@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/tool-error-envelope.js

@@ -7,6 +7,10 @@
  * "this operation has no local-backend equivalent" refusal, which the ticket
  * routes return as HTTP 409 with `detail.error = "UNSUPPORTED_IN_LOCAL_MODE"`.
  *
+ * BAPI-1382 adds a second trusted pair: the plan-entitlement denial, which the
+ * server returns as HTTP 403 with `detail.error = "ENTITLEMENT_REQUIRED"`. It
+ * tells a plan limit apart from a bad credential, which is also a 403.
+ *
  * Recognition is by the exact `(error, status)` PAIR — never by message text.
  * Message text is prose that gets reworded; matching on it would make a copy
  * edit silently change orchestration control flow.
@@ -18,6 +22,54 @@
 export const UNSUPPORTED_IN_LOCAL_MODE_ERROR = "UNSUPPORTED_IN_LOCAL_MODE";
 /** The HTTP status that marker is only ever valid with. */
 export const UNSUPPORTED_IN_LOCAL_MODE_STATUS = 409;
+/** The plan-entitlement marker (BAPI-1382): the account's plan lacks a feature. */
+export const ENTITLEMENT_REQUIRED_ERROR = "ENTITLEMENT_REQUIRED";
+/** The HTTP status that marker is only ever valid with. */
+export const ENTITLEMENT_REQUIRED_STATUS = 403;
+/**
+ * The request-time too-little-ticket-detail refusal (BAPI-1382): the generate
+ * routes answer HTTP 422 with `detail.error = "INSUFFICIENT_TICKET_DETAIL"`
+ * plus the measured length, threshold, and description source.
+ */
+export const INSUFFICIENT_TICKET_DETAIL_ERROR = "INSUFFICIENT_TICKET_DETAIL";
+/** The HTTP status that marker is only ever valid with. */
+export const INSUFFICIENT_TICKET_DETAIL_STATUS = 422;
+/**
+ * The server `(error, status)` pairs the MCP relay keeps as received. Every
+ * other server-provided `error` is replaced by the relay's own status-derived
+ * code, so an arbitrary detail object can never forge a code.
+ */
+export const TRUSTED_UPSTREAM_ERROR_PAIRS = [
+    [UNSUPPORTED_IN_LOCAL_MODE_ERROR, UNSUPPORTED_IN_LOCAL_MODE_STATUS],
+    [ENTITLEMENT_REQUIRED_ERROR, ENTITLEMENT_REQUIRED_STATUS],
+    [INSUFFICIENT_TICKET_DETAIL_ERROR, INSUFFICIENT_TICKET_DETAIL_STATUS],
+];
+/** True only for an exact trusted `(error, status)` pair. */
+export function isTrustedUpstreamErrorPair(error, status) {
+    return TRUSTED_UPSTREAM_ERROR_PAIRS.some(([code, code_status]) => error === code && status === code_status);
+}
+/**
+ * Add the typed `operation` to a serialized error envelope (BAPI-1382). A text
+ * that is not an envelope is wrapped into one with the given status, so a
+ * refused request is always parseable and never a prose-prefixed string.
+ */
+export function withRequestOperation(envelopeText, operation, status) {
+    let parsed = null;
+    try {
+        parsed = JSON.parse(envelopeText);
+    }
+    catch {
+        parsed = null;
+    }
+    if (parsed !== null &&
+        typeof parsed === "object" &&
+        !Array.isArray(parsed) &&
+        typeof parsed.error === "string" &&
+        typeof parsed.status === "number") {
+        return JSON.stringify({ ...parsed, operation });
+    }
+    return JSON.stringify({ error: "UNKNOWN_ERROR", status, message: envelopeText, operation });
+}
 /**
  * Parse `text` as a tool-error envelope, or return `null`.
