath = codexHookScriptPath();
+  let removedAny = false;
+  const config = readCodexConfig(configPath, { strict: true, command: "uninstall" });
+  const hooks = config.hooks;
+  let keepBackups = false;
+  if (hooks !== void 0) {
+    const plan = planStateCleanup(configPath, structuredClone(hooks));
+    const hooksRemoved = stripOwnHooksFromMap(hooks, isCodexTokenGoatCommand);
+    const hooksState = hooks["state"];
+    let stateChanged = false;
+    if (hooksState && typeof hooksState === "object") {
+      const kept = [];
+      const moved = [];
+      for (const [key, value] of Object.entries(hooksState)) {
+        const hash = value?.trusted_hash;
+        if (plan.ownKeys.has(key) || typeof hash === "string" && plan.ownHashes.has(hash)) {
+          stateChanged = true;
+          continue;
+        }
+        const next = plan.rekey.get(key);
+        if (next === void 0) kept.push([key, value]);
+        else {
+          moved.push([next, value]);
+          stateChanged = true;
+        }
+      }
+      for (const k of Object.keys(hooksState)) delete hooksState[k];
+      for (const [k, v] of [...kept, ...moved]) hooksState[k] = v;
+      if (Object.keys(hooksState).length === 0) {
+        delete hooks["state"];
+      }
+    }
+    if (hooksRemoved || stateChanged) {
+      if (Object.keys(hooks).length === 0) {
+        delete config.hooks;
+      } else {
+        config.hooks = hooks;
+      }
+      backupFile(configPath);
+      const before = fs3.readFileSync(configPath, "utf8");
+      const text = removeManagedBlockText(before, config, plan.rekey);
+      if (text === void 0) {
+        try {
+          keepBackups = stringify(parse(before)) !== before;
+        } catch {
+          keepBackups = true;
+        }
+      }
+      writeConfigText(configPath, text ?? stringify(config));
+      removedAny = true;
+    }
+  }
+  if (stripAgentsBlock(agentsPath)) {
+    removedAny = true;
+  }
+  for (const p of [scriptPath, codexLegacyHookScriptPath()]) {
+    try {
+      fs3.unlinkSync(p);
+      removedAny = true;
+    } catch {
+    }
+  }
+  if (!keepBackups) removeCreatedBackups(configPath);
+  removeCreatedTree(codexArtifactPaths());
+  return removedAny;
+}
+function wiredCodexHookWords() {
+  const hooks = readCodexConfig(codexConfigPath()).hooks ?? {};
+  const scriptPath = codexHookScriptPath();
+  const expected = new Set([...Object.values(CODEX_EVENT_ARG), ...Object.values(CODEX_GLOBAL_EVENT_ARG)].map((arg) => codexHookCommandFor(scriptPath, arg, { sync: false })));
+  const out = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (event === "state" || !Array.isArray(groups)) continue;
+    for (const g of groups) {
+      for (const h of Array.isArray(g?.hooks) ? g.hooks : []) {
+        if (isCodexTokenGoatCommand(h?.command)) out.push({ words: splitHookCommand(h.command, process.platform === "win32" ? "powershell" : "sh"), current: expected.has(h.command) });
+      }
+    }
+  }
+  return out;
+}
+function isCodexInstalled() {
+  const configPath = codexConfigPath();
+  const config = readCodexConfig(configPath);
+  const hooks = config.hooks;
+  if (hooks === void 0) return false;
+  const scriptPath = codexHookScriptPath();
+  const hooksState = hooks["state"] ?? {};
+  for (const event of CODEX_HOOK_EVENTS) {
+    const eventArg = CODEX_EVENT_ARG[event];
+    const expectedCommand = codexHookCommandFor(scriptPath, eventArg, { sync: false });
+    const groups = hooks[event] ?? [];
+    for (const matcher of CODEX_MATCHERS) {
+      const position = findTokenGoatEntryPosition(groups, matcher, (c) => c === expectedCommand);
+      if (position === void 0) return false;
+      const stateKey = `${configPath}:${eventArg}:${position.groupIndex}:${position.hookIndex}`;
+      const expectedHash = computeCodexHookHash(eventArg, expectedCommand, matcher);
+      if (hooksState[stateKey]?.trusted_hash !== expectedHash) return false;
+    }
+  }
+  for (const event of CODEX_GLOBAL_HOOK_EVENTS) {
+    const eventArg = CODEX_GLOBAL_EVENT_ARG[event];
+    const expectedCommand = codexHookCommandFor(scriptPath, eventArg, { sync: false });
+    const groups = hooks[event] ?? [];
+    const position = findAnyTokenGoatEntryPosition(groups, (c) => c === expectedCommand);
+    if (position === void 0) return false;
+    const stateKey = `${configPath}:${eventArg}:${position.groupIndex}:${position.hookIndex}`;
+    const expectedHash = computeCodexHookHash(eventArg, expectedCommand);
+    if (hooksState[stateKey]?.trusted_hash !== expectedHash) return false;
+  }
+  if (!fs3.existsSync(scriptPath)) return false;
+  let agents;
+  try {
+    agents = fs3.readFileSync(codexAgentsPath(), "utf8");
+  } catch {
+    return false;
+  }
+  return agents.includes(AGENTS_BEGIN) && agents.includes(AGENTS_END);
+}
+var AGENTS_BEGIN = "<!-- token-goat-codex-begin -->";
+var AGENTS_END = "<!-- token-goat-codex-end -->";
+function buildAgentsBlock() {
+  return buildGuidanceBlock({
+    beginMarker: AGENTS_BEGIN,
+    endMarker: AGENTS_END,
+    fallbackToolClause: "Codex's native `exec`, `apply_patch`, and `view_image` tools (shell commands like `cat`/`type` run inside `exec`)",
+    gdrive: loadConfig().gdrive.enabled
+  });
+}
+function writeAgentsBlock(p) {
+  return upsertDelimitedBlock(p, AGENTS_BEGIN, AGENTS_END, buildAgentsBlock());
+}
+function stripAgentsBlock(p) {
+  return stripDelimitedBlock(p, AGENTS_BEGIN, AGENTS_END);
+}
+
+// src/bridges/copilot_cli.ts
+init_define_import_meta_env();
+
+// src/bridges/copilot_session_start.ts
+init_define_import_meta_env();
+var COPILOT_SESSION_START_HELPERS = `
+const SHIM_SESSION_START_TIMEOUT_MS = ${SHIM_SESSION_START_TIMEOUT_MS}
+
+// Test-only seam, mirrored by the native owner: a plain decimal in range replaces the budget so a test need not race the clock; anything else is ignored.
+function sessionStartBudgetMs() {
+  const text = process.env.${SESSION_START_TEST_BUDGET_ENV}
+  if (typeof text !== 'string' || !/^[0-9]+$/.test(text)) return SHIM_SESSION_START_TIMEOUT_MS
+  const value = Number(text)
+  return value >= ${SESSION_START_TEST_BUDGET_MIN_MS} && value <= ${SESSION_START_TEST_BUDGET_MAX_MS} ? value : SHIM_SESSION_START_TIMEOUT_MS
+}
+const SESSION_START_CLEANUP_RESERVE_MS = 1000
+// How long past the deadline the shim keeps its stdin listener for a payload already in the pipe: on Windows the pipe read completes on a worker thread, so the completion can land many event-loop turns after the listener attaches. Measured resume-to-data under 52 busy loops on 26 CPUs: p50 5.7 ms, max 204 ms.
+const SESSION_START_LATE_PAYLOAD_GRACE_MS = 1000
+const SESSION_START_MAX_INPUT_BYTES = 1024 * 1024
+
+function failOpenSessionStart(reason) {
+  process.stderr.write('[token-goat] SessionStart failed open: ' + reason + '\\n')
+  process.stdout.write('{}')
+}
+
+function readSessionStartInput(timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    const closers = []
+    let totalBytes = 0
+    let frameStart = -1
+    let frameEnd = -1
+    let inString = false
+    let escaped = false
+    let settled = false
+    let timer
+
+    function cleanup() {
+      clearTimeout(timer)
+      process.stdin.removeListener('data', onData)
+      process.stdin.removeListener('end', onEnd)
+      process.stdin.removeListener('error', onError)
+      process.stdin.pause()
+      if (typeof process.stdin.unref === 'function') process.stdin.unref()
+      process.stdin.destroy()
+    }
+
+    function finish(error, value) {
+      if (settled) return
+      settled = true
+      cleanup()
+      if (error) reject(new Error(error))
+      else resolve(value)
+    }
+
+    function onData(chunk) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      const chunkStart = totalBytes
+      totalBytes += bytes.length
+      if (totalBytes > SESSION_START_MAX_INPUT_BYTES) {
+        finish('input exceeded 1 MiB')
+        return
+      }
+      chunks.push(bytes)
+
+      for (let index = 0; index < bytes.length; index += 1) {
+        const byte = bytes[index]
+        const position = chunkStart + index
+        if (frameEnd !== -1) {
+          if (byte !== 0x20 && byte !== 0x09 && byte !== 0x0a && byte !== 0x0d) {
+            finish('input contained trailing data')
+            return
+          }
+          continue
+        }
+        if (frameStart === -1) {
+          if (byte === 0x20 || byte === 0x09 || byte === 0x0a || byte === 0x0d) continue
+          if (byte !== 0x7b) {
+            finish('input was not a JSON object')
+            return
+          }
+          frameStart = position
+          closers.push(0x7d)
+          continue
+        }
+        if (inString) {
+          if (escaped) escaped = false
+          else if (byte === 0x5c) escaped = true
+          else if (byte === 0x22) inString = false
+          continue
+        }
+        if (byte === 0x22) {
+          inString = true
+        } else if (byte === 0x7b) {
+          closers.push(0x7d)
+        } else if (byte === 0x5b) {
+          closers.push(0x5d)
+        } else if (byte === 0x7d || byte === 0x5d) {
+          if (closers.pop() !== byte) {
+            finish('input contained malformed JSON')
+            return
+          }
+          if (closers.length === 0) frameEnd = position + 1
+        }
+      }
+
+      if (frameEnd !== -1) {
+        const framed = Buffer.concat(chunks, totalBytes)
+        const raw = framed.subarray(frameStart, frameEnd).toString('utf8')
+        try {
+          const parsed = JSON.parse(raw)
+          if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            finish('input was not a JSON object')
+            return
+          }
+        } catch {
+          finish('input contained malformed JSON')
+          return
+        }
+        finish(undefined, raw)
+      }
+    }
+
+    function onEnd() {
+      finish(frameStart === -1 ? 'stdin closed without input' : 'stdin closed before the JSON object was complete')
+    }
+
+    function onError() {
+      finish('stdin could not be read')
+    }
+
+    // A payload already in the pipe must be framed even when the deadline has passed: expiry opens one bounded grace window that data, end or error closes at once, so only a payload that never arrives costs the full grace.
+    timer = setTimeout(() => { timer = setTimeout(() => finish('input deadline exceeded'), SESSION_START_LATE_PAYLOAD_GRACE_MS) }, Math.max(0, timeoutMs))
+    process.stdin.on('data', onData)
+    process.stdin.on('end', onEnd)
+    process.stdin.on('error', onError)
+    process.stdin.resume()
+  })
+}
+
+// Plain-JS mirror of session_start_owed.ts::resetSessionStartOwed for a main-thread key: tests/session_start_owed_reset.test.ts pins both to the same files. It runs before anything can throw so a helper killed before its own stamp still leaves the start begun, and an earlier start's marker cannot read settled.
+function resetSessionStartOwedFiles(payload) {
+  stampSessionStartOwedFiles(payload, true)
+}
+
+// A start this shim failed open on is owed whatever the helper's own marker says: the helper judges "settled in time" from its own clock, and the shim can still discard its response (a helper whose exit outlasts the budget, a cleanup that fails, an unreadable response). The shim is the party that knows it printed nothing, so it re-stamps the start begun after the helper tree is gone. A plain-JS mirror of session_start_owed.ts::recordSessionStartBegun.
+function stampSessionStartOwedFiles(payload, dropClaim) {
+  try {
+    const raw = payload && (payload.session_id !== undefined ? payload.session_id : payload.sessionId)
+    if (typeof raw !== 'string' || raw === '' || raw.indexOf(':agent:') !== -1) return
+    // A subagent's key is salted, and its start is not the parent's to reset.
+    if (payload.agent_id || payload.agentId) return
+    const override = (process.env.TOKEN_GOAT_HOME || '').trim()
+    const rooted = override !== '' && require('node:path').isAbsolute(override) &&
+      (process.platform !== 'win32' || !['', '/', String.fromCharCode(92)].includes(require('node:path').parse(override).root))
+    const home = rooted ? override : require('node:path').join(require('node:os').homedir(), '.token-goat')
+    const stem = raw.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64)
+    if (stem === '') return
+    // The claim goes, and the settle file is rewritten as a begun stamp: only a begun, unsettled start is owed.
+    if (dropClaim) require('node:fs').rmSync(require('node:path').join(home, 'sessions', stem + '.session-start-owed'), { force: true })
+    require('node:fs').mkdirSync(require('node:path').join(home, 'sessions'), { recursive: true })
+    require('node:fs').writeFileSync(require('node:path').join(home, 'sessions', stem + '.session-start'), JSON.stringify({ begunAtMs: Date.now() }), 'utf8')
+  } catch {
+    // Best-effort: the helper clears the marker itself when it gets that far.
