v1.4.2

Release 1.4.2 (#358)

* Codex: read patch headers as Codex does; hold apply_patch run from the shell; a Cursor Delete is a file edit

Codex reads a patch's file headers from the line with its whitespace trimmed, so the hooks now read an indented
header too and decide every file the patch names. A patch run from the shell (apply_patch, applypatch, or
codex --codex-run-as-apply-patch) is applied by Codex itself, so the coding pack holds it for a person (TK-A034,
pack 2026.10-v2-24). Cursor's Delete is mapped to Edit, so the file rules decide it as they do a Codex patch's
Delete File. The Cursor Write fixture uses Cursor's own {file_path, content} shape.

docs/limits.md names what TK-A034 doesn't read and that v1 decides a Codex patch by its first file. The eval
results are refreshed once for this branch's pack changes in a later commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* TK-A034: read Codex's patch flag after any program name, and after its npm launcher's script

Codex reads --codex-run-as-apply-patch as its first argument whatever its binary is called, and its npm launcher
passes it on, so the rule holds the flag there too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* TK-A034: hold Codex started as apply_patch (exec -a, env --argv0); docs say '/' directories and the Windows .bat copy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* fix(policy): TK-A001 also holds terragrunt's older destroy-all and apply-all -destroy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* eval: refresh E17 and E21 results for the coding pack's TK-A034 and TK-A001 changes

Policy hashes only; every count and rate is unchanged. E21's machine and latency values are the committed ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* Coding-agent hooks: v1 decides every file a patch names; OpenCode plugin in plugin/, names its event, refuses batch

- The v1 policy decides a call with a `paths` list (a Codex or OpenCode patch) on each file as its file_path: a rule
  that matches any of them applies, and one file outside the project flags the call.
- OpenCode patch headers are also read up to their next ':', as OpenCode read them from 2026-01-18 to 2026-02-23
  (1.2.0); both readings are decided.
- The v1 hooks read a payload after a byte order mark. A payload that isn't a JSON object goes to the hook's error
  path, which follows the fail mode, as the docs say. The OpenCode plugin names its event, so a pre-tool call its hook
  can't decide is blocked whatever the fail mode; in every v1 hook (Claude Code's too) a payload nested too deep to
  read blocks the call.
- The plugin is written to plugin/, which every OpenCode 1.x loads (1.0 reads no plugins/); uninstall with nothing
  installed makes no directory.
- The plugin refuses OpenCode's experimental batch tool, whose inner calls run without plugin hooks.
- In dev mode the plugin runs the hook as the other harnesses' hooks do (install._dev_hook_argv), so a --user
  install of Tracekit runs under -I.
- docs: coding agents and limits rows updated; a row for the batch tool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* OpenCode hooks: 1.0's patch tool is decided as an Edit of every file it names, as apply_patch is

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* Hermes plugin: a call run with Hermes's repaired argument types is recorded as run; a call Hermes blocked while its hook still decided never runs; a hold whose wait fails is withdrawn

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* fix(policy): TK-A031, TK-A032 and TK-A033 read past a newline in an argument and options before the verb

TK-A033 missed a merge after an argument with a newline in it: a multi-line GraphQL query (as GitHub's docs write
them), `gh api -X PUT -f commit_message='a<newline>b' …/pulls/1/merge` and glab's multi-line mergeRequestAccept. The
same `.*` hid the flag or bucket from TK-A031 and TK-A032. Each now uses a lazy `[\w\W]*?`, as TK-A001 and TK-A002 do.

TK-A031 and TK-A032 also read up to eight options between the service and its verb (`aws s3 --profile p rm …
--recursive`, `aws s3api --region r delete-bucket`, `gcloud storage --project=p buckets delete`, `aws s3 --profile p
cp f s3://b/k`). TK-A031 also holds s3cmd rb and a recursive s3cmd del/rm, az storage fs delete, fs directory delete,
file delete-batch and remove --recursive. Downloads, listings and one object's delete stay as they were.

TK-A031 is now linear on the fallback engine (64 KiB of ` -` after `gsutil rm`: 200 ms, quadratic, now 5 ms), so the
speed test holds it to every filler and gains a bare ` -` filler. TK-A032's worst drops from ~90 ms to ~47 ms.

docs/limits.md names what stays uncovered (curl dot segments and globbing, a branch merge, a query in a variable or
pipe, a backslash Windows path to the program, TF_CLI_ARGS_apply, `?`/`[...]` wildcards, a listing piped into a
delete) and TK-A032 among the patterns the speed test exempts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* eval: refresh E17 and E21 results for the TK-A031, TK-A032 and TK-A033 changes

Policy hashes only; every count is unchanged. E21's machine and latency values are kept from the last recorded run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* Release 1.4.2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* Policy: TK-A001 reads a platform mutation written over several lines; TK-A031 reads s3cmd's options before its verb and wildcard deletes; TK-A034 reads an argv0 path and node's options; evals refreshed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* Docs: limits name the Codex launch forms TK-A034 doesn't read; s3cmd single deletes aren't flagged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

* Test: a deeply nested payload never lets a denied command run, whether or not Python can read it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ATcivvA21pgXCHLNCcYrLG
Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>

---------

Signed-off-by: LoopGlitch26 <53336715+LoopGlitch26@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>