  *
@@ -52,8 +104,17 @@ export function parseToolErrorEnvelope(text) {
     if (Array.isArray(obj.unsupported_fields)) {
         envelope.unsupported_fields = obj.unsupported_fields.filter((v) => typeof v === "string");
     }
+    if (typeof obj.operation === "string") {
+        envelope.operation = obj.operation;
+    }
     return envelope;
 }
+/** True for the exact plan-entitlement contract: the marker AND HTTP 403. */
+export function isEntitlementRequiredEnvelope(envelope) {
+    return (envelope !== null &&
+        envelope.error === ENTITLEMENT_REQUIRED_ERROR &&
+        envelope.status === ENTITLEMENT_REQUIRED_STATUS);
+}
 /** True for the exact unsupported-local contract: the marker AND HTTP 409. */
 export function isUnsupportedInLocalModeEnvelope(envelope) {
     return (envelope !== null &&

package/build/upgrade-cli.js

@@ -42,26 +42,85 @@ import { fetchLatestVersion } from "./cli-release.js";
 import { CANONICAL_UPGRADE_COMMAND } from "./upgrade-advice.js";
 import { describeLauncherReason, inspectLauncherConfigs, isApplicableStandardLauncher, isPrerequisiteFailure, LAUNCHER_CONFIG_TARGETS, } from "./launcher-config-inspection.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
+import { defaultNpmEntryFileExists, resolveNpmEntry } from "./windows-npm-entry.js";
 /** The sentinel this CLI passes to the child it re-execs from `@latest`. */
 const INTERNAL_REEXEC_FLAG = "--internal-reexec";
-// ---------------------------------------------------------------------------
-// Default dependency construction
-// ---------------------------------------------------------------------------
-function defaultReexec(cwd, oldVersion) {
-    const npxCmd = process.platform === "win32" ? "npx.cmd" : "npx";
+/**
+ * The fixed, secret-free message printed when, on Windows, the latest CLI could
+ * not be STARTED. Upgrade stops here rather than continuing with the local copy.
+ */
+export const UPGRADE_REEXEC_START_FAILURE_MESSAGE = "Bridge API upgrade failed: could not start the latest version of the CLI. " +
+    `Nothing was changed. Run ${CANONICAL_UPGRADE_COMMAND} to run the latest copy directly.`;
+export function defaultReexec(cwd, oldVersion, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const doSpawn = options.spawn ?? spawn;
+    const errorLog = options.errorLog ?? ((message) => console.error(message));
+    const reexecArgs = [
+        "-y",
+        `${MCP_PACKAGE_NAME}@latest`,
+        "upgrade",
+        INTERNAL_REEXEC_FLAG,
+        "--old-version",
+        oldVersion,
+    ];
+    if (platform !== "win32") {
+        return new Promise((resolve) => {
+            const child = doSpawn("npx", reexecArgs, { stdio: "inherit", cwd });
+            child.on("close", (code) => resolve(code ?? 0));
+            child.on("error", (err) => {
+                errorLog(`Bridge API upgrade failed: could not re-exec npx: ${err.message}`);
+                resolve(1);
+            });
+        });
+    }
+    // WINDOWS (BAPI-1319): run npm's `npx-cli.js` through Node, never `npx.cmd`
+    // (EINVAL without a shell since CVE-2024-27980). A launch that fails before the
+    // child starts STOPS the upgrade with a fixed message — it never continues with
+    // the local copy, and a sync throw can no longer escape as an unhandled rejection.
+    const resolved = resolveNpmEntry("npx", reexecArgs, {
+        platform,
+        env: options.env ?? process.env,
+        execPath: options.execPath ?? process.execPath,
+        fileExists: options.fileExists ?? defaultNpmEntryFileExists,
+    });
+    if (resolved.status !== "resolved") {
+        errorLog(UPGRADE_REEXEC_START_FAILURE_MESSAGE);
+        return Promise.resolve(1);
+    }
     return new Promise((resolve) => {
-        const child = spawn(npxCmd, [
-            "-y",
-            `${MCP_PACKAGE_NAME}@latest`,
-            "upgrade",
-            INTERNAL_REEXEC_FLAG,
-            "--old-version",
-            oldVersion,
-        ], { stdio: "inherit", cwd });
-        child.on("close", (code) => resolve(code ?? 0));
+        let settled = false;
+        let started = false;
+        const settle = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(code);
+        };
+        const failToStart = () => {
+            if (settled)
+                return;
+            errorLog(UPGRADE_REEXEC_START_FAILURE_MESSAGE);
+            settle(1);
+        };
+        let child;
+        try {
+            child = doSpawn(resolved.command, resolved.args, { shell: false, stdio: "inherit", cwd });
+        }
+        catch {
+            failToStart();
+            return;
+        }