+  }
+}
+
+async function runBoundedSessionStart(entryPath, eventName, payload, harness, deadline) {
+  resetSessionStartOwedFiles(payload)
+  // Do not probe entryPath here: even existsSync can block on a network filesystem.
+  if (typeof entryPath !== 'string' || entryPath === '') throw new Error('hook entry unavailable')
+  const remainingMs = deadline - Date.now()
+  if (remainingMs <= 0) throw new Error('overall deadline exceeded')
+  // Reject before spawning when only the process-tree teardown reserve remains.
+  if (remainingMs <= SESSION_START_CLEANUP_RESERVE_MS) {
+    throw new Error('insufficient time for process-tree cleanup')
+  }
+
+  const args = [entryPath, 'hook', eventName]
+  const env = Object.assign({}, process.env, { TOKEN_GOAT_HOOK_SERVER: '0' })
+  if (process.platform === 'win32') env.TG_SESSION_START_DEFER_WORKER = '1'
+  // Lets the helper's settle marker say how close to the deadline it finished.
+  env.TG_SESSION_START_DEADLINE_EPOCH = String(deadline)
+  if (harness === 'vscode') {
+    args.push('--harness', 'vscode')
+    env.TOKEN_GOAT_HARNESS_OVERRIDE = 'vscode'
+    env.TOKEN_GOAT_VSCODE_HOOKS_DIR = __dirname
+  } else {
+    env.TOKEN_GOAT_HARNESS_OVERRIDE = 'copilot_cli'
+    env.TOKEN_GOAT_COPILOT_HOOKS_DIR = __dirname
+  }
+
+  let stdout
+  try {
+    stdout = await superviseSessionStart({ args, env, payload, deadline })
+  } catch (error) {
+    // The caller prints the failed-open line and exactly {}: the start is owed, whatever marker the helper left.
+    stampSessionStartOwedFiles(payload, false)
+    throw error
+  }
+  try {
+    const parsed = JSON.parse(stdout.trim())
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error('hook helper returned a non-object response')
+    }
+    return JSON.stringify(parsed)
+  } catch {
+    stampSessionStartOwedFiles(payload, false)
+    throw new Error('hook helper returned invalid JSON')
+  }
+}
+
+function superviseSessionStart({ args, env, payload, deadline }) {
+  if (process.platform === 'win32') return superviseWindowsSessionStart({ args, env, payload, deadline })
+  const { spawn } = require('node:child_process')
+  // On POSIX, retain the canonical root until its detached group is killed.
+  const supervisor = [
+    "const keeper = setInterval(() => {}, 1000); keeper.unref()",
+    "let finished = false",
+    "function done(code) { if (finished) return; finished = true; keeper.ref(); process.send({ type: 'hookExit', code }) }",
+    "process.exit = code => done(code === undefined ? (process.exitCode || 0) : Number(code))",
+    "process.once('beforeExit', code => done(code))",
+    "process.once('uncaughtException', () => done(1))",
+    "process.once('unhandledRejection', () => done(1))",
+    "import(require('node:url').pathToFileURL(require('node:path').resolve(process.argv[1])).href).catch(() => done(1))",
+  ].join(';')
+  return new Promise((resolve, reject) => {
+    const root = spawn(process.execPath, ['-e', supervisor, ...args], {
+      env, windowsHide: true,
+      // owner: this shim, which SIGKILLs the whole group in beginCleanup and, when that fails or the supervisor died first, in cleanupFailed; dies when the helper reports its exit, on an error, a timeout or the hard deadline (descendants that left the group, or the shim itself being SIGKILLed, are not covered).
+      detached: process.platform !== 'win32',
+      stdio: ['pipe', 'pipe', 'pipe', 'ipc'],
+    })
+    let helperCode
+    let rootClosed = false
+    let cleaning = false
+    let cleaned = false
+    let settled = false
+    let failure
+    let outputBytes = 0
+    const output = []
+    let stderrBytes = 0
+    let timer
+    let hardTimer
+
+    function alive(pid) {
+      if (!pid) return false
+      try { process.kill(pid, 0); return true } catch (error) { return error.code === 'EPERM' }
+    }
+
+    function finish(error) {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      clearTimeout(hardTimer)
+      root.removeListener('message', onMessage)
+      root.removeListener('exit', onExit)
+      root.removeListener('close', onClose)
+      root.stdout.removeListener('data', onOutput)
+      root.stderr.removeListener('data', onStderr)
+      root.stdin.destroy()
+      root.stdout.destroy()
+      root.stderr.destroy()
+      if (root.connected) root.disconnect()
+      // owner: this shim, which has killed the group by now (beginCleanup, or the group kill in cleanupFailed); dies when that kill lands, and the unref only lets the shim exit.
+      root.unref()
+      if (error) reject(new Error(error))
+      else resolve(Buffer.concat(output, outputBytes).toString('utf8'))
+    }
+
+    function complete() {
+      // close, not exit, proves all buffered stdout was drained. The hard deadline
+      // below also covers an escaped descendant retaining a pipe indefinitely.
+      if (!cleaned || !rootClosed) return
+      if (!failure && (helperCode !== 0 || outputBytes === 0)) failure = 'hook helper exited without a response'
+      finish(failure)
+    }
+
+    function killGroup() { process.kill(-root.pid, 'SIGKILL') }
+
+    function cleanupFailed(reason) {
+      // The group outlives its leader while any member runs, so this reaches descendants even after the supervisor died; ESRCH means no member is left. Descendants that left the group are still unverified.
+      if (root.pid) {
+        try { killGroup() } catch (error) {
+          if (error.code !== 'ESRCH') reason += '; group kill failed'
+        }
+      }
+      // Verify the known owned PIDs before falling back to direct kills. Unknown
+      // descendants cannot be certified clean when the tree utility has failed.
+      const remaining = [root.pid].filter(alive)
+      for (const pid of remaining) {
+        try { process.kill(pid, 'SIGKILL') } catch (error) {
+          if (error.code !== 'ESRCH') reason += '; direct kill failed for PID ' + pid
+        }
+      }
+      finish((failure ? failure + '; ' : '') + 'process-tree cleanup failed: ' + reason
+        + '; remaining owned PIDs before fallback: ' + (remaining.join(',') || 'none')
+        + '; remaining known PIDs after fallback: ' + (remaining.filter(alive).join(',') || 'none')
+        + '; descendant termination not verified')
+    }
+
+    function beginCleanup(reason) {
+      if (reason && !failure) failure = reason
+      if (settled || cleaning) return
+      cleaning = true
+      clearTimeout(timer)
+      if (!root.pid) { finish(failure || 'hook helper could not run'); return }
+      try {
+        killGroup()
+        cleaned = true
+        complete()
+      } catch (error) {
+        cleanupFailed(error.code || 'group kill failed')
+      }
+    }
+
+    function onOutput(chunk) {
+      outputBytes += chunk.length
+      if (outputBytes > SESSION_START_MAX_INPUT_BYTES) { beginCleanup('hook helper output exceeded 1 MiB'); return }
+      output.push(chunk)
+    }
+
+    function onStderr(chunk) {
+      stderrBytes += chunk.length
+      if (stderrBytes > SESSION_START_MAX_INPUT_BYTES) beginCleanup('hook helper stderr exceeded 1 MiB')
+    }
+
+    function onMessage(message) {
+      if (message && message.type === 'hookExit') {
+        helperCode = message.code
+        beginCleanup(message.code === 0 ? undefined : 'hook helper exited without a response')
+      }
+    }
+
+    function onExit() {
+      if (!cleaning) cleanupFailed('supervisor exited before tree cleanup')
+    }
+
+    function onClose() { rootClosed = true; complete() }
+
+    root.on('message', onMessage)
+    root.once('exit', onExit)
+    root.once('close', onClose)
+    root.once('error', () => beginCleanup('hook helper could not run'))
+    root.stdin.on('error', () => beginCleanup('hook helper input failed'))
+    root.stdout.on('data', onOutput)
+    root.stderr.on('data', onStderr)
+    root.stdout.on('error', () => beginCleanup('hook helper stdout failed'))
+    root.stderr.on('error', () => beginCleanup('hook helper stderr failed'))
+    const remaining = deadline - Date.now()
+    // Reserve the final second of the single budget for owned-tree teardown.
+    timer = setTimeout(() => beginCleanup('hook helper timed out'), Math.max(0, remaining - SESSION_START_CLEANUP_RESERVE_MS))
+    hardTimer = setTimeout(() => cleanupFailed('overall deadline exceeded'), Math.max(0, remaining))
+    root.stdin.end(JSON.stringify(payload))
+  })
+}
+
+function superviseWindowsSessionStart({ args, env, payload, deadline }) {
+  const { spawn } = require('node:child_process')
+  const path = require('node:path')
+  // Pure path arithmetic on the trusted installed entry, never PATH lookup or
+  // synchronous filesystem probing in the externally visible parent.
+  const binary = path.join(path.dirname(args[0]), 'native', 'win32-' + process.arch, 'tg-hook.exe')
+  return new Promise((resolve, reject) => {
+    // owner: the native tg-hook client, which holds a strict Job Object and ends every descendant when this shim closes its handle; dies when the job closes or the deadline passes.
+    const root = spawn(binary, ['--session-start-owner-v1', String(deadline), process.execPath, ...args], {
+      env, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'],
+    })
+    const output = []
+    const diagnostics = []
+    let outputBytes = 0
+    let diagnosticBytes = 0
+    let settled = false
+    let timer
+    function finish(error, candidate) {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      root.stdin.destroy()
+      root.stdout.destroy()
+      root.stderr.destroy()
+      // Killing the owner closes the sole non-inherited job handle. Never
+      // traverse a dead canonical PID or launch an unowned Windows fallback.
+      if (error && root.pid) root.kill('SIGKILL')
+      // owner: this shim, which kills the native owner on any error (its job handle closing ends the tree) and finds it closed on success; dies when that kill lands or the owner has exited.
+      root.unref()
+      if (error) reject(new Error(error))
+      else resolve(JSON.stringify(candidate))
+    }
+    root.once('error', error => finish('native startup owner unavailable: ' + error.message))
+    root.stdin.on('error', error => finish('native startup owner input failed: ' + error.message))
+    root.stdout.on('error', error => finish('native startup owner stdout failed: ' + error.message))
+    root.stderr.on('error', error => finish('native startup owner stderr failed: ' + error.message))
+    root.stdout.on('data', chunk => {
+      outputBytes += chunk.length
+      if (outputBytes > SESSION_START_MAX_INPUT_BYTES + 4096) finish('native startup owner output exceeded 1 MiB')
+      else output.push(chunk)
+    })
+    root.stderr.on('data', chunk => {
+      diagnosticBytes += chunk.length
+      if (diagnosticBytes > SESSION_START_MAX_INPUT_BYTES) finish('native startup owner stderr exceeded 1 MiB')
+      else diagnostics.push(chunk)
+    })
+    root.once('close', code => {
+      if (settled) return
+      const diagnostic = Buffer.concat(diagnostics).toString('utf8').trim()
+      if (code !== 0) { finish('native startup owner failed: ' + (diagnostic || 'exit ' + code)); return }
+      let ack
+      try { ack = JSON.parse(Buffer.concat(output).toString('utf8')) } catch {
+        finish('native startup owner returned invalid protocol JSON'); return
+      }
+      if (!ack || ack.protocol !== 'tg-session-start-owner-v1' || ack.capability !== 'atomic-job-list'
+          || ack.activeProcesses !== 0 || ack.rootExited !== true || ack.pipesDrained !== true
+          || !ack.candidate || typeof ack.candidate !== 'object' || Array.isArray(ack.candidate)) {
+        finish('native startup owner incompatible protocol or unverified cleanup'); return
+      }
+      if (ack.workerWake === true) {
+        // The installed native entry owns this shim too. Relay only a bounded
+        // request; it, not an inner owner, must launch outside every startup job.
+        if (process.argv[4] && process.argv[4].startsWith('--session-start-deadline=')) {
+          process.stderr.write('\\x1eTG_WORKER_WAKE_V1\\x1e\\n')
+        } else if (process.env.TOKEN_GOAT_NO_WORKER_SPAWN !== '1') {
+          const workerEnv = Object.assign({}, process.env)
+          delete workerEnv.TG_SESSION_START_DEFER_WORKER
+          try {
+            const worker = spawn(process.execPath, [args[0], '--worker-daemon', '--claim-worker'], {
+              env: workerEnv, cwd: require('node:os').tmpdir(), windowsHide: true, stdio: 'ignore',
+              // owner: none, the daemon outlives this shim on purpose; dies when its pid file or data directory is gone, when it sits idle, or on worker stop.
+              detached: true,
+            })
+            worker.on('error', () => {})
+            // owner: none, the daemon outlives this shim on purpose; dies when its pid file or data directory is gone, when it sits idle, or on worker stop.
+            worker.unref()
+          } catch {
+            // Queue remains durable; ordinary lifecycle activation can retry.
+          }
+        }
+      }
+      finish(undefined, ack.candidate)
+    })
+    timer = setTimeout(() => finish('native startup owner overall deadline exceeded'), Math.max(0, deadline - Date.now()))
+    root.stdin.end(JSON.stringify(payload))
+  })
+}
+`;
+
+// src/bridges/shrink_block.ts
+init_define_import_meta_env();
+var MATERIALIZE_SHRUNK_IMAGE_JS = `// Best-effort sweep of previously materialized shrunk copies in the OS temp dir. The temp file only needs to outlive the single tool call whose path argument was rewritten to it, so anything older than an hour is finished with; the "token-goat-shrink-" prefix check confines the sweep to this mechanism's own files (same defense-in-depth rule as pruneShrinkCache in src/image_shrink.ts). Throttled per process; runs only when a shrink payload actually arrives, so the common no-image path never pays for it.
