capt-hook 12.76.1__tar.gz → 12.76.2__tar.gz

{capt_hook-12.76.1 → capt_hook-12.76.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: capt-hook
-Version: 12.76.1
+Version: 12.76.2
 Summary: Stop repeating yourself to Claude.
 Project-URL: Homepage, https://github.com/yasyf/captain-hook
 Project-URL: Documentation, https://yasyf.github.io/captain-hook/

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "captain-hook",
-  "version": "12.76.0",
+  "version": "12.76.1",
   "displayName": "Captain Hook",
   "description": "Skills for the capt-hook declarative hook framework: bootstrap gates and nudges from a repo's conventions, and translate style guides into enforced StyleRules.",
   "author": {

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/bindings.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
+import glob
 import re
 from dataclasses import dataclass, field
 from itertools import product
 from math import prod
+from pathlib import PurePath
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -49,6 +51,7 @@ PREFIXES = frozenset({"!", "time", "builtin", "command"})
 DECLARERS = frozenset({"local", "declare", "typeset", "readonly", "let"})
 READERS = frozenset({"read", "mapfile", "readarray", "getopts"})
 UNREADABLE_BINDERS = frozenset({"eval", "source", ".", "case", "select", "coproc"})
+MUTATORS = READERS | DECLARERS | UNREADABLE_BINDERS | frozenset({"unset", "export", "printf"})
 UNREADABLE_IN_SUBSTITUTION = ("#", "<<", "case")
 SHELL_OWNED = frozenset({"PWD", "OLDPWD", "RANDOM", "SECONDS", "LINENO", "REPLY", "IFS", "BASH_COMMAND", "PIPESTATUS"})
 ENVIRONMENT = {"HOME": "~"}
@@ -338,7 +341,7 @@ class Scope:
     def __post_init__(self) -> None:
         self.mentioned = frozenset(match.group(1) for match in ASSIGNMENT.finditer(self.text))
         self.mutated = frozenset(name for match in MUTATION.finditer(self.text) for name in match.groups() if name)
-        if "IFS" in self.mentioned:
+        if "IFS" in self.mentioned or "IFS" in self.mutated:
             self.unreadable_from = 0
         Walk(self).run()
 
@@ -412,7 +415,7 @@ class Scope:
         )
         if any(len(candidate) > CANDIDATE_LENGTH for candidate in candidates):
             return Unresolved(None)
-        splittable = any(not ref.quoted for ref in refs.values())
+        splittable = any(not part.quoted for part in parts if isinstance(part, Ref))
         mixed = splittable and any(part.quoted for part in parts)
         if mixed and any(candidate.split() != [candidate] for candidate in candidates):
             return Unresolved(None)
@@ -425,6 +428,18 @@ def head_of(words: list[Token]) -> tuple[str, list[Token]]:
     return (dequote(words[0].raw), words[1:]) if words else ("", [])
 
 
+def literal_name(word: Token) -> str | None:
+    parts = segments(word.raw)
+    if parts is None or not all(isinstance(part, Literal) for part in parts):
+        return None
+    match = NAME.search("".join(part.text for part in parts))
+    return None if match is None else match.group()
+
+
+def program_name(candidate: str) -> str:
+    return PurePath(pieces[0] if (pieces := candidate.split()) else candidate).name
+
+
 @dataclass
 class Walk:
     scope: Scope
@@ -483,15 +498,42 @@ class Walk:
                 self.scope.functions.append((start, token.end))
         self.previous = token.raw
 
+    def bind(self, event: Event) -> None:
+        if event.name == "IFS":
+            self.scope.mark_unreadable(event.offset)
+        self.scope.events.append(event)
+
     def bind_unreadable(self, word: Token) -> None:
         if (match := ASSIGNMENT.match(word.raw)) is not None:
-            self.scope.events.append(Event(word.start, match.group(1), Unknown(None)))
+            self.bind(Event(word.start, match.group(1), Unknown(None)))
+
+    def computed_mutator(self, word: Token) -> bool:
+        parts = segments(word.raw)
+        if parts is not None and all(isinstance(part, Literal) for part in parts):
+            return False
+        match self.scope.resolve(word.raw, word.start):
+            case Resolved(candidates, _):
+                return any(program_name(candidate) in MUTATORS for candidate in candidates)
+            case Unresolved():
+                return True
 