+        child.on("spawn", () => {
+            started = true;
+        });
+        child.on("close", (code) => settle(code ?? 0));
         child.on("error", (err) => {
-            console.error(`Bridge API upgrade failed: could not re-exec npx: ${err.message}`);
-            resolve(1);
+            if (!started) {
+                failToStart();
+                return;
+            }
+            errorLog(`Bridge API upgrade failed: could not re-exec npx: ${err.message}`);
+            settle(1);
         });
     });
 }
@@ -77,13 +136,39 @@ async function defaultHasCompetingLocalInstall(cwd) {
         return false;
     }
 }
-function defaultRemoveCompetingLocalInstall(cwd) {
-    const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
-    return new Promise((resolve) => {
-        const child = spawn(npmCmd, ["uninstall", MCP_PACKAGE_NAME], {
-            stdio: "inherit",
-            cwd,
+export function defaultRemoveCompetingLocalInstall(cwd, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const doSpawn = options.spawn ?? spawn;
+    const removeArgs = ["uninstall", MCP_PACKAGE_NAME];
+    if (platform !== "win32") {
+        return new Promise((resolve) => {
+            const child = doSpawn("npm", removeArgs, {
+                stdio: "inherit",
+                cwd,
+            });
+            child.on("close", (code) => resolve(code === 0));
+            child.on("error", () => resolve(false));
         });
+    }
+    // WINDOWS (BAPI-1319): `npm-cli.js` through Node. Every launch failure resolves
+    // false, which reaches the caller's existing "could not remove" message.
+    const resolved = resolveNpmEntry("npm", removeArgs, {
+        platform,
+        env: options.env ?? process.env,
+        execPath: options.execPath ?? process.execPath,
+        fileExists: options.fileExists ?? defaultNpmEntryFileExists,
+    });
+    if (resolved.status !== "resolved")
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = doSpawn(resolved.command, resolved.args, { shell: false, stdio: "inherit", cwd });
+        }
+        catch {
+            resolve(false);
+            return;
+        }
         child.on("close", (code) => resolve(code === 0));
         child.on("error", () => resolve(false));
     });
@@ -95,9 +180,9 @@ export function createDefaultUpgradeCliDeps(cwd) {
         fetchLatestVersion,
         readFile: (filePath) => readFile(filePath, "utf-8"),
         hasCompetingLocalInstall: defaultHasCompetingLocalInstall,
-        removeCompetingLocalInstall: defaultRemoveCompetingLocalInstall,
+        removeCompetingLocalInstall: (installCwd) => defaultRemoveCompetingLocalInstall(installCwd),
         runInit,
-        reexecFromLatest: defaultReexec,
+        reexecFromLatest: (reexecCwd, oldVersion) => defaultReexec(reexecCwd, oldVersion),
         stdout: (m) => console.log(m),
         stderr: (m) => console.error(m),
         env: process.env,

package/build/version.generated.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.65";
-export const BUILD_COMMIT = "a6ee899f43d8";
-export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.65", "serve"];
+export const VERSION = "0.2.67";
+export const BUILD_COMMIT = "8eb6ba563e5f";
+export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.67", "serve"];

package/build/visual-diff.js

@@ -18,6 +18,7 @@
  * mismatch budget (never 0%, which AA/font rendering makes unreachable).
  */
 import path from "path";
+import { createRequire } from "module";
 import { Worker } from "worker_threads";
 import { computePngVisualDiff, DEFAULT_PASS_MISMATCH_PCT, PIXELMATCH_COLOR_THRESHOLD, } from "./visual-diff-worker.js";
 // ---------------------------------------------------------------------------
@@ -247,6 +248,26 @@ export async function loadPlaywright() {
         return { ok: false };
     }
 }
+/**
+ * The Chromium install command matching the bundled `playwright-core`.
+ *
+ * A bare `npx playwright install chromium` fetches whatever Playwright is
+ * newest, whose browser build may not match the one this server drives.
+ * Resolution is best-effort: any failure returns the historic unversioned
+ * command rather than throwing, since this only builds a hint.
+ */
+export function chromiumInstallCommand(readMetadata = () => createRequire(import.meta.url)("playwright-core/package.json")) {
+    try {
+        const version = readMetadata()?.version;
+        if (typeof version === "string" && version.length > 0) {
+            return `npx playwright@${version} install chromium`;
+        }
+    }
+    catch {
+        // Not resolvable: fall through to the unversioned command.