+const MATERIALIZED_SHRINK_MAX_AGE_MS = 60 * 60 * 1000
+let lastMaterializedShrinkSweepAtMs = 0
+function pruneMaterializedShrinks() {
+  const now = Date.now()
+  if (now - lastMaterializedShrinkSweepAtMs < MATERIALIZED_SHRINK_MAX_AGE_MS) return
+  lastMaterializedShrinkSweepAtMs = now
+  try {
+    const dir = os.tmpdir()
+    for (const file of fs.readdirSync(dir)) {
+      if (!file.startsWith("token-goat-shrink-")) continue
+      const full = path.join(dir, file)
+      try {
+        const st = fs.statSync(full)
+        if (st.isFile() && now - st.mtimeMs > MATERIALIZED_SHRINK_MAX_AGE_MS) fs.unlinkSync(full)
+      } catch {
+        // Best-effort per-file cleanup; one bad stat/unlink must not abort the sweep.
+      }
+    }
+  } catch {
+    // Best-effort; a readdir failure must never break the materialization below.
+  }
+}
+
+// Decode a token-goat image-shrink additionalContext payload ("<summary>\\ndata:image/<fmt>;base64,<data>") into a real file on disk, since the host's pre-tool hook has no context-injection channel to hand the shrunk image to the model directly -- only argument rewriting. The temp filename is derived from pid/time/random alone, never from the source image's own name, so an attacker-chosen filename cannot steer the write; the format suffix comes from the data-URL's media subtype, whose character class ([a-zA-Z0-9.+-]) admits no path separators. Returns undefined (leaving the original path argument untouched, so a failed shrink falls back to the original image) if the context isn't a shrink payload or anything goes wrong writing it.
+function materializeShrunkImage(context) {
+  if (typeof context !== "string") return undefined
+  const idx = context.indexOf("data:image/")
+  if (idx === -1) return undefined
+  const match = /^data:image\\/([a-zA-Z0-9.+-]+);base64,([A-Za-z0-9+/=]+)$/.exec(context.slice(idx).trim())
+  if (!match) return undefined
+  try {
+    pruneMaterializedShrinks()
+    const buf = Buffer.from(match[2], "base64")
+    const name = \`token-goat-shrink-\${process.pid}-\${Date.now()}-\${globalThis.crypto.randomUUID()}.\${match[1]}\`
+    const file = path.join(os.tmpdir(), name)
+    // Owner-only: the copy is of a workspace image and sits in the shared temp dir.
+    fs.writeFileSync(file, buf, { mode: 0o600 })
+    return file
+  } catch {
+    return undefined
+  }
+}`;
+
+// src/bridges/copilot_cli.ts
+var COPILOT_CLI_HOOK_SCRIPT = `#!/usr/bin/env node
+// token-goat Copilot CLI hook shim. Translates Copilot's hook event names and
+// request/response schema to/from token-goat's internal hook protocol.
+'use strict'
+${SHIM_MAX_BUFFER_CONST}
+const { spawnSync } = require('node:child_process')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const { pathToFileURL } = require('node:url')
+
+// How long the fallback spawn of the real hook may run before the shim answers an empty fail-open '{}' for it. The hook entries token-goat installs give Copilot 60 s (HOOK_TIMEOUT_SEC in copilot_cli_install.ts); the number is SHIM_FALLBACK_TIMEOUT_MS.copilot in shim_common.ts, and a hook Copilot kills fails open the same way, so a cap of a few seconds only discarded the verdict of a cold start that was merely slow (bundle load, DB open, a loaded machine). Kept under that 60 s so the shim, not Copilot, ends a hook that really is stuck.
+${shimFallbackTimeoutConst("copilot")}
+${COPILOT_SESSION_START_HELPERS}
+
+// Copilot event name -> token-goat internal HookEventName (src/types.ts's
+// HOOK_EVENTS). Only these nine have a token-goat handler; every other real
+// Copilot event (sessionEnd, errorOccurred, notification, permissionRequest)
+// is left unimplemented rather than guessed at, and falls through to the
+// default no-op below. subagentStart answers with the spawn briefing as
+// additionalContext, which Copilot CLI 1.0.88 prepends to the subagent's own
+// prompt (capture C4a), so the briefing no longer rides a rewrite of the
+// parent's task call and stays out of the parent's history.
+// postToolUseFailure is the newest of the eight and the only one whose channel
+// costs tokens instead of saving them: it fires instead of postToolUse when a
+// tool result is a failure, and accepts only additionalContext back --
+// modifiedResult and suppressOutput are not honored there, so a failed result
+// still cannot be fenced, compressed or shrunk. It is wired anyway because
+// additionalContext demonstrably reaches the model (see the postToolUseFailure
+// branch in translate() for the bundle offset), and hooks_tool_failure.ts
+// spends that channel only on an exact repeat failure, where staying silent
+// costs a whole wasted retry.
+// 'sessionStart' was previously a permanent no-op on the stated grounds that
+// token-goat has no internal session_start handler. That was simply wrong --
+// hooks_session_start.ts has long emitted the command-routing reminder that
+// every other harness receives -- and the no-op was the reason Copilot CLI
+// sessions alone never got told token-goat exists. It is wired now: verified
+// against Copilot CLI 1.0.77 that a hooks.json sessionStart entry returning
+// {additionalContext} does reach the model. The github/copilot-cli#2142
+// fire-and-forget bug that would have made this dead wiring was fixed in a
+// pre-release months before that version, and its companion multi-extension
+// hook-overwrite bug never applied here: it hit runtime *extension* hooks,
+// while this config-file hooks.json path goes through Copilot's own merge.
+const COPILOT_TO_TG_EVENT = {
+  sessionStart: 'session_start',
+  preToolUse: 'pre_tool_use',
+  postToolUse: 'post_tool_use',
+  preCompact: 'pre_compact',
+  agentStop: 'stop',
+  subagentStop: 'subagent_stop',
+  userPromptSubmitted: 'user_prompt_submit',
+  postToolUseFailure: 'post_tool_use_failure',
+  subagentStart: 'subagent_start',
+}
+
+// Keys only VS Code reads. VS Code 1.137 parses this same hooks file and
+// accepts a key either from its camelCase Copilot table, which has no
+// subagentStart, or when the key is already its own PascalCase hook type
+// (workbench.desktop.main.js: iut(key) ?? eut(key)). So VS Code's subagent
+// hook needs the key spelled SubagentStart. A Copilot CLI payload arriving on
+// one of these keys is answered with nothing, so a Copilot build that also
+// honored the PascalCase spelling could not brief a subagent twice.
+const VSCODE_ONLY_TO_TG_EVENT = {
+  SessionStart: 'session_start',
+  SubagentStart: 'subagent_start',
+}
+
+// Copilot built-in tool name -> token-goat internal tool name. Confirmed via
+// @github/copilot-sdk type definitions and multiple real GitHub issue payload
+// dumps -- supersedes an earlier docs-based guess (shell/read/write/url) that
+// didn't hold up in practice; 'write' in particular was never a real
+// toolName value, only a Copilot permission-pattern keyword. 'powershell'
+// maps to the same 'Bash' handler as 'bash' since both are shell-command
+// execution from token-goat's perspective (mirrors how hooks_bash.ts's own
+// filters already treat powershell-wrapped commands as part of the Bash
+// pipeline, not a separate tool). 'task', 'ask_user', 'memory', and
+// MCP-server tool invocations (<server-name>-<tool-name>) have no
+// token-goat equivalent and are passed through unmapped (safe no-op for
+// handlers that don't recognize the name).
+// 'read_bash'/'read_powershell' are the background-shell output pollers, and
+// they are the exact shape of Claude Code's BashOutput: Copilot's shell tool
+// is async, so a long-running command is started once and then re-read over
+// and over within one turn, each read returning the accumulated output again.
+// hooks_bashoutput.ts already collapses that into a delta (or a short
+// "unchanged" marker) for Claude Code, and now does the same here. Both the
+// names and the argument key were read out of the shipping 1.0.80 bundle
+// rather than guessed: the builtin tool-name table in
+// prebuilds/win32-x64/runtime.node lists read_bash/stop_bash/list_bash and
+// read_powershell/stop_powershell/list_powershell, and the poller's own input
+// schema in app.js is {shellId, delay} -- so the shell id needs the
+// POLL_ID_ARG_KEY remap below to reach postBashOutputHandler, which reads
+// 'bash_id'. read_shell/stop_shell/list_shells, which an earlier static sweep
+// of the same binary suggested were the real names, are internal Rust
+// identifiers (tool_read_shell_prepare_input, tool_list_shells_descriptor,
+// PreparedStopShellInput, and the serde field names of the shell config
+// struct), never wire tool names, so they are deliberately absent here.
+// stop_bash/list_bash and their powershell twins stay unmapped because
+// token-goat has no KillShell-equivalent handler for them to reach; a mapping
+// would be pure decoration.
+// 'bash'/'powershell' stay exactly as they were. The same sweep suggested the
+// executor had been renamed to write_bash/write_powershell and that this
+// mapping was dead, and that is not what the bundle says: app.js resolves the
+// executor as shellConfig?.shellToolName ?? "bash" (with "powershell" as the
+// Windows default of the same config), and its command lives under 'command'
+// exactly as hooks_bash.ts expects. write_bash/write_powershell are real tool
+// names, but they are a different tool -- their schema is {shellId, input,
+// delay} and the bundle files them under the subtype "write_shell", i.e. send
+// stdin to an already-running shell, not run a command. Mapping them to Bash
+// would label a stdin write as a shell execution, so they are left unmapped.
+// 'task', 'read_agent' and 'memory'-family tools are likewise left alone:
+// task's result is assembled in the native addon and its shape is unknown,
+// read_agent is an incremental poll that postAgentHandler is not written for,
+// and the real tool names behind memory were never confirmed. Each would put
+// a handler that rewrites model-visible output in front of a payload shape
+// nobody has seen, which is worse than leaving the compression on the table.
+// Own properties only, for every map in this shim -- see the event map in main() for why a
+// bare lookup on a plain object literal is not a gate. A tool named 'constructor' resolved to
+// a Function, which JSON.stringify drops, so the forwarded payload carried no tool_name and
+// every hook keyed on one no-opped; '__proto__' forwarded a whole prototype instead. The key
+// is third-party text: Copilot namespaces MCP tools as server:tool and the stripped half is
+// whatever that server called its tool.
+function ownGet(map, key) {
+  return typeof key === 'string' && Object.prototype.hasOwnProperty.call(map, key) ? map[key] : undefined
+}
+
+const TOOL_TO_TG = {
+  bash: 'Bash',
+  powershell: 'Bash',
+  read_bash: 'BashOutput',
+  read_powershell: 'BashOutput',
+  view: 'Read',
+  create: 'Write',
+  edit: 'Edit',
+  web_fetch: 'WebFetch',
+  web_search: 'WebSearch',
+  grep: 'Grep',
+  glob: 'Glob',
+  skill: 'Skill',
+  exit_plan_mode: 'ExitPlanMode',
+}
+
+function foldToolName(name) {
+  return typeof name === 'string' ? name.toLowerCase().replace(/[_-]/g, '') : ''
+}
+
+const FOLDED_TOOL_TO_TG = {}
+for (const [k, v] of Object.entries(TOOL_TO_TG)) {
+  FOLDED_TOOL_TO_TG[foldToolName(k)] = v
+}
+// Also register folded entries for canonical TG tool names directly (e.g. WebSearch -> websearch)
+for (const v of Object.values(TOOL_TO_TG)) {
+  FOLDED_TOOL_TO_TG[foldToolName(v)] = v
+}
+
+function resolveCanonicalToolName(name) {
+  if (!name || typeof name !== 'string') return name
+  const direct = ownGet(TOOL_TO_TG, name)
+  if (direct !== undefined) return direct
+  const stripped = name.indexOf(':') !== -1 ? name.split(':').pop() : name
+  const strippedDirect = ownGet(TOOL_TO_TG, stripped)
+  if (strippedDirect !== undefined) return strippedDirect
+  const folded = foldToolName(name)
+  const foldedStripped = foldToolName(stripped)
+  return ownGet(FOLDED_TOOL_TO_TG, folded) || ownGet(FOLDED_TOOL_TO_TG, foldedStripped) || name
+}
+
+// Confirmed via github/copilot-cli#3349 (open, unresolved as of writing): some
+// real Copilot CLI invocations send toolArgs as a JSON-*encoded string*
+// rather than a parsed object, contradicting the documented schema. Left
+// unhandled, canonical.tool_input would become a raw string and every
+// downstream event.toolInput[key] lookup in token-goat's handlers would
+// silently return undefined -- the deny/dedup mechanism would no-op with no
+// error surfaced. Parse it defensively; on a non-string, absent, or
+// unparsable value, fall back to {} rather than throwing (this shim's
+// convention throughout is fail-open, never crash on a malformed payload).
+function parseMaybeJsonObject(value) {
+  if (value && typeof value === 'object') return value
+  if (typeof value === 'string') {
+    try {
+      const parsed = JSON.parse(value)
+      if (parsed && typeof parsed === 'object') return parsed
+    } catch {
+      // fall through to {}
+    }
+  }
+  return {}
+}
+
+// view/edit/create send the file path under 'path'; every token-goat handler these
+// three tools reach only ever looks for 'file_path' (getFilePath in hooks_common.ts).