     def flush(self, *, sure: bool) -> None:
         words, self.words = self.words, []
         if not words:
             return
         head, rest = head_of(words)
+        head_word = next(
+            (
+                word
+                for word in words
+                if dequote(word.raw) not in PREFIXES
+                and ASSIGNMENT.match(word.raw) is None
+                and not word.raw.startswith("-")
+            ),
+            None,
+        )
+        if head_word is not None and self.computed_mutator(head_word):
+            self.scope.mark_unreadable(head_word.start)
         if head in BODY_OPENERS:
             if head == "else" and self.stack and self.stack[-1][0] == "then":
                 self.stack.pop()
@@ -530,14 +572,18 @@ class Walk:
                 self.bind_assignment(word, sure=sure)
 
     def bind_names(self, head: str, words: list[Token]) -> None:
-        names = [
-            match.group()
-            for word in words
-            if not word.raw.startswith("-") and (match := NAME.search(dequote(word.raw))) is not None
-        ]
+        names: list[str] = []
+        for word in words:
+            if word.raw.startswith("-"):
+                continue
+            if (name := literal_name(word)) is None:
+                self.scope.mark_unreadable(word.start)
+                return
+            names.append(name)
         if head == "read" and not names:
             names = ["REPLY"]
-        self.scope.events.extend(Event(words[0].start if words else 0, name, Unknown(None)) for name in names)
+        for name in names:
+            self.bind(Event(words[0].start if words else 0, name, Unknown(None)))
 
     def bind_exports(self, words: list[Token], sure: bool) -> None:
         options = any(word.raw.startswith("-") for word in words)
@@ -567,7 +613,7 @@ class Walk:
                 binding = Unknown(" ".join(candidates))
             case Unresolved(source):
                 binding = Unknown(source)
-        self.scope.events.append(Event(word.start, name, binding))
+        self.bind(Event(word.start, name, binding))
 
     def bind_loop(self, words: list[Token]) -> None:
         match [word.raw for word in words]:
@@ -575,7 +621,9 @@ class Walk:
                 candidates: list[str] = []
                 for item in words[2:]:
                     match self.scope.resolve(item.raw, item.start):
-                        case Resolved(values, splittable) if not any("{" in value for value in values):
+                        case Resolved(values, splittable) if not any(
+                            "{" in value or glob.has_magic(value) for value in values
+                        ):
                             candidates.extend(
                                 piece for value in values for piece in (value.split() if splittable else [value])
                             )
@@ -588,16 +636,16 @@ class Walk:
                     else Unknown(" ".join(word.raw for word in words[2:]) or None)
                 )
                 self.pending_loop = len(self.scope.events)
-                self.scope.events.append(Event(words[0].start, name, binding))
+                self.bind(Event(words[0].start, name, binding))
             case [name, *_] if NAME.fullmatch(name) is not None:
-                self.scope.events.append(Event(words[0].start, name, Unknown(None)))
+                self.bind(Event(words[0].start, name, Unknown(None)))
             case _:
                 pass
 
     def close_loop(self, index: int, end: int) -> None:
         event = self.scope.events[index]
         self.scope.events[index] = Event(event.offset, event.name, event.binding, end)
-        self.scope.events.append(Event(end, event.name, Unknown(source_of(event.binding))))
+        self.bind(Event(end, event.name, Unknown(source_of(event.binding))))
 
 
 def printf_destination(words: list[Token]) -> list[Token]:

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/builtin_packs/general/hooks/_sessions.py

@@ -341,10 +341,10 @@ def head_reason(call: Call) -> str | None:
                 f"BLOCKED: `{spelling}` runs a command named at run time (`{clip(head.raw, 40)}`), so the guard "
                 "cannot tell what runs. Spell the command name literally."
             )
-        case Unresolved(source) if (named := names_guarded_word(source)) is not None:
+        case Unresolved(source) if source:
             return (
-                f"BLOCKED: `{spelling}` runs a command named at run time (`{clip(head.raw, 40)}`) from text "
-                f"that names `{named}` (`{clip(source, 40)}`). Spell the command name literally."
+                f"BLOCKED: `{spelling}` runs a command named at run time (`{clip(head.raw, 40)}`) built from text "
+                f"the guard cannot read (`{clip(source, 40)}`). Spell the command name literally."
             )
         case _:
             return None

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/builtin_packs/general/hooks/commands.py

