fix(caprock): decode smallcaps ! escape in vat provision responses

@endo/marshal smallcaps encoding prefixes strings starting with sigil
characters (like `-` for negative floats) with `!`. Shell flags such as
`--oneline` or `-l` were rendered as `!--oneline` and `!-l` in the TUI
because vatFindMatch decoded only the outer CapData wrapper, leaving
nested strings un-unescaped.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: grypez

packages/caprock/bin/hook.ts

@@ -36,6 +36,7 @@ import {
   pingDaemon,
   sendCommand,
   decodeCapData,
+  decodeSmallcapsStrings,
   createKernelSession,
   authorizeRequest,
   recordProvisioned,
@@ -285,7 +286,8 @@ async function vatFindMatch(
   if (isJsonRpcFailure(response)) {
     return null;
   }
-  return decodeCapData(response.result as CapData) as Provision | null;
+  const raw = decodeCapData(response.result as CapData);
+  return decodeSmallcapsStrings(raw) as Provision | null;
 }
 
 /**

packages/caprock/src/rpc.ts

@@ -311,3 +311,31 @@ export function decodeCapData(capData: CapData): unknown {
   }
   throw new Error(`Unexpected CapData body format: ${body.slice(0, 40)}`);
 }
+
+/**
+ * Recursively strip the smallcaps `!` escape prefix from string values in a
+ * decoded CapData object. In smallcaps encoding, strings that begin with a
+ * sigil character (including `-` for negative special floats) are prefixed
+ * with `!` to distinguish them from encoding markers. This reversal is needed
+ * when decoding complex objects like Provision (whose argv may contain flags
+ * like `--oneline` that become `!--oneline` after encoding).
+ *
+ * @param value - A JSON-parsed smallcaps value.
+ * @returns The value with all `!`-escaped strings decoded.
+ */
+export function decodeSmallcapsStrings(value: unknown): unknown {
+  if (typeof value === 'string') {
+    return value.startsWith('!') ? value.slice(1) : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(decodeSmallcapsStrings);
+  }
+  if (typeof value === 'object' && value !== null) {
+    const result: Record<string, unknown> = {};
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+      result[key] = decodeSmallcapsStrings(val);
+    }
+    return result;
+  }
+  return value;
+}