+// Keyed by the ORIGINAL Copilot tool name (before TOOL_TO_TG renames it) since that's
+// the name toolArgs' shape is keyed to, not token-goat's internal tool name.
+const FILE_PATH_ARG_KEY = {
+  view: 'path',
+  edit: 'path',
+  create: 'path',
+}
+
+// read_bash/read_powershell send the background shell's id under 'shellId' (confirmed
+// against the poller's input schema in the shipping 1.0.80 app.js: {shellId, delay});
+// postBashOutputHandler reads 'bash_id'. Without this the tool-name mapping above would
+// be inert -- the handler bails on a missing bash_id and every poll would keep costing
+// the full accumulated output. Same keying convention as FILE_PATH_ARG_KEY: the ORIGINAL
+// Copilot tool name, since that is what the argument shape belongs to.
+const POLL_ID_ARG_KEY = {
+  read_bash: 'shellId',
+  read_powershell: 'shellId',
+}
+
+// Copilot spawns a brand-new process for every single hook invocation (no long-lived plugin
+// process the way OpenClaw's is -- OPENCLAW_HOOK_SCRIPT's own \`copilot-\${process.pid}-\${Date.now()}\`
+// fallback is safe there specifically because that process lives for the whole session, so the
+// pid stays constant across calls). If Copilot ever omits \`sessionId\` from a payload, falling
+// back to \`process.pid\` here would mint a DIFFERENT id on every single call for what's really
+// the same session, since process.pid varies per invocation -- breaking token-goat's
+// session-based dedup/state ledger, which never accumulates across calls as a result. Derive a
+// stable id instead from the one thing that's actually constant across calls for the same
+// session: the working directory Copilot reports. Copilot CLI's command hooks send it as \`cwd\`:
+// every payload 1.0.88 sent in the tg-captures run carried \`cwd\` and none carried
+// \`workingDirectory\` (tests/fixtures/copilot_cli_1_0_88/). The SDK's BaseHookInput in
+// copilot-sdk/types.d.ts declares the same value as \`workingDirectory\`, so both names are read,
+// that one first. Were neither read, the fallback id would come from process.cwd() and
+// \`canonical.cwd\` below would be undefined; tests/harness_schema_manifest.test.ts drives the
+// captured payload from a different directory to catch exactly that.
+function stableFallbackSessionId(cwd) {
+  const key = typeof cwd === 'string' && cwd ? cwd : process.cwd()
+  const hash = require('node:crypto').createHash('sha256').update(key).digest('hex').slice(0, 16)
+  return 'copilot-' + hash
+}
+
+function remapToolInput(copilotToolName, input) {
+  if (!input || typeof input !== 'object') return input
+  let out = input
+  // Add the canonical key alongside the original rather than renaming it, so nothing that
+  // might read the original 'path'/'shellId' key elsewhere (e.g. a future handler) loses it.
+  const stripped = typeof copilotToolName === 'string' && copilotToolName.indexOf(':') !== -1
+    ? copilotToolName.split(':').pop()
+    : copilotToolName
+  const folded = foldToolName(stripped)
+  const pathKey = ownGet(FILE_PATH_ARG_KEY, copilotToolName) || ownGet(FILE_PATH_ARG_KEY, stripped) || (folded === 'view' || folded === 'edit' || folded === 'create' ? 'path' : undefined)
+  if (pathKey !== undefined && pathKey in out) {
+    out = Object.assign({}, out, { file_path: out[pathKey] })
+  }
+  const idKey = ownGet(POLL_ID_ARG_KEY, copilotToolName) || ownGet(POLL_ID_ARG_KEY, stripped) || (folded === 'readbash' || folded === 'readpowershell' ? 'shellId' : undefined)
+  if (idKey !== undefined && idKey in out) {
+    out = Object.assign({}, out, { bash_id: out[idKey] })
+  }
+  if (Array.isArray(out.view_range) && out.view_range.length >= 1) {
+    const rawStart = Number(out.view_range[0])
+    if (Number.isFinite(rawStart) && rawStart >= 1) {
+      const mapped = { offset: Math.floor(rawStart) }
+      if (out.view_range.length >= 2) {
+        const rawEnd = Number(out.view_range[1])
+        if (Number.isFinite(rawEnd) && rawEnd >= rawStart) {
+          mapped.limit = Math.floor(rawEnd - rawStart + 1)
+        }
+      }
+      out = Object.assign({}, out, mapped)
+    }
+  }
+  if ('old_str' in out && !('old_string' in out)) {
+    out = Object.assign({}, out, { old_string: out.old_str })
+  }
+  if ('new_str' in out && !('new_string' in out)) {
+    out = Object.assign({}, out, { new_string: out.new_str })
+  }
+  return out
+}
+
+${SHIM_TRY_SERVER}
+
+// Attempts the resident server (tryServer above), then the in-process hook call: import()s dist/token-goat-hook.mjs (a sibling of
+// the baked token-goat entry path, built with zero load-time side effects -- unlike
+// the CLI entry, which runs the full argv-parsing CLI as a side effect of being
+// loaded) and calls its exported relayInProcess() directly, avoiding a second node
+// process spawn entirely. Returns undefined (triggering the spawnSync fallback below)
+// when entryPath is absent, the sibling file doesn't exist (an older install predating
+// this file), or anything else goes wrong -- this must never throw.
+async function tryInProcess(entryPath, tgEvent, canonical, harness) {
+  if (!entryPath) return undefined
+  try {
+    // Set before either path: the resident server runs the call under this process's environment.
+    process.env.TOKEN_GOAT_HARNESS_OVERRIDE = harness
+    // Which hooks directory VS Code loaded this shim from is the only thing separating a
+    // user-scope copy from a project-scope one -- the two files are byte-identical and so are
+    // their payloads. vscode_duplicate.ts needs it to stand the redundant copy down.
+    if (harness === 'vscode') process.env.TOKEN_GOAT_VSCODE_HOOKS_DIR = __dirname
+    // Whether this hooks file wires subagentStart decides where a subagent's spawn briefing goes
+    // (hooks_agent_spawn.ts subagentStartWired), and only this directory says which file that is.
+    else process.env.TOKEN_GOAT_COPILOT_HOOKS_DIR = __dirname
+    const served = await tryServer(entryPath, tgEvent, canonical)
+    if (served !== undefined) return served
+    const hookLibPath = path.join(path.dirname(entryPath), 'token-goat-hook.mjs')
+    if (!require('node:fs').existsSync(hookLibPath)) return undefined
+    const mod = await import(pathToFileURL(hookLibPath).href)
+    return await mod.relayInProcess(tgEvent, canonical)
+  } catch {
+    return undefined
+  }
+}
+
+// VS Code's built-in agent reads this same hooks file (~/.copilot/hooks and .github/hooks are both
+// on its hook-source list) and runs these same entries, but it sends Claude Code's payload shape:
+// hook_event_name, session_id, tool_name, tool_input, tool_response. Copilot CLI's payload never
+// carries hook_event_name and always names its tool in toolName, so that pair tells them apart.
+// The payload goes to token-goat as-is under the vscode harness, which does its own tool-name
+// mapping and writes a response VS Code reads directly, so nothing here translates it.
+function isVscodePayload(payload) {
+  return payload !== null && typeof payload === 'object' && typeof payload.hook_event_name === 'string' && payload.toolName === undefined
+}
+
+async function relayVscode(entryPath, tgEvent, payload) {
+  // VS Code omits session_id when the chat has no session resource yet; key the state on the workspace instead, the same fallback the Copilot path uses.
+  const input = typeof payload.session_id === 'string' && payload.session_id !== ''
+    ? payload
+    : Object.assign({}, payload, { session_id: stableFallbackSessionId(process.cwd()) })
+  let stdout = await tryInProcess(entryPath, tgEvent, input, 'vscode')
+  if (stdout === undefined) {
+    // tgEvent is a value of the closed COPILOT_TO_TG_EVENT map (gated in main) and the harness is a literal, so nothing caller-controlled reaches the shell string below.
+    const spawnOpts = {
+      input: JSON.stringify(input),
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: SHIM_FALLBACK_TIMEOUT_MS,
+      killSignal: 'SIGKILL',
+      maxBuffer: SHIM_MAX_BUFFER_BYTES,
+      env: Object.assign({}, process.env, { TOKEN_GOAT_HARNESS_OVERRIDE: 'vscode', TOKEN_GOAT_VSCODE_HOOKS_DIR: __dirname }),
+    }
+    const res = entryPath
+      ? spawnSync(process.execPath, [entryPath, 'hook', tgEvent, '--harness', 'vscode'], spawnOpts)
+      : spawnSync('token-goat hook ' + tgEvent + ' --harness vscode', Object.assign({ shell: true }, spawnOpts))
+    if (res.status !== 0 || !res.stdout) return '{}'
+    stdout = res.stdout
+  }
+  try {
+    const parsed = JSON.parse(stdout)
+    return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed) ? JSON.stringify(parsed) : '{}'
+  } catch {
+    return '{}'
+  }
+}
+
+async function main() {
+  const startedAt = Math.floor(require('node:perf_hooks').performance.timeOrigin)
+  const copilotEvent = process.argv[2] || ''
+
+  // ownGet, not a bare lookup: the map is a plain object literal, so eight keys it never declares ('constructor', 'toString', '__proto__' and the rest of Object.prototype) come back truthy and sail past the check below. tgEvent is then a Function, and 'token-goat hook ' + tgEvent is concatenated into a shell command string by the fallback at the bottom of this shim. No member of Object.prototype stringifies with a shell metacharacter, so this was a failed spawn rather than a second command -- but argv reaching a shell string through a gate that reads like it stops it is the shape worth closing, not the payload that happened to be harmless. The four shims built on shim_common.ts validate against a closed Set, which has no equivalent hole.
+  const vscodeOnly = ownGet(VSCODE_ONLY_TO_TG_EVENT, copilotEvent)
+  const tgEvent = ownGet(COPILOT_TO_TG_EVENT, copilotEvent) || vscodeOnly
+  if (!tgEvent) {
+    process.stdout.write('{}')
+    return
+  }
+
+  let sessionStartDeadline
+  if (tgEvent === 'session_start') {
+    const inherited = process.argv[4]
+    const epoch = inherited === undefined ? startedAt + sessionStartBudgetMs()
+      : inherited.startsWith('--session-start-deadline=') ? Number(inherited.slice('--session-start-deadline='.length)) : NaN
+    if (!Number.isSafeInteger(epoch) || epoch <= 0 || epoch > startedAt + sessionStartBudgetMs()) {
+      failOpenSessionStart('invalid inherited startup deadline')
+      return
+    }
+    sessionStartDeadline = epoch
+  }
+  let raw = ''
+  if (sessionStartDeadline !== undefined) {
+    try {
+      raw = await readSessionStartInput(sessionStartDeadline - Date.now())
+    } catch (error) {
+      failOpenSessionStart(error && error.message ? error.message : 'input could not be read')
+      return
+    }
+  } else {
+    try {
+      raw = require('node:fs').readFileSync(0, 'utf8')
+    } catch {
+      process.stdout.write('{}')
+      return
+    }
+  }
+
+  let payload
+  try {
+    payload = JSON.parse(raw)
+  } catch {
+    if (sessionStartDeadline !== undefined) failOpenSessionStart('input contained malformed JSON')
+    else process.stdout.write('{}')
+    return
+  }
+
+  if (isVscodePayload(payload)) {
+    if (sessionStartDeadline === undefined) {
+      process.stdout.write(await relayVscode(process.argv[3], tgEvent, payload))
+    } else {
+      try {
+        const input = typeof payload.session_id === 'string' && payload.session_id !== ''
+          ? payload
+          : Object.assign({}, payload, { session_id: stableFallbackSessionId(process.cwd()) })
+        process.stdout.write(await runBoundedSessionStart(process.argv[3], tgEvent, input, 'vscode', sessionStartDeadline))
+      } catch (error) {
+        failOpenSessionStart(error && error.message ? error.message : 'hook helper failed')
+      }
+    }
+    return
+  }
+  if (vscodeOnly) {
+    process.stdout.write('{}')
+    return
+  }
+
+  const toolName = payload && payload.toolName
+  const canonical = {
+    session_id:
+      (payload && payload.sessionId) ||
+      stableFallbackSessionId(payload && (payload.workingDirectory || payload.cwd)),
+    cwd: payload && (payload.workingDirectory || payload.cwd),
+  }
+
+  // Subagent correlation and W3C Trace Context propagation from Copilot CLI payloads
+  const agentId = payload && (payload.agent_id || payload.agentId)
+  if (typeof agentId === 'string' && agentId !== '') {
+    canonical.agent_id = agentId
+  }
+  const traceparent = payload && (payload.traceparent || payload.traceParent)
+  if (typeof traceparent === 'string' && traceparent !== '') {
+    canonical.traceparent = traceparent
+  }
+  const tracestate = payload && (payload.tracestate || payload.traceState)
+  if (typeof tracestate === 'string' && tracestate !== '') {
+    canonical.tracestate = tracestate
+  }
+
+  // userPromptSubmitted only: Copilot declares \`prompt\` required on UserPromptSubmittedHookInput.