@@ -438,7 +438,10 @@ hook(
         Input(command="cd / && find . -name '*.pyc' -exec rm {} +"): Block(),
         Input(command="find / -newermt 2020-01-01 -exec echo {} +"): Block(),
         Input(command="find . -name '*.pyc' -exec rm {} +", cwd="/Users/alice"): Block(),
-        Input(command=r"cd /tmp/reco-box-size && find . -name '*gil*.json' -exec cat {} \;"): Allow(),
+        Input(command='D=$(printf /); cd "$D" && find . -exec echo {} +'): Block(),
+        Input(command="find . -name '*.pyc' -exec rm {} +"): Block(),
+        Input(command=r"find . -name '*gil*.json' -exec cat {} \;", cwd="/tmp/reco-box-size"): Allow(),
+        Input(command=r"cd /tmp && find . -name '*gil*.json' -exec cat {} \;"): Allow(),
         Input(command=r"find . -name '*.pyc' -exec rm {} \;", cwd="/repo"): Allow(),
         Input(command="R=~/.claude/worktrees/monorepo/x; find $R -name targets.yaml -exec cat {} +"): Allow(),
         Input(command="find . -name '*.pyc'"): Allow(),

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/builtin_packs/general/hooks/deletions.py

@@ -22,6 +22,8 @@ if TYPE_CHECKING:
     from captain_hook.cmd import Call
     from captain_hook.events import PreToolUseEvent
 
+SCRATCH_GLOB_LIMIT = 2000
+
 
 @dataclass(frozen=True)
 class Recoverable:
@@ -99,11 +101,18 @@ def check_target(
             f"The glob '{token}' is too broad to verify before deleting. "
             "Narrow the pattern or run `rm -r <dir>` on a specific directory."
         )
-    if len(expansion) > GLOB_LIMIT and not scratch_glob(target):
-        return evt.block(
-            f"The glob '{token}' matches more than {GLOB_LIMIT} files. "
-            f"Run `ls {token}`, then narrow the pattern or run `rm -r <dir>` on a named directory."
-        )
+    if len(expansion) > GLOB_LIMIT:
+        if not scratch_glob(target):
+            return evt.block(
+                f"The glob '{token}' matches more than {GLOB_LIMIT} files. "
+                f"Run `ls {token}`, then narrow the pattern or run `rm -r <dir>` on a named directory."
+            )
+        expansion = target.expand(limit=SCRATCH_GLOB_LIMIT)
+        if expansion.exhausted or len(expansion) > SCRATCH_GLOB_LIMIT:
+            return evt.block(
+                f"The glob '{token}' matches more than {SCRATCH_GLOB_LIMIT} files, too many to check before "
+                "deleting. Run `rm -r <dir>` on a named scratch directory instead."
+            )
     recovery: Recoverable | None = None
     for match in expansion:
         result = check_resolved(evt, Target(match, match, cwd), rewritable=rewritable)
@@ -164,6 +173,9 @@ ROOT_RM: Block = Block(pattern="filesystem root") if trash_binary() else Block(p
         Input(command="rm -rf $d/*", cwd="/"): Block(pattern="built at run time"),
         Input(command='X="/tmp/x /"; rm -rf $X', cwd="/"): ROOT_RM,
         Input(command='X="/tmp/x /outside"; rm -rf $X', cwd="/"): RECOVERABLE_RM,
+        Input(command='X="/tmp/a /Users/yasyf /tmp/b"; rm -rf $X"$X"', cwd="/"): Block(pattern="repository"),
+        Input(command='read IFS <<<:; X="/tmp/x:/Users/yasyf"; rm -rf $X', cwd="/"): Block(pattern="repository"),
+        Input(command='IFS=:; X="/tmp/x:/Users/yasyf"; rm -rf $X', cwd="/"): Block(pattern="repository"),
         Input(command="rm -f /tmp/../etc/*", cwd="/"): Block(),
         Input(command="rm /outside/{a,b}", cwd="/"): Block(pattern="repository"),
         Input(command="rm foo\\\nbar", cwd="/"): Block(pattern="repository"),

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/builtin_packs/general/hooks/sessions.py

@@ -8,7 +8,7 @@ from typing import TYPE_CHECKING
 from cc_transcript.command import PAYLOAD_DEPTH_LIMIT
 
 from captain_hook import Allow, Block
-from captain_hook.bindings import Ref, segments
+from captain_hook.bindings import Resolved
 from captain_hook.builtin_packs.general.hooks._sessions import (
     ARG_TOKEN_BREAK,
     GUARDED_PROGRAMS,
@@ -34,18 +34,49 @@ from captain_hook.builtin_packs.general.hooks._sessions import (
     spell,
     unresolvable,
 )
-from captain_hook.command_schemas import KILL, LAUNCHCTL, ORCA, PMSET, RENICE, SIGNAL_FLAGS, SOFTWAREUPDATE, TMUX
+from captain_hook.command_schemas import KILL, LAUNCHCTL, ORCA, PMSET, RENICE, SOFTWAREUPDATE, TMUX
 from captain_hook.guard_literal import QUOTING_CHARS
 from captain_hook.util.shell import SHELLS
 
 if TYPE_CHECKING:
+    from cc_transcript.command import Word
+
     from captain_hook import HookResult, ToolRewriteEvent
     from captain_hook.builtin_packs.general.hooks._sessions import Facts, Unparsed
     from captain_hook.cmd import Call
     from captain_hook.command_schema import Arguments, Scalar
 