+    }
+    return "npx playwright install chromium";
+}
 export async function launchBrowser(playwright) {
     try {
         const browser = await playwright.chromium.launch({ headless: true });
@@ -258,7 +279,7 @@ export async function launchBrowser(playwright) {
             ok: false,
             error: "BROWSER_UNAVAILABLE",
             status: 503,
-            message: `Chromium could not be launched: ${err instanceof Error ? err.message : "unknown error"}. Run "npx playwright install chromium".`,
+            message: `Chromium could not be launched: ${err instanceof Error ? err.message : "unknown error"}. Run "${chromiumInstallCommand()}".`,
         };
     }
 }

package/build/windows-npm-entry.js

@@ -0,0 +1,103 @@
+/**
+ * Windows `npx` / `npm` entry resolution (BAPI-1319).
+ *
+ * WHY THIS EXISTS. Since Node's April 2024 security releases (CVE-2024-27980),
+ * `child_process.spawn` throws `EINVAL` when handed a `.cmd` or `.bat` file
+ * without the `shell` option, and a bare `"npx"` is `ENOENT` on Windows because
+ * the real launcher is `npx.cmd`. `shell: true` is not an option: the install
+ * re-exec argv carries user input. So on `win32` this module skips the shim and
+ * runs npm's own JavaScript entry point (`npx-cli.js` / `npm-cli.js`) through
+ * the running Node executable, with no shell at all.
+ *
+ * LOOKUP ORDER MIRRORS THE SHELL. The first `npx.cmd` (or `npm.cmd`) on PATH
+ * wins, and its sibling `node_modules/npm/bin/<cli>.js` is the entry point. If
+ * that first shim has no sibling CLI the result is `unresolved` — a later PATH
+ * candidate is never tried, because that is not the npx the user's shell would
+ * run, and the test harnesses that put a fake `npx.cmd` first on PATH must still
+ * catch the call. Only when no shim is on PATH at all does the resolver fall
+ * back to the npm bundled beside `execPath`.
+ *
+ * On every platform other than `win32` the input is returned unchanged, so
+ * macOS and Linux spawn exactly what they spawned before this module existed.
+ *
+ * The resolver never throws and never carries exception text: every failure is
+ * the typed `unresolved` result.
+ */
+import { statSync } from "fs";
+import path from "path";
+const DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+const CLI_FILE = {
+    npx: "npx-cli.js",
+    npm: "npm-cli.js",
+};
+/** Production `fileExists`: a regular file, never a throw. */
+export function defaultNpmEntryFileExists(filePath) {
+    try {
+        return statSync(filePath).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** Case-insensitive env read, as Windows environments are. */
+function _readEnvCaseInsensitive(env, name) {
+    const target = name.toUpperCase();
+    for (const key of Object.keys(env)) {
+        if (key.toUpperCase() === target) {
+            const value = env[key];
+            if (value === undefined)
+                continue;
+            if (typeof value !== "string")
+                throw new TypeError("malformed environment value");
+            return value;
+        }
+    }
+    return undefined;
+}
+/** Find the first shim on PATH, or null when none exists. */
+function _findFirstShim(command, env, fileExists) {
+    const rawPath = _readEnvCaseInsensitive(env, "PATH") ?? "";
+    const rawPathExt = _readEnvCaseInsensitive(env, "PATHEXT");
+    const pathExt = rawPathExt && rawPathExt.trim().length > 0 ? rawPathExt : DEFAULT_PATHEXT;
+    // Only the `.cmd` shim is the launcher npm installs beside its CLI. PATHEXT is
+    // matched case-insensitively and its own spelling is used for the lookup.
+    const cmdExt = pathExt
+        .split(";")
+        .map((ext) => ext.trim())
+        .find((ext) => ext.toLowerCase() === ".cmd");
+    if (!cmdExt)
+        return null;
+    for (const segment of rawPath.split(";")) {
+        const dir = segment.trim();
+        if (dir.length === 0)
+            continue;
+        const candidate = path.win32.join(dir, `${command}${cmdExt}`);
+        if (fileExists(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Map `npx`/`npm` plus args to a spawnable `{ command, args }`.
+ *
+ * Non-`win32`: `{ command, args }` unchanged. `win32`: `{ command: execPath,
+ * args: [<cliPath>, ...args] }`, or `unresolved`.