+  // hooks_session.ts's userPromptSubmitHandler reads it as \`event.raw['prompt']\` and gates every
+  // branch it has on the text, so without this it saw '' on every Copilot prompt and the
+  // embedded-skill dedup hint could never fire. Same shape as the postToolUseFailure \`error\`
+  // drop: a required field the canonical builder simply did not list.
+  if (typeof (payload && payload.prompt) === 'string' && payload.prompt !== '') {
+    canonical.prompt = payload.prompt
+  }
+  // subagentStop only: the subagent's final answer arrives as response (Copilot CLI 1.0.88,
+  // tg-captures C4a-013). Forwarded under Claude Code's name for the same text,
+  // last_assistant_message, which both subagent_stop handlers read. Unforwarded, they saw ''.
+  if (typeof (payload && payload.response) === 'string' && payload.response !== '') {
+    canonical.last_assistant_message = payload.response
+  }
+  let originalToolArgs = {}
+  if (toolName) {
+    originalToolArgs = parseMaybeJsonObject(payload && payload.toolArgs)
+    canonical.tool_name = resolveCanonicalToolName(toolName)
+    canonical.tool_input = remapToolInput(toolName, originalToolArgs)
+  }
+
+  // postToolUse only: confirmed via https://docs.github.com/en/copilot/reference/hooks-reference
+  // that Copilot's toolResult is an object ({resultType, textResultForLlm}), not a bare string
+  // or array. Without this, token-goat's tool_response consumers (hooks_read.ts's
+  // extractReadOutput, hooks_bash.ts's extractBashOutput, etc. -- all of which check for a
+  // string or an object keyed by output/content/text/body) never see any content, so
+  // post-read/post-bash stats stay empty no matter how many tool calls happen. Extract the
+  // LLM-facing text directly rather than forwarding the raw object, since textResultForLlm
+  // isn't one of those recognized object keys.
+  // postToolUseFailure only: Copilot's PostToolUseFailureHookInput (copilot-sdk/types.d.ts:1042)
+  // carries {toolName, toolArgs, error} and no toolResult at all -- the failure text lives in
+  // \`error\`, a plain string. Without forwarding it, hooks_tool_failure.ts's extractFailureText
+  // finds nothing to key on and the repeat-failure brake returns pass on every single call: wired,
+  // green, and doing nothing. Found by driving the installed shim rather than by a test, because
+  // the handler's own tests hand it a raw payload that already has the field.
+  if (typeof (payload && payload.error) === 'string' && payload.error !== '') {
+    canonical.error = payload.error
+  }
+
+  const rawResult = payload && payload.toolResult
+  if (rawResult && typeof rawResult === 'object') {
+    const tr = rawResult
+    // text_result_for_llm: Copilot's docs also describe a "VS Code compatible" snake_case
+    // wire format (tool_result.text_result_for_llm) alongside the camelCase one above; try
+    // both rather than assuming only the camelCase shape ever reaches this shim.
+    const text = typeof tr.textResultForLlm === 'string' ? tr.textResultForLlm : tr.text_result_for_llm
+    if (typeof text === 'string') canonical.tool_response = text
+  }
+
+  // process.argv[3], when present, is the absolute path to the token-goat CLI entry that ran
+  // \`token-goat install --copilot\` (baked in by hookCommandFor in copilot_cli_install.ts).
+  // Invoking it directly via process.execPath sidesteps PATH/cmd.exe resolution for this
+  // inner call too -- confirmed live-production root cause of an *intermittent* (not the
+  // original, already-fixed github/copilot-cli#4001) "(hook errored)" deny-all: even once the
+  // outer command launches via its own baked process.execPath, this inner call still shelled
+  // out to a bare \`token-goat\`, which depends on the npm global bin being on whatever PATH
+  // Copilot spawns this hook subprocess with. Falls back to the old PATH-based shell:true
+  // invocation when argv[3] is absent (an older cached hook config still pointing at a
+  // freshly-reinstalled shim, or a direct dev/test invocation), so this is a pure hardening,
+  // never a behavior break for configs installed before this fix. An args array (not a
+  // template string) is safe here specifically because entryPath and tgEvent never touch a
+  // shell -- no DEP0190 concern, unlike the shell:true fallback below.
+  const entryPath = process.argv[3]
+  // SessionStart bypasses the resident server and in-process path: only a child-process deadline can interrupt synchronous handler or SQLite work. TOKEN_GOAT_HOOK_SERVER=0 below also prevents that child from leaving a server process behind.
+  let stdout
+  if (sessionStartDeadline !== undefined) {
+    try {
+      stdout = await runBoundedSessionStart(entryPath, tgEvent, canonical, 'copilot_cli', sessionStartDeadline)
+    } catch (error) {
+      failOpenSessionStart(error && error.message ? error.message : 'hook helper failed')
+      return
+    }
+  } else {
+    // Other events retain the in-process fast path and existing fallback behavior.
+    stdout = await tryInProcess(entryPath, tgEvent, canonical, 'copilot_cli')
+  }
+  if (stdout === undefined) {
+    const res = entryPath
+      ? spawnSync(process.execPath, [entryPath, 'hook', tgEvent], {
+          input: JSON.stringify(canonical),
+          encoding: 'utf8',
+          windowsHide: true,
+          timeout: SHIM_FALLBACK_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+          maxBuffer: SHIM_MAX_BUFFER_BYTES,
+          env: Object.assign({}, process.env, { TOKEN_GOAT_HARNESS_OVERRIDE: 'copilot_cli', TOKEN_GOAT_COPILOT_HOOKS_DIR: __dirname }),
+        })
+      : spawnSync('token-goat hook ' + tgEvent, {
+          input: JSON.stringify(canonical),
+          encoding: 'utf8',
+          shell: true,
+          windowsHide: true,
+          timeout: SHIM_FALLBACK_TIMEOUT_MS,
+          killSignal: 'SIGKILL',
+          maxBuffer: SHIM_MAX_BUFFER_BYTES,
+          env: Object.assign({}, process.env, { TOKEN_GOAT_HARNESS_OVERRIDE: 'copilot_cli', TOKEN_GOAT_COPILOT_HOOKS_DIR: __dirname }),
+        })
+    if (res.status !== 0 || !res.stdout) {
+      process.stdout.write('{}')
+      return
+    }
+    stdout = res.stdout
+  }
+
+  let resp
+  try {
+    resp = JSON.parse(stdout)
+  } catch {
+    process.stdout.write('{}')
+    return
+  }
+
+  process.stdout.write(JSON.stringify(translate(copilotEvent, resp, toolName, originalToolArgs)))
+}
+
+${MATERIALIZE_SHRUNK_IMAGE_JS}
+
+function translate(copilotEvent, resp, toolName, originalToolArgs) {
+  if (copilotEvent === 'preToolUse') {
+    const hso = resp && resp.hookSpecificOutput
+    const denied = resp && (resp.decision === 'block' || (hso && hso.permissionDecision === 'deny'))
+    if (denied) {
+      const reason =
+        (resp && resp.reason) || (hso && hso.permissionDecisionReason) || 'blocked by token-goat'
+      return { permissionDecision: 'deny', permissionDecisionReason: reason }
+    }
+    const context = extractContext(resp)
+    // A shrink payload is a base64 data URL, not prose. It rides the same additionalContext field every other pre-tool hint does, so the two have to be told apart before either is forwarded: handing the model a data URL would cost far more context than the image it was shrunk from ever did. It is only ever materialized to a temp file the read argument is pointed at.
+    const shrinkPayload = typeof context === 'string' && context.indexOf('data:image/') !== -1
+    const out = {}
+    const updated = hso && hso.updatedInput
+    if (updated && typeof updated === 'object') {
+      out.modifiedArgs = updated
+    } else if (shrinkPayload && (toolName === 'view' || foldToolName(toolName) === 'view')) {
+      // modifiedArgs REPLACES the tool call's args wholesale (ESr in the 1.0.80 bundle, see this module's header docblock), so the full original toolArgs are spread and only Copilot's own path key is swapped.
+      const shrunkPath = materializeShrunkImage(context)
+      if (shrunkPath) out.modifiedArgs = Object.assign({}, originalToolArgs, { path: shrunkPath })
+    }
+    // Every pre-tool hint token-goat emits -- read-dedup nudges, the bash surgical-read advisories, the write-path notices -- used to stop here, on the stated grounds that Copilot's preToolUse output schema has no additionalContext field. It has one, and has had one for every version this bridge was ever checked against: copilot-sdk/types.d.ts declares additionalContext as an optional string on PreToolUseHookOutput in 1.0.80, 1.0.82, 1.0.86, 1.0.87 and 1.0.88 alike, and the 1.0.88 native runtime (prebuilds/win32-x64/runtime.node) carries it in the preToolUse response key list beside the three keys already known to work -- permissionDecision, permissionDecisionReason, modifiedArgs, additionalContext, in that order, immediately before "preToolUse hook timed out; allowing the tool call to proceed". The same binary carries an aggregation limit message naming the field generically ("Ignoring additionalContext returned by a ... hook because aggregating it would exceed the ... byte limit"), which is the mechanism 1.0.88's own release note calls combining contributions within a limit. Forwarded alongside modifiedArgs rather than instead of it: the schema accepts both, and a rewritten argument is no reason to drop the sentence explaining it.
+    if (context && !shrinkPayload) out.additionalContext = context
+    return out
+  }
+
+  if (copilotEvent === 'postToolUse') {
+    // Each field carries one thing. modifiedResult replaces the tool output, so it is sent only for a real rewrite (compression, fencing, image shrink). additionalContext carries the hint: Copilot CLI 1.0.88 appends it to the tool output itself, under the heading Tool "<name>" succeeded. Additional guidance from postToolUse hooks:, followed by the text, once (captured on the wire, tg-captures C1a; with a modifiedResult alongside, C1c, each arrives once). This branch used to also fold the hint into modifiedResult, on a 1.0.80 reading that additionalContext was dropped here, so on 1.0.88 the model got every post-tool hint twice.
+    const hso = resp && resp.hookSpecificOutput
+    const updatedToolOutput = hso && hso.updatedToolOutput
+    const context = extractContext(resp)
+    const out = {}
+    if (typeof updatedToolOutput === 'string') out.modifiedResult = { resultType: 'success', textResultForLlm: updatedToolOutput }
+    if (context) out.additionalContext = context
+    return out
+  }
+
+  if (copilotEvent === 'postToolUseFailure') {
+    // The failed-tool twin of postToolUse, and the only response field it accepts is
+    // additionalContext: the shipped copilot-sdk/types.d.ts says "modifiedResult or suppressOutput
+    // are not honored for failure hooks", so nothing here can fence, compress or shrink the failed
+    // output -- that gap is real and stays open. What is NOT open, and was the reason this event
+    // went unwired for so long, is whether additionalContext reaches the model at all. It does:
+    // app.js 1.0.80 at offset 2043380 either folds it into textResultForLlm (when
+    // appendFailureContextToToolResult is set) or has the native
+    // hookAppendPostToolUseFailureContext push {content, source:'system'} onto
+    // toolResult.newMessages. That is the exact opposite of postToolUse, whose additionalContext
+    // the JS side drops on the floor, so neither event's behaviour generalises to the other.
+    //
+    // Because this channel spends tokens rather than saving them, the handler behind it
+    // (hooks_tool_failure.ts) is silent on a first failure and speaks only on an exact repeat.
+    const context = extractContext(resp)
+    if (context) return { additionalContext: context }
+    return {}
+  }
+
+  if (copilotEvent === 'sessionStart' || copilotEvent === 'subagentStart') {
+    // Neither event has a tool result to modify, so only additionalContext applies. sessionStart's
+    // is the one channel that reaches the model before it picks its first read tool, so the routing
+    // reminder lands there. subagentStart's is prepended to the subagent's own prompt (Copilot CLI
+    // 1.0.88, capture C4a), which is where the spawn briefing belongs.
+    const context = extractContext(resp)
+    if (context) return { additionalContext: context }
+    return {}
+  }
+
+  if (copilotEvent === 'agentStop' || copilotEvent === 'subagentStop') {
+    // Confirmed against the hooks reference doc: the only accepted response
+    // shape for these two events is {decision, reason} -- additionalContext
+    // is not part of their schema and Copilot silently ignores it there.
+    // token-goat's internal 'stop'/'subagent_stop' handlers never return a
+    // real deny today (subagentStopHandler only ever logs and passes), but a
+    // future deny is mapped through here rather than silently dropped.
+    if (resp && resp.decision === 'block') {
+      const reason = (resp && resp.reason) || 'blocked by token-goat'
+      return { decision: 'block', reason: reason }
+    }
+    // subagentStop also takes modifiedResponse, which replaces the subagent's answer in the
+    // parent's task result and in the model request built from it (Copilot CLI 1.0.88,
+    // tg-captures C4a: the marker a hook returned there was all the parent's model saw).
+    const stopHso = resp && resp.hookSpecificOutput
+    const modifiedResponse = stopHso && stopHso.updatedToolOutput
+    if (copilotEvent === 'subagentStop' && typeof modifiedResponse === 'string') {
+      return { modifiedResponse: modifiedResponse }
+    }
+    return { decision: 'allow' }
+  }
+
+  if (copilotEvent === 'userPromptSubmitted') {
+    // Copilot's own hooks reference says command-hook output here "is dropped, including
+    // modifiedPrompt", and this branch used to believe it and return nothing. That is wrong for
+    // additionalContext on 1.0.80, established by experiment rather than by reading: a config-file
+    // command hook (at <cwd>/.github/hooks/, the project scope -- the user scope ~/.copilot/hooks/
+    // was never exercised) returned {"additionalContext":"<marker>"} and the marker turned up
+    // verbatim inside the session's user.message.transformedContent, wrapped in a
+    // <system_reminder> block. What settles that it reached the model rather than only the on-disk
+    // record is the billing: the provider's returned usage charged ~140 input tokens for a turn
+    // whose raw content field is 35 bytes, so the marker's bytes were paid for whichever field
+    // carried them. (The weaker argument first offered for this -- that transformedContent carries
+    // an envelope the content field lacks, 29 B vs 195 B -- was measured on the control turn that
+    // had no marker in it, and proves nothing about the marker.) That the model sees it is the
+    // whole point: hook.start/hook.end records also persist and reach nothing.