 CRITERIA_PROGRAMS = frozenset({"pkill", "killall", "killall5", "skill", "snice", "kill-port"})
-SIGNAL_FLAGS_SET = frozenset(SIGNAL_FLAGS)
+PKILL_CRITERIA_SHORT = frozenset("fxnoiluUgGtPacvF")
+PKILL_CRITERIA_LONG = frozenset(
+    {
+        "--full",
+        "--exact",
+        "--newest",
+        "--oldest",
+        "--ignore-case",
+        "--inverse",
+        "--count",
+        "--list-name",
+        "--list-full",
+        "--euid",
+        "--uid",
+        "--group",
+        "--pgroup",
+        "--session",
+        "--terminal",
+        "--parent",
+        "--ns",
+        "--nslist",
+        "--pidfile",
+        "--logpidfile",
+        "--cgroup",
+        "--runstates",
+        "--ignore-ancestors",
+        "--require-handler",
+    }
+)
+ORCA_VM_RUN_FLAGS = frozenset({"--provision", "--connect"})
 PACKAGE_RUNNERS = frozenset({"npx", "bunx", "pnpx", "pnpm", "yarn"})
 CRITERIA_FIX = (
     "Find the pid with `pgrep -fl <pattern>`, verify it with `ps -o pid,ppid,pgid,lstart,command -p <pid>`, and "
@@ -138,10 +169,25 @@ STDIN_SCRIPTS = frozenset({"-", "/dev/stdin", "/dev/fd/0"})
 @guard(
     tests={
         guarded(command="read p; $p sleep; ls ~/.orca"): Block(pattern="named at run time"),
-        guarded(command="p=$(echo pkill); $p sleep"): Block(pattern="from text that names `pkill`"),
+        guarded(command="p=$(echo pkill); $p sleep"): Block(pattern="built from text the guard cannot read"),
         guarded(command='P=$(ls | head -1); [ -z "$P" ] && P=$(find ~ -name python); "$P" -c x'): Block(
-            pattern="from text that names"
+            pattern="text the guard cannot read"
+        ),
+        guarded(command="C=$(printf '%s%s' pk ill); \"$C\" claude; orca status"): Block(
+            pattern="text the guard cannot read"
+        ),
+        guarded(command='X=echo; V=X; read "$V" <<<pkill; "$X" claude; ls ~/.orca'): Block(pattern="named at run time"),
+        guarded(command='X=echo; V=X; printf -v "$V" pkill; "$X" claude; ls ~/.orca'): Block(
+            pattern="named at run time"
+        ),
+        guarded(command='X=echo; R=read; $R X <<<pkill; "$X" claude; ls ~/.orca'): Block(pattern="named at run time"),
+        guarded(command='X=echo; R=$(echo read); $R X <<<pkill; "$X" claude; ls ~/.orca'): Block(
+            pattern="named at run time"
         ),
+        guarded(command='for P in /usr/bin/[p]kill; do "$P" -f claude; done'): Block(
+            pattern="text the guard cannot read"
+        ),
+        guarded(command='P=echo; sh -c "P=pkill; \\$P claude"'): Block(pattern="named at run time"),
         guarded(command="$W kill 14575"): Block(pattern="`kill` among its arguments"),
         guarded(command="W=timeout; $W 5 kill 14575"): Block(pattern="among its arguments"),
         guarded(command="$SHELL -c 'kill 14575'"): Block(pattern="among its arguments"),
@@ -149,11 +195,11 @@ STDIN_SCRIPTS = frozenset({"-", "/dev/stdin", "/dev/fd/0"})
         guarded(command='$W "$1"; ls ~/.orca'): Block(pattern='`"\\$1"` among its arguments'),
         guarded(command="W='timeout 5'; $W pkill sleep"): Block(pattern="`pkill` among its arguments"),
         guarded(command="f() { $CMD 14575; }; CMD=kill; f"): Block(pattern="named at run time"),
-        guarded(command="p=ls; (p=kill); $p 14575"): Block(pattern="from text that names"),
-        guarded(command="false && p=kill; $p 14575"): Block(pattern="from text that names"),
+        guarded(command="p=ls; (p=kill); $p 14575"): Block(pattern="text the guard cannot read"),
+        guarded(command="false && p=kill; $p 14575"): Block(pattern="text the guard cannot read"),
         guarded(command="eval 'p=ls'; $p 14575; ls ~/.orca"): Block(pattern="named at run time"),
         guarded(command='[ -z "$P" ] && kill -l'): Allow(),