+ */
+export function resolveNpmEntry(command, args, options) {
+    if (options.platform !== "win32") {
+        return { status: "resolved", command, args };
+    }
+    try {
+        const cliFile = CLI_FILE[command];
+        const shim = _findFirstShim(command, options.env, options.fileExists);
+        const cliPath = shim
+            ? path.win32.join(path.win32.dirname(shim), "node_modules", "npm", "bin", cliFile)
+            : path.win32.join(path.win32.dirname(options.execPath), "node_modules", "npm", "bin", cliFile);
+        if (!options.fileExists(cliPath))
+            return { status: "unresolved" };
+        return { status: "resolved", command: options.execPath, args: [cliPath, ...args] };
+    }
+    catch {
+        return { status: "unresolved" };
+    }
+}

package/build/worker-guard-hook-bin.js

@@ -1,6 +1,4 @@
 #!/usr/bin/env node
-import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family){return category==="git-ambiguous"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This shell form cannot be safely resolved: substitution, redirection, or stdin-fed arguments hide what git will run. Use literal arguments instead; for a commit message, write it to a file and run git commit -F <file>.`:`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
-`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.length<=1?{kind:"allow"}:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeGitCategory(argv){let{subcommand}=parseGitInvocation(argv,void 0);return subcommand==="push"?"git-push":subcommand==="reset"?"git-reset-hard":subcommand==="clean"?"filesystem-clean":"git-ambiguous"}function unsafeSegmentDecision(family,argv){switch(family){case"git":return{kind:"deny",category:unsafeGitCategory(argv),family:"git"};case"rm":return{kind:"deny",category:"filesystem-remove",family:"rm"};case"database":return{kind:"deny",category:"database-destructive",family:"psql"};case"network":return{kind:"deny",category:"network-mutating",family:"curl"}}}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){for(let nested of tokenizeShellCommand(inner)){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){for(let nested of tokenizeShellCommand(argv.slice(1).join(" "))){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0)}segment={argv,unsafe:segment.unsafe};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family,segment.argv);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?{kind:"deny",category:"git-push",family:"git"}:evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?{kind:"deny",category:"git-reset-hard",family:"git"}:evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?{kind:"deny",category:"filesystem-clean",family:"git"}:evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function evaluateWorkerGuardPayload(payload,ctx){let root=asRecord(payload);if(root===void 0)return{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return{kind:"malformed"};if(toolName!=="Bash")return{kind:"allow"};let input=asRecord(root.tool_input??root.toolInput);if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0;for(let segment of tokenizeShellCommand(command)){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){if(typeof raw!="string")return{kind:"malformed"};if(raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES)return{kind:"malformed"};if(raw.trim().length===0)return{kind:"malformed"};let parsed;try{parsed=JSON.parse(raw)}catch{return{kind:"malformed"}}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return{kind:"malformed"}}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;return typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim()),ctx}function readStdinSync(){return readFileSync(0,"utf-8")}var exitCode=0;try{let raw=readStdinSync(),ctx=resolveWorkerGuardContext(process.env,process.cwd(),process.argv.slice(2)),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(process.stderr.write(`${renderWorkerGuardReason(decision.category,decision.family)}
-`),exitCode=2):decision.kind==="malformed"&&(process.stderr.write(`${WORKER_GUARD_MALFORMED_LINE}
-`),exitCode=0)}catch{try{process.stderr.write(`${WORKER_GUARD_MALFORMED_LINE}
-`)}catch{}exitCode=0}process.exit(exitCode);