+    //
+    // On 1.0.80 that was demonstrated once: of two turns, one delivered the marker and one fired
+    // a hook that never ran the script. On 1.0.88 it held 5 times in 5 clean runs (tg-captures
+    // C3): each wire request carried the context once, in the user message itself, as the prompt,
+    // a blank line, and the context inside a <system_reminder> block.
+    //
+    // modifiedPrompt is NOT claimed to work and is not wanted: rewriting a user's prompt is far
+    // more invasive than anything token-goat does, so only additionalContext is forwarded.
+    //
+    // This is also where the compaction manifest reaches the model. Copilot has no postCompact
+    // hook and does not read preCompact's answer (below), so token-goat queues the manifest at
+    // preCompact and the prompt handler puts it first in this answer on the next prompt
+    // (PRE_COMPACT_RESUMES_ON_PROMPT in ../harness_channels.ts; tests/copilot_compaction_resume.test.ts
+    // drives the captured C7 payloads through this shim). Whether the summary is recoverable from
+    // events.jsonl is still not settled; see COPILOT_NO_POST_COMPACT_REASON in ../bridges_status.ts.
+    const context = extractContext(resp)
+    if (context) return { additionalContext: context }
+    return {}
+  }
+
+  // preCompact is the genuine notification-only case. The hooks reference marks it "No --
+  // notification only", both preCompact call sites in app.js (1.0.79, re-checked in 1.0.80) await
+  // the hook and never assign its result, and on 1.0.88 a marker returned here as
+  // additionalContext appeared zero times in the wire requests, the OTel spans and the model's
+  // reply after a manual /compact (tg-captures C7 and C7d). The payload is {sessionId, timestamp,
+  // cwd, transcriptPath, trigger, customInstructions}. There is no field to aim at here.
+  return {}
+}
+
+function extractContext(resp) {
+  const hso = resp && resp.hookSpecificOutput
+  if (hso && typeof hso.additionalContext === 'string') return hso.additionalContext
+  if (resp && typeof resp.systemMessage === 'string') return resp.systemMessage
+  return undefined
+}
+
+// Hard outer safety net, on top of main()'s own per-step try/catch fallbacks
+// (JSON.parse, readFileSync, spawnSync): a hook error must never itself cause
+// Copilot's fail-closed "(hook errored)" behavior, which denies EVERY tool
+// call unconditionally (the exact live-production failure mode behind
+// github/copilot-cli#4001). Any uncaught exception anywhere in this script --
+// including one a future code path adds that the existing per-step guards
+// don't anticipate -- still guarantees stdout gets valid JSON and the
+// process exits 0. process.exitCode is set explicitly and unconditionally at
+// the very end of every path so nothing upstream (e.g. an unhandled-rejection
+// warning in some Node versions nudging exit-code inference) can flip it.
+main()
+  .catch(() => {
+    try {
+      process.stdout.write('{}')
+    } catch {
+      // stdout itself is broken; nothing more can be done here.
+    }
+  })
+  .finally(() => {
+    process.exitCode = 0
+  })
+`;
+var TOOL_TO_TG_MAPPING = COPILOT_CLI_TOOL_NAME_MAP;
+var FOLDED_MAPPING = {};
+for (const [k, v] of Object.entries(TOOL_TO_TG_MAPPING)) {
+  FOLDED_MAPPING[foldToolName(k)] = v;
+  FOLDED_MAPPING[foldToolName(v)] = v;
+}
+
+// src/bridges/copilot_cli_install.ts
+init_define_import_meta_env();
+import * as fs7 from "node:fs";
+import * as path7 from "node:path";
+
+// src/bridges/copilot_mcp_install.ts
+init_define_import_meta_env();
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
+
+// src/bridges/mcp_servers_json.ts
+init_define_import_meta_env();
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+import { fileURLToPath } from "node:url";
+function bundledCliPath() {
+  const here = path4.dirname(fileURLToPath(import.meta.url));
+  const bundled = path4.join(here, "token-goat.mjs");
+  if (fs4.existsSync(bundled)) return bundled;
+  return path4.resolve(here, "..", "..", "dist", "token-goat.mjs");
+}
+function managedServer() {
+  return {
+    type: "stdio",
+    command: process.execPath,
+    args: [bundledCliPath(), "mcp-serve"]
+  };
+}
+function isManagedServer(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  const args = entry["args"];
+  return entry["type"] === "stdio" && Array.isArray(args) && args.length === 2 && typeof args[0] === "string" && path4.basename(args[0]).toLowerCase() === "token-goat.mjs" && args[1] === "mcp-serve";
+}
+function readServersJson(filePath, label) {
+  const text = fs4.existsSync(filePath) ? stripBom(fs4.readFileSync(filePath, "utf8")) : "{}\n";
+  const errors = [];
+  const parsed = jsonc().parse(text, errors, { allowTrailingComma: true, disallowComments: false });
+  if (errors.length > 0) {
+    throw new Error(`malformed ${label} MCP JSON at ${filePath}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`malformed ${label} MCP JSON at ${filePath}: expected a JSON object`);
+  }
+  return { text, value: parsed };
+}
+function serversOf(config, filePath, label, rootKey = "servers") {
+  const servers = config.value[rootKey];
+  if (servers === void 0) return {};
+  if (servers === null || typeof servers !== "object" || Array.isArray(servers)) {
+    throw new Error(`malformed ${label} MCP JSON at ${filePath}: ${rootKey} must be an object`);
+  }
+  return servers;
+}
+var FORMAT = { insertSpaces: true, tabSize: 2, eol: "\n" };
+function editAt(text, jsonPath, value) {
+  let out = text;
+  for (const e of [...jsonc().modify(text, jsonPath, value, {})].sort((a, b) => b.offset - a.offset)) {
+    out = out.slice(0, e.offset) + e.content + out.slice(e.offset + e.length);
+    if (e.content.length > 0) out = jsonc().applyEdits(out, jsonc().format(out, { offset: e.offset, length: e.content.length }, FORMAT));
+  }
+  return out;
+}
+function setTokenGoatServer(text, value, rootKey = "servers") {
+  if (value !== void 0 && /^\s*\{\s*\}\s*$/.test(text)) return `${JSON.stringify({ [rootKey]: { "token-goat": value } }, null, 2)}
+`;
+  return editAt(text, [rootKey, "token-goat"], value);
+}
+function holdsOnlyManagedServer(value) {
+  const keys = Object.keys(value);
+  if (keys.length !== 1) return false;
+  const root = keys[0];
+  if (root !== "servers" && root !== "mcpServers") return false;
+  const servers = value[root];
+  if (servers === null || typeof servers !== "object" || Array.isArray(servers)) return false;
+  const names = Object.keys(servers);
+  return names.length === 1 && names[0] === "token-goat" && isManagedServer(servers["token-goat"]);
+}
+function isResidueServersJson(text, rootKey = "servers") {
+  const trimmed = text.trim();
+  if (trimmed === "") return true;
+  const parsed = parseObject(trimmed);
+  if (parsed === null) return false;
+  const keys = Object.keys(parsed);
+  if (keys.length !== 1 || keys[0] !== rootKey) return false;
+  const servers = parsed[rootKey];
+  return servers !== null && typeof servers === "object" && !Array.isArray(servers) && Object.keys(servers).length === 0;
+}
+function noteRootKeyCreation(filePath, config, rootKey = "servers") {
+  if (config.value[rootKey] === void 0) recordCreatedRootKey(filePath, rootKey);
+}
+function dropEmptyServers(text, filePath, rootKey = "servers") {
+  const owned = takeCreatedRootKey(filePath, rootKey) || hasCreatedConfig(filePath);
+  const parsed = parseObject(text);
+  if (!owned || parsed === null) return text;
+  const servers = parsed[rootKey];
+  if (servers === null || typeof servers !== "object" || Array.isArray(servers) || Object.keys(servers).length > 0) return text;
+  return editAt(text, [rootKey], void 0);
+}
+function parseObject(text) {
+  const parsed = jsonc().parse(text, [], { allowTrailingComma: true, disallowComments: false });
+  return parsed === null || typeof parsed !== "object" || Array.isArray(parsed) ? null : parsed;
+}
+function ensureMcpServersKey(text) {
+  const parsed = parseObject(text);
+  if (parsed === null || "mcpServers" in parsed) return text;
+  return editAt(text, ["mcpServers"], {});
+}
+function dropLoneEmptyMcpServers(text) {
+  const parsed = parseObject(text);
+  if (parsed === null || Object.keys(parsed).length !== 1) return text;
+  const mcpServers = parsed["mcpServers"];
+  if (mcpServers === null || typeof mcpServers !== "object" || Array.isArray(mcpServers) || Object.keys(mcpServers).length > 0) return text;
+  return editAt(text, ["mcpServers"], void 0);
+}
+function managedServerEntry(filePath, label, rootKey = "servers", isManaged = isManagedServer) {
+  if (!fs4.existsSync(filePath)) return null;
+  try {
+    const entry = serversOf(readServersJson(filePath, label), filePath, label, rootKey)["token-goat"];
+    return isManaged(entry) ? entry : null;
+  } catch {
+    return null;
+  }
+}
+function hasManagedServer(filePath, label, rootKey = "servers", isManaged = isManagedServer) {
+  return managedServerEntry(filePath, label, rootKey, isManaged) !== null;
+}
+
+// src/bridges/copilot_mcp_install.ts
+var MCP_SERVERS_KEY = "mcpServers";
+var TOKEN_GOAT_ENTRY_KEY = "token-goat";
+var LABEL = "Copilot CLI";
+function copilotMcpConfigPath() {
+  return path5.join(copilotCliUserRoot(), "mcp-config.json");
+}
+function copilotManagedServer() {
+  return { tools: ["*"], type: "local", command: process.execPath, args: [bundledCliPath(), "mcp-serve"] };
+}
+function isCopilotManagedServer(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  const args = entry["args"];
+  return entry["type"] === "local" && typeof entry["command"] === "string" && Array.isArray(args) && args.length === 2 && typeof args[0] === "string" && path5.basename(args[0]).toLowerCase() === "token-goat.mjs" && args[1] === "mcp-serve";
+}
+function isReadmeServer(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  const args = entry["args"];
+  return Object.keys(entry).every((k) => k === "command" || k === "args") && entry["command"] === "token-goat" && Array.isArray(args) && args.length === 1 && args[0] === "mcp-serve";
+}
+function installCopilotMcpServer() {
+  const mcpPath = copilotMcpConfigPath();
+  const fileExisted = fs5.existsSync(mcpPath);
+  const config = readServersJson(mcpPath, LABEL);
+  const current = serversOf(config, mcpPath, LABEL, MCP_SERVERS_KEY)[TOKEN_GOAT_ENTRY_KEY];
+  if (current !== void 0 && !isCopilotManagedServer(current) && !isReadmeServer(current)) {
+    throw new Error(`Copilot CLI mcp-config.json already has a ${echoedValue(TOKEN_GOAT_ENTRY_KEY)} MCP server entry token-goat did not write, at ${mcpPath}; remove it manually first`);
+  }
+  const nextText = setTokenGoatServer(config.text, copilotManagedServer(), MCP_SERVERS_KEY);
+  if (nextText === config.text) return false;
+  ensureDirSync(path5.dirname(mcpPath));
+  if (!fileExisted) recordCreatedConfig(mcpPath);
+  backupFile(mcpPath);
+  writeConfigText(mcpPath, nextText);
+  noteRootKeyCreation(mcpPath, config, MCP_SERVERS_KEY);
+  return true;
+}
+function uninstallCopilotMcpServer() {
+  const mcpPath = copilotMcpConfigPath();
+  if (!fs5.existsSync(mcpPath)) return false;
+  const config = readServersJson(mcpPath, LABEL);
+  if (!isCopilotManagedServer(serversOf(config, mcpPath, LABEL, MCP_SERVERS_KEY)[TOKEN_GOAT_ENTRY_KEY])) return false;
+  const next = dropEmptyServers(setTokenGoatServer(config.text, void 0, MCP_SERVERS_KEY), mcpPath, MCP_SERVERS_KEY);
+  if (/^\s*\{\s*\}\s*$/.test(next) && takeCreatedConfig(mcpPath)) {
+    removeFileInScope(mcpPath);
+  } else {
+    backupFile(mcpPath);
+    writeConfigText(mcpPath, next);
+  }
+  removeCreatedBackups(mcpPath);
+  return true;
+}
+
+// src/bridges/visualstudio_install.ts
+init_define_import_meta_env();
+import * as fs6 from "node:fs";
+import * as os2 from "node:os";
+import * as path6 from "node:path";
+var LABEL2 = "Visual Studio";
+var VISUALSTUDIO_GUIDANCE_BEGIN = "<!-- token-goat-visualstudio-begin -->";
+var VISUALSTUDIO_GUIDANCE_END = "<!-- token-goat-visualstudio-end -->";
+var SIBLING_GATE_MARKERS = [
+  ["<!-- token-goat-vscode-begin -->", "<!-- token-goat-vscode-end -->"],
+  ["<!-- token-goat-begin -->", "<!-- token-goat-end -->"]
+];
+function visualStudioUserMcpPath() {
+  return path6.join(os2.homedir(), ".mcp.json");
+}
+function visualStudioProjectMcpPath(projectRoot = process.cwd()) {
+  return path6.join(path6.resolve(projectRoot), ".mcp.json");
+}
+function visualStudioMcpPath(opts = {}) {
+  return opts.project === true ? visualStudioProjectMcpPath(opts.projectRoot) : visualStudioUserMcpPath();
+}
+function otherScopeMcpPath(opts) {
+  return opts.project === true ? visualStudioUserMcpPath() : visualStudioProjectMcpPath(opts.projectRoot);
+}
+function visualStudioInstructionsPath(opts = {}) {