-        guarded(command="false && p=ls; $p 14575; ls ~/.orca"): Allow(),
+        guarded(command="false && p=ls; $p 14575; ls ~/.orca"): Block(pattern="text the guard cannot read"),
         guarded(command="cat <<'EOF'\np=ls\nEOF\n$p kill 14575"): Block(),
         guarded(command="{kill,14575}"): Block(pattern="expands at run time"),
         guarded(command="{pkill,-x,sleep}"): Block(),
@@ -185,6 +231,13 @@ STDIN_SCRIPTS = frozenset({"-", "/dev/stdin", "/dev/fd/0"})
                 'skills/codex/1.14.0/skills/codex/../../bin/codex-ask"; "$CA" --lane review --schema findings - '
                 "<<'Q' 2>&1 | tail -40\nReview the builtin packs.\nQ"
             )
+        ): Block(pattern="text the guard cannot read"),
+        guarded(
+            command=(
+                'CA="/Users/yasyf/.claude/plugins/cache/skills/codex/1.14.0/skills/codex/../../bin/codex-ask"; '
+                'cd ~/.claude/worktrees/captain-hook/hook-lint-builtins && "$CA" --lane review --schema findings - '
+                "<<'Q' 2>&1 | tail -40\nReview the builtin packs.\nQ"
+            )
         ): Allow(),
         guarded(
             command=(
@@ -203,21 +256,21 @@ STDIN_SCRIPTS = frozenset({"-", "/dev/stdin", "/dev/fd/0"})
                 "cd /Users/yasyf/.orca/workspaces/monorepo/monorepo/v3-incident-api-1n80-fix-base && "
                 "B=$(realpath ../v3-incident-api-1n7z-fix-base/node_modules/.bin/biome); $B --version"
             )
-        ): Allow(),
+        ): Block(pattern="text the guard cannot read"),
         guarded(command='timeout 20 "$CP" outcomes --no-doc --session d0bf 2>&1; ls ~/.orca'): Allow(),
         guarded(
             command=(
                 "B=$(ls /Users/yasyf/.orca/workspaces/monorepo/monorepo/sole/node_modules/.bin/biome 2>/dev/null || "
                 "command -v biome) && $B check infra/ci/src/verbs/release-stacks.ts 2>&1 | tail -25"
             )
-        ): Allow(),
+        ): Block(pattern="text the guard cannot read"),
         guarded(
             command=(
                 'for c in "bun infra/graph.ts" "bun infra/k8s.ts delivery"; do eval $c || echo "FAILED $c"; done; '
                 "ls ~/.orca"
             )
         ): Allow(),
-        guarded(command="X=echo; X[0]=pkill; $X claude"): Block(pattern="from text that names `pkill`"),
+        guarded(command="X=echo; X[0]=pkill; $X claude"): Block(pattern="text the guard cannot read"),
         guarded(command="X=echo; printf -v X pkill; $X claude"): Block(pattern="named at run time"),
         guarded(command="X=echo; read 'X' <<<pkill; $X claude"): Block(pattern="named at run time"),
         guarded(command="X=echo; declare -n Y=X; Y=pkill; $X claude"): Block(pattern="named at run time"),
@@ -228,7 +281,7 @@ STDIN_SCRIPTS = frozenset({"-", "/dev/stdin", "/dev/fd/0"})
         guarded(command="X='{p,q}kill'; $X -x claude"): Block(pattern="expands at run time"),
         guarded(command='X=echo; function f() { "$X" claude; }; X=pkill; f'): Block(pattern="named at run time"),
         guarded(command='X=echo; f() { echo }; "$X" claude; }; X=pkill; f'): Block(pattern="named at run time"),
-        guarded(command='for X in {echo,pkill}; do "$X" claude; done'): Block(pattern="from text that names"),
+        guarded(command='for X in {echo,pkill}; do "$X" claude; done'): Block(pattern="text the guard cannot read"),
         guarded(command="PWD=/tmp; cd /; $PWD/kill 14575"): Block(pattern="named at run time"),
         guarded(command='cd ~/.orca/workspaces/x && for g in a.ts b.ts; do eval "timeout 120 bun $g"; done'): Allow(),
         guarded(command="~/bin/kill 14575"): Allow(),
@@ -261,10 +314,12 @@ def unread_reason(call: Call, arguments: Arguments) -> str:
     return "it names an option or signal at run time"
 