+import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family){return category==="git-ambiguous"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This shell form cannot be safely resolved: substitution, redirection, or stdin-fed arguments hide what git will run. Use literal arguments instead; for a commit message, write it to a file and run git commit -F <file>.`:category==="workflow-entry"||category==="workflow-launch-skill"||category==="workflow-launch-shell"||category==="workflow-planner-tool"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). A correction worker must not start a full workflow. Reading or editing files that mention a workflow is allowed; make the focused correction directly.`:category==="correction-context-invalid"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). The correction context for this worker is not valid, so no tool call can be checked. Stop and report the launch problem.`:category==="correction-payload-invalid"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). The tool call could not be read as a tool name with a tool input, so it cannot be checked. Retry with a well-formed call.`:`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
+`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.length<=1?{kind:"allow"}:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeGitCategory(argv){let{subcommand}=parseGitInvocation(argv,void 0);return subcommand==="push"?"git-push":subcommand==="reset"?"git-reset-hard":subcommand==="clean"?"filesystem-clean":"git-ambiguous"}function unsafeSegmentDecision(family,argv){switch(family){case"git":return{kind:"deny",category:unsafeGitCategory(argv),family:"git"};case"rm":return{kind:"deny",category:"filesystem-remove",family:"rm"};case"database":return{kind:"deny",category:"database-destructive",family:"psql"};case"network":return{kind:"deny",category:"network-mutating",family:"curl"}}}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}var WORKFLOW_NAMES="implement-ticket|plan-ticket|idea-to-pr|review-and-implement",WORKFLOW_SLASH_LAUNCH=new RegExp(`(?:^|\\s)/(?:bridge-)?(?:${WORKFLOW_NAMES})(?=\\s|$)`,"i"),WORKFLOW_NAME_EXACT=new RegExp(`^/?(?:[A-Za-z0-9_-]+:)?(?:bridge-)?(?:${WORKFLOW_NAMES})$`,"i"),CLAUDE_PACKAGE_TOKEN=/^(?:@anthropic-ai\/)?claude(?:-code)?(?:@\S+)?$/;function claudeLaunchArgs(argv){let base=path.basename(argv[0]??"");if(base==="claude")return argv.slice(1);if(base==="npx"){let index=argv.findIndex((token,i)=>i>0&&CLAUDE_PACKAGE_TOKEN.test(token));return index===-1?void 0:argv.slice(index+1)}}function isClaudeWorkflowPrintLaunch(segment){let args=claudeLaunchArgs(segment.argv);return args===void 0||!args.some(token=>token==="-p"||token==="--print"||token.startsWith("--print="))?!1:segment.unsafe?!0:args.some(token=>{let value=token.startsWith("--print=")?token.slice(8):token;return WORKFLOW_SLASH_LAUNCH.test(value)})}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){for(let nested of tokenizeShellCommand(inner)){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){for(let nested of tokenizeShellCommand(argv.slice(1).join(" "))){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0)}if(segment={argv,unsafe:segment.unsafe},ctx.correctionEnforced&&isClaudeWorkflowPrintLaunch(segment))return{kind:"deny",category:"workflow-launch-shell",family:"workflow"};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family,segment.argv);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?{kind:"deny",category:"git-push",family:"git"}:evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?{kind:"deny",category:"git-reset-hard",family:"git"}:evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?{kind:"deny",category:"filesystem-clean",family:"git"}:evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function workflowDeny(category){return{kind:"deny",category,family:"workflow"}}var FILE_TOOLS=new Set(["Read","Edit","Write","MultiEdit","NotebookEdit","Grep","Glob"]),INVOCATION_FIELDS={Skill:["skill","args"],Task:["prompt","description"],Agent:["prompt","description"],SlashCommand:["command"]},PLANNER_TOOL_NAME=/(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;function evaluateCorrectionToolRole(toolName,input){if(FILE_TOOLS.has(toolName))return{kind:"allow"};if(toolName==="Bash")return;let fields=INVOCATION_FIELDS[toolName];if(fields!==void 0){for(let field of fields){let value=input[field];if(value===void 0)continue;if(typeof value!="string")return workflowDeny("workflow-launch-skill");let nameField=toolName==="Skill"?field==="skill":toolName==="SlashCommand";if(WORKFLOW_SLASH_LAUNCH.test(value)||nameField&&WORKFLOW_NAME_EXACT.test(value.trim().split(/\s+/)[0]??""))return workflowDeny("workflow-launch-skill")}return{kind:"allow"}}if(/^mcp__/i.test(toolName)&&PLANNER_TOOL_NAME.test(toolName))return workflowDeny("workflow-planner-tool");let args=Object.values(input).filter(v=>typeof v=="string").join(" ");return WORKFLOW_SLASH_LAUNCH.test(args)?workflowDeny("workflow-entry"):void 0}function evaluateWorkerGuardPayload(payload,ctx){if(ctx.correctionContextInvalid)return workflowDeny("correction-context-invalid");let root=asRecord(payload);if(root===void 0)return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let input=asRecord(root.tool_input??root.toolInput);if(ctx.correctionEnforced){if(input===void 0)return workflowDeny("correction-payload-invalid");let decision=evaluateCorrectionToolRole(toolName,input);if(decision!