+  return opts.project === true ? path6.join(path6.resolve(opts.projectRoot ?? process.cwd()), ".github", "copilot-instructions.md") : path6.join(os2.homedir(), "copilot-instructions.md");
+}
+function visualStudioOtherScopeHasManagedServer(opts = {}) {
+  return hasManagedServer(otherScopeMcpPath(opts), LABEL2);
+}
+function isVisualStudioInstalled(opts = {}) {
+  return hasManagedServer(visualStudioMcpPath(opts), LABEL2);
+}
+function visualStudioSolutionVscodeMcpPath(projectRoot = process.cwd()) {
+  return path6.join(path6.resolve(projectRoot), ".vscode", "mcp.json");
+}
+function visualStudioManagedRegistrations(projectRoot = process.cwd()) {
+  return [visualStudioUserMcpPath(), visualStudioProjectMcpPath(projectRoot), visualStudioSolutionVscodeMcpPath(projectRoot)].filter((p) => hasManagedServer(p, LABEL2));
+}
+function visualStudioDuplicateNote(projectRoot = process.cwd()) {
+  const found = visualStudioManagedRegistrations(projectRoot);
+  if (found.length < 2) return null;
+  const lead = `Note: Visual Studio reads ${found.join(" and ")}, and each registers token-goat, so it will list the token-goat server more than once for this solution.`;
+  if (!found.includes(visualStudioSolutionVscodeMcpPath(projectRoot))) return `${lead} Keep one: run ${fencedCommand("token-goat uninstall --visualstudio")} or ${fencedCommand("token-goat uninstall --visualstudio -p")}.`;
+  return `${lead} Keep one: if you do not use VS Code in this folder, run ${fencedCommand("token-goat uninstall --vscode -p")}; otherwise run ${fencedCommand("token-goat uninstall --visualstudio" + (found.includes(visualStudioUserMcpPath()) ? "" : " -p"))}.`;
+}
+function visualStudioMcpStatus(opts = {}) {
+  const checkedPaths = [visualStudioUserMcpPath()];
+  if (opts.projectRoot !== void 0) checkedPaths.push(visualStudioProjectMcpPath(opts.projectRoot));
+  return { configured: checkedPaths.some((p) => hasManagedServer(p, LABEL2)), checkedPaths };
+}
+function visualStudioManagedEntry(filePath) {
+  const entry = managedServerEntry(filePath, LABEL2);
+  if (entry === null) return null;
+  const { command, args } = entry;
+  return { command: typeof command === "string" ? command : "", bundlePath: args[0] ?? "" };
+}
+var FALLBACK_TOOL_CLAUSE = "Visual Studio\u2019s built-in readfile, code_search, and find_references tools";
+var RETRIEVE_NOTE = "**Compressed payloads:** a message containing a token-goat payload block (recognizable by a `recovery: token-goat retrieve <id>` line) is compressed text, not an answer. Call the MCP tool `retrieve_text` with that id to recover the original text, then answer the question the message asks using the recovered text. Never present the raw payload to the user as the response; if the `retrieve_text` tool is unavailable (the MCP server is not running, or its tools are not ticked in the chat Tools picker), say so plainly and ask the user to turn on the token-goat tools.";
+var SUPPORT_NOTE = "Visual Studio support: token-goat install --visualstudio registers a stdio MCP server under the servers root key of %USERPROFILE%\\.mcp.json (with --project, the .mcp.json in the solution folder). Visual Studio runs no token-goat hooks, so nothing denies a repeated read, adds a hint, shrinks an image, or folds what readfile returns there: the narrow reads come only from calling the token-goat MCP tools, or the token-goat CLI through runcommandinterminal.";
+function buildVisualStudioGuidanceBlock(sharesFileWithGate) {
+  const lead = sharesFileWithGate ? ["## token-goat in Visual Studio", "", `The token-goat gate elsewhere in this file applies in Visual Studio too; there, ${FALLBACK_TOOL_CLAUSE} are the fallback it names.`] : [buildGuidanceBody(FALLBACK_TOOL_CLAUSE, { gdrive: loadConfig().gdrive.enabled })];
+  return [VISUALSTUDIO_GUIDANCE_BEGIN, ...lead, "", RETRIEVE_NOTE, "", SUPPORT_NOTE, VISUALSTUDIO_GUIDANCE_END].join("\n");
+}
+function hasBlock(text, begin, end) {
+  const b = text.indexOf(begin);
+  const e = text.indexOf(end);
+  return b !== -1 && e > b;
+}
+function readText(filePath) {
+  try {
+    return fs6.readFileSync(filePath, "utf8");
+  } catch {
+    return "";
+  }
+}
+function writeGuidance(filePath) {
+  const text = readText(filePath);
+  const shares = SIBLING_GATE_MARKERS.some(([begin, end]) => hasBlock(text, begin, end));
+  return upsertDelimitedBlock(filePath, VISUALSTUDIO_GUIDANCE_BEGIN, VISUALSTUDIO_GUIDANCE_END, buildVisualStudioGuidanceBlock(shares));
+}
+function syncVisualStudioProjectGuidance(filePath) {
+  if (!hasBlock(readText(filePath), VISUALSTUDIO_GUIDANCE_BEGIN, VISUALSTUDIO_GUIDANCE_END)) return false;
+  return writeGuidance(filePath);
+}
+function installVisualStudio(opts = {}) {
+  return withInstallScope(projectScopeRoot(opts), () => installVisualStudioScoped(opts));
+}
+function installVisualStudioScoped(opts) {
+  const scope = opts.project === true ? "project" : "user";
+  const mcpPath = visualStudioMcpPath(opts);
+  const instructionsPath = visualStudioInstructionsPath(opts);
+  if (visualStudioOtherScopeHasManagedServer(opts)) {
+    const otherScope = scope === "project" ? "user" : "project";
+    throw new Error(
+      `token-goat is already registered in Visual Studio ${otherScope} scope (${otherScopeMcpPath(opts)}). Visual Studio reads both files, so installing into ${scope} scope too would register it twice. Run ${fencedCommand("token-goat uninstall --visualstudio" + (otherScope === "project" ? " --project" : ""))} first if you want to move it, or drop --visualstudio from this run.`
+    );
+  }
+  const mcpExisted = fs6.existsSync(mcpPath);
+  const config = readServersJson(mcpPath, LABEL2);
+  const ownedAlready = mcpExisted && holdsOnlyManagedServer(config.value);
+  const current = serversOf(config, mcpPath, LABEL2)["token-goat"];
+  if (current !== void 0 && !isManagedServer(current)) {
+    throw new Error(`Visual Studio MCP JSON at ${mcpPath} already has a non-token-goat-managed server named "token-goat"`);
+  }
+  const next = ensureMcpServersKey(setTokenGoatServer(config.text, managedServer()));
+  if (config.text !== next) {
+    ensureDirSync(path6.dirname(mcpPath));
+    backupFile(mcpPath);
+    writeConfigText(mcpPath, next);
+    noteRootKeyCreation(mcpPath, config);
+    if (!mcpExisted || ownedAlready) recordCreatedConfig(mcpPath);
+  }
+  const guidanceChanged = writeGuidance(instructionsPath);
+  return { mcpPath, instructionsPath, alreadyInstalled: config.text === next && !guidanceChanged, scope };
+}
+function uninstallVisualStudio(opts = {}) {
+  return withInstallScope(projectScopeRoot(opts), () => uninstallVisualStudioScoped(opts));
+}
+function uninstallVisualStudioScoped(opts) {
+  const mcpPath = visualStudioMcpPath(opts);
+  let removed = false;
+  if (fs6.existsSync(mcpPath)) {
+    const config = readServersJson(mcpPath, LABEL2);
+    if (isManagedServer(serversOf(config, mcpPath, LABEL2)["token-goat"])) {
+      const next = dropEmptyServers(setTokenGoatServer(config.text, void 0), mcpPath);
+      if (/^\s*\{\s*\}\s*$/.test(dropLoneEmptyMcpServers(next)) && takeCreatedConfig(mcpPath)) removeFileInScope(mcpPath);
+      else {
+        backupFile(mcpPath);
+        writeConfigText(mcpPath, ensureMcpServersKey(next));
+      }
+      removeCreatedBackups(mcpPath);
+      removed = true;
+    }
+  }
+  const instructionsPath = visualStudioInstructionsPath(opts);
+  if (stripDelimitedBlock(instructionsPath, VISUALSTUDIO_GUIDANCE_BEGIN, VISUALSTUDIO_GUIDANCE_END)) {
+    removed = true;
+    if (readText(instructionsPath).trim() === "") removeFileInScope(instructionsPath);
+  }
+  return removed;
+}
+
+// src/bridges/copilot_cli_install.ts
+var COPILOT_CLI_HOOK_EVENTS = [
+  "sessionStart",
+  "preToolUse",
+  "postToolUse",
+  "preCompact",
+  "agentStop",
+  "subagentStop",
+  "userPromptSubmitted",
+  "postToolUseFailure",
+  "subagentStart"
+];
+var VSCODE_ONLY_HOOK_EVENTS = ["SubagentStart"];
+function copilotCliUserHooksDir() {
+  return path7.join(copilotCliUserRoot(), "hooks");
+}
+function canonicalProjectRoot(projectRoot) {
+  return process.platform === "win32" ? projectRoot.replace(/^[a-z]:/, (drive) => drive.toUpperCase()) : projectRoot;
+}
+function copilotCliProjectHooksDir(projectRoot) {
+  return path7.join(canonicalProjectRoot(projectRoot ?? process.cwd()), ".github", "hooks");
+}
+function copilotCliHooksDir(opts = {}) {
+  return opts.local === true ? copilotCliProjectHooksDir(opts.projectRoot) : copilotCliUserHooksDir();
+}
+function copilotCliConfigPath(opts = {}) {
+  return path7.join(copilotCliHooksDir(opts), HOOKS_CONFIG_FILE);
+}
+function copilotCliScriptPath(opts = {}) {
+  return path7.join(copilotCliHooksDir(opts), HOOKS_SCRIPT_FILE);
+}
+function copilotCliInstructionsPath(opts = {}) {
+  return path7.join(path7.dirname(copilotCliHooksDir(opts)), "copilot-instructions.md");
+}
+var COPILOT_INSTRUCTIONS_BEGIN = "<!-- token-goat-begin -->";
+var COPILOT_INSTRUCTIONS_END = "<!-- token-goat-end -->";
+function buildCopilotInstructionsBlock() {
+  return stripInlineCodeSpans(
+    buildGuidanceBlock({
+      beginMarker: COPILOT_INSTRUCTIONS_BEGIN,
+      endMarker: COPILOT_INSTRUCTIONS_END,
+      fallbackToolClause: "Copilot CLI's native `view`, `grep`, and `glob` tools (with PowerShell commands `Get-Content`/`Select-String` as search fallbacks)",
+      gdrive: loadConfig().gdrive?.enabled ?? false
+    })
+  );
+}
+function stripInlineCodeSpans(text) {
+  return text.replace(/`([^`]+)`/g, "$1");
+}
+function writeCopilotInstructionsBlock(p) {
+  const changed = upsertDelimitedBlock(p, COPILOT_INSTRUCTIONS_BEGIN, COPILOT_INSTRUCTIONS_END, buildCopilotInstructionsBlock());
+  const visualStudioChanged = syncVisualStudioProjectGuidance(p);
+  return changed || visualStudioChanged;
+}
+function stripCopilotInstructionsBlock(p) {
+  const removed = stripDelimitedBlock(p, COPILOT_INSTRUCTIONS_BEGIN, COPILOT_INSTRUCTIONS_END);
+  if (removed) syncVisualStudioProjectGuidance(p);
+  return removed;
+}
+function hookPowershellCommandFor(scriptPath, event) {
+  return powershellHookLine(hookPowershellCommand(scriptPath, event));
+}
+var HOOK_TIMEOUT_SEC = 60;
+var ALLOWED_ENV_VARS = [
+  "TRACEPARENT",
+  "TRACESTATE",
+  "COPILOT_HOME",
+  "COPILOT_CACHE_HOME",
+  "TOKEN_GOAT_LOG"
+];
+function copilotHookCommandsFor(scriptPath, event, opts = {}) {
+  const bin = nativeHookBinary(process.argv[1], opts);
+  const command = bin === void 0 ? void 0 : nativeHookCommandLine(process.platform === "win32" ? "cmd" : "sh", bin, "copilot_cli", scriptPath, event);
+  const sh = bin === void 0 ? void 0 : nativeHookCommandLine("sh", bin, "copilot_cli", scriptPath, event);
+  const ps = bin === void 0 ? void 0 : nativeHookCommandLine("powershell", bin, "copilot_cli", scriptPath, event);
+  if (command !== void 0 && sh !== void 0 && ps !== void 0) return { command, bash: sh, powershell: ps };
+  return { command: hookCommandFor(scriptPath, event), bash: hookCommandFor(scriptPath, event), powershell: hookPowershellCommandFor(scriptPath, event) };
+}
+function wiredCopilotHookWords(opts = {}) {
+  let config;
+  try {
+    config = JSON.parse(stripBom(fs7.readFileSync(copilotCliConfigPath(opts), "utf8")));
+  } catch {
+    return [];
+  }
+  const scriptPath = copilotCliScriptPath(opts);
+  const out = [];
+  for (const [event, entries] of Object.entries(config?.hooks ?? {})) {
+    const known = COPILOT_CLI_HOOK_EVENTS.includes(event) || VSCODE_ONLY_HOOK_EVENTS.includes(event);
+    const expected = known ? copilotHookCommandsFor(scriptPath, event, { sync: false }) : void 0;
+    for (const h of Array.isArray(entries) ? entries : []) {
+      if (typeof h?.command !== "string") continue;
+      const current = expected !== void 0 && h.command === expected.command && h.bash === expected.bash && h.powershell === expected.powershell;
+      out.push({ words: splitHookCommand(h.command, process.platform === "win32" ? "cmd" : "sh"), current });
+    }
+  }
+  return out;
+}
+function buildConfig(scriptPath, owners) {
+  const hooks = {};
+  const events = owners.has("vscode") ? [...COPILOT_CLI_HOOK_EVENTS, ...VSCODE_ONLY_HOOK_EVENTS] : COPILOT_CLI_HOOK_EVENTS;
+  for (const event of events) {
+    hooks[event] = [
+      {
+        type: "command",
+        ...copilotHookCommandsFor(scriptPath, event),
+        timeoutSec: HOOK_TIMEOUT_SEC,
+        allowedEnvVars: [...ALLOWED_ENV_VARS]
+      }
+    ];
+  }
+  return { version: 1, hooks };
+}
+var HOOKS_SCRIPT_FILE = "token-goat-shim.cjs";
+var LEGACY_HOOKS_SCRIPT_FILE = "token-goat-shim.js";
+var HOOKS_SCRIPT_FORWARDER = `#!/usr/bin/env node
+// Forwarder for compatibility with cached hook definitions in running Copilot CLI sessions.