 
-def one_variable(raw: str) -> bool:
-    match segments(raw):
-        case [Ref()]:
-            return True
+def probe_pid(call: Call, word: Word, value: Scalar | None) -> bool:
+    if literal_pid(word, value) is not None:
+        return True
+    match call.resolve(word):
+        case Resolved(candidates, _):
+            return all(candidate.isdecimal() for candidate in candidates)
         case _:
             return False
 
@@ -286,10 +341,7 @@ def kill_verdict(call: Call, facts: Facts) -> str | None:
         return None
     targets = tuple(zip(arguments.words.get("targets", ()), values.get("targets", ()), strict=True))
     probing = ("probe" in values and "signal" not in values) or values.get("signal") == ("0",)
-    if probing and (
-        all(literal_pid(word, value) is not None for word, value in targets)
-        or (len(targets) == 1 and (double_quoted(targets[0][0].raw) or one_variable(targets[0][0].raw)))
-    ):
+    if probing and all(probe_pid(call, word, value) for word, value in targets):
         return None
     if not targets:
         return deny("a wrapper supplies its targets") if call.wrappers else None
@@ -299,7 +351,7 @@ def kill_verdict(call: Call, facts: Facts) -> str | None:
     if probing:
         return (
             f"BLOCKED: `{spelling}` cannot be verified: {describe_target(word, value)}, so the probe could expand "
-            f'into a real signal. Pass one double-quoted word (`"{clip(word.raw, 40)}"`) or the literal pid.'
+            "into a real signal. Pass the literal pid, or a variable the same line sets to one."
         )
     return deny(describe_target(word, value))
 
@@ -350,7 +402,17 @@ def kill_verdict(call: Call, facts: Facts) -> str | None:
         guarded(command="kill -STOP 14575"): Block(),
         guarded(command="kill -s KILL 14575"): Block(),
         guarded(command="kill -0 -9 14575"): Block(),
+        guarded(command="kill -0 14575 -9"): Block(),
         guarded(command="PID='-s 9 14575'; kill -0 $PID"): Block(pattern="an agent session"),
+        guarded(command='bash -c \'PID=$(printf "%s" "-s KILL 14575"); kill -0 $PID\''): Block(
+            pattern="probe could expand into a real signal"
+        ),
+        guarded(command='kill -0 "$worker" 2>/dev/null || break'): Block(pattern="probe could expand"),
+        guarded(command="kill -0 ${PID}"): Block(pattern="probe could expand"),
+        guarded(command="PID=$(awk '{print $2}' /tmp/apply.pid); kill -0 $PID 2>/dev/null && echo alive"): Block(
+            pattern="probe could expand"
+        ),
+        guarded(command="PID=14575x; kill -0 $PID"): Block(pattern="probe could expand"),
         guarded(command="X=-9; kill $X $(printf 14575)"): Block(pattern="command substitution"),
         guarded(command="kill -0 $pid 14575"): Block(pattern="probe could expand into a real signal"),
         guarded(command="kill -0 $pid$x"): Block(pattern="probe could expand into a real signal"),
@@ -369,15 +431,9 @@ def kill_verdict(call: Call, facts: Facts) -> str | None:
         guarded(tool="mcp__runner__exec", tool_input={"argv": ["kill", 14575]}): Block(pattern="an agent session"),
         guarded(tool="mcp__x__exec", tool_input={"command": "kill 14575 \udc80"}): Block(),
         guarded(command="kill -0 14575"): Allow(),
-        guarded(command='kill -0 "$worker" 2>/dev/null || break'): Allow(),
-        guarded(
-            command=(
-                "LOG=~/.claude/scratch/release-v3/sandsql-aig-migration/apply-a9922c25.log; PID=$(awk '{print $2}' "
-                "~/.claude/scratch/release-v3/sandsql-aig-migration/apply.pid); kill -0 $PID 2>/dev/null && echo alive"
-            )
-        ): Allow(),
-        guarded(command="kill -0 ${PID}"): Allow(),
         guarded(command="PID=31337; kill -0 $PID"): Allow(),
+        guarded(command='PID=31337; kill -0 "$PID" 2>/dev/null || break'): Allow(),
+        guarded(command="for p in 31337 31338; do kill -0 $p; done"): Allow(),
         guarded(command="kill -s 0 14575"): Allow(),
         guarded(command="kill -l"): Allow(),
         guarded(command="kill -l 9"): Allow(),
@@ -437,7 +493,17 @@ def renice_unverified_pid(evt: ToolRewriteEvent) -> HookResult | None:
 