==void 0)return decision}if(toolName!=="Bash")return{kind:"allow"};if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0;for(let segment of tokenizeShellCommand(command)){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){let unreadable=()=>ctx.correctionContextInvalid?workflowDeny("correction-context-invalid"):ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};if(typeof raw!="string"||raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES||raw.trim().length===0)return unreadable();let parsed;try{parsed=JSON.parse(raw)}catch{return unreadable()}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return unreadable()}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim());let flagIndex=argv.indexOf("--correction-intent-version"),flagValue=flagIndex>=0?argv[flagIndex+1]:void 0,envValue=env.BAPI_CORRECTION_INTENT_VERSION;return ctx.correctionEnforced=flagValue==="1"||envValue==="1",ctx.correctionContextInvalid=flagIndex>=0&&flagValue!=="1"||envValue!==void 0&&envValue!=="1"||flagIndex>=0&&envValue!==void 0&&envValue!==flagValue,ctx}function runWorkerGuardHook(io){let exitCode=0,correctionRequested=io.argv.includes("--correction-intent-version")||io.env.BAPI_CORRECTION_INTENT_VERSION!==void 0;try{let raw=io.readStdin(),ctx=resolveWorkerGuardContext(io.env,io.cwd,io.argv),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(io.writeStderr(renderWorkerGuardReason(decision.category,decision.family)),exitCode=2):decision.kind==="malformed"&&(io.writeStderr(WORKER_GUARD_MALFORMED_LINE),exitCode=0)}catch{try{io.writeStderr(correctionRequested?renderWorkerGuardReason("correction-payload-invalid","workflow"):WORKER_GUARD_MALFORMED_LINE)}catch{}exitCode=correctionRequested?2:0}return exitCode}function readStdinSync(){return readFileSync(0,"utf-8")}process.exit(runWorkerGuardHook({readStdin:readStdinSync,env:process.env,cwd:process.cwd(),argv:process.argv.slice(2),writeStderr:text=>{process.stderr.write(`${text}
+`)}}));

package/build/worker-guard-hook-main.js

@@ -0,0 +1,47 @@
+/**
+ * The worker-guard hook's whole decision-to-exit-code path, with its process
+ * boundaries injected (BAPI-1386).
+ *
+ * `worker-guard-hook-bin.ts` is the packaged entry point and calls `process.exit`,
+ * so a test cannot import it. This module holds everything that bin does, taking
+ * stdin, the environment, the working directory, argv, and stderr as parameters.
+ * The bin's behavior is unchanged: see its header for the exit-code contract.
+ *
+ * NOTHING is written to stdout: Claude Code reads a hook's stdout as structured
+ * control output.
+ */
+import { WORKER_GUARD_MALFORMED_LINE, evaluateWorkerGuardInput, renderWorkerGuardReason, resolveWorkerGuardContext, } from "./executor/worker-guard-hook.js";
+/** Run the hook once and return the exit code the process should use. */
+export function runWorkerGuardHook(io) {
+    let exitCode = 0;
+    const correctionRequested = io.argv.includes("--correction-intent-version") || io.env.BAPI_CORRECTION_INTENT_VERSION !== undefined;
+    try {
+        const raw = io.readStdin();
+        const ctx = resolveWorkerGuardContext(io.env, io.cwd, io.argv);
+        const decision = evaluateWorkerGuardInput(raw, ctx);
+        if (decision.kind === "deny") {
+            io.writeStderr(renderWorkerGuardReason(decision.category, decision.family));
+            exitCode = 2;
+        }
+        else if (decision.kind === "malformed") {
+            io.writeStderr(WORKER_GUARD_MALFORMED_LINE);
+            exitCode = 0;
+        }
+    }
+    catch {
+        // Defensive top-level boundary. An unreadable stdin, an OOM on a pathological
+        // payload, anything at all: it becomes ONE fixed line, never raw exception text
+        // — an exception message can carry a path or an environment value and this line
+        // travels into worker logs.
+        try {
+            io.writeStderr(correctionRequested
+                ? renderWorkerGuardReason("correction-payload-invalid", "workflow")
+                : WORKER_GUARD_MALFORMED_LINE);
+        }
+        catch {
+            // stderr itself is unavailable; there is nothing further to report.
+        }
+        exitCode = correctionRequested ? 2 : 0;
+    }
+    return exitCode;
+}