fix(attach): word-split multi-token --dangerous flags so omp gets --approval-mode yolo as two args

README.md

@@ -112,7 +112,7 @@ tmux attach -t my-agent
 | `--rationguard` | Start rationguard watcher alongside pluk (requires `rationguard` on `PATH` — `npm install -g @hivecommons/rationguard` — or `--rationguard-bin`; pluk never fetches it from the registry implicitly) |
 | `--rationguard-bin=<cmd>` | Explicit rationguard command to run instead of the one on `PATH`, e.g. `--rationguard-bin='npx --yes @hivecommons/rationguard@0.11.0'` (also `PLUK_RATIONGUARD_BIN`) |
 | `--rebuttal=send` | Auto-send rebuttals when rationguard detects excuses |
-| `--dangerous` | Skip CLI permission prompts (`--dangerously-skip-permissions` for claude, `--full-auto` for codex, `--non-interactive` for goose) |
+| `--dangerous` | Skip CLI permission prompts (`--dangerously-skip-permissions` for claude, `--full-auto` for codex, `--non-interactive` for goose, `--approval-mode yolo` for omp) |
 | `--dir=/path` | Working directory for the agent |
 | `--cli-args="..."` | Extra arguments to pass to the CLI |
 | `--no-open` | Don't open a terminal window |

changelog.d/fixed-omp-dangerous-flag.md

@@ -0,0 +1 @@
+- `pluk attach --cli=omp --dangerous` now passes `--approval-mode yolo` as two arguments; previously omp received a single `--approval-mode yolo` token and the flag had no effect.

src/attach.ts

@@ -295,7 +295,9 @@ export function attach(opts: AttachOptions): void {
     if (opts.dangerouslySkipPermissions) {
       const dangerFlag = resolveDangerousFlag(cli);
       if (dangerFlag) {
-        fullCmd += ` ${shellQuote(dangerFlag)}`;
+        // Word-split: some flags are two tokens (omp's `--approval-mode yolo`),
+        // and a single shellQuote() would hand the CLI one argv entry.
+        fullCmd += ` ${splitShellWords(dangerFlag).map(shellQuote).join(' ')}`;
       } else {
         log(`no dangerous/auto flag known for cli=${cli}, skipping`);
       }

test/cli.test.js

@@ -255,6 +255,17 @@ test('attach --dangerous appends the per-CLI danger flag to the start command',
   assert.match(calls, /^send-keys -t =agent-y: -- 'claude' '--dangerously-skip-permissions' Enter$/m);
 });
 
+test('attach --dangerous word-splits a multi-token danger flag (omp)', () => {
+  rmSync(tmuxLog, { force: true });
+  const runDir = makeRunDir();
+  const { code } = runCli([
+    'attach', 'agent-omp', '--cli=omp', `--run-dir=${runDir}`, '--no-open', '--dangerous',
+  ]);
+  assert.equal(code, 0);
+  const calls = readFileSync(tmuxLog, 'utf-8');
+  assert.match(calls, /^send-keys -t =agent-omp: -- 'omp' '--approval-mode' 'yolo' Enter$/m);
+});
+
 // --- watch over stdin -------------------------------------------------------------
 
 test('watch classifies stdin lines and emits JSONL events', () => {