 
 def probes_only(call: Call) -> bool:
-    return call.args[:1] == ("-0",) and SIGNAL_FLAGS_SET.isdisjoint(call.args[1:])
+    if call.args[:1] != ("-0",):
+        return False
+    for arg in call.args[1:]:
+        if not arg.startswith("-"):
+            continue
+        flag = arg.partition("=")[0]
+        if flag in PKILL_CRITERIA_LONG:
+            continue
+        if flag.startswith("--") or len(flag) < 2 or not set(flag[1:]) <= PKILL_CRITERIA_SHORT:
+            return False
+    return True
 
 
 def criteria_program(call: Call) -> str | None:
@@ -481,6 +547,12 @@ def criteria_verdict(call: Call) -> str | None:
         guarded(command="X=pkill; cat <<EOF\n\tEOF\nX=echo\nEOF\n$X claude"): Block(pattern="signals every process"),
         guarded(command="X=pkill; cat <<-EOF\n\tEOF\nX=echo\nEOF\n$X claude"): Allow(),
         guarded(command="pkill node"): Block(),
+        guarded(command="pkill -0 --signal KILL -f claude"): Block(pattern="signals every process matching"),
+        guarded(command="pkill -0 --signal=KILL -f claude"): Block(),
+        guarded(command="pkill -0 -s KILL -f claude"): Block(),
+        guarded(command="pkill -0 -SIGKILL -f claude"): Block(),
+        guarded(command="pkill -0 -fs KILL claude"): Block(),
+        guarded(command="pkill -0 -e claude"): Block(),
         guarded(command="pkill -0 -9 x"): Block(),
         guarded(command="pkill -f -0 x"): Block(),
         guarded(command="pkill -TERM -0 x"): Block(),
@@ -516,6 +588,7 @@ def criteria_verdict(call: Call) -> str | None:
         guarded(command="fuser -v 3000/tcp"): Allow(),
         guarded(command="gh api rate_limit -q '.resources.core' ; date +%s; pkill -0 x 2>/dev/null; echo"): Allow(),
         guarded(command="pkill -0 -f 'ledger.py watch'"): Allow(),
+        guarded(command="pkill -0 -fx --newest claude"): Allow(),
         guarded(command="pgrep -f claude"): Allow(),
         guarded(command="echo pkill -f never"): Allow(),
         guarded(tool="mcp__runner__exec", tool_input={"cmd": "pgrep -f claude"}): Allow(),
@@ -624,10 +697,19 @@ def orca_ending_verdict(call: Call) -> str | None:
             )
         case (str() as group_name, str() as verb_name) if verb_name in ORCA_ENDINGS.get(group_name, ()):
             return orca_ending(spelling, group_name, verb_name, arguments)
+        case ("vm", verb_name) if (flag := orca_vm_run_flag(call)) is not None or verb_name != "recipe":
+            return (
+                f"BLOCKED: `{spelling}` passes `{flag or verb_name}`, which runs a recipe's commands on a VM, and a "
+                "recipe may end sessions. Run `orca vm recipe doctor <recipe-id>` without `--provision` or `--connect`."
+            )
         case _:
             return None
 
 
+def orca_vm_run_flag(call: Call) -> str | None:
+    return next((arg for arg in call.args if arg.partition("=")[0] in ORCA_VM_RUN_FLAGS), None)
+
+
 @guard(
     tests={
         guarded(
@@ -678,6 +760,15 @@ def orca_ending_verdict(call: Call) -> str | None:
         guarded(command="orca nuke everything"): Block(pattern="does not know"),
         guarded(command="orca orchestration worker-release --help 2>&1 | head -15"): Block(pattern="worker-release"),
         guarded(command="orca terminal close --help"): Block(pattern="closes the current terminal"),
+        guarded(
+            command="orca vm recipe doctor guard-probe --provision --repo-path /Users/yasyf/.claude/scratch/x/vm-probe"
+        ): Block(pattern="passes `--provision`"),
+        guarded(command="orca vm recipe doctor guard-probe --connect --json"): Block(pattern="passes `--connect`"),
+        guarded(command="orca vm recipe doctor guard-probe --provision=true"): Block(
+            pattern="passes `--provision=true`"
+        ),
+        guarded(command="orca vm create guard-probe"): Block(pattern="passes `create`"),
+        guarded(command="orca vm recipe doctor cloud-sandbox --repo-path /path/to/repo --json"): Allow(),
         guarded(command="'orca' terminal close"): Block(),
         guarded(
             tool="mcp__runner__exec", tool_input={"command": "orca", "args": ["terminal", "close", "--terminal", "t"]}