+import('./token-goat-shim.cjs').catch(() => {
+  try { process.stdout.write('{}') } catch {}
+  process.exitCode = 0
+});
+`;
+function copilotHooksFilePaths(hooksDir) {
+  return [
+    path7.join(hooksDir, HOOKS_CONFIG_FILE),
+    path7.join(hooksDir, HOOKS_SCRIPT_FILE),
+    path7.join(hooksDir, LEGACY_HOOKS_SCRIPT_FILE),
+    copilotHooksOwnersPath(hooksDir)
+  ];
+}
+function installCopilotHooksFile(hooksDir, owner) {
+  const configPath = path7.join(hooksDir, HOOKS_CONFIG_FILE);
+  const scriptPath = path7.join(hooksDir, HOOKS_SCRIPT_FILE);
+  const legacyScriptPath = path7.join(hooksDir, LEGACY_HOOKS_SCRIPT_FILE);
+  const owners = readCopilotHooksOwners(hooksDir);
+  ensureDirRecordingCreation(path7.dirname(hooksDir));
+  ensureDirRecordingCreation(hooksDir);
+  const scriptChanged = writeIfDifferent(scriptPath, COPILOT_CLI_HOOK_SCRIPT);
+  const legacyScriptChanged = writeIfDifferent(legacyScriptPath, HOOKS_SCRIPT_FORWARDER);
+  owners.add(owner);
+  const desiredText = JSON.stringify(buildConfig(scriptPath, owners), null, 2) + "\n";
+  const configChanged = writeIfDifferent(configPath, desiredText, true);
+  recordCreatedConfig(configPath);
+  const ownersChanged = writeIfDifferent(copilotHooksOwnersPath(hooksDir), [...owners].sort().join("\n") + "\n");
+  return { configPath, scriptPath, changed: scriptChanged || legacyScriptChanged || configChanged || ownersChanged };
+}
+function releaseCopilotHooksFile(hooksDir, owner, keepBackups = false) {
+  const ownersPath = copilotHooksOwnersPath(hooksDir);
+  const hadSidecar = fs7.existsSync(ownersPath);
+  const owners = readCopilotHooksOwners(hooksDir);
+  if (!owners.has(owner) && (hadSidecar || owner !== "copilot")) return false;
+  owners.delete(owner);
+  if (owners.size > 0) {
+    writeIfDifferent(ownersPath, [...owners].sort().join("\n") + "\n");
+    const configPath = path7.join(hooksDir, HOOKS_CONFIG_FILE);
+    if (fs7.existsSync(configPath)) writeIfDifferent(configPath, JSON.stringify(buildConfig(path7.join(hooksDir, HOOKS_SCRIPT_FILE), owners), null, 2) + "\n", true);
+    return true;
+  }
+  const configRemoved = removeFileInScope(path7.join(hooksDir, HOOKS_CONFIG_FILE));
+  if (!keepBackups) removeCreatedBackups(path7.join(hooksDir, HOOKS_CONFIG_FILE));
+  takeCreatedConfig(path7.join(hooksDir, HOOKS_CONFIG_FILE));
+  const scriptRemoved = removeFileInScope(path7.join(hooksDir, HOOKS_SCRIPT_FILE));
+  const legacyScriptRemoved = removeFileInScope(path7.join(hooksDir, LEGACY_HOOKS_SCRIPT_FILE));
+  const ownersRemoved = removeFileInScope(ownersPath);
+  removeCreatedIfEmpty(hooksDir);
+  return configRemoved || scriptRemoved || legacyScriptRemoved || ownersRemoved;
+}
+function installCopilotCli(opts = {}) {
+  return withInstallScope(projectScopeRoot(opts), () => installCopilotCliScoped(opts));
+}
+function syncCopilotHooksAndInstructions(opts) {
+  const hooks = installCopilotHooksFile(copilotCliHooksDir(opts), "copilot");
+  const instructionsPath = copilotCliInstructionsPath(opts);
+  const instructionsExisted = fs7.existsSync(instructionsPath);
+  const instructionsChanged = writeCopilotInstructionsBlock(instructionsPath);
+  if (!instructionsExisted) recordCreatedConfig(instructionsPath);
+  return { hooks, instructionsChanged };
+}
+function repairCopilotCliHooks(opts = {}) {
+  return withInstallScope(projectScopeRoot(opts), () => {
+    const { hooks, instructionsChanged } = syncCopilotHooksAndInstructions(opts);
+    return hooks.changed || instructionsChanged;
+  });
+}
+function installCopilotCliScoped(opts) {
+  const instructionsPath = copilotCliInstructionsPath(opts);
+  const userScope = opts.local !== true;
+  const scopeDir = path7.dirname(instructionsPath);
+  const scopeDirExisted = fs7.existsSync(scopeDir);
+  const mcpChanged = userScope ? installCopilotMcpServer() : false;
+  if (!scopeDirExisted && fs7.existsSync(scopeDir)) recordCreatedConfig(scopeDir);
+  const { hooks, instructionsChanged: scopeInstructionsChanged } = syncCopilotHooksAndInstructions(opts);
+  let instructionsChanged = scopeInstructionsChanged;
+  if (userScope) {
+    const projectRoot = path7.resolve(opts.projectRoot ?? process.cwd());
+    const projectInstructions = copilotCliInstructionsPath({ local: true, projectRoot });
+    if (fs7.existsSync(projectInstructions)) {
+      const projectChanged = writeCopilotInstructionsBlock(projectInstructions);
+      if (projectChanged) instructionsChanged = true;
+    }
+  }
+  return {
+    configPath: hooks.configPath,
+    scriptPath: hooks.scriptPath,
+    instructionsPath,
+    ...userScope ? { mcpConfigPath: copilotMcpConfigPath() } : {},
+    alreadyInstalled: !hooks.changed && !instructionsChanged && !mcpChanged
+  };
+}
+function uninstallCopilotCliScope(opts) {
+  return withInstallScope(projectScopeRoot(opts), () => uninstallCopilotCliScopeInner(opts));
+}
+function uninstallCopilotCliScopeInner(opts) {
+  let removedAny = releaseCopilotHooksFile(copilotCliHooksDir(opts), "copilot");
+  const instructionsPath = copilotCliInstructionsPath(opts);
+  if (stripCopilotInstructionsBlock(instructionsPath)) {
+    removedAny = true;
+  }
+  removeCreatedIfEmpty(instructionsPath);
+  if (opts.local !== true && uninstallCopilotMcpServer()) {
+    removedAny = true;
+  }
+  removeCreatedIfEmpty(path7.dirname(instructionsPath));
+  return removedAny;
+}
+function uninstallCopilotCli(opts = {}) {
+  if (opts.local === true) {
+    return uninstallCopilotCliScope({ local: true });
+  }
+  const userRemoved = uninstallCopilotCliScope({ local: false });
+  const localRemoved = uninstallCopilotCliScope({ local: true });
+  return userRemoved || localRemoved;
+}
+function isCopilotCliInstalled(opts = {}) {
+  const scriptPresent = fs7.existsSync(copilotCliScriptPath(opts)) || fs7.existsSync(path7.join(copilotCliHooksDir(opts), LEGACY_HOOKS_SCRIPT_FILE));
+  if (!fs7.existsSync(copilotCliConfigPath(opts)) || !scriptPresent) {
+    return false;
+  }
+  if (!readCopilotHooksOwners(copilotCliHooksDir(opts)).has("copilot")) return false;
+  let instructions;
+  try {
+    instructions = fs7.readFileSync(copilotCliInstructionsPath(opts), "utf8");
+  } catch {
+    return false;
+  }
+  return instructions.includes(COPILOT_INSTRUCTIONS_BEGIN) && instructions.includes(COPILOT_INSTRUCTIONS_END);
+}
+
+export {
+  SHIM_TRY_SERVER,
+  SHIM_FILE,
+  LEGACY_SHIM_FILE,
+  legacyShimForwarder,
+  SHIM_REQUIRES,
+  SHIM_VALID_HOOK_EVENTS,
+  SHIM_TRY_IN_PROCESS,
+  SHIM_SPAWN_LADDER,
+  shimFallbackTimeoutConst,
+  SHIM_MAX_BUFFER_CONST,
+  CLAUDECODE_HOOK_SCRIPT,
+  buildGuidanceBody,
+  skillDescriptionLine,
+  buildGuidanceBlock,
+  packagedNativeBinary,
+  nativeCopyPath,
+  nativeCopyCurrent,
+  nativeSelftest,
+  nativeHookBinary,
+  nativeHookCommandLine,
+  splitHookCommand,
+  HookCommandRewriteError,
+  hookCommandRewrittenSpan,
+  parseNativeInvocation,
+  anchoredMarkerPattern,
+  claudeHookScriptPath,
+  settingsPath,
+  wiredClaudeHookWords,
+  installHooks,
+  uninstallHooks,
+  finishHookUninstall,
+  isInstalled,
+  claudeHooksInstalledAnyScope,
+  hookEventGaps,
+  claudeMdPath,
+  installedClaudeMdBlock,
+  installClaudeMd,
+  uninstallClaudeMd,
+  findStrayClaudeMdBlocks,
+  skillPath,
+  installedSkillDescription,
+  installSkill,
+  uninstallSkill,
+  CODEX_HOOK_SCRIPT,
+  groupHasTokenGoat2 as groupHasTokenGoat,
+  codexConfigPath,
+  codexAgentsPath,
+  codexHookScriptPath,
+  installCodex,
+  uninstallCodex,
+  wiredCodexHookWords,
+  isCodexInstalled,
+  bundledCliPath,
+  managedServer,
+  isManagedServer,
+  readServersJson,
+  serversOf,
+  editAt,
+  setTokenGoatServer,
+  isResidueServersJson,
+  noteRootKeyCreation,
+  dropEmptyServers,
+  managedServerEntry,
+  hasManagedServer,
+  MATERIALIZE_SHRUNK_IMAGE_JS,
+  COPILOT_CLI_HOOK_SCRIPT,
+  copilotMcpConfigPath,
+  visualStudioUserMcpPath,
+  visualStudioProjectMcpPath,
+  visualStudioOtherScopeHasManagedServer,
+  isVisualStudioInstalled,
+  visualStudioSolutionVscodeMcpPath,
+  visualStudioDuplicateNote,
+  visualStudioMcpStatus,
+  visualStudioManagedEntry,
+  syncVisualStudioProjectGuidance,
+  installVisualStudio,
+  uninstallVisualStudio,
+  canonicalProjectRoot,
+  copilotCliConfigPath,
+  copilotCliScriptPath,
+  copilotCliInstructionsPath,
+  wiredCopilotHookWords,
+  HOOKS_SCRIPT_FILE,
+  LEGACY_HOOKS_SCRIPT_FILE,
+  copilotHooksFilePaths,
+  installCopilotHooksFile,
+  releaseCopilotHooksFile,
+  installCopilotCli,
+  repairCopilotCliHooks,
+  uninstallCopilotCli,
+  isCopilotCliInstalled
+};