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/builtin_packs/performance/hooks/filesystem.py

@@ -91,6 +91,15 @@ hook(
         Input(command="cd / && for d in *; do find $d -name daemonkit; done"): Block(),
         Input(command="find ~/.claude/worktrees/*/ -name daemonkit"): Block(),
         Input(command="find /Users/* -maxdepth 3 -name daemonkit"): Block(),
+        Input(command='D=$(printf /); cd "$D" && find . -name daemonkit'): Block(),
+        Input(command="find . -name daemonkit"): Block(),
+        Input(
+            command=(
+                "for d in go/ci/internal/release/*/; do "
+                "echo \"$(find $d -name '*.go' ! -name '*_test.go' | xargs cat | wc -l) $d\"; done"
+            ),
+            cwd="/Users/yasyf/.claude/worktrees/monorepo/ethos-audit",
+        ): Block(),
         Input(command="find / -maxdepth 1 -type d"): Allow(),
         Input(command="find ~ -maxdepth 2 -type d -name daemonkit"): Allow(),
         Input(command="find / -maxdepth 0"): Allow(),
@@ -103,13 +112,6 @@ hook(
                 "find $R -name 'targets.yaml' -not -path '*/node_modules/*' | head"
             )
         ): Allow(),
-        Input(
-            command=(
-                "for d in go/ci/internal/release/*/; do "
-                "echo \"$(find $d -name '*.go' ! -name '*_test.go' | xargs cat | wc -l) $d\"; done"
-            ),
-            cwd="/Users/yasyf/.claude/worktrees/monorepo/ethos-audit",
-        ): Allow(),
         Input(
             command="for v in 0.2.9 0.2.11; do find $v -maxdepth 3; done",
             cwd="/Users/yasyf/.claude/plugins/cache/forge",
@@ -129,9 +131,9 @@ hook(
         ): Allow(),
         Input(command="find $HOME/.claude/worktrees/captain-hook/x -name daemonkit"): Allow(),
         Input(command="find ~/.claude/worktrees/captain-hook/* -name daemonkit"): Allow(),
-        Input(command="find src -name daemonkit"): Allow(),
+        Input(command="find src -name daemonkit", cwd="/repo"): Allow(),
         Input(command="find src -newermt 2026-09-17", cwd="/repo"): Allow(),
-        Input(command="find src -path / -prune"): Allow(),
+        Input(command="find src -path / -prune", cwd="/repo"): Allow(),
         Input(command="echo 'find / -name daemonkit'"): Allow(),
         Input(command="cat <<'EOF'\nfind / -name daemonkit\nEOF"): Allow(),
         Input(command="ccx repo locate daemonkit"): Allow(),

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/cmd.py

@@ -580,7 +580,7 @@ class Cmd:
             return self.scope, None
         quote = call.occurrence.quote_contexts[-1:]
         if quote == ('"',):
-            return host_scope, host_offset
+            return (self.scope, None) if "\\$" in payload.raw else (host_scope, host_offset)
         within = None if word.span is None else self.char_offset(word.span[0]) - self.char_offset(payload.span[0])
         if quote == ("'",) and payload.value is not None:
             text, start = payload.value, 1

{capt_hook-12.76.1 → capt_hook-12.76.2}/captain_hook/command_schema.py

@@ -263,7 +263,7 @@ class PathMatches:
         path = Path(value)
         if not path.is_absolute():
             if target.cwd is None:
-                return False
+                return self.unresolved
             path = target.cwd / path
         return any(self.matches(candidate) for candidate in (path, glob_prefix(path)))
 

{capt_hook-12.76.1 → capt_hook-12.76.2}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "capt-hook"
 # Inert sentinel — the real version is stamped from the release tag (uv version --frozen).
-version = "12.76.1"
+version = "12.76.2"
 description = "Stop repeating yourself to Claude."
 readme = "README.md"
 license = "PolyForm-Noncommercial-1